fetchWithAuth: validate the path is relative instead of resolving it

Review feedback: don't resolve the path against the document and don't gate
the method on a browser — Nitro dispatches a relative path to another server
route in-process, and the SDK should not stand in the way of that.

The origin guarantee now comes from the path shape rather than from a
comparison: one leading slash cannot carry a scheme, and rejecting "//host"
and "/\host" covers the two forms that reach another origin. The check runs on
the string a URL parser would see — tabs and newlines removed, leading
C0/space trimmed — because "/<tab>/evil.example" reads as protocol-relative by
the time the request is built and would otherwise pass a prefix test.

The path then goes to fetch untouched, so a server-side client works: the
token on such a client is the caller's own, from createClientFromRequest. Only
Authorization is added — a callee building its own client from the request
still needs the platform headers, which the JSDoc now says.

A bare relative path ("api/orders") is no longer accepted; a leading slash is
also what an in-process dispatcher expects.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014tTNp16fczTqi3KQ7mGEKS

Author: netanelgilad

src/client.types.ts

@@ -152,16 +152,16 @@ export interface Base44Client {
    *
    * Base44 keeps the user's access token in the browser's local storage, so a plain `fetch()` to your app's server routes arrives without it and the route sees an anonymous caller. `fetchWithAuth()` is the same `fetch()` with the `Authorization: Bearer <token>` header added, which is what lets a server route act on behalf of the signed-in user.
    *
-   * Requests are restricted to your app's own origin so the token is never sent to a third party: pass a path such as `/api/orders`, not a full URL. An absolute URL, a protocol-relative path, or anything else that resolves to another origin throws. To call a Base44 backend function, use {@linkcode FunctionsModule.fetch | functions.fetch()}; for another origin, use plain `fetch()`.
+   * Requests are restricted to your app's own origin so the token is never sent to a third party: pass a relative path beginning with a single `/`, such as `/api/orders`. An absolute URL, a protocol-relative `//host`, or anything else that a URL parser would read as another origin throws. To call a Base44 backend function, use {@linkcode FunctionsModule.fetch | functions.fetch()}; for another origin, use plain `fetch()`.
    *
-   * When no user is signed in the request is sent without an `Authorization` header, so routes that allow anonymous access keep working.
+   * The path is passed to `fetch` unchanged, so this also works in server code, where the runtime's `fetch` decides what a relative path means — a server-side client from {@linkcode createClientFromRequest | createClientFromRequest()} carries the caller's own token. Note that only the `Authorization` header is added: a route that builds its own client from the incoming request also needs the platform's `Base44-App-Id` and `Base44-Api-Url`, which a request you construct yourself does not have.
    *
-   * This method is browser-only. In server code, read the caller's token from the incoming request instead.
+   * When no user is signed in the request is sent without an `Authorization` header, so routes that allow anonymous access keep working.
    *
-   * @param path - A path on your app's own origin, such as `/api/orders`.
+   * @param path - A relative path on your app's own origin, such as `/api/orders`.
    * @param init - Optional [`RequestInit`](https://developer.mozilla.org/en-US/docs/Web/API/RequestInit) options such as `method`, `headers`, `body`, and `signal`. The auth header is added automatically; an `Authorization` header you set yourself is kept.
    * @returns Promise resolving to a native [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response).
-   * @throws {Error} When `path` resolves to a different origin, or when called outside the browser.
+   * @throws {Error} When `path` is not a relative path on your app's own origin.
    *
    * @example
    * ```typescript

src/utils/fetch-with-auth.ts

@@ -2,11 +2,12 @@ import type { AxiosInstance } from "axios";
 
 /**
  * Builds the client's `fetchWithAuth`: a `fetch` that attaches the signed-in
- * user's access token, restricted to the app's own origin.
+ * user's access token to a request for the app's own origin.
  *
  * @param axios - The user-scoped axios instance. Its `Authorization` default is
  * the live token: it follows `setToken()` and is deleted on `logout()`, so a
- * request never carries a token the user no longer has.
+ * request never carries a token the user no longer has. In a server-side client
+ * from `createClientFromRequest()` it holds the caller's own token.
  * @internal
  */
 export function createFetchWithAuth(axios: AxiosInstance) {
@@ -22,47 +23,43 @@ export function createFetchWithAuth(axios: AxiosInstance) {
     path: string,
     init: RequestInit = {}
   ): Promise<Response> {
-    const url = resolveSameOriginUrl(path);
+    assertOwnOriginPath(path);
+
     const headers = new Headers(init.headers);
     const token = currentToken();
 
     if (token && !headers.has("Authorization")) {
       headers.set("Authorization", `Bearer ${token}`);
     }
 
-    return fetch(url, { ...init, headers });
+    // Passed through untouched: resolving it here would need a document, and a
+    // root-relative path is already what a runtime that dispatches in-process
+    // (Nitro's `fetch`) expects.
+    return fetch(path, { ...init, headers });
   };
 }
 
-function resolveSameOriginUrl(path: string): string {
+function assertOwnOriginPath(path: string): void {
   if (typeof path !== "string" || path === "") {
     throw new Error("fetchWithAuth() requires a path, such as '/api/orders'.");
   }
 
