@smileid/usesmileid 12.0.2 → 12.1.0

package/src/data/api/auth/token_holder.ts

@@ -1,72 +0,0 @@
-/**
- * Thread-safe holder for the partner-supplied `smileid-token`.
- *
- * The token is mutable at runtime so a partner-supplied refresh callback can
- * replace it on a 401 response and subsequent requests automatically pick up
- * the fresh value via `SmileAuthInterceptor` (and `SmileRequestMacInterceptor`
- * when MAC stamping is re-enabled). JavaScript's single-threaded event loop
- * provides safe publication of field writes; this class adds **single-flight**
- * refresh semantics so concurrent 401s collapse into one partner-callback
- * invocation.
- */
-export class TokenHolder {
-  private _token: string;
-  private _inflight: Promise<string | null> | null = null;
-
-  constructor(initialToken: string) {
-    this._token = initialToken;
-  }
-
-  /** Current token. Returns the latest value any refresh has written. */
-  get current(): string {
-    return this._token;
-  }
-
-  /**
-   * Replace the current token. Visible for integration tests that simulate a
-   * refresh without driving a full HTTP round-trip; production refresh flows
-   * always update the holder via {@link refreshSingleFlight}.
-   */
-  update(newToken: string): void {
-    this._token = newToken;
-  }
-
-  /**
-   * Single-flight refresh.
-   *
-   * If another concurrent caller already refreshed the token while this caller
-   * was awaiting, return the new token without re-invoking `refreshCallback`.
-   * If a refresh is already in flight, join it instead of starting a second
-   * one. Otherwise invoke the callback, store the result, and return it.
-   *
-   * `refreshCallback` is supplied by the caller as a non-throwing
-   * `Promise<string | null>` returning function; `TokenRefreshInterceptor`
-   * wraps the partner-facing `(previous) => Promise<string>` so any thrown
-   * exception is collapsed to `null`. A `null` return tells the caller to
-   * surface the original 401 unchanged.
-   */
-  async refreshSingleFlight(
-    previousToken: string,
-    refreshCallback: (previousToken: string) => Promise<string | null>,
-  ): Promise<string | null> {
-    if (this._token !== previousToken) {
-      return this._token;
-    }
-    if (this._inflight) {
-      return this._inflight;
-    }
-    const promise = (async () => {
-      try {
-        const next = await refreshCallback(previousToken);
-        if (next !== null) {
-          this._token = next;
-        }
-        return next;
-      } finally {
-        this._inflight = null;
-      }
-    })();
-    this._inflight = promise;
-    return promise;
-  }
-}

