@bytescale/sdk 3.11.0 → 3.12.0

package/dist/browser/cjs/main.js

@@ -2372,6 +2372,11 @@ var ConsoleUtils = /*#__PURE__*/function () {
     ConsoleUtils_classCallCheck(this, ConsoleUtils);
   }
   ConsoleUtils_createClass(ConsoleUtils, null, [{
+    key: "debug",
+    value: function debug(message) {
+      console.log(ConsoleUtils.prefix(message));
+    }
+  }, {
     key: "warn",
     value: function warn(message) {
       console.warn(ConsoleUtils.prefix(message));
@@ -2480,22 +2485,25 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     value: function beginAuthSession(params) {
       try {
         var _this2 = this;
-        var newSession = {
-          accessToken: undefined,
-          accessTokenRefreshHandle: undefined,
-          params: params,
-          isActive: true
-        };
         return AuthManagerBrowser_await(_this2.authSessionMutex.safe(AuthManagerBrowser_async(function () {
           // We check both 'session' and 'sessionDisposing' here, as we don't want to call 'beginAuthSession' until the session is fully disposed.
           if (_this2.isAuthSessionActive()) {
             throw new Error("Auth session already active. Please call 'await endAuthSession()' and then call 'await beginAuthSession(...)' to start a new auth session.");
           }
-          AuthSessionState.setSession(newSession);
-          return AuthManagerBrowser_await();
-        })), function () {
+          return AuthManagerBrowser_await(_this2.registerAuthServiceWorker(params), function (_this2$registerAuthSe) {
+            var newSession = {
+              accessToken: undefined,
+              accessTokenRefreshHandle: undefined,
+              params: params,
+              isActive: true,
+              authServiceWorker: _this2$registerAuthSe
+            };
+            AuthSessionState.setSession(newSession);
+            return newSession;
+          });
+        })), function (session) {
           // IMPORTANT: must be called outside the above, else re-entrant deadlock will occur.
-          return AuthManagerBrowser_awaitIgnored(_this2.refreshAccessToken(newSession));
+          return AuthManagerBrowser_awaitIgnored(_this2.refreshAccessToken(session));
         });
       } catch (e) {
         return Promise.reject(e);
@@ -2516,12 +2524,55 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (session.accessTokenRefreshHandle !== undefined) {
             clearTimeout(session.accessTokenRefreshHandle);
           }
-          return AuthManagerBrowser_awaitIgnored(_this4.deleteAccessToken(session.params));
+          return AuthManagerBrowser_await(_this4.deleteAccessToken(session.params), function () {
+            _this4.setServiceWorkerConfig(session, []); // Prevent service worker from authorizing subsequent requests.
+          });
         })));
       } catch (e) {
         return Promise.reject(e);
       }
     }
+    /**
+     * Idempotent.
+     *
+     * Only returns once the service worker has been activated.
+     *
+     * We don't need to unregister it: we just need to clear the config when auth ends.
+     */
+  }, {
+    key: "registerAuthServiceWorker",
+    value: function registerAuthServiceWorker(_ref) {
+      var serviceWorkerScript = _ref.serviceWorkerScript;
+      try {
+        if (serviceWorkerScript === undefined) {
+          return undefined;
+        }
+        return AuthManagerBrowser_catch(function () {
+          if ("serviceWorker" in navigator) {
+            return AuthManagerBrowser_await(navigator.serviceWorker.register(serviceWorkerScript), function (registration) {
+              return registration.active !== null ? registration.active : AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
+                registration.addEventListener("updatefound", function () {
+                  var newWorker = registration.installing;
+                  if (newWorker !== null) {
+                    newWorker.addEventListener("statechange", function () {
+                      if (newWorker.state === "activated") {
+                        resolve(newWorker);
+                      }
+                    });
+                  }
+                });
+              }));
+            }); // Occurs when: (service worker is already registered AND there's been no code changes) OR (service worker was not previously registered).
