@bytescale/sdk 3.59.0 → 3.61.0

package/tests/ApiClientAuth.test.ts

@@ -60,6 +60,80 @@ describe("API-client AuthManager configuration", () => {
     expect(requestHeaders(fetchApi, 1).get("Authorization-Token")).toBe("access-refreshed");
   });
 
+  test("awaits manager-owned authentication at the expiry boundary", async () => {
+    const configState = state("customer", accountA, "jwt-old", "access-old");
+    configState.expiresAt = Date.now();
+    let completeRefresh = (): void => {
+      throw new Error("Refresh completion callback was not initialized.");
+    };
+    const authenticationPromise = new Promise<void>(resolve => {
+      completeRefresh = () => {
+        configState.accessToken = "access-new";
+        configState.expiresAt = Date.now() + 60_000;
+        configState.jwt = "jwt-new";
+        configState.refreshPromise = undefined;
+        resolve();
+      };
+    });
+    configState.authenticationPromise = authenticationPromise;
+    configState.refreshPromise = authenticationPromise;
+    setModernSession([configState]);
+    const { api, fetchApi } = createApi({ apiKey: apiKeyA, authConfigId: "customer" });
+
+    const requests = [api.get(), api.get()];
+    expect(fetchApi).not.toHaveBeenCalled();
+    completeRefresh();
+    await Promise.all(requests);
+
+    expect(requestHeaders(fetchApi, 0).get("Authorization-Token")).toBe("access-new");
+    expect(requestHeaders(fetchApi, 1).get("Authorization-Token")).toBe("access-new");
+  });
+
+  test("observes authentication that starts while resolving custom headers", async () => {
+    const configState = state("customer", accountB, "jwt-old", "access-old");
+    let completeRefresh = (): void => {
+      throw new Error("Refresh completion callback was not initialized.");
+    };
+    const authenticationPromise = new Promise<void>(resolve => {
+      completeRefresh = () => {
+        configState.accessToken = "access-new";
+        configState.expiresAt = Date.now() + 60_000;
+        configState.jwt = "jwt-new";
+        configState.refreshPromise = undefined;
+        resolve();
+      };
+    });
+    setModernSession([configState]);
+    const { api, fetchApi } = createApi({
+      authConfigId: "customer",
+      headers: async (): Promise<Record<string, string>> => {
+        configState.authenticationPromise = authenticationPromise;
+        configState.refreshPromise = authenticationPromise;
+        return {};
+      }
+    });
+
+    const request = api.get();
+    expect(fetchApi).not.toHaveBeenCalled();
+    completeRefresh();
+    await request;
+
+    expect(requestHeaders(fetchApi).get("Authorization")).toBe("Bearer jwt-new");
+  });
+
+  test("never invokes the token provider when authentication is not in progress", async () => {
+    const getAuthorizationToken = jest.fn(async () => "jwt-new");
+    const configState = state("customer", accountB, "jwt-old", "access-old", getAuthorizationToken);
+    configState.expiresAt = Date.now();
+    setModernSession([configState]);
+    const { api, fetchApi } = createApi({ authConfigId: "customer" });
+
+    await expect(api.get()).rejects.toThrow("not ready");
+
+    expect(getAuthorizationToken).not.toHaveBeenCalled();
+    expect(fetchApi).not.toHaveBeenCalled();
+  });
+
   test("uses the raw JWT as sole authentication for an API-key-less named client", async () => {
     setModernSession([state("customer", accountB, "jwt-b", "access-b")]);
     const { api, fetchApi } = createApi({ authConfigId: "customer" });
@@ -126,6 +200,29 @@ describe("API-client AuthManager configuration", () => {
     expect(requestHeaders(optedOut.fetchApi).get("Authorization")).toBe(`Bearer ${apiKeyA}`);
   });
 
