@lark-apaas/http-client 0.1.0

package/dist/index.js

@@ -0,0 +1,625 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_CLOCK_TOLERANCE_SEC: () => DEFAULT_CLOCK_TOLERANCE_SEC,
+  DEFAULT_JWT_EXPIRE_TIME_MS: () => DEFAULT_JWT_EXPIRE_TIME_MS,
+  HttpClient: () => HttpClient,
+  HttpError: () => HttpError,
+  generateJWTToken: () => generateJWTToken,
+  parseJWTTokenWithVerify: () => parseJWTTokenWithVerify,
+  registerPlatformPlugin: () => registerPlatformPlugin,
+  resolvePlatformBaseURL: () => resolvePlatformBaseURL
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/helper/jwt.ts
+var import_crypto = require("crypto");
+var DEFAULT_JWT_EXPIRE_TIME_MS = 30 * 60 * 1e3;
+var DEFAULT_CLOCK_TOLERANCE_SEC = 60;
+var JWT_HEADER = {
+  alg: "HS256",
+  typ: "JWT"
+};
+function generateJWTToken(customClaims, config) {
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  const payload = {
+    ...customClaims,
+    iss: customClaims.access_key,
+    iat: nowSeconds,
+    nbf: nowSeconds,
+    exp: nowSeconds + Math.floor(config.expireTimeMs / 1e3),
+    jti: (0, import_crypto.randomUUID)()
+  };
+  const encodedHeader = base64UrlEncode(JSON.stringify(JWT_HEADER));
+  const encodedPayload = base64UrlEncode(JSON.stringify(payload));
+  const signature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);
+  return `${encodedHeader}.${encodedPayload}.${signature}`;
+}
+function parseJWTTokenWithVerify(tokenString, config, options) {
+  const segments = tokenString.split(".");
+  if (segments.length !== 3) {
+    throw new Error("invalid JWT token format");
+  }
+  const [encodedHeader, encodedPayload, signature] = segments;
+  const headerJson = JSON.parse(base64UrlDecode(encodedHeader));
+  if (headerJson.alg !== "HS256") {
+    throw new Error("unsupported JWT alg");
+  }
+  const expectedSignature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const signatureBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== signatureBuffer.length || !(0, import_crypto.timingSafeEqual)(expectedBuffer, signatureBuffer)) {
+    throw new Error("JWT signature verification failed");
+  }
+  const payload = JSON.parse(base64UrlDecode(encodedPayload));
+  if (!options?.skipExpiration) {
+    const clockTolerance = options?.clockTolerance ?? DEFAULT_CLOCK_TOLERANCE_SEC;
+    const now = Math.floor(Date.now() / 1e3);
+    if (payload.exp !== void 0) {
+      if (payload.exp + clockTolerance < now) {
+        throw new Error(
+          `JWT token expired at ${new Date(payload.exp * 1e3).toISOString()}`
+        );
+      }
+    }
+    if (payload.nbf !== void 0) {
+      if (payload.nbf - clockTolerance > now) {
+        throw new Error(
+          `JWT token not yet valid, will be valid at ${new Date(payload.nbf * 1e3).toISOString()}`
+        );
+      }
+    }
+    if (payload.iat !== void 0) {
+      if (payload.iat - clockTolerance > now) {
+        throw new Error(
+          `JWT token issued in the future at ${new Date(payload.iat * 1e3).toISOString()}`
+        );
+      }
+    }
+  }
+  return payload;
+}
+function sign(input, secret) {
+  return (0, import_crypto.createHmac)("sha256", secret).update(input).digest("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function base64UrlEncode(input) {
+  return Buffer.from(input).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function base64UrlDecode(input) {
+  const padLength = (4 - (input.length % 4 || 4)) % 4;
+  const padded = `${input}${"=".repeat(padLength)}`.replace(/-/g, "+").replace(/_/g, "/");
