@solarwinds/squadcast-sdk-typescript 1.2.0 → 1.4.0

package/src/funcs/workflowsBulkEnableDisable.ts

@@ -119,8 +119,10 @@ async function $do(
     Accept: "*/*",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -131,7 +133,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/funcs/workflowsCreate.ts

@@ -117,8 +117,10 @@ async function $do(
     Accept: "application/json",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -129,7 +131,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/funcs/workflowsDelete.ts

@@ -123,8 +123,10 @@ async function $do(
     Accept: "*/*",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -135,7 +137,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/funcs/workflowsDeleteAction.ts

@@ -131,8 +131,10 @@ async function $do(
     Accept: "*/*",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -143,7 +145,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/funcs/workflowsEnableDisable.ts

@@ -130,8 +130,10 @@ async function $do(
     Accept: "*/*",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -142,7 +144,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/funcs/workflowsGetById.ts

@@ -123,8 +123,10 @@ async function $do(
     Accept: "application/json",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -135,7 +137,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/funcs/workflowsList.ts

@@ -142,8 +142,10 @@ async function $do(
     Accept: "application/json",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -154,7 +156,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/funcs/workflowsUpdate.ts

@@ -127,8 +127,10 @@ async function $do(
     Accept: "application/json",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -139,7 +141,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/funcs/workflowsUpdateAction.ts

@@ -133,8 +133,10 @@ async function $do(
     Accept: "application/json",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -145,7 +147,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/funcs/workflowsUpdateActionsOrder.ts

@@ -130,8 +130,10 @@ async function $do(
     Accept: "application/json",
   }));
 
-  const secConfig = await extractSecurity(client._options.bearerAuth);
-  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const secConfig = await extractSecurity(client._options.refreshTokenAuth);
+  const securityInput = secConfig == null
+    ? {}
+    : { refreshTokenAuth: secConfig };
   const requestSecurity = resolveGlobalSecurity(securityInput);
 
   const context = {
@@ -142,7 +144,7 @@ async function $do(
 
     resolvedSecurity: requestSecurity,
 
-    securitySource: client._options.bearerAuth,
+    securitySource: client._options.refreshTokenAuth,
     retryConfig: options?.retries
       || client._options.retryConfig
       || { strategy: "none" },

package/src/hooks/accesstokenhook.ts

@@ -0,0 +1,175 @@
+import type { BeforeRequestContext, BeforeRequestHook } from "./types.js";
+
+const defaultRefreshURL = "https://auth.squadcast.com/oauth/access-token";
+const refreshPath = "/oauth/access-token";
+
+type CachedToken = {
+  token: string;
+  expiry: Date;
+};
+
+type RefreshTokenSecurity = {
+  refreshToken?: unknown;
+  bearerAuth?: unknown;
+};
+
+type AccessTokenResponse = {
+  data?: {
+    access_token?: unknown;
+    expires_at?: unknown;
+  };
+};
+
+class TokenCache {
+  #token: CachedToken | undefined;
+
+  get(): string | undefined {
+    if (!this.#token) {
+      return;
+    }
+
+    if (Date.now() >= this.#token.expiry.getTime()) {
+      this.#token = undefined;
+      return;
+    }
+
+    return this.#token.token;
+  }
+
+  set(token: string, expiry: Date): void {
+    this.#token = { token, expiry };
+  }
+}
+
+export class AccessTokenHook implements BeforeRequestHook {
+  #cache = new TokenCache();
+
+  async beforeRequest(
+    hookCtx: BeforeRequestContext,
+    request: Request,
+  ): Promise<Request> {
+    const refreshToken = await extractRefreshToken(hookCtx.securitySource);
+    if (!refreshToken) {
+      return request;
+    }
+
+    const cachedToken = this.#cache.get();
+    if (cachedToken) {
+      request.headers.set("Authorization", `Bearer ${cachedToken}`);
+      return request;
+    }
+
+    const refreshURL = resolveRefreshURL(hookCtx.baseURL, request.url);
+    const { token, expiry } = await fetchAccessToken(
+      refreshURL,
+      refreshToken,
+      hookCtx,
+    );
+
+    this.#cache.set(token, expiry);
+    request.headers.set("Authorization", `Bearer ${token}`);
+    return request;
+  }
+}
+
+async function extractRefreshToken(
+  source: BeforeRequestContext["securitySource"],
+): Promise<string | undefined> {
+  if (!source) {
+    return;
+  }
+
+  const raw = typeof source === "function" ? await source() : source;
+  if (typeof raw === "string" && raw) {
+    return raw;
+  }
+
+  if (!raw || typeof raw !== "object") {
+    return;
+  }
+
+  const security = raw as RefreshTokenSecurity;
+  if (typeof security.refreshToken === "string" && security.refreshToken) {
+    return security.refreshToken;
+  }
+
+  if (typeof security.bearerAuth === "string" && security.bearerAuth) {
+    return security.bearerAuth;
+  }
+
+  return;
+}
+
+function resolveRefreshURL(baseURL: string | URL, requestURL: string): string {
+  for (const candidate of [baseURL, requestURL]) {
+    if (!candidate) {
+      continue;
+    }
+
+    try {
+      const parsedURL = new URL(candidate.toString());
+      const authHost = authHostForAPIHost(parsedURL.hostname);
+      if (!authHost) {
+        continue;
+      }
+
+      return new URL(refreshPath, `https://${authHost}`).toString();
+    } catch {
+      continue;
+    }
+  }
+
+  return defaultRefreshURL;
+}
+
+function authHostForAPIHost(apiHost: string): string {
+  const normalizedHost = apiHost.trim().toLowerCase();
+  if (!normalizedHost) {
+    return "";
+  }
+
+  if (normalizedHost.startsWith("api.")) {
+    return `auth.${normalizedHost.slice(4)}`;
+  }
+
+  return "auth.squadcast.com";
+}
+
+async function fetchAccessToken(
+  refreshURL: string,
+  refreshToken: string,
+  hookCtx: BeforeRequestContext,
+): Promise<{ token: string; expiry: Date }> {
+  const request = new Request(refreshURL, {
+    method: "GET",
+    headers: {
+      Accept: "application/json",
+      "X-Refresh-Token": refreshToken,
+    },
+  });
+
+  const response = hookCtx.options.httpClient
+    ? await hookCtx.options.httpClient.request(request)
+    : await fetch(request);
+
+  if (!response.ok) {
+    throw new Error(
+      `squadcast-sdk: unexpected status ${response.status} from token endpoint`,
+    );
+  }
+
+  const payload = await response.json() as AccessTokenResponse;
+  const token = payload.data?.access_token;
+  if (typeof token !== "string" || !token) {
+    throw new Error(
+      "squadcast-sdk: empty access_token in refresh response",
+    );
+  }
+
+  const expiresAt = payload.data?.expires_at;
+  const expiry = typeof expiresAt === "number"
+    ? new Date(expiresAt * 1000)
+    : new Date(0);
+
+  return { token, expiry };
+}

