@itwin/ecschema-rpcinterface-tests 5.16.0-dev.6 → 5.16.0-dev.8

package/lib/dist/bundled-tests.js

@@ -97495,6 +97495,8 @@ class RealityDataSourceTilesetUrlImpl {
     _baseUrl = "";
     /** Need to be passed down to child tile requests when requesting from blob storage, e.g. a Cesium export from the Mesh Export Service*/
     _searchParams = "";
+    /** Origin of the root tileset URL. `_searchParams` are only forwarded to this origin. */
+    _origin;
     /** Construct a new reality data source.
      * @param props JSON representation of the reality data source
      */
@@ -97543,6 +97545,7 @@ class RealityDataSourceTilesetUrlImpl {
         const urlParts = url.split("/");
         const newUrl = new URL(url);
         this._searchParams = newUrl.search;
+        this._origin = newUrl.origin;
         urlParts.pop();
         if (urlParts.length === 0)
             this._baseUrl = "";
@@ -97576,10 +97579,13 @@ class RealityDataSourceTilesetUrlImpl {
     /** Returns the tile URL.
      * If the tile path is a relative URL, the base URL is prepended to it.
      * For both absolute and relative tile path URLs, the search parameters are checked. If the search params are empty, the base URL's search params are appended to the tile path.
+     * The base URL's search params (which may contain credentials such as a SAS token) are never appended to an absolute URL on a different origin.
      */
     getTileUrl(tilePath) {
         if (this.isValidURL(tilePath)) {
             const url = new URL(tilePath);
+            if (url.origin !== this._origin)
+                return tilePath;
             return url.search === "" ? `${tilePath}${this._searchParams}` : tilePath;
         }
         return tilePath.includes("?") ? `${this._baseUrl}${tilePath}` : `${this._baseUrl}${tilePath}${this._searchParams}`;
@@ -117581,6 +117587,9 @@ class RealityDataSourceGoogle3dTilesImpl {
         // We also do not need to worry about the tile path starting with a slash.
         // This happens in these tiles at the second .json level, but the URL API will handle that for us.
         const url = new URL(tilePath, this._baseUrl);
+        // Never forward the API key or session params to a different origin.
+        if (!this.isSameOrigin(url))
+            return url.toString();
         // If tile is a reference to a tileset, iterate over tileset url's search params and store them in this._searchParams so we can pass them down to children
         if (this.getTileContentType(url.toString()) === "tileset" && url.searchParams.size !== 0) {
             for (const [key, value] of url.searchParams.entries()) {
@@ -117600,15 +117609,20 @@ class RealityDataSourceGoogle3dTilesImpl {
         }
         return newUrl.toString();
     }
+    /** Returns true if `url` has the same origin as the root tileset. Credentials are only sent to that origin. */
+    isSameOrigin(url) {
+        return new URL(url).origin === this._baseUrl;
+    }
     /**
      * Returns the tile content. The path to the tile is relative to the base url of present reality data whatever the type.
      */
     async getTileContent(name) {
+        const url = this.getTileUrl(name);
         let authToken;
-        if (this._getAuthToken) {
+        if (this._getAuthToken && this.isSameOrigin(url)) {
             authToken = await this._getAuthToken();
         }
-        return (0,_request_Request__WEBPACK_IMPORTED_MODULE_2__.request)(this.getTileUrl(name), "arraybuffer", authToken ? {
+        return (0,_request_Request__WEBPACK_IMPORTED_MODULE_2__.request)(url, "arraybuffer", authToken ? {
             headers: {
                 authorization: `Bearer ${authToken}`
             }
@@ -117618,11 +117632,12 @@ class RealityDataSourceGoogle3dTilesImpl {
      * Returns the tile content in json format. The path to the tile is relative to the base url of present reality data whatever the type.
      */
     async getTileJson(name) {
+        const url = this.getTileUrl(name);
         let authToken;
-        if (this._getAuthToken) {
+        if (this._getAuthToken && this.isSameOrigin(url)) {
             authToken = await this._getAuthToken();
         }
-        return (0,_request_Request__WEBPACK_IMPORTED_MODULE_2__.request)(this.getTileUrl(name), "json", authToken ? {
+        return (0,_request_Request__WEBPACK_IMPORTED_MODULE_2__.request)(url, "json", authToken ? {
             headers: {
                 authorization: `Bearer ${authToken}`
             }
@@ -156743,7 +156758,7 @@ class RealityTileLoader {
     /** The base URL the glTF reader should resolve relatively-referenced resources (e.g. external images) against.
      * Prefer the tile's own content URL so that images referenced relative to the content (typical of JSON `.gltf` tiles)
      * resolve correctly, rather than against the tileset root. The tileset's query/authentication parameters (e.g.
-     * `?sig=abc`) are preserved on the returned URL: the data source appends them to every tile request, and the glTF
+     * `?sig=abc`) are preserved on the returned URL when it shares the tileset's origin: the data source appends them to every tile request, and the glTF
      * reader re-applies the base URL's query string to each relatively-referenced resource (see `GltfReader.resolveUrl`),
      * so external resources must be fetched with the same parameters.
