Send the idempotency key as an Idempotency-Key header instead of a query parameter

[eastagiletracker]

This PR proposes sending the idempotency key as an Idempotency-Key header instead of a query parameter on every resource create() that accepts one. We include this PR work along with a full history of your repo at https://eastagiletracker.com/projects/336. You can sign in with your GitHub ID to claim ownership of the project.

What's happening

Resource._create is declared as _create(data, params?, requestConfig = {}), and it already builds the Idempotency-Key header out of requestConfig.idempotency_key. Eleven public create() methods call it with only two arguments — super._create(opts, requestConfig) — so the request config lands in the params slot and requestConfig silently falls back to its {} default. The compiler cannot see it: Params defaults to {}, and IRequestConfig is structurally assignable to {}, so tsc accepts the call.

The effect is that the key each of those methods documents (@param requestConfig Idempotency key: { idempotency_key: string}) is serialized into the query string and no Idempotency-Key header is ever sent. payments.create is where that costs the most: a retried create looks like a brand new request to the API, so the retry can post a second payment. It also places the key in the request URL, where it lands in proxy and access logs.

Reproduced on master at d0aa5f6

consthttp=require('http');const{ Method }=require('method-node');constseen=[];constserver=http.createServer((req,res)=>{seen.push({url: req.url,headers: req.headers});res.setHeader('content-type','application/json');res.end(JSON.stringify({data: {id: 'pmt_123',status: 'pending'}}));});server.listen(0,'127.0.0.1',async()=>{constmethod=newMethod({apiKey: 'sk_test',env: 'dev',baseURL: `http://127.0.0.1:${server.address().port}`,});awaitmethod.payments.create({amount: 5000,source: 'acc_src',destination: 'acc_dst',description: 'Loan Pmt'},{idempotency_key: 'my-idem-key-123'},);console.log('request url :',seen[0].url);console.log('Idempotency-Key hdr :',seen[0].headers['idempotency-key']);server.close();});

request url : /payments?idempotency_key=my-idem-key-123
Idempotency-Key hdr : undefined

Affected today: accounts.create, entities.create, entities(id).subscriptions.create, entities(id).manualConnect.create, payments.create, reports.create, secrets.create, forwardingRequests.create, webhooks.create, teams.create and teams.publicKeys.create. entities(id).connect.create was already passing all three arguments and is correct as-is.

The change

Each of those eleven call sites now passes requestConfig in its own positional slot (super._create(opts, undefined, requestConfig)). No public method signature changes, Resource._create is untouched, and the only difference on the wire is the one that was documented all along: the key moves out of the query string and into the Idempotency-Key header. Running the same script above against this branch prints request url : /payments and Idempotency-Key hdr : my-idem-key-123.

How it was verified

test/resources/RequestConfig.tests.ts is new and wired into test/index.ts. It stands up a local HTTP server, points a client at it through the baseURL option, and asserts three things for each of the eleven methods: the key is sent as an Idempotency-Key header, it is absent from the query string, and no such header is sent when no request config is passed. It needs no API credentials, so it runs anywhere:

npx tsc -p tsconfig-test.json
NODE_ENV=TEST npx mocha --exit --timeout 20000 ./test-dist/test/resources/RequestConfig.tests.js

Against master's src those tests report 12 passing, 22 failing — the twelve that pass are the controls asserting no header when no request config is given, which is correct on both trees. With this change they report 34 passing. There is also a control for entities(id).connect.create, confirming it still sends its expand query parameters and the header, so the one already-correct caller does not move.

npx tsc -p tsconfig-test.json (your pretest) and npm run build are green before and after. npm run lint fails identically on both trees on a clean checkout, since .eslintrc.js references @typescript-eslint/eslint-plugin and it is not in devDependencies; that is untouched here. The credentialed suite needs TEST_CLIENT_KEY, which I do not have, so I could not run it — hence the new file being self-contained.

One merge note: #127 also adds a line to test/index.ts, so that file may want a trivial rebase depending on merge order.

How this was managed

This work was tracked on a board imported from this repository's own issues and pull requests — 131 stories in all. The story for this change is Idempotency key is sent as a query param instead of the Idempotency-Key header, on the board at https://eastagiletracker.com/projects/336.

If you'd rather not receive contributions like this, reply no-more-prs on this pull request and we won't open any further ones on your repositories.

