@aws-sdk/nested-clients 3.935.0 → 3.939.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist-cjs/submodules/signin/auth/httpAuthSchemeProvider.js +56 -0
- package/dist-cjs/submodules/signin/endpoint/endpointResolver.js +18 -0
- package/dist-cjs/submodules/signin/endpoint/ruleset.js +7 -0
- package/dist-cjs/submodules/signin/index.js +439 -0
- package/dist-cjs/submodules/signin/runtimeConfig.browser.js +39 -0
- package/dist-cjs/submodules/signin/runtimeConfig.js +54 -0
- package/dist-cjs/submodules/signin/runtimeConfig.native.js +15 -0
- package/dist-cjs/submodules/signin/runtimeConfig.shared.js +42 -0
- package/dist-es/submodules/signin/Signin.js +9 -0
- package/dist-es/submodules/signin/SigninClient.js +50 -0
- package/dist-es/submodules/signin/auth/httpAuthExtensionConfiguration.js +38 -0
- package/dist-es/submodules/signin/auth/httpAuthSchemeProvider.js +50 -0
- package/dist-es/submodules/signin/commands/CreateOAuth2TokenCommand.js +16 -0
- package/dist-es/submodules/signin/commands/index.js +1 -0
- package/dist-es/submodules/signin/endpoint/EndpointParameters.js +13 -0
- package/dist-es/submodules/signin/endpoint/endpointResolver.js +14 -0
- package/dist-es/submodules/signin/endpoint/ruleset.js +4 -0
- package/dist-es/submodules/signin/extensionConfiguration.js +1 -0
- package/dist-es/submodules/signin/index.js +6 -0
- package/dist-es/submodules/signin/models/SigninServiceException.js +8 -0
- package/dist-es/submodules/signin/models/enums.js +8 -0
- package/dist-es/submodules/signin/models/errors.js +57 -0
- package/dist-es/submodules/signin/models/models_0.js +1 -0
- package/dist-es/submodules/signin/runtimeConfig.browser.js +34 -0
- package/dist-es/submodules/signin/runtimeConfig.js +49 -0
- package/dist-es/submodules/signin/runtimeConfig.native.js +11 -0
- package/dist-es/submodules/signin/runtimeConfig.shared.js +38 -0
- package/dist-es/submodules/signin/runtimeExtensions.js +9 -0
- package/dist-es/submodules/signin/schemas/schemas_0.js +221 -0
- package/dist-types/submodules/signin/Signin.d.ts +18 -0
- package/dist-types/submodules/signin/SigninClient.d.ts +198 -0
- package/dist-types/submodules/signin/auth/httpAuthExtensionConfiguration.d.ts +29 -0
- package/dist-types/submodules/signin/auth/httpAuthSchemeProvider.d.ts +75 -0
- package/dist-types/submodules/signin/commands/CreateOAuth2TokenCommand.d.ts +157 -0
- package/dist-types/submodules/signin/commands/index.d.ts +1 -0
- package/dist-types/submodules/signin/endpoint/EndpointParameters.d.ts +38 -0
- package/dist-types/submodules/signin/endpoint/endpointResolver.d.ts +5 -0
- package/dist-types/submodules/signin/endpoint/ruleset.d.ts +2 -0
- package/dist-types/submodules/signin/extensionConfiguration.d.ts +9 -0
- package/dist-types/submodules/signin/index.d.ts +16 -0
- package/dist-types/submodules/signin/models/SigninServiceException.d.ts +14 -0
- package/dist-types/submodules/signin/models/enums.d.ts +34 -0
- package/dist-types/submodules/signin/models/errors.d.ts +102 -0
- package/dist-types/submodules/signin/models/models_0.d.ts +142 -0
- package/dist-types/submodules/signin/runtimeConfig.browser.d.ts +59 -0
- package/dist-types/submodules/signin/runtimeConfig.d.ts +59 -0
- package/dist-types/submodules/signin/runtimeConfig.native.d.ts +58 -0
- package/dist-types/submodules/signin/runtimeConfig.shared.d.ts +33 -0
- package/dist-types/submodules/signin/runtimeExtensions.d.ts +17 -0
- package/dist-types/submodules/signin/schemas/schemas_0.d.ts +14 -0
- package/dist-types/submodules/sts/commands/AssumeRoleCommand.d.ts +2 -3
- package/dist-types/submodules/sts/commands/AssumeRoleWithWebIdentityCommand.d.ts +2 -3
- package/dist-types/submodules/sts/models/errors.d.ts +2 -3
- package/dist-types/ts3.4/submodules/signin/Signin.d.ts +22 -0
- package/dist-types/ts3.4/submodules/signin/SigninClient.d.ts +127 -0
- package/dist-types/ts3.4/submodules/signin/auth/httpAuthExtensionConfiguration.d.ts +32 -0
- package/dist-types/ts3.4/submodules/signin/auth/httpAuthSchemeProvider.d.ts +47 -0
- package/dist-types/ts3.4/submodules/signin/commands/CreateOAuth2TokenCommand.d.ts +47 -0
- package/dist-types/ts3.4/submodules/signin/commands/index.d.ts +1 -0
- package/dist-types/ts3.4/submodules/signin/endpoint/EndpointParameters.d.ts +51 -0
- package/dist-types/ts3.4/submodules/signin/endpoint/endpointResolver.d.ts +8 -0
- package/dist-types/ts3.4/submodules/signin/endpoint/ruleset.d.ts +2 -0
- package/dist-types/ts3.4/submodules/signin/extensionConfiguration.d.ts +9 -0
- package/dist-types/ts3.4/submodules/signin/index.d.ts +10 -0
- package/dist-types/ts3.4/submodules/signin/models/SigninServiceException.d.ts +9 -0
- package/dist-types/ts3.4/submodules/signin/models/enums.d.ts +10 -0
- package/dist-types/ts3.4/submodules/signin/models/errors.d.ts +35 -0
- package/dist-types/ts3.4/submodules/signin/models/models_0.d.ts +26 -0
- package/dist-types/ts3.4/submodules/signin/runtimeConfig.browser.d.ts +121 -0
- package/dist-types/ts3.4/submodules/signin/runtimeConfig.d.ts +114 -0
- package/dist-types/ts3.4/submodules/signin/runtimeConfig.native.d.ts +125 -0
- package/dist-types/ts3.4/submodules/signin/runtimeConfig.shared.d.ts +53 -0
- package/dist-types/ts3.4/submodules/signin/runtimeExtensions.d.ts +11 -0
- package/dist-types/ts3.4/submodules/signin/schemas/schemas_0.d.ts +19 -0
- package/package.json +22 -11
- package/signin.d.ts +7 -0
- package/signin.js +5 -0
|
@@ -0,0 +1,157 @@
|
|
|
1
|
+
import { Command as $Command } from "@smithy/smithy-client";
|
|
2
|
+
import { MetadataBearer as __MetadataBearer } from "@smithy/types";
|
|
3
|
+
import { CreateOAuth2TokenRequest, CreateOAuth2TokenResponse } from "../models/models_0";
|
|
4
|
+
import { SigninClientResolvedConfig } from "../SigninClient";
|
|
5
|
+
/**
|
|
6
|
+
* @public
|
|
7
|
+
*/
|
|
8
|
+
export type { __MetadataBearer };
|
|
9
|
+
export { $Command };
|
|
10
|
+
/**
|
|
11
|
+
* @public
|
|
12
|
+
*
|
|
13
|
+
* The input for {@link CreateOAuth2TokenCommand}.
