@bytescale/sdk 3.60.0 → 3.62.0

package/tests/ApiClientAuth.test.ts

@@ -60,6 +60,94 @@ describe("API-client AuthManager configuration", () => {
     expect(requestHeaders(fetchApi, 1).get("Authorization-Token")).toBe("access-refreshed");
   });
 
+  test.each(
+    [[], ["https://app.example.com/media-auth/"]].map((prefixes): { prefixes: typeof prefixes } => ({ prefixes }))
+  )("ignores service-worker request restrictions in API clients: $prefixes", async ({ prefixes }) => {
+    const configState = state(undefined, accountA, "jwt-a", "access-a");
+    configState.config.requestUrlPrefixes = prefixes;
+    setModernSession([configState]);
+    const withKey = createApi({ apiKey: apiKeyA });
+    const withoutKey = createApi({});
+    await withKey.api.get();
+    await withoutKey.api.get();
+    expect(requestHeaders(withKey.fetchApi).get("Authorization-Token")).toBe("access-a");
+    expect(requestHeaders(withoutKey.fetchApi).get("Authorization")).toBe("Bearer jwt-a");
+  });
+
+  test("awaits manager-owned authentication at the expiry boundary", async () => {
+    const configState = state("customer", accountA, "jwt-old", "access-old");
+    configState.expiresAt = Date.now();
+    let completeRefresh = (): void => {
+      throw new Error("Refresh completion callback was not initialized.");
+    };
+    const authenticationPromise = new Promise<void>(resolve => {
+      completeRefresh = () => {
+        configState.accessToken = "access-new";
+        configState.expiresAt = Date.now() + 60_000;
+        configState.jwt = "jwt-new";
+        configState.refreshPromise = undefined;
+        resolve();
+      };
+    });
+    configState.authenticationPromise = authenticationPromise;
+    configState.refreshPromise = authenticationPromise;
+    setModernSession([configState]);
+    const { api, fetchApi } = createApi({ apiKey: apiKeyA, authConfigId: "customer" });
+
+    const requests = [api.get(), api.get()];
+    expect(fetchApi).not.toHaveBeenCalled();
+    completeRefresh();
+    await Promise.all(requests);
+
+    expect(requestHeaders(fetchApi, 0).get("Authorization-Token")).toBe("access-new");
+    expect(requestHeaders(fetchApi, 1).get("Authorization-Token")).toBe("access-new");
+  });
+
+  test("observes authentication that starts while resolving custom headers", async () => {
+    const configState = state("customer", accountB, "jwt-old", "access-old");
+    let completeRefresh = (): void => {
+      throw new Error("Refresh completion callback was not initialized.");
+    };
+    const authenticationPromise = new Promise<void>(resolve => {
+      completeRefresh = () => {
+        configState.accessToken = "access-new";
+        configState.expiresAt = Date.now() + 60_000;
+        configState.jwt = "jwt-new";
+        configState.refreshPromise = undefined;
+        resolve();
+      };
+    });
+    setModernSession([configState]);
+    const { api, fetchApi } = createApi({
+      authConfigId: "customer",
+      headers: async (): Promise<Record<string, string>> => {
+        configState.authenticationPromise = authenticationPromise;
+        configState.refreshPromise = authenticationPromise;
+        return {};
+      }
+    });
+
+    const request = api.get();
+    expect(fetchApi).not.toHaveBeenCalled();
+    completeRefresh();
+    await request;
+
+    expect(requestHeaders(fetchApi).get("Authorization")).toBe("Bearer jwt-new");
+  });
+
+  test("never invokes the token provider when authentication is not in progress", async () => {
+    const getAuthorizationToken = jest.fn(async () => "jwt-new");
+    const configState = state("customer", accountB, "jwt-old", "access-old", getAuthorizationToken);
+    configState.expiresAt = Date.now();
+    setModernSession([configState]);
+    const { api, fetchApi } = createApi({ authConfigId: "customer" });
+
+    await expect(api.get()).rejects.toThrow("not ready");
+
+    expect(getAuthorizationToken).not.toHaveBeenCalled();
+    expect(fetchApi).not.toHaveBeenCalled();
+  });
+
   test("uses the raw JWT as sole authentication for an API-key-less named client", async () => {
