@base44-preview/sdk 0.8.46-pr.277.5cc15f3 → 0.8.46-pr.278.d5b4fe4

package/dist/client.js

@@ -5,7 +5,6 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
 import { createAiGatewayModule } from "./modules/ai-gateway.js";
@@ -261,8 +260,6 @@ export function createClient(config) {
     // Assemble and return the client
     const client = {
         ...userModules,
-        /** See {@link Base44Client.fetchWithAuth}. */
-        fetchWithAuth: createFetchWithAuth(axiosClient),
         /**
          * Sets a new authentication token for all subsequent requests.
          *

package/dist/client.types.d.ts

@@ -139,44 +139,6 @@ export interface Base44Client {
     integrations: IntegrationsModule;
     /** Cleanup function to disconnect WebSocket connections. Call when you're done with the client. */
     cleanup: () => void;
-    /**
-     * Calls one of your app's own server routes with the signed-in user's access token attached.
-     *
-     * Base44 keeps the user's access token in the browser's local storage, so a plain `fetch()` to your app's server routes arrives without it and the route sees an anonymous caller. `fetchWithAuth()` is the same `fetch()` with the `Authorization: Bearer <token>` header added, which is what lets a server route act on behalf of the signed-in user.
-     *
-     * Requests are restricted to your app's own origin so the token is never sent to a third party: pass a relative path beginning with a single `/`, such as `/api/orders`. An absolute URL, a protocol-relative `//host`, or anything else that a URL parser would read as another origin throws. To call a Base44 backend function, use {@linkcode FunctionsModule.fetch | functions.fetch()}; for another origin, use plain `fetch()`.
-     *
-     * The path is passed to `fetch` unchanged, so this also works in server code, where the runtime's `fetch` decides what a relative path means — a server-side client from {@linkcode createClientFromRequest | createClientFromRequest()} carries the caller's own token. Note that only the `Authorization` header is added: a route that builds its own client from the incoming request also needs the platform's `Base44-App-Id` and `Base44-Api-Url`, which a request you construct yourself does not have.
-     *
-     * When no user is signed in the request is sent without an `Authorization` header, so routes that allow anonymous access keep working.
-     *
-     * @param path - A relative path on your app's own origin, such as `/api/orders`.
-     * @param init - Optional [`RequestInit`](https://developer.mozilla.org/en-US/docs/Web/API/RequestInit) options such as `method`, `headers`, `body`, and `signal`. The auth header is added automatically; an `Authorization` header you set yourself is kept.
-     * @returns Promise resolving to a native [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response).
-     * @throws {Error} When `path` is not a relative path on your app's own origin.
-     *
-     * @example
-     * ```typescript
-     * // Call your app's own server route as the signed-in user
-     * const response = await base44.fetchWithAuth('/api/orders');
-     * const orders = await response.json();
-     * ```
-     *
-     * @example
-     * ```typescript
-     * // POST with a JSON body
-     * const response = await base44.fetchWithAuth('/api/orders', {
-     *   method: 'POST',
-     *   headers: { 'Content-Type': 'application/json' },
-     *   body: JSON.stringify({ productId: 'abc', quantity: 2 }),
-     * });
-     *
-     * if (!response.ok) {
-     *   throw new Error(`Request failed: ${response.status}`);
-     * }
-     * ```
-     */
-    fetchWithAuth(path: string, init?: RequestInit): Promise<Response>;
     /**
      * Sets a new authentication token for all subsequent requests.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.46-pr.277.5cc15f3",
+  "version": "0.8.46-pr.278.d5b4fe4",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/utils/fetch-with-auth.d.ts

@@ -1,12 +0,0 @@
-import type { AxiosInstance } from "axios";
-/**
- * Builds the client's `fetchWithAuth`: a `fetch` that attaches the signed-in
- * user's access token to a request for the app's own origin.
- *
- * @param axios - The user-scoped axios instance. Its `Authorization` default is
- * the live token: it follows `setToken()` and is deleted on `logout()`, so a
- * request never carries a token the user no longer has. In a server-side client
- * from `createClientFromRequest()` it holds the caller's own token.
- * @internal
- */
-export declare function createFetchWithAuth(axios: AxiosInstance): (path: string, init?: RequestInit) => Promise<Response>;

package/dist/utils/fetch-with-auth.js

@@ -1,49 +0,0 @@
-/**
- * Builds the client's `fetchWithAuth`: a `fetch` that attaches the signed-in
- * user's access token to a request for the app's own origin.
- *
- * @param axios - The user-scoped axios instance. Its `Authorization` default is
- * the live token: it follows `setToken()` and is deleted on `logout()`, so a
- * request never carries a token the user no longer has. In a server-side client
- * from `createClientFromRequest()` it holds the caller's own token.
- * @internal
- */
-export function createFetchWithAuth(axios) {
-    const currentToken = () => {
-        const header = axios.defaults.headers.common["Authorization"];
-        if (typeof header !== "string" || !header.startsWith("Bearer ")) {
-            return null;
-        }
-        return header.slice("Bearer ".length) || null;
-    };
-    return async function fetchWithAuth(path, init = {}) {
-        assertOwnOriginPath(path);
-        const headers = new Headers(init.headers);
-        const token = currentToken();
-        if (token && !headers.has("Authorization")) {
-            headers.set("Authorization", `Bearer ${token}`);
-        }
-        // Passed through untouched: resolving it here would need a document, and a
-        // root-relative path is already what a runtime that dispatches in-process
-        // (Nitro's `fetch`) expects.
-        return fetch(path, { ...init, headers });
-    };
-}
-function assertOwnOriginPath(path) {
-    if (typeof path !== "string" || path === "") {
-        throw new Error("fetchWithAuth() requires a path, such as '/api/orders'.");
-    }
-    // Check what a URL parser would see, not the raw string: it drops every ASCII
-    // tab/newline anywhere in the input and trims leading C0/space, so
-    // "/<tab>/evil.example" would pass a naive prefix check and then resolve to
-    // another host.
-    const asParsed = path.replace(/[\t\n\r]/g, "").replace(/^[\x00-\x20]+/, "");
-    // One leading slash is the whole rule: it cannot carry a scheme, and it rules
-    // out the two forms that reach another origin — "//host" and, since URL
-    // parsing treats a backslash as a slash, "/\host".
-    if (!asParsed.startsWith("/") ||
-        asParsed.startsWith("//") ||
-        asParsed.startsWith("/\\")) {
-        throw new Error(`fetchWithAuth() only sends requests to your app's own origin, so the access token never reaches a third party. "${path}" is not a path on it — pass a relative path such as '/api/orders'. Use base44.functions.fetch() to call a Base44 backend function, or plain fetch() for another origin.`);
-    }
-}