@webpieces/http-client-browser 0.4.598 → 0.4.600

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-client-browser",
-  "version": "0.4.598",
+  "version": "0.4.600",
   "description": "Browser HTTP client for webpieces: DI-free (React or Angular), app-managed context store, no AsyncLocalStorage",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,7 +22,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@webpieces/core-util": "0.4.598",
-    "@webpieces/http-client-core": "0.4.598"
+    "@webpieces/core-util": "0.4.600",
+    "@webpieces/http-client-core": "0.4.600"
   }
 }

package/src/MutableContextStore.d.ts

@@ -1,4 +1,4 @@
-import { AnyContextKey, ContextReader } from '@webpieces/core-util';
+import { AnyContextKey, AnyUntrustedContextKey, ContextReader } from '@webpieces/core-util';
 /**
  * MutableContextStore - the BROWSER ContextReader.
  *
@@ -22,10 +22,15 @@ import { AnyContextKey, ContextReader } from '@webpieces/core-util';
  */
 export declare class MutableContextStore implements ContextReader {
     private values;
-    /** Set (or overwrite) the current value for a context key. */
-    set(key: AnyContextKey, value: string): void;
+    /**
+     * Set (or overwrite) the current value for a context key. UNTRUSTED keys only, by type. A browser cannot PROVE anything — every value in here was typed
+     * by the app or the user — so a store that accepted a trusted key would be a forgery side door,
+     * exactly the one closed on the {@link ApiCallContext} seam. Narrowing it here makes the mistake
+     * a compile error in the browser bundle instead of a 401 at the far end of an HTTP call.
+     */
+    set(key: AnyUntrustedContextKey, value: string): void;
     /** Remove the current value for a context key (e.g. on logout). */
-    remove(key: AnyContextKey): void;
+    remove(key: AnyUntrustedContextKey): void;
     /** Clear all stored values. */
     clear(): void;
     read(key: AnyContextKey): string | undefined;

package/src/MutableContextStore.js

@@ -24,7 +24,12 @@ exports.MutableContextStore = void 0;
  */
 class MutableContextStore {
     values = new Map();
-    /** Set (or overwrite) the current value for a context key. */
+    /**
+     * Set (or overwrite) the current value for a context key. UNTRUSTED keys only, by type. A browser cannot PROVE anything — every value in here was typed
+     * by the app or the user — so a store that accepted a trusted key would be a forgery side door,
+     * exactly the one closed on the {@link ApiCallContext} seam. Narrowing it here makes the mistake
+     * a compile error in the browser bundle instead of a 401 at the far end of an HTTP call.
+     */
     set(key, value) {
         this.values.set(key.name, value);
     }

package/src/MutableContextStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"MutableContextStore.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-browser/src/MutableContextStore.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,mBAAmB;IACpB,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEhD,8DAA8D;IAC9D,GAAG,CAAC,GAAkB,EAAE,KAAa;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,GAAkB;QACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,+BAA+B;IAC/B,KAAK;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,GAAkB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACJ;AArBD,kDAqBC","sourcesContent":["import { ContextKey, AnyContextKey, ContextReader } from '@webpieces/core-util';\n\n/**\n * MutableContextStore - the BROWSER ContextReader.\n *\n * Browsers have no AsyncLocalStorage, so apps (Angular/React) hold one of these\n * (e.g. as an Angular service / React context value) and set values as they become\n * known (login token, selected tenant, ...). The ContextMgr then reads from it on\n * every outbound request.\n *\n * Example (Angular):\n * ```typescript\n * const store = new MutableContextStore();\n * // startup:\n * HeaderRegistry.configure(CompanyHeaders.ALL_HEADERS, true);\n * const factory = new ClientHttpFactory(new ContextMgr(store));\n * const client = factory.createRpcClient(SaveApi, new ClientConfig('server'));\n *\n * // later, when the user logs in / picks a tenant:\n * store.set(AppHeaders.AUTHORIZATION, token);   // an app-defined key, if it wants auto-attach\n * store.set(CompanyHeaders.TENANT_ID, tenantId);\n * ```\n */\nexport class MutableContextStore implements ContextReader {\n    private values: Map<string, string> = new Map();\n\n    /** Set (or overwrite) the current value for a context key. */\n    set(key: AnyContextKey, value: string): void {\n        this.values.set(key.name, value);\n    }\n\n    /** Remove the current value for a context key (e.g. on logout). */\n    remove(key: AnyContextKey): void {\n        this.values.delete(key.name);\n    }\n\n    /** Clear all stored values. */\n    clear(): void {\n        this.values.clear();\n    }\n\n    read(key: AnyContextKey): string | undefined {\n        return this.values.get(key.name);\n    }\n}\n"]}
+{"version":3,"file":"MutableContextStore.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-browser/src/MutableContextStore.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,mBAAmB;IACpB,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEhD;;;;;OAKG;IACH,GAAG,CAAC,GAA2B,EAAE,KAAa;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,GAA2B;QAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,+BAA+B;IAC/B,KAAK;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,GAAkB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACJ;AA1BD,kDA0BC","sourcesContent":["import { AnyContextKey, AnyUntrustedContextKey, ContextReader } from '@webpieces/core-util';\n\n/**\n * MutableContextStore - the BROWSER ContextReader.\n *\n * Browsers have no AsyncLocalStorage, so apps (Angular/React) hold one of these\n * (e.g. as an Angular service / React context value) and set values as they become\n * known (login token, selected tenant, ...). The ContextMgr then reads from it on\n * every outbound request.\n *\n * Example (Angular):\n * ```typescript\n * const store = new MutableContextStore();\n * // startup:\n * HeaderRegistry.configure(CompanyHeaders.ALL_HEADERS, true);\n * const factory = new ClientHttpFactory(new ContextMgr(store));\n * const client = factory.createRpcClient(SaveApi, new ClientConfig('server'));\n *\n * // later, when the user logs in / picks a tenant:\n * store.set(AppHeaders.AUTHORIZATION, token);   // an app-defined key, if it wants auto-attach\n * store.set(CompanyHeaders.TENANT_ID, tenantId);\n * ```\n */\nexport class MutableContextStore implements ContextReader {\n    private values: Map<string, string> = new Map();\n\n    /**\n     * Set (or overwrite) the current value for a context key. UNTRUSTED keys only, by type. A browser cannot PROVE anything — every value in here was typed\n     * by the app or the user — so a store that accepted a trusted key would be a forgery side door,\n     * exactly the one closed on the {@link ApiCallContext} seam. Narrowing it here makes the mistake\n     * a compile error in the browser bundle instead of a 401 at the far end of an HTTP call.\n     */\n    set(key: AnyUntrustedContextKey, value: string): void {\n        this.values.set(key.name, value);\n    }\n\n    /** Remove the current value for a context key (e.g. on logout). */\n    remove(key: AnyUntrustedContextKey): void {\n        this.values.delete(key.name);\n    }\n\n    /** Clear all stored values. */\n    clear(): void {\n        this.values.clear();\n    }\n\n    read(key: AnyContextKey): string | undefined {\n        return this.values.get(key.name);\n    }\n}\n"]}