@arizeai/phoenix-client 6.13.0 → 6.14.0

package/src/authFetch.ts

@@ -0,0 +1,87 @@
+export interface AuthFetchOptions {
+  /**
+   * Return an access token for a request.
+   *
+   * When `forceRefresh` is true, the previous token was rejected with a 401
+   * and the provider should refresh it before returning. Providers own token
+   * storage and refresh-token rotation.
+   */
+  getAccessToken: (options: {
+    forceRefresh: boolean;
+  }) => string | Promise<string>;
+  /** Fetch implementation used to send requests. Defaults to global fetch. */
+  fetch?: typeof fetch;
+  /** Called when the request is still unauthorized after one refresh. */
+  onUnauthorized?: (response: Response) => void | Promise<void>;
+}
+
+/**
+ * Create a fetch implementation that supplies a bearer token and refreshes it
+ * after a 401 response.
+ *
+ * Refresh calls are coalesced so concurrent unauthorized requests rotate a
+ * refresh token only once. Each request is retried at most once.
+ *
+ * @param options - Authentication behavior for the fetch implementation.
+ * @param options.getAccessToken - Returns the current token or refreshes it.
+ * @param options.fetch - Fetch implementation used to send requests.
+ * @param options.onUnauthorized - Handles a second unauthorized response.
+ */
+export function createAuthFetch({
+  getAccessToken,
+  fetch: fetchImpl = fetch,
+  onUnauthorized,
+}: AuthFetchOptions): typeof fetch {
+  let refreshPromise: Promise<string> | undefined;
+
+  const refreshAccessToken = (): Promise<string> => {
+    if (!refreshPromise) {
+      refreshPromise = Promise.resolve(
+        getAccessToken({ forceRefresh: true })
+      ).finally(() => {
+        refreshPromise = undefined;
+      });
+    }
+    return refreshPromise;
+  };
+
+  return async function authFetch(
+    input: Parameters<typeof fetch>[0],
+    init?: RequestInit
+  ) {
+    const request = new Request(input, init);
+    const retryRequest = request.clone();
+    const accessToken = await getAccessToken({ forceRefresh: false });
+    const response = await fetchImpl(addBearerToken({ request, accessToken }));
+    if (response.status !== 401) {
+      return response;
+    }
+
+    // Another request may already have refreshed and persisted the token while
+    // this request was in flight. Reuse it instead of rotating again.
+    const currentAccessToken = await getAccessToken({ forceRefresh: false });
+    const retryAccessToken =
+      currentAccessToken === accessToken
+        ? await refreshAccessToken()
+        : currentAccessToken;
+    const retryResponse = await fetchImpl(
+      addBearerToken({ request: retryRequest, accessToken: retryAccessToken })
+    );
+    if (retryResponse.status === 401) {
+      await onUnauthorized?.(retryResponse);
+    }
+    return retryResponse;
+  };
+}
+
+function addBearerToken({
+  request,
+  accessToken,
+}: {
+  request: Request;
+  accessToken: string;
+}): Request {
+  const headers = new Headers(request.headers);
+  headers.set("Authorization", `Bearer ${accessToken}`);
+  return new Request(request, { headers });
+}

package/src/errors.ts

@@ -6,6 +6,7 @@
  * for instance, is how a caller learns that auth is enabled on the deployment.
  */
 export class HttpError extends Error {
+  readonly response: Response;
   readonly status: number;
   readonly statusText: string;
   readonly url: string;
@@ -13,6 +14,7 @@ export class HttpError extends Error {
   constructor(response: Response) {
     super(`${response.url}: ${response.status} ${response.statusText}`);
     this.name = "HttpError";
+    this.response = response;
     this.status = response.status;
     this.statusText = response.statusText;
     this.url = response.url;

package/src/index.ts

@@ -1,2 +1,3 @@
 export * from "./client";
+export * from "./authFetch";
 export * from "./errors";

package/src/spans/logSpans.ts

@@ -1,5 +1,6 @@
 import type { paths } from "../__generated__/api/v1";
 import { createClient } from "../client";
+import { HttpError } from "../errors";
 import type { ClientFn } from "../types/core";
 import type { ProjectIdentifier } from "../types/projects";
 import { resolveProjectIdentifier } from "../types/projects";
@@ -264,6 +265,21 @@ function parseLogSpansError(error: unknown, spans: Span[]): Error {
   return new Error(`Failed to log spans: ${formatApiError(error)}`);
 }
 
+async function parseLogSpansHttpError(
+  error: HttpError,
+  spans: Span[]
+): Promise<Error> {
+  try {
+    const contentType = error.response.headers.get("content-type");
+    const payload: unknown = contentType?.includes("application/json")
+      ? await error.response.json()
+      : await error.response.text();
+    return parseLogSpansError(payload, spans);
+  } catch {
+    return parseLogSpansError(error, spans);
+  }
+}
+
 /**
  * Log spans to a project using Phoenix's simplified span structure.
  *
@@ -303,9 +319,9 @@ export async function logSpans({
   const client = _client ?? createClient();
   const projectIdentifier = resolveProjectIdentifier(project);
 
-  const { data, error } = await client.POST(
-    "/v1/projects/{project_identifier}/spans",
-    {
+  let response: Awaited<ReturnType<typeof client.POST>>;
+  try {
+    response = await client.POST("/v1/projects/{project_identifier}/spans", {
       params: {
         path: {
           project_identifier: projectIdentifier,
@@ -314,8 +330,15 @@ export async function logSpans({
       body: {
         data: spans,
       },
+    });
+  } catch (error) {
+    if (error instanceof HttpError) {
+      throw await parseLogSpansHttpError(error, spans);
     }
-  );
+    throw error;
+  }
+
+  const { data, error } = response;
 
   if (error) {
     throw parseLogSpansError(error, spans);