@rebasepro/client 0.9.1-canary.fd3754b → 0.10.0

package/src/realtime-optout.test.ts

@@ -0,0 +1,245 @@
+import { jest } from "@jest/globals";
+import { createRebaseClient } from "./index";
+
+/**
+ * A WebSocket stand-in that records construction. The real socket keeps the Node
+ * event loop alive, which is what makes a one-shot script hang; here we only
+ * need to know whether one would have been opened at all.
+ */
+function trackingWebSocket() {
+    const opened: string[] = [];
+    const closed: string[] = [];
+
+    class FakeWebSocket {
+        static readonly OPEN = 1;
+        readyState = 0;
+        onopen: (() => void) | null = null;
+        onclose: (() => void) | null = null;
+        onerror: (() => void) | null = null;
+        onmessage: (() => void) | null = null;
+
+        constructor(public url: string) {
+            opened.push(url);
+        }
+
+        close() {
+            closed.push(this.url);
+        }
+
+        send() { /* no-op */ }
+    }
+
+    return { FakeWebSocket: FakeWebSocket as unknown as typeof WebSocket, opened, closed };
+}
+
+describe("realtime opt-out", () => {
+    const original = globalThis.WebSocket;
+
+    afterEach(() => {
+        globalThis.WebSocket = original;
+        jest.restoreAllMocks();
+    });
+
+    it("opens NO socket on construction, even with realtime enabled", () => {
+        // Changed deliberately. Constructing a client is not a statement that
+        // the app wants a socket — `createRebaseClient` builds one whenever
+        // realtime is not explicitly disabled, so dialling here cost a
+        // connection on every page load of every app that merely *might*
+        // subscribe later. Anonymous-first apps paid it on every visit to
+        // authenticate with nothing.
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+
+        expect(opened).toHaveLength(0);
+    });
+
+    it("opens the socket on the first channel operation", () => {
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const client = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+
+        // Asking for the channel is not using it.
+        const channel = client.realtime.channel("doc:1");
+        expect(opened).toHaveLength(0);
+
+        void channel.join();
+        expect(opened).toHaveLength(1);
+    });
+
+    it("opens the socket on the first collection subscription", () => {
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const client = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+        expect(opened).toHaveLength(0);
+
+        client.collection("posts").listen!(undefined, () => { /* noop */ });
+
+        expect(opened).toHaveLength(1);
+    });
+
+    it("opens exactly one socket however many things subscribe", () => {
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const client = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+
+        client.collection("posts").listen!(undefined, () => { /* noop */ });
+        client.collection("authors").listen!(undefined, () => { /* noop */ });
+        void client.realtime.channel("doc:1").join();
+
+        expect(opened).toHaveLength(1);
+    });
+
+    it("stays silent for an anonymous client that never subscribes", () => {
+        // The motivating case: most page loads of an anonymous-first app.
+        // No socket, and no console noise either.
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+        const warn = jest.spyOn(console, "warn").mockImplementation(() => { /* capture */ });
+        const debug = jest.spyOn(console, "debug").mockImplementation(() => { /* capture */ });
+
+        const client = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+        void client.realtime.channel("doc:1"); // obtained, never used
+
+        expect(opened).toHaveLength(0);
+        expect(warn).not.toHaveBeenCalled();
+        expect(debug).not.toHaveBeenCalled();
+    });
+
+    it("says nothing about a missing WebSocket until something needs one", () => {
+        // The environment warning used to fire on construction, so a Node
+        // process that never subscribed was told off for a socket it did not
+        // want.
+        // @ts-expect-error deliberately removing the global
+        delete globalThis.WebSocket;
+        const warn = jest.spyOn(console, "warn").mockImplementation(() => { /* capture */ });
+
+        const client = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+        expect(warn).not.toHaveBeenCalled();
+
+        void client.realtime.channel("doc:1").join();
