@emilgroup/action-sdk 1.8.1-beta.1 → 1.8.1-beta.13

package/base.ts

@@ -32,9 +32,20 @@ export const COLLECTION_FORMATS = {
     pipes: "|",
 };
 
+export interface SessionClass {
+    sub: string;
+    username?: string;
+    email?: string;
+    tenantSlug?: string;
+    permissions?: string;
+    expiresAt?: number;
+}
+
 export interface LoginClass {
     accessToken: string;
     permissions: string;
+    authMode?: string;
+    session?: SessionClass;
 }
 
 export interface SwitchWorkspaceRequest {
@@ -45,6 +56,8 @@ export interface SwitchWorkspaceRequest {
 export interface SwitchWorkspaceResponseClass {
     accessToken: string;
     permissions: string;
+    authMode?: string;
+    session?: SessionClass;
 }
 
 export enum Environment {
@@ -77,10 +90,19 @@ interface TokenData {
     accessToken?: string;
     username?: string;
     permissions?: string;
+    // 'both' or 'session' when authservice keeps the tokens in a server session.
+    authMode?: string;
+    sub?: string;
 }
 
 const NETWORK_ERROR_MESSAGE = "Network Error";
 const TOKEN_DATA = 'APP_TOKEN';
+// Sent only to authservice, to ask for a server session.
+const AUTH_MODE_HEADER = 'X-Emil-Auth-Mode';
+// Names the account on every call; one browser session can hold several.
+const ACCOUNT_HEADER = 'X-Emil-Account';
+const SESSION_MODES = ['both', 'session'];
+const RESEND_SAFE_METHODS = ['get', 'head', 'options'];
 
 /**
  *
@@ -102,10 +124,18 @@ export class BaseAPI {
             this.configuration = configuration;
             this.basePath = configuration.basePath || this.basePath;
 
-            // Use config token if provided, otherwise use tokenData token
-            const configToken = this.configuration.accessToken;
-            const storedToken = accessToken ? `Bearer ${accessToken}` : '';
-            this.configuration.accessToken = configToken || storedToken;
+            if (configuration.cookieAuth) {
+                this.configuration.username = this.configuration.username || this.tokenData.username;
+            }
+
+            if (this.usesSession()) {
+                this.useSessionAuth();
+            } else {
+                // Use config token if provided, otherwise use tokenData token
+                const configToken = this.configuration.accessToken;
+                const storedToken = accessToken ? `Bearer ${accessToken}` : '';
+                this.configuration.accessToken = configToken || storedToken;
+            }
         } else {
             const { accessToken, username } = this.tokenData;
 
@@ -119,6 +149,107 @@ export class BaseAPI {
         this.attachInterceptor(axios);
     }
 
