@bardioc/app-sdk 0.4.5 → 0.4.6

package/dist/dev-proxy.js

@@ -49,9 +49,29 @@ export function createDevAuthProxyHandler(options) {
         const upstreamPath = url.pathname.slice('/rest'.length) + url.search;
         const upstreamUrl = `${apiBaseUrl}${upstreamPath}`;
         const headers = new Headers();
-        const contentType = req.headers['content-type'];
-        if (contentType) {
-            headers.set('Content-Type', contentType);
+        // Forward headers from the browser so the BFF sees the same request the host would relay
+        // (cookies, origin, referer, etc.). Skip hop-by-hop headers; fetch sets Host from the URL.
+        const skipHeaders = new Set([
+            'connection',
+            'content-length',
+            'host',
+            'keep-alive',
+            'te',
+            'transfer-encoding',
+            'upgrade',
+        ]);
+        for (const [name, value] of Object.entries(req.headers)) {
+            if (value == null || skipHeaders.has(name.toLowerCase())) {
+                continue;
+            }
+            if (Array.isArray(value)) {
+                for (const v of value) {
+                    headers.append(name, v);
+                }
+            }
+            else {
+                headers.set(name, value);
+            }
         }
         addDevSecretHeader(req, headers, devSecret);
         // The host stamps X-App-ID from its own registration data, never from the app — the
@@ -61,19 +81,6 @@ export function createDevAuthProxyHandler(options) {
         }
         // BFF rejects /bardioc/ calls without this CSRF marker header; stamp it like the host does.
         headers.set('X-Requested-With', 'XMLHttpRequest');
-        // Forward a few useful headers from the browser.
-        const forwardedHeaders = ['accept', 'accept-language', 'x-scope-id'];
-        for (const name of forwardedHeaders) {
-            const value = req.headers[name];
-            if (typeof value === 'string') {
-                headers.set(name, value);
-            }
-            else if (Array.isArray(value)) {
-                for (const v of value) {
-                    headers.append(name, v);
-                }
-            }
-        }
         let body;
         try {
             body = await readRequestBody(req);

package/dist/vite.js

@@ -316,7 +316,9 @@ export function bardiocApp(opts) {
         config(_config, env) {
             const isDev = env.command === 'serve';
             return {
-                base: isDev ? `/_apps/${manifestId}/` : './',
+                // Dev runs standalone without the host, so a root base avoids a
+                // base path in the Referer/Origin that the BFF may reject.
+                base: isDev ? '/' : './',
                 server: {
                     port,
                     allowedHosts: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/app-sdk",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "SDK for building apps for the Bardioc OS",
   "license": "MIT",
   "private": false,