fix: fetchfile controller refuses any in-browser fetch, even if CORS would allow it

We should just try the network request, and let the browser fail it for us, rather than trying to be smart, here.

Author: starpit

plugins/plugin-client-common/notebook/src/load.ts

@@ -24,7 +24,7 @@ export async function loadNotebook(
 ): Promise<string | object> {
   try {
     if (/^https:/.test(filepath)) {
-      return (await REPL.rexec<(string | object)[]>(`_fetchfile ${encodeComponent(filepath)}`)).content[0]
+      return (await REPL.rexec<(string | object)[]>(`vfs _fetchfile ${encodeComponent(filepath)}`)).content[0]
     } else {
       //   --with-data says give us the file contents
       const fullpath = Util.absolute(Util.expandHomeDir(filepath))

plugins/plugin-kubectl/src/controller/fetch-file.ts

@@ -68,6 +68,22 @@ async function fetchKustomizeString(
   }
 }
 
+async function fetchFileController(args: Arguments<Options>) {
+  const { argvNoOptions, parsedOptions, execOptions } = args
+
+  const uri = argvNoOptions[argvNoOptions.indexOf('_fetchfile') + 1]
+  const opts = Object.assign(
+    { tryFetchEvenInBrowser: true },
+    typeof execOptions.data === 'object' && !Buffer.isBuffer(execOptions.data) ? execOptions.data : undefined
+  )
+
+  if (!parsedOptions.kustomize) {
+    return { mode: 'raw', content: await fetchFile(args, uri, opts) }
+  } else {
+    return { mode: 'raw', content: await fetchKustomizeString(args, uri) }
+  }
+}
+
 /**
  * A server-side shim to allow browser-based clients to fetch `-f`
  * file content.
@@ -115,21 +131,15 @@ export default (registrar: Registrar) => {
     { requiresLocal: true }
   )
 
-  registrar.listen(
-    `/_fetchfile`,
-    async (args: Arguments<Options>) => {
-      const { argvNoOptions, parsedOptions, execOptions } = args
-
-      const uri = argvNoOptions[argvNoOptions.indexOf('_fetchfile') + 1]
-      const opts =
-        typeof execOptions.data === 'object' && !Buffer.isBuffer(execOptions.data) ? execOptions.data : undefined
+  /**
+   * WARNING: called **internally** by util/fetch-file.ts to
+   * facilitate the browser-to-proxy hand-off.
+   */
+  registrar.listen(`/_fetchfile`, fetchFileController, { requiresLocal: true, flags: { boolean: ['kustomize'] } })
 
-      if (!parsedOptions.kustomize) {
-        return { mode: 'raw', content: await fetchFile(args, uri, opts) }
-      } else {
-        return { mode: 'raw', content: await fetchKustomizeString(args, uri) }
-      }
-    },
-    { requiresLocal: true, flags: { boolean: ['kustomize'] } }
-  )
+  /**
+   * Called by anyone; note the requiresLocal difference here. This is
+   * to allow fetches from a browser when CORS supports it.
+   */
+  registrar.listen(`/vfs/_fetchfile`, fetchFileController, { flags: { boolean: ['kustomize'] } })
 }

plugins/plugin-kubectl/src/lib/util/fetch-file.ts

@@ -129,6 +129,7 @@ interface FetchOptions<Data extends BodyData | BodyData[]> {
   data?: Data
   headers?: Record<string, string>
   method?: 'get' | 'put' | 'post' | 'delete'
+  tryFetchEvenInBrowser?: boolean
 }
 
 export async function _needle(
@@ -137,7 +138,7 @@ export async function _needle(
   opts?: FetchOptions<BodyData>,
   retryCount = 0
 ): Promise<{ statusCode: number; body: string | object }> {
-  if (!Capabilities.inBrowser()) {
+  if (!Capabilities.inBrowser() || (opts && opts.tryFetchEvenInBrowser)) {
     const method = (opts && opts.method) || 'get'
     const headers = Object.assign({ connection: 'keep-alive' }, opts.headers)
     debug('fetch via needle', method, headers, url)