@base44-preview/sdk 0.8.46-pr.277.118e9c8 → 0.8.46-pr.277.5cc15f3

package/dist/client.types.d.ts

@@ -144,16 +144,16 @@ export interface Base44Client {
      *
      * Base44 keeps the user's access token in the browser's local storage, so a plain `fetch()` to your app's server routes arrives without it and the route sees an anonymous caller. `fetchWithAuth()` is the same `fetch()` with the `Authorization: Bearer <token>` header added, which is what lets a server route act on behalf of the signed-in user.
      *
-     * Requests are restricted to your app's own origin so the token is never sent to a third party: pass a path such as `/api/orders`, not a full URL. An absolute URL, a protocol-relative path, or anything else that resolves to another origin throws. To call a Base44 backend function, use {@linkcode FunctionsModule.fetch | functions.fetch()}; for another origin, use plain `fetch()`.
+     * Requests are restricted to your app's own origin so the token is never sent to a third party: pass a relative path beginning with a single `/`, such as `/api/orders`. An absolute URL, a protocol-relative `//host`, or anything else that a URL parser would read as another origin throws. To call a Base44 backend function, use {@linkcode FunctionsModule.fetch | functions.fetch()}; for another origin, use plain `fetch()`.
      *
-     * When no user is signed in the request is sent without an `Authorization` header, so routes that allow anonymous access keep working.
+     * The path is passed to `fetch` unchanged, so this also works in server code, where the runtime's `fetch` decides what a relative path means — a server-side client from {@linkcode createClientFromRequest | createClientFromRequest()} carries the caller's own token. Note that only the `Authorization` header is added: a route that builds its own client from the incoming request also needs the platform's `Base44-App-Id` and `Base44-Api-Url`, which a request you construct yourself does not have.
      *
-     * This method is browser-only. In server code, read the caller's token from the incoming request instead.
+     * When no user is signed in the request is sent without an `Authorization` header, so routes that allow anonymous access keep working.
      *
-     * @param path - A path on your app's own origin, such as `/api/orders`.
+     * @param path - A relative path on your app's own origin, such as `/api/orders`.
      * @param init - Optional [`RequestInit`](https://developer.mozilla.org/en-US/docs/Web/API/RequestInit) options such as `method`, `headers`, `body`, and `signal`. The auth header is added automatically; an `Authorization` header you set yourself is kept.
      * @returns Promise resolving to a native [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response).
-     * @throws {Error} When `path` resolves to a different origin, or when called outside the browser.
+     * @throws {Error} When `path` is not a relative path on your app's own origin.
      *
      * @example
      * ```typescript

package/dist/utils/fetch-with-auth.d.ts

@@ -1,11 +1,12 @@
 import type { AxiosInstance } from "axios";
 /**
  * Builds the client's `fetchWithAuth`: a `fetch` that attaches the signed-in
- * user's access token, restricted to the app's own origin.
+ * user's access token to a request for the app's own origin.
  *
  * @param axios - The user-scoped axios instance. Its `Authorization` default is
  * the live token: it follows `setToken()` and is deleted on `logout()`, so a
- * request never carries a token the user no longer has.
+ * request never carries a token the user no longer has. In a server-side client
+ * from `createClientFromRequest()` it holds the caller's own token.
  * @internal
  */
 export declare function createFetchWithAuth(axios: AxiosInstance): (path: string, init?: RequestInit) => Promise<Response>;

package/dist/utils/fetch-with-auth.js

@@ -1,10 +1,11 @@
 /**
  * Builds the client's `fetchWithAuth`: a `fetch` that attaches the signed-in
- * user's access token, restricted to the app's own origin.
+ * user's access token to a request for the app's own origin.
  *
  * @param axios - The user-scoped axios instance. Its `Authorization` default is
  * the live token: it follows `setToken()` and is deleted on `logout()`, so a
- * request never carries a token the user no longer has.
+ * request never carries a token the user no longer has. In a server-side client
+ * from `createClientFromRequest()` it holds the caller's own token.
  * @internal
  */
 export function createFetchWithAuth(axios) {
@@ -16,37 +17,33 @@ export function createFetchWithAuth(axios) {
         return header.slice("Bearer ".length) || null;
     };
     return async function fetchWithAuth(path, init = {}) {
-        const url = resolveSameOriginUrl(path);
+        assertOwnOriginPath(path);
         const headers = new Headers(init.headers);
         const token = currentToken();
         if (token && !headers.has("Authorization")) {
             headers.set("Authorization", `Bearer ${token}`);
         }
-        return fetch(url, { ...init, headers });
+        // Passed through untouched: resolving it here would need a document, and a
+        // root-relative path is already what a runtime that dispatches in-process
+        // (Nitro's `fetch`) expects.
+        return fetch(path, { ...init, headers });
     };
 }
-function resolveSameOriginUrl(path) {
+function assertOwnOriginPath(path) {
     if (typeof path !== "string" || path === "") {
         throw new Error("fetchWithAuth() requires a path, such as '/api/orders'.");
     }
-    const location = typeof window !== "undefined" ? window.location : undefined;
-    if (!(location === null || location === void 0 ? void 0 : location.href)) {
-        throw new Error("fetchWithAuth() is only available in the browser. In server code, read the caller's token from the request instead — see createClientFromRequest().");
+    // Check what a URL parser would see, not the raw string: it drops every ASCII
+    // tab/newline anywhere in the input and trims leading C0/space, so
+    // "/<tab>/evil.example" would pass a naive prefix check and then resolve to
+    // another host.
+    const asParsed = path.replace(/[\t\n\r]/g, "").replace(/^[\x00-\x20]+/, "");
+    // One leading slash is the whole rule: it cannot carry a scheme, and it rules
+    // out the two forms that reach another origin — "//host" and, since URL
+    // parsing treats a backslash as a slash, "/\host".
+    if (!asParsed.startsWith("/") ||
+        asParsed.startsWith("//") ||
+        asParsed.startsWith("/\\")) {
+        throw new Error(`fetchWithAuth() only sends requests to your app's own origin, so the access token never reaches a third party. "${path}" is not a path on it — pass a relative path such as '/api/orders'. Use base44.functions.fetch() to call a Base44 backend function, or plain fetch() for another origin.`);
     }
-    let pageUrl;
-    let resolved;
-    try {
-        pageUrl = new URL(location.href);
-        resolved = new URL(path, pageUrl);
-    }
-    catch (_a) {
-        throw new Error(`fetchWithAuth() received an invalid path: "${path}".`);
-    }
-    // Resolving before comparing is what makes this safe: a protocol-relative
-    // path ("//evil.example"), a backslash ("/\\evil.example") and an absolute URL
-    // all land on another origin here, and are rejected the same way.
-    if (resolved.origin !== pageUrl.origin) {
-        throw new Error(`fetchWithAuth() only sends requests to your app's own origin, so the access token never reaches a third party. "${path}" resolves to ${resolved.origin}. Use base44.functions.fetch() to call a Base44 backend function, or plain fetch() for another origin.`);
-    }
-    return resolved.toString();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.46-pr.277.118e9c8",
+  "version": "0.8.46-pr.277.5cc15f3",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",