@bytescale/sdk 3.57.0 → 3.58.0

package/dist/browser/cjs/main.js

@@ -3513,9 +3513,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
               }))) {
                 throw new Error("The 'sourceUrlPrefixes' field returned by 'serviceWorkerConfig' must be an array of strings.");
               }
+              if (result.urlRewriteRules !== undefined && (!Array.isArray(result.urlRewriteRules) || !result.urlRewriteRules.every(function (rule) {
+                return rule !== null && AuthManagerBrowser_typeof(rule) === "object" && typeof rule.fromUrlPrefix === "string" && typeof rule.toUrlPrefix === "string";
+              }))) {
+                throw new Error("The 'urlRewriteRules' field returned by 'serviceWorkerConfig' must be an array of URL rewrite rules.");
+              }
               var config = {
                 additionalConfig: result.additionalConfig,
-                sourceUrlPrefixes: result.sourceUrlPrefixes
+                sourceUrlPrefixes: result.sourceUrlPrefixes,
+                urlRewriteRules: result.urlRewriteRules
               };
               return AuthManagerBrowser_invoke(function () {
                 if (session.primaryAuthSwConfig !== undefined) {
@@ -3555,7 +3561,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         var _a;
         return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this5.sendServiceWorkerConfig(session, [Object.assign(Object.assign({}, primaryConfig), {
           sourceUrlPrefixes: serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.sourceUrlPrefixes
-        })].concat(AuthManagerBrowser_toConsumableArray((_a = serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.additionalConfig) !== null && _a !== void 0 ? _a : [])))));
+        })].concat(AuthManagerBrowser_toConsumableArray((_a = serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.additionalConfig) !== null && _a !== void 0 ? _a : [])), serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.urlRewriteRules)));
       } catch (e) {
         return Promise.reject(e);
       }
@@ -3582,20 +3588,22 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "sendServiceWorkerConfig",
-    value: function sendServiceWorkerConfig(session, config) {
+    value: function sendServiceWorkerConfig(session, config, urlRewriteRules) {
       try {
         var _this6 = this;
         if (session.authServiceWorker === undefined) {
           throw new Error("Service worker configuration cannot be applied because service workers are unavailable.");
         }
-        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage({
+        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage(Object.assign({
           type: "SET_BYTESCALE_AUTH_CONFIG",
           config: config.map(function (entry) {
             return Object.assign(Object.assign({}, entry), {
               urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this6.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
             });
           })
-        }, session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
+        }, urlRewriteRules === undefined ? {} : {
+          urlRewriteRules: urlRewriteRules
+        }), session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
           session.authServiceWorker = _this6$serviceWorkerU;
         });
       } catch (e) {

package/dist/browser/esm/main.mjs

@@ -3473,9 +3473,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
               }))) {
                 throw new Error("The 'sourceUrlPrefixes' field returned by 'serviceWorkerConfig' must be an array of strings.");
               }
+              if (result.urlRewriteRules !== undefined && (!Array.isArray(result.urlRewriteRules) || !result.urlRewriteRules.every(function (rule) {
+                return rule !== null && AuthManagerBrowser_typeof(rule) === "object" && typeof rule.fromUrlPrefix === "string" && typeof rule.toUrlPrefix === "string";
+              }))) {
+                throw new Error("The 'urlRewriteRules' field returned by 'serviceWorkerConfig' must be an array of URL rewrite rules.");
+              }
               var config = {
                 additionalConfig: result.additionalConfig,
-                sourceUrlPrefixes: result.sourceUrlPrefixes
+                sourceUrlPrefixes: result.sourceUrlPrefixes,
+                urlRewriteRules: result.urlRewriteRules
               };
               return AuthManagerBrowser_invoke(function () {
                 if (session.primaryAuthSwConfig !== undefined) {
@@ -3515,7 +3521,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         var _a;
         return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this5.sendServiceWorkerConfig(session, [Object.assign(Object.assign({}, primaryConfig), {
           sourceUrlPrefixes: serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.sourceUrlPrefixes
-        })].concat(AuthManagerBrowser_toConsumableArray((_a = serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.additionalConfig) !== null && _a !== void 0 ? _a : [])))));
+        })].concat(AuthManagerBrowser_toConsumableArray((_a = serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.additionalConfig) !== null && _a !== void 0 ? _a : [])), serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.urlRewriteRules)));
       } catch (e) {
         return Promise.reject(e);
       }
@@ -3542,20 +3548,22 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "sendServiceWorkerConfig",
-    value: function sendServiceWorkerConfig(session, config) {
+    value: function sendServiceWorkerConfig(session, config, urlRewriteRules) {
       try {
         var _this6 = this;
         if (session.authServiceWorker === undefined) {
           throw new Error("Service worker configuration cannot be applied because service workers are unavailable.");
         }
-        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage({
+        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage(Object.assign({
           type: "SET_BYTESCALE_AUTH_CONFIG",
           config: config.map(function (entry) {
             return Object.assign(Object.assign({}, entry), {
               urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this6.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
             });
           })
-        }, session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
+        }, urlRewriteRules === undefined ? {} : {
+          urlRewriteRules: urlRewriteRules
+        }), session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
           session.authServiceWorker = _this6$serviceWorkerU;
         });
       } catch (e) {

