@superblocksteam/shared 0.9597.1 → 0.9598.1

package/src/socket/socketWithClientAuth.ts

@@ -14,6 +14,7 @@ export class ISocketWithClientAuth<ImplementedMethods, CallableMethods, RequestC
   RequestContext
 > {
   private authorization?: string;
+  private authorizationVersion = 0;
   private hasSentAuth = false;
 
   constructor(
@@ -35,9 +36,12 @@ export class ISocketWithClientAuth<ImplementedMethods, CallableMethods, RequestC
   // override `request` from the base class to send `authorization` when appropriate
   async request<Params, Result>(method: string, params: Params): Promise<Result> {
     // only send `authorization` on the first request
+    const authorizationVersion = this.authorizationVersion;
     const authorization = this.hasSentAuth ? undefined : this.authorization;
     const result = await super.request<Params, Result>(method, params, authorization);
-    this.hasSentAuth = true;
+    if (this.authorizationVersion === authorizationVersion) {
+      this.hasSentAuth = true;
+    }
     return result;
   }
 
@@ -49,6 +53,7 @@ export class ISocketWithClientAuth<ImplementedMethods, CallableMethods, RequestC
    */
   setAuthorization(newAuthorization: string | undefined): void {
     this.authorization = newAuthorization;
+    this.authorizationVersion++;
     this.hasSentAuth = false;
   }
 }

package/src/socket/util.test.ts

@@ -0,0 +1,71 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { buildClientUserAgent, connectWebSocket, DEFAULT_WEBSOCKET_USER_AGENT, MAX_SOCKET_PAYLOAD_BYTES } from './util.js';
+
+const constructorSpy = vi.fn();
+
+// isomorphic-ws resolves to the `ws` package on Node; capture its constructor args.
+// vitest hoists this mock above the static import above, so `util.ts` picks it up.
+vi.mock('isomorphic-ws', () => ({
+  default: class MockWebSocket {
+    constructor(url: string, protocol: unknown, options: unknown) {
+      constructorSpy(url, protocol, options);
+    }
+    addEventListener(): void {
+      // no-op; the connect promise stays pending, which is fine for these assertions
+    }
+  }
+}));
+
+describe('connectWebSocket User-Agent', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    constructorSpy.mockClear();
+  });
+
+  afterEach(() => {
+    vi.clearAllTimers();
+    vi.useRealTimers();
+  });
+
+  it('sends a default User-Agent and preserves maxPayload on the handshake', () => {
+    void connectWebSocket('wss://example.com/api/v1/rpc-ws');
+
+    expect(constructorSpy).toHaveBeenCalledWith(
+      'wss://example.com/api/v1/rpc-ws',
+      undefined,
+      expect.objectContaining({
+        maxPayload: MAX_SOCKET_PAYLOAD_BYTES,
+        headers: expect.objectContaining({ 'User-Agent': DEFAULT_WEBSOCKET_USER_AGENT })
+      })
+    );
+  });
+
+  it('lets callers override the User-Agent via options.headers', () => {
+    void connectWebSocket('wss://example.com/api/v1/rpc-ws', { headers: { 'User-Agent': 'superblocks-cli/9.9.9' } });
+
+    expect(constructorSpy).toHaveBeenCalledWith(
+      'wss://example.com/api/v1/rpc-ws',
+      undefined,
+      expect.objectContaining({
+        headers: expect.objectContaining({ 'User-Agent': 'superblocks-cli/9.9.9' })
+      })
+    );
+  });
+
+  it('forwards options.protocol as the WebSocket subprotocol', () => {
+    void connectWebSocket('wss://example.com/api/v1/rpc-ws', { protocol: 'editor' });
+
+    expect(constructorSpy).toHaveBeenCalledWith('wss://example.com/api/v1/rpc-ws', 'editor', expect.anything());
+  });
+});
+
+describe('buildClientUserAgent', () => {
+  it('joins component and version with a slash', () => {
+    expect(buildClientUserAgent('superblocks-cli', '2.0.0-next.1')).toBe('superblocks-cli/2.0.0-next.1');
+  });
+
+  it('returns the bare component when no version is given', () => {
+    expect(buildClientUserAgent('superblocks-dev-server')).toBe('superblocks-dev-server');
+  });
+});

package/src/socket/util.ts

@@ -12,13 +12,43 @@ import WebSocket from 'isomorphic-ws';
  */
 export const MAX_SOCKET_PAYLOAD_BYTES = 100 * 1024 * 1024;
 
+/**
+ * Default User-Agent for Node-originated WebSocket handshakes. The `ws` client
+ * sends no User-Agent by default (unlike browsers, axios, or undici's fetch),
+ * and AWS WAF's managed common rule set blocks UA-less requests
+ * (`NoUserAgent_HEADER`) with a 403 at the ALB. A non-empty UA keeps the
+ * handshake from being rejected; callers may override with a more specific,
+ * versioned identity. Ignored by browsers (native WebSocket sets its own UA).
+ */
+export const DEFAULT_WEBSOCKET_USER_AGENT = 'superblocks-client';
+
+/**
+ * Build a client User-Agent of the form `component/version`, or bare `component`
+ * when no version is supplied. Single source of truth for the identity strings
+ * Node WebSocket clients (CLI, dev server, ...) send on the handshake.
+ */
+export function buildClientUserAgent(component: string, version?: string): string {
+  return version ? `${component}/${version}` : component;
+}
+
+export interface ConnectWebSocketOptions {
+  protocol?: string | string[];
+  timeout?: number;
+  /** Extra handshake headers (Node only; ignored by browsers). Overrides the default User-Agent. */
+  headers?: Record<string, string>;
+}
+
 /**
  * If the connection is not established within the timeout, the promise will be rejected.
  * This can happen with bad network conditions, but is very rare.
  */
-export function connectWebSocket(wsUrl: string, protocol?: string | string[], timeout = 30_000): Promise<WebSocket> {
+export function connectWebSocket(wsUrl: string, options: ConnectWebSocketOptions = {}): Promise<WebSocket> {
+  const { protocol, timeout = 30_000, headers } = options;
   return new Promise((resolve, reject) => {
-    const ws = new WebSocket(wsUrl, protocol, { maxPayload: MAX_SOCKET_PAYLOAD_BYTES });
+    const ws = new WebSocket(wsUrl, protocol, {
+      maxPayload: MAX_SOCKET_PAYLOAD_BYTES,
+      headers: { 'User-Agent': DEFAULT_WEBSOCKET_USER_AGENT, ...headers }
+    });
 
     const timeoutId = setTimeout(() => {
       reject(new Error('[internal] WebSocket connection timeout'));

package/src/types/git/index.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest';
+
+import { isGitAuthErrorMessage } from './index.js';
+
+describe('isGitAuthErrorMessage', () => {
+  it('matches fine-grained GitHub invalid username or token errors', () => {
+    expect(
+      isGitAuthErrorMessage(new Error('remote: Invalid username or token. Password authentication is not supported for Git operations.'))
+    ).toBe(true);
+  });
+
+  it('matches password authentication is not supported errors', () => {
+    expect(isGitAuthErrorMessage(new Error('fatal: Password authentication is not supported for Git operations.'))).toBe(true);
+  });
+});

package/src/types/git/index.ts

@@ -18,7 +18,9 @@ export const GIT_AUTH_ERROR_PATTERNS: readonly string[] = [
   'authentication failed',
   'could not read username',
   'invalid credentials',
+  'invalid username or token',
   'bad credentials',
+  'password authentication is not supported',
   '401'
 ];