|
|
14
|
+
*/
|
|
15
|
+
export interface CreateOAuth2TokenCommandInput extends CreateOAuth2TokenRequest {
|
|
16
|
+
}
|
|
17
|
+
/**
|
|
18
|
+
* @public
|
|
19
|
+
*
|
|
20
|
+
* The output of {@link CreateOAuth2TokenCommand}.
|
|
21
|
+
*/
|
|
22
|
+
export interface CreateOAuth2TokenCommandOutput extends CreateOAuth2TokenResponse, __MetadataBearer {
|
|
23
|
+
}
|
|
24
|
+
declare const CreateOAuth2TokenCommand_base: {
|
|
25
|
+
new (input: CreateOAuth2TokenCommandInput): import("@smithy/smithy-client").CommandImpl<CreateOAuth2TokenCommandInput, CreateOAuth2TokenCommandOutput, SigninClientResolvedConfig, CreateOAuth2TokenCommandInput, CreateOAuth2TokenCommandOutput>;
|
|
26
|
+
new (input: CreateOAuth2TokenCommandInput): import("@smithy/smithy-client").CommandImpl<CreateOAuth2TokenCommandInput, CreateOAuth2TokenCommandOutput, SigninClientResolvedConfig, CreateOAuth2TokenCommandInput, CreateOAuth2TokenCommandOutput>;
|
|
27
|
+
getEndpointParameterInstructions(): import("@smithy/middleware-endpoint").EndpointParameterInstructions;
|
|
28
|
+
};
|
|
29
|
+
/**
|
|
30
|
+
* CreateOAuth2Token API
|
|
31
|
+
*
|
|
32
|
+
* Path: /v1/token
|
|
33
|
+
* Request Method: POST
|
|
34
|
+
* Content-Type: application/json or application/x-www-form-urlencoded
|
|
35
|
+
*
|
|
36
|
+
* This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both:
|
|
37
|
+
* 1. Authorization code redemption (grant_type=authorization_code) - NOT idempotent
|
|
38
|
+
* 2. Token refresh (grant_type=refresh_token) - Idempotent within token validity window
|
|
39
|
+
*
|
|
40
|
+
* The operation behavior is determined by the grant_type parameter in the request body:
|
|
41
|
+
*
|
|
42
|
+
* **Authorization Code Flow (NOT Idempotent):**
|
|
43
|
+
* - JSON or form-encoded body with client_id, grant_type=authorization_code, code, redirect_uri, code_verifier
|
|
44
|
+
* - Returns access_token, token_type, expires_in, refresh_token, and id_token
|
|
45
|
+
* - Each authorization code can only be used ONCE for security (prevents replay attacks)
|
|
46
|
+
*
|
|
47
|
+
* **Token Refresh Flow (Idempotent):**
|
|
48
|
+
* - JSON or form-encoded body with client_id, grant_type=refresh_token, refresh_token
|
|
49
|
+
* - Returns access_token, token_type, expires_in, and refresh_token (no id_token)
|
|
50
|
+
* - Multiple calls with same refresh_token return consistent results within validity window
|
|
51
|
+
*
|
|
52
|
+
* Authentication and authorization:
|
|
53
|
+
* - Confidential clients: sigv4 signing required with signin:ExchangeToken permissions
|
|
54
|
+
* - CLI clients (public): authn/authz skipped based on client_id & grant_type
|
|
55
|
+
*
|
|
56
|
+
* Note: This operation cannot be marked as @idempotent because it handles both idempotent
|
|
57
|
+
* (token refresh) and non-idempotent (auth code redemption) flows in a single endpoint.
|
|
58
|
+
* @example
|
|
59
|
+
* Use a bare-bones client and the command you need to make an API call.
