accessio 1.2.0 → 1.4.0

package/src/accessio.ts

@@ -15,6 +15,66 @@ import type {
 } from './types';
 import defaultsConfig from './defaults/index';
 
+function runRequestInterceptorsSync(
+  startConfig: AccessioRequestConfig,
+  interceptors: InterceptorHandler[],
+): Promise<AccessioRequestConfig> {
+  let cfg = startConfig;
+  let rejectReason: any = null;
+  let isRejected = false;
+
+  for (const interceptor of interceptors) {
+    if (!isRejected) {
+      try {
+        if (interceptor.fulfilled) {
+          cfg = (interceptor.fulfilled as any)(cfg) as AccessioRequestConfig;
+        }
+      } catch (err) {
+        rejectReason = err;
+        isRejected = true;
+      }
+    } else if (interceptor.rejected) {
+      try {
+        cfg = interceptor.rejected(rejectReason) as AccessioRequestConfig;
+        isRejected = false;
+      } catch (err) {
+        rejectReason = err;
+        isRejected = true;
+      }
+    }
+  }
+
+  return isRejected ? Promise.reject(rejectReason) : Promise.resolve(cfg);
+}
+
+function runRequestInterceptorsAsync(
+  startConfig: AccessioRequestConfig,
+  interceptors: InterceptorHandler[],
+): Promise<AccessioRequestConfig> {
+  let promise: Promise<any> = Promise.resolve(startConfig);
+  for (const interceptor of interceptors) {
+    promise = promise.then(
+      (value: any) => (interceptor.fulfilled ? (interceptor.fulfilled as any)(value) : value),
+      interceptor.rejected ?? undefined,
+    );
+  }
+  return promise as Promise<AccessioRequestConfig>;
+}
+
+function dispatchAndRetry(cfg: AccessioRequestConfig): Promise<AccessioResponse> {
+  const fullUrl = buildURL(cfg.url ?? '', cfg.baseURL, cfg.params, cfg.paramsSerializer);
+  logRequest(cfg, fullUrl);
+
+  const enrichedCfg = fullUrl !== (cfg.url || '') ? { ...cfg, _builtUrl: fullUrl } : cfg;
+
+  const dispatchFn = cfg.rateLimiter
+    ? (config: AccessioRequestConfig) =>
+        rateLimitedRequest(dispatchRequest, config.rateLimiter!, config)
+    : dispatchRequest;
+
+  return retryRequest(dispatchFn, enrichedCfg);
+}
+
 export class Accessio {
   defaults: AccessioRequestConfig;
   interceptors: Interceptors;
@@ -51,86 +111,17 @@ export class Accessio {
       );
     }
 
-    const requestInterceptors: any[] = [];
-    const responseInterceptors: any[] = [];
-    let synchronousRequestInterceptors = true;
+    const { requestInterceptors, responseInterceptors, synchronous } =
+      this.collectInterceptors(mergedConfig);
 
-    this.interceptors.request.forEach((interceptor: InterceptorHandler) => {
-      if (interceptor.runWhen && !interceptor.runWhen(mergedConfig)) {
-        return;
-      }
-      synchronousRequestInterceptors = synchronousRequestInterceptors && interceptor.synchronous;
-      requestInterceptors.unshift(interceptor);
-    });
-
-    this.interceptors.response.forEach((interceptor: InterceptorHandler) => {
-      responseInterceptors.push(interceptor);
-    });
-
-    let promise: Promise<any>;
-
-    if (synchronousRequestInterceptors) {
-      let newConfig = mergedConfig;
-      let rejectReason: any = null;
-      let isRejected = false;
-
-      for (const interceptor of requestInterceptors) {
-        if (!isRejected) {
-          try {
-            if (interceptor.fulfilled) {
-              newConfig = interceptor.fulfilled(newConfig);
-            }
-          } catch (err) {
-            rejectReason = err;
-            isRejected = true;
-          }
-        } else {
-          if (interceptor.rejected) {
-            try {
-              newConfig = interceptor.rejected(rejectReason);
-              isRejected = false;
-            } catch (err) {
-              rejectReason = err;
-              isRejected = true;
-            }
-          }
-        }
-      }
-
-      if (isRejected) {
-        promise = Promise.reject(rejectReason);
-      } else {
-        promise = Promise.resolve(newConfig);
-      }
-    } else {
-      promise = Promise.resolve(mergedConfig);
-      for (const interceptor of requestInterceptors) {
-        promise = promise.then((value: any) => {
-          if (interceptor.fulfilled) {
-            return interceptor.fulfilled(value);
-          }
-          return value;
-        }, interceptor.rejected);
-      }
-    }
+    let promise: Promise<any> = synchronous
+      ? runRequestInterceptorsSync(mergedConfig, requestInterceptors)
+      : runRequestInterceptorsAsync(mergedConfig, requestInterceptors);
 
