@haddowg/json-api-client 1.2.0 → 1.3.1

package/dist/ajv.d.cts

@@ -1,4 +1,4 @@
-import { a as Validator, n as SchemaMap } from "./validate-DgCUbzgT.cjs";
+import { a as Validator, n as SchemaMap } from "./validate-B98ghVgw.cjs";
 import { ValidateFunction } from "ajv";
 
 //#region src/ajv.d.ts

package/dist/ajv.d.mts

@@ -1,4 +1,4 @@
-import { a as Validator, n as SchemaMap } from "./validate-DgCUbzgT.mjs";
+import { a as Validator, n as SchemaMap } from "./validate-B98ghVgw.mjs";
 import { ValidateFunction } from "ajv";
 
 //#region src/ajv.d.ts

package/dist/index.cjs

@@ -540,12 +540,31 @@ const ATOMIC_MEDIA_TYPE = mediaType({ ext: [ATOMIC_EXT] });
 //#region src/request.ts
 const isAbsolute = (path) => /^https?:\/\//i.test(path);
 const RELATIVE_ORIGIN = "http://relative.invalid";
-/** Resolve a server link against `baseUrl` per RFC 3986. An absolute link is kept verbatim. */
+/**
+* Resolve a server link against `baseUrl` per RFC 3986 and check where it lands. A link on the
+* base's origin is followed; a relative base (e.g. `/api`) takes the page's origin in a browser and
+* otherwise only accepts a link that keeps the host. Anything that isn't plain http(s) is refused.
+*/
 function resolveLink(link, baseUrl) {
-	if (isAbsolute(link)) return link;
-	if (isAbsolute(baseUrl)) return new URL(link, baseUrl).href;
-	const resolved = new URL(link, new URL(baseUrl, RELATIVE_ORIGIN));
-	return resolved.origin === RELATIVE_ORIGIN ? resolved.pathname + resolved.search + resolved.hash : resolved.href;
+	let normalised = link.replace(/[\t\n\r]/g, "");
+	let start = 0;
+	while (start < normalised.length && normalised.charCodeAt(start) <= 32) start++;
+	normalised = normalised.slice(start);
+	const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(normalised)?.[1]?.toLowerCase();
+	if (scheme !== void 0 && scheme !== "http" && scheme !== "https") throw new Error(`Refusing to follow link "${link}": only http(s) links are followed`);
+	const relativeBase = !isAbsolute(baseUrl);
+	const page = globalThis.location?.href;
+	const base = new URL(baseUrl, relativeBase ? typeof page === "string" ? page : RELATIVE_ORIGIN : void 0);
+	const resolved = new URL(link, base);
+	const sameOrigin = resolved.origin === base.origin && (scheme === void 0 || /^https?:\/\//i.test(normalised));
+	if (!sameOrigin) return {
+		url: resolved.href,
+		sameOrigin
+	};
+	return {
+		url: relativeBase ? resolved.pathname + resolved.search + resolved.hash : resolved.href,
+		sameOrigin
+	};
 }
 const append = (parts, key, value) => {
 	if (value === void 0 || value === null || value === "") return;
@@ -583,14 +602,21 @@ function serializeQuery(query) {
 	return parts.join("&");
 }
 /**
-* Execute a request: build the URL (a server link resolved against `baseUrl`, an absolute path
-* verbatim, else `baseUrl + path`), apply content negotiation and any async per-request headers,
+* Execute a request: build the URL (a server link resolved against `baseUrl` and held to its
+* origin, an absolute path verbatim, else `baseUrl + path`), apply content negotiation and any async per-request headers,
 * then drive the transport. A 2xx with a body parses to a {@link Document}; an empty /
 * 204 body resolves to `undefined`. A non-2xx throws a {@link JsonApiError} carrying the
 * parsed error objects (tolerating a non-JSON error body with an empty list).
 */
 async function execute(ctx, req) {
-	let url = req.link ? resolveLink(req.path, ctx.baseUrl) : isAbsolute(req.path) ? req.path : ctx.baseUrl + req.path;
+	let url;
+	let sendHeaders = true;
+	if (req.link) {
+		const link = resolveLink(req.path, ctx.baseUrl);
+		if (!link.sameOrigin && ctx.allowCrossOriginLinks !== true) throw new Error(`Refusing to follow link "${req.path}": it leaves the base URL's origin (set allowCrossOriginLinks to follow it without the configured headers)`);
+		url = link.url;
+		sendHeaders = link.sameOrigin;
+	} else url = isAbsolute(req.path) ? req.path : ctx.baseUrl + req.path;
 	if (req.query) {
 		const qs = serializeQuery(req.query);
 		if (qs) url += (url.includes("?") ? "&" : "?") + qs;
@@ -610,7 +636,7 @@ async function execute(ctx, req) {
 		headers["Content-Type"] = req.contentType ?? negotiated;
 		transportReq.body = req.raw && typeof req.body === "string" ? req.body : JSON.stringify(req.body);
 	}
-	if (ctx.headers) mergeHeaders(headers, await ctx.headers());
+	if (ctx.headers && sendHeaders) mergeHeaders(headers, await ctx.headers());
 	const res = await ctx.transport(transportReq);
 	if (res.status >= 200 && res.status < 300) return parseDocument(res.body);
 	throw new JsonApiError(res.status, parseErrors(res.body));
@@ -1020,6 +1046,18 @@ const fetchTransport = async (req) => {
 /** Substitute `{key}` placeholders in a path template (`/albums/{id}/{rel}` -> `/albums/1/tracks`). */
 const fill = (template, vars) => template.replace(/\{(\w+)\}/g, (_, key) => vars[key] ?? `{${key}}`);
 /**
+* Fill a type's path template, putting a relation's URI segment (its `uriField`, else its name)
+* in place of `{rel}`. `vars.rel` stays the relation's name everywhere else.
