From 3b3d22d0ce3fb3ba0b95d60ca6ae43b1e798148f Mon Sep 17 00:00:00 2001 From: archipelago Date: Fri, 31 Jul 2026 05:40:18 -0400 Subject: [PATCH] =?UTF-8?q?fix(botfights):=201.2.2=20=E2=80=94=20allow=20n?= =?UTF-8?q?ode-dashboard=20iframe=20embedding=20via=20ARCHY=5FEMBEDDED=3D1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1.2.x's auth-hardening work added Hono secureHeaders() with a default X-Frame-Options: SAMEORIGIN, which unconditionally blocked the Archipelago node dashboard's iframe (different origin by port) — a real regression versus 1.1.0, which never sent this header. Fixed upstream in the botfight repo (commit 8eb27ed): X-Frame-Options is now conditional on ARCHY_EMBEDDED, disabled only for the first-party node-embedded instance. apps/botfights/manifest.yml: image/version -> 1.2.2, adds ARCHY_EMBEDDED=1 to environment, drops the interim metadata.launch.open_in_new_tab workaround (no longer needed — the app can now be framed). app-catalog/catalog.json, scripts/image-versions.sh, neode-ui/public/catalog.json bumped in lockstep via scripts/generate-app-catalog.py. core/archipelago/src/fips/app_ports.rs regenerated (formatting only, same port set). Co-Authored-By: Claude Fable 5 --- app-catalog/catalog.json | 4 +-- apps/botfights/manifest.yml | 9 ++++-- core/archipelago/src/fips/app_ports.rs | 38 ++++++++++++++++++++++++-- neode-ui/public/catalog.json | 4 +-- scripts/image-versions.sh | 2 +- 5 files changed, 47 insertions(+), 10 deletions(-) diff --git a/app-catalog/catalog.json b/app-catalog/catalog.json index 610fabac..b11db51f 100644 --- a/app-catalog/catalog.json +++ b/app-catalog/catalog.json @@ -109,12 +109,12 @@ { "id": "botfights", "title": "BotFights", - "version": "1.2.1", + "version": "1.2.2", "description": "Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.", "icon": "/assets/img/app-icons/botfights.svg", "author": "BotFights", "category": "community", - "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.1", + "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.2", "repoUrl": "https://botfights.net", "containerConfig": { "ports": [ diff --git a/apps/botfights/manifest.yml b/apps/botfights/manifest.yml index 0f22ad5e..bf245ab8 100644 --- a/apps/botfights/manifest.yml +++ b/apps/botfights/manifest.yml @@ -1,12 +1,12 @@ app: id: botfights name: BotFights - version: 1.2.1 + version: 1.2.2 description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners. category: community container: - image: 146.59.87.168:3000/lfg2025/botfights:1.2.1 + image: 146.59.87.168:3000/lfg2025/botfights:1.2.2 pull_policy: always # Auto-generated on first install (random hex, 0600, rootless-owned). The # 1.2.x image's server/src/middleware/jwt.ts throws at module import when @@ -60,6 +60,11 @@ app: # without this var set), and an operator can remove this line entirely to # run a fully standalone, node-local arena instead. - ARENA_UPSTREAM_URL=https://botfights.archipelago-foundation.org + # Tells the app it is embedded (first-party) in the node dashboard's + # iframe, so it can safely disable X-Frame-Options: SAMEORIGIN — see + # server/src/app.ts in the botfight repo. Without this the 1.2.x image's + # default security headers block the dashboard iframe entirely. + - ARCHY_EMBEDDED=1 health_check: type: http diff --git a/core/archipelago/src/fips/app_ports.rs b/core/archipelago/src/fips/app_ports.rs index 78fb5285..2f8d25e5 100644 --- a/core/archipelago/src/fips/app_ports.rs +++ b/core/archipelago/src/fips/app_ports.rs @@ -6,7 +6,39 @@ //! no listener, so allowing them is inert. pub const APP_LAUNCH_PORTS: &[u16] = &[ - 2283, 2342, 3000, 3001, 3002, 4080, 5180, 7778, 8080, 8081, 8082, 8083, 8084, 8085, 8087, 8088, - 8089, 8090, 8096, 8123, 8175, 8176, 8240, 8334, 8888, 8999, 9000, 9100, 10380, 11434, 18081, - 18083, 23000, 32838, 50002, + 2283, + 2342, + 3000, + 3001, + 3002, + 4080, + 5180, + 7778, + 8080, + 8081, + 8082, + 8083, + 8084, + 8085, + 8087, + 8088, + 8089, + 8090, + 8096, + 8123, + 8175, + 8176, + 8240, + 8334, + 8888, + 8999, + 9000, + 9100, + 10380, + 11434, + 18081, + 18083, + 23000, + 32838, + 50002, ]; diff --git a/neode-ui/public/catalog.json b/neode-ui/public/catalog.json index 145f7cd3..b11db51f 100644 --- a/neode-ui/public/catalog.json +++ b/neode-ui/public/catalog.json @@ -109,12 +109,12 @@ { "id": "botfights", "title": "BotFights", - "version": "1.1.0", + "version": "1.2.2", "description": "Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.", "icon": "/assets/img/app-icons/botfights.svg", "author": "BotFights", "category": "community", - "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.1.0", + "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.2", "repoUrl": "https://botfights.net", "containerConfig": { "ports": [ diff --git a/scripts/image-versions.sh b/scripts/image-versions.sh index cf66d77e..0982b409 100644 --- a/scripts/image-versions.sh +++ b/scripts/image-versions.sh @@ -90,7 +90,7 @@ FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest" ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3" # Community / Gaming -BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.1" +BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.2" # IndeedHub stack INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"