@umbraco-cms/backoffice 16.4.0-rc → 16.4.0-rc2

package/dist-cms/external/openid/src/xhr.js

@@ -30,6 +30,7 @@ export class FetchRequestor extends Requestor {
         const requestInit = {};
         requestInit.method = settings.method;
         requestInit.mode = 'cors';
+        requestInit.credentials = settings.credentials ?? 'include';
         if (settings.data) {
             if (settings.method && settings.method.toUpperCase() === 'POST') {
                 requestInit.body = settings.data;

package/dist-cms/packages/core/auth/auth-flow.js

@@ -294,6 +294,7 @@ export class UmbAuthFlow {
         const token = await this.performWithFreshTokens();
         const request = new Request(this.#unlink_endpoint, {
             method: 'POST',
+            credentials: 'include',
             headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
             body: JSON.stringify({ loginProvider, providerKey }),
         });
@@ -370,6 +371,7 @@ export class UmbAuthFlow {
     async #makeLinkTokenRequest(provider) {
         const token = await this.performWithFreshTokens();
         const request = await fetch(`${this.#link_key_endpoint}?provider=${provider}`, {
+            credentials: 'include',
             headers: {
                 Authorization: `Bearer ${token}`,
                 'Content-Type': 'application/json',

package/dist-cms/packages/core/http-client/index.d.ts

@@ -1 +1,2 @@
-export { client as umbHttpClient } from '../backend-api/index.js';
+import { client } from '../backend-api/index.js';
+export { client as umbHttpClient };

package/dist-cms/packages/core/http-client/index.js

@@ -1 +1,12 @@
-export { client as umbHttpClient } from '../backend-api/index.js';
+import { client } from '../backend-api/index.js';
+/**
+ * Pre-configure the client with default credentials for cookie-based authentication.
+ * This ensures all requests include cookies by default, which is required for
+ * cookie-based authentication in Umbraco 17.0+.
+ *
+ * Extensions using this client will automatically get credentials: 'include'.
+ */
+client.setConfig({
+    credentials: 'include',
+});
+export { client as umbHttpClient };

package/dist-cms/packages/core/resources/try-execute/tryXhrRequest.function.js

@@ -36,6 +36,7 @@ function createXhrRequest(options) {
     return new UmbCancelablePromise(async (resolve, reject, onCancel) => {
         const xhr = new XMLHttpRequest();
         xhr.open(options.method, `${baseUrl}${options.url}`, true);
+        xhr.withCredentials = options.withCredentials ?? true;
         // Set default headers
         if (options.token) {
             const token = typeof options.token === 'function' ? await options.token() : options.token;

package/dist-cms/packages/core/resources/types.d.ts

@@ -4,6 +4,7 @@ export interface XhrRequestOptions extends UmbTryExecuteOptions {
     baseUrl?: string;
     method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';
     url: string;
+    withCredentials?: boolean;
     body?: unknown;
     token?: string | (() => undefined | string | Promise<string | undefined>);
     headers?: Record<string, string>;

package/dist-cms/packages/documents/documents/user-permissions/document/repository/document-permission.server.data.js

@@ -16,6 +16,7 @@ export class UmbDocumentPermissionServerDataSource {
     requestPermissions(id) {
         return tryExecute(this.#host, fetch(`/umbraco/management/api/v1/document/${id}/permissions`, {
             method: 'GET',
+            credentials: 'include',
             headers: {
                 'Content-Type': 'application/json',
             },