fix: update packages & replace request dependency (#60)

.github/workflows/test.yml

@@ -11,7 +11,7 @@ jobs:
     timeout-minutes: 5
     strategy:
       matrix:
-        node: [ '16', '17', '18' ]
+        node: [ '18', '20' ]
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v2

.gitignore

@@ -3,11 +3,11 @@ node_modules
 typings
 dist
 coverage
-ui
-next-edge
-next
-routes
-
+/ui
+/next-edge
+/next
+/routes
+/next-edge-app
 .idea
 
 pnpm-lock.yaml

package.json

@@ -14,49 +14,42 @@
     "format:check": "prettier --check ${npm_package_config_prettierTarget}",
     "build": "rm -rf dist ui nextjs && rollup -c",
     "prepublishOnly": "npm run build",
-    "test": "jest --detectOpenHandles"
+    "test": "jest --forceExit"
   },
   "devDependencies": {
-    "@babel/core": "7.15.5",
-    "@babel/preset-env": "7.15.6",
-    "@babel/preset-typescript": "7.15.0",
-    "@ory/client": "1.1.51",
-    "@types/cookie": "0.5.1",
-    "@types/express": "4.17.17",
-    "@types/jest": "27.0.1",
+    "@babel/core": "7.23.9",
+    "@babel/preset-env": "7.23.9",
+    "@babel/preset-typescript": "7.23.3",
+    "@ory/client": "1.6.2",
+    "@types/cookie": "0.6.0",
+    "@types/express": "4.17.21",
+    "@types/jest": "29.5.12",
     "@types/node": "18.17.14",
-    "@types/request": "2.48.8",
-    "@types/set-cookie-parser": "2.4.3",
-    "@types/supertest": "2.0.11",
-    "babel-jest": "27.2.0",
-    "esbuild": "0.12.28",
+    "@types/set-cookie-parser": "2.4.7",
+    "@types/supertest": "6.0.2",
+    "babel-jest": "29.7.0",
+    "esbuild": "0.20.1",
     "express": "4.18.2",
-    "jest": "27.2.0",
-    "rollup": "2.56.3",
-    "rollup-plugin-dts": "4.0.0",
-    "rollup-plugin-esbuild": "4.5.0",
-    "supertest": "6.1.6",
-    "typescript": "4.4.3",
+    "jest": "29.7.0",
+    "rollup": "4.12.0",
+    "rollup-plugin-dts": "6.1.0",
+    "rollup-plugin-esbuild": "6.1.1",
+    "supertest": "6.3.4",
+    "typescript": "5.3.3",
     "tough-cookie": "4.1.3"
   },
   "peerDependencies": {
     "@ory/client": ">1.1.38",
     "next": ">=12.0.10"
   },
   "dependencies": {
-    "@types/tldjs": "2.3.1",
-    "cookie": "0.5.0",
-    "istextorbinary": "6.0.0",
+    "@types/tldjs": "2.3.4",
+    "cookie": "0.6.0",
+    "istextorbinary": "9.5.0",
     "next": ">=12.0.10",
     "ory-prettier-styles": "1.3.0",
-    "prettier": "2.3.2",
-    "request": "2.88.2",
+    "prettier": "3.2.5",
     "set-cookie-parser": "2.6.0",
     "tldjs": "2.3.1"
-  },
-  "overrides": {
-    "request": {
-      "tough-cookie": "$tough-cookie"
-    }
   }
 }

rollup.config.js → rollup.config.mjs

@@ -6,7 +6,7 @@ const bundle = (config) => ({
   external: (id) => !/^[./]/.test(id),
 })
 
-const modules = ["ui", "routes", "next-edge", "next"]
+const modules = ["ui", "routes", "next-edge", "next", "next-edge-app"]
   .map((module) => [
     bundle({
       plugins: [esbuild()],

src/common/default-forwarded-headers.ts

@@ -0,0 +1,13 @@
+export const defaultForwardedHeaders = [
+  "accept",
+  "accept-charset",
+  "accept-encoding",
+  "accept-language",
+  "authorization",
+  "cache-control",
+  "content-type",
+  "cookie",
+  "host",
+  "user-agent",
+  "referer",
+]