|
|
60
|
+
* ```javascript
|
|
61
|
+
* import { SigninClient, CreateOAuth2TokenCommand } from "@aws-sdk/client-signin"; // ES Modules import
|
|
62
|
+
* // const { SigninClient, CreateOAuth2TokenCommand } = require("@aws-sdk/client-signin"); // CommonJS import
|
|
63
|
+
* // import type { SigninClientConfig } from "@aws-sdk/client-signin";
|
|
64
|
+
* const config = {}; // type is SigninClientConfig
|
|
65
|
+
* const client = new SigninClient(config);
|
|
66
|
+
* const input = { // CreateOAuth2TokenRequest
|
|
67
|
+
* tokenInput: { // CreateOAuth2TokenRequestBody
|
|
68
|
+
* clientId: "STRING_VALUE", // required
|
|
69
|
+
* grantType: "STRING_VALUE", // required
|
|
70
|
+
* code: "STRING_VALUE",
|
|
71
|
+
* redirectUri: "STRING_VALUE",
|
|
72
|
+
* codeVerifier: "STRING_VALUE",
|
|
73
|
+
* refreshToken: "STRING_VALUE",
|
|
74
|
+
* },
|
|
75
|
+
* };
|
|
76
|
+
* const command = new CreateOAuth2TokenCommand(input);
|
|
77
|
+
* const response = await client.send(command);
|
|
78
|
+
* // { // CreateOAuth2TokenResponse
|
|
79
|
+
* // tokenOutput: { // CreateOAuth2TokenResponseBody
|
|
80
|
+
* // accessToken: { // AccessToken
|
|
81
|
+
* // accessKeyId: "STRING_VALUE", // required
|
|
82
|
+
* // secretAccessKey: "STRING_VALUE", // required
|
|
83
|
+
* // sessionToken: "STRING_VALUE", // required
|
|
84
|
+
* // },
|
|
85
|
+
* // tokenType: "STRING_VALUE", // required
|
|
86
|
+
* // expiresIn: Number("int"), // required
|
|
87
|
+
* // refreshToken: "STRING_VALUE", // required
|
|
88
|
+
* // idToken: "STRING_VALUE",
|
|
89
|
+
* // },
|
|
90
|
+
* // };
|
|
91
|
+
*
|
|
92
|
+
* ```
|
|
93
|
+
*
|
|
94
|
+
* @param CreateOAuth2TokenCommandInput - {@link CreateOAuth2TokenCommandInput}
|
|
95
|
+
* @returns {@link CreateOAuth2TokenCommandOutput}
|
|
96
|
+
* @see {@link CreateOAuth2TokenCommandInput} for command's `input` shape.
|
|
97
|
+
* @see {@link CreateOAuth2TokenCommandOutput} for command's `response` shape.
|
|
98
|
+
* @see {@link SigninClientResolvedConfig | config} for SigninClient's `config` shape.
|
|
99
|
+
*
|
|
100
|
+
* @throws {@link AccessDeniedException} (client fault)
|
|
101
|
+
* Error thrown for access denied scenarios with flexible HTTP status mapping
|
|
102
|
+
*
|
|
103
|
+
* Runtime HTTP Status Code Mapping:
|
|
104
|
+
* - HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
|
|
105
|
+
* - HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS
|
|
106
|
+
*
|
|
107
|
+
* The specific HTTP status code is determined at runtime based on the error enum value.
|
|
108
|
+
* Consumers should use the error field to determine the specific access denial reason.
|
|
109
|
+
*
|
|
110
|
+
* @throws {@link InternalServerException} (server fault)
|
|
111
|
+
* Error thrown when an internal server error occurs
|
|
112
|
+
*
|
|
113
|
+
* HTTP Status Code: 500 Internal Server Error
|
|
114
|
+
*
|
|
115
|
+
* Used for unexpected server-side errors that prevent request processing.
|
|
116
|
+
*
|
|
117
|
+
* @throws {@link TooManyRequestsError} (client fault)
|
|
118
|
+
* Error thrown when rate limit is exceeded
|
|
119
|
+
*
|
|
120
|
+
* HTTP Status Code: 429 Too Many Requests
|
|
121
|
+
*
|
|
122
|
+
* Possible OAuth2ErrorCode values:
|
|
123
|
+
* - INVALID_REQUEST: Rate limiting, too many requests, abuse prevention
|
|
124
|
+
*
|
|
125
|
+
* Possible causes:
|
|
126
|
+
* - Too many token requests from the same client
|
|
127
|
+
* - Rate limiting based on client_id or IP address
|
|
128
|
+
* - Abuse prevention mechanisms triggered
|
|
129
|
+
* - Service protection against excessive token generation
|
|
130
|
+
*
|
|
131
|
+
* @throws {@link ValidationException} (client fault)
|
|
132
|
+
* Error thrown when request validation fails
|
|
133
|
+
*
|
|
134
|
+
* HTTP Status Code: 400 Bad Request
|
|
135
|
+
*
|
|
136
|
+
* Used for request validation errors such as malformed parameters,
|
|
137
|
+
* missing required fields, or invalid parameter values.
