@emilgroup/migration-sdk 0.10.1-beta.14 → 0.10.1-beta.17

package/README.md

@@ -17,11 +17,11 @@ Although this package can be used in both TypeScript and JavaScript, it is inten
 Navigate to the folder of your consuming project and run one of the following commands:
 
 ```
-npm install @emilgroup/migration-sdk@0.10.1-beta.14 --save
+npm install @emilgroup/migration-sdk@0.10.1-beta.17 --save
 ```
 or 
 ```
-yarn add @emilgroup/migration-sdk@0.10.1-beta.14
+yarn add @emilgroup/migration-sdk@0.10.1-beta.17
 ```
 
 And then you can import ``.

package/api/migration-api.ts

@@ -101,8 +101,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -152,8 +154,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -199,8 +203,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -246,8 +252,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -293,8 +301,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -340,8 +350,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -388,8 +400,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -433,8 +447,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -478,8 +494,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -554,8 +572,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
                 localVarQueryParameter['filters'] = filters;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -630,8 +650,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
                 localVarQueryParameter['filters'] = filters;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -710,8 +732,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
                 localVarQueryParameter['filters'] = filters;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -790,8 +814,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
                 localVarQueryParameter['filters'] = filters;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -866,8 +892,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
                 localVarQueryParameter['filters'] = filters;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -914,8 +942,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -965,8 +995,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -1016,8 +1048,10 @@ export const MigrationApiAxiosParamCreator = function (configuration?: Configura
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 

package/base.ts

@@ -32,9 +32,20 @@ export const COLLECTION_FORMATS = {
     pipes: "|",
 };
 
+export interface SessionClass {
+    sub: string;
+    username?: string;
+    email?: string;
+    tenantSlug?: string;
+    permissions?: string;
+    expiresAt?: number;
+}
+
 export interface LoginClass {
     accessToken: string;
     permissions: string;
+    authMode?: string;
+    session?: SessionClass;
 }
 
 
@@ -68,10 +79,19 @@ interface TokenData {
     accessToken?: string;
     username?: string;
     permissions?: string;
+    // 'both' or 'session' when authservice keeps the tokens in a server session.
+    authMode?: string;
+    sub?: string;
 }
 
 const NETWORK_ERROR_MESSAGE = "Network Error";
 const TOKEN_DATA = 'APP_TOKEN';
+// Sent only to authservice, to ask for a server session.
+const AUTH_MODE_HEADER = 'X-Emil-Auth-Mode';
+// Names the account on every call; one browser session can hold several.
+const ACCOUNT_HEADER = 'X-Emil-Account';
+const SESSION_MODES = ['both', 'session'];
+const RESEND_SAFE_METHODS = ['get', 'head', 'options'];
 
 /**
  *
@@ -94,7 +114,11 @@ export class BaseAPI {
             this.basePath = configuration.basePath || this.basePath;
 
             if (configuration.cookieAuth) {
-                this.useCookieAuth();
+                this.configuration.username = this.configuration.username || this.tokenData.username;
+            }
+
+            if (this.usesSession()) {
+                this.useSessionAuth();
             } else {
                 // Use config token if provided, otherwise use tokenData token
                 const configToken = this.configuration.accessToken;
@@ -114,10 +138,105 @@ export class BaseAPI {
         this.attachInterceptor(axios);
     }
 
