@vercel/flags-core 1.10.2 → 1.10.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @vercel/flags-core
 
+## 1.10.3
+
+### Patch Changes
+
+- [#578](https://github.com/vercel/flags/pull/578) [`63d13be`](https://github.com/vercel/flags/commit/63d13be0193102a4f0cbcbf48e7f67efad96a462) Thanks [@luismeyer](https://github.com/luismeyer)! - Fail fast on authentication errors. When the stream gets a 401 or no OIDC token is available, the client no longer falls back to polling, which would fail the same way, and goes straight to revalidating over HTTP on reads. When polling is the primary source, its first auth failure stops it, and a missing OIDC token is no longer retried. A failed OIDC token refresh is still retried. A client without credentials no longer keeps scripts and test files running.
+
 ## 1.10.2
 
 ### Patch Changes

package/dist/{chunk-LGS6CVED.js → chunk-2P2UTT7O.js}

@@ -576,7 +576,7 @@ function bulkEvaluate(flags, shared) {
 }
 
 // package.json
-var version = "1.10.2";
+var version = "1.10.3";
 
 // src/lib/report-value.ts
 function internalReportValue(key, value, data) {
@@ -1106,17 +1106,26 @@ function unauthorizedMessage(sourceProjectId) {
   }
   return `unauthorized (401): this deployment is not allowed to read the flags of project "${sourceProjectId}". Check that the project is connected. See https://vercel.com/docs/flags/vercel-flags/project-connections`;
 }
+var oidcTokenMessage = [
+  "@vercel/flags-core: Failed to get OIDC token.",
+  "Are you running in a Vercel Environment where OIDC tokens are available?",
+  "Did you mean to use an SDK Key instead? Use the environment variable FLAGS or pass it directly to the client."
+].join(" ");
+var missingCredentials = /`vc link|vercel login|^The 'x-vercel-oidc-token' header is missing from the request\.$/;
+var OidcTokenError = class extends Error {
+  constructor(cause) {
+    super(oidcTokenMessage, { cause });
+    this.name = "OidcTokenError";
+  }
+};
 async function getOidcToken() {
   try {
     return await getVercelOidcToken();
-  } catch {
-    throw new Error(
-      [
-        "@vercel/flags-core: Failed to get OIDC token.",
-        "Are you running in a Vercel Environment where OIDC tokens are available?",
-        "Did you mean to use an SDK Key instead? Use the environment variable FLAGS or pass it directly to the client."
-      ].join(" ")
-    );
+  } catch (error) {
+    if (error instanceof Error && missingCredentials.test(error.message)) {
+      throw new OidcTokenError(error);
+    }
+    throw new Error(oidcTokenMessage, { cause: error });
   }
 }
 function getProjectIdFromOidcToken(oidcToken) {
@@ -2160,7 +2169,8 @@ async function fetchDatafile(options) {
         return await Promise.race([fetchAttempt(attempt + 1), aborted]);
       } catch (error) {
         signal.throwIfAborted();
-        if (attempt === maxAttempts - 1 || error instanceof DatafileHttpError && !error.retryable) {
+        if (attempt === maxAttempts - 1 || error instanceof DatafileHttpError && !error.retryable || // Retrying will not produce a token that is not there.
+        error instanceof OidcTokenError) {
           throw error instanceof Error ? error : new Error("Unknown fetch error");
         }
         debug(options.clientName, "datafile.fetch.retry", () => ({
@@ -2578,7 +2588,7 @@ async function connectStream(config, callbacks) {
             rejectInit(error);
           }
           onDisconnect?.();
-          abortController.abort();
+          abortController.abort(error);
           break;
         }
         if (!response.ok) {
@@ -2680,7 +2690,7 @@ async function connectStream(config, callbacks) {
         }
         if (error instanceof TokenResolutionError && !initialDataReceived) {
           rejectInit(error.cause);
-          abortController.abort();
+          abortController.abort(error.cause);
           break;
         }
         if (connectionAbort.signal.reason !== PING_TIMEOUT) {
@@ -2754,7 +2764,7 @@ var StreamSource = class extends TypedEmitter {
         if (this.abortController === abortController) {
           this.promise = void 0;
           this.abortController = void 0;
-          this.emit("exhausted");
+          this.emit("exhausted", abortController.signal.reason);
         }
       },
       { once: true }
@@ -2815,7 +2825,7 @@ var UNKNOWN_FRESHNESS = {
   assess: () => ({ status: "unknown" })
 };
 function isUnauthorizedError(error) {
-  if (error instanceof UnauthorizedError) {
+  if (error instanceof UnauthorizedError || error instanceof OidcTokenError) {
     return true;
   }
   if (!(error instanceof Error)) {
@@ -2850,8 +2860,9 @@ var Controller = class {
   // Build-step deduplication
   buildDataPromise = null;
   buildReadTracked = false;
-  // Suppresses usage tracking while the credential is rejected. Set on a 401
-  // from any source, cleared as soon as a source delivers data again.
+  // Suppresses usage tracking while the credential is rejected or no OIDC
+  // token is available. Set on an auth failure from any source, cleared as
+  // soon as a source delivers data again.
   unauthorized = false;
   constructor(options) {
     this.options = normalizeOptions(options);
@@ -2947,10 +2958,16 @@ var Controller = class {
       this.transition("degraded", "stream-disconnected");
     }
   };
-  onStreamExhausted = () => {
+  onStreamExhausted = (reason) => {
     if (this.state !== "streaming" && this.state !== "degraded") {
       return;
     }
+    if (isUnauthorizedError(reason)) {
+      if (this.state === "streaming") {
+        this.transition("degraded", "stream-auth-failed");
+      }
+      return;
+    }
     void this.activateFallbackSource().catch(() => {
     });
   };
@@ -2962,7 +2979,7 @@ var Controller = class {
     this.onSourceError(error);
     if (this.state === "polling" && isUnauthorizedError(error)) {
       this.pollingSource.stop();
-      this.transition("degraded", "polling-unauthorized");
+      this.transition("degraded", "polling-auth-failed");
     }
   };
   // ---------------------------------------------------------------------------
@@ -3372,6 +3389,10 @@ var Controller = class {
         this.transition("degraded", "stream-still-connecting");
         return;
       }
+      if (outcome === "auth-failed") {
+        this.transition("degraded", "stream-auth-failed");
+        return;
+      }
     }
     if (this.options.polling.enabled) {
       if (this.state !== "polling") {
@@ -3404,7 +3425,7 @@ var Controller = class {
         return "connected";
       } catch (error) {
         this.noteUnauthorized(error);
-        return "failed";
+        return isUnauthorizedError(error) ? "auth-failed" : "failed";
       }
     }
     let timeoutId;
@@ -3438,7 +3459,7 @@ var Controller = class {
     } catch (error) {
       clearTimeout(timeoutId);
       this.noteUnauthorized(error);
-      return "failed";
+      return isUnauthorizedError(error) ? "auth-failed" : "failed";
     }
   }
   // ---------------------------------------------------------------------------
@@ -3766,4 +3787,4 @@ export {
   resetDefaultFlagsClient,
   createClient
 };
-//# sourceMappingURL=chunk-LGS6CVED.js.map
+//# sourceMappingURL=chunk-2P2UTT7O.js.map