---

Lawrence W. Sinclair
CEO / East Agile
linkedin.com/in/lwsinclair/
eastagile.com

[eastagiletracker]

This PR proposes sending the idempotency key as an Idempotency-Key header instead of a query parameter on every resource create() that accepts one. We include this PR work along with a full history of your repo at https://eastagiletracker.com/projects/336. You can sign in with your GitHub ID to claim ownership of the project.

What's happening

Resource._create is declared as _create(data, params?, requestConfig = {}), and it already builds the Idempotency-Key header out of requestConfig.idempotency_key. Eleven public create() methods call it with only two arguments — super._create(opts, requestConfig) — so the request config lands in the params slot and requestConfig silently falls back to its {} default. The compiler cannot see it: Params defaults to {}, and IRequestConfig is structurally assignable to {}, so tsc accepts the call.

The effect is that the key each of those methods documents (@param requestConfig Idempotency key: { idempotency_key: string}) is serialized into the query string and no Idempotency-Key header is ever sent. payments.create is where that costs the most: a retried create looks like a brand new request to the API, so the retry can post a second payment. It also places the key in the request URL, where it lands in proxy and access logs.

Reproduced on master at d0aa5f6

consthttp=require('http');const{ Method }=require('method-node');constseen=[];constserver=http.createServer((req,res)=>{seen.push({url: req.url,headers: req.headers});res.setHeader('content-type','application/json');res.end(JSON.stringify({data: {id: 'pmt_123',status: 'pending'}}));});server.listen(0,'127.0.0.1',async()=>{constmethod=newMethod({apiKey: 'sk_test',env: 'dev',baseURL: `http://127.0.0.1:${server.address().port}`,});awaitmethod.payments.create({amount: 5000,source: 'acc_src',destination: 'acc_dst',description: 'Loan Pmt'},{idempotency_key: 'my-idem-key-123'},);console.log('request url :',seen[0].url);console.log('Idempotency-Key hdr :',seen[0].headers['idempotency-key']);server.close();});

request url : /payments?idempotency_key=my-idem-key-123
Idempotency-Key hdr : undefined

Affected today: accounts.create, entities.create, entities(id).subscriptions.create, entities(id).manualConnect.create, payments.create, reports.create, secrets.create, forwardingRequests.create, webhooks.create, teams.create and teams.publicKeys.create. entities(id).connect.create was already passing all three arguments and is correct as-is.

The change

Each of those eleven call sites now passes requestConfig in its own positional slot (super._create(opts, undefined, requestConfig)). No public method signature changes, Resource._create is untouched, and the only difference on the wire is the one that was documented all along: the key moves out of the query string and into the Idempotency-Key header. Running the same script above against this branch prints request url : /payments and Idempotency-Key hdr : my-idem-key-123.

How it was verified

test/resources/RequestConfig.tests.ts is new and wired into test/index.ts. It stands up a local HTTP server, points a client at it through the baseURL option, and asserts three things for each of the eleven methods: the key is sent as an Idempotency-Key header, it is absent from the query string, and no such header is sent when no request config is passed. It needs no API credentials, so it runs anywhere:

npx tsc -p tsconfig-test.json
NODE_ENV=TEST npx mocha --exit --timeout 20000 ./test-dist/test/resources/RequestConfig.tests.js

Against master's src those tests report 12 passing, 22 failing — the twelve that pass are the controls asserting no header when no request config is given, which is correct on both trees. With this change they report 34 passing. There is also a control for entities(id).connect.create, confirming it still sends its expand query parameters and the header, so the one already-correct caller does not move.

npx tsc -p tsconfig-test.json (your pretest) and npm run build are green before and after. npm run lint fails identically on both trees on a clean checkout, since .eslintrc.js references @typescript-eslint/eslint-plugin and it is not in devDependencies; that is untouched here. The credentialed suite needs TEST_CLIENT_KEY, which I do not have, so I could not run it — hence the new file being self-contained.

One merge note: #127 also adds a line to test/index.ts, so that file may want a trivial rebase depending on merge order.

How this was managed

This work was tracked on a board imported from this repository's own issues and pull requests — 131 stories in all. The story for this change is Idempotency key is sent as a query param instead of the Idempotency-Key header, on the board at https://eastagiletracker.com/projects/336.

If you'd rather not receive contributions like this, reply no-more-prs on this pull request and we won't open any further ones on your repositories.

