@conduit-client/salesforce-lightning-service-worker 3.2.0 → 3.3.0

package/dist/index.js

@@ -3,7 +3,72 @@
  * All rights reserved.
  * For full license text, see the LICENSE.txt file
  */
-function createServiceWorker({ debug } = {}) {
+const CACHE_VERSION = 1;
+const CACHE_NAME = `salesforce-lightning-service-worker-${CACHE_VERSION}`;
+async function withCache(callback) {
+  if (caches) {
+    const cache = await caches.open(CACHE_NAME);
+    return callback(cache);
+  } else {
+    return void 0;
+  }
+}
+function isProtectedMethod(method) {
+  const normalizedMethod = method.toLowerCase();
+  return normalizedMethod === "post" || normalizedMethod === "put" || normalizedMethod === "patch" || normalizedMethod === "delete";
+}
+function isProtectedUrl(urlString) {
+  const url = new URL(urlString);
+  return url.pathname.startsWith("/services");
+}
+async function isTokenInvalid(response) {
+  var _a;
+  if (response.status === 400) {
+    const body = await response.clone().json();
+    return ((_a = body[0]) == null ? void 0 : _a.errorCode) === "INVALID_ACCESS_TOKEN";
+  }
+  return false;
+}
+function createCsrfHandler(version) {
+  const CSRF_TOKEN_URL = `/services/data/v${version}/ui-api/session/csrf`;
+  async function obtainToken() {
+    let response = await withCache((cache) => cache.match(CSRF_TOKEN_URL));
+    if (!response) {
+      response = await fetch(CSRF_TOKEN_URL, { method: "get" });
+    }
+    const csrfToken = (await response.clone().json()).csrfToken;
+    await withCache((cache) => cache.put(CSRF_TOKEN_URL, response));
+    return csrfToken;
+  }
+  let tokenPromise = obtainToken();
+  async function refreshToken() {
+    await withCache((cache) => cache.delete(CSRF_TOKEN_URL));
+    tokenPromise = obtainToken();
+  }
+  async function fetchWithToken(request) {
+    const headers = new Headers(request.headers);
+    headers.set("X-CSRF-Token", await tokenPromise);
+    return fetch(request, { headers });
+  }
+  return async (request) => {
+    if (isProtectedMethod(request.method) && isProtectedUrl(request.url)) {
+      try {
+        const response = await fetchWithToken(request.clone());
+        if (await isTokenInvalid(response)) {
+          await refreshToken();
+          return fetchWithToken(request.clone());
+        } else {
+          return response;
+        }
+      } catch (error) {
+        return new Response(JSON.stringify({ error }), { status: 500 });
+      }
+    } else {
+      return fetch(request);
+    }
+  };
+}
+function createServiceWorker({ version, debug }) {
   const scope = self;
   scope.addEventListener("install", (event) => {
     if (debug) console.log("[Service Worker] Installed");
@@ -13,14 +78,9 @@ function createServiceWorker({ debug } = {}) {
     if (debug) console.log("[Service Worker] Activated");
     event.waitUntil(scope.clients.claim());
   });
+  const applyCsrfProtection = createCsrfHandler(version);
   scope.addEventListener("fetch", (event) => {
-    console.log("[Service Worker] Fetch intercepted for pass-through:", {
-      url: event.request.url,
-      method: event.request.method,
-      destination: event.request.destination,
-      mode: event.request.mode
-    });
-    event.respondWith(fetch(event.request));
+    event.respondWith(applyCsrfProtection(event.request));
   });
 }
