@1password/sdk 0.4.1 → 0.5.0

package/README.md

@@ -22,7 +22,7 @@ You can choose between two [authentication methods](https://developer.1password.
 
 ### Option 1: 1Password desktop app
 
-[1Password desktop app authentication](https://developer.1password.com/docs/sdks/concepts#1password-desktop-app) is best for local integrations that require minimal setup from end users and sensitive workflows that require human-in-the-loop approval. 
+[1Password desktop app authentication](https://developer.1password.com/docs/sdks/concepts#1password-desktop-app) is best for local integrations that require minimal setup from end users and sensitive workflows that require human-in-the-loop approval.
 
 1. Install the [1Password desktop app](https://1password.com/downloads/) and sign in to your account in the app.
 2. Select your account or collection at the top of the sidebar, then navigate to **Settings** > **Developer**.
@@ -206,9 +206,16 @@ Inside `createClient()`, set `integrationName` to the name of your application a
 ### Authentication
 
 - [x] [1Password Service Accounts](https://developer.1password.com/docs/sdks/concepts#1password-service-account)
+- [x] [Workload identity](#workload-identity-public-preview) (public preview)
 - [x] [User authentication](https://developer.1password.com/docs/sdks/concepts#1password-desktop-app)
 - [ ] 1Password Connect. For now, use [1Password/connect-sdk-js](https://github.com/1Password/connect-sdk-js).
 
+### Workload identity (public preview)
+
+> **Public Preview** This feature is currently in *public preview*. Please see documentation [here](https://www.1password.dev/environments/credential-broker).
+
+Instead of a service account token, you can authenticate a workload by providing an OIDC token fetcher and your workload details. The SDK calls your `oidcFetcher` to obtain a token when it needs one.
+
 ## 📖 Learn more
 
 - [Load secrets](https://developer.1password.com/docs/sdks/load-secrets)

package/dist/client_builder.js

@@ -22,11 +22,19 @@ const finalizationRegistry = new FinalizationRegistry((heldClient) => {
  * @returns The authenticated 1Password SDK client.
  */
 const createClientWithCore = (config, core) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!config.auth && !config.oidcFetcher) {
+        throw new Error("createClient requires either `auth` (service account token) or `oidcFetcher` (workload identity).");
+    }
+    if (config.oidcFetcher && !config.workloadDetails) {
+        throw new Error("`oidcFetcher` (workload identity) requires `workloadDetails` to be set.");
+    }
     const authConfig = (0, configuration_js_1.clientAuthConfig)(config);
     if (authConfig.accountName) {
         core.setInner(new shared_lib_core_js_1.SharedLibCore(authConfig.accountName));
     }
-    const clientId = yield core.initClient(authConfig);
+    const clientId = config.oidcFetcher
+        ? yield core.initClientOidc(authConfig, config.oidcFetcher)
+        : yield core.initClient(authConfig);
     const inner = new core_js_1.InnerClient(parseInt(clientId, 10), core, authConfig);
     const client = new client_js_1.Client(inner);
     // Cleans up associated memory from core when client instance goes out of scope.

package/dist/configuration.d.ts

@@ -1,10 +1,12 @@
-import { ClientAuthConfig } from "./core.js";
+import { ClientAuthConfig, WorkloadDetails } from "./core.js";
 export declare const LANGUAGE = "JS";
-export declare const VERSION = "0040102";
+export declare const VERSION = "0050002";
 export interface ClientConfiguration {
-    auth: Auth;
+    auth?: Auth;
     integrationName: string;
     integrationVersion: string;
+    oidcFetcher?: (audience: string) => Promise<string>;
+    workloadDetails?: WorkloadDetails;
 }
 type Auth = string | DesktopAuth;
 /**

package/dist/configuration.js

@@ -44,6 +44,7 @@ const clientAuthConfig = (userConfig) => {
         os: (0, exports.getOsName)(),
         osVersion: defaultOsVersion,
         architecture: os_1.default.arch(),
+        workloadDetails: userConfig.workloadDetails,
     };
 };
 exports.clientAuthConfig = clientAuthConfig;