---

Lawrence W. Sinclair
CEO / East Agile
linkedin.com/in/lwsinclair/
eastagile.com

[eastagiletracker]

This PR proposes sending the idempotency key as an Idempotency-Key header instead of a query parameter on every resource create() that accepts one. We include this PR work along with a full history of your repo at https://eastagiletracker.com/projects/336. You can sign in with your GitHub ID to claim ownership of the project.

What's happening

Resource._create is declared as _create(data, params?, requestConfig = {}), and it already builds the Idempotency-Key header out of requestConfig.idempotency_key. Eleven public create() methods call it with only two arguments — super._create(opts, requestConfig) — so the request config lands in the params slot and requestConfig silently falls back to its {} default. The compiler cannot see it: Params defaults to {}, and IRequestConfig is structurally assignable to {}, so tsc accepts the call.

The effect is that the key each of those methods documents (@param requestConfig Idempotency key: { idempotency_key: string}) is serialized into the query string and no Idempotency-Key header is ever sent. payments.create is where that costs the most: a retried create looks like a brand new request to the API, so the retry can post a second payment. It also places the key in the request URL, where it lands in proxy and access logs.

Reproduced on master at d0aa5f6

consthttp=require('http');const{ Method }=require('method-node');constseen=[];constserver=http.createServer((req,res)=>{seen.push({url: req.url,headers: req.headers});res.setHeader('content-type','application/json');res.end(JSON.stringify({data: {id: 'pmt_123',status: 'pending'}}));});server.listen(0,'127.0.0.1',async()=>{constmethod=newMethod({apiKey: 'sk_test',env: 'dev',baseURL: `http://127.0.0.1:${server.address().port}`,});awaitmethod.payments.create({amount: 5000,source: 'acc_src',destination: 'acc_dst',description: 'Loan Pmt'},{idempotency_key: 'my-idem-key-123'},);console.log('request url :',seen[0].url);console.log('Idempotency-Key hdr :',seen[0].headers['idempotency-key']);server.close();});

request url : /payments?idempotency_key=my-idem-key-123
Idempotency-Key hdr : undefined

Affected today: accounts.create, entities.create, entities(id).subscriptions.create, entities(id).manualConnect.create, payments.create, reports.create, secrets.create, forwardingRequests.create, webhooks.create, teams.create and teams.publicKeys.create. entities(id).connect.create was already passing all three arguments and is correct as-is.

The change

Each of those eleven call sites now passes requestConfig in its own positional slot (super._create(opts, undefined, requestConfig)). No public method signature changes, Resource._create is untouched, and the only difference on the wire is the one that was documented all along: the key moves out of the query string and into the Idempotency-Key header. Running the same script above against this branch prints request url : /payments and Idempotency-Key hdr : my-idem-key-123.

How it was verified

test/resources/RequestConfig.tests.ts is new and wired into test/index.ts. It stands up a local HTTP server, points a client at it through the baseURL option, and asserts three things for each of the eleven methods: the key is sent as an Idempotency-Key header, it is absent from the query string, and no such header is sent when no request config is passed. It needs no API credentials, so it runs anywhere:

npx tsc -p tsconfig-test.json
NODE_ENV=TEST npx mocha --exit --timeout 20000 ./test-dist/test/resources/RequestConfig.tests.js

Against master's src those tests report 12 passing, 22 failing — the twelve that pass are the controls asserting no header when no request config is given, which is correct on both trees. With this change they report 34 passing. There is also a control for entities(id).connect.create, confirming it still sends its expand query parameters and the header, so the one already-correct caller does not move.

npx tsc -p tsconfig-test.json (your pretest) and npm run build are green before and after. npm run lint fails identically on both trees on a clean checkout, since .eslintrc.js references @typescript-eslint/eslint-plugin and it is not in devDependencies; that is untouched here. The credentialed suite needs TEST_CLIENT_KEY, which I do not have, so I could not run it — hence the new file being self-contained.

One merge note: #127 also adds a line to test/index.ts, so that file may want a trivial rebase depending on merge order.

How this was managed

This work was tracked on a board imported from this repository's own issues and pull requests — 131 stories in all. The story for this change is Idempotency key is sent as a query param instead of the Idempotency-Key header, on the board at https://eastagiletracker.com/projects/336.

If you'd rather not receive contributions like this, reply no-more-prs on this pull request and we won't open any further ones on your repositories.

