attlaz-client 1.48.1 → 1.48.2

package/dist/Helper/LoadAllHelper.js

@@ -9,9 +9,14 @@ export class LoadAllHelper {
             firstPagination.limit = limit;
             firstPagination.startingAfter = lastRef;
             const data = await call(firstPagination);
-            for (const record of data.getData()) {
-                totalResult.push(record);
-                lastRef = record.id.toString();
+            const records = data.getData();
+            // Spread is faster than a per-element loop but can exceed the call stack for very large collections (50k+)
+            if (totalResult.length + records.length > 50_000) {
+                throw new Error('loadAll exceeded 50,000 records (' + (totalResult.length + records.length) + '). This method is not intended for large datasets.');
+            }
+            totalResult.push(...records);
+            if (records.length > 0) {
+                lastRef = records[records.length - 1].id.toString();
             }
             hasMore = data.hasMore;
         }

package/dist/Http/Transport/DirectTransport.d.ts

@@ -8,13 +8,18 @@ export interface DirectTransportRoute {
  * Transport for internal service-to-service calls that bypasses Gateway OAuth.
  * Authenticates via HMAC-signed session headers instead of an OAuth token.
  *
+ * The caller is responsible for computing the HMAC signature (since this requires
+ * node:crypto which is not available in browser environments).
+ *
  * Usage:
- *   const transport = new DirectTransport('http://core-api:5728', process.env.api_secret);
+ *   import {createHmac} from 'node:crypto';
+ *   const sessionPayload = DirectTransport.createSessionPayload();
+ *   const sessionSignature = createHmac('sha256', apiSecret).update(sessionPayload).digest('hex');
+ *   const transport = new DirectTransport('http://core-api:5728', sessionPayload, sessionSignature);
  *   const client = Client.withTransport(transport);
- *   client.getFlowEndpoint().getById(id);
  *
  * With multiple backends:
- *   const transport = new DirectTransport('http://core-api:5728', secret, [
+ *   const transport = new DirectTransport('http://core-api:5728', sessionPayload, sessionSignature, [
  *     { prefix: '/products', baseUrl: 'http://products-api:5730' },
  *     { prefix: '/services', baseUrl: 'http://services-api:5731' },
  *   ]);
@@ -22,7 +27,11 @@ export interface DirectTransportRoute {
 export declare class DirectTransport implements ITransport {
     private readonly clients;
     private readonly sortedRoutes;
-    constructor(defaultBaseUrl: string, apiSecret: string, routes?: DirectTransportRoute[]);
+    /**
+     * Creates the default session payload for internal service-to-service calls.
+     */
+    static createSessionPayload(): string;
+    constructor(defaultBaseUrl: string, sessionPayload: string, sessionSignature: string, routes?: DirectTransportRoute[]);
     request<T>(action: string, parameters?: Parameters, method?: string, _signWithOauthToken?: boolean): Promise<T>;
     private resolveClient;
     isDebugEnabled(): boolean;

package/dist/Http/Transport/DirectTransport.js

@@ -1,17 +1,21 @@
-import { createHmac } from 'node:crypto';
 import { OAuthClientOptions } from '../OAuthClientOptions.js';
 import { OAuthClient } from './OAuthClient.js';
 /**
  * Transport for internal service-to-service calls that bypasses Gateway OAuth.
  * Authenticates via HMAC-signed session headers instead of an OAuth token.
  *
+ * The caller is responsible for computing the HMAC signature (since this requires
+ * node:crypto which is not available in browser environments).
+ *
  * Usage:
- *   const transport = new DirectTransport('http://core-api:5728', process.env.api_secret);
+ *   import {createHmac} from 'node:crypto';
+ *   const sessionPayload = DirectTransport.createSessionPayload();
+ *   const sessionSignature = createHmac('sha256', apiSecret).update(sessionPayload).digest('hex');
+ *   const transport = new DirectTransport('http://core-api:5728', sessionPayload, sessionSignature);
  *   const client = Client.withTransport(transport);
- *   client.getFlowEndpoint().getById(id);
  *
  * With multiple backends:
- *   const transport = new DirectTransport('http://core-api:5728', secret, [
+ *   const transport = new DirectTransport('http://core-api:5728', sessionPayload, sessionSignature, [
  *     { prefix: '/products', baseUrl: 'http://products-api:5730' },
  *     { prefix: '/services', baseUrl: 'http://services-api:5731' },
  *   ]);
@@ -19,9 +23,11 @@ import { OAuthClient } from './OAuthClient.js';
 export class DirectTransport {
     clients = new Map();
     sortedRoutes;
-    constructor(defaultBaseUrl, apiSecret, routes = []) {
-        // TODO: do we need to define user, client and ip?
-        const sessionPayload = JSON.stringify({
+    /**
+     * Creates the default session payload for internal service-to-service calls.
+     */
+    static createSessionPayload() {
+        return JSON.stringify({
             api_version: 'latest',
             user: null,
             client: null,
@@ -30,7 +36,8 @@ export class DirectTransport {
             scopes: [],
             access_token: null,
         });
-        const sessionSignature = createHmac('sha256', apiSecret).update(sessionPayload).digest('hex');
+    }
+    constructor(defaultBaseUrl, sessionPayload, sessionSignature, routes = []) {
         // All routes plus the catch-all default, sorted by prefix length descending (most specific first)
         this.sortedRoutes = [...routes, { prefix: '', baseUrl: defaultBaseUrl }]
             .sort((a, b) => b.prefix.length - a.prefix.length);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "attlaz-client",
-  "version": "1.48.1",
+  "version": "1.48.2",
   "description": "Javascript Client to access Attlaz API",
   "types": "./dist/index.d.ts",
   "main": "./dist/index.js",