+*/
+function fillPath(ctx, type, template, vars) {
+	const rel = vars["rel"];
+	const uriField = rel === void 0 ? void 0 : ctx.descriptor[type]?.relations[rel]?.uriField;
+	return fill(template, uriField === void 0 ? vars : {
+		...vars,
+		rel: uriField
+	});
+}
+/**
 * Run an operation: resolve the path template from the type's descriptor, fill its
 * placeholders, execute, and materialise the resulting document. A no-body / 204 response
 * materialises to `undefined`; an operation the type does not declare (no path template) throws
@@ -1032,7 +1070,7 @@ async function run(ctx, type, operation, vars, query, linkage = false, relationF
 	if (template === void 0) throw new Error(`No "${operation}" path declared for type "${type}"`);
 	const req = {
 		method: "GET",
-		path: fill(template, vars)
+		path: fillPath(ctx, type, template, vars)
 	};
 	if (query !== void 0) {
 		const { signal, ...params } = query;
@@ -1082,7 +1120,7 @@ async function runWrite(ctx, spec) {
 	if (template === void 0) throw new Error(`No "${spec.operation}" path declared for type "${spec.type}"`);
 	const req = {
 		method: spec.method,
-		path: fill(template, spec.vars),
+		path: fillPath(ctx, spec.type, template, spec.vars),
 		body: spec.body
 	};
 	if (spec.query !== void 0) req.query = spec.query;
@@ -1181,8 +1219,9 @@ function relationshipAccessor(ctx, type, id, rel) {
 		return mutations === void 0 ? true : mutations[verb] === true;
 	};
 	const accessor = {};
-	if (relation?.relationship !== false) accessor["get"] = (query) => run(ctx, type, "fetchRelationship", vars, query, true, rel);
-	if (relation?.related !== false) accessor["related"] = (query) => run(ctx, type, "fetchRelated", vars, query, false, rel);
+	const readable = relation?.writeOnly !== true;
+	if (readable && relation?.relationship !== false) accessor["get"] = (query) => run(ctx, type, "fetchRelationship", vars, query, true, rel);
+	if (readable && relation?.related !== false) accessor["related"] = (query) => run(ctx, type, "fetchRelated", vars, query, false, rel);
 	if (cardinality === "many") {
 		if (advertises("add")) accessor["add"] = (refs) => mutate("POST", refs);
 		if (advertises("remove")) accessor["remove"] = (refs) => mutate("DELETE", refs);
@@ -1267,7 +1306,8 @@ function createClient(descriptor, options) {
 	const request = {
 		baseUrl: options.baseUrl,
 		transport: options.transport ?? fetchTransport,
-		...options.headers !== void 0 ? { headers: options.headers } : {}
+		...options.headers !== void 0 ? { headers: options.headers } : {},
+		...options.allowCrossOriginLinks !== void 0 ? { allowCrossOriginLinks: options.allowCrossOriginLinks } : {}
 	};
 	const validator = resolveValidator(options.validate);
 	const ctx = {

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { $ as ResourceAccessors, $t as ActionInput, A as DefaultActionTypes, At as Edge, B as IdentifierMember, Bt as CANONICAL_PAGE_KEYS, C as fetchTransport, Ct as JSON_API_MEDIA_TYPE, D as Collection, Dt as mediaType, E as Client, Et as ResourceIdentifier, F as FieldSelectionMap, Ft as ResourceEnvelope, G as MemberName, Gt as PageMeta, H as IncludedRelations, Ht as Page, I as FieldsMap, It as ResourceLinks, J as RelationName, Jt as PageParamsOf, K as PivotInput, Kt as PageOf, L as FilterKey, Lt as materialise, M as DefaultWriteAttributes, Mt as MaterialiseContext, N as EdgeMembers, Nt as NavigateOptions, O as CountToken, Ot as ArrayEnvelope, P as ErrorCodeOf, Pt as RelationView, Q as RelationshipAccessor, Qt as ActionDescriptor, R as FilterQuery, Rt as relatedPaginator, S as TransportResponse, St as ATOMIC_MEDIA_TYPE, T as AtomicResultOf, Tt as MediaTypeParams, U as LinkageRef, Ut as PageKeys, V as IncludePath, Vt as ExactPageParams, W as ListPageParams, Wt as PageLinks, X as RelationPaginator, Xt as TypedPage, Y as RelationPageParams, Yt as ResolvedPaginator, Z as RelationReadQuery, Zt as resolvePaginator, _ as HANDLE_RESERVED, _t as AtomicResults, a as Validator, an as ClientIdPolicy, at as TypeAccessor, b as JsonApiTransport, bt as runAtomic, c as resolveValidator, cn as PaginatorDescriptor, ct as UpdateInput, d as JsonApiContext, dn as PaginatorStrategy, dt as AtomicCreateInput, en as ActionOutput, et as ResourceHandle, f as JsonApiRequest, fn as RelationDescriptor, ft as AtomicDeleteHandle, g as ClientOptions, gt