@faable/auth-sdk 2.5.37 → 2.5.38

package/dist/FaableAuthApi.d.ts

@@ -1,5 +1,6 @@
 import { GeneratedFaableAuthApi } from "./api/generated-client.js";
 import { type ApiParams } from "@faable/sdk-base";
+export declare const __resetAudienceCacheForTests: () => void;
 type FaableAuthApiParams = {
     domain: string;
     /**

package/dist/FaableAuthApi.js

@@ -10,9 +10,17 @@ import { version } from "./version.js";
 // resolves the account by host and exposes its id as `account`) lazily on the
 // first token request, and memoize it. Omitting `scope` then yields the full
 // management catalog server-side (Auth0 parity), so no scope wiring is needed.
+//
+// The memo is module-level, keyed by host. It used to be a closure created per
+// constructor, so it only ever helped an instance that outlived several token
+// refreshes — and a multi-tenant consumer does the opposite: it builds one
+// instance per tenant (a tenant is scoped through the constructor `headers`),
+// so every one of them re-ran discovery. The account id a host resolves to does
+// not change, so caching it per host is the honest scope.
+const audience_by_host = new Map();
 const discoverManagementAudience = (baseURL) => {
-    let cached;
     return async () => {
+        const cached = audience_by_host.get(baseURL);
         if (cached)
             return cached;
         const url = `${baseURL}/.well-known/openid-configuration`;
@@ -27,10 +35,13 @@ const discoverManagementAudience = (baseURL) => {
                 "auth server may be older than the management-audience support. " +
                 "Pass `auth.audience` explicitly (faable:management:<account_id>).");
         }
-        cached = `faable:management:${doc.account}`;
-        return cached;
+        const audience = `faable:management:${doc.account}`;
+        audience_by_host.set(baseURL, audience);
+        return audience;
     };
 };
+// Testing seam: the memo outlives any single api instance.
+export const __resetAudienceCacheForTests = () => audience_by_host.clear();
 export class FaableAuthApi extends GeneratedFaableAuthApi {
     constructor(params) {
         if (!params?.domain) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.5.37",
+  "version": "2.5.38",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",