@haddowg/json-api-client 1.3.0 → 1.3.1

package/dist/ajv.d.cts

@@ -1,4 +1,4 @@
-import { a as Validator, n as SchemaMap } from "./validate-CJPivkqT.cjs";
+import { a as Validator, n as SchemaMap } from "./validate-B98ghVgw.cjs";
 import { ValidateFunction } from "ajv";
 
 //#region src/ajv.d.ts

package/dist/ajv.d.mts

@@ -1,4 +1,4 @@
-import { a as Validator, n as SchemaMap } from "./validate-CJPivkqT.mjs";
+import { a as Validator, n as SchemaMap } from "./validate-B98ghVgw.mjs";
 import { ValidateFunction } from "ajv";
 
 //#region src/ajv.d.ts

package/dist/index.cjs

@@ -540,12 +540,31 @@ const ATOMIC_MEDIA_TYPE = mediaType({ ext: [ATOMIC_EXT] });
 //#region src/request.ts
 const isAbsolute = (path) => /^https?:\/\//i.test(path);
 const RELATIVE_ORIGIN = "http://relative.invalid";
-/** Resolve a server link against `baseUrl` per RFC 3986. An absolute link is kept verbatim. */
+/**
+* Resolve a server link against `baseUrl` per RFC 3986 and check where it lands. A link on the
+* base's origin is followed; a relative base (e.g. `/api`) takes the page's origin in a browser and
+* otherwise only accepts a link that keeps the host. Anything that isn't plain http(s) is refused.
+*/
 function resolveLink(link, baseUrl) {
-	if (isAbsolute(link)) return link;
-	if (isAbsolute(baseUrl)) return new URL(link, baseUrl).href;
-	const resolved = new URL(link, new URL(baseUrl, RELATIVE_ORIGIN));
-	return resolved.origin === RELATIVE_ORIGIN ? resolved.pathname + resolved.search + resolved.hash : resolved.href;
+	let normalised = link.replace(/[\t\n\r]/g, "");
+	let start = 0;
+	while (start < normalised.length && normalised.charCodeAt(start) <= 32) start++;
+	normalised = normalised.slice(start);
+	const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(normalised)?.[1]?.toLowerCase();
+	if (scheme !== void 0 && scheme !== "http" && scheme !== "https") throw new Error(`Refusing to follow link "${link}": only http(s) links are followed`);
+	const relativeBase = !isAbsolute(baseUrl);
+	const page = globalThis.location?.href;
+	const base = new URL(baseUrl, relativeBase ? typeof page === "string" ? page : RELATIVE_ORIGIN : void 0);
+	const resolved = new URL(link, base);
+	const sameOrigin = resolved.origin === base.origin && (scheme === void 0 || /^https?:\/\//i.test(normalised));
+	if (!sameOrigin) return {
+		url: resolved.href,
+		sameOrigin
+	};
+	return {
+		url: relativeBase ? resolved.pathname + resolved.search + resolved.hash : resolved.href,
+		sameOrigin
+	};
 }
 const append = (parts, key, value) => {
 	if (value === void 0 || value === null || value === "") return;
@@ -583,14 +602,21 @@ function serializeQuery(query) {
 	return parts.join("&");
 }
 /**
-* Execute a request: build the URL (a server link resolved against `baseUrl`, an absolute path
-* verbatim, else `baseUrl + path`), apply content negotiation and any async per-request headers,
+* Execute a request: build the URL (a server link resolved against `baseUrl` and held to its
+* origin, an absolute path verbatim, else `baseUrl + path`), apply content negotiation and any async per-request headers,
 * then drive the transport. A 2xx with a body parses to a {@link Document}; an empty /
 * 204 body resolves to `undefined`. A non-2xx throws a {@link JsonApiError} carrying the
 * parsed error objects (tolerating a non-JSON error body with an empty list).
 */
 async function execute(ctx, req) {
-	let url = req.link ? resolveLink(req.path, ctx.baseUrl) : isAbsolute(req.path) ? req.path : ctx.baseUrl + req.path;
+	let url;
+	let sendHeaders = true;
+	if (req.link) {
+		const link = resolveLink(req.path, ctx.baseUrl);
+		if (!link.sameOrigin && ctx.allowCrossOriginLinks !== true) throw new Error(`Refusing to follow link "${req.path}": it leaves the base URL's origin (set allowCrossOriginLinks to follow it without the configured headers)`);
+		url = link.url;
+		sendHeaders = link.sameOrigin;
+	} else url = isAbsolute(req.path) ? req.path : ctx.baseUrl + req.path;
 	if (req.query) {
 		const qs = serializeQuery(req.query);
 		if (qs) url += (url.includes("?") ? "&" : "?") + qs;
@@ -610,7 +636,7 @@ async function execute(ctx, req) {
 		headers["Content-Type"] = req.contentType ?? negotiated;
 		transportReq.body = req.raw && typeof req.body === "string" ? req.body : JSON.stringify(req.body);
 	}
-	if (ctx.headers) mergeHeaders(headers, await ctx.headers());
+	if (ctx.headers && sendHeaders) mergeHeaders(headers, await ctx.headers());
 	const res = await ctx.transport(transportReq);
 	if (res.status >= 200 && res.status < 300) return parseDocument(res.body);
 	throw new JsonApiError(res.status, parseErrors(res.body));
@@ -1280,7 +1306,8 @@ function createClient(descriptor, options) {
 	const request = {
 		baseUrl: options.baseUrl,
 		transport: options.transport ?? fetchTransport,
-		...options.headers !== void 0 ? { headers: options.headers } : {}
+		...options.headers !== void 0 ? { headers: options.headers } : {},
+		...options.allowCrossOriginLinks !== void 0 ? { allowCrossOriginLinks: options.allowCrossOriginLinks } : {}
 	};
 	const validator = resolveValidator(options.validate);
 	const ctx = {

