@izak0s/spacebring-api 1.8.0 → 1.10.0

package/dist/index.js

@@ -2080,6 +2080,8 @@ var Spacebring = class {
   /** Typed openapi-fetch client — escape hatch for endpoints or options the facade does not cover. */
   raw;
   constructor(config) {
+    const baseUrl = config.baseUrl ?? "https://api.spacebring.com";
+    assertSecureBaseUrl(baseUrl);
     const headers = {
       Authorization: `Basic ${toBase64(`${config.clientId}:${config.clientSecret}`)}`
     };
@@ -2087,7 +2089,7 @@ var Spacebring = class {
       headers["spacebring-network-id"] = config.networkId;
     }
     this.raw = createClient({
-      baseUrl: config.baseUrl ?? "https://api.spacebring.com",
+      baseUrl,
       headers,
       fetch: withRetry(config.fetch ?? globalThis.fetch, config.maxRetries ?? 3, config.timeoutMs)
     });
@@ -2156,6 +2158,20 @@ function sleep(ms, signal) {
     signal.addEventListener("abort", onAbort, { once: true });
   });
 }
+function assertSecureBaseUrl(baseUrl) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    throw new Error(`Spacebring baseUrl is not a valid URL: ${baseUrl}`);
+  }
+  if (url.protocol === "https:") return;
+  const isLoopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol === "http:" && isLoopback) return;
+  throw new Error(
+    `Spacebring baseUrl must use https (got "${url.protocol}//"): Basic-auth credentials would otherwise be sent in cleartext. Use https, or http only for a loopback host.`
+  );
+}
 function toBase64(value) {
   if (typeof Buffer !== "undefined") {
     return Buffer.from(value, "utf8").toString("base64");