Add support for crossorigin parameter

This is a parameter I’m proposing for the Action API (see the linked
Gerrit change); as it affects CORS, it must be part of any preflight
request and thus be included in the URL, rather than the POST body, just
like the origin parameter. Let’s add support for it already so it can be
tested more easily. (If the parameters ends up not being merged after
all, we can remove this again.)

CHANGES.md

@@ -7,7 +7,9 @@ but this file may sometimes contain later improvements (e.g. typo fixes).
 
 ## next (not yet released)
 
-No changes yet.
+- Added experimental support for the upcoming `crossorigin` API parameter
+  (added in [Gerrit change I41200852ee][I41200852ee] for [T322944][]).
+  This may be reverted in a future release if the MediaWiki change is not merged after all.
 
 ## v0.8.3 (2024-09-07)
 
@@ -331,3 +333,5 @@ but I see no reason to recreate the tag now.
 [m3api-doc-v0.7.1]: https://lucaswerkmeister.github.io/m3api/v0.7.1/
 [m3api-oauth2]: https://www.npmjs.com/package/m3api-oauth2
 [CVE-2023-45143]: https://github.com/advisories/GHSA-wqq4-5wpv-mx2g
+[I41200852ee]: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/926663
+[T322944]: https://phabricator.wikimedia.org/T322944

core.js

@@ -237,7 +237,7 @@ function splitPostParameters( params ) {
 	const urlParams = {};
 	const bodyParams = {};
 	for ( const [ key, value ] of Object.entries( params ) ) {
-		if ( key === 'action' || key === 'origin' ) {
+		if ( key === 'action' || key === 'origin' || key === 'crossorigin' ) {
 			urlParams[ key ] = value;
 		} else {
 			bodyParams[ key ] = value;

test/unit/core.test.js

@@ -1243,6 +1243,24 @@ describe( 'Session', () => {
 
 		} );
 
+		it( 'splits URL and body params', async () => {
+			const session = singleRequestSession( {
+				action: 'query',
+				list: 'search',
+				srsearch: 'test',
+				origin: '*',
+				crossorigin: '',
+			}, {}, 'POST' );
+			await session.request( {
+				action: 'query',
+				list: 'search',
+				srsearch: 'test',
+				origin: '*',
+				crossorigin: true,
+			}, { method: 'POST' } );
+			// actual assertions are in checkPostParams()
+		} );
+
 	} );
 
 	describe( 'requestAndContinue', () => {

test/unit/sessions.js

@@ -74,14 +74,27 @@ export function makeResponse( bodyOrResponse ) {
 	}
 }
 
+/**
+ * Check that the URL and body parameters are disjoint,
+ * that the URL parameters only include action/origin/crossorigin
+ * and that the body paramaters don’t include those parameters.
+ *
+ * @param {Object} urlParams
+ * @param {Object} bodyParams
+ */
 function checkPostParams( urlParams, bodyParams ) {
 	const urlParamNames = Object.keys( urlParams );
 	const commonParamNames = urlParamNames.filter(
 		( name ) => name in bodyParams );
 	expect( commonParamNames ).to.be.empty;
+
 	const unexpectedUrlParamNames = urlParamNames.filter(
-		( name ) => name !== 'action' && name !== 'origin' );
+		( name ) => name !== 'action' && name !== 'origin' && name !== 'crossorigin' );
 	expect( unexpectedUrlParamNames ).to.be.empty;
+
+	expect( bodyParams ).not.to.have.keys( 'action' );
+	expect( bodyParams ).not.to.have.keys( 'origin' );
+	expect( bodyParams ).not.to.have.keys( 'crossorigin' );
 }
 
 /**