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { $ as RelationshipAccessor, $t as ActionDescriptor, A as DefaultActionTypes, At as DocumentEnvelope, B as IdentifierMember, Bt as relatedPaginatorKind, C as fetchTransport, Ct as ATOMIC_MEDIA_TYPE, D as Collection, Dt as ResourceIdentifier, E as Client, Et as MediaTypeParams, F as FieldSelectionMap, Ft as RelationView, G as MemberName, Gt as PageLinks, H as IncludedRelations, Ht as ExactPageParams, I as FieldsMap, It as ResourceEnvelope, J as ReadableRelationName, Jt as PageParams, K as PivotInput, Kt as PageMeta, L as FilterKey, Lt as ResourceLinks, M as DefaultWriteAttributes, Mt as EdgeEnvelope, N as EdgeMembers, Nt as MaterialiseContext, O as CountToken, Ot as mediaType, P as ErrorCodeOf, Pt as NavigateOptions, Q as RelationReadQuery, Qt as resolvePaginator, R as FilterQuery, Rt as materialise, S as TransportResponse, St as ATOMIC_EXT, T as AtomicResultOf, Tt as LocalIdentifier, U as LinkageRef, Ut as Page, V as IncludePath, Vt as CANONICAL_PAGE_KEYS, W as ListPageParams, Wt as PageKeys, X as RelationPageParams, Xt as ResolvedPaginator, Y as RelationName, Yt as PageParamsOf, Z as RelationPaginator, Zt as TypedPage, _ as HANDLE_RESERVED, _n as StrategyDescriptor, _t as AtomicResult, a as Validator, an as Cardinality, at as SortToken, b as JsonApiTransport, bt as AtomicUpdateInput, c as resolveValidator, cn as MenuDescriptor, ct as TypedReadQuery, d as JsonApiContext, dn as PaginatorRole, dt as AtomicCreateHandle, en as ActionInput, et as ResourceAccessors, f as JsonApiRequest, fn as PaginatorStrategy, ft as AtomicCreateInput, g as ClientOptions, gn as ResourceDescriptor, gt as AtomicRef, h as serializeQuery, hn as RelationMutations, ht as AtomicRecorder, i as ValidationOption, in as AtomicDescriptor, it as SortQuery, j as DefaultAttributes, jt as Edge, k as CreateInput, kt as ArrayEnvelope, l as validateDocument, ln as PaginatorDescriptor, lt as UpdateInput, m as execute, mn as RelationDescriptor, mt as AtomicHandle, n as SchemaMap, nn as ActionScope, nt as ResourceObjectView, o as WireResource, on as ClientIdPolicy, ot as TypeAccessor, p as ReadQuery, pn as PivotDescriptor, pt as AtomicDeleteHandle, q as ReadResult, qt as PageOf, r as ValidationConfig, rn as ApiDescriptor, rt as SingleReadQuery, s as assertJsonApiDocument, sn as CountableDescriptor, st as TypeName, t as ResolvedValidator, tn as ActionOutput, tt as ResourceHandle, u as Document, un as PaginatorKind, ut as WriteOptions, v as HeadersInit, vt as AtomicResults, w as ActionsAccessor, wt as JSON_API_MEDIA_TYPE, x as TransportRequest, xt as runAtomic, y as createClient, yt as AtomicUpdateHandle, z as HydratedMember, zt as relatedPaginator } from "./validate-CJPivkqT.cjs";
