fix(livepreview): preserve private transport setup in production

Replace the declaration-based config marker with a call that survives minification.

Keep transport configuration private and retain the captured globals and runtime sealing.

Author: abose

src/LiveDevelopment/BrowserScripts/LivePreviewTransportRemote.js

@@ -19,6 +19,8 @@
  *
  */
 
+/*global __PHOENIX_LIVE_PREVIEW_TRANSPORT_CONFIG__ */
+
 // This is a transport injected into the browser via a script that handles the low
 // level communication between the live development protocol handlers on both sides.
 // The actual communication to phoenix is done via the loaded web worker below. We just post/receive all
@@ -89,13 +91,10 @@
 
 (function (global) {
 
-    // The below line will be replaced with the transport scripts provided by the static server at
-    // LivePreviewTransport.js:getRemoteScript() This is so that the actual live preview page doesnt get hold of
-    // any phoenix web socket or broadcast channel ids from this closure programatically for security.
-
-    //Replace dynamic section start
-    const TRANSPORT_CONFIG={};
-    //Replace dynamic section end
+    // getRemoteScript() replaces this call with a private config initializer before serving the script.
+    // A call survives minification without depending on declaration spacing or merged const statements.
+    // Its unknown return value also prevents the minifier from folding config property reads.
+    const TRANSPORT_CONFIG = __PHOENIX_LIVE_PREVIEW_TRANSPORT_CONFIG__();
 
     // The page's own scripts run after this one and may patch built-ins to read or rewrite what goes
     // to and from the editor. The channel uses the originals, captured here before any of them runs.

src/LiveDevelopment/MultiBrowserImpl/transports/LivePreviewTransport.js

@@ -63,30 +63,29 @@ define(function (require, exports, module) {
     let _transportBridge;
 
     /**
-     * Returns the script that should be injected into the browser to handle the other end of the transport.
+     * Fill the remote script's config initializer, preserving its private scope in source and minified builds.
      * @return {string}
      */
     function getRemoteScript() {
-        const replaceString = "const TRANSPORT_CONFIG={};";
+        const replaceString = "__PHOENIX_LIVE_PREVIEW_TRANSPORT_CONFIG__()";
         if(!LivePreviewTransportRemote.includes(replaceString)){
-            throw new Error("Live preview transport is expected to have replaceable template string:" +
-                " //REPLACE_ME_WITH_LIVE_PREVIEW_TRANSPORT_CONFIG_AND_SCRIPT_DYNAMIC");
+            throw new Error("Live preview transport is missing its config initializer: " + replaceString);
         }
-        let transportScript = (_transportBridge && _transportBridge.getRemoteTransportScript &&
+        const transportScript = (_transportBridge && _transportBridge.getRemoteTransportScript &&
             _transportBridge.getRemoteTransportScript()) || "";
-        transportScript = "const TRANSPORT_CONFIG={};" +
-            `TRANSPORT_CONFIG.PHOENIX_INSTANCE_ID = "${Phoenix.PHOENIX_INSTANCE_ID}";\n` +
-            `TRANSPORT_CONFIG.IS_NATIVE_APP = ${Phoenix.isNativeApp};\n` +
-            `TRANSPORT_CONFIG.PLATFORM = "${Phoenix.platform}";\n` +
-            `TRANSPORT_CONFIG.LIVE_DEV_REMOTE_WORKER_SCRIPTS_FILE_NAME = "${LiveDevProtocol.LIVE_DEV_REMOTE_WORKER_SCRIPTS_FILE_NAME}";\n` +
-            `TRANSPORT_CONFIG.LIVE_PREVIEW_DEBUG_ENABLED = ${logger.loggingOptions.logLivePreview};\n`+
-            `TRANSPORT_CONFIG.TRUSTED_ORIGINS_EMBED = ${JSON.stringify(Phoenix.TRUSTED_ORIGINS)};\n`+
-            `TRANSPORT_CONFIG.STRINGS = {
-                UNSUPPORTED_DOM_APIS_CONFIRM: "${Strings.UNSUPPORTED_DOM_APIS_CONFIRM}"
-            };\n`+
-            transportScript;
-        return LivePreviewTransportRemote.replace(replaceString, transportScript)
-            + "\n";
+        const config = {
+            PHOENIX_INSTANCE_ID: Phoenix.PHOENIX_INSTANCE_ID,
+            IS_NATIVE_APP: Phoenix.isNativeApp,
+            PLATFORM: Phoenix.platform,
+            LIVE_DEV_REMOTE_WORKER_SCRIPTS_FILE_NAME: LiveDevProtocol.LIVE_DEV_REMOTE_WORKER_SCRIPTS_FILE_NAME,
+            LIVE_PREVIEW_DEBUG_ENABLED: logger.loggingOptions.logLivePreview,
+            TRUSTED_ORIGINS_EMBED: Phoenix.TRUSTED_ORIGINS,
+            STRINGS: { UNSUPPORTED_DOM_APIS_CONFIRM: Strings.UNSUPPORTED_DOM_APIS_CONFIRM }
+        };
+        const initializer = "(function () {\nconst TRANSPORT_CONFIG = " + JSON.stringify(config) + ";\n" +
+            transportScript + "\nreturn TRANSPORT_CONFIG;\n}())";
+        // A callback keeps literal $ sequences in config values out of String.replace's replacement syntax.
+        return LivePreviewTransportRemote.replace(replaceString, () => initializer) + "\n";
     }
 
     EventDispatcher.makeEventDispatcher(exports);