astro-tokenkit 1.0.18 → 1.0.20

package/README.md

@@ -307,3 +307,17 @@ Run on a standard development machine using `npm run bench`:
 ## License
 
 MIT © [oamm](https://github.com/oamm)
+
+---
+
+## Playground
+
+We've included a [playground](./playground) project to quickly test the integration.
+
+To run the playground:
+
+```bash
+npm run playground
+```
+
+This will install the dependencies and start the Astro dev server for the playground.

package/dist/auth/manager.d.ts

@@ -23,7 +23,7 @@ export declare class TokenManager {
     /**
      * Ensure valid tokens (with automatic refresh)
      */
-    ensure(ctx: TokenKitContext, options?: AuthOptions, headers?: Record<string, string>): Promise<Session | null>;
+    ensure(ctx: TokenKitContext, options?: AuthOptions, headers?: Record<string, string>, force?: boolean): Promise<Session | null>;
     /**
      * Logout (clear tokens)
      */

package/dist/auth/manager.js

@@ -26,21 +26,18 @@ class SingleFlight {
             const existing = this.inFlight.get(key);
             if (existing)
                 return existing;
-            const promise = this.doExecute(key, fn);
+            const promise = (() => __awaiter(this, void 0, void 0, function* () {
+                try {
+                    return yield fn();
+                }
+                finally {
+                    this.inFlight.delete(key);
+                }
+            }))();
             this.inFlight.set(key, promise);
             return promise;
         });
     }
-    doExecute(key, fn) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                return yield fn();
-            }
-            finally {
-                this.inFlight.delete(key);
-            }
-        });
-    }
 }
 /**
  * Token Manager handles all token operations
@@ -56,6 +53,7 @@ export class TokenManager {
      */
     login(ctx, credentials, options) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const url = this.joinURL(this.baseURL, this.config.login);
             const contentType = this.config.contentType || 'application/json';
             const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), options === null || options === void 0 ? void 0 : options.headers);
@@ -67,12 +65,16 @@ export class TokenManager {
             else {
                 requestBody = JSON.stringify(data);
             }
+            const timeout = (_b = (_a = options === null || options === void 0 ? void 0 : options.timeout) !== null && _a !== void 0 ? _a : this.config.timeout) !== null && _b !== void 0 ? _b : 30000;
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), timeout);
             let response;
             try {
                 response = yield safeFetch(url, {
                     method: 'POST',
                     headers,
                     body: requestBody,
+                    signal: controller.signal,
                 }, this.config);
             }
             catch (error) {
@@ -81,6 +83,9 @@ export class TokenManager {
                     yield options.onError(authError, ctx);
                 throw authError;
             }
+            finally {
+                clearTimeout(timeoutId);
+            }
             if (!response.ok) {
                 const authError = new AuthError(`Login failed: ${response.status} ${response.statusText}`, response.status, response);
                 if (options === null || options === void 0 ? void 0 : options.onError)
@@ -136,6 +141,7 @@ export class TokenManager {
      */
     performRefresh(ctx, refreshToken, options, extraHeaders) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const url = this.joinURL(this.baseURL, this.config.refresh);
             const contentType = this.config.contentType || 'application/json';
             const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), extraHeaders);
@@ -148,17 +154,24 @@ export class TokenManager {
             else {
                 requestBody = JSON.stringify(data);
             }
+            const timeout = (_b = (_a = options === null || options === void 0 ? void 0 : options.timeout) !== null && _a !== void 0 ? _a : this.config.timeout) !== null && _b !== void 0 ? _b : 30000;
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), timeout);
             let response;
             try {
                 response = yield safeFetch(url, {
                     method: 'POST',
