@geekmidas/client 0.4.0 → 0.5.0

package/src/auth-fetcher.ts

@@ -1,10 +1,10 @@
 import { TypedFetcher } from './fetcher';
 import type {
-  ExtractEndpointResponse,
-  FetcherOptions,
-  FilteredRequestConfig,
-  TypedApiFunction,
-  TypedEndpoint,
+	ExtractEndpointResponse,
+	FetcherOptions,
+	FilteredRequestConfig,
+	TypedApiFunction,
+	TypedEndpoint,
 } from './types';
 
 export type { FetcherOptions } from './types';
@@ -13,15 +13,15 @@ export type { FetcherOptions } from './types';
  * Security scheme object matching OpenAPI 3.1 specification.
  */
 export interface SecuritySchemeObject {
-  type: 'apiKey' | 'http' | 'mutualTLS' | 'oauth2' | 'openIdConnect';
-  description?: string;
-  name?: string;
-  in?: 'query' | 'header' | 'cookie';
-  scheme?: string;
-  bearerFormat?: string;
-  flows?: Record<string, unknown>;
-  openIdConnectUrl?: string;
-  [key: string]: unknown;
+	type: 'apiKey' | 'http' | 'mutualTLS' | 'oauth2' | 'openIdConnect';
+	description?: string;
+	name?: string;
+	in?: 'query' | 'header' | 'cookie';
+	scheme?: string;
+	bearerFormat?: string;
+	flows?: Record<string, unknown>;
+	openIdConnectUrl?: string;
+	[key: string]: unknown;
 }
 
 /**
@@ -29,7 +29,7 @@ export interface SecuritySchemeObject {
  * This gives us the union of scheme names that endpoints require.
  */
 export type UsedSecuritySchemes<
-  EndpointAuth extends Record<string, string | null>,
+	EndpointAuth extends Record<string, string | null>,
 > = NonNullable<EndpointAuth[keyof EndpointAuth]>;
 
 /**
@@ -37,48 +37,48 @@ export type UsedSecuritySchemes<
  * Compatible with @geekmidas/auth TokenClient.
  */
 export interface TokenProvider {
-  /**
-   * Get a valid access token, refreshing if necessary.
-   */
-  getValidAccessToken(): Promise<string | null>;
+	/**
+	 * Get a valid access token, refreshing if necessary.
+	 */
+	getValidAccessToken(): Promise<string | null>;
 
-  /**
-   * Create Authorization headers from the current token.
-   */
-  createValidAuthHeaders(): Promise<Record<string, string>>;
+	/**
+	 * Create Authorization headers from the current token.
+	 */
+	createValidAuthHeaders(): Promise<Record<string, string>>;
 }
 
 /**
  * Interface for API key providers.
  */
 export interface ApiKeyProvider {
-  /**
-   * Get the API key value.
-   */
-  getApiKey(): Promise<string> | string;
+	/**
+	 * Get the API key value.
+	 */
+	getApiKey(): Promise<string> | string;
 }
 
 /**
  * Interface for AWS SigV4 request signing.
  */
 export interface AwsSigner {
-  /**
-   * Sign a request with AWS SigV4.
-   * @param url - The request URL
-   * @param init - The request init object
-   * @returns Headers to add to the request
-   */
-  sign(url: string, init: RequestInit): Promise<Record<string, string>>;
+	/**
+	 * Sign a request with AWS SigV4.
+	 * @param url - The request URL
+	 * @param init - The request init object
+	 * @returns Headers to add to the request
+	 */
+	sign(url: string, init: RequestInit): Promise<Record<string, string>>;
 }
 
 /**
  * Auth strategy configuration for a specific security scheme type.
  */
 export type AuthStrategy =
-  | { type: 'bearer'; tokenProvider: TokenProvider }
-  | { type: 'apiKey'; apiKeyProvider: ApiKeyProvider; headerName?: string }
-  | { type: 'iam'; signer: AwsSigner }
-  | { type: 'none' };
+	| { type: 'bearer'; tokenProvider: TokenProvider }
+	| { type: 'apiKey'; apiKeyProvider: ApiKeyProvider; headerName?: string }
+	| { type: 'iam'; signer: AwsSigner }
+	| { type: 'none' };
 
 /**
  * Options for creating an auth-aware fetcher.
@@ -87,41 +87,41 @@ export type AuthStrategy =
  * @template SecuritySchemes - Available security scheme definitions
  */
 export interface AuthFetcherOptions<
-  EndpointAuth extends Record<string, string | null>,
-  SecuritySchemes extends Record<string, SecuritySchemeObject>,
+	EndpointAuth extends Record<string, string | null>,
+	SecuritySchemes extends Record<string, SecuritySchemeObject>,
 > extends Omit<FetcherOptions, 'onRequest'> {
-  /**
-   * Runtime map of endpoints to their required auth scheme.
-   * Generated by `gkm openapi --ts`.
-   */
-  endpointAuth: EndpointAuth;
+	/**
+	 * Runtime map of endpoints to their required auth scheme.
+	 * Generated by `gkm openapi --ts`.
+	 */
+	endpointAuth: EndpointAuth;
 
