@attlaz/client 1.102.1 → 1.104.0

package/dist/Http/Transport/DirectTransport.d.ts

@@ -4,24 +4,18 @@ export interface DirectTransportRoute {
     prefix: string;
     baseUrl: string;
 }
-/**
- * The actor an internal call runs as. Backends resolve access against this, so a caller that reaches
- * user-owned resources must name one — an anonymous session can only reach unguarded routes.
- */
-export interface DirectTransportPrincipal {
-    id: string;
-    name: string;
-}
 /**
  * Transport for internal service-to-service calls that bypasses Gateway OAuth.
  * Authenticates via HMAC-signed session headers instead of an OAuth token.
  *
- * The caller is responsible for computing the HMAC signature (since this requires
- * node:crypto which is not available in browser environments).
+ * It carries the session payload and its signature without interpreting either: the payload's shape
+ * is a contract between Attlaz services, and building it needs `node:crypto` and platform models
+ * this package deliberately does not depend on. **Attlaz services should not construct this
+ * directly** — use `InternalTransportFactory.asSystem()` from `@attlaz/attlaz-core`, which owns that
+ * shape and does the signing.
  *
- * Usage:
+ * Usage (non-Attlaz callers, or anything supplying its own session):
  *   import {createHmac} from 'node:crypto';
- *   const sessionPayload = DirectTransport.createSessionPayload();
  *   const sessionSignature = createHmac('sha256', apiSecret).update(sessionPayload).digest('hex');
  *   const transport = new DirectTransport('http://core-api:5728', sessionPayload, sessionSignature);
  *   const client = Client.withTransport(transport);
@@ -36,14 +30,6 @@ export declare class DirectTransport implements ITransport {
     private readonly clients;
     private readonly sortedRoutes;
     private parseErrorHandler;
-    /**
-     * Creates the session payload for internal service-to-service calls.
-     *
-     * Pass `user` when the call reaches resources an access policy guards (typically the platform
-     * SYSTEM user); omit it only for routes that need no actor. The payload is what the receiving
-     * backend authenticates as, so it must be re-signed whenever it changes.
-     */
-    static createSessionPayload(user?: DirectTransportPrincipal | null): string;
     constructor(defaultBaseUrl: string, sessionPayload: string, sessionSignature: string, routes?: DirectTransportRoute[]);
     request<T>(action: string, parameters?: Parameters, method?: string, _signWithOauthToken?: boolean): Promise<T>;
     private resolveClient;

package/dist/Http/Transport/DirectTransport.js

@@ -4,12 +4,14 @@ import { OAuthClient } from './OAuthClient.js';
  * Transport for internal service-to-service calls that bypasses Gateway OAuth.
  * Authenticates via HMAC-signed session headers instead of an OAuth token.
  *
- * The caller is responsible for computing the HMAC signature (since this requires
- * node:crypto which is not available in browser environments).
+ * It carries the session payload and its signature without interpreting either: the payload's shape
+ * is a contract between Attlaz services, and building it needs `node:crypto` and platform models
+ * this package deliberately does not depend on. **Attlaz services should not construct this
+ * directly** — use `InternalTransportFactory.asSystem()` from `@attlaz/attlaz-core`, which owns that
+ * shape and does the signing.
  *
- * Usage:
+ * Usage (non-Attlaz callers, or anything supplying its own session):
  *   import {createHmac} from 'node:crypto';
- *   const sessionPayload = DirectTransport.createSessionPayload();
  *   const sessionSignature = createHmac('sha256', apiSecret).update(sessionPayload).digest('hex');
  *   const transport = new DirectTransport('http://core-api:5728', sessionPayload, sessionSignature);
  *   const client = Client.withTransport(transport);
@@ -24,24 +26,6 @@ export class DirectTransport {
     clients = new Map();
     sortedRoutes;
     parseErrorHandler = null;
-    /**
-     * Creates the session payload for internal service-to-service calls.
-     *
-     * Pass `user` when the call reaches resources an access policy guards (typically the platform
-     * SYSTEM user); omit it only for routes that need no actor. The payload is what the receiving
-     * backend authenticates as, so it must be re-signed whenever it changes.
-     */
-    static createSessionPayload(user = null) {
-        return JSON.stringify({
-            api_version: 'latest',
-            user: user,
-            client: null,
-            ip: 'internal',
-            roles: [],
-            scopes: [],
-            access_token: null,
-        });
-    }
     constructor(defaultBaseUrl, sessionPayload, sessionSignature, routes = []) {
         // All routes plus the catch-all default, sorted by prefix length descending (most specific first)
         this.sortedRoutes = [...routes, { prefix: '', baseUrl: defaultBaseUrl }]

