@databricks/sdk-auth 0.33.0 → 0.35.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth.d.ts +42 -40
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +38 -42
- package/dist/auth.js.map +1 -1
- package/dist/credentials/default/chain.d.ts +26 -22
- package/dist/credentials/default/chain.d.ts.map +1 -1
- package/dist/credentials/default/chain.js +74 -84
- package/dist/credentials/default/chain.js.map +1 -1
- package/dist/credentials/default/default-credentials.d.ts +12 -9
- package/dist/credentials/default/default-credentials.d.ts.map +1 -1
- package/dist/credentials/default/default-credentials.js +29 -20
- package/dist/credentials/default/default-credentials.js.map +1 -1
- package/dist/credentials/default/errors.d.ts +7 -4
- package/dist/credentials/default/errors.d.ts.map +1 -1
- package/dist/credentials/default/errors.js +17 -13
- package/dist/credentials/default/errors.js.map +1 -1
- package/dist/credentials/default/u2m-strategy.d.ts +6 -2
- package/dist/credentials/default/u2m-strategy.d.ts.map +1 -1
- package/dist/credentials/default/u2m-strategy.js +21 -20
- package/dist/credentials/default/u2m-strategy.js.map +1 -1
- package/dist/credentials/errors.d.ts +15 -12
- package/dist/credentials/errors.d.ts.map +1 -1
- package/dist/credentials/errors.js +40 -41
- package/dist/credentials/errors.js.map +1 -1
- package/dist/credentials/host-metadata.d.ts +22 -19
- package/dist/credentials/host-metadata.d.ts.map +1 -1
- package/dist/credentials/host-metadata.js +88 -109
- package/dist/credentials/host-metadata.js.map +1 -1
- package/dist/credentials/index.browser.d.ts +4 -11
- package/dist/credentials/index.browser.js +5 -9
- package/dist/credentials/index.d.ts +7 -14
- package/dist/credentials/index.js +8 -10
- package/dist/credentials/m2m.d.ts +29 -28
- package/dist/credentials/m2m.d.ts.map +1 -1
- package/dist/credentials/m2m.js +66 -81
- package/dist/credentials/m2m.js.map +1 -1
- package/dist/credentials/pat.d.ts +6 -5
- package/dist/credentials/pat.d.ts.map +1 -1
- package/dist/credentials/pat.js +33 -37
- package/dist/credentials/pat.js.map +1 -1
- package/dist/credentials/u2m.d.ts +17 -20
- package/dist/credentials/u2m.d.ts.map +1 -1
- package/dist/credentials/u2m.js +107 -135
- package/dist/credentials/u2m.js.map +1 -1
- package/dist/index.d.ts +6 -8
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +12 -7
- package/dist/index.js.map +1 -1
- package/dist/oidc/env.d.ts +6 -2
- package/dist/oidc/env.d.ts.map +1 -1
- package/dist/oidc/env.js +19 -16
- package/dist/oidc/env.js.map +1 -1
- package/dist/oidc/file.d.ts +6 -2
- package/dist/oidc/file.d.ts.map +1 -1
- package/dist/oidc/file.js +23 -25
- package/dist/oidc/file.js.map +1 -1
- package/dist/oidc/index.browser.d.ts +3 -13
- package/dist/oidc/index.browser.js +4 -11
- package/dist/oidc/index.d.ts +5 -14
- package/dist/oidc/index.js +6 -12
- package/dist/oidc/oidc.d.ts +8 -5
- package/dist/oidc/oidc.d.ts.map +1 -1
- package/dist/oidc/oidc.js +11 -7
- package/dist/oidc/oidc.js.map +1 -1
- package/dist/oidc/tokensource.d.ts +41 -41
- package/dist/oidc/tokensource.d.ts.map +1 -1
- package/dist/oidc/tokensource.js +47 -52
- package/dist/oidc/tokensource.js.map +1 -1
- package/dist/package.js +6 -0
- package/dist/package.js.map +1 -0
- package/package.json +3 -3
- package/dist/credentials/index.browser.d.ts.map +0 -1
- package/dist/credentials/index.browser.js.map +0 -1
- package/dist/credentials/index.d.ts.map +0 -1
- package/dist/credentials/index.js.map +0 -1
- package/dist/oidc/index.browser.d.ts.map +0 -1
- package/dist/oidc/index.browser.js.map +0 -1
- package/dist/oidc/index.d.ts.map +0 -1
- package/dist/oidc/index.js.map +0 -1
|
@@ -1,15 +1,19 @@
|
|
|
1
|
+
//#region src/credentials/default/errors.ts
|
|
1
2
|
/**
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
}
|
|
3
|
+
* Error thrown when the default credentials chain cannot resolve a
|
|
4
|
+
* strategy to authenticate with.
