@esri/telemetry-amazon 5.1.2 → 5.1.4

package/dist/umd/telemetry-amazon.min.js

@@ -538,6 +538,168 @@
         }
     }
 
+    /* istanbul ignore file */
+    // Note: currently this is all internal to the package, and we are not exposing
+    // anything that a user can set... but we need all this to be able to ensure
+    // that multiple instances of the package can share the same config.
+    /**
+     * The default config for the request module. This is used to store
+     * the no-cors domains and pending requests.
+     */
+    const DEFAULT_ARCGIS_REQUEST_CONFIG = {
+        noCorsDomains: [],
+        crossOriginNoCorsDomains: {},
+        pendingNoCorsRequests: {}
+    };
+    const GLOBAL_VARIABLE_NAME = "ARCGIS_REST_JS_NO_CORS";
+    // Set the global variable to the default config if it is not aleady defined
+    // This is done to ensure that all instances of rest-request work with a single
+    // instance of the config
+    if (!globalThis[GLOBAL_VARIABLE_NAME]) {
+        globalThis[GLOBAL_VARIABLE_NAME] = Object.assign({}, DEFAULT_ARCGIS_REQUEST_CONFIG);
+    }
+    // export the settings as immutable consts that read from the global config
+    const requestConfig = globalThis[GLOBAL_VARIABLE_NAME];
+
+    /**
+     * Send a no-cors request to the passed uri. This is used to pick up
+     * a cookie from a 3rd party server to meet a requirement of some authentication
+     * flows.
+     * @param url
+     * @returns
+     */
+    function sendNoCorsRequest(url) {
+        // drop any query params, other than f=json
+        const urlObj = new URL(url);
+        url = urlObj.origin + urlObj.pathname;
+        if (urlObj.search.includes("f=json")) {
+            url += "?f=json";
+        }
+        const origin = urlObj.origin;
+        // If we have already sent a no-cors request to this url, return the promise
+        // so we don't send multiple requests
+        if (requestConfig.pendingNoCorsRequests[origin]) {
+            return requestConfig.pendingNoCorsRequests[origin];
+        }
+        // Make the request and add to the cache
+        requestConfig.pendingNoCorsRequests[origin] = fetch(url, {
+            mode: "no-cors",
+            credentials: "include",
+            cache: "no-store"
+        })
+            .then((response) => {
+            // Add to the list of cross-origin no-cors domains
+            // if the domain is not already in the list
+            if (requestConfig.noCorsDomains.indexOf(origin) === -1) {
+                requestConfig.noCorsDomains.push(origin);
+            }
+            // Hold the timestamp of this request so we can decide when to
+            // send another request to this domain
+            requestConfig.crossOriginNoCorsDomains[origin.toLowerCase()] = Date.now();
+            // Remove the pending request from the cache
+            delete requestConfig.pendingNoCorsRequests[origin];
+            // Due to limitations of fetchMock at the version of the tooling
+            // in this project, we can't mock the response type of a no-cors request
+            // and thus we can't test this. So we are going to comment this out
+            // and leave it in place for now. If we need to test this, we can
+            // update the tooling to a version that supports this. Also
+            // JS SDK does not do this check, so we are going to leave it out for now.
+            // ================================================================
+            // no-cors requests are opaque to javascript
+            // and thus will always return a response with a type of "opaque"
+            // if (response.type === "opaque") {
+            //   return Promise.resolve();
+            // } else {
+            //   // Not sure if this is possible, but since we have a check above
+            //   // lets handle the else case
+            //   return Promise.reject(
+            //     new Error(`no-cors request to ${origin} not opaque`)
+            //   );
+            // }
+            // ================================================================
+        })
+            .catch((e) => {
+            // Not sure this is necessary, but if the request fails
+            // we should remove it from the pending requests
+            // and return a rejected promise with some information
+            delete requestConfig.pendingNoCorsRequests[origin];
+            return Promise.reject(new Error(`no-cors request to ${origin} failed`));
+        });
+        // return the promise
+        return requestConfig.pendingNoCorsRequests[origin];
+    }
+    /**
+     * Register the domains that are allowed to be used in no-cors requests
+     * This is called by `request` when the portal/self response is intercepted
+     * and the `.authorizedCrossOriginNoCorsDomains` property is set.
+     * @param authorizedCrossOriginNoCorsDomains
+     */
+    function registerNoCorsDomains(authorizedCrossOriginNoCorsDomains) {
+        // register the domains
+        authorizedCrossOriginNoCorsDomains.forEach((domain) => {
+            // ensure domain is lower case and ensure protocol is included
+            domain = domain.toLowerCase();
+            if (/^https?:\/\//.test(domain)) {
+                addNoCorsDomain(domain);
+            }
+            else {
+                // no protocol present, so add http and https
+                addNoCorsDomain("http://" + domain);
+                addNoCorsDomain("https://" + domain);
+            }
+        });
+    }
+    /**
+     * Ensure we don't get duplicate domains in the no-cors domains list
+     * @param domain
+     */
+    function addNoCorsDomain(url) {
+        // Since the caller of this always ensures a protocol is present
+        // we can safely use the URL constructor to get the origin
+        // and add it to the no-cors domains list
+        const uri = new URL(url);
+        const domain = uri.origin;
+        if (requestConfig.noCorsDomains.indexOf(domain) === -1) {
+            requestConfig.noCorsDomains.push(domain);
+        }
+    }
+    /**
+     *  Is the origin of the passed url in the no-cors domains list?
+     * @param url
+     * @returns
+     */
+    function isNoCorsDomain(url) {
+        let result = false;
+        if (requestConfig.noCorsDomains.length) {
+            // is the current url in the no-cors domains?
+            const origin = new URL(url).origin.toLowerCase();
+            result = requestConfig.noCorsDomains.some((domain) => {
+                return origin.includes(domain);
+            });
+        }
+        return result;
+    }
+    /**
+     * Is the origin of the passed url in the no-cors domains list
+     * and do we need to send a no-cors request?
+     *
+     * @param url
+     * @returns
+     */
+    function isNoCorsRequestRequired(url) {
+        let result = false;
+        // is the current origin in the no-cors domains?
+        if (isNoCorsDomain(url)) {
+            const origin = new URL(url).origin.toLowerCase();
+            // check if we have sent a no-cors request to this domain in the last hour
+            const lastRequest = requestConfig.crossOriginNoCorsDomains[origin] || 0;
+            if (Date.now() - 60 * 60000 > lastRequest) {
+                result = true;
+            }
+        }
+        return result;
+    }
+
     /* Copyright (c) 2017-2018 Environmental Systems Research Institute, Inc.
      * Apache-2.0 */
     /**
@@ -558,6 +720,28 @@
       });
     }
 
