@protobase/ui 0.44.5 → 0.45.0

package/dist/app/native-auth-fetch.js

@@ -11,37 +11,65 @@ const nullBodyStatuses = [
 const encodedSeparator = /%2f|%5c/i;
 const isPlatform = (platform) => Object.hasOwn(capacitorOrigin, platform);
 const allowedUrl = (url, apiOrigin) => url.origin === apiOrigin && !url.username && !url.password && url.pathname.startsWith(`${authBasePath}/`) && !encodedSeparator.test(url.pathname);
+/**
+* The native call of a sign-in request: on Android Protobase's own ProtobaseAuth plugin, which checks the address,
+* names the Capacitor origin, refuses redirects and keeps Set-Cookie from the page itself; on iOS, until it has that
+* plugin too, Capacitor's native HTTP with the origin named here.
+*/
+const nativeAuthCall = (platform, { url, method, headers, data }) => {
+	const withData = data === void 0 ? {} : { data };
+	if (platform === "android") return [
+		"ProtobaseAuth",
+		"request",
+		{
+			url,
+			method,
+			headers,
+			...withData
+		}
+	];
+	return [
+		"CapacitorHttp",
+		"request",
+		{
+			url,
+			method,
+			headers: {
+				...headers,
+				origin: capacitorOrigin[platform]
+			},
+			...withData,
+			responseType: "text",
+			disableRedirects: true
+		}
+	];
+};
 const bodyOf = ({ status, headers, data }) => {
 	if (nullBodyStatuses.includes(status)) return null;
 	if (Object.entries(headers).some(([name, value]) => name.toLowerCase() === "content-type" && value.startsWith("application/json"))) return JSON.stringify(data);
 	return typeof data === "string" ? data : JSON.stringify(data);
 };
 /**
-* A `fetch` for the app's sign-in, at `<apiOrigin>/api/auth/...` only, through Capacitor's native HTTP: the session
-* cookie lives in the device's cookie jar, which native HTTP sends and keeps, and the request names the Capacitor
-* origin of the platform, which the server trusts for sign-in with a mobile section. The page cannot set `Cookie`, so
-* the cookie comes from the native jar alone. Any other address is refused before the bridge is called.
+* A `fetch` for the app's sign-in, at `<apiOrigin>/api/auth/...` only, through native HTTP (`nativeAuthCall`): the
+* session cookie lives in the device's cookie jar, which native HTTP sends and keeps, and the request names the
+* Capacitor origin of the platform, which the server trusts for sign-in with a mobile section. The page cannot set
+* `Cookie`, so the cookie comes from the native jar alone. Any other address is refused before the bridge is called.
 */
 const nativeAuthFetch = (bridge, apiOrigin) => {
 	const platform = bridge.getPlatform();
 	if (!isPlatform(platform)) throw new Error(`Signing in through native HTTP is for iOS and Android, not ${platform}`);
-	const origin = capacitorOrigin[platform];
 	return async (input, init) => {
 		const request = new Request(input, init);
 		const url = new URL(request.url);
 		if (!allowedUrl(url, apiOrigin)) throw new Error(`Native sign-in requests go to ${apiOrigin}${authBasePath}/ only, not ${request.url}`);
 		const withBody = request.method !== "GET" && request.method !== "HEAD";
-		const answer = await bridge.nativePromise("CapacitorHttp", "request", {
+		const call = nativeAuthCall(platform, {
 			url: url.href,
 			method: request.method,
-			headers: {
-				...Object.fromEntries(request.headers),
-				origin
-			},
-			...withBody && { data: await request.text() },
-			responseType: "text",
-			disableRedirects: true
+			headers: Object.fromEntries(request.headers),
+			...withBody && { data: await request.text() }
 		});
+		const answer = await bridge.nativePromise(...call);
 		const headers = Object.entries(answer.headers).filter(([name]) => name.toLowerCase() !== "set-cookie");
 		return new Response(bodyOf(answer), {
 			status: answer.status,

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.44.5";
+var version = "0.45.0";
 var protobase = { "pluginApi": 1 };
 //#endregion
 export { protobase, version };