|
|
5
|
+
*
|
|
6
|
+
* Use the `code` field to distinguish between error causes.
|
|
7
|
+
*/
|
|
8
|
+
var DefaultCredentialsError = class extends Error {
|
|
9
|
+
code;
|
|
10
|
+
constructor(code, message) {
|
|
11
|
+
super(message);
|
|
12
|
+
this.name = "DefaultCredentialsError";
|
|
13
|
+
this.code = code;
|
|
14
|
+
}
|
|
15
|
+
};
|
|
16
|
+
|
|
17
|
+
//#endregion
|
|
18
|
+
export { DefaultCredentialsError };
|
|
15
19
|
//# sourceMappingURL=errors.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.js","
|
|
1
|
+
{"version":3,"file":"errors.js","names":[],"sources":["../../../src/credentials/default/errors.ts"],"sourcesContent":["/** Discriminant codes for {@link DefaultCredentialsError}. */\nexport type DefaultCredentialsErrorCode =\n | 'NO_AUTH_CONFIGURED'\n | 'AUTH_TYPE_NOT_FOUND';\n\n/**\n * Error thrown when the default credentials chain cannot resolve a\n * strategy to authenticate with.\n *\n * Use the `code` field to distinguish between error causes.\n */\nexport class DefaultCredentialsError extends Error {\n readonly code: DefaultCredentialsErrorCode;\n\n constructor(code: DefaultCredentialsErrorCode, message: string) {\n super(message);\n this.name = 'DefaultCredentialsError';\n this.code = code;\n }\n}\n"],"mappings":";;;;;;;AAWA,IAAa,0BAAb,cAA6C,MAAM;CACjD,AAAS;CAET,YAAY,MAAmC,SAAiB;AAC9D,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,OAAO"}
|
|
@@ -1,9 +1,13 @@
|
|
|
1
|
-
import
|
|
1
|
+
import { Strategy } from "./chain.js";
|
|
2
|
+
|
|
3
|
+
//#region src/credentials/default/u2m-strategy.d.ts
|
|
2
4
|
/**
|
|
3
5
|
* U2M (Databricks CLI) strategy. Configured when the profile was loaded
|
|
4
6
|
* from the config file (so the section name is known) and a host is set.
|
|
5
7
|
* The CLI must have been logged in ahead of time via `databricks auth
|
|
6
8
|
* login`.
|
|
7
9
|
*/
|
|
8
|
-
|
|
10
|
+
declare const u2mStrategy: Strategy;
|
|
11
|
+
//#endregion
|
|
12
|
+
export { u2mStrategy };
|
|
9
13
|
//# sourceMappingURL=u2m-strategy.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"u2m-strategy.d.ts","
|
|
1
|
+
{"version":3,"file":"u2m-strategy.d.ts","names":[],"sources":["../../../src/credentials/default/u2m-strategy.ts"],"mappings":";;;;;AAUA;;;;cAAa,WAAA,EAAa,QAAA"}
|
|
@@ -1,23 +1,24 @@
|
|
|
1
|
-
import { newU2mCredentials } from
|
|
1
|
+
import { newU2mCredentials } from "../u2m.js";
|
|
2
|
+
|
|
3
|
+
//#region src/credentials/default/u2m-strategy.ts
|
|
2
4
|
/**
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
cliPath: profile.databricksCliPath,
|
|
19
|
-
}),
|
|
20
|
-
});
|
|
21
|
-
},
|
|
5
|
+
* U2M (Databricks CLI) strategy. Configured when the profile was loaded
|
|
6
|
+
* from the config file (so the section name is known) and a host is set.
|
|
7
|
+
* The CLI must have been logged in ahead of time via `databricks auth
|
|
8
|
+
* login`.
