@contential/api - npm Package Compare versions

Comparing version 0.0.1-test to 0.0.1

dist/index.d.ts

 interface ContentialApiOptions {
-    secretKey?: string;
+    key?: string;
     url?: string;
@@ -13,3 +13,3 @@ }
     url: string;
-    secretKey: string;
+    key: string;
     constructor(options?: ContentialApiOptions);
@@ -20,2 +20,8 @@ stream<ResponseData>({ path, data, onUpdate, }: ContentialApiStreamOptions<ResponseData>): Promise<{} | undefined>;
 
-export { ContentialApi, ContentialApiOptions, ContentialApiStreamOptions, getClient };
+declare const isServer: () => boolean;
+declare const isClient: () => boolean;
+declare const isSecretKey: (key: string) => boolean;
+declare const getApiUrl: (url: string | undefined) => string;
+declare const getKey: (key: string | undefined) => string;
+
+export { ContentialApi, ContentialApiOptions, ContentialApiStreamOptions, getApiUrl, getClient, getKey, isClient, isSecretKey, isServer };

dist/index.js

@@ -44,15 +44,45 @@ "use strict";
   ContentialApi: () => ContentialApi,
-  getClient: () => getClient
+  getApiUrl: () => getApiUrl,
+  getClient: () => getClient,
+  getKey: () => getKey,
+  isClient: () => isClient,
+  isSecretKey: () => isSecretKey,
+  isServer: () => isServer
 });
 module.exports = __toCommonJS(src_exports);
 
+// src/utils.ts
+var isServer = () => {
+  return !(typeof window != "undefined" && window.document);
+};
+var isClient = () => {
+  return !isServer();
+};
+var isSecretKey = (key) => {
+  return key.startsWith("sk_");
+};
+var getApiUrl = (url) => {
+  if (url)
+    return url;
+  return process.env.CONTENTIAL_API_URL || process.env.NEXT_PUBLIC_CONTENTIAL_API_URL || process.env.VITE_CONTENTIAL_API_URL || process.env.REACT_APP_CONTENTIAL_API_URL || process.env.GATSBY_CONTENTIAL_API_URL || "https://api.contential.ai";
+};
+var getKey = (key) => {
+  if (key)
+    return key;
+  return process.env.CONTENTIAL_SECRET_KEY || process.env.CONTENTIAL_PUBLISHABLE_KEY || process.env.NEXT_PUBLIC_CONTENTIAL_PUBLISHABLE_KEY || process.env.VITE_CONTENTIAL_PUBLISHABLE_KEY || process.env.REACT_APP_CONTENTIAL_PUBLISHABLE_KEY || process.env.GATSBY_CONTENTIAL_PUBLISHABLE_KEY || "";
+};
+
 // src/api.ts
-var import_undici = require("undici");
 var ContentialApi = class {
   constructor(options) {
-    this.url = (options == null ? void 0 : options.url) || process.env.CONTENTIAL_API_URL || "https://api.contential.ai";
-    this.secretKey = (options == null ? void 0 : options.secretKey) || process.env.CONTENTIAL_SECRET_KEY || "";
-    if (!this.secretKey) {
-      throw new Error("Missing: secretKey");
+    this.url = getApiUrl(options == null ? void 0 : options.url);
+    this.key = getKey(options == null ? void 0 : options.key);
+    if (!this.key) {
+      throw new Error("Missing: key");
     }
+    if (isClient() && isSecretKey(this.key)) {
+      throw new Error(
+        "Using secret key on client is not allowed. Please use publishable key instead (pk_...)."
+      );
+    }
   }
@@ -67,7 +97,7 @@ stream(_0) {
         const url = `${this.url}${path}`;
-        const response = yield (0, import_undici.fetch)(url, {
+        const response = yield fetch(url, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
-            Authorization: `Bearer ${this.secretKey}`
+            Authorization: `Bearer ${this.key}`
           },
@@ -120,3 +150,8 @@ body: JSON.stringify(data)
   ContentialApi,
-  getClient
+  getApiUrl,
+  getClient,
+  getKey,
+  isClient,
+  isSecretKey,
+  isServer
 });

package.json

 {
   "name": "@contential/api",
-  "version": "0.0.1-test",
+  "version": "0.0.1",
   "license": "MIT",
@@ -10,4 +10,3 @@ "main": "dist/index.js",
   "dependencies": {
-    "axios": "^1.4.0",
-    "undici": "^5.22.1"
+    "axios": "^1.4.0"
   },
@@ -14,0 +13,0 @@ "scripts": {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Improved metrics

Dependency count

1

decreased by-50%

Number of low supply chain risk alerts

1

decreased by-80%

Worsened metrics

Total package byte prevSize

10708

decreased by-3.75%

Number of package files

7

decreased by-30%

Lines of code

295

decreased by-7.52%

Number of lines in readme file

2

decreased by-77.78%

Number of medium supply chain risk alerts

2

increased by100%

Dependency changes

• - Removedundici@^5.22.1

• - Removed@fastify/busboy@2.1.1(transitive)

• - Removedundici@5.28.4(transitive)