+    // The app's own account wins over APP_TOKEN, which holds whichever tab wrote last.
+    private sessionAccount(): string | undefined {
+        return this.configuration.account || this.tokenData.sub;
+    }
+
+    // Apps may pass the address as the second argument only; authservice is on the same host.
+    private authBasePath(): string {
+        return this.configuration.basePath || this.basePath;
+    }
+
+    private usesSession(): boolean {
+        return !!this.configuration.cookieAuth && SESSION_MODES.indexOf(this.tokenData.authMode) !== -1 && !!this.sessionAccount();
+    }
+
+    private useSessionAuth() {
+        const { headers, ...baseOptions } = this.configuration.baseOptions || {};
+        this.configuration.accessToken = '';
+        this.configuration.baseOptions = {
+            ...baseOptions,
+            withCredentials: true,
+            headers: { ...headers, [ACCOUNT_HEADER]: this.sessionAccount() },
+        };
+    }
+
+    private useHeaderAuth(accessToken: string) {
+        this.configuration.accessToken = accessToken ? `Bearer ${accessToken}` : '';
+        this.tokenData.accessToken = accessToken;
+        delete this.tokenData.authMode;
+        delete this.tokenData.sub;
+        if (this.configuration.cookieAuth) {
+            const { withCredentials, headers, ...baseOptions } = this.configuration.baseOptions || {};
+            const { [ACCOUNT_HEADER]: account, ...otherHeaders } = headers || {};
+            this.configuration.baseOptions = { ...baseOptions, headers: otherHeaders };
+        }
+    }
+
+    private applyTokenReply({ accessToken, authMode, session }: LoginClass) {
+        if (this.configuration.cookieAuth && SESSION_MODES.indexOf(authMode) !== -1 && session?.sub) {
+            this.tokenData.authMode = authMode;
+            this.tokenData.sub = session.sub;
+            if (this.configuration.account) {
+                // A workspace switch moves the app to another account.
+                this.configuration.account = session.sub;
+            }
+            // Both keeps the token for apps not moved yet; session mode keeps no token at all.
+            if (authMode === 'both' && accessToken) {
+                this.tokenData.accessToken = accessToken;
+            } else {
+                delete this.tokenData.accessToken;
+            }
+            this.useSessionAuth();
+        } else {
+            this.useHeaderAuth(accessToken);
+        }
+    }
+
+    private sessionHeaders(): Record<string, string> {
+        if (!this.configuration.cookieAuth) {
+            return {};
+        }
+        return {
+            [AUTH_MODE_HEADER]: 'session',
+            ...(this.usesSession() && { [ACCOUNT_HEADER]: this.sessionAccount() }),
+        };
+    }
+
+    private withCurrentAuth(config: AxiosRequestConfig): AxiosRequestConfig {
+        delete config.headers['Authorization'];
+        delete config.headers[ACCOUNT_HEADER];
+        if (this.usesSession()) {
+            config.headers[ACCOUNT_HEADER] = this.sessionAccount();
+            config.withCredentials = true;
+        } else if (this.configuration.accessToken) {
+            config.headers['Authorization'] = this.configuration.accessToken;
+        }
+        return config;
+    }
+
+    // Both keeps the token, so a session call the browser could not complete can be sent again with it.
+    private canRetryWithToken(config: AxiosRequestConfig): boolean {
+        return !!config.withCredentials && !!config.headers?.[ACCOUNT_HEADER]
+            && !!this.tokenData.accessToken && this.tokenData.authMode !== 'session';
+    }
+
+    // A network error can come after the server ran the call, so only a call that is safe to repeat is sent again.
+    private canResend(config: AxiosRequestConfig): boolean {
+        return RESEND_SAFE_METHODS.indexOf((config.method || 'get').toLowerCase()) !== -1
+            || Object.keys(config.headers || {}).some((name) => name.toLowerCase() === 'idempotency-key');
+    }
+
+    private switchToToken() {
+        this.useHeaderAuth(this.tokenData.accessToken);
+        this.storeTokenData(this.tokenData);
+    }
+
+    private retryWithToken(axios: AxiosInstance, config: AxiosRequestConfig) {
+        this.switchToToken();
+        config.withCredentials = false;
+        return axios(this.withCurrentAuth(config));
+    }
+
     selectEnvironment(env: Environment) {
         this.selectBasePath(env);
     }
@@ -138,8 +269,8 @@ export class BaseAPI {
     async authorize(username: string, password: string, targetWorkspace?: string): Promise<void> {
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/login`,
-            headers: { 'Content-Type': 'application/json' },
+            url: `${this.authBasePath()}/authservice/v1/login`,
+            headers: { 'Content-Type': 'application/json', ...(this.configuration.cookieAuth && { [AUTH_MODE_HEADER]: 'session' }) },
             data: {
                 username,
                 password,
@@ -149,13 +280,10 @@ export class BaseAPI {
 
         const response = await globalAxios.request<LoginClass>(options);
 
-        const { data: { accessToken, permissions } } = response;
-
         this.configuration.username = username;
-        this.configuration.accessToken = `Bearer ${accessToken}`;
         this.tokenData.username = username;
-        this.tokenData.accessToken = accessToken;
-        this.tokenData.permissions = permissions;
+        this.tokenData.permissions = response.data.permissions;
+        this.applyTokenReply(response.data);
 