     setModernSession([state("customer", accountB, "jwt-b", "access-b")]);
     const { api, fetchApi } = createApi({ authConfigId: "customer" });
@@ -126,6 +214,29 @@ describe("API-client AuthManager configuration", () => {
     expect(requestHeaders(optedOut.fetchApi).get("Authorization")).toBe(`Bearer ${apiKeyA}`);
   });
 
+  test("fails closed for an expired V1 default instead of falling back to its API key", async () => {
+    const expired = state(undefined, accountA, "jwt-a", "access-a");
+    expired.expiresAt = Date.now() - 1;
+    AuthSessionState.setSession({
+      accessToken: undefined,
+      accessTokenRefreshHandle: undefined,
+      authConfigs: [expired],
+      authServiceWorker: undefined,
+      isActive: true,
+      isReady: false,
+      params: {
+        accountId: accountA,
+        authHeaders: async (): Promise<Record<string, string>> => ({}),
+        authUrl: "https://app.example.com/auth"
+      },
+      serviceWorkerConfigured: false
+    });
+    const { api, fetchApi } = createApi({ apiKey: apiKeyA });
+
+    await expect(api.get()).rejects.toThrow("not ready");
+    expect(fetchApi).not.toHaveBeenCalled();
+  });
+
   test("recognizes a 3.54 session as the default supplemental token", async () => {
     AuthSessionState.setSession({
       accessToken: "legacy-access",
@@ -184,16 +295,18 @@ function state(
   authConfigId: string | undefined,
   accountId: string,
   jwt: string,
-  accessToken: string
+  accessToken: string,
+  getAuthorizationToken: () => Promise<string> = async () => jwt
 ): AuthSessionConfigState {
   const config: AuthSessionConfig = {
     accountId,
     authConfigId,
     enableServiceWorkerAuth: false,
-    getAuthorizationToken: async () => jwt
+    getAuthorizationToken
   };
   return {
     accessToken,
+    authenticationPromise: Promise.resolve(),
     config,
     expiresAt: Date.now() + 60_000,
     jwt,

package/tests/AuthManagerBrowser.test.ts

@@ -4,11 +4,14 @@ import { AuthSessionState } from "../src/private/AuthSessionState";
 import { AuthSessionConfigState } from "../src/private/model/AuthSession";
 import type {
   AuthSessionConfig,
+  AuthSwConfigEntryDto,
   BeginAuthSessionParams,
   BeginAuthSessionParamsV2,
   UrlRewriteRule
 } from "../src/index.browser";
 
+import { AuthServiceWorkerHarness } from "./utils/AuthServiceWorkerHarness";
+
 type FetchApi = NonNullable<NonNullable<BeginAuthSessionParams["options"]>["fetchApi"]>;
 
 interface AuthManagerApi {
@@ -143,11 +146,13 @@ describe("AuthManager browser multi-configuration sessions", () => {
         authConfigId: undefined,
         authHeaders: async (): Promise<Record<string, string>> => ({ "X-App-Auth": "app-token" }),
         authUrl: "https://app.example.com/auth-a",
+        requestUrlPrefixes: ["https://app.example.com/media-auth/"],
         sourceUrlPrefixes: ["https://app.example.com/"]
       },
       {
         accountId: accountB,
         authConfigId: "customer-b",
+        requestUrlPrefixes: ["https://app.example.com/download/"],
         getAuthorizationToken: manualB
       },
       {
@@ -188,14 +193,16 @@ describe("AuthManager browser multi-configuration sessions", () => {
         {
           expires: expect.any(Number),
           headers: [{ key: "Authorization", value: `Bearer ${jwtA}` }],
+          requestUrlPrefixes: ["https://app.example.com/media-auth/"],
           sourceUrlPrefixes: ["https://app.example.com/"],
-          urlPrefix: `!bytescale-source-scoped!https://upcdn.io/${accountA}/`
+          urlPrefix: `!bytescale-request-scoped!!bytescale-source-scoped!https://upcdn.io/${accountA}/`
         },
         {
           expires: expect.any(Number),
           headers: [{ key: "Authorization", value: `Bearer ${jwtB}` }],
+          requestUrlPrefixes: ["https://app.example.com/download/"],
           sourceUrlPrefixes: undefined,
-          urlPrefix: `https://upcdn.io/${accountB}/`
+          urlPrefix: `!bytescale-request-scoped!https://upcdn.io/${accountB}/`
         }
       ],
       type: "SET_BYTESCALE_AUTH_CONFIG",