+  return Buffer.from(padded, "base64").toString("utf8");
+}
+
+// src/helper/jwt-manager.ts
+var JWTTokenManager = class {
+  cache = /* @__PURE__ */ new Map();
+  config;
+  constructor(config) {
+    this.config = {
+      refreshBeforeMs: 5 * 60 * 1e3,
+      // 默认 5 分钟
+      ...config
+    };
+  }
+  /**
+   * 获取 JWT token，优先使用缓存
+   *
+   * 如果缓存的 token 即将过期（距离过期时间小于 refreshBeforeMs），
+   * 则会生成新的 token 并更新缓存
+   *
+   * @param claims - JWT claims
+   * @returns JWT token 字符串
+   */
+  getToken(claims) {
+    const cacheKey = this.getCacheKey(claims);
+    const cached = this.cache.get(cacheKey);
+    const now = Date.now();
+    if (cached && cached.expiresAtMs - now > this.config.refreshBeforeMs) {
+      return cached.token;
+    }
+    const token = generateJWTToken(claims, this.config);
+    const expiresAtMs = now + this.config.expireTimeMs;
+    this.cache.set(cacheKey, { token, expiresAtMs });
+    return token;
+  }
+  /**
+   * 清除所有缓存的 token
+   */
+  clearCache() {
+    this.cache.clear();
+  }
+  /**
+   * 清除特定 claims 的缓存
+   *
+   * @param claims - 要清除的 claims
+   */
+  clearCacheFor(claims) {
+    const cacheKey = this.getCacheKey(claims);
+    this.cache.delete(cacheKey);
+  }
+  /**
+   * 生成缓存 key（基于关键的 claims 字段）
+   *
+   * 使用稳定的字段顺序确保相同 claims 生成相同 key
+   *
+   * @private
+   */
+  getCacheKey(claims) {
+    const parts = [
+      claims.access_key,
+      claims.tenant_id?.toString() || "",
+      claims.user_id || "",
+      claims.app_id || "",
+      claims.app_env || "",
+      claims.sandbox_id || ""
+    ];
+    return parts.join(":");
+  }
+  /**
+   * 获取缓存统计信息（用于监控和调试）
+   *
+   * @returns 缓存统计信息
+   */
+  getCacheStats() {
+    const now = Date.now();
+    let validCount = 0;
+    let expiredCount = 0;
+    for (const cached of this.cache.values()) {
+      if (cached.expiresAtMs > now) {
+        validCount++;
+      } else {
+        expiredCount++;
+      }
+    }
+    return {
+      total: this.cache.size,
+      valid: validCount,
+      expired: expiredCount
+    };
+  }
+};
+
+// src/plugins/platform-plugin.ts
+var DEFAULT_DOMAIN_ENV = "FORCE_AUTHN_INNERAPI_DOMAIN";
+var DEFAULT_ACCESS_KEY_ENV = "FORCE_AUTHN_ACCESS_KEY";
+var DEFAULT_SECRET_KEY_ENV = "FORCE_AUTHN_SECRET_KEY";
+function resolvePlatformBaseURL(options) {
+  if (!options?.enabled) {
+    return options?.baseURL;
+  }
+  if (options.baseURL) {
+    return options.baseURL;
+  }
+  const envName = options.domainEnv || DEFAULT_DOMAIN_ENV;
+  const domain = process.env[envName];
+  if (!domain) {
+    throw new Error(`\u5E73\u53F0\u6A21\u5F0F\u9700\u8981\u57FA\u7840\u57DF\u540D\uFF0C\u8BF7\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ${envName}`);
+  }
+  return domain;
+}
+function registerPlatformPlugin(interceptors, options) {
+  if (!options.enabled) {
+    return void 0;
+  }
+  ensureNoAccessKeyOverride("platform.defaultClaims", options.defaultClaims);
+  const accessKeyEnv = options.accessKeyEnv || DEFAULT_ACCESS_KEY_ENV;
+  const secretKeyEnv = options.secretKeyEnv || DEFAULT_SECRET_KEY_ENV;
+  const accessKey = options.accessKey ?? process.env[accessKeyEnv];
+  if (!accessKey) {
+    throw new Error(`\u5E73\u53F0\u9274\u6743\u9700\u8981 access key\uFF0C\u8BF7\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ${accessKeyEnv}`);
+  }
+  const secretKey = options.secretKey ?? process.env[secretKeyEnv];
+  if (!secretKey) {
+    throw new Error(`\u5E73\u53F0\u9274\u6743\u9700\u8981 secret key\uFF0C\u8BF7\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ${secretKeyEnv}`);
+  }
