@pikku/fetch 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 ## 0.12.0
 
+## 0.12.1
+
+### Patch Changes
+
+- 3fbd05c: Encode URI path parameters with encodeURIComponent to prevent path injection via user-supplied data values.
+
 ### New Features
 
 - Auto-remove `Content-Type` header for bodyless requests (GET/DELETE)

package/dist/cjs/core-pikku-fetch.d.ts

@@ -61,6 +61,27 @@ export declare class CorePikkuFetch {
     get(uri: string, data: any, options?: RequestInit): Promise<any>;
     patch(uri: string, data: any, options?: RequestInit): Promise<any>;
     head(uri: string, data: any, options?: RequestInit): Promise<any>;
+    /**
+     * Uploads a file to a URL obtained from `getUploadURL`.
+     * Handles both presigned URLs (e.g. S3) and header-based auth (e.g. B2).
+     *
+     * @param {Object} uploadInfo - The result from the backend's `getUploadURL` call.
+     * @param {string} uploadInfo.uploadUrl - The URL to upload to.
+     * @param {string} uploadInfo.assetKey - The finalized asset key.
+     * @param {Record<string, string>} [uploadInfo.uploadHeaders] - Optional headers required by the storage backend.
+     * @param {Blob | File | Buffer | ReadableStream} body - The file content to upload.
+     * @param {string} [contentType] - The MIME type (used as fallback if not in uploadHeaders).
+     * @returns {Promise<{ assetKey: string; response: Response }>} - The asset key and raw response.
+     */
+    uploadFile(uploadInfo: {
+        uploadUrl: string;
+        assetKey: string;
+        uploadHeaders?: Record<string, string>;
+        uploadMethod?: 'PUT' | 'POST';
+    }, body: Blob | File | BufferSource | ReadableStream, contentType?: string): Promise<{
+        assetKey: string;
+        response: Response;
+    }>;
     /**
      * Makes an API request with the specified URI, method, and data, and optionally transforms dates in the response.
      *

package/dist/cjs/core-pikku-fetch.js

@@ -103,6 +103,36 @@ class CorePikkuFetch {
             return yield this.api(uri, 'HEAD', data, options);
         });
     }
+    /**
+     * Uploads a file to a URL obtained from `getUploadURL`.
+     * Handles both presigned URLs (e.g. S3) and header-based auth (e.g. B2).
+     *
+     * @param {Object} uploadInfo - The result from the backend's `getUploadURL` call.
+     * @param {string} uploadInfo.uploadUrl - The URL to upload to.
+     * @param {string} uploadInfo.assetKey - The finalized asset key.
+     * @param {Record<string, string>} [uploadInfo.uploadHeaders] - Optional headers required by the storage backend.
+     * @param {Blob | File | Buffer | ReadableStream} body - The file content to upload.
+     * @param {string} [contentType] - The MIME type (used as fallback if not in uploadHeaders).
+     * @returns {Promise<{ assetKey: string; response: Response }>} - The asset key and raw response.
+     */
+    uploadFile(uploadInfo, body, contentType) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const headers = Object.assign({}, uploadInfo.uploadHeaders);
+            if (!headers['Content-Type'] && contentType) {
+                headers['Content-Type'] = contentType;
+            }
+            const response = yield fetch(uploadInfo.uploadUrl, {
+                method: (_a = uploadInfo.uploadMethod) !== null && _a !== void 0 ? _a : 'PUT',
+                headers,
+                body: body,
+            });
+            if (response.status >= 400) {
+                throw response;
+            }
+            return { assetKey: uploadInfo.assetKey, response };
+        });
+    }
     /**
      * Makes an API request with the specified URI, method, and data, and optionally transforms dates in the response.
      *

package/dist/cjs/pikku-fetch.js

@@ -28,7 +28,7 @@ const corePikkuFetch = (uri, data, options) => __awaiter(void 0, void 0, void 0,
         const keys = Object.keys(data);
         for (const key of keys) {
             if (uri.includes(`:${key}`)) {
-                uri = uri.replace(`:${key}`, data[key]);
+                uri = uri.replace(`:${key}`, encodeURIComponent(String(data[key])));
                 delete data[key];
             }
         }

package/dist/esm/core-pikku-fetch.d.ts

@@ -61,6 +61,27 @@ export declare class CorePikkuFetch {
     get(uri: string, data: any, options?: RequestInit): Promise<any>;
     patch(uri: string, data: any, options?: RequestInit): Promise<any>;
     head(uri: string, data: any, options?: RequestInit): Promise<any>;
+    /**
+     * Uploads a file to a URL obtained from `getUploadURL`.
+     * Handles both presigned URLs (e.g. S3) and header-based auth (e.g. B2).
+     *
+     * @param {Object} uploadInfo - The result from the backend's `getUploadURL` call.
+     * @param {string} uploadInfo.uploadUrl - The URL to upload to.
+     * @param {string} uploadInfo.assetKey - The finalized asset key.
+     * @param {Record<string, string>} [uploadInfo.uploadHeaders] - Optional headers required by the storage backend.
+     * @param {Blob | File | Buffer | ReadableStream} body - The file content to upload.
+     * @param {string} [contentType] - The MIME type (used as fallback if not in uploadHeaders).
+     * @returns {Promise<{ assetKey: string; response: Response }>} - The asset key and raw response.
+     */
+    uploadFile(uploadInfo: {
+        uploadUrl: string;
+        assetKey: string;
+        uploadHeaders?: Record<string, string>;
+        uploadMethod?: 'PUT' | 'POST';
+    }, body: Blob | File | BufferSource | ReadableStream, contentType?: string): Promise<{
+        assetKey: string;
+        response: Response;
+    }>;
     /**
      * Makes an API request with the specified URI, method, and data, and optionally transforms dates in the response.
      *

