connectbase-client 6.13.0 → 6.14.0

package/dist/index.js

@@ -41,6 +41,7 @@ __export(index_exports, {
   RolesAPI: () => RolesAPI,
   SessionManager: () => SessionManager,
   VideoProcessingError: () => VideoProcessingError,
+  WsTicketError: () => WsTicketError,
   default: () => index_default,
   detectInAppBrowser: () => detectInAppBrowser,
   escapeToExternalBrowser: () => escapeToExternalBrowser,
@@ -170,9 +171,9 @@ var AdsAPI = class {
 
 // src/types/error.ts
 var ApiError = class extends Error {
-  constructor(statusCode, message, code, details) {
+  constructor(statusCode2, message, code, details) {
     super(message);
-    this.statusCode = statusCode;
+    this.statusCode = statusCode2;
     this.name = "ApiError";
     this.code = code;
     this.details = details;
@@ -308,7 +309,7 @@ var RealtimeConnectionError = class extends Error {
   }
 };
 function isRetryableRealtimeRejection(code) {
-  return code === "connection_limit_exceeded" || code === "server_at_capacity" || code === "rate_limited" || code === "auth_unavailable" || code === "internal_error";
+  return code === "connection_limit_exceeded" || code === "server_at_capacity" || code === "rate_limited" || code === "auth_unavailable" || code === "internal_error" || code === "invalid_ws_ticket" || code === "ws_ticket_unavailable";
 }
 var RealtimeRequestError = class extends Error {
   constructor(init) {
@@ -3698,9 +3699,107 @@ var HttpClient = class {
   }
 };
 
+// src/core/ws-ticket.ts
+var WsTicketError = class extends Error {
+  constructor(init) {
+    super(
+      init.message || init.code || `WebSocket ticket request failed (${init.status})`
+    );
+    this.name = "WsTicketError";
+    this.status = init.status;
+    this.code = init.code || "ws_ticket_rejected";
+    this.retryAfterMs = init.retryAfterMs;
+  }
+};
+var DEFAULT_TICKET_TIMEOUT_MS = 5e3;
+var unsupported = /* @__PURE__ */ new Set();
+function supportKey(url, kind) {
+  try {
+    const u = new URL(url);
+    return `${u.origin}|${kind}`;
+  } catch {
+    return `${url}|${kind}`;
+  }
+}
+async function fetchWsTicket(url, kind, credential, options = {}) {
+  const key = supportKey(url, kind);
+  if (unsupported.has(key)) return null;
+  const headers = {};
+  if (credential.kind === "access_token") {
+    headers.Authorization = `Bearer ${credential.value}`;
+  } else {
+    headers["X-Public-Key"] = credential.value;
+  }
+  const { signal, cleanup } = createTimeoutController({
+    timeout: Math.max(
+      1,
+      Math.min(
+        options.timeoutMs ?? DEFAULT_TICKET_TIMEOUT_MS,
+        DEFAULT_TICKET_TIMEOUT_MS
+      )
+    ),
+    signal: options.signal
+  });
+  let response;
+  try {
+    response = await withAbort(
+      fetch(url, { method: "POST", headers, credentials: "omit", signal }),
+      signal
+    );
+  } catch (err) {
+    cleanup();
+    if (options.signal?.aborted) throw err;
+    return null;
+  }
+  try {
+    if (response.ok) {
+      const body2 = await response.json().catch(() => null);
+      return typeof body2?.ticket === "string" && body2.ticket !== "" ? body2.ticket : null;
+    }