@@ -203,6 +210,94 @@ describe("AuthManager browser multi-configuration sessions", () => {
     });
   });
 
+  test.each(
+    [undefined, [], ["https://app.example.com/media-auth/", "https://app.example.com/download/"]].map(
+      (prefixes): { prefixes: typeof prefixes } => ({
+        prefixes
+      })
+    )
+  )("sends request prefixes through messages and restores them in the worker: $prefixes", async ({ prefixes }) => {
+    const fetchApi = createFetchApi();
+    await AuthManager.beginAuthSession({
+      authConfigs: async () => [
+        {
+          accountId: accountA,
+          authConfigId: undefined,
+          getAuthorizationToken: async () => jwtA,
+          requestUrlPrefixes: prefixes
+        }
+      ],
+      options: { fetchApi },
+      serviceWorkerScript: "/auth-sw.js",
+      urlRewriteRules: [{ fromUrlPrefix: "https://app.example.com/media-auth/", toUrlPrefix: "https://upcdn.io/" }]
+    });
+    const message = postMessage.mock.calls.at(-1)?.[0] as {
+      config: AuthSwConfigEntryDto[];
+      type: "SET_BYTESCALE_AUTH_CONFIG";
+      urlRewriteRules: UrlRewriteRule[];
+    };
+    expect(message.config[0].requestUrlPrefixes).toEqual(prefixes);
+    expect(message.config[0].urlPrefix).toBe(
+      `${prefixes === undefined ? "" : "!bytescale-request-scoped!"}https://upcdn.io/${accountA}/`
+    );
+    const worker = new AuthServiceWorkerHarness();
+    await worker.dispatchMessage(message);
+    const restarted = worker.restart();
+    const result = await restarted.dispatchFetch(`https://app.example.com/media-auth/${accountA}/image/example.jpg`);
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe(prefixes?.length === 0 ? null : `Bearer ${jwtA}`);
+    const direct = await restarted.dispatchFetch(`https://upcdn.io/${accountA}/image/example.jpg`);
+    expect(direct.responded).toBe(prefixes === undefined);
+  });
+
+  test("snapshots request prefixes and keeps them through token refresh", async () => {
+    const requestUrlPrefixes = ["https://app.example.com/media-auth/"];
+    const provider = jest.fn<() => Promise<string>>().mockResolvedValueOnce(jwtA).mockResolvedValueOnce(jwtB);
+    await AuthManager.beginAuthSession({
+      authConfigs: async () => [
+        { accountId: accountA, authConfigId: undefined, getAuthorizationToken: provider, requestUrlPrefixes }
+      ],
+      options: { fetchApi: createFetchApi() },
+      serviceWorkerScript: "/auth-sw.js"
+    });
+    requestUrlPrefixes.length = 0;
+    const session = AuthSessionState.getSession();
+    const state = session?.authConfigs?.[0];
+    if (session === undefined || state === undefined) {
+      throw new Error("Expected initialized auth state.");
+    }
+    await (AuthManager as AuthManagerInternals).refreshAuthConfig(session, state);
+    expect(provider).toHaveBeenCalledTimes(2);
+    expect(state.config.requestUrlPrefixes).toEqual(["https://app.example.com/media-auth/"]);
+    expect(state.refreshHandle).toBeDefined();
+    expect((postMessage.mock.calls.at(-1)?.[0] as { config: AuthSwConfigEntryDto[] }).config[0]).toMatchObject({
+      headers: [{ key: "Authorization", value: `Bearer ${jwtB}` }],
+      requestUrlPrefixes: ["https://app.example.com/media-auth/"]
+    });
+  });
+
+  test.each(
+    [null, "https://app.example.com/", [42], ["https://app.example.com/", null]].map(
+      (prefixes): { prefixes: typeof prefixes } => ({ prefixes })
+    )
+  )("rejects malformed request prefixes before acquiring tokens: $prefixes", async ({ prefixes }) => {
+    const provider = jest.fn(async () => jwtA);
+    const fetchApi = createFetchApi();
+    await expect(
+      AuthManager.beginAuthSession(
+        v2Params(fetchApi, [
+          {
+            ...apiOnlyConfig(undefined, accountA, provider),
+            requestUrlPrefixes: prefixes as unknown as string[]
+          }
+        ])
+      )
+    ).rejects.toThrow("The 'requestUrlPrefixes' field must be an array of strings.");
+    expect(provider).not.toHaveBeenCalled();
+    expect(fetchApi).not.toHaveBeenCalled();
+    expect(postMessage).not.toHaveBeenCalled();
