@bytescale/sdk 3.58.0 → 3.59.0

package/dist/worker/esm/main.mjs

@@ -210,6 +210,55 @@ var AuthSessionState = /*#__PURE__*/function () {
       }
       return window[AuthSessionState.stateKey];
     }
+    /** Resolves request-time auth while remaining compatible with the single-token session used by SDK 3.54.0. */
+  }, {
+    key: "resolveAuthConfig",
+    value: function resolveAuthConfig(authConfigId, requireReadyDefault) {
+      if (authConfigId === false) {
+        return undefined;
+      }
+      var session = AuthSessionState.getSession();
+      if (session === undefined || !session.isActive) {
+        if (typeof authConfigId === "string") {
+          throw new Error("No active AuthManager configuration has ID '".concat(authConfigId, "'."));
+        }
+        return undefined;
+      }
+      if (Array.isArray(session.authConfigs)) {
+        var state = session.authConfigs.find(function (config) {
+          return config.config.authConfigId === authConfigId;
+        });
+        if (state === undefined) {
+          if (typeof authConfigId === "string") {
+            throw new Error("No active AuthManager configuration has ID '".concat(authConfigId, "'."));
+          }
+          return undefined;
+        }
+        if (state.accessToken === undefined || state.expiresAt === undefined || state.expiresAt <= Date.now() || state.jwt === undefined) {
+          var isV2Session = typeof session.params.authConfigs === "function";
+          if (typeof authConfigId === "string" || requireReadyDefault || isV2Session) {
+            throw new Error("AuthManager configuration '".concat(authConfigId !== null && authConfigId !== void 0 ? authConfigId : "default", "' is not ready."));
+          }
+          return undefined;
+        }
+        return {
+          accessToken: state.accessToken,
+          accountId: state.config.accountId,
+          jwt: state.jwt
+        };
+      }
+      if (typeof authConfigId === "string") {
+        throw new Error("No active AuthManager configuration has ID '".concat(authConfigId, "'."));
+      }
+      if (session.accessToken === undefined || typeof session.params.accountId !== "string") {
+        return undefined;
+      }
+      return {
+        accessToken: session.accessToken,
+        accountId: session.params.accountId,
+        jwt: undefined
+      };
+    }
   }]);
 }();
 AuthSessionState.stateKey = "BytescaleSessionState";
@@ -353,12 +402,47 @@ var BytescaleApiClientConfigUtils = /*#__PURE__*/function () {
   }, {
     key: "getAccountId",
     value: function getAccountId(config) {
+      return BytescaleApiClientConfigUtils.resolveAuthentication(config).accountId;
+    }
+  }, {
+    key: "resolveAuthentication",
+    value: function resolveAuthentication(config) {
+      var _a, _b;
+      var apiKey = (_a = config.apiKey) !== null && _a !== void 0 ? _a : undefined;
+      var authConfig = AuthSessionState.resolveAuthConfig(config.authConfigId, apiKey === undefined);
+      var apiKeyAccountId = apiKey === undefined ? undefined : BytescaleApiClientConfigUtils.getApiKeyAccountId(apiKey);
+      if (apiKeyAccountId !== undefined && authConfig !== undefined && apiKeyAccountId !== authConfig.accountId) {
+        throw new Error("The API key belongs to account '".concat(apiKeyAccountId, "', but AuthManager configuration '").concat((_b = config.authConfigId) !== null && _b !== void 0 ? _b : "default", "' belongs to account '").concat(authConfig.accountId, "'."));
+      }
+      if (apiKey !== undefined) {
+        return {
+          accountId: apiKeyAccountId,
+          headers: Object.assign({
+            Authorization: "Bearer ".concat(apiKey)
+          }, authConfig === undefined ? {} : {
+            "Authorization-Token": authConfig.accessToken
+          })
+        };
