@bytescale/sdk 3.61.0 → 3.62.0

package/tests/fixtures/auth-sw-3.61.0.js

@@ -0,0 +1,272 @@
+// Frozen worker from SDK 3.61.0 (ee6a3a2d), retained for compatibility tests.
+/* eslint-disable no-undef */
+/**
+ * Bytescale Auth Service Worker (SW)
+ *
+ * This script should be referenced by the "serviceWorkerScript" field in the "AuthManager.beginAuthSession" method of
+ * the Bytescale JavaScript SDK to append "Authorization" headers to HTTP requests sent to the Bytescale CDN. This
+ * approach serves as an alternative to cookie-based authentication, which is incompatible with certain modern browsers.
+ *
+ * Documentation:
+ * - https://www.bytescale.com/docs/types/BeginAuthSessionParams#serviceWorkerScript
+ */
+let transientCache; // [{urlPrefix, headers, expires?}] (See: AuthSwConfigDto)
+let transientUrlRewriteRules;
+const maxSourceUrlCacheEntries = 1000;
+const persistentCacheName = "bytescale-sw-config";
+const persistentCacheKey = "config";
+const persistentUrlRewriteRulesCacheKey = "url-rewrite-rules";
+const sourceScopedUrlPrefixMarker = "!bytescale-source-scoped!";
+const sourceUrlsByClientId = new Map();
+
+console.log(`[bytescale] Auth SW Registered`);
+
+self.addEventListener("install", function (event) {
+  // Typically service workers go: 'installing' -> 'waiting' -> 'activated'.
+  // However, we skip the 'waiting' phase as we want this service worker to be used immediately after it's installed,
+  // instead of requiring a page refresh if the browser already has an old version of the service worker installed.
+  event.waitUntil(self.skipWaiting());
+});
+
+self.addEventListener("activate", function (event) {
+  // Immediately allow the service worker to intercept "fetch" events (instead of requiring a page refresh) if this is
+  // the first time this service worker is being installed.
+  event.waitUntil(self.clients.claim());
+});
+
+self.addEventListener("message", event => {
+  // Allows communication with the windows/tabs that have are able to generate the JWT (as they have the auth session with the user's API).
+  // See: AuthSwSetConfigDto
+  if (event.data) {
+    switch (event.data.type) {
+      // Auth sessions are started/ended by calling SET_CONFIG with auth config or with 'undefined' config, respectively.
+      // We use 'undefined' to end the auth session instead of unregistering the worker, as there may be multiple tabs
+      // in the user's application, so while the user may sign out in one tab, they may remain signed in to another tab,
+      // which may subsequently send a follow-up 'SET_CONFIG' which will resume auth.
+      case "SET_BYTESCALE_AUTH_CONFIG":
+        setConfig(event.data.config, event.data.urlRewriteRules).then(
+          () => {},
+          e => console.error(`[bytescale] Auth SW failed to persist config.`, e)
+        );
+        break;
+    }
+  }
+});
+
+self.addEventListener("fetch", function (event) {
+  // Faster and intercepts only the required requests.
+  // Called in almost all cases.
+  const interceptSync = config => {
+    const newRequest = interceptRequest(event, config, transientUrlRewriteRules);
+    if (newRequest instanceof Promise) {
+      event.respondWith(
+        newRequest.then(
+          request => handleRequestErrors(request ?? event.request),
+          () => handleRequestErrors(event.request)
+        )
+      );
+    } else if (newRequest !== undefined) {
+      event.respondWith(handleRequestErrors(newRequest));
+    }
+  };
+
+  // Slower and intercepts all requests (while still only rewriting the relevant requests).
+  // Called only for the initial request after this Service Worker is restarted after going idle (e.g. after 30s on Firefox/Windows).
+  const interceptAsync = async () =>
+    await handleRequestErrors(
+      (await getState()
+        .then(state => (state === undefined ? undefined : interceptRequest(event, state.config, state.urlRewriteRules)))
+        .catch(() => undefined)) ?? event.request
+    );
+
+  // Makes it clearer to developers that the request failed for normal reasons (not reasons caused by this script).
+  const handleRequestErrors = async request => {
+    try {
+      return await fetch(request);
+    } catch (e) {
+      throw new Error("Network request failed: see previous browser errors for the cause.");
+    }
+  };
+
+  // Optimization: avoids running async code (which necessitates intercepting all requests) when the config is already cached locally.
+  if (transientCache !== undefined && transientUrlRewriteRules !== undefined) {
+    interceptSync(transientCache);
+  } else {
+    event.respondWith(interceptAsync());
+  }
+});
+
+function interceptRequest(event, config, urlRewriteRules) {
+  const rewrittenUrl = getRewrittenUrl(event.request.url, urlRewriteRules);
+  const url = rewrittenUrl === undefined ? event.request.url : rewrittenUrl;
+  const fallbackRequest =
+    rewrittenUrl === undefined ? undefined : createCorsRequest(event.request, rewrittenUrl, event.request.headers);
+
+  if (config !== undefined) {
+    // Config is an array to support multiple different accounts within a single website, if needed.
