@aws-sdk/credential-provider-sso 3.490.0 → 3.495.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,61 +1 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.fromSSO = void 0;
4
- const property_provider_1 = require("@smithy/property-provider");
5
- const shared_ini_file_loader_1 = require("@smithy/shared-ini-file-loader");
6
- const isSsoProfile_1 = require("./isSsoProfile");
7
- const resolveSSOCredentials_1 = require("./resolveSSOCredentials");
8
- const validateSsoProfile_1 = require("./validateSsoProfile");
9
- const fromSSO = (init = {}) => async () => {
10
- const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, ssoSession } = init;
11
- const profileName = (0, shared_ini_file_loader_1.getProfileName)(init);
12
- if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
13
- const profiles = await (0, shared_ini_file_loader_1.parseKnownFiles)(init);
14
- const profile = profiles[profileName];
15
- if (!profile) {
16
- throw new property_provider_1.CredentialsProviderError(`Profile ${profileName} was not found.`);
17
- }
18
- if (!(0, isSsoProfile_1.isSsoProfile)(profile)) {
19
- throw new property_provider_1.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`);
20
- }
21
- if (profile === null || profile === void 0 ? void 0 : profile.sso_session) {
22
- const ssoSessions = await (0, shared_ini_file_loader_1.loadSsoSessionData)(init);
23
- const session = ssoSessions[profile.sso_session];
24
- const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
25
- if (ssoRegion && ssoRegion !== session.sso_region) {
26
- throw new property_provider_1.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, false);
27
- }
28
- if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
29
- throw new property_provider_1.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, false);
30
- }
31
- profile.sso_region = session.sso_region;
32
- profile.sso_start_url = session.sso_start_url;
33
- }
34
- const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = (0, validateSsoProfile_1.validateSsoProfile)(profile);
35
- return (0, resolveSSOCredentials_1.resolveSSOCredentials)({
36
- ssoStartUrl: sso_start_url,
37
- ssoSession: sso_session,
38
- ssoAccountId: sso_account_id,
39
- ssoRegion: sso_region,
40
- ssoRoleName: sso_role_name,
41
- ssoClient: ssoClient,
42
- profile: profileName,
43
- });
44
- }
45
- else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
46
- throw new property_provider_1.CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " +
47
- '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"');
48
- }
49
- else {
50
- return (0, resolveSSOCredentials_1.resolveSSOCredentials)({
51
- ssoStartUrl,
52
- ssoSession,
53
- ssoAccountId,
54
- ssoRegion,
55
- ssoRoleName,
56
- ssoClient,
57
- profile: profileName,
58
- });
59
- }
60
- };
61
- exports.fromSSO = fromSSO;
1
+ module.exports = require("./index.js");
package/dist-cjs/index.js CHANGED
@@ -1,7 +1,175 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- const tslib_1 = require("tslib");
4
- tslib_1.__exportStar(require("./fromSSO"), exports);
5
- tslib_1.__exportStar(require("./isSsoProfile"), exports);
6
- tslib_1.__exportStar(require("./types"), exports);
7
- tslib_1.__exportStar(require("./validateSsoProfile"), exports);
1
+ var __defProp = Object.defineProperty;
2
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
3
+ var __getOwnPropNames = Object.getOwnPropertyNames;
4
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
5
+ var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
6
+ var __export = (target, all) => {
7
+ for (var name in all)
8
+ __defProp(target, name, { get: all[name], enumerable: true });
9
+ };
10
+ var __copyProps = (to, from, except, desc) => {
11
+ if (from && typeof from === "object" || typeof from === "function") {
12
+ for (let key of __getOwnPropNames(from))