+    expect(AuthManager.isAuthSessionActive()).toBe(false);
+  });
+
   test("uses each config's effective CDN URL for registration, worker prefixes, cleanup, and collisions", async () => {
     const fetchApi = createFetchApi();
     const defaultCdnUrl = "https://downloads-default.example.com";
@@ -269,6 +364,7 @@ describe("AuthManager browser multi-configuration sessions", () => {
           authConfigId: undefined,
           enableCookieAuth: true,
           enableServiceWorkerAuth: false,
+          requestUrlPrefixes: [],
           getAuthorizationToken: provider
         }
       ],
@@ -308,6 +404,53 @@ describe("AuthManager browser multi-configuration sessions", () => {
     expect(AuthManager.isAuthSessionReady()).toBe(true);
   });
 
+  test("deduplicates concurrent refreshes for the same auth config", async () => {
+    const fetchApi = createFetchApi();
+    let resolveRefresh = (_jwt: string): void => {
+      throw new Error("Refresh resolver was not initialized.");
+    };
+    const refreshResult = new Promise<string>(resolve => {
+      resolveRefresh = resolve;
+    });
+    let markRefreshStarted = (): void => {
+      throw new Error("Refresh-start resolver was not initialized.");
+    };
+    const refreshStarted = new Promise<void>(resolve => {
+      markRefreshStarted = resolve;
+    });
+    const provider = jest
+      .fn<() => Promise<string>>()
+      .mockResolvedValueOnce(jwtA)
+      .mockImplementationOnce(async () => {
+        markRefreshStarted();
+        return await refreshResult;
+      });
+
+    await AuthManager.beginAuthSession({
+      authConfigs: async () => [apiOnlyConfig("customer", accountA, provider)],
+      options: { fetchApi }
+    });
+    const session = AuthSessionState.getSession();
+    const configState = session?.authConfigs?.[0];
+    if (session === undefined || configState === undefined) {
+      throw new Error("Expected initialized auth state.");
+    }
+    const internals = AuthManager as AuthManagerInternals;
+
+    const firstRefresh = internals.refreshAuthConfig(session, configState);
+    const secondRefresh = internals.refreshAuthConfig(session, configState);
+    await refreshStarted;
+    expect(provider).toHaveBeenCalledTimes(2);
+    expect(configState.authenticationPromise).toBe(configState.refreshPromise);
+
+    resolveRefresh(jwtB);
+    await Promise.all([firstRefresh, secondRefresh]);
+
+    expect(configState.jwt).toBe(jwtB);
+    expect(configState.authenticationPromise).toBeDefined();
+    expect(configState.refreshPromise).toBeUndefined();
+  });
+
   test("clears the cookie-enabled config and the complete worker config on end", async () => {
     const fetchApi = createFetchApi();
     await AuthManager.beginAuthSession({

package/tests/AuthServiceWorkerRequestScope.test.ts

@@ -0,0 +1,259 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import type { AuthSwConfigEntryDto } from "../src/index.browser";
+import { AuthServiceWorkerHarness, authConfig, rewriteRule } from "./utils/AuthServiceWorkerHarness";
+
+const mediaPrefix = "https://dashboard.example.com/media-auth/";
+const downloadPrefix = "https://dashboard.example.com/download/";
+const sourcePrefix = "https://app.example.com/private/";
+const rules = [rewriteRule("media-auth/", ""), rewriteRule("download/", "")];
+const oldWorkerSource = readFileSync(resolve(process.cwd(), "tests/fixtures/auth-sw-3.61.0.js"), "utf8");
+
+describe("Auth service-worker original request URL restrictions", () => {
+  test.each([
+    { prefixes: undefined, directAuth: true, mediaAuth: true, downloadAuth: true },
+    { prefixes: [], directAuth: false, mediaAuth: false, downloadAuth: false },
+    { prefixes: [""], directAuth: true, mediaAuth: true, downloadAuth: true },
+    { prefixes: [mediaPrefix], directAuth: false, mediaAuth: true, downloadAuth: false },
+    { prefixes: [mediaPrefix, downloadPrefix], directAuth: false, mediaAuth: true, downloadAuth: true },
+    { prefixes: ["https://upcdn.io/account-a/"], directAuth: true, mediaAuth: false, downloadAuth: false }