+      }
+      if ((authConfig === null || authConfig === void 0 ? void 0 : authConfig.jwt) !== undefined) {
+        return {
+          accountId: authConfig.accountId,
+          headers: {
+            Authorization: "Bearer ".concat(authConfig.jwt)
+          }
+        };
+      }
+      throw new Error("Please provide an API key via the 'apiKey' config parameter.");
+    }
+  }, {
+    key: "getApiKeyAccountId",
+    value: function getApiKeyAccountId(apiKey) {
       var _a, _b;
       var accountId;
-      if (BytescaleApiClientConfigUtils.specialApiKeys.includes(config.apiKey)) {
+      if (BytescaleApiClientConfigUtils.specialApiKeys.includes(apiKey)) {
         accountId = BytescaleApiClientConfigUtils.specialApiKeyAccountId;
       } else {
-        accountId = (_b = (_a = config.apiKey.split("_")[1]) === null || _a === void 0 ? void 0 : _a.substr(0, BytescaleApiClientConfigUtils.accountIdLength)) !== null && _b !== void 0 ? _b : "";
+        accountId = (_b = (_a = apiKey.split("_")[1]) === null || _a === void 0 ? void 0 : _a.substr(0, BytescaleApiClientConfigUtils.accountIdLength)) !== null && _b !== void 0 ? _b : "";
         if (accountId.length !== BytescaleApiClientConfigUtils.accountIdLength) {
           throw new Error("Invalid Bytescale API key.");
         }
@@ -368,21 +452,24 @@ var BytescaleApiClientConfigUtils = /*#__PURE__*/function () {
   }, {
     key: "validate",
     value: function validate(config) {
-      var _a;
       // Defensive programming, for users not using TypeScript. Mainly because this is used by UploadWidget users.
       if ((config !== null && config !== void 0 ? config : undefined) === undefined) {
         throw new Error("Config parameter required.");
       }
-      if (((_a = config.apiKey) !== null && _a !== void 0 ? _a : undefined) === undefined) {
-        throw new Error("Please provide an API key via the 'apiKey' config parameter.");
+      if (config.authConfigId !== undefined && config.authConfigId !== false && typeof config.authConfigId !== "string") {
+        throw new Error("The 'authConfigId' config parameter must be a string, false, or undefined.");
       }
-      if (config.apiKey.trim() !== config.apiKey) {
+      if (config.apiKey !== undefined && typeof config.apiKey !== "string") {
+        throw new Error("The 'apiKey' config parameter must be a string when provided.");
+      }
+      if (config.apiKey !== undefined && config.apiKey.trim() !== config.apiKey) {
         // We do not support API keys with whitespace (by trimming ourselves) because otherwise we'd need to support this
         // everywhere in perpetuity (since removing the trimming would be a breaking change).
         throw new Error("API key needs trimming (whitespace detected).");
       }
-      // This performs futher validation on the API key...
-      BytescaleApiClientConfigUtils.getAccountId(config);
+      if (config.apiKey !== undefined) {
+        BytescaleApiClientConfigUtils.getApiKeyAccountId(config.apiKey);
+      }
     }
   }]);
 }();
@@ -409,12 +496,7 @@ var BaseAPI = /*#__PURE__*/function () {
       try {
         var _this = this;
         var _a;
-        var apiKey = _this.config.apiKey;
-        context.headers["Authorization"] = "Bearer ".concat(apiKey); // authorization-header authentication
-        var session = AuthSessionState.getSession();
-        if ((session === null || session === void 0 ? void 0 : session.accessToken) !== undefined) {
-          context.headers["Authorization-Token"] = session.accessToken;
-        }
+        Object.assign(context.headers, BytescaleApiClientConfigUtils.resolveAuthentication(_this.config).headers);
         // Key: any possible value for 'baseUrlOverride'
         // Value: user-overridden value for that base URL from the config.
