@kedaruma/revlm-client 1.0.11 → 1.0.13

package/dist/index.d.mts

@@ -174,6 +174,11 @@ type RevlmOptions = {
     provisionalAuthDomain?: string;
     autoSetToken?: boolean;
     autoRefreshOn401?: boolean;
+    sigv4SecretKey?: string;
+    sigv4AccessKey?: string;
+    sigv4Region?: string;
+    sigv4Service?: string;
+    sigv4Enabled?: boolean;
 };
 type RevlmResponse<T = any> = {
     ok: boolean;
@@ -193,6 +198,7 @@ declare class Revlm {
     private provisionalAuthDomain;
     private autoSetToken;
     private autoRefreshOn401;
+    private sigv4Signer;
     constructor(baseUrl: string, opts?: RevlmOptions);
     setToken(token: string): void;
     getToken(): string | undefined;
@@ -204,6 +210,7 @@ declare class Revlm {
     private parseResponse;
     private request;
     private shouldSkipAuthRetry;
+    private signIfNeeded;
     private requestWithRetry;
     login(authId: string, password: string): Promise<LoginResponse>;
     provisionalLogin(authId: string): Promise<ProvisionalLoginResponse>;

package/dist/index.d.ts

@@ -174,6 +174,11 @@ type RevlmOptions = {
     provisionalAuthDomain?: string;
     autoSetToken?: boolean;
     autoRefreshOn401?: boolean;
+    sigv4SecretKey?: string;
+    sigv4AccessKey?: string;
+    sigv4Region?: string;
+    sigv4Service?: string;
+    sigv4Enabled?: boolean;
 };
 type RevlmResponse<T = any> = {
     ok: boolean;
@@ -193,6 +198,7 @@ declare class Revlm {
     private provisionalAuthDomain;
     private autoSetToken;
     private autoRefreshOn401;
+    private sigv4Signer;
     constructor(baseUrl: string, opts?: RevlmOptions);
     setToken(token: string): void;
     getToken(): string | undefined;
@@ -204,6 +210,7 @@ declare class Revlm {
     private parseResponse;
     private request;
     private shouldSkipAuthRetry;
+    private signIfNeeded;
     private requestWithRetry;
     login(authId: string, password: string): Promise<LoginResponse>;
     provisionalLogin(authId: string): Promise<ProvisionalLoginResponse>;

package/dist/index.js

@@ -46,6 +46,8 @@ module.exports = __toCommonJS(index_exports);
 // src/Revlm.ts
 var import_bson = require("bson");
 var import_revlm_shared = require("@kedaruma/revlm-shared");
+var import_signature_v4 = require("@aws-sdk/signature-v4");
+var import_sha256_js = require("@aws-crypto/sha256-js");
 
