@loaders.gl/services 5.0.0-alpha.4 → 5.0.0-alpha.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loaders.gl/services",
-  "version": "5.0.0-alpha.4",
+  "version": "5.0.0-alpha.6",
   "description": "Framework-independent loaders and sources for geospatial services",
   "license": "MIT",
   "type": "module",
@@ -36,6 +36,10 @@
     "./bundled": {
       "types": "./dist/bundled.d.ts",
       "import": "./dist/bundled.js"
+    },
+    "./authentication": {
+      "types": "./dist/authentication.d.ts",
+      "import": "./dist/authentication.js"
     }
   },
   "sideEffects": false,
@@ -45,16 +49,16 @@
     "README.md"
   ],
   "dependencies": {
-    "@loaders.gl/gis": "5.0.0-alpha.4",
-    "@loaders.gl/i3s": "5.0.0-alpha.4",
-    "@loaders.gl/images": "5.0.0-alpha.4",
-    "@loaders.gl/lerc": "5.0.0-alpha.4",
-    "@loaders.gl/loader-utils": "5.0.0-alpha.4",
-    "@loaders.gl/mvt": "5.0.0-alpha.4",
-    "@loaders.gl/schema": "5.0.0-alpha.4"
+    "@loaders.gl/gis": "5.0.0-alpha.6",
+    "@loaders.gl/i3s": "5.0.0-alpha.6",
+    "@loaders.gl/images": "5.0.0-alpha.6",
+    "@loaders.gl/lerc": "5.0.0-alpha.6",
+    "@loaders.gl/loader-utils": "5.0.0-alpha.6",
+    "@loaders.gl/mvt": "5.0.0-alpha.6",
+    "@loaders.gl/schema": "5.0.0-alpha.6"
   },
   "peerDependencies": {
     "@loaders.gl/core": "~5.0.0-alpha.0"
   },
-  "gitHead": "470a9cf1956b8326c92015b314f4ad8a10a3517c"
+  "gitHead": "9b9ea7738e0fe63e55c19c136283705f99e0b9bf"
 }

package/src/arcgis/arcgis-feature-server-source-loader.ts

@@ -155,7 +155,9 @@ export class ArcGISVectorSource
         return geoJsonTable;
       case 'arrow':
       default:
-        return convertFeaturesToWKBArrowTable(geoJsonTable.features);
+        return convertFeaturesToWKBArrowTable(geoJsonTable.features, {
+          encodingPreference: parameters.geoarrow?.encodingPreference
+        });
     }
   }
 

package/src/authentication.ts

@@ -2,12 +2,24 @@
 // SPDX-License-Identifier: MIT
 // Copyright (c) vis.gl contributors
 
-import type {RequestCredential, TokenValue} from '@loaders.gl/loader-utils';
+import type {
+  FetchLike,
+  RequestCredential,
+  TokenProviderContext,
+  TokenValue
+} from '@loaders.gl/loader-utils';
 import {
+  createAuthenticatedFetch,
   createBearerTokenCredential,
   createQueryParameterCredential
 } from '@loaders.gl/loader-utils';
 
+const CESIUM_ION_API_ORIGIN = 'https://api.cesium.com';
+const CESIUM_ION_ASSET_ORIGINS = [
+  'https://assets.ion.cesium.com',
+  'https://assets.cesium.com'
+] as const;
+
 /** Shared options for provider credential presets with known public API origins. */
 export type ServiceCredentialOptions = {
   /** Replaces the provider's default exact-origin allowlist. */
@@ -38,6 +50,12 @@ export type GoogleMapsCredentialOptions = ServiceCredentialOptions & {
 export type CesiumIonCredentialOptions = ServiceCredentialOptions & {
   /** Cesium ion access token or application-managed token callback. */
   accessToken: TokenValue;
+  /** Optional asset whose endpoint-scoped token should be resolved. */
+  assetId?: number | string;
+  /** Overrides the transport used for the ion endpoint-token exchange. */
+  fetch?: FetchLike;
+  /** Whether the supplied token is account-scoped or already asset-scoped. */
+  tokenType?: 'account' | 'asset' | 'auto';
 };
 
 /** Creates an exact-origin ArcGIS `token` query credential. */
@@ -73,11 +91,98 @@ export function createGoogleMapsCredential(
   });
 }
 
