@enfuce/nextgen-sdk 0.0.4 → 0.0.5

package/dist/esm/oauth/axios.d.ts

@@ -1,13 +1,19 @@
 import { AxiosInstance } from 'axios';
 import { TokenManager } from './tokenManager';
 /**
- * Returns an {@link AxiosInstance} with a response interceptor that, on a `401`,
- * forces a token refresh and retries the request exactly once with the new bearer
- * token. Pass it as the third argument of a generated API class:
+ * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
+ *
+ * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
+ *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
+ * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
+ *   exactly once with the new bearer token.
+ *
+ * Pass it as the third argument of a generated API class:
  *
  * ```ts
  * const http = createOAuthAxios(tokens);
- * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
+ * const config = new card.Configuration({ basePath });
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */

package/dist/esm/oauth/axios.js

@@ -22,18 +22,29 @@ function stripBearer(header) {
         : header;
 }
 /**
- * Returns an {@link AxiosInstance} with a response interceptor that, on a `401`,
- * forces a token refresh and retries the request exactly once with the new bearer
- * token. Pass it as the third argument of a generated API class:
+ * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
+ *
+ * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
+ *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
+ * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
+ *   exactly once with the new bearer token.
+ *
+ * Pass it as the third argument of a generated API class:
  *
  * ```ts
  * const http = createOAuthAxios(tokens);
- * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
+ * const config = new card.Configuration({ basePath });
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
 export function createOAuthAxios(manager, instance) {
     const http = instance !== null && instance !== void 0 ? instance : axios.create();
+    // Proactive: attach a fresh bearer token to every outgoing request.
+    http.interceptors.request.use((config) => __awaiter(this, void 0, void 0, function* () {
+        config.headers.set('Authorization', BEARER_PREFIX + (yield manager.getToken()));
+        return config;
+    }));
     http.interceptors.response.use(undefined, (error) => __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
         const response = error.response;

package/dist/esm/oauth/index.js

@@ -13,10 +13,13 @@
  *     clientSecret: 'my-secret',
  *     scopes: ['cards:read'],
  *   });
- *   const http = oauth.createOAuthAxios(tokens);
- *   const config = new card.Configuration({ accessToken: () => tokens.getToken() });
+ *   const http = oauth.createOAuthAxios(tokens); // attaches the token + retries on 401
+ *   const config = new card.Configuration({ basePath: 'https://api.example.com' });
  *   const api = new card.CardApi(config, undefined, http);
  *
+ * The same `http` instance authenticates every API module, including ones whose spec declares no
+ * security scheme (e.g. exchange-rate) — no `accessToken` on the `Configuration` is required.
+ *
  * Server-side only — a client secret must never ship to a browser.
  */
 export { TokenManager } from './tokenManager';

package/dist/oauth/axios.d.ts

@@ -1,13 +1,19 @@
 import { AxiosInstance } from 'axios';
 import { TokenManager } from './tokenManager';
 /**
- * Returns an {@link AxiosInstance} with a response interceptor that, on a `401`,
- * forces a token refresh and retries the request exactly once with the new bearer
- * token. Pass it as the third argument of a generated API class:
+ * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
+ *
+ * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
+ *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
+ * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
+ *   exactly once with the new bearer token.
+ *
+ * Pass it as the third argument of a generated API class:
  *
  * ```ts
  * const http = createOAuthAxios(tokens);
- * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
+ * const config = new card.Configuration({ basePath });
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */

package/dist/oauth/axios.js

@@ -25,18 +25,29 @@ function stripBearer(header) {
         : header;
 }
 /**
- * Returns an {@link AxiosInstance} with a response interceptor that, on a `401`,
- * forces a token refresh and retries the request exactly once with the new bearer
- * token. Pass it as the third argument of a generated API class:
+ * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
+ *
+ * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
+ *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
+ * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
+ *   exactly once with the new bearer token.
+ *
+ * Pass it as the third argument of a generated API class:
  *
  * ```ts
  * const http = createOAuthAxios(tokens);
- * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
+ * const config = new card.Configuration({ basePath });
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
 function createOAuthAxios(manager, instance) {
     const http = instance !== null && instance !== void 0 ? instance : axios_1.default.create();
+    // Proactive: attach a fresh bearer token to every outgoing request.
+    http.interceptors.request.use((config) => __awaiter(this, void 0, void 0, function* () {
+        config.headers.set('Authorization', BEARER_PREFIX + (yield manager.getToken()));
+        return config;
+    }));
     http.interceptors.response.use(undefined, (error) => __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
         const response = error.response;

