From cf703c4cafa8456a917c384d18c37ccbcb36931b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 7 Jul 2026 09:51:04 +0900 Subject: [PATCH 1/2] feat(viewer): make frame-ancestors env-configurable on default profile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The buyer-demo profile exposes CLEARFOLIO_FRAME_ANCESTORS, but the default application.yml hard-coded 'self', so a production deployment on the default profile could not allow the viewer to be embedded cross-origin. Mirror the ${CLEARFOLIO_FRAME_ANCESTORS:self} indirection so naruon can embed the /viewer surface via config. Default stays 'self' — no behavior change when unset. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_017RkKdtHRLG4wSLh6PVsp8J --- src/main/resources/application.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml index b98dcbe2..a2c59b96 100644 --- a/src/main/resources/application.yml +++ b/src/main/resources/application.yml @@ -18,6 +18,7 @@ conversion: viewer: security: - # Default is safe and non-breaking for same-origin usage. - # Set an explicit allowlist if the viewer must be embedded cross-origin. - frame-ancestors: self + # Default is safe (same-origin only). Set CLEARFOLIO_FRAME_ANCESTORS to an + # explicit allowlist (e.g. "self https://naruon.example") to embed the viewer + # cross-origin, such as inside naruon's document surface. + frame-ancestors: ${CLEARFOLIO_FRAME_ANCESTORS:self} From 8b2dd35bf0358269fd2bb3c6e16df7d9be01e03c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 7 Jul 2026 19:39:47 +0900 Subject: [PATCH 2/2] ci: re-trigger (prior run cancelled) Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01RjGVapDZ3k7V7zKYk16P4C