+  const expireTimeMs = options.expireTimeMs ?? DEFAULT_JWT_EXPIRE_TIME_MS;
+  const tokenManager = new JWTTokenManager({
+    accessKey,
+    secretKey,
+    expireTimeMs,
+    refreshBeforeMs: options.refreshBeforeMs
+  });
+  interceptors.request.use((config) => {
+    ensureNoAccessKeyOverride("request.platformAuth.customClaims", config.platformAuth?.customClaims);
+    const claims = {
+      ...options.defaultClaims || {},
+      ...config.platformAuth?.customClaims || {},
+      access_key: accessKey
+    };
+    const token = tokenManager.getToken(claims);
+    const headers = {
+      ...config.headers,
+      "Authorization": `Bearer ${token}`,
+      "x-api-key": accessKey
+    };
+    return {
+      ...config,
+      headers
+    };
+  });
+  return tokenManager;
+}
+function ensureNoAccessKeyOverride(name, claims) {
+  if (claims && Object.prototype.hasOwnProperty.call(claims, "access_key")) {
+    throw new Error(`${name} \u4E0D\u5141\u8BB8\u8BBE\u7F6E access_key`);
+  }
+}
+
+// src/core/InterceptorManager.ts
+var InterceptorManager = class {
+  interceptors = [];
+  /**
+   * 添加拦截器
+   * @returns 拦截器 ID，用于后续移除
+   */
+  use(onFulfilled, onRejected) {
+    this.interceptors.push({ onFulfilled, onRejected });
+    return this.interceptors.length - 1;
+  }
+  /**
+   * 移除拦截器
+   */
+  eject(id) {
+    if (this.interceptors[id]) {
+      this.interceptors[id] = null;
+    }
+  }
+  /**
+   * 清空所有拦截器
+   */
+  clear() {
+    this.interceptors = [];
+  }
+  /**
+   * 遍历所有拦截器
+   */
+  forEach(fn) {
+    this.interceptors.forEach((interceptor) => {
+      if (interceptor !== null) {
+        fn(interceptor);
+      }
+    });
+  }
+};
+
+// src/core/utils.ts
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function normalizeHeaders(headers) {
+  if (!headers) {
+    return {};
+  }
+  if (headers instanceof Headers) {
+    const normalized2 = {};
+    headers.forEach((value, key) => {
+      normalized2[key] = value;
+    });
+    return normalized2;
+  }
+  if (Array.isArray(headers)) {
+    return headers.reduce((acc, [key, value]) => {
+      acc[key] = value;
+      return acc;
+    }, {});
+  }
+  const normalized = {};
+  Object.entries(headers).forEach(
+    ([key, value]) => {
+      const normalizedValue = Array.isArray(value) ? value.join(",") : value;
+      normalized[key] = normalizedValue;
+    }
+  );
+  return normalized;
+}
+
+// src/core/types.ts
+var HttpError = class _HttpError extends Error {
+  isHttpError = true;
+  response;
+  config;
+  constructor(response, config, message) {
+    super(message || `Request failed with status ${response?.status || "unknown"}`);
+    this.name = "HttpError";
+    this.response = response;
+    this.config = sanitizeConfig(config);
+    Object.setPrototypeOf(this, _HttpError.prototype);
+  }
+};
+function sanitizeConfig(config) {
+  const { headers, ...rest } = config;
+  return {
+    ...rest,
+    headers: sanitizeHeaders(headers)
+  };
+}
+function sanitizeHeaders(headers) {
+  if (!headers) {
+    return void 0;
+  }
+  const normalized = normalizeHeaders(headers);
+  const sanitized = {};
+  const sensitiveHeaders = ["authorization", "x-api-key", "cookie", "x-secret"];
+  for (const [key, value] of Object.entries(normalized)) {
+    const lowerKey = key.toLowerCase();
+    if (sensitiveHeaders.includes(lowerKey)) {
+      sanitized[key] = "[REDACTED]";
+    } else {
+      sanitized[key] = value;
+    }
+  }
+  return sanitized;
+}
+
+// src/core/HttpClient.ts
+var HttpClient = class {
+  defaultConfig;