         var nonDefaultBasePaths = _defineProperty({}, BytescaleApiClientConfigUtils.defaultCdnUrl, BytescaleApiClientConfigUtils.getCdnUrl(_this.config));
@@ -454,9 +536,21 @@ var BaseAPI = /*#__PURE__*/function () {
           url += "?" + querystring(context.query);
         }
         var configHeaders = _this2.config.headers;
-        var _Object$assign = Object.assign({}, context.headers);
-        return runtime_await(runtime_await(configHeaders === undefined ? {} : typeof configHeaders === "function" ? configHeaders() : configHeaders, function (_configHeaders) {
-          var headers = Object.assign(_Object$assign, configHeaders === undefined ? _configHeaders : _configHeaders);
+        return runtime_await(runtime_await(configHeaders === undefined ? {} : typeof configHeaders === "function" ? configHeaders() : configHeaders, function (resolvedConfigHeaders) {
+          for (var _i = 0, _Object$keys = Object.keys(resolvedConfigHeaders); _i < _Object$keys.length; _i++) {
+            var key = _Object$keys[_i];
+            if (key.toLowerCase() === "authorization" || key.toLowerCase() === "authorization-token") {
+              for (var _i2 = 0, _Object$keys2 = Object.keys(context.headers); _i2 < _Object$keys2.length; _i2++) {
+                var generatedKey = _Object$keys2[_i2];
+                if (generatedKey.toLowerCase() === key.toLowerCase()) {
+                  // Custom auth headers have documented precedence; remove the generated spelling to make that deterministic.
+                  // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+                  delete context.headers[generatedKey];
+                }
+              }
+            }
+          }
+          var headers = Object.assign(Object.assign({}, context.headers), resolvedConfigHeaders);
           Object.keys(headers).forEach(function (key) {
             return headers[key] === undefined ? delete headers[key] : {};
           });
@@ -468,12 +562,12 @@ var BaseAPI = /*#__PURE__*/function () {
             headers: headers,
             body: context.body
           };
-          var _Object$assign2 = Object.assign({}, initParams);
+          var _Object$assign = Object.assign({}, initParams);
           return runtime_await(initOverrideFn({
             init: initParams,
             context: context
           }), function (_initOverrideFn) {
-            var overriddenInit = Object.assign(_Object$assign2, _initOverrideFn);
+            var overriddenInit = Object.assign(_Object$assign, _initOverrideFn);
             var init = Object.assign(Object.assign({}, overriddenInit), {
               body: JSON.stringify(overriddenInit.body)
             });
@@ -2098,7 +2192,6 @@ var UploadManagerBase = /*#__PURE__*/function () {
     this.defaultMaxConcurrentUploadParts = 4;
     this.intervalMs = 500;
     this.uploadApi = new UploadApi(config);
-    this.accountId = BytescaleApiClientConfigUtils.getAccountId(config);
   }
   return UploadManagerBase_createClass(UploadManagerBase, [{
     key: "upload",
@@ -2106,6 +2199,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
       try {
         var _this = this;
         _this.assertNotCancelled(request);
+        var accountId = BytescaleApiClientConfigUtils.getAccountId(_this.config);
         var source = _this.processUploadSource(request.data);
         var preUploadInfo = _this.getPreUploadInfo(request, source);
         var bytesTotal = preUploadInfo.size;
@@ -2115,7 +2209,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
         if (request.onProgress !== undefined) {
           request.onProgress(_this.makeProgressEvent(0, bytesTotal));
         }
-        return UploadManagerBase_await(_this.beginUpload(request, preUploadInfo), function (uploadInfo) {
+        return UploadManagerBase_await(_this.beginUpload(request, preUploadInfo, accountId), function (uploadInfo) {
           var partCount = uploadInfo.uploadParts.count;
           var parts = UploadManagerBase_toConsumableArray(Array(partCount).keys());