+    if (response.status === 404 || response.status === 405 || response.status === 501) {
+      unsupported.add(key);
+      return null;
+    }
+    if (response.status >= 500) return null;
+    const body = await response.json().catch(() => null);
+    const raw = typeof body?.error === "string" ? body.error : void 0;
+    const isCode = raw !== void 0 && /^[a-z0-9_]+$/.test(raw);
+    const code = isCode ? raw : statusCode(response.status);
+    const message = typeof body?.message === "string" ? body.message : raw;
+    const retryAfterMs = typeof body?.retry_after_ms === "number" && body.retry_after_ms > 0 ? body.retry_after_ms : void 0;
+    throw new WsTicketError({
+      status: response.status,
+      code,
+      message,
+      retryAfterMs
+    });
+  } finally {
+    cleanup();
+  }
+}
+function statusCode(status) {
+  switch (status) {
+    case 401:
+      return "unauthorized";
+    case 402:
+      return "quota_exceeded";
+    case 403:
+      return "forbidden";
+    case 429:
+      return "rate_limited";
+    default:
+      return "ws_ticket_rejected";
+  }
+}
+function ticketUrl(base, path) {
+  const httpBase = base.replace(/^ws(s?):\/\//, "http$1://").replace(/\/+$/, "");
+  return `${httpBase}${path}`;
+}
+
 // src/api/database.ts
 var REALTIME_TOKEN_MIN_VALIDITY_SEC = 600;
 var REALTIME_CONNECT_TOKEN_MIN_VALIDITY_SEC = 60;
+var REALTIME_CONNECT_TIMEOUT_MS = 15e3;
 var REALTIME_AUTH_REFRESH_RETRY_MS = 3e4;
 var REALTIME_CLOSING_NOTICE_CODES = /* @__PURE__ */ new Set([
   "TOKEN_EXPIRED",
@@ -4645,15 +4744,52 @@ var DatabaseAPI = class {
       );
       if (fresh) opts.accessToken = fresh;
     }
-    return this.doRealtimeConnect();
+    let ticket;
+    try {
+      ticket = await this.realtimeTicket();
+    } catch (e) {
+      if (e instanceof WsTicketError) {
+        if (e.status === 429 && this.realtimeOptions) {
+          this.attemptRealtimeReconnect();
+        } else {
+          this.setRealtimeState("disconnected");
+        }
+        const err = new RealtimeConnectionError({
+          code: e.code,
+          message: e.message,
+          closeCode: 4e3 + e.status,
+          retryAfterMs: e.retryAfterMs
+        });
+        this.realtimeOnError?.(err);
+        throw err;
+      }
+      throw e;
+    }
+    return this.doRealtimeConnect(ticket);
+  }
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓을 받는다(core/ws-ticket.ts). 브라우저 WebSocket 은 헤더를 못 붙여 예전에는 멤버 토큰을
+   * URL(`?access_token=`)에 실었다 — 이제 헤더로 티켓을 받아 `?ticket=` 만 싣는다. 서버가 티켓을 모르거나(구버전) 잠시 못
+   * 주면 null 이고 예전처럼 붙는다. cross-app OAuth 토큰도 같은 경로다(서버가 티켓에서 토큰을 되살려 같은 검증을 한다).
+   */
+  async realtimeTicket() {
+    const opts = this.realtimeOptions;
+    if (!opts?.accessToken) return null;
+    const baseUrl = opts.dataServerUrl || this.http.getBaseUrl();
+    return fetchWsTicket(
+      ticketUrl(baseUrl, "/v1/database/realtime/ws-ticket"),
+      "data.realtime",
+      { kind: "access_token", value: opts.accessToken },
+      { timeoutMs: REALTIME_CONNECT_TIMEOUT_MS }
+    );
   }
-  doRealtimeConnect() {
+  doRealtimeConnect(ticket = null) {
     if (!this.realtimeOptions)
       return Promise.reject(new Error("No realtime options"));
