diff --git a/src/shareddoc.js b/src/shareddoc.js index 069272c..a8ce353 100644 --- a/src/shareddoc.js +++ b/src/shareddoc.js @@ -392,7 +392,12 @@ export const persistence = { .map((con) => con.auth); if (auth.length > 0) { - headers.Authorization = [...new Set(auth)].join(','); + if (isHelixDoc(ydoc.name)) { + // eslint-disable-next-line prefer-destructuring + headers.Authorization = auth[0]; + } else { + headers.Authorization = [...new Set(auth)].join(','); + } } opts.headers = new Headers(headers); diff --git a/test/shareddoc.test.js b/test/shareddoc.test.js index 4359d99..2e21cd0 100644 --- a/test/shareddoc.test.js +++ b/test/shareddoc.test.js @@ -3185,6 +3185,40 @@ describe('Collab Test Suite', () => { } }); + it('persistence.put for a Helix doc with multiple connections uses only the first auth (no comma-join)', async () => { + const savedFetch = globalThis.fetch; + const calls = []; + globalThis.fetch = async (url, opts) => { + calls.push({ url, opts }); + return { ok: true, status: 200, statusText: 'OK' }; + }; + try { + const conns = new Map(); + conns.set({ auth: 'Bearer abc' }, new Set()); + conns.set({ auth: 'Bearer xyz' }, new Set()); + const ydoc = { + name: 'https://api.aem.live/owner/repo/page.html', + conns, + daadmin: { + fetch: async () => { assert.fail('daadmin.fetch must not be called for Helix docs'); }, + }, + }; + const body = '

some helix content that is long enough to avoid the empty-stub warning padding

'; + const result = await persistence.put(ydoc, body); + + assert(result.ok); + assert.equal(1, calls.length); + const { opts } = calls[0]; + assert.equal(opts.headers.get('Authorization'), 'Bearer abc'); + assert( + !opts.headers.get('Authorization').includes(','), + 'Helix Authorization header must not be a comma-joined multi-auth value', + ); + } finally { + globalThis.fetch = savedFetch; + } + }); + it('persistence.put for a Helix .json doc sets application/json Content-Type', async () => { const savedFetch = globalThis.fetch; let captured;