-    promise = promise.then((cfg: any) => {
-      const fullUrl = buildURL(cfg.url ?? '', cfg.baseURL, cfg.params, cfg.paramsSerializer);
-
-      logRequest(cfg, fullUrl);
-
-      const enrichedCfg = fullUrl !== (cfg.url || '') ? { ...cfg, _builtUrl: fullUrl } : cfg;
-
-      const dispatchFn = cfg.rateLimiter
-        ? (config: AccessioRequestConfig) =>
-            rateLimitedRequest(dispatchRequest, config.rateLimiter!, config)
-        : dispatchRequest;
-
-      return retryRequest(dispatchFn, enrichedCfg);
-    });
+    promise = promise.then((cfg: AccessioRequestConfig) => dispatchAndRetry(cfg));
 
     promise = promise.then(
-      (value: any) => {
+      (value: AccessioResponse) => {
         logResponse(value);
         return value;
       },
@@ -143,15 +134,37 @@ export class Accessio {
     for (const interceptor of responseInterceptors) {
       promise = promise.then((value: any) => {
         if (interceptor.fulfilled) {
-          return interceptor.fulfilled(value);
+          return (interceptor.fulfilled as any)(value);
         }
         return value;
-      }, interceptor.rejected);
+      }, interceptor.rejected ?? undefined);
     }
 
     return promise;
   }
 
+  private collectInterceptors(mergedConfig: AccessioRequestConfig): {
+    requestInterceptors: InterceptorHandler[];
+    responseInterceptors: InterceptorHandler[];
+    synchronous: boolean;
+  } {
+    const requestInterceptors: InterceptorHandler[] = [];
+    const responseInterceptors: InterceptorHandler[] = [];
+    let synchronous = true;
+
+    this.interceptors.request.forEach((interceptor: InterceptorHandler) => {
+      if (interceptor.runWhen && !interceptor.runWhen(mergedConfig)) return;
+      synchronous = synchronous && interceptor.synchronous;
+      requestInterceptors.unshift(interceptor);
+    });
+
+    this.interceptors.response.forEach((interceptor: InterceptorHandler) => {
+      responseInterceptors.push(interceptor);
+    });
+
+    return { requestInterceptors, responseInterceptors, synchronous };
+  }
+
   getUri(config?: AccessioRequestConfig): string {
     const merged = mergeConfig(this.defaults, config);
     return buildURL(merged.url ?? '', merged.baseURL, merged.params, merged.paramsSerializer);
@@ -197,7 +210,8 @@ export class Accessio {
     return this.request<T>(mergeConfig(config || {}, { method: 'patch', url, data }));
   }
 
-  postForm<T = any>(
+  private formRequest<T = any>(
+    method: 'post' | 'put' | 'patch',
     url: string,
     data?: any,
     config?: AccessioRequestConfig,
@@ -205,7 +219,7 @@ export class Accessio {
     const formData = data && !(data instanceof FormData) ? toFormData(data) : data;
     return this.request<T>(
       mergeConfig(config || {}, {
-        method: 'post',
+        method,
         url,
         data: formData,
         headers: { 'Content-Type': 'multipart/form-data' },
@@ -213,20 +227,20 @@ export class Accessio {
     );
   }
 
+  postForm<T = any>(
+    url: string,
+    data?: any,
+    config?: AccessioRequestConfig,
+  ): Promise<AccessioResponse<T>> {
+    return this.formRequest<T>('post', url, data, config);
+  }
+
   putForm<T = any>(
     url: string,
     data?: any,
     config?: AccessioRequestConfig,
   ): Promise<AccessioResponse<T>> {
-    const formData = data && !(data instanceof FormData) ? toFormData(data) : data;
-    return this.request<T>(
-      mergeConfig(config || {}, {
-        method: 'put',
-        url,
-        data: formData,
-        headers: { 'Content-Type': 'multipart/form-data' },
-      }),
-    );
+    return this.formRequest<T>('put', url, data, config);
   }
 
   patchForm<T = any>(
@@ -234,15 +248,7 @@ export class Accessio {
     data?: any,
     config?: AccessioRequestConfig,
   ): Promise<AccessioResponse<T>> {
-    const formData = data && !(data instanceof FormData) ? toFormData(data) : data;
-    return this.request<T>(
-      mergeConfig(config || {}, {
-        method: 'patch',
-        url,
-        data: formData,
-        headers: { 'Content-Type': 'multipart/form-data' },
-      }),
-    );
+    return this.formRequest<T>('patch', url, data, config);
   }
 
   async *stream<T = any>(

package/src/core/accessioError.ts

@@ -1,6 +1,55 @@
 import ErrorCodes from '../constants/errorCodes';
 import type { AccessioRequestConfig, AccessioResponse } from '../types';
 
