@bardioc/app-sdk 0.4.5 → 0.4.7

package/dist/dev-proxy.d.ts

@@ -4,8 +4,6 @@ export interface DevAuthProxyOptions {
     apiBaseUrl: string;
     /** Dev secret copied from the backend. */
     devSecret: string;
-    /** App slug stamped as `X-App-ID`, mirroring how the host identifies iframe apps. */
-    appId?: string;
     /** Optional CORS origin (e.g. `*`). */
     allowOrigin?: string;
 }

package/dist/dev-proxy.js

@@ -33,7 +33,7 @@ function addDevSecretHeader(req, headers, devSecret) {
 }
 export function createDevAuthProxyHandler(options) {
     const apiBaseUrl = normalizeApiBaseUrl(options.apiBaseUrl);
-    const { devSecret, allowOrigin, appId } = options;
+    const { devSecret, allowOrigin } = options;
     return async (req, res) => {
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         if (req.method === 'OPTIONS') {
@@ -49,31 +49,36 @@ export function createDevAuthProxyHandler(options) {
         const upstreamPath = url.pathname.slice('/rest'.length) + url.search;
         const upstreamUrl = `${apiBaseUrl}${upstreamPath}`;
         const headers = new Headers();
-        const contentType = req.headers['content-type'];
-        if (contentType) {
-            headers.set('Content-Type', contentType);
-        }
-        addDevSecretHeader(req, headers, devSecret);
-        // The host stamps X-App-ID from its own registration data, never from the app — the
-        // dev proxy does the same with the configured app slug.
-        if (appId) {
-            headers.set('X-App-ID', appId);
-        }
-        // BFF rejects /bardioc/ calls without this CSRF marker header; stamp it like the host does.
-        headers.set('X-Requested-With', 'XMLHttpRequest');
-        // Forward a few useful headers from the browser.
-        const forwardedHeaders = ['accept', 'accept-language', 'x-scope-id'];
-        for (const name of forwardedHeaders) {
-            const value = req.headers[name];
-            if (typeof value === 'string') {
-                headers.set(name, value);
+        // Forward headers from the browser so the BFF sees the same request the host would relay
+        // (cookies, origin, referer, etc.). Skip hop-by-hop headers; fetch sets Host from the URL.
+        const skipHeaders = new Set([
+            'connection',
+            'content-length',
+            'host',
+            'keep-alive',
+            'te',
+            'transfer-encoding',
+            'upgrade',
+        ]);
+        for (const [name, value] of Object.entries(req.headers)) {
+            if (value == null || skipHeaders.has(name.toLowerCase())) {
+                continue;
             }
-            else if (Array.isArray(value)) {
+            if (Array.isArray(value)) {
                 for (const v of value) {
                     headers.append(name, v);
                 }
             }
+            else {
+                headers.set(name, value);
+            }
         }
+        addDevSecretHeader(req, headers, devSecret);
+        // Dev auth is dev-secret only: never forward X-App-Id, so the BFF app-token
+        // exchange (which would also demand X-Scope-ID) can never be triggered here.
+        headers.delete('X-App-Id');
+        // BFF rejects /bardioc/ calls without this CSRF marker header; stamp it like the host does.
+        headers.set('X-Requested-With', 'XMLHttpRequest');
         let body;
         try {
             body = await readRequestBody(req);

package/dist/vite.js

@@ -260,7 +260,6 @@ export function bardiocDevAuth(options) {
                 proxyOptions = {
                     apiBaseUrl: env.API_BASE_URL,
                     devSecret: env.DEV_SECRET,
-                    appId: options.appName,
                 };
             }
             const handler = createDevAuthProxyHandler(proxyOptions);
@@ -316,7 +315,9 @@ export function bardiocApp(opts) {
         config(_config, env) {
             const isDev = env.command === 'serve';
             return {
-                base: isDev ? `/_apps/${manifestId}/` : './',
+                // Dev runs standalone without the host, so a root base avoids a
+                // base path in the Referer/Origin that the BFF may reject.
+                base: isDev ? '/' : './',
                 server: {
                     port,
                     allowedHosts: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/app-sdk",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "SDK for building apps for the Bardioc OS",
   "license": "MIT",
   "private": false,