@1password/sdk 0.4.1-beta.1 → 0.5.0-beta.1

package/README.md

@@ -135,9 +135,16 @@ Field types:
 ### Authentication
 
 - [x] [1Password Service Accounts](https://developer.1password.com/docs/service-accounts/get-started/)
+- [x] [Workload identity](#workload-identity-beta) (beta)
 - [ ] User authentication
 - [ ] 1Password Connect. For now, use [1Password/connect-sdk-js](https://github.com/1Password/connect-sdk-js).
 
+### Workload identity (beta)
+
+> **Private beta.** Currently available for GitHub Actions via 1Password Credential Broker.
+
+Instead of a service account token, you can authenticate a workload by providing an OIDC token fetcher and your workload details. The SDK calls your `oidcFetcher` to obtain a token when it needs one.
+
 ## 📖 Learn more
 
 - [Load secrets with 1Password SDKs](https://developer.1password.com/docs/sdks/load-secrets)

package/dist/client_builder.js

@@ -22,11 +22,19 @@ const finalizationRegistry = new FinalizationRegistry((heldClient) => {
  * @returns The authenticated 1Password SDK client.
  */
 const createClientWithCore = (config, core) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!config.auth && !config.oidcFetcher) {
+        throw new Error("createClient requires either `auth` (service account token) or `oidcFetcher` (workload identity).");
+    }
+    if (config.oidcFetcher && !config.workloadDetails) {
+        throw new Error("`oidcFetcher` (workload identity) requires `workloadDetails` to be set.");
+    }
     const authConfig = (0, configuration_js_1.clientAuthConfig)(config);
     if (authConfig.accountName) {
         core.setInner(new shared_lib_core_js_1.SharedLibCore(authConfig.accountName));
     }
-    const clientId = yield core.initClient(authConfig);
+    const clientId = config.oidcFetcher
+        ? yield core.initClientOidc(authConfig, config.oidcFetcher)
+        : yield core.initClient(authConfig);
     const inner = new core_js_1.InnerClient(parseInt(clientId, 10), core, authConfig);
     const client = new client_js_1.Client(inner);
     // Cleans up associated memory from core when client instance goes out of scope.

package/dist/configuration.d.ts

@@ -1,10 +1,12 @@
-import { ClientAuthConfig } from "./core.js";
+import { ClientAuthConfig, WorkloadDetails } from "./core.js";
 export declare const LANGUAGE = "JS";
-export declare const VERSION = "0040101";
+export declare const VERSION = "0050001";
 export interface ClientConfiguration {
-    auth: Auth;
+    auth?: Auth;
     integrationName: string;
     integrationVersion: string;
+    oidcFetcher?: (audience: string) => Promise<string>;
+    workloadDetails?: WorkloadDetails;
 }
 type Auth = string | DesktopAuth;
 /**

package/dist/configuration.js

@@ -44,6 +44,7 @@ const clientAuthConfig = (userConfig) => {
         os: (0, exports.getOsName)(),
         osVersion: defaultOsVersion,
         architecture: os_1.default.arch(),
+        workloadDetails: userConfig.workloadDetails,
     };
 };
 exports.clientAuthConfig = clientAuthConfig;

package/dist/core.d.ts

@@ -6,6 +6,10 @@ export interface Core {
      *  Allocates a new authenticated client and returns its id.
      */
     initClient(config: string): Promise<string>;
+    /**
+     *  Allocates a new authenticated client using an OIDC token fetcher and returns its id.
+     */
+    initClientOidc(config: string, fetcher: (audience: string) => Promise<string>): Promise<string>;
     /**
      *  Calls async business logic from a given client and returns the result.
      */
@@ -30,6 +34,14 @@ export interface ClientAuthConfig {
     architecture: string;
     serviceAccountToken?: string;
     accountName?: string;
+    workloadDetails?: WorkloadDetails;
+}
+/**
+ *  Contains workload authentication details for OIDC-based workload identity.
+ */
+export interface WorkloadDetails {
+    customerManagedSecret: string;
+    workloadUuid: string;
 }
 /**
  *  Contains the information sent to the SDK core when you call (invoke) a function.
@@ -64,6 +76,7 @@ export interface Parameters {
 }
 export declare class WasmCore implements Core {
     initClient(config: string): Promise<string>;
+    initClientOidc(config: string, fetcher: (audience: string) => Promise<string>): Promise<string>;
     invoke(config: string): Promise<string>;
     releaseClient(clientId: string): void;
 }
@@ -75,6 +88,7 @@ export declare class SharedCore {
     constructor();
     setInner(core: Core): void;
     initClient(config: ClientAuthConfig): Promise<string>;
+    initClientOidc(config: ClientAuthConfig, fetcher: (audience: string) => Promise<string>): Promise<string>;
     invoke(config: InvokeConfig): Promise<string>;
     invoke_sync(config: InvokeConfig): string;
     releaseClient(clientId: number): void;

