@fluidframework/odsp-driver 3.0.2 → 3.1.0

package/src/pointInTimeDriver/odspPointInTimeDocumentService.ts

@@ -4,16 +4,45 @@
  */
 
 import { TypedEventEmitter } from "@fluid-internal/client-utils";
-import type {
-	IClient,
-	IDocumentDeltaConnection,
-	IDocumentDeltaStorageService,
-	IDocumentService,
-	IDocumentServiceEvents,
-	IDocumentServicePolicies,
-	IDocumentStorageService,
-	IResolvedUrl,
+import {
+	FetchSource,
+	type IClient,
+	type IDocumentDeltaConnection,
+	type IDocumentDeltaStorageService,
+	type IDocumentService,
+	type IDocumentServiceEvents,
+	type IDocumentServicePolicies,
+	type IDocumentStorageService,
+	type IResolvedUrl,
+	type ISnapshot,
+	type ISnapshotFetchOptions,
+	type IVersion,
 } from "@fluidframework/driver-definitions/internal";
+import { DocumentStorageServiceProxy } from "@fluidframework/driver-utils/internal";
+
+/**
+ * Forces point-in-time snapshot reads to bypass caches while forwarding all other storage operations
+ * to the selected historical document service.
+ */
+class PointInTimeDocumentStorageService extends DocumentStorageServiceProxy {
+	public override async getSnapshot(
+		snapshotFetchOptions?: ISnapshotFetchOptions,
+	): Promise<ISnapshot> {
+		return super.getSnapshot({
+			...snapshotFetchOptions,
+			fetchSource: FetchSource.noCache,
+		});
+	}
+
+	public override async getVersions(
+		// eslint-disable-next-line @rushstack/no-new-null -- IDocumentStorageService is a legacy API that requires null.
+		versionId: string | null,
+		count: number,
+		scenarioName?: string,
+	): Promise<IVersion[]> {
+		return super.getVersions(versionId, count, scenarioName, FetchSource.noCache);
+	}
+}
 
 /**
  * A read-only document service that materializes a document at a target sequence number by combining
@@ -64,7 +93,8 @@ export class OdspPointInTimeDocumentService
 	}
 
 	public async connectToStorage(): Promise<IDocumentStorageService> {
-		return this.recoverableDocumentService.connectToStorage();
+		const storage = await this.recoverableDocumentService.connectToStorage();
+		return new PointInTimeDocumentStorageService(storage);
 	}
 
 	public async connectToDeltaStorage(): Promise<IDocumentDeltaStorageService> {

package/src/prefetchLatestSnapshot.ts

@@ -113,6 +113,9 @@ export async function prefetchLatestSnapshot(
 			odspLogger,
 			undefined,
 			controller,
+			undefined,
+			undefined,
+			odspDocumentServiceFactory?.requestHeaders,
 		);
 	};
 	const snapshotKey = createCacheSnapshotKey(odspResolvedUrl, useGroupIdsForSnapshotFetch);
@@ -150,6 +153,7 @@ export async function prefetchLatestSnapshot(
 				removeEntries,
 				loadingGroupIds,
 				enableRedeemFallback,
+				odspDocumentServiceFactory?.requestHeaders,
 			)
 				.then(async (value) => {
 					assert(!!snapshotEpoch, 0x585 /* prefetched snapshot should have a valid epoch */);

package/src/requestHeaders.ts

@@ -0,0 +1,56 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+const driverOwnedHeaderNames = new Set([
+	"authorization",
+	"content-type",
+	"x-fluid-epoch",
+	"x-http-method-override",
+	"x-requeststats",
+]);
+
+/**
+ * Creates an immutable snapshot of host-provided per-session headers after removing names owned by
+ * the ODSP driver. The factory, URL resolver, epoch tracker, and Socket.IO connection use the
+ * returned value so later host mutations cannot change an active document session or override
+ * authentication and protocol headers.
+ */
+export function copyRequestHeaders(
+	requestHeaders: Readonly<Record<string, string>> | undefined,
+): Readonly<Record<string, string>> | undefined {
+	if (requestHeaders === undefined || Object.keys(requestHeaders).length === 0) {
+		return undefined;
+	}
+	const copiedHeaders = Object.fromEntries(
+		Object.entries(requestHeaders).filter(
+			([name]) => !driverOwnedHeaderNames.has(name.toLowerCase()),
+		),
+	);
+	return Object.keys(copiedHeaders).length === 0 ? undefined : Object.freeze(copiedHeaders);
+}
+
+/**
+ * Adds sanitized host headers to one ODSP request. Request-specific headers are applied last, so
+ * driver-generated values win case-insensitive collisions. ODSP fetch paths use this helper for
+ * snapshot, delta, blob, share-link, file-link, and version requests; Socket.IO applies the copied
+ * headers separately as Node.js `extraHeaders`.
+ */
+export function mergeRequestHeaders(
+	hostHeaders: Readonly<Record<string, string>> | undefined,
+	requestHeaders: HeadersInit | undefined,
+): HeadersInit | undefined {
+	const safeHostHeaders = copyRequestHeaders(hostHeaders);
+	if (safeHostHeaders === undefined) {
+		return requestHeaders;
+	}
+
+	const merged = new Headers(safeHostHeaders);
+	if (requestHeaders !== undefined) {
+		for (const [key, value] of new Headers(requestHeaders)) {
+			merged.set(key, value);
+		}
+	}
+	return Object.fromEntries(merged);
+}