Skip to content

feat(auth): accept optional features in prefetch()#1643

Closed
jmcbgaston wants to merge 3 commits into
box:masterfrom
jmcbgaston:feat/prefetch-features-param
Closed

feat(auth): accept optional features in prefetch()#1643
jmcbgaston wants to merge 3 commits into
box:masterfrom
jmcbgaston:feat/prefetch-features-param

Conversation

@jmcbgaston
Copy link
Copy Markdown
Contributor

@jmcbgaston jmcbgaston commented May 12, 2026

Description

prefetch() relied on this.options.features, which is only set during Preview.show(). Callers that prefetch before show() (for example, folder-list hover prefetch in a host application) had no way to opt into auth-header routing for the access token, so featureEnabled('migrateAccessTokenToHeader') checks inside viewer prefetch() methods always read the default (false).

This change adds an optional top-level isAccessTokenHeaderEnabled = false param to prefetch(), matching the shape of the existing isDocFirstPrefetchEnabled param. When the prefetch is for preload, the per-call viewer options merge in features.migrateAccessTokenToHeader so viewer prefetch() methods see the threaded value — without mutating this.options.features.

  • Callers that omit the flag get byte-identical behavior.
  • Subsequent show() / prefetch() calls aren't affected by prior per-call state.

Test plan

  • yarn test src/lib/__tests__/Preview-test.js — 271 passing, including new tests covering flag-on (feature surfaced to viewer options) and flag-off (feature surfaced as false) paths
  • Host app verified hover-prefetch requests include Authorization: Bearer header (no access_token in URL) when passing isAccessTokenHeaderEnabled: true
  • Host app verified omitting / passing false preserves existing behavior

Semantic release type

  • feat - New feature

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented May 12, 2026

CLA assistant check
All committers have signed the CLA.

@jmcbgaston jmcbgaston marked this pull request as ready for review May 12, 2026 20:33
@jmcbgaston jmcbgaston requested a review from a team as a code owner May 12, 2026 20:33
@jmcbgaston jmcbgaston marked this pull request as draft May 12, 2026 20:38
@jmcbgaston jmcbgaston marked this pull request as ready for review May 12, 2026 20:38
Comment thread src/lib/Preview.js Outdated
Comment thread src/lib/Preview.js Outdated
@jmcbgaston jmcbgaston force-pushed the feat/prefetch-features-param branch from 3a5b1fe to 68e67ed Compare May 12, 2026 22:55
Comment thread src/lib/Preview.js
options.features = {
...this.options.features,
migrateAccessTokenToHeader: isAccessTokenHeaderEnabled,
};
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note on the asymmetry between options.features.migrateAccessTokenToHeader = ... here vs. options.isDocFirstPrefetchEnabled = isDocFirstPrefetchEnabled above:

The param shape matches isDocFirstPrefetchEnabled (top-level boolean coming into prefetch()), but the destination differs because the two flags are read differently by viewers:

  • isDocFirstPrefetchEnabled → read directly off this.options: const { isDocFirstPrefetchEnabled } = this.options (DocBaseViewer.js:464)
  • migrateAccessTokenToHeader → read via this.featureEnabled('migrateAccessTokenToHeader'), which pulls from this.options.features. Used in ~14 call sites across DocBaseViewer, ImageViewer, MultiImageViewer, ArchiveViewer, PlainTextViewer, CSVViewer, BaseViewer.

So the param matches the existing top-level shape, but the destination has to land in options.features to align with how viewers already consume it (and with how PreviewContent.tsx sets it on the show() path). Placing it top-level instead would require refactoring every viewer call site.

sharedLinkPassword,
isDocFirstPrefetchEnabled: false,
docFirstPagesConfig: null,
features: { migrateAccessTokenToHeader: false },
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we update this to isAccessTokenHeaderEnabled also?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment thread src/lib/Preview.js
options.docFirstPagesConfig = docFirstPagesConfig;
options.features = {
...this.options.features,
migrateAccessTokenToHeader: isAccessTokenHeaderEnabled,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

prefetch() relied on this.options.features which is only set by show().
Callers that prefetch before show() (e.g. folder hover prefetch) had no
way to pass features into the viewer, so featureEnabled() checks in
viewer prefetch() methods always read defaults.

Add an optional features param to prefetch() and merge it into per-call
viewer options without mutating this.options.
prefetch() relied on this.options.features which is only set by show().
Callers that prefetch before show() (e.g. folder hover prefetch) had no
way to opt into auth-header routing, so featureEnabled() checks in
viewer prefetch() methods always read defaults.

Add an optional isAccessTokenHeaderEnabled top-level param to prefetch()
(matching the isDocFirstPrefetchEnabled shape). When set inside the
preload branch, the viewer's options.features.migrateAccessTokenToHeader
gets the threaded value without mutating this.options.
@jmcbgaston jmcbgaston force-pushed the feat/prefetch-features-param branch from 9793a36 to cb43514 Compare May 13, 2026 02:35
@jmcbgaston
Copy link
Copy Markdown
Contributor Author

Reopening from upstream branch so Mergify's strict-merge queue can operate (the queue check failed because this PR was from a fork). Replacement PR: #1645

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants