@faable/auth-sdk 2.7.21 → 2.7.22

package/README.md

@@ -170,7 +170,7 @@ await api.fetcher.get(`/user/${id}`, { timeout: 800, retry: false });
 | `authStrategy` | strategy builder                      | Auth strategy (`authClientCredentials` \| `authApikey` \| `authBearer` \| `authCookie`), re-exported from `@faable/auth-sdk`. Defaults to `authClientCredentials` when `auth` is given; anonymous when neither is. |
 | `auth`         | config                                | Config for the chosen strategy. Its shape is inferred from `authStrategy` (e.g. `{ client_id, client_secret }`).            |
 | `debug`        | boolean                               | Enables verbose logging in the underlying fetcher.                                                                          |
-| `headers`      | `{ team_id?; account_id? }`           | Advanced / testing escape hatch — target `domain` but have the server resolve a different team/account (sent as `x-faable-team` / `x-faableauth-account`). |
+| `headers`      | `{ project_id?; account_id? }`        | Advanced / testing escape hatch — target `domain` but have the server resolve a different project/account (sent as `x-faable-project` / `x-faableauth-account`). `team_id` is a deprecated alias of `project_id`: a `team_<hex>` value is sent as `project_<hex>`, and passing both with different ids throws. The SDK no longer sends `x-faable-team`. |
 | `clientInfo`   | `{ client?; name?; instance? }`       | How this integration identifies itself (`x-faable-client` / `x-faable-instance`). `client` replaces the SDK's own `auth-sdk/<version>+<sha>`. |
 
 ---

package/dist/FaableAuthApi.d.ts

@@ -9,10 +9,22 @@ type FaableAuthApiParams = {
      * dashboard and some tests need this (e.g. point at a concrete host but
      * resolve another account) — it is intentionally kept out of the normal
      * config surface. Maps to:
-     *   - `team_id`    → `x-faable-team`
+     *   - `project_id` → `x-faable-project` (`project_<hex>`)
+     *   - `team_id`    → `x-faable-project` too (deprecated alias, see below)
      *   - `account_id` → `x-faableauth-account`
+     *
+     * A project and a team are the same object under two prefixes (same hex
+     * suffix). The SDK never sends the deprecated `x-faable-team` header.
      */
     headers?: {
+        /** Project to resolve, `project_<hex>`. Sent as `x-faable-project`. */
+        project_id?: string;
+        /**
+         * @deprecated use `project_id`. A `team_<hex>` value is rewritten to
+         * `project_<hex>` and sent as `x-faable-project`; `x-faable-team` is no
+         * longer sent. Giving both `project_id` and `team_id` is allowed only when
+         * they name the same project.
+         */
         team_id?: string;
         account_id?: string;
     };

package/dist/FaableAuthApi.js

@@ -42,6 +42,25 @@ const discoverManagementAudience = (baseURL) => {
 };
 // Testing seam: the memo outlives any single api instance.
 export const __resetAudienceCacheForTests = () => audience_by_host.clear();
+// `team_<hex>` and `project_<hex>` are the same object; the canonical form on
+// the wire is `project_`. Idempotent: a `project_` (or unprefixed) value is
+// returned as is.
+const toProjectId = (id) => id.startsWith("team_") ? `project_${id.slice("team_".length)}` : id;
+// Resolve `headers.project_id` / the deprecated `headers.team_id` alias to the
+// single `x-faable-project` value. Conflicting ids throw here, at construction,
+// rather than as a 400 from the server on the first call.
+const resolveProjectHeader = (headers) => {
+    const from_project = headers?.project_id
+        ? toProjectId(headers.project_id)
+        : undefined;
+    const from_team = headers?.team_id ? toProjectId(headers.team_id) : undefined;
+    if (from_project && from_team && from_project !== from_team) {
+        throw new FaableApiError(`FaableAuthApi: \`headers.project_id\` (${headers?.project_id}) and the ` +
+            `deprecated \`headers.team_id\` (${headers?.team_id}) name different ` +
+            "projects. Pass only `project_id`.");
+    }
+    return from_project ?? from_team;
+};
 export class FaableAuthApi extends GeneratedFaableAuthApi {
     constructor(params) {
         if (!params?.domain) {
@@ -50,6 +69,7 @@ export class FaableAuthApi extends GeneratedFaableAuthApi {
                 "The hardcoded default was removed so SDK calls never target another tenant by accident.");
         }
         const baseURL = getDomain(params.domain);
+        const project_id = resolveProjectHeader(params.headers);
         // When authenticating via client_credentials without an explicit audience,
         // default it to this tenant's management audience (discovered from the
         // domain). Only when the resolved strategy is client_credentials — an
@@ -89,9 +109,7 @@ export class FaableAuthApi extends GeneratedFaableAuthApi {
                 ...params?.fetcher,
                 headers: {
                     ...params?.fetcher?.headers,
-                    ...(params?.headers?.team_id && {
-                        "x-faable-team": params.headers.team_id,
-                    }),
+                    ...(project_id && { "x-faable-project": project_id }),
                     ...(params?.headers?.account_id && {
                         "x-faableauth-account": params.headers.account_id,
                     }),

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.21";
+export const version = "2.7.22";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "eda9c4d";
+export const commit = "49d06d3";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.21",
+  "version": "2.7.22",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",