package/dist/core.d.ts

@@ -6,6 +6,10 @@ export interface Core {
      *  Allocates a new authenticated client and returns its id.
      */
     initClient(config: string): Promise<string>;
+    /**
+     *  Allocates a new authenticated client using an OIDC token fetcher and returns its id.
+     */
+    initClientOidc(config: string, fetcher: (audience: string) => Promise<string>): Promise<string>;
     /**
      *  Calls async business logic from a given client and returns the result.
      */
@@ -30,6 +34,14 @@ export interface ClientAuthConfig {
     architecture: string;
     serviceAccountToken?: string;
     accountName?: string;
+    workloadDetails?: WorkloadDetails;
+}
+/**
+ *  Contains workload authentication details for OIDC-based workload identity.
+ */
+export interface WorkloadDetails {
+    customerManagedSecret: string;
+    workloadUuid: string;
 }
 /**
  *  Contains the information sent to the SDK core when you call (invoke) a function.
@@ -64,6 +76,7 @@ export interface Parameters {
 }
 export declare class WasmCore implements Core {
     initClient(config: string): Promise<string>;
+    initClientOidc(config: string, fetcher: (audience: string) => Promise<string>): Promise<string>;
     invoke(config: string): Promise<string>;
     releaseClient(clientId: string): void;
 }
@@ -75,6 +88,7 @@ export declare class SharedCore {
     constructor();
     setInner(core: Core): void;
     initClient(config: ClientAuthConfig): Promise<string>;
+    initClientOidc(config: ClientAuthConfig, fetcher: (audience: string) => Promise<string>): Promise<string>;
     invoke(config: InvokeConfig): Promise<string>;
     invoke_sync(config: InvokeConfig): string;
     releaseClient(clientId: number): void;

package/dist/core.js

@@ -28,6 +28,16 @@ class WasmCore {
             }
         });
     }
+    initClientOidc(config, fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield (0, sdk_core_1.init_client_oidc)(config, fetcher);
+            }
+            catch (e) {
+                (0, errors_1.throwError)(e);
+            }
+        });
+    }
     invoke(config) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
@@ -64,6 +74,12 @@ class SharedCore {
             return this.inner.initClient(serializedConfig);
         });
     }
+    initClientOidc(config, fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const serializedConfig = JSON.stringify(config);
+            return this.inner.initClientOidc(serializedConfig, fetcher);
+        });
+    }
     invoke(config) {
         return __awaiter(this, void 0, void 0, function* () {
             const serializedConfig = JSON.stringify(config, types_1.ReplacerFunc);

package/dist/errors.d.ts

@@ -6,4 +6,8 @@ export declare class RateLimitExceededError extends Error {
     message: string;
     constructor(message: string);
 }
+export declare class AuthExpiredError extends Error {
+    message: string;
+    constructor(message: string);
+}
 export declare const throwError: (errString: string) => never;

package/dist/errors.js

@@ -1,7 +1,7 @@
 "use strict";
 // Code generated by op-codegen - DO NOT EDIT MANUALLY
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.throwError = exports.RateLimitExceededError = exports.DesktopSessionExpiredError = void 0;
+exports.throwError = exports.AuthExpiredError = exports.RateLimitExceededError = exports.DesktopSessionExpiredError = void 0;
 class DesktopSessionExpiredError extends Error {
     constructor(message) {
         super();
@@ -16,6 +16,13 @@ class RateLimitExceededError extends Error {
     }
 }
 exports.RateLimitExceededError = RateLimitExceededError;
+class AuthExpiredError extends Error {
+    constructor(message) {
+        super();
+        this.message = message;
+    }
+}
+exports.AuthExpiredError = AuthExpiredError;
 const throwError = (errString) => {
     let err;
     try {
@@ -29,6 +36,8 @@ const throwError = (errString) => {
             throw new DesktopSessionExpiredError(err.message);
         case "RateLimitExceeded":
             throw new RateLimitExceededError(err.message);
+        case "AuthExpired":
+            throw new AuthExpiredError(err.message);
         default:
             throw new Error(err.message);
     }

