@emilgroup/account-sdk 1.49.1-beta.20 → 1.49.1-beta.21

package/dist/base.js

@@ -74,6 +74,17 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -106,12 +117,21 @@ var Environment;
 })(Environment = exports.Environment || (exports.Environment = {}));
 var _retry_count = 0;
 var _retry = null;
+// Marks each request with the account (username) of the SDK object that sent it: only SDK objects of that
+// account refresh and resend it, never an object of another account open in the same browser.
+var REQUEST_OWNER = '_emilSdkOwner';
 function resetRetry() {
     _retry_count = 0;
 }
 exports.resetRetry = resetRetry;
 var NETWORK_ERROR_MESSAGE = "Network Error";
 var TOKEN_DATA = 'APP_TOKEN';
+// Sent only to authservice, to ask for a server session.
+var AUTH_MODE_HEADER = 'X-Emil-Auth-Mode';
+// Names the account on every call; one browser session can hold several.
+var ACCOUNT_HEADER = 'X-Emil-Account';
+var SESSION_MODES = ['both', 'session'];
+var RESEND_SAFE_METHODS = ['get', 'head', 'options'];
 /**
  *
  * @export
@@ -125,13 +145,30 @@ var BaseAPI = /** @class */ (function () {
         this.axios = axios;
         this.loadTokenData();
         if (configuration) {
+            // Two accounts in one browser share APP_TOKEN: never take the token or session account saved for
+            // another account. The mode stays (an app naming its account keeps its session). Saved with the next refresh.
+            var ownUser = configuration.username;
+            var storedUser = this.tokenData.username;
+            if (ownUser && storedUser && ownUser.toLowerCase() !== storedUser.toLowerCase()) {
+                delete this.tokenData.accessToken;
+                delete this.tokenData.sub;
+                this.tokenData.username = ownUser;
+            }
             var accessToken = this.tokenData.accessToken;
             this.configuration = configuration;
             this.basePath = configuration.basePath || this.basePath;
-            // Use config token if provided, otherwise use tokenData token
-            var configToken = this.configuration.accessToken;
-            var storedToken = accessToken ? "Bearer ".concat(accessToken) : '';
-            this.configuration.accessToken = configToken || storedToken;
+            if (configuration.cookieAuth) {
+                this.configuration.username = this.configuration.username || this.tokenData.username;
+            }
+            if (this.usesSession()) {
+                this.useSessionAuth();
+            }
+            else {
+                // Use config token if provided, otherwise use tokenData token
+                var configToken = this.configuration.accessToken;
+                var storedToken = accessToken ? "Bearer ".concat(accessToken) : '';
+                this.configuration.accessToken = configToken || storedToken;
+            }
         }
         else {
             var _a = this.tokenData, accessToken = _a.accessToken, username = _a.username;
@@ -143,6 +180,100 @@ var BaseAPI = /** @class */ (function () {
         }
         this.attachInterceptor(axios);
     }
+    // The app's own account wins over APP_TOKEN, which holds whichever tab wrote last.
+    BaseAPI.prototype.sessionAccount = function () {
+        return this.configuration.account || this.tokenData.sub;
+    };
+    // Apps may pass the address as the second argument only; authservice is on the same host.
+    BaseAPI.prototype.authBasePath = function () {
+        return this.configuration.basePath || this.basePath;
+    };
+    BaseAPI.prototype.usesSession = function () {
+        return !!this.configuration.cookieAuth && SESSION_MODES.indexOf(this.tokenData.authMode) !== -1 && !!this.sessionAccount();
+    };
+    BaseAPI.prototype.useSessionAuth = function () {
+        var _a;
+        var _b = this.configuration.baseOptions || {}, headers = _b.headers, baseOptions = __rest(_b, ["headers"]);
+        this.configuration.accessToken = '';
+        this.configuration.baseOptions = __assign(__assign({}, baseOptions), { withCredentials: true, headers: __assign(__assign({}, headers), (_a = {}, _a[ACCOUNT_HEADER] = this.sessionAccount(), _a)) });
+    };
+    BaseAPI.prototype.useHeaderAuth = function (accessToken, keepSessionData) {
+        if (keepSessionData === void 0) { keepSessionData = false; }
+        this.configuration.accessToken = accessToken ? "Bearer ".concat(accessToken) : '';
+        this.tokenData.accessToken = accessToken;
+        // An app without cookieAuth does not own the session fields: its refresh leaves them for the session apps.
