feat: disable dev auth on sandboxed env

Author: antfu

packages/devtools/src/constant.ts

@@ -1,3 +1,4 @@
+import { provider } from 'std-env'
 import type { ModuleOptions, NuxtDevToolsOptions } from './types'
 
 export const ROUTE_PATH = '/__nuxt_devtools__'
@@ -8,6 +9,8 @@ export const ROUTE_AUTH_VERIFY = `${ROUTE_PATH}/auth-verify`
 export const ROUTE_ANALYZE = `${ROUTE_PATH}/analyze`
 export const WS_EVENT_NAME = 'nuxt:devtools:rpc'
 
+const isSandboxed = provider === 'stackblitz' || provider === 'codesandbox'
+
 export const defaultOptions: ModuleOptions = {
   enabled: undefined, // determine multiple conditions
   componentInspector: true,
@@ -18,6 +21,7 @@ export const defaultOptions: ModuleOptions = {
     port: 3080,
     reuseExistingServer: true,
   },
+  disableAuthorization: isSandboxed,
 }
 
 export const defaultTabOptions: NuxtDevToolsOptions = {

packages/devtools/src/server-rpc/general.ts

@@ -5,7 +5,6 @@ import { resolveBuiltinPresets } from 'unimport'
 import { resolve } from 'pathe'
 import { colors } from 'consola/utils'
 import { logger } from '@nuxt/kit'
-import type { Nitro } from 'nitropack'
 import destr from 'destr'
 import { snakeCase } from 'scule'
 
@@ -190,6 +189,9 @@ export function setupGeneralRPC({ nuxt, options, refresh, openInEditorHooks }: N
       return nuxt.callHook('restart', { hard })
     },
     async requestForAuth(info: string, origin?: string) {
+      if (options.disableAuthorization)
+        return
+
       const token = await getDevAuthToken()
 
       origin ||= `${nuxt.options.devServer.https ? 'https' : 'http'}://${nuxt.options.devServer.host === '::' ? 'localhost' : (nuxt.options.devServer.host || 'localhost')}:${nuxt.options.devServer.port}`
@@ -215,6 +217,8 @@ export function setupGeneralRPC({ nuxt, options, refresh, openInEditorHooks }: N
       })
     },
     async verifyAuthToken(token: string) {
+      if (options.disableAuthorization)
+        return true
       return token === await getDevAuthToken()
     },
   } satisfies Partial<ServerFunctions>