@bytescale/sdk 3.16.0 → 3.17.0

package/dist/browser/cjs/main.js

@@ -2597,7 +2597,12 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                 _session$params = session.params;
               return AuthManagerBrowser_await(session.params.authHeaders(), function (_session$params$authH) {
                 return AuthManagerBrowser_await(_getAccessToken.call(_this6, _session$params, _session$params$authH), function (jwt) {
-                  return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt), function (setTokenResult) {
+                  // We don't use cookie-based auth if the browser supports service worker-based auth, as using both will cause
+                  // confusion for us in the future (i.e. we may question "do we need to use both together? was there a reason?").
+                  // Also: if the user has omitted "allowedOrigins" from their JWT, then service worker-based auth is more secure
+                  // than cookie-based auth, which is another reason to prevent these cookies from being set unless required.
+                  var setCookie = !_this6.isUsingServiceWorker(session);
+                  return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt, setCookie), function (setTokenResult) {
                     _this6.setServiceWorkerConfig(session, [{
                       headers: [{
                         key: "Authorization",
@@ -2636,6 +2641,11 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "isUsingServiceWorker",
+    value: function isUsingServiceWorker(session) {
+      return session.authServiceWorker !== undefined;
+    }
   }, {
     key: "setServiceWorkerConfig",
     value: function setServiceWorkerConfig(session, config) {
@@ -2648,8 +2658,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "getAccessTokenUrl",
-    value: function getAccessTokenUrl(params) {
-      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId);
+    value: function getAccessTokenUrl(params, setCookie) {
+      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId, "?set-cookie=").concat(setCookie ? "true" : "false");
     }
   }, {
     key: "getCdnUrl",
@@ -2663,7 +2673,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
       try {
         var _this8 = this;
         var _a;
-        return AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this8.getAccessTokenUrl(params), {
+        return AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this8.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -2677,14 +2687,14 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "setAccessToken",
-    value: function setAccessToken(params, jwt) {
+    value: function setAccessToken(params, jwt, setCookie) {
       try {
         var _this10 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this10.getAccessTokenUrl(params), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this10.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
           headers: AuthManagerBrowser_defineProperty({}, _this10.contentType, _this10.contentTypeJson),

package/dist/browser/esm/main.mjs

@@ -2582,7 +2582,12 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                 _session$params = session.params;
               return AuthManagerBrowser_await(session.params.authHeaders(), function (_session$params$authH) {
                 return AuthManagerBrowser_await(_getAccessToken.call(_this6, _session$params, _session$params$authH), function (jwt) {
-                  return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt), function (setTokenResult) {
+                  // We don't use cookie-based auth if the browser supports service worker-based auth, as using both will cause
+                  // confusion for us in the future (i.e. we may question "do we need to use both together? was there a reason?").
+                  // Also: if the user has omitted "allowedOrigins" from their JWT, then service worker-based auth is more secure
+                  // than cookie-based auth, which is another reason to prevent these cookies from being set unless required.
+                  var setCookie = !_this6.isUsingServiceWorker(session);
+                  return AuthManagerBrowser_await(_this6.setAccessToken(session.params, jwt, setCookie), function (setTokenResult) {
                     _this6.setServiceWorkerConfig(session, [{
                       headers: [{
                         key: "Authorization",
@@ -2621,6 +2626,11 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "isUsingServiceWorker",
+    value: function isUsingServiceWorker(session) {
+      return session.authServiceWorker !== undefined;
+    }
   }, {
     key: "setServiceWorkerConfig",
     value: function setServiceWorkerConfig(session, config) {
@@ -2633,8 +2643,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "getAccessTokenUrl",
-    value: function getAccessTokenUrl(params) {
-      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId);
+    value: function getAccessTokenUrl(params, setCookie) {
+      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId, "?set-cookie=").concat(setCookie ? "true" : "false");
     }
   }, {
     key: "getCdnUrl",
@@ -2648,7 +2658,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
       try {
         var _this8 = this;
         var _a;
-        return AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this8.getAccessTokenUrl(params), {
+        return AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this8.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -2662,14 +2672,14 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "setAccessToken",
-    value: function setAccessToken(params, jwt) {
+    value: function setAccessToken(params, jwt, setCookie) {
       try {
         var _this10 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this10.getAccessTokenUrl(params), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this10.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
           headers: AuthManagerBrowser_defineProperty({}, _this10.contentType, _this10.contentTypeJson),

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -21,6 +21,7 @@ declare class AuthManagerImpl implements AuthManagerInterface {
      */
     private registerAuthServiceWorker;
     private refreshAccessToken;
+    private isUsingServiceWorker;
     private setServiceWorkerConfig;
     private getAccessTokenUrl;
     private getCdnUrl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.16.0",
+  "version": "3.17.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",