+  securityConfig;
+  /**
+   * 拦截器管理器（API 与 Axios 一致）
+   */
+  interceptors = {
+    request: new InterceptorManager(),
+    response: new InterceptorManager()
+  };
+  constructor(config) {
+    const { platform, security, ...restConfig } = config || {};
+    this.defaultConfig = {
+      timeout: 5e3,
+      ...restConfig
+    };
+    const strictMode = security?.strictMode ?? false;
+    this.securityConfig = {
+      allowedProtocols: strictMode ? ["http:", "https:"] : null,
+      maxResponseSize: strictMode ? 50 * 1024 * 1024 : 0,
+      // 50MB
+      strictMode,
+      ...security
+    };
+    if (platform?.enabled) {
+      if (!this.defaultConfig.baseURL) {
+        this.defaultConfig.baseURL = resolvePlatformBaseURL(platform);
+      }
+      registerPlatformPlugin(this.interceptors, platform);
+    }
+  }
+  /**
+   * GET 请求
+   */
+  async get(url, config) {
+    return this.request({ ...config, url, method: "GET" });
+  }
+  /**
+   * POST 请求
+   */
+  async post(url, data, config) {
+    const headers = { ...config?.headers };
+    let body = data;
+    if (isPlainObject(data)) {
+      body = JSON.stringify(data);
+      if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
+        headers["Content-Type"] = "application/json";
+      }
+    }
+    return this.request({
+      ...config,
+      url,
+      method: "POST",
+      body,
+      headers
+    });
+  }
+  /**
+   * PUT 请求
+   */
+  async put(url, data, config) {
+    const headers = { ...config?.headers };
+    let body = data;
+    if (isPlainObject(data)) {
+      body = JSON.stringify(data);
+      if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
+        headers["Content-Type"] = "application/json";
+      }
+    }
+    return this.request({
+      ...config,
+      url,
+      method: "PUT",
+      body,
+      headers
+    });
+  }
+  /**
+   * DELETE 请求
+   */
+  async delete(url, config) {
+    return this.request({ ...config, url, method: "DELETE" });
+  }
+  /**
+   * PATCH 请求
+   */
+  async patch(url, data, config) {
+    const headers = { ...config?.headers };
+    let body = data;
+    if (isPlainObject(data)) {
+      body = JSON.stringify(data);
+      if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
+        headers["Content-Type"] = "application/json";
+      }
+    }
+    return this.request({
+      ...config,
+      url,
+      method: "PATCH",
+      body,
+      headers
+    });
+  }
+  /**
+   * 核心请求方法（fetch 风格）
+   */
+  async request(config) {
+    const baseHeaders = normalizeHeaders(this.defaultConfig.headers);
+    const overrideHeaders = normalizeHeaders(config.headers);
+    const mergedKeyMap = {};
+    for (const key in baseHeaders) {
+      mergedKeyMap[key.toLowerCase()] = { key, value: baseHeaders[key] };
+    }
+    for (const key in overrideHeaders) {
+      mergedKeyMap[key.toLowerCase()] = { key, value: overrideHeaders[key] };
+    }
+    const finalHeaders = {};
+    for (const lowerKey in mergedKeyMap) {
+      const { key, value } = mergedKeyMap[lowerKey];
+      finalHeaders[key] = value;
+    }
+    let mergedConfig = {
+      ...this.defaultConfig,
+      ...config,
+      headers: finalHeaders
+    };
+    try {
+      mergedConfig = await this.runRequestInterceptors(mergedConfig);
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    mergedConfig.headers = normalizeHeaders(mergedConfig.headers);
+    const fullUrl = this.buildUrl(mergedConfig.url, mergedConfig.params);
+    const timeout = mergedConfig.timeout || this.defaultConfig.timeout || 5e3;
