@bytescale/sdk 3.58.0 → 3.60.0

package/tests/AuthServiceWorkerRewrite.test.ts

@@ -149,9 +149,73 @@ describe("Auth service-worker URL rewriting", () => {
     expect(authenticated.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
     expect(untouched.responded).toBe(false);
   });
+
+  test("waits for delayed persistent authentication state on a cold start", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    harness.setPersistentConfig([authConfig("account-a/", "token-a")], 300);
+
+    const result = await harness.dispatchFetch("https://upcdn.io/account-a/file.pdf");
+
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+  });
+
+  test("keeps source-page authorization independent across multiple client IDs", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    harness.setWindowClient("client-a", "https://app.example.com/a/");
+    harness.setWindowClient("client-b", "https://app.example.com/b/");
+    await harness.setConfig([
+      {
+        ...authConfig("account-a/", "token-a"),
+        sourceUrlPrefixes: ["https://app.example.com/a/"],
+        urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-a/"
+      },
+      {
+        ...authConfig("account-b/", "token-b"),
+        sourceUrlPrefixes: ["https://app.example.com/b/"],
+        urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-b/"
+      }
+    ]);
+
+    const a = await harness.dispatchFetch("https://upcdn.io/account-a/file.pdf", { clientId: "client-a" });
+    const wrongSource = await harness.dispatchFetch("https://upcdn.io/account-a/file.pdf", {
+      clientId: "client-b"
+    });
+    const b = await harness.dispatchFetch("https://upcdn.io/account-b/file.pdf", { clientId: "client-b" });
+
+    expect(a.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+    expect(wrongSource.responded).toBe(true);
+    expect(wrongSource.outboundRequest?.headers.has("Authorization")).toBe(false);
+    expect(b.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-b");
+  });
+
+  test("source-scoped auth replaces both authentication headers and preserves unrelated headers", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    harness.setWindowClient("client-a", "https://app.example.com/a/");
+    await harness.setConfig([
+      {
+        ...authConfig("account-a/", "token-a"),
+        sourceUrlPrefixes: ["https://app.example.com/a/"],
+        urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-a/"
+      }
+    ]);
+
+    const result = await harness.dispatchFetch("https://upcdn.io/account-a/file.pdf", {
+      clientId: "client-a",
+      headers: {
+        "Authorization": "Bearer stale",
+        "Authorization-Token": "stale-token",
+        "X-Trace-Id": "trace"
+      }
+    });
+
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+    expect(result.outboundRequest?.headers.has("Authorization-Token")).toBe(false);
+    expect(result.outboundRequest?.headers.get("X-Trace-Id")).toBe("trace");
+  });
 });
 
 interface FetchOptions {
+  clientId?: string;
   headers?: HeadersInit;
   navigation?: boolean;
 }
@@ -165,6 +229,9 @@ interface FetchResult {
 type WorkerEventListener = (event: unknown) => void;
 
 class AuthServiceWorkerHarness {
+  private readonly clientsById = new Map<string, { type: "window"; url: string }>();
+  private readonly cacheEntries = new Map<string, NodeFetchResponse>();
+  private cacheReadDelayMilliseconds = 0;
   private readonly context: {
     getRewrittenUrl: (url: string, rules: UrlRewriteRule[]) => string | undefined;
     setConfig: (config: AuthSwConfigEntryDto[], rules?: UrlRewriteRule[]) => Promise<void>;
@@ -175,7 +242,6 @@ class AuthServiceWorkerHarness {
 
   constructor(private readonly upstreamResponse: NodeFetchResponse = new NodeFetchResponse("ok")) {
     const listeners = new Map<string, WorkerEventListener>();
-    const cacheEntries = new Map<string, NodeFetchResponse>();
     this.fetchMock = jest.fn(async (_request: TestRequest): Promise<NodeFetchResponse> => this.upstreamResponse);
 
