woodsportal-client-sdk 4.1.1-dev.0 → 4.1.1-dev.1

package/dist/{chunk-IOBRI7OT.js → chunk-JEQNFCQP.js}

@@ -1,5 +1,5 @@
 import { getParamDetails, getRouteDetails, updateLink, getParam, decodeToBase64, generatePath, getPath, getRouteMenu, tableUiActions, ticketHubspotObjectTypeId, makePreviewParams, tableStore, actions2, userStore, isPipelineBoardObjectTypeId, tableUiStore, fileStore, actions7, emailStore, actions5, noteStore, actions4, resetAllStore, breadcrumbStage, isMessingParentLastItem, isMessingParent, generateUrl } from './chunk-ZZCYSW32.js';
-import { getRuntimeHttpClientApiDate, config, configureLogger, setIframeStorageMode, setRefreshBufferSeconds, setRefreshCallback, hydrateSessionRefreshState, isHttpTracingEnabled, logger, getAccessToken, sanitizeAxiosErrorData, classifyRefreshHttpError, shouldLogoutAfterRefreshFailure, setRefreshToken, storAccessToken, classifyRefreshResponseWithoutToken, storage, HUBSPOT_DATA, setRuntimeHttpClientHubContext, isServiceUnavailableError, refreshSession, ensureValidRefresh, HUB_ID, DEV_PORTAL_ID, PORTAL_ID, DEV_API_URL, isAccessTokenExpired } from './chunk-JVJMM4SZ.js';
+import { getRuntimeHttpClientApiDate, config, configureLogger, setIframeStorageMode, setRefreshBufferSeconds, setRefreshCallback, hydrateSessionRefreshState, logger, isHttpTracingEnabled, getAccessToken, sanitizeAxiosErrorData, classifyRefreshHttpError, shouldLogoutAfterRefreshFailure, setRefreshToken, storAccessToken, classifyRefreshResponseWithoutToken, storage, HUBSPOT_DATA, setRuntimeHttpClientHubContext, isServiceUnavailableError, refreshSession, ensureValidRefresh, HUB_ID, DEV_PORTAL_ID, PORTAL_ID, DEV_API_URL, isAccessTokenExpired } from './chunk-JVJMM4SZ.js';
 import { getClientType, configureStorageKeys } from './chunk-32ERSTFY.js';
 import { AuthErrorCode } from './chunk-COHBSTHF.js';
 import axios from 'axios';
@@ -300,7 +300,46 @@ function getHttpUrl(config4) {
   return sanitizeHttpUrl(config4.url);
 }
 
+// src/main/core/http/csp-violation-monitor.ts
+var VIOLATION_TTL_MS = 3e4;
+var MAX_RECORDED = 20;
+var violations = [];
+var installed = false;
+function installCspViolationMonitor() {
+  if (installed || typeof document === "undefined" || typeof document.addEventListener !== "function") {
+    return;
+  }
+  installed = true;
+  document.addEventListener("securitypolicyviolation", (event) => {
+    violations.push({
+      blockedUri: event.blockedURI ?? "",
+      effectiveDirective: event.effectiveDirective ?? event.violatedDirective ?? "",
+      at: Date.now()
+    });
+    if (violations.length > MAX_RECORDED) {
+      violations = violations.slice(-MAX_RECORDED);
+    }
+  });
+}
+function findCspViolationFor(requestUrl) {
+  if (!requestUrl) {
+    return void 0;
+  }
+  const now = Date.now();
+  violations = violations.filter((violation) => now - violation.at <= VIOLATION_TTL_MS);
+  let origin;
+  try {
+    origin = new URL(requestUrl, typeof location !== "undefined" ? location.href : void 0).origin;
+  } catch {
+    return void 0;
+  }
+  return violations.find(
+    (violation) => violation.blockedUri === origin || violation.blockedUri.startsWith(`${origin}/`)
+  );
+}
+
 // src/main/core/http/http-client.ts
+var INVALID_PATH_SEGMENT_PATTERN = /\/(undefined|null|NaN)([/?#]|$)/;
 var axiosInstance = null;
 var config3 = {};
 function hasBrowserLocation() {
@@ -502,9 +541,17 @@ function initializeHttpClient(clientConfig) {
       ...config3.headers
     }
   });
+  installCspViolationMonitor();
   setRefreshCallback(getAuthRefreshToken);
   hydrateSessionRefreshState();
   axiosInstance.interceptors.request.use(async (requestConfig) => {
+    const requestUrl = getHttpUrl(requestConfig);
+    if (requestUrl && INVALID_PATH_SEGMENT_PATTERN.test(requestUrl)) {
+      logger.error("http", "blocked request with unresolved id in path", { url: requestUrl });
+      throw new Error(
+        `[woodsportal-sdk] Blocked request: URL contains an unresolved id segment: ${requestUrl}`
+      );
+    }
     const previewMock = await resolveEditorPreviewMock(requestConfig);
     if (previewMock) {
       requestConfig.adapter = () => Promise.resolve({
@@ -545,6 +592,17 @@ function initializeHttpClient(clientConfig) {
     (error) => {
       if (axios.isAxiosError(error) && error.config) {
         const status = error.response?.status;
+        if (status == null) {
+          const violation = findCspViolationFor(getHttpUrl(error.config));
+          if (violation) {
+            logger.error("http", "request blocked by the embedding page CSP", {
+              url: sanitizeHttpUrl(error.config.url),
+              violatedDirective: violation.effectiveDirective,
+              blockedUri: violation.blockedUri,
+              fix: `the embedding page's Content-Security-Policy must include "${violation.effectiveDirective} ${violation.blockedUri}"`
+            });
+          }
+        }
         if (isHttpTracingEnabled()) {
           logger.debug("http", "request failed", {
             method: getHttpMethod(error.config),
@@ -2605,5 +2663,5 @@ function createMutation(mutationFn, options) {
 }
 
 export { API_ENDPOINTS, Client, HttpClient, applyContractApiDate, buildCachePurgeRequest, buildCrmListPurgeTarget, buildCrmSinglePurgeTarget, buildEngagementPurgeTarget, buildPortalConfigPurgeTarget, buildUserSessionPurgeTarget, createCachePurgeJob, createMutation, extractEngagementItemIdFromWriteResponse, extractHubspotRecordIdFromWriteResponse, generateApiUrl, getAuthRefreshToken, getConfiguredContractApiDate, getFieldErrors, getFormErrors, initializeHttpClient, mergePurgeTargets, navigationApi, purgeCrmCombined, purgeCrmDetailAndListAfterCrmWrite, purgeCrmListCache, purgeCrmListCacheAfterCrmWrite, purgeCrmObjectDataCache, purgeCrmRecordCache, purgeEngagementCaches, purgeEngagementCachesAfterCrmWrite, resolveCrmListPurgeQuery, resolveListTableParams, setEditorPreviewMockHandler, startVisibilityRefreshScheduler, stopVisibilityRefreshScheduler, toCachePurgeListQuery };
-//# sourceMappingURL=chunk-IOBRI7OT.js.map
-//# sourceMappingURL=chunk-IOBRI7OT.js.map
+//# sourceMappingURL=chunk-JEQNFCQP.js.map
+//# sourceMappingURL=chunk-JEQNFCQP.js.map