attlaz-client 1.74.0 → 1.75.0

package/dist/Client.d.ts

@@ -1,5 +1,5 @@
 import { OAuthClientToken } from './Http/OAuthClientToken.js';
-import { ITransport } from './Http/Transport/ITransport.js';
+import { ITransport, ParseErrorHandler } from './Http/Transport/ITransport.js';
 import { OAuthClient } from './Http/Transport/OAuthClient.js';
 import { AccessTokenEndpoint } from './Service/AccessTokenEndpoint.js';
 import { AdapterConnectionEndpoint } from './Service/AdapterConnectionEndpoint.js';
@@ -59,6 +59,13 @@ export declare class Client {
     setPublicClient(clientId: string): void;
     setVersion(version: string | null): void;
     getHttpClient(): OAuthClient;
+    /**
+     * Set a handler for non-fatal response parse failures (schema drift). Defaults to
+     * console.error; wire this to your logger / error tracker to observe drift in production
+     * without breaking views. Pass null to restore the default. Set on the active transport,
+     * so it applies whether the client uses OAuth or a custom transport.
+     */
+    setParseErrorHandler(handler: ParseErrorHandler | null): void;
     authenticate(): Promise<boolean>;
     authenticate(username: string, password: string): Promise<boolean>;
     isAuthenticated(): boolean;

package/dist/Client.js

@@ -122,6 +122,15 @@ export class Client {
     getHttpClient() {
         return this.httpClient;
     }
+    /**
+     * Set a handler for non-fatal response parse failures (schema drift). Defaults to
+     * console.error; wire this to your logger / error tracker to observe drift in production
+     * without breaking views. Pass null to restore the default. Set on the active transport,
+     * so it applies whether the client uses OAuth or a custom transport.
+     */
+    setParseErrorHandler(handler) {
+        this.transport.setParseErrorHandler(handler);
+    }
     async authenticate(username = null, password = null) {
         if (username === null || password === null) {
             return await this.httpClient.authenticate();

package/dist/Http/ClientError.js

@@ -10,53 +10,16 @@ export class ClientError extends Error {
     }
     static fromError(error) {
         // Already a ClientError (or a subclass such as ApiError) — preserve it as-is.
-        // Re-deriving here would discard its httpStatus, because this method inspects the
-        // `.status`/`.code` shape of raw transport errors, not ClientError's own fields.
         if (error instanceof ClientError) {
             return error;
         }
-        let clientError = new ClientError('Unknown error', HttpStatus.HTTP_INTERNAL_SERVER_ERROR);
-        const xError = error;
-        if (xError.status !== null && xError.status !== undefined) {
-            const statusCode = xError.status;
-            const { body } = xError;
-            const clientErrorByStatus = this.byStatus(statusCode, body);
-            if (clientErrorByStatus !== null) {
-                clientError = clientErrorByStatus;
-            }
-        }
-        else if (xError.code !== null && xError.code !== undefined) {
-            switch (xError.code) {
-                case 'EUNAVAILABLE':
-                case 'ECONNREFUSED':
-                case 'HTTP_UNAVAILABLE':
-                    clientError.httpStatus = HttpStatus.HTTP_UNAVAILABLE;
-                    break;
-                case 'EAUTH':
-                case 401:
-                    clientError.httpStatus = HttpStatus.HTTP_UNAUTHORIZED;
-                    break;
-                case 'ESTATUS':
-                    if (error.message === 'HTTP status 503') {
-                        clientError.httpStatus = HttpStatus.HTTP_UNAVAILABLE;
-                    }
-                    break;
-                case 500:
-                    clientError.httpStatus = HttpStatus.HTTP_INTERNAL_SERVER_ERROR;
-                    break;
-                default:
-                    console.warn('[Client error] Error code `' + xError.code + '` not recognised');
-                    clientError.httpStatus = HttpStatus.HTTP_INTERNAL_SERVER_ERROR;
-            }
-        }
-        else if (error instanceof TypeError) {
-            // fetch throws TypeError on network failures (ECONNREFUSED, DNS, etc.)
-            clientError.httpStatus = HttpStatus.HTTP_UNAVAILABLE;
-            clientError.message = 'Service not available';
-            return clientError;
-        }
+        // The transport uses fetch, which throws TypeError on network failures (DNS, refused
+        // connection, TLS, etc.). Anything else reaching here is unexpected — surface it as a
+        // generic 500 while keeping the original name/stack for debugging.
+        const clientError = error instanceof TypeError
+            ? new ClientError('Service not available', HttpStatus.HTTP_UNAVAILABLE)
+            : new ClientError('Unknown error', HttpStatus.HTTP_INTERNAL_SERVER_ERROR);
         clientError.name = error.name;
-        // TODO: only in debug mode
         clientError.stack = error.stack;
         return clientError;
     }

