@oxy.so/core 1.18.0 → 1.18.1

package/dist/esm/HttpService.js

@@ -233,6 +233,7 @@ export class HttpService {
         this.noFresherTokenThan = null;
         this.authRefreshHandler = null;
         this.accessTokenProvider = null;
+        this.anonymousAuthProvider = null;
         this.deviceSecretMintInFlight = null;
         /**
          * Bumped by every {@link endSession}. A re-mint captures it before its first
@@ -918,7 +919,7 @@ export class HttpService {
     async getAuthHeader() {
         const accessToken = this.syncAccessTokenFromProvider();
         if (!accessToken) {
-            return null;
+            return this.getAnonymousAuthHeader();
         }
         try {
             const decoded = jwtDecode(accessToken);
@@ -947,6 +948,24 @@ export class HttpService {
             return null;
         }
     }
+    /**
+     * The bearer for a request that has no user session behind it, from the
+     * {@link AnonymousAuthProvider} if one is installed. Never throws: a provider
+     * that fails sends the request anonymous, exactly as it went before any
+     * provider existed.
+     */
+    async getAnonymousAuthHeader() {
+        if (!this.anonymousAuthProvider)
+            return null;
+        try {
+            const token = await this.anonymousAuthProvider();
+            return token ? `Bearer ${token}` : null;
+        }
+        catch (error) {
+            this.logger.debug('Anonymous auth provider failed; sending the request anonymous:', error);
+            return null;
+        }
+    }
     async refreshAccessToken(reason) {
         if (!this.authRefreshHandler) {
             return null;
@@ -1255,6 +1274,16 @@ export class HttpService {
     setAccessTokenProvider(provider) {
         this.accessTokenProvider = provider;
     }
+    /**
+     * Authenticate requests that carry no user session with the bearer this
+     * provider returns — in practice a backend's own service token (see
+     * `OxyConfig.serviceIdentity`). A user session always wins: the provider is
+     * consulted only when there is no access token, and never for `skipAuth`
+     * requests. `null` removes it.
+     */
+    setAnonymousAuthProvider(provider) {
+        this.anonymousAuthProvider = provider;
+    }
     clearTokens() {
         this.tokenStore.clearTokens();
         // Drop the response cache on logout. The cache is identity-scoped, so a

package/dist/esm/mixins/OxyServices.auth.js

@@ -85,6 +85,11 @@ export class ServiceCredentialMismatchError extends Error {
         this.name = 'ServiceCredentialMismatchError';
     }
 }
+/**
+ * How long a failed service-token mint sends session-less requests anonymous
+ * before the next attempt, under `serviceIdentity: 'when-anonymous'`.
+ */
+export const ANONYMOUS_SERVICE_TOKEN_RETRY_MS = 30000;
 export function OxyServicesAuthMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -111,6 +116,56 @@ export function OxyServicesAuthMixin(Base) {
             this._serviceApiKey = null;
             /** @internal Raw apiSecret stored by configureServiceAuth() for use by getServiceToken() */
             this._serviceApiSecret = null;
+            /**
+             * Before this instant, a request without a user session does not try to
+             * mint a service token and goes out anonymous. Set after a failed mint; see
+             * {@link _serviceTokenForAnonymousRequest}.
+             *
+             * @internal
+             */
+            this._anonymousServiceTokenRetryAt = 0;
+            if (this.config.serviceIdentity === 'when-anonymous') {
+                this.httpService.setAnonymousAuthProvider(() => this._serviceTokenForAnonymousRequest());
+            }
+        }
+        /**
+         * The bearer for a request with no user session, under `serviceIdentity:
+         * 'when-anonymous'`: this process's service token, or `null` to send the
+         * request anonymous as before.
+         *
+         * `null`, never a throw, whenever there is no token to offer:
+         * - no key pair and no attestable workload (a local checkout) — asking
+         *   costs nothing and there is nothing to ask for;
+         * - the mint failed. The request still goes out, anonymous, and so does
+         *   every request for the next {@link ANONYMOUS_SERVICE_TOKEN_RETRY_MS}, so
+         *   an Oxy that is refusing attestation (seen for ~2.5 minutes after a
+         *   deploy on 2026-09-25) is asked once per window rather than once per
+         *   read, and no read waits on a mint that just failed.
+         *
+         * The token itself comes from {@link getServiceToken}: cached for its
+         * lifetime and single-flight, so concurrent reads share one mint.
+         *
+         * @internal
+         */
+        async _serviceTokenForAnonymousRequest() {
+            if (Date.now() < this._anonymousServiceTokenRetryAt)
+                return null;
+            const hasKeyPair = Boolean(this._serviceApiKey && this._serviceApiSecret);
+            if (!hasKeyPair && !(await this._canUseWorkloadIdentity()))
+                return null;
+            try {
+                return await this.getServiceToken();
+            }
+            catch (error) {
+                this._anonymousServiceTokenRetryAt = Date.now() + ANONYMOUS_SERVICE_TOKEN_RETRY_MS;
+                logger.warn('[oxy.auth] No service token for a request without a session; sending it anonymous', {
+                    component: 'auth',
+                    method: '_serviceTokenForAnonymousRequest',
+                    retryInMs: ANONYMOUS_SERVICE_TOKEN_RETRY_MS,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return null;
+            }
         }
         /**
          * Hash an apiKey into a stable Map cache key. Uses Node's SHA-256 — service