package/src/data/api/interceptors/__tests__/credential_header_redaction.test.ts

@@ -1,144 +0,0 @@
-import axios, { AxiosHeaders, type InternalAxiosRequestConfig } from "axios";
-import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
-
-import { LogLevel } from "../../../../core/models/network_config";
-import { LoggingConfigBuilder } from "../../../dsl/builder/config_builder";
-import { InterceptorConfigBuilder } from "../../../dsl/builder/interceptor_config_builder";
-import { attachLoggingInterceptor } from "../logging_interceptor";
-
-const CANONICAL_CREDENTIAL_HEADERS: ReadonlyArray<
-  readonly [name: string, value: string]
-> = [
-  ["SmileID-Token", "secret-jwt-value"],
-  ["smileid-partner-id", "secret-partner-002"],
-  ["SmileID-Api-Key", "secret-api-key"],
-  ["smileid-device-nonce", "secret-nonce"],
-  ["Authorization", "Bearer secret-bearer"],
-  ["Cookie", "session=secret-cookie"],
-  ["Set-Cookie", "session=secret-set-cookie"],
-];
-
-function requestHeaders(): AxiosHeaders {
-  const headers = new AxiosHeaders();
-  for (const [name, value] of CANONICAL_CREDENTIAL_HEADERS) {
-    headers.set(name, value);
-  }
-  headers.set("Content-Type", "multipart/form-data");
-  return headers;
-}
-
-function invokeRequestFulfilled(
-  client: ReturnType<typeof axios.create>,
-): InternalAxiosRequestConfig {
-  const handlers = (
-    client.interceptors.request as unknown as {
-      handlers: {
-        fulfilled?: (
-          config: InternalAxiosRequestConfig,
-        ) => InternalAxiosRequestConfig;
-      }[];
-    }
-  ).handlers;
-  const lastHandler = handlers[handlers.length - 1];
-  if (typeof lastHandler?.fulfilled !== "function") {
-    throw new Error("No fulfilled request handler found");
-  }
-  return lastHandler.fulfilled({
-    method: "post",
-    baseURL: "https://testapi.smileidentity.com",
-    url: "/v2/submit-job",
-    headers: requestHeaders(),
-  } as InternalAxiosRequestConfig);
-}
-
-describe("credential headers under the partner-facing logging config", () => {
-  let client: ReturnType<typeof axios.create>;
-  let consoleLogSpy: ReturnType<typeof vi.spyOn>;
-
-  beforeEach(() => {
-    client = axios.create();
-    consoleLogSpy = vi.spyOn(console, "log").mockImplementation(() => {});
-  });
-
-  afterEach(() => {
-    consoleLogSpy.mockRestore();
-  });
-
-  function printedOutput(): string {
-    return consoleLogSpy.mock.calls
-      .map((call) => call.map((arg) => JSON.stringify(arg)).join(" "))
-      .join("\n");
-  }
-
-  const configurations: ReadonlyArray<
-    readonly [label: string, attach: (client_: typeof client) => void]
-  > = [
-    [
-      "network { config { logging { } } } at default redactHeaders",
-      (client_) => {
-        const builder = new LoggingConfigBuilder();
-        builder.level = LogLevel.headers;
-        attachLoggingInterceptor(client_, builder.build());
-      },
-    ],
-    [
-      "network { interceptors { logging() } } at default redactHeaders",
-      (client_) => {
-        const interceptors = new InterceptorConfigBuilder();
-        interceptors
-          .logging((l) => {
-            l.level = LogLevel.headers;
-          })
-          .attach(client_);
-      },
-    ],
-  ];
-
-  for (const [label, attach] of configurations) {
-    it(`masks every credential header — ${label}`, () => {
-      attach(client);
-      invokeRequestFulfilled(client);
-
-      const output = printedOutput();
-      expect(output).not.toBe("");
-      for (const [name, value] of CANONICAL_CREDENTIAL_HEADERS) {
-        expect(output, `${name} leaked its value`).not.toContain(value);
-      }
-      expect(output).toContain("multipart/form-data");
-    });
-
-    it(`keeps the header names visible so the audit trail survives — ${label}`, () => {
-      attach(client);
-      invokeRequestFulfilled(client);
-
-      const output = printedOutput().toLowerCase();
-      for (const [name] of CANONICAL_CREDENTIAL_HEADERS) {
-        expect(output, `${name} was dropped entirely`).toContain(
-          name.toLowerCase(),
-        );
-      }
-    });
-  }
-
-  it("does not print headers at the default verbosity", () => {
-    const builder = new LoggingConfigBuilder();
-    attachLoggingInterceptor(client, builder.build());
-    invokeRequestFulfilled(client);
-
-    expect(printedOutput()).not.toContain("headers");
-  });
-
-  it("unions the partner's list with the always-redact set rather than replacing it", () => {
-    const builder = new LoggingConfigBuilder();
-    builder.level = LogLevel.headers;
-    builder.redactHeaders = ["content-type"];
-    attachLoggingInterceptor(client, builder.build());
-    invokeRequestFulfilled(client);
-
-    const output = printedOutput();
-    expect(output).not.toContain("multipart/form-data");
-    for (const [, value] of CANONICAL_CREDENTIAL_HEADERS) {
-      expect(output).not.toContain(value);
-    }
-  });
-});

