fix(client): send authorizedFetch calls under the adapter mount as adapter calls

An application reaching the adapter's own routes through authorizedFetch
(its session list, a passthrough it adds) got no transport header, so in
bearer transport the adapter answered in cookie mode and refused the call.
A URL under the mount now takes the same road as the client's own calls:
the header, the route's identity, and its effect on the held tokens.

Author: Bccorb

packages/client/README.md

@@ -56,7 +56,10 @@ mirroring the server adapter's own map.
 `client.authorizedFetch(input, init)` is a fetch for the application's own API
 that carries the session the same way: cookies in cookie transport, the access
 token with one refresh-and-retry on a 401 in bearer transport. It never reads
-tokens out of the response, since that body is the application's.
+tokens out of the response, since that body is the application's. A URL under
+the adapter's own mount (`/auth/sessions`, a passthrough the adapter adds) is
+sent the way the client's own calls are, transport header included, so an
+application can reach every adapter route through the one fetch.
 
 ## Ports
 

packages/client/src/transport.ts

@@ -347,29 +347,40 @@ export function createTransport(options: TransportOptions): Transport {
     return response;
   }
 
+  const mount = `${buildUrl(options.apiHost, basePath, '')}/`;
+
+  const fetchUnderMount: FetchWithAuth = async (input, init) => {
+    const path = normalizePath(input);
+    const rule = resolveRouteRule(path);
+
+    const response = await sendWithRefresh(
+      buildUrl(options.apiHost, basePath, path),
+      init,
+      rule.identity,
+      true
+    );
+
+    if (response.ok && rule.effect) {
+      await applyEffect(rule.effect, response);
+    }
+
+    return response;
+  };
+
   return {
     mode,
     clearTokens,
-    fetch: async (input, init) => {
-      const path = normalizePath(input);
-      const rule = resolveRouteRule(path);
-
-      const response = await sendWithRefresh(
-        buildUrl(options.apiHost, basePath, path),
-        init,
-        rule.identity,
-        true
-      );
-
-      if (response.ok && rule.effect) {
-        await applyEffect(rule.effect, response);
-      }
-
-      return response;
-    },
+    fetch: fetchUnderMount,
     // The transport header is the adapter's; an application's own API only
-    // needs the bearer token, which requireAuth reads.
-    authorizedFetch: (input, init) =>
-      sendWithRefresh(String(input), init, 'access', false),
+    // needs the bearer token, which requireAuth reads. A URL under the
+    // adapter's own mount (its session list, a passthrough it adds) is the
+    // adapter's, though, and without the header it would answer in cookie
+    // mode, so it takes the same road as the client's own calls.
+    authorizedFetch: (input, init) => {
+      const url = String(input);
+      return url.startsWith(mount)
+        ? fetchUnderMount(url.slice(mount.length - 1), init)
+        : sendWithRefresh(url, init, 'access', false);
+    },
   };
 }

packages/client/tests/transport.node.test.ts

@@ -457,6 +457,23 @@ describe('bearer transport', () => {
     });
   });
 
+  it('authorizedFetch treats a URL under the adapter mount as an adapter call', async () => {
+    const storage = createMemoryTokenStorage();
+    await storage.set({ accessToken: 'access-1', refreshToken: 'refresh-1' });
+    const { calls, fetchImpl } = scriptedFetch(() => jsonResponse(200, { sessions: [] }));
+
+    const response = await bearer(fetchImpl, storage).authorizedFetch(`${API}/auth/sessions`, {
+      method: 'GET',
+    });
+
+    expect(response.status).toBe(200);
+    expect(calls[0].url).toBe(`${API}/auth/sessions`);
+    expect(headersOf(calls[0])).toEqual({
+      Authorization: 'Bearer access-1',
+      [AUTH_TRANSPORT_HEADER]: 'bearer',
+    });
+  });
+
   it('authorizedFetch refreshes once on a 401 and retries', async () => {
     const storage = createMemoryTokenStorage();
     await storage.set({ accessToken: 'access-old', refreshToken: 'refresh-old' });

packages/react-native/README.md

@@ -91,7 +91,8 @@ function SignIn() {
 ```
 
 `useAuthorizedFetch()` is a fetch for your own API that carries the access
-token and refreshes it once on a 401; a path resolves on `apiHost`:
+token and refreshes it once on a 401; a path resolves on `apiHost`, and a path
+under the adapter's mount (`/auth/sessions`) is sent as an adapter call:
 
 ```ts
 const authorizedFetch = useAuthorizedFetch();