eip-cloud-services 1.4.0 → 1.5.0

package/CHANGELOG.md

@@ -3,6 +3,11 @@
 
 All notable changes to this project will be documented in this file.
 
+## Unreleased
+
+### Added
+- Added staging-safe OnDemand Content Ingest, Content Discovery, and Azure Blob upload clients with injectable fetch, timeouts, production-host guards, and signed-query redaction.
+
 ## [1.2.5] - 2026-03-02
 
 ### Fixed

package/README.md

@@ -82,6 +82,51 @@ module.exports = {
 5. [AWS Lambda Module](#aws-lambda-module)
 6. [AWS SQS Module](#aws-sqs-module)
 7. [AWS Secrets Manager Module](#aws-secrets-manager-module)
+8. [OnDemand Module](#ondemand-module)
+
+# OnDemand Module
+
+## Overview
+
+The OnDemand module provides dependency-free clients for Axel Springer's Content Ingest and Content Discovery APIs, plus streaming uploads to their Azure Blob Storage target. Staging endpoints are the defaults. Production Content Discovery/Ingest hosts are rejected unless a future caller explicitly supplies `allowProduction: true`.
+
+Secrets are caller-provided and are never stored by this package. Provider errors and returned metadata are sanitized so signed Azure query parameters are not included in thrown errors.
+
+## Usage
+
+```javascript
+const { ondemand } = require ( 'eip-cloud-services' );
+
+const ingest = ondemand.createIngestClient ( {
+    apiKey: process.env.ONDEMAND_INGEST_API_KEY
+} );
+
+const discovery = ondemand.createDiscoveryClient ( {
+    apiKey: process.env.ONDEMAND_DISCOVERY_API_KEY
+} );
+
+const assets = await discovery.search ( {
+    q: 'climate change',
+    assetType: 'video',
+    suppliers: [ 'https://cv.content-discovery.video/party/telegraph' ]
+} );
+```
+
+Available Ingest operations are `createAsset`, `getAsset`, `updateAsset`, `startIngest`, `getIngest`, `createRendition`, and `updateRendition`. Discovery operations are `getVersion`, `getAsset`, `getAssets`, `search`, `searchByExpression`, and `getMasterDownload`.
+
+Use `uploadAzureBlob` with a clean blob URL and a separate SAS token. Pass the clean URL—not the signed upload URL—to `startIngest`:
+
+```javascript
+await ondemand.uploadAzureBlob ( {
+    blobUrl: cleanBlobUrl,
+    sasToken: process.env.ONDEMAND_AZURE_SAS_TOKEN,
+    body: videoStream,
+    contentLength: videoSize,
+    contentType: 'video/mp4'
+} );
+
+await ingest.startIngest ( assetId, { url: cleanBlobUrl } );
+```
 
 # AWS Secrets Manager Module
 

package/index.js

@@ -7,3 +7,4 @@ exports.sqs = require ( './src/sqs' );
 exports.secrets = require ( './src/secrets' );
 exports.mysql = require ( './src/mysql' );
 exports.mysql8 = require ( './src/mysql8' );
+exports.ondemand = require ( './src/ondemand' );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eip-cloud-services",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Houses a collection of helpers for connecting with Cloud services.",
   "main": "index.js",
   "scripts": {