+  ])("matches the original URL for $prefixes", async ({ prefixes, directAuth, mediaAuth, downloadAuth }) => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig([scopedConfig(prefixes)], rules);
+
+    const direct = await harness.dispatchFetch("https://upcdn.io/account-a/image/example.jpg");
+    expect(direct.responded).toBe(directAuth);
+    expect(direct.outboundRequest?.headers.get("Authorization")).toBe(directAuth ? "Bearer token-a" : undefined);
+
+    for (const [prefix, expectedAuth] of [
+      [mediaPrefix, mediaAuth],
+      [downloadPrefix, downloadAuth]
+    ] as const) {
+      const result = await harness.dispatchFetch(`${prefix}account-a/raw/example.jpg?download=true`, {
+        navigation: true
+      });
+      expect(result.outboundRequest?.url).toBe("https://upcdn.io/account-a/raw/example.jpg?download=true");
+      expect(result.outboundRequest?.headers.get("Authorization")).toBe(expectedAuth ? "Bearer token-a" : null);
+    }
+  });
+
+  test("still checks the final account and CDN for an allowed alias", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig([scopedConfig([mediaPrefix])], rules);
+
+    const otherAccount = await harness.dispatchFetch(`${mediaPrefix}account-b/raw/example.jpg`);
+    const similarAccount = await harness.dispatchFetch(`${mediaPrefix}account-a-extra/raw/example.jpg`);
+    expect(otherAccount.outboundRequest?.headers.has("Authorization")).toBe(false);
+    expect(similarAccount.outboundRequest?.headers.has("Authorization")).toBe(false);
+
+    await harness.setConfig(
+      [scopedConfig([mediaPrefix])],
+      [{ fromUrlPrefix: mediaPrefix, toUrlPrefix: "https://other-cdn.example.com/" }]
+    );
+    const otherCdn = await harness.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`);
+    expect(otherCdn.outboundRequest?.url).toBe("https://other-cdn.example.com/account-a/raw/example.jpg");
+    expect(otherCdn.outboundRequest?.headers.has("Authorization")).toBe(false);
+  });
+
+  test.each([[], [downloadPrefix]].map((prefixes): { prefixes: typeof prefixes } => ({ prefixes })))(
+    "continues to another eligible config after rejecting $prefixes",
+    async ({ prefixes }) => {
+      const harness = new AuthServiceWorkerHarness();
+      await harness.setConfig(
+        [
+          { ...scopedConfig(prefixes), headers: [{ key: "X-Rejected", value: "must-not-leak" }] },
+          scopedConfig([mediaPrefix]),
+          { ...scopedConfig([mediaPrefix]), headers: [{ key: "Authorization", value: "Bearer later" }] }
+        ],
+        rules
+      );
+
+      const result = await harness.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`);
+      expect(result.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+      expect(result.outboundRequest?.headers.has("X-Rejected")).toBe(false);
+    }
+  );
+
+  test("does not block an eligible destination config with a rejected original-prefix config", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig(
+      [
+        scopedConfig([downloadPrefix]),
+        {
+          ...scopedConfig([mediaPrefix]),
+          headers: [{ key: "Authorization", value: "Bearer token-b" }],
+          urlPrefix: "!bytescale-request-scoped!https://upcdn.io/account-b/"
+        }
+      ],
+      rules
+    );
+
+    const result = await harness.dispatchFetch(`${mediaPrefix}account-b/raw/example.jpg`);
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-b");
+  });
+
+  test.each([
+    { requestPrefix: mediaPrefix, clientUrl: `${sourcePrefix}page`, authorized: true },
+    { requestPrefix: mediaPrefix, clientUrl: "https://app.example.com/public/", authorized: false },
+    { requestPrefix: downloadPrefix, clientUrl: `${sourcePrefix}page`, authorized: false },
+    { requestPrefix: mediaPrefix, clientUrl: undefined, authorized: false }
+  ])("combines resource and initiating-page restrictions: %j", async ({ requestPrefix, clientUrl, authorized }) => {
+    const harness = new AuthServiceWorkerHarness();
+    if (clientUrl !== undefined) {
+      harness.setWindowClient("client", clientUrl);
+    }