+import { $ as RelationshipAccessor, $t as ActionDescriptor, A as DefaultActionTypes, At as DocumentEnvelope, B as IdentifierMember, Bt as relatedPaginatorKind, C as fetchTransport, Ct as ATOMIC_MEDIA_TYPE, D as Collection, Dt as ResourceIdentifier, E as Client, Et as MediaTypeParams, F as FieldSelectionMap, Ft as RelationView, G as MemberName, Gt as PageLinks, H as IncludedRelations, Ht as ExactPageParams, I as FieldsMap, It as ResourceEnvelope, J as ReadableRelationName, Jt as PageParams, K as PivotInput, Kt as PageMeta, L as FilterKey, Lt as ResourceLinks, M as DefaultWriteAttributes, Mt as EdgeEnvelope, N as EdgeMembers, Nt as MaterialiseContext, O as CountToken, Ot as mediaType, P as ErrorCodeOf, Pt as NavigateOptions, Q as RelationReadQuery, Qt as resolvePaginator, R as FilterQuery, Rt as materialise, S as TransportResponse, St as ATOMIC_EXT, T as AtomicResultOf, Tt as LocalIdentifier, U as LinkageRef, Ut as Page, V as IncludePath, Vt as CANONICAL_PAGE_KEYS, W as ListPageParams, Wt as PageKeys, X as RelationPageParams, Xt as ResolvedPaginator, Y as RelationName, Yt as PageParamsOf, Z as RelationPaginator, Zt as TypedPage, _ as HANDLE_RESERVED, _n as StrategyDescriptor, _t as AtomicResult, a as Validator, an as Cardinality, at as SortToken, b as JsonApiTransport, bt as AtomicUpdateInput, c as resolveValidator, cn as MenuDescriptor, ct as TypedReadQuery, d as JsonApiContext, dn as PaginatorRole, dt as AtomicCreateHandle, en as ActionInput, et as ResourceAccessors, f as JsonApiRequest, fn as PaginatorStrategy, ft as AtomicCreateInput, g as ClientOptions, gn as ResourceDescriptor, gt as AtomicRef, h as serializeQuery, hn as RelationMutations, ht as AtomicRecorder, i as ValidationOption, in as AtomicDescriptor, it as SortQuery, j as DefaultAttributes, jt as Edge, k as CreateInput, kt as ArrayEnvelope, l as validateDocument, ln as PaginatorDescriptor, lt as UpdateInput, m as execute, mn as RelationDescriptor, mt as AtomicHandle, n as SchemaMap, nn as ActionScope, nt as ResourceObjectView, o as WireResource, on as ClientIdPolicy, ot as TypeAccessor, p as ReadQuery, pn as PivotDescriptor, pt as AtomicDeleteHandle, q as ReadResult, qt as PageOf, r as ValidationConfig, rn as ApiDescriptor, rt as SingleReadQuery, s as assertJsonApiDocument, sn as CountableDescriptor, st as TypeName, t as ResolvedValidator, tn as ActionOutput, tt as ResourceHandle, u as Document, un as PaginatorKind, ut as WriteOptions, v as HeadersInit, vt as AtomicResults, w as ActionsAccessor, wt as JSON_API_MEDIA_TYPE, x as TransportRequest, xt as runAtomic, y as createClient, yt as AtomicUpdateHandle, z as HydratedMember, zt as relatedPaginator } from "./validate-B98ghVgw.cjs";
 
