@mdbase-dev/connect 0.1.0-beta.107 → 0.1.0-beta.108

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-qa5e6QDDjQFkjqKf4HstaDjyvJmQnvu4PkubKmMs2QIDou3qqMn+uYWQG2Z0ImA2
+sha384-wpc0R7K2M2u/v8bIQcBgnveqMOK02ergpDhAolUQ2yEXNgyXH7U7pLkhlzyvmKZs

package/dist/connect.js

@@ -75,9 +75,7 @@ export class MdbaseConnectInternals {
             : this.application?.distribution ?? "web";
         return {
             distribution,
-            applicationOrigin: distribution === "portable"
-                ? "null"
-                : this.defaultApplicationOrigin(),
+            applicationOrigin: this.defaultApplicationOrigin(),
             credentialStorage: this.credentialStorage
         };
     }
@@ -448,8 +446,8 @@ export class MdbaseConnectInternals {
                     && tokenBody.encryption.suite === RELAY_ENCRYPTION_SUITE
                     && tokenBody.encryption.application_agreement_public_key
                         === grantKey.agreementPublicKey;
-                if (tokenBody.application_origin !== "null") {
-                    throw connectError("invalid_token_response", "Authorization did not bind the portable grant to its opaque application origin.");
+                if (tokenBody.application_origin !== this.defaultApplicationOrigin()) {
+                    throw connectError("invalid_token_response", "Authorization did not bind the portable grant to its exact application origin.");
                 }
                 if (tokenBody.authority
                     && (!authority

package/dist/runtime-utils.d.ts

@@ -34,6 +34,7 @@ export declare function isCanonicalGrantScope(scope: GrantScope): boolean;
 export declare function stripTrailingSlash(value: string): string;
 export declare function defaultManifestSource(): string;
 export declare function defaultRedirectUri(): string;
+export declare function portableApplicationOrigin(): string;
 export declare function applicationStorageOrigin(manifest: MdbaseAppManifest | string, manifestSource: string, redirectUri: string, registeredPortable: boolean): string;
 export declare function collectionIdFromTokenKey(key: string): string;
 export declare function defaultCallbackUrl(): string;

package/dist/runtime-utils.js

@@ -282,10 +282,22 @@ export function defaultRedirectUri() {
     }
     return location.href.split(/[?#]/)[0];
 }
+export function portableApplicationOrigin() {
+    if (typeof location === "undefined")
+        return "null";
+    const url = new URL(location.href);
+    if (["chrome-extension:", "moz-extension:"].includes(url.protocol)) {
+        // Generic URL parsers can serialize extension origins as null. Browsers
+        // send their exact scheme/host as the request Origin.
+        return `${url.protocol}//${url.host}`;
+    }
+    // Chromium can serialize file URL origins as file://; their wire origin is null.
+    return ["http:", "https:"].includes(url.protocol) ? url.origin : "null";
+}
 export function applicationStorageOrigin(manifest, manifestSource, redirectUri, registeredPortable) {
     if ((typeof manifest !== "string" && manifest.distribution === "portable")
         || registeredPortable)
-        return "null";
+        return portableApplicationOrigin();
     const redirect = new URL(redirectUri);
     if (["http:", "https:"].includes(redirect.protocol))
         return redirect.origin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect",
-  "version": "0.1.0-beta.107",
+  "version": "0.1.0-beta.108",
   "private": false,
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@mdbase-dev/connect-protocol": "0.1.0-beta.107"
+    "@mdbase-dev/connect-protocol": "0.1.0-beta.108"
   },
   "devDependencies": {
     "esbuild": "^0.28.1",