@attlaz/client 1.80.0 → 1.81.0

package/dist/Client.js

@@ -99,22 +99,16 @@ export class Client {
         return client;
     }
     setClientCredentials(clientId, clientSecret = '') {
-        const options = new OAuthClientOptions(this.apiEndpoint, clientId, clientSecret);
-        // TODO: how to know these scopes?
-        options.scopes = ['all'];
-        // TODO: do we need to create a new oauth client, or can we update with these credentials?
-        this.httpClient = new OAuthClient(options);
-        this.transport = this.httpClient;
+        // Store the credentials in place; the token (if any) is preserved and used while valid. When
+        // no valid token exists, the client mints one from these credentials on the next request.
+        this.httpClient.setClientCredentials(clientId, clientSecret, ['all']);
     }
     /**
      * Configure this client as a public OAuth client (no client_secret).
      * Used for SPAs and other public clients that cannot keep a secret.
      */
     setPublicClient(clientId) {
-        const options = new OAuthClientOptions(this.apiEndpoint, clientId, null);
-        options.scopes = ['all'];
-        this.httpClient = new OAuthClient(options);
-        this.transport = this.httpClient;
+        this.httpClient.setClientCredentials(clientId, null, ['all']);
     }
     setVersion(version) {
         this.httpClient.setVersion(version);

package/dist/Http/OAuthClientOptions.d.ts

@@ -1,7 +1,7 @@
 export declare class OAuthClientOptions {
     apiEndpoint: string;
-    readonly clientId: string | null;
-    readonly clientSecret: string | null;
+    clientId: string | null;
+    clientSecret: string | null;
     accessTokenUri: string;
     authorizationUri: string;
     redirectUri: string;

package/dist/Http/OAuthClientOptions.js

@@ -7,7 +7,10 @@ export class OAuthClientOptions {
     redirectUri = 'https://example.com/auth/github/callback';
     scopes = [];
     state = '';
-    constructor(apiEndpoint, clientId = null, clientSecret = null) {
+    constructor(apiEndpoint, 
+    // Mutable so client credentials can be updated in place (see OAuthClient.setClientCredentials)
+    // without recreating the client and losing its token.
+    clientId = null, clientSecret = null) {
         this.apiEndpoint = apiEndpoint;
         this.clientId = clientId;
         this.clientSecret = clientSecret;

package/dist/Http/Transport/OAuthClient.d.ts

@@ -7,13 +7,29 @@ export declare class OAuthClient implements ITransport {
     private readonly options;
     private debug;
     private oauthClientToken;
-    private refreshTokenPromise;
+    private tokenAcquisitionPromise;
     private version;
     private parseErrorHandler;
     constructor(options: OAuthClientOptions);
     authenticate(username: string, password: string): Promise<boolean>;
     authenticate(): Promise<boolean>;
     refreshToken(): Promise<void>;
+    /**
+     * Update the client credentials in place — without recreating the client or touching the current
+     * token. Mirrors the PHP client: token and credentials are independent. A valid token keeps being
+     * used; the credentials are only the fallback to mint/renew a token when none is valid.
+     */
+    setClientCredentials(clientId: string | null, clientSecret: string | null, scopes?: string[]): void;
+    /**
+     * Ensure a usable access token exists before a signed request. Token-first with credentials as a
+     * fallback (mirrors the PHP client's lazy authenticate()): a valid token is left untouched; an
+     * expired token carrying a refresh_token is refreshed; otherwise, if confidential client
+     * credentials are configured, a token is minted via the client_credentials grant. Single-flighted
+     * so concurrent requests share one acquisition.
+     */
+    private ensureAccessToken;
+    private acquireToken;
+    private static hasRefreshToken;
     private isPublicClient;
     /**
      * Performs an OAuth token request (password, client_credentials or refresh_token grant) and

