@doist/todoist-sdk 10.3.1 → 10.3.3

package/dist/cjs/clients/upload-client.js

@@ -7,6 +7,70 @@ const file_response_1 = require("../utils/file-response");
 const multipart_upload_1 = require("../utils/multipart-upload");
 const validators_1 = require("../utils/validators");
 const base_client_1 = require("./base-client");
+/**
+ * First-party origin that serves attachment downloads behind Bearer auth.
+ * It redirects to the CDN; on the cross-origin hop the runtime drops the
+ * Authorization header, so the token never reaches the CDN.
+ */
+const AUTHENTICATED_ATTACHMENT_HOST = 'files.todoist.com';
+/**
+ * CDN origins that serve attachments via pre-signed URLs. These are
+ * third-party infrastructure and must never receive the auth token.
+ */
+const CDN_ATTACHMENT_HOSTS = new Set(['todoist.b-cdn.net', 'd1ysz50cxb9zwl.cloudfront.net']);
+const MAX_ATTACHMENT_REDIRECTS = 5;
+/**
+ * Builds the request headers for an attachment fetch, attaching the Bearer
+ * token only when the URL is on the first-party authenticated host.
+ */
+function buildAttachmentAuthHeaders(url, authToken) {
+    return new URL(url).hostname === AUTHENTICATED_ATTACHMENT_HOST
+        ? { Authorization: `Bearer ${authToken}` }
+        : {};
+}
+/**
+ * Fetches an attachment through a caller-supplied `customFetch` while
+ * guaranteeing the auth token is never sent across origins.
+ *
+ * A `customFetch` is an arbitrary implementation that may not honour the Fetch
+ * standard's rule of stripping `Authorization` on cross-origin redirects (older
+ * `node-fetch`, for example, does not). Because `files.todoist.com` redirects
+ * downloads to the CDN, a naive implementation could forward the token there.
+ * We therefore drive redirects with `redirect: 'manual'` and follow them
+ * ourselves, dropping the auth header whenever the origin changes.
+ *
+ * Implementations that hide the redirect behind an opaque response (status `0`,
+ * e.g. undici and browsers) can't be followed manually; for those we re-issue
+ * with normal redirect following and rely on the Fetch standard's cross-origin
+ * auth stripping, which those runtimes implement.
+ */
+async function customFetchFollowingRedirects(customFetch, startUrl, authToken) {
+    let currentUrl = startUrl;
+    let headers = buildAttachmentAuthHeaders(currentUrl, authToken);
+    for (let redirects = 0; redirects < MAX_ATTACHMENT_REDIRECTS; redirects++) {
+        const response = await customFetch(currentUrl, {
+            method: 'GET',
+            headers,
+            redirect: 'manual',
+        });
+        const location = response.headers['location'];
+        const isReadableRedirect = response.status >= 300 && response.status < 400 && Boolean(location);
+        if (!isReadableRedirect) {
+            // Opaque redirect (the impl hid the Location, e.g. undici): re-issue
+            // with normal following and trust the runtime to strip auth cross-origin.
+            if (response.status === 0) {
+                return customFetch(currentUrl, { method: 'GET', headers });
+            }
+            return response;
+        }
+        const nextUrl = new URL(location, currentUrl);
+        if (nextUrl.origin !== new URL(currentUrl).origin) {
+            headers = {};
+        }
+        currentUrl = nextUrl.toString();
+    }
+    throw new Error('Too many redirects while fetching attachment');
+}
 /**
  * Internal sub-client handling upload + attachment endpoints
  * (file upload, upload delete, attachment view).
@@ -57,22 +121,30 @@ class UploadClient extends base_client_1.BaseClient {
             }
             fileUrl = commentOrUrl.fileAttachment.fileUrl;
         }
-        // Validate the URL belongs to Todoist to prevent leaking the auth token
+        // Only allow known attachment origins, and only attach the auth token to the
+        // first-party authenticated host. This prevents the token leaking to other
+        // todoist.com hosts (e.g. api.todoist.com) or to third-party CDN infrastructure.
         const urlHostname = new URL(fileUrl).hostname;
-        if (!urlHostname.endsWith('.todoist.com')) {
-            throw new Error('Attachment URLs must be on a todoist.com domain');
+        const isAuthenticatedHost = urlHostname === AUTHENTICATED_ATTACHMENT_HOST;
+        if (!isAuthenticatedHost && !CDN_ATTACHMENT_HOSTS.has(urlHostname)) {
+            throw new Error('Attachment URLs must be on a known Todoist attachment host');
         }
-        const fetchOptions = {
-            method: 'GET',
-            headers: { Authorization: `Bearer ${this.authToken}` },
-        };
         if (this.customFetch) {
-            const response = await this.customFetch(fileUrl, fetchOptions);
+            // customFetch may not strip auth on cross-origin redirects, so we
+            // follow the files.todoist.com -> CDN hop ourselves to avoid leaking
+            // the token. See customFetchFollowingRedirects for details.
+            const response = await customFetchFollowingRedirects(this.customFetch, fileUrl, this.authToken);
             if (!response.ok) {
                 throw new Error(`Failed to fetch attachment: ${response.status} ${response.statusText}`);
             }
             return (0, file_response_1.wrapAsFileResponse)(response, 'viewAttachment');
         }
+        // Built-in fetch (undici) strips Authorization on cross-origin redirects
+        // per the Fetch standard, so the files.todoist.com -> CDN hop is safe here.
+        const fetchOptions = {
+            method: 'GET',
+            headers: isAuthenticatedHost ? { Authorization: `Bearer ${this.authToken}` } : {},
+        };
         const response = await fetch(fileUrl, fetchOptions);
         if (!response.ok) {
             throw new Error(`Failed to fetch attachment: ${response.status} ${response.statusText}`);