package/dist/shared_lib_core.d.ts

@@ -11,6 +11,7 @@ export declare class SharedLibCore implements Core {
      */
     private callSharedLibrary;
     initClient(config: string): Promise<string>;
+    initClientOidc(config: string, _fetcher: (audience: string) => Promise<string>): Promise<string>;
     invoke(invokeConfigBytes: string): Promise<string>;
     releaseClient(clientId: string): void;
 }

package/dist/shared_lib_core.js

@@ -163,6 +163,12 @@ class SharedLibCore {
             return this.callSharedLibrary(config, "init_client");
         });
     }
+    // eslint-disable-next-line @typescript-eslint/require-await
+    initClientOidc(config, _fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            throw new Error("OIDC authentication is not supported with desktop auth");
+        });
+    }
     invoke(invokeConfigBytes) {
         return __awaiter(this, void 0, void 0, function* () {
             return this.callSharedLibrary(invokeConfigBytes, "invoke");

package/dist/types.d.ts

@@ -18,7 +18,14 @@ export interface DocumentCreateParams {
     /** The content of the file */
     content: Uint8Array;
 }
-/** Represents an environment variable (name:value pair) and its masked state */
+/**
+ * One environment variable resolved by the credential broker.
+ *
+ * Shared between the Environments API (`GetVariablesResponse`) and the
+ * Credentials API (`CredentialResponse::Environment`, gated on
+ * `brokered-access`), since both surfaces read from the same credential
+ * broker enclave endpoint.
+ */
 export interface EnvironmentVariable {
     /** An environment variable's name */
     name: string;
@@ -107,7 +114,8 @@ export declare enum GroupState {
 }
 export declare enum VaultAccessorType {
     User = "user",
-    Group = "group"
+    Group = "group",
+    Broker = "broker"
 }
 /** Represents the vault access information. */
 export interface VaultAccess {
@@ -619,7 +627,7 @@ export interface Vault {
     activeItemCount: number;
     /** The content version number of the vault. It gets incremented whenever the state of the vault's contents changes (e.g. items from within the vault get created or updated). */
     contentVersion: number;
-    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its title or icon. */
+    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its name or icon. */
     attributeVersion: number;
     /** The access information associated with the vault. */
     access?: VaultAccess[];
@@ -651,7 +659,7 @@ export interface VaultOverview {
     activeItemCount: number;
     /** The content version number of the vault. It gets incremented whenever the state of the vault's contents changes (e.g. items from within the vault get created or updated). */
     contentVersion: number;
-    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its title or icon. */
+    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its name or icon. */
     attributeVersion: number;
     /** The time the vault was created at */
     createdAt: Date;

package/dist/types.js

@@ -57,6 +57,7 @@ var VaultAccessorType;
 (function (VaultAccessorType) {
     VaultAccessorType["User"] = "user";
     VaultAccessorType["Group"] = "group";
+    VaultAccessorType["Broker"] = "broker";
 })(VaultAccessorType || (exports.VaultAccessorType = VaultAccessorType = {}));
 var ItemCategory;
 (function (ItemCategory) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const SDK_VERSION = "0.4.1";
-export declare const SDK_BUILD_NUMBER = "0040102";
+export declare const SDK_VERSION = "0.5.0";
+export declare const SDK_BUILD_NUMBER = "0050002";

package/dist/version.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_BUILD_NUMBER = exports.SDK_VERSION = void 0;
-exports.SDK_VERSION = "0.4.1";
-exports.SDK_BUILD_NUMBER = "0040102";
-const SDK_CORE_VERSION = "0.4.1";
+exports.SDK_VERSION = "0.5.0";
+exports.SDK_BUILD_NUMBER = "0050002";
+const SDK_CORE_VERSION = "0.5.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1password/sdk",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "The 1Password JavaScript SDK offers programmatic read access to your secrets in 1Password in an interface native to JavaScript. The SDK currently supports `Node.JS`",
   "scripts": {
     "build": "tsc",
@@ -26,7 +26,7 @@
   "main": "./dist/sdk.js",
   "types": "./dist/sdk.d.ts",
   "dependencies": {
-    "@1password/sdk-core": "0.4.1"
+    "@1password/sdk-core": "0.5.0"
   },
   "devDependencies": {
     "@1password/eslint-config": "^4.0.0",