|
|
138
|
+
*
|
|
139
|
+
* @throws {@link SigninServiceException}
|
|
140
|
+
* <p>Base exception class for all service exceptions from Signin service.</p>
|
|
141
|
+
*
|
|
142
|
+
*
|
|
143
|
+
* @public
|
|
144
|
+
*/
|
|
145
|
+
export declare class CreateOAuth2TokenCommand extends CreateOAuth2TokenCommand_base {
|
|
146
|
+
/** @internal type navigation helper, not in runtime. */
|
|
147
|
+
protected static __types: {
|
|
148
|
+
api: {
|
|
149
|
+
input: CreateOAuth2TokenRequest;
|
|
150
|
+
output: CreateOAuth2TokenResponse;
|
|
151
|
+
};
|
|
152
|
+
sdk: {
|
|
153
|
+
input: CreateOAuth2TokenCommandInput;
|
|
154
|
+
output: CreateOAuth2TokenCommandOutput;
|
|
155
|
+
};
|
|
156
|
+
};
|
|
157
|
+
}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export * from "./CreateOAuth2TokenCommand";
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
import { Endpoint, EndpointParameters as __EndpointParameters, EndpointV2, Provider } from "@smithy/types";
|
|
2
|
+
/**
|
|
3
|
+
* @public
|
|
4
|
+
*/
|
|
5
|
+
export interface ClientInputEndpointParameters {
|
|
6
|
+
useDualstackEndpoint?: boolean | undefined | Provider<boolean | undefined>;
|
|
7
|
+
useFipsEndpoint?: boolean | undefined | Provider<boolean | undefined>;
|
|
8
|
+
endpoint?: string | Provider<string> | Endpoint | Provider<Endpoint> | EndpointV2 | Provider<EndpointV2>;
|
|
9
|
+
region?: string | undefined | Provider<string | undefined>;
|
|
10
|
+
}
|
|
11
|
+
export type ClientResolvedEndpointParameters = Omit<ClientInputEndpointParameters, "endpoint"> & {
|
|
12
|
+
defaultSigningName: string;
|
|
13
|
+
};
|
|
14
|
+
export declare const resolveClientEndpointParameters: <T>(options: T & ClientInputEndpointParameters) => T & ClientResolvedEndpointParameters;
|
|
15
|
+
export declare const commonParams: {
|
|
16
|
+
readonly UseFIPS: {
|
|
17
|
+
readonly type: "builtInParams";
|
|
18
|
+
readonly name: "useFipsEndpoint";
|
|
19
|
+
};
|
|
20
|
+
readonly Endpoint: {
|
|
21
|
+
readonly type: "builtInParams";
|
|
22
|
+
readonly name: "endpoint";
|
|
23
|
+
};
|
|
24
|
+
readonly Region: {
|
|
25
|
+
readonly type: "builtInParams";
|
|
26
|
+
readonly name: "region";
|
|
27
|
+
};
|
|
28
|
+
readonly UseDualStack: {
|
|
29
|
+
readonly type: "builtInParams";
|
|
30
|
+
readonly name: "useDualstackEndpoint";
|
|
31
|
+
};
|
|
32
|
+
};
|
|
33
|
+
export interface EndpointParameters extends __EndpointParameters {
|
|
34
|
+
UseDualStack?: boolean | undefined;
|
|
35
|
+
UseFIPS?: boolean | undefined;
|
|
36
|
+
Endpoint?: string | undefined;
|
|
37
|
+
Region?: string | undefined;
|
|
38
|
+
}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
import { AwsRegionExtensionConfiguration } from "@aws-sdk/types";
|
|
2
|
+
import { HttpHandlerExtensionConfiguration } from "@smithy/protocol-http";
|
|
3
|
+
import { DefaultExtensionConfiguration } from "@smithy/types";
|
|
4
|
+
import { HttpAuthExtensionConfiguration } from "./auth/httpAuthExtensionConfiguration";
|
|
5
|
+
/**
|
|
6
|
+
* @internal
|
|
7
|
+
*/
|
|
8
|
+
export interface SigninExtensionConfiguration extends HttpHandlerExtensionConfiguration, DefaultExtensionConfiguration, AwsRegionExtensionConfiguration, HttpAuthExtensionConfiguration {
|
|
9
|
+
}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* AWS Sign-In manages authentication for AWS services. This service provides
|
|
3
|
+
* secure authentication flows for accessing AWS resources from the console and developer tools.
|
|
4
|
+
*
|
|
5
|
+
* @packageDocumentation
|
|
6
|
+
*/
|
|
7
|
+
export * from "./SigninClient";
|
|
8
|
+
export * from "./Signin";
|
|
9
|
+
export { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
|
|
10
|
+
export type { RuntimeExtension } from "./runtimeExtensions";
|
|
11
|
+
export type { SigninExtensionConfiguration } from "./extensionConfiguration";
|
|
12
|
+
export * from "./commands";
|
|
13
|
+
export * from "./models/enums";
|
|
14
|
+
export * from "./models/errors";
|
|
15
|
+
export type * from "./models/models_0";
|
|
16
|
+
export { SigninServiceException } from "./models/SigninServiceException";
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
import { ServiceException as __ServiceException, ServiceExceptionOptions as __ServiceExceptionOptions } from "@smithy/smithy-client";
|
|
2
|
+
export type { __ServiceExceptionOptions };
|
|
3
|
+
export { __ServiceException };
|
|
4
|
+
/**
|
|
5
|
+
* @public
|
|
6
|
+
*
|
|
7
|
+
* Base exception class for all service exceptions from Signin service.
|
|
8
|
+
*/
|
|
9
|
+
export declare class SigninServiceException extends __ServiceException {
|
|
10
|
+
/**
|
|
11
|
+
* @internal
|
|
12
|
+
*/
|
|
13
|
+
constructor(options: __ServiceExceptionOptions);
|
|
14
|
+
}
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @public
|
|
3
|
+
* @enum
|
|
4
|
+
*/
|
|
5
|
+
export declare const OAuth2ErrorCode: {
|
|
6
|
+
/**
|
|
7
|
+
* Authorization code has expired
|
|
8
|
+
*/
|
|
9
|
+
readonly AUTHCODE_EXPIRED: "AUTHCODE_EXPIRED";
|
|
10
|
+
/**
|
|
11
|
+
* Insufficient permissions to perform this operation
|
|
12
|
+
*/
|
|
13
|
+
readonly INSUFFICIENT_PERMISSIONS: "INSUFFICIENT_PERMISSIONS";
|
|
14
|
+
/**
|
|
15
|
+
* The request is missing a required parameter, includes an invalid parameter value, or is otherwise malformed
|
|
16
|
+
*/
|
|
17
|
+
readonly INVALID_REQUEST: "INVALID_REQUEST";
|
|
18
|
+
/**
|
|
19
|
+
* Internal server error occurred
|
|
20
|
+
*/
|
|
21
|
+
readonly SERVER_ERROR: "server_error";
|
|
22
|
+
/**
|
|
23
|
+
* Token has expired and needs to be refreshed
|
|
24
|
+
*/
|
|
25
|
+
readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
|
|
26
|
+
/**
|
|
27
|
+
* User credentials have been changed
|
|
28
|
+
*/
|
|
29
|
+
readonly USER_CREDENTIALS_CHANGED: "USER_CREDENTIALS_CHANGED";
|
|
30
|
+
};
|
|
31
|
+
/**
|
|
32
|
+
* @public
|
|
33
|
+
*/
|
|
34
|
+
export type OAuth2ErrorCode = (typeof OAuth2ErrorCode)[keyof typeof OAuth2ErrorCode];
|
|
@@ -0,0 +1,102 @@
|
|
|
1
|
+
import { ExceptionOptionType as __ExceptionOptionType } from "@smithy/smithy-client";
|
|
2
|
+
import { OAuth2ErrorCode } from "./enums";
|
|
3
|
+
import { SigninServiceException as __BaseException } from "./SigninServiceException";
|
|
4
|
+
/**
|
|
5
|
+
* Error thrown for access denied scenarios with flexible HTTP status mapping
|
|
6
|
+
*
|
|
7
|
+
* Runtime HTTP Status Code Mapping:
|
|
8
|
+
* - HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
|
|
9
|
+
* - HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS
|
|
10
|
+
*
|
|
11
|
+
* The specific HTTP status code is determined at runtime based on the error enum value.