package/dist/Http/HttpClientResponse.d.ts

@@ -5,6 +5,4 @@ export declare class HttpClientResponse {
     body: any | null;
     headers: Headers;
     constructor(status: number, statusText: string);
-    getContentType(): string | null;
-    isJson(): boolean;
 }

package/dist/Http/HttpClientResponse.js

@@ -1,4 +1,3 @@
-import { ContentTypeHelper } from './ContentTypeHelper.js';
 export class HttpClientResponse {
     status;
     statusText;
@@ -8,22 +7,4 @@ export class HttpClientResponse {
         this.status = status;
         this.statusText = statusText;
     }
-    getContentType() {
-        // TODO: content-type or Content-Type or both...?
-        let contentType = this.headers['content-type'];
-        if (contentType === null || contentType === undefined) {
-            return null;
-        }
-        if (Array.isArray(contentType)) {
-            [contentType] = contentType;
-        }
-        if (contentType === null || contentType === undefined) {
-            return null;
-        }
-        const parsedContentType = ContentTypeHelper.formatContentType(contentType);
-        return parsedContentType.type;
-    }
-    isJson() {
-        return this.getContentType() === 'application/json';
-    }
 }

package/dist/Http/Transport/DirectTransport.d.ts

@@ -1,5 +1,5 @@
 import { Parameters } from '../Data/Parameters.js';
-import { ITransport } from './ITransport.js';
+import { ITransport, ParseErrorHandler } from './ITransport.js';
 export interface DirectTransportRoute {
     prefix: string;
     baseUrl: string;
@@ -27,6 +27,7 @@ export interface DirectTransportRoute {
 export declare class DirectTransport implements ITransport {
     private readonly clients;
     private readonly sortedRoutes;
+    private parseErrorHandler;
     /**
      * Creates the default session payload for internal service-to-service calls.
      */
@@ -35,4 +36,6 @@ export declare class DirectTransport implements ITransport {
     request<T>(action: string, parameters?: Parameters, method?: string, _signWithOauthToken?: boolean): Promise<T>;
     private resolveClient;
     isDebugEnabled(): boolean;
+    setParseErrorHandler(handler: ParseErrorHandler | null): void;
+    reportParseError(message: string, context: Record<string, unknown>): void;
 }

package/dist/Http/Transport/DirectTransport.js

@@ -23,6 +23,7 @@ import { OAuthClient } from './OAuthClient.js';
 export class DirectTransport {
     clients = new Map();
     sortedRoutes;
+    parseErrorHandler = null;
     /**
      * Creates the default session payload for internal service-to-service calls.
      */
@@ -69,4 +70,14 @@ export class DirectTransport {
     isDebugEnabled() {
         return false;
     }
+    setParseErrorHandler(handler) {
+        this.parseErrorHandler = handler;
+    }
+    reportParseError(message, context) {
+        if (this.parseErrorHandler !== null) {
+            this.parseErrorHandler(message, context);
+            return;
+        }
+        console.error(message, context);
+    }
 }

package/dist/Http/Transport/ITransport.d.ts

@@ -1,5 +1,13 @@
 import { Parameters } from '../Data/Parameters.js';
+/**
+ * Invoked when an endpoint fails to parse a response object (schema drift). Reporting is
+ * non-fatal — parsing still degrades gracefully. Defaults to console.error; set a custom handler
+ * (e.g. via Client.setParseErrorHandler) to route these to a logger / error tracker.
+ */
+export type ParseErrorHandler = (message: string, context: Record<string, unknown>) => void;
 export interface ITransport {
     request: <T>(action: string, parameters: Parameters, method: string, signWithOauthToken: boolean) => Promise<T>;
     isDebugEnabled: () => boolean;
+    reportParseError: (message: string, context: Record<string, unknown>) => void;
+    setParseErrorHandler: (handler: ParseErrorHandler | null) => void;
 }

