@bytescale/sdk 3.15.0 → 3.17.0

package/dist/browser/cjs/main.js

@@ -2597,7 +2597,12 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                 _session$params = session.params;
               return AuthManagerBrowser_await(session.params.authHeaders(), function (_session$params$authH) {
                 return AuthManagerBrowser_await(_getAccessToken.call(_this6, _session$params, _session$params$authH), function (jwt) {
-                  return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt), function (setTokenResult) {
+                  // We don't use cookie-based auth if the browser supports service worker-based auth, as using both will cause
+                  // confusion for us in the future (i.e. we may question "do we need to use both together? was there a reason?").
+                  // Also: if the user has omitted "allowedOrigins" from their JWT, then service worker-based auth is more secure
+                  // than cookie-based auth, which is another reason to prevent these cookies from being set unless required.
+                  var setCookie = !_this6.isUsingServiceWorker(session);
+                  return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt, setCookie), function (setTokenResult) {
                     _this6.setServiceWorkerConfig(session, [{
                       headers: [{
                         key: "Authorization",
@@ -2636,6 +2641,11 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "isUsingServiceWorker",
+    value: function isUsingServiceWorker(session) {
+      return session.authServiceWorker !== undefined;
+    }
   }, {
     key: "setServiceWorkerConfig",
     value: function setServiceWorkerConfig(session, config) {
@@ -2648,8 +2658,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "getAccessTokenUrl",
-    value: function getAccessTokenUrl(params) {
-      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId);
+    value: function getAccessTokenUrl(params, setCookie) {
+      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId, "?set-cookie=").concat(setCookie ? "true" : "false");
     }
   }, {
     key: "getCdnUrl",
@@ -2663,7 +2673,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
       try {
         var _this8 = this;
         var _a;
-        return AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this8.getAccessTokenUrl(params), {
+        return AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this8.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -2677,14 +2687,14 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "setAccessToken",
-    value: function setAccessToken(params, jwt) {
+    value: function setAccessToken(params, jwt, setCookie) {
       try {
         var _this10 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this10.getAccessTokenUrl(params), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this10.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
           headers: AuthManagerBrowser_defineProperty({}, _this10.contentType, _this10.contentTypeJson),

package/dist/browser/esm/main.mjs

@@ -2582,7 +2582,12 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                 _session$params = session.params;
               return AuthManagerBrowser_await(session.params.authHeaders(), function (_session$params$authH) {
                 return AuthManagerBrowser_await(_getAccessToken.call(_this6, _session$params, _session$params$authH), function (jwt) {
-                  return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt), function (setTokenResult) {
+                  // We don't use cookie-based auth if the browser supports service worker-based auth, as using both will cause
+                  // confusion for us in the future (i.e. we may question "do we need to use both together? was there a reason?").
+                  // Also: if the user has omitted "allowedOrigins" from their JWT, then service worker-based auth is more secure
+                  // than cookie-based auth, which is another reason to prevent these cookies from being set unless required.
+                  var setCookie = !_this6.isUsingServiceWorker(session);
+                  return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt, setCookie), function (setTokenResult) {
                     _this6.setServiceWorkerConfig(session, [{
                       headers: [{
                         key: "Authorization",
@@ -2621,6 +2626,11 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "isUsingServiceWorker",
+    value: function isUsingServiceWorker(session) {
+      return session.authServiceWorker !== undefined;
+    }
   }, {
     key: "setServiceWorkerConfig",
     value: function setServiceWorkerConfig(session, config) {
@@ -2633,8 +2643,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "getAccessTokenUrl",
-    value: function getAccessTokenUrl(params) {
-      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId);
+    value: function getAccessTokenUrl(params, setCookie) {
+      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId, "?set-cookie=").concat(setCookie ? "true" : "false");
     }
   }, {
     key: "getCdnUrl",
@@ -2648,7 +2658,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
       try {
         var _this8 = this;
         var _a;
-        return AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this8.getAccessTokenUrl(params), {
+        return AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this8.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -2662,14 +2672,14 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "setAccessToken",
-    value: function setAccessToken(params, jwt) {
+    value: function setAccessToken(params, jwt, setCookie) {
       try {
         var _this10 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this10.getAccessTokenUrl(params), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this10.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
           headers: AuthManagerBrowser_defineProperty({}, _this10.contentType, _this10.contentTypeJson),

package/dist/types/private/model/AuthManagerInterface.d.ts

@@ -19,9 +19,11 @@ export interface BeginAuthSessionParams {
      */
     options?: Pick<BytescaleApiClientConfig, "fetchApi" | "cdnUrl">;
     /**
-     * The Bytescale Auth Service Worker enables JWT-based auth for browsers that block third-party cookies.
+     * Enables support for modern browsers that block third-party cookies (like Safari).
      *
-     * You must set this field if you need to support browsers that block third-party cookies (like Safari).
+     * The value of this field must be the path to the service worker JavaScript file hosted at the root of your website.
+     *
+     * OVERVIEW:
      *
      * This feature works by running a "service worker" in the background that adds "Authorization" and "Authorization-Token"
      * request headers to HTTP requests made to the Bytescale CDN. This allows the Bytescale CDN to authorize requests
@@ -30,21 +32,23 @@ export interface BeginAuthSessionParams {
      * to block these cookies, meaning "Authorization" request headers must be used instead. Authorization headers can
      * only be added to requests originating from page elements like "<img>" elements through the use of service workers.
      *
-     * Usage:
+     * INSTRUCTIONS:
+     *
+     * 1. Your JWT must include the 'accountId' field at the root of the 'payload' section of the JWT (i.e. next to the 'exp' field).
      *
-     * 1. Create a JavaScript file that contains the following line:
+     * 2. Create a JavaScript file that contains the following line:
      *
      *      importScripts("https://js.bytescale.com/auth-sw/v1");
      *
-     * 2. Host this JavaScript file from your website:
+     * 3. Host this JavaScript file from your website:
      *
-     *    2a. It MUST be under the ROOT directory of your website.
+     *    3a. It MUST be under the ROOT directory of your website.
      *        (e.g. "/bytescale-auth-sw.js")
      *
-     *    2b. It MUST be on the SAME DOMAIN as your website.
+     *    3b. It MUST be on the SAME DOMAIN as your website.
      *        (e.g. "www.example.com" and not "assets.example.com")
      *
-     * 3. Specify the absolute path to your JavaScript file in the 'beginAuthSession' call.
+     * 4. Specify the absolute path to your JavaScript file in the 'beginAuthSession' call.
      *    (e.g. { ..., serviceWorkerScript: "/bytescale-auth-sw.js" })
      *
      * Examples:

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -21,6 +21,7 @@ declare class AuthManagerImpl implements AuthManagerInterface {
      */
     private registerAuthServiceWorker;
     private refreshAccessToken;
+    private isUsingServiceWorker;
     private setServiceWorkerConfig;
     private getAccessTokenUrl;
     private getCdnUrl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.15.0",
+  "version": "3.17.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",