Pass Melissa credentials through the actor runtime #149

Merged

lost-rob0t merged 9 commits from fix/melissa-explicit-credential into main

2026-07-29 15:51:09 +00:00

lost-rob0t commented

2026-07-29 15:42:52 +00:00

(Migrated from github.com)

Root cause

Melissa configuration was only injected by a global fetch monkeypatch. The actor runtime itself did not receive the saved context.configuration, despite the settings UI stating that it did. That left Melissa authentication dependent on component mount order and an indirect global interceptor.

Fix

load the actor's saved configuration at the browser-actor host boundary
pass that configuration into actor code as context.configuration
explicitly set the saved Melissa credential on trusted bundled Melissa requests before they reach fetch
prevent untrusted actors that spoof the Melissa ID prefix from receiving the shared Melissa credential
accept dashboard copies where License Key Using Credits is separated from the value by whitespace rather than : or =
ignore an intervening Copy/Copied label

Regression coverage

verifies the actor receives its configuration
verifies a credit key containing +, /, and = reaches Personator Search exactly and is percent-encoded correctly
verifies dashboard-label copy formats normalize to the actual key

This replaces the indirect authentication path for Melissa actors while retaining the existing interceptor for other direct Melissa requests.

## Root cause Melissa configuration was only injected by a global `fetch` monkeypatch. The actor runtime itself did not receive the saved `context.configuration`, despite the settings UI stating that it did. That left Melissa authentication dependent on component mount order and an indirect global interceptor. ## Fix - load the actor's saved configuration at the browser-actor host boundary - pass that configuration into actor code as `context.configuration` - explicitly set the saved Melissa credential on trusted bundled Melissa requests before they reach `fetch` - prevent untrusted actors that spoof the Melissa ID prefix from receiving the shared Melissa credential - accept dashboard copies where `License Key Using Credits` is separated from the value by whitespace rather than `:` or `=` - ignore an intervening `Copy`/`Copied` label ## Regression coverage - verifies the actor receives its configuration - verifies a credit key containing `+`, `/`, and `=` reaches Personator Search exactly and is percent-encoded correctly - verifies dashboard-label copy formats normalize to the actual key This replaces the indirect authentication path for Melissa actors while retaining the existing interceptor for other direct Melissa requests.