     const self = {
@@ -184,14 +250,20 @@ class AuthServiceWorkerHarness {
       },
       clients: {
         claim: async (): Promise<void> => {},
-        get: async (): Promise<undefined> => undefined
+        get: async (clientId: string): Promise<{ type: "window"; url: string } | undefined> =>
+          this.clientsById.get(clientId)
       },
       skipWaiting: async (): Promise<void> => {}
     };
     const cache = {
-      match: async (key: string): Promise<NodeFetchResponse | undefined> => cacheEntries.get(key)?.clone(),
+      match: async (key: string): Promise<NodeFetchResponse | undefined> => {
+        if (this.cacheReadDelayMilliseconds > 0) {
+          await new Promise(resolve => setTimeout(resolve, this.cacheReadDelayMilliseconds));
+        }
+        return this.cacheEntries.get(key)?.clone();
+      },
       put: async (key: string, value: NodeFetchResponse): Promise<void> => {
-        cacheEntries.set(key, value.clone());
+        this.cacheEntries.set(key, value.clone());
       }
     };
     const sandbox = {
@@ -223,6 +295,15 @@ class AuthServiceWorkerHarness {
     return this.context.getRewrittenUrl(url, rules);
   }
 
+  setWindowClient(clientId: string, url: string): void {
+    this.clientsById.set(clientId, { type: "window", url });
+  }
+
+  setPersistentConfig(config: AuthSwConfigEntryDto[], cacheReadDelayMilliseconds: number): void {
+    this.cacheEntries.set("config", new NodeFetchResponse(JSON.stringify(config)));
+    this.cacheReadDelayMilliseconds = cacheReadDelayMilliseconds;
+  }
+
   async dispatchFetch(url: string, options: FetchOptions = {}): Promise<FetchResult> {
     const request = new TestRequest(url, { headers: options.headers as NodeFetchRequestInit["headers"] });
     if (options.navigation === true) {
@@ -231,7 +312,7 @@ class AuthServiceWorkerHarness {
 
     let responsePromise: Promise<NodeFetchResponse> | undefined;
     this.fetchListener({
-      clientId: "",
+      clientId: options.clientId ?? "",
       request,
       respondWith: (response: NodeFetchResponse | Promise<NodeFetchResponse>): void => {
         responsePromise = Promise.resolve(response);

