accessio 1.3.0 → 1.5.0

package/src/accessio.ts

@@ -15,6 +15,66 @@ import type {
 } from './types';
 import defaultsConfig from './defaults/index';
 
+function runRequestInterceptorsSync(
+  startConfig: AccessioRequestConfig,
+  interceptors: InterceptorHandler[],
+): Promise<AccessioRequestConfig> {
+  let cfg = startConfig;
+  let rejectReason: any = null;
+  let isRejected = false;
+
+  for (const interceptor of interceptors) {
+    if (!isRejected) {
+      try {
+        if (interceptor.fulfilled) {
+          cfg = (interceptor.fulfilled as any)(cfg) as AccessioRequestConfig;
+        }
+      } catch (err) {
+        rejectReason = err;
+        isRejected = true;
+      }
+    } else if (interceptor.rejected) {
+      try {
+        cfg = interceptor.rejected(rejectReason) as AccessioRequestConfig;
+        isRejected = false;
+      } catch (err) {
+        rejectReason = err;
+        isRejected = true;
+      }
+    }
+  }
+
+  return isRejected ? Promise.reject(rejectReason) : Promise.resolve(cfg);
+}
+
+function runRequestInterceptorsAsync(
+  startConfig: AccessioRequestConfig,
+  interceptors: InterceptorHandler[],
+): Promise<AccessioRequestConfig> {
+  let promise: Promise<any> = Promise.resolve(startConfig);
+  for (const interceptor of interceptors) {
+    promise = promise.then(
+      (value: any) => (interceptor.fulfilled ? (interceptor.fulfilled as any)(value) : value),
+      interceptor.rejected ?? undefined,
+    );
+  }
+  return promise as Promise<AccessioRequestConfig>;
+}
+
+function dispatchAndRetry(cfg: AccessioRequestConfig): Promise<AccessioResponse> {
+  const fullUrl = buildURL(cfg.url ?? '', cfg.baseURL, cfg.params, cfg.paramsSerializer);
+  logRequest(cfg, fullUrl);
+
+  const enrichedCfg = fullUrl !== (cfg.url || '') ? { ...cfg, _builtUrl: fullUrl } : cfg;
+
+  const dispatchFn = cfg.rateLimiter
+    ? (config: AccessioRequestConfig) =>
+        rateLimitedRequest(dispatchRequest, config.rateLimiter!, config)
+    : dispatchRequest;
+
+  return retryRequest(dispatchFn, enrichedCfg);
+}
+
 export class Accessio {
   defaults: AccessioRequestConfig;
   interceptors: Interceptors;
@@ -51,86 +111,17 @@ export class Accessio {
       );
     }
 
-    const requestInterceptors: any[] = [];
-    const responseInterceptors: any[] = [];
-    let synchronousRequestInterceptors = true;
-
-    this.interceptors.request.forEach((interceptor: InterceptorHandler) => {
-      if (interceptor.runWhen && !interceptor.runWhen(mergedConfig)) {
-        return;
-      }
-      synchronousRequestInterceptors = synchronousRequestInterceptors && interceptor.synchronous;
-      requestInterceptors.unshift(interceptor);
-    });
-
-    this.interceptors.response.forEach((interceptor: InterceptorHandler) => {
-      responseInterceptors.push(interceptor);
-    });
-
-    let promise: Promise<any>;
-
-    if (synchronousRequestInterceptors) {
-      let newConfig = mergedConfig;
-      let rejectReason: any = null;
-      let isRejected = false;
-
-      for (const interceptor of requestInterceptors) {
-        if (!isRejected) {
-          try {
-            if (interceptor.fulfilled) {
-              newConfig = interceptor.fulfilled(newConfig);
-            }
-          } catch (err) {
-            rejectReason = err;
-            isRejected = true;
-          }
-        } else {
-          if (interceptor.rejected) {
-            try {
-              newConfig = interceptor.rejected(rejectReason);
-              isRejected = false;
-            } catch (err) {
-              rejectReason = err;
-              isRejected = true;
-            }
-          }
-        }
-      }
-
-      if (isRejected) {
-        promise = Promise.reject(rejectReason);
-      } else {
-        promise = Promise.resolve(newConfig);
-      }
-    } else {
-      promise = Promise.resolve(mergedConfig);
-      for (const interceptor of requestInterceptors) {
-        promise = promise.then((value: any) => {
-          if (interceptor.fulfilled) {
-            return interceptor.fulfilled(value);
-          }
-          return value;
-        }, interceptor.rejected);
-      }
-    }
-
-    promise = promise.then((cfg: any) => {
-      const fullUrl = buildURL(cfg.url ?? '', cfg.baseURL, cfg.params, cfg.paramsSerializer);
-
-      logRequest(cfg, fullUrl);
+    const { requestInterceptors, responseInterceptors, synchronous } =
+      this.collectInterceptors(mergedConfig);
 