|
|
9
|
+
*/
|
|
10
|
+
const u2mStrategy = {
|
|
11
|
+
name: "databricks-cli",
|
|
12
|
+
configure: (profile) => {
|
|
13
|
+
if (profile.host === void 0) return void 0;
|
|
14
|
+
if (profile.name === void 0) return void 0;
|
|
15
|
+
return newU2mCredentials({
|
|
16
|
+
profile: profile.name,
|
|
17
|
+
...profile.databricksCliPath !== void 0 && { cliPath: profile.databricksCliPath }
|
|
18
|
+
});
|
|
19
|
+
}
|
|
22
20
|
};
|
|
21
|
+
|
|
22
|
+
//#endregion
|
|
23
|
+
export { u2mStrategy };
|
|
23
24
|
//# sourceMappingURL=u2m-strategy.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"u2m-strategy.js","
|
|
1
|
+
{"version":3,"file":"u2m-strategy.js","names":[],"sources":["../../../src/credentials/default/u2m-strategy.ts"],"sourcesContent":["import {newU2mCredentials} from '../u2m';\n\nimport type {Strategy} from './chain';\n\n/**\n * U2M (Databricks CLI) strategy. Configured when the profile was loaded\n * from the config file (so the section name is known) and a host is set.\n * The CLI must have been logged in ahead of time via `databricks auth\n * login`.\n */\nexport const u2mStrategy: Strategy = {\n name: 'databricks-cli',\n configure: profile => {\n if (profile.host === undefined) return undefined;\n if (profile.name === undefined) return undefined;\n return newU2mCredentials({\n profile: profile.name,\n ...(profile.databricksCliPath !== undefined && {\n cliPath: profile.databricksCliPath,\n }),\n });\n },\n};\n"],"mappings":";;;;;;;;;AAUA,MAAa,cAAwB;CACnC,MAAM;CACN,YAAW,YAAW;AACpB,MAAI,QAAQ,SAAS,OAAW,QAAO;AACvC,MAAI,QAAQ,SAAS,OAAW,QAAO;AACvC,SAAO,kBAAkB;GACvB,SAAS,QAAQ;GACjB,GAAI,QAAQ,sBAAsB,UAAa,EAC7C,SAAS,QAAQ,mBAClB;GACF,CAAC;;CAEL"}
|
|
@@ -1,39 +1,42 @@
|
|
|
1
|
+
//#region src/credentials/errors.d.ts
|
|
1
2
|
/**
|
|
2
3
|
* Error types for credential operations.
|
|
3
4
|
*
|
|
4
5
|
* @module
|
|
5
6
|
*/
|
|
6
7
|
/** Discriminant codes for {@link PatCredentialsError}. */
|
|
7
|
-
|
|
8
|
+
type PatCredentialsErrorCode = 'TOKEN_REQUIRED' | 'TOKEN_MALFORMED';
|
|
8
9
|
/**
|
|
9
10
|
* Error thrown by personal access token (PAT) credential operations.
|
|
10
11
|
*
|
|
11
12
|
* Use the `code` field to distinguish between error causes.
|
|
12
13
|
*/
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
14
|
+
declare class PatCredentialsError extends Error {
|
|
15
|
+
readonly code: PatCredentialsErrorCode;
|
|
16
|
+
constructor(code: PatCredentialsErrorCode, message: string);
|
|
16
17
|
}
|
|
17
18
|
/** Discriminant codes for {@link M2mCredentialsError}. */
|
|
18
|
-
|
|
19
|
+
type M2mCredentialsErrorCode = 'CLIENT_ID_REQUIRED' | 'CLIENT_SECRET_REQUIRED' | 'HOST_REQUIRED' | 'DISCOVERY_FAILED' | 'TOKEN_REQUEST_FAILED';
|
|
19
20
|
/**
|
|
20
21
|
* Error thrown by M2M credential operations.
|
|
21
22
|
*
|
|
22
23
|
* Use the `code` field to distinguish between error causes.
|
|
23
24
|
*/
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
25
|
+
declare class M2mCredentialsError extends Error {
|
|
26
|
+
readonly code: M2mCredentialsErrorCode;
|
|
27
|
+
constructor(code: M2mCredentialsErrorCode, message: string);
|
|
27
28
|
}
|
|
28
29
|
/** Discriminant codes for {@link U2mCredentialsError}. */
|
|
29
|
-
|
|
30
|
+
type U2mCredentialsErrorCode = 'PROFILE_REQUIRED' | 'CLI_NOT_FOUND' | 'LEGACY_CLI_DETECTED' | 'TOKEN_FETCH_FAILED' | 'INVALID_RESPONSE';
|
|
30
31
|
/**
|
|
31
32
|
* Error thrown by U2M (databricks-cli) credential operations.
|
|
32
33
|
*
|
|
33
34
|
* Use the `code` field to distinguish between error causes.
