feat: iframe page

frontend-web/src/core/api/canvas-client.ts

@@ -5,6 +5,7 @@ import { Client as LangGraphClient } from "@langchain/langgraph-sdk/client";
 import { getAuthorizationHeaderValue } from "../auth";
 import { getCanvasLangGraphBaseURL } from "../config";
 
+import { withCsrfHeaders } from "./csrf";
 import { sanitizeRunStreamOptions } from "./stream-mode";
 
 /**
@@ -19,12 +20,16 @@ function createCanvasClient(): LangGraphClient {
   const client = new LangGraphClient({
     apiUrl: getCanvasLangGraphBaseURL(),
     onRequest(_url, init) {
-      const headers = new Headers(init.headers ?? {});
+      const headers = withCsrfHeaders(init.headers);
       const authHeader = getAuthorizationHeaderValue();
       if (authHeader && !headers.has("Authorization")) {
         headers.set("Authorization", authHeader);
       }
-      return { ...init, headers };
+      return {
+        ...init,
+        credentials: init.credentials ?? "include",
+        headers,
+      };
     },
   });