+          } else {
+            ConsoleUtils.warn("Service workers not supported by browser. Falling back to Bytescale CDN cookies for auth. These are third-party cookies, which some modern browsers block.");
+          }
+        }, function (e) {
+          throw new Error("Failed to install Bytescale Auth Service Worker (SW). ".concat(e.name, ": ").concat(e.message));
+        });
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "refreshAccessToken",
     value: function refreshAccessToken(session) {
@@ -2539,12 +2590,20 @@ var AuthManagerImpl = /*#__PURE__*/function () {
               return AuthManagerBrowser_await(session.params.authHeaders(), function (_session$params$authH) {
                 return AuthManagerBrowser_await(_getAccessToken.call(_this6, _session$params, _session$params$authH), function (jwt) {
                   return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt), function (setTokenResult) {
+                    _this6.setServiceWorkerConfig(session, [{
+                      headers: [{
+                        key: "Authorization-Token",
+                        value: jwt
+                      }],
+                      expires: Date.now() + setTokenResult.ttlSeconds * 1000,
+                      urlPrefix: "".concat(_this6.getCdnUrl(session.params), "/").concat(session.params.accountId, "/")
+                    }]);
                     var desiredTtl = setTokenResult.ttlSeconds - _this6.refreshBeforeExpirySeconds;
                     timeout = Math.max(desiredTtl, _this6.minJwtTtlSeconds);
                     if (desiredTtl !== timeout) {
                       ConsoleUtils.warn("JWT expiration is too short: waiting for ".concat(timeout, " seconds before refreshing."));
                     }
-                    // There's need to print a warning for this: it's OK to silently request the JWT before it expires. Also, this is 24 days in this case!
+                    // There's no need to print a warning for this: it's OK to silently request the JWT before it expires. Also, this is 24 days in this case!
                     timeout = Math.min(timeout, _this6.maxJwtTtlSeconds);
                     session.accessToken = setTokenResult.accessToken;
                   });
@@ -2554,7 +2613,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
               // Use 'warn' instead of 'error' since this happens frequently, i.e. user goes through a tunnel, and some customers report these errors to systems like Sentry, so we don't want to spam.
               ConsoleUtils.warn("Unable to refresh JWT access token: ".concat(e));
             });
-          }, function (_wasThrown, _result) {
+          }, function (_wasThrown, _result3) {
             session.accessTokenRefreshHandle = window.setTimeout(function () {
               _this6.refreshAccessToken(session).then(function () {},
               // Should not occur, as this method shouldn't throw errors.
@@ -2562,19 +2621,33 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                 return ConsoleUtils.error("Unexpected error when refreshing JWT access token: ".concat(e));
               });
             }, timeout * 1000);
-            return AuthManagerBrowser_rethrow(_wasThrown, _result);
+            return AuthManagerBrowser_rethrow(_wasThrown, _result3);
           }));
         })));
       } catch (e) {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "setServiceWorkerConfig",
+    value: function setServiceWorkerConfig(session, config) {
+      var _a;
+      var message = {
+        type: "SET_CONFIG",
+        config: config
+      };
+      (_a = session.authServiceWorker) === null || _a === void 0 ? void 0 : _a.postMessage(message);
+    }
   }, {
     key: "getAccessTokenUrl",
     value: function getAccessTokenUrl(params) {
+      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId);
+    }
+  }, {
+    key: "getCdnUrl",
+    value: function getCdnUrl(params) {
       var _a;
-      var cdnUrl = BytescaleApiClientConfigUtils.getCdnUrl((_a = params.options) !== null && _a !== void 0 ? _a : {});
-      return "".concat(cdnUrl, "/api/v1/access_tokens/").concat(params.accountId);
+      return BytescaleApiClientConfigUtils.getCdnUrl((_a = params.options) !== null && _a !== void 0 ? _a : {});
     }
   }, {
     key: "deleteAccessToken",

