@bardioc/app-sdk 0.4.6 → 0.4.8

package/dist/dev-proxy.d.ts

@@ -4,8 +4,6 @@ export interface DevAuthProxyOptions {
     apiBaseUrl: string;
     /** Dev secret copied from the backend. */
     devSecret: string;
-    /** App slug stamped as `X-App-ID`, mirroring how the host identifies iframe apps. */
-    appId?: string;
     /** Optional CORS origin (e.g. `*`). */
     allowOrigin?: string;
 }

package/dist/dev-proxy.js

@@ -31,9 +31,19 @@ function addDevSecretHeader(req, headers, devSecret) {
     }
     return headers;
 }
+// The BFF answers a bare 403 for any Origin outside its CORS allow-list, which no
+// localhost dev server is in. Dropping Origin makes it a non-CORS request, and the
+// dev-secret check then still passes via its Referer localhost fallback.
+function dropOriginKeepReferer(headers) {
+    const origin = headers.get('Origin');
+    if (origin && !headers.has('Referer')) {
+        headers.set('Referer', `${origin}/`);
+    }
+    headers.delete('Origin');
+}
 export function createDevAuthProxyHandler(options) {
     const apiBaseUrl = normalizeApiBaseUrl(options.apiBaseUrl);
-    const { devSecret, allowOrigin, appId } = options;
+    const { devSecret, allowOrigin } = options;
     return async (req, res) => {
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         if (req.method === 'OPTIONS') {
@@ -49,8 +59,8 @@ export function createDevAuthProxyHandler(options) {
         const upstreamPath = url.pathname.slice('/rest'.length) + url.search;
         const upstreamUrl = `${apiBaseUrl}${upstreamPath}`;
         const headers = new Headers();
-        // Forward headers from the browser so the BFF sees the same request the host would relay
-        // (cookies, origin, referer, etc.). Skip hop-by-hop headers; fetch sets Host from the URL.
+        // Forward headers from the browser so the BFF sees the same request the host would
+        // relay (cookies, referer, etc.). Skip hop-by-hop headers; fetch sets Host from the URL.
         const skipHeaders = new Set([
             'connection',
             'content-length',
@@ -74,11 +84,10 @@ export function createDevAuthProxyHandler(options) {
             }
         }
         addDevSecretHeader(req, headers, devSecret);
-        // The host stamps X-App-ID from its own registration data, never from the app — the
-        // dev proxy does the same with the configured app slug.
-        if (appId) {
-            headers.set('X-App-ID', appId);
-        }
+        dropOriginKeepReferer(headers);
+        // Dev auth is dev-secret only: never forward X-App-Id, so the BFF app-token
+        // exchange (which would also demand X-Scope-ID) can never be triggered here.
+        headers.delete('X-App-Id');
         // BFF rejects /bardioc/ calls without this CSRF marker header; stamp it like the host does.
         headers.set('X-Requested-With', 'XMLHttpRequest');
         let body;

package/dist/vite.js

@@ -260,7 +260,6 @@ export function bardiocDevAuth(options) {
                 proxyOptions = {
                     apiBaseUrl: env.API_BASE_URL,
                     devSecret: env.DEV_SECRET,
-                    appId: options.appName,
                 };
             }
             const handler = createDevAuthProxyHandler(proxyOptions);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/app-sdk",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "SDK for building apps for the Bardioc OS",
   "license": "MIT",
   "private": false,