@hachej/boring-files 0.4.9 → 0.4.11

package/README.md

@@ -155,6 +155,15 @@ const revisionProvider = await connectRevisionProvider({
 });
 ```
 
+The same route also answers `createResourceClient` of `@hachej/boring-files/remote`:
+a resource call (`read`, `publish`, `lookup`, `rename`, `delete`) sent without the
+binding header is served by `createResourceHandler` with the resolved access, so the
+envelope's identity must match it, and conditional writes refuse a stale revision
+with `conflict`. A binding header that is sent is checked (`409` for another
+workspace); the listing and the change feed always need it. A host that serves only
+`createResourceHandler` (for example at `/api/resource`) keeps working with the same
+client; `connectRevisionProvider` there fails discovery (`405`), which means no listing.
+
 The binding discovers identity and workspace incarnation from the authenticated
 server. Reconnect when the selected workspace changes. It exposes `list`,
 filename `search`, retained `history`, `locate`, `read`, `publish`, `lookup`,

package/dist/revision-handler.js

@@ -124,18 +124,24 @@ export function createRevisionHandler(options) {
             const op = new URL(request.url).searchParams.get('op');
             if (request.method === 'GET' && op === null)
                 return respond(association);
+            // A resource call (POST without the catalog header) is `createResourceHandler`'s protocol, whose envelope carries and checks
+            // the identity, so a plain `createResourceClient` works here too. The listing and the change feed need the binding; a binding
+            // that is sent is always checked.
+            const resourceCall = request.method === 'POST' && !request.headers.has(catalogHeader);
             const header = request.headers.get(bindingHeader);
-            if (!header || header.length > 16384)
-                return refuse(403);
-            let requested;
-            try {
-                requested = bindingValue(binding(JSON.parse(decodeURIComponent(header))));
-            }
-            catch {
+            if (header === null ? !resourceCall : header.length > 16384)
                 return refuse(403);
+            if (header !== null) {
+                let requested;
+                try {
+                    requested = bindingValue(binding(JSON.parse(decodeURIComponent(header))));
+                }
+                catch {
+                    return refuse(403);
+                }
+                if (requested !== bindingValue(association))
+                    return refuse(409);
             }
-            if (requested !== bindingValue(association))
-                return refuse(409);
             const provider = selected.provider;
             if (request.method === 'GET') {
                 if (op !== 'changes')
@@ -157,7 +163,7 @@ export function createRevisionHandler(options) {
                 }
                 catch { /* the stream already ended */ } });
             }
-            if (!request.headers.has(catalogHeader))
+            if (resourceCall)
                 return await createResourceHandler({
                     authenticate: async () => access,
                     reader: { read: (value, context) => hold(provider.read(value, context)) },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-files",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "license": "MIT",
   "private": false,
   "type": "module",