@pylonsync/react 0.3.269 → 0.3.270

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.269",
+  "version": "0.3.270",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -12,8 +12,8 @@
     "check": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@pylonsync/sdk": "0.3.269",
-    "@pylonsync/sync": "0.3.269"
+    "@pylonsync/sdk": "0.3.270",
+    "@pylonsync/sync": "0.3.270"
   },
   "peerDependencies": {
     "react": ">=19.0.0"

package/src/baseUrl.test.ts

@@ -0,0 +1,44 @@
+// Regression: `getBaseUrl()` is the origin every @pylonsync/client auth helper
+// (createOrg, passwordRegister, createInvite, …) and the room/shard hooks fetch
+// against. It used to return a static `http://localhost:4321` until an explicit
+// `configureClient({ baseUrl })` — so a unified same-origin SSR app (which never
+// calls configureClient) fired all auth/org calls at the dev port: broken on any
+// non-4321 dev port AND in production. The fix defaults to the page origin in a
+// browser. These pin that contract.
+
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { configureClient, getBaseUrl } from "./index";
+
+const realWindow = (globalThis as { window?: unknown }).window;
+afterEach(() => {
+  (globalThis as { window?: unknown }).window = realWindow;
+});
+
+describe("getBaseUrl() — same-origin default for unified SSR apps", () => {
+  // Run order matters: these three execute before any configureClient, so the
+  // first two observe the un-configured resolution path.
+  test("SSR/node (no window) keeps the localhost dev default", () => {
+    (globalThis as { window?: unknown }).window = undefined;
+    expect(getBaseUrl()).toBe("http://localhost:4321");
+  });
+
+  test("browser, unconfigured → the page origin, not localhost:4321", () => {
+    (globalThis as { window?: unknown }).window = {
+      location: { origin: "https://app.example.com" },
+    };
+    expect(getBaseUrl()).toBe("https://app.example.com");
+  });
+
+  test("an explicit configureClient({ baseUrl }) wins over the origin default", () => {
+    (globalThis as { window?: unknown }).window = {
+      location: { origin: "https://app.example.com" },
+    };
+    configureClient({ baseUrl: "https://api.example.com" });
+    expect(getBaseUrl()).toBe("https://api.example.com");
+    // …and still wins when server-rendered (no window) — a separate-origin API
+    // deploy must not silently flip to the page origin.
+    (globalThis as { window?: unknown }).window = undefined;
+    expect(getBaseUrl()).toBe("https://api.example.com");
+  });
+});

package/src/index.ts

@@ -159,9 +159,29 @@ let _baseUrl = "http://localhost:4321";
 let _baseUrlConfigured = false;
 let _appName = "default";
 
-/** Current effective base URL. Used by hooks (useRoom, useShard) that share
- *  the client config but don't have access to the module-private state. */
+/** Current effective base URL. Used by hooks (useRoom, useShard) and the
+ *  @pylonsync/client auth helpers (createOrg, passwordRegister, createInvite,
+ *  …) that share the client config but don't have access to the module-private
+ *  state.
+ *
+ *  When NOT explicitly configured, default to the page origin in a browser
+ *  instead of the `http://localhost:4321` dev constant. A unified SSR/embedded
+ *  app serves its API same-origin, so the static default was a footgun: every
+ *  auth/org call fired at `localhost:4321` — broken on any non-4321 dev port
+ *  AND in production (it would hit the engineer's dev port, not the app's
+ *  domain). `init()`/`createSyncEngine` already resolve `window.location.origin`
+ *  for the sync engine; this brings the auth helpers to the same origin so the
+ *  two never disagree. An explicit `configureClient({ baseUrl })` still wins
+ *  (separate-origin API setups), and SSR/node (no `window`) keeps the dev
+ *  default (server-side calls use same-process paths anyway). */
 export function getBaseUrl(): string {
+  if (
+    !_baseUrlConfigured &&
+    typeof window !== "undefined" &&
+    window.location?.origin
+  ) {
+    return window.location.origin;
+  }
   return _baseUrl;
 }
 
@@ -250,7 +270,7 @@ function assertBaseUrlSafeForEnv(): void {
  */
 function transportConfig(): import("@pylonsync/sync").TransportConfig {
   return {
-    baseUrl: _baseUrl,
+    baseUrl: getBaseUrl(),
     getToken: () => currentAuthToken() ?? undefined,
   };
 }
@@ -328,7 +348,7 @@ export async function getAuthContext(
   token?: string
 ): Promise<{ user_id: string | null }> {
   return pylonFetch<{ user_id: string | null }>(
-    { baseUrl: _baseUrl, token },
+    { baseUrl: getBaseUrl(), token },
     "/api/auth/me",
   );
 }
@@ -349,7 +369,7 @@ export async function refreshSession(
       token: string;
       user_id: string;
       expires_at: number;
-    }>({ baseUrl: _baseUrl, token }, "/api/auth/refresh", { method: "POST" });
+    }>({ baseUrl: getBaseUrl(), token }, "/api/auth/refresh", { method: "POST" });
   } catch {
     return null;
   }
@@ -453,7 +473,7 @@ export async function callFn<T = unknown>(
 ): Promise<T> {
   return pylonFetch<T>(
     {
-      baseUrl: _baseUrl,
+      baseUrl: getBaseUrl(),
       getToken: () => options.token ?? currentAuthToken() ?? undefined,
     },
     `/api/fn/${name}`,
@@ -481,7 +501,7 @@ export async function* streamFn(
   // transport.
   const res = await pylonFetchRaw(
     {
-      baseUrl: _baseUrl,
+      baseUrl: getBaseUrl(),
       getToken: () => options.token ?? currentAuthToken() ?? undefined,
     },
     `/api/fn/${name}`,
@@ -605,7 +625,7 @@ export async function uploadFile(
 
   return pylonFetch<UploadedFile>(
     {
-      baseUrl: _baseUrl,
+      baseUrl: getBaseUrl(),
       getToken: () => options.token ?? currentAuthToken() ?? undefined,
     },
     "/api/files/upload",
@@ -638,7 +658,7 @@ export async function uploadFileMultipart(
 
   return pylonFetch<UploadedFile>(
     {
-      baseUrl: _baseUrl,
+      baseUrl: getBaseUrl(),
       getToken: () => options.token ?? currentAuthToken() ?? undefined,
     },
     "/api/files/upload",