+        if (!keepSessionData || this.configuration.cookieAuth) {
+            delete this.tokenData.authMode;
+            delete this.tokenData.sub;
+        }
+        if (this.configuration.cookieAuth) {
+            var _a = this.configuration.baseOptions || {}, withCredentials = _a.withCredentials, headers = _a.headers, baseOptions = __rest(_a, ["withCredentials", "headers"]);
+            var _b = headers || {}, _c = ACCOUNT_HEADER, account = _b[_c], otherHeaders = __rest(_b, [typeof _c === "symbol" ? _c : _c + ""]);
+            this.configuration.baseOptions = __assign(__assign({}, baseOptions), { headers: otherHeaders });
+        }
+    };
+    BaseAPI.prototype.applyTokenReply = function (_a, fromRefresh) {
+        var accessToken = _a.accessToken, authMode = _a.authMode, session = _a.session;
+        if (fromRefresh === void 0) { fromRefresh = false; }
+        if (this.configuration.cookieAuth && SESSION_MODES.indexOf(authMode) !== -1 && (session === null || session === void 0 ? void 0 : session.sub)) {
+            this.tokenData.authMode = authMode;
+            this.tokenData.sub = session.sub;
+            if (this.configuration.account) {
+                // A workspace switch moves the app to another account.
+                this.configuration.account = session.sub;
+            }
+            // Both keeps the token for apps not moved yet; session mode keeps no token at all.
+            if (authMode === 'both' && accessToken) {
+                this.tokenData.accessToken = accessToken;
+            }
+            else {
+                delete this.tokenData.accessToken;
+            }
+            this.useSessionAuth();
+        }
+        else {
+            this.useHeaderAuth(accessToken, fromRefresh);
+        }
+    };
+    BaseAPI.prototype.sessionHeaders = function () {
+        var _a, _b;
+        if (!this.configuration.cookieAuth) {
+            return {};
+        }
+        return __assign((_a = {}, _a[AUTH_MODE_HEADER] = 'session', _a), (this.usesSession() && (_b = {}, _b[ACCOUNT_HEADER] = this.sessionAccount(), _b)));
+    };
+    BaseAPI.prototype.withCurrentAuth = function (config) {
+        delete config.headers['Authorization'];
+        delete config.headers[ACCOUNT_HEADER];
+        if (this.usesSession()) {
+            config.headers[ACCOUNT_HEADER] = this.sessionAccount();
+            config.withCredentials = true;
+        }
+        else if (this.configuration.accessToken) {
+            config.headers['Authorization'] = this.configuration.accessToken;
+        }
+        return config;
+    };
+    // Both keeps the token, so a session call the browser could not complete can be sent again with it.
+    BaseAPI.prototype.canRetryWithToken = function (config) {
+        var _a;
+        return !!config.withCredentials && !!((_a = config.headers) === null || _a === void 0 ? void 0 : _a[ACCOUNT_HEADER])
+            && !!this.tokenData.accessToken && this.tokenData.authMode !== 'session';
+    };
+    // A network error can come after the server ran the call, so only a call that is safe to repeat is sent again.
