@deliverart/sdk-js-core 2.35.2 → 2.35.3-dev.0

package/dist/index.cjs

@@ -480,6 +480,13 @@ function isFormDataInstance(input2) {
   return typeof FormData === "function" && typeof input2 === "object" && input2 !== null && input2 instanceof FormData;
 }
 function createApiClient(config) {
+  const baseUrl = new URL(config.baseUrl);
+  const assertDestination = (url) => {
+    if (!["http:", "https:"].includes(url.protocol) || url.origin !== baseUrl.origin || url.username || url.password) {
+      throw new Error("API requests must target the configured origin without URL credentials");
+    }
+  };
+  assertDestination(baseUrl);
   const requestMiddlewares = [];
   const responseMiddlewares = [];
   const base = {
@@ -494,7 +501,8 @@ function createApiClient(config) {
       const input2 = request.validateInput();
       const query = request.validateQuery();
       const headers = request.validateHeaders();
-      const url = new URL(request.getPath(), config.baseUrl);
+      const url = new URL(request.getPath(), baseUrl);
+      assertDestination(url);
       const queryParams = { ...query || {} };
       if (options?.pagination === false) {
         queryParams.pagination = false;
@@ -537,7 +545,8 @@ function createApiClient(config) {
       for (const middleware of requestMiddlewares) {
         ctx = await middleware(ctx);
       }
-      let response = await fetch(ctx.url.toString(), ctx.init);
+      assertDestination(ctx.url);
+      let response = await fetch(ctx.url.toString(), { ...ctx.init, redirect: "error" });
       let contentType = response.headers.get("Content-Type") ?? "";
       let parsedBody;
       if (response.status === 204) {

package/dist/index.js

@@ -438,6 +438,13 @@ function isFormDataInstance(input2) {
   return typeof FormData === "function" && typeof input2 === "object" && input2 !== null && input2 instanceof FormData;
 }
 function createApiClient(config) {
+  const baseUrl = new URL(config.baseUrl);
+  const assertDestination = (url) => {
+    if (!["http:", "https:"].includes(url.protocol) || url.origin !== baseUrl.origin || url.username || url.password) {
+      throw new Error("API requests must target the configured origin without URL credentials");
+    }
+  };
+  assertDestination(baseUrl);
   const requestMiddlewares = [];
   const responseMiddlewares = [];
   const base = {
@@ -452,7 +459,8 @@ function createApiClient(config) {
       const input2 = request.validateInput();
       const query = request.validateQuery();
       const headers = request.validateHeaders();
-      const url = new URL(request.getPath(), config.baseUrl);
+      const url = new URL(request.getPath(), baseUrl);
+      assertDestination(url);
       const queryParams = { ...query || {} };
       if (options?.pagination === false) {
         queryParams.pagination = false;
@@ -495,7 +503,8 @@ function createApiClient(config) {
       for (const middleware of requestMiddlewares) {
         ctx = await middleware(ctx);
       }
-      let response = await fetch(ctx.url.toString(), ctx.init);
+      assertDestination(ctx.url);
+      let response = await fetch(ctx.url.toString(), { ...ctx.init, redirect: "error" });
       let contentType = response.headers.get("Content-Type") ?? "";
       let parsedBody;
       if (response.status === 204) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deliverart/sdk-js-core",
   "description": "Core SDK for DeliverArt, providing essential functionalities and utilities.",
-  "version": "2.35.2",
+  "version": "2.35.3-dev.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -21,15 +21,17 @@
     "access": "public"
   },
   "dependencies": {
-    "qs": "6.15.3",
+    "qs": "6.16.0",
     "zod": "4.3.5"
   },
   "devDependencies": {
-    "@types/qs": "^6.14.0",
-    "@deliverart/sdk-js-global-types": "2.35.2"
+    "@types/qs": "^6.15.1",
+    "vitest": "4.1.11",
+    "@deliverart/sdk-js-global-types": "2.35.3-dev.0"
   },
   "scripts": {
     "build": "tsup src/index.ts --dts --format esm,cjs",
-    "dev": "tsup src/index.ts --dts --watch"
+    "dev": "tsup src/index.ts --dts --watch",
+    "test": "vitest run"
   }
 }