+        expect(warn).toHaveBeenCalledWith(expect.stringMatching(/WebSocket is not defined/));
+
+        // ...and only once, however many times it is asked.
+        void client.realtime.channel("doc:2").join();
+        expect(warn).toHaveBeenCalledTimes(1);
+    });
+
+    it("opens no socket when realtime is disabled", () => {
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const client = createRebaseClient({
+            baseUrl: "http://localhost:3000/api",
+            realtime: false
+        });
+
+        // The socket is what keeps a CLI / cron / ETL process alive past its work.
+        expect(opened).toHaveLength(0);
+        expect(client.ws).toBeUndefined();
+    });
+
+    it("opens no socket when realtime is disabled even if a websocketUrl is given", () => {
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        createRebaseClient({
+            baseUrl: "http://localhost:3000/api",
+            websocketUrl: "ws://localhost:3000",
+            realtime: false
+        });
+
+        expect(opened).toHaveLength(0);
+    });
+
+    it("close() releases a socket that was opened", () => {
+        const { FakeWebSocket, opened, closed } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const client = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+        client.collection("posts").listen!(undefined, () => { /* noop */ });
+        expect(opened).toHaveLength(1);
+
+        client.close();
+
+        expect(closed).toHaveLength(1);
+    });
+
+    it("close() is final — a later subscribe does not redial", () => {
+        // Otherwise one queued frame could reopen the socket that close() just
+        // released, and the Node process this method exists to let exit would
+        // stay alive anyway.
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const client = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+        client.collection("posts").listen!(undefined, () => { /* noop */ });
+        expect(opened).toHaveLength(1);
+
+        client.close();
+        client.collection("authors").listen!(undefined, () => { /* noop */ });
+
+        expect(opened).toHaveLength(1);
+    });
+
+    it("close() is safe when realtime was never started, and when called twice", () => {
+        const { FakeWebSocket } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const offline = createRebaseClient({ baseUrl: "http://localhost:3000/api", realtime: false });
+        expect(() => offline.close()).not.toThrow();
+
+        const live = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+        live.close();
+        expect(() => live.close()).not.toThrow();
+    });
+
+    it("still refuses channels when realtime is disabled", () => {
+        // `realtime: false` remains a hard opt-out. Only the *default* changed
+        // — from "connected eagerly" to "connected on use".
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const client = createRebaseClient({
+            baseUrl: "http://localhost:3000/api",
+            realtime: false
+        });
+
+        expect(() => client.realtime.channel("doc:1")).toThrow(/realtime: false/);
+        expect(opened).toHaveLength(0);
+    });
+
+    it("signing in does not by itself open a socket", () => {
+        // Authenticating is not a request for realtime. If it dialled, every
+        // app with a login would lose lazy connect at the moment of login.
+        const { FakeWebSocket, opened } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const client = createRebaseClient({ baseUrl: "http://localhost:3000/api" });
+        // Drive the auth-state path the way a sign-in would.
+        client.auth.onAuthStateChange(() => { /* noop */ });
+
+        expect(opened).toHaveLength(0);
+    });
+
+    it("leaves listen() absent so callers can feature-detect, and says why via the query builder", () => {
+        const { FakeWebSocket } = trackingWebSocket();
+        globalThis.WebSocket = FakeWebSocket;
+
+        const client = createRebaseClient({
+            baseUrl: "http://localhost:3000/api",
+            realtime: false
+        });
+
+        // `listen` stays undefined rather than becoming a throwing stub: the
+        // optional type is what makes `if (client.listen)` work and what makes
+        // TypeScript reject a bare call.
+        expect(client.collection("posts").listen).toBeUndefined();
+        expect(() => client.data.posts.include("author").listen(() => { /* noop */ }))
+            .toThrow(/realtime: false/);
+    });
+});