+    BaseAPI.prototype.canResend = function (config) {
+        return RESEND_SAFE_METHODS.indexOf((config.method || 'get').toLowerCase()) !== -1
+            || Object.keys(config.headers || {}).some(function (name) { return name.toLowerCase() === 'idempotency-key'; });
+    };
+    BaseAPI.prototype.switchToToken = function () {
+        this.useHeaderAuth(this.tokenData.accessToken);
+        this.storeTokenData(this.tokenData);
+    };
+    BaseAPI.prototype.retryWithToken = function (axios, config) {
+        this.switchToToken();
+        config.withCredentials = false;
+        return axios(this.withCurrentAuth(config));
+    };
     BaseAPI.prototype.selectEnvironment = function (env) {
         this.selectBasePath(env);
     };
@@ -158,14 +289,15 @@ var BaseAPI = /** @class */ (function () {
     };
     BaseAPI.prototype.authorize = function (username, password, targetWorkspace) {
         return __awaiter(this, void 0, void 0, function () {
-            var options, response, _a, accessToken, permissions;
+            var options, response;
+            var _a;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
                         options = {
                             method: 'POST',
-                            url: "".concat(this.configuration.basePath, "/authservice/v1/login"),
-                            headers: { 'Content-Type': 'application/json' },
+                            url: "".concat(this.authBasePath(), "/authservice/v1/login"),
+                            headers: __assign({ 'Content-Type': 'application/json' }, (this.configuration.cookieAuth && (_a = {}, _a[AUTH_MODE_HEADER] = 'session', _a))),
                             data: {
                                 username: username,
                                 password: password,
@@ -175,12 +307,10 @@ var BaseAPI = /** @class */ (function () {
                         return [4 /*yield*/, axios_1.default.request(options)];
                     case 1:
                         response = _b.sent();
-                        _a = response.data, accessToken = _a.accessToken, permissions = _a.permissions;
                         this.configuration.username = username;
-                        this.configuration.accessToken = "Bearer ".concat(accessToken);
                         this.tokenData.username = username;
-                        this.tokenData.accessToken = accessToken;
-                        this.tokenData.permissions = permissions;
+                        this.tokenData.permissions = response.data.permissions;
+                        this.applyTokenReply(response.data);
                         if (!targetWorkspace) return [3 /*break*/, 3];
                         return [4 /*yield*/, this.switchWorkspace(targetWorkspace)];
                     case 2:
@@ -199,17 +329,14 @@ var BaseAPI = /** @class */ (function () {
     };
     BaseAPI.prototype.switchWorkspace = function (targetWorkspace) {
         return __awaiter(this, void 0, void 0, function () {
-            var options, response, _a, accessToken, permissions;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            var options, response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         options = {
                             method: 'POST',
-                            url: "".concat(this.configuration.basePath, "/authservice/v1/workspaces/switch"),
-                            headers: {
-                                'Content-Type': 'application/json',
-                                'Authorization': "Bearer ".concat(this.configuration.accessToken),
-                            },
+                            url: "".concat(this.authBasePath(), "/authservice/v1/workspaces/switch"),
+                            headers: __assign(__assign({ 'Content-Type': 'application/json' }, this.sessionHeaders()), (!this.usesSession() && !!this.configuration.accessToken && { 'Authorization': this.configuration.accessToken })),
                             data: {
                                 username: this.configuration.username,
                                 targetWorkspace: targetWorkspace,
@@ -218,11 +345,9 @@ var BaseAPI = /** @class */ (function () {
                         };
                         return [4 /*yield*/, axios_1.default.request(options)];
                     case 1:
-                        response = _b.sent();
-                        _a = response.data, accessToken = _a.accessToken, permissions = _a.permissions;
-                        this.configuration.accessToken = "Bearer ".concat(accessToken);
-                        this.tokenData.accessToken = accessToken;
-                        this.tokenData.permissions = permissions;
+                        response = _a.sent();
+                        this.tokenData.permissions = response.data.permissions;
+                        this.applyTokenReply(response.data);
                         this.storeTokenData(__assign({}, this.tokenData));
                         return [2 /*return*/];
                 }
@@ -242,17 +367,42 @@ var BaseAPI = /** @class */ (function () {
                         }
                         refreshTokenAxios = axios_1.default.create();
                         refreshTokenAxios.interceptors.response.use(function (response) {
-                            var permissions = response.data.permissions;
+                            var _a, _b;
+                            var _c = response.data, permissions = _c.permissions, accessToken = _c.accessToken, authMode = _c.authMode;
+                            // Decided before the merge below: newer session data must not keep the new token from this object.
