fix!: require eventSource in PostMessageTransport + add security tests (#208)

Author: ochafik

src/message-transport.ts

@@ -73,7 +73,7 @@ export class PostMessageTransport implements Transport {
    */
   constructor(
     private eventTarget: Window = window.parent,
-    private eventSource?: MessageEventSource,
+    private eventSource: MessageEventSource,
   ) {
     this.messageListener = (event) => {
       if (eventSource && event.source !== this.eventSource) {

src/react/useApp.tsx

@@ -117,7 +117,10 @@ export function useApp({
 
     async function connect() {
       try {
-        const transport = new PostMessageTransport(window.parent);
+        const transport = new PostMessageTransport(
+          window.parent,
+          window.parent,
+        );
         const app = new App(appInfo, capabilities);
 
         // Register handlers BEFORE connecting