13
+ if (!__hasOwnProp.call(to, key) && key !== except)
14
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
15
+ }
16
+ return to;
17
+ };
18
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
19
+
20
+ // src/index.ts
21
+ var src_exports = {};
22
+ __export(src_exports, {
23
+ fromSSO: () => fromSSO,
24
+ isSsoProfile: () => isSsoProfile,
25
+ validateSsoProfile: () => validateSsoProfile
26
+ });
27
+ module.exports = __toCommonJS(src_exports);
28
+
29
+ // src/fromSSO.ts
30
+
31
+
32
+
33
+ // src/isSsoProfile.ts
34
+ var isSsoProfile = /* @__PURE__ */ __name((arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string"), "isSsoProfile");
35
+
36
+ // src/resolveSSOCredentials.ts
37
+ var import_client_sso = require("@aws-sdk/client-sso");
38
+ var import_token_providers = require("@aws-sdk/token-providers");
39
+ var import_property_provider = require("@smithy/property-provider");
40
+ var import_shared_ini_file_loader = require("@smithy/shared-ini-file-loader");
41
+ var SHOULD_FAIL_CREDENTIAL_CHAIN = false;
42
+ var resolveSSOCredentials = /* @__PURE__ */ __name(async ({
43
+ ssoStartUrl,
44
+ ssoSession,
45
+ ssoAccountId,
46
+ ssoRegion,
47
+ ssoRoleName,
48
+ ssoClient,
49
+ profile
50
+ }) => {
51
+ var _a;
52
+ let token;
53
+ const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
54
+ if (ssoSession) {
55
+ try {
56
+ const _token = await (0, import_token_providers.fromSso)({ profile })();
57
+ token = {
58
+ accessToken: _token.token,
59
+ expiresAt: new Date(_token.expiration).toISOString()
60
+ };
61
+ } catch (e) {
62
+ throw new import_property_provider.CredentialsProviderError(e.message, SHOULD_FAIL_CREDENTIAL_CHAIN);
63
+ }
64
+ } else {
65
+ try {
66
+ token = await (0, import_shared_ini_file_loader.getSSOTokenFromFile)(ssoStartUrl);
67
+ } catch (e) {
68
+ throw new import_property_provider.CredentialsProviderError(
69
+ `The SSO session associated with this profile is invalid. ${refreshMessage}`,
70
+ SHOULD_FAIL_CREDENTIAL_CHAIN
71
+ );
72
+ }
73
+ }
74
+ if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
75
+ throw new import_property_provider.CredentialsProviderError(
76
+ `The SSO session associated with this profile has expired. ${refreshMessage}`,
77
+ SHOULD_FAIL_CREDENTIAL_CHAIN
78
+ );
79
+ }
80
+ const { accessToken } = token;
81
+ const sso = ssoClient || new import_client_sso.SSOClient({ region: ssoRegion });
82
+ let ssoResp;
83
+ try {
84
+ ssoResp = await sso.send(
85
+ new import_client_sso.GetRoleCredentialsCommand({
86
+ accountId: ssoAccountId,
87
+ roleName: ssoRoleName,
88
+ accessToken
89
+ })
90
+ );
91
+ } catch (e) {
92
+ throw import_property_provider.CredentialsProviderError.from(e, SHOULD_FAIL_CREDENTIAL_CHAIN);
93
+ }
94
+ const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration } = {} } = ssoResp;
95
+ const credentialScope = (_a = ssoResp == null ? void 0 : ssoResp.roleCredentials) == null ? void 0 : _a.credentialScope;
96
+ if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
97
+ throw new import_property_provider.CredentialsProviderError("SSO returns an invalid temporary credential.", SHOULD_FAIL_CREDENTIAL_CHAIN);
98
+ }
99
+ return { accessKeyId, secretAccessKey, sessionToken, expiration: new Date(expiration), credentialScope };
100
+ }, "resolveSSOCredentials");
101
+
102
+ // src/validateSsoProfile.ts
103
+
104
+ var validateSsoProfile = /* @__PURE__ */ __name((profile) => {
105
+ const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
106
+ if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
107
+ throw new import_property_provider.CredentialsProviderError(
108
+ `Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(
109
+ ", "
110
+ )}
111
+ Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,
112
+ false
113
+ );
114
+ }
115
