@jcoder-stack/abp-react 0.2.0 → 0.3.0

package/dist/proxy.d.ts

@@ -4,11 +4,18 @@ import { A as Auth, d as OidcStrategy, b as Codec, C as CookieOptions } from './
 import { A as ApplicationConfiguration } from './application-configuration-DhOZRqtz.js';
 import { z } from 'zod';
 
+/**
+ * 请求正文。四种形状的共同点是**可重发**：401→刷新→重放与幂等重试都要把同一个 body 再发一次。
+ *
+ * `ReadableStream` 刻意不在其中。它只能消费一次，收下它会让上述两条路径静默退化成「重放一个
+ * 空正文」——上游看到的是内容缺失的请求而不是错误，最难查。要传流请先自行缓冲成字节。
+ */
+type AbpProxyBody = string | Uint8Array | ArrayBuffer | FormData;
 interface AbpProxyRequest {
     path: string;
     method?: string;
     headers?: Record<string, string>;
-    body?: string;
+    body?: AbpProxyBody;
     /** 调用方的取消信号（如宿主的 `request.signal`）；触发后当前尝试立即中止且不再重试。 */
     signal?: AbortSignal;
 }
@@ -49,6 +56,8 @@ declare function createAbpProxy(opts: {
     };
     /** 含重试与退避在内的总预算；默认不设，此时最坏耗时是 (retries+1)×timeoutMs 加退避。 */
     totalTimeoutMs?: number;
+    /** 可测正文（字节/FormData）的上限，默认 10MB。字符串正文不参与判断，见 `measurableBodyBytes`。 */
+    maxBodyBytes?: number;
     logger?: Logger;
 }): AbpProxy;
 
@@ -224,4 +233,4 @@ type InstallExtraCaResult = "installed" | "already-installed" | "unsupported";
  */
 declare function installExtraCa(caFile: string, caApi?: RuntimeCaApi): InstallExtraCaResult;
 
-export { type AbpAuthEnv, type AbpAuthRuntimeOptions, type AbpCallRuntime, type AbpProxy, type AbpProxyAuth, AbpProxyError, type AbpProxyRequest, type AbpProxyResponse, type AppState, type AuthCookieConfig, type AuthCookieSettings, type AuthRuntime, CULTURE_COOKIE, DEFAULT_LOGIN_COOKIE, DEFAULT_LOGIN_COOKIE_MAX_AGE, DEFAULT_SESSION_COOKIE, DEFAULT_SESSION_COOKIE_MAX_AGE, type InstallExtraCaResult, SWITCH_COOKIE_MAX_AGE, TENANT_COOKIE, abpAuthEnvSchema, buildPolicyHeaders, callAbpWithSession, cookieAttributesOf, createAbpAuthRuntime, createAbpIdentityResolver, createAbpProxy, deriveIdentity, handleCallback, handleLogin, handleLogout, handleSetCulture, handleSetTenant, installExtraCa, loadAppState, resolveAbpAuthEnv, tlsTrustFailureCode, tlsTrustFailureMessage, upstreamUnreachableCode, upstreamUnreachableMessage };
+export { type AbpAuthEnv, type AbpAuthRuntimeOptions, type AbpCallRuntime, type AbpProxy, type AbpProxyAuth, type AbpProxyBody, AbpProxyError, type AbpProxyRequest, type AbpProxyResponse, type AppState, type AuthCookieConfig, type AuthCookieSettings, type AuthRuntime, CULTURE_COOKIE, DEFAULT_LOGIN_COOKIE, DEFAULT_LOGIN_COOKIE_MAX_AGE, DEFAULT_SESSION_COOKIE, DEFAULT_SESSION_COOKIE_MAX_AGE, type InstallExtraCaResult, SWITCH_COOKIE_MAX_AGE, TENANT_COOKIE, abpAuthEnvSchema, buildPolicyHeaders, callAbpWithSession, cookieAttributesOf, createAbpAuthRuntime, createAbpIdentityResolver, createAbpProxy, deriveIdentity, handleCallback, handleLogin, handleLogout, handleSetCulture, handleSetTenant, installExtraCa, loadAppState, resolveAbpAuthEnv, tlsTrustFailureCode, tlsTrustFailureMessage, upstreamUnreachableCode, upstreamUnreachableMessage };

