@geolonia/geonicdb-sdk 0.21.0 → 0.23.0

package/README.md

@@ -248,8 +248,10 @@ const entities = await db.getEntities({ type: 'GeoJSON' });
 > restricts where `@context` may come from based on `Content-Type` and forbids
 > mixing the two. Since the SDK always sends `application/ld+json`, adding a
 > JSON-LD `Link` header to a `POST` / `PATCH` / `PUT` via the `request()` /
-> `requestRaw()` escape hatch returns `400 BadRequestData`. Put the `@context`
-> in the body for writes; the `Link` header remains the channel for reads.
+> `requestRaw()` escape hatch (`options.headers`) returns `400 BadRequestData`. Put the `@context`
+> in the body for writes; the `Link` header remains the channel for reads and is
+> passed as `options.headers`. `Authorization`, `DPoP`, `Fiware-Service`, and
+> `NGSILD-Tenant` (any casing) are reserved and throw `TypeError`. A CR or LF in a header name or value also throws `TypeError`.
 
 ```typescript
 // Create
@@ -644,8 +646,28 @@ handle.stop();
 
 | Method | Parameters | Returns | Description |
 |--------|-----------|---------|-------------|
-| `request(method, path, body?)` | `string, string, unknown` | `Promise<unknown>` | Authenticated request with automatic JSON parsing |
-| `requestRaw(method, path, body?)` | `string, string, unknown` | `Promise<Response>` | Authenticated request returning raw `Response` (for accessing headers) |
+| `request(method, path, body?, options?)` | `string, string, unknown, RequestOptions` | `Promise<unknown>` | Authenticated request with automatic JSON parsing. `options.headers` overrides `Content-Type` / `Accept` (header names are case-insensitive) |
+| `requestRaw(method, path, body?, options?)` | `string, string, unknown, RequestOptions` | `Promise<Response>` | Authenticated request returning raw `Response` (for accessing headers). Same `options` as `request()` |
+
+#### Calling `POST /mcp` (#3322)
+
+`POST /mcp` requires `Content-Type: application/json` and `Accept: application/json, text/event-stream`. The SDK defaults are `application/ld+json`, so omitting `headers` returns **406**.
+
+```javascript
+const rpc = await db.request('POST', '/mcp', {
+  jsonrpc: '2.0',
+  id: 1,
+  method: 'tools/call',
+  params: { name: 'config', arguments: { resource: 'rules', action: 'list' } },
+}, {
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json, text/event-stream',
+  },
+});
+```
+
+The body is JSON-RPC, not SSE. Tool failures are still HTTP 200 — check `result.isError`. `Authorization`, `DPoP`, `Fiware-Service`, and `NGSILD-Tenant` (any casing) throw `TypeError`, as does a CR or LF in a header name or value. A GET or HEAD that passes `headers` skips the ETag cache and in-flight dedup. After `login()`, the DPoP session calls `/mcp` as that user. `config` / `admin` need `tenant_admin`; an API-key principal gets `Admin privileges required`.
 
 ### Cache & Polling
 

package/geonicdb.cjs

@@ -585,6 +585,46 @@ function isCacheableMethod(method) {
 }
 
 // src/sdk/auth.ts
+var SDK_RESERVED_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "dpop",
+  "fiware-service",
+  "ngsild-tenant"
+]);
+function assertCallerHeadersAllowed(headers) {
+  if (!headers) return;
+  for (const [name, value] of Object.entries(headers)) {
+    if (/[\r\n]/.test(name) || /[\r\n]/.test(value)) {
+      throw new TypeError("Header name or value contains CR or LF");
+    }
+    if (SDK_RESERVED_REQUEST_HEADERS.has(name.toLowerCase())) {
+      throw new TypeError(
+        `Header "${name}" is reserved; the SDK sets Authorization, DPoP, Fiware-Service, and NGSILD-Tenant`
+      );
+    }
+  }
+}
+function mergeCallerHeaders(defaults, extraHeaders) {
+  const merged = new Headers(defaults);
+  const callerNames = /* @__PURE__ */ new Map();
+  if (extraHeaders) {
+    for (const [name, value] of Object.entries(extraHeaders)) {
+      merged.set(name, value);
+      callerNames.set(name.toLowerCase(), name);
+    }
+  }
+  const headers = {};
+  for (const name of Object.keys(defaults)) {
+    if (callerNames.has(name.toLowerCase())) continue;
+    const value = merged.get(name);
+    if (value !== null) headers[name] = value;
+  }
+  for (const [lower, name] of callerNames) {
+    const value = merged.get(lower);
+    if (value !== null) headers[name] = value;
+  }
+  return headers;
+}
 var _AuthManager = class _AuthManager {
   constructor(baseUrl, apiKey, tenant, debug = false, anonymous = false) {
     __publicField(this, "_baseUrl");
@@ -1205,11 +1245,12 @@ var _AuthManager = class _AuthManager {
    *     the cache.
    *   - Deduplicates concurrent in-flight requests to the same path.
    */
-  async request(method, path, body) {
+  async request(method, path, body, headers) {
     this._log(method, path);
-    if (!this._cache || !isCacheableMethod(method) || body !== void 0) {
+    assertCallerHeadersAllowed(headers);
+    if (!this._cache || !isCacheableMethod(method) || body !== void 0 || headers !== void 0) {
       const token = this.isAnonymous() ? null : await this.ensureToken();
-      const res = await this._doAuthenticatedRequest(method, path, body, token);
+      const res = await this._doAuthenticatedRequest(method, path, body, token, 0, headers);
       this._log(method, path, "\u2192", res.status);
       return res;
     }
@@ -1304,11 +1345,13 @@ var _AuthManager = class _AuthManager {
         reqToken,
         dpopNonce
       ) : null;
-      const headers = {
-        "Content-Type": "application/ld+json",
-        Accept: "application/ld+json",
-        ...extraHeaders
-      };
+      const headers = mergeCallerHeaders(
+        {
+          "Content-Type": "application/ld+json",
+          Accept: "application/ld+json"
+        },
+        extraHeaders
+      );
       if (reqToken !== null) {
         headers["Authorization"] = (reqIsDPoP ? "DPoP " : "Bearer ") + reqToken;
       }
@@ -2216,8 +2259,8 @@ var GeonicDB = class extends EventEmitter {
    * 空だが、サーバ実装が `Content-Type: application/ld+json` を付けて返す
    * ケースがあり、そこで `res.json()` が SyntaxError を投げて止まっていた。
    */
-  async request(method, path, body) {
-    const res = await this._auth.request(method, path, body);
+  async request(method, path, body, options) {
+    const res = await this._auth.request(method, path, body, options?.headers);
     if (!res.ok) {
       const e = await res.json().catch(() => ({}));
       throw createErrorFromResponse(res.status, e, "Request failed: " + res.status);
@@ -2237,8 +2280,8 @@ var GeonicDB = class extends EventEmitter {
    * Make an authenticated API request and return the raw Response object.
    * Use this when you need access to response headers (e.g. NGSILD-Results-Count).
    */
-  async requestRaw(method, path, body) {
-    return this._auth.request(method, path, body);
+  async requestRaw(method, path, body, options) {
+    return this._auth.request(method, path, body, options?.headers);
   }
   // --- WebSocket ---
   /** Establish WebSocket connection (authentication is automatic). */