+    await harness.setConfig([scopedConfig([mediaPrefix], [sourcePrefix])], rules);
+
+    const result = await harness.dispatchFetch(`${requestPrefix}account-a/raw/example.jpg`, { clientId: "client" });
+    expect(result.outboundRequest?.url).toBe("https://upcdn.io/account-a/raw/example.jpg");
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe(authorized ? "Bearer token-a" : null);
+  });
+
+  test("a rejected request restriction skips source lookup and permits a later config", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig([scopedConfig([], [sourcePrefix]), scopedConfig([mediaPrefix])], rules);
+
+    const result = await harness.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`);
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+  });
+
+  test.each(["expired", "empty source", "HEAD"])("keeps rewriting when auth is excluded by %s", async reason => {
+    const harness = new AuthServiceWorkerHarness();
+    const config = scopedConfig([mediaPrefix], reason === "empty source" ? [] : undefined);
+    if (reason === "expired") {
+      config.expires = Date.now() - 1;
+    }
+    await harness.setConfig([config], rules);
+
+    const result = await harness.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg?download=true`, {
+      method: reason === "HEAD" ? "HEAD" : "GET"
+    });
+    expect(result.outboundRequest?.url).toBe("https://upcdn.io/account-a/raw/example.jpg?download=true");
+    expect(result.outboundRequest?.headers.has("Authorization")).toBe(false);
+  });
+
+  test("does not strip caller headers from requests excluded by the restriction", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig([scopedConfig([])], rules);
+    const result = await harness.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`, {
+      headers: { "Authorization": "Caller token", "Authorization-Token": "Caller access token", "Range": "bytes=0-9" }
+    });
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe("Caller token");
+    expect(result.outboundRequest?.headers.get("Authorization-Token")).toBe("Caller access token");
+    expect(result.outboundRequest?.headers.get("Range")).toBe("bytes=0-9");
+  });
+
+  test.each(
+    [undefined, [], [mediaPrefix, downloadPrefix]].map((prefixes): { prefixes: typeof prefixes } => ({ prefixes }))
+  )("recovers restrictions and rewrites after restart: $prefixes", async ({ prefixes }) => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.dispatchMessage({
+      type: "SET_BYTESCALE_AUTH_CONFIG",
+      config: [scopedConfig(prefixes)],
+      urlRewriteRules: rules
+    });
+
+    const direct = await harness.restart().dispatchFetch("https://upcdn.io/account-a/raw/example.jpg");
+    expect(direct.outboundRequest?.headers.get("Authorization")).toBe(prefixes === undefined ? "Bearer token-a" : null);
+    for (const prefix of [mediaPrefix, downloadPrefix]) {
+      const alias = await harness
+        .restart()
+        .dispatchFetch(`${prefix}account-a/raw/example.jpg?download=true`, { navigation: true });
+      expect(alias.outboundRequest?.url).toBe("https://upcdn.io/account-a/raw/example.jpg?download=true");
+      expect(alias.outboundRequest?.headers.get("Authorization")).toBe(
+        prefixes?.length === 0 ? null : "Bearer token-a"
+      );
+    }
+  });
+
+  test("recovers both restrictions after restart", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.dispatchMessage({
+      type: "SET_BYTESCALE_AUTH_CONFIG",
+      config: [scopedConfig([mediaPrefix], [sourcePrefix])],
+      urlRewriteRules: rules
+    });
+    const restarted = harness.restart();
+    restarted.setWindowClient("client", `${sourcePrefix}page`);
+    const allowed = await restarted.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`, { clientId: "client" });
+    const rejected = await restarted.dispatchFetch(`${downloadPrefix}account-a/raw/example.jpg`, {
+      clientId: "client"
+    });
+    expect(allowed.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+    expect(rejected.outboundRequest?.headers.has("Authorization")).toBe(false);
+  });
+
