hcloud-sdk 22.44.0 → 22.45.0

package/changelog.md

@@ -1,5 +1,6 @@
-## [22.44.0](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/compare/v22.43.0...v22.44.0) (2026-10-02)
+## [22.45.0](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/compare/v22.44.0...v22.45.0) (2026-10-02)
 
 ### Features
 
-* add SSO provider retrieval for domains ([e1cc605](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/commit/e1cc605f865f7ce53898ca5eea915c5b8a9b70cd))
+* add HCloud.clone() to adjust a shared instance for a single call ([c9c49d5](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/commit/c9c49d5ef68f777a747942c15f4039feec27ed26))
+* back off NATS reconnects on authorization errors and allow aborting them ([1680eb7](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/commit/1680eb756f569cf7dc5ce040e46ee44240c308a1))

package/lib/Hcloud.d.ts

@@ -46,6 +46,14 @@ export declare class HCloud {
     private refreshToken;
     private refreshPromise;
     constructor(options: Options);
+    /**
+     * Returns an independent copy of this instance that shares its NATS connection.
+     * Options (e.g. server) and default request headers (e.g. auth token, correlationID) are copied, so calling
+     * setServer, setAuthToken, setCorrelationId, ... on the copy never affects this instance and vice versa.
+     * Use it whenever a long-lived, shared instance has to be adjusted for a single call.
+     * A refresh token or a custom axios instance set via setAxios is not carried over.
+     */
+    clone(): HCloud;
     /**
      * Sets the server url that the SDK shall do a request to.
      */

package/lib/Hcloud.js

@@ -164,6 +164,19 @@ class HCloud {
             return Promise.reject(error);
         }));
     }
+    /**
+     * Returns an independent copy of this instance that shares its NATS connection.
+     * Options (e.g. server) and default request headers (e.g. auth token, correlationID) are copied, so calling
+     * setServer, setAuthToken, setCorrelationId, ... on the copy never affects this instance and vice versa.
+     * Use it whenever a long-lived, shared instance has to be adjusted for a single call.
+     * A refresh token or a custom axios instance set via setAxios is not carried over.
+     */
+    clone() {
+        const copy = new HCloud(Object.assign({}, this.options));
+        copy.axios.defaults.headers.common = Object.assign({}, this.axios.defaults.headers.common);
+        copy._Nats = this.Nats;
+        return copy;
+    }
     /**
      * Sets the server url that the SDK shall do a request to.
      */

package/lib/service/nats/index.d.ts

@@ -1,6 +1,15 @@
 import { Msg, NatsConnection, PublishOptions, RequestOptions, Subscription, SubscriptionOptions } from "nats";
 import Base from "../../Base";
 import { NatsCallback, NatsMessageType, NatsObject, NatsObjectType, RawMsg } from "../../interfaces/nats";
+/**
+ * Called on every consecutive 'Authorization Violation' the NATS server answers a (re)connect with.
+ * Return false to close the connection and stop reconnecting (e.g. once the token turned out to be invalid),
+ * true to keep reconnecting with an increasing delay.
+ *
+ * Note: the server reports a failing or unreachable auth service with the same error, so only give up once
+ * the credentials are known to be invalid, e.g. because an HTTP request with the same token is rejected with 401.
+ */
+export type NatsAuthErrorHandler = (consecutiveAuthErrors: number) => boolean | Promise<boolean>;
 /**
  * Connect and authenticate using email and jwt
  *
@@ -16,6 +25,7 @@ type ConnectParamsJwt = {
     servers?: string[];
     debug?: boolean;
     forceWebsocket?: boolean;
+    onAuthError?: NatsAuthErrorHandler;
 };
 /**
  * Connect and authenticate using username and password
@@ -33,12 +43,23 @@ type ConnectParamsPassword = {
     servers?: string[];
     debug?: boolean;
     forceWebsocket?: boolean;
+    onAuthError?: NatsAuthErrorHandler;
 };
+/**
+ * Delay before the next reconnect attempt: the usual 2s, doubled for every consecutive authorization error
+ * (4s, 8s, ... up to 5min), so clients with rejected credentials don't hammer the server (and its auth callout).
+ */
+export declare function reconnectDelay(consecutiveAuthErrors: number): number;
 declare class Nats extends Base {
     private natsConnection;
     private subMap;
     private connection;
     connect(params: ConnectParamsJwt | ConnectParamsPassword): Promise<NatsConnection>;
+    /**
+     * Counts consecutive authorization errors of a connection (reset by a successful reconnect) and closes it
+     * once onAuthError asks to stop.
+     */
+    private watchAuthErrors;
     getConnection: () => NatsConnection | undefined;
     sub(subject: string, callback: NatsCallback, options?: SubscriptionOptions): Promise<Subscription>;
     unsub(subject: string | Subscription): void;

