tempest-react-sdk 0.80.0 → 0.82.0

package/dist/sw/background-sync.js

@@ -1,11 +1,12 @@
 import { isDevBuild as e } from "../utils/dev-mode.js";
-import { DEFAULT_CREDENTIAL_HEADERS as t, credentialHeaderSet as n } from "./credential-headers.js";
+import { isTrustedCredentialTarget as t } from "../http/credential-scope.js";
+import { DEFAULT_CREDENTIAL_HEADERS as n, credentialHeaderSet as r } from "./credential-headers.js";
 //#region src/sw/background-sync.ts
-function r() {
+function i() {
 	return globalThis;
 }
-var i = "tempest-bg-sync", a = 2, o = "requests", s = "meta", c = "epoch", l = "tempest:bg-sync-credentials", u = 3e3, d = u * 2;
-function f(e, t) {
+var a = "tempest-bg-sync", o = 2, s = "requests", c = "meta", l = "epoch", u = "tempest:bg-sync-credentials", d = 3e3, f = d * 2;
+function p(e, t) {
 	let n = [], r = [];
 	for (let [i, a] of e) t.has(i.toLowerCase()) ? r.push(i.toLowerCase()) : n.push([i, a]);
 	return {
@@ -13,12 +14,12 @@ function f(e, t) {
 		stripped: r
 	};
 }
-function p(e, t) {
+function m(e, t) {
 	let n = e.openCursor();
 	n.onsuccess = () => {
 		let e = n.result;
 		if (!e) return;
-		let r = e.value, { kept: i, stripped: a } = f(r.headers, t);
+		let r = e.value, { kept: i, stripped: a } = p(r.headers, t);
 		e.update({
 			...r,
 			headers: i,
@@ -27,64 +28,64 @@ function p(e, t) {
 		}), e.continue();
 	};
 }
-function m(e, t = n()) {
+function h(e, t = r()) {
 	return new Promise((n, r) => {
-		let i = indexedDB.open(e, a);
+		let i = indexedDB.open(e, o);
 		i.onupgradeneeded = (e) => {
 			let n = i.result;
-			n.objectStoreNames.contains(o) ? e.oldVersion < 2 && i.transaction && p(i.transaction.objectStore(o), t) : n.createObjectStore(o, {
+			n.objectStoreNames.contains(s) ? e.oldVersion < 2 && i.transaction && m(i.transaction.objectStore(s), t) : n.createObjectStore(s, {
 				keyPath: "id",
 				autoIncrement: !0
-			}), n.objectStoreNames.contains(s) || n.createObjectStore(s);
+			}), n.objectStoreNames.contains(c) || n.createObjectStore(c);
 		}, i.onsuccess = () => {
 			let e = i.result;
 			e.onversionchange = () => e.close(), n(e);
 		}, i.onerror = () => r(i.error);
 	});
 }
-function h(e) {
+function g(e) {
 	return new Promise((t, n) => {
 		e.oncomplete = () => t(), e.onerror = () => n(e.error), e.onabort = () => n(e.error);
 	});
 }
-async function g(e, t) {
-	let n = await m(e, t), r = n.transaction(s, "readonly"), i = r.objectStore(s).get(c);
-	return await h(r), n.close(), i.result ?? 0;
+async function _(e, t) {
+	let n = await h(e, t), r = n.transaction(c, "readonly"), i = r.objectStore(c).get(l);
+	return await g(r), n.close(), i.result ?? 0;
 }
-async function _(e, t, n, r) {
-	let i = await m(e, r), a = i.transaction([o, s], "readwrite"), l, u = a.objectStore(s).get(c);
+async function v(e, t, n, r) {
+	let i = await h(e, r), a = i.transaction([s, c], "readwrite"), o, u = a.objectStore(c).get(l);
 	return u.onsuccess = () => {
 		if ((u.result ?? 0) !== n) return;
-		let e = a.objectStore(o).add(t);
+		let e = a.objectStore(s).add(t);
 		e.onsuccess = () => {
-			l = e.result;
+			o = e.result;
 		};
-	}, await h(a), i.close(), l;
+	}, await g(a), i.close(), o;
 }
-async function v(e, t, n, r) {
-	let i = await m(e), a = i.transaction(o, "readwrite"), s = a.objectStore(o), c = s.get(t);