package/dist/oauth/index.js

@@ -16,10 +16,13 @@ exports.createOAuthAxios = exports.clientCredentialsFetcher = exports.clientCred
  *     clientSecret: 'my-secret',
  *     scopes: ['cards:read'],
  *   });
- *   const http = oauth.createOAuthAxios(tokens);
- *   const config = new card.Configuration({ accessToken: () => tokens.getToken() });
+ *   const http = oauth.createOAuthAxios(tokens); // attaches the token + retries on 401
+ *   const config = new card.Configuration({ basePath: 'https://api.example.com' });
  *   const api = new card.CardApi(config, undefined, http);
  *
+ * The same `http` instance authenticates every API module, including ones whose spec declares no
+ * security scheme (e.g. exchange-rate) — no `accessToken` on the `Configuration` is required.
+ *
  * Server-side only — a client secret must never ship to a browser.
  */
 var tokenManager_1 = require("./tokenManager");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enfuce/nextgen-sdk",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Enfuce nextgen client SDK (TypeScript). One namespaced export per API.",
   "publishConfig": {
     "access": "public"

package/src/oauth/axios.ts

@@ -19,19 +19,31 @@ function stripBearer(header: string): string {
 }
 
 /**
- * Returns an {@link AxiosInstance} with a response interceptor that, on a `401`,
- * forces a token refresh and retries the request exactly once with the new bearer
- * token. Pass it as the third argument of a generated API class:
+ * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
+ *
+ * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
+ *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
+ * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
+ *   exactly once with the new bearer token.
+ *
+ * Pass it as the third argument of a generated API class:
  *
  * ```ts
  * const http = createOAuthAxios(tokens);
- * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
+ * const config = new card.Configuration({ basePath });
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
 export function createOAuthAxios(manager: TokenManager, instance?: AxiosInstance): AxiosInstance {
     const http = instance ?? axios.create();
 
+    // Proactive: attach a fresh bearer token to every outgoing request.
+    http.interceptors.request.use(async (config) => {
+        config.headers.set('Authorization', BEARER_PREFIX + (await manager.getToken()));
+        return config;
+    });
+
     http.interceptors.response.use(undefined, async (error: AxiosError) => {
         const response = error.response;
         const original = error.config as RetriableConfig | undefined;

package/src/oauth/index.ts

@@ -13,10 +13,13 @@
  *     clientSecret: 'my-secret',
  *     scopes: ['cards:read'],
  *   });
- *   const http = oauth.createOAuthAxios(tokens);
- *   const config = new card.Configuration({ accessToken: () => tokens.getToken() });
+ *   const http = oauth.createOAuthAxios(tokens); // attaches the token + retries on 401
+ *   const config = new card.Configuration({ basePath: 'https://api.example.com' });
  *   const api = new card.CardApi(config, undefined, http);
  *
+ * The same `http` instance authenticates every API module, including ones whose spec declares no
+ * security scheme (e.g. exchange-rate) — no `accessToken` on the `Configuration` is required.
+ *
  * Server-side only — a client secret must never ship to a browser.
  */
 export { AccessToken, TokenFetcher, TokenManager } from './tokenManager';

package/test/oauth.test.ts

@@ -139,6 +139,25 @@ describe('clientCredentialsFetcher', () => {
 });
 
 describe('createOAuthAxios', () => {
+  it('proactively attaches a bearer token to a request that has no Authorization header', async () => {
+    const { fetch, calls } = countingFetcher();
+    const mgr = new TokenManager(fetch, 60, makeClock().now);
+
+    const seenAuth: (string | undefined)[] = [];
+    const adapter: AxiosAdapter = async (config) => {
+      seenAuth.push(config.headers?.Authorization as string | undefined);
+      return { data: { ok: true }, status: 200, statusText: 'OK', headers: {}, config };
+    };
+    const http = createOAuthAxios(mgr, axios.create({ adapter }));
+
+    // No Authorization header supplied — the SDK must attach one (as for a no-security-scheme spec).
+    const response = await http.request({ url: 'http://localhost/v1/ecb/currencies', method: 'get' });
+
+    expect(response.status).toBe(200);
+    expect(seenAuth).toEqual(['Bearer token-1']);
+    expect(calls.n).toBe(1);
+  });
+
   it('retries the request with a refreshed token when the first call rejects with 401', async () => {
     const { fetch } = countingFetcher();
     const mgr = new TokenManager(fetch, 60, makeClock().now);