From ee0af68bfdc8081806ff3fdc88ca2e3ca745be2e Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 25 Jan 2026 02:33:30 +0000
Subject: [PATCH] fix: prevent SecurityError in pushState when playing video on
 local origin

When running the application locally (e.g., `127.0.0.1:5500`) but using a production configuration (`BITVID_WEBSITE_URL` pointing to `bitvid.network`), `playVideoByEventId` would attempt to `pushState` with the production URL. This triggers a browser `SecurityError` due to the origin mismatch, preventing the video modal from opening.

This change adds a check to normalize the `pushUrl`. If the target URL's origin differs from the current window's origin, it falls back to a relative path using `window.location.pathname` combined with the target's search parameters and hash. This ensures `pushState` always receives a safe, same-origin URL regardless of the environment configuration.
---
 js/app.js | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/js/app.js b/js/app.js
index 100c577a..ee6868ef 100644
--- a/js/app.js
+++ b/js/app.js
@@ -8713,11 +8713,21 @@ class Application {
     // this.setShareButtonState(true); // Moved to after showModalWithPoster
 
     const nevent = window.NostrTools.nip19.neventEncode({ id: eventId });
-    const pushUrl =
+    let pushUrl =
       this.buildShareUrlFromNevent(nevent) ||
       `${this.getShareUrlBase() || window.location.pathname}?v=${encodeURIComponent(
         nevent
       )}`;
+
+    try {
+      const targetUrl = new URL(pushUrl, window.location.origin);
+      if (targetUrl.origin !== window.location.origin) {
+        pushUrl = `${window.location.pathname}${targetUrl.search}${targetUrl.hash}`;
+      }
+    } catch (err) {
+      devLogger.warn("[Application] Failed to normalize pushState URL:", err);
+    }
+
     window.history.pushState({}, "", pushUrl);
 
     this.zapController?.resetState();