[next] Story Improvements (#2054)

* feat: improved logs

* feat: improved scraper

- added scraper debug graph call

* feat: improved story closing

* fix: fixed tests

src/core/server/app/middleware/csp/tenant.ts

@@ -1,12 +1,13 @@
 import builder from "content-security-policy-builder";
 import {
   doesRequireSchemePrefixing,
-  extractParentsOrigin,
+  extractParentsURL,
   getOrigin,
   isURLSecure,
   prefixSchemeIfRequired,
 } from "talk-server/app/url";
 import { Tenant } from "talk-server/models/tenant";
+import { isURLPermitted } from "talk-server/services/stories";
 import { Request, RequestHandler } from "talk-server/types/express";
 
 /**
@@ -65,8 +66,13 @@ export function generateFrameOptions(
     return `allow-from ${getOrigin(tenant.domains[0])}`;
   }
 
-  // Grab the parent's hostname.
-  const parentsOrigin = extractParentsOrigin(req);
+  const parentsURL = extractParentsURL(req);
+  if (!parentsURL) {
+    return "deny";
+  }
+
+  // Grab the parent's origin.
+  const parentsOrigin = getOrigin(parentsURL);
   if (!parentsOrigin) {
     return "deny";
   }
@@ -88,6 +94,11 @@ export function generateFrameOptions(
     )}`;
   }
 
+  // Determine if this origin is allowed.
+  if (!isURLPermitted(tenant, parentsURL)) {
+    return "deny";
+  }
+
   // As we can only return a single domain in the `allow-from` directive as per
   // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
   // We need to find the domain that is asking so we can respond with the right