package/dist/types/private/dtos/AuthSwSetConfigDto.d.ts

@@ -1,4 +1,5 @@
 import { AuthSwConfigDto } from "./AuthSwConfigDto";
+import { UrlRewriteRule } from "../model/AuthManagerInterface";
 export interface AuthSwSetConfigDto {
     config: AuthSwConfigDto;
     /**
@@ -8,4 +9,5 @@ export interface AuthSwSetConfigDto {
      * with the user's events.
      */
     type: "SET_BYTESCALE_AUTH_CONFIG";
+    urlRewriteRules?: UrlRewriteRule[];
 }

package/dist/types/private/model/AuthManagerInterface.d.ts

@@ -1,5 +1,11 @@
 import { BytescaleApiClientConfig } from "../../public/shared";
 import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
+export interface UrlRewriteRule {
+    /** URL prefix to replace. This URL must be covered by the service worker's origin and scope. */
+    fromUrlPrefix: string;
+    /** Replacement URL prefix. The remainder of the original URL is appended unchanged. */
+    toUrlPrefix: string;
+}
 export interface AuthManagerServiceWorkerConfig {
     /**
      * Additional download-only service-worker authorization rules.
@@ -12,6 +18,11 @@ export interface AuthManagerServiceWorkerConfig {
      * History API changes do not update the matched client URL.
      */
     sourceUrlPrefixes?: string[];
+    /**
+     * Rewrites matching service-worker requests before applying authorization rules. The first matching rule wins and
+     * rewritten URLs are not processed recursively.
+     */
+    urlRewriteRules?: UrlRewriteRule[];
 }
 export interface BeginAuthSessionParams {
     /**
@@ -34,7 +45,8 @@ export interface BeginAuthSessionParams {
     options?: Pick<BytescaleApiClientConfig, "fetchApi" | "cdnUrl">;
     /**
      * Returns configuration for service-worker authorization. The primary JWT returned by `authUrl` is restricted using
-     * `sourceUrlPrefixes`; `additionalConfig` contains download-only rules and never authenticates SDK API operations.
+     * `sourceUrlPrefixes`; `additionalConfig` contains download-only rules and never authenticates SDK API operations;
+     * `urlRewriteRules` rewrites in-scope URLs before download authorization is evaluated.
      * Called when the session begins and again 20 seconds before the earliest additional entry expires. Entries without
      * an expiry do not trigger a refresh.
      *

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -3,7 +3,7 @@ import { AuthSwSetConfigDto } from "../../private/dtos/AuthSwSetConfigDto";
 import { ServiceWorkerUtils } from "../../private/ServiceWorkerUtils";
 export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
 export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
-export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
+export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams, UrlRewriteRule } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     private readonly serviceWorkerUtils;
     private readonly authSessionMutex;

package/dist/types/public/node/AuthManagerNode.d.ts

@@ -1,7 +1,7 @@
 import { AuthManagerInterface, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
 export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
-export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
+export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams, UrlRewriteRule } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     beginAuthSession(_params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.57.0",
+  "version": "3.58.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",

