@pagamio/frontend-commons-lib 0.8.290 → 0.8.292

package/lib/api/client.js

@@ -11,7 +11,7 @@ export class ApiClient {
             defaultHeaders: {
                 'Content-Type': 'application/json',
             },
-            credentials: 'include',
+            credentials: 'same-origin',
             ...config,
         };
     }
@@ -159,7 +159,11 @@ export class ApiClient {
      * Creates a URL with query parameters.
      */
     createUrl(endpoint, params) {
-        const url = new URL(endpoint.startsWith('http') ? endpoint : `${this.config.baseURL}${endpoint}`);
+        const raw = endpoint.startsWith('http') ? endpoint : `${this.config.baseURL}${endpoint}`;
+        // When baseURL is a relative path (e.g. /api/v1) we need window.location.origin
+        // as the base for the URL constructor.
+        const base = typeof window !== 'undefined' ? window.location.origin : undefined;
+        const url = new URL(raw, base);
         if (params) {
             Object.entries(params).forEach(([key, value]) => {
                 url.searchParams.append(key, value);

package/lib/auth/utils/TokenManager.js

@@ -60,13 +60,13 @@ export class TokenManager {
     }
     async refreshTokens() {
         try {
-            // The refresh token is stored as an httpOnly cookie and cannot be read
-            // by JS. We send `credentials: 'include'` so the browser attaches it
-            // automatically, and `x-origin-web` so the backend reads from cookies.
+            // The refresh token is stored as an httpOnly cookie by the backend.
+            // Requests go through the same-origin proxy so cookies are first-party
+            // and sent automatically with credentials: 'same-origin'.
             const oldRefreshToken = this.getRefreshToken();
             const response = await fetch(`${this.baseUrl}${this.refreshEndpoint}`, {
                 method: 'POST',
-                credentials: 'include',
+                credentials: 'same-origin',
                 headers: {
                     'Content-Type': 'application/json',
                     'x-origin-web': 'web-client',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pagamio/frontend-commons-lib",
   "description": "Pagamio library for Frontend reusable components like the form engine and table container",
-  "version": "0.8.290",
+  "version": "0.8.292",
   "publishConfig": {
     "access": "public",
     "provenance": false