-  /**
-   * Security scheme definitions.
-   * Generated by `gkm openapi --ts`.
-   */
-  securitySchemes: SecuritySchemes;
+	/**
+	 * Security scheme definitions.
+	 * Generated by `gkm openapi --ts`.
+	 */
+	securitySchemes: SecuritySchemes;
 
-  /**
-   * Auth strategies for security schemes that are actually used.
-   * Only schemes referenced in endpointAuth are required.
-   *
-   * @example
-   * ```typescript
-   * // If endpointAuth has: { 'GET /users': 'jwt', 'POST /data': 'iam', 'GET /public': null }
-   * // Then authStrategies must include strategies for 'jwt' and 'iam'
-   * authStrategies: {
-   *   jwt: { type: 'bearer', tokenProvider },
-   *   iam: { type: 'iam', signer: awsSigner },
-   * }
-   * ```
-   */
-  authStrategies: Record<UsedSecuritySchemes<EndpointAuth>, AuthStrategy>;
+	/**
+	 * Auth strategies for security schemes that are actually used.
+	 * Only schemes referenced in endpointAuth are required.
+	 *
+	 * @example
+	 * ```typescript
+	 * // If endpointAuth has: { 'GET /users': 'jwt', 'POST /data': 'iam', 'GET /public': null }
+	 * // Then authStrategies must include strategies for 'jwt' and 'iam'
+	 * authStrategies: {
+	 *   jwt: { type: 'bearer', tokenProvider },
+	 *   iam: { type: 'iam', signer: awsSigner },
+	 * }
+	 * ```
+	 */
+	authStrategies: Record<UsedSecuritySchemes<EndpointAuth>, AuthStrategy>;
 
-  /**
-   * Optional request interceptor (runs after auth headers are added).
-   */
-  onRequest?: (config: RequestInit) => RequestInit | Promise<RequestInit>;
+	/**
+	 * Optional request interceptor (runs after auth headers are added).
+	 */
+	onRequest?: (config: RequestInit) => RequestInit | Promise<RequestInit>;
 }
 
