fix: polyfill crypto.randomUUID for self-hosted HTTP (insecure context) - #257
Open
philippecottier wants to merge 4 commits into
Open
fix: polyfill crypto.randomUUID for self-hosted HTTP (insecure context)#257philippecottier wants to merge 4 commits into
philippecottier wants to merge 4 commits into
Conversation
crypto.randomUUID() is only exposed in secure contexts (HTTPS pages, or http://localhost). A self-hosted instance served over plain HTTP on a LAN address (e.g. http://192.168.1.50:3000) is not a secure context, so crypto.randomUUID is undefined there and the app crashes on startup with "TypeError: crypto.randomUUID is not a function" — it is called from several client components (PromptView, EditorView, TextAreaChat, ...). Add a small polyfill, imported for its side effect at the top of the client entry point, that derives a spec-compliant RFC 4122 v4 UUID from crypto.getRandomValues() when the native method is missing. The native implementation is always preferred, so this is a no-op on HTTPS and on localhost.
|
@philippecottier is attempting to deploy a commit to the Adam Team on Vercel. A member of the Team first needs to authorize it. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
- Separate the polyfill side-effect import from the external imports. - Wrap the UUID assembly to stay within the 100-char line limit. - Assert to the exact template-literal return type instead of ReturnType<Crypto['randomUUID']>, and document why a single assertion is unavoidable for a UUID built at runtime.
Addresses review: the side-effect import intentionally precedes the external imports so the polyfill is installed before any module that may call crypto.randomUUID during initialization. Kept in its own import group with an explanatory comment.
Addresses review: drop the `as ReturnType<Crypto['randomUUID']>` assertion. The polyfill now declares its return type as the UUID template-literal type, so the compiler verifies the produced shape. Splitting the segments into locals also keeps every line within the formatting limit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
crypto.randomUUID()is only available in secure contexts — HTTPS pages, orhttp://localhost. A self-hosted CADAM instance served over plain HTTP on a LANaddress (e.g.
http://192.168.1.50:3000) is not a secure context, socrypto.randomUUIDisundefinedthere.The app calls it from several client components (
PromptView,EditorView,TextAreaChat,messageService, …), so it crashes on startup with:The error is swallowed by the root error boundary, so the user only sees the
"Oops! Something went wrong" screen. This makes the app unusable for anyone
self-hosting over HTTP on a LAN — a setup the README supports.
Reproduce: serve the app on any non-localhost HTTP origin and open it → blank error screen.
Fix
Add a small polyfill (
src/lib/ensureRandomUUID.ts), imported for its sideeffect at the very top of the client entry point (
src/client.tsx) so it runsbefore anything calls
randomUUID. It derives a spec-compliant RFC 4122 v4 UUIDfrom
crypto.getRandomValues()(which is available in insecure contexts) onlywhen the native method is missing.
localhost(native implementation always preferred).crypto.randomUUIDnatively).Testing
tsc -bandeslintpass.patch the app shows the error boundary; with it, the app loads and generation works.