+                            var onSession = _this.usesSession();
+                            // Newer data saved for this account (e.g. the session mode the shell saved later) wins over the copy
+                            // read when the object was made; data of another account or another workspace (sub) is never taken.
+                            var latest = ((typeof window !== 'undefined' && (0, common_1.defaultStorage)().get(TOKEN_DATA)) || {});
+                            var ownSub = _this.sessionAccount();
+                            if (((_a = latest.username) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === username.toLowerCase()
+                                && (!ownSub || !latest.sub || latest.sub === ownSub)) {
+                                // A bare reset ({username}, an app's account check) keeps this copy's other fields; any fuller record
+                                // is the truth, so fields it lacks were removed on purpose (e.g. a rollback) and stay removed.
+                                var bareReset = Object.keys(latest).every(function (key) { return key === 'username'; });
+                                _this.tokenData = bareReset ? __assign(__assign({}, _this.tokenData), latest) : __assign({}, latest);
+                            }
+                            // The reply is for this account: label it, or an SDK object of another account would take the token.
+                            if (((_b = _this.tokenData.username) === null || _b === void 0 ? void 0 : _b.toLowerCase()) !== username.toLowerCase()) {
+                                _this.tokenData.username = username;
+                            }
                             _this.tokenData.permissions = permissions;
+                            // Keep the new token for the page's next SDK objects; session data is left as it is.
+                            if (accessToken && !onSession) {
+                                _this.tokenData.accessToken = accessToken;
+                                _this.configuration.accessToken = "Bearer ".concat(accessToken);
+                            }
+                            else if (accessToken && authMode === 'both') {
+                                // Both: this app stays on the session; the token is kept for apps not moved yet.
+                                _this.tokenData.accessToken = accessToken;
+                            }
                             _this.storeTokenData(_this.tokenData);
                             return response;
                         });
                         options = {
                             method: 'POST',
-                            url: "".concat(this.configuration.basePath, "/authservice/v1/refresh-token"),
-                            headers: {
-                                'Content-Type': 'application/json',
-                            },
+                            url: "".concat(this.authBasePath(), "/authservice/v1/refresh-token"),
+                            headers: __assign({ 'Content-Type': 'application/json' }, this.sessionHeaders()),
                             data: { username: username },
                             withCredentials: true,
                         };
@@ -280,67 +430,100 @@ var BaseAPI = /** @class */ (function () {
     BaseAPI.prototype.cleanTokenData = function () {
         this.storeTokenData(null);
     };
+    BaseAPI.prototype.ownAccount = function () {
+        return (this.configuration.username || '').toLowerCase();
+    };
+    BaseAPI.prototype.withOwner = function (options) {
+        var _a;
+        // An object without a username cannot refresh itself: its requests stay unmarked, as before.
+        if (!this.ownAccount()) {
+            return __assign({}, options);
+        }
+        return __assign(__assign({}, options), (_a = {}, _a[REQUEST_OWNER] = this.ownAccount(), _a));
+    };
     BaseAPI.prototype.attachInterceptor = function (axios) {
         var _this = this;
         axios.interceptors.response.use(function (res) {
             return res;
         }, function (err) { return __awaiter(_this, void 0, void 0, function () {
-            var originalConfig, _a, tokenString, permissions, accessToken, _error_1, _b, tokenString, permissions, accessToken, _error_2;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
+            var originalConfig, owner, reply, _error_1, reply, _error_2;
+            var _this = this;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         originalConfig = err.config;
+                        owner = originalConfig === null || originalConfig === void 0 ? void 0 : originalConfig[REQUEST_OWNER];
+                        if (owner !== undefined && owner !== this.ownAccount()) {
+                            return [2 /*return*/, Promise.reject(err)];
+                        }
                         if (!(err.response && !(err.response instanceof XMLHttpRequest))) return [3 /*break*/, 5];
                         if (!((err.response.status === 401 || err.response.status === 403)
                             && !originalConfig._retry)) return [3 /*break*/, 4];
                         originalConfig._retry = true;
-                        _c.label = 1;
+                        _a.label = 1;
                     case 1:
-                        _c.trys.push([1, 3, , 4]);
+                        _a.trys.push([1, 3, , 4]);
                         return [4 /*yield*/, this.refreshTokenInternal()];
                     case 2:
-                        _a = _c.sent(), tokenString = _a.accessToken, permissions = _a.permissions;
-                        accessToken = "Bearer ".concat(tokenString);
-                        this.tokenData.permissions = permissions;
-                        delete originalConfig.headers['Authorization'];
-                        originalConfig.headers['Authorization'] = accessToken;
-                        this.configuration.accessToken = accessToken;
-                        this.tokenData.accessToken = tokenString;
+                        reply = _a.sent();
+                        this.tokenData.permissions = reply.permissions;
+                        this.applyTokenReply(reply, true);
                         this.storeTokenData(this.tokenData);
-                        return [2 /*return*/, axios(originalConfig)];
+                        if (!this.usesSession()) {
+                            return [2 /*return*/, axios(this.withCurrentAuth(originalConfig))];
+                        }
+                        // Both mode: if the browser does not send the session cookie (another site), use the token.