 //#region src/errors.d.ts
 /**

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as RelationshipAccessor, $t as ActionDescriptor, A as DefaultActionTypes, At as DocumentEnvelope, B as IdentifierMember, Bt as relatedPaginatorKind, C as fetchTransport, Ct as ATOMIC_MEDIA_TYPE, D as Collection, Dt as ResourceIdentifier, E as Client, Et as MediaTypeParams, F as FieldSelectionMap, Ft as RelationView, G as MemberName, Gt as PageLinks, H as IncludedRelations, Ht as ExactPageParams, I as FieldsMap, It as ResourceEnvelope, J as ReadableRelationName, Jt as PageParams, K as PivotInput, Kt as PageMeta, L as FilterKey, Lt as ResourceLinks, M as DefaultWriteAttributes, Mt as EdgeEnvelope, N as EdgeMembers, Nt as MaterialiseContext, O as CountToken, Ot as mediaType, P as ErrorCodeOf, Pt as NavigateOptions, Q as RelationReadQuery, Qt as resolvePaginator, R as FilterQuery, Rt as materialise, S as TransportResponse, St as ATOMIC_EXT, T as AtomicResultOf, Tt as LocalIdentifier, U as LinkageRef, Ut as Page, V as IncludePath, Vt as CANONICAL_PAGE_KEYS, W as ListPageParams, Wt as PageKeys, X as RelationPageParams, Xt as ResolvedPaginator, Y as RelationName, Yt as PageParamsOf, Z as RelationPaginator, Zt as TypedPage, _ as HANDLE_RESERVED, _n as StrategyDescriptor, _t as AtomicResult, a as Validator, an as Cardinality, at as SortToken, b as JsonApiTransport, bt as AtomicUpdateInput, c as resolveValidator, cn as MenuDescriptor, ct as TypedReadQuery, d as JsonApiContext, dn as PaginatorRole, dt as AtomicCreateHandle, en as ActionInput, et as ResourceAccessors, f as JsonApiRequest, fn as PaginatorStrategy, ft as AtomicCreateInput, g as ClientOptions, gn as ResourceDescriptor, gt as AtomicRef, h as serializeQuery, hn as RelationMutations, ht as AtomicRecorder, i as ValidationOption, in as AtomicDescriptor, it as SortQuery, j as DefaultAttributes, jt as Edge, k as CreateInput, kt as ArrayEnvelope, l as validateDocument, ln as PaginatorDescriptor, lt as UpdateInput, m as execute, mn as RelationDescriptor, mt as AtomicHandle, n as SchemaMap, nn as ActionScope, nt as ResourceObjectView, o as WireResource, on as ClientIdPolicy, ot as TypeAccessor, p as ReadQuery, pn as PivotDescriptor, pt as AtomicDeleteHandle, q as ReadResult, qt as PageOf, r as ValidationConfig, rn as ApiDescriptor, rt as SingleReadQuery, s as assertJsonApiDocument, sn as CountableDescriptor, st as TypeName, t as ResolvedValidator, tn as ActionOutput, tt as ResourceHandle, u as Document, un as PaginatorKind, ut as WriteOptions, v as HeadersInit, vt as AtomicResults, w as ActionsAccessor, wt as JSON_API_MEDIA_TYPE, x as TransportRequest, xt as runAtomic, y as createClient, yt as AtomicUpdateHandle, z as HydratedMember, zt as relatedPaginator } from "./validate-CJPivkqT.mjs";
