Forward only the known dev/prod X-Data-Env values

Defense-in-depth: gate the propagated header on the closed dev/prod set
instead of any truthy string, matching the backend contract and avoiding
relaying an arbitrary caller-supplied header value onward.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Elior Hamamy

src/client.ts

@@ -445,7 +445,9 @@ export function createClientFromRequest(request: Request): Base44Client {
   // matters for the user-scoped client: unlike the service token, the user JWT
   // carries no data-env, so without forwarding this header the callbacks fall
   // back to production data even when the app runs in test-data mode.
-  if (dataEnvHeader) {
+  // Forward only the known closed set (matches the backend contract) rather
+  // than relaying an arbitrary attacker-supplied header value onward.
+  if (dataEnvHeader === "dev" || dataEnvHeader === "prod") {
     additionalHeaders["X-Data-Env"] = dataEnvHeader;
   }
 

tests/unit/client.test.js

@@ -569,6 +569,33 @@ describe('Service Role Authorization Headers', () => {
     expect(scope.isDone()).toBe(true);
   });
 
+  test('should not forward an X-Data-Env value outside the dev/prod set', async () => {
+    const mockRequest = {
+      headers: {
+        get: (name) => {
+          const headers = {
+            'Authorization': 'Bearer user-token-123',
+            'Base44-App-Id': appId,
+            'Base44-Api-Url': serverUrl,
+            'X-Data-Env': 'evil'
+          };
+          return headers[name] || null;
+        }
+      }
+    };
+
+    const client = createClientFromRequest(mockRequest);
+
+    scope.get(`/api/apps/${appId}/entities/Todo`)
+      .matchHeader('X-Data-Env', (val) => !val) // arbitrary value must not be relayed
+      .matchHeader('Authorization', 'Bearer user-token-123')
+      .reply(200, { items: [], total: 0 });
+
+    await client.entities.Todo.list();
+
+    expect(scope.isDone()).toBe(true);
+  });
+
   test('should not include X-Data-Env header when not present in original request', async () => {
     const mockRequest = {
       headers: {