@structured-id/ui-core 4.7.1 → 4.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.7.1",
+  "version": "4.7.2",
   "type": "module",
   "publishConfig": {
     "access": "public",

package/src/composables/useBffAuth.test.ts

@@ -6,6 +6,16 @@ import { GrantOutcome } from "@structured-id/proto/sid/v1/authn/application_sess
 const host = vi.hoisted(() => ({
   getApplicationSession: vi.fn(),
   endApplicationSession: vi.fn(),
+  /** The base URL of the transport last made. */
+  transportBase: undefined as string | undefined,
+}));
+
+vi.mock("@protobuf-ts/grpcweb-transport", () => ({
+  GrpcWebFetchTransport: class {
+    constructor(options: { baseUrl: string }) {
+      host.transportBase = options.baseUrl;
+    }
+  },
 }));
 
 vi.mock("@structured-id/proto/sid/v1/authn/application_session.client", () => ({
@@ -40,6 +50,27 @@ const LIVE = {
   csrfToken: "token-1",
 };
 
+describe("the session service's address", () => {
+  // The host serves a page's calls only under its API mount: a call at the
+  // root is refused, and the page cannot read a session it has.
+  it("is the API mount of the page's own origin", () => {
+    initBff("");
+    expect(host.transportBase).toBe("/api");
+  });
+
+  it("is the API mount of a configured host", () => {
+    initBff("https://host.sid.example.com");
+    expect(host.transportBase).toBe("https://host.sid.example.com/api");
+  });
+
+  it("is the API mount of a host named for one call", async () => {
+    initBff("");
+    host.getApplicationSession.mockReturnValue(answers(LIVE));
+    await checkBffSession("https://other.sid.example.com");
+    expect(host.transportBase).toBe("https://other.sid.example.com/api");
+  });
+});
+
 describe("checkBffSession", () => {
   beforeEach(() => {
     vi.clearAllMocks();

package/src/composables/useBffAuth.ts

@@ -43,10 +43,13 @@ let _session: ApplicationSessionServiceClient | null = null;
  */
 let _csrfToken: string | null = null;
 
-/** The session service at `baseUrl`; the cookie never travels to another origin. */
+/**
+ * The session service of the host at `baseUrl`, under the `/api` mount that
+ * serves a page's calls; the cookie never travels to another origin.
+ */
 function sessionClient(baseUrl: string): ApplicationSessionServiceClient {
   const transport: RpcTransport = new GrpcWebFetchTransport({
-    baseUrl,
+    baseUrl: `${baseUrl}/api`,
     fetchInit: { credentials: "same-origin" },
   });
   return new ApplicationSessionServiceClient(transport);