as AtomicResult, h as serializeQuery, hn as StrategyDescriptor, ht as AtomicRef, i as ValidationOption, in as Cardinality, it as SortToken, j as DefaultAttributes, jt as EdgeEnvelope, k as CreateInput, kt as DocumentEnvelope, l as validateDocument, ln as PaginatorKind, lt as WriteOptions, m as execute, mn as ResourceDescriptor, mt as AtomicRecorder, n as SchemaMap, nn as ApiDescriptor, nt as SingleReadQuery, o as WireResource, on as CountableDescriptor, ot as TypeName, p as ReadQuery, pn as RelationMutations, pt as AtomicHandle, q as ReadResult, qt as PageParams, r as ValidationConfig, rn as AtomicDescriptor, rt as SortQuery, s as assertJsonApiDocument, sn as MenuDescriptor, st as TypedReadQuery, t as ResolvedValidator, tn as ActionScope, tt as ResourceObjectView, u as Document, un as PaginatorRole, ut as AtomicCreateHandle, v as HeadersInit, vt as AtomicUpdateHandle, w as ActionsAccessor, wt as LocalIdentifier, x as TransportRequest, xt as ATOMIC_EXT, y as createClient, yt as AtomicUpdateInput, z as HydratedMember, zt as relatedPaginatorKind } from "./validate-DgCUbzgT.cjs";
+import { $ as RelationshipAccessor, $t as ActionDescriptor, A as DefaultActionTypes, At as DocumentEnvelope, B as IdentifierMember, Bt as relatedPaginatorKind, C as fetchTransport, Ct as ATOMIC_MEDIA_TYPE, D as Collection, Dt as ResourceIdentifier, E as Client, Et as MediaTypeParams, F as FieldSelectionMap, Ft as RelationView, G as MemberName, Gt as PageLinks, H as IncludedRelations, Ht as ExactPageParams, I as FieldsMap, It as ResourceEnvelope, J as ReadableRelationName, Jt as PageParams, K as PivotInput, Kt as PageMeta, L as FilterKey, Lt as ResourceLinks, M as DefaultWriteAttributes, Mt as EdgeEnvelope, N as EdgeMembers, Nt as MaterialiseContext, O as CountToken, Ot as mediaType, P as ErrorCodeOf, Pt as NavigateOptions, Q as RelationReadQuery, Qt as resolvePaginator, R as FilterQuery, Rt as materialise, S as TransportResponse, St as ATOMIC_EXT, T as AtomicResultOf, Tt as LocalIdentifier, U as LinkageRef, Ut as Page, V as IncludePath, Vt as CANONICAL_PAGE_KEYS, W as ListPageParams, Wt as PageKeys, X as RelationPageParams, Xt as ResolvedPaginator, Y as RelationName, Yt as PageParamsOf, Z as RelationPaginator, Zt as TypedPage, _ as HANDLE_RESERVED, _n as StrategyDescriptor, _t as AtomicResult, a as Validator, an as Cardinality, at as SortToken, b as JsonApiTransport, bt as AtomicUpdateInput, c as resolveValidator, cn as MenuDescriptor, ct as TypedReadQuery, d as JsonApiContext, dn as PaginatorRole, dt as AtomicCreateHandle, en as ActionInput, et as ResourceAccessors, f as JsonApiRequest, fn as PaginatorStrategy, ft as AtomicCreateInput, g as ClientOptions, gn as ResourceDescriptor, gt as AtomicRef, h as serializeQuery, hn as RelationMutations, ht as AtomicRecorder, i as ValidationOption, in as AtomicDescriptor, it as SortQuery, j as DefaultAttributes, jt as Edge, k as CreateInput, kt as ArrayEnvelope, l as validateDocument, ln as PaginatorDescriptor, lt as UpdateInput, m as execute, mn as RelationDescriptor, mt as AtomicHandle, n as SchemaMap, nn as ActionScope, nt as ResourceObjectView, o as WireResource, on as ClientIdPolicy, ot as TypeAccessor, p as ReadQuery, pn as PivotDescriptor, pt as AtomicDeleteHandle, q as ReadResult, qt as PageOf, r as ValidationConfig, rn as ApiDescriptor, rt as SingleReadQuery, s as assertJsonApiDocument, sn as CountableDescriptor, st as TypeName, t as ResolvedValidator, tn as ActionOutput, tt as ResourceHandle, u as Document, un as PaginatorKind, ut as WriteOptions, v as HeadersInit, vt as AtomicResults, w as ActionsAccessor, wt as JSON_API_MEDIA_TYPE, x as TransportRequest, xt as runAtomic, y as createClient, yt as AtomicUpdateHandle, z as HydratedMember, zt as relatedPaginator } from "./validate-B98ghVgw.cjs";
 
 //#region src/errors.d.ts
 /**
@@ -216,5 +216,5 @@ declare function withRemappedRelationshipPaths(error: JsonApiError, rel: string,
  */
 declare function withRemappedAtomicPaths(error: JsonApiError, descriptor: ApiDescriptor, typeForOp: (opIndex: number) => string | undefined): JsonApiError;
 //#endregion