package/src/realtime-row-identity.test.ts

@@ -0,0 +1,254 @@
+import { RebaseWebSocketClient } from "./websocket";
+
+/**
+ * Realtime patches name a row by address; the cached rows are columns only.
+ *
+ * The SDK deliberately holds no collection config — a BaaS caller declares
+ * nothing — so it cannot derive an address by itself, and used to just read
+ * `row.id`. For a table keyed on anything else that is `undefined`: deletes
+ * matched no cached row and removed nothing, and updates matched none either,
+ * so every edit was prepended as a duplicate of the row it was editing.
+ *
+ * The server now sends the key columns with the patch, and they are used here.
+ */
+describe("collection_patch — cached rows are matched by derived address", () => {
+    const SKU_PKS = [{ fieldName: "sku",
+type: "string" as const }];
+
+    /**
+     * A client with one collection subscription holding `cached`, wired to the
+     * backend subscription id the patches below use.
+     */
+    const setup = (cached: Record<string, unknown>[]) => {
+        const client = new RebaseWebSocketClient({ url: "ws://localhost:1234" });
+        const updates: Record<string, unknown>[][] = [];
+
+        const internals = client as unknown as {
+            backendToCollectionKey: Map<string, string>;
+            collectionSubscriptions: Map<string, unknown>;
+            handleWebSocketMessage: (m: unknown) => void;
+        };
+
+        internals.backendToCollectionKey.set("backend-1", "sub-key");
+        internals.collectionSubscriptions.set("sub-key", {
+            backendSubscriptionId: "backend-1",
+            callbacks: new Map([["cb", { onUpdate: (rows: Record<string, unknown>[]) => updates.push(rows) }]]),
+            props: { path: "sku_items" },
+            latestData: cached,
+            isInitialDataReceived: true
+        });
+
+        const patch = (message: Record<string, unknown>) =>
+            internals.handleWebSocketMessage({ type: "collection_patch",
+subscriptionId: "backend-1",
+...message });
+
+        const update = (rows: Record<string, unknown>[], pks?: unknown) =>
+            internals.handleWebSocketMessage({ type: "collection_update",
+subscriptionId: "backend-1",
+rows,
+pks });
+
+        return { patch,
+update,
+updates,
+sub: () => internals.collectionSubscriptions.get("sub-key") as { latestData: Record<string, unknown>[] } };
+    };
+
+    it("removes the deleted row a `sku` key names", () => {
+        const { patch, sub } = setup([
+            { sku: "ABC-1",
+label: "Widget" },
+            { sku: "ABC-2",
+label: "Gadget" }
+        ]);
+
+        patch({ id: "ABC-1",
+row: null,
+pks: SKU_PKS });
+
+        expect(sub().latestData).toEqual([{ sku: "ABC-2",
+label: "Gadget" }]);
+    });
+
+    it("replaces the row the patch names, not whichever row is first", () => {
+        // Both sides of the old comparison stringified to "undefined", so it
+        // matched at index 0 every time: editing the second row overwrote the
+        // first one, in place, with the second one's values.
+        const { patch, sub } = setup([
+            { sku: "ABC-1",
+label: "Widget" },
+            { sku: "ABC-2",
+label: "Gadget" }
+        ]);
+
+        patch({ id: "ABC-2",
+row: { sku: "ABC-2",
+label: "Gadget v2" },
+pks: SKU_PKS });
+
+        expect(sub().latestData).toEqual([
+            { sku: "ABC-1",
+label: "Widget" },
+            { sku: "ABC-2",
+label: "Gadget v2" }
+        ]);
+    });
+
+    it("prepends a row that really is new", () => {
+        const { patch, sub } = setup([{ sku: "ABC-2",
+label: "Gadget" }]);
+
+        patch({ id: "ABC-9",
+row: { sku: "ABC-9",
+label: "New" },
+pks: SKU_PKS });
+
+        expect(sub().latestData).toEqual([
+            { sku: "ABC-9",
+label: "New" },
+            { sku: "ABC-2",
+label: "Gadget" }
+        ]);
+    });
+
+    it("matches a composite key by its joined address", () => {
+        const { patch, sub } = setup([
+            { tenant_id: 1,
+user_id: 2,
+role: "admin" },
+            { tenant_id: 1,
+user_id: 3,
+role: "viewer" }
+        ]);
+
+        patch({
+            id: "1:::3",
+            row: { tenant_id: 1,
+user_id: 3,
+role: "owner" },