+  test("fails closed for an expired V1 default instead of falling back to its API key", async () => {
+    const expired = state(undefined, accountA, "jwt-a", "access-a");
+    expired.expiresAt = Date.now() - 1;
+    AuthSessionState.setSession({
+      accessToken: undefined,
+      accessTokenRefreshHandle: undefined,
+      authConfigs: [expired],
+      authServiceWorker: undefined,
+      isActive: true,
+      isReady: false,
+      params: {
+        accountId: accountA,
+        authHeaders: async (): Promise<Record<string, string>> => ({}),
+        authUrl: "https://app.example.com/auth"
+      },
+      serviceWorkerConfigured: false
+    });
+    const { api, fetchApi } = createApi({ apiKey: apiKeyA });
+
+    await expect(api.get()).rejects.toThrow("not ready");
+    expect(fetchApi).not.toHaveBeenCalled();
+  });
+
   test("recognizes a 3.54 session as the default supplemental token", async () => {
     AuthSessionState.setSession({
       accessToken: "legacy-access",
@@ -184,16 +281,18 @@ function state(
   authConfigId: string | undefined,
   accountId: string,
   jwt: string,
-  accessToken: string
+  accessToken: string,
+  getAuthorizationToken: () => Promise<string> = async () => jwt
 ): AuthSessionConfigState {
   const config: AuthSessionConfig = {
     accountId,
     authConfigId,
     enableServiceWorkerAuth: false,
-    getAuthorizationToken: async () => jwt
+    getAuthorizationToken
   };
   return {
     accessToken,
+    authenticationPromise: Promise.resolve(),
     config,
     expiresAt: Date.now() + 60_000,
     jwt,

package/tests/AuthManagerBrowser.test.ts

@@ -203,6 +203,60 @@ describe("AuthManager browser multi-configuration sessions", () => {
     });
   });
 
+  test("uses each config's effective CDN URL for registration, worker prefixes, cleanup, and collisions", async () => {
+    const fetchApi = createFetchApi();
+    const defaultCdnUrl = "https://downloads-default.example.com";
+    const customCdnUrl = "https://downloads-custom.example.com";
+    const cookieCdnUrl = "https://downloads-cookie.example.com";
+
+    await AuthManager.beginAuthSession({
+      authConfigs: async () => [
+        {
+          ...apiOnlyConfig("custom-worker", accountA, async () => jwtA),
+          cdnUrl: customCdnUrl,
+          enableServiceWorkerAuth: true
+        },
+        {
+          ...apiOnlyConfig("default-worker", accountA, async () => jwtB),
+          enableServiceWorkerAuth: true
+        },
+        {
+          ...apiOnlyConfig("cookie", accountA, async () => jwtC),
+          cdnUrl: cookieCdnUrl,
+          enableCookieAuth: true
+        }
+      ],
+      options: { cdnUrl: defaultCdnUrl, fetchApi },
+      serviceWorkerScript: "/auth-sw.js"
+    });
+
+    expect(fetchApi.mock.calls.filter(([, init]) => init?.method === "PUT").map(([input]) => inputUrl(input))).toEqual([
+      `${customCdnUrl}/api/v1/access_tokens/${accountA}?set-cookie=false`,
+      `${defaultCdnUrl}/api/v1/access_tokens/${accountA}?set-cookie=false`,
+      `${cookieCdnUrl}/api/v1/access_tokens/${accountA}?set-cookie=true`
+    ]);
+    expect((postMessage.mock.calls.at(-1)?.[0] as any).config).toEqual([
+      {
+        expires: expect.any(Number),
+        headers: [{ key: "Authorization", value: `Bearer ${jwtA}` }],
+        sourceUrlPrefixes: undefined,
+        urlPrefix: `${customCdnUrl}/${accountA}/`
+      },
+      {
+        expires: expect.any(Number),
+        headers: [{ key: "Authorization", value: `Bearer ${jwtB}` }],
+        sourceUrlPrefixes: undefined,
+        urlPrefix: `${defaultCdnUrl}/${accountA}/`
+      }
+    ]);
+
+    await AuthManager.endAuthSession();
+
+    expect(
+      fetchApi.mock.calls.filter(([, init]) => init?.method === "DELETE").map(([input]) => inputUrl(input))
+    ).toEqual([`${cookieCdnUrl}/api/v1/access_tokens/${accountA}?set-cookie=true`]);
+  });
+
   test("supports a manual cookie-only V2 config without a service worker", async () => {
     delete navigatorValue.serviceWorker;
     const fetchApi = createFetchApi();
@@ -254,6 +308,53 @@ describe("AuthManager browser multi-configuration sessions", () => {
     expect(AuthManager.isAuthSessionReady()).toBe(true);
   });
 
