Release cookie-free Persimmons vault link 0.6.0

extension/human-api.mjs

@@ -1,13 +1,15 @@
+import {VAULT_CAPABILITY} from './connection-state.mjs';
 export class VaultUnavailableError extends Error {}
 const BASE = 'https://teahub.xyz/tea/site/chat/persimmons';
 export async function vaultRequest(method = 'GET', owner, id, body, fetcher = fetch) {
   if (!['GET', 'POST', 'PUT', 'DELETE'].includes(method) || (id !== undefined && !/^[0-9a-f]{32}$/.test(id))) throw new Error('Invalid vault operation.');
-  // Chromium omits Origin on permitted extension GETs. POST reads carry its
-  // genuine Origin so the server retains the pinned-caller check.
   try {
+    const stored = (await chrome.storage.local.get(VAULT_CAPABILITY))[VAULT_CAPABILITY];
+    const capability = stored?.owner === owner && typeof stored?.capability === 'string' ? stored.capability : null;
+    if (!capability) throw new Error();
     const response = await fetcher(`${BASE}/human-vault/items${id ? '/' + id : ''}${method === 'GET' ? '/read' : ''}`, {
-      method: method === 'GET' ? 'POST' : method, credentials: 'include', cache: 'no-store', redirect: 'error', signal: AbortSignal.timeout(15000),
-      headers: {Accept: 'application/json', ...(owner ? {'X-Vault-Owner': owner} : {}), ...(body ? {'Content-Type': 'application/json'} : {})},
+      method: method === 'GET' ? 'POST' : method, credentials: 'omit', cache: 'no-store', redirect: 'error', signal: AbortSignal.timeout(15000),
+      headers: {Accept: 'application/json', 'X-Vault-Capability': capability, ...(owner ? {'X-Vault-Owner': owner} : {}), ...(body ? {'Content-Type': 'application/json'} : {})},
       ...(body ? {body: JSON.stringify(body)} : {})});
     if (!response.ok || !(response.headers.get('content-type') || '').includes('application/json')) throw new Error();
     const data = await response.json();