---

Lawrence W. Sinclair
CEO / East Agile
linkedin.com/in/lwsinclair/
eastagile.com

[eastagiletracker]

This PR proposes sending the idempotency key as an Idempotency-Key header instead of a query parameter on every resource create() that accepts one. We include this PR work along with a full history of your repo at https://eastagiletracker.com/projects/336. You can sign in with your GitHub ID to claim ownership of the project.

What's happening

Resource._create is declared as _create(data, params?, requestConfig = {}), and it already builds the Idempotency-Key header out of requestConfig.idempotency_key. Eleven public create() methods call it with only two arguments — super._create(opts, requestConfig) — so the request config lands in the params slot and requestConfig silently falls back to its {} default. The compiler cannot see it: Params defaults to {}, and IRequestConfig is structurally assignable to {}, so tsc accepts the call.

The effect is that the key each of those methods documents (@param requestConfig Idempotency key: { idempotency_key: string}) is serialized into the query string and no Idempotency-Key header is ever sent. payments.create is where that costs the most: a retried create looks like a brand new request to the API, so the retry can post a second payment. It also places the key in the request URL, where it lands in proxy and access logs.

Reproduced on master at d0aa5f6

consthttp=require('http');const{ Method }=require('method-node');constseen=[];constserver=http.createServer((req,res)=>{seen.push({url: req.url,headers: req.headers});res.setHeader('content-type','application/json');res.end(JSON.stringify({data: {id: 'pmt_123',status: 'pending'}}));});server.listen(0,'127.0.0.1',async()=>{constmethod=newMethod({apiKey: 'sk_test',env: 'dev',baseURL: `http://127.0.0.1:${server.address().port}`,});awaitmethod.payments.create({amount: 5000,source: 'acc_src',destination: 'acc_dst',description: 'Loan Pmt'},{idempotency_key: 'my-idem-key-123'},);console.log('request url :',seen[0].url);console.log('Idempotency-Key hdr :',seen[0].headers['idempotency-key']);server.close();});

request url : /payments?idempotency_key=my-idem-key-123
Idempotency-Key hdr : undefined

Affected today: accounts.create, entities.create, entities(id).subscriptions.create, entities(id).manualConnect.create, payments.create, reports.create, secrets.create, forwardingRequests.create, webhooks.create, teams.create and teams.publicKeys.create. entities(id).connect.create was already passing all three arguments and is correct as-is.

The change

Each of those eleven call sites now passes requestConfig in its own positional slot (super._create(opts, undefined, requestConfig)). No public method signature changes, Resource._create is untouched, and the only difference on the wire is the one that was documented all along: the key moves out of the query string and into the Idempotency-Key header. Running the same script above against this branch prints request url : /payments and Idempotency-Key hdr : my-idem-key-123.

How it was verified

test/resources/RequestConfig.tests.ts is new and wired into test/index.ts. It stands up a local HTTP server, points a client at it through the baseURL option, and asserts three things for each of the eleven methods: the key is sent as an Idempotency-Key header, it is absent from the query string, and no such header is sent when no request config is passed. It needs no API credentials, so it runs anywhere:

npx tsc -p tsconfig-test.json
NODE_ENV=TEST npx mocha --exit --timeout 20000 ./test-dist/test/resources/RequestConfig.tests.js

Against master's src those tests report 12 passing, 22 failing — the twelve that pass are the controls asserting no header when no request config is given, which is correct on both trees. With this change they report 34 passing. There is also a control for entities(id).connect.create, confirming it still sends its expand query parameters and the header, so the one already-correct caller does not move.

npx tsc -p tsconfig-test.json (your pretest) and npm run build are green before and after. npm run lint fails identically on both trees on a clean checkout, since .eslintrc.js references @typescript-eslint/eslint-plugin and it is not in devDependencies; that is untouched here. The credentialed suite needs TEST_CLIENT_KEY, which I do not have, so I could not run it — hence the new file being self-contained.

One merge note: #127 also adds a line to test/index.ts, so that file may want a trivial rebase depending on merge order.

How this was managed

This work was tracked on a board imported from this repository's own issues and pull requests — 131 stories in all. The story for this change is Idempotency key is sent as a query param instead of the Idempotency-Key header, on the board at https://eastagiletracker.com/projects/336.

If you'd rather not receive contributions like this, reply no-more-prs on this pull request and we won't open any further ones on your repositories.