+  test("deduplicates concurrent refreshes for the same auth config", async () => {
+    const fetchApi = createFetchApi();
+    let resolveRefresh = (_jwt: string): void => {
+      throw new Error("Refresh resolver was not initialized.");
+    };
+    const refreshResult = new Promise<string>(resolve => {
+      resolveRefresh = resolve;
+    });
+    let markRefreshStarted = (): void => {
+      throw new Error("Refresh-start resolver was not initialized.");
+    };
+    const refreshStarted = new Promise<void>(resolve => {
+      markRefreshStarted = resolve;
+    });
+    const provider = jest
+      .fn<() => Promise<string>>()
+      .mockResolvedValueOnce(jwtA)
+      .mockImplementationOnce(async () => {
+        markRefreshStarted();
+        return await refreshResult;
+      });
+
+    await AuthManager.beginAuthSession({
+      authConfigs: async () => [apiOnlyConfig("customer", accountA, provider)],
+      options: { fetchApi }
+    });
+    const session = AuthSessionState.getSession();
+    const configState = session?.authConfigs?.[0];
+    if (session === undefined || configState === undefined) {
+      throw new Error("Expected initialized auth state.");
+    }
+    const internals = AuthManager as AuthManagerInternals;
+
+    const firstRefresh = internals.refreshAuthConfig(session, configState);
+    const secondRefresh = internals.refreshAuthConfig(session, configState);
+    await refreshStarted;
+    expect(provider).toHaveBeenCalledTimes(2);
+    expect(configState.authenticationPromise).toBe(configState.refreshPromise);
+
+    resolveRefresh(jwtB);
+    await Promise.all([firstRefresh, secondRefresh]);
+
+    expect(configState.jwt).toBe(jwtB);
+    expect(configState.authenticationPromise).toBeDefined();
+    expect(configState.refreshPromise).toBeUndefined();
+  });
+
   test("clears the cookie-enabled config and the complete worker config on end", async () => {
     const fetchApi = createFetchApi();
     await AuthManager.beginAuthSession({
@@ -340,6 +441,14 @@ describe("AuthManager browser multi-configuration sessions", () => {
       params: (fetchApi: FetchApi) => v2Params(fetchApi, [apiOnlyConfig("a", "A12/abc", async () => jwtA)]),
       error: "Invalid Bytescale account ID"
     },
+    {
+      name: "invalid config CDN URL",
+      params: (fetchApi: FetchApi) =>
+        v2Params(fetchApi, [
+          { ...apiOnlyConfig("a", accountA, async () => jwtA), cdnUrl: 123 } as unknown as AuthSessionConfig
+        ]),
+      error: "cdnUrl"
+    },
     {
       name: "overlapping cookie and worker accounts",
       params: (fetchApi: FetchApi): BeginAuthSessionParamsV2 => ({

package/tests/AuthServiceWorkerRewrite.test.ts

@@ -150,6 +150,15 @@ describe("Auth service-worker URL rewriting", () => {
     expect(untouched.responded).toBe(false);
   });
 
+  test("waits for delayed persistent authentication state on a cold start", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    harness.setPersistentConfig([authConfig("account-a/", "token-a")], 300);
+
+    const result = await harness.dispatchFetch("https://upcdn.io/account-a/file.pdf");
+
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+  });
+
   test("keeps source-page authorization independent across multiple client IDs", async () => {
     const harness = new AuthServiceWorkerHarness();
     harness.setWindowClient("client-a", "https://app.example.com/a/");
@@ -221,6 +230,8 @@ type WorkerEventListener = (event: unknown) => void;
 
 class AuthServiceWorkerHarness {
   private readonly clientsById = new Map<string, { type: "window"; url: string }>();
+  private readonly cacheEntries = new Map<string, NodeFetchResponse>();
+  private cacheReadDelayMilliseconds = 0;
   private readonly context: {
     getRewrittenUrl: (url: string, rules: UrlRewriteRule[]) => string | undefined;
     setConfig: (config: AuthSwConfigEntryDto[], rules?: UrlRewriteRule[]) => Promise<void>;
@@ -231,7 +242,6 @@ class AuthServiceWorkerHarness {
 
