Load the Maps API over https rather than protocol-relative

[LukeTowers]

Summary

AddressFinder::loadAssets() registers the Google Maps API with a protocol-relative URL:

$this->addJs('//maps.googleapis.com/maps/api/js?libraries=places&key='.$apiKey);

Snowboard's Url utility doesn't recognise that form. Both to() and asset() test for an explicit scheme and, when the URL doesn't match, strip every leading slash before resolving what's left against the site:

const urlRegex = /^(?:[^:]+:\/\/)[-a-z0-9@:%._+~#=]{1,256}\b([-a-z0-9()@:%_+.~#?&//=]*)/i;

if (url.match(urlRegex)) {
    return url;
}

const theUrl = url.replace(/^\/+/, '');

return `${this.assetUrl()}${theUrl}`;

So the browser requests https://<site>/maps.googleapis.com/maps/api/js?… and gets a 404.

Why it isn't noticed on a page load

AssetMaker::getAssetPath() and getAssetScheme() both pass protocol-relative URLs through untouched, so a full render emits a working <script src="//maps.googleapis.com/…">. The break only happens when the same asset arrives via X_WINTER_ASSETS and is loaded by AssetLoader.loadScript() — i.e. on any AJAX request made from a backend form containing an AddressFinder.

The symptom is worse than a missing script. loadScript() rejects its promise when the script errors, and handleUpdateResponse() awaits it, so the AJAX handler never completes. I ran into this through LukeTowers.EasyAudit, where opening an audit log entry left the popup spinning forever with nothing but the 404 in the console to go on.

The change

Requests the scheme explicitly. It costs nothing — the Maps API only serves over https anyway — and it's the smaller of the two fixes.

The underlying Url behaviour is reported separately as wintercms/winter#1538, since a protocol-relative URL is valid and shouldn't be silently rewritten into a same-origin path. That fix belongs in core; this one unblocks the plugin in the meantime and remains correct either way.

Version bumped to 2.2.2 (patch — a bug fix, no API or behaviour change).

Testing

Verified against a Winter 1.2.12 backend form containing an AddressFinder: before the change the AJAX request for the widget's assets resolved to https://<site>/maps.googleapis.com/… and 404'd, leaving the handler's response unapplied; after it, the asset loads from maps.googleapis.com and the handler completes. Confirmed the widget is the only protocol-relative asset in the plugin.

🤖 Generated with Claude Code

https://claude.ai/code/session_018icgbPJpBGE4wCuDGxsKjE

Summary by CodeRabbit

• Bug Fixes

  • Fixed an issue where the Google Maps Places API could fail to load when the AddressFinder widget was rendered through AJAX.
  • AddressFinder now consistently loads the Maps API over a secure HTTPS connection, improving reliability when entering or selecting addresses.

• Documentation

  • Updated the version history to record the fix in release 2.2.2.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 4772cb53-efe4-4797-83c5-d72ab9f9b049

📥 Commits

Reviewing files that changed from the base of the PR and between 5d07ce8 and 39a7a8e.

📒 Files selected for processing (2)

• formwidgets/AddressFinder.php
• updates/version.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The Google Maps API asset URL in AddressFinder::loadAssets() now uses HTTPS. The version history adds release 2.2.2 and documents the AJAX rendering fix.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 39a7a

AddressFinder now loads the Google Maps API via HTTPS during AJAX rendering, preventing the same-origin asset rewrite that blocked autocomplete and form handling. The focused change is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: loading the Maps API over HTTPS instead of using a protocol-relative URL.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/addressfinder-protocol-relative-maps-url

Warning

Some tools did not complete. Review the errors below.

🔧 PHPStan (2.2.8)

Composer install failed: dependency resolution error. Check composer.json and composer.lock for version constraints.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}