+                        return [2 /*return*/, axios(this.withCurrentAuth(originalConfig)).catch(function (retryError) {
+                                var _a;
+                                if (((_a = retryError === null || retryError === void 0 ? void 0 : retryError.response) === null || _a === void 0 ? void 0 : _a.status) !== 401 || !_this.tokenData.accessToken) {
+                                    return Promise.reject(retryError);
+                                }
+                                return _this.retryWithToken(axios, originalConfig);
+                            })];
                     case 3:
-                        _error_1 = _c.sent();
+                        _error_1 = _a.sent();
                         if (_error_1.response && _error_1.response.data) {
                             return [2 /*return*/, Promise.reject(_error_1.response.data)];
                         }
                         return [2 /*return*/, Promise.reject(_error_1)];
-                    case 4: return [3 /*break*/, 9];
+                    case 4: return [3 /*break*/, 10];
                     case 5:
+                        if (!(err.message === NETWORK_ERROR_MESSAGE && this.canRetryWithToken(originalConfig))) return [3 /*break*/, 6];
+                        // Both mode: the browser blocked the session call or hid its reply; later calls use the token.
+                        if (!this.canResend(originalConfig)) {
+                            this.switchToToken();
+                            return [2 /*return*/, Promise.reject(err)];
+                        }
+                        return [2 /*return*/, this.retryWithToken(axios, originalConfig)];
+                    case 6:
                         if (!(err.message === NETWORK_ERROR_MESSAGE
-                            && originalConfig.headers.hasOwnProperty('Authorization')
-                            && _retry_count < 4)) return [3 /*break*/, 9];
+                            && (originalConfig.headers.hasOwnProperty('Authorization')
+                                || (this.configuration.cookieAuth && originalConfig.withCredentials && this.canResend(originalConfig)))
+                            && _retry_count < 4)) return [3 /*break*/, 10];
                         _retry_count++;
-                        _c.label = 6;
-                    case 6:
-                        _c.trys.push([6, 8, , 9]);
-                        return [4 /*yield*/, this.refreshTokenInternal()];
+                        _a.label = 7;
                     case 7:
-                        _b = _c.sent(), tokenString = _b.accessToken, permissions = _b.permissions;
-                        accessToken = "Bearer ".concat(tokenString);
-                        this.tokenData.permissions = permissions;
+                        _a.trys.push([7, 9, , 10]);
+                        return [4 /*yield*/, this.refreshTokenInternal()];
+                    case 8:
+                        reply = _a.sent();
+                        this.tokenData.permissions = reply.permissions;
                         _retry = true;
-                        originalConfig.headers['Authorization'] = accessToken;
-                        this.configuration.accessToken = accessToken;
-                        this.tokenData.accessToken = tokenString;
+                        this.applyTokenReply(reply, true);
                         this.storeTokenData(this.tokenData);
-                        return [2 /*return*/, axios.request(__assign({}, originalConfig))];
-                    case 8:
-                        _error_2 = _c.sent();
+                        // The limit is for refreshes that do not help; one that worked starts the count again.