           var _this$makeCancellatio = _this.makeCancellationMethods(),
@@ -2125,7 +2219,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
           var uploadedParts;
           return UploadManagerBase_continue(UploadManagerBase_finallyRethrows(function () {
             return UploadManagerBase_await(_this.mapAsync(parts, preUploadInfo.maxConcurrentUploadParts, _async(function (part) {
-              return _this.uploadPart(request, source, part, uploadInfo, makeOnProgressForPart(), addCancellationHandler);
+              return _this.uploadPart(request, source, part, uploadInfo, makeOnProgressForPart(), addCancellationHandler, accountId);
             })), function (_this$mapAsync) {
               uploadedParts = _this$mapAsync;
               return UploadManagerBase_awaitIgnored(_this.postUpload(init));
@@ -2237,14 +2331,14 @@ var UploadManagerBase = /*#__PURE__*/function () {
     }
   }, {
     key: "beginUpload",
-    value: function beginUpload(request, _ref2) {
+    value: function beginUpload(request, _ref2, accountId) {
       var size = _ref2.size,
         mime = _ref2.mime,
         originalFileName = _ref2.originalFileName;
       try {
         var _this4 = this;
         return UploadManagerBase_await(_this4.uploadApi.beginMultipartUpload({
-          accountId: _this4.accountId,
+          accountId: accountId,
           beginMultipartUploadRequest: {
             metadata: request.metadata,
             mime: mime,
@@ -2261,16 +2355,16 @@ var UploadManagerBase = /*#__PURE__*/function () {
     }
   }, {
     key: "uploadPart",
-    value: function uploadPart(request, source, partIndex, uploadInfo, onProgress, addCancellationHandler) {
+    value: function uploadPart(request, source, partIndex, uploadInfo, onProgress, addCancellationHandler, accountId) {
       try {
         var _this5 = this;
         _this5.assertNotCancelled(request);
-        return UploadManagerBase_await(_this5.getUploadPart(partIndex, uploadInfo), function (part) {
+        return UploadManagerBase_await(_this5.getUploadPart(partIndex, uploadInfo, accountId), function (part) {
           _this5.assertNotCancelled(request);
           return UploadManagerBase_await(_this5.putUploadPart(part, source, onProgress, addCancellationHandler), function (etag) {
             _this5.assertNotCancelled(request);
             return UploadManagerBase_await(_this5.uploadApi.completeUploadPart({
-              accountId: _this5.accountId,
+              accountId: accountId,
               uploadId: uploadInfo.uploadId,
               uploadPartIndex: partIndex,
               completeUploadPartRequest: {
@@ -2311,7 +2405,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
     }
   }, {
     key: "getUploadPart",
-    value: function getUploadPart(partIndex, uploadInfo) {
+    value: function getUploadPart(partIndex, uploadInfo, accountId) {
       try {
         var _this7 = this;
         if (partIndex === 0) {
@@ -2319,7 +2413,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
         }
         return UploadManagerBase_await(_this7.uploadApi.getUploadPart({
           uploadId: uploadInfo.uploadId,
-          accountId: _this7.accountId,
+          accountId: accountId,
           uploadPartIndex: partIndex
         }));
       } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.58.0",
+  "version": "3.59.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",

package/tests/ApiClientAuth.test.ts

@@ -0,0 +1,222 @@
+import { jest } from "@jest/globals";
+import { Headers as NodeFetchHeaders, Response as NodeFetchResponse } from "node-fetch";
+import { AuthSessionState } from "../src/private/AuthSessionState";
+import { AuthSession, AuthSessionConfigState } from "../src/private/model/AuthSession";
+import { BaseAPI, BytescaleApiClientConfig, FetchAPI, RequestOpts } from "../src/public/shared/generated/runtime";
+import { BeginAuthSessionParams } from "../src/private/model/BeginAuthSessionParams";
+import { AuthSessionConfig } from "../src/private/model/AuthSessionConfig";