package/dist/Http/Transport/OAuthClient.d.ts

@@ -2,25 +2,26 @@ import { Headers } from '../Data/Headers.js';
 import { Parameters } from '../Data/Parameters.js';
 import { OAuthClientOptions } from '../OAuthClientOptions.js';
 import { OAuthClientToken } from '../OAuthClientToken.js';
-import { ITransport } from './ITransport.js';
+import { ITransport, ParseErrorHandler } from './ITransport.js';
 export declare class OAuthClient implements ITransport {
     private readonly options;
     private debug;
     private oauthClientToken;
     private refreshTokenPromise;
     private version;
+    private parseErrorHandler;
     constructor(options: OAuthClientOptions);
     authenticate(username: string, password: string): Promise<boolean>;
     authenticate(): Promise<boolean>;
     refreshToken(): Promise<void>;
     private isPublicClient;
     /**
-     * Direct token request for public clients that must not send client_secret.
-     * The axios-oauth-client library always includes client_secret in the body,
-     * so public clients use this method instead.
+     * Performs an OAuth token request (password, client_credentials or refresh_token grant) and
+     * returns the raw token response. On a non-ok response it throws a ClientError carrying the
+     * server's HTTP status and, when the body is JSON, its structured error message.
      */
     private requestToken;
-    isTokenExpires(): boolean;
+    isTokenExpired(): boolean;
     request<T>(action: string, parameters?: Parameters, method?: string, signWithOauthToken?: boolean): Promise<T>;
     isAuthenticated(): boolean;
     getToken(): OAuthClientToken | null;
@@ -29,6 +30,8 @@ export declare class OAuthClient implements ITransport {
     enableDebug(): void;
     disableDebug(): void;
     isDebugEnabled(): boolean;
+    setParseErrorHandler(handler: ParseErrorHandler | null): void;
+    reportParseError(message: string, context: Record<string, unknown>): void;
     private defaultHeaders;
     getDefaultHeaders(): Headers;
     private initDefaultHeaders;

