@controleonline/ui-common 1.2.104 → 1.2.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@controleonline/ui-common",
-  "version": "1.2.104",
+  "version": "1.2.105",
   "author": "ControleOnline",
   "description": "ControleOnline Common Quasar UI Component",
   "license": "MIT",

package/src/react/utils/fileUrl.js

@@ -1,5 +1,5 @@
 import {env as APP_ENV} from '@env';
-import {filterApiHeaders} from '../../utils/trustedApiUrl';
+import {filterApiHeaders, isTrustedApiUrl} from '../../utils/trustedApiUrl';
 import {buildAssetUrl} from '@controleonline/../../src/styles/branding';
 import {
   resolveAppDomain,
@@ -79,16 +79,11 @@ const ensureAbsoluteUrl = url => {
 const resolveDownloadHost = ({company = null, appDomain = ''} = {}) => {
   const fallbackDomain =
     normalizeText(appDomain) || resolveAppDomain(APP_ENV?.DOMAIN);
-  return resolveCompanyDomain(company, fallbackDomain);
+  const companyDomain = resolveCompanyDomain(company, fallbackDomain);
+  // FileService may return the API authority instead of an application domain.
+  return isApiEntrypointHost(companyDomain) ? fallbackDomain : companyDomain;
 };
 
-/**
- * Environment / platform hosts (staging, dev, localhost) are not tenant domains.
- * Injecting them into /{host}/files/{id}/download produces URLs like
- * https://s.controleonline.com/staging.controleonline.com/files/... → 403.
- * Keep app-domain header only; do not path-inject environment hosts.
- * app-community#432
- */
 const resolveApiEntrypointHost = () => {
   const entry = normalizeText(APP_ENV?.API_ENTRYPOINT);
   if (!entry) {
@@ -216,11 +211,10 @@ const buildTenantDownloadUrl = (url, host) => {
     return absoluteUrl;
   }
 
-  // Do not path-inject environment/platform hosts (app-community#432).
-  // Bare /files/{id}/download remains for staging/manager/dev; tenant hosts
-  // (erp.jaguncos.com.br, loja..., etc.) still get /{appDomain}/files/... .
-  // Never path-inject the API entrypoint host (app-community#1160).
-  if (isEnvironmentLikeHost(normalizedHost) || isApiEntrypointHost(normalizedHost)) {
+  // Public file routes require the application domain, including registered
+  // staging/dev/platform domains. Never use the API authority as that domain.
+  if (isApiEntrypointHost(normalizedHost) ||
+      !isTrustedApiUrl(absoluteUrl, APP_ENV?.API_ENTRYPOINT)) {
     return absoluteUrl;
   }
 
@@ -377,8 +371,11 @@ const resolveFileSource = (
       isDownloadLikeUrl(normalizedFile?.uri) ||
       isDownloadLikeUrl(normalizedFile?.url) ||
       isDownloadLikeUrl(normalizedFile?.path);
+    const rawUrl = normalizedFile.url || normalizedFile.path || normalizedFile.uri;
+    // Relative backend paths belong to API_ENTRYPOINT. File.domain selects the
+    // route's tenant segment, not a new server origin.
     const uriBase =
-      directUrl ||
+      (isDownloadLikeUrl(rawUrl) ? rawUrl : directUrl) ||
       (fileId ? buildBackendDownloadUrl(fileId, {company, appDomain}) : '');
 
     if (!uriBase) {

package/src/tests/react/utils/fileUrl.test.js

@@ -14,6 +14,28 @@ const {
 } = require('../../../react/utils/fileUrl');
 
 describe('fileUrl helpers', () => {
+  it.each([
+    'staging.controleonline.com', 'dev.controleonline.com',
+    'admin.controleonline.com', 'manager.controleonline.com',
+    'pos.lave-go.com', 'shop.lave-go.com', 'delivery.controleonline.com',
+    'crm.controleonline.com', 'ppc.controleonline.com', 'service.controleonline.com',
+    'localhost:8081',
+  ])('resolves shared file shapes on the application route for %s', appDomain => {
+    for (const file of [6042, '/files/6042', '/files/6042/download',
+      {id: 6042, domain: 'api.controleonline.com', url: '/api.controleonline.com/files/6042/download'},
+      {file: {id: 6042, url: '/files/6042/download'}}]) {
+      const source = resolveDefaultFileSource(file, {appDomain, headers: {'API-TOKEN': 'session'}});
+      expect(source.uri).toBe(`https://api.controleonline.com/${encodeURIComponent(appDomain)}/files/6042/download`);
+      expect(source.headers).toEqual({'API-TOKEN': 'session', 'app-domain': appDomain});
+    }
+  });
+
+  it('preserves URL parameters and fragments while replacing an infrastructure prefix', () => {
+    expect(resolveFileImageUrl('/api.controleonline.com/files/6042/download?size=48&app-domain=old#image', {
+      appDomain: 'staging.controleonline.com',
+    })).toBe('https://api.controleonline.com/staging.controleonline.com/files/6042/download?size=48#image');
+  });
+
   it('uses path app-domain for backend download urls and keeps headers', () => {
     const company = {
       domain: 'maincompany.controleonline.com',
@@ -108,6 +130,7 @@ describe('file authentication origin boundary', () => {
       expect(source.headers).not.toHaveProperty('Authorization');
       expect(source.headers).not.toHaveProperty('App-Domain');
       expect(source.headers.Accept).toBe('image/*');
+      expect(source.uri).toBe(uri);
     }
   });
   it('preserves authentication on the configured API download', () => {