+            pks: [{ fieldName: "tenant_id",
+type: "number" }, { fieldName: "user_id",
+type: "number" }]
+        });
+
+        expect(sub().latestData).toEqual([
+            { tenant_id: 1,
+user_id: 2,
+role: "admin" },
+            { tenant_id: 1,
+user_id: 3,
+role: "owner" }
+        ]);
+    });
+
+    it("carries the patch's keys into the refetch merge, preserving unchanged references", () => {
+        // Phase 2 of every patch is a full refetch (`collection_update`), whose
+        // merge keeps the cached object for rows that did not change so React
+        // sees the same reference. That matching needs an address too — the
+        // keys learned from the patch are remembered on the subscription.
+        const unchanged = { sku: "ABC-1",
+label: "Widget" };
+        const { patch, update, sub } = setup([unchanged, { sku: "ABC-2",
+label: "Gadget" }]);
+
+        patch({ id: "ABC-2",
+row: { sku: "ABC-2",
+label: "Gadget v2" },
+pks: SKU_PKS });
+        update([{ sku: "ABC-1",
+label: "Widget" }, { sku: "ABC-2",
+label: "Gadget v3" }], SKU_PKS);
+
+        expect(sub().latestData[0]).toBe(unchanged);
+        expect(sub().latestData[1]).toEqual({ sku: "ABC-2",
+label: "Gadget v3" });
+    });
+
+    it("learns the keys from the rows themselves, for a change that sends no patch", () => {
+        // A write from outside the API — psql, a cron job — reaches subscribers
+        // through CDC, which invalidates and refetches without ever sending a
+        // patch. Keys learned only from patches would never arrive, and every
+        // row of the refetch would be a new reference: the whole table
+        // re-renders on any external write.
+        const unchanged = { sku: "ABC-1",
+label: "Widget" };
+        const { update, sub } = setup([unchanged, { sku: "ABC-2",
+label: "Gadget" }]);
+
+        update([{ sku: "ABC-1",
+label: "Widget" }, { sku: "ABC-2",
+label: "Gadget v2" }], SKU_PKS);
+
+        expect(sub().latestData[0]).toBe(unchanged);
+        expect(sub().latestData[1]).toEqual({ sku: "ABC-2",
+label: "Gadget v2" });
+    });
+
+    it("addresses an `id`-keyed collection from the keys like any other", () => {
+        // `id` is not special: the server reports it as the key column, and it
+        // is derived through the same path as a `sku` or a composite.
+        const { patch, sub } = setup([{ id: 1,
+name: "Camera" }, { id: 2,
+name: "Lens" }]);
+
+        patch({ id: "1",
+row: null,
+pks: [{ fieldName: "id",
+type: "number" }] });
+
+        expect(sub().latestData).toEqual([{ id: 2,
+name: "Lens" }]);
+    });
+
+    it("recognises nothing when the server resolved no keys, rather than guessing at `id`", () => {
+        // A table with no primary key and no `id` column has no address. The
+        // server says so by sending no keys, and inventing one from a column
+        // that merely looks like an id would address rows that are not there.
+        const { patch, sub } = setup([
+            { id: "batch-42",
+name: "Camera" },
+            { id: "batch-42",
+name: "Lens" }
+        ]);
+
+        patch({ id: "batch-42",
+row: null });
+
+        // Nothing removed: the patch names a row this client cannot identify.
+        expect(sub().latestData).toHaveLength(2);
+    });
+
+    it("prefers the real key over a column merely named `id`", () => {
+        // `event_id` is the key; `id` is ordinary data, and ordinary data has no
+        // uniqueness to borrow — both rows here carry the same external ref.
+        // Matching on it finds the first, so editing the party rewrote the
+        // launch with the party's values.
+        const { patch, sub } = setup([
+            { event_id: 7,
+id: "batch-42",
+name: "Launch" },
+            { event_id: 8,
+id: "batch-42",
+name: "Party" }
+        ]);
+
+        patch({
+            id: "8",
+            row: { event_id: 8,
+id: "batch-42",
+name: "Party v2" },
+            pks: [{ fieldName: "event_id",
+type: "number" }]
+        });
+
+        expect(sub().latestData).toEqual([
+            { event_id: 7,
+id: "batch-42",
+name: "Launch" },
+            { event_id: 8,
+id: "batch-42",
+name: "Party v2" }
+        ]);
+    });
+});