+async function y(e, t, n, r) {
+	let i = await h(e), a = i.transaction(s, "readwrite"), o = a.objectStore(s), c = o.get(t);
 	c.onsuccess = () => {
 		let e = c.result;
-		e && (e.ownerState = n, n === "bound" && (e.owner = r ?? null), s.put(e));
-	}, await h(a), i.close();
+		e && (e.ownerState = n, n === "bound" && (e.owner = r ?? null), o.put(e));
+	}, await g(a), i.close();
 }
-async function y(e, t) {
-	let n = await m(e, t), r = n.transaction(o, "readonly"), i = await new Promise((e, t) => {
-		let n = r.objectStore(o).getAll();
+async function b(e, t) {
+	let n = await h(e, t), r = n.transaction(s, "readonly"), i = await new Promise((e, t) => {
+		let n = r.objectStore(s).getAll();
 		n.onsuccess = () => e(n.result), n.onerror = () => t(n.error);
 	});
 	return n.close(), i;
 }
-async function b(e, t) {
-	let n = await m(e), r = n.transaction(o, "readonly"), i = r.objectStore(o).count(t);
-	return await h(r), n.close(), i.result > 0;
-}
 async function x(e, t) {
-	let n = await m(e), r = n.transaction(o, "readwrite");
-	r.objectStore(o).delete(t), await h(r), n.close();
+	let n = await h(e), r = n.transaction(s, "readonly"), i = r.objectStore(s).count(t);
+	return await g(r), n.close(), i.result > 0;
 }
-async function S(e, t, n, r) {
-	let i = await e.clone().arrayBuffer(), { kept: a, stripped: o } = f(e.headers.entries(), n);
+async function S(e, t) {
+	let n = await h(e), r = n.transaction(s, "readwrite");
+	r.objectStore(s).delete(t), await g(r), n.close();
+}
+async function C(e, t, n, r) {
+	let i = await e.clone().arrayBuffer(), { kept: a, stripped: o } = p(e.headers.entries(), n);
 	return {
 		url: e.url,
 		method: e.method,
@@ -96,8 +97,8 @@ async function S(e, t, n, r) {
 		ownerState: r
 	};
 }
-function C(e, t) {
-	let { kept: n, stripped: r } = f(e.headers, t);
+function w(e, t) {
+	let { kept: n, stripped: r } = p(e.headers, t);
 	return {
 		request: new Request(e.url, {
 			method: e.method,
@@ -108,10 +109,10 @@ function C(e, t) {
 		strippedHeaders: [.../* @__PURE__ */ new Set([...e.strippedHeaders ?? [], ...r])]
 	};
 }
-async function w(e, t, n) {
+async function T(e, t, n) {
 	let r = new MessageChannel(), i = await Promise.race([new Promise((n) => {
 		r.port1.onmessage = (e) => n(e.data), e.postMessage({
-			type: l,
+			type: u,
 			...t
 		}, [r.port2]);
 	}), n.then(() => void 0)]);
@@ -123,50 +124,54 @@ async function w(e, t, n) {
 		owner: s ? o : null
 	};
 }
-function T() {
+function E() {
 	let e;
 	return {
 		promise: new Promise((t) => {
-			e = setTimeout(t, u);
+			e = setTimeout(t, d);
 		}),
 		cancel: () => clearTimeout(e)
 	};
 }
-async function E(e, t) {
+async function D(e, t) {
 	let n = await e.clients?.matchAll({ type: "window" }) ?? [];
 	if (n.length === 0) return [];
-	let r = T(), i = await Promise.all(n.map((e) => w(e, t, r.promise)));
+	let r = E(), i = await Promise.all(n.map((e) => T(e, t, r.promise)));
 	return r.cancel(), i.filter((e) => e !== void 0);
 }
-function D(t) {
-	let n = /* @__PURE__ */ new Map(), r = !1;
+function O(t) {
+	let n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Set(), i = !1;
 	return {
 		ask(e) {
 			let r = `${e.method} ${e.url}`, i = n.get(r);
-			return i || (i = E(t, {
+			return i || (i = D(t, {
 				url: e.url,
 				method: e.method,
 				phase: "replay"
 			}), n.set(r, i)), i;