package/tests/AuthManagerBrowser.test.ts

@@ -4,7 +4,8 @@ import { AuthSessionState } from "../src/private/AuthSessionState";
 import type {
   AuthManagerServiceWorkerConfig,
   AuthSwConfigEntryDto,
-  BeginAuthSessionParams
+  BeginAuthSessionParams,
+  UrlRewriteRule
 } from "../src/index.browser";
 
 type FetchApi = NonNullable<NonNullable<BeginAuthSessionParams["options"]>["fetchApi"]>;
@@ -130,10 +131,17 @@ describe("AuthManager browser service-worker config", () => {
         urlPrefix: "https://upcdn.io/account-c/"
       }
     ];
+    const urlRewriteRules: UrlRewriteRule[] = [
+      {
+        fromUrlPrefix: "https://app.example.com/__authenticated-download/",
+        toUrlPrefix: "https://upcdn.io/account-b/"
+      }
+    ];
     const serviceWorkerConfig = jest.fn(
       async (): Promise<AuthManagerServiceWorkerConfig> => ({
         additionalConfig,
-        sourceUrlPrefixes: ["https://app.example.com/"]
+        sourceUrlPrefixes: ["https://app.example.com/"],
+        urlRewriteRules
       })
     );
 
@@ -159,7 +167,8 @@ describe("AuthManager browser service-worker config", () => {
         },
         additionalConfig[1]
       ],
-      type: "SET_BYTESCALE_AUTH_CONFIG"
+      type: "SET_BYTESCALE_AUTH_CONFIG",
+      urlRewriteRules
     });
     expect(additionalConfig[0].urlPrefix).toBe("https://upcdn.io/account-b/");
     expect(AuthSessionState.getSession()?.accessToken).toBe("access-a");
@@ -184,11 +193,23 @@ describe("AuthManager browser service-worker config", () => {
       .fn<() => Promise<AuthManagerServiceWorkerConfig>>()
       .mockResolvedValueOnce({
         additionalConfig: initialAdditionalConfig,
-        sourceUrlPrefixes: ["https://app.example.com/initial/"]
+        sourceUrlPrefixes: ["https://app.example.com/initial/"],
+        urlRewriteRules: [
+          {
+            fromUrlPrefix: "https://app.example.com/download/",
+            toUrlPrefix: "https://upcdn.io/account-b/"
+          }
+        ]
       })
       .mockResolvedValueOnce({
         additionalConfig: [],
-        sourceUrlPrefixes: ["https://app.example.com/refreshed/"]
+        sourceUrlPrefixes: ["https://app.example.com/refreshed/"],
+        urlRewriteRules: [
+          {
+            fromUrlPrefix: "https://app.example.com/download/",
+            toUrlPrefix: "https://upcdn.io/account-c/"
+          }
+        ]
       });
 
     await AuthManager.beginAuthSession({
@@ -208,7 +229,13 @@ describe("AuthManager browser service-worker config", () => {
           urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-a/"
         }
       ],
-      type: "SET_BYTESCALE_AUTH_CONFIG"
+      type: "SET_BYTESCALE_AUTH_CONFIG",
+      urlRewriteRules: [
+        {
+          fromUrlPrefix: "https://app.example.com/download/",
+          toUrlPrefix: "https://upcdn.io/account-c/"
+        }
+      ]
     });
     expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT"]);
     expect(AuthManager.isAuthSessionReady()).toBe(true);
@@ -225,7 +252,13 @@ describe("AuthManager browser service-worker config", () => {
     ];
     const serviceWorkerConfig = jest.fn(
       async (): Promise<AuthManagerServiceWorkerConfig> => ({
-        additionalConfig
+        additionalConfig,
+        urlRewriteRules: [
+          {
+            fromUrlPrefix: "https://app.example.com/download/",
+            toUrlPrefix: "https://upcdn.io/account-b/"
+          }
+        ]
       })
     );
 
