@zapier/zapier-sdk 0.47.0 → 0.47.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @zapier/zapier-sdk
 
+## 0.47.1
+
+### Patch Changes
+
+- 4ab820a: Skip the approval `poll_url` and `approval_url` origin checks when `baseUrl` (or `ZAPIER_BASE_URL`) points at `localhost` / `127.0.0.1`. Local dev runs sdkapi, approvalsapi, and the approval frontend on different ports, so the origin pin can never match. The check is intended to stop a compromised sdkapi from redirecting bearer-token traffic to an attacker host — a threat that doesn't apply when the developer owns every service on the machine.
+
 ## 0.47.0
 
 ### Minor Changes

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAGjB,MAAM,SAAS,CAAC;AAqiCjB,eAAO,MAAM,eAAe,GAAI,SAAS,gBAAgB,KAAG,SAW3D,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAGjB,MAAM,SAAS,CAAC;AAgjCjB,eAAO,MAAM,eAAe,GAAI,SAAS,gBAAgB,KAAG,SAW3D,CAAC"}

package/dist/api/client.js

@@ -8,7 +8,7 @@ import { getAuthorizationHeader } from "./auth";
 import { createDebugLogger, createDebugFetch } from "./debug";
 import { pollUntilComplete } from "./polling";
 import { resolveAuthToken, invalidateCredentialsToken, isCliLoginAvailable, } from "../auth";
-import { getZapierBaseUrl } from "../utils/url-utils";
+import { getZapierBaseUrl, isLocalhostBaseUrl } from "../utils/url-utils";
 import { sleep, calculateExponentialBackoffMs } from "../utils/retry-utils";
 import { isPlainObject } from "../utils/type-guard-utils";
 import { ZapierApiError, ZapierApprovalError, ZapierAuthenticationError, ZapierTimeoutError, ZapierValidationError, ZapierResourceNotFoundError, ZapierRateLimitError, } from "../types/errors";
@@ -711,8 +711,15 @@ class ZapierApiClient {
                 throw new ZapierApiError(`Approval ${label} origin ${parsed.origin} does not match expected ${expectedOrigin}`, { statusCode: approvalResponse.status, response: body });
             }
         };
-        assertApprovalOrigin(approval.poll_url, sdkapiOrigin, "poll_url");
-        assertApprovalOrigin(approval.approval_url, browserOrigin, "approval_url");
+        // In local dev the SDK API, approvalsapi, and approval frontend run on
+        // different localhost ports, so neither origin can match. The check
+        // exists to stop a compromised sdkapi from redirecting bearer-token
+        // traffic to an attacker host — that threat model doesn't apply when
+        // the dev owns every service on the machine.
+        if (!isLocalhostBaseUrl(this.options.baseUrl)) {
+            assertApprovalOrigin(approval.poll_url, sdkapiOrigin, "poll_url");
+            assertApprovalOrigin(approval.approval_url, browserOrigin, "approval_url");
+        }
         this.emitEvent("approval:required", {
             approvalId: approval.approval_id,
             approvalUrl: approval.approval_url,

package/dist/index.cjs

@@ -5207,6 +5207,17 @@ function getZapierBaseUrl(baseUrl) {
     return void 0;
   }
 }
+function isLocalhostBaseUrl(baseUrl) {
+  if (!baseUrl) {
+    return false;
+  }
+  try {
+    const { hostname } = new URL(baseUrl);
+    return hostname === "localhost" || hostname === "127.0.0.1";
+  } catch {
+    return false;
+  }
+}
 function getTrackingBaseUrl({
   trackingBaseUrl,
   baseUrl
@@ -5620,7 +5631,7 @@ async function invalidateCredentialsToken(options) {
 }
 
 // src/sdk-version.ts
-var SDK_VERSION = (typeof process !== "undefined" && process.env ? "0.47.0" : void 0) || "unknown";
+var SDK_VERSION = (typeof process !== "undefined" && process.env ? "0.47.1" : void 0) || "unknown";
 