package/dist/Http/Transport/OAuthClient.js

@@ -11,6 +11,7 @@ export class OAuthClient {
     oauthClientToken = null;
     refreshTokenPromise = null;
     version = null;
+    parseErrorHandler = null;
     constructor(options) {
         this.options = options;
         this.initDefaultHeaders();
@@ -96,9 +97,9 @@ export class OAuthClient {
         return this.options.clientSecret === null || this.options.clientSecret === '';
     }
     /**
-     * Direct token request for public clients that must not send client_secret.
-     * The axios-oauth-client library always includes client_secret in the body,
-     * so public clients use this method instead.
+     * Performs an OAuth token request (password, client_credentials or refresh_token grant) and
+     * returns the raw token response. On a non-ok response it throws a ClientError carrying the
+     * server's HTTP status and, when the body is JSON, its structured error message.
      */
     async requestToken(params) {
         const response = await fetch(this.getApiEndpointUrl(this.options.accessTokenUri), {
@@ -107,64 +108,83 @@ export class OAuthClient {
             body: new URLSearchParams(params).toString(),
         });
         if (!response.ok) {
-            throw new ClientError(response.statusText || 'Token request failed', response.status);
+            const clientError = new ClientError(response.statusText || 'Token request failed', response.status);
+            // The token endpoint bypasses HttpClient (and authenticate() bypasses Endpoint.toApiError),
+            // so without this the server's body is discarded and callers only see the generic HTTP
+            // statusText. Attach the body and surface its structured OAuth error message directly so a
+            // failed login shows e.g. an invalid-credentials reason. Mirrors HttpClient.request() +
+            // Endpoint.toApiError(). The refresh path replaces this message with a 401, so it's unaffected.
+            try {
+                const data = await response.json();
+                clientError.response = {
+                    status: response.status,
+                    statusText: response.statusText,
+                    data,
+                };
+                const apiMessage = data?.error?.message;
+                if (apiMessage !== undefined && apiMessage !== null && apiMessage !== '') {
+                    clientError.message = apiMessage;
+                }
+            }
+            catch {
+                // Response body is not JSON — leave response/message as-is
+            }
+            throw clientError;
         }
         return response.json();
     }
-    isTokenExpires() {
+    isTokenExpired() {
         if (this.oauthClientToken === null) {
             throw new Error('No token defined');
         }
         return OAuthClientToken.isExpired(this.oauthClientToken);
     }
     async request(action, parameters = null, method = 'GET', signWithOauthToken = true) {
-        if (signWithOauthToken && !this.isAuthenticated()) {
-            throw new ClientError('Unable to perform request, access token not provided');
-        }
-        else {
-            if (signWithOauthToken) {
-                if (this.oauthClientToken === null) {
-                    throw new ClientError('Unable to perform request, access token not provided');
-                }
-                if (signWithOauthToken && OAuthClientToken.isExpired(this.oauthClientToken)) {
-                    if (this.refreshTokenPromise === null) {
-                        this.refreshTokenPromise = this.refreshToken();
-                        try {
-                            await this.refreshTokenPromise;
-                        }
-                        finally {
-                            // Always clear, even on failure, so a single failed refresh
-                            // doesn't poison every later request with the same rejected
-                            // promise (e.g. after the user re-authenticates).
-                            this.refreshTokenPromise = null;
-                        }
-                    }
-                    else {
+        if (signWithOauthToken) {
+            // A single null check both guards and narrows the token type. No access token at
+            // all is an auth failure (401), so consumers route it to the same sign-out path as
+            // a rejected refresh.
+            if (this.oauthClientToken === null) {
+                throw new ClientError('Unable to perform request, access token not provided', HttpStatus.HTTP_UNAUTHORIZED);
+            }
+            if (OAuthClientToken.isExpired(this.oauthClientToken)) {
+                if (this.refreshTokenPromise === null) {
+                    this.refreshTokenPromise = this.refreshToken();
+                    try {
                         await this.refreshTokenPromise;
                     }
-                }
-            }
-            const requestData = this.createRequestData(action, parameters, method, signWithOauthToken);
-            if (this.debug) {
-                console.debug('[OAuthClient] Request: ' + requestData.method.toUpperCase() + ' ' + requestData.getFullUrl(), { headers: requestData.headers });
-            }
-            try {
-                const response = await HttpClient.request(requestData);
-                return response.body;
-            }
-            catch (error) {
-                if (!(error instanceof ClientError)) {
-                    const clientError = ClientError.fromError(error);
-                    if (this.debug) {
-                        console.error('[Client] Error:', { error, clientError });
+                    finally {
+                        // Always clear, even on failure, so a single failed refresh doesn't
+                        // poison every later request with the same rejected promise (e.g.
+                        // after the user re-authenticates).
+                        this.refreshTokenPromise = null;
                     }
-                    throw clientError;
                 }
+                else {
+                    await this.refreshTokenPromise;
+                }
+            }
+        }
+        const requestData = this.createRequestData(action, parameters, method, signWithOauthToken);
+        if (this.debug) {
+            console.debug('[OAuthClient] Request: ' + requestData.method.toUpperCase() + ' ' + requestData.getFullUrl(), { headers: requestData.headers });
+        }
+        try {
+            const response = await HttpClient.request(requestData);
+            return response.body;
+        }
+        catch (error) {
+            if (!(error instanceof ClientError)) {
+                const clientError = ClientError.fromError(error);
                 if (this.debug) {
-                    console.error('[Client] Error:', { error });
+                    console.error('[Client] Error:', { error, clientError });
                 }
-                throw error;
+                throw clientError;
             }
+            if (this.debug) {
+                console.error('[Client] Error:', { error });
+            }
+            throw error;
         }
     }
     isAuthenticated() {
@@ -189,6 +209,16 @@ export class OAuthClient {
     isDebugEnabled() {
         return this.debug;
     }
+    setParseErrorHandler(handler) {
+        this.parseErrorHandler = handler;
+    }
+    reportParseError(message, context) {
+        if (this.parseErrorHandler !== null) {
+            this.parseErrorHandler(message, context);
+            return;
+        }
+        console.error(message, context);
+    }
     defaultHeaders = {};
     getDefaultHeaders() {
         return this.defaultHeaders;
@@ -262,22 +292,18 @@ export class OAuthClient {
             });
         }
         if (signWithOauthToken) {
+            // request() already ensured a present, non-expired token; this guard only narrows
+            // the type before signing.
             if (this.oauthClientToken === null) {
-                throw new ClientError('Unable to perform request, access token not provided');
+                throw new ClientError('Unable to perform request, access token not provided', HttpStatus.HTTP_UNAUTHORIZED);
             }
-            if (OAuthClientToken.isExpired(this.oauthClientToken)) {
-                throw new Error('Unable to sign request, token is expired');
-            }
-            requestData = this.signRequest(requestData);
+            requestData = this.signRequest(requestData, this.oauthClientToken);
         }
         return requestData;
     }
-    signRequest(requestObject) {
-        if (this.oauthClientToken === null) {
-            throw new ClientError('Unable to sign request, access token not provided');
-        }
-        const tokenType = this.oauthClientToken.token_type;
-        const accessToken = this.oauthClientToken.access_token;
+    signRequest(requestObject, token) {
+        const tokenType = token.token_type;
+        const accessToken = token.access_token;
         if (tokenType !== undefined && tokenType.toLowerCase() === 'bearer') {
             requestObject.setHeader('Authorization', 'Bearer ' + accessToken);
         }