package/dist/cjs/todoist-api.js

@@ -862,7 +862,7 @@ class TodoistApi {
      * @example
      * ```typescript
      * await api.deleteUpload({
-     *   fileUrl: 'https://cdn.todoist.com/...'
+     *   fileUrl: 'https://files.todoist.com/...'
      * })
      * ```
      */
@@ -876,9 +876,14 @@ class TodoistApi {
      * or a direct file URL string. Returns the raw Response object so the caller
      * can read the body in the appropriate format (.arrayBuffer(), .text(), etc.).
      *
+     * Only known Todoist attachment hosts are allowed: the authenticated
+     * `files.todoist.com` origin (which receives the Bearer token) and the
+     * attachment CDN origins (fetched without the token). Other URLs are rejected.
+     *
      * @param commentOrUrl - A Comment object with a file attachment, or a file URL string.
      * @returns The raw fetch Response for the file content.
-     * @throws Error if a Comment is provided without a file attachment or file URL.
+     * @throws Error if a Comment is provided without a file attachment or file URL,
+     *   or if the URL is not on a known Todoist attachment host.
      *
      * @example
      * ```typescript

package/dist/cjs/transport/http-dispatcher.js

@@ -68,6 +68,16 @@ async function createDefaultDispatcher() {
     // undici into their bundle. `getDefaultDispatcher` already short-circuits
     // outside Node, so this branch only runs when undici is safe to load.
     const { EnvHttpProxyAgent, interceptors } = await Promise.resolve().then(() => __importStar(require('undici')));
+    const agent = new EnvHttpProxyAgent(KEEP_ALIVE_OPTIONS);
+    // Some runtimes report `process.versions.node` (so `isNodeEnvironment()`
+    // passes) but ship only a partial undici: `interceptors.decompress` is
+    // absent and dispatchers have no `.compose`. Bun is the common case. There
+    // the proxy agent alone is enough — Bun's `fetch` decompresses
+    // gzip/deflate/br/zstd natively — so skip the interceptor instead of
+    // crashing on the missing API.
+    if (typeof interceptors.decompress !== 'function') {
+        return agent;
+    }
     // Compose the response-decompression interceptor so gzip/deflate/br/zstd
     // bodies are decoded before consumers parse them. Required on Node 24+:
     // attaching any custom dispatcher to the global `fetch` strips the
@@ -75,7 +85,7 @@ async function createDefaultDispatcher() {
     // so callers receive raw gzipped bytes and `JSON.parse` fails.
     // See https://github.com/Doist/todoist-cli/issues/318.
     const decompress = suppressExperimentalWarningsSync(() => interceptors.decompress());
-    return new EnvHttpProxyAgent(KEEP_ALIVE_OPTIONS).compose(decompress);
+    return agent.compose(decompress);
 }
 // undici emits an `ExperimentalWarning` the first time `interceptors.decompress()`
 // runs. The interceptor is stable for our gzipped-JSON-over-HTTPS use case;