 		},
 		warnNoAnswer() {
-			!r && e() && (r = !0, console.warn("[tempest-react-sdk/sw] background-sync: a queued request needs an open page to confirm who is signed in or to supply the current credentials, and no open page answered. Call provideBackgroundSyncCredentials() in the page; the entry stays pending."));
+			!i && e() && (i = !0, console.warn("[tempest-react-sdk/sw] background-sync: a queued request needs an open page to confirm who is signed in or to supply the current credentials, and no open page answered. Call provideBackgroundSyncCredentials() in the page; the entry stays pending."));
+		},
+		warnOutOfScope(t) {
+			let n = new URL(t).origin;
+			!r.has(n) && e() && (r.add(n), console.warn(`[tempest-react-sdk/sw] background-sync: dropped a credentialed request to ${n}; list it in trustedOrigins to replay it.`));
 		}
 	};
 }
-function O(e, t) {
+function k(e, t) {
 	switch (t.ownerState) {
 		case "bound": return e.find((e) => e.hasPrincipal && e.owner === t.owner);
 		case "unknown": return e.every((e) => !e.hasPrincipal) ? e[0] : void 0;
 		case "unbound": return e.find((e) => !e.hasPrincipal) ?? e[0];
 	}
 }
-async function k(e, t, n, r) {
+async function A(e, t, n, r) {
 	let i = n.strippedHeaders.length > 0, a = n.ownerState === "unbound" || r === "lenient" && n.ownerState === "unknown";
 	if (!i && a) return t;
 	let o = await e.ask(t);
 	if (o.length === 0) throw e.warnNoAnswer(), Error("background-sync: no client answered");
-	let s = O(o, n);
+	let s = k(o, n);
 	if (!s) return null;
 	if (!i) return t;
 	if (s.headers === null) return null;
@@ -176,118 +181,133 @@ async function k(e, t, n, r) {
 	for (let e of n.strippedHeaders) l.set(e, c.get(e));
 	return new Request(t, { headers: l });
 }
-async function A(e, t) {
-	let { sw: n, name: r, maxRetentionMs: i, credentialHeaders: a, beforeReplay: o, ownerPolicy: s } = e, c = D(n), l = o ?? ((e, t) => k(c, e, t, s)), u = await y(r, a), f = 0;
-	for (let e of u) {
+function j(e, t) {
+	return [...e.headers.keys()].some((e) => t.has(e));
+}
+async function M(e, t) {
+	let { sw: n, name: r, maxRetentionMs: i, credentialHeaders: a, beforeReplay: o, ownerPolicy: s, inCredentialScope: c } = e, l = O(n), u = o ?? ((e, t) => A(l, e, t, s)), d = await b(r, a), p = 0;
+	for (let e of d) {
 		if (e.id === void 0) continue;
 		if (t - e.timestamp > i) {
-			await x(r, e.id);
+			await S(r, e.id);
 			continue;
 		}
 		let n = e.ownerState ?? "unknown";
-		if (n === "pending" && t - e.timestamp < d) {
-			f += 1;
+		if (n === "pending" && t - e.timestamp < f) {
+			p += 1;
 			continue;
 		}
 		let o = n === "pending" ? "unknown" : n;
 		try {
-			let { request: t, strippedHeaders: n } = C(e, a), i = await l(t, {
+			let { request: t, strippedHeaders: n } = w(e, a);
+			if (n.length > 0 && !c(t.url)) {
+				l.warnOutOfScope(t.url), await S(r, e.id);
+				continue;
+			}
+			let i = await u(t, {
 				queuedAt: e.timestamp,
 				strippedHeaders: n,
 				ownerState: o,
 				owner: o === "bound" ? e.owner ?? null : void 0
 			});
-			if (!await b(r, e.id)) continue;
+			if (!await x(r, e.id)) continue;
 			if (i === null) {
-				await x(r, e.id);
+				await S(r, e.id);
+				continue;
+			}
+			if (j(i, a) && !c(i.url)) {
+				l.warnOutOfScope(i.url), await S(r, e.id);
 				continue;
 			}
 			let s = await fetch(i);
