@motherbase/cli 0.2.1 → 0.2.2

package/bin/motherbase.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 'use strict';
 
 const { main } = require('../src/main');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motherbase/cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Motherbase operator CLI — drives the Platform Console and linked projects.",
   "type": "commonjs",
   "bin": {
@@ -20,5 +20,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "dependencies": {
+    "@motherbase/cli": "^0.2.1"
+  }
 }

package/src/api.js

@@ -36,6 +36,14 @@ function unwrap(body) {
   return body;
 }
 
+// Non-browser clients send no Origin header. Better Auth (and reverse proxies
+// that inject cookies) then treat the request as CSRF-suspect and reject it with
+// "Missing or null Origin". Sending the target's own origin — which the server
+// keeps in its trustedOrigins (baseURL) — satisfies that check for every route.
+function originFor(url) {
+  try { return new URL(url).origin; } catch { return undefined; }
+}
+
 function errorMessage(status, body, text) {
   const snippet = (body && (body.message || body.error)) || (text ? text.slice(0, 300) : '');
   if (status === 401) {
@@ -65,6 +73,10 @@ async function parseResponse(res) {
 async function doFetch(url, { method = 'GET', token, body, headers = {} } = {}) {
   const finalHeaders = { ...headers };
   if (token) finalHeaders['authorization'] = `Bearer ${token}`;
+  if (!finalHeaders['origin']) {
+    const origin = originFor(url);
+    if (origin) finalHeaders['origin'] = origin;
+  }
   let payload;
   if (body !== undefined && body !== null) {
     finalHeaders['content-type'] = 'application/json';
@@ -94,9 +106,12 @@ async function loginRequest(consoleUrl, email, password) {
   const url = `${consoleUrl}/api/auth/sign-in/email`;
   let res;
   try {
+    const headers = { 'content-type': 'application/json' };
+    const origin = originFor(url);
+    if (origin) headers['origin'] = origin;
     res = await fetch(url, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      headers,
       body: JSON.stringify({ email, password }),
     });
   } catch (err) {
@@ -149,11 +164,14 @@ async function uploadFile(ctx, apiPath, filePath, fields = {}) {
   for (const [k, v] of Object.entries(fields)) {
     if (v !== undefined && v !== null) form.append(k, String(v));
   }
+  const uploadHeaders = token ? { authorization: `Bearer ${token}` } : {};
+  const uploadOrigin = originFor(url);
+  if (uploadOrigin) uploadHeaders['origin'] = uploadOrigin;
   let res;
   try {
     res = await fetch(url, {
       method: 'POST',
-      headers: token ? { authorization: `Bearer ${token}` } : {},
+      headers: uploadHeaders,
       body: form,
     });
   } catch (err) {
@@ -168,9 +186,12 @@ async function downloadFile(ctx, apiPath, destPath, { query } = {}) {
   const target = ctx.requireProject();
   const { base, token } = adminBase(target);
   const url = `${base}${apiPath}${buildQuery(query)}`;
+  const dlHeaders = token ? { authorization: `Bearer ${token}` } : {};
+  const dlOrigin = originFor(url);
+  if (dlOrigin) dlHeaders['origin'] = dlOrigin;
   let res;
   try {
-    res = await fetch(url, { headers: token ? { authorization: `Bearer ${token}` } : {} });
+    res = await fetch(url, { headers: dlHeaders });
   } catch (err) {
     throw new CliError(`Cannot reach ${url}: ${err.message}`);
   }