 export {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../src/index.ts"],"sourcesContent":["type Config = {\n    debug?: boolean;\n};\n\n/**\n * Adds event listeners for setting up service worker.\n *\n * @param debug\n */\nexport function createServiceWorker({ debug }: Config = {}) {\n    const scope = self as any as ServiceWorkerGlobalScope;\n\n    scope.addEventListener('install', (event) => {\n        if (debug) console.log('[Service Worker] Installed');\n\n        // Skip waiting to activate immediately\n        event.waitUntil(scope.skipWaiting());\n    });\n\n    scope.addEventListener('activate', (event) => {\n        if (debug) console.log('[Service Worker] Activated');\n\n        // Claim all clients immediately\n        event.waitUntil(scope.clients.claim());\n    });\n\n    scope.addEventListener('fetch', (event) => {\n        console.log('[Service Worker] Fetch intercepted for pass-through:', {\n            url: event.request.url,\n            method: event.request.method,\n            destination: event.request.destination,\n            mode: event.request.mode,\n        });\n\n        // Simply forward for now\n        event.respondWith(fetch(event.request));\n    });\n}\n"],"names":[],"mappings":";;;;;AASO,SAAS,oBAAoB,EAAE,MAAA,IAAkB,IAAI;AACxD,QAAM,QAAQ;AAEd,QAAM,iBAAiB,WAAW,CAAC,UAAU;AACzC,QAAI,MAAO,SAAQ,IAAI,4BAA4B;AAGnD,UAAM,UAAU,MAAM,aAAa;AAAA,EACvC,CAAC;AAED,QAAM,iBAAiB,YAAY,CAAC,UAAU;AAC1C,QAAI,MAAO,SAAQ,IAAI,4BAA4B;AAGnD,UAAM,UAAU,MAAM,QAAQ,MAAA,CAAO;AAAA,EACzC,CAAC;AAED,QAAM,iBAAiB,SAAS,CAAC,UAAU;AACvC,YAAQ,IAAI,wDAAwD;AAAA,MAChE,KAAK,MAAM,QAAQ;AAAA,MACnB,QAAQ,MAAM,QAAQ;AAAA,MACtB,aAAa,MAAM,QAAQ;AAAA,MAC3B,MAAM,MAAM,QAAQ;AAAA,IAAA,CACvB;AAGD,UAAM,YAAY,MAAM,MAAM,OAAO,CAAC;AAAA,EAC1C,CAAC;AACL;"}
+{"version":3,"file":"index.js","sources":["../src/csrf.ts","../src/index.ts"],"sourcesContent":["const CACHE_VERSION = 1;\nconst CACHE_NAME = `salesforce-lightning-service-worker-${CACHE_VERSION}`;\n\n/**\n * Retrieves the cache and supplies it to a callback.\n *\n * @param callback\n */\nasync function withCache<T>(callback: (cache: Cache) => Promise<T>): Promise<T | undefined> {\n    // defend against the cache API not being available\n    if (caches) {\n        const cache = await caches.open(CACHE_NAME);\n        return callback(cache);\n    } else {\n        return undefined;\n    }\n}\n\n/**\n * Determine if an HTTP method is one that mutates data.\n */\nfunction isProtectedMethod(method: string) {\n    const normalizedMethod = method.toLowerCase();\n    return (\n        normalizedMethod === 'post' ||\n        normalizedMethod === 'put' ||\n        normalizedMethod === 'patch' ||\n        normalizedMethod === 'delete'\n    );\n}\n\n/**\n * Determine if the URL is for a path that has CSRF protection.\n *\n * Note: Could allow customization\n */\nfunction isProtectedUrl(urlString: string) {\n    const url = new URL(urlString);\n    return url.pathname.startsWith('/services');\n}\n\n/**\n * Check response for status and error code of an invalid token\n */\nasync function isTokenInvalid(response: Response) {\n    if (response.status === 400) {\n        // clone response to read body without consuming it\n        const body = await response.clone().json();\n\n        // check for specific error code\n        return body[0]?.errorCode === 'INVALID_ACCESS_TOKEN';\n    }\n\n    return false;\n}\n\nexport function createCsrfHandler(version: string) {\n    const CSRF_TOKEN_URL = `/services/data/v${version}/ui-api/session/csrf`;\n\n    async function obtainToken(): Promise<string> {\n        // look up response in cache\n        let response = await withCache((cache) => cache.match(CSRF_TOKEN_URL));\n\n        if (!response) {\n            // cached response not available to fetch\n            response = await fetch(CSRF_TOKEN_URL, { method: 'get' });\n        }\n\n        // extract token using clone so caching can still process\n        const csrfToken: string = (await response.clone().json()).csrfToken;\n\n        // store token response\n        await withCache((cache) => cache.put(CSRF_TOKEN_URL, response));\n\n        return csrfToken;\n    }\n\n    let tokenPromise = obtainToken();\n\n    /**\n     * Clear any cached token and retrieve a new one.\n     */\n    async function refreshToken() {\n        await withCache((cache) => cache.delete(CSRF_TOKEN_URL));\n\n        tokenPromise = obtainToken();\n    }\n\n    /**\n     * Make a request with the token header based on the supplied request\n     */\n    async function fetchWithToken(request: Request) {\n        // combine original headers with new csrf header\n        const headers = new Headers(request.headers);\n        headers.set('X-CSRF-Token', await tokenPromise!);\n\n        // make request with updated headers\n        return fetch(request, { headers });\n    }\n\n    /**\n     * Applies a valid CSRF token to targeted requests that modify data\n     */\n    return async (request: Request): Promise<Response> => {\n        // see if the method and url qualify for CSRF\n        if (isProtectedMethod(request.method) && isProtectedUrl(request.url)) {\n            try {\n                // make request with token, clone so that any retry isn't based on a consumed request\n                const response = await fetchWithToken(request.clone());\n\n                // see if token was bad\n                if (await isTokenInvalid(response)) {\n                    // it was, so refresh and try again\n                    await refreshToken();\n                    return fetchWithToken(request.clone());\n                } else {\n                    // use response\n                    return response;\n                }\n            } catch (error) {\n                // always need to return a response\n                return new Response(JSON.stringify({ error }), { status: 500 });\n            }\n        } else {\n            // protection not required, run as is\n            return fetch(request);\n        }\n    };\n}\n","import { createCsrfHandler } from './csrf';\n\nexport type Config = {\n    version: string;\n    debug?: boolean;\n};\n\n/**\n * Adds event listeners for setting up service worker.\n *\n * @param version\n * @param debug\n */\nexport function createServiceWorker({ version, debug }: Config) {\n    const scope = self as any as ServiceWorkerGlobalScope;\n\n    scope.addEventListener('install', (event) => {\n        if (debug) console.log('[Service Worker] Installed');\n\n        // Skip waiting to activate immediately\n        event.waitUntil(scope.skipWaiting());\n    });\n\n    scope.addEventListener('activate', (event) => {\n        if (debug) console.log('[Service Worker] Activated');\n\n        // Claim all clients immediately\n        event.waitUntil(scope.clients.claim());\n    });\n\n    const applyCsrfProtection = createCsrfHandler(version);\n    scope.addEventListener('fetch', (event) => {\n        // Apply CSRF protection\n        event.respondWith(applyCsrfProtection(event.request));\n    });\n}\n"],"names":[],"mappings":";;;;;AAAA,MAAM,gBAAgB;AACtB,MAAM,aAAa,uCAAuC,aAAa;AAOvE,eAAe,UAAa,UAAgE;AAExF,MAAI,QAAQ;AACR,UAAM,QAAQ,MAAM,OAAO,KAAK,UAAU;AAC1C,WAAO,SAAS,KAAK;AAAA,EACzB,OAAO;AACH,WAAO;AAAA,EACX;AACJ;AAKA,SAAS,kBAAkB,QAAgB;AACvC,QAAM,mBAAmB,OAAO,YAAA;AAChC,SACI,qBAAqB,UACrB,qBAAqB,SACrB,qBAAqB,WACrB,qBAAqB;AAE7B;AAOA,SAAS,eAAe,WAAmB;AACvC,QAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,SAAO,IAAI,SAAS,WAAW,WAAW;AAC9C;AAKA,eAAe,eAAe,UAAoB;;AAC9C,MAAI,SAAS,WAAW,KAAK;AAEzB,UAAM,OAAO,MAAM,SAAS,MAAA,EAAQ,KAAA;AAGpC,aAAO,UAAK,CAAC,MAAN,mBAAS,eAAc;AAAA,EAClC;AAEA,SAAO;AACX;AAEO,SAAS,kBAAkB,SAAiB;AAC/C,QAAM,iBAAiB,mBAAmB,OAAO;AAEjD,iBAAe,cAA+B;AAE1C,QAAI,WAAW,MAAM,UAAU,CAAC,UAAU,MAAM,MAAM,cAAc,CAAC;AAErE,QAAI,CAAC,UAAU;AAEX,iBAAW,MAAM,MAAM,gBAAgB,EAAE,QAAQ,OAAO;AAAA,IAC5D;AAGA,UAAM,aAAqB,MAAM,SAAS,MAAA,EAAQ,QAAQ;AAG1D,UAAM,UAAU,CAAC,UAAU,MAAM,IAAI,gBAAgB,QAAQ,CAAC;AAE9D,WAAO;AAAA,EACX;AAEA,MAAI,eAAe,YAAA;AAKnB,iBAAe,eAAe;AAC1B,UAAM,UAAU,CAAC,UAAU,MAAM,OAAO,cAAc,CAAC;AAEvD,mBAAe,YAAA;AAAA,EACnB;AAKA,iBAAe,eAAe,SAAkB;AAE5C,UAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,YAAQ,IAAI,gBAAgB,MAAM,YAAa;AAG/C,WAAO,MAAM,SAAS,EAAE,SAAS;AAAA,EACrC;AAKA,SAAO,OAAO,YAAwC;AAElD,QAAI,kBAAkB,QAAQ,MAAM,KAAK,eAAe,QAAQ,GAAG,GAAG;AAClE,UAAI;AAEA,cAAM,WAAW,MAAM,eAAe,QAAQ,OAAO;AAGrD,YAAI,MAAM,eAAe,QAAQ,GAAG;AAEhC,gBAAM,aAAA;AACN,iBAAO,eAAe,QAAQ,OAAO;AAAA,QACzC,OAAO;AAEH,iBAAO;AAAA,QACX;AAAA,MACJ,SAAS,OAAO;AAEZ,eAAO,IAAI,SAAS,KAAK,UAAU,EAAE,MAAA,CAAO,GAAG,EAAE,QAAQ,KAAK;AAAA,MAClE;AAAA,IACJ,OAAO;AAEH,aAAO,MAAM,OAAO;AAAA,IACxB;AAAA,EACJ;AACJ;ACnHO,SAAS,oBAAoB,EAAE,SAAS,SAAiB;AAC5D,QAAM,QAAQ;AAEd,QAAM,iBAAiB,WAAW,CAAC,UAAU;AACzC,QAAI,MAAO,SAAQ,IAAI,4BAA4B;AAGnD,UAAM,UAAU,MAAM,aAAa;AAAA,EACvC,CAAC;AAED,QAAM,iBAAiB,YAAY,CAAC,UAAU;AAC1C,QAAI,MAAO,SAAQ,IAAI,4BAA4B;AAGnD,UAAM,UAAU,MAAM,QAAQ,MAAA,CAAO;AAAA,EACzC,CAAC;AAED,QAAM,sBAAsB,kBAAkB,OAAO;AACrD,QAAM,iBAAiB,SAAS,CAAC,UAAU;AAEvC,UAAM,YAAY,oBAAoB,MAAM,OAAO,CAAC;AAAA,EACxD,CAAC;AACL;"}

package/dist/types/__tests__/csrf.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/csrf.d.ts

@@ -1,8 +1 @@
-import { AxiosInstance } from 'axios';
-/**
- * Enforces a valid CSRF token for all requests that modify data
- *
- * @param targetClient - The client to add the interceptor to
- * @param csrfClient - The client to use for fetching CSRF tokens (should not have interceptors to avoid circular dependencies)
- */
-export declare function csrfInterceptor(targetClient: AxiosInstance, csrfClient: AxiosInstance): void;
+export declare function createCsrfHandler(version: string): (request: Request) => Promise<Response>;

package/dist/types/index.d.ts

@@ -1,10 +1,11 @@
-type Config = {
+export type Config = {
+    version: string;
     debug?: boolean;
 };
 /**
  * Adds event listeners for setting up service worker.
  *
+ * @param version
  * @param debug
  */
-export declare function createServiceWorker({ debug }?: Config): void;
-export {};
+export declare function createServiceWorker({ version, debug }: Config): void;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@conduit-client/salesforce-lightning-service-worker",
-    "version": "3.2.0",
+    "version": "3.3.0",
     "private": false,
     "description": "Service worker for accessing Salesforce data",
     "type": "module",
@@ -20,6 +20,7 @@
         "clean": "rm -rf dist",
         "dev": "npm run build && tsx scripts/dev.ts",
         "test": "vitest run",
+        "test:coverage": "vitest run --coverage",
         "test:size": "size-limit",
         "watch": "npm run build --watch"
     },
@@ -31,7 +32,7 @@
     "size-limit": [
         {
             "path": "dist/index.js",
-            "limit": "344 B"
+            "limit": "917 B"
         }
     ]
 }