      */
@@ -156754,8 +156769,10 @@ class RealityTileLoader {
                 return tile.contentUrl;
             try {
                 const resolved = new URL(tile.contentUrl, treeBaseUrl);
-                if ("" === resolved.search)
-                    resolved.search = new URL(treeBaseUrl).search;
+                const base = new URL(treeBaseUrl);
+                // Only inherit the tileset's query (which may contain credentials) on the tileset's own origin.
+                if ("" === resolved.search && resolved.origin === base.origin)
+                    resolved.search = base.search;
                 return resolved.toString();
             }
             catch {
@@ -168149,7 +168166,9 @@ class GltfReader {
     resolveUrl(uri) {
         try {
             const resolved = new URL(uri, this._baseUrl);
-            resolved.search = this._baseUrl?.search ?? "";
+            // Only forward the base URL's query (which may contain credentials) to the same origin.
+            if (this._baseUrl && resolved.origin === this._baseUrl.origin)
+                resolved.search = this._baseUrl.search;
             return resolved.toString();
         }
         catch {
@@ -338186,7 +338205,7 @@ class WMS {
 (module) {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@itwin/core-frontend","version":"5.16.0-dev.6","description":"iTwin.js frontend components","main":"lib/cjs/core-frontend.js","module":"lib/esm/core-frontend.js","typings":"lib/cjs/core-frontend","license":"MIT","scripts":{"build":"npm run -s copy:public && npm run -s build:cjs && npm run -s build:esm && npm run -s build:workers && npm run -s copy:draco","build:cjs":"npm run -s copy:js:cjs && tsc 1>&2 --outDir lib/cjs","build:esm":"npm run -s copy:js:esm && tsc 1>&2 --module ES2022 --outDir lib/esm","clean":"rimraf -g lib .rush/temp/package-deps*.json","copy:public":"cpx \\"./src/public/**/*\\" ./lib/public","copy:js:cjs":"cpx \\"./src/**/*.js\\" ./lib/cjs","copy:js:esm":"cpx \\"./src/**/*.js\\" ./lib/esm","copy:draco":"cpx \\"./node_modules/@loaders.gl/draco/dist/libs/*\\" ./lib/public/scripts","docs":"betools docs --json=../../generated-docs/core/core-frontend/file.json --tsIndexFile=./core-frontend.ts --onlyJson --excludes=webgl/**/*,**/map/*.d.ts,**/tile/*.d.ts,**/*-css.ts && npm run -s extract","extract":"betools extract --fileExt=ts --extractFrom=./src/test/example-code --recursive --out=../../generated-docs/extract","extract-api":"betools extract-api --entry=core-frontend && npm run extract-extension-api","extract-extension-api":"eslint --no-inline-config -c extraction.eslint.config.js  \\"./src/**/*.ts\\" 1>&2","lint":"eslint \\"./src/**/*.ts\\" 1>&2","lint-fix":"eslint --fix -f visualstudio \\"./src/**/*.ts\\" 1>&2","lint-deprecation":"eslint --fix -f visualstudio --no-inline-config -c ../../common/config/eslint/eslint.config.deprecation-policy.js \\"./src/**/*.ts\\"","pseudolocalize":"betools pseudolocalize --englishDir ./src/public/locales/en --out ./public/locales/en-PSEUDO","test":"npm run build:test-worker && vitest --run","cover":"npm run build:test-worker && vitest --run","build:test-worker":"vite build --config ./src/test/worker/vite.config.mts 1>&2","build:workers":"rimraf lib/workers/webpack && vite build --config ./src/workers/ImdlParser/vite.config.mts 1>&2"},"repository":{"type":"git","url":"https://github.com/iTwin/itwinjs-core.git","directory":"core/frontend"},"keywords":["Bentley","BIM","iModel","digital-twin","iTwin"],"author":{"name":"Bentley Systems, Inc.","url":"http://www.bentley.com"},"peerDependencies":{"@itwin/appui-abstract":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*"},"//devDependencies":["NOTE: All peerDependencies should also be listed as devDependencies since peerDependencies are not considered by npm install","NOTE: All tools used by scripts in this package must be listed as devDependencies"],"devDependencies":{"@bentley/aec-units-schema":"^1.0.3","@bentley/formats-schema":"^1.0.0","@bentley/units-schema":"^1.0.12","@itwin/appui-abstract":"workspace:*","@itwin/build-tools":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*","@itwin/object-storage-core":"^3.0.4","@itwin/eslint-plugin":"^6.0.0","@types/node":"~20.17.0","@types/sinon":"^17.0.2","@vitest/browser-playwright":"^4.1.10","@vitest/coverage-v8":"^4.1.10","cpx2":"^8.0.0","eslint":"^9.31.0","playwright":"~1.64.1","rimraf":"^6.0.1","sinon":"^17.0.2","typescript":"~5.6.2","vite":"^6.4.4","vitest":"^4.1.10"},"//dependencies":["NOTE: these dependencies should be only for things that DO NOT APPEAR IN THE API","NOTE: core-frontend should remain UI technology agnostic, so no react/angular dependencies are allowed"],"dependencies":{"@itwin/core-i18n":"workspace:*","@itwin/webgl-compatibility":"workspace:*","@loaders.gl/core":"^4.4.5","@loaders.gl/draco":"^4.4.5","fuse.js":"^3.3.0","wms-capabilities":"0.6.0"}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@itwin/core-frontend","version":"5.16.0-dev.8","description":"iTwin.js frontend components","main":"lib/cjs/core-frontend.js","module":"lib/esm/core-frontend.js","typings":"lib/cjs/core-frontend","license":"MIT","scripts":{"build":"npm run -s copy:public && npm run -s build:cjs && npm run -s build:esm && npm run -s build:workers && npm run -s copy:draco","build:cjs":"npm run -s copy:js:cjs && tsc 1>&2 --outDir lib/cjs","build:esm":"npm run -s copy:js:esm && tsc 1>&2 --module ES2022 --outDir lib/esm","clean":"rimraf -g lib .rush/temp/package-deps*.json","copy:public":"cpx \\"./src/public/**/*\\" ./lib/public","copy:js:cjs":"cpx \\"./src/**/*.js\\" ./lib/cjs","copy:js:esm":"cpx \\"./src/**/*.js\\" ./lib/esm","copy:draco":"cpx \\"./node_modules/@loaders.gl/draco/dist/libs/*\\" ./lib/public/scripts","docs":"betools docs --json=../../generated-docs/core/core-frontend/file.json --tsIndexFile=./core-frontend.ts --onlyJson --excludes=webgl/**/*,**/map/*.d.ts,**/tile/*.d.ts,**/*-css.ts && npm run -s extract","extract":"betools extract --fileExt=ts --extractFrom=./src/test/example-code --recursive --out=../../generated-docs/extract","extract-api":"betools extract-api --entry=core-frontend && npm run extract-extension-api","extract-extension-api":"eslint --no-inline-config -c extraction.eslint.config.js  \\"./src/**/*.ts\\" 1>&2","lint":"eslint \\"./src/**/*.ts\\" 1>&2","lint-fix":"eslint --fix -f visualstudio \\"./src/**/*.ts\\" 1>&2","lint-deprecation":"eslint --fix -f visualstudio --no-inline-config -c ../../common/config/eslint/eslint.config.deprecation-policy.js \\"./src/**/*.ts\\"","pseudolocalize":"betools pseudolocalize --englishDir ./src/public/locales/en --out ./public/locales/en-PSEUDO","test":"npm run build:test-worker && vitest --run","cover":"npm run build:test-worker && vitest --run","build:test-worker":"vite build --config ./src/test/worker/vite.config.mts 1>&2","build:workers":"rimraf lib/workers/webpack && vite build --config ./src/workers/ImdlParser/vite.config.mts 1>&2"},"repository":{"type":"git","url":"https://github.com/iTwin/itwinjs-core.git","directory":"core/frontend"},"keywords":["Bentley","BIM","iModel","digital-twin","iTwin"],"author":{"name":"Bentley Systems, Inc.","url":"http://www.bentley.com"},"peerDependencies":{"@itwin/appui-abstract":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*"},"//devDependencies":["NOTE: All peerDependencies should also be listed as devDependencies since peerDependencies are not considered by npm install","NOTE: All tools used by scripts in this package must be listed as devDependencies"],"devDependencies":{"@bentley/aec-units-schema":"catalog:schemas","@bentley/formats-schema":"catalog:schemas","@bentley/units-schema":"catalog:schemas","@itwin/appui-abstract":"workspace:*","@itwin/build-tools":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*","@itwin/object-storage-core":"catalog:imodels-clients","@itwin/eslint-plugin":"catalog:linting","@types/node":"catalog:build","@types/sinon":"catalog:testing","@vitest/browser-playwright":"catalog:testing","@vitest/coverage-v8":"catalog:testing","cpx2":"catalog:build","eslint":"catalog:linting","playwright":"catalog:testing","rimraf":"catalog:build","sinon":"catalog:testing","typescript":"catalog:build","vite":"catalog:bundling","vitest":"catalog:testing"},"//dependencies":["NOTE: these dependencies should be only for things that DO NOT APPEAR IN THE API","NOTE: core-frontend should remain UI technology agnostic, so no react/angular dependencies are allowed"],"dependencies":{"@itwin/core-i18n":"workspace:*","@itwin/webgl-compatibility":"workspace:*","@loaders.gl/core":"^4.4.5","@loaders.gl/draco":"^4.4.5","fuse.js":"^3.3.0","wms-capabilities":"0.6.0"}}');
 
 /***/ },