@base44-preview/sdk 0.8.46-pr.277.118e9c8 → 0.8.46-pr.278.85a6f80

package/dist/client.js

@@ -5,7 +5,6 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
 import { createAiGatewayModule } from "./modules/ai-gateway.js";
@@ -261,8 +260,6 @@ export function createClient(config) {
     // Assemble and return the client
     const client = {
         ...userModules,
-        /** See {@link Base44Client.fetchWithAuth}. */
-        fetchWithAuth: createFetchWithAuth(axiosClient),
         /**
          * Sets a new authentication token for all subsequent requests.
          *

package/dist/client.types.d.ts

@@ -139,44 +139,6 @@ export interface Base44Client {
     integrations: IntegrationsModule;
     /** Cleanup function to disconnect WebSocket connections. Call when you're done with the client. */
     cleanup: () => void;
-    /**
-     * Calls one of your app's own server routes with the signed-in user's access token attached.
-     *
-     * Base44 keeps the user's access token in the browser's local storage, so a plain `fetch()` to your app's server routes arrives without it and the route sees an anonymous caller. `fetchWithAuth()` is the same `fetch()` with the `Authorization: Bearer <token>` header added, which is what lets a server route act on behalf of the signed-in user.
-     *
-     * Requests are restricted to your app's own origin so the token is never sent to a third party: pass a path such as `/api/orders`, not a full URL. An absolute URL, a protocol-relative path, or anything else that resolves to another origin throws. To call a Base44 backend function, use {@linkcode FunctionsModule.fetch | functions.fetch()}; for another origin, use plain `fetch()`.
-     *
-     * When no user is signed in the request is sent without an `Authorization` header, so routes that allow anonymous access keep working.
-     *
-     * This method is browser-only. In server code, read the caller's token from the incoming request instead.
-     *
-     * @param path - A path on your app's own origin, such as `/api/orders`.
-     * @param init - Optional [`RequestInit`](https://developer.mozilla.org/en-US/docs/Web/API/RequestInit) options such as `method`, `headers`, `body`, and `signal`. The auth header is added automatically; an `Authorization` header you set yourself is kept.
-     * @returns Promise resolving to a native [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response).
-     * @throws {Error} When `path` resolves to a different origin, or when called outside the browser.
-     *
-     * @example
-     * ```typescript
-     * // Call your app's own server route as the signed-in user
-     * const response = await base44.fetchWithAuth('/api/orders');
-     * const orders = await response.json();
-     * ```
-     *
-     * @example
-     * ```typescript
-     * // POST with a JSON body
-     * const response = await base44.fetchWithAuth('/api/orders', {
-     *   method: 'POST',
-     *   headers: { 'Content-Type': 'application/json' },
-     *   body: JSON.stringify({ productId: 'abc', quantity: 2 }),
-     * });
-     *
-     * if (!response.ok) {
-     *   throw new Error(`Request failed: ${response.status}`);
-     * }
-     * ```
-     */
-    fetchWithAuth(path: string, init?: RequestInit): Promise<Response>;
     /**
      * Sets a new authentication token for all subsequent requests.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.46-pr.277.118e9c8",
+  "version": "0.8.46-pr.278.85a6f80",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/utils/fetch-with-auth.d.ts

@@ -1,11 +0,0 @@
-import type { AxiosInstance } from "axios";
-/**
- * Builds the client's `fetchWithAuth`: a `fetch` that attaches the signed-in
- * user's access token, restricted to the app's own origin.
- *
- * @param axios - The user-scoped axios instance. Its `Authorization` default is
- * the live token: it follows `setToken()` and is deleted on `logout()`, so a
- * request never carries a token the user no longer has.
- * @internal
- */
-export declare function createFetchWithAuth(axios: AxiosInstance): (path: string, init?: RequestInit) => Promise<Response>;

package/dist/utils/fetch-with-auth.js

@@ -1,52 +0,0 @@
-/**
- * Builds the client's `fetchWithAuth`: a `fetch` that attaches the signed-in
- * user's access token, restricted to the app's own origin.
- *
- * @param axios - The user-scoped axios instance. Its `Authorization` default is
- * the live token: it follows `setToken()` and is deleted on `logout()`, so a
- * request never carries a token the user no longer has.
- * @internal
- */
-export function createFetchWithAuth(axios) {
-    const currentToken = () => {
-        const header = axios.defaults.headers.common["Authorization"];
-        if (typeof header !== "string" || !header.startsWith("Bearer ")) {
-            return null;
-        }
-        return header.slice("Bearer ".length) || null;
-    };
-    return async function fetchWithAuth(path, init = {}) {
-        const url = resolveSameOriginUrl(path);
-        const headers = new Headers(init.headers);
-        const token = currentToken();
-        if (token && !headers.has("Authorization")) {
-            headers.set("Authorization", `Bearer ${token}`);
-        }
-        return fetch(url, { ...init, headers });
-    };
-}
-function resolveSameOriginUrl(path) {
-    if (typeof path !== "string" || path === "") {
-        throw new Error("fetchWithAuth() requires a path, such as '/api/orders'.");
-    }
-    const location = typeof window !== "undefined" ? window.location : undefined;
-    if (!(location === null || location === void 0 ? void 0 : location.href)) {
-        throw new Error("fetchWithAuth() is only available in the browser. In server code, read the caller's token from the request instead — see createClientFromRequest().");
-    }
-    let pageUrl;
-    let resolved;
-    try {
-        pageUrl = new URL(location.href);
-        resolved = new URL(path, pageUrl);
-    }
-    catch (_a) {
-        throw new Error(`fetchWithAuth() received an invalid path: "${path}".`);
-    }
-    // Resolving before comparing is what makes this safe: a protocol-relative
-    // path ("//evil.example"), a backslash ("/\\evil.example") and an absolute URL
-    // all land on another origin here, and are rejected the same way.
-    if (resolved.origin !== pageUrl.origin) {
-        throw new Error(`fetchWithAuth() only sends requests to your app's own origin, so the access token never reaches a third party. "${path}" resolves to ${resolved.origin}. Use base44.functions.fetch() to call a Base44 backend function, or plain fetch() for another origin.`);
-    }
-    return resolved.toString();
-}