-      const enrichedCfg = fullUrl !== (cfg.url || '') ? { ...cfg, _builtUrl: fullUrl } : cfg;
+    let promise: Promise<any> = synchronous
+      ? runRequestInterceptorsSync(mergedConfig, requestInterceptors)
+      : runRequestInterceptorsAsync(mergedConfig, requestInterceptors);
 
-      const dispatchFn = cfg.rateLimiter
-        ? (config: AccessioRequestConfig) =>
-            rateLimitedRequest(dispatchRequest, config.rateLimiter!, config)
-        : dispatchRequest;
-
-      return retryRequest(dispatchFn, enrichedCfg);
-    });
+    promise = promise.then((cfg: AccessioRequestConfig) => dispatchAndRetry(cfg));
 
     promise = promise.then(
-      (value: any) => {
+      (value: AccessioResponse) => {
         logResponse(value);
         return value;
       },
@@ -143,15 +134,37 @@ export class Accessio {
     for (const interceptor of responseInterceptors) {
       promise = promise.then((value: any) => {
         if (interceptor.fulfilled) {
-          return interceptor.fulfilled(value);
+          return (interceptor.fulfilled as any)(value);
         }
         return value;
-      }, interceptor.rejected);
+      }, interceptor.rejected ?? undefined);
     }
 
     return promise;
   }
 
+  private collectInterceptors(mergedConfig: AccessioRequestConfig): {
+    requestInterceptors: InterceptorHandler[];
+    responseInterceptors: InterceptorHandler[];
+    synchronous: boolean;
+  } {
+    const requestInterceptors: InterceptorHandler[] = [];
+    const responseInterceptors: InterceptorHandler[] = [];
+    let synchronous = true;
+
+    this.interceptors.request.forEach((interceptor: InterceptorHandler) => {
+      if (interceptor.runWhen && !interceptor.runWhen(mergedConfig)) return;
+      synchronous = synchronous && interceptor.synchronous;
+      requestInterceptors.unshift(interceptor);
+    });
+
+    this.interceptors.response.forEach((interceptor: InterceptorHandler) => {
+      responseInterceptors.push(interceptor);
+    });
+
+    return { requestInterceptors, responseInterceptors, synchronous };
+  }
+
   getUri(config?: AccessioRequestConfig): string {
     const merged = mergeConfig(this.defaults, config);
     return buildURL(merged.url ?? '', merged.baseURL, merged.params, merged.paramsSerializer);
@@ -197,7 +210,8 @@ export class Accessio {
     return this.request<T>(mergeConfig(config || {}, { method: 'patch', url, data }));
   }
 
-  postForm<T = any>(
+  private formRequest<T = any>(
+    method: 'post' | 'put' | 'patch',
     url: string,
     data?: any,
     config?: AccessioRequestConfig,
@@ -205,7 +219,7 @@ export class Accessio {
     const formData = data && !(data instanceof FormData) ? toFormData(data) : data;
     return this.request<T>(
       mergeConfig(config || {}, {
-        method: 'post',
+        method,
         url,
         data: formData,
         headers: { 'Content-Type': 'multipart/form-data' },
@@ -213,20 +227,20 @@ export class Accessio {
     );
   }
 