package/src/sdk_query_builder.ts

@@ -131,7 +131,10 @@ export class SDKQueryBuilder<M extends Record<string, unknown> = Record<string,
      */
     listen(onUpdate: (data: FindResult<M>) => void, onError?: (error: Error) => void): () => void {
         if (!this.collection.listen) {
-            throw new Error("Listen is only available when RebaseClient is configured with a websocketUrl.");
+            throw new Error(
+                "Listen is only available when RebaseClient is configured with a websocketUrl, " +
+                "and not when it was created with realtime: false."
+            );
         }
         return this.collection.listen(this.params, onUpdate, onError);
     }

package/src/transport-baseurl.test.ts

@@ -0,0 +1,53 @@
+import { describe, it, expect, afterEach } from "@jest/globals";
+import { createTransport } from "./transport";
+
+/**
+ * `baseUrl` is optional because the common production shape is a Rebase backend
+ * serving its own SPA: the API is the page's origin. These pin the resolution,
+ * because getting it wrong pushes apps into baking an absolute host — which
+ * breaks the moment a custom domain points at the same app, and which CORS
+ * cannot repair (a SameSite=Lax auth cookie is not sent cross-site either).
+ */
+const setWindow = (origin?: string) => {
+    if (origin === undefined) { delete (globalThis as never as { window?: unknown }).window; return; }
+    (globalThis as never as { window: unknown }).window = { location: { origin, href: origin + "/" } };
+};
+
+afterEach(() => setWindow(undefined));
+
+describe("transport baseUrl resolution", () => {
+    it("uses the page origin when unset in a browser", () => {
+        setWindow("https://dadaki.com");
+        expect(createTransport({}).baseUrl).toBe("https://dadaki.com");
+    });
+
+    it("gives callers something they can build an absolute URL from", () => {
+        setWindow("https://dadaki.com");
+        const t = createTransport({});
+        // The empty-string version of this threw, which is what drove apps to
+        // bake a hostname into the bundle.
+        expect(() => new URL(`${t.baseUrl}/api/functions/doc-content/get`)).not.toThrow();
+    });
+
+    it("follows the page, so a second hostname on the same app just works", () => {
+        setWindow("https://dadaki.apps.rebase.pro");
+        expect(createTransport({}).baseUrl).toBe("https://dadaki.apps.rebase.pro");
+        setWindow("https://dadaki.com");
+        expect(createTransport({}).baseUrl).toBe("https://dadaki.com");
+    });
+
+    it("still honours an explicit baseUrl, which is what dev needs", () => {
+        setWindow("https://dadaki.com");
+        expect(createTransport({ baseUrl: "http://localhost:3001" }).baseUrl).toBe("http://localhost:3001");
+    });
+
+    it("strips a trailing slash so joins do not double up", () => {
+        setWindow(undefined);
+        expect(createTransport({ baseUrl: "https://api.example.com/" }).baseUrl).toBe("https://api.example.com");
+    });
+
+    it("stays relative off-browser, where there is no origin to borrow", () => {
+        setWindow(undefined);
+        expect(createTransport({}).baseUrl).toBe("");
+    });
+});

package/src/transport.ts

@@ -9,12 +9,46 @@ export { RebaseApiError } from "@rebasepro/types";
 export type { RebaseErrorInit } from "@rebasepro/types";
 