-export { ATOMIC_EXT, ATOMIC_MEDIA_TYPE, ActionDescriptor, ActionInput, ActionOutput, ActionScope, ActionsAccessor, ApiDescriptor, ArrayEnvelope, AtomicCreateHandle, AtomicCreateInput, AtomicDeleteHandle, AtomicDescriptor, AtomicHandle, AtomicRecorder, AtomicRef, AtomicResult, AtomicResultOf, AtomicResults, AtomicUpdateHandle, AtomicUpdateInput, CANONICAL_PAGE_KEYS, Cardinality, Client, ClientIdPolicy, ClientOptions, Collection, CountToken, CountableDescriptor, CreateInput, DefaultActionTypes, DefaultAttributes, DefaultWriteAttributes, Document, DocumentEnvelope, Edge, EdgeEnvelope, EdgeMembers, ErrorCodeGuard, ErrorCodeOf, ExactPageParams, FieldSelectionMap, FieldsMap, FilterKey, FilterQuery, HANDLE_RESERVED, HeadersInit, HydratedMember, IdentifierMember, IncludePath, IncludedRelations, JSON_API_MEDIA_TYPE, JsonApiContext, JsonApiError, JsonApiErrorObject, JsonApiRequest, JsonApiTransport, LinkageRef, ListPageParams, LocalIdentifier, MaterialiseContext, MediaTypeParams, MemberName, MenuDescriptor, NavigateOptions, Page, PageKeys, PageLinks, PageMeta, PageOf, PageParams, PageParamsOf, PaginatorDescriptor, PaginatorKind, PaginatorRole, PaginatorStrategy, PivotInput, ReadQuery, ReadResult, RelationDescriptor, RelationMutations, RelationName, RelationPageParams, RelationPaginator, RelationReadQuery, RelationView, RelationshipAccessor, RelationshipDocument, ResolvedPaginator, ResolvedValidator, ResourceAccessors, ResourceDescriptor, ResourceEnvelope, ResourceHandle, ResourceIdentifier, ResourceLinks, ResourceObjectView, SchemaMap, SingleReadQuery, SortQuery, SortToken, StrategyDescriptor, StructuralGuardError, ToDocumentOptions, TransportRequest, TransportResponse, TypeAccessor, TypeName, TypedPage, TypedReadQuery, UpdateInput, ValidationConfig, ValidationOption, Validator, WireResource, WriteDocument, WriteOptions, assertJsonApiDocument, createClient, execute, fetchTransport, hasErrorCode, materialise, mediaType, relatedPaginator, relatedPaginatorKind, remapPointer, remapRelationshipPointer, resolvePaginator, resolveValidator, runAtomic, serializeQuery, toDocument, toRelationshipDocument, validateDocument, withRemappedAtomicPaths, withRemappedPaths, withRemappedRelationshipPaths };
+export { ATOMIC_EXT, ATOMIC_MEDIA_TYPE, ActionDescriptor, ActionInput, ActionOutput, ActionScope, ActionsAccessor, ApiDescriptor, ArrayEnvelope, AtomicCreateHandle, AtomicCreateInput, AtomicDeleteHandle, AtomicDescriptor, AtomicHandle, AtomicRecorder, AtomicRef, AtomicResult, AtomicResultOf, AtomicResults, AtomicUpdateHandle, AtomicUpdateInput, CANONICAL_PAGE_KEYS, Cardinality, Client, ClientIdPolicy, ClientOptions, Collection, CountToken, CountableDescriptor, CreateInput, DefaultActionTypes, DefaultAttributes, DefaultWriteAttributes, Document, DocumentEnvelope, Edge, EdgeEnvelope, EdgeMembers, ErrorCodeGuard, ErrorCodeOf, ExactPageParams, FieldSelectionMap, FieldsMap, FilterKey, FilterQuery, HANDLE_RESERVED, HeadersInit, HydratedMember, IdentifierMember, IncludePath, IncludedRelations, JSON_API_MEDIA_TYPE, JsonApiContext, JsonApiError, JsonApiErrorObject, JsonApiRequest, JsonApiTransport, LinkageRef, ListPageParams, LocalIdentifier, MaterialiseContext, MediaTypeParams, MemberName, MenuDescriptor, NavigateOptions, Page, PageKeys, PageLinks, PageMeta, PageOf, PageParams, PageParamsOf, PaginatorDescriptor, PaginatorKind, PaginatorRole, PaginatorStrategy, PivotDescriptor, PivotInput, ReadQuery, ReadResult, ReadableRelationName, RelationDescriptor, RelationMutations, RelationName, RelationPageParams, RelationPaginator, RelationReadQuery, RelationView, RelationshipAccessor, RelationshipDocument, ResolvedPaginator, ResolvedValidator, ResourceAccessors, ResourceDescriptor, ResourceEnvelope, ResourceHandle, ResourceIdentifier, ResourceLinks, ResourceObjectView, SchemaMap, SingleReadQuery, SortQuery, SortToken, StrategyDescriptor, StructuralGuardError, ToDocumentOptions, TransportRequest, TransportResponse, TypeAccessor, TypeName, TypedPage, TypedReadQuery, UpdateInput, ValidationConfig, ValidationOption, Validator, WireResource, WriteDocument, WriteOptions, assertJsonApiDocument, createClient, execute, fetchTransport, hasErrorCode, materialise, mediaType, relatedPaginator, relatedPaginatorKind, remapPointer, remapRelationshipPointer, resolvePaginator, resolveValidator, runAtomic, serializeQuery, toDocument, toRelationshipDocument, validateDocument, withRemappedAtomicPaths, withRemappedPaths, withRemappedRelationshipPaths };
 //# sourceMappingURL=index.d.cts.map