+  postForm<T = any>(
+    url: string,
+    data?: any,
+    config?: AccessioRequestConfig,
+  ): Promise<AccessioResponse<T>> {
+    return this.formRequest<T>('post', url, data, config);
+  }
+
   putForm<T = any>(
     url: string,
     data?: any,
     config?: AccessioRequestConfig,
   ): Promise<AccessioResponse<T>> {
-    const formData = data && !(data instanceof FormData) ? toFormData(data) : data;
-    return this.request<T>(
-      mergeConfig(config || {}, {
-        method: 'put',
-        url,
-        data: formData,
-        headers: { 'Content-Type': 'multipart/form-data' },
-      }),
-    );
+    return this.formRequest<T>('put', url, data, config);
   }
 
   patchForm<T = any>(
@@ -234,15 +248,7 @@ export class Accessio {
     data?: any,
     config?: AccessioRequestConfig,
   ): Promise<AccessioResponse<T>> {
-    const formData = data && !(data instanceof FormData) ? toFormData(data) : data;
-    return this.request<T>(
-      mergeConfig(config || {}, {
-        method: 'patch',
-        url,
-        data: formData,
-        headers: { 'Content-Type': 'multipart/form-data' },
-      }),
-    );
+    return this.formRequest<T>('patch', url, data, config);
   }
 
   async *stream<T = any>(
@@ -255,19 +261,13 @@ export class Accessio {
     if (!response.data) return;
 
     const reader = response.data.getReader();
-    const decoder = new TextDecoder();
-    let buffer = '';
+    try {
+      const decoder = new TextDecoder();
+      let buffer = '';
 
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split('\n');
-      buffer = lines.pop() || '';
-
-      for (const line of lines) {
-        if (line.trim().startsWith('data:')) {
+      const processLine = function* (line: string) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith('data:')) {
           const dataStr = line.replace(/^data:\s*/, '');
           if (dataStr === '[DONE]') return;
           try {
@@ -275,14 +275,39 @@ export class Accessio {
           } catch (e) {
             yield dataStr as any;
           }
-        } else if (line.trim().startsWith('{') || line.trim().startsWith('[')) {
+        } else if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
           try {
             yield JSON.parse(line);
           } catch (e) {
             // ignore partial json
           }
         }
+      };
+
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+
+        buffer += decoder.decode(value, { stream: true });
+        const lines = buffer.split('\n');
+        buffer = lines.pop() || '';
+
+        for (const line of lines) {
+          yield* processLine(line);
+        }
       }
+
+      buffer += decoder.decode(new Uint8Array(), { stream: false });
+      if (buffer.trim()) {
+        yield* processLine(buffer);
+      }
+    } finally {
+      try {
+        await reader.cancel();
+      } catch {
+        // ignore errors on cancel
+      }
+      reader.releaseLock();
     }
   }
 
@@ -296,14 +321,24 @@ export class Accessio {
     while (nextUrl) {
       const response: AccessioResponse<any> = await this.get(nextUrl, currentConfig);
 
-      const items = Array.isArray(response.data) ? response.data : response.data.data;
+      const data = response.data;
+      const items = Array.isArray(data)
+        ? data
+        : data && typeof data === 'object'
+          ? (data as any).data
+          : null;
+
       if (Array.isArray(items)) {
         for (const item of items) {
           yield item;
         }
       }
 
-      nextUrl = response.data.next || response.data.links?.next || null;
+      nextUrl =
+        data && typeof data === 'object'
+          ? (data as any).next || (data as any).links?.next || null
+          : null;
+
       if (nextUrl) {
         currentConfig = mergeConfig(currentConfig, { url: nextUrl, params: {} });
       }

package/src/core/accessioError.ts

@@ -6,7 +6,7 @@ function redactHeaders(headers: unknown): unknown {
   const out: Record<string, unknown> = {};
   for (const key of Object.keys(headers as Record<string, unknown>)) {
     const value = (headers as Record<string, unknown>)[key];
-    if (/^authorization$/i.test(key)) {
+    if (/^authorization$/i.test(key) || /^cookie$/i.test(key) || /^set-cookie$/i.test(key)) {
       out[key] = '[REDACTED]';
     } else if (value && typeof value === 'object' && !Array.isArray(value)) {
       out[key] = redactHeaders(value);
@@ -17,11 +17,67 @@ function redactHeaders(headers: unknown): unknown {
   return out;
 }
 
