fix(module-services): preserve caller headers on App State wipe, fix TSDoc example

- me.delete.ts / admin-app.delete.ts: merge caller headers via Headers instead of\n  Object.assign shallow-replacing the headers object, so callers can add headers\n  without stripping the mandatory X-Confirm-Wipe header\n- client.ts / changeset: fix TSDoc/example importing HttpClient from the wrong\n  path and constructing it with an unsupported { baseUri } argument\n- client.ts: remove inaccurate "defaults to 'json'" claim on @template TMethod

Author: odinr

.changeset/module-services_add-app-state-client.md

@@ -8,9 +8,9 @@ The client follows the same versioned method pattern as `bookmarks`/`context`/`n
 
 ```typescript
 import { AppStateApiClient } from '@equinor/fusion-framework-module-services/app-state';
-import { HttpClient } from '@equinor/fusion-framework-module-http';
+import { HttpClient } from '@equinor/fusion-framework-module-http/client';
 
-const httpClient = new HttpClient({ baseUri: 'https://app-state-api.example.com/' });
+const httpClient = new HttpClient('https://app-state-api.example.com/');
 const client = new AppStateApiClient(httpClient, 'json');
 
 const apps = await client.listMyApps('v1');

packages/modules/services/src/app-state/client.ts

@@ -72,16 +72,16 @@ import {
  * @example
  * ```typescript
  * import { AppStateApiClient } from '@equinor/fusion-framework-module-services/app-state';
- * import { HttpClient } from '@equinor/fusion-framework-module-http';
+ * import { HttpClient } from '@equinor/fusion-framework-module-http/client';
  *
- * const httpClient = new HttpClient({ baseUri: 'https://my-app-state-api.com/' });
+ * const httpClient = new HttpClient('https://my-app-state-api.com/');
  * const client = new AppStateApiClient(httpClient, 'json');
  *
  * const apps = await client.listMyApps('v1');
  * await client.wipeMyAppState('v1', { appKey: 'my-app' });
  * ```
  *
- * @template TMethod - The client method to use for the request, defaults to 'json'.
+ * @template TMethod - The client method to use for the request.
  * @template TClient - The HTTP client to use for executing the request.
  */
 export class AppStateApiClient<

packages/modules/services/src/app-state/endpoints/admin-app.delete.ts

@@ -56,14 +56,15 @@ const generateRequestParameters = <TResult, TVersion extends AvailableVersions>(
   // Select the response schema that matches the requested API version.
   switch (version) {
     case ApiVersion.v1: {
-      // The API requires an explicit opt-in header before it will wipe every user's state for the app.
       const baseInit: FetchRequestInit<ApiResponse<ApiVersion.v1>, JsonRequest> = {
         method: 'DELETE',
-        headers: { 'X-Confirm-Wipe': 'true' },
         selector: schemaSelector(ApiResponseSchema[version]),
       };
-      // Merge caller overrides on top of the generated version-specific defaults.
-      return Object.assign({}, baseInit, init);
+      // Preserve caller headers, but force the API's required confirmation header last so it can't be stripped.
+      const headers = new Headers(init?.headers);
+      headers.set('X-Confirm-Wipe', 'true');
+      // Merge caller overrides on top of the generated defaults, with the confirmation header applied last.
+      return Object.assign({}, baseInit, init, { headers });
     }
   }
   throw Error(`Unknown API version: ${version}`);

packages/modules/services/src/app-state/endpoints/me.delete.ts

@@ -49,14 +49,15 @@ const generateRequestParameters = <TResult, TVersion extends AvailableVersions>(
   // Select the response schema that matches the requested API version.
   switch (version) {
     case ApiVersion.v1: {
-      // The API requires an explicit opt-in header before it will perform a full GDPR erasure.
       const baseInit: FetchRequestInit<ApiResponse<ApiVersion.v1>, JsonRequest> = {
         method: 'DELETE',
-        headers: { 'X-Confirm-Wipe': 'true' },
         selector: schemaSelector(ApiResponseSchema[version]),
       };
-      // Merge caller overrides on top of the generated version-specific defaults.
-      return Object.assign({}, baseInit, init);
+      // Preserve caller headers, but force the API's required confirmation header last so it can't be stripped.
+      const headers = new Headers(init?.headers);
+      headers.set('X-Confirm-Wipe', 'true');
+      // Merge caller overrides on top of the generated defaults, with the confirmation header applied last.
+      return Object.assign({}, baseInit, init, { headers });
     }
   }
   throw Error(`Unknown API version: ${version}`);

packages/modules/services/tests/app-state.test.ts

@@ -65,11 +65,22 @@ describe('AppState', () => {
       expect(result).toMatchObject({ wiped: true });
       expect(httpClientWatcher).toHaveBeenCalledWith(
         `/persons/me?api-version=${ApiVersion.v1}`,
-        expect.objectContaining({
-          method: 'DELETE',
-          headers: { 'X-Confirm-Wipe': 'true' },
-        }),
+        expect.objectContaining({ method: 'DELETE' }),
       );
+      const [, init] = httpClientWatcher.mock.calls.at(-1) ?? [];
+      expect(new Headers(init?.headers).get('X-Confirm-Wipe')).toBe('true');
+    });
+
+    it('preserves caller headers without stripping the confirmation header', async () => {
+      const result = await appStateClient.wipeAllMyState('v1', {
+        headers: { 'X-Custom': 'yes' },
+      });
+
+      expect(result).toMatchObject({ wiped: true });
+      const [, init] = httpClientWatcher.mock.calls.at(-1) ?? [];
+      const headers = new Headers(init?.headers);
+      expect(headers.get('X-Custom')).toBe('yes');
+      expect(headers.get('X-Confirm-Wipe')).toBe('true');
     });
   });
 
@@ -118,22 +129,25 @@ describe('AppState', () => {
       expect(result).toMatchObject({ wiped: true });
       expect(httpClientWatcher).toHaveBeenCalledWith(
         `/admin/apps/my-app?api-version=${ApiVersion.v1}`,
-        expect.objectContaining({
-          method: 'DELETE',
-          headers: { 'X-Confirm-Wipe': 'true' },
-        }),
+        expect.objectContaining({ method: 'DELETE' }),
       );
+      const [, init] = httpClientWatcher.mock.calls.at(-1) ?? [];
+      expect(new Headers(init?.headers).get('X-Confirm-Wipe')).toBe('true');
     });
 
-    it('rejects when the API rejects a missing confirmation header', async () => {
-      // Simulate the upstream API rejecting the request when the confirmation header is stripped
-      await expect(
-        appStateClient.wipeAllAppUsersState(
-          'v1',
-          { appKey: 'my-app' },
-          { headers: {} as unknown as HeadersInit },
-        ),
-      ).rejects.toBeTruthy();
+    it('preserves caller headers without stripping the confirmation header', async () => {
+      // The caller's own headers must survive alongside the mandatory confirmation header, not replace it.
+      const result = await appStateClient.wipeAllAppUsersState(
+        'v1',
+        { appKey: 'my-app' },
+        { headers: { 'X-Custom': 'yes' } },
+      );
+
+      expect(result).toMatchObject({ wiped: true });
+      const [, init] = httpClientWatcher.mock.calls.at(-1) ?? [];
+      const headers = new Headers(init?.headers);
+      expect(headers.get('X-Custom')).toBe('yes');
+      expect(headers.get('X-Confirm-Wipe')).toBe('true');
     });
   });
 });