+    for (const { expires, urlPrefix, headers, sourceUrlPrefixes } of config) {
+      const makeNewRequest = overwrite => {
+        const newHeaders = new Headers(event.request.headers);
+        if (overwrite) {
+          newHeaders.delete("Authorization");
+          newHeaders.delete("Authorization-Token");
+        }
+        for (const { key, value } of headers) {
+          if (overwrite || !newHeaders.has(key)) {
+            newHeaders.set(key, value);
+          }
+        }
+        return createCorsRequest(event.request, url, newHeaders);
+      };
+
+      if (expires === undefined || expires > Date.now()) {
+        const isSourceScoped = sourceUrlPrefixes !== undefined;
+
+        // AuthManager adds the 'sourceScopedUrlPrefixMarker' prefix to the 'urlPrefix' when 'sourceUrlPrefixes' is provided,
+        // as this prevents old versions of the service worker (that don't support 'sourceUrlPrefixes') from intercepting the requests,
+        // since it would end up intercepting ALL requests, whereas the user's intention is to intercept only source-filtered requests.
+        const actualUrlPrefix = isSourceScoped
+          ? urlPrefix.startsWith(sourceScopedUrlPrefixMarker)
+            ? urlPrefix.substring(sourceScopedUrlPrefixMarker.length)
+            : undefined
+          : urlPrefix;
+
+        if (
+          actualUrlPrefix !== undefined &&
+          url.startsWith(actualUrlPrefix) &&
+          event.request.method.toUpperCase() === "GET"
+        ) {
+          if (isSourceScoped) {
+            if (!Array.isArray(sourceUrlPrefixes) || sourceUrlPrefixes.length === 0) {
+              return fallbackRequest;
+            }
+            return getSourceUrl(event.clientId).then(sourceUrl => {
+              if (sourceUrl === undefined || !sourceUrlPrefixes.some(prefix => sourceUrl.startsWith(prefix))) {
+                return fallbackRequest;
+              }
+
+              // Overwrite existing auth headers that may have been set by other broad-match authorizers (i.e. AuthManager
+              // instances that were configured without any sourceUrlPrefixes specified).
+              return makeNewRequest(true);
+            });
+          }
+
+          // Do not overwrite existing auth headers, as this is a broad-match authorizer (i.e. AuthManager was run
+          // without any 'sourceUrlPrefixes' specified), so give priority to AuthManagers where sourceUrlPrefixes is specified.
+          return makeNewRequest(false);
+        }
+      }
+    }
+  }
+
+  return fallbackRequest;
+}
+
+function getRewrittenUrl(url, urlRewriteRules) {
+  if (Array.isArray(urlRewriteRules)) {
+    for (const rule of urlRewriteRules) {
+      if (
+        rule !== null &&
+        typeof rule === "object" &&
+        typeof rule.fromUrlPrefix === "string" &&
+        typeof rule.toUrlPrefix === "string" &&
+        url.startsWith(rule.fromUrlPrefix)
+      ) {
+        return `${rule.toUrlPrefix}${url.substring(rule.fromUrlPrefix.length)}`;
+      }
+    }
+  }
+  return undefined;
+}
+
+function createCorsRequest(originalRequest, url, headers) {
+  if (url === originalRequest.url) {
+    return new Request(originalRequest, {
+      mode: "cors", // Required for adding custom HTTP headers.
