[jherforth]

After #320, Music, Sunrise & Sunset and WeatherGlance broke on hgtest. This fixes both causes.

Causes

The SDK never loaded.

• Some browsers send Origin: null with a sandboxed page's script and style loads. fix(plugins): isolate plugins from HomeGlow and from each other #320's request policy answered every Origin: null request without a token with 403, and that included /plugin-sdk/v1.js. Fetching hgtest's SDK with Origin: null confirms the 403.
• Without window.HomeGlow:
  • Music threw Cannot read properties of undefined (reading 'settings').
  • Sunrise & Sunset couldn't read its saved location, so it showed "No location configured yet".
  • WeatherGlance couldn't read its own location setting either, found none on the display, and asked /api/weather with no location, which answered 404.

Location detection was blocked by permissions policy. A cross-origin frame, here an opaque one, can't ask for the location unless its iframe allows it.

Changes

• A GET or HEAD the policy refuses now goes through, without CORS headers.
  • The page can use the response (run the script, show the image) but can't read it.
  • No GET route changes anything. I audited every one for the fix(plugins): isolate plugins from HomeGlow and from each other #320 review.
  • A fetch the policy refuses (Sec-Fetch-Mode: cors) still gets the readable 403, and writes still need a token and an allowed route.
• Plugin frames, and the Admin preview, carry allow="geolocation". It's scoped to the plugin's own address, and the browser still asks the household first. In Edge, a sandboxed frame is refused without it, and both geolocation and geolocation * work.

Testing

• Edge, forcing Origin: null on the frame's script and style loads, as the affected browser does, with Sunrise & Sunset (a location saved in its settings) and a probe plugin:

  • fix(plugins): isolate plugins from HomeGlow and from each other #320 as merged: 0 of 5 checks pass. It reproduces every symptom: HomeGlow is not defined, "No location configured yet", and the same geolocation permissions-policy error.
  • This branch: the SDK loads, Sunrise & Sunset shows its times, the frame gets the location, and there's no policy violation.

• pluginIsolation.test.js:

  • a new test covers a page's own SDK and stylesheet, with Origin: null and with or without Sec-Fetch-Mode;
  • another plugin's data loaded that way comes back with no CORS headers;
  • a write sent that way is still refused.

  The new test fails on fix(plugins): isolate plugins from HomeGlow and from each other #320's code with the same 403. Its fetch-style requests now send Sec-Fetch-Mode: cors, as browsers do.

• Server npm test (626), client vitest (749) and build all pass.

• On hgtest itself: in a clean sandboxed frame in Edge and in Chrome, all three plugins already work, because those browsers send no Origin on script loads. So the affected browser is a different one. Worth checking which display or browser showed the errors.

🤖 Generated with Claude Code