@jskit-ai/http-runtime 0.1.144 → 0.1.145

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/http-runtime",
-  "version": "0.1.144",
+  "version": "0.1.145",
   "kind": "runtime",
   "dependsOn": [],
   "capabilities": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/http-runtime",
-  "version": "0.1.144",
+  "version": "0.1.145",
   "type": "module",
   "scripts": {
     "test": "node --test"

package/src/shared/clientRuntime/client.js

@@ -288,8 +288,8 @@ function createHttpClient(options = {}) {
     return normalizeResolvedRequestUrl(resolved, normalizedUrl);
   }
 
-  async function maybeRetry({ response, method, state, data, stream }) {
-    if (!csrf.enabled) {
+  async function maybeRetry({ response, method, state, data, stream, csrfEnabled = csrf.enabled }) {
+    if (!csrfEnabled) {
       return false;
     }
 
@@ -351,8 +351,10 @@ function createHttpClient(options = {}) {
     const {
       transport: _transport,
       query: requestQuery,
+      csrf: requestCsrf,
       ...forwardedRequestOptions
     } = requestOptions && typeof requestOptions === "object" ? requestOptions : {};
+    const csrfEnabled = csrf.enabled && requestCsrf !== false;
     const requestUrl = appendRequestQueryToUrl(url, requestQuery, transport);
     const resolvedRequestUrl = await resolveRequestUrl(requestUrl, {
       originalUrl: url,
@@ -398,7 +400,7 @@ function createHttpClient(options = {}) {
       config.body = JSON.stringify(config.body);
     }
 
-    if (csrf.enabled && unsafeMethods.has(method) && !hasHeader(headers, csrf.headerName)) {
+    if (csrfEnabled && unsafeMethods.has(method) && !hasHeader(headers, csrf.headerName)) {
       const token = await ensureCsrfToken();
       if (token) {
         setHeaderIfMissing(headers, csrf.headerName, token);
@@ -409,6 +411,7 @@ function createHttpClient(options = {}) {
       method,
       config,
       state: resolvedState,
+      csrfEnabled,
       transport,
       url: resolvedRequestUrl
     };
@@ -445,6 +448,7 @@ function createHttpClient(options = {}) {
     contentType,
     isJson,
     stream,
+    csrfEnabled,
     retryRequest
   }) {
     if (
@@ -453,7 +457,8 @@ function createHttpClient(options = {}) {
         method,
         state,
         data,
-        stream
+        stream,
+        csrfEnabled
       })
     ) {
       return retryRequest();
@@ -525,6 +530,7 @@ function createHttpClient(options = {}) {
           contentType: result.contentType,
           isJson: result.isJson,
           stream,
+          csrfEnabled: requestContext.csrfEnabled,
           retryRequest() {
             return retryRequest(resolvedState);
           }

package/test/client.test.js

@@ -56,6 +56,57 @@ test("request serializes json body and injects csrf token for unsafe methods", a
   assert.equal(calls[1][1].body, JSON.stringify({ demo: true }));
 });
 
+test("request-level csrf false skips session preflight and is not forwarded to fetch", async (t) => {
+  for (const method of ["POST", "PATCH", "DELETE"]) {
+    await t.test(method, async () => {
+      const calls = [];
+      const client = createHttpClient({
+        fetchImpl: async (url, options) => {
+          calls.push([url, options]);
+          return mockResponse({ data: { ok: true } });
+        }
+      });
+
+      await client.request("/api/books/1", {
+        method,
+        csrf: false,
+        body: method === "DELETE" ? undefined : { title: "Book" }
+      });
+
+      assert.equal(calls.length, 1);
+      assert.equal(calls[0][0], "/api/books/1");
+      assert.equal(Object.hasOwn(calls[0][1], "csrf"), false);
+      assert.equal(Object.hasOwn(calls[0][1].headers, "csrf-token"), false);
+    });
+  }
+});
+
+test("request-level csrf false does not retry a csrf-shaped failure", async () => {
+  const calls = [];
+  const client = createHttpClient({
+    fetchImpl: async (url, options) => {
+      calls.push([url, options]);
+      return mockResponse({
+        status: 403,
+        data: {
+          error: {
+            code: "CSRF_TOKEN_INVALID"
+          }
+        }
+      });
+    }
+  });
+
+  await assert.rejects(
+    client.request("/api/books/1", {
+      method: "DELETE",
+      csrf: false
+    })
+  );
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0][0], "/api/books/1");
+});
+
 test("request resolves request urls after query encoding and before fetch", async () => {
   const calls = [];
   const contexts = [];