package/dist/Service/AdapterConnectionEndpoint.d.ts

@@ -11,6 +11,14 @@ export declare class AdapterConnectionEndpoint extends Endpoint {
     getConnectionByKey(projectId: string, connectionKey: string): Promise<AdapterConnection | null>;
     getConnectionConfiguration(connectionId: string): Promise<CollectionResult<AdapterConnectionConfigurationValue>>;
     saveConnection(projectId: string, connection: AdapterConnection): Promise<AdapterConnection>;
+    /**
+     * Writes the supplied configurations and leaves the rest of the connection alone — PATCH, since
+     * it is a partial update. A configuration the API does not let a client set (a provider token)
+     * is untouched rather than cleared.
+     *
+     * Needs an API that serves the PATCH route; it is also still registered as POST for clients
+     * released before the verb changed.
+     */
     saveConnectionConfiguration(connectionId: string, configuration: AdapterConnectionConfigurationValue[]): Promise<boolean>;
     getConnectionEvents(connectionId: string, pagination: CursorPagination): Promise<CollectionResult<AdapterConnectionEvent>>;
     /**

package/dist/Service/AdapterConnectionEndpoint.js

@@ -79,11 +79,19 @@ export class AdapterConnectionEndpoint extends Endpoint {
             throw error;
         }
     }
+    /**
+     * Writes the supplied configurations and leaves the rest of the connection alone — PATCH, since
+     * it is a partial update. A configuration the API does not let a client set (a provider token)
+     * is untouched rather than cleared.
+     *
+     * Needs an API that serves the PATCH route; it is also still registered as POST for clients
+     * released before the verb changed.
+     */
     async saveConnectionConfiguration(connectionId, configuration) {
         try {
             const url = path('/connections/:connectionId/configuration', { connectionId });
             const parser = (raw) => ({ saved: raw.saved });
-            const result = await this.requestObject(url, { configuration: configuration }, parser, 'POST');
+            const result = await this.requestObject(url, { configuration: configuration }, parser, 'PATCH');
             const res = result.getData();
             if (res === null) {
                 throw new Error('Unable to save connection configuration: wrong response from API');

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export { HttpClientRequest } from './Http/HttpClientRequest.js';
 export { HttpClientResponse } from './Http/HttpClientResponse.js';
 export { ITransport } from './Http/Transport/ITransport.js';
 export { DirectTransport } from './Http/Transport/DirectTransport.js';
-export type { DirectTransportRoute, DirectTransportPrincipal } from './Http/Transport/DirectTransport.js';
+export type { DirectTransportRoute } from './Http/Transport/DirectTransport.js';
 export { OAuthClient } from './Http/Transport/OAuthClient.js';
 export { OAuthClientOptions } from './Http/OAuthClientOptions.js';
 export { OAuthClientToken } from './Http/OAuthClientToken.js';

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.102.0";
+export declare const VERSION = "1.103.0";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "1.102.0";
+export const VERSION = "1.103.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attlaz/client",
-  "version": "1.102.1",
+  "version": "1.104.0",
   "description": "Javascript Client to access Attlaz API",
   "types": "./dist/index.d.ts",
   "main": "./dist/index.js",