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as ResourceAccessors, $t as ActionInput, A as DefaultActionTypes, At as Edge, B as IdentifierMember, Bt as CANONICAL_PAGE_KEYS, C as fetchTransport, Ct as JSON_API_MEDIA_TYPE, D as Collection, Dt as mediaType, E as Client, Et as ResourceIdentifier, F as FieldSelectionMap, Ft as ResourceEnvelope, G as MemberName, Gt as PageMeta, H as IncludedRelations, Ht as Page, I as FieldsMap, It as ResourceLinks, J as RelationName, Jt as PageParamsOf, K as PivotInput, Kt as PageOf, L as FilterKey, Lt as materialise, M as DefaultWriteAttributes, Mt as MaterialiseContext, N as EdgeMembers, Nt as NavigateOptions, O as CountToken, Ot as ArrayEnvelope, P as ErrorCodeOf, Pt as RelationView, Q as RelationshipAccessor, Qt as ActionDescriptor, R as FilterQuery, Rt as relatedPaginator, S as TransportResponse, St as ATOMIC_MEDIA_TYPE, T as AtomicResultOf, Tt as MediaTypeParams, U as LinkageRef, Ut as PageKeys, V as IncludePath, Vt as ExactPageParams, W as ListPageParams, Wt as PageLinks, X as RelationPaginator, Xt as TypedPage, Y as RelationPageParams, Yt as ResolvedPaginator, Z as RelationReadQuery, Zt as resolvePaginator, _ as HANDLE_RESERVED, _t as AtomicResults, a as Validator, an as ClientIdPolicy, at as TypeAccessor, b as JsonApiTransport, bt as runAtomic, c as resolveValidator, cn as PaginatorDescriptor, ct as UpdateInput, d as JsonApiContext, dn as PaginatorStrategy, dt as AtomicCreateInput, en as ActionOutput, et as ResourceHandle, f as JsonApiRequest, fn as RelationDescriptor, ft as AtomicDeleteHandle, g as ClientOptions, gt as AtomicResult, h as serializeQuery, hn as StrategyDescriptor, ht as AtomicRef, i as ValidationOption, in as Cardinality, it as SortToken, j as DefaultAttributes, jt as EdgeEnvelope, k as CreateInput, kt as DocumentEnvelope, l as validateDocument, ln as PaginatorKind, lt as WriteOptions, m as execute, mn as ResourceDescriptor, mt as AtomicRecorder, n as SchemaMap, nn as ApiDescriptor, nt as SingleReadQuery, o as WireResource, on as CountableDescriptor, ot as TypeName, p as ReadQuery, pn as RelationMutations, pt as AtomicHandle, q as ReadResult, qt as PageParams, r as ValidationConfig, rn as AtomicDescriptor, rt as SortQuery, s as assertJsonApiDocument, sn as MenuDescriptor, st as TypedReadQuery, t as ResolvedValidator, tn as ActionScope, tt as ResourceObjectView, u as Document, un as PaginatorRole, ut as AtomicCreateHandle, v as HeadersInit, vt as AtomicUpdateHandle, w as ActionsAccessor, wt as LocalIdentifier, x as TransportRequest, xt as ATOMIC_EXT, y as createClient, yt as AtomicUpdateInput, z as HydratedMember, zt as relatedPaginatorKind } from "./validate-DgCUbzgT.mjs";
+import { $ as RelationshipAccessor, $t as ActionDescriptor, A as DefaultActionTypes, At as DocumentEnvelope, B as IdentifierMember, Bt as relatedPaginatorKind, C as fetchTransport, Ct as ATOMIC_MEDIA_TYPE, D as Collection, Dt as ResourceIdentifier, E as Client, Et as MediaTypeParams, F as FieldSelectionMap, Ft as RelationView, G as MemberName, Gt as PageLinks, H as IncludedRelations, Ht as ExactPageParams, I as FieldsMap, It as ResourceEnvelope, J as ReadableRelationName, Jt as PageParams, K as PivotInput, Kt as PageMeta, L as FilterKey, Lt as ResourceLinks, M as DefaultWriteAttributes, Mt as EdgeEnvelope, N as EdgeMembers, Nt as MaterialiseContext, O as CountToken, Ot as mediaType, P as ErrorCodeOf, Pt as NavigateOptions, Q as RelationReadQuery, Qt as resolvePaginator, R as FilterQuery, Rt as materialise, S as TransportResponse, St as ATOMIC_EXT, T as AtomicResultOf, Tt as LocalIdentifier, U as LinkageRef, Ut as Page, V as IncludePath, Vt as CANONICAL_PAGE_KEYS, W as ListPageParams, Wt as PageKeys, X as RelationPageParams, Xt as ResolvedPaginator, Y as RelationName, Yt as PageParamsOf, Z as RelationPaginator, Zt as TypedPage, _ as HANDLE_RESERVED, _n as StrategyDescriptor, _t as AtomicResult, a as Validator, an as Cardinality, at as SortToken, b as JsonApiTransport, bt as AtomicUpdateInput, c as resolveValidator, cn as MenuDescriptor, ct as TypedReadQuery, d as JsonApiContext, dn as PaginatorRole, dt as AtomicCreateHandle, en as ActionInput, et as ResourceAccessors, f as JsonApiRequest, fn as PaginatorStrategy, ft as AtomicCreateInput, g as ClientOptions, gn as ResourceDescriptor, gt as AtomicRef, h as serializeQuery, hn as RelationMutations, ht