     this.setRealtimeState("connecting");
     const baseUrl = this.realtimeOptions.dataServerUrl || this.http.getBaseUrl();
     const wsUrl = baseUrl.replace(/^http/, "ws");
-    let url = `${wsUrl}/v1/database/realtime/ws?access_token=${encodeURIComponent(this.realtimeOptions.accessToken)}`;
+    let url = ticket ? `${wsUrl}/v1/database/realtime/ws?ticket=${encodeURIComponent(ticket)}` : `${wsUrl}/v1/database/realtime/ws?access_token=${encodeURIComponent(this.realtimeOptions.accessToken)}`;
     this.realtimeTokenRefresh = this.http.canRefreshMemberToken(
       this.realtimeOptions.accessToken
     );
@@ -4672,7 +4808,7 @@ var DatabaseAPI = class {
             this.setRealtimeState("disconnected");
             reject(new Error("Connection timeout"));
           }
-        }, 15e3);
+        }, REALTIME_CONNECT_TIMEOUT_MS);
         this.realtimeWs.onopen = () => {
           if (!settled) {
             settled = true;
@@ -5213,7 +5349,7 @@ var EndpointAPI = class {
       );
     }
     const baseUrl = this.http.getBaseUrl().replace(/\/+$/, "");
-    const ticketUrl = `${baseUrl}/v1/proxy/${encodeURIComponent(label)}/ws-ticket`;
+    const ticketUrl2 = `${baseUrl}/v1/proxy/${encodeURIComponent(label)}/ws-ticket`;
     const ticketHeaders = new Headers();
     const pk = this.http.getPublicKey();
     if (!pk) {
@@ -5222,7 +5358,7 @@ var EndpointAPI = class {
       );
     }
     ticketHeaders.set("X-Public-Key", pk);
-    const ticketRes = await fetch(ticketUrl, {
+    const ticketRes = await fetch(ticketUrl2, {
       method: "POST",
       headers: ticketHeaders,
       signal: opts.signal
@@ -5920,20 +6056,54 @@ var GameRoom = class {
    * 게임 서버에 연결
    */
   connect(roomId) {
-    return new Promise((resolve, reject) => {
-      if (this.ws?.readyState === WebSocket.OPEN) {
-        resolve();
-        return;
-      }
-      if (!this.config.appId) {
-        reject(
-          new Error(
-            "cb.game: appId is required to connect. Pass it to `new ConnectBase({ appId })` or per-client via `cb.game.createClient({ appId, clientId })`."
-          )
-        );
-        return;
+    if (this.ws?.readyState === WebSocket.OPEN) {
+      return Promise.resolve();
+    }
+    if (!this.config.appId) {
+      return Promise.reject(
+        new Error(
+          "cb.game: appId is required to connect. Pass it to `new ConnectBase({ appId })` or per-client via `cb.game.createClient({ appId, clientId })`."
+        )
+      );
+    }
+    if (!this.config.clientId) {
+      return Promise.reject(
+        new Error(
+          "cb.game: clientId is required to build a game connection URL. Pass it via `cb.game.createClient({ appId, clientId })`."
+        )
+      );
+    }
+    return this.connectionTicket().then(
+      (ticket) => this.openSocket(roomId, ticket)
+    );
+  }
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓을 받는다(core/ws-ticket.ts). 브라우저 WebSocket 은 헤더를 못 붙여 예전에는 멤버
+   * 토큰(`?token=`)과 공개 키(`?public_key=`)를 URL 에 실었다 — 이제 헤더로 티켓을 받아 `?ticket=` 만 싣는다. 서버가
+   * 티켓을 모르거나(구버전) 잠시 못 주면 null 이고 예전처럼 붙는다. 발급이 자격증명을 거부하면 {@link GameError} 로 던진다.
