@larc-iu/plaid-client 0.1.0-alpha.8 → 0.2.0-alpha.0

package/src/http.js

@@ -94,6 +94,9 @@ export function timeoutSignal(timeout) {
  *   skipResponseTransform - Return raw parsed JSON (no transformResponse)
  *   noAuth          - Skip Authorization header
  *   binaryResponse  - Return arrayBuffer instead of JSON/text
+ *   timeout         - Per-request timeout in ms overriding client.timeout
+ *                     for this call (0/null disables). Used for known-long
+ *                     ops like project delete.
  */
 export async function makeRequest(client, method, path, options = {}) {
   const {
@@ -105,6 +108,8 @@ export async function makeRequest(client, method, path, options = {}) {
     skipResponseTransform,
     noAuth,
     binaryResponse,
+    auditMessage,
+    timeout,
   } = options;
 
   // Build URL
@@ -135,16 +140,35 @@ export async function makeRequest(client, method, path, options = {}) {
     requestBody = transformRequest(body);
   }
 
-  // Strict mode: append document-version for non-GET requests
-  if (client.strictModeDocumentId && method !== 'GET') {
+  // Strict mode: append document-version for non-GET requests.
+  // Inside a batch, stamp ONLY the first write: batches run atomically
+  // server-side, so a version check on the first op gives whole-batch OCC
+  // semantics, while stamping every op would 409 the second op against the
+  // version bump the first op itself caused (every queued op captures the
+  // same pre-batch version).
+  if (client.strictModeDocumentId && method !== 'GET'
+      && !(client.isBatching && client.batchVersionStamped)) {
     const docId = client.strictModeDocumentId;
     if (client.documentVersions[docId]) {
       const docVersion = client.documentVersions[docId];
       const separator = url.includes('?') ? '&' : '?';
       url += `${separator}document-version=${encodeURIComponent(docVersion)}`;
+      if (client.isBatching) client.batchVersionStamped = true;
     }
   }
 
+  // Custom audit-log message (overrides the auto-generated description).
+  // Per-call `auditMessage` option wins, else the ambient `client.auditMessage`
+  // (see setAuditMessage/withAuditMessage). Unlike document-version this has no
+  // OCC self-conflict, so it is stamped on EVERY queued batch op, not just the
+  // first. The server templates `{param}` placeholders against the endpoint's
+  // own path/query/body params.
+  const effectiveAuditMessage = auditMessage !== undefined ? auditMessage : client.auditMessage;
+  if (effectiveAuditMessage && method !== 'GET') {
+    const separator = url.includes('?') ? '&' : '?';
+    url += `${separator}audit-message=${encodeURIComponent(effectiveAuditMessage)}`;
+  }
+
   // Batch mode
   if (client.isBatching) {
     if (noBatch) {
@@ -174,14 +198,22 @@ export async function makeRequest(client, method, path, options = {}) {
   if (requestBody !== undefined) {
     fetchOptions.body = formData ? requestBody : JSON.stringify(requestBody);
   }
-  const signal = timeoutSignal(client.timeout);
+  const signal = timeoutSignal(timeout !== undefined ? timeout : client.timeout);
   if (signal) fetchOptions.signal = signal;
 
   try {
     const response = await fetch(url, fetchOptions);
 
     if (!response.ok) {
-      throw makeHttpError(response, await parseErrorBody(response), url, method);
+      const error = makeHttpError(response, await parseErrorBody(response), url, method);
+      // 401 means the token is missing/expired/invalid. Fire the app's auth-error
+      // handler once (it discards the token and routes back to login). 403
+      // (forbidden — authenticated but not permitted) deliberately does NOT.
+      if (response.status === 401 && typeof client.onAuthError === 'function' && !client._authErrorFired) {
+        client._authErrorFired = true;
+        try { client.onAuthError(error); } catch (_) { /* handler must not mask the original error */ }
+      }
+      throw error;
     }
 
     // Binary response (getMedia)