package/dist/proxy.js

@@ -289,12 +289,28 @@ function exposeHeaders(headers) {
   }
   return out;
 }
-function sanitizeHeaders(headers) {
+function sanitizeHeaders(headers, body) {
   if (headers === void 0) return {};
+  const dropContentType = typeof FormData !== "undefined" && body instanceof FormData;
   return Object.fromEntries(
-    Object.entries(headers).filter(([key]) => FORWARDABLE.has(key.toLowerCase()))
+    Object.entries(headers).filter(
+      ([key]) => FORWARDABLE.has(key.toLowerCase()) && !(dropContentType && key.toLowerCase() === "content-type")
+    )
   );
 }
+var DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024;
+var isStreamLike = (body) => typeof body?.getReader === "function";
+function measurableBodyBytes(body) {
+  if (body === void 0 || typeof body === "string") return null;
+  if (body instanceof ArrayBuffer) return body.byteLength;
+  if (ArrayBuffer.isView(body)) return body.byteLength;
+  let total = 0;
+  body.forEach((value, name) => {
+    total += name.length;
+    total += typeof value === "string" ? value.length : value.size;
+  });
+  return total;
+}
 var ABSOLUTE_OR_PROTOCOL_RELATIVE = /^([a-z][a-z0-9+.-]*:)?\/\//i;
 function resolveTargetUrl(path, baseUrl) {
   if (ABSOLUTE_OR_PROTOCOL_RELATIVE.test(path)) {
@@ -312,8 +328,18 @@ function createAbpProxy(opts) {
   const fetchFn = opts.fetchFn ?? fetch;
   const timeoutMs = opts.timeoutMs ?? 3e4;
   const retries = opts.retry?.retries ?? 2;
+  const maxBodyBytes = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
   return {
     async send(req, auth) {
+      if (isStreamLike(req.body)) {
+        throw new Error(
+          "abp proxy: a ReadableStream body cannot be replayed after a 401 refresh or an idempotent retry; buffer it into bytes first"
+        );
+      }
+      const bodyBytes = measurableBodyBytes(req.body);
+      if (bodyBytes !== null && bodyBytes > maxBodyBytes) {
+        throw new Error(`abp proxy: request body too large (${bodyBytes} > ${maxBodyBytes} bytes)`);
+      }
       const method = (req.method ?? "GET").toUpperCase();
       const maxRetries = IDEMPOTENT.has(method) ? retries : 0;
       const url = resolveTargetUrl(req.path, opts.baseUrl);
@@ -336,9 +362,12 @@ function createAbpProxy(opts) {
           res = await fetchFn(url, {
             method,
             headers: {
-              ...sanitizeHeaders(req.headers),
+              ...sanitizeHeaders(req.headers, req.body),
               ...session === null ? {} : { Authorization: `Bearer ${session.tokens.accessToken}` }
             },
+            // AbpProxyBody 的四种形状运行时都是合法的 fetch 正文。TS 5.7 起 Uint8Array 带上了
+            // ArrayBufferLike 泛型参数，而 BodyInit 只认 ArrayBuffer 背衬的那支；把泛型参数写进
+            // 公开类型能消掉这次转换，但会反过来拒掉调用方最常写的裸 `Uint8Array` 标注。
             body: req.body,
             signal: AbortSignal.any([...stops, AbortSignal.timeout(timeoutMs)])
           });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jcoder-stack/abp-react",
   "description": "Pure-React runtime for ABP backends: logging, ABP types with zod parsing, fetch client, auth sessions, the ABP proxy gateway, permissions, i18n, React providers/hooks, and TanStack Router guards — exported per domain via subpaths",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "license": "MIT",
   "repository": {