package/lib/service/nats/index.js

@@ -8,14 +8,33 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconnectDelay = reconnectDelay;
 const nats_1 = require("nats");
 const nats_ws_1 = require("nats.ws");
 const Base_1 = __importDefault(require("../../Base"));
 const isBrowser = typeof window !== "undefined";
+const RECONNECT_TIME_WAIT_MS = 2 * 1000;
+const RECONNECT_JITTER_MS = 1000;
+const AUTH_ERROR_RECONNECT_MAX_WAIT_MS = 5 * 60 * 1000;
+/**
+ * Delay before the next reconnect attempt: the usual 2s, doubled for every consecutive authorization error
+ * (4s, 8s, ... up to 5min), so clients with rejected credentials don't hammer the server (and its auth callout).
+ */
+function reconnectDelay(consecutiveAuthErrors) {
+    const wait = Math.min(RECONNECT_TIME_WAIT_MS * Math.pow(2, consecutiveAuthErrors), AUTH_ERROR_RECONNECT_MAX_WAIT_MS);
+    return wait + Math.floor(Math.random() * RECONNECT_JITTER_MS);
+}
 class Nats extends Base_1.default {
     constructor() {
         super(...arguments);
@@ -47,16 +66,21 @@ class Nats extends Base_1.default {
                     params.servers = ["hcloud-nats-0.hcloud-nats:4222", "hcloud-nats-1.hcloud-nats:4222", "hcloud-nats-2.hcloud-nats:4222"];
                 }
             }
+            // Authorization errors are not fatal on their own (the server also reports a failing auth service that way),
+            // so keep reconnecting, but back off and let onAuthError decide when to give up.
+            const authErrors = { consecutive: 0 };
             this.natsConnection = yield this.connection({
                 name: params.name,
                 debug: params.debug,
                 maxReconnectAttempts: -1,
                 ignoreAuthErrorAbort: true,
+                reconnectDelayHandler: () => reconnectDelay(authErrors.consecutive),
                 servers: params.servers,
                 pingInterval: 55 * 1000, //ping every 55 seconds
                 user: params.email !== undefined ? params.email : params.username,
                 pass: params.jwt !== undefined ? params.jwt : params.password,
             });
+            void this.watchAuthErrors(this.natsConnection, authErrors, params.onAuthError);
             for (const entry of previousSubs) {
                 yield this.sub(entry.subject, (err, data, msg) => {
                     var _a, _b;
@@ -70,6 +94,47 @@ class Nats extends Base_1.default {
             return this.natsConnection;
         });
     }
+    /**
+     * Counts consecutive authorization errors of a connection (reset by a successful reconnect) and closes it
+     * once onAuthError asks to stop.
+     */
+    watchAuthErrors(connection, authErrors, onAuthError) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, e_1, _b, _c;
+            var _d, _e, _f;
+            try {
+                try {
+                    for (var _g = true, _h = __asyncValues(connection.status()), _j; _j = yield _h.next(), _a = _j.done, !_a; _g = true) {
+                        _c = _j.value;
+                        _g = false;
+                        const status = _c;
+                        if (status.type === nats_1.Events.Reconnect) {
+                            authErrors.consecutive = 0;
+                        }
+                        else if (status.type === nats_1.Events.Error && status.data === nats_1.ErrorCode.AuthorizationViolation) {
+                            authErrors.consecutive++;
+                            (_d = this.logger) === null || _d === void 0 ? void 0 : _d.warn(`NATS authorization failed (${authErrors.consecutive} in a row), retrying in about ${reconnectDelay(authErrors.consecutive) / 1000}s`);
+                            if (onAuthError && !(yield onAuthError(authErrors.consecutive))) {
+                                (_e = this.logger) === null || _e === void 0 ? void 0 : _e.error("NATS authorization failed permanently, closing the connection");
+                                yield connection.close();
+                                return;
+                            }
+                        }
+                    }
+                }
+                catch (e_1_1) { e_1 = { error: e_1_1 }; }
+                finally {
+                    try {
+                        if (!_g && !_a && (_b = _h.return)) yield _b.call(_h);
+                    }
+                    finally { if (e_1) throw e_1.error; }
+                }
+            }
+            catch (err) {
+                (_f = this.logger) === null || _f === void 0 ? void 0 : _f.error(`Unable to watch NATS connection status: ${String(err)}`);
+            }
+        });
+    }
     sub(subject, callback, options) {
         return __awaiter(this, void 0, void 0, function* () {
             const delay = 500;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hcloud-sdk",
-  "version": "22.44.0",
+  "version": "22.45.0",
   "description": "hcloud platform sdk",
   "main": "index.js",
   "types": "index.d.ts",