@native-marketing/sdk 0.3.1 → 0.3.2

package/dist/http.js

@@ -1,11 +1,83 @@
 // packages/api-client/src/client.ts
 import createClient from "openapi-fetch";
+
+// packages/api-client/src/request-policy.ts
+var verbs = /* @__PURE__ */ new Set(["GET", "PUT", "POST", "DELETE", "OPTIONS", "HEAD", "PATCH", "TRACE"]);
+function unsafe() {
+  throw new TypeError("HTTP client request violates its configured secure API boundary.");
+}
+function scopeOf(value) {
+  if (typeof value !== "string" || value.trim() !== value || /[\\?#]/.test(value)) unsafe();
+  const relative = value.startsWith("/") && !value.startsWith("//");
+  let url;
+  try {
+    url = relative ? new URL(value, "https://relative.invalid") : new URL(value);
+  } catch {
+    return unsafe();
+  }
+  if (url.username || url.password || url.search || url.hash) unsafe();
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+    unsafe();
+  return {
+    ...relative ? {} : { origin: url.origin },
+    pathname: url.pathname.replace(/\/+$/, "")
+  };
+}
+function httpRequestPolicy(baseUrl, transport) {
+  const scope = scopeOf(baseUrl);
+  const origin = scope.origin ?? globalThis.location?.origin;
+  return {
+    validateInit(value) {
+      if (value === void 0) return;
+      if (value === null || typeof value !== "object") unsafe();
+      const init = value;
+      if (init.redirect !== void 0 && init.redirect !== "error") unsafe();
+      if (init.fetch !== void 0 || init.Request !== void 0 || init.middleware !== void 0)
+        unsafe();
+      if (init.baseUrl !== void 0) {
+        if (typeof init.baseUrl !== "string") unsafe();
+        const alternate = scopeOf(init.baseUrl);
+        if ((alternate.origin ?? origin) !== origin || alternate.pathname !== scope.pathname)
+          unsafe();
+      }
+    },
+    async fetch(request) {
+      const url = new URL(request.url);
+      if (!origin || url.origin !== origin || url.username || url.password || !(url.pathname === scope.pathname || url.pathname.startsWith(`${scope.pathname}/`)) || request.redirect !== "error")
+        unsafe();
+      return transport(request);
+    }
+  };
+}
+function guardHttpMethods(client, validate) {
+  const methods = /* @__PURE__ */ new Map();
+  return new Proxy(client, {
+    get(target, property, receiver) {
+      const value = Reflect.get(target, property, receiver);
+      if (typeof property !== "string" || typeof value !== "function" || !(verbs.has(property) || property === "request"))
+        return value;
+      if (!methods.has(property))
+        methods.set(property, async (...args) => {
+          validate(args[property === "request" ? 2 : 1]);
+          return Reflect.apply(value, target, args);
+        });
+      return methods.get(property);
+    }
+  });
+}
+
+// packages/api-client/src/client.ts
 function createContentFactoryClient(options = {}) {
+  const baseUrl = options.baseUrl ?? "/api/v1";
+  const policy = httpRequestPolicy(
+    baseUrl,
+    options.fetch ?? ((request) => globalThis.fetch(request))
+  );
   const client = createClient({
-    baseUrl: options.baseUrl ?? "/api/v1",
+    baseUrl,
     credentials: "include",
     redirect: "error",
-    ...options.fetch ? { fetch: options.fetch } : {}
+    fetch: policy.fetch
   });
   client.use({
     onRequest({ request }) {
@@ -16,7 +88,7 @@ function createContentFactoryClient(options = {}) {
       return new Request(request, { headers, body: "{}" });
     }
   });
-  return client;
+  return guardHttpMethods(client, policy.validateInit);
 }
 
 // packages/contracts/src/business-code.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@native-marketing/sdk",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {

package/release.json

@@ -1,7 +1,7 @@
 {
-  "sourceCommit": "afa0dc260d267c9f7fa1da3ff3e629325bf5a6a1",
+  "sourceCommit": "09d271148a0cdfdfa89b0404023cc24a55c42618",
   "workingTreeDirty": false,
-  "version": "0.3.1",
+  "version": "0.3.2",
   "openapiTypesSha256": "1a86e24ce9e458e945e4df5e9c7423c9bf4253ac24b3f627f67ba38c92856a38",
   "localBuild": true
 }

package/types/http/request-policy.d.ts

@@ -0,0 +1,5 @@
+export declare function httpRequestPolicy(baseUrl: string, transport: (input: Request) => Promise<Response>): {
+    validateInit(value: unknown): void;
+    fetch(request: Request): Promise<Response>;
+};
+export declare function guardHttpMethods<T extends object>(client: T, validate: (init: unknown) => void): T;