+  test.each([null, "https://", [42]].map((prefixes): { prefixes: typeof prefixes } => ({ prefixes })))(
+    "rejects malformed persisted request prefixes: $prefixes",
+    async ({ prefixes }) => {
+      const harness = new AuthServiceWorkerHarness();
+      await harness.setConfig([scopedConfig(prefixes as unknown as string[])], rules);
+      const result = await harness.restart().dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`);
+      expect(result.outboundRequest?.headers.has("Authorization")).toBe(false);
+    }
+  );
+
+  test("rejects restricted configs without the compatibility marker", async () => {
+    const harness = new AuthServiceWorkerHarness();
+    await harness.setConfig([{ ...authConfig("account-a/", "token-a"), requestUrlPrefixes: [mediaPrefix] }], rules);
+    const result = await harness.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`);
+    expect(result.outboundRequest?.headers.has("Authorization")).toBe(false);
+  });
+});
+
+describe("Auth service-worker version compatibility", () => {
+  test.each(
+    [undefined, [], [sourcePrefix]].map((sourcePrefixes): { sourcePrefixes: typeof sourcePrefixes } => ({
+      sourcePrefixes
+    }))
+  )("3.61.0 skips request-scoped auth with source prefixes $sourcePrefixes", async ({ sourcePrefixes }) => {
+    const oldWorker = new AuthServiceWorkerHarness(undefined, oldWorkerSource);
+    oldWorker.setWindowClient("client", `${sourcePrefix}page`);
+    await oldWorker.setConfig([scopedConfig([mediaPrefix, downloadPrefix], sourcePrefixes)], rules);
+    const direct = await oldWorker.dispatchFetch("https://upcdn.io/account-a/raw/example.jpg", {
+      clientId: "client"
+    });
+    expect(direct.responded).toBe(false);
+    const alias = await oldWorker.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`, { clientId: "client" });
+    expect(alias.outboundRequest?.url).toBe("https://upcdn.io/account-a/raw/example.jpg");
+    expect(alias.outboundRequest?.headers.has("Authorization")).toBe(false);
+
+    const recoveredOld = await oldWorker.restart().dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`);
+    expect(recoveredOld.outboundRequest?.headers.has("Authorization")).toBe(false);
+    const upgraded = oldWorker.restart(readFileSync(resolve(process.cwd(), "src/index.auth-sw.js"), "utf8"));
+    upgraded.setWindowClient("client", `${sourcePrefix}page`);
+    const recoveredNew = await upgraded.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`, {
+      clientId: "client"
+    });
+    expect(recoveredNew.outboundRequest?.headers.get("Authorization")).toBe(
+      sourcePrefixes?.length === 0 ? null : "Bearer token-a"
+    );
+  });
+
+  test("3.61.0 skips empty request prefixes before and after restart", async () => {
+    const oldWorker = new AuthServiceWorkerHarness(undefined, oldWorkerSource);
+    await oldWorker.setConfig([scopedConfig([])], rules);
+    const alias = await oldWorker.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`);
+    const direct = await oldWorker.restart().dispatchFetch("https://upcdn.io/account-a/raw/example.jpg");
+    expect(alias.outboundRequest?.headers.has("Authorization")).toBe(false);
+    expect(direct.outboundRequest?.headers.has("Authorization")).toBe(false);
+  });
+
+  test("3.61.0 still authenticates unrestricted configs from the new SDK", async () => {
+    const oldWorker = new AuthServiceWorkerHarness(undefined, oldWorkerSource);
+    await oldWorker.setConfig([scopedConfig(undefined)], rules);
+    const result = await oldWorker.dispatchFetch(`${mediaPrefix}account-a/raw/example.jpg`);
+    expect(result.outboundRequest?.headers.get("Authorization")).toBe("Bearer token-a");
+  });
+});
+
+function scopedConfig(requestUrlPrefixes: string[] | undefined, sourceUrlPrefixes?: string[]): AuthSwConfigEntryDto {
+  return {
+    ...authConfig("account-a/", "token-a"),
+    requestUrlPrefixes,
+    sourceUrlPrefixes,
+    urlPrefix: `${requestUrlPrefixes === undefined ? "" : "!bytescale-request-scoped!"}${
+      sourceUrlPrefixes === undefined ? "" : "!bytescale-source-scoped!"
+    }https://upcdn.io/account-a/`
+  };
+}