thirdweb 5.57.0 → 5.57.1

package/src/utils/fetch.test.ts

@@ -52,6 +52,26 @@ describe("getClientFetch", () => {
     );
   });
 
+  it("should send a bearer token if secret key is a JWT", () => {
+    vi.spyOn(global, "fetch").mockResolvedValue(new Response());
+    const clientFetch = getClientFetch({
+      clientId: "test-client-id",
+      secretKey: "foo.bar.baz",
+    });
+    clientFetch("https://api.thirdweb.com/test");
+
+    expect(global.fetch).toHaveBeenCalledWith(
+      "https://api.thirdweb.com/test",
+      expect.objectContaining({
+        headers: expect.any(Headers),
+      }),
+    );
+
+    // biome-ignore lint/suspicious/noExplicitAny: `any` type ok for tests
+    const headers = (global.fetch as any).mock.calls[0][1].headers;
+    expect(headers.get("authorization")).toBe("Bearer foo.bar.baz");
+  });
+
   it("should abort the request after timeout", async () => {
     vi.useFakeTimers();
     const abortSpy = vi.spyOn(AbortController.prototype, "abort");

package/src/utils/fetch.ts

@@ -7,6 +7,7 @@ import {
   detectOS,
   detectPlatform,
 } from "./detect-platform.js";
+import { isJWT } from "./jwt/is-jwt.js";
 
 const DEFAULT_REQUEST_TIMEOUT = 60000;
 
@@ -31,7 +32,11 @@ export function getClientFetch(client: ThirdwebClient, ecosystem?: Ecosystem) {
       if (!headers) {
         headers = new Headers();
       }
-      const authToken = getTWAuthToken();
+      const authToken =
+        client.secretKey && isJWT(client.secretKey)
+          ? client.secretKey
+          : undefined;
+
       // if we have an auth token set, use that (thirdweb.com/dashboard sets this for the user)
       // pay urls should never send the auth token, because we always want the "developer" to be the one making the request, not the "end user"
       if (authToken && !isPayUrl(url)) {
@@ -185,16 +190,3 @@ function parseOs(os: OperatingSystem | NodeJS.Platform) {
       return osLowerCased.replace(/\s/gi, "_");
   }
 }
-
-function getTWAuthToken(): string | null {
-  if (
-    typeof globalThis !== "undefined" &&
-    "TW_AUTH_TOKEN" in globalThis &&
-    // biome-ignore lint/suspicious/noExplicitAny: get around globalThis typing
-    typeof (globalThis as any).TW_AUTH_TOKEN === "string"
-  ) {
-    // biome-ignore lint/suspicious/noExplicitAny: get around globalThis typing
-    return (globalThis as any).TW_AUTH_TOKEN as string;
-  }
-  return null;
-}

package/src/utils/jwt/is-jwt.ts

@@ -0,0 +1,5 @@
+import type { JWTString } from "./types.js";
+
+export function isJWT(str: string): str is JWTString {
+  return str.split(".").length === 3;
+}

package/src/utils/jwt/types.ts

@@ -8,3 +8,5 @@ export type JWTPayload<Tctx = unknown> = {
   jti: string;
   ctx?: Tctx;
 };
+
+export type JWTString = `${string}.${string}.${string}`;

package/src/version.ts

@@ -1 +1 @@
-export const version = "5.57.0";
+export const version = "5.57.1";