package/src/ondemand.js

@@ -0,0 +1,339 @@
+const DEFAULT_INGEST_BASE_URL = 'https://ingest.staging.content-discovery.video/v1';
+const DEFAULT_DISCOVERY_BASE_URL = 'https://api.staging.content-discovery.video/v1';
+const PRODUCTION_HOSTS = new Set ( [
+    'ingest.content-discovery.video',
+    'api.content-discovery.video'
+] );
+const DEFAULT_TIMEOUT_MS = 15000;
+
+class OnDemandRequestError extends Error {
+    constructor ( message, { status = null, details = null, cause = null } = {} ) {
+        super ( message, cause ? { cause } : undefined );
+        this.name = 'OnDemandRequestError';
+        this.status = status;
+        this.details = details;
+    }
+}
+
+const normalizeText = value => typeof value === 'string' ? value.trim () : '';
+
+const sanitizeUrl = value => {
+    try {
+        const url = new URL ( value );
+        url.search = '';
+        url.hash = '';
+        return url.toString ();
+    }
+    catch ( error ) {
+        return value;
+    }
+};
+
+const sanitizeText = value => normalizeText ( value )
+    .replace ( /https?:\/\/[^\s"'<>]+/gi, match => sanitizeUrl ( match ) )
+    .replace ( /[?&](?:sig|sv|se|sp|spr|srt|ss|st)=[^&\s"']*/gi, '' );
+
+const sanitizeDetails = value => {
+    if ( typeof value === 'string' ) return sanitizeText ( value );
+    if ( Array.isArray ( value ) ) return value.map ( sanitizeDetails );
+    if ( !value || typeof value !== 'object' ) return value;
+
+    return Object.fromEntries ( Object.entries ( value ).map ( ( [ key, item ] ) => [ key, sanitizeDetails ( item ) ] ) );
+};
+
+const resolveFetch = fetchImpl => {
+    const resolved = fetchImpl || global.fetch;
+    if ( typeof resolved !== 'function' ) {
+        throw new Error ( 'OnDemand requires a fetch implementation' );
+    }
+
+    return resolved;
+};
+
+const normalizeBaseUrl = ( value, defaultValue, allowProduction ) => {
+    const normalized = normalizeText ( value ) || defaultValue;
+    const url = new URL ( normalized );
+
+    if ( url.protocol !== 'https:' ) {
+        throw new Error ( 'OnDemand endpoint must use HTTPS' );
+    }
+    if ( PRODUCTION_HOSTS.has ( url.hostname ) && !allowProduction ) {
+        throw new Error ( 'OnDemand production endpoint is disabled' );
+    }
+
+    url.search = '';
+    url.hash = '';
+    return url.toString ().replace ( /\/$/, '' );
+};
+
+const requireApiKey = value => {
+    const apiKey = normalizeText ( value );
+    if ( !apiKey ) throw new Error ( 'OnDemand API key is required' );
+    return apiKey;
+};
+
+const parseResponse = async response => {
+    if ( response.status === 204 ) return null;
+
+    const contentType = normalizeText ( response?.headers?.get?.( 'content-type' ) ).toLowerCase ();
+    if ( contentType.includes ( 'json' ) && typeof response.json === 'function' ) {
+        return response.json ();
+    }
+
+    const text = typeof response.text === 'function' ? await response.text () : '';
+    if ( !text ) return null;
+
+    try {
+        return JSON.parse ( text );
+    }
+    catch ( error ) {
+        return text;
+    }
+};
+
+const buildErrorMessage = ( status, details ) => {
+    const detail = typeof details === 'object' && details
+        ? details.detail || details.title || details.message
+        : details;
+    const suffix = sanitizeText ( detail );
+    return `OnDemand request failed (${status})${suffix ? `: ${suffix}` : ''}`;
+};
+
+const executeRequest = async ( {
+    fetchImpl,
+    url,
+    options,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    includeResponse = false
+} ) => {
+    const controller = new AbortController ();
+    const timer = setTimeout ( () => controller.abort (), timeoutMs );
+    timer.unref?.();
+
+    try {
+        const response = await fetchImpl ( url, {
+            ...options,
+            signal: controller.signal
+        } );
+        const payload = await parseResponse ( response );
+
+        if ( !response.ok ) {
+            const sanitizedDetails = sanitizeDetails ( payload );
+            throw new OnDemandRequestError ( buildErrorMessage ( response.status, sanitizedDetails ), {
+                status: response.status,
+                details: sanitizedDetails
+            } );
+        }
+