|
|
34
35
|
*/
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
36
|
+
declare class U2mCredentialsError extends Error {
|
|
37
|
+
readonly code: U2mCredentialsErrorCode;
|
|
38
|
+
constructor(code: U2mCredentialsErrorCode, message: string);
|
|
38
39
|
}
|
|
40
|
+
//#endregion
|
|
41
|
+
export { M2mCredentialsError, M2mCredentialsErrorCode, PatCredentialsError, PatCredentialsErrorCode, U2mCredentialsError, U2mCredentialsErrorCode };
|
|
39
42
|
//# sourceMappingURL=errors.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.d.ts","
|
|
1
|
+
{"version":3,"file":"errors.d.ts","names":[],"sources":["../../src/credentials/errors.ts"],"mappings":";;AAOA;;;;;KAAY,uBAAA;;;;;;cAOC,mBAAA,SAA4B,KAAA;EAAA,SAC9B,IAAA,EAAM,uBAAA;cAEH,IAAA,EAAM,uBAAA,EAAyB,OAAA;AAAA;;KAQjC,uBAAA;;;;;;cAYC,mBAAA,SAA4B,KAAA;EAAA,SAC9B,IAAA,EAAM,uBAAA;cAEH,IAAA,EAAM,uBAAA,EAAyB,OAAA;AAAA;;KAQjC,uBAAA;;;;;;cAYC,mBAAA,SAA4B,KAAA;EAAA,SAC9B,IAAA,EAAM,uBAAA;cAEH,IAAA,EAAM,uBAAA,EAAyB,OAAA;AAAA"}
|
|
@@ -1,45 +1,44 @@
|
|
|
1
|
+
//#region src/credentials/errors.ts
|
|
1
2
|
/**
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
3
|
+
* Error thrown by personal access token (PAT) credential operations.
|
|
4
|
+
*
|
|
5
|
+
* Use the `code` field to distinguish between error causes.
|
|
6
|
+
*/
|
|
7
|
+
var PatCredentialsError = class extends Error {
|
|
8
|
+
code;
|
|
9
|
+
constructor(code, message) {
|
|
10
|
+
super(message);
|
|
11
|
+
this.name = "PatCredentialsError";
|
|
12
|
+
this.code = code;
|
|
13
|
+
}
|
|
14
|
+
};
|
|
6
15
|
/**
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
}
|
|
16
|
+
* Error thrown by M2M credential operations.
|
|
17
|
+
*
|
|
18
|
+
* Use the `code` field to distinguish between error causes.
|
|
19
|
+
*/
|
|
20
|
+
var M2mCredentialsError = class extends Error {
|
|
21
|
+
code;
|
|
22
|
+
constructor(code, message) {
|
|
23
|
+
super(message);
|
|
24
|
+
this.name = "M2mCredentialsError";
|
|
25
|
+
this.code = code;
|
|
26
|
+
}
|
|
27
|
+
};
|
|
19
28
|
/**
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
}
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
* Use the `code` field to distinguish between error causes.
|
|
36
|
-
*/
|
|
37
|
-
export class U2mCredentialsError extends Error {
|
|
38
|
-
code;
|
|
39
|
-
constructor(code, message) {
|
|
40
|
-
super(message);
|
|
41
|
-
this.name = 'U2mCredentialsError';
|
|
42
|
-
this.code = code;
|
|
43
|
-
}
|
|
44
|
-
}
|
|
29
|
+
* Error thrown by U2M (databricks-cli) credential operations.
|
|
30
|
+
*
|
|
31
|
+
* Use the `code` field to distinguish between error causes.
