@geolonia/geonicdb-sdk 0.20.0 → 0.22.0

package/geonicdb.mjs

@@ -544,6 +544,46 @@ function isCacheableMethod(method) {
 }
 
 // src/sdk/auth.ts
+var SDK_RESERVED_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "dpop",
+  "fiware-service",
+  "ngsild-tenant"
+]);
+function assertCallerHeadersAllowed(headers) {
+  if (!headers) return;
+  for (const [name, value] of Object.entries(headers)) {
+    if (/[\r\n]/.test(name) || /[\r\n]/.test(value)) {
+      throw new TypeError("Header name or value contains CR or LF");
+    }
+    if (SDK_RESERVED_REQUEST_HEADERS.has(name.toLowerCase())) {
+      throw new TypeError(
+        `Header "${name}" is reserved; the SDK sets Authorization, DPoP, Fiware-Service, and NGSILD-Tenant`
+      );
+    }
+  }
+}
+function mergeCallerHeaders(defaults, extraHeaders) {
+  const merged = new Headers(defaults);
+  const callerNames = /* @__PURE__ */ new Map();
+  if (extraHeaders) {
+    for (const [name, value] of Object.entries(extraHeaders)) {
+      merged.set(name, value);
+      callerNames.set(name.toLowerCase(), name);
+    }
+  }
+  const headers = {};
+  for (const name of Object.keys(defaults)) {
+    if (callerNames.has(name.toLowerCase())) continue;
+    const value = merged.get(name);
+    if (value !== null) headers[name] = value;
+  }
+  for (const [lower, name] of callerNames) {
+    const value = merged.get(lower);
+    if (value !== null) headers[name] = value;
+  }
+  return headers;
+}
 var _AuthManager = class _AuthManager {
   constructor(baseUrl, apiKey, tenant, debug = false, anonymous = false) {
     __publicField(this, "_baseUrl");
@@ -1164,11 +1204,12 @@ var _AuthManager = class _AuthManager {
    *     the cache.
    *   - Deduplicates concurrent in-flight requests to the same path.
    */
-  async request(method, path, body) {
+  async request(method, path, body, headers) {
     this._log(method, path);
-    if (!this._cache || !isCacheableMethod(method) || body !== void 0) {
+    assertCallerHeadersAllowed(headers);
+    if (!this._cache || !isCacheableMethod(method) || body !== void 0 || headers !== void 0) {
       const token = this.isAnonymous() ? null : await this.ensureToken();
-      const res = await this._doAuthenticatedRequest(method, path, body, token);
+      const res = await this._doAuthenticatedRequest(method, path, body, token, 0, headers);
       this._log(method, path, "\u2192", res.status);
       return res;
     }
@@ -1263,11 +1304,13 @@ var _AuthManager = class _AuthManager {
         reqToken,
         dpopNonce
       ) : null;
-      const headers = {
-        "Content-Type": "application/ld+json",
-        Accept: "application/ld+json",
-        ...extraHeaders
-      };
+      const headers = mergeCallerHeaders(
+        {
+          "Content-Type": "application/ld+json",
+          Accept: "application/ld+json"
+        },
+        extraHeaders
+      );
       if (reqToken !== null) {
         headers["Authorization"] = (reqIsDPoP ? "DPoP " : "Bearer ") + reqToken;
       }
@@ -2175,8 +2218,8 @@ var GeonicDB = class extends EventEmitter {
    * 空だが、サーバ実装が `Content-Type: application/ld+json` を付けて返す
    * ケースがあり、そこで `res.json()` が SyntaxError を投げて止まっていた。
    */
-  async request(method, path, body) {
-    const res = await this._auth.request(method, path, body);
+  async request(method, path, body, options) {
+    const res = await this._auth.request(method, path, body, options?.headers);
     if (!res.ok) {
       const e = await res.json().catch(() => ({}));
       throw createErrorFromResponse(res.status, e, "Request failed: " + res.status);
@@ -2196,8 +2239,8 @@ var GeonicDB = class extends EventEmitter {
    * Make an authenticated API request and return the raw Response object.
    * Use this when you need access to response headers (e.g. NGSILD-Results-Count).
    */
-  async requestRaw(method, path, body) {
-    return this._auth.request(method, path, body);
+  async requestRaw(method, path, body, options) {
+    return this._auth.request(method, path, body, options?.headers);
   }
   // --- WebSocket ---
   /** Establish WebSocket connection (authentication is automatic). */