@object-ui/auth 16.0.0 → 16.1.0

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # @object-ui/auth
 
+## 16.1.0
+
+### Minor Changes
+
+- 803558e: feat(data): thread the host's authenticated fetch into `provider: 'api'` data sources (#2725)
+
+  `provider: 'api'` view data sources went through a bare `globalThis.fetch`, so
+  custom endpoints (gantt composite trees, report aggregates) carried only
+  same-origin cookies while every native `/api/v1/*` request carried
+  `Authorization: Bearer` — the moment cookie HMAC verification failed (dev
+  restart rotating the fallback auth secret, cookie expiry/rotation in prod)
+  those views 401'd while the rest of the app kept working.
+
+  - **`@object-ui/react`** — `SchemaRendererProvider` accepts an optional
+    `apiFetch`; nested providers inherit it from their parent so re-wrapped
+    subtrees (react pages, preview surfaces) keep the host's authentication.
+    `useViewData` defaults the api-provider adapter's fetch to the context
+    `apiFetch` (explicit `adapterOptions.fetch` still wins).
+  - **`@object-ui/auth`** — `createAuthenticatedFetch` gains a
+    `sameOriginOnly` option: cross-origin URLs pass through to the bare fetch
+    with no `Authorization` / `X-Tenant-ID` / `Accept-Language`, so metadata-
+    supplied third-party URLs never see the platform token.
+  - **`@object-ui/app-shell`** — the console wires
+    `createAuthenticatedFetch({ sameOriginOnly: true })` (settle-signal wrapped)
+    as `apiFetch` on the root `SchemaRendererProvider`.
+  - **`@object-ui/plugin-gantt`** — `ObjectGantt` resolves its api-provider
+    DataSource with the context `apiFetch`, covering reads and write-backs.
+
+  Behaviour is unchanged for hosts that don't provide `apiFetch` (bare fetch +
+  cookies, as before).
+
+### Patch Changes
+
+- Updated dependencies [7cf4051]
+- Updated dependencies [94d4876]
+- Updated dependencies [2b17339]
+- Updated dependencies [31b77d4]
+- Updated dependencies [6d4fbe6]
+- Updated dependencies [62b9ab5]
+- Updated dependencies [29c6040]
+- Updated dependencies [faebac3]
+- Updated dependencies [199fa83]
+  - @object-ui/types@16.1.0
+
 ## 16.0.0
 
 ### Patch Changes

package/README.md

@@ -126,10 +126,16 @@ Displays current user info with avatar and sign-out:
 
 ### createAuthenticatedFetch
 
-Creates a fetch wrapper that injects auth tokens into DataSource requests:
+Creates a fetch wrapper that injects the stored Bearer token (plus
+`X-Tenant-ID` and `Accept-Language`) into API requests:
 
 ```tsx
-const authedFetch = createAuthenticatedFetch({ getToken: () => session.token });
+const authedFetch = createAuthenticatedFetch();
+
+// For fetches whose target URL comes from view metadata (`provider: 'api'`
+// data sources), restrict credential injection to the current page's origin
+// so the platform token never leaks to third-party hosts:
+const apiProviderFetch = createAuthenticatedFetch({ sameOriginOnly: true });
 ```
 
 ## Preview Mode

package/dist/createAuthenticatedFetch.d.ts

@@ -24,6 +24,18 @@ export declare const ActiveOrganizationStorage: {
     set(orgId: string): void;
     clear(): void;
 };
+export interface CreateAuthenticatedFetchOptions {
+    /**
+     * When true, requests whose URL resolves to a different origin than the
+     * current page are passed through to the bare global fetch — no
+     * Authorization, X-Tenant-ID, or Accept-Language headers are attached.
+     *
+     * Use this for fetches whose target URL comes from view metadata
+     * (`provider: 'api'` data sources): those may point at third-party hosts
+     * that must never see the platform bearer token.
+     */
+    sameOriginOnly?: boolean;
+}
 /**
  * Creates an authenticated fetch wrapper that injects the Bearer token
  * from localStorage into every request to the ObjectStack API.
@@ -42,5 +54,5 @@ export declare const ActiveOrganizationStorage: {
  * });
  * ```
  */
-export declare function createAuthenticatedFetch(): (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export declare function createAuthenticatedFetch(options?: CreateAuthenticatedFetchOptions): (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 //# sourceMappingURL=createAuthenticatedFetch.d.ts.map

package/dist/createAuthenticatedFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthenticatedFetch.d.ts","sourceRoot":"","sources":["../src/createAuthenticatedFetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;;GAGG;AACH,eAAO,MAAM,yBAAyB;kBACd,MAAM,GAAG,IAAI;WAE5B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aASf,IAAI;CAQd,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAuC9G"}
+{"version":3,"file":"createAuthenticatedFetch.d.ts","sourceRoot":"","sources":["../src/createAuthenticatedFetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;;GAGG;AACH,eAAO,MAAM,yBAAyB;kBACd,MAAM,GAAG,IAAI;WAE5B,MAAM,GAAG,IAAI;eAST,MAAM,GAAG,IAAI;aASf,IAAI;CAQd,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,+BAA+B,GACxC,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CA0CrE"}

package/dist/createAuthenticatedFetch.js

@@ -42,6 +42,17 @@ export const ActiveOrganizationStorage = {
         catch { /* SSR / test */ }
     },
 };
+/** True when `url` resolves to a different origin than the current page. */
+function isCrossOrigin(url) {
+    if (typeof window === 'undefined' || !window.location)
+        return true;
+    try {
+        return new URL(url, window.location.href).origin !== window.location.origin;
+    }
+    catch {
+        return true;
+    }
+}
 /**
  * Creates an authenticated fetch wrapper that injects the Bearer token
  * from localStorage into every request to the ObjectStack API.
@@ -60,10 +71,13 @@ export const ActiveOrganizationStorage = {
  * });
  * ```
  */
-export function createAuthenticatedFetch() {
+export function createAuthenticatedFetch(options) {
     return async (input, init) => {
         const headers = new Headers(init?.headers);
         const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+        if (options?.sameOriginOnly && isCrossOrigin(url)) {
+            return fetch(input, init);
+        }
         const isApiCall = /\/api\//i.test(url);
         const token = TokenStorage.get();
         if (token && isApiCall) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/auth",
-  "version": "16.0.0",
+  "version": "16.1.0",
   "type": "module",
   "license": "MIT",
   "description": "Authentication system for Object UI with AuthProvider, useAuth hook, AuthGuard, and form components.",
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "better-auth": "^1.6.23",
-    "@object-ui/types": "16.0.0"
+    "@object-ui/types": "16.1.0"
   },
   "devDependencies": {
     "@types/react": "19.2.17",