fix(permissions): request host permissions during user gesture, not in background

chrome.permissions.request() must be called synchronously within a user gesture. Moving it from the background message-router (where the gesture context has expired) into the addVhostSubmit click handler in virtual-hosts.js fixes the "Unchecked runtime.lastError: This function must be called during a user gesture" console error.
2026-03-01 13:24:04 -05:00
parent 440fbf350e
commit 58a41f6965
2 changed files with 33 additions and 26 deletions
@@ -180,21 +180,41 @@ function setupVirtualHostEvents() {
    if (!hsUrl || !hsUrl.startsWith('hs://')) { showModalError('modal-addVhost', 'addVhostError', 'Enter a valid hs:// URL'); return; }
    const btn = $('addVhostSubmit');
    if (btn) { btn.disabled = true; btn.textContent = 'Adding…'; }
-    chrome.runtime.sendMessage(
-      { target: 'holesail-native', action: 'send', payload: { type: 'setVirtualHost', payload: { hostname, hsUrl } } },
-      (response) => {
-        if (btn) { btn.disabled = false; btn.textContent = 'Add Host'; }
-        if (response?.ok) {
-          if (hostnameEl) hostnameEl.value = '';
-          if (hsUrlEl) hsUrlEl.value = '';
-          closeModal('modal-addVhost');
-          showToast('Virtual host added', 'success');
-          refresh();
-        } else {
-          showModalError('modal-addVhost', 'addVhostError', response?.error || 'Failed to add');
+
+    function doAddVhost() {
+      chrome.runtime.sendMessage(
+        { target: 'holesail-native', action: 'send', payload: { type: 'setVirtualHost', payload: { hostname, hsUrl } } },
+        (response) => {
+          if (btn) { btn.disabled = false; btn.textContent = 'Add Host'; }
+          if (response?.ok) {
+            if (hostnameEl) hostnameEl.value = '';
+            if (hsUrlEl) hsUrlEl.value = '';
+            closeModal('modal-addVhost');
+            showToast('Virtual host added', 'success');
+            refresh();
+          } else {
+            showModalError('modal-addVhost', 'addVhostError', response?.error || 'Failed to add');
+          }
        }
+      );
+    }
+
+    // Request host permissions synchronously within the user gesture so Chrome
+    // allows the permissions.request call. Non-hole.sail custom domains need
+    // explicit host permission for the extension to intercept their traffic.
+    const parts = hostname.split('.');
+    if (parts.length >= 3) {
+      const baseDomain = parts.slice(-2).join('.');
+      if (baseDomain !== 'hole.sail') {
+        const origin = '*://*.' + baseDomain + '/*';
+        chrome.permissions.request({ origins: [origin] }, () => {
+          void chrome.runtime.lastError;
+          doAddVhost();
+        });
+        return;
      }
-    );
+    }
+    doAddVhost();
  });

  $('removeVhostConfirm')?.addEventListener('click', () => {