@liveblocks/core 1.3.1 → 1.3.3

package/dist/index.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "1.3.1";
+var PKG_VERSION = "1.3.3";
 var PKG_FORMAT = "esm";
 
 // src/dupe-detection.ts
@@ -1281,6 +1281,7 @@ function parseAuthToken(rawTokenString) {
 // src/auth-manager.ts
 function createAuthManager(authOptions) {
   const authentication = prepareAuthentication(authOptions);
+  const seenTokens = /* @__PURE__ */ new Set();
   const tokens = [];
   const expiryTimes = [];
   const requestPromises = /* @__PURE__ */ new Map();
@@ -1304,8 +1305,6 @@ function createAuthManager(authOptions) {
       }
       if (token.parsed.k === "id" /* ID_TOKEN */) {
         return token;
-      } else if (token.parsed.k === "sec-legacy" /* SECRET_LEGACY */) {
-        return void 0;
       } else if (token.parsed.k === "acc" /* ACCESS_TOKEN */) {
         for (const [resource, scopes] of Object.entries(token.parsed.perms)) {
           if (resource.includes("*") && roomId.startsWith(resource.replace("*", "")) || roomId === resource && hasCorrespondingScopes(requestedScope, scopes)) {
@@ -1327,7 +1326,13 @@ function createAuthManager(authOptions) {
       const response = await fetchAuthEndpoint(fetcher, authentication.url, {
         room: roomId
       });
-      return parseAuthToken(response.token);
+      const parsed = parseAuthToken(response.token);
+      if (seenTokens.has(parsed.raw)) {
+        throw new StopRetrying(
+          "The same Liveblocks auth token was issued from the backend before. Caching Liveblocks tokens is not supported."
+        );
+      }
+      return parsed;
     }
     if (authentication.type === "custom") {
       const response = await authentication.callback(roomId);
@@ -1368,8 +1373,11 @@ function createAuthManager(authOptions) {
       const token = await currentPromise;
       const BUFFER = 30;
       const expiresAt = Math.floor(Date.now() / 1e3) + (token.parsed.exp - token.parsed.iat) - BUFFER;
-      tokens.push(token);
-      expiryTimes.push(expiresAt);
+      seenTokens.add(token.raw);
+      if (token.parsed.k !== "sec-legacy" /* SECRET_LEGACY */) {
+        tokens.push(token);
+        expiryTimes.push(expiresAt);
+      }
       return { type: "secret", token };
     } finally {
       requestPromises.delete(roomId);
@@ -1703,7 +1711,9 @@ function createCommentsApi(roomId, getAuthValue, { serverEndpoint }) {
   }
   async function fetchApi(roomId2, endpoint, options) {
     const authValue = await getAuthValue();
-    const url = `${serverEndpoint}/c/rooms/${roomId2}${endpoint}`;
+    const url = `${serverEndpoint}/c/rooms/${encodeURIComponent(
+      roomId2
+    )}${endpoint}`;
     return await fetch(url, {
       ...options,
       headers: {
@@ -1749,7 +1759,7 @@ function createCommentsApi(roomId, getAuthValue, { serverEndpoint }) {
     threadId
   }) {
     return fetchJson(
-      `/threads/${threadId}/metadata`,
+      `/threads/${encodeURIComponent(threadId)}/metadata`,
       {
         method: "POST",
         headers: {
@@ -1764,16 +1774,19 @@ function createCommentsApi(roomId, getAuthValue, { serverEndpoint }) {
     commentId,
     body
   }) {
-    return fetchJson(`/threads/${threadId}/comments`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        id: commentId,
-        body
-      })
-    });
+    return fetchJson(
+      `/threads/${encodeURIComponent(threadId)}/comments`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          id: commentId,
+          body
+        })
+      }
+    );
   }
   function editComment({
     threadId,
@@ -1781,7 +1794,9 @@ function createCommentsApi(roomId, getAuthValue, { serverEndpoint }) {
     body
   }) {
     return fetchJson(
-      `/threads/${threadId}/comments/${commentId}`,
+      `/threads/${encodeURIComponent(threadId)}/comments/${encodeURIComponent(
+        commentId
+      )}`,
       {
         method: "POST",
         headers: {
@@ -1797,9 +1812,14 @@ function createCommentsApi(roomId, getAuthValue, { serverEndpoint }) {
     threadId,
     commentId
   }) {
-    await fetchJson(`/threads/${threadId}/comments/${commentId}`, {
-      method: "DELETE"
-    });
+    await fetchJson(
+      `/threads/${encodeURIComponent(threadId)}/comments/${encodeURIComponent(
+        commentId
+      )}`,
+      {
+        method: "DELETE"
+      }
+    );
   }
   return {
     getThreads,