---

Lawrence W. Sinclair
CEO / East Agile
linkedin.com/in/lwsinclair/
eastagile.com

[eastagiletracker]

This PR proposes sending the idempotency key as an Idempotency-Key header instead of a query parameter on every resource create() that accepts one. We include this PR work along with a full history of your repo at https://eastagiletracker.com/projects/336. You can sign in with your GitHub ID to claim ownership of the project.

What's happening

Resource._create is declared as _create(data, params?, requestConfig = {}), and it already builds the Idempotency-Key header out of requestConfig.idempotency_key. Eleven public create() methods call it with only two arguments — super._create(opts, requestConfig) — so the request config lands in the params slot and requestConfig silently falls back to its {} default. The compiler cannot see it: Params defaults to {}, and IRequestConfig is structurally assignable to {}, so tsc accepts the call.

The effect is that the key each of those methods documents (@param requestConfig Idempotency key: { idempotency_key: string}) is serialized into the query string and no Idempotency-Key header is ever sent. payments.create is where that costs the most: a retried create looks like a brand new request to the API, so the retry can post a second payment. It also places the key in the request URL, where it lands in proxy and access logs.

Reproduced on master at d0aa5f6

consthttp=require('http');const{ Method }=require('method-node');constseen=[];constserver=http.createServer((req,res)=>{seen.push({url: req.url,headers: req.headers});res.setHeader('content-type','application/json');res.end(JSON.stringify({data: {id: 'pmt_123',status: 'pending'}}));});server.listen(0,'127.0.0.1',async()=>{constmethod=newMethod({apiKey: 'sk_test',env: 'dev',baseURL: `http://127.0.0.1:${server.address().port}`,});awaitmethod.payments.create({amount: 5000,source: 'acc_src',destination: 'acc_dst',description: 'Loan Pmt'},{idempotency_key: 'my-idem-key-123'},);console.log('request url :',seen[0].url);console.log('Idempotency-Key hdr :',seen[0].headers['idempotency-key']);server.close();});

request url : /payments?idempotency_key=my-idem-key-123
Idempotency-Key hdr : undefined

Affected today: accounts.create, entities.create, entities(id).subscriptions.create, entities(id).manualConnect.create, payments.create, reports.create, secrets.create, forwardingRequests.create, webhooks.create, teams.create and teams.publicKeys.create. entities(id).connect.create was already passing all three arguments and is correct as-is.

The change

Each of those eleven call sites now passes requestConfig in its own positional slot (super._create(opts, undefined, requestConfig)). No public method signature changes, Resource._create is untouched, and the only difference on the wire is the one that was documented all along: the key moves out of the query string and into the Idempotency-Key header. Running the same script above against this branch prints request url : /payments and Idempotency-Key hdr : my-idem-key-123.

How it was verified

test/resources/RequestConfig.tests.ts is new and wired into test/index.ts. It stands up a local HTTP server, points a client at it through the baseURL option, and asserts three things for each of the eleven methods: the key is sent as an Idempotency-Key header, it is absent from the query string, and no such header is sent when no request config is passed. It needs no API credentials, so it runs anywhere:

npx tsc -p tsconfig-test.json
NODE_ENV=TEST npx mocha --exit --timeout 20000 ./test-dist/test/resources/RequestConfig.tests.js

Against master's src those tests report 12 passing, 22 failing — the twelve that pass are the controls asserting no header when no request config is given, which is correct on both trees. With this change they report 34 passing. There is also a control for entities(id).connect.create, confirming it still sends its expand query parameters and the header, so the one already-correct caller does not move.

npx tsc -p tsconfig-test.json (your pretest) and npm run build are green before and after. npm run lint fails identically on both trees on a clean checkout, since .eslintrc.js references @typescript-eslint/eslint-plugin and it is not in devDependencies; that is untouched here. The credentialed suite needs TEST_CLIENT_KEY, which I do not have, so I could not run it — hence the new file being self-contained.

One merge note: #127 also adds a line to test/index.ts, so that file may want a trivial rebase depending on merge order.

How this was managed

This work was tracked on a board imported from this repository's own issues and pull requests — 131 stories in all. The story for this change is Idempotency key is sent as a query param instead of the Idempotency-Key header, on the board at https://eastagiletracker.com/projects/336.

If you'd rather not receive contributions like this, reply no-more-prs on this pull request and we won't open any further ones on your repositories.

