fix: request HTTPS tiles for ion-backed Bing imagery

src/maps/imagery.js

@@ -25,5 +25,42 @@ export function createEsriImagery() {
 export function createIonImagery(style, accessToken) {
   accessToken = String(accessToken || '').trim();
   if (!accessToken) throw new Error('Ion imagery requires an explicit token');
+  if (
+    style === Cesium.IonWorldImageryStyle.AERIAL ||
+    style === Cesium.IonWorldImageryStyle.AERIAL_WITH_LABELS
+  ) {
+    return createBingIonImagery(style, accessToken);
+  }
   return Cesium.IonImageryProvider.fromAssetId(style, { accessToken });
 }
+
+async function createBingIonImagery(style, accessToken) {
+  const endpoint = await new Cesium.Resource({
+    url: `https://api.cesium.com/v1/assets/${style}/endpoint`,
+    queryParameters: { access_token: accessToken },
+  }).fetchJson();
+  if (
+    endpoint?.type !== 'IMAGERY' ||
+    endpoint.externalType !== 'BING' ||
+    typeof endpoint.options?.url !== 'string'
+  ) {
+    throw new Error('Ion world imagery did not return a Bing imagery endpoint');
+  }
+  // Bing otherwise follows the page's HTTP scheme on localhost. Resolve its
+  // ion-issued credentials through public APIs so tiles use HTTPS without
+  // weakening CSP, changing SDK defaults or touching provider internals.
+  const { url, ...options } = endpoint.options;
+  const provider = await Cesium.BingMapsImageryProvider.fromUrl(url, {
+    ...options,
+    tileProtocol: 'https',
+  });
+  const ionCredits = (endpoint.attributions ?? []).map(
+    ({ html, collapsible }) => new Cesium.Credit(html, collapsible === false),
+  );
+  const getTileCredits = provider.getTileCredits.bind(provider);
+  provider.getTileCredits = (x, y, level) => [
+    ...ionCredits,
+    ...(getTileCredits(x, y, level) ?? []),
+  ];
+  return provider;
+}