Skip to content

fix: resolve hubRequestOptions being overwritten in getFrameMessage - #557

Open
dajiaohuang wants to merge 7 commits into
framesjs:mainfrom
dajiaohuang:fix/hubRequestOptions-overwriting-getFrameMessage
Open

fix: resolve hubRequestOptions being overwritten in getFrameMessage#557
dajiaohuang wants to merge 7 commits into
framesjs:mainfrom
dajiaohuang:fix/hubRequestOptions-overwriting-getFrameMessage

Conversation

@dajiaohuang

Copy link
Copy Markdown

Summary

修复 getFrameMessage 函数中 hubRequestOptions 被覆盖的问题。

问题

当使用默认 hub URL (DEFAULT_HUB_API_URL) 时,用户提供的 hubRequestOptions(如 cachecredentials 等)完全丢失,因为代码直接用一个只包含 api_key 的对象覆盖了整个选项。

代码变更

// Before
requestOptions = {
  headers: {
    api_key: DEFAULT_HUB_API_KEY,
  },
};

// After
requestOptions = {
  ...requestOptions,
  headers: {
    ...(requestOptions.headers ?? {}),
    api_key: DEFAULT_HUB_API_KEY,
  },
};

Fix

现在正确合并用户提供的选项与默认的 api_key header。

- Remove redundant else branch that was overwriting acc[type] with the same value
- Fix mutable default argument by creating requestOptions object fresh each time
- Properly merge user-provided hubRequestOptions with default api_key header
Create fresh requestOptions object each time to avoid shared mutable default.
Properly merge user-provided hubRequestOptions with default api_key header.
Create fresh requestOptions object each time to avoid shared mutable default.
Properly merge user-provided hubRequestOptions with default api_key header.
- Fix mutable default argument by using empty object as default
- Add missing api_key header when using default hub URL
When using the default hub URL, user-provided hubRequestOptions
(like cache, credentials, etc.) were being completely lost.
Now properly merges user options with the default api_key header.
@vercel

vercel Bot commented Sep 2, 2026

Copy link
Copy Markdown

@dajiaohuang is attempting to deploy a commit to the Discove Team on Vercel.

A member of the Team first needs to authorize it.

Comment thread packages/frames.js/src/getUserDataForFid.ts
Comment thread packages/frames.js/src/getUserDataForFid.ts
Comment on lines +27 to +33
const requestOptions = {
...hubRequestOptions,
headers: {
...(hubRequestOptions.headers ?? {}),
api_key: DEFAULT_HUB_API_KEY,
},
};

@vercel vercel Bot Sep 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

getAddressForFid unconditionally injects the default public api_key header, overwriting a caller-supplied api_key even when a custom hub URL is used, breaking auth against custom hubs.

Fix on Vercel

Comment on lines +37 to +43
const requestOptions = {
...hubRequestOptions,
headers: {
...(hubRequestOptions.headers ?? {}),
api_key: DEFAULT_HUB_API_KEY,
},
};

@vercel vercel Bot Sep 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

getAddressesForFid unconditionally injects the default public api_key header, overriding a caller-supplied api_key even when a custom hub URL is used, which breaks auth against custom hubs.

Fix on Vercel

Comment on lines 53 to +54
...headers,
api_key: DEFAULT_HUB_API_KEY,

@vercel vercel Bot Sep 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

validateFrameMessage unconditionally injects the default public Neynar api_key after spreading user headers, clobbering a caller's own api_key even when a custom hubHttpUrl is used.

Fix on Vercel

@dajiaohuang

Copy link
Copy Markdown
Author

Addressed the current review feedback in the latest commit. The user-data reducer now stores the first value for each type and replaces it only when a newer timestamp is seen, so first-seen fields are no longer lost. Validation: git diff --check passed. The local checkout has no Yarn binary/dependencies, so the package test suite could not run here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant