@base44-preview/sdk 0.8.51-pr.294.a7ae332 → 0.8.52-pr.295.572d9e6

package/dist/modules/functions.js

@@ -61,7 +61,10 @@ export function createFunctionsModule(axios, appId, config) {
                 formData = data;
                 contentType = "application/json";
             }
-            return axios.post(`/apps/${appId}/functions/${functionName}`, formData || data, { headers: { "Content-Type": contentType } });
+            // Return only the response fields: the axios response also carries the
+            // request config and raw request, both of which hold the auth headers.
+            const { data: responseData, status, statusText, headers } = await axios.post(`/apps/${appId}/functions/${functionName}`, formData || data, { headers: { "Content-Type": contentType } });
+            return { data: responseData, status, statusText, headers };
         },
         // Fetch a backend function endpoint directly.
         async fetch(path, init = {}) {

package/dist/modules/functions.types.d.ts

@@ -59,7 +59,7 @@ export interface FunctionsModule {
      *
      * @param functionName - The name of the function to invoke.
      * @param data - An object containing named parameters for the function.
-     * @returns Promise resolving to the function's response. The `data` property contains the data returned by the function, if there is any.
+     * @returns Promise resolving to the function's response, with `data`, `status`, `statusText`, and `headers` properties. The `data` property contains the data returned by the function, if there is any. The request config isn't included, since it holds the auth headers.
      *
      * @example
      * ```typescript

package/dist/utils/axios-client.js

@@ -1,4 +1,4 @@
-import axios from "axios";
+import axios, { AxiosHeaders } from "axios";
 import { isInIFrame } from "./common.js";
 import { v4 as uuidv4 } from "uuid";
 import { getAnalyticsSessionId } from "../modules/analytics.js";
@@ -101,6 +101,134 @@ function safeErrorLog(prefix, error) {
         console.error(`${prefix} ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+const REDACTED = "[REDACTED]";
+const CREDENTIAL_HEADERS = [
+    "Authorization",
+    "on-behalf-of",
+    "Base44-Service-Authorization",
+    // Signed proof that the caller passed the IP allowlist; replayable if logged.
+    "Base44-State",
+];
+// Request body fields that hold secrets (see the bodies built in modules/auth.ts).
+const SECRET_BODY_KEYS = new Set([
+    "password",
+    "current_password",
+    "new_password",
+    "reset_token",
+    "turnstile_token",
+    "otp_code",
+    "access_token",
+    "refresh_token",
+    "token",
+]);
+/**
+ * Returns a copy of request headers with credential values replaced.
+ *
+ * @param headers - The request's headers, left unchanged
+ * @returns A new AxiosHeaders instance
+ * @internal
+ */
+function redactHeaders(headers) {
+    // Not `AxiosHeaders.from`, which returns an AxiosHeaders argument as-is.
+    const copy = new AxiosHeaders(headers);
+    for (const name of CREDENTIAL_HEADERS) {
+        if (copy.has(name)) {
+            copy.set(name, REDACTED);
+        }
+    }
+    return copy;
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+function redactSecretKeys(value, seen) {
+    if (Array.isArray(value)) {
+        if (seen.has(value))
+            return value;
+        seen.add(value);
+        return value.map((item) => redactSecretKeys(item, seen));
+    }
+    if (!isPlainObject(value) || seen.has(value))
+        return value;
+    seen.add(value);
+    const copy = {};
+    for (const [key, item] of Object.entries(value)) {
+        copy[key] = SECRET_BODY_KEYS.has(key.toLowerCase())
+            ? REDACTED
+            : redactSecretKeys(item, seen);
+    }
+    return copy;
+}
+/**
+ * Returns a copy of a request body with secret fields replaced.
+ *
+ * Handles both a serialized JSON string (the usual case by the time a request
+ * has been sent) and a plain object. Other bodies, such as `FormData`, are
+ * returned unchanged.
+ *
+ * @param data - The request body, left unchanged
+ * @returns The redacted body
+ * @internal
+ */
+function redactBody(data) {
+    if (typeof data === "string") {
+        let parsed;
+        try {
+            parsed = JSON.parse(data);
+        }
+        catch (_a) {
+            return data;
+        }
+        return typeof parsed === "object" && parsed !== null
+            ? JSON.stringify(redactSecretKeys(parsed, new WeakSet()))
+            : data;
+    }
+    return redactSecretKeys(data, new WeakSet());
+}
+/**
+ * Removes credentials from a failed request's error before app code sees it.
+ *
+ * An axios error carries its request config and the raw Node request, so
+ * logging it (for example `console.log(error)`) printed the bearer token.
+ * The config is replaced with a redacted copy, so the object axios sent is not
+ * changed, and the raw request is removed.
+ *
+ * Never throws: a failure here must not replace the original error.
+ *
+ * @param error - The rejection value to scrub
+ * @internal
+ */
+function sanitizeError(error) {
+    var _a;
+    if (!error || typeof error !== "object")
+        return;
+    try {
+        const target = error;
+        const config = target.config;
+        if (config && typeof config === "object") {
+            const redactedConfig = {
+                ...config,
+                headers: redactHeaders(config.headers),
+                data: redactBody(config.data),
+            };
+            target.config = redactedConfig;
+            if (((_a = target.response) === null || _a === void 0 ? void 0 : _a.config) === config) {
+                target.response.config = redactedConfig;
+            }
+        }
+        // The Node request object also holds the raw header block (`_header`).
+        delete target.request;
+        if (target.response && typeof target.response === "object") {
+            delete target.response.request;
+        }
+    }
+    catch (_b) {
+        /* leave the error as it is */
+    }
+}
 /**
  * Creates an axios client with default configuration and interceptors.
  *
@@ -128,6 +256,11 @@ export function createAxiosClient({ baseURL, headers = {}, token, interceptRespo
     if (token) {
         client.defaults.headers.common["Authorization"] = `Bearer ${token}`;
     }
+    // Registered first so it also covers clients that skip the Base44Error wrapper.
+    client.interceptors.response.use(undefined, (error) => {
+        sanitizeError(error);
+        return Promise.reject(error);
+    });
     // Add origin URL in browser environment
     client.interceptors.request.use((config) => {
         // `window.location` is absent on React Native (where `window` still exists),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.51-pr.294.a7ae332",
+  "version": "0.8.52-pr.295.572d9e6",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",