package/dist/browser/esm/main.mjs

@@ -2357,6 +2357,11 @@ var ConsoleUtils = /*#__PURE__*/function () {
     ConsoleUtils_classCallCheck(this, ConsoleUtils);
   }
   ConsoleUtils_createClass(ConsoleUtils, null, [{
+    key: "debug",
+    value: function debug(message) {
+      console.log(ConsoleUtils.prefix(message));
+    }
+  }, {
     key: "warn",
     value: function warn(message) {
       console.warn(ConsoleUtils.prefix(message));
@@ -2465,22 +2470,25 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     value: function beginAuthSession(params) {
       try {
         var _this2 = this;
-        var newSession = {
-          accessToken: undefined,
-          accessTokenRefreshHandle: undefined,
-          params: params,
-          isActive: true
-        };
         return AuthManagerBrowser_await(_this2.authSessionMutex.safe(AuthManagerBrowser_async(function () {
           // We check both 'session' and 'sessionDisposing' here, as we don't want to call 'beginAuthSession' until the session is fully disposed.
           if (_this2.isAuthSessionActive()) {
             throw new Error("Auth session already active. Please call 'await endAuthSession()' and then call 'await beginAuthSession(...)' to start a new auth session.");
           }
-          AuthSessionState.setSession(newSession);
-          return AuthManagerBrowser_await();
-        })), function () {
+          return AuthManagerBrowser_await(_this2.registerAuthServiceWorker(params), function (_this2$registerAuthSe) {
+            var newSession = {
+              accessToken: undefined,
+              accessTokenRefreshHandle: undefined,
+              params: params,
+              isActive: true,
+              authServiceWorker: _this2$registerAuthSe
+            };
+            AuthSessionState.setSession(newSession);
+            return newSession;
+          });
+        })), function (session) {
           // IMPORTANT: must be called outside the above, else re-entrant deadlock will occur.
-          return AuthManagerBrowser_awaitIgnored(_this2.refreshAccessToken(newSession));
+          return AuthManagerBrowser_awaitIgnored(_this2.refreshAccessToken(session));
         });
       } catch (e) {
         return Promise.reject(e);
@@ -2501,12 +2509,55 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (session.accessTokenRefreshHandle !== undefined) {
             clearTimeout(session.accessTokenRefreshHandle);
           }
-          return AuthManagerBrowser_awaitIgnored(_this4.deleteAccessToken(session.params));
+          return AuthManagerBrowser_await(_this4.deleteAccessToken(session.params), function () {
+            _this4.setServiceWorkerConfig(session, []); // Prevent service worker from authorizing subsequent requests.
+          });
         })));
       } catch (e) {
         return Promise.reject(e);
       }
     }
+    /**
+     * Idempotent.
+     *
+     * Only returns once the service worker has been activated.
+     *
+     * We don't need to unregister it: we just need to clear the config when auth ends.
+     */
+  }, {
+    key: "registerAuthServiceWorker",
+    value: function registerAuthServiceWorker(_ref) {
+      var serviceWorkerScript = _ref.serviceWorkerScript;
+      try {
+        if (serviceWorkerScript === undefined) {
+          return undefined;
+        }
+        return AuthManagerBrowser_catch(function () {
+          if ("serviceWorker" in navigator) {
+            return AuthManagerBrowser_await(navigator.serviceWorker.register(serviceWorkerScript), function (registration) {
+              return registration.active !== null ? registration.active : AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
+                registration.addEventListener("updatefound", function () {
+                  var newWorker = registration.installing;
+                  if (newWorker !== null) {
+                    newWorker.addEventListener("statechange", function () {
+                      if (newWorker.state === "activated") {
+                        resolve(newWorker);
+                      }
+                    });
+                  }
+                });
+              }));
+            }); // Occurs when: (service worker is already registered AND there's been no code changes) OR (service worker was not previously registered).
+          } else {
+            ConsoleUtils.warn("Service workers not supported by browser. Falling back to Bytescale CDN cookies for auth. These are third-party cookies, which some modern browsers block.");
+          }
+        }, function (e) {
+          throw new Error("Failed to install Bytescale Auth Service Worker (SW). ".concat(e.name, ": ").concat(e.message));
+        });
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "refreshAccessToken",
     value: function refreshAccessToken(session) {
@@ -2524,12 +2575,20 @@ var AuthManagerImpl = /*#__PURE__*/function () {
               return AuthManagerBrowser_await(session.params.authHeaders(), function (_session$params$authH) {
                 return AuthManagerBrowser_await(_getAccessToken.call(_this6, _session$params, _session$params$authH), function (jwt) {
                   return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt), function (setTokenResult) {
+                    _this6.setServiceWorkerConfig(session, [{
+                      headers: [{
+                        key: "Authorization-Token",
+                        value: jwt
+                      }],
+                      expires: Date.now() + setTokenResult.ttlSeconds * 1000,
+                      urlPrefix: "".concat(_this6.getCdnUrl(session.params), "/").concat(session.params.accountId, "/")
+                    }]);
                     var desiredTtl = setTokenResult.ttlSeconds - _this6.refreshBeforeExpirySeconds;
                     timeout = Math.max(desiredTtl, _this6.minJwtTtlSeconds);
                     if (desiredTtl !== timeout) {
                       ConsoleUtils.warn("JWT expiration is too short: waiting for ".concat(timeout, " seconds before refreshing."));
                     }
-                    // There's need to print a warning for this: it's OK to silently request the JWT before it expires. Also, this is 24 days in this case!
+                    // There's no need to print a warning for this: it's OK to silently request the JWT before it expires. Also, this is 24 days in this case!
                     timeout = Math.min(timeout, _this6.maxJwtTtlSeconds);
                     session.accessToken = setTokenResult.accessToken;
                   });
@@ -2539,7 +2598,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
               // Use 'warn' instead of 'error' since this happens frequently, i.e. user goes through a tunnel, and some customers report these errors to systems like Sentry, so we don't want to spam.
               ConsoleUtils.warn("Unable to refresh JWT access token: ".concat(e));
             });
-          }, function (_wasThrown, _result) {
+          }, function (_wasThrown, _result3) {
             session.accessTokenRefreshHandle = window.setTimeout(function () {
               _this6.refreshAccessToken(session).then(function () {},
               // Should not occur, as this method shouldn't throw errors.
@@ -2547,19 +2606,33 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                 return ConsoleUtils.error("Unexpected error when refreshing JWT access token: ".concat(e));
               });
             }, timeout * 1000);
-            return AuthManagerBrowser_rethrow(_wasThrown, _result);
+            return AuthManagerBrowser_rethrow(_wasThrown, _result3);
           }));
         })));
       } catch (e) {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "setServiceWorkerConfig",
+    value: function setServiceWorkerConfig(session, config) {
+      var _a;
+      var message = {
+        type: "SET_CONFIG",
+        config: config
+      };
+      (_a = session.authServiceWorker) === null || _a === void 0 ? void 0 : _a.postMessage(message);
+    }
   }, {
     key: "getAccessTokenUrl",
     value: function getAccessTokenUrl(params) {
+      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId);
+    }
+  }, {
+    key: "getCdnUrl",
+    value: function getCdnUrl(params) {
       var _a;
-      var cdnUrl = BytescaleApiClientConfigUtils.getCdnUrl((_a = params.options) !== null && _a !== void 0 ? _a : {});
-      return "".concat(cdnUrl, "/api/v1/access_tokens/").concat(params.accountId);
+      return BytescaleApiClientConfigUtils.getCdnUrl((_a = params.options) !== null && _a !== void 0 ? _a : {});
     }
   }, {
     key: "deleteAccessToken",