package/src/data/api/interceptors/__tests__/gzip_interceptor.test.ts

@@ -1,83 +0,0 @@
-import { describe, expect, it } from "vitest";
-import axios, { AxiosHeaders, type InternalAxiosRequestConfig } from "axios";
-
-import { createGzipInterceptor } from "../gzip_interceptor";
-
-/**
- * Pins `createGzipInterceptor`'s wire shape: it stamps `Accept-Encoding: gzip` on every request
- * (never reading `config.data`), leaves the body unmodified (no compression, no Content-Type/
- * Length), never sets `Content-Encoding`, and overwrites any existing `Accept-Encoding`.
- */
-describe("createGzipInterceptor", () => {
-  function attachAndRun(
-    config: InternalAxiosRequestConfig,
-  ): Promise<InternalAxiosRequestConfig> {
-    const client = axios.create();
-    createGzipInterceptor().attach(client);
-    const handlers = (
-      client.interceptors.request as unknown as {
-        handlers: {
-          fulfilled?: (
-            cfg: InternalAxiosRequestConfig,
-          ) => InternalAxiosRequestConfig | Promise<InternalAxiosRequestConfig>;
-        }[];
-      }
-    ).handlers;
-    const fulfilled = handlers[handlers.length - 1]?.fulfilled;
-    if (!fulfilled) throw new Error("gzip interceptor did not register");
-    return Promise.resolve(fulfilled(config));
-  }
-
-  it("stamps Accept-Encoding: gzip on a bodyless request", async () => {
-    const result = await attachAndRun({
-      headers: new AxiosHeaders(),
-    } as InternalAxiosRequestConfig);
-
-    expect(result.headers.get("Accept-Encoding")).toBe("gzip");
-    expect(result.data).toBeUndefined();
-  });
-
-  it("stamps the header without touching a JSON string body", async () => {
-    const result = await attachAndRun({
-      headers: new AxiosHeaders(),
-      data: '{"hello":"world"}',
-    } as InternalAxiosRequestConfig);
-
-    expect(result.headers.get("Accept-Encoding")).toBe("gzip");
-    // The body is not compressed or otherwise transformed.
-    expect(result.data).toBe('{"hello":"world"}');
-    expect(result.headers.get("Content-Type")).toBeUndefined();
-  });
-
-  it("stamps the header without touching a multipart FormData body", async () => {
-    // A minimal FormData-like stand-in; the interceptor never inspects
-    // `config.data`'s shape, so this is enough to prove pass-through.
-    const formData = { getParts: () => [] };
-    const result = await attachAndRun({
-      headers: new AxiosHeaders(),
-      data: formData,
-    } as unknown as InternalAxiosRequestConfig);
-
-    expect(result.headers.get("Accept-Encoding")).toBe("gzip");
-    expect(result.data).toBe(formData);
-    expect(result.headers.get("Content-Type")).toBeUndefined();
-    expect(result.headers.get("Content-Length")).toBeUndefined();
-  });
-
-  it("never stamps Content-Encoding — the request body itself is never compressed", async () => {
-    const result = await attachAndRun({
-      headers: new AxiosHeaders(),
-      data: '{"hello":"world"}',
-    } as InternalAxiosRequestConfig);
-
-    expect(result.headers.get("Content-Encoding")).toBeUndefined();
-  });
-
-  it("overwrites an Accept-Encoding value set by an earlier interceptor", async () => {
-    const result = await attachAndRun({
-      headers: new AxiosHeaders({ "Accept-Encoding": "identity" }),
-    } as InternalAxiosRequestConfig);
-
-    expect(result.headers.get("Accept-Encoding")).toBe("gzip");
-  });
-});