src/common/get-base-url.ts

@@ -0,0 +1,26 @@
+import { type CreateApiHandlerOptions } from "../type/create-api-handler-options"
+
+export function getBaseUrl(options: CreateApiHandlerOptions) {
+  let baseUrl = options.fallbackToPlayground
+    ? "https://playground.projects.oryapis.com/"
+    : ""
+
+  if (process.env.ORY_SDK_URL) {
+    baseUrl = process.env.ORY_SDK_URL
+  }
+
+  if (process.env.ORY_KRATOS_URL) {
+    baseUrl = process.env.ORY_KRATOS_URL
+  }
+
+  if (process.env.ORY_SDK_URL && process.env.ORY_KRATOS_URL) {
+    throw new Error("Only one of ORY_SDK_URL or ORY_KRATOS_URL can be set.")
+  }
+
+  if (options.apiBaseUrlOverride) {
+    baseUrl = options.apiBaseUrlOverride
+  }
+
+  return baseUrl.replace(/\/$/, "")
+}
+export { CreateApiHandlerOptions }

src/common/get-cookie-domain.test.ts

@@ -0,0 +1,71 @@
+import { guessCookieDomain } from "./get-cookie-domain"
+
+describe("cookie guesser", () => {
+  test("uses force domain", async () => {
+    expect(
+      guessCookieDomain("https://localhost", {
+        forceCookieDomain: "some-domain",
+      }),
+    ).toEqual("some-domain")
+  })
+
+  test("does not use any guessing domain", async () => {
+    expect(
+      guessCookieDomain("https://localhost", {
+        dontUseTldForCookieDomain: true,
+      }),
+    ).toEqual(undefined)
+  })
+
+  test("is not confused by invalid data", async () => {
+    expect(
+      guessCookieDomain("5qw5tare4g", {
+        dontUseTldForCookieDomain: true,
+      }),
+    ).toEqual(undefined)
+    expect(
+      guessCookieDomain("https://123.123.123.123.123", {
+        dontUseTldForCookieDomain: true,
+      }),
+    ).toEqual(undefined)
+  })
+
+  test("is not confused by IP", async () => {
+    expect(
+      guessCookieDomain("https://123.123.123.123", {
+        dontUseTldForCookieDomain: true,
+      }),
+    ).toEqual(undefined)
+    expect(
+      guessCookieDomain("https://2001:0db8:0000:0000:0000:ff00:0042:8329", {
+        dontUseTldForCookieDomain: true,
+      }),
+    ).toEqual(undefined)
+  })
+
+  test("uses TLD", async () => {
+    expect(guessCookieDomain("https://foo.localhost", {})).toEqual(
+      "foo.localhost",
+    )
+
+    expect(guessCookieDomain("https://foo.localhost:1234", {})).toEqual(
+      "foo.localhost",
+    )
+
+    expect(
+      guessCookieDomain(
+        "https://spark-public.s3.amazonaws.com/dataanalysis/loansData.csv",
+        {},
+      ),
+    ).toEqual("spark-public.s3.amazonaws.com")
+
+    expect(guessCookieDomain("spark-public.s3.amazonaws.com", {})).toEqual(
+      "spark-public.s3.amazonaws.com",
+    )
+
+    expect(guessCookieDomain("https://localhost/123", {})).toEqual("localhost")
+    expect(guessCookieDomain("https://localhost:1234/123", {})).toEqual(
+      "localhost",
+    )
+  })
+})

src/common/get-cookie-domain.ts

@@ -0,0 +1,27 @@
+import tldjs from "tldjs"
+import { CreateApiHandlerOptions } from "./get-base-url"
+
+export function guessCookieDomain(
+  url: string | undefined,
+  options: CreateApiHandlerOptions,
+) {
+  if (!url || options.forceCookieDomain) {
+    return options.forceCookieDomain
+  }
+
+  if (options.dontUseTldForCookieDomain) {
+    return undefined
+  }
+
+  const parsed = tldjs.parse(url || "")
+
+  if (!parsed.isValid || parsed.isIp) {
+    return undefined
+  }
+
+  if (!parsed.domain) {
+    return parsed.hostname
+  }
+
+  return parsed.domain
+}

src/common/process-location-header.ts

@@ -0,0 +1,18 @@
+export function processLocationHeader(
+  locationHeaderValue: string,
+  baseUrl: string,
+) {
+  if (locationHeaderValue.startsWith(baseUrl)) {
+    return locationHeaderValue.replace(baseUrl, "/api/.ory")
+  }
+
+  if (
+    locationHeaderValue.startsWith("/api/kratos/public/") ||
+    locationHeaderValue.startsWith("/self-service/") ||
+    locationHeaderValue.startsWith("/ui/")
+  ) {
+    return "/api/.ory" + locationHeaderValue
+  }
+
+  return locationHeaderValue
+}