Tecnoblog 使用 Discourse 评论系统的体验

Previously, full app embeds loaded on a third-party domain could not see the for…um's session cookie, leaving users effectively logged out, and `showLogin` only opened a dead-end `/login` tab the iframe never reacted to. This change adds an opt-in `embed_full_app_signin_flow` site setting that intercepts logged-out actions inside the iframe with a guided flow: an in-iframe modal opens a top-level sign-in tab that auto-closes via `postMessage` on success, and the iframe reloads to pick up the session cookie. On Safari, the flow first calls `requestStorageAccess()` to bypass ITP before opening the popup. ## Flow 1. User clicks an auth-gated action (Like, Reply CTA, etc.). `showLogin` / `showCreateAccount` (and the embed-topic-footer reply CTA) route into the new `embed-auth-flow` service. 2. **Safari only**: if `hasStorageAccess()` is false, an in-iframe modal asks the user to share their session. Confirming calls `requestStorageAccess()` (synchronously inside the click handler so user activation is preserved), persists the original intent, and reloads the iframe. 3. A sign-in modal opens a top-level `/login?embed_signin_callback=1` (or `/signup`) tab. A new `embed-signin-popup-callback` initializer detects a successful sign-in in that tab, posts a message to the opener, and closes the tab. 4. The iframe reloads on the explicit `postMessage` success signal so the user picks up their session. Plain popup close (user dismissed) tears down silently — no false "signed in" state. ## Setting - `embed_full_app_signin_flow` (boolean, default `false`, in the `embedding` area). Off by default; the existing Safari-only on-load storage access prompt and the legacy `window.open("/login")` paths continue to run when the flag is off. - Activating this requires the embed to be **same-site** to the host page (e.g. `forum.discourse.org` ↔ `meta.discourse.org`) **or** `same_site_cookies = "None"` for cross-site embeds. The browser's SameSite policy still applies to cookies after `requestStorageAccess()`, so cross-site Lax/Strict cookies cannot be delivered to the iframe. ## Implementation notes - **User activation preserved.** The modal is rendered via `service:modal` with native `<button {{on "click" handler}}>` elements rather than `service:dialog` (which wraps actions in `next()` and breaks user activation), so `requestStorageAccess()` and `window.open()` see a live activation token. - **Intent persisted across reload.** Sign-up vs. sign-in intent survives the storage-access reload via `sessionStorage`. - **API-unsupported fallback.** On Safari without `document.requestStorageAccess`, the service opens a plain top-level login tab (no callback) instead of trapping the user in a popup that cannot bridge cookies. - **Storage access denial is a dead-end on purpose.** The catch handler does not chain to a sign-in popup, since a sign-in tab cannot help an iframe that lacks storage access. The user retries the action to be re-prompted. ## Tests `tests/unit/services/embed-auth-flow-test.js` covers the state machine: gating, the Safari/non-Safari split for Storage Access, post-reload handling (including signup-intent preservation), denial behaviour, popup URL routing, and the API-unsupported fallback.

这是一项复杂的变更，但我们相信能够带来更好的用户体验。

Thiago_Mobilon · 2026 年5 月 7 日 20:14

我发现另一个 UI 错误：

当我点击编辑我的帖子时，iframe 底部会出现一个空白区域，没有任何内容。‘标准’表单仍然打开，但我的评论并不在其中供编辑。此外，显示帖子数量的元素向左移动了。

Falco · 2026 年5 月 7 日 20:27

听起来和 AI 机器人作曲器上的一个 bug 很像，对吧 @keegan？

keegan · 2026 年5 月 8 日 20:29

这现在应该已通过以下提交解决：

github.com/discourse/discourse

FEATURE: Add post editing support to docked composers (#39858)

committed 06:11PM - 08 May 26 UTC

keegangeorge

+277 -18

**Previously**, clicking "edit" on a post in embed mode or an AI bot PM would op…en the standard floating composer. **This change** adds inline edit support to both the embed-mode and AI bot docked composers, intercepting the edit action via app events and handling the PUT request directly, so users never leave the docked composer flow. ---- Embed Mode: <img width="670" height="401" alt="embed-mode" src="https://github.com/user-attachments/assets/bd11afc6-b7f0-456d-b0be-ddb48fdd964e" /> AI Bot: <img width="786" height="230" alt="ai-bot" src="https://github.com/user-attachments/assets/7c63fa08-cb03-4a5a-9405-b0f204264d02" />

话题		回复	浏览量
Embed Discourse comments on another website via Javascript Integrations embedding , how-to	123	302243	2025 年10 月 27 日
How to automatically adjust iframe height for embedded wordpress posts WordPress	18	4943	2025 年6 月 26 日
Embed Discourse comments with on-page commenting? Feature	32	8000	2019 年1 月 19 日
Discourse Comments stuck on "Loading..." Support	22	2115	2024 年9 月 18 日
Embed Discourse as a full comment system on your site Announcements embedding	23	1266	2026 年5 月 6 日

Tecnoblog 使用 Discourse 评论系统的体验

相关话题