+                        // Not awaited, so a failed retry reaches the app as the same axios error as before.
+                        return [2 /*return*/, axios.request(__assign({}, this.withCurrentAuth(originalConfig))).then(function (retried) {
+                                _retry_count = 0;
+                                return retried;
+                            })];
+                    case 9:
+                        _error_2 = _a.sent();
                         if (_error_2.response && _error_2.response.data) {
                             return [2 /*return*/, Promise.reject(_error_2.response.data)];
                         }
                         return [2 /*return*/, Promise.reject(_error_2)];
-                    case 9: return [2 /*return*/, Promise.reject(err)];
+                    case 10: return [2 /*return*/, Promise.reject(err)];
                 }
             });
         }); });

package/dist/common.d.ts

@@ -62,7 +62,7 @@ export declare const toPathString: (url: URL) => string;
  *
  * @export
  */
-export declare const createRequestFunction: (axiosArgs: RequestArgs, globalAxios: AxiosInstance, BASE_PATH: string, configuration?: Configuration) => <T = unknown, R = AxiosResponse<T, any, {}>>(axios?: AxiosInstance, basePath?: string) => Promise<R>;
+export declare const createRequestFunction: (axiosArgs: RequestArgs, globalAxios: AxiosInstance, BASE_PATH: string, configuration?: Configuration) => <T = unknown, R = AxiosResponse<T, any, {}, any>>(axios?: AxiosInstance, basePath?: string) => Promise<R>;
 /**
  * EMIL AccountService
  * The EMIL AccountService API description

package/dist/common.js

@@ -233,6 +233,7 @@ exports.toPathString = toPathString;
  * @export
  */
 var createRequestFunction = function (axiosArgs, globalAxios, BASE_PATH, configuration) {
+    // Typed by hand: since axios 1.20, request() returns an internal axios type that SDK declarations cannot name.
     return function (axios, basePath) {
         if (axios === void 0) { axios = globalAxios; }
         if (basePath === void 0) { basePath = BASE_PATH; }

package/dist/configuration.d.ts

@@ -17,6 +17,8 @@ export interface ConfigurationParameters {
     basePath?: string;
     baseOptions?: any;
     formDataCtor?: new () => any;
+    cookieAuth?: boolean;
+    account?: string;
 }
 export declare class Configuration {
     /**
@@ -68,6 +70,21 @@ export declare class Configuration {
      * @type {new () => FormData}
      */
     formDataCtor?: new () => any;
+    /**
+     * Use a server session when authservice makes one; otherwise the token, as without this option.
+     * Set `account` too, so each SDK object keeps its own account.
+     *
+     * @type {boolean}
+     * @memberof Configuration
+     */
+    cookieAuth?: boolean;
+    /**
+     * The session account (Cognito sub) this app shows, so the SDK never takes another tab's account.
+     *
+     * @type {string}
+     * @memberof Configuration
+     */
+    account?: string;
     constructor(param?: ConfigurationParameters);
     /**
      * Check if the given MIME is a JSON MIME.

package/dist/configuration.js

@@ -24,6 +24,8 @@ var Configuration = /** @class */ (function () {
         this.basePath = param.basePath;
         this.baseOptions = param.baseOptions;
         this.formDataCtor = param.formDataCtor;
+        this.cookieAuth = param.cookieAuth;
+        this.account = param.account;
     }
     /**
      * Check if the given MIME is a JSON MIME.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emilgroup/account-sdk",
-  "version": "1.49.1-beta.20",
+  "version": "1.49.1-beta.21",
   "description": "OpenAPI client for @emilgroup/account-sdk",
   "author": "OpenAPI-Generator Contributors",
   "keywords": [
@@ -18,7 +18,7 @@
     "prepare": "npm run build"
   },
   "dependencies": {
-    "axios": "1.18.0"
+    "axios": "1.20.0"
   },
   "devDependencies": {