-    // Cookie mode: the browser sends the HttpOnly access cookie, so no token is read from storage.
-    private useCookieAuth() {
-        this.configuration.username = this.configuration.username || this.tokenData.username;
-        this.configuration.baseOptions = { ...this.configuration.baseOptions, withCredentials: true };
+    // The app's own account wins over APP_TOKEN, which holds whichever tab wrote last.
+    private sessionAccount(): string | undefined {
+        return this.configuration.account || this.tokenData.sub;
+    }
+
+    // Apps may pass the address as the second argument only; authservice is on the same host.
+    private authBasePath(): string {
+        return this.configuration.basePath || this.basePath;
+    }
+
+    private usesSession(): boolean {
+        return !!this.configuration.cookieAuth && SESSION_MODES.indexOf(this.tokenData.authMode) !== -1 && !!this.sessionAccount();
+    }
+
+    private useSessionAuth() {
+        const { headers, ...baseOptions } = this.configuration.baseOptions || {};
+        this.configuration.accessToken = '';
+        this.configuration.baseOptions = {
+            ...baseOptions,
+            withCredentials: true,
+            headers: { ...headers, [ACCOUNT_HEADER]: this.sessionAccount() },
+        };
+    }
+
+    private useHeaderAuth(accessToken: string) {
+        this.configuration.accessToken = accessToken ? `Bearer ${accessToken}` : '';
+        this.tokenData.accessToken = accessToken;
+        delete this.tokenData.authMode;
+        delete this.tokenData.sub;
+        if (this.configuration.cookieAuth) {
+            const { withCredentials, headers, ...baseOptions } = this.configuration.baseOptions || {};
+            const { [ACCOUNT_HEADER]: account, ...otherHeaders } = headers || {};
+            this.configuration.baseOptions = { ...baseOptions, headers: otherHeaders };
+        }
+    }
+
+    private applyTokenReply({ accessToken, authMode, session }: LoginClass) {
+        if (this.configuration.cookieAuth && SESSION_MODES.indexOf(authMode) !== -1 && session?.sub) {
+            this.tokenData.authMode = authMode;
+            this.tokenData.sub = session.sub;
+            if (this.configuration.account) {
+                // A workspace switch moves the app to another account.
+                this.configuration.account = session.sub;
+            }
+            // Both keeps the token for apps not moved yet; session mode keeps no token at all.
+            if (authMode === 'both' && accessToken) {
+                this.tokenData.accessToken = accessToken;
+            } else {
+                delete this.tokenData.accessToken;
+            }
+            this.useSessionAuth();
+        } else {
+            this.useHeaderAuth(accessToken);
+        }
+    }
+
+    private sessionHeaders(): Record<string, string> {
+        if (!this.configuration.cookieAuth) {
+            return {};
+        }
+        return {
+            [AUTH_MODE_HEADER]: 'session',
+            ...(this.usesSession() && { [ACCOUNT_HEADER]: this.sessionAccount() }),
+        };
+    }
+
+    private withCurrentAuth(config: AxiosRequestConfig): AxiosRequestConfig {
+        delete config.headers['Authorization'];
+        delete config.headers[ACCOUNT_HEADER];
+        if (this.usesSession()) {
+            config.headers[ACCOUNT_HEADER] = this.sessionAccount();
+            config.withCredentials = true;
+        } else if (this.configuration.accessToken) {
+            config.headers['Authorization'] = this.configuration.accessToken;
+        }
+        return config;
+    }
+
+    // Both keeps the token, so a session call the browser could not complete can be sent again with it.
+    private canRetryWithToken(config: AxiosRequestConfig): boolean {
+        return !!config.withCredentials && !!config.headers?.[ACCOUNT_HEADER]
+            && !!this.tokenData.accessToken && this.tokenData.authMode !== 'session';
+    }
+
+    // A network error can come after the server ran the call, so only a call that is safe to repeat is sent again.
+    private canResend(config: AxiosRequestConfig): boolean {
+        return RESEND_SAFE_METHODS.indexOf((config.method || 'get').toLowerCase()) !== -1
+            || Object.keys(config.headers || {}).some((name) => name.toLowerCase() === 'idempotency-key');
+    }
+
+    private switchToToken() {
+        this.useHeaderAuth(this.tokenData.accessToken);
+        this.storeTokenData(this.tokenData);
+    }
+
+    private retryWithToken(axios: AxiosInstance, config: AxiosRequestConfig) {
+        this.switchToToken();
+        config.withCredentials = false;
+        return axios(this.withCurrentAuth(config));
     }
 
     selectEnvironment(env: Environment) {
@@ -139,8 +258,8 @@ export class BaseAPI {
     async authorize(username: string, password: string, targetWorkspace?: string): Promise<void> {
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/login`,
-            headers: { 'Content-Type': 'application/json' },
+            url: `${this.authBasePath()}/authservice/v1/login`,
+            headers: { 'Content-Type': 'application/json', ...(this.configuration.cookieAuth && { [AUTH_MODE_HEADER]: 'session' }) },
             data: {
                 username,
                 password,
@@ -150,15 +269,10 @@ export class BaseAPI {
 
         const response = await globalAxios.request<LoginClass>(options);
 