package/src/hooks/registration.ts

@@ -1,3 +1,4 @@
+import { AccessTokenHook } from "./accesstokenhook.js";
 import { Hooks } from "./types.js";
 
 /*
@@ -6,9 +7,8 @@ import { Hooks } from "./types.js";
  * in this file or in separate files in the hooks folder.
  */
 
-// @ts-expect-error remove this line when you add your first hook and hooks is used
 export function initHooks(hooks: Hooks) {
-  // Add hooks by calling hooks.register{ClientInit/BeforeCreateRequest/BeforeRequest/AfterSuccess/AfterError}Hook
-  // with an instance of a hook that implements that specific Hook interface
-  // Hooks are registered per SDK instance, and are valid for the lifetime of the SDK instance
+  // AccessTokenHook exchanges a refresh token for an access token on every
+  // request, caching the result until it expires.
+  hooks.registerBeforeRequestHook(new AccessTokenHook());
 }

package/src/lib/config.ts

@@ -12,13 +12,17 @@ import { Params, pathToFunc } from "./url.js";
  */
 export const ServerList = [
   /**
-   * production env
+   * production EU env
+   */
+  "https://api.eu.squadcast.com",
+  /**
+   * production US env
    */
   "https://api.squadcast.com",
 ] as const;
 
 export type SDKOptions = {
-  bearerAuth?: string | (() => Promise<string>) | undefined;
+  refreshTokenAuth?: string | (() => Promise<string>) | undefined;
 
   httpClient?: HTTPClient;
   /**
@@ -61,8 +65,8 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "1.0.0",
-  sdkVersion: "1.2.0",
-  genVersion: "2.845.15",
+  sdkVersion: "1.4.0",
+  genVersion: "2.865.2",
   userAgent:
-    "speakeasy-sdk/typescript 1.2.0 2.845.15 1.0.0 @solarwinds/squadcast-sdk-typescript",
+    "speakeasy-sdk/typescript 1.4.0 2.865.2 1.0.0 @solarwinds/squadcast-sdk-typescript",
 } as const;

package/src/lib/matchers.ts

@@ -251,8 +251,9 @@ export function match<T, E>(
         raw = body;
         break;
       default:
-        encoding satisfies never;
-        throw new Error(`Unsupported response type: ${encoding}`);
+        throw new Error(
+          `Unsupported response type: ${encoding satisfies never}`,
+        );
     }
 
     if (matcher.enc === "fail") {

package/src/lib/security.ts

@@ -197,8 +197,7 @@ export function resolveSecurity(
         applyBearer(state, spec);
         break;
       default:
-        spec satisfies never;
-        throw SecurityError.unrecognizedType(type);
+        throw SecurityError.unrecognizedType((spec satisfies never, type));
     }
   });
 
@@ -244,9 +243,9 @@ export function resolveGlobalSecurity(
   return resolveSecurity(
     [
       {
-        fieldName: "Authorization",
-        type: "http:bearer",
-        value: security?.bearerAuth,
+        fieldName: "refreshToken",
+        type: "http:custom",
+        value: security?.refreshTokenAuth,
       },
     ],
   );

package/src/models/security.ts

@@ -6,12 +6,15 @@ import * as z from "zod/v3";
 import { remap as remap$ } from "../lib/primitives.js";
 
 export type Security = {
-  bearerAuth: string;
+  /**
+   * Squadcast refresh token used to obtain short-lived bearer tokens.
+   */
+  refreshTokenAuth: string;
 };
 
 /** @internal */
 export type Security$Outbound = {
-  BearerAuth: string;
+  RefreshTokenAuth: string;
 };
 
 /** @internal */
@@ -20,10 +23,10 @@ export const Security$outboundSchema: z.ZodType<
   z.ZodTypeDef,
   Security
 > = z.object({
-  bearerAuth: z.string(),
+  refreshTokenAuth: z.string(),
 }).transform((v) => {
   return remap$(v, {
-    bearerAuth: "BearerAuth",
+    refreshTokenAuth: "RefreshTokenAuth",
   });
 });