AliReza
737414f246
The app hands every outside URL to the phone browser, which sends no Referer, and Zarinpal's StartPay refuses a request without our domain as Referer («دسترسی از این دامنه مجاز نمیباشد»). Checked against production on a pending order: no Referer → refused; Referer https://math.tadrisino2.ir/ → forwards to the bank (sep.shaparak.ir). - pay.html + src/pay.ts: opened in the phone browser, forwards only to our own /api/payment/orders/<id>/pay link (anything else is refused), so the Referer is math.tadrisino2.ir. The app opens it as http:// (the WebView keeps only https on its own host); ArvanCloud moves it to https, and the link rides in the fragment, which never reaches a server. - MainActivity.kt (next APK): payment pages (our subdomains, zarinpal, shaparak) stay inside the WebView and `paysInApp()` tells the frontend to navigate directly. Not built. Not checked: a full payment on a real phone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
37 lines
1.4 KiB
TypeScript
37 lines
1.4 KiB
TypeScript
import { defineConfig, loadEnv } from 'vite';
|
|
import path from 'node:path';
|
|
import react from '@vitejs/plugin-react';
|
|
import tailwindcss from '@tailwindcss/vite';
|
|
|
|
export default defineConfig(({ mode }) => {
|
|
const env = loadEnv(mode, process.cwd(), 'VITE_');
|
|
const proxyTarget = env.VITE_DEV_PROXY_TARGET || 'http://127.0.0.1:8000';
|
|
|
|
return {
|
|
plugins: [react(), tailwindcss()],
|
|
resolve: {
|
|
alias: { '@': path.resolve(__dirname, './src') },
|
|
},
|
|
build: {
|
|
rollupOptions: {
|
|
// pay.html: صفحهی واسطهی درگاه برای اپِ اندروید (src/pay.ts).
|
|
input: { main: path.resolve(__dirname, 'index.html'), pay: path.resolve(__dirname, 'pay.html') },
|
|
output: {
|
|
// کتابخانهها با هر انتشار عوض نمیشوند؛ فایلِ جدا یعنی بعد از هر دیپلوی
|
|
// از کشِ مرورگر میآیند و فقط کدِ خودِ اپ دوباره دانلود میشود.
|
|
manualChunks: {
|
|
react: ['react', 'react-dom'],
|
|
motion: ['motion/react'],
|
|
},
|
|
},
|
|
},
|
|
},
|
|
server: {
|
|
// در توسعه /api همدامنه است و به بکاند پاس داده میشود؛ CORS لازم نیست.
|
|
proxy: {
|
|
'/api': { target: proxyTarget, changeOrigin: true, secure: true },
|
|
},
|
|
},
|
|
};
|
|
});
|