package/dist/esm/clients/upload-client.js

@@ -4,6 +4,70 @@ import { wrapAsFileResponse } from '../utils/file-response.js';
 import { uploadMultipartFile } from '../utils/multipart-upload.js';
 import { validateAttachment } from '../utils/validators.js';
 import { BaseClient } from './base-client.js';
+/**
+ * First-party origin that serves attachment downloads behind Bearer auth.
+ * It redirects to the CDN; on the cross-origin hop the runtime drops the
+ * Authorization header, so the token never reaches the CDN.
+ */
+const AUTHENTICATED_ATTACHMENT_HOST = 'files.todoist.com';
+/**
+ * CDN origins that serve attachments via pre-signed URLs. These are
+ * third-party infrastructure and must never receive the auth token.
+ */
+const CDN_ATTACHMENT_HOSTS = new Set(['todoist.b-cdn.net', 'd1ysz50cxb9zwl.cloudfront.net']);
+const MAX_ATTACHMENT_REDIRECTS = 5;
+/**
+ * Builds the request headers for an attachment fetch, attaching the Bearer
+ * token only when the URL is on the first-party authenticated host.
+ */
+function buildAttachmentAuthHeaders(url, authToken) {
+    return new URL(url).hostname === AUTHENTICATED_ATTACHMENT_HOST
+        ? { Authorization: `Bearer ${authToken}` }
+        : {};
+}
+/**
+ * Fetches an attachment through a caller-supplied `customFetch` while
+ * guaranteeing the auth token is never sent across origins.
+ *
+ * A `customFetch` is an arbitrary implementation that may not honour the Fetch
+ * standard's rule of stripping `Authorization` on cross-origin redirects (older
+ * `node-fetch`, for example, does not). Because `files.todoist.com` redirects
+ * downloads to the CDN, a naive implementation could forward the token there.
+ * We therefore drive redirects with `redirect: 'manual'` and follow them
+ * ourselves, dropping the auth header whenever the origin changes.
+ *
+ * Implementations that hide the redirect behind an opaque response (status `0`,
+ * e.g. undici and browsers) can't be followed manually; for those we re-issue
+ * with normal redirect following and rely on the Fetch standard's cross-origin
+ * auth stripping, which those runtimes implement.
+ */
+async function customFetchFollowingRedirects(customFetch, startUrl, authToken) {
+    let currentUrl = startUrl;
+    let headers = buildAttachmentAuthHeaders(currentUrl, authToken);
+    for (let redirects = 0; redirects < MAX_ATTACHMENT_REDIRECTS; redirects++) {
+        const response = await customFetch(currentUrl, {
+            method: 'GET',
+            headers,
+            redirect: 'manual',
+        });
+        const location = response.headers['location'];
+        const isReadableRedirect = response.status >= 300 && response.status < 400 && Boolean(location);
+        if (!isReadableRedirect) {
+            // Opaque redirect (the impl hid the Location, e.g. undici): re-issue
+            // with normal following and trust the runtime to strip auth cross-origin.
+            if (response.status === 0) {
+                return customFetch(currentUrl, { method: 'GET', headers });
+            }
+            return response;
+        }
+        const nextUrl = new URL(location, currentUrl);
+        if (nextUrl.origin !== new URL(currentUrl).origin) {
+            headers = {};
+        }
+        currentUrl = nextUrl.toString();
+    }
+    throw new Error('Too many redirects while fetching attachment');
+}
 /**
  * Internal sub-client handling upload + attachment endpoints
  * (file upload, upload delete, attachment view).
@@ -54,22 +118,30 @@ export class UploadClient extends BaseClient {
             }
             fileUrl = commentOrUrl.fileAttachment.fileUrl;
         }
-        // Validate the URL belongs to Todoist to prevent leaking the auth token
+        // Only allow known attachment origins, and only attach the auth token to the
+        // first-party authenticated host. This prevents the token leaking to other
+        // todoist.com hosts (e.g. api.todoist.com) or to third-party CDN infrastructure.
         const urlHostname = new URL(fileUrl).hostname;
-        if (!urlHostname.endsWith('.todoist.com')) {
-            throw new Error('Attachment URLs must be on a todoist.com domain');
+        const isAuthenticatedHost = urlHostname === AUTHENTICATED_ATTACHMENT_HOST;
+        if (!isAuthenticatedHost && !CDN_ATTACHMENT_HOSTS.has(urlHostname)) {
+            throw new Error('Attachment URLs must be on a known Todoist attachment host');
         }
-        const fetchOptions = {
-            method: 'GET',
-            headers: { Authorization: `Bearer ${this.authToken}` },
-        };
         if (this.customFetch) {
-            const response = await this.customFetch(fileUrl, fetchOptions);
+            // customFetch may not strip auth on cross-origin redirects, so we
+            // follow the files.todoist.com -> CDN hop ourselves to avoid leaking
+            // the token. See customFetchFollowingRedirects for details.
+            const response = await customFetchFollowingRedirects(this.customFetch, fileUrl, this.authToken);
             if (!response.ok) {
                 throw new Error(`Failed to fetch attachment: ${response.status} ${response.statusText}`);
             }
             return wrapAsFileResponse(response, 'viewAttachment');
         }
+        // Built-in fetch (undici) strips Authorization on cross-origin redirects
+        // per the Fetch standard, so the files.todoist.com -> CDN hop is safe here.
+        const fetchOptions = {
+            method: 'GET',
+            headers: isAuthenticatedHost ? { Authorization: `Bearer ${this.authToken}` } : {},
+        };
         const response = await fetch(fileUrl, fetchOptions);
         if (!response.ok) {
             throw new Error(`Failed to fetch attachment: ${response.status} ${response.statusText}`);