+      headers
+    });
+  }
+
+  const method = originalRequest.method.toUpperCase();
+  const requestInit = {
+    cache: originalRequest.cache,
+    credentials: originalRequest.credentials,
+    headers,
+    integrity: originalRequest.integrity,
+    keepalive: originalRequest.keepalive,
+    method: originalRequest.method,
+    mode: "cors",
+    redirect: originalRequest.redirect,
+    referrer: originalRequest.referrer,
+    referrerPolicy: originalRequest.referrerPolicy
+  };
+  if (method !== "GET" && method !== "HEAD") {
+    requestInit.body = originalRequest.body;
+  }
+  return new Request(url, requestInit);
+}
+
+function getSourceUrl(clientId) {
+  if (typeof clientId !== "string" || clientId.length === 0) {
+    return Promise.resolve(undefined);
+  }
+  const cached = sourceUrlsByClientId.get(clientId);
+  if (cached !== undefined) {
+    return cached;
+  }
+  const lookup = withTimeout(self.clients.get(clientId))
+    .then(client =>
+      client !== undefined &&
+      client !== null &&
+      client.type === "window" &&
+      typeof client.url === "string" &&
+      client.url.length > 0
+        ? client.url
+        : undefined
+    )
+    .catch(() => undefined);
+  sourceUrlsByClientId.set(clientId, lookup);
+  if (sourceUrlsByClientId.size > maxSourceUrlCacheEntries) {
+    sourceUrlsByClientId.delete(sourceUrlsByClientId.keys().next().value);
+  }
+  return lookup;
+}
+
+function withTimeout(promise) {
+  return Promise.race([promise, new Promise(resolve => setTimeout(() => resolve(undefined), 250))]);
+}
+
+async function getState() {
+  if (transientCache !== undefined && transientUrlRewriteRules !== undefined) {
+    return { config: transientCache, urlRewriteRules: transientUrlRewriteRules };
+  }
+
+  const cache = await getCache();
+  const responses = await Promise.all([
+    cache.match(persistentCacheKey),
+    cache.match(persistentUrlRewriteRulesCacheKey)
+  ]);
+  const config = responses[0] === undefined ? [] : await responses[0].json();
+  const urlRewriteRules = responses[1] === undefined ? [] : await responses[1].json();
+
+  transientCache = Array.isArray(config) ? config : [];
+  transientUrlRewriteRules = Array.isArray(urlRewriteRules) ? urlRewriteRules : [];
+  return { config: transientCache, urlRewriteRules: transientUrlRewriteRules };
+}
+
+async function setConfig(config, urlRewriteRules) {
+  // Ensures "fetch" events can start seeing the config immediately. Persistent config is only required for when this
+  // service worker expires (after 30s on some browsers, like FireFox on Windows).
+  transientCache = config;
+  transientUrlRewriteRules = Array.isArray(urlRewriteRules) ? urlRewriteRules : [];
+
+  const cache = await getCache();
+  await Promise.all([
+    cache.put(persistentCacheKey, new Response(JSON.stringify(config))),
+    cache.put(persistentUrlRewriteRulesCacheKey, new Response(JSON.stringify(transientUrlRewriteRules)))
+  ]);
+}
+
+function getCache() {
+  return caches.open(persistentCacheName);
+}

package/tests/utils/AuthServiceWorkerHarness.ts

@@ -0,0 +1,183 @@
+import { jest } from "@jest/globals";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { runInNewContext } from "node:vm";
+import { Headers as NodeFetchHeaders, Request as NodeFetchRequest, Response as NodeFetchResponse } from "node-fetch";
+import type { RequestInit as NodeFetchRequestInit } from "node-fetch";
+import type { AuthSwConfigEntryDto, UrlRewriteRule } from "../../src/index.browser";
+import type { AuthSwSetConfigDto } from "../../src/private/dtos/AuthSwSetConfigDto";
+
+const currentWorkerSource = readFileSync(resolve(process.cwd(), "src/index.auth-sw.js"), "utf8");
+
+interface FetchOptions {
+  clientId?: string;
+  headers?: HeadersInit;
+  method?: string;
+  navigation?: boolean;
+}
+
+interface FetchResult {
+  outboundRequest: TestRequest | undefined;
+  responded: boolean;
+  response: NodeFetchResponse | undefined;
+}
+
+type WorkerEventListener = (event: unknown) => void;
+
+export class AuthServiceWorkerHarness {
+  private readonly clientsById = new Map<string, { type: "window"; url: string }>();
+  private cacheReadDelayMilliseconds = 0;
+  private readonly context: {
+    getRewrittenUrl: (url: string, rules: UrlRewriteRule[]) => string | undefined;
+    setConfig: (config: AuthSwConfigEntryDto[], rules?: UrlRewriteRule[]) => Promise<void>;
+  };
+
+  private readonly messageListener: WorkerEventListener;
+  private readonly fetchListener: WorkerEventListener;
+  private readonly fetchMock: jest.MockedFunction<(request: TestRequest) => Promise<NodeFetchResponse>>;
+
+  constructor(
+    private readonly upstreamResponse: NodeFetchResponse = new NodeFetchResponse("ok"),
+    private readonly workerSource: string = currentWorkerSource,
+    private readonly cacheEntries = new Map<string, NodeFetchResponse>()
+  ) {
+    const listeners = new Map<string, WorkerEventListener>();
+    this.fetchMock = jest.fn(async (_request: TestRequest): Promise<NodeFetchResponse> => this.upstreamResponse);