   constructor(private readonly upstreamResponse: NodeFetchResponse = new NodeFetchResponse("ok")) {
     const listeners = new Map<string, WorkerEventListener>();
-    const cacheEntries = new Map<string, NodeFetchResponse>();
     this.fetchMock = jest.fn(async (_request: TestRequest): Promise<NodeFetchResponse> => this.upstreamResponse);
 
     const self = {
@@ -246,9 +256,14 @@ class AuthServiceWorkerHarness {
       skipWaiting: async (): Promise<void> => {}
     };
     const cache = {
-      match: async (key: string): Promise<NodeFetchResponse | undefined> => cacheEntries.get(key)?.clone(),
+      match: async (key: string): Promise<NodeFetchResponse | undefined> => {
+        if (this.cacheReadDelayMilliseconds > 0) {
+          await new Promise(resolve => setTimeout(resolve, this.cacheReadDelayMilliseconds));
+        }
+        return this.cacheEntries.get(key)?.clone();
+      },
       put: async (key: string, value: NodeFetchResponse): Promise<void> => {
-        cacheEntries.set(key, value.clone());
+        this.cacheEntries.set(key, value.clone());
       }
     };
     const sandbox = {
@@ -284,6 +299,11 @@ class AuthServiceWorkerHarness {
     this.clientsById.set(clientId, { type: "window", url });
   }
 
+  setPersistentConfig(config: AuthSwConfigEntryDto[], cacheReadDelayMilliseconds: number): void {
+    this.cacheEntries.set("config", new NodeFetchResponse(JSON.stringify(config)));
+    this.cacheReadDelayMilliseconds = cacheReadDelayMilliseconds;
+  }
+
   async dispatchFetch(url: string, options: FetchOptions = {}): Promise<FetchResult> {
     const request = new TestRequest(url, { headers: options.headers as NodeFetchRequestInit["headers"] });
     if (options.navigation === true) {