+   */
+  async connectionTicket() {
+    const { accessToken, publicKey, appId, gameServerUrl } = this.config;
+    if (!accessToken && !publicKey || !appId || !gameServerUrl) return null;
+    try {
+      return await fetchWsTicket(
+        ticketUrl(
+          gameServerUrl,
+          `/v1/game/${encodeURIComponent(appId)}/ws-ticket`
+        ),
+        "game.ws",
+        accessToken ? { kind: "access_token", value: accessToken } : { kind: "public_key", value: publicKey }
+      );
+    } catch (e) {
+      if (e instanceof WsTicketError) {
+        throw new GameError({ code: e.code, message: e.message });
       }
-      const url = this.buildConnectionUrl(roomId);
+      throw e;
+    }
+  }
+  openSocket(roomId, ticket) {
+    return new Promise((resolve, reject) => {
+      const url = this.buildConnectionUrl(roomId, ticket);
       this.ws = new WebSocket(url);
       const onOpen = () => {
         this._isConnected = true;
@@ -6189,7 +6359,7 @@ var GameRoom = class {
     });
   }
   // Private methods
-  buildConnectionUrl(roomId) {
+  buildConnectionUrl(roomId, ticket) {
     const baseUrl = this.config.gameServerUrl;
     const wsUrl = baseUrl.replace(/^http/, "ws");
     const params = new URLSearchParams();
@@ -6202,11 +6372,15 @@ var GameRoom = class {
     if (roomId) {
       params.set("room_id", roomId);
     }
-    if (this.config.publicKey) {
-      params.set("public_key", this.config.publicKey);
-    }
-    if (this.config.accessToken) {
-      params.set("token", this.config.accessToken);
+    if (ticket) {
+      params.set("ticket", ticket);
+    } else {
+      if (this.config.publicKey) {
+        params.set("public_key", this.config.publicKey);
+      }
+      if (this.config.accessToken) {
+        params.set("token", this.config.accessToken);
+      }
     }
     if (!this.config.appId) {
       throw new Error(
@@ -10063,7 +10237,14 @@ var ConnectCancelledError = class extends Error {
   }
 };
 var MAX_HANDSHAKE_RETRIES = 2;
-var RETRY_IN_CONNECT_CODES = /* @__PURE__ */ new Set(["rate_limited", "auth_unavailable"]);
+var RETRY_IN_CONNECT_CODES = /* @__PURE__ */ new Set([
+  "rate_limited",
+  "auth_unavailable",
+  // 1회용 티켓이 업그레이드에서 거부됐다(만료, 이미 쓰임, 저장소 일시 장애). 다음 시도는 새 티켓을 받거나, 저장소가
+  // 없으면 예전 방식으로 붙는다(core/ws-ticket.ts).
+  "invalid_ws_ticket",
+  "ws_ticket_unavailable"
+]);
 var CONNECTION_TOKEN_MIN_VALIDITY_SEC = 600;
 var CONNECT_TOKEN_MIN_VALIDITY_SEC = 60;
 var AUTH_REFRESH_RETRY_MS = 3e4;
@@ -11178,7 +11359,10 @@ var RealtimeAPI = class {
       for (let attempt = 1; ; attempt++) {
         try {
           await this.prepareConnectToken();
-          await this.doConnect(Math.max(deadline - Date.now(), 1));
+          const ticket = await this.connectTicket(
+            Math.max(deadline - Date.now(), 1)
+          );
+          await this.doConnect(Math.max(deadline - Date.now(), 1), ticket);
           return;
         } catch (e) {
           let wait = null;
@@ -11221,7 +11405,39 @@ var RealtimeAPI = class {
       this.initialConnecting = false;
     }
   }
-  async doConnect(timeoutMs = this.options.timeout) {
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓을 받는다(core/ws-ticket.ts). 브라우저 WebSocket 은 헤더를 못 붙여 예전에는 멤버
+   * 토큰과 공개 키를 URL 에 실었다 — 이제 헤더로 티켓을 받아 `?ticket=` 만 싣는다. 티켓은 한 번만 쓰이므로 시도마다
+   * 새로 받는다.
+   *
+   * 서버가 티켓을 모르거나(구버전) 잠시 못 주면 null 이고, doConnect 가 예전처럼 자격증명을 URL 에 싣는다. 발급이
+   * 자격증명을 거부하면 업그레이드 거부와 같은 {@link RealtimeConnectionError} 로 던진다 — 재시도 규칙이 같다.
