@thunderid/browser 1.9.1 → 1.9.3

package/dist/index.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer/index.js';
 if (typeof window !== 'undefined' && !window.Buffer) { window.Buffer = Buffer; }
-import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getTokenPermissions, getUsersMe, isEmojiUri, resolveBackendEndpoints, resolveResourceEndpoint } from "@thunderid/javascript";
+import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getTokenPermissions, getUsersMe, isEmojiUri, resolveBackendEndpoints, resolveRequestBaseUrl, resolveResourceEndpoint } from "@thunderid/javascript";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
 import { createLocalJWKSet, jwtVerify } from "jose";
@@ -178,18 +178,21 @@ var BackendClient = class BackendClient {
 		return (await response.json()).redirectUrl;
 	}
 	/**
-	* Maps an API URL to its backend proxy URL.
+	* Maps an API URL to its backend proxy URL. A URL already on the proxy is sent as it is, and any
+	* other path (`/users`) goes under the proxy. The backend, not the app, knows the API's address.
 	*
-	* @returns The proxy URL, or `undefined` when the URL is not under the API base and so cannot be
-	* sent with the session's credentials.
+	* @returns The proxy URL, or `undefined` for an absolute URL that isn't on the proxy and so cannot
+	* be sent with the session's credentials.
 	*/
 	toProxyUrl(url) {
-		const { apiBaseUrl, proxy } = this.endpoints;
-		let rest;
-		if (url === apiBaseUrl || url.startsWith(`${apiBaseUrl}/`) || url.startsWith(`${apiBaseUrl}?`)) rest = url.slice(apiBaseUrl.length);
-		else if (url.startsWith("/") && !url.startsWith("//")) rest = url;
-		else return;
-		return `${proxy}${rest.startsWith("/") ? rest : `/${rest}`}`;
+		const { proxy } = this.endpoints;
+		const origin = typeof window !== "undefined" ? window.location.origin : "";
+		const isPath = (value) => value.startsWith("/") && !value.startsWith("//");
+		const isUnder = (base) => url === base || url.startsWith(`${base}/`) || url.startsWith(`${base}?`);
+		const absoluteProxy = isPath(proxy) ? `${origin}${proxy}` : proxy;
+		const proxyPath = absoluteProxy.startsWith(`${origin}/`) ? absoluteProxy.slice(origin.length) : void 0;
+		if (isUnder(proxy) || isUnder(absoluteProxy) || proxyPath !== void 0 && isUnder(proxyPath)) return url;
+		return isPath(url) ? `${proxy}${url}` : void 0;
 	}
 	/**
 	* Whether a request to this URL skips the proxy and goes straight from the browser.
@@ -220,11 +223,12 @@ var BackendClient = class BackendClient {
 		return await response.json();
 	}
 	/**
-	* The headers and credentials mode every backend request is sent with.
+	* The headers and credentials mode every backend request is sent with. The cookies go with every
+	* request, so a backend on another origin works too when its CORS allows credentials.
 	*/
 	static requestInit(headers = {}) {
 		return {
-			credentials: "same-origin",
+			credentials: "include",
 			headers: {
 				...headers,
 				[BACKEND_REQUEST_HEADER]: BACKEND_REQUEST_HEADER_VALUE
@@ -3083,7 +3087,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		await this._validateMethod();
 		const configData = await this.getStorageManager().getConfigData();
 		const profile = await getUsersMe({
-			baseUrl: options?.baseUrl ?? configData?.baseUrl,
+			baseUrl: options?.baseUrl ?? resolveRequestBaseUrl(configData),
 			fetcher: createHttpClientFetcher_default(this._browserInstanceId),
 			url: resolveResourceEndpoint("usersMe", configData, options?.url)
 		});