@@ -254,8 +287,31 @@ describe("AuthManager browser service-worker config", () => {
         },
         additionalConfig[0]
       ],
-      type: "SET_BYTESCALE_AUTH_CONFIG"
+      type: "SET_BYTESCALE_AUTH_CONFIG",
+      urlRewriteRules: [
+        {
+          fromUrlPrefix: "https://app.example.com/download/",
+          toUrlPrefix: "https://upcdn.io/account-b/"
+        }
+      ]
+    });
+  });
+
+  test("rejects malformed URL rewrite rules", async () => {
+    jest.spyOn(console, "warn").mockImplementation(() => {});
+    const fetchApi = createPrimaryFetchApi();
+
+    await AuthManager.beginAuthSession({
+      ...createParams(fetchApi),
+      serviceWorkerConfig: async (): Promise<AuthManagerServiceWorkerConfig> => ({
+        additionalConfig: [],
+        urlRewriteRules: [{ fromUrlPrefix: "https://app.example.com/download/" }] as UrlRewriteRule[]
+      }),
+      serviceWorkerScript: "/bytescale-auth-sw.js"
     });
+
+    expect(postMessage).not.toHaveBeenCalled();
+    expect(AuthManager.isAuthSessionReady()).toBe(false);
   });
 
   test("fails closed until the initial service-worker config callback succeeds", async () => {