 /**
@@ -153,138 +153,136 @@ export interface AuthFetcherOptions<
  * ```
  */
 export function createAuthAwareFetcher<
-  Paths,
-  EndpointAuth extends Record<string, string | null> = Record<
-    string,
-    string | null
-  >,
-  SecuritySchemes extends Record<string, SecuritySchemeObject> = Record<
-    string,
-    SecuritySchemeObject
-  >,
+	Paths,
+	EndpointAuth extends Record<string, string | null> = Record<
+		string,
+		string | null
+	>,
+	SecuritySchemes extends Record<string, SecuritySchemeObject> = Record<
+		string,
+		SecuritySchemeObject
+	>,
 >(
-  options: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {
-    baseURL: string;
-  },
+	options: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {
+		baseURL: string;
+	},
 ): TypedApiFunction<Paths> {
-  const {
-    endpointAuth,
-    securitySchemes,
-    authStrategies,
-    onRequest: userOnRequest,
-    ...fetcherOptions
-  } = options;
+	const {
+		endpointAuth,
+		securitySchemes,
+		authStrategies,
+		onRequest: userOnRequest,
+		...fetcherOptions
+	} = options;
 
-  // Create base fetcher with user's onRequest if provided
-  const baseFetcher = new TypedFetcher<Paths>({
-    ...fetcherOptions,
-    onRequest: userOnRequest,
-  });
+	// Create base fetcher with user's onRequest if provided
+	const baseFetcher = new TypedFetcher<Paths>({
+		...fetcherOptions,
+		onRequest: userOnRequest,
+	});
 
-  const fetcher = async <T extends TypedEndpoint<Paths>>(
-    endpoint: T,
-    config?: FilteredRequestConfig<Paths, T>,
-  ): Promise<ExtractEndpointResponse<Paths, T>> => {
-    // Look up auth requirement for this endpoint
-    const schemeName = endpointAuth[endpoint as keyof EndpointAuth] as
-      | string
-      | null;
+	const fetcher = async <T extends TypedEndpoint<Paths>>(
+		endpoint: T,
+		config?: FilteredRequestConfig<Paths, T>,
+	): Promise<ExtractEndpointResponse<Paths, T>> => {
+		// Look up auth requirement for this endpoint
+		const schemeName = endpointAuth[endpoint as keyof EndpointAuth] as
+			| string
+			| null;
 
-    let authHeaders: Record<string, string> = {};
+		let authHeaders: Record<string, string> = {};
 
-    if (schemeName) {
-      const scheme = securitySchemes[schemeName as keyof SecuritySchemes];
-      // Since authStrategies is now required to have all used schemes,
-      // we can safely access it - TypeScript ensures the strategy exists
-      const strategy =
-        authStrategies[schemeName as UsedSecuritySchemes<EndpointAuth>];
+		if (schemeName) {
+			const scheme = securitySchemes[schemeName as keyof SecuritySchemes];
+			// Since authStrategies is now required to have all used schemes,
+			// we can safely access it - TypeScript ensures the strategy exists
+			const strategy =
+				authStrategies[schemeName as UsedSecuritySchemes<EndpointAuth>];
 
-      if (strategy && scheme) {
-        authHeaders = await resolveAuthHeaders(strategy, scheme);
-      }
-    }
+			if (strategy && scheme) {
+				authHeaders = await resolveAuthHeaders(strategy, scheme);
+			}
+		}
 
-    // Merge auth headers with config headers
-    const existingHeaders =
-      config && 'headers' in config && config.headers
-        ? (config.headers as Record<string, string>)
-        : {};
+		// Merge auth headers with config headers
+		const existingHeaders =
+			config && 'headers' in config && config.headers
+				? (config.headers as Record<string, string>)
+				: {};
 
-    const mergedConfig = {
-      ...config,
-      headers: {
-        ...authHeaders,
-        ...existingHeaders,
-      },
-    } as unknown as FilteredRequestConfig<Paths, T>;
+		const mergedConfig = {
+			...config,
+			headers: {
+				...authHeaders,
+				...existingHeaders,
+			},
+		} as unknown as FilteredRequestConfig<Paths, T>;
 
-    return baseFetcher.request(endpoint, mergedConfig);
-  };
+		return baseFetcher.request(endpoint, mergedConfig);
+	};
 
-  return fetcher as TypedApiFunction<Paths>;
+	return fetcher as TypedApiFunction<Paths>;
 }
 
 /**
  * Resolves auth headers based on the strategy and scheme.
  */
 async function resolveAuthHeaders(
-  strategy: AuthStrategy,
-  scheme: SecuritySchemeObject,
+	strategy: AuthStrategy,
+	scheme: SecuritySchemeObject,
 ): Promise<Record<string, string>> {
-  switch (strategy.type) {
-    case 'bearer': {
-      return strategy.tokenProvider.createValidAuthHeaders();
-    }
+	switch (strategy.type) {
+		case 'bearer': {
+			return strategy.tokenProvider.createValidAuthHeaders();
+		}
 
-    case 'apiKey': {
-      const apiKey = await strategy.apiKeyProvider.getApiKey();
-      const headerName = strategy.headerName || scheme.name || 'X-API-Key';
+		case 'apiKey': {
+			const apiKey = await strategy.apiKeyProvider.getApiKey();
+			const headerName = strategy.headerName || scheme.name || 'X-API-Key';
 
-      if (scheme.in === 'header' || !scheme.in) {
-        return { [headerName]: apiKey };
-      }
-      // Note: query and cookie API keys are handled differently
-      // For now, we only support header-based API keys
-      return {};
-    }
+			if (scheme.in === 'header' || !scheme.in) {
+				return { [headerName]: apiKey };
+			}
+			// Note: query and cookie API keys are handled differently
+			// For now, we only support header-based API keys
+			return {};
+		}
 
-    case 'iam': {
-      // IAM signing requires the full URL and request config
-      // This is a simplified version - full implementation would need
-      // access to the complete request
-      // For now, return empty - the actual signing should be done
-      // in a custom onRequest interceptor if needed
-      return {};
-    }
-
-    case 'none':
-    default:
-      return {};
-  }
+		case 'iam': {
+			// IAM signing requires the full URL and request config
+			// This is a simplified version - full implementation would need
+			// access to the complete request
+			// For now, return empty - the actual signing should be done
+			// in a custom onRequest interceptor if needed
+			return {};
+		}
+		default:
+			return {};
+	}
 }
 
 /**
  * Type helper to extract the security scheme ID from an endpoint.
  */
 export type GetEndpointAuth<
-  EndpointAuth extends Record<string, string | null>,
-  Endpoint extends keyof EndpointAuth,
+	EndpointAuth extends Record<string, string | null>,
+	Endpoint extends keyof EndpointAuth,
 > = EndpointAuth[Endpoint];
 
 /**
  * Type helper to get all authenticated endpoints.
  */
 export type AuthenticatedEndpoints<
-  EndpointAuth extends Record<string, string | null>,
+	EndpointAuth extends Record<string, string | null>,
 > = {
-  [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? never : K;
+	[K in keyof EndpointAuth]: EndpointAuth[K] extends null ? never : K;
 }[keyof EndpointAuth];
 
 /**
  * Type helper to get all public endpoints.
  */
 export type PublicEndpoints<
-  EndpointAuth extends Record<string, string | null>,
+	EndpointAuth extends Record<string, string | null>,
 > = {
-  [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? K : never;
+	[K in keyof EndpointAuth]: EndpointAuth[K] extends null ? K : never;
 }[keyof EndpointAuth];