+ return profile;
116
+ }, "validateSsoProfile");
117
+
118
+ // src/fromSSO.ts
119
+ var fromSSO = /* @__PURE__ */ __name((init = {}) => async () => {
120
+ const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, ssoSession } = init;
121
+ const profileName = (0, import_shared_ini_file_loader.getProfileName)(init);
122
+ if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
123
+ const profiles = await (0, import_shared_ini_file_loader.parseKnownFiles)(init);
124
+ const profile = profiles[profileName];
125
+ if (!profile) {
126
+ throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} was not found.`);
127
+ }
128
+ if (!isSsoProfile(profile)) {
129
+ throw new import_property_provider.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`);
130
+ }
131
+ if (profile == null ? void 0 : profile.sso_session) {
132
+ const ssoSessions = await (0, import_shared_ini_file_loader.loadSsoSessionData)(init);
133
+ const session = ssoSessions[profile.sso_session];
134
+ const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
135
+ if (ssoRegion && ssoRegion !== session.sso_region) {
136
+ throw new import_property_provider.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, false);
137
+ }
138
+ if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
139
+ throw new import_property_provider.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, false);
140
+ }
141
+ profile.sso_region = session.sso_region;
142
+ profile.sso_start_url = session.sso_start_url;
143
+ }
144
+ const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile);
145
+ return resolveSSOCredentials({
146
+ ssoStartUrl: sso_start_url,
147
+ ssoSession: sso_session,
148
+ ssoAccountId: sso_account_id,
149
+ ssoRegion: sso_region,
150
+ ssoRoleName: sso_role_name,
151
+ ssoClient,
152
+ profile: profileName
153
+ });
154
+ } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
155
+ throw new import_property_provider.CredentialsProviderError(
156
+ 'Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"'
157
+ );
158
+ } else {
159
+ return resolveSSOCredentials({
160
+ ssoStartUrl,
161
+ ssoSession,
162
+ ssoAccountId,
163
+ ssoRegion,
164
+ ssoRoleName,
165
+ ssoClient,
166
+ profile: profileName
167
+ });
168
+ }
169
+ }, "fromSSO");
170
+ // Annotate the CommonJS export names for ESM import in node:
171
+ 0 && (module.exports = {
172
+ fromSSO,
173
+ isSsoProfile,
174
+ validateSsoProfile
175
+ });
@@ -1,10 +1 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.isSsoProfile = void 0;
4
- const isSsoProfile = (arg) => arg &&
5
- (typeof arg.sso_start_url === "string" ||
6
- typeof arg.sso_account_id === "string" ||
7
- typeof arg.sso_session === "string" ||
8
- typeof arg.sso_region === "string" ||
9
- typeof arg.sso_role_name === "string");
10
- exports.isSsoProfile = isSsoProfile;
1
+ module.exports = require("./index.js");
@@ -1,56 +1 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.resolveSSOCredentials = void 0;
4
- const client_sso_1 = require("@aws-sdk/client-sso");
5
- const token_providers_1 = require("@aws-sdk/token-providers");
6
- const property_provider_1 = require("@smithy/property-provider");
7
- const shared_ini_file_loader_1 = require("@smithy/shared-ini-file-loader");
8
- const SHOULD_FAIL_CREDENTIAL_CHAIN = false;
9
- const resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, profile, }) => {
10
- var _a;
11
- let token;
12
- const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
13
- if (ssoSession) {
14
- try {
15
- const _token = await (0, token_providers_1.fromSso)({ profile })();
16
- token = {
17
- accessToken: _token.token,
18
- expiresAt: new Date(_token.expiration).toISOString(),
19
- };
20
- }
21
- catch (e) {
22
- throw new property_provider_1.CredentialsProviderError(e.message, SHOULD_FAIL_CREDENTIAL_CHAIN);
23
- }
24
- }
25
- else {