package/dist/types/private/ConsoleUtils.d.ts

@@ -1,4 +1,5 @@
 export declare class ConsoleUtils {
+    static debug(message: string): void;
     static warn(message: string): void;
     static error(message: string): void;
     private static prefix;

package/dist/types/private/dtos/AuthSwConfigDto.d.ts

@@ -0,0 +1,2 @@
+import { AuthSwConfigEntryDto } from "./AuthSwConfigEntryDto";
+export declare type AuthSwConfigDto = AuthSwConfigEntryDto[];

package/dist/types/private/dtos/AuthSwConfigEntryDto.d.ts

@@ -0,0 +1,6 @@
+import { AuthSwHeaderDto } from "./AuthSwHeaderDto";
+export interface AuthSwConfigEntryDto {
+    expires: number | undefined;
+    headers: AuthSwHeaderDto[];
+    urlPrefix: string;
+}

package/dist/types/private/dtos/AuthSwHeaderDto.d.ts

@@ -0,0 +1,4 @@
+export interface AuthSwHeaderDto {
+    key: string;
+    value: string;
+}

package/dist/types/private/dtos/AuthSwSetConfigDto.d.ts

@@ -0,0 +1,5 @@
+import { AuthSwConfigDto } from "./AuthSwConfigDto";
+export interface AuthSwSetConfigDto {
+    config: AuthSwConfigDto;
+    type: "SET_CONFIG";
+}