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    const externalSignal = mergedConfig.signal;
+    if (externalSignal) {
+      if (externalSignal.aborted) {
+        clearTimeout(timeoutId);
+        controller.abort();
+      } else {
+        externalSignal.addEventListener("abort", () => controller.abort(), { once: true });
+      }
+    }
+    const { platformAuth, params, timeout: _timeout, baseURL, url, ...fetchOptions } = mergedConfig;
+    try {
+      const response = await fetch(fullUrl, {
+        ...fetchOptions,
+        signal: controller.signal
+        // 传递我们自己的 controller signal
+      });
+      clearTimeout(timeoutId);
+      if (this.securityConfig.maxResponseSize > 0) {
+        const contentLength = response.headers.get("content-length");
+        if (contentLength) {
+          const size = parseInt(contentLength, 10);
+          if (size > this.securityConfig.maxResponseSize) {
+            throw new Error(
+              `Response size ${size} bytes exceeds limit of ${this.securityConfig.maxResponseSize} bytes`
+            );
+          }
+        }
+      }
+      if (!response.ok) {
+        const error = new HttpError(response, mergedConfig);
+        return this.runResponseInterceptors(Promise.reject(error));
+      }
+      return this.runResponseInterceptors(Promise.resolve(response));
+    } catch (error) {
+      clearTimeout(timeoutId);
+      const httpError = error instanceof HttpError ? error : new HttpError(
+        void 0,
+        mergedConfig,
+        error.name === "AbortError" ? "Request aborted" : error.message
+      );
+      return this.runResponseInterceptors(Promise.reject(httpError));
+    }
+  }
+  /**
+   * 执行请求拦截器链
+   */
+  runRequestInterceptors(config) {
+    let promise = Promise.resolve(config);
+    const interceptors = [];
+    this.interceptors.request.forEach((interceptor) => {
+      interceptors.push(interceptor);
+    });
+    for (const interceptor of interceptors) {
+      promise = promise.then(
+        interceptor.onFulfilled,
+        interceptor.onRejected
+      );
+    }
+    return promise;
+  }
+  /**
+   * 执行响应拦截器链
+   */
+  async runResponseInterceptors(promise) {
+    let currentPromise = promise;
+    const interceptors = [];
+    this.interceptors.response.forEach((interceptor) => {
+      interceptors.push(interceptor);
+    });
+    for (const interceptor of interceptors) {
+      currentPromise = currentPromise.then(
+        interceptor.onFulfilled,
+        interceptor.onRejected
+      );
+    }
+    return currentPromise;
+  }
+  /**
+   * 构建完整 URL（包含 baseURL 和 query params）
+   */
+  buildUrl(url, params) {
+    const fullUrl = new URL(url, this.defaultConfig.baseURL);
+    if (this.securityConfig.allowedProtocols) {
+      if (!this.securityConfig.allowedProtocols.includes(fullUrl.protocol)) {
+        throw new Error(
+          `Protocol ${fullUrl.protocol} is not allowed. Allowed protocols: ${this.securityConfig.allowedProtocols.join(", ")}`
+        );
+      }
+    }
+    if (params) {
+      Object.entries(params).forEach(([key, value]) => {
+        if (value !== void 0 && value !== null) {
+          fullUrl.searchParams.set(key, String(value));
+        }
+      });
+    }
+    return fullUrl.href;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_CLOCK_TOLERANCE_SEC,
+  DEFAULT_JWT_EXPIRE_TIME_MS,
+  HttpClient,
+  HttpError,
+  generateJWTToken,
+  parseJWTTokenWithVerify,
+  registerPlatformPlugin,
+  resolvePlatformBaseURL
+});
+//# sourceMappingURL=index.js.map