|
|
12
|
+
* Consumers should use the error field to determine the specific access denial reason.
|
|
13
|
+
* @public
|
|
14
|
+
*/
|
|
15
|
+
export declare class AccessDeniedException extends __BaseException {
|
|
16
|
+
readonly name: "AccessDeniedException";
|
|
17
|
+
readonly $fault: "client";
|
|
18
|
+
/**
|
|
19
|
+
* OAuth 2.0 error code indicating the specific type of access denial
|
|
20
|
+
* Can be TOKEN_EXPIRED, AUTHCODE_EXPIRED, USER_CREDENTIALS_CHANGED, or INSUFFICIENT_PERMISSIONS
|
|
21
|
+
* @public
|
|
22
|
+
*/
|
|
23
|
+
error: OAuth2ErrorCode | undefined;
|
|
24
|
+
/**
|
|
25
|
+
* @internal
|
|
26
|
+
*/
|
|
27
|
+
constructor(opts: __ExceptionOptionType<AccessDeniedException, __BaseException>);
|
|
28
|
+
}
|
|
29
|
+
/**
|
|
30
|
+
* Error thrown when an internal server error occurs
|
|
31
|
+
*
|
|
32
|
+
* HTTP Status Code: 500 Internal Server Error
|
|
33
|
+
*
|
|
34
|
+
* Used for unexpected server-side errors that prevent request processing.
|
|
35
|
+
* @public
|
|
36
|
+
*/
|
|
37
|
+
export declare class InternalServerException extends __BaseException {
|
|
38
|
+
readonly name: "InternalServerException";
|
|
39
|
+
readonly $fault: "server";
|
|
40
|
+
/**
|
|
41
|
+
* OAuth 2.0 error code indicating server error
|
|
42
|
+
* Will be SERVER_ERROR for internal server errors
|
|
43
|
+
* @public
|
|
44
|
+
*/
|
|
45
|
+
error: OAuth2ErrorCode | undefined;
|
|
46
|
+
/**
|
|
47
|
+
* @internal
|
|
48
|
+
*/
|
|
49
|
+
constructor(opts: __ExceptionOptionType<InternalServerException, __BaseException>);
|
|
50
|
+
}
|
|
51
|
+
/**
|
|
52
|
+
* Error thrown when rate limit is exceeded
|
|
53
|
+
*
|
|
54
|
+
* HTTP Status Code: 429 Too Many Requests
|
|
55
|
+
*
|
|
56
|
+
* Possible OAuth2ErrorCode values:
|
|
57
|
+
* - INVALID_REQUEST: Rate limiting, too many requests, abuse prevention
|
|
58
|
+
*
|
|
59
|
+
* Possible causes:
|
|
60
|
+
* - Too many token requests from the same client
|
|
61
|
+
* - Rate limiting based on client_id or IP address
|
|
62
|
+
* - Abuse prevention mechanisms triggered
|
|
63
|
+
* - Service protection against excessive token generation
|
|
64
|
+
* @public
|
|
65
|
+
*/
|
|
66
|
+
export declare class TooManyRequestsError extends __BaseException {
|
|
67
|
+
readonly name: "TooManyRequestsError";
|
|
68
|
+
readonly $fault: "client";
|
|
69
|
+
/**
|
|
70
|
+
* OAuth 2.0 error code indicating the specific type of error
|
|
71
|
+
* Will be INVALID_REQUEST for rate limiting scenarios
|
|
72
|
+
* @public
|
|
73
|
+
*/
|
|
74
|
+
error: OAuth2ErrorCode | undefined;
|
|
75
|
+
/**
|
|
76
|
+
* @internal
|
|
77
|
+
*/
|
|
78
|
+
constructor(opts: __ExceptionOptionType<TooManyRequestsError, __BaseException>);
|
|
79
|
+
}
|
|
80
|
+
/**
|
|
81
|
+
* Error thrown when request validation fails
|
|
82
|
+
*
|
|
83
|
+
* HTTP Status Code: 400 Bad Request
|
|
84
|
+
*
|
|
85
|
+
* Used for request validation errors such as malformed parameters,
|
|
86
|
+
* missing required fields, or invalid parameter values.
|
|
87
|
+
* @public
|
|
88
|
+
*/
|
|
89
|
+
export declare class ValidationException extends __BaseException {
|
|
90
|
+
readonly name: "ValidationException";
|
|
91
|
+
readonly $fault: "client";
|
|
92
|
+
/**
|
|
93
|
+
* OAuth 2.0 error code indicating validation failure
|
|
94
|
+
* Will be INVALID_REQUEST for validation errors
|
|
95
|
+
* @public
|
|
96
|
+
*/
|
|
97
|
+
error: OAuth2ErrorCode | undefined;
|
|
98
|
+
/**
|
|
99
|
+
* @internal
|
|
100
|
+
*/
|
|
101
|
+
constructor(opts: __ExceptionOptionType<ValidationException, __BaseException>);
|
|
102
|
+
}
|
|
@@ -0,0 +1,142 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* AWS credentials structure containing temporary access credentials
|
|
3
|
+
*
|
|
4
|
+
* The scoped-down, 15 minute duration AWS credentials.