---

Lawrence W. Sinclair
CEO / East Agile
linkedin.com/in/lwsinclair/
eastagile.com

[eastagiletracker]

This PR proposes sending the idempotency key as an Idempotency-Key header instead of a query parameter on every resource create() that accepts one. We include this PR work along with a full history of your repo at https://eastagiletracker.com/projects/336. You can sign in with your GitHub ID to claim ownership of the project.

What's happening

Resource._create is declared as _create(data, params?, requestConfig = {}), and it already builds the Idempotency-Key header out of requestConfig.idempotency_key. Eleven public create() methods call it with only two arguments — super._create(opts, requestConfig) — so the request config lands in the params slot and requestConfig silently falls back to its {} default. The compiler cannot see it: Params defaults to {}, and IRequestConfig is structurally assignable to {}, so tsc accepts the call.

The effect is that the key each of those methods documents (@param requestConfig Idempotency key: { idempotency_key: string}) is serialized into the query string and no Idempotency-Key header is ever sent. payments.create is where that costs the most: a retried create looks like a brand new request to the API, so the retry can post a second payment. It also places the key in the request URL, where it lands in proxy and access logs.

Reproduced on master at d0aa5f6

consthttp=require('http');const{ Method }=require('method-node');constseen=[];constserver=http.createServer((req,res)=>{seen.push({url: req.url,headers: req.headers});res.setHeader('content-type','application/json');res.end(JSON.stringify({data: {id: 'pmt_123',status: 'pending'}}));});server.listen(0,'127.0.0.1',async()=>{constmethod=newMethod({apiKey: 'sk_test',env: 'dev',baseURL: `http://127.0.0.1:${server.address().port}`,});awaitmethod.payments.create({amount: 5000,source: 'acc_src',destination: 'acc_dst',description: 'Loan Pmt'},{idempotency_key: 'my-idem-key-123'},);console.log('request url :',seen[0].url);console.log('Idempotency-Key hdr :',seen[0].headers['idempotency-key']);server.close();});

request url : /payments?idempotency_key=my-idem-key-123
Idempotency-Key hdr : undefined

Affected today: accounts.create, entities.create, entities(id).subscriptions.create, entities(id).manualConnect.create, payments.create, reports.create, secrets.create, forwardingRequests.create, webhooks.create, teams.create and teams.publicKeys.create. entities(id).connect.create was already passing all three arguments and is correct as-is.

The change

Each of those eleven call sites now passes requestConfig in its own positional slot (super._create(opts, undefined, requestConfig)). No public method signature changes, Resource._create is untouched, and the only difference on the wire is the one that was documented all along: the key moves out of the query string and into the Idempotency-Key header. Running the same script above against this branch prints request url : /payments and Idempotency-Key hdr : my-idem-key-123.

How it was verified

test/resources/RequestConfig.tests.ts is new and wired into test/index.ts. It stands up a local HTTP server, points a client at it through the baseURL option, and asserts three things for each of the eleven methods: the key is sent as an Idempotency-Key header, it is absent from the query string, and no such header is sent when no request config is passed. It needs no API credentials, so it runs anywhere:

npx tsc -p tsconfig-test.json
NODE_ENV=TEST npx mocha --exit --timeout 20000 ./test-dist/test/resources/RequestConfig.tests.js

Against master's src those tests report 12 passing, 22 failing — the twelve that pass are the controls asserting no header when no request config is given, which is correct on both trees. With this change they report 34 passing. There is also a control for entities(id).connect.create, confirming it still sends its expand query parameters and the header, so the one already-correct caller does not move.

npx tsc -p tsconfig-test.json (your pretest) and npm run build are green before and after. npm run lint fails identically on both trees on a clean checkout, since .eslintrc.js references @typescript-eslint/eslint-plugin and it is not in devDependencies; that is untouched here. The credentialed suite needs TEST_CLIENT_KEY, which I do not have, so I could not run it — hence the new file being self-contained.

One merge note: #127 also adds a line to test/index.ts, so that file may want a trivial rebase depending on merge order.

How this was managed

This work was tracked on a board imported from this repository's own issues and pull requests — 131 stories in all. The story for this change is Idempotency key is sent as a query param instead of the Idempotency-Key header, on the board at https://eastagiletracker.com/projects/336.

If you'd rather not receive contributions like this, reply no-more-prs on this pull request and we won't open any further ones on your repositories.

