@dual-os/http

Dual plugin for generic HTTP requests to any REST API.

http/request/send accepts an optional Connection. Without one, use an absolute HTTP or HTTPS URL; headers and query parameters work as before. Dual does not select a default Connection for this optional action. An explicitly selected invalid Connection fails the call.

With a Connection, url is a path below its baseUrl (for example /users below https://api.example.com/v1 becomes https://api.example.com/v1/users), or an absolute URL on the same origin. The Connection supplies one of these authentication methods:

• Bearer token: baseUrl and token.
• API key: baseUrl, apiKey, name, and in (header or query).
• Basic auth: baseUrl, username, and password.
• Login token: baseUrl, loginPath, resultPath (such as data.access_token), and injectName. Optional loginBody, loginHeaders and loginFormat (json or form) configure the login request. injectIn defaults to header; injectPrefix can be Bearer . expiresPath reads a numeric lifetime in seconds or an ISO expiry date from the login response. Dual prepares and persists the token, then refreshes it before expiry. Without a usable expiry, it logs in again before every authenticated call. A 401 is returned without replaying the HTTP request; a revoked token can be renewed through Dual's Connection refresh.

Connection authentication overrides the matching request header or query parameter. Authenticated requests and login requests reject redirects to another origin, including a change of scheme or port. Same-origin redirects continue to work.

import { httpPluginBase } from "@dual-os/http/definition";
import { httpPlugin } from "@dual-os/http/executable";

Set DUAL_HTTP_BLOCK_PRIVATE_NETWORKS=true to refuse requests and redirects to private, loopback and link-local addresses when running the plugin directly. The isolated worker does not inherit the host's environment variables; configure its network policy separately.