|
|
5
|
+
* Scoping down will be based on CLI policy (CLI team needs to create it).
|
|
6
|
+
* Similar to cloud shell implementation.
|
|
7
|
+
* @public
|
|
8
|
+
*/
|
|
9
|
+
export interface AccessToken {
|
|
10
|
+
/**
|
|
11
|
+
* AWS access key ID for temporary credentials
|
|
12
|
+
* @public
|
|
13
|
+
*/
|
|
14
|
+
accessKeyId: string | undefined;
|
|
15
|
+
/**
|
|
16
|
+
* AWS secret access key for temporary credentials
|
|
17
|
+
* @public
|
|
18
|
+
*/
|
|
19
|
+
secretAccessKey: string | undefined;
|
|
20
|
+
/**
|
|
21
|
+
* AWS session token for temporary credentials
|
|
22
|
+
* @public
|
|
23
|
+
*/
|
|
24
|
+
sessionToken: string | undefined;
|
|
25
|
+
}
|
|
26
|
+
/**
|
|
27
|
+
* Request body payload for CreateOAuth2Token operation
|
|
28
|
+
*
|
|
29
|
+
* The operation type is determined by the grant_type parameter:
|
|
30
|
+
* - grant_type=authorization_code: Requires code, redirect_uri, code_verifier
|
|
31
|
+
* - grant_type=refresh_token: Requires refresh_token
|
|
32
|
+
* @public
|
|
33
|
+
*/
|
|
34
|
+
export interface CreateOAuth2TokenRequestBody {
|
|
35
|
+
/**
|
|
36
|
+
* The client identifier (ARN) used during Sign-In onboarding
|
|
37
|
+
* Required for both authorization code and refresh token flows
|
|
38
|
+
* @public
|
|
39
|
+
*/
|
|
40
|
+
clientId: string | undefined;
|
|
41
|
+
/**
|
|
42
|
+
* OAuth 2.0 grant type - determines which flow is used
|
|
43
|
+
* Must be "authorization_code" or "refresh_token"
|
|
44
|
+
* @public
|
|
45
|
+
*/
|
|
46
|
+
grantType: string | undefined;
|
|
47
|
+
/**
|
|
48
|
+
* The authorization code received from /v1/authorize
|
|
49
|
+
* Required only when grant_type=authorization_code
|
|
50
|
+
* @public
|
|
51
|
+
*/
|
|
52
|
+
code?: string | undefined;
|
|
53
|
+
/**
|
|
54
|
+
* The redirect URI that must match the original authorization request
|
|
55
|
+
* Required only when grant_type=authorization_code
|
|
56
|
+
* @public
|
|
57
|
+
*/
|
|
58
|
+
redirectUri?: string | undefined;
|
|
59
|
+
/**
|
|
60
|
+
* PKCE code verifier to prove possession of the original code challenge
|
|
61
|
+
* Required only when grant_type=authorization_code
|
|
62
|
+
* @public
|
|
63
|
+
*/
|
|
64
|
+
codeVerifier?: string | undefined;
|
|
65
|
+
/**
|
|
66
|
+
* The refresh token returned from auth_code redemption
|
|
67
|
+
* Required only when grant_type=refresh_token
|
|
68
|
+
* @public
|
|
69
|
+
*/
|
|
70
|
+
refreshToken?: string | undefined;
|
|
71
|
+
}
|
|
72
|
+
/**
|
|
73
|
+
* Input structure for CreateOAuth2Token operation
|
|
74
|
+
*
|
|
75
|
+
* Contains flattened token operation inputs for both authorization code and refresh token flows.
|
|
76
|
+
* The operation type is determined by the grant_type parameter in the request body.
|
|
77
|
+
* @public
|
|
78
|
+
*/
|
|
79
|
+
export interface CreateOAuth2TokenRequest {
|
|
80
|
+
/**
|
|
81
|
+
* Flattened token operation inputs
|
|
82
|
+
* The specific operation is determined by grant_type in the request body
|
|
83
|
+
* @public
|
|
84
|
+
*/
|
|
85
|
+
tokenInput: CreateOAuth2TokenRequestBody | undefined;
|
|
86
|
+
}
|
|
87
|
+
/**
|
|
88
|
+
* Response body payload for CreateOAuth2Token operation
|
|
89
|
+
*
|
|
90
|
+
* The response content depends on the grant_type from the request:
|
|
91
|
+
* - grant_type=authorization_code: Returns all fields including refresh_token and id_token
|
|
92
|
+
* - grant_type=refresh_token: Returns access_token, token_type, expires_in, refresh_token (no id_token)
|
|
93
|
+
* @public
|
|
94
|
+
*/
|
|
95
|
+
export interface CreateOAuth2TokenResponseBody {
|
|
96
|
+
/**
|
|
97
|
+
* Scoped-down AWS credentials (15 minute duration)
|
|
98
|
+
* Present for both authorization code redemption and token refresh
|
|
99
|
+
* @public
|
|
100
|
+
*/
|
|
101
|
+
accessToken: AccessToken | undefined;
|
|
102
|
+
/**
|
|
103
|
+
* Token type indicating this is AWS SigV4 credentials
|
|
104
|
+
* Value is "aws_sigv4" for both flows
|
|
105
|
+
* @public
|
|
106
|
+
*/
|
|
107
|
+
tokenType: string | undefined;
|
|
108
|
+
/**
|
|
109
|
+
* Time to expiry in seconds (maximum 900)
|
|
110
|
+
* Present for both authorization code redemption and token refresh
|
|
111
|
+
* @public
|
|
112
|
+
*/
|
|
113
|
+
expiresIn: number | undefined;
|
|
114
|
+
/**
|
|
115
|
+
* Encrypted refresh token with cnf.jkt (SHA-256 thumbprint of presented jwk)
|
|
116
|
+
* Always present in responses (required for both flows)
|
|
117
|
+
* @public
|
|
118
|
+
*/
|
|
119
|
+
refreshToken: string | undefined;
|
|
120
|
+
/**
|
|
121
|
+
* ID token containing user identity information
|
|
122
|
+
* Present only in authorization code redemption response (grant_type=authorization_code)
|
|
123
|
+
* Not included in token refresh responses
|
|
124
|
+
* @public
|
|
125
|
+
*/
|
|
126
|
+
idToken?: string | undefined;
|
|
127
|
+
}
|
|
128
|
+
/**
|
|
129
|
+
* Output structure for CreateOAuth2Token operation
|
|
130
|
+
*
|
|
131
|
+
* Contains flattened token operation outputs for both authorization code and refresh token flows.