 export interface RebaseClientConfig {
+    /**
+     * Origin of the Rebase server — scheme, host and port **only**.
+     *
+     * {@link apiPath} is appended to this, so do not include it here:
+     * `"http://localhost:3001"` is correct, while `"http://localhost:3001/api"`
+     * silently builds `/api/api/…` and every request 404s. Omit entirely for
+     * same-origin requests from the browser.
+     */
     baseUrl?: string;
+    /**
+     * Bearer token sent as `Authorization` on every request.
+     *
+     * In the browser this is the signed-in user's access token, so row-level
+     * security applies. Server-side callers — scripts, cron jobs, ETL — pass the
+     * service key instead, which resolves to `{ uid: "service", roles: ["admin"] }`
+     * and **bypasses RLS**: there is no user to constrain those queries, so scope
+     * them explicitly.
+     */
     token?: string;
+    /**
+     * Path the API is mounted under, appended to {@link baseUrl}.
+     * Defaults to `"/api"`; override only if the server mounts it elsewhere.
+     */
     apiPath?: string;
     fetch?: typeof globalThis.fetch;
     onUnauthorized?: () => Promise<boolean>;
     websocketUrl?: string; // Optional real-time WebSocket connection
+    /**
+     * Open the realtime WebSocket. **Defaults to `true`.**
+     *
+     * The socket connects as soon as the client is constructed and keeps the
+     * Node event loop alive, so a one-shot script (CLI, cron job, ETL) will not
+     * exit on its own. Set this to `false` for any process that reads or writes
+     * and then terminates — `.listen()` and `.listenById()` then throw instead
+     * of silently doing nothing.
+     *
+     * Long-lived processes that do want realtime can instead call
+     * `client.close()` when shutting down.
+     */
+    realtime?: boolean;
 }
 
 /**
@@ -78,6 +112,29 @@ export interface Transport {
     resolveToken: () => Promise<string | null>;
 }
 
+/**
+ * The base every request and every caller-built URL resolves against.
+ *
+ * `baseUrl` is optional because the common production shape is a Rebase
+ * backend serving its own SPA, where the API is simply the page's origin.
+ * Leaving it unset is therefore the *correct* configuration there — and the
+ * one that keeps working when a second hostname (a custom domain) points at
+ * the same app.
+ *
+ * When unset in a browser this resolves to the page origin rather than "".
+ * Requests behave identically either way, but the empty string is a trap for
+ * anything that builds a URL from `client.baseUrl`: `new URL("" + path)`
+ * throws, so apps "fixed" it by baking an absolute host into their bundle —
+ * which is exactly what breaks the day a custom domain is added, and which no
+ * amount of CORS configuration repairs, because a SameSite=Lax auth cookie is
+ * not sent cross-site either.
+ */
+function resolveBaseUrl(configured?: string): string {
+    if (configured) return configured.replace(/\/$/, "");
+    if (typeof window !== "undefined" && window.location?.origin) return window.location.origin;
+    return "";
+}
+
 export function createTransport(config: RebaseClientConfig): Transport {
     const fetchFn = config.fetch || globalThis.fetch;
     const apiPath = config.apiPath || "/api";
@@ -94,8 +151,7 @@ export function createTransport(config: RebaseClientConfig): Transport {
     }
 
     async function request<T = unknown>(path: string, init?: RequestInit): Promise<T> {
-        const base = config.baseUrl ? config.baseUrl.replace(/\/$/, "") : "";
-        const url = base + apiPath + path;
+        const url = resolveBaseUrl(config.baseUrl) + apiPath + path;
 
         let activeToken = token;
         if (tokenGetter) {
@@ -208,7 +264,7 @@ headers: retryHeaders });
         setToken(newToken: string | null) { token = newToken || undefined; },
         setAuthTokenGetter(getter: () => Promise<string | null>) { tokenGetter = getter; },
         setOnUnauthorized(handler: () => Promise<boolean>) { onUnauthorizedHandler = handler; },
-        get baseUrl() { return config.baseUrl ? config.baseUrl.replace(/\/$/, "") : ""; },
+        get baseUrl() { return resolveBaseUrl(config.baseUrl); },
         get apiPath() { return apiPath; },
         get fetchFn() { return fetchFn; },
         getHeaders: (init?: RequestInit) => getHeaders(token, init) as Record<string, string>,