package/dist/Http/Transport/OAuthClient.js

@@ -9,7 +9,9 @@ export class OAuthClient {
     options;
     debug = false;
     oauthClientToken = null;
-    refreshTokenPromise = null;
+    // Single-flight guard for token acquisition (initial client-credentials auth or refresh), so
+    // concurrent requests share one in-flight acquisition instead of each hitting the token endpoint.
+    tokenAcquisitionPromise = null;
     version = null;
     parseErrorHandler = null;
     constructor(options) {
@@ -93,6 +95,58 @@ export class OAuthClient {
             throw ClientError.fromError(e);
         }
     }
+    /**
+     * Update the client credentials in place — without recreating the client or touching the current
+     * token. Mirrors the PHP client: token and credentials are independent. A valid token keeps being
+     * used; the credentials are only the fallback to mint/renew a token when none is valid.
+     */
+    setClientCredentials(clientId, clientSecret, scopes = ['all']) {
+        this.options.clientId = clientId;
+        this.options.clientSecret = clientSecret;
+        this.options.scopes = scopes;
+    }
+    /**
+     * Ensure a usable access token exists before a signed request. Token-first with credentials as a
+     * fallback (mirrors the PHP client's lazy authenticate()): a valid token is left untouched; an
+     * expired token carrying a refresh_token is refreshed; otherwise, if confidential client
+     * credentials are configured, a token is minted via the client_credentials grant. Single-flighted
+     * so concurrent requests share one acquisition.
+     */
+    async ensureAccessToken() {
+        if (this.oauthClientToken !== null && !OAuthClientToken.isExpired(this.oauthClientToken)) {
+            return;
+        }
+        if (this.tokenAcquisitionPromise === null) {
+            this.tokenAcquisitionPromise = this.acquireToken();
+            try {
+                await this.tokenAcquisitionPromise;
+            }
+            finally {
+                // Always clear, even on failure, so one failed acquisition doesn't poison every later
+                // request with the same rejected promise.
+                this.tokenAcquisitionPromise = null;
+            }
+        }
+        else {
+            await this.tokenAcquisitionPromise;
+        }
+    }
+    async acquireToken() {
+        // Expired token that carries a refresh_token → refresh grant (keeps the existing session).
+        if (this.oauthClientToken !== null && OAuthClientToken.isExpired(this.oauthClientToken) && OAuthClient.hasRefreshToken(this.oauthClientToken)) {
+            await this.refreshToken();
+            return;
+        }
+        // No usable token (missing, or expired without a refresh_token): mint one from client
+        // credentials if we have them. Public clients (no secret) can't use the client_credentials
+        // grant, so they fall through and the caller gets a 401 — they must obtain a token another way.
+        if (this.options.clientId !== null && !this.isPublicClient()) {
+            await this.authenticate();
+        }
+    }
+    static hasRefreshToken(token) {
+        return token.refresh_token !== undefined && token.refresh_token !== null && token.refresh_token !== '';
+    }
     isPublicClient() {
         return this.options.clientSecret === null || this.options.clientSecret === '';
     }
@@ -141,29 +195,13 @@ export class OAuthClient {
     }
     async request(action, parameters = null, method = 'GET', signWithOauthToken = true) {
         if (signWithOauthToken) {
-            // A single null check both guards and narrows the token type. No access token at
-            // all is an auth failure (401), so consumers route it to the same sign-out path as
-            // a rejected refresh.
+            // Token-first, credentials-as-fallback (mirrors the PHP client): use a valid token as-is,
+            // otherwise refresh or mint one from client credentials. Only when nothing is available do
+            // we 401 — the same sign-out path consumers already handle for a rejected refresh.
+            await this.ensureAccessToken();
             if (this.oauthClientToken === null) {
                 throw new ClientError('Unable to perform request, access token not provided', HttpStatus.HTTP_UNAUTHORIZED);
             }
-            if (OAuthClientToken.isExpired(this.oauthClientToken)) {
-                if (this.refreshTokenPromise === null) {
-                    this.refreshTokenPromise = this.refreshToken();
-                    try {
-                        await this.refreshTokenPromise;
-                    }
-                    finally {
-                        // Always clear, even on failure, so a single failed refresh doesn't
-                        // poison every later request with the same rejected promise (e.g.
-                        // after the user re-authenticates).
-                        this.refreshTokenPromise = null;
-                    }
-                }
-                else {
-                    await this.refreshTokenPromise;
-                }
-            }
         }
         const requestData = this.createRequestData(action, parameters, method, signWithOauthToken);
         if (this.debug) {