+
+const accountA = "A123abc";
+const accountB = "B123abc";
+const apiKeyA = `public_${accountA}_test`;
+
+class TestApi extends BaseAPI {
+  async get(): Promise<Response> {
+    const request: RequestOpts = { headers: {}, method: "GET", path: "/test" };
+    return await this.request(request, undefined, undefined);
+  }
+}
+
+describe("API-client AuthManager configuration", () => {
+  const originalWindow = Object.getOwnPropertyDescriptor(globalThis, "window");
+
+  beforeAll(() => {
+    Object.defineProperty(globalThis, "window", { configurable: true, value: {} });
+  });
+
+  afterEach(() => {
+    AuthSessionState.setSession(undefined);
+  });
+
+  afterAll(() => {
+    if (originalWindow === undefined) {
+      Reflect.deleteProperty(globalThis, "window");
+    } else {
+      Object.defineProperty(globalThis, "window", originalWindow);
+    }
+  });
+
+  test("retains API-key-only authentication when no default AuthManager config exists", async () => {
+    setModernSession([state("named", accountA, "jwt-a", "access-a")]);
+    const { api, fetchApi } = createApi({ apiKey: apiKeyA });
+
+    await api.get();
+
+    expect(requestHeaders(fetchApi).get("Authorization")).toBe(`Bearer ${apiKeyA}`);
+    expect(requestHeaders(fetchApi).has("Authorization-Token")).toBe(false);
+  });
+
+  test("supplements an API key with the selected registered access token on every request", async () => {
+    const defaultState = state(undefined, accountA, "jwt-a", "access-a");
+    setModernSession([defaultState]);
+    const { api, fetchApi } = createApi({ apiKey: apiKeyA });
+
+    await api.get();
+    defaultState.accessToken = "access-refreshed";
+    await api.get();
+
+    expect(requestHeaders(fetchApi, 0).get("Authorization")).toBe(`Bearer ${apiKeyA}`);
+    expect(requestHeaders(fetchApi, 0).get("Authorization-Token")).toBe("access-a");
+    expect(requestHeaders(fetchApi, 1).get("Authorization-Token")).toBe("access-refreshed");
+  });
+
+  test("uses the raw JWT as sole authentication for an API-key-less named client", async () => {
+    setModernSession([state("customer", accountB, "jwt-b", "access-b")]);
+    const { api, fetchApi } = createApi({ authConfigId: "customer" });
+
+    await api.get();
+
+    expect(requestHeaders(fetchApi).get("Authorization")).toBe("Bearer jwt-b");
+    expect(requestHeaders(fetchApi).has("Authorization-Token")).toBe(false);
+  });
+
+  test("supports an API-key-less default client", async () => {
+    setModernSession([state(undefined, accountA, "jwt-a", "access-a")]);
+    const { api, fetchApi } = createApi({});
+
+    await api.get();
+
+    expect(requestHeaders(fetchApi).get("Authorization")).toBe("Bearer jwt-a");
+  });
+
+  test("fails clearly for opt-out without an API key and for an unknown named config", async () => {
+    setModernSession([state(undefined, accountA, "jwt-a", "access-a")]);
+
+    await expect(createApi({ authConfigId: false }).api.get()).rejects.toThrow("provide an API key");
+    await expect(createApi({ apiKey: apiKeyA, authConfigId: "missing" }).api.get()).rejects.toThrow(
+      "No active AuthManager configuration has ID 'missing'"
+    );
+  });
+
+  test("fails before fetch when API-key and AuthManager accounts differ", async () => {
+    setModernSession([state(undefined, accountB, "jwt-b", "access-b")]);
+    const { api, fetchApi } = createApi({ apiKey: apiKeyA });
+
+    await expect(api.get()).rejects.toThrow("belongs to account");
+    expect(fetchApi).not.toHaveBeenCalled();
+  });
+
+  test("allows construction before an API-key-less AuthManager config becomes available", async () => {
+    const { api, fetchApi } = createApi({ authConfigId: "later" });
+    await expect(api.get()).rejects.toThrow("No active AuthManager configuration");
+
+    setModernSession([state("later", accountA, "jwt-a", "access-a")]);
+    await api.get();
+
+    expect(requestHeaders(fetchApi).get("Authorization")).toBe("Bearer jwt-a");
+  });
+
+  test("fails closed for an expired selected configuration", async () => {