         // Switch workspace if provided
         if (targetWorkspace) {
@@ -175,10 +303,11 @@ export class BaseAPI {
     async switchWorkspace(targetWorkspace: string): Promise<void> {
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/workspaces/switch`,
+            url: `${this.authBasePath()}/authservice/v1/workspaces/switch`,
             headers: {
                 'Content-Type': 'application/json',
-                'Authorization': `Bearer ${this.configuration.accessToken}`,
+                ...this.sessionHeaders(),
+                ...(!this.usesSession() && !!this.configuration.accessToken && { 'Authorization': this.configuration.accessToken as string }),
             },
             data: {
                 username: this.configuration.username,
@@ -189,11 +318,8 @@ export class BaseAPI {
 
         const response = await globalAxios.request<SwitchWorkspaceResponseClass>(options);
 
-        const { data: { accessToken, permissions } } = response;
-        
-        this.configuration.accessToken = `Bearer ${accessToken}`;
-        this.tokenData.accessToken = accessToken;
-        this.tokenData.permissions = permissions;
+        this.tokenData.permissions = response.data.permissions;
+        this.applyTokenReply(response.data);
 
         this.storeTokenData({
             ...this.tokenData
@@ -219,9 +345,10 @@ export class BaseAPI {
 
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/refresh-token`,
+            url: `${this.authBasePath()}/authservice/v1/refresh-token`,
             headers: {
                 'Content-Type': 'application/json',
+                ...this.sessionHeaders(),
             },
             data: { username: username },
             withCredentials: true,
@@ -262,20 +389,22 @@ export class BaseAPI {
                         && !originalConfig._retry) {
                         originalConfig._retry = true;
                         try {
-                            const { accessToken: tokenString, permissions } = await this.refreshTokenInternal();
-                            const accessToken = `Bearer ${tokenString}`;
-                            this.tokenData.permissions = permissions;
-
-                            delete originalConfig.headers['Authorization']
-
-                            originalConfig.headers['Authorization'] = accessToken;
-
-                            this.configuration.accessToken = accessToken;
-                            this.tokenData.accessToken = tokenString;
-
+                            const reply = await this.refreshTokenInternal();
+                            this.tokenData.permissions = reply.permissions;
+                            this.applyTokenReply(reply);
                             this.storeTokenData(this.tokenData);
 
-                            return axios(originalConfig);
+                            if (!this.usesSession()) {
+                                return axios(this.withCurrentAuth(originalConfig));
+                            }
+
+                            // Both mode: if the browser does not send the session cookie (another site), use the token.
+                            return axios(this.withCurrentAuth(originalConfig)).catch((retryError) => {
+                                if (retryError?.response?.status !== 401 || !this.tokenData.accessToken) {
+                                    return Promise.reject(retryError);
+                                }
+                                return this.retryWithToken(axios, originalConfig);
+                            });
                         } catch (_error) {
                             if (_error.response && _error.response.data) {
                                 return Promise.reject(_error.response.data);
@@ -283,26 +412,30 @@ export class BaseAPI {
                             return Promise.reject(_error);
                         }
                     }
+                } else if (err.message === NETWORK_ERROR_MESSAGE && this.canRetryWithToken(originalConfig)) {
+                    // Both mode: the browser blocked the session call or hid its reply; later calls use the token.
+                    if (!this.canResend(originalConfig)) {
+                        this.switchToToken();
+                        return Promise.reject(err);
+                    }
+                    return this.retryWithToken(axios, originalConfig);
                 } else if (err.message === NETWORK_ERROR_MESSAGE
-                    && originalConfig.headers.hasOwnProperty('Authorization')
+                    && (originalConfig.headers.hasOwnProperty('Authorization')
+                        || (this.configuration.cookieAuth && originalConfig.withCredentials && this.canResend(originalConfig)))
                     && _retry_count < 4
                 ) {
                     _retry_count++;
                     try {
-                        const { accessToken: tokenString, permissions } = await this.refreshTokenInternal();
-                        const accessToken = `Bearer ${tokenString}`;
-                        this.tokenData.permissions = permissions;
+                        // In session mode an unreadable 401 (no CORS headers on the error reply) also lands here.
+                        const reply = await this.refreshTokenInternal();
+                        this.tokenData.permissions = reply.permissions;
 