 // src/MdbCollection.ts
 var MdbCollection = class {
@@ -156,6 +158,7 @@ var Revlm = class {
   provisionalAuthDomain;
   autoSetToken;
   autoRefreshOn401;
+  sigv4Signer;
   constructor(baseUrl, opts = {}) {
     if (!baseUrl) throw new Error("baseUrl is required");
     this.baseUrl = baseUrl.replace(/\/$/, "");
@@ -166,6 +169,24 @@ var Revlm = class {
     this.provisionalAuthDomain = opts.provisionalAuthDomain || "";
     this.autoSetToken = opts.autoSetToken ?? true;
     this.autoRefreshOn401 = opts.autoRefreshOn401 || false;
+    const sigv4SecretKey = opts.sigv4SecretKey || process.env.REVLM_SIGV4_SECRET_KEY;
+    const sigv4AccessKey = opts.sigv4AccessKey || process.env.REVLM_SIGV4_ACCESS_KEY || "revlm-access";
+    const sigv4Region = opts.sigv4Region || process.env.REVLM_SIGV4_REGION || "revlm";
+    const sigv4Service = opts.sigv4Service || process.env.REVLM_SIGV4_SERVICE || "revlm";
+    const sigv4Enabled = opts.sigv4Enabled ?? true;
+    if (sigv4Enabled) {
+      if (!sigv4SecretKey) {
+        throw new Error("SigV4 is enabled but REVLM_SIGV4_SECRET_KEY or opts.sigv4SecretKey is not provided");
+      }
+      this.sigv4Signer = new import_signature_v4.SignatureV4({
+        credentials: { accessKeyId: sigv4AccessKey, secretAccessKey: sigv4SecretKey },
+        region: sigv4Region,
+        service: sigv4Service,
+        sha256: import_sha256_js.Sha256
+      });
+    } else {
+      this.sigv4Signer = null;
+    }
     if (!this.fetchImpl) {
       throw new Error("No fetch implementation available. Provide fetchImpl in options or run in Node 18+ with global fetch.");
     }
@@ -214,7 +235,7 @@ var Revlm = class {
       headers["Content-Type"] = "application/ejson";
     }
     if (this._token) {
-      headers["Authorization"] = `Bearer ${this._token}`;
+      headers["X-Revlm-JWT"] = `Bearer ${this._token}`;
     }
     return headers;
   }
@@ -238,6 +259,33 @@ var Revlm = class {
     const pathname = path.startsWith("http") ? new URL(path).pathname : path;
     return pathname.includes("/login") || pathname.includes("/provisional-login") || pathname.includes("/refresh-token") || pathname.includes("/verify-token");
   }
+  async signIfNeeded(url, method, headers, body) {
+    if (!this.sigv4Signer) {
+      return { signedUrl: url, signedHeaders: headers };
+    }
+    const u = new URL(url);
+    const signingHeaders = {
+      host: u.host,
+      ...headers
+    };
+    const reqToSign = {
+      method,
+      protocol: u.protocol,
+      path: u.pathname + (u.search || ""),
+      hostname: u.hostname,
+      headers: signingHeaders,
+      body: body ?? ""
+    };
+    if (u.port) {
+      reqToSign.port = Number(u.port);
+    }
+    const signed = await this.sigv4Signer.sign(reqToSign);
+    const signedHeaders = {};
+    Object.entries(signed.headers || {}).forEach(([k, v]) => {
+      signedHeaders[k] = Array.isArray(v) ? v.join(",") : String(v);
+    });
+    return { signedUrl: url, signedHeaders };
+  }
   async requestWithRetry(path, method = "POST", body, opts = { allowAuthRetry: false, retrying: false }) {
     const { allowAuthRetry, retrying } = opts;
     const url = path.startsWith("http") ? path : `${this.baseUrl}${path.startsWith("/") ? "" : "/"}${path}`;
@@ -247,10 +295,11 @@ var Revlm = class {
     if (hasBody) {
       serializedBody = import_bson.EJSON.stringify(body);
     }
+    const { signedUrl, signedHeaders } = await this.signIfNeeded(url, method, headers, serializedBody);
     try {
-      const res = await this.fetchImpl(url, {
+      const res = await this.fetchImpl(signedUrl, {
         method,
-        headers,
+        headers: signedHeaders,
         body: serializedBody
       });
       const parsed = await this.parseResponse(res);

package/dist/index.mjs

@@ -1,6 +1,8 @@
 // src/Revlm.ts
 import { EJSON } from "bson";
 import { AuthClient } from "@kedaruma/revlm-shared";
+import { SignatureV4 } from "@aws-sdk/signature-v4";
+import { Sha256 } from "@aws-crypto/sha256-js";
 