+function redactHeaders(headers: unknown): unknown {
+  if (!headers || typeof headers !== 'object') return headers;
+  const out: Record<string, unknown> = {};
+  for (const key of Object.keys(headers as Record<string, unknown>)) {
+    const value = (headers as Record<string, unknown>)[key];
+    if (/^authorization$/i.test(key) || /^cookie$/i.test(key) || /^set-cookie$/i.test(key)) {
+      out[key] = '[REDACTED]';
+    } else if (value && typeof value === 'object' && !Array.isArray(value)) {
+      out[key] = redactHeaders(value);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+const SENSITIVE_BODY_KEY =
+  /^(password|passwd|pwd|token|access_token|refresh_token|id_token|authorization|api[_-]?key|secret|client[_-]?secret|cookie|set[_-]?cookie|private[_-]?key|session)$/i;
+
+export function redactBody(value: unknown, seen?: WeakSet<object>): unknown {
+  if (value === null || typeof value !== 'object') return value;
+  const visited = seen ?? new WeakSet<object>();
+  if (visited.has(value as object)) return '[Circular]';
+  visited.add(value as object);
+
+  if (Array.isArray(value)) {
+    return value.map((item) => redactBody(item, visited));
+  }
+
+  const out: Record<string, unknown> = {};
+  for (const key of Object.keys(value as Record<string, unknown>)) {
+    const v = (value as Record<string, unknown>)[key];
+    if (SENSITIVE_BODY_KEY.test(key)) {
+      out[key] = '[REDACTED]';
+    } else {
+      out[key] = redactBody(v, visited);
+    }
+  }
+  return out;
+}
+
+export function redactConfig(config: AccessioRequestConfig | null): AccessioRequestConfig | null {
+  if (!config) return config;
+  const clone = { ...config } as AccessioRequestConfig & { auth?: unknown };
+  if ('auth' in clone) delete clone.auth;
+  if (clone.headers) clone.headers = redactHeaders(clone.headers) as typeof clone.headers;
+  return clone;
+}
+
 export class AccessioError extends Error {
   static ERR_BAD_OPTION_VALUE: string = ErrorCodes.ERR_BAD_OPTION_VALUE;
   static ERR_BAD_OPTION: string = ErrorCodes.ERR_BAD_OPTION;
@@ -32,7 +81,7 @@ export class AccessioError extends Error {
     super(message);
     this.name = 'AccessioError';
     this.code = code ?? null;
-    this.config = config ?? null;
+    this.config = redactConfig(config ?? null);
     this.request = request ?? null;
     this.response = response ?? null;
     this.isAccessioError = true;

package/src/core/buildURL.ts

@@ -76,11 +76,19 @@ export default function buildURL(
   let fullURL = baseURL && !isAbsoluteURL(url) ? combineURLs(baseURL, url) : url || '';
 
   let finalParams = params;
-  if (params && typeof params === 'object') {
-    const unusedParams = { ...params };
+  if (params && typeof params === 'object' && !(params instanceof URLSearchParams)) {
+    const unusedParams: Record<string, unknown> = {};
+    for (const key of Object.keys(params)) {
+      if (key === '__proto__' || key === 'prototype' || key === 'constructor') continue;
+      unusedParams[key] = (params as Record<string, unknown>)[key];
+    }
     fullURL = fullURL.replace(/(?::([a-zA-Z0-9_]+))|(?:{([a-zA-Z0-9_]+)})/g, (match, p1, p2) => {
       const key = p1 || p2;
-      if (key && unusedParams[key] !== undefined) {
+      if (
+        key &&
+        Object.prototype.hasOwnProperty.call(unusedParams, key) &&
+        unusedParams[key] !== undefined
+      ) {
         const val = unusedParams[key];
         delete unusedParams[key];
         return encodeURIComponent(String(val));
@@ -93,10 +101,12 @@ export default function buildURL(
   const serialized = serializeParams(finalParams as Record<string, unknown>, paramsSerializer);
   if (serialized) {
     const hashIndex = fullURL.indexOf('#');
+    let fragment = '';
     if (hashIndex !== -1) {
+      fragment = fullURL.slice(hashIndex);
       fullURL = fullURL.slice(0, hashIndex);
     }
-    fullURL += (fullURL.indexOf('?') === -1 ? '?' : '&') + serialized;
+    fullURL += (fullURL.indexOf('?') === -1 ? '?' : '&') + serialized + fragment;
   }
 
   return fullURL;