                         _retry = true;
-                        originalConfig.headers['Authorization'] = accessToken;
-
-                        this.configuration.accessToken = accessToken;
-                        this.tokenData.accessToken = tokenString;
-
+                        this.applyTokenReply(reply);
                         this.storeTokenData(this.tokenData);
 
                         return axios.request({
-                            ...originalConfig,
+                            ...this.withCurrentAuth(originalConfig),
                         });
                     } catch (_error) {
                         if (_error.response && _error.response.data) {

package/common.ts

@@ -130,9 +130,10 @@ export const toPathString = function (url: URL) {
  * @export
  */
 export const createRequestFunction = function (axiosArgs: RequestArgs, globalAxios: AxiosInstance, BASE_PATH: string, configuration?: Configuration) {
-    return <T = unknown, R = AxiosResponse<T>>(axios: AxiosInstance = globalAxios, basePath: string = BASE_PATH) => {
+    // Typed by hand: since axios 1.20, request() returns an internal axios type that SDK declarations cannot name.
+    return <T = unknown, R = AxiosResponse<T>>(axios: AxiosInstance = globalAxios, basePath: string = BASE_PATH): Promise<R> => {
         const axiosRequestArgs = {...axiosArgs.options, url: (configuration?.basePath || basePath) + axiosArgs.url};
-        return axios.request<T, R>(axiosRequestArgs);
+        return axios.request<T, R>(axiosRequestArgs) as Promise<R>;
     };
 }
 

package/configuration.ts

@@ -21,6 +21,8 @@ export interface ConfigurationParameters {
     basePath?: string;
     baseOptions?: any;
     formDataCtor?: new () => any;
+    cookieAuth?: boolean;
+    account?: string;
 }
 
 export class Configuration {
@@ -74,6 +76,22 @@ export class Configuration {
      */
     formDataCtor?: new () => any;
 
+    /**
+     * Use a server session when authservice makes one; otherwise the token, as without this option.
+     * Set `account` too, so each SDK object keeps its own account.
+     *
+     * @type {boolean}
+     * @memberof Configuration
+     */
+    cookieAuth?: boolean;
+    /**
+     * The session account (Cognito sub) this app shows, so the SDK never takes another tab's account.
+     *
+     * @type {string}
+     * @memberof Configuration
+     */
+    account?: string;
+
     constructor(param: ConfigurationParameters = {}) {
         this.apiKey = param.apiKey;
         this.username = param.username;
@@ -82,6 +100,8 @@ export class Configuration {
         this.basePath = param.basePath;
         this.baseOptions = param.baseOptions;
         this.formDataCtor = param.formDataCtor;
+        this.cookieAuth = param.cookieAuth;
+        this.account = param.account;
     }
 