                     headers,
                     body: requestBody,
+                    signal: controller.signal,
                 }, this.config);
             }
             catch (error) {
                 throw new AuthError(`Refresh request failed: ${error.message}`, undefined, undefined, undefined, error);
             }
+            finally {
+                clearTimeout(timeoutId);
+            }
             if (!response.ok) {
                 // 401/403 = invalid refresh token
                 if (response.status === 401 || response.status === 403) {
@@ -190,8 +203,8 @@ export class TokenManager {
     /**
      * Ensure valid tokens (with automatic refresh)
      */
-    ensure(ctx, options, headers) {
-        return __awaiter(this, void 0, void 0, function* () {
+    ensure(ctx_1, options_1, headers_1) {
+        return __awaiter(this, arguments, void 0, function* (ctx, options, headers, force = false) {
             var _a, _b, _c, _d, _e, _f;
             const now = Math.floor(Date.now() / 1000);
             const tokens = retrieveTokens(ctx, this.config.cookies);
@@ -199,12 +212,14 @@ export class TokenManager {
             if (!tokens.accessToken || !tokens.refreshToken || !tokens.expiresAt) {
                 return null;
             }
-            // Token expired
-            if (isExpired(tokens.expiresAt, now, this.config.policy)) {
+            // Token expired or force refresh
+            if (force || isExpired(tokens.expiresAt, now, this.config.policy)) {
                 const flightKey = this.createFlightKey(tokens.refreshToken);
                 const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
                 if (!bundle)
                     return null;
+                // Ensure tokens are stored in the current context (in case of shared flight)
+                storeTokens(ctx, bundle, this.config.cookies);
                 return {
                     accessToken: bundle.accessToken,
                     expiresAt: bundle.accessExpiresAt,
@@ -217,6 +232,8 @@ export class TokenManager {
                 const flightKey = this.createFlightKey(tokens.refreshToken);
                 const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
                 if (bundle) {
+                    // Ensure tokens are stored in the current context (in case of shared flight)
+                    storeTokens(ctx, bundle, this.config.cookies);
                     return {
                         accessToken: bundle.accessToken,
                         expiresAt: bundle.accessExpiresAt,
@@ -244,23 +261,33 @@ export class TokenManager {
      */
     logout(ctx) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
+            var _a, _b;
             // Optionally call logout endpoint
             if (this.config.logout) {
+                const timeout = (_a = this.config.timeout) !== null && _a !== void 0 ? _a : 10000;
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), timeout);
                 try {
                     const url = this.joinURL(this.baseURL, this.config.logout);
                     const session = this.getSession(ctx);
                     const headers = {};
                     if (session === null || session === void 0 ? void 0 : session.accessToken) {
-                        const injectFn = (_a = this.config.injectToken) !== null && _a !== void 0 ? _a : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
+                        const injectFn = (_b = this.config.injectToken) !== null && _b !== void 0 ? _b : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
                         headers['Authorization'] = injectFn(session.accessToken, session.tokenType);
                     }
-                    yield safeFetch(url, { method: 'POST', headers }, this.config);
+                    yield safeFetch(url, {
+                        method: 'POST',
+                        headers,
+                        signal: controller.signal,
+                    }, this.config);
                 }
                 catch (error) {
                     // Ignore logout endpoint errors
                     logger.debug('[TokenKit] Logout endpoint failed:', error);
                 }
+                finally {
+                    clearTimeout(timeoutId);
+                }
             }
             clearTokens(ctx, this.config.cookies);
         });