+        return includeResponse ? { payload, response } : payload;
+    }
+    catch ( error ) {
+        if ( error instanceof OnDemandRequestError ) throw error;
+
+        const timedOut = controller.signal.aborted || error?.name === 'AbortError';
+        throw new OnDemandRequestError ( timedOut ? 'OnDemand request timed out' : 'OnDemand request failed', {
+            cause: error
+        } );
+    }
+    finally {
+        clearTimeout ( timer );
+    }
+};
+
+const createApiClient = ( {
+    apiKey,
+    baseUrl,
+    defaultBaseUrl,
+    allowProduction = false,
+    fetch: fetchOption,
+    timeoutMs = DEFAULT_TIMEOUT_MS
+} ) => {
+    const resolvedApiKey = requireApiKey ( apiKey );
+    const resolvedBaseUrl = normalizeBaseUrl ( baseUrl, defaultBaseUrl, allowProduction );
+    const fetchImpl = resolveFetch ( fetchOption );
+
+    return async ( path, { method = 'GET', body, headers = {} } = {} ) => executeRequest ( {
+        fetchImpl,
+        url: `${resolvedBaseUrl}${path}`,
+        timeoutMs,
+        options: {
+            method,
+            headers: {
+                ...( body === undefined ? {} : { 'Content-Type': 'application/json' } ),
+                'X-API-KEY': resolvedApiKey,
+                ...headers
+            },
+            ...( body === undefined ? {} : { body: JSON.stringify ( body ) } )
+        }
+    } );
+};
+
+const encodePathSegment = ( value, label ) => {
+    const normalized = normalizeText ( value );
+    if ( !normalized ) throw new Error ( `${label} is required` );
+    return encodeURIComponent ( normalized );
+};
+
+const assertCleanIngestUrl = value => {
+    const normalized = normalizeText ( value );
+    if ( !normalized ) throw new Error ( 'OnDemand ingest URL is required' );
+
+    const url = new URL ( normalized );
+    if ( url.search ) throw new Error ( 'OnDemand ingest URL must not contain query parameters' );
+    return url.toString ();
+};
+
+/**
+ * Create a Content Ingest API client. Staging is the default and production hosts
+ * are rejected unless a future caller explicitly opts in with allowProduction.
+ *
+ * @param {object} options
+ * @param {string} options.apiKey Content Ingest X-API-KEY value.
+ * @param {string} [options.baseUrl] Content Ingest base URL.
+ * @param {boolean} [options.allowProduction=false] Explicit production safety override.
+ * @param {Function} [options.fetch] Injectable fetch implementation.
+ * @param {number} [options.timeoutMs=15000] Per-request timeout.
+ * @returns {object} Content Ingest operations.
+ */
+exports.createIngestClient = options => {
+    const request = createApiClient ( {
+        ...options,
+        defaultBaseUrl: DEFAULT_INGEST_BASE_URL
+    } );
+
+    return {
+        createAsset: input => request ( '/assets', { method: 'POST', body: input } ),
+        getAsset: assetId => request ( `/assets/${encodePathSegment ( assetId, 'OnDemand asset id' )}` ),
+        updateAsset: ( assetId, input ) => request ( `/assets/${encodePathSegment ( assetId, 'OnDemand asset id' )}`, {
+            method: 'PATCH',
+            body: input
+        } ),
+        startIngest: ( assetId, input ) => request ( `/assets/${encodePathSegment ( assetId, 'OnDemand asset id' )}/ingest`, {
+            method: 'POST',
+            body: {
+                ...input,
+                url: assertCleanIngestUrl ( input?.url )
+            }
+        } ),
+        getIngest: ingestId => request ( `/ingests/${encodePathSegment ( ingestId, 'OnDemand ingest id' )}` ),
+        createRendition: ( assetId, input ) => request ( `/assets/${encodePathSegment ( assetId, 'OnDemand asset id' )}/rendition`, {
+            method: 'POST',
+            body: input
+        } ),
+        updateRendition: ( assetId, rendition, input ) => request ( `/assets/${encodePathSegment ( assetId, 'OnDemand asset id' )}/rendition/${encodePathSegment ( rendition, 'OnDemand rendition' )}`, {
+            method: 'PUT',
+            body: input
+        } )
+    };
+};
+
+const buildQueryString = params => {
+    const searchParams = new URLSearchParams ();
+
+    Object.entries ( params || {} ).forEach ( ( [ key, value ] ) => {
+        if ( value === undefined || value === null || value === '' ) return;