package/src/data/api/interceptors/__tests__/logging_interceptor.test.ts

@@ -1,252 +0,0 @@
-import axios, {
-  AxiosError,
-  AxiosHeaders,
-  type AxiosResponse,
-  type InternalAxiosRequestConfig,
-} from "axios";
-import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
-
-import { LogLevel } from "../../../../core/models/network_config";
-import { attachLoggingInterceptor } from "../logging_interceptor";
-
-/**
- * Invoke the response success handler of the most-recently attached
- * interceptor.
- */
-async function invokeResponseFulfilled(
-  client: ReturnType<typeof axios.create>,
-  response: AxiosResponse,
-): Promise<AxiosResponse> {
-  const handlers = (
-    client.interceptors.response as unknown as {
-      handlers: {
-        fulfilled?: (response: AxiosResponse) => AxiosResponse;
-      }[];
-    }
-  ).handlers;
-  const lastHandler = handlers[handlers.length - 1];
-  if (typeof lastHandler?.fulfilled === "function") {
-    return (await lastHandler.fulfilled(response)) as AxiosResponse;
-  }
-  throw new Error("No fulfilled response handler found");
-}
-
-/**
- * Invoke the response error (rejected) handler of the most-recently
- * attached interceptor.
- */
-async function invokeResponseRejected(
-  client: ReturnType<typeof axios.create>,
-  error: AxiosError,
-): Promise<void> {
-  const handlers = (
-    client.interceptors.response as unknown as {
-      handlers: {
-        rejected?: (error: unknown) => Promise<unknown>;
-      }[];
-    }
-  ).handlers;
-  const lastHandler = handlers[handlers.length - 1];
-  if (typeof lastHandler?.rejected === "function") {
-    await lastHandler.rejected(error);
-  } else {
-    throw new Error("No rejected response handler found");
-  }
-}
-
-function makeAxiosResponse(data: unknown, status: number = 200): AxiosResponse {
-  return {
-    data,
-    status,
-    statusText: "OK",
-    headers: new AxiosHeaders(),
-    config: {
-      headers: new AxiosHeaders(),
-      url: "/v1/test",
-    } as InternalAxiosRequestConfig,
-  } as AxiosResponse;
-}
-
-function makeAxiosError(data: unknown, status: number = 400): AxiosError {
-  const config = {
-    headers: new AxiosHeaders(),
-    url: "/v1/test",
-  } as InternalAxiosRequestConfig;
-
-  const response = {
-    data,
-    status,
-    statusText: "Bad Request",
-    headers: new AxiosHeaders(),
-    config,
-  } as AxiosResponse;
-
-  const error = new AxiosError(
-    "Request failed",
-    "ERR_BAD_REQUEST",
-    config,
-    null,
-    response,
-  );
-  Object.assign(error, { isAxiosError: true });
-  return error;
-}
-
-describe("attachLoggingInterceptor — body redaction", () => {
-  let client: ReturnType<typeof axios.create>;
-  let consoleLogSpy: ReturnType<typeof vi.spyOn>;
-  let consoleWarnSpy: ReturnType<typeof vi.spyOn>;
-
-  beforeEach(() => {
-    client = axios.create();
-    consoleLogSpy = vi.spyOn(console, "log").mockImplementation(() => {});
-    consoleWarnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
-  });
-
-  afterEach(() => {
-    consoleLogSpy.mockRestore();
-    consoleWarnSpy.mockRestore();
-  });
-
-  it("redacts sensitive top-level keys and passes non-sensitive ones through", async () => {
-    attachLoggingInterceptor(client, {
-      enabled: true,
-      level: LogLevel.body,
-      redactHeaders: [],
-    });
-
-    const response = makeAxiosResponse({ token: "abc", user_id: "u1" });
-    await invokeResponseFulfilled(client, response);
-
-    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
-      String(call[0]).includes("body:"),
-    );
-    expect(bodyCall).toBeDefined();
-    const loggedBody = bodyCall![1] as Record<string, unknown>;
-    expect(loggedBody["token"]).toBe("<redacted>");
-    expect(loggedBody["user_id"]).toBe("u1");
-  });
-
-  it("redacts sensitive keys nested inside an object", async () => {
-    attachLoggingInterceptor(client, {
-      enabled: true,
-      level: LogLevel.body,
-      redactHeaders: [],
-    });
-
-    const response = makeAxiosResponse({ result: { signature: "s" } });
-    await invokeResponseFulfilled(client, response);
-
-    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
-      String(call[0]).includes("body:"),
-    );
-    expect(bodyCall).toBeDefined();
-    const loggedBody = bodyCall![1] as Record<string, unknown>;
-    const nested = loggedBody["result"] as Record<string, unknown>;
-    expect(nested["signature"]).toBe("<redacted>");
-  });
-
-  it("redacts sensitive keys inside array elements", async () => {
-    attachLoggingInterceptor(client, {
-      enabled: true,
-      level: LogLevel.body,
-      redactHeaders: [],
-    });
-
-    const response = makeAxiosResponse([{ api_key: "k" }, { name: "safe" }]);
-    await invokeResponseFulfilled(client, response);
-
-    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
-      String(call[0]).includes("body:"),
-    );
-    expect(bodyCall).toBeDefined();
-    const loggedBody = bodyCall![1] as Array<Record<string, unknown>>;
-    expect(loggedBody[0]?.["api_key"]).toBe("<redacted>");
-    expect(loggedBody[1]?.["name"]).toBe("safe");
-  });
-
-  it("applies redaction on the error path at LogLevel.body", async () => {
-    attachLoggingInterceptor(client, {
-      enabled: true,
-      level: LogLevel.body,
-      redactHeaders: [],
-    });
-
-    const error = makeAxiosError({ token: "secret-token", message: "bad" });
-    try {
-      await invokeResponseRejected(client, error);
-    } catch {
-      // Expected: the interceptor re-rejects.
-    }
-
-    const bodyCall = consoleWarnSpy.mock.calls.find((call: unknown[]) =>
-      String(call[0]).includes("body:"),
-    );
-    expect(bodyCall).toBeDefined();
-    const loggedBody = bodyCall![1] as Record<string, unknown>;
-    expect(loggedBody["token"]).toBe("<redacted>");
-    expect(loggedBody["message"]).toBe("bad");
-  });
-
-  it("replaces values beyond the depth limit with '<depth-limit>'", async () => {
-    attachLoggingInterceptor(client, {
-      enabled: true,
-      level: LogLevel.body,
-      redactHeaders: [],
-    });
-
-    // Build an object 8 levels deep — exceeds MAX_REDACT_DEPTH of 6.
-    const deepObject = {
-      a: { b: { c: { d: { e: { f: { g: { h: "leaf" } } } } } } },
-    };
-    const response = makeAxiosResponse(deepObject);
-    await invokeResponseFulfilled(client, response);
-
-    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
-      String(call[0]).includes("body:"),
-    );
-    expect(bodyCall).toBeDefined();
-
-    // Navigate to the depth boundary — depth 6 (0-indexed from root) should
-    // be replaced by "<depth-limit>".
-    const logged = bodyCall![1] as {
-      a: { b: { c: { d: { e: { f: unknown } } } } };
-    };
-    expect(logged.a.b.c.d.e.f).toBe("<depth-limit>");
-  });
-
-  it("does not log the body at LogLevel.headers (regression pin)", async () => {
-    attachLoggingInterceptor(client, {
-      enabled: true,
-      level: LogLevel.headers,
-      redactHeaders: [],
-    });
-
-    const response = makeAxiosResponse({ token: "abc" });
-    await invokeResponseFulfilled(client, response);
-
-    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
-      String(call[0]).includes("body:"),
-    );
-    expect(bodyCall).toBeUndefined();
-  });
-
-  it("redacts keys case-insensitively (capitalised key variant)", async () => {
-    attachLoggingInterceptor(client, {
-      enabled: true,
-      level: LogLevel.body,
-      redactHeaders: [],
-    });
-
-    const response = makeAxiosResponse({ Token: "t", UserId: "u" });
-    await invokeResponseFulfilled(client, response);
-
-    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
-      String(call[0]).includes("body:"),
-    );
-    expect(bodyCall).toBeDefined();
-    const loggedBody = bodyCall![1] as Record<string, unknown>;
-    expect(loggedBody["Token"]).toBe("<redacted>");
-    expect(loggedBody["UserId"]).toBe("u");
-  });
-});