package/dist/client/client.js

@@ -143,6 +143,7 @@ export class APIClient {
     executeRequest(config, ctx, attempt) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b, _c, _d, _e;
+            const method = config.method.toUpperCase();
             // Ensure valid session (if auth is enabled)
             if (this.tokenManager && !config.skipAuth) {
                 yield this.tokenManager.ensure(ctx, config.auth, config.headers);
@@ -153,13 +154,18 @@ export class APIClient {
             const headers = this.buildHeaders(config, ctx, fullURL);
             // Build request init
             const init = {
-                method: config.method,
+                method,
                 headers,
                 signal: config.signal,
             };
-            // Add body for non-GET requests
-            if (config.data && config.method !== 'GET') {
+            // Add body for appropriate methods
+            const methodsWithNoBody = ['GET', 'HEAD', 'DELETE'];
+            if (config.data && !methodsWithNoBody.includes(method)) {
                 init.body = JSON.stringify(config.data);
+                // Add Content-Type if not already present
+                if (!headers['Content-Type'] && !headers['content-type']) {
+                    headers['Content-Type'] = 'application/json';
+                }
             }
             // Apply request interceptors
             let requestConfig = Object.assign({}, config);
@@ -177,8 +183,8 @@ export class APIClient {
                 clearTimeout(timeoutId);
                 // Handle 401 (try refresh and retry once)
                 if (response.status === 401 && this.tokenManager && !config.skipAuth && attempt === 1) {
-                    // Clear and try fresh session
-                    const session = yield this.tokenManager.ensure(ctx, config.auth, config.headers);
+                    // Clear and try fresh session (force refresh)
+                    const session = yield this.tokenManager.ensure(ctx, config.auth, config.headers, true);
                     if (session) {
                         // Retry with new token
                         return this.executeRequest(config, ctx, attempt + 1);
@@ -271,7 +277,7 @@ export class APIClient {
      */
     buildHeaders(config, ctx, targetURL) {
         var _a, _b;
-        const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json' }, this.config.headers), config.headers);
+        const headers = Object.assign(Object.assign({}, this.config.headers), config.headers);
         // Add auth token if available (only for safe URLs)
         if (this.tokenManager && !config.skipAuth && this.isSafeURL(targetURL)) {
             const session = this.tokenManager.getSession(ctx);