+const SENSITIVE_BODY_KEY =
+  /^(password|passwd|pwd|token|access_token|refresh_token|id_token|authorization|api[_-]?key|secret|client[_-]?secret|cookie|set[_-]?cookie|private[_-]?key|session)$/i;
+
+export function redactBody(value: unknown, seen?: WeakSet<object>): unknown {
+  if (value === null || typeof value !== 'object') return value;
+  const visited = seen ?? new WeakSet<object>();
+  if (visited.has(value as object)) return '[Circular]';
+  visited.add(value as object);
+
+  if (Array.isArray(value)) {
+    return value.map((item) => redactBody(item, visited));
+  }
+
+  const out: Record<string, unknown> = {};
+  for (const key of Object.keys(value as Record<string, unknown>)) {
+    const v = (value as Record<string, unknown>)[key];
+    if (SENSITIVE_BODY_KEY.test(key)) {
+      out[key] = '[REDACTED]';
+    } else {
+      out[key] = redactBody(v, visited);
+    }
+  }
+  return out;
+}
+
+function redactParams(params: unknown): unknown {
+  if (!params || typeof params !== 'object') return params;
+  const out: Record<string, unknown> = {};
+  for (const key of Object.keys(params as Record<string, unknown>)) {
+    const value = (params as Record<string, unknown>)[key];
+    if (SENSITIVE_BODY_KEY.test(key)) {
+      out[key] = '[REDACTED]';
+    } else if (value && typeof value === 'object' && !Array.isArray(value)) {
+      out[key] = redactParams(value);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+function redactURL(url: string | undefined): string | undefined {
+  if (!url) return url;
+  // Match inline credentials: http://user:pass@host
+  return url.replace(/^([a-z][a-z\d+\-.]*:\/\/)([^/]+)@/i, (match, protocol, userInfo) => {
+    const parts = userInfo.split(':');
+    if (parts.length > 1) {
+      return `${protocol}${parts[0]}:[REDACTED]@`;
+    }
+    return `${protocol}[REDACTED]@`;
+  });
+}
+
 export function redactConfig(config: AccessioRequestConfig | null): AccessioRequestConfig | null {
   if (!config) return config;
   const clone = { ...config } as AccessioRequestConfig & { auth?: unknown };
   if ('auth' in clone) delete clone.auth;
   if (clone.headers) clone.headers = redactHeaders(clone.headers) as typeof clone.headers;
+  if (clone.params) clone.params = redactParams(clone.params) as typeof clone.params;
+  if (clone.url) clone.url = redactURL(clone.url);
+  if (clone._builtUrl) clone._builtUrl = redactURL(clone._builtUrl);
   return clone;
 }
 

package/src/core/buildURL.ts

@@ -76,11 +76,19 @@ export default function buildURL(
   let fullURL = baseURL && !isAbsoluteURL(url) ? combineURLs(baseURL, url) : url || '';
 
   let finalParams = params;
-  if (params && typeof params === 'object') {
-    const unusedParams = { ...params };
+  if (params && typeof params === 'object' && !(params instanceof URLSearchParams)) {
+    const unusedParams: Record<string, unknown> = {};
+    for (const key of Object.keys(params)) {
+      if (key === '__proto__' || key === 'prototype' || key === 'constructor') continue;
+      unusedParams[key] = (params as Record<string, unknown>)[key];
+    }
     fullURL = fullURL.replace(/(?::([a-zA-Z0-9_]+))|(?:{([a-zA-Z0-9_]+)})/g, (match, p1, p2) => {
       const key = p1 || p2;
-      if (key && unusedParams[key] !== undefined) {
+      if (
+        key &&
+        Object.prototype.hasOwnProperty.call(unusedParams, key) &&
+        unusedParams[key] !== undefined
+      ) {
         const val = unusedParams[key];
         delete unusedParams[key];
         return encodeURIComponent(String(val));
@@ -93,10 +101,12 @@ export default function buildURL(
   const serialized = serializeParams(finalParams as Record<string, unknown>, paramsSerializer);
   if (serialized) {
     const hashIndex = fullURL.indexOf('#');
+    let fragment = '';
     if (hashIndex !== -1) {
+      fragment = fullURL.slice(hashIndex);
       fullURL = fullURL.slice(0, hashIndex);
     }
-    fullURL += (fullURL.indexOf('?') === -1 ? '?' : '&') + serialized;
+    fullURL += (fullURL.indexOf('?') === -1 ? '?' : '&') + serialized + fragment;
   }
 
   return fullURL;