+import { $ as RelationshipAccessor, $t as ActionDescriptor, A as DefaultActionTypes, At as DocumentEnvelope, B as IdentifierMember, Bt as relatedPaginatorKind, C as fetchTransport, Ct as ATOMIC_MEDIA_TYPE, D as Collection, Dt as ResourceIdentifier, E as Client, Et as MediaTypeParams, F as FieldSelectionMap, Ft as RelationView, G as MemberName, Gt as PageLinks, H as IncludedRelations, Ht as ExactPageParams, I as FieldsMap, It as ResourceEnvelope, J as ReadableRelationName, Jt as PageParams, K as PivotInput, Kt as PageMeta, L as FilterKey, Lt as ResourceLinks, M as DefaultWriteAttributes, Mt as EdgeEnvelope, N as EdgeMembers, Nt as MaterialiseContext, O as CountToken, Ot as mediaType, P as ErrorCodeOf, Pt as NavigateOptions, Q as RelationReadQuery, Qt as resolvePaginator, R as FilterQuery, Rt as materialise, S as TransportResponse, St as ATOMIC_EXT, T as AtomicResultOf, Tt as LocalIdentifier, U as LinkageRef, Ut as Page, V as IncludePath, Vt as CANONICAL_PAGE_KEYS, W as ListPageParams, Wt as PageKeys, X as RelationPageParams, Xt as ResolvedPaginator, Y as RelationName, Yt as PageParamsOf, Z as RelationPaginator, Zt as TypedPage, _ as HANDLE_RESERVED, _n as StrategyDescriptor, _t as AtomicResult, a as Validator, an as Cardinality, at as SortToken, b as JsonApiTransport, bt as AtomicUpdateInput, c as resolveValidator, cn as MenuDescriptor, ct as TypedReadQuery, d as JsonApiContext, dn as PaginatorRole, dt as AtomicCreateHandle, en as ActionInput, et as ResourceAccessors, f as JsonApiRequest, fn as PaginatorStrategy, ft as AtomicCreateInput, g as ClientOptions, gn as ResourceDescriptor, gt as AtomicRef, h as serializeQuery, hn as RelationMutations, ht as AtomicRecorder, i as ValidationOption, in as AtomicDescriptor, it as SortQuery, j as DefaultAttributes, jt as Edge, k as CreateInput, kt as ArrayEnvelope, l as validateDocument, ln as PaginatorDescriptor, lt as UpdateInput, m as execute, mn as RelationDescriptor, mt as AtomicHandle, n as SchemaMap, nn as ActionScope, nt as ResourceObjectView, o as WireResource, on as ClientIdPolicy, ot as TypeAccessor, p as ReadQuery, pn as PivotDescriptor, pt as AtomicDeleteHandle, q as ReadResult, qt as PageOf, r as ValidationConfig, rn as ApiDescriptor, rt as SingleReadQuery, s as assertJsonApiDocument, sn as CountableDescriptor, st as TypeName, t as ResolvedValidator, tn as ActionOutput, tt as ResourceHandle, u as Document, un as PaginatorKind, ut as WriteOptions, v as HeadersInit, vt as AtomicResults, w as ActionsAccessor, wt as JSON_API_MEDIA_TYPE, x as TransportRequest, xt as runAtomic, y as createClient, yt as AtomicUpdateHandle, z as HydratedMember, zt as relatedPaginator } from "./validate-B98ghVgw.mjs";
 
