An app-supplied authorization hook for BYOD source URLs. addByodSource runs it
after the built-in scheme, size and timeout policy and before the network fetch.
Return { valid: true } to allow the fetch or { valid: false, reason } to
block it (see ByodSourceUrlValidation). It may be sync or async, such as
an allowlist lookup.
The toolkit can't enforce SSRF guarantees the host itself can't, so by default it
leaves the URL surface open. This hook lets a deployment add its own policy, such
as refusing cloud-metadata endpoints (169.254.169.254) or allowing only known
hosts, without the SDK prescribing one for everyone. Set it via the
byod.validateSourceUrl option on createMapAgent, or assign
state.byod.sourceUrlValidator directly.
An app-supplied authorization hook for BYOD source URLs.
addByodSourceruns it after the built-in scheme, size and timeout policy and before the network fetch. Return{ valid: true }to allow the fetch or{ valid: false, reason }to block it (see ByodSourceUrlValidation). It may be sync or async, such as an allowlist lookup.The toolkit can't enforce SSRF guarantees the host itself can't, so by default it leaves the URL surface open. This hook lets a deployment add its own policy, such as refusing cloud-metadata endpoints (
169.254.169.254) or allowing only known hosts, without the SDK prescribing one for everyone. Set it via thebyod.validateSourceUrloption oncreateMapAgent, or assignstate.byod.sourceUrlValidatordirectly.