package/dist/Service/Endpoint.js

@@ -17,10 +17,6 @@ export class Endpoint {
         if (data === null || data === undefined) {
             return null;
         }
-        if (typeof data === 'object' && '_formatted' in data) {
-            // TODO: unset _formatted
-            return data;
-        }
         if (Array.isArray(data)) {
             const result = [];
             for (const value of data) {
@@ -118,14 +114,9 @@ export class Endpoint {
         /**
          * Parse errors
          */
-        // TODO: temporary check until we know the API is fully upgraded
         if (requestResponse === null || requestResponse === undefined) {
             throw new ApiError('Unable to parse object: response is empty for action `[' + method + '] ' + action + '`', HttpStatus.HTTP_INTERNAL_SERVER_ERROR);
         }
-        if ((Object.prototype.hasOwnProperty.call(requestResponse, 'data') && !Object.prototype.hasOwnProperty.call(requestResponse, 'id')) && requestResponse.data !== undefined) {
-            console.error('Response for object "' + action + '" seem to still use old "data" property (this property is only used for collection requests)', { requestResponse });
-            requestResponse = requestResponse.data;
-        }
         result.setData(this.parseObject(requestResponse, parser));
         return result;
     }
@@ -170,13 +161,24 @@ export class Endpoint {
         return data;
     }
     parseObject(rawObject, parser) {
-        // TODO: is it interesting to keep this wrapper, or only in develop mode?
-        const wrappedData = ObjectWrapper.wrap(rawObject);
+        // Parse the raw object directly by default. With debug enabled the object is wrapped so
+        // that reads of properties the response doesn't contain get reported — useful for spotting
+        // schema drift, but too noisy (and a per-object Proxy cost) to run normally.
+        // Enable via client.getHttpClient().enableDebug().
+        const data = this.httpClient.isDebugEnabled() ? ObjectWrapper.wrap(rawObject) : rawObject;
         try {
-            return parser(wrappedData);
+            return parser(data);
         }
         catch (error) {
-            console.error('Unable to parse object', { object: rawObject, error });
+            // Report through the transport's parse-error handler (defaults to console.error;
+            // consumers can route it to a logger / error tracker via Client.setParseErrorHandler).
+            this.httpClient.reportParseError('Unable to parse object', { object: rawObject, error });
+            // In debug, surface schema drift loudly (dev/tests) by rethrowing. In production,
+            // degrade gracefully — return null so the caller skips the row / shows a not-found
+            // state, and a single unparseable object never breaks an entire view.
+            if (this.httpClient.isDebugEnabled()) {
+                throw error;
+            }
         }
         return null;
     }

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export { OAuthClientOptions } from './Http/OAuthClientOptions.js';
 export { OAuthClientToken } from './Http/OAuthClientToken.js';
 export { ClientError } from './Http/ClientError.js';
 export { ApiError } from './Model/Error/ApiError.js';
+export type { ParseErrorHandler } from './Http/Transport/ITransport.js';
 export { HttpStatus } from './Http/HttpStatus.js';
 export { ContentTypeHelper } from './Http/ContentTypeHelper.js';
 /**

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.73.1";
+export declare const VERSION = "1.74.0";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "1.73.1";
+export const VERSION = "1.74.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "attlaz-client",
-  "version": "1.74.0",
+  "version": "1.75.0",
   "description": "Javascript Client to access Attlaz API",
   "types": "./dist/index.d.ts",
   "main": "./dist/index.js",