 //#region src/errors.d.ts
 /**

package/dist/index.mjs

@@ -539,12 +539,31 @@ const ATOMIC_MEDIA_TYPE = mediaType({ ext: [ATOMIC_EXT] });
 //#region src/request.ts
 const isAbsolute = (path) => /^https?:\/\//i.test(path);
 const RELATIVE_ORIGIN = "http://relative.invalid";
-/** Resolve a server link against `baseUrl` per RFC 3986. An absolute link is kept verbatim. */
+/**
+* Resolve a server link against `baseUrl` per RFC 3986 and check where it lands. A link on the
+* base's origin is followed; a relative base (e.g. `/api`) takes the page's origin in a browser and
+* otherwise only accepts a link that keeps the host. Anything that isn't plain http(s) is refused.
+*/
 function resolveLink(link, baseUrl) {
-	if (isAbsolute(link)) return link;
-	if (isAbsolute(baseUrl)) return new URL(link, baseUrl).href;
-	const resolved = new URL(link, new URL(baseUrl, RELATIVE_ORIGIN));
-	return resolved.origin === RELATIVE_ORIGIN ? resolved.pathname + resolved.search + resolved.hash : resolved.href;
+	let normalised = link.replace(/[\t\n\r]/g, "");
+	let start = 0;
+	while (start < normalised.length && normalised.charCodeAt(start) <= 32) start++;
+	normalised = normalised.slice(start);
+	const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(normalised)?.[1]?.toLowerCase();
+	if (scheme !== void 0 && scheme !== "http" && scheme !== "https") throw new Error(`Refusing to follow link "${link}": only http(s) links are followed`);
+	const relativeBase = !isAbsolute(baseUrl);
+	const page = globalThis.location?.href;
+	const base = new URL(baseUrl, relativeBase ? typeof page === "string" ? page : RELATIVE_ORIGIN : void 0);
+	const resolved = new URL(link, base);
+	const sameOrigin = resolved.origin === base.origin && (scheme === void 0 || /^https?:\/\//i.test(normalised));
+	if (!sameOrigin) return {
+		url: resolved.href,
+		sameOrigin
+	};
+	return {
+		url: relativeBase ? resolved.pathname + resolved.search + resolved.hash : resolved.href,
+		sameOrigin
+	};
 }
 const append = (parts, key, value) => {
 	if (value === void 0 || value === null || value === "") return;
@@ -582,14 +601,21 @@ function serializeQuery(query) {
 	return parts.join("&");
 }
 /**
-* Execute a request: build the URL (a server link resolved against `baseUrl`, an absolute path
-* verbatim, else `baseUrl + path`), apply content negotiation and any async per-request headers,
+* Execute a request: build the URL (a server link resolved against `baseUrl` and held to its
+* origin, an absolute path verbatim, else `baseUrl + path`), apply content negotiation and any async per-request headers,
 * then drive the transport. A 2xx with a body parses to a {@link Document}; an empty /
 * 204 body resolves to `undefined`. A non-2xx throws a {@link JsonApiError} carrying the
 * parsed error objects (tolerating a non-JSON error body with an empty list).
 */
 async function execute(ctx, req) {
-	let url = req.link ? resolveLink(req.path, ctx.baseUrl) : isAbsolute(req.path) ? req.path : ctx.baseUrl + req.path;
+	let url;
+	let sendHeaders = true;
+	if (req.link) {
+		const link = resolveLink(req.path, ctx.baseUrl);
+		if (!link.sameOrigin && ctx.allowCrossOriginLinks !== true) throw new Error(`Refusing to follow link "${req.path}": it leaves the base URL's origin (set allowCrossOriginLinks to follow it without the configured headers)`);
+		url = link.url;
+		sendHeaders = link.sameOrigin;
+	} else url = isAbsolute(req.path) ? req.path : ctx.baseUrl + req.path;
 	if (req.query) {
 		const qs = serializeQuery(req.query);
 		if (qs) url += (url.includes("?") ? "&" : "?") + qs;
@@ -609,7 +635,7 @@ async function execute(ctx, req) {
 		headers["Content-Type"] = req.contentType ?? negotiated;
 		transportReq.body = req.raw && typeof req.body === "string" ? req.body : JSON.stringify(req.body);
 	}
-	if (ctx.headers) mergeHeaders(headers, await ctx.headers());
+	if (ctx.headers && sendHeaders) mergeHeaders(headers, await ctx.headers());
 	const res = await ctx.transport(transportReq);
 	if (res.status >= 200 && res.status < 300) return parseDocument(res.body);
 	throw new JsonApiError(res.status, parseErrors(res.body));
@@ -1279,7 +1305,8 @@ function createClient(descriptor, options) {
 	const request = {
 		baseUrl: options.baseUrl,
 		transport: options.transport ?? fetchTransport,
-		...options.headers !== void 0 ? { headers: options.headers } : {}
+		...options.headers !== void 0 ? { headers: options.headers } : {},
+		...options.allowCrossOriginLinks !== void 0 ? { allowCrossOriginLinks: options.allowCrossOriginLinks } : {}
 	};
 	const validator = resolveValidator(options.validate);
 	const ctx = {