package/dist/core.js

@@ -28,6 +28,16 @@ class WasmCore {
             }
         });
     }
+    initClientOidc(config, fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield (0, sdk_core_1.init_client_oidc)(config, fetcher);
+            }
+            catch (e) {
+                (0, errors_1.throwError)(e);
+            }
+        });
+    }
     invoke(config) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
@@ -64,6 +74,12 @@ class SharedCore {
             return this.inner.initClient(serializedConfig);
         });
     }
+    initClientOidc(config, fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const serializedConfig = JSON.stringify(config);
+            return this.inner.initClientOidc(serializedConfig, fetcher);
+        });
+    }
     invoke(config) {
         return __awaiter(this, void 0, void 0, function* () {
             const serializedConfig = JSON.stringify(config, types_1.ReplacerFunc);

package/dist/shared_lib_core.d.ts

@@ -11,6 +11,7 @@ export declare class SharedLibCore implements Core {
      */
     private callSharedLibrary;
     initClient(config: string): Promise<string>;
+    initClientOidc(config: string, _fetcher: (audience: string) => Promise<string>): Promise<string>;
     invoke(invokeConfigBytes: string): Promise<string>;
     releaseClient(clientId: string): void;
 }

package/dist/shared_lib_core.js

@@ -163,6 +163,12 @@ class SharedLibCore {
             return this.callSharedLibrary(config, "init_client");
         });
     }
+    // eslint-disable-next-line @typescript-eslint/require-await
+    initClientOidc(config, _fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            throw new Error("OIDC authentication is not supported with desktop auth");
+        });
+    }
     invoke(invokeConfigBytes) {
         return __awaiter(this, void 0, void 0, function* () {
             return this.callSharedLibrary(invokeConfigBytes, "invoke");

package/dist/types.d.ts

@@ -107,7 +107,8 @@ export declare enum GroupState {
 }
 export declare enum VaultAccessorType {
     User = "user",
-    Group = "group"
+    Group = "group",
+    Broker = "broker"
 }
 /** Represents the vault access information. */
 export interface VaultAccess {
@@ -619,7 +620,7 @@ export interface Vault {
     activeItemCount: number;
     /** The content version number of the vault. It gets incremented whenever the state of the vault's contents changes (e.g. items from within the vault get created or updated). */
     contentVersion: number;
-    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its title or icon. */
+    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its name or icon. */
     attributeVersion: number;
     /** The access information associated with the vault. */
     access?: VaultAccess[];
@@ -651,7 +652,7 @@ export interface VaultOverview {
     activeItemCount: number;
     /** The content version number of the vault. It gets incremented whenever the state of the vault's contents changes (e.g. items from within the vault get created or updated). */
     contentVersion: number;
-    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its title or icon. */
+    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its name or icon. */
     attributeVersion: number;
     /** The time the vault was created at */
     createdAt: Date;

package/dist/types.js

@@ -57,6 +57,7 @@ var VaultAccessorType;
 (function (VaultAccessorType) {
     VaultAccessorType["User"] = "user";
     VaultAccessorType["Group"] = "group";
+    VaultAccessorType["Broker"] = "broker";
 })(VaultAccessorType || (exports.VaultAccessorType = VaultAccessorType = {}));
 var ItemCategory;
 (function (ItemCategory) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const SDK_VERSION = "0.4.1-beta.1";
-export declare const SDK_BUILD_NUMBER = "0040101";
+export declare const SDK_VERSION = "0.5.0-beta.1";
+export declare const SDK_BUILD_NUMBER = "0050001";

package/dist/version.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_BUILD_NUMBER = exports.SDK_VERSION = void 0;
-exports.SDK_VERSION = "0.4.1-beta.1";
-exports.SDK_BUILD_NUMBER = "0040101";
-const SDK_CORE_VERSION = "0.4.1-beta.1";
+exports.SDK_VERSION = "0.5.0-beta.1";
+exports.SDK_BUILD_NUMBER = "0050001";
+const SDK_CORE_VERSION = "0.5.0-beta.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1password/sdk",
-  "version": "0.4.1-beta.1",
+  "version": "0.5.0-beta.1",
   "description": "The 1Password JavaScript SDK offers programmatic read access to your secrets in 1Password in an interface native to JavaScript. The SDK currently supports `Node.JS`",
   "scripts": {
     "build": "tsc",
@@ -26,7 +26,7 @@
   "main": "./dist/sdk.js",
   "types": "./dist/sdk.d.ts",
   "dependencies": {
-    "@1password/sdk-core": "0.4.1-beta.1"
+    "@1password/sdk-core": "0.5.0-beta.1"
   },
   "devDependencies": {
     "@1password/eslint-config": "^4.0.0",