-        const { data: { accessToken, permissions } } = response;
-
         this.configuration.username = username;
         this.tokenData.username = username;
-        this.tokenData.permissions = permissions;
-        if (!this.configuration.cookieAuth) {
-            this.configuration.accessToken = `Bearer ${accessToken}`;
-            this.tokenData.accessToken = accessToken;
-        }
+        this.tokenData.permissions = response.data.permissions;
+        this.applyTokenReply(response.data);
 
     }
 
@@ -182,9 +296,10 @@ export class BaseAPI {
 
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/refresh-token`,
+            url: `${this.authBasePath()}/authservice/v1/refresh-token`,
             headers: {
                 'Content-Type': 'application/json',
+                ...this.sessionHeaders(),
             },
             data: { username: username },
             withCredentials: true,
@@ -196,11 +311,6 @@ export class BaseAPI {
 
     private storeTokenData(tokenData?: TokenData) {
         if (typeof window !== 'undefined') {
-            if (tokenData && this.configuration?.cookieAuth) {
-                // Cookie mode saves who is logged in, never the token; a token saved by apps not yet migrated stays.
-                const { username, permissions } = tokenData;
-                tokenData = { ...(defaultStorage().get<TokenData>(TOKEN_DATA) || {}), username, permissions };
-            }
             defaultStorage().set<TokenData>(TOKEN_DATA, tokenData);
         }
     }
@@ -230,22 +340,22 @@ export class BaseAPI {
                         && !originalConfig._retry) {
                         originalConfig._retry = true;
                         try {
-                            const { accessToken: tokenString, permissions } = await this.refreshTokenInternal();
-                            this.tokenData.permissions = permissions;
-
-                            delete originalConfig.headers['Authorization']
+                            const reply = await this.refreshTokenInternal();
+                            this.tokenData.permissions = reply.permissions;
+                            this.applyTokenReply(reply);
+                            this.storeTokenData(this.tokenData);
 
-                            // In cookie mode the refresh reply renewed the access cookie, so retry without a header.
-                            if (!this.configuration.cookieAuth) {
-                                const accessToken = `Bearer ${tokenString}`;
-                                originalConfig.headers['Authorization'] = accessToken;
-                                this.configuration.accessToken = accessToken;
-                                this.tokenData.accessToken = tokenString;
+                            if (!this.usesSession()) {
+                                return axios(this.withCurrentAuth(originalConfig));
                             }
 
-                            this.storeTokenData(this.tokenData);
-
-                            return axios(originalConfig);
+                            // Both mode: if the browser does not send the session cookie (another site), use the token.
+                            return axios(this.withCurrentAuth(originalConfig)).catch((retryError) => {
+                                if (retryError?.response?.status !== 401 || !this.tokenData.accessToken) {
+                                    return Promise.reject(retryError);
+                                }
+                                return this.retryWithToken(axios, originalConfig);
+                            });
                         } catch (_error) {
                             if (_error.response && _error.response.data) {
                                 return Promise.reject(_error.response.data);
@@ -253,26 +363,30 @@ export class BaseAPI {
                             return Promise.reject(_error);
                         }
                     }
+                } else if (err.message === NETWORK_ERROR_MESSAGE && this.canRetryWithToken(originalConfig)) {
+                    // Both mode: the browser blocked the session call or hid its reply; later calls use the token.
+                    if (!this.canResend(originalConfig)) {
+                        this.switchToToken();
+                        return Promise.reject(err);
+                    }
+                    return this.retryWithToken(axios, originalConfig);
                 } else if (err.message === NETWORK_ERROR_MESSAGE
-                    && originalConfig.headers.hasOwnProperty('Authorization')
+                    && (originalConfig.headers.hasOwnProperty('Authorization')
+                        || (this.configuration.cookieAuth && originalConfig.withCredentials && this.canResend(originalConfig)))
                     && _retry_count < 4
                 ) {
                     _retry_count++;
                     try {
-                        const { accessToken: tokenString, permissions } = await this.refreshTokenInternal();
-                        const accessToken = `Bearer ${tokenString}`;
-                        this.tokenData.permissions = permissions;
+                        // In session mode an unreadable 401 (no CORS headers on the error reply) also lands here.
+                        const reply = await this.refreshTokenInternal();
+                        this.tokenData.permissions = reply.permissions;
 