package/tests/Scheduler.test.ts

@@ -0,0 +1,135 @@
+import { jest } from "@jest/globals";
+import { Scheduler } from "../src/private/Scheduler";
+
+class TestEventTarget {
+  private readonly listeners = new Map<string, Set<EventListener>>();
+  visibilityState: DocumentVisibilityState = "visible";
+
+  addEventListener(type: string, listener: EventListener): void {
+    const listeners = this.listeners.get(type) ?? new Set<EventListener>();
+    listeners.add(listener);
+    this.listeners.set(type, listeners);
+  }
+
+  removeEventListener(type: string, listener: EventListener): void {
+    this.listeners.get(type)?.delete(listener);
+  }
+
+  dispatch(type: string): void {
+    for (const listener of this.listeners.get(type) ?? []) {
+      listener(new Event(type));
+    }
+  }
+
+  listenerCount(type: string): number {
+    return this.listeners.get(type)?.size ?? 0;
+  }
+}
+
+describe("Scheduler", () => {
+  const originalDocument = Object.getOwnPropertyDescriptor(globalThis, "document");
+  const originalWindow = Object.getOwnPropertyDescriptor(globalThis, "window");
+  let documentEvents: TestEventTarget;
+  let windowEvents: TestEventTarget;
+  let now: number;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    now = 1000;
+    jest.spyOn(Date, "now").mockImplementation(() => now);
+    documentEvents = new TestEventTarget();
+    windowEvents = new TestEventTarget();
+    Object.defineProperty(globalThis, "document", { configurable: true, value: documentEvents });
+    Object.defineProperty(globalThis, "window", { configurable: true, value: windowEvents });
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+    restoreGlobal("document", originalDocument);
+    restoreGlobal("window", originalWindow);
+  });
+
+  test.each(["focus", "online", "pageshow"])("runs overdue callbacks immediately on %s", eventName => {
+    const scheduler = new Scheduler();
+    const callback = jest.fn();
+    scheduler.schedule(2000, callback);
+
+    now = 3000;
+    windowEvents.dispatch(eventName);
+
+    expect(callback).toHaveBeenCalledTimes(1);
+  });
+
+  test("runs overdue callbacks when a visible document resumes", () => {
+    const scheduler = new Scheduler();
+    const callback = jest.fn();
+    scheduler.schedule(2000, callback);
+
+    now = 3000;
+    documentEvents.visibilityState = "hidden";
+    documentEvents.dispatch("visibilitychange");
+    expect(callback).not.toHaveBeenCalled();
+
+    documentEvents.visibilityState = "visible";
+    documentEvents.dispatch("visibilitychange");
+    expect(callback).toHaveBeenCalledTimes(1);
+  });
+
+  test("runs scheduled callbacks immediately after a material backwards clock change", () => {
+    const scheduler = new Scheduler();
+    const callback = jest.fn();
+    now = 10_000;
+    scheduler.schedule(20_000, callback);
+
+    now = 8000;
+    documentEvents.dispatch("resume");
+
+    expect(callback).toHaveBeenCalledTimes(1);
+  });
+
+  test("retains normal polling behavior", () => {
+    const scheduler = new Scheduler();
+    const callback = jest.fn();
+    scheduler.schedule(2000, callback);
+
+    now = 1999;
+    jest.advanceTimersByTime(1000);
+    expect(callback).not.toHaveBeenCalled();
+
+    now = 2000;
+    jest.advanceTimersByTime(1000);
+    expect(callback).toHaveBeenCalledTimes(1);
+  });
+
+  test("does not refresh early for a small clock correction", () => {
+    const scheduler = new Scheduler();
+    const callback = jest.fn();
+    const handle = scheduler.schedule(20_000, callback);
+
+    now = 500;
+    windowEvents.dispatch("focus");
+
+    expect(callback).not.toHaveBeenCalled();
+    scheduler.unschedule(handle);
+  });
+
+  test("removes lifecycle listeners after the final callback is removed", () => {
+    const scheduler = new Scheduler();
+    const handle = scheduler.schedule(20_000, jest.fn());
+
+    expect(windowEvents.listenerCount("focus")).toBe(1);
+    expect(documentEvents.listenerCount("resume")).toBe(1);
+    scheduler.unschedule(handle);
+    expect(windowEvents.listenerCount("focus")).toBe(0);
+    expect(documentEvents.listenerCount("resume")).toBe(0);
+  });
+});
+
+function restoreGlobal(name: "document" | "window", descriptor: PropertyDescriptor | undefined): void {
+  if (descriptor === undefined) {
+    Reflect.deleteProperty(globalThis, name);
+  } else {
+    Object.defineProperty(globalThis, name, descriptor);
+  }
+}

package/tests/UploadManagerAuth.test.ts

@@ -80,6 +80,35 @@ describe("UploadManager AuthManager configuration", () => {
     await expect(manager.upload({ data: "x" })).rejects.toThrow("provide an API key");
     expect(uploadApi.beginMultipartUpload).not.toHaveBeenCalled();
   });
+
+  test("awaits manager-owned authentication before starting an upload", async () => {
+    const configState = state("customer", accountA);
+    configState.expiresAt = Date.now();
+    let completeRefresh = (): void => {
+      throw new Error("Refresh completion callback was not initialized.");
+    };
+    const refreshPromise = new Promise<void>(resolve => {
+      completeRefresh = () => {
+        configState.accessToken = "access-token-new";
+        configState.expiresAt = Date.now() + 60_000;
+        configState.jwt = "jwt-new";
+        configState.refreshPromise = undefined;
+        resolve();
+      };
+    });
+    configState.authenticationPromise = refreshPromise;
+    configState.refreshPromise = refreshPromise;
+    setSession(configState);
+    const manager = new TestUploadManager({ authConfigId: "customer" });
+    const uploadApi = installUploadApiMock(manager);
+
+    const upload = manager.upload({ data: "x" });
+    expect(uploadApi.beginMultipartUpload).not.toHaveBeenCalled();
+    completeRefresh();
+    await upload;
+
+    expect(uploadApi.beginMultipartUpload).toHaveBeenCalled();
+  });
 });
 
 interface UploadApiMock {
@@ -127,6 +156,7 @@ function installUploadApiMock(manager: TestUploadManager): UploadApiMock {
 function state(authConfigId: string, accountId: string): AuthSessionConfigState {
   return {
     accessToken: "access-token",
+    authenticationPromise: Promise.resolve(),
     config: {
       accountId,
       authConfigId,