|
|
132
|
+
* The response content depends on the grant_type from the original request.
|
|
133
|
+
* @public
|
|
134
|
+
*/
|
|
135
|
+
export interface CreateOAuth2TokenResponse {
|
|
136
|
+
/**
|
|
137
|
+
* Flattened token operation outputs
|
|
138
|
+
* The specific response fields depend on the grant_type used in the request
|
|
139
|
+
* @public
|
|
140
|
+
*/
|
|
141
|
+
tokenOutput: CreateOAuth2TokenResponseBody | undefined;
|
|
142
|
+
}
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
import { FetchHttpHandler as RequestHandler } from "@smithy/fetch-http-handler";
|
|
2
|
+
import { SigninClientConfig } from "./SigninClient";
|
|
3
|
+
/**
|
|
4
|
+
* @internal
|
|
5
|
+
*/
|
|
6
|
+
export declare const getRuntimeConfig: (config: SigninClientConfig) => {
|
|
7
|
+
runtime: string;
|
|
8
|
+
defaultsMode: import("@smithy/types").Provider<import("@smithy/smithy-client").ResolvedDefaultsMode>;
|
|
9
|
+
bodyLengthChecker: import("@smithy/types").BodyLengthCalculator;
|
|
10
|
+
credentialDefaultProvider: ((input: any) => import("@smithy/types").AwsCredentialIdentityProvider) | ((_: unknown) => () => Promise<import("@smithy/types").AwsCredentialIdentity>);
|
|
11
|
+
defaultUserAgentProvider: (config?: import("@aws-sdk/util-user-agent-browser").PreviouslyResolved) => Promise<import("@smithy/types").UserAgent>;
|
|
12
|
+
maxAttempts: number | import("@smithy/types").Provider<number>;
|
|
13
|
+
region: string | import("@smithy/types").Provider<any>;
|
|
14
|
+
requestHandler: import("@smithy/protocol-http").HttpHandler<any> | RequestHandler;
|
|
15
|
+
retryMode: string | import("@smithy/types").Provider<string>;
|
|
16
|
+
sha256: import("@smithy/types").HashConstructor;
|
|
17
|
+
streamCollector: import("@smithy/types").StreamCollector;
|
|
18
|
+
useDualstackEndpoint: (boolean | import("@smithy/types").Provider<boolean>) & (boolean | import("@smithy/types").Provider<boolean | undefined>);
|
|
19
|
+
useFipsEndpoint: (boolean | import("@smithy/types").Provider<boolean>) & (boolean | import("@smithy/types").Provider<boolean | undefined>);
|
|
20
|
+
apiVersion: string;
|
|
21
|
+
cacheMiddleware?: boolean | undefined;
|
|
22
|
+
urlParser: import("@smithy/types").UrlParser;
|
|
23
|
+
base64Decoder: import("@smithy/types").Decoder;
|
|
24
|
+
base64Encoder: (_input: Uint8Array | string) => string;
|
|
25
|
+
utf8Decoder: import("@smithy/types").Decoder;
|
|
26
|
+
utf8Encoder: (input: Uint8Array | string) => string;
|
|
27
|
+
disableHostPrefix: boolean;
|
|
28
|
+
serviceId: string;
|
|
29
|
+
profile?: string;
|
|
30
|
+
logger: import("@smithy/types").Logger;
|
|
31
|
+
extensions: import("./runtimeExtensions").RuntimeExtension[];
|
|
32
|
+
protocol: import("@smithy/types").ClientProtocol<import("@smithy/types").HttpRequest, import("@smithy/types").HttpResponse>;
|
|
33
|
+
customUserAgent?: string | import("@smithy/types").UserAgent;
|
|
34
|
+
userAgentAppId?: string | undefined | import("@smithy/types").Provider<string | undefined>;
|
|
35
|
+
retryStrategy?: import("@smithy/types").RetryStrategy | import("@smithy/types").RetryStrategyV2;
|
|
36
|
+
endpoint?: ((string | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>) & (string | import("@smithy/types").Provider<string> | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>)) | undefined;
|
|
37
|
+
endpointProvider: (endpointParams: import("./endpoint/EndpointParameters").EndpointParameters, context?: {
|
|
38
|
+
logger?: import("@smithy/types").Logger;
|
|
39
|
+
}) => import("@smithy/types").EndpointV2;
|
|
40
|
+
tls?: boolean;
|
|
41
|
+
serviceConfiguredEndpoint?: never;
|
|
42
|
+
authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
|
|
43
|
+
httpAuthSchemes: import("@smithy/types").HttpAuthScheme[] | ({
|
|
44
|
+
schemeId: string;
|
|
45
|
+
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | undefined;
|
|
46
|
+
signer: import("@aws-sdk/core").AwsSdkSigV4Signer;
|
|
47
|
+
} | {
|
|
48
|
+
schemeId: string;
|
|
49
|
+
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | (() => Promise<{}>);
|
|
50
|
+
signer: import("@smithy/core").NoAuthSigner;
|
|
51
|
+
})[];
|
|
52
|
+
httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").SigninHttpAuthSchemeProvider;
|
|
53
|
+
credentials?: import("@smithy/types").AwsCredentialIdentity | import("@smithy/types").AwsCredentialIdentityProvider;
|
|
54
|
+