-/** Creates a bearer credential for the Cesium ion REST API. */
+/**
+ * Creates a bearer credential for the Cesium ion REST API or one Cesium ion asset.
+ *
+ * Supplying `assetId` creates an asset-origin credential. Account tokens are exchanged lazily
+ * through Cesium ion's endpoint API; legacy asset-scoped tokens are used directly. Without an
+ * `assetId`, the credential is scoped only to the ion REST API for backwards compatibility.
+ */
 export function createCesiumIonCredential(options: CesiumIonCredentialOptions): RequestCredential {
+  if (options.assetId === undefined || options.assetId === null) {
+    return createBearerTokenCredential({
+      id: 'cesium-ion-access-token',
+      origins: options.origins || [CESIUM_ION_API_ORIGIN],
+      token: options.accessToken
+    });
+  }
+
+  const assetId = options.assetId;
+  const origins = options.origins || CESIUM_ION_ASSET_ORIGINS;
+  let endpointTokenPromise: Promise<string | null> | null = null;
+
   return createBearerTokenCredential({
-    id: 'cesium-ion-access-token',
-    origins: options.origins || ['https://api.cesium.com'],
-    token: options.accessToken
+    id: `cesium-ion-asset-${assetId}`,
+    origins,
+    token: context => {
+      if (context.reason === 'refresh') {
+        endpointTokenPromise = null;
+      }
+      endpointTokenPromise ||= resolveCesiumIonAssetToken(options, assetId, origins, context);
+      return endpointTokenPromise;
+    }
+  });
+}
+
+/** Resolves an account token and exchanges it for an asset endpoint token when required. */
+async function resolveCesiumIonAssetToken(
+  options: CesiumIonCredentialOptions,
+  assetId: number | string,
+  origins: readonly string[],
+  context: TokenProviderContext
+): Promise<string | null> {
+  const endpointURL = `${CESIUM_ION_API_ORIGIN}/v1/assets/${assetId}/endpoint`;
+  const accessToken =
+    typeof options.accessToken === 'function'
+      ? await options.accessToken({...context, url: endpointURL})
+      : options.accessToken;
+  if (!accessToken) return null;
+
+  const tokenType = options.tokenType || 'auto';
+  if (
+    tokenType === 'asset' ||
+    (tokenType === 'auto' && isCesiumIonAssetToken(accessToken, assetId))
+  ) {
+    return accessToken;
+  }
+
+  const apiCredential = createBearerTokenCredential({
+    id: `cesium-ion-api-${assetId}`,
+    origins: [CESIUM_ION_API_ORIGIN],
+    token: accessToken
+  });
+  const ionFetch = createAuthenticatedFetch({
+    fetch: options.fetch,
+    credentials: [apiCredential]
   });
+  const response = await ionFetch(endpointURL);
+  if (!response.ok) {
+    throw new Error(`Cesium ion asset ${assetId} endpoint request failed: ${response.status}`);
+  }
+
+  const endpoint = (await response.json()) as {accessToken?: unknown; url?: unknown};
+  if (typeof endpoint.url !== 'string' || !origins.includes(new URL(endpoint.url).origin)) {
+    throw new Error(`Cesium ion asset ${assetId} resolved to an unconfigured origin.`);
+  }
+  if (typeof endpoint.accessToken !== 'string' || !endpoint.accessToken) {
+    throw new Error(`Cesium ion did not return an endpoint token for asset ${assetId}.`);
+  }
+  return endpoint.accessToken;
+}
+
+/** Detects legacy JWTs whose claims scope them directly to the requested asset. */
+function isCesiumIonAssetToken(token: string, assetId: number | string): boolean {
+  try {
+    const encodedClaims = token.split('.')[1];
+    if (!encodedClaims) return false;
+    const base64 = encodedClaims.replace(/-/g, '+').replace(/_/g, '/');
+    const paddedBase64 = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
+    const claims = JSON.parse(atob(paddedBase64)) as {assets?: unknown};
+    return (
+      Array.isArray(claims.assets) &&
+      claims.assets.some(claimAssetId => String(claimAssetId) === String(assetId))
+    );
+  } catch {
+    return false;
+  }
 }