     /**

package/dist/api/action-client-api.d.ts

@@ -870,7 +870,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    createAction(requestParameters: ActionClientApiCreateActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<CreateActionResponseClass, any, {}>>;
+    createAction(requestParameters: ActionClientApiCreateActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<CreateActionResponseClass, any, {}, any>>;
     /**
      * Deletes an action configuration by its code  **Required Permissions**  \"action-management.actions.delete\"
      * @summary Delete the action
@@ -879,7 +879,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    deleteAction(requestParameters: ActionClientApiDeleteActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    deleteAction(requestParameters: ActionClientApiDeleteActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}, any>>;
     /**
      * Deletes a specific action version by its version code  **Required Permissions**  \"action-management.actions.delete\"
      * @summary Delete the action version
@@ -888,7 +888,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    deleteActionVersion(requestParameters: ActionClientApiDeleteActionVersionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    deleteActionVersion(requestParameters: ActionClientApiDeleteActionVersionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}, any>>;
     /**
      * Retrieves an action configuration by its code  **Required Permissions**  \"action-management.actions.view\"
      * @summary Retrieve the action
@@ -897,7 +897,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    getAction(requestParameters: ActionClientApiGetActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetActionResponseClass, any, {}>>;
+    getAction(requestParameters: ActionClientApiGetActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetActionResponseClass, any, {}, any>>;
     /**
      * Retrieves the latest action execution status by executionCode or correlationId  **Required Permissions**  \"action-management.actions.view\"
      * @summary Retrieve the actionExecution
@@ -906,7 +906,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    getActionExecutionStatus(requestParameters?: ActionClientApiGetActionExecutionStatusRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetActionExecutionStatusResponseClass, any, {}>>;
+    getActionExecutionStatus(requestParameters?: ActionClientApiGetActionExecutionStatusRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetActionExecutionStatusResponseClass, any, {}, any>>;
     /**
      * Gets a specific action version by its version code  **Required Permissions**  \"action-management.actions.view\"
      * @summary Retrieve the action version
@@ -915,7 +915,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    getActionVersion(requestParameters: ActionClientApiGetActionVersionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetActionVersionResponseClass, any, {}>>;
+    getActionVersion(requestParameters: ActionClientApiGetActionVersionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetActionVersionResponseClass, any, {}, any>>;
     /**
      * Lists action executions (latest status per execution only) with optional filters  **Required Permissions**  \"action-management.actions.view\"
      * @summary List actionExecutions
@@ -924,7 +924,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    listActionExecutions(requestParameters?: ActionClientApiListActionExecutionsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListActionExecutionsResponseClass, any, {}>>;
+    listActionExecutions(requestParameters?: ActionClientApiListActionExecutionsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListActionExecutionsResponseClass, any, {}, any>>;
     /**
      * Lists all versions for an action by code  **Required Permissions**  \"action-management.actions.view\"
      * @summary List action versions
@@ -933,7 +933,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    listActionVersions(requestParameters: ActionClientApiListActionVersionsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListActionVersionsResponseClass, any, {}>>;
+    listActionVersions(requestParameters: ActionClientApiListActionVersionsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListActionVersionsResponseClass, any, {}, any>>;
     /**
      * Lists all action configurations with optional filters  **Required Permissions**  \"action-management.actions.view\"
      * @summary List actions
@@ -942,7 +942,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    listActions(requestParameters?: ActionClientApiListActionsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListActionsResponseClass, any, {}>>;
+    listActions(requestParameters?: ActionClientApiListActionsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListActionsResponseClass, any, {}, any>>;
     /**
      * Lists all action versions. Use filters e.g. isActive==true, entityType==LEAD, name, slug. No parent action code required.  **Required Permissions**  \"action-management.actions.view\"
      * @summary List action versions
@@ -951,7 +951,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    listAllActionVersions(requestParameters?: ActionClientApiListAllActionVersionsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListActionVersionsResponseClass, any, {}>>;
+    listAllActionVersions(requestParameters?: ActionClientApiListAllActionVersionsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListActionVersionsResponseClass, any, {}, any>>;
     /**
      * Triggers an action execution. When the action has an input_validation_schema, the input payload is validated against it; invalid payloads return HTTP 400 with a body containing message and errors (JSON Schema validation errors).  **Required Permissions**  \"action-management.actions.run\"
      * @summary Create the actionExecution
@@ -960,7 +960,7 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    triggerAction(requestParameters: ActionClientApiTriggerActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<TriggerActionResponseClass, any, {}>>;
+    triggerAction(requestParameters: ActionClientApiTriggerActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<TriggerActionResponseClass, any, {}, any>>;
     /**
      * Updates an existing action configuration (patch semantics)  **Required Permissions**  \"action-management.actions.update\"
      * @summary Update the action
@@ -969,5 +969,5 @@ export declare class ActionClientApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof ActionClientApi
      */
-    updateAction(requestParameters: ActionClientApiUpdateActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<UpdateActionResponseClass, any, {}>>;
+    updateAction(requestParameters: ActionClientApiUpdateActionRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<UpdateActionResponseClass, any, {}, any>>;
 }