package/dist/types/private/model/AuthManagerInterface.d.ts

@@ -18,6 +18,48 @@ export interface BeginAuthSessionParams {
      * Optional configuration.
      */
     options?: Pick<BytescaleApiClientConfig, "fetchApi" | "cdnUrl">;
+    /**
+     * The Bytescale Auth Service Worker enables JWT-based auth for browsers that block third-party cookies.
+     *
+     * You must set this field if you need to support browsers that block third-party cookies (like Safari).
+     *
+     * This feature works by running a "service worker" in the background that adds "Authorization" and "Authorization-Token"
+     * request headers to HTTP requests made to the Bytescale CDN. This allows the Bytescale CDN to authorize requests
+     * to private files using JWTs issued by your application. Historically, these requests have been authorized using
+     * JWT cookies (i.e. JWTs sent to the Bytescale CDN via the "Cookies" header). However, modern browsers are starting
+     * to block these cookies, meaning "Authorization" request headers must be used instead. Authorization headers can
+     * only be added to requests originating from page elements like "<img>" elements through the use of service workers.
+     *
+     * Usage:
+     *
+     * 1. Create a JavaScript file that contains the following line:
+     *
+     *      importScripts("https://js.bytescale.com/auth-sw/v1");
+     *
+     * 2. Host this JavaScript file from your website:
+     *
+     *    2a. It MUST be under the ROOT directory of your website.
+     *        (e.g. "/bytescale-auth-sw.js")
+     *
+     *    2b. It MUST be on the SAME DOMAIN as your website.
+     *        (e.g. "www.example.com" and not "assets.example.com")
+     *
+     * 3. Specify the absolute path to your JavaScript file in the 'beginAuthSession' call.
+     *    (e.g. { ..., serviceWorkerScript: "/bytescale-auth-sw.js" })
+     *
+     * Examples:
+     *
+     * - CORRECT:   "/bytescale-auth-sw.js"
+     * - INCORRECT: "bytescale-auth-sw.js"
+     * - INCORRECT: "/scripts/bytescale-auth-sw.js"
+     * - INCORRECT: "https://example.com/bytescale-auth-sw.js"
+     *
+     * Why does the script need to be hosted on the website's domain, under the root directory?:
+     *
+     * Service workers can only interact with events raised by pages at the same level or below them, hence why your
+     * script must be hosted on your website's domain in the root directory.
+     */
+    serviceWorkerScript: string | undefined;
 }
 export interface AuthManagerInterface {
     /**

package/dist/types/private/model/AuthSession.d.ts

@@ -2,6 +2,7 @@ import { BeginAuthSessionParams } from "./AuthManagerInterface";
 export interface AuthSession {
     accessToken: string | undefined;
     accessTokenRefreshHandle: number | undefined;
+    authServiceWorker: ServiceWorker | undefined;
     isActive: boolean;
     params: BeginAuthSessionParams;
 }

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -12,8 +12,18 @@ declare class AuthManagerImpl implements AuthManagerInterface {
     isAuthSessionActive(): boolean;
     beginAuthSession(params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;
+    /**
+     * Idempotent.
+     *
+     * Only returns once the service worker has been activated.
+     *
+     * We don't need to unregister it: we just need to clear the config when auth ends.
+     */
+    private registerAuthServiceWorker;
     private refreshAccessToken;
+    private setServiceWorkerConfig;
     private getAccessTokenUrl;
+    private getCdnUrl;
     private deleteAccessToken;
     private setAccessToken;
     private getAccessToken;

package/dist/types/public/shared/generated/runtime.d.ts

@@ -24,11 +24,11 @@ export interface BytescaleApiClientConfig {
      */
     apiKey: string;
     /**
-     * The base URL of the Bytescale API.
+     * The base URL of the Bytescale API. (Excludes trailing "/".)
      */
     apiUrl?: string;
     /**
-     * The base URL of the Bytescale CDN.
+     * The base URL of the Bytescale CDN. (Excludes trailing "/".)
      */
     cdnUrl?: string;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.11.0",
+  "version": "3.12.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",
@@ -67,7 +67,9 @@
     "publish:executeIfReleaseCommit": "bash -c 'COMMIT=$(git log -1 --pretty=%B) && [ \"${COMMIT:0:8}\" != \"Release \" ] || npm run publish:execute'",
     "publish:execute": "npm run publish:cdn && npm publish && npm run publish:createGitHubRelease",
     "publish:createGitHubRelease": "gh release create v$(node -p \"require('./package.json').version\")",
-    "publish:cdn": "npm run prepack:cdn && aws s3 cp --recursive --content-type application/javascript dist/ s3://upload-js-releases/sdk/ && aws cloudfront create-invalidation --distribution-id E250290WAJ43YY --paths '/sdk/*'"
+    "publish:cdn": "npm run publish:cdn:sdk && npm run publish:cdn:authSw",
+    "publish:cdn:sdk": "npm run prepack:cdn && aws s3 cp --recursive --content-type text/javascript dist/ s3://upload-js-releases/sdk/ && aws cloudfront create-invalidation --distribution-id E250290WAJ43YY --paths '/sdk/*'",
+    "publish:cdn:authSw": "aws s3 cp --content-type text/javascript src/index.auth-sw.js s3://upload-js-releases/auth-sw/v1 && aws cloudfront create-invalidation --distribution-id E250290WAJ43YY --paths '/auth-sw/*'"
   },
   "husky": {
     "hooks": {