@geolonia/geonicdb-sdk 0.21.0 → 0.23.0

package/geonicdb.d.ts

@@ -40,6 +40,18 @@ export interface GeonicDBOptions {
 	 */
 	anonymous?: boolean;
 }
+/**
+ * Options for {@link GeonicDB.request} and `requestRaw` (#3322).
+ *
+ * `headers` overrides the SDK defaults `Content-Type` / `Accept`
+ * (header names are matched case-insensitively; the caller's spelling is sent).
+ * `Authorization`, `DPoP`, `Fiware-Service`, and `NGSILD-Tenant` (any casing)
+ * are reserved and throw `TypeError` — the SDK sets those itself.
+ * A GET or HEAD that includes `headers` skips the ETag cache and in-flight dedup.
+ */
+export interface RequestOptions {
+	headers?: Record<string, string>;
+}
 /** Options for the SDK polling helper. */
 export interface PollOptions<T = unknown> {
 	/** Polling interval in milliseconds (default: 5000). */
@@ -860,12 +872,12 @@ export declare class GeonicDB extends EventEmitter {
 	 * 空だが、サーバ実装が `Content-Type: application/ld+json` を付けて返す
 	 * ケースがあり、そこで `res.json()` が SyntaxError を投げて止まっていた。
 	 */
-	request(method: string, path: string, body?: unknown): Promise<unknown>;
+	request(method: string, path: string, body?: unknown, options?: RequestOptions): Promise<unknown>;
 	/**
 	 * Make an authenticated API request and return the raw Response object.
 	 * Use this when you need access to response headers (e.g. NGSILD-Results-Count).
 	 */
-	requestRaw(method: string, path: string, body?: unknown): Promise<Response>;
+	requestRaw(method: string, path: string, body?: unknown, options?: RequestOptions): Promise<Response>;
 	/** Establish WebSocket connection (authentication is automatic). */
 	connect(): Promise<void>;
 	/** Force-reconnect (closes existing connection, preserves subscriptions). */

package/geonicdb.iife.js

@@ -585,6 +585,46 @@ var GeonicDBModule = (() => {
   }
 
   // src/sdk/auth.ts
+  var SDK_RESERVED_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+    "authorization",
+    "dpop",
+    "fiware-service",
+    "ngsild-tenant"
+  ]);
+  function assertCallerHeadersAllowed(headers) {
+    if (!headers) return;
+    for (const [name, value] of Object.entries(headers)) {
+      if (/[\r\n]/.test(name) || /[\r\n]/.test(value)) {
+        throw new TypeError("Header name or value contains CR or LF");
+      }
+      if (SDK_RESERVED_REQUEST_HEADERS.has(name.toLowerCase())) {
+        throw new TypeError(
+          `Header "${name}" is reserved; the SDK sets Authorization, DPoP, Fiware-Service, and NGSILD-Tenant`
+        );
+      }
+    }
+  }
+  function mergeCallerHeaders(defaults, extraHeaders) {
+    const merged = new Headers(defaults);
+    const callerNames = /* @__PURE__ */ new Map();
+    if (extraHeaders) {
+      for (const [name, value] of Object.entries(extraHeaders)) {
+        merged.set(name, value);
+        callerNames.set(name.toLowerCase(), name);
+      }
+    }
+    const headers = {};
+    for (const name of Object.keys(defaults)) {
+      if (callerNames.has(name.toLowerCase())) continue;
+      const value = merged.get(name);
+      if (value !== null) headers[name] = value;
+    }
+    for (const [lower, name] of callerNames) {
+      const value = merged.get(lower);
+      if (value !== null) headers[name] = value;
+    }
+    return headers;
+  }
   var _AuthManager = class _AuthManager {
     constructor(baseUrl, apiKey, tenant, debug = false, anonymous = false) {
       __publicField(this, "_baseUrl");
@@ -1205,11 +1245,12 @@ var GeonicDBModule = (() => {
      *     the cache.
      *   - Deduplicates concurrent in-flight requests to the same path.
      */
-    async request(method, path, body) {
+    async request(method, path, body, headers) {
       this._log(method, path);
-      if (!this._cache || !isCacheableMethod(method) || body !== void 0) {
+      assertCallerHeadersAllowed(headers);
+      if (!this._cache || !isCacheableMethod(method) || body !== void 0 || headers !== void 0) {
         const token = this.isAnonymous() ? null : await this.ensureToken();
-        const res = await this._doAuthenticatedRequest(method, path, body, token);
+        const res = await this._doAuthenticatedRequest(method, path, body, token, 0, headers);
         this._log(method, path, "\u2192", res.status);
         return res;
       }
@@ -1304,11 +1345,13 @@ var GeonicDBModule = (() => {
           reqToken,
           dpopNonce
         ) : null;
-        const headers = {
-          "Content-Type": "application/ld+json",
-          Accept: "application/ld+json",
-          ...extraHeaders
-        };
+        const headers = mergeCallerHeaders(
+          {
+            "Content-Type": "application/ld+json",
+            Accept: "application/ld+json"
+          },
+          extraHeaders
+        );
         if (reqToken !== null) {
           headers["Authorization"] = (reqIsDPoP ? "DPoP " : "Bearer ") + reqToken;
         }
@@ -2216,8 +2259,8 @@ var GeonicDBModule = (() => {
      * 空だが、サーバ実装が `Content-Type: application/ld+json` を付けて返す
      * ケースがあり、そこで `res.json()` が SyntaxError を投げて止まっていた。
      */
-    async request(method, path, body) {
-      const res = await this._auth.request(method, path, body);
+    async request(method, path, body, options) {
+      const res = await this._auth.request(method, path, body, options?.headers);
       if (!res.ok) {
         const e = await res.json().catch(() => ({}));
         throw createErrorFromResponse(res.status, e, "Request failed: " + res.status);
@@ -2237,8 +2280,8 @@ var GeonicDBModule = (() => {
      * Make an authenticated API request and return the raw Response object.
      * Use this when you need access to response headers (e.g. NGSILD-Results-Count).
      */
-    async requestRaw(method, path, body) {
-      return this._auth.request(method, path, body);
+    async requestRaw(method, path, body, options) {
+      return this._auth.request(method, path, body, options?.headers);
     }
     // --- WebSocket ---
     /** Establish WebSocket connection (authentication is automatic). */