+
+    const self = {
+      addEventListener: (type: string, listener: WorkerEventListener): void => {
+        listeners.set(type, listener);
+      },
+      clients: {
+        claim: async (): Promise<void> => {},
+        get: async (clientId: string): Promise<{ type: "window"; url: string } | undefined> =>
+          this.clientsById.get(clientId)
+      },
+      skipWaiting: async (): Promise<void> => {}
+    };
+    const cache = {
+      match: async (key: string): Promise<NodeFetchResponse | undefined> => {
+        if (this.cacheReadDelayMilliseconds > 0) {
+          await new Promise(resolve => setTimeout(resolve, this.cacheReadDelayMilliseconds));
+        }
+        return this.cacheEntries.get(key)?.clone();
+      },
+      put: async (key: string, value: NodeFetchResponse): Promise<void> => {
+        this.cacheEntries.set(key, value.clone());
+      }
+    };
+    const sandbox = {
+      caches: { open: async (): Promise<typeof cache> => cache },
+      console: { error: jest.fn(), log: jest.fn() },
+      fetch: this.fetchMock,
+      Headers: NodeFetchHeaders,
+      Promise,
+      Request: TestRequest,
+      Response: NodeFetchResponse,
+      self,
+      setTimeout
+    };
+    runInNewContext(workerSource, sandbox);
+
+    this.context = sandbox as typeof sandbox & AuthServiceWorkerHarness["context"];
+    const fetchListener = listeners.get("fetch");
+    if (fetchListener === undefined) {
+      throw new Error("Auth service worker did not register a fetch listener.");
+    }
+    this.fetchListener = fetchListener;
+    const messageListener = listeners.get("message");
+    if (messageListener === undefined) {
+      throw new Error("Auth service worker did not register a message listener.");
+    }
+    this.messageListener = messageListener;
+  }
+
+  async setConfig(config: AuthSwConfigEntryDto[], rules?: UrlRewriteRule[]): Promise<void> {
+    await this.context.setConfig(config, rules);
+  }
+
+  async dispatchMessage(message: AuthSwSetConfigDto): Promise<void> {
+    let persistence: Promise<void> | undefined;
+    this.messageListener({
+      data: message,
+      waitUntil: (promise: Promise<void>): void => {
+        persistence = promise;
+      }
+    });
+    expect(persistence).toBeDefined();
+    await persistence;
+  }
+
+  restart(workerSource = this.workerSource): AuthServiceWorkerHarness {
+    return new AuthServiceWorkerHarness(this.upstreamResponse, workerSource, this.cacheEntries);
+  }
+
+  getRewrittenUrl(url: string, rules: UrlRewriteRule[]): string | undefined {
+    return this.context.getRewrittenUrl(url, rules);
+  }
+
+  setWindowClient(clientId: string, url: string): void {
+    this.clientsById.set(clientId, { type: "window", url });
+  }
+
+  setPersistentConfig(config: AuthSwConfigEntryDto[], cacheReadDelayMilliseconds: number): void {
+    this.cacheEntries.set("config", new NodeFetchResponse(JSON.stringify(config)));
+    this.cacheReadDelayMilliseconds = cacheReadDelayMilliseconds;
+  }
+
+  async dispatchFetch(url: string, options: FetchOptions = {}): Promise<FetchResult> {
+    this.fetchMock.mockClear();
+    const request = new TestRequest(url, {
+      headers: options.headers as NodeFetchRequestInit["headers"],
+      method: options.method
+    });
+    if (options.navigation === true) {
+      Object.defineProperty(request, "mode", { configurable: true, value: "navigate" });
+    }
+
+    let responsePromise: Promise<NodeFetchResponse> | undefined;
+    this.fetchListener({
+      clientId: options.clientId ?? "",
+      request,
+      respondWith: (response: NodeFetchResponse | Promise<NodeFetchResponse>): void => {
+        responsePromise = Promise.resolve(response);
+      }
+    });
+
+    const response = await responsePromise;
+    expect(this.fetchMock).toHaveBeenCalledTimes(responsePromise === undefined ? 0 : 1);
+    return {
+      outboundRequest: this.fetchMock.mock.calls.at(-1)?.[0],
+      responded: responsePromise !== undefined,
+      response
+    };
+  }
+}
+
+class TestRequest extends NodeFetchRequest {
+  readonly mode: RequestMode;
+
+  constructor(input: string | NodeFetchRequest, init: NodeFetchRequestInit & { mode?: RequestMode } = {}) {
+    super(input, init);
+    this.mode = init.mode ?? (input instanceof TestRequest ? input.mode : "cors");
+  }
+}
+
+export function authConfig(accountPath: string, token: string): AuthSwConfigEntryDto {
+  return authConfigForUrl(`https://upcdn.io/${accountPath}`, token);
+}
+
+export function authConfigForUrl(urlPrefix: string, token: string): AuthSwConfigEntryDto {
+  return {
+    expires: undefined,
+    headers: [{ key: "Authorization", value: `Bearer ${token}` }],
+    urlPrefix
+  };
+}
+
+export function rewriteRule(fromPath: string, toPath: string): UrlRewriteRule {
+  return {
+    fromUrlPrefix: `https://dashboard.example.com/${fromPath}`,
+    toUrlPrefix: `https://upcdn.io/${toPath}`
+  };
+}