package/dist/Model/ApiRecord.d.ts

@@ -1 +1,5 @@
-export type ApiRecord = Record<string, string | number | boolean | Date | null>;
+import { DataValueValue } from './DataValue.js';
+export type ApiRecord = Record<string, string | number | boolean | Date | {
+    key: string;
+    value: DataValueValue;
+}[] | null>;

package/dist/Model/Collections/CollectionRecord.d.ts

@@ -1,6 +1,7 @@
+import { ApiRecord } from '../ApiRecord.js';
 export declare class CollectionRecord {
     id: string;
     collection: string;
     properties: Record<string, unknown>;
-    static parse(raw: Record<string, unknown>): CollectionRecord;
+    static parse(raw: ApiRecord): CollectionRecord;
 }

package/dist/Model/Configuration/Configuration.d.ts

@@ -1,10 +1,11 @@
-import { State } from '../State.js';
+import { ApiRecord } from '../ApiRecord.js';
 import { DataValueValue } from '../DataValue.js';
+import { State } from '../State.js';
 export declare class Configuration {
     id: string;
     path: string;
     value: DataValueValue;
     state: State;
     scope: string;
-    static parse(rawConfig: Record<string, unknown>): Configuration;
+    static parse(rawConfig: ApiRecord): Configuration;
 }

package/dist/Model/Deployment/CodeSourceBuildStrategy.d.ts

@@ -1,3 +1,4 @@
+import { ApiRecord } from '../ApiRecord.js';
 import { DataValueCollection } from '../DataValueCollection.js';
 import { State } from '../State.js';
 import { StateAware } from '../StateAware.js';
@@ -8,5 +9,5 @@ export declare class CodeSourceBuildStrategy implements StateAware {
     languageId: string;
     state: State;
     data: DataValueCollection;
-    static parse(raw: any): CodeSourceBuildStrategy;
+    static parse(raw: ApiRecord): CodeSourceBuildStrategy;
 }

package/dist/Model/Deployment/CodeSourceRunStrategy.d.ts

@@ -1,6 +1,7 @@
+import { ApiRecord } from '../ApiRecord.js';
 import { DataValueCollection } from '../DataValueCollection.js';
-import { StateAware } from '../StateAware.js';
 import { State } from '../State.js';
+import { StateAware } from '../StateAware.js';
 export declare class CodeSourceRunStrategy implements StateAware {
     id: string;
     name: string;
@@ -8,5 +9,5 @@ export declare class CodeSourceRunStrategy implements StateAware {
     languageId: string;
     state: State;
     data: DataValueCollection;
-    static parse(raw: any): CodeSourceRunStrategy;
+    static parse(raw: ApiRecord): CodeSourceRunStrategy;
 }

package/dist/Model/Deployment/SourcesAccountRepository.d.ts

@@ -1,7 +1,8 @@
+import { ApiRecord } from '../ApiRecord.js';
 export declare class SourcesAccountRepository {
     key: string;
     name: string;
     url: string;
     description: string;
-    static parse(rawSourcesAccountRepository: any): SourcesAccountRepository;
+    static parse(rawSourcesAccountRepository: ApiRecord): SourcesAccountRepository;
 }

package/dist/Model/Deployment/SourcesAccountRepositoryBranch.d.ts

@@ -1,4 +1,5 @@
+import { ApiRecord } from '../ApiRecord.js';
 export declare class SourcesAccountRepositoryBranch {
     key: string;
-    static parse(raw: any): SourcesAccountRepositoryBranch;
+    static parse(raw: ApiRecord): SourcesAccountRepositoryBranch;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attlaz/client",
-  "version": "1.80.0",
+  "version": "1.81.0",
   "description": "Javascript Client to access Attlaz API",
   "types": "./dist/index.d.ts",
   "main": "./dist/index.js",