 // src/utils/open-url.ts
 var nodePrefix = "node:";
@@ -6286,8 +6297,14 @@ var ZapierApiClient = class {
         );
       }
     };
-    assertApprovalOrigin(approval.poll_url, sdkapiOrigin, "poll_url");
-    assertApprovalOrigin(approval.approval_url, browserOrigin, "approval_url");
+    if (!isLocalhostBaseUrl(this.options.baseUrl)) {
+      assertApprovalOrigin(approval.poll_url, sdkapiOrigin, "poll_url");
+      assertApprovalOrigin(
+        approval.approval_url,
+        browserOrigin,
+        "approval_url"
+      );
+    }
     this.emitEvent("approval:required", {
       approvalId: approval.approval_id,
       approvalUrl: approval.approval_url

package/dist/index.mjs

@@ -5205,6 +5205,17 @@ function getZapierBaseUrl(baseUrl) {
     return void 0;
   }
 }
+function isLocalhostBaseUrl(baseUrl) {
+  if (!baseUrl) {
+    return false;
+  }
+  try {
+    const { hostname } = new URL(baseUrl);
+    return hostname === "localhost" || hostname === "127.0.0.1";
+  } catch {
+    return false;
+  }
+}
 function getTrackingBaseUrl({
   trackingBaseUrl,
   baseUrl
@@ -5618,7 +5629,7 @@ async function invalidateCredentialsToken(options) {
 }
 
 // src/sdk-version.ts
-var SDK_VERSION = (typeof process !== "undefined" && process.env ? "0.47.0" : void 0) || "unknown";
+var SDK_VERSION = (typeof process !== "undefined" && process.env ? "0.47.1" : void 0) || "unknown";
 
 // src/utils/open-url.ts
 var nodePrefix = "node:";
@@ -6284,8 +6295,14 @@ var ZapierApiClient = class {
         );
       }
     };
-    assertApprovalOrigin(approval.poll_url, sdkapiOrigin, "poll_url");
-    assertApprovalOrigin(approval.approval_url, browserOrigin, "approval_url");
+    if (!isLocalhostBaseUrl(this.options.baseUrl)) {
+      assertApprovalOrigin(approval.poll_url, sdkapiOrigin, "poll_url");
+      assertApprovalOrigin(
+        approval.approval_url,
+        browserOrigin,
+        "approval_url"
+      );
+    }
     this.emitEvent("approval:required", {
       approvalId: approval.approval_id,
       approvalUrl: approval.approval_url

package/dist/utils/url-utils.d.ts

@@ -4,6 +4,12 @@
  * This combines domain checking and URL extraction logic.
  */
 export declare function getZapierBaseUrl(baseUrl?: string): string | undefined;
+/**
+ * Returns true if the baseUrl points at a developer's local machine
+ * (`localhost` or `127.0.0.1`). Used to relax checks that don't make sense
+ * when the SDK API and other services run on different localhost ports.
+ */
+export declare function isLocalhostBaseUrl(baseUrl?: string): boolean;
 /**
  * Gets tracking base URL with the following precedence:
  * 1. Explicit trackingBaseUrl parameter

package/dist/utils/url-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-utils.d.ts","sourceRoot":"","sources":["../../src/utils/url-utils.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA+BrE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,eAAe,EACf,OAAO,GACR,EAAE;IACD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CA0BT"}
+{"version":3,"file":"url-utils.d.ts","sourceRoot":"","sources":["../../src/utils/url-utils.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA+BrE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAU5D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,eAAe,EACf,OAAO,GACR,EAAE;IACD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CA0BT"}

package/dist/utils/url-utils.js

@@ -29,6 +29,23 @@ export function getZapierBaseUrl(baseUrl) {
         return undefined;
     }
 }
+/**
+ * Returns true if the baseUrl points at a developer's local machine
+ * (`localhost` or `127.0.0.1`). Used to relax checks that don't make sense
+ * when the SDK API and other services run on different localhost ports.
+ */
+export function isLocalhostBaseUrl(baseUrl) {
+    if (!baseUrl) {
+        return false;
+    }
+    try {
+        const { hostname } = new URL(baseUrl);
+        return hostname === "localhost" || hostname === "127.0.0.1";
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Gets tracking base URL with the following precedence:
  * 1. Explicit trackingBaseUrl parameter

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/zapier-sdk",
-  "version": "0.47.0",
+  "version": "0.47.1",
   "description": "Complete Zapier SDK - combines all Zapier SDK packages",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",