+    /**
+     * Is the given URL the same origin as the current window?
+     * Used to determine if we need to do any additional cross-origin
+     * handling for the request.
+     * @param url
+     * @param win - optional window object to use for origin comparison
+     *             (useful for testing)
+     * @returns
+     */
+    function isSameOrigin(url, win) {
+        var _a;
+        /* istanbul ignore next */
+        if ((!win && !window) || !url) {
+            return false;
+        }
+        else {
+            win = win || window;
+            const origin = (_a = win.location) === null || _a === void 0 ? void 0 : _a.origin;
+            return url.startsWith(origin);
+        }
+    }
+
     /* Copyright (c) 2017-2018 Environmental Systems Research Institute, Inc.
      * Apache-2.0 */
     const NODEJS_DEFAULT_REFERER_HEADER = `@esri/arcgis-rest-js`;
@@ -713,6 +897,10 @@
             needed to support sending IWA cookies */
             credentials: options.credentials || "same-origin"
         };
+        // Is this a no-cors domain? if so we need to set credentials to include
+        if (isNoCorsDomain(url)) {
+            fetchOptions.credentials = "include";
+        }
         // the /oauth2/platformSelf route will add X-Esri-Auth-Client-Id header
         // and that request needs to send cookies cross domain
         // so we need to set the credentials to "include"
@@ -748,7 +936,31 @@
         // for errors in GET requests we want the URL passed to the error to be the URL before
         // query params are applied.
         const originalUrl = url;
-        return (authentication
+        // default to false, for nodejs
+        let sameOrigin = false;
+        // if we are in a browser, check if the url is same origin
+        /* istanbul ignore else */
+        if (typeof window !== "undefined") {
+            sameOrigin = isSameOrigin(url);
+        }
+        const requiresNoCors = !sameOrigin && isNoCorsRequestRequired(url);
+        // the /oauth2/platformSelf route will add X-Esri-Auth-Client-Id header
+        // and that request needs to send cookies cross domain
+        // so we need to set the credentials to "include"
+        if (options.headers &&
+            options.headers["X-Esri-Auth-Client-Id"] &&
+            url.indexOf("/oauth2/platformSelf") > -1) {
+            fetchOptions.credentials = "include";
+        }
+        // Simple first promise that we may turn into the no-cors request
+        let firstPromise = Promise.resolve();
+        if (requiresNoCors) {
+            // ensure we send cookies on the request after
+            fetchOptions.credentials = "include";
+            firstPromise = sendNoCorsRequest(url);
+        }
+        return firstPromise
+            .then(() => authentication
             ? authentication.getToken(url).catch((err) => {
                 /**
                  * append original request url and requestOptions
@@ -791,7 +1003,8 @@
                 const urlWithQueryString = queryParams === "" ? url : url + "?" + encodeQueryString(params);
                 if (
                 // This would exceed the maximum length for URLs by 2000 as default or as specified by the consumer and requires POST
-                (options.maxUrlLength && urlWithQueryString.length > options.maxUrlLength) ||
+                (options.maxUrlLength &&
+                    urlWithQueryString.length > options.maxUrlLength) ||
                     (!options.maxUrlLength && urlWithQueryString.length > 2000) ||
                     // Or if the customer requires the token to be hidden and it has not already been hidden in the header (for browsers)
                     (params.token && options.hideToken)) {
@@ -889,6 +1102,14 @@
             // Most ArcGIS Server services will return a successful status code but include an error in the response body.
             if ((params.f === "json" || params.f === "geojson") && !rawResponse) {
                 const response = checkForErrors(data, originalUrl, params, options, originalAuthError);
+                // If this was a portal/self call, and we got authorizedNoCorsDomains back
+                // register them
+                if (data && /\/sharing\/rest\/(accounts|portals)\/self/i.test(url)) {
+                    // if we have a list of no-cors domains, register them
+                    if (Array.isArray(data.authorizedCrossOriginNoCorsDomains)) {
+                        registerNoCorsDomains(data.authorizedCrossOriginNoCorsDomains);
+                    }
+                }
                 if (originalAuthError) {
                     /* If the request was made to an unfederated service that
                     didn't require authentication, add the base url and a dummy token