+        searchParams.set ( key, Array.isArray ( value ) ? value.join ( ',' ) : String ( value ) );
+    } );
+
+    const query = searchParams.toString ();
+    return query ? `?${query}` : '';
+};
+
+/**
+ * Create a Content Discovery API client. Staging is the default and production
+ * hosts are rejected unless a future caller explicitly opts in.
+ *
+ * @param {object} options
+ * @param {string} options.apiKey Content Discovery X-API-KEY value.
+ * @param {string} [options.baseUrl] Content Discovery base URL.
+ * @param {boolean} [options.allowProduction=false] Explicit production safety override.
+ * @param {Function} [options.fetch] Injectable fetch implementation.
+ * @param {number} [options.timeoutMs=15000] Per-request timeout.
+ * @returns {object} Content Discovery operations.
+ */
+exports.createDiscoveryClient = options => {
+    const request = createApiClient ( {
+        ...options,
+        defaultBaseUrl: DEFAULT_DISCOVERY_BASE_URL
+    } );
+
+    return {
+        getVersion: () => request ( '/' ),
+        getAsset: assetId => request ( `/assets/${encodePathSegment ( assetId, 'OnDemand asset id' )}` ),
+        getAssets: assetIds => request ( `/assets${buildQueryString ( {
+            id: ( Array.isArray ( assetIds ) ? assetIds : [ assetIds ] ).join ( ',' )
+        } )}` ),
+        search: params => request ( `/search${buildQueryString ( params )}` ),
+        searchByExpression: expression => request ( '/search', { method: 'POST', body: expression } ),
+        getMasterDownload: assetId => request ( `/assets/${encodePathSegment ( assetId, 'OnDemand asset id' )}/renditions/master/download` )
+    };
+};
+
+const buildAzureUploadUrl = ( blobUrl, sasToken ) => {
+    const url = new URL ( normalizeText ( blobUrl ) );
+    if ( url.protocol !== 'https:' || !url.hostname.endsWith ( '.blob.core.windows.net' ) ) {
+        throw new Error ( 'OnDemand Azure blob URL must be an HTTPS Azure Blob Storage URL' );
+    }
+    if ( url.search ) {
+        throw new Error ( 'OnDemand Azure blob URL must not already contain query parameters' );
+    }
+
+    const normalizedSas = normalizeText ( sasToken ).replace ( /^\?/, '' );
+    if ( !normalizedSas ) throw new Error ( 'OnDemand Azure SAS token is required' );
+    url.search = normalizedSas;
+    return url.toString ();
+};
+
+/**
+ * Stream a source video to an Azure block blob using a SAS token. The returned
+ * result never includes the signed request URL.
+ *
+ * @param {object} options
+ * @param {string} options.blobUrl Clean Azure blob URL without a query string.
+ * @param {string} options.sasToken Azure SAS query string.
+ * @param {import('stream').Readable|Buffer|Uint8Array|Blob} options.body Upload body.
+ * @param {number} options.contentLength Exact byte length.
+ * @param {string} [options.contentType='video/mp4'] MIME type.
+ * @param {Function} [options.fetch] Injectable fetch implementation.
+ * @param {number} [options.timeoutMs=300000] Upload timeout.
+ * @returns {Promise<{status: number, etag: string|null}>} Sanitized upload result.
+ */
+exports.uploadAzureBlob = async ( {
+    blobUrl,
+    sasToken,
+    body,
+    contentLength,
+    contentType = 'video/mp4',
+    fetch: fetchOption,
+    timeoutMs = 300000
+} ) => {
+    if ( !body ) throw new Error ( 'OnDemand Azure upload body is required' );
+    if ( !Number.isFinite ( Number ( contentLength ) ) || Number ( contentLength ) < 0 ) {
+        throw new Error ( 'OnDemand Azure upload content length is required' );
+    }
+
+    const fetchImpl = resolveFetch ( fetchOption );
+    const { response } = await executeRequest ( {
+        fetchImpl,
+        url: buildAzureUploadUrl ( blobUrl, sasToken ),
+        timeoutMs,
+        includeResponse: true,
+        options: {
+            method: 'PUT',
+            headers: {
+                'Content-Type': contentType,
+                'Content-Length': String ( contentLength ),
+                'x-ms-blob-type': 'BlockBlob'
+            },
+            body,
+            ...( typeof body?.pipe === 'function' ? { duplex: 'half' } : {} )
+        }
+    } );
+
+    return {
+        status: response.status,
+        etag: response.headers?.get?.( 'etag' ) || null
+    };
+};
+
+exports.OnDemandRequestError = OnDemandRequestError;