package/src/data/api/interceptors/__tests__/sensitive_headers.test.ts

@@ -1,29 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { ALWAYS_REDACT } from "../sensitive_headers";
-
-describe("ALWAYS_REDACT", () => {
-  it("contains the credentials and partner-identity headers", () => {
-    // Canonical credential + partner-identity headers SmileID issues.
-    // Adding a new header here is a single edit that surfaces in the
-    // test failure first, then in the masking behaviour of every
-    // request the logging interceptor prints.
-    expect(ALWAYS_REDACT.has("smileid-token")).toBe(true);
-    expect(ALWAYS_REDACT.has("smileid-partner-id")).toBe(true);
-    expect(ALWAYS_REDACT.has("smileid-api-key")).toBe(true);
-    expect(ALWAYS_REDACT.has("authorization")).toBe(true);
-    expect(ALWAYS_REDACT.has("cookie")).toBe(true);
-    expect(ALWAYS_REDACT.has("set-cookie")).toBe(true);
-  });
-
-  it("stores every entry lowercase for case-insensitive matching", () => {
-    for (const header of ALWAYS_REDACT) {
-      expect(header).toBe(header.toLowerCase());
-    }
-  });
-
-  it("rejects an arbitrary non-sensitive header", () => {
-    // Sanity check that the set isn't a free-for-all.
-    expect(ALWAYS_REDACT.has("content-type")).toBe(false);
-    expect(ALWAYS_REDACT.has("user-agent")).toBe(false);
-  });
-});