signer?: import("@smithy/types").RequestSigner | ((authScheme?: import("@smithy/types").AuthScheme) => Promise<import("@smithy/types").RequestSigner>);
|
|
55
|
+
signingEscapePath?: boolean;
|
|
56
|
+
systemClockOffset?: number;
|
|
57
|
+
signingRegion?: string;
|
|
58
|
+
signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
|
|
59
|
+
};
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
import { NodeHttpHandler as RequestHandler } from "@smithy/node-http-handler";
|
|
2
|
+
import { SigninClientConfig } from "./SigninClient";
|
|
3
|
+
/**
|
|
4
|
+
* @internal
|
|
5
|
+
*/
|
|
6
|
+
export declare const getRuntimeConfig: (config: SigninClientConfig) => {
|
|
7
|
+
runtime: string;
|
|
8
|
+
defaultsMode: import("@smithy/types").Provider<import("@smithy/smithy-client").ResolvedDefaultsMode>;
|
|
9
|
+
authSchemePreference: string[] | import("@smithy/types").Provider<string[]>;
|
|
10
|
+
bodyLengthChecker: import("@smithy/types").BodyLengthCalculator;
|
|
11
|
+
defaultUserAgentProvider: (config?: import("@aws-sdk/util-user-agent-node").PreviouslyResolved) => Promise<import("@smithy/types").UserAgent>;
|
|
12
|
+
maxAttempts: number | import("@smithy/types").Provider<number>;
|
|
13
|
+
region: string | import("@smithy/types").Provider<string>;
|
|
14
|
+
requestHandler: RequestHandler | import("@smithy/protocol-http").HttpHandler<any>;
|
|
15
|
+
retryMode: string | import("@smithy/types").Provider<string>;
|
|
16
|
+
sha256: import("@smithy/types").HashConstructor;
|
|
17
|
+
streamCollector: import("@smithy/types").StreamCollector;
|
|
18
|
+
useDualstackEndpoint: boolean | import("@smithy/types").Provider<boolean>;
|
|
19
|
+
useFipsEndpoint: boolean | import("@smithy/types").Provider<boolean>;
|
|
20
|
+
userAgentAppId: string | import("@smithy/types").Provider<string | undefined>;
|
|
21
|
+
apiVersion: string;
|
|
22
|
+
cacheMiddleware?: boolean | undefined;
|
|
23
|
+
urlParser: import("@smithy/types").UrlParser;
|
|
24
|
+
base64Decoder: import("@smithy/types").Decoder;
|
|
25
|
+
base64Encoder: (_input: Uint8Array | string) => string;
|
|
26
|
+
utf8Decoder: import("@smithy/types").Decoder;
|
|
27
|
+
utf8Encoder: (input: Uint8Array | string) => string;
|
|
28
|
+
disableHostPrefix: boolean;
|
|
29
|
+
serviceId: string;
|
|
30
|
+
profile?: string;
|
|
31
|
+
credentialDefaultProvider?: (input: any) => import("@smithy/types").AwsCredentialIdentityProvider;
|
|
32
|
+
logger: import("@smithy/types").Logger;
|
|
33
|
+
extensions: import("./runtimeExtensions").RuntimeExtension[];
|
|
34
|
+
protocol: import("@smithy/types").ClientProtocol<import("@smithy/types").HttpRequest, import("@smithy/types").HttpResponse>;
|
|
35
|
+
customUserAgent?: string | import("@smithy/types").UserAgent;
|
|
36
|
+
retryStrategy?: import("@smithy/types").RetryStrategy | import("@smithy/types").RetryStrategyV2;
|
|
37
|
+
endpoint?: ((string | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>) & (string | import("@smithy/types").Provider<string> | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>)) | undefined;
|
|
38
|
+
endpointProvider: (endpointParams: import("./endpoint/EndpointParameters").EndpointParameters, context?: {
|
|
39
|
+
logger?: import("@smithy/types").Logger;
|
|
40
|
+
}) => import("@smithy/types").EndpointV2;
|
|
41
|
+
tls?: boolean;
|
|
42
|
+
serviceConfiguredEndpoint?: never;
|
|
43
|
+
httpAuthSchemes: import("@smithy/types").HttpAuthScheme[] | ({
|
|
44
|
+
schemeId: string;
|
|
45
|
+
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | undefined;
|
|
46
|
+
signer: import("@aws-sdk/core").AwsSdkSigV4Signer;
|
|
47
|
+
} | {
|
|
48
|
+
schemeId: string;
|
|
49
|
+
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | (() => Promise<{}>);
|
|
50
|
+
signer: import("@smithy/core").NoAuthSigner;
|
|
51
|
+
})[];
|
|
52
|
+
httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").SigninHttpAuthSchemeProvider;
|
|
53
|
+
credentials?: import("@smithy/types").AwsCredentialIdentity | import("@smithy/types").AwsCredentialIdentityProvider;
|
|
54
|
+
signer?: import("@smithy/types").RequestSigner | ((authScheme?: import("@smithy/types").AuthScheme) => Promise<import("@smithy/types").RequestSigner>);
|
|
55
|
+
signingEscapePath?: boolean;
|
|
56
|
+
systemClockOffset?: number;
|
|
57
|
+
signingRegion?: string;
|
|
58
|
+
signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
|
|
59
|
+
};
|