26
- try {
27
- token = await (0, shared_ini_file_loader_1.getSSOTokenFromFile)(ssoStartUrl);
28
- }
29
- catch (e) {
30
- throw new property_provider_1.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, SHOULD_FAIL_CREDENTIAL_CHAIN);
31
- }
32
- }
33
- if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
34
- throw new property_provider_1.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, SHOULD_FAIL_CREDENTIAL_CHAIN);
35
- }
36
- const { accessToken } = token;
37
- const sso = ssoClient || new client_sso_1.SSOClient({ region: ssoRegion });
38
- let ssoResp;
39
- try {
40
- ssoResp = await sso.send(new client_sso_1.GetRoleCredentialsCommand({
41
- accountId: ssoAccountId,
42
- roleName: ssoRoleName,
43
- accessToken,
44
- }));
45
- }
46
- catch (e) {
47
- throw property_provider_1.CredentialsProviderError.from(e, SHOULD_FAIL_CREDENTIAL_CHAIN);
48
- }
49
- const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration } = {} } = ssoResp;
50
- const credentialScope = (_a = ssoResp === null || ssoResp === void 0 ? void 0 : ssoResp.roleCredentials) === null || _a === void 0 ? void 0 : _a.credentialScope;
51
- if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
52
- throw new property_provider_1.CredentialsProviderError("SSO returns an invalid temporary credential.", SHOULD_FAIL_CREDENTIAL_CHAIN);
53
- }
54
- return { accessKeyId, secretAccessKey, sessionToken, expiration: new Date(expiration), credentialScope };
55
- };
56
- exports.resolveSSOCredentials = resolveSSOCredentials;
1
+ module.exports = require("./index.js");
package/dist-cjs/types.js CHANGED
@@ -1,2 +1 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
1
+ module.exports = require("./index.js");
@@ -1,13 +1 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.validateSsoProfile = void 0;
4
- const property_provider_1 = require("@smithy/property-provider");
5
- const validateSsoProfile = (profile) => {
6
- const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
7
- if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
8
- throw new property_provider_1.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` +
9
- `"sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}\nReference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, false);
10
- }
11
- return profile;
12
- };
13
- exports.validateSsoProfile = validateSsoProfile;
1
+ module.exports = require("./index.js");
package/package.json CHANGED
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "name": "@aws-sdk/credential-provider-sso",
3
- "version": "3.490.0",
3
+ "version": "3.495.0",
4
4
  "description": "AWS credential provider that exchanges a resolved SSO login token file for temporary AWS credentials",
5
5
  "main": "./dist-cjs/index.js",
6
6
  "module": "./dist-es/index.js",
7
7
  "scripts": {
8
8
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
9
- "build:cjs": "tsc -p tsconfig.cjs.json",
9
+ "build:cjs": "node ../../scripts/compilation/inline credential-provider-sso",
10
10
  "build:es": "tsc -p tsconfig.es.json",
11
11
  "build:include:deps": "lerna run --scope $npm_package_name --include-dependencies build",
12
12
  "build:types": "tsc -p tsconfig.types.json",
@@ -24,12 +24,12 @@
24
24
  },
25
25
  "license": "Apache-2.0",
26
26
  "dependencies": {
27
- "@aws-sdk/client-sso": "3.490.0",
28
- "@aws-sdk/token-providers": "3.489.0",
29
- "@aws-sdk/types": "3.489.0",
30
- "@smithy/property-provider": "^2.0.0",
31
- "@smithy/shared-ini-file-loader": "^2.0.6",
32
- "@smithy/types": "^2.8.0",
27
+ "@aws-sdk/client-sso": "3.495.0",
28
+ "@aws-sdk/token-providers": "3.495.0",
29
+ "@aws-sdk/types": "3.495.0",
30
+ "@smithy/property-provider": "^2.1.0",
31
+ "@smithy/shared-ini-file-loader": "^2.3.0",
32
+ "@smithy/types": "^2.9.0",
33
33
  "tslib": "^2.5.0"
34
34
  },
35
35
  "devDependencies": {