fix: use extend with deep copy where necessary

auth/authenticators/basic-authenticator.ts

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+import extend = require('extend');
 import { computeBasicAuthHeader, validateInput } from '../utils';
 import { Authenticator } from './authenticator';
 import { AuthenticateOptions } from './authenticator-interface';
@@ -71,7 +72,7 @@ export class BasicAuthenticator extends Authenticator {
    */
   public authenticate(requestOptions: AuthenticateOptions): Promise<void | Error>  {
     return new Promise((resolve) => {
-      requestOptions.headers = Object.assign({}, requestOptions.headers, this.authHeader);
+      requestOptions.headers = extend(true, {}, requestOptions.headers, this.authHeader);
       resolve();
     });
   }

auth/authenticators/bearer-token-authenticator.ts

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+import extend = require('extend');
 import { validateInput } from '../utils';
 import { Authenticator } from './authenticator';
 import { AuthenticateOptions } from './authenticator-interface';
@@ -76,7 +77,7 @@ export class BearerTokenAuthenticator extends Authenticator {
   public authenticate(requestOptions: AuthenticateOptions): Promise<void> {
     return new Promise((resolve) => {
       const authHeader = { Authorization: `Bearer ${this.bearerToken}` };
-      requestOptions.headers = Object.assign({}, requestOptions.headers, authHeader);
+      requestOptions.headers = extend(true, {}, requestOptions.headers, authHeader);
       resolve();
     });
   }

auth/authenticators/token-request-based-authenticator.ts

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+import extend = require('extend');
 import { OutgoingHttpHeaders } from 'http';
 import { JwtTokenManager } from '../token-managers';
 import { Authenticator } from './authenticator';
@@ -118,7 +119,7 @@ export class TokenRequestBasedAuthenticator extends Authenticator {
   public authenticate(requestOptions: AuthenticateOptions): Promise<void | Error> {
     return this.tokenManager.getToken().then(token => {
       const authHeader = { Authorization: `Bearer ${token}` };
-      requestOptions.headers = Object.assign({}, requestOptions.headers, authHeader);
+      requestOptions.headers = extend(true, {}, requestOptions.headers, authHeader);
       return;
     });
   }

auth/token-managers/cp4d-token-manager.ts

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+import extend = require('extend');
 import { computeBasicAuthHeader, validateInput } from '../utils';
 import { JwtTokenManager, JwtTokenManagerOptions } from './jwt-token-manager';
 
@@ -95,7 +96,7 @@ export class Cp4dTokenManager extends JwtTokenManager {
       options: {
         url: this.url,
         method: 'GET',
-        headers: Object.assign({}, this.headers, requiredHeaders),
+        headers: extend(true, {}, this.headers, requiredHeaders),
         rejectUnauthorized: !this.disableSslVerification,
       }
     };

auth/token-managers/iam-token-manager.ts

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+import extend = require('extend');
 import { OutgoingHttpHeaders } from 'http';
 import logger from '../../lib/logger';
 import { computeBasicAuthHeader, validateInput } from '../utils';
@@ -132,7 +133,7 @@ export class IamTokenManager extends JwtTokenManager {
       options: {
         url: this.url,
         method: 'POST',
-        headers: Object.assign({}, this.headers, requiredHeaders),
+        headers: extend(true, {}, this.headers, requiredHeaders),
         form: {
           grant_type: 'urn:ibm:params:oauth:grant-type:apikey',
           apikey: this.apikey,

lib/request-wrapper.ts

@@ -17,6 +17,7 @@
 import axios from 'axios';
 import { AxiosRequestConfig } from 'axios';
 import axiosCookieJarSupport from 'axios-cookiejar-support';
+import extend = require('extend');
 import FormData = require('form-data');
 import https = require('https');
 import querystring = require('querystring');
@@ -53,7 +54,7 @@ export class RequestWrapper {
     };
 
     // merge axios config into default
-    Object.assign(axiosConfig, axiosOptions);
+    extend(true, axiosConfig, axiosOptions);
 
     // if the user explicitly sets `disableSslVerification` to true,
     // `rejectUnauthorized` must be set to false in the https agent
@@ -137,7 +138,7 @@ export class RequestWrapper {
    * @throws {Error}
    */
   public sendRequest(parameters): Promise<any> {
-    const options = Object.assign({}, parameters.defaultOptions, parameters.options);
+    const options = extend(true, {}, parameters.defaultOptions, parameters.options);
     const { path, body, form, formData, qs, method, serviceUrl } = options;
     let { headers, url } = options;
 
@@ -198,7 +199,7 @@ export class RequestWrapper {
     if (formData) {
       data = multipartForm;
       // form-data generates headers that MUST be included or the request will fail
-      headers = Object.assign({}, headers, multipartForm.getHeaders());
+      headers = extend(true, {}, headers, multipartForm.getHeaders());
     }
 
     // TEMPORARY: Disabling gzipping due to bug in axios until fix is released:

package.json

@@ -55,12 +55,14 @@
     "@types/file-type": "~5.2.1",
     "@types/isstream": "^0.1.0",
     "@types/node": "~10.14.19",
+    "@types/tough-cookie": "^4.0.0",
     "axios": "^0.18.1",
     "axios-cookiejar-support": "^1.0.0",
     "camelcase": "^5.3.1",
     "debug": "^4.1.1",
     "dotenv": "^6.2.0",
     "expect": "^26.1.0",
+    "extend": "^3.0.2",
     "file-type": "^7.7.1",
     "form-data": "^2.3.3",
     "isstream": "~0.1.2",