+   */
+  async connectTicket(timeoutMs) {
+    const accessToken = this.options.accessToken;
+    const publicKey = accessToken ? void 0 : this.http.getPublicKey();
+    if (!accessToken && !publicKey) return null;
+    try {
+      return await fetchWsTicket(
+        ticketUrl(this.socketUrl, "/v1/realtime/ws-ticket"),
+        "socket.realtime",
+        accessToken ? { kind: "access_token", value: accessToken } : { kind: "public_key", value: publicKey },
+        { timeoutMs }
+      );
+    } catch (e) {
+      if (e instanceof WsTicketError) {
+        this.log(`WebSocket ticket rejected: ${e.code} (${e.status})`);
+        throw new RealtimeConnectionError({
+          code: e.code,
+          message: e.message,
+          closeCode: 4e3 + e.status,
+          retryAfterMs: e.retryAfterMs
+        });
+      }
+      throw e;
+    }
+  }
+  async doConnect(timeoutMs = this.options.timeout, ticket = null) {
     return new Promise((resolve, reject) => {
       this.state = "connecting";
       this.notifyStateChange();
@@ -11230,9 +11446,10 @@ var RealtimeAPI = class {
       const usingDirect = !!directWsBase;
       const wsUrl = (directWsBase ?? this.socketUrl).replace(/^http/, "ws");
       let url;
+      const auth = ticket ? `ticket=${encodeURIComponent(ticket)}` : void 0;
       this.tokenRefreshNegotiated = false;
       if (this.options.accessToken) {
-        url = `${wsUrl}/v1/realtime/auth?access_token=${encodeURIComponent(this.options.accessToken)}&client_id=${this.clientId}`;
+        url = `${wsUrl}/v1/realtime/auth?${auth ?? `access_token=${encodeURIComponent(this.options.accessToken)}`}&client_id=${this.clientId}`;
         if (this.http.canRefreshMemberToken(this.options.accessToken)) {
           this.tokenRefreshNegotiated = true;
           url += "&token_refresh=1";
@@ -11248,7 +11465,7 @@ var RealtimeAPI = class {
           reject(error);
           return;
         }
-        url = `${wsUrl}/v1/realtime/auth?public_key=${encodeURIComponent(publicKey)}&client_id=${this.clientId}`;
+        url = `${wsUrl}/v1/realtime/auth?${auth ?? `public_key=${encodeURIComponent(publicKey)}`}&client_id=${this.clientId}`;
         this.log("Using API Key authentication");
       }
       if (this.userId) {
@@ -11728,7 +11945,9 @@ var RealtimeAPI = class {
         try {
           await this.prepareConnectToken();
           if (this.state !== "reconnecting") return;
-          await this.doConnect();
+          const ticket = await this.connectTicket(this.options.timeout);
+          if (this.state !== "reconnecting") return;
+          await this.doConnect(void 0, ticket);
           this.log("Reconnected successfully, restoring subscriptions...");
           const snapshot = this.pendingRestore;
           this.pendingRestore = null;
@@ -13331,8 +13550,8 @@ var SupportAPI = class {
   }
 };
 function detectSdkVersion() {
-  if ("6.13.0") {
-    return "6.13.0";
+  if ("6.14.0") {
+    return "6.14.0";
   }
   return "unknown";
 }
@@ -14301,9 +14520,35 @@ var WebRTCAPI = class _WebRTCAPI {
     }
     return this.connectWebSocket();
   }
-  connectWebSocket() {
+  async connectWebSocket() {
+    const before = this.wsGeneration;
+    const ticket = await this.signalingTicket();
+    if (this.wsGeneration !== before) {
+      throw new Error("\uC5F0\uACB0\uC774 \uCDE8\uC18C\uB418\uC5C8\uC2B5\uB2C8\uB2E4");
+    }
+    return this.openSignalingSocket(ticket);
+  }
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓을 받는다(core/ws-ticket.ts). 브라우저 WebSocket 은 헤더를 못 붙여 예전에는 멤버 토큰
+   * (`?access_token=`)과 공개 키(`?public_key=`)를 URL 에 실었다 — 이제 헤더로 티켓을 받아 `?ticket=` 만 싣는다. 서버가
+   * 티켓을 모르거나(구버전) 잠시 못 주면 null 이고 예전처럼 붙는다. 발급이 자격증명을 거부하면 그 이유로 던진다.
