Repository navigation
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Closing for now. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets a CLI that embeds
sandbox(likevercel sandbox) supply the auth headers for each API request, so a sender-constrained token such as a DPoP-bound one (RFC 9449) can be used. Without the new option nothing changes.Why
A DPoP-bound access token is rejected when it's sent as
Authorization: Bearer. It has to be sent asAuthorization: DPoP <token>with a newDPoPproof for every request, signed for that method and URL. Today every sandbox API request sendsBearer, so an embedding CLI with such a token can't use sandbox commands.Approach
Every SDK request from the CLI already goes through the CLI's
fetchWithUserAgent, which the SDK's retry wrapper calls once per attempt. So that's the one place to add the headers:createApp({ getAuthHeaders }): an optional(method, url) => Promise<headers>, set for the run and cleared after.fetchWithUserAgentcalls it for each attempt and replaces theAuthorizationheader with what it returns. Only requests that already carry the token are touched.inferScopefrom@vercel/sandbox/dist/authtakes an optionalfetch, and the CLI passesfetchWithUserAgent, so scope inference (/v2/user,/v2/teams, the default project) uses it too.Snapshot.getnow also goes throughfetchWithUserAgent, like the other clients.No SDK request API changes: the SDK keeps sending
Bearer, and the CLI swaps the header.Validation
client.test.tscases: the headers replaceBearer, a retried request (500, then 200) gets new headers for each attempt, and withoutgetAuthHeadersthe request still sendsBearer. The retry case fails without the change.infer-scope.test.tscase: the givenfetchreaches every API request.sandbox:tsc --noEmitclean, 230 tests pass.@vercel/sandbox:tsc --noEmitclean, auth tests pass (28).