---

Lawrence W. Sinclair
CEO / East Agile
linkedin.com/in/lwsinclair/
eastagile.com

[eastagiletracker]

This PR proposes sending the idempotency key as an Idempotency-Key header instead of a query parameter on every resource create() that accepts one. We include this PR work along with a full history of your repo at https://eastagiletracker.com/projects/336. You can sign in with your GitHub ID to claim ownership of the project.

What's happening

Resource._create is declared as _create(data, params?, requestConfig = {}), and it already builds the Idempotency-Key header out of requestConfig.idempotency_key. Eleven public create() methods call it with only two arguments — super._create(opts, requestConfig) — so the request config lands in the params slot and requestConfig silently falls back to its {} default. The compiler cannot see it: Params defaults to {}, and IRequestConfig is structurally assignable to {}, so tsc accepts the call.

The effect is that the key each of those methods documents (@param requestConfig Idempotency key: { idempotency_key: string}) is serialized into the query string and no Idempotency-Key header is ever sent. payments.create is where that costs the most: a retried create looks like a brand new request to the API, so the retry can post a second payment. It also places the key in the request URL, where it lands in proxy and access logs.

Reproduced on master at d0aa5f6

consthttp=require('http');const{ Method }=require('method-node');constseen=[];constserver=http.createServer((req,res)=>{seen.push({url: req.url,headers: req.headers});res.setHeader('content-type','application/json');res.end(JSON.stringify({data: {id: 'pmt_123',status: 'pending'}}));});server.listen(0,'127.0.0.1',async()=>{constmethod=newMethod({apiKey: 'sk_test',env: 'dev',baseURL: `http://127.0.0.1:${server.address().port}`,});awaitmethod.payments.create({amount: 5000,source: 'acc_src',destination: 'acc_dst',description: 'Loan Pmt'},{idempotency_key: 'my-idem-key-123'},);console.log('request url :',seen[0].url);console.log('Idempotency-Key hdr :',seen[0].headers['idempotency-key']);server.close();});

request url : /payments?idempotency_key=my-idem-key-123
Idempotency-Key hdr : undefined

Affected today: accounts.create, entities.create, entities(id).subscriptions.create, entities(id).manualConnect.create, payments.create, reports.create, secrets.create, forwardingRequests.create, webhooks.create, teams.create and teams.publicKeys.create. entities(id).connect.create was already passing all three arguments and is correct as-is.

The change

Each of those eleven call sites now passes requestConfig in its own positional slot (super._create(opts, undefined, requestConfig)). No public method signature changes, Resource._create is untouched, and the only difference on the wire is the one that was documented all along: the key moves out of the query string and into the Idempotency-Key header. Running the same script above against this branch prints request url : /payments and Idempotency-Key hdr : my-idem-key-123.

How it was verified

test/resources/RequestConfig.tests.ts is new and wired into test/index.ts. It stands up a local HTTP server, points a client at it through the baseURL option, and asserts three things for each of the eleven methods: the key is sent as an Idempotency-Key header, it is absent from the query string, and no such header is sent when no request config is passed. It needs no API credentials, so it runs anywhere:

npx tsc -p tsconfig-test.json
NODE_ENV=TEST npx mocha --exit --timeout 20000 ./test-dist/test/resources/RequestConfig.tests.js

Against master's src those tests report 12 passing, 22 failing — the twelve that pass are the controls asserting no header when no request config is given, which is correct on both trees. With this change they report 34 passing. There is also a control for entities(id).connect.create, confirming it still sends its expand query parameters and the header, so the one already-correct caller does not move.

npx tsc -p tsconfig-test.json (your pretest) and npm run build are green before and after. npm run lint fails identically on both trees on a clean checkout, since .eslintrc.js references @typescript-eslint/eslint-plugin and it is not in devDependencies; that is untouched here. The credentialed suite needs TEST_CLIENT_KEY, which I do not have, so I could not run it — hence the new file being self-contained.

One merge note: #127 also adds a line to test/index.ts, so that file may want a trivial rebase depending on merge order.

How this was managed

This work was tracked on a board imported from this repository's own issues and pull requests — 131 stories in all. The story for this change is Idempotency key is sent as a query param instead of the Idempotency-Key header, on the board at https://eastagiletracker.com/projects/336.

If you'd rather not receive contributions like this, reply no-more-prs on this pull request and we won't open any further ones on your repositories.