-			s.ok || s.status >= 400 && s.status < 500 ? await x(r, e.id) : f += 1;
+			s.ok || s.status >= 400 && s.status < 500 ? await S(r, e.id) : p += 1;
 		} catch {
-			f += 1;
+			p += 1;
 		}
 	}
-	if (f > 0) throw Error(`background-sync: ${f} request(s) still pending`);
+	if (p > 0) throw Error(`background-sync: ${p} request(s) still pending`);
 }
-var j = /* @__PURE__ */ new Map();
-function M(e) {
-	let t = j.get(e.name);
+var N = /* @__PURE__ */ new Map();
+function P(e) {
+	let t = N.get(e.name);
 	if (t) return t;
-	let n = A(e, Date.now()).finally(() => {
-		j.delete(e.name);
+	let n = M(e, Date.now()).finally(() => {
+		N.delete(e.name);
 	});
-	return j.set(e.name, n), n;
+	return N.set(e.name, n), n;
 }
-function N(e, t, n) {
+function F(e, t, n) {
 	return e ? typeof e == "function" ? e(t, n) : e.test(t.href) : !0;
 }
-async function P(e, t, n, r) {
-	let i = T(), a = await w(n, {
+async function I(e, t, n, r) {
+	let i = E(), a = await T(n, {
 		url: r.url,
 		method: r.method,
 		phase: "enqueue"
 	}, i.promise);
-	i.cancel(), await v(e, t, a ? a.hasPrincipal ? "bound" : "unbound" : "unknown", a?.owner);
+	i.cancel(), await y(e, t, a ? a.hasPrincipal ? "bound" : "unbound" : "unknown", a?.owner);
 }
-function F(e = {}) {
-	let a = r(), { match: o, queueName: s = i, maxRetentionMinutes: c = 1440, periodicSyncTag: l = `${e.queueName ?? i}-periodic`, credentialHeaders: u = t, beforeReplay: d, ownerPolicy: f = "strict" } = e, p = n(u), m = {
-		sw: a,
-		name: s,
-		maxRetentionMs: c * 60 * 1e3,
-		credentialHeaders: p,
-		beforeReplay: d,
-		ownerPolicy: f
+function L(e = {}) {
+	let o = i(), { match: s, queueName: c = a, maxRetentionMinutes: l = 1440, periodicSyncTag: u = `${e.queueName ?? a}-periodic`, credentialHeaders: d = n, beforeReplay: f, ownerPolicy: p = "strict", trustedOrigins: m = [] } = e, h = r(d), g = globalThis.location?.href ?? "", y = {
+		sw: o,
+		name: c,
+		maxRetentionMs: l * 60 * 1e3,
+		credentialHeaders: h,
+		beforeReplay: f,
+		ownerPolicy: p,
+		inCredentialScope: (e) => t(e, g, m)
 	};
-	a.addEventListener("fetch", (e) => {
+	o.addEventListener("fetch", (e) => {
 		let t = e.request;
 		if (t.method === "GET" || t.method === "HEAD") return;
 		let n = new URL(t.url);
-		if (!N(o, n, t)) return;
-		let r = g(s, p);
+		if (!F(s, n, t)) return;
+		let r = _(c, h);
 		r.catch(() => void 0);
-		let i = fetch(t.clone()), c = i.then(() => void 0, async () => {
-			let n = e.clientId ? await a.clients?.get(e.clientId) : void 0, i = await S(t, Date.now(), p, n ? "pending" : "unknown"), o = await _(s, i, await r, p);
-			if (o !== void 0) {
+		let i = fetch(t.clone()), a = i.then(() => void 0, async () => {
+			let n = e.clientId ? await o.clients?.get(e.clientId) : void 0, i = await C(t, Date.now(), h, n ? "pending" : "unknown"), a = await v(c, i, await r, h);
+			if (a !== void 0) {
 				try {
-					await a.registration.sync?.register(s);
+					await o.registration.sync?.register(c);
 				} catch {}
 				return n ? {
-					id: o,
+					id: a,
 					issuer: n
 				} : void 0;
 			}
 		});
 		e.respondWith(i.catch(async (e) => {
-			throw await c, e;
-		})), e.waitUntil(c.then((e) => e ? P(s, e.id, e.issuer, t) : void 0).catch(() => void 0));
-	}), a.addEventListener("sync", (e) => {
-		e.tag === s && e.waitUntil(M(m));
