Merge branch 'valid-local'

CHANGES.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.8.2 (2025-01-22)
+
+- Fix: consider localhost as secure in `isValidSecureUrl`.
+
 ## 0.8.1 (2025-01-22)
 
 - Fix: `getNext` now supports port numbers as well.

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@slipmatio/toolbelt",
   "type": "module",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "main": "dist/toolbelt.js",
   "module": "dist/toolbelt.js",
   "exports": {

src/browser.ts

@@ -120,17 +120,20 @@ export function isAllowedDomain(url: string, allowedDomains: string[]): boolean
 
 /**
  * Basic URL validation that checks if string can be parsed as URL
- * Input must start with https://
  */
 export function isValidSecureUrl(url: string) {
   try {
     const parsed = new URL(url)
+
+    if (parsed.hostname === 'localhost') {
+      return true
+    }
+
     return parsed.protocol === 'https:'
   } catch {
     return false
   }
 }
-
 /**
  * Simple helper to prefetch images
  * @param urls URL or array of URLs to prefetch

tests/unit/secure-urls.test.ts

@@ -0,0 +1,15 @@
+import { expect, test } from 'vitest'
+
+import { isValidSecureUrl } from '@/browser'
+
+test('isValidSecureUrl', () => {
+  expect(isValidSecureUrl('https://www.fi')).toBe(true)
+  expect(isValidSecureUrl('https://example.com/')).toBe(true)
+  expect(isValidSecureUrl('not-an-url.io')).toBe(false)
+
+  expect(isValidSecureUrl('https://next.slipmat.io/djuninen/')).toBe(true)
+
+  expect(isValidSecureUrl('http://localhost')).toBe(true)
+  expect(isValidSecureUrl('http://localhost:8000')).toBe(true)
+  expect(isValidSecureUrl('http://localhost:8000/login/')).toBe(true)
+})

tests/unit/type-helpers.test.ts

@@ -2,7 +2,7 @@ import { expect, test } from 'vitest'
 
 import { isString } from '@/type-helpers'
 
-test('entries', async () => {
+test('entries', () => {
   expect(isString('')).toBe(true)
   expect(isString('foo')).toBe(true)
   expect(isString([null])).toBe(false)