package/dist/index.cjs

@@ -400,6 +400,7 @@ function isExpired(expiresAt, now, policy = {}) {
 }
 
 // packages/astro-tokenkit/src/utils/fetch.ts
+let sharedInsecureAgent = null;
 /**
  * Perform a fetch request with optional certificate validation bypass
  */
@@ -408,16 +409,26 @@ function safeFetch(url, init, config) {
         const fetchFn = config.fetch || fetch;
         const fetchOptions = Object.assign({}, init);
         if (config.dangerouslyIgnoreCertificateErrors && typeof process !== 'undefined') {
-            // In Node.js environment
             try {
-                // Try to use undici Agent if available (it is built-in in Node 18+)
-                // However, we might need to import it if we want to create an Agent.
-                // Since we don't want to depend on undici in package.json, we use dynamic import.
-                // But wait, undici's Agent is what we need.
-                // As a fallback and most reliable way for self-signed certs in Node without extra deps:
-                process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
-                // NOTE: This affects the whole process. We should ideally only do this if it's not already 0.
-                // But for a dev tool / specialized library, it's often what's needed.
+                // Try to use undici Agent if available to avoid global process.env changes
+                if (!sharedInsecureAgent) {
+                    // @ts-ignore
+                    const undici = yield import('undici').catch(() => null);
+                    if (undici && undici.Agent) {
+                        sharedInsecureAgent = new undici.Agent({
+                            connect: { rejectUnauthorized: false }
+                        });
+                    }
+                }
+                if (sharedInsecureAgent) {
+                    fetchOptions.dispatcher = sharedInsecureAgent;
+                }
+                else {
+                    // Fallback to global setting (less secure, but only way without undici)
+                    if (process.env.NODE_TLS_REJECT_UNAUTHORIZED !== '0') {
+                        process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+                    }
+                }
             }
             catch (e) {
                 // Ignore
@@ -528,21 +539,18 @@ class SingleFlight {
             const existing = this.inFlight.get(key);
             if (existing)
                 return existing;
-            const promise = this.doExecute(key, fn);
+            const promise = (() => __awaiter(this, void 0, void 0, function* () {
+                try {
+                    return yield fn();
+                }
+                finally {
+                    this.inFlight.delete(key);
+                }
+            }))();
             this.inFlight.set(key, promise);
             return promise;
         });
     }
-    doExecute(key, fn) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                return yield fn();
-            }
-            finally {
-                this.inFlight.delete(key);
-            }
-        });
-    }
 }
 /**
  * Token Manager handles all token operations
@@ -558,6 +566,7 @@ class TokenManager {
      */
     login(ctx, credentials, options) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const url = this.joinURL(this.baseURL, this.config.login);
             const contentType = this.config.contentType || 'application/json';
             const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), options === null || options === void 0 ? void 0 : options.headers);
@@ -569,12 +578,16 @@ class TokenManager {
             else {
                 requestBody = JSON.stringify(data);
             }
+            const timeout = (_b = (_a = options === null || options === void 0 ? void 0 : options.timeout) !== null && _a !== void 0 ? _a : this.config.timeout) !== null && _b !== void 0 ? _b : 30000;
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), timeout);
             let response;
             try {
                 response = yield safeFetch(url, {
                     method: 'POST',
                     headers,
                     body: requestBody,
+                    signal: controller.signal,
                 }, this.config);
             }
             catch (error) {
@@ -583,6 +596,9 @@ class TokenManager {
                     yield options.onError(authError, ctx);
                 throw authError;
             }
+            finally {
+                clearTimeout(timeoutId);
+            }
             if (!response.ok) {
                 const authError = new AuthError(`Login failed: ${response.status} ${response.statusText}`, response.status, response);
                 if (options === null || options === void 0 ? void 0 : options.onError)
@@ -638,6 +654,7 @@ class TokenManager {
      */
     performRefresh(ctx, refreshToken, options, extraHeaders) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const url = this.joinURL(this.baseURL, this.config.refresh);
             const contentType = this.config.contentType || 'application/json';
             const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), extraHeaders);
@@ -650,17 +667,24 @@ class TokenManager {
             else {
                 requestBody = JSON.stringify(data);
             }
+            const timeout = (_b = (_a = options === null || options === void 0 ? void 0 : options.timeout) !== null && _a !== void 0 ? _a : this.config.timeout) !== null && _b !== void 0 ? _b : 30000;
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), timeout);
             let response;
             try {
                 response = yield safeFetch(url, {
                     method: 'POST',
                     headers,
                     body: requestBody,
+                    signal: controller.signal,
                 }, this.config);
             }
             catch (error) {
                 throw new AuthError(`Refresh request failed: ${error.message}`, undefined, undefined, undefined, error);
             }
+            finally {
+                clearTimeout(timeoutId);
+            }
             if (!response.ok) {
                 // 401/403 = invalid refresh token
                 if (response.status === 401 || response.status === 403) {
@@ -692,8 +716,8 @@ class TokenManager {
     /**
      * Ensure valid tokens (with automatic refresh)