package/dist/esm/core-pikku-fetch.js

@@ -84,6 +84,35 @@ export class CorePikkuFetch {
     async head(uri, data, options) {
         return await this.api(uri, 'HEAD', data, options);
     }
+    /**
+     * Uploads a file to a URL obtained from `getUploadURL`.
+     * Handles both presigned URLs (e.g. S3) and header-based auth (e.g. B2).
+     *
+     * @param {Object} uploadInfo - The result from the backend's `getUploadURL` call.
+     * @param {string} uploadInfo.uploadUrl - The URL to upload to.
+     * @param {string} uploadInfo.assetKey - The finalized asset key.
+     * @param {Record<string, string>} [uploadInfo.uploadHeaders] - Optional headers required by the storage backend.
+     * @param {Blob | File | Buffer | ReadableStream} body - The file content to upload.
+     * @param {string} [contentType] - The MIME type (used as fallback if not in uploadHeaders).
+     * @returns {Promise<{ assetKey: string; response: Response }>} - The asset key and raw response.
+     */
+    async uploadFile(uploadInfo, body, contentType) {
+        const headers = {
+            ...uploadInfo.uploadHeaders,
+        };
+        if (!headers['Content-Type'] && contentType) {
+            headers['Content-Type'] = contentType;
+        }
+        const response = await fetch(uploadInfo.uploadUrl, {
+            method: uploadInfo.uploadMethod ?? 'PUT',
+            headers,
+            body: body,
+        });
+        if (response.status >= 400) {
+            throw response;
+        }
+        return { assetKey: uploadInfo.assetKey, response };
+    }
     /**
      * Makes an API request with the specified URI, method, and data, and optionally transforms dates in the response.
      *

package/dist/esm/pikku-fetch.js

@@ -15,7 +15,7 @@ export const corePikkuFetch = async (uri, data, options) => {
         const keys = Object.keys(data);
         for (const key of keys) {
             if (uri.includes(`:${key}`)) {
-                uri = uri.replace(`:${key}`, data[key]);
+                uri = uri.replace(`:${key}`, encodeURIComponent(String(data[key])));
                 delete data[key];
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/fetch",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "type": "module",
@@ -21,7 +21,8 @@
     "release": "yarn build && npm test",
     "test": "bash run-tests.sh",
     "test:watch": "bash run-tests.sh --watch",
-    "test:coverage": "bash run-tests.sh --coverage"
+    "test:coverage": "bash run-tests.sh --coverage",
+    "prepublishOnly": "yarn build"
   },
   "devDependencies": {
     "typescript": "^5.9"

package/src/core-pikku-fetch.ts

@@ -114,6 +114,48 @@ export class CorePikkuFetch {
     return await this.api(uri, 'HEAD', data, options)
   }
 
+  /**
+   * Uploads a file to a URL obtained from `getUploadURL`.
+   * Handles both presigned URLs (e.g. S3) and header-based auth (e.g. B2).
+   *
+   * @param {Object} uploadInfo - The result from the backend's `getUploadURL` call.
+   * @param {string} uploadInfo.uploadUrl - The URL to upload to.
+   * @param {string} uploadInfo.assetKey - The finalized asset key.
+   * @param {Record<string, string>} [uploadInfo.uploadHeaders] - Optional headers required by the storage backend.
+   * @param {Blob | File | Buffer | ReadableStream} body - The file content to upload.
+   * @param {string} [contentType] - The MIME type (used as fallback if not in uploadHeaders).
+   * @returns {Promise<{ assetKey: string; response: Response }>} - The asset key and raw response.
+   */
+  public async uploadFile(
+    uploadInfo: {
+      uploadUrl: string
+      assetKey: string
+      uploadHeaders?: Record<string, string>
+      uploadMethod?: 'PUT' | 'POST'
+    },
+    body: Blob | File | BufferSource | ReadableStream,
+    contentType?: string
+  ): Promise<{ assetKey: string; response: Response }> {
+    const headers: Record<string, string> = {
+      ...uploadInfo.uploadHeaders,
+    }
+    if (!headers['Content-Type'] && contentType) {
+      headers['Content-Type'] = contentType
+    }
+
+    const response = await fetch(uploadInfo.uploadUrl, {
+      method: uploadInfo.uploadMethod ?? 'PUT',
+      headers,
+      body: body as any,
+    })
+
+    if (response.status >= 400) {
+      throw response
+    }
+
+    return { assetKey: uploadInfo.assetKey, response }
+  }
+
   /**
    * Makes an API request with the specified URI, method, and data, and optionally transforms dates in the response.
    *

package/src/pikku-fetch.ts

@@ -21,7 +21,7 @@ export const corePikkuFetch = async (
     const keys = Object.keys(data)
     for (const key of keys) {
       if (uri.includes(`:${key}`)) {
-        uri = uri.replace(`:${key}`, data[key])
+        uri = uri.replace(`:${key}`, encodeURIComponent(String(data[key])))
         delete data[key]
       }
     }