                         _retry = true;
-                        originalConfig.headers['Authorization'] = accessToken;
-
-                        this.configuration.accessToken = accessToken;
-                        this.tokenData.accessToken = tokenString;
-
+                        this.applyTokenReply(reply);
                         this.storeTokenData(this.tokenData);
 
                         return axios.request({
-                            ...originalConfig,
+                            ...this.withCurrentAuth(originalConfig),
                         });
                     } catch (_error) {
                         if (_error.response && _error.response.data) {

package/common.ts

@@ -130,9 +130,10 @@ export const toPathString = function (url: URL) {
  * @export
  */
 export const createRequestFunction = function (axiosArgs: RequestArgs, globalAxios: AxiosInstance, BASE_PATH: string, configuration?: Configuration) {
-    return <T = unknown, R = AxiosResponse<T>>(axios: AxiosInstance = globalAxios, basePath: string = BASE_PATH) => {
+    // Typed by hand: since axios 1.20, request() returns an internal axios type that SDK declarations cannot name.
+    return <T = unknown, R = AxiosResponse<T>>(axios: AxiosInstance = globalAxios, basePath: string = BASE_PATH): Promise<R> => {
         const axiosRequestArgs = {...axiosArgs.options, url: (configuration?.basePath || basePath) + axiosArgs.url};
-        return axios.request<T, R>(axiosRequestArgs);
+        return axios.request<T, R>(axiosRequestArgs) as Promise<R>;
     };
 }
 

package/configuration.ts

@@ -22,6 +22,7 @@ export interface ConfigurationParameters {
     baseOptions?: any;
     formDataCtor?: new () => any;
     cookieAuth?: boolean;
+    account?: string;
 }
 
 export class Configuration {
@@ -76,13 +77,20 @@ export class Configuration {
     formDataCtor?: new () => any;
 
     /**
-     * Authenticate with the HttpOnly access cookie instead of a stored token: every call sends credentials.
-     * The browser holds one cookie, so use it with one logged-in account; log out through the auth service.
+     * Use a server session when authservice makes one; otherwise the token, as without this option.
+     * Set `account` too, so each SDK object keeps its own account.
      *
      * @type {boolean}
      * @memberof Configuration
      */
     cookieAuth?: boolean;
+    /**
+     * The session account (Cognito sub) this app shows, so the SDK never takes another tab's account.
+     *
+     * @type {string}
+     * @memberof Configuration
+     */
+    account?: string;
 
     constructor(param: ConfigurationParameters = {}) {
         this.apiKey = param.apiKey;
@@ -93,6 +101,7 @@ export class Configuration {
         this.baseOptions = param.baseOptions;
         this.formDataCtor = param.formDataCtor;
         this.cookieAuth = param.cookieAuth;
+        this.account = param.account;
     }
 
     /**

package/dist/api/health-api.d.ts

@@ -66,5 +66,5 @@ export declare class HealthApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof HealthApi
      */
-    check(options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<InlineResponse200, any, {}>>;
+    check(options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<InlineResponse200, any, {}, any>>;
 }