+   */
+  async signalingTicket() {
+    const accessToken = this.http.getAccessToken();
+    const publicKey = accessToken ? void 0 : this.http.getPublicKey();
+    if (!accessToken && !publicKey || !this.appId) return null;
+    return fetchWsTicket(
+      ticketUrl(
+        this.webrtcUrl,
+        `/v1/apps/${encodeURIComponent(this.appId)}/signaling/ws-ticket`
+      ),
+      "webrtc.signaling",
+      accessToken ? { kind: "access_token", value: accessToken } : { kind: "public_key", value: publicKey }
+    );
+  }
+  openSignalingSocket(ticket) {
     return new Promise((resolve, reject) => {
-      const wsUrl = this.buildWebSocketUrl();
+      const wsUrl = this.buildWebSocketUrl(ticket);
       const generation = ++this.wsGeneration;
       const ws = new WebSocket(wsUrl);
       this.ws = ws;
@@ -14372,12 +14617,14 @@ var WebRTCAPI = class _WebRTCAPI {
     ws.onerror = null;
     ws.onclose = null;
   }
-  buildWebSocketUrl() {
+  buildWebSocketUrl(ticket = null) {
     const wsBase = this.webrtcUrl.replace("https://", "wss://").replace("http://", "ws://");
     const publicKey = this.http.getPublicKey();
     const accessToken = this.http.getAccessToken();
     let authParam = "";
-    if (accessToken) {
+    if (ticket) {
+      authParam = `ticket=${encodeURIComponent(ticket)}`;
+    } else if (accessToken) {
       authParam = `access_token=${encodeURIComponent(accessToken)}`;
     } else if (publicKey) {
       authParam = `public_key=${encodeURIComponent(publicKey)}`;
@@ -15035,11 +15282,35 @@ var WebSocketTransport = class {
     this.onClose = onClose;
     this.onError = onError;
   }
-  connect() {
+  async connect() {
+    const ticket = await this.connectionTicket();
+    return this.openSocket(ticket);
+  }
+  /**
+   * 연결 시도 한 번에 쓸 1회용 티켓(core/ws-ticket.ts). 서버가 티켓을 모르거나(구버전) 잠시 못 주면 null 이고 예전처럼
+   * 자격증명을 URL 에 싣는다. 발급이 자격증명을 거부하면 {@link GameError} 로 던진다.
+   */
+  async connectionTicket() {
+    const { accessToken, publicKey, appId } = this.config;
+    if (!accessToken && !publicKey || !appId) return null;
+    const baseUrl = this.config.gameServerUrl || "wss://game.connectbase.world";
+    try {
+      return await fetchWsTicket(
+        ticketUrl(baseUrl, `/v1/game/${encodeURIComponent(appId)}/ws-ticket`),
+        "game.ws",
+        accessToken ? { kind: "access_token", value: accessToken } : { kind: "public_key", value: publicKey }
+      );
+    } catch (e) {
+      if (e instanceof WsTicketError) {
+        throw new GameError({ code: e.code, message: e.message });
+      }
+      throw e;
+    }
+  }
+  openSocket(ticket) {
     return new Promise((resolve, reject) => {
-      const url = this.buildUrl();
       try {
-        this.ws = new WebSocket(url);
+        this.ws = new WebSocket(this.buildUrl(ticket));
         this.ws.binaryType = "arraybuffer";
       } catch (error) {
         reject(error);
@@ -15069,16 +15340,20 @@ var WebSocketTransport = class {
       this.ws.addEventListener("message", onMessage);
     });
   }
-  buildUrl() {
+  buildUrl(ticket = null) {
     const baseUrl = this.config.gameServerUrl || "wss://game.connectbase.world";
     const wsUrl = baseUrl.replace(/^http/, "ws");
     const params = new URLSearchParams();
     params.set("client_id", requireClientId(this.config.clientId));
-    if (this.config.publicKey) {
-      params.set("public_key", this.config.publicKey);
-    }
-    if (this.config.accessToken) {
-      params.set("token", this.config.accessToken);
+    if (ticket) {
+      params.set("ticket", ticket);
+    } else {
+      if (this.config.publicKey) {
+        params.set("public_key", this.config.publicKey);
+      }
+      if (this.config.accessToken) {
+        params.set("token", this.config.accessToken);
+      }
     }
     if (!this.config.appId) {
       throw new Error(
@@ -15758,6 +16033,7 @@ var index_default = ConnectBase;
   RolesAPI,
   SessionManager,
   VideoProcessingError,
+  WsTicketError,
   detectInAppBrowser,
   escapeToExternalBrowser,
   isWebTransportSupported,