@webpieces/http-client-browser 0.4.604 → 0.4.606
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@webpieces/http-client-browser",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.606",
|
|
4
4
|
"description": "Browser HTTP client for webpieces: DI-free (React or Angular), app-managed context store, no AsyncLocalStorage",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -22,7 +22,7 @@
|
|
|
22
22
|
"access": "public"
|
|
23
23
|
},
|
|
24
24
|
"dependencies": {
|
|
25
|
-
"@webpieces/core-util": "0.4.
|
|
26
|
-
"@webpieces/http-client-core": "0.4.
|
|
25
|
+
"@webpieces/core-util": "0.4.606",
|
|
26
|
+
"@webpieces/http-client-core": "0.4.606"
|
|
27
27
|
}
|
|
28
28
|
}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { AuthMeta, ContextMgr, RouteMetadata } from '@webpieces/core-util';
|
|
1
|
+
import { AuthMeta, ContextMgr, DestinationTrust, RouteMetadata } from '@webpieces/core-util';
|
|
2
2
|
import { ApiPrototype, ProxyClient, RequestOutcome } from '@webpieces/http-client-core';
|
|
3
3
|
import { ClientConfig } from './ClientConfig';
|
|
4
4
|
import { RequestLifecycleListener } from './RequestLifecycleListener';
|
|
@@ -31,7 +31,14 @@ export declare class BrowserProxyClient extends ProxyClient {
|
|
|
31
31
|
* relative. No `window` access, so this stays SSR-safe and testable.
|
|
32
32
|
*/
|
|
33
33
|
protected resolveBaseUrl(): Promise<string>;
|
|
34
|
-
|
|
34
|
+
/**
|
|
35
|
+
* `destination` is always the un-verifying kind here — {@link assertEndpointSupported} below
|
|
36
|
+
* refuses to bind an @AuthOidc / @AuthSharedSecret contract, so every browser destination is
|
|
37
|
+
* @AuthJwt or @Public — which means a browser never puts a trusted context key on the wire. It is
|
|
38
|
+
* still threaded rather than short-circuited: the rule lives in ContextMgr, one place, for both
|
|
39
|
+
* environments.
|
|
40
|
+
*/
|
|
41
|
+
protected outboundContextHeaders(destination: DestinationTrust): Map<string, string>;
|
|
35
42
|
/**
|
|
36
43
|
* Forward the call's lifecycle to the app's listener, if one was registered on the factory. The
|
|
37
44
|
* optional chain makes both a no-op when no listener is present — the default browser case.
|
|
@@ -41,8 +41,15 @@ class BrowserProxyClient extends http_client_core_1.ProxyClient {
|
|
|
41
41
|
async resolveBaseUrl() {
|
|
42
42
|
return (await core_util_1.ClientRegistry.tryResolve(this.config.svcName)) ?? '';
|
|
43
43
|
}
|
|
44
|
-
|
|
45
|
-
|
|
44
|
+
/**
|
|
45
|
+
* `destination` is always the un-verifying kind here — {@link assertEndpointSupported} below
|
|
46
|
+
* refuses to bind an @AuthOidc / @AuthSharedSecret contract, so every browser destination is
|
|
47
|
+
* @AuthJwt or @Public — which means a browser never puts a trusted context key on the wire. It is
|
|
48
|
+
* still threaded rather than short-circuited: the rule lives in ContextMgr, one place, for both
|
|
49
|
+
* environments.
|
|
50
|
+
*/
|
|
51
|
+
outboundContextHeaders(destination) {
|
|
52
|
+
return this.contextMgr.buildOutboundHeaders(destination);
|
|
46
53
|
}
|
|
47
54
|
/**
|
|
48
55
|
* Forward the call's lifecycle to the app's listener, if one was registered on the factory. The
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BrowserProxyClient.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-browser/src/BrowserProxyClient.ts"],"names":[],"mappings":";;;AAAA,
|
|
1
|
+
{"version":3,"file":"BrowserProxyClient.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-browser/src/BrowserProxyClient.ts"],"names":[],"mappings":";;;AAAA,oDAA6G;AAC7G,kEAAwF;AAIxF;;;;;;;;;GASG;AACH,MAAa,kBAAmB,SAAQ,8BAAW;IAI1B;IACA;IAJb,MAAM,CAAgB;IAE9B,YACqB,UAAsB,EACtB,iBAA4C;QAE7D,KAAK,EAAE,CAAC;QAHS,eAAU,GAAV,UAAU,CAAY;QACtB,sBAAiB,GAAjB,iBAAiB,CAA2B;IAGjE,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,YAAkC,EAAE,MAAoB;QACzD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;OAUG;IACgB,KAAK,CAAC,cAAc;QACnC,OAAO,CAAC,MAAM,0BAAc,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACgB,sBAAsB,CAAC,WAA6B;QACnE,OAAO,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACgB,cAAc,CAAC,KAAoB;QAClD,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAEkB,YAAY,CAAC,KAAoB,EAAE,OAAuB;QACzE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACgB,uBAAuB,CAAC,QAA8B,EAAE,UAAkB;QACzF,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC;QACjC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC9C,OAAO;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACX,YAAY,UAAU,QAAQ,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,sBAAsB;YACrG,wGAAwG,CAC3G,CAAC;IACN,CAAC;CACJ;AArED,gDAqEC","sourcesContent":["import { AuthMeta, ContextMgr, ClientRegistry, DestinationTrust, RouteMetadata } from '@webpieces/core-util';\nimport { ApiPrototype, ProxyClient, RequestOutcome } from '@webpieces/http-client-core';\nimport { ClientConfig } from './ClientConfig';\nimport { RequestLifecycleListener } from './RequestLifecycleListener';\n\n/**\n * The browser {@link ProxyClient}. Reads context from the app-held store (via {@link ContextMgr}),\n * because a browser has no ambient request scope.\n *\n * It attaches NO outbound credential and does NO recording — both inherit the base's no-ops. A\n * browser cannot mint an OIDC token and must never hold a shared secret; the user's JWT travels as\n * an ordinary transferred context key, set on the store at login.\n *\n * This is the ONLY class in webpieces that names ContextMgr.\n */\nexport class BrowserProxyClient extends ProxyClient {\n private config!: ClientConfig;\n\n constructor(\n private readonly contextMgr: ContextMgr,\n private readonly lifecycleListener?: RequestLifecycleListener,\n ) {\n super();\n }\n\n /** Bind this client to one API contract + base URL. */\n init(apiPrototype: ApiPrototype<object>, config: ClientConfig): void {\n this.config = config;\n this.initRoutes(apiPrototype);\n }\n\n /**\n * The same chain every client runs — a ClientRegistry mapping, else the installed deriver — but\n * with the BROWSER's fallback: `''`, which makes the URL RELATIVE (`/auth/oauth`) and therefore\n * same-origin, by definition. A browser app almost always calls the backend that served it, so\n * that is the default, and an unregistered svcName must NEVER throw the way it used to — a\n * forgotten registration silently killed sign-in, the request never leaving the page.\n *\n * A mapping still wins, which is exactly how an Angular dev server on :4201 reaches its backend\n * on :8201, while the same bundle served BY that backend in prod registers nothing and goes\n * relative. No `window` access, so this stays SSR-safe and testable.\n */\n protected override async resolveBaseUrl(): Promise<string> {\n return (await ClientRegistry.tryResolve(this.config.svcName)) ?? '';\n }\n\n /**\n * `destination` is always the un-verifying kind here — {@link assertEndpointSupported} below\n * refuses to bind an @AuthOidc / @AuthSharedSecret contract, so every browser destination is\n * @AuthJwt or @Public — which means a browser never puts a trusted context key on the wire. It is\n * still threaded rather than short-circuited: the rule lives in ContextMgr, one place, for both\n * environments.\n */\n protected override outboundContextHeaders(destination: DestinationTrust): Map<string, string> {\n return this.contextMgr.buildOutboundHeaders(destination);\n }\n\n /**\n * Forward the call's lifecycle to the app's listener, if one was registered on the factory. The\n * optional chain makes both a no-op when no listener is present — the default browser case.\n */\n protected override onRequestStart(route: RouteMetadata): void {\n this.lifecycleListener?.onRequestStart(route);\n }\n\n protected override onRequestEnd(route: RouteMetadata, outcome: RequestOutcome): void {\n this.lifecycleListener?.onRequestEnd(route, outcome);\n }\n\n /**\n * Reject a contract this browser cannot satisfy, at bind time rather than on the first call.\n * Both service-to-service modes need credentials only a server has: @AuthOidc needs a runtime\n * service account to mint a token, @AuthSharedSecret needs a secret no browser may ship.\n */\n protected override assertEndpointSupported(authMeta: AuthMeta | undefined, methodName: string): void {\n const kind = authMeta?.mode.kind;\n if (kind !== 'oidc' && kind !== 'shared-secret') {\n return;\n }\n throw new Error(\n `Endpoint ${methodName} is @${kind === 'oidc' ? 'AuthOidc' : 'AuthSharedSecret'} — a browser cannot ` +\n `hold service credentials. Call it server-side with ClientHttpFactory from @webpieces/http-client-node.`,\n );\n }\n}\n"]}
|