      */
-    ensure(ctx, options, headers) {
-        return __awaiter(this, void 0, void 0, function* () {
+    ensure(ctx_1, options_1, headers_1) {
+        return __awaiter(this, arguments, void 0, function* (ctx, options, headers, force = false) {
             var _a, _b, _c, _d, _e, _f;
             const now = Math.floor(Date.now() / 1000);
             const tokens = retrieveTokens(ctx, this.config.cookies);
@@ -701,12 +725,14 @@ class TokenManager {
             if (!tokens.accessToken || !tokens.refreshToken || !tokens.expiresAt) {
                 return null;
             }
-            // Token expired
-            if (isExpired(tokens.expiresAt, now, this.config.policy)) {
+            // Token expired or force refresh
+            if (force || isExpired(tokens.expiresAt, now, this.config.policy)) {
                 const flightKey = this.createFlightKey(tokens.refreshToken);
                 const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
                 if (!bundle)
                     return null;
+                // Ensure tokens are stored in the current context (in case of shared flight)
+                storeTokens(ctx, bundle, this.config.cookies);
                 return {
                     accessToken: bundle.accessToken,
                     expiresAt: bundle.accessExpiresAt,
@@ -719,6 +745,8 @@ class TokenManager {
                 const flightKey = this.createFlightKey(tokens.refreshToken);
                 const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
                 if (bundle) {
+                    // Ensure tokens are stored in the current context (in case of shared flight)
+                    storeTokens(ctx, bundle, this.config.cookies);
                     return {
                         accessToken: bundle.accessToken,
                         expiresAt: bundle.accessExpiresAt,
@@ -746,23 +774,33 @@ class TokenManager {
      */
     logout(ctx) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
+            var _a, _b;
             // Optionally call logout endpoint
             if (this.config.logout) {
+                const timeout = (_a = this.config.timeout) !== null && _a !== void 0 ? _a : 10000;
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), timeout);
                 try {
                     const url = this.joinURL(this.baseURL, this.config.logout);
                     const session = this.getSession(ctx);
                     const headers = {};
                     if (session === null || session === void 0 ? void 0 : session.accessToken) {
-                        const injectFn = (_a = this.config.injectToken) !== null && _a !== void 0 ? _a : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
+                        const injectFn = (_b = this.config.injectToken) !== null && _b !== void 0 ? _b : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
                         headers['Authorization'] = injectFn(session.accessToken, session.tokenType);
                     }
-                    yield safeFetch(url, { method: 'POST', headers }, this.config);
+                    yield safeFetch(url, {
+                        method: 'POST',
+                        headers,
+                        signal: controller.signal,
+                    }, this.config);
                 }
                 catch (error) {
                     // Ignore logout endpoint errors
                     logger.debug('[TokenKit] Logout endpoint failed:', error);
                 }
+                finally {
+                    clearTimeout(timeoutId);
+                }
             }
             clearTokens(ctx, this.config.cookies);
         });
@@ -1065,6 +1103,7 @@ class APIClient {
     executeRequest(config, ctx, attempt) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b, _c, _d, _e;
+            const method = config.method.toUpperCase();
             // Ensure valid session (if auth is enabled)
             if (this.tokenManager && !config.skipAuth) {
                 yield this.tokenManager.ensure(ctx, config.auth, config.headers);
@@ -1075,13 +1114,18 @@ class APIClient {
             const headers = this.buildHeaders(config, ctx, fullURL);
             // Build request init
             const init = {
-                method: config.method,
+                method,
                 headers,
                 signal: config.signal,
             };
-            // Add body for non-GET requests
-            if (config.data && config.method !== 'GET') {
+            // Add body for appropriate methods
+            const methodsWithNoBody = ['GET', 'HEAD', 'DELETE'];
+            if (config.data && !methodsWithNoBody.includes(method)) {
                 init.body = JSON.stringify(config.data);
+                // Add Content-Type if not already present
+                if (!headers['Content-Type'] && !headers['content-type']) {
+                    headers['Content-Type'] = 'application/json';
+                }
             }
             // Apply request interceptors
             let requestConfig = Object.assign({}, config);
@@ -1099,8 +1143,8 @@ class APIClient {
                 clearTimeout(timeoutId);
                 // Handle 401 (try refresh and retry once)
                 if (response.status === 401 && this.tokenManager && !config.skipAuth && attempt === 1) {
-                    // Clear and try fresh session
-                    const session = yield this.tokenManager.ensure(ctx, config.auth, config.headers);
+                    // Clear and try fresh session (force refresh)
+                    const session = yield this.tokenManager.ensure(ctx, config.auth, config.headers, true);
                     if (session) {
                         // Retry with new token
                         return this.executeRequest(config, ctx, attempt + 1);
@@ -1193,7 +1237,7 @@ class APIClient {
      */
     buildHeaders(config, ctx, targetURL) {
         var _a, _b;
-        const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json' }, this.config.headers), config.headers);
+        const headers = Object.assign(Object.assign({}, this.config.headers), config.headers);
         // Add auth token if available (only for safe URLs)
         if (this.tokenManager && !config.skipAuth && this.isSafeURL(targetURL)) {
             const session = this.tokenManager.getSession(ctx);