 // src/MdbCollection.ts
 var MdbCollection = class {
@@ -111,6 +113,7 @@ var Revlm = class {
   provisionalAuthDomain;
   autoSetToken;
   autoRefreshOn401;
+  sigv4Signer;
   constructor(baseUrl, opts = {}) {
     if (!baseUrl) throw new Error("baseUrl is required");
     this.baseUrl = baseUrl.replace(/\/$/, "");
@@ -121,6 +124,24 @@ var Revlm = class {
     this.provisionalAuthDomain = opts.provisionalAuthDomain || "";
     this.autoSetToken = opts.autoSetToken ?? true;
     this.autoRefreshOn401 = opts.autoRefreshOn401 || false;
+    const sigv4SecretKey = opts.sigv4SecretKey || process.env.REVLM_SIGV4_SECRET_KEY;
+    const sigv4AccessKey = opts.sigv4AccessKey || process.env.REVLM_SIGV4_ACCESS_KEY || "revlm-access";
+    const sigv4Region = opts.sigv4Region || process.env.REVLM_SIGV4_REGION || "revlm";
+    const sigv4Service = opts.sigv4Service || process.env.REVLM_SIGV4_SERVICE || "revlm";
+    const sigv4Enabled = opts.sigv4Enabled ?? true;
+    if (sigv4Enabled) {
+      if (!sigv4SecretKey) {
+        throw new Error("SigV4 is enabled but REVLM_SIGV4_SECRET_KEY or opts.sigv4SecretKey is not provided");
+      }
+      this.sigv4Signer = new SignatureV4({
+        credentials: { accessKeyId: sigv4AccessKey, secretAccessKey: sigv4SecretKey },
+        region: sigv4Region,
+        service: sigv4Service,
+        sha256: Sha256
+      });
+    } else {
+      this.sigv4Signer = null;
+    }
     if (!this.fetchImpl) {
       throw new Error("No fetch implementation available. Provide fetchImpl in options or run in Node 18+ with global fetch.");
     }
@@ -169,7 +190,7 @@ var Revlm = class {
       headers["Content-Type"] = "application/ejson";
     }
     if (this._token) {
-      headers["Authorization"] = `Bearer ${this._token}`;
+      headers["X-Revlm-JWT"] = `Bearer ${this._token}`;
     }
     return headers;
   }
@@ -193,6 +214,33 @@ var Revlm = class {
     const pathname = path.startsWith("http") ? new URL(path).pathname : path;
     return pathname.includes("/login") || pathname.includes("/provisional-login") || pathname.includes("/refresh-token") || pathname.includes("/verify-token");
   }
+  async signIfNeeded(url, method, headers, body) {
+    if (!this.sigv4Signer) {
+      return { signedUrl: url, signedHeaders: headers };
+    }
+    const u = new URL(url);
+    const signingHeaders = {
+      host: u.host,
+      ...headers
+    };
+    const reqToSign = {
+      method,
+      protocol: u.protocol,
+      path: u.pathname + (u.search || ""),
+      hostname: u.hostname,
+      headers: signingHeaders,
+      body: body ?? ""
+    };
+    if (u.port) {
+      reqToSign.port = Number(u.port);
+    }
+    const signed = await this.sigv4Signer.sign(reqToSign);
+    const signedHeaders = {};
+    Object.entries(signed.headers || {}).forEach(([k, v]) => {
+      signedHeaders[k] = Array.isArray(v) ? v.join(",") : String(v);
+    });
+    return { signedUrl: url, signedHeaders };
+  }
   async requestWithRetry(path, method = "POST", body, opts = { allowAuthRetry: false, retrying: false }) {
     const { allowAuthRetry, retrying } = opts;
     const url = path.startsWith("http") ? path : `${this.baseUrl}${path.startsWith("/") ? "" : "/"}${path}`;
@@ -202,10 +250,11 @@ var Revlm = class {
     if (hasBody) {
       serializedBody = EJSON.stringify(body);
     }
+    const { signedUrl, signedHeaders } = await this.signIfNeeded(url, method, headers, serializedBody);
     try {
-      const res = await this.fetchImpl(url, {
+      const res = await this.fetchImpl(signedUrl, {
         method,
-        headers,
+        headers: signedHeaders,
         body: serializedBody
       });
       const parsed = await this.parseResponse(res);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kedaruma/revlm-client",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "private": false,
   "description": "TypeScript client SDK for talking to the Revlm server replacement for MongoDB Realm.",
   "keywords": [
@@ -36,9 +36,11 @@
     "access": "public"
   },
   "dependencies": {
+    "@aws-sdk/signature-v4": "^3.374.0",
+    "@aws-crypto/sha256-js": "^5.2.0",
     "bson": "^6.10.4",
     "dotenv": "^17.2.3",
-    "@kedaruma/revlm-shared": "1.0.3"
+    "@kedaruma/revlm-shared": "1.0.4"
   },
   "devDependencies": {
     "tsup": "^8.5.1"