-	}), a.addEventListener("periodicsync", (e) => {
-		e.tag === l && e.waitUntil(M(m).catch(() => void 0));
-	}), a.addEventListener("fetch", (e) => {
-		a.registration.sync || e.request.method === "GET" && e.waitUntil(M(m).catch(() => void 0));
+			throw await a, e;
+		})), e.waitUntil(a.then((e) => e ? I(c, e.id, e.issuer, t) : void 0).catch(() => void 0));
+	}), o.addEventListener("sync", (e) => {
+		e.tag === c && e.waitUntil(P(y));
+	}), o.addEventListener("periodicsync", (e) => {
+		e.tag === u && e.waitUntil(P(y).catch(() => void 0));
+	}), o.addEventListener("fetch", (e) => {
+		o.registration.sync || e.request.method === "GET" && e.waitUntil(P(y).catch(() => void 0));
 	});
 }
-async function I(e = i) {
+async function R(e = a) {
 	if (typeof indexedDB > "u") return !1;
-	let t = await m(e), n = t.transaction([o, s], "readwrite");
-	n.objectStore(o).clear();
-	let r = n.objectStore(s), a = r.get(c);
-	return a.onsuccess = () => {
-		r.put((a.result ?? 0) + 1, c);
-	}, await h(n), t.close(), !0;
+	let t = await h(e), n = t.transaction([s, c], "readwrite");
+	n.objectStore(s).clear();
+	let r = n.objectStore(c), i = r.get(l);
+	return i.onsuccess = () => {
+		r.put((i.result ?? 0) + 1, l);
+	}, await g(n), t.close(), !0;
 }
-async function L(e) {
+async function z(e) {
 	if (e == null || e === "") return null;
 	let t = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`tempest-bg-sync:${e}`));
 	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("");
 }
-function R(e, t = {}) {
+function B(t, n = {}) {
 	if (typeof navigator > "u" || !navigator.serviceWorker) return () => void 0;
-	let n = navigator.serviceWorker, { getPrincipal: r } = t, i = (t) => {
-		let n = t.data, i = t.ports[0];
-		if (n?.type !== "tempest:bg-sync-credentials" || !i) return;
+	let r = navigator.serviceWorker, { getPrincipal: i } = n;
+	!i && e() && console.warn("[tempest-react-sdk/sw] provideBackgroundSyncCredentials() without `getPrincipal`: queued mutations are not bound to the account that made them and replay with whichever session answers next, unless clearSessionData() runs on logout. Pass { getPrincipal: () => currentUserId } to bind them.");
+	let a = (e) => {
+		let n = e.data, r = e.ports[0];
+		if (n?.type !== "tempest:bg-sync-credentials" || !r) return;
 		let a = {
 			url: String(n.url),
 			method: String(n.method),
@@ -295,16 +315,16 @@ function R(e, t = {}) {
 		};
 		(async () => {
 			try {
-				let t = { headers: a.phase === "enqueue" ? null : await e(a) };
-				r && (t.owner = await L(await r())), i.postMessage(t);
+				let e = { headers: a.phase === "enqueue" ? null : await t(a) };
+				i && (e.owner = await z(await i())), r.postMessage(e);
 			} catch {
-				i.postMessage({ error: !0 });
+				r.postMessage({ error: !0 });
 			}
 		})();
 	};
-	return n.addEventListener("message", i), () => n.removeEventListener("message", i);
+	return r.addEventListener("message", a), () => r.removeEventListener("message", a);
 }
 //#endregion
-export { l as BACKGROUND_SYNC_CREDENTIALS_MESSAGE, I as clearBackgroundSyncQueue, F as installBackgroundSync, R as provideBackgroundSyncCredentials };
+export { u as BACKGROUND_SYNC_CREDENTIALS_MESSAGE, R as clearBackgroundSyncQueue, L as installBackgroundSync, B as provideBackgroundSyncCredentials };
 
 //# sourceMappingURL=background-sync.js.map