+    const expired = state("expired", accountA, "jwt-a", "access-a");
+    expired.expiresAt = Date.now() - 1;
+    setModernSession([expired]);
+
+    await expect(createApi({ apiKey: apiKeyA, authConfigId: "expired" }).api.get()).rejects.toThrow("not ready");
+    await expect(createApi({ authConfigId: "expired" }).api.get()).rejects.toThrow("not ready");
+  });
+
+  test("fails closed for an expired V2 default unless AuthManager is explicitly disabled", async () => {
+    const expired = state(undefined, accountA, "jwt-a", "access-a");
+    expired.expiresAt = Date.now() - 1;
+    setModernSession([expired]);
+
+    await expect(createApi({ apiKey: apiKeyA }).api.get()).rejects.toThrow("not ready");
+    const optedOut = createApi({ apiKey: apiKeyA, authConfigId: false });
+    await optedOut.api.get();
+    expect(requestHeaders(optedOut.fetchApi).get("Authorization")).toBe(`Bearer ${apiKeyA}`);
+  });
+
+  test("recognizes a 3.54 session as the default supplemental token", async () => {
+    AuthSessionState.setSession({
+      accessToken: "legacy-access",
+      accessTokenRefreshHandle: undefined,
+      authServiceWorker: undefined,
+      isActive: true,
+      params: {
+        accountId: accountA,
+        authHeaders: async (): Promise<Record<string, string>> => ({}),
+        authUrl: "https://app.example.com/auth"
+      }
+    });
+    const withKey = createApi({ apiKey: apiKeyA });
+
+    await withKey.api.get();
+
+    expect(requestHeaders(withKey.fetchApi).get("Authorization-Token")).toBe("legacy-access");
+    await expect(createApi({}).api.get()).rejects.toThrow("provide an API key");
+  });
+
+  test("retains deterministic custom authentication-header precedence", async () => {
+    setModernSession([state(undefined, accountA, "jwt-a", "access-a")]);
+    const { api, fetchApi } = createApi({
+      apiKey: apiKeyA,
+      headers: async (): Promise<Record<string, string>> => ({
+        "authorization": "Custom authorization",
+        "AUTHORIZATION-TOKEN": "custom-token"
+      })
+    });
+
+    await api.get();
+
+    const headers = requestHeaders(fetchApi);
+    expect(headers.get("Authorization")).toBe("Custom authorization");
+    expect(headers.get("Authorization-Token")).toBe("custom-token");
+    expect(headers.has("authConfigId")).toBe(false);
+  });
+});
+
+function createApi(config: Omit<BytescaleApiClientConfig, "fetchApi">): {
+  api: TestApi;
+  fetchApi: jest.MockedFunction<FetchAPI>;
+} {
+  const fetchApi = jest.fn<FetchAPI>(async () => new NodeFetchResponse("{}") as unknown as Response);
+  return { api: new TestApi({ ...config, fetchApi }), fetchApi };
+}
+
+function requestHeaders(
+  fetchApi: jest.MockedFunction<FetchAPI>,
+  call = fetchApi.mock.calls.length - 1
+): NodeFetchHeaders {
+  return new NodeFetchHeaders(fetchApi.mock.calls[call][1]?.headers as Record<string, string>);
+}
+
+function state(
+  authConfigId: string | undefined,
+  accountId: string,
+  jwt: string,
+  accessToken: string
+): AuthSessionConfigState {
+  const config: AuthSessionConfig = {
+    accountId,
+    authConfigId,
+    enableServiceWorkerAuth: false,
+    getAuthorizationToken: async () => jwt
+  };
+  return {
+    accessToken,
+    config,
+    expiresAt: Date.now() + 60_000,
+    jwt,
+    refreshHandle: undefined
+  };
+}
+
+function setModernSession(states: AuthSessionConfigState[]): void {
+  const configs = states.map(value => value.config);
+  const nonEmptyConfigs: [AuthSessionConfig, ...AuthSessionConfig[]] = [configs[0], ...configs.slice(1)];
+  const params: BeginAuthSessionParams = {
+    authConfigs: async () => nonEmptyConfigs,
+    serviceWorkerScript: undefined
+  };
+  const session: AuthSession = {
+    accessToken: undefined,
+    accessTokenRefreshHandle: undefined,
+    authConfigs: states,
+    authServiceWorker: undefined,
+    isActive: true,
+    isReady: true,
+    params,
+    serviceWorkerConfigured: false
+  };
+  AuthSessionState.setSession(session);
+}