as AtomicRecorder, i as ValidationOption, in as AtomicDescriptor, it as SortQuery, j as DefaultAttributes, jt as Edge, k as CreateInput, kt as ArrayEnvelope, l as validateDocument, ln as PaginatorDescriptor, lt as UpdateInput, m as execute, mn as RelationDescriptor, mt as AtomicHandle, n as SchemaMap, nn as ActionScope, nt as ResourceObjectView, o as WireResource, on as ClientIdPolicy, ot as TypeAccessor, p as ReadQuery, pn as PivotDescriptor, pt as AtomicDeleteHandle, q as ReadResult, qt as PageOf, r as ValidationConfig, rn as ApiDescriptor, rt as SingleReadQuery, s as assertJsonApiDocument, sn as CountableDescriptor, st as TypeName, t as ResolvedValidator, tn as ActionOutput, tt as ResourceHandle, u as Document, un as PaginatorKind, ut as WriteOptions, v as HeadersInit, vt as AtomicResults, w as ActionsAccessor, wt as JSON_API_MEDIA_TYPE, x as TransportRequest, xt as runAtomic, y as createClient, yt as AtomicUpdateHandle, z as HydratedMember, zt as relatedPaginator } from "./validate-B98ghVgw.mjs";
 
 //#region src/errors.d.ts
 /**
@@ -216,5 +216,5 @@ declare function withRemappedRelationshipPaths(error: JsonApiError, rel: string,
  */
 declare function withRemappedAtomicPaths(error: JsonApiError, descriptor: ApiDescriptor, typeForOp: (opIndex: number) => string | undefined): JsonApiError;
 //#endregion
-export { ATOMIC_EXT, ATOMIC_MEDIA_TYPE, ActionDescriptor, ActionInput, ActionOutput, ActionScope, ActionsAccessor, ApiDescriptor, ArrayEnvelope, AtomicCreateHandle, AtomicCreateInput, AtomicDeleteHandle, AtomicDescriptor, AtomicHandle, AtomicRecorder, AtomicRef, AtomicResult, AtomicResultOf, AtomicResults, AtomicUpdateHandle, AtomicUpdateInput, CANONICAL_PAGE_KEYS, Cardinality, Client, ClientIdPolicy, ClientOptions, Collection, CountToken, CountableDescriptor, CreateInput, DefaultActionTypes, DefaultAttributes, DefaultWriteAttributes, Document, DocumentEnvelope, Edge, EdgeEnvelope, EdgeMembers, ErrorCodeGuard, ErrorCodeOf, ExactPageParams, FieldSelectionMap, FieldsMap, FilterKey, FilterQuery, HANDLE_RESERVED, HeadersInit, HydratedMember, IdentifierMember, IncludePath, IncludedRelations, JSON_API_MEDIA_TYPE, JsonApiContext, JsonApiError, JsonApiErrorObject, JsonApiRequest, JsonApiTransport, LinkageRef, ListPageParams, LocalIdentifier, MaterialiseContext, MediaTypeParams, MemberName, MenuDescriptor, NavigateOptions, Page, PageKeys, PageLinks, PageMeta, PageOf, PageParams, PageParamsOf, PaginatorDescriptor, PaginatorKind, PaginatorRole, PaginatorStrategy, PivotInput, ReadQuery, ReadResult, RelationDescriptor, RelationMutations, RelationName, RelationPageParams, RelationPaginator, RelationReadQuery, RelationView, RelationshipAccessor, RelationshipDocument, ResolvedPaginator, ResolvedValidator, ResourceAccessors, ResourceDescriptor, ResourceEnvelope, ResourceHandle, ResourceIdentifier, ResourceLinks, ResourceObjectView, SchemaMap, SingleReadQuery, SortQuery, SortToken, StrategyDescriptor, StructuralGuardError, ToDocumentOptions, TransportRequest, TransportResponse, TypeAccessor, TypeName, TypedPage, TypedReadQuery, UpdateInput, ValidationConfig, ValidationOption, Validator, WireResource, WriteDocument, WriteOptions, assertJsonApiDocument, createClient, execute, fetchTransport, hasErrorCode, materialise, mediaType, relatedPaginator, relatedPaginatorKind, remapPointer, remapRelationshipPointer, resolvePaginator, resolveValidator, runAtomic, serializeQuery, toDocument, toRelationshipDocument, validateDocument, withRemappedAtomicPaths, withRemappedPaths, withRemappedRelationshipPaths };
+export { ATOMIC_EXT, ATOMIC_MEDIA_TYPE, ActionDescriptor, ActionInput, ActionOutput, ActionScope, ActionsAccessor, ApiDescriptor, ArrayEnvelope, AtomicCreateHandle, AtomicCreateInput, AtomicDeleteHandle, AtomicDescriptor, AtomicHandle, AtomicRecorder, AtomicRef, AtomicResult, AtomicResultOf, AtomicResults, AtomicUpdateHandle, AtomicUpdateInput, CANONICAL_PAGE_KEYS, Cardinality, Client, ClientIdPolicy, ClientOptions, Collection, CountToken, CountableDescriptor, CreateInput, DefaultActionTypes, DefaultAttributes, DefaultWriteAttributes, Document, DocumentEnvelope, Edge, EdgeEnvelope, EdgeMembers, ErrorCodeGuard, ErrorCodeOf, ExactPageParams, FieldSelectionMap, FieldsMap, FilterKey, FilterQuery, HANDLE_RESERVED, HeadersInit, HydratedMember, IdentifierMember, IncludePath, IncludedRelations, JSON_API_MEDIA_TYPE, JsonApiContext, JsonApiError, JsonApiErrorObject, JsonApiRequest, JsonApiTransport, LinkageRef, ListPageParams, LocalIdentifier, MaterialiseContext, MediaTypeParams, MemberName, MenuDescriptor, NavigateOptions, Page, PageKeys, PageLinks, PageMeta, PageOf, PageParams, PageParamsOf, PaginatorDescriptor, PaginatorKind, PaginatorRole, PaginatorStrategy, PivotDescriptor, PivotInput, ReadQuery, ReadResult, ReadableRelationName, RelationDescriptor, RelationMutations, RelationName, RelationPageParams, RelationPaginator, RelationReadQuery, RelationView, RelationshipAccessor, RelationshipDocument, ResolvedPaginator, ResolvedValidator, ResourceAccessors, ResourceDescriptor, ResourceEnvelope, ResourceHandle, ResourceIdentifier, ResourceLinks, ResourceObjectView, SchemaMap, SingleReadQuery, SortQuery, SortToken, StrategyDescriptor, StructuralGuardError, ToDocumentOptions, TransportRequest, TransportResponse, TypeAccessor, TypeName, TypedPage, TypedReadQuery, UpdateInput, ValidationConfig, ValidationOption, Validator, WireResource, WriteDocument, WriteOptions, assertJsonApiDocument, createClient, execute, fetchTransport, hasErrorCode, materialise, mediaType, relatedPaginator, relatedPaginatorKind, remapPointer, remapRelationshipPointer, resolvePaginator, resolveValidator, runAtomic, serializeQuery, toDocument, toRelationshipDocument, validateDocument, withRemappedAtomicPaths, withRemappedPaths, withRemappedRelationshipPaths };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -539,12 +539,31 @@ const ATOMIC_MEDIA_TYPE = mediaType({ ext: [ATOMIC_EXT] });
 //#region src/request.ts
 const isAbsolute = (path) => /^https?:\/\//i.test(path);
 const RELATIVE_ORIGIN = "http://relative.invalid";
-/** Resolve a server link against `baseUrl` per RFC 3986. An absolute link is kept verbatim. */
+/**
+* Resolve a server link against `baseUrl` per RFC 3986 and check where it lands. A link on the
+* base's origin is followed; a relative base (e.g. `/api`) takes the page's origin in a browser and
+* otherwise only accepts a link that keeps the host. Anything that isn't plain http(s) is refused.
+*/
 function resolveLink(link, baseUrl) {
-	if (isAbsolute(link)) return link;
-	if (isAbsolute(baseUrl)) return new URL(link, baseUrl).href;
-	const resolved = new URL(link, new URL(baseUrl, RELATIVE_ORIGIN));
-	return resolved.origin === RELATIVE_ORIGIN ? resolved.pathname + resolved.search + resolved.hash : resolved.href;
+	let normalised = link.replace(/[\t\n\r]/g, "");
+	let start = 0;
+	while (start < normalised.length && normalised.charCodeAt(start) <= 32) start++;
+	normalised = normalised.slice(start);
+	const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(normalised)?.[1]?.toLowerCase();
+	if (scheme !== void 0 && scheme !== "http" && scheme !== "https") throw new Error(`Refusing to follow link "${link}": only http(s) links are followed`);
+	const relativeBase = !isAbsolute(baseUrl);
+	const page = globalThis.location?.href;
+	const base = new URL(baseUrl, relativeBase ? typeof page === "string" ? page : RELATIVE_ORIGIN : void 0);
+	const resolved = new URL(link, base);
+	const sameOrigin = resolved.origin === base.origin && (scheme === void 0 || /^https?:\/\//i.test(normalised));
+	if (!sameOrigin) return {
+		url: resolved.href,
+		sameOrigin
+	};
+	return {
+		url: relativeBase ? resolved.pathname + resolved.search + resolved.hash : resolved.href,
+		sameOrigin
+	};
 }
 const append = (parts, key, value) => {
 	if (value === void 0 || value === null || value === "") return;
@@ -582,14 +601,21 @@ function serializeQuery(query) {
 	return parts.join("&");
 }
 /**
-* Execute a request: build the URL (a server link resolved against `baseUrl`, an absolute path
-* verbatim, else `baseUrl + path`), apply content negotiation and any async per-request headers,
+* Execute a request: build the URL (a server link resolved against `baseUrl` and held to its
+* origin, an absolute path verbatim, else `baseUrl + path`), apply content negotiation and any async per-request headers,
 * then drive the transport. A 2xx with a body parses to a {@link Document}; an empty /
 * 204 body resolves to `undefined`. A non-2xx throws a {@link JsonApiError} carrying the
 * parsed error objects (tolerating a non-JSON error body with an empty list).