---

Lawrence W. Sinclair
CEO / East Agile
linkedin.com/in/lwsinclair/
eastagile.com

[eastagiletracker]

This PR proposes sending the idempotency key as an Idempotency-Key header instead of a query parameter on every resource create() that accepts one. We include this PR work along with a full history of your repo at https://eastagiletracker.com/projects/336. You can sign in with your GitHub ID to claim ownership of the project.

What's happening

Resource._create is declared as _create(data, params?, requestConfig = {}), and it already builds the Idempotency-Key header out of requestConfig.idempotency_key. Eleven public create() methods call it with only two arguments — super._create(opts, requestConfig) — so the request config lands in the params slot and requestConfig silently falls back to its {} default. The compiler cannot see it: Params defaults to {}, and IRequestConfig is structurally assignable to {}, so tsc accepts the call.

The effect is that the key each of those methods documents (@param requestConfig Idempotency key: { idempotency_key: string}) is serialized into the query string and no Idempotency-Key header is ever sent. payments.create is where that costs the most: a retried create looks like a brand new request to the API, so the retry can post a second payment. It also places the key in the request URL, where it lands in proxy and access logs.

Reproduced on master at d0aa5f6

consthttp=require('http');const{ Method }=require('method-node');constseen=[];constserver=http.createServer((req,res)=>{seen.push({url: req.url,headers: req.headers});res.setHeader('content-type','application/json');res.end(JSON.stringify({data: {id: 'pmt_123',status: 'pending'}}));});server.listen(0,'127.0.0.1',async()=>{constmethod=newMethod({apiKey: 'sk_test',env: 'dev',baseURL: `http://127.0.0.1:${server.address().port}`,});awaitmethod.payments.create({amount: 5000,source: 'acc_src',destination: 'acc_dst',description: 'Loan Pmt'},{idempotency_key: 'my-idem-key-123'},);console.log('request url :',seen[0].url);console.log('Idempotency-Key hdr :',seen[0].headers['idempotency-key']);server.close();});

request url : /payments?idempotency_key=my-idem-key-123
Idempotency-Key hdr : undefined

Affected today: accounts.create, entities.create, entities(id).subscriptions.create, entities(id).manualConnect.create, payments.create, reports.create, secrets.create, forwardingRequests.create, webhooks.create, teams.create and teams.publicKeys.create. entities(id).connect.create was already passing all three arguments and is correct as-is.

The change

Each of those eleven call sites now passes requestConfig in its own positional slot (super._create(opts, undefined, requestConfig)). No public method signature changes, Resource._create is untouched, and the only difference on the wire is the one that was documented all along: the key moves out of the query string and into the Idempotency-Key header. Running the same script above against this branch prints request url : /payments and Idempotency-Key hdr : my-idem-key-123.

How it was verified

test/resources/RequestConfig.tests.ts is new and wired into test/index.ts. It stands up a local HTTP server, points a client at it through the baseURL option, and asserts three things for each of the eleven methods: the key is sent as an Idempotency-Key header, it is absent from the query string, and no such header is sent when no request config is passed. It needs no API credentials, so it runs anywhere:

npx tsc -p tsconfig-test.json
NODE_ENV=TEST npx mocha --exit --timeout 20000 ./test-dist/test/resources/RequestConfig.tests.js

Against master's src those tests report 12 passing, 22 failing — the twelve that pass are the controls asserting no header when no request config is given, which is correct on both trees. With this change they report 34 passing. There is also a control for entities(id).connect.create, confirming it still sends its expand query parameters and the header, so the one already-correct caller does not move.

npx tsc -p tsconfig-test.json (your pretest) and npm run build are green before and after. npm run lint fails identically on both trees on a clean checkout, since .eslintrc.js references @typescript-eslint/eslint-plugin and it is not in devDependencies; that is untouched here. The credentialed suite needs TEST_CLIENT_KEY, which I do not have, so I could not run it — hence the new file being self-contained.

One merge note: #127 also adds a line to test/index.ts, so that file may want a trivial rebase depending on merge order.

How this was managed

This work was tracked on a board imported from this repository's own issues and pull requests — 131 stories in all. The story for this change is Idempotency key is sent as a query param instead of the Idempotency-Key header, on the board at https://eastagiletracker.com/projects/336.

If you'd rather not receive contributions like this, reply no-more-prs on this pull request and we won't open any further ones on your repositories.

---

Lawrence W. Sinclair
CEO / East Agile
linkedin.com/in/lwsinclair/
eastagile.com