-  const location = typeof window !== "undefined" ? window.location : undefined;
-  if (!location?.href) {
-    throw new Error(
-      "fetchWithAuth() is only available in the browser. In server code, read the caller's token from the request instead — see createClientFromRequest()."
-    );
-  }
+  // Check what a URL parser would see, not the raw string: it drops every ASCII
+  // tab/newline anywhere in the input and trims leading C0/space, so
+  // "/<tab>/evil.example" would pass a naive prefix check and then resolve to
+  // another host.
+  const asParsed = path.replace(/[\t\n\r]/g, "").replace(/^[\x00-\x20]+/, "");
 
-  let pageUrl: URL;
-  let resolved: URL;
-  try {
-    pageUrl = new URL(location.href);
-    resolved = new URL(path, pageUrl);
-  } catch {
-    throw new Error(`fetchWithAuth() received an invalid path: "${path}".`);
-  }
-
-  // Resolving before comparing is what makes this safe: a protocol-relative
-  // path ("//evil.example"), a backslash ("/\\evil.example") and an absolute URL
-  // all land on another origin here, and are rejected the same way.
-  if (resolved.origin !== pageUrl.origin) {
+  // One leading slash is the whole rule: it cannot carry a scheme, and it rules
+  // out the two forms that reach another origin — "//host" and, since URL
+  // parsing treats a backslash as a slash, "/\host".
+  if (
+    !asParsed.startsWith("/") ||
+    asParsed.startsWith("//") ||
+    asParsed.startsWith("/\\")
+  ) {
     throw new Error(
-      `fetchWithAuth() only sends requests to your app's own origin, so the access token never reaches a third party. "${path}" resolves to ${resolved.origin}. Use base44.functions.fetch() to call a Base44 backend function, or plain fetch() for another origin.`
+      `fetchWithAuth() only sends requests to your app's own origin, so the access token never reaches a third party. "${path}" is not a path on it — pass a relative path such as '/api/orders'. Use base44.functions.fetch() to call a Base44 backend function, or plain fetch() for another origin.`
     );
   }
-
-  return resolved.toString();
 }

tests/unit/fetch-with-auth.test.ts

@@ -68,7 +68,7 @@ describe("fetchWithAuth", () => {
     await base44.fetchWithAuth("/api/orders");
 
     const { url, headers } = lastCall();
-    expect(url).toBe(`${origin}/api/orders`);
+    expect(url).toBe("/api/orders");
     expect(headers.get("Authorization")).toBe("Bearer user-token");
   });
 
@@ -133,20 +133,26 @@ describe("fetchWithAuth", () => {
     expect(headers.get("Authorization")).toBe("Bearer caller-token");
   });
 
-  test("resolves a path relative to the current page", async () => {
+  test("passes the path through untouched", async () => {
     stubBrowser();
     const base44 = createTestClient("user-token");
 
-    await base44.fetchWithAuth("api/orders");
+    await base44.fetchWithAuth("/api/orders?status=open#top");
 
-    expect(lastCall().url).toBe(`${origin}/api/orders`);
+    expect(lastCall().url).toBe("/api/orders?status=open#top");
   });
 
   test.each([
     ["an absolute URL", "https://evil.example/steal"],
     ["a protocol-relative path", "//evil.example/steal"],
     ["a backslash-prefixed path", "/\\evil.example/steal"],
     ["an absolute URL on another port", `${origin}:8443/api/orders`],
+    ["a bare relative path", "api/orders"],
+    // A URL parser drops tabs/newlines and trims leading space, so these read
+    // as "//evil.example" by the time the request is built.
+    ["a tab-split protocol-relative path", "/\t/evil.example/steal"],
+    ["a newline-split protocol-relative path", "/\n/evil.example/steal"],
+    ["a space-padded protocol-relative path", "  //evil.example/steal"],
   ])("rejects %s", async (_label, path) => {
     stubBrowser();
     const base44 = createTestClient("user-token");
@@ -165,12 +171,23 @@ describe("fetchWithAuth", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
-  test("throws outside the browser", async () => {
-    const base44 = createTestClient("user-token");
+  test("works with no document, as in a server route", async () => {
+    // No stubBrowser(): window is undefined here, the way it is on a worker.
+    const base44 = createTestClient("caller-token");
 
-    await expect(base44.fetchWithAuth("/api/orders")).rejects.toThrow(
-      /only available in the browser/
-    );
+    await base44.fetchWithAuth("/api/orders");
+
+    const { url, headers } = lastCall();
+    expect(url).toBe("/api/orders");
+    expect(headers.get("Authorization")).toBe("Bearer caller-token");
+  });
+
+  test("rejects another origin with no document too", async () => {
+    const base44 = createTestClient("caller-token");
+
+    await expect(
+      base44.fetchWithAuth("https://evil.example/steal")
+    ).rejects.toThrow(/only sends requests to your app's own origin/);
     expect(fetchMock).not.toHaveBeenCalled();
   });
 });