 */
 async function execute(ctx, req) {
-	let url = req.link ? resolveLink(req.path, ctx.baseUrl) : isAbsolute(req.path) ? req.path : ctx.baseUrl + req.path;
+	let url;
+	let sendHeaders = true;
+	if (req.link) {
+		const link = resolveLink(req.path, ctx.baseUrl);
+		if (!link.sameOrigin && ctx.allowCrossOriginLinks !== true) throw new Error(`Refusing to follow link "${req.path}": it leaves the base URL's origin (set allowCrossOriginLinks to follow it without the configured headers)`);
+		url = link.url;
+		sendHeaders = link.sameOrigin;
+	} else url = isAbsolute(req.path) ? req.path : ctx.baseUrl + req.path;
 	if (req.query) {
 		const qs = serializeQuery(req.query);
 		if (qs) url += (url.includes("?") ? "&" : "?") + qs;
@@ -609,7 +635,7 @@ async function execute(ctx, req) {
 		headers["Content-Type"] = req.contentType ?? negotiated;
 		transportReq.body = req.raw && typeof req.body === "string" ? req.body : JSON.stringify(req.body);
 	}
-	if (ctx.headers) mergeHeaders(headers, await ctx.headers());
+	if (ctx.headers && sendHeaders) mergeHeaders(headers, await ctx.headers());
 	const res = await ctx.transport(transportReq);
 	if (res.status >= 200 && res.status < 300) return parseDocument(res.body);
 	throw new JsonApiError(res.status, parseErrors(res.body));
@@ -1019,6 +1045,18 @@ const fetchTransport = async (req) => {
 /** Substitute `{key}` placeholders in a path template (`/albums/{id}/{rel}` -> `/albums/1/tracks`). */
 const fill = (template, vars) => template.replace(/\{(\w+)\}/g, (_, key) => vars[key] ?? `{${key}}`);
 /**
+* Fill a type's path template, putting a relation's URI segment (its `uriField`, else its name)
+* in place of `{rel}`. `vars.rel` stays the relation's name everywhere else.
+*/
+function fillPath(ctx, type, template, vars) {
+	const rel = vars["rel"];
+	const uriField = rel === void 0 ? void 0 : ctx.descriptor[type]?.relations[rel]?.uriField;
+	return fill(template, uriField === void 0 ? vars : {
+		...vars,
+		rel: uriField
+	});
+}
+/**
 * Run an operation: resolve the path template from the type's descriptor, fill its
 * placeholders, execute, and materialise the resulting document. A no-body / 204 response
 * materialises to `undefined`; an operation the type does not declare (no path template) throws
@@ -1031,7 +1069,7 @@ async function run(ctx, type, operation, vars, query, linkage = false, relationF
 	if (template === void 0) throw new Error(`No "${operation}" path declared for type "${type}"`);
 	const req = {
 		method: "GET",
-		path: fill(template, vars)
+		path: fillPath(ctx, type, template, vars)
 	};
 	if (query !== void 0) {
 		const { signal, ...params } = query;
@@ -1081,7 +1119,7 @@ async function runWrite(ctx, spec) {
 	if (template === void 0) throw new Error(`No "${spec.operation}" path declared for type "${spec.type}"`);
 	const req = {
 		method: spec.method,
-		path: fill(template, spec.vars),
+		path: fillPath(ctx, spec.type, template, spec.vars),
 		body: spec.body
 	};
 	if (spec.query !== void 0) req.query = spec.query;
@@ -1180,8 +1218,9 @@ function relationshipAccessor(ctx, type, id, rel) {
 		return mutations === void 0 ? true : mutations[verb] === true;
 	};
 	const accessor = {};
-	if (relation?.relationship !== false) accessor["get"] = (query) => run(ctx, type, "fetchRelationship", vars, query, true, rel);
-	if (relation?.related !== false) accessor["related"] = (query) => run(ctx, type, "fetchRelated", vars, query, false, rel);
+	const readable = relation?.writeOnly !== true;
+	if (readable && relation?.relationship !== false) accessor["get"] = (query) => run(ctx, type, "fetchRelationship", vars, query, true, rel);
+	if (readable && relation?.related !== false) accessor["related"] = (query) => run(ctx, type, "fetchRelated", vars, query, false, rel);
 	if (cardinality === "many") {
 		if (advertises("add")) accessor["add"] = (refs) => mutate("POST", refs);
 		if (advertises("remove")) accessor["remove"] = (refs) => mutate("DELETE", refs);
@@ -1266,7 +1305,8 @@ function createClient(descriptor, options) {
 	const request = {
 		baseUrl: options.baseUrl,
 		transport: options.transport ?? fetchTransport,
-		...options.headers !== void 0 ? { headers: options.headers } : {}
+		...options.headers !== void 0 ? { headers: options.headers } : {},
+		...options.allowCrossOriginLinks !== void 0 ? { allowCrossOriginLinks: options.allowCrossOriginLinks } : {}
 	};
 	const validator = resolveValidator(options.validate);
 	const ctx = {