From 776b6831f3db784fb2571dd8b6fd82227d285307 Mon Sep 17 00:00:00 2001
From: Sam Atkins <atkinssj@gmail.com>
Date: Thu, 11 Apr 2024 14:35:22 +0100
Subject: [PATCH] Fix permission check for closeApp message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Firstly, I was missing an `async` here, which somehow still worked for
me then, but produced errors for me when I tried it today.

Then, actually await the promise.

Finally, actually check the target's parent is us, and not just that it
has the attribute!

I don't know what was going on in my head that day. 🤦‍♂️
---
 src/IPC.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/IPC.js b/src/IPC.js
index d9a2eb4a..f8aad660 100644
--- a/src/IPC.js
+++ b/src/IPC.js
@@ -1116,9 +1116,9 @@ window.addEventListener('message', async (event) => {
         }
 
         // Check permissions
-        const allowed = (() => {
+        const allowed = await (async () => {
             // Parents can close their children
-            if (target_window.dataset['parent_instance_id']) {
+            if (target_window.dataset['parent_instance_id'] === appInstanceID) {
                 console.log(`⚠️ Allowing app ${appInstanceID} to close child app ${targetAppInstanceID}`);
                 return true;
             }