package/tests/UploadManagerAuth.test.ts

@@ -0,0 +1,156 @@
+import { jest } from "@jest/globals";
+import { AuthSessionState } from "../src/private/AuthSessionState";
+import { UploadManagerBase } from "../src/private/UploadManagerBase";
+import { AddCancellationHandler } from "../src/private/model/AddCancellationHandler";
+import { AuthSessionConfigState } from "../src/private/model/AuthSession";
+import { OnPartProgress } from "../src/private/model/OnPartProgress";
+import { PreUploadInfo } from "../src/private/model/PreUploadInfo";
+import { PutUploadPartResult } from "../src/private/model/PutUploadPartResult";
+import { UploadManagerParams, UploadSource } from "../src/public/shared/CommonTypes";
+import {
+  BeginMultipartUploadResponse,
+  CompleteMultipartUploadResponse,
+  UploadPart
+} from "../src/public/shared/generated";
+
+const accountA = "A123abc";
+
+class TestUploadManager extends UploadManagerBase<string, undefined> {
+  protected processUploadSource(data: UploadSource): string {
+    return String(data);
+  }
+
+  protected getPreUploadInfoPartial(
+    _request: UploadManagerParams,
+    _source: string
+  ): Partial<PreUploadInfo> & { size: number } {
+    return { size: 1 };
+  }
+
+  protected preUpload(_source: string): undefined {
+    return undefined;
+  }
+
+  protected async postUpload(_init: undefined): Promise<void> {}
+
+  protected async doPutUploadPart(
+    _part: UploadPart,
+    _contentLength: number,
+    _source: string,
+    _onProgress: OnPartProgress,
+    _addCancellationHandler: AddCancellationHandler
+  ): Promise<PutUploadPartResult> {
+    return { etag: "etag", status: 200 };
+  }
+}
+
+describe("UploadManager AuthManager configuration", () => {
+  const originalWindow = Object.getOwnPropertyDescriptor(globalThis, "window");
+
+  beforeAll(() => {
+    Object.defineProperty(globalThis, "window", { configurable: true, value: {} });
+  });
+
+  afterEach(() => AuthSessionState.setSession(undefined));
+
+  afterAll(() => {
+    if (originalWindow === undefined) {
+      Reflect.deleteProperty(globalThis, "window");
+    } else {
+      Object.defineProperty(globalThis, "window", originalWindow);
+    }
+  });
+
+  test("allows keyless construction and resolves the selected account once upload begins", async () => {
+    const manager = new TestUploadManager({ authConfigId: "customer" });
+    await expect(manager.upload({ data: "x" })).rejects.toThrow("No active AuthManager configuration");
+
+    setSession(state("customer", accountA));
+    const uploadApi = installUploadApiMock(manager);
+    await manager.upload({ data: "x" });
+
+    expect(uploadApi.beginMultipartUpload).toHaveBeenCalledWith(expect.objectContaining({ accountId: accountA }));
+    expect(uploadApi.completeUploadPart).toHaveBeenCalledWith(expect.objectContaining({ accountId: accountA }));
+  });
+
+  test("fails before upload network work when keyless AuthManager auth is explicitly disabled", async () => {
+    const manager = new TestUploadManager({ authConfigId: false });
+    const uploadApi = installUploadApiMock(manager);
+
+    await expect(manager.upload({ data: "x" })).rejects.toThrow("provide an API key");
+    expect(uploadApi.beginMultipartUpload).not.toHaveBeenCalled();
+  });
+});
+
+interface UploadApiMock {
+  beginMultipartUpload: jest.MockedFunction<(request: { accountId: string }) => Promise<BeginMultipartUploadResponse>>;
+  completeUploadPart: jest.MockedFunction<(request: { accountId: string }) => Promise<CompleteMultipartUploadResponse>>;
+  getUploadPart: jest.MockedFunction<(request: { accountId: string }) => Promise<UploadPart>>;
+}
+
+function installUploadApiMock(manager: TestUploadManager): UploadApiMock {
+  const firstPart: UploadPart = {
+    range: { inclusiveEnd: 0, inclusiveStart: 0 },
+    uploadId: "upload-id",
+    uploadPartIndex: 0,
+    uploadUrl: "https://upload.example.com/part"
+  };
+  const beginResponse: BeginMultipartUploadResponse = {
+    file: {
+      accountId: accountA,
+      etag: null,
+      filePath: "/file.txt",
+      fileUrl: `https://upcdn.io/${accountA}/raw/file.txt`,
+      lastModified: { tYPE: "EpochMillis" },
+      metadata: {},
+      mime: "text/plain",
+      originalFileName: null,
+      size: 1,
+      tags: []
+    },
+    uploadId: "upload-id",
+    uploadParts: { count: 1, first: firstPart }
+  };
+  const uploadApi: UploadApiMock = {
+    beginMultipartUpload: jest.fn<(request: { accountId: string }) => Promise<BeginMultipartUploadResponse>>(
+      async _request => beginResponse
+    ),
+    completeUploadPart: jest.fn<(request: { accountId: string }) => Promise<CompleteMultipartUploadResponse>>(
+      async (_request): Promise<CompleteMultipartUploadResponse> => ({ etag: "etag", status: "Completed" })
+    ),
+    getUploadPart: jest.fn<(request: { accountId: string }) => Promise<UploadPart>>(async _request => firstPart)
+  };
+  (manager as unknown as { uploadApi: UploadApiMock }).uploadApi = uploadApi;
+  return uploadApi;
+}
+
+function state(authConfigId: string, accountId: string): AuthSessionConfigState {
+  return {
+    accessToken: "access-token",
+    config: {
+      accountId,
+      authConfigId,
+      enableServiceWorkerAuth: false,
+      getAuthorizationToken: async () => "jwt"
+    },
+    expiresAt: Date.now() + 60_000,
+    jwt: "jwt",
+    refreshHandle: undefined
+  };
+}
+
+function setSession(configState: AuthSessionConfigState): void {
+  AuthSessionState.setSession({
+    accessToken: undefined,
+    accessTokenRefreshHandle: undefined,
+    authConfigs: [configState],
+    authServiceWorker: undefined,
+    isActive: true,
+    isReady: true,
+    params: {
+      authConfigs: async () => [configState.config],
+      serviceWorkerScript: undefined
+    },
+    serviceWorkerConfigured: false
+  });
+}