package/dist/esm/todoist-api.js

@@ -859,7 +859,7 @@ export class TodoistApi {
      * @example
      * ```typescript
      * await api.deleteUpload({
-     *   fileUrl: 'https://cdn.todoist.com/...'
+     *   fileUrl: 'https://files.todoist.com/...'
      * })
      * ```
      */
@@ -873,9 +873,14 @@ export class TodoistApi {
      * or a direct file URL string. Returns the raw Response object so the caller
      * can read the body in the appropriate format (.arrayBuffer(), .text(), etc.).
      *
+     * Only known Todoist attachment hosts are allowed: the authenticated
+     * `files.todoist.com` origin (which receives the Bearer token) and the
+     * attachment CDN origins (fetched without the token). Other URLs are rejected.
+     *
      * @param commentOrUrl - A Comment object with a file attachment, or a file URL string.
      * @returns The raw fetch Response for the file content.
-     * @throws Error if a Comment is provided without a file attachment or file URL.
+     * @throws Error if a Comment is provided without a file attachment or file URL,
+     *   or if the URL is not on a known Todoist attachment host.
      *
      * @example
      * ```typescript

package/dist/esm/transport/http-dispatcher.js

@@ -30,6 +30,16 @@ async function createDefaultDispatcher() {
     // undici into their bundle. `getDefaultDispatcher` already short-circuits
     // outside Node, so this branch only runs when undici is safe to load.
     const { EnvHttpProxyAgent, interceptors } = await import('undici');
+    const agent = new EnvHttpProxyAgent(KEEP_ALIVE_OPTIONS);
+    // Some runtimes report `process.versions.node` (so `isNodeEnvironment()`
+    // passes) but ship only a partial undici: `interceptors.decompress` is
+    // absent and dispatchers have no `.compose`. Bun is the common case. There
+    // the proxy agent alone is enough — Bun's `fetch` decompresses
+    // gzip/deflate/br/zstd natively — so skip the interceptor instead of
+    // crashing on the missing API.
+    if (typeof interceptors.decompress !== 'function') {
+        return agent;
+    }
     // Compose the response-decompression interceptor so gzip/deflate/br/zstd
     // bodies are decoded before consumers parse them. Required on Node 24+:
     // attaching any custom dispatcher to the global `fetch` strips the
@@ -37,7 +47,7 @@ async function createDefaultDispatcher() {
     // so callers receive raw gzipped bytes and `JSON.parse` fails.
     // See https://github.com/Doist/todoist-cli/issues/318.
     const decompress = suppressExperimentalWarningsSync(() => interceptors.decompress());
-    return new EnvHttpProxyAgent(KEEP_ALIVE_OPTIONS).compose(decompress);
+    return agent.compose(decompress);
 }
 // undici emits an `ExperimentalWarning` the first time `interceptors.decompress()`
 // runs. The interceptor is stable for our gzipped-JSON-over-HTTPS use case;

package/dist/types/todoist-api.d.ts

@@ -722,7 +722,7 @@ export declare class TodoistApi {
      * @example
      * ```typescript
      * await api.deleteUpload({
-     *   fileUrl: 'https://cdn.todoist.com/...'
+     *   fileUrl: 'https://files.todoist.com/...'
      * })
      * ```
      */
@@ -734,9 +734,14 @@ export declare class TodoistApi {
      * or a direct file URL string. Returns the raw Response object so the caller
      * can read the body in the appropriate format (.arrayBuffer(), .text(), etc.).
      *
+     * Only known Todoist attachment hosts are allowed: the authenticated
+     * `files.todoist.com` origin (which receives the Bearer token) and the
+     * attachment CDN origins (fetched without the token). Other URLs are rejected.
+     *
      * @param commentOrUrl - A Comment object with a file attachment, or a file URL string.
      * @returns The raw fetch Response for the file content.
-     * @throws Error if a Comment is provided without a file attachment or file URL.
+     * @throws Error if a Comment is provided without a file attachment or file URL,
+     *   or if the URL is not on a known Todoist attachment host.
      *
      * @example
      * ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@doist/todoist-sdk",
-    "version": "10.3.1",
+    "version": "10.3.3",
     "description": "The official TypeScript SDK for the Todoist REST API.",
     "author": "Doist developers",
     "repository": "https://github.com/Doist/todoist-sdk-typescript",