package/tests/AuthServiceWorkerRewrite.test.ts

@@ -0,0 +1,276 @@
+import { jest } from "@jest/globals";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { runInNewContext } from "node:vm";
+import { Headers as NodeFetchHeaders, Request as NodeFetchRequest, Response as NodeFetchResponse } from "node-fetch";
+import type { RequestInit as NodeFetchRequestInit } from "node-fetch";
+import type { AuthSwConfigEntryDto, UrlRewriteRule } from "../src/index.browser";
+
+const workerSource = readFileSync(resolve(process.cwd(), "src/index.auth-sw.js"), "utf8");
+
+describe("Auth service-worker URL rewriting", () => {
+  test("preserves the remaining path, query string, and fragment", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    const rules = [rewriteRule("download/", "account-a/")];
+    await harness.setConfig([], rules);
+
+    const result = await harness.dispatchFetch(
+      "https://dashboard.example.com/download/path/to/file.pdf?download=true&version=2"
+    );
+
+    expect(result.outboundRequest?.url).toBe("https://upcdn.io/account-a/path/to/file.pdf?download=true&version=2");
+    expect(harness.getRewrittenUrl("https://dashboard.example.com/download/file.pdf?download=true#page=2", rules)).toBe(
+      "https://upcdn.io/account-a/file.pdf?download=true#page=2"
+    );
+  });
+
+  test("matches authentication against the rewritten URL and supports navigation requests", async () => {
+    const upstreamResponse = new NodeFetchResponse("streamed-body", {
+      headers: {
+        "Accept-Ranges": "bytes",
+        "Content-Disposition": 'attachment; filename="file.pdf"',
+        "Content-Length": "13",
+        "Content-Range": "bytes 0-12/13",
+        "Content-Type": "application/pdf"
+      },
+      status: 206
+    });
+    const blob = jest.spyOn(upstreamResponse, "blob");
+    const arrayBuffer = jest.spyOn(upstreamResponse, "arrayBuffer");
+    const harness = new AuthServiceWorkerHarness(upstreamResponse);
+    await harness.setConfig([authConfig("account-a/", "token-a")], [rewriteRule("download/", "account-a/")]);
+
+    const result = await harness.dispatchFetch("https://dashboard.example.com/download/file.pdf", {
+      headers: {
+        "If-Modified-Since": "Wed, 21 Oct 2015 07:28:00 GMT",
+        "If-None-Match": '"etag"',
+        "If-Range": '"range-etag"',
+        "Range": "bytes=0-12"
+      },
+      navigation: true
+    });
+
+    expect(result.outboundRequest?.url).toBe("https://upcdn.io/account-a/file.pdf");
+    expect(result.outboundRequest?.mode).toBe("cors");
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+    expect(result.outboundRequest?.headers.get("Range")).toBe("bytes=0-12");
+    expect(result.outboundRequest?.headers.get("If-Range")).toBe('"range-etag"');
+    expect(result.outboundRequest?.headers.get("If-None-Match")).toBe('"etag"');
+    expect(result.outboundRequest?.headers.get("If-Modified-Since")).toBe("Wed, 21 Oct 2015 07:28:00 GMT");
+    expect(result.response).toBe(upstreamResponse);
+    expect(result.response?.status).toBe(206);
+    expect(result.response?.headers.get("Content-Disposition")).toBe('attachment; filename="file.pdf"');
+    expect(result.response?.headers.get("Accept-Ranges")).toBe("bytes");
+    expect(blob).not.toHaveBeenCalled();
+    expect(arrayBuffer).not.toHaveBeenCalled();
+  });
+
+  test("selects different authentication configurations for different rewrite destinations", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig(
+      [authConfig("account-a/", "token-a"), authConfig("account-b/", "token-b")],
+      [rewriteRule("download-a/", "account-a/"), rewriteRule("download-b/", "account-b/")]
+    );
+
+    const first = await harness.dispatchFetch("https://dashboard.example.com/download-a/file.pdf");
+    const second = await harness.dispatchFetch("https://dashboard.example.com/download-b/file.pdf");
+
+    expect(first.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+    expect(second.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-b");
+  });
+
+  test("never selects a token from the original URL", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig(
+      [authConfigForUrl("https://dashboard.example.com/download/", "original-token")],
+      [rewriteRule("download/", "unconfigured-account/")]
+    );
+
+    const result = await harness.dispatchFetch("https://dashboard.example.com/download/file.pdf");
+
+    expect(result.outboundRequest?.url).toBe("https://upcdn.io/unconfigured-account/file.pdf");
+    expect(result.outboundRequest?.headers.has("Authorization")).toBe(false);
+  });
+
+  test("fetches rewritten requests even when no authentication configuration matches", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig([], [rewriteRule("download/", "public-account/")]);
+
+    const result = await harness.dispatchFetch("https://dashboard.example.com/download/public.pdf");
+
+    expect(result.responded).toBe(true);
+    expect(result.outboundRequest?.url).toBe("https://upcdn.io/public-account/public.pdf");
+    expect(result.outboundRequest?.headers.has("Authorization")).toBe(false);
+  });
+
+  test("uses only the first matching rewrite rule", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig(
+      [authConfig("account-a/", "token-a"), authConfig("account-b/", "token-b")],
+      [rewriteRule("download/", "account-a/"), rewriteRule("download/", "account-b/")]
+    );
+
+    const result = await harness.dispatchFetch("https://dashboard.example.com/download/file.pdf");
+
+    expect(result.outboundRequest?.url).toBe("https://upcdn.io/account-a/file.pdf");
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+  });
+
