@solarisdk/browserbase-compat 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 0.2.1
+- **Security: the base URL check accepts only the Solari API hosts.** It used to accept any `*.getsolari.com` host, including sandbox preview hosts (`<label>-<port>.preview.getsolari.com`) that serve customer code, so a `baseURL` / `SOLARI_BASE_URL` pointed there would send your `slr_` key to code running in a sandbox. Now only the Solari API hosts and loopback are accepted.
+
 ## 0.2.0
 - `timeout`, `keepAlive` and `userMetadata` are sent to Solari (they were warned about and ignored in 0.1.0). `userMetadata` comes back on `create`, `retrieve` and `list`, and `sessions.list({ q })` filters on it.
 - **A base URL that does not point at Solari is now refused.** `baseURL` and `SOLARI_BASE_URL` must be `https` on `getsolari.com` (or a subdomain) or a loopback address; anything else throws `BrowserbaseError` ("Refusing to send a Solari API key to …"). In 0.1.0 such a URL was used as given, which could send your `slr_` key to another host.

package/COMPAT.md

@@ -22,7 +22,7 @@ Keep it private: the session id inside it is the credential.
 | | |
 |---|---|
 | Key | `apiKey` option, else `SOLARI_API_KEY`, else `BROWSERBASE_API_KEY`. **A key that does not start with `slr_` is never used or sent** (it is probably a Browserbase secret): it is skipped with a warning that does not print it, and if no `slr_` key remains the constructor throws. |
-| Endpoint | `baseURL` option or `SOLARI_BASE_URL`; default `https://api.getsolari.com`. Must be `https` on `getsolari.com` (or a subdomain) or loopback, otherwise the constructor throws `BrowserbaseError` ("Refusing to send a Solari API key to …"): the key is never sent to another host. |
+| Endpoint | `baseURL` option or `SOLARI_BASE_URL`; default `https://api.getsolari.com`. Must be `https` on a Solari API host or loopback (preview and other `*.getsolari.com` hosts are refused: they serve customer code), otherwise the constructor throws `BrowserbaseError` ("Refusing to send a Solari API key to …"): the key is never sent to another host. |
 | `projectId` | Accepted and ignored: Solari keys belong to an organisation, there are no projects. |
 
 ## Works
@@ -35,7 +35,7 @@ Keep it private: the session id inside it is the credential.
 | `browserSettings.verified`, `advancedStealth` | Solari's stealth browser. |
 | `browserSettings.solveCaptchas: true` | Solari captcha solving (stealth browser, plan-gated). **Off unless you pass `true`**: Browserbase turns it on by default. |
 | `browserSettings.recordSession: true` | Session recording. **Off unless you pass `true`**: Browserbase records by default. Read it back with `sessions.recording.retrieve(id)` (rrweb events). |
-| `browserSettings.allowedDomains` | Egress allowlist (enterprise plan, stealth browser); a plan error comes back as an `APIError` with `code: "FeatureRequiresPlan"`. |
+| `browserSettings.allowedDomains` | Egress allowlist (Team or Enterprise plan, stealth browser); a plan error comes back as an `APIError` with `code: "FeatureRequiresPlan"`. |
 | `browserSettings.context: { id, persist }`, `contexts.create/retrieve/delete` | A Context is a Solari **profile**. See [Contexts](#contexts). |
 | `sessions.debug(id, { expiresIn })` | A view-only live-view link (`debuggerUrl` and `debuggerFullscreenUrl` are the same link; `pages` is empty; `wsUrl` is the CDP URL). |
 

package/dist/client.d.ts

@@ -15,7 +15,7 @@ export interface BrowserbaseOptions {
     /** Test hook. */
     fetch?: typeof fetch;
 }
-/** Whether a base URL may receive a Solari key: https on getsolari.com or a subdomain, or loopback. */
+/** Whether a base URL may receive a Solari key: https on a Solari API host, or loopback. */
 export declare function isSolariBaseUrl(raw: string): boolean;
 export declare class Browserbase {
     readonly sessions: Sessions;

package/dist/client.js

@@ -19,7 +19,9 @@ function resolveApiKey(explicit, warn) {
     }
     throw new BrowserbaseError("No Solari API key: pass apiKey or set SOLARI_API_KEY (keys start with slr_)");
 }
-/** Whether a base URL may receive a Solari key: https on getsolari.com or a subdomain, or loopback. */
+/** The only Solari hosts that may receive a key (the API gateways). Not every *.getsolari.com host: preview hosts (<label>-<port>.preview.getsolari.com) serve customer code. */
+const SOLARI_API_HOST = /^api(-sta(-gcp)?)?\.getsolari\.com$/;
+/** Whether a base URL may receive a Solari key: https on a Solari API host, or loopback. */
 export function isSolariBaseUrl(raw) {
     let u;
     try {
@@ -31,7 +33,7 @@ export function isSolariBaseUrl(raw) {
     if (u.username || u.password)
         return false; // never a URL with credentials in it
     const host = u.hostname.toLowerCase().replace(/\.$/, "");
-    if (u.protocol === "https:" && (host === "getsolari.com" || host.endsWith(".getsolari.com")))
+    if (u.protocol === "https:" && SOLARI_API_HOST.test(host))
         return true;
     const loopback = host === "localhost" || host === "[::1]" || /^127(\.\d{1,3}){3}$/.test(host);
     return loopback && (u.protocol === "http:" || u.protocol === "https:");
@@ -49,7 +51,7 @@ function resolveBaseUrl(explicit) {
     if (!given)
         return DEFAULT_BASE_URL;
     if (!isSolariBaseUrl(given)) {
-        throw new BrowserbaseError(`Refusing to send a Solari API key to ${describeHost(given)}: it does not point at Solari (getsolari.com or loopback).`);
+        throw new BrowserbaseError(`Refusing to send a Solari API key to ${describeHost(given)}: it is not a Solari API host or loopback.`);
     }
     return given.replace(/\/+$/, "");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solarisdk/browserbase-compat",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Drop-in Browserbase-style SDK surface for Solari Browser: sessions, connectUrl (CDP), contexts, live view, replay events.",
   "license": "MIT",
   "type": "module",