+  test("does not recursively rewrite the rewritten URL", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig(
+      [authConfig("account-a/", "token-a")],
+      [
+        {
+          fromUrlPrefix: "https://dashboard.example.com/download/",
+          toUrlPrefix: "https://proxy.example.com/download/"
+        },
+        {
+          fromUrlPrefix: "https://proxy.example.com/download/",
+          toUrlPrefix: "https://upcdn.io/account-a/"
+        }
+      ]
+    );
+
+    const result = await harness.dispatchFetch("https://dashboard.example.com/download/file.pdf");
+
+    expect(result.outboundRequest?.url).toBe("https://proxy.example.com/download/file.pdf");
+    expect(result.outboundRequest?.headers.has("Authorization")).toBe(false);
+  });
+
+  test("retains existing behavior when no rewrite rule matches", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig([authConfig("account-a/", "token-a")], [rewriteRule("download/", "account-a/")]);
+
+    const authenticated = await harness.dispatchFetch("https://upcdn.io/account-a/file.pdf");
+    const untouched = await harness.dispatchFetch("https://dashboard.example.com/ordinary-page");
+
+    expect(authenticated.outboundRequest?.url).toBe("https://upcdn.io/account-a/file.pdf");
+    expect(authenticated.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+    expect(untouched.responded).toBe(false);
+  });
+});
+
+interface FetchOptions {
+  headers?: HeadersInit;
+  navigation?: boolean;
+}
+
+interface FetchResult {
+  outboundRequest: TestRequest | undefined;
+  responded: boolean;
+  response: NodeFetchResponse | undefined;
+}
+
+type WorkerEventListener = (event: unknown) => void;
+
+class AuthServiceWorkerHarness {
+  private readonly context: {
+    getRewrittenUrl: (url: string, rules: UrlRewriteRule[]) => string | undefined;
+    setConfig: (config: AuthSwConfigEntryDto[], rules?: UrlRewriteRule[]) => Promise<void>;
+  };
+
+  private readonly fetchListener: WorkerEventListener;
+  private readonly fetchMock: jest.MockedFunction<(request: TestRequest) => Promise<NodeFetchResponse>>;
+
+  constructor(private readonly upstreamResponse: NodeFetchResponse = new NodeFetchResponse("ok")) {
+    const listeners = new Map<string, WorkerEventListener>();
+    const cacheEntries = new Map<string, NodeFetchResponse>();
+    this.fetchMock = jest.fn(async (_request: TestRequest): Promise<NodeFetchResponse> => this.upstreamResponse);
+
+    const self = {
+      addEventListener: (type: string, listener: WorkerEventListener): void => {
+        listeners.set(type, listener);
+      },
+      clients: {
+        claim: async (): Promise<void> => {},
+        get: async (): Promise<undefined> => undefined
+      },
+      skipWaiting: async (): Promise<void> => {}
+    };
+    const cache = {
+      match: async (key: string): Promise<NodeFetchResponse | undefined> => cacheEntries.get(key)?.clone(),
+      put: async (key: string, value: NodeFetchResponse): Promise<void> => {
+        cacheEntries.set(key, value.clone());
+      }
+    };
+    const sandbox = {
+      caches: { open: async (): Promise<typeof cache> => cache },
+      console: { error: jest.fn(), log: jest.fn() },
+      fetch: this.fetchMock,
+      Headers: NodeFetchHeaders,
+      Promise,
+      Request: TestRequest,
+      Response: NodeFetchResponse,
+      self,
+      setTimeout
+    };
+    runInNewContext(workerSource, sandbox);
+
+    this.context = sandbox as typeof sandbox & AuthServiceWorkerHarness["context"];
+    const fetchListener = listeners.get("fetch");
+    if (fetchListener === undefined) {
+      throw new Error("Auth service worker did not register a fetch listener.");
+    }
+    this.fetchListener = fetchListener;
+  }
+
+  async setConfig(config: AuthSwConfigEntryDto[], rules?: UrlRewriteRule[]): Promise<void> {
+    await this.context.setConfig(config, rules);
+  }
+
+  getRewrittenUrl(url: string, rules: UrlRewriteRule[]): string | undefined {
+    return this.context.getRewrittenUrl(url, rules);
+  }
+
+  async dispatchFetch(url: string, options: FetchOptions = {}): Promise<FetchResult> {
+    const request = new TestRequest(url, { headers: options.headers as NodeFetchRequestInit["headers"] });
+    if (options.navigation === true) {
+      Object.defineProperty(request, "mode", { configurable: true, value: "navigate" });
+    }
+
+    let responsePromise: Promise<NodeFetchResponse> | undefined;
+    this.fetchListener({
+      clientId: "",
+      request,
+      respondWith: (response: NodeFetchResponse | Promise<NodeFetchResponse>): void => {
+        responsePromise = Promise.resolve(response);
+      }
+    });
+
+    const response = await responsePromise;
+    return {
+      outboundRequest: this.fetchMock.mock.calls.at(-1)?.[0],
+      responded: responsePromise !== undefined,
+      response
+    };
+  }
+}
+
+class TestRequest extends NodeFetchRequest {
+  readonly mode: RequestMode;
+
+  constructor(input: string | NodeFetchRequest, init: NodeFetchRequestInit & { mode?: RequestMode } = {}) {
+    super(input, init);
+    this.mode = init.mode ?? (input instanceof TestRequest ? input.mode : "cors");
+  }
+}
+
+function authConfig(accountPath: string, token: string): AuthSwConfigEntryDto {
+  return authConfigForUrl(`https://upcdn.io/${accountPath}`, token);
+}
+
+function authConfigForUrl(urlPrefix: string, token: string): AuthSwConfigEntryDto {
+  return {
+    expires: undefined,
+    headers: [{ key: "Authorization", value: `Bearer ${token}` }],
+    urlPrefix
+  };
+}
+
+function rewriteRule(fromPath: string, toPath: string): UrlRewriteRule {
+  return {
+    fromUrlPrefix: `https://dashboard.example.com/${fromPath}`,
+    toUrlPrefix: `https://upcdn.io/${toPath}`
+  };
+}