|
|
32
|
+
*/
|
|
33
|
+
var U2mCredentialsError = class extends Error {
|
|
34
|
+
code;
|
|
35
|
+
constructor(code, message) {
|
|
36
|
+
super(message);
|
|
37
|
+
this.name = "U2mCredentialsError";
|
|
38
|
+
this.code = code;
|
|
39
|
+
}
|
|
40
|
+
};
|
|
41
|
+
|
|
42
|
+
//#endregion
|
|
43
|
+
export { M2mCredentialsError, PatCredentialsError, U2mCredentialsError };
|
|
45
44
|
//# sourceMappingURL=errors.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.js","
|
|
1
|
+
{"version":3,"file":"errors.js","names":[],"sources":["../../src/credentials/errors.ts"],"sourcesContent":["/**\n * Error types for credential operations.\n *\n * @module\n */\n\n/** Discriminant codes for {@link PatCredentialsError}. */\nexport type PatCredentialsErrorCode = 'TOKEN_REQUIRED' | 'TOKEN_MALFORMED';\n\n/**\n * Error thrown by personal access token (PAT) credential operations.\n *\n * Use the `code` field to distinguish between error causes.\n */\nexport class PatCredentialsError extends Error {\n readonly code: PatCredentialsErrorCode;\n\n constructor(code: PatCredentialsErrorCode, message: string) {\n super(message);\n this.name = 'PatCredentialsError';\n this.code = code;\n }\n}\n\n/** Discriminant codes for {@link M2mCredentialsError}. */\nexport type M2mCredentialsErrorCode =\n | 'CLIENT_ID_REQUIRED'\n | 'CLIENT_SECRET_REQUIRED'\n | 'HOST_REQUIRED'\n | 'DISCOVERY_FAILED'\n | 'TOKEN_REQUEST_FAILED';\n\n/**\n * Error thrown by M2M credential operations.\n *\n * Use the `code` field to distinguish between error causes.\n */\nexport class M2mCredentialsError extends Error {\n readonly code: M2mCredentialsErrorCode;\n\n constructor(code: M2mCredentialsErrorCode, message: string) {\n super(message);\n this.name = 'M2mCredentialsError';\n this.code = code;\n }\n}\n\n/** Discriminant codes for {@link U2mCredentialsError}. */\nexport type U2mCredentialsErrorCode =\n | 'PROFILE_REQUIRED'\n | 'CLI_NOT_FOUND'\n | 'LEGACY_CLI_DETECTED'\n | 'TOKEN_FETCH_FAILED'\n | 'INVALID_RESPONSE';\n\n/**\n * Error thrown by U2M (databricks-cli) credential operations.\n *\n * Use the `code` field to distinguish between error causes.\n */\nexport class U2mCredentialsError extends Error {\n readonly code: U2mCredentialsErrorCode;\n\n constructor(code: U2mCredentialsErrorCode, message: string) {\n super(message);\n this.name = 'U2mCredentialsError';\n this.code = code;\n }\n}\n"],"mappings":";;;;;;AAcA,IAAa,sBAAb,cAAyC,MAAM;CAC7C,AAAS;CAET,YAAY,MAA+B,SAAiB;AAC1D,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;;;;AAiBhB,IAAa,sBAAb,cAAyC,MAAM;CAC7C,AAAS;CAET,YAAY,MAA+B,SAAiB;AAC1D,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;;;;AAiBhB,IAAa,sBAAb,cAAyC,MAAM;CAC7C,AAAS;CAET,YAAY,MAA+B,SAAiB;AAC1D,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,OAAO"}
|
|
@@ -1,24 +1,25 @@
|
|
|
1
|
+
//#region src/credentials/host-metadata.d.ts
|
|
1
2
|
/**
|
|
2
3
|
* HostMetadata holds the parsed response from the
|
|
3
4
|
* /.well-known/databricks-config discovery endpoint.
|
|
4
5
|
*/
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
6
|
+
interface HostMetadata {
|
|
7
|
+
/**
|
|
8
|
+
* oidcEndpoint is the OIDC discovery URL for this host. For account hosts,
|
|
9
|
+
* this may contain an {account_id} placeholder that callers must
|
|
10
|
+
* substitute.
|
|
11
|
+
*/
|
|
12
|
+
oidcEndpoint: string;
|
|
13
|
+
/**
|
|
14
|
+
* accountId is the Databricks account ID associated with this host, if
|
|
15
|
+
* available.
|
|
16
|
+
*/
|
|
17
|
+
accountId?: string;
|
|
18
|
+
/**
|
|
19
|
+
* workspaceId is the Databricks workspace ID associated with this host, if
|
|
20
|
+
* available.
|
|
21
|
+
*/
|
|
22
|
+
workspaceId?: string;
|
|
22
23
|
}
|
|
23
24
|
/**
|
|
24
25
|
* getHostMetadata fetches the raw Databricks well-known configuration from
|
|
@@ -26,7 +27,7 @@ export interface HostMetadata {
|
|
|
26
27
|
* raw values with no substitution (e.g., {account_id} placeholders are left
|
|
27
28
|
* as-is). Callers are responsible for interpreting the result.
|
|
28
29
|
*/
|
|
29
|
-
|
|
30
|
+
declare function getHostMetadata(host: string): Promise<HostMetadata>;
|
|
30
31
|
/**
|
|
31
32
|
* resolveTokenEndpoint resolves the OAuth `token_endpoint` for the given
|
|
32
33
|
* Databricks host via a two-step discovery:
|
|
@@ -41,5 +42,7 @@ export declare function getHostMetadata(host: string): Promise<HostMetadata>;
|
|
|
41
42
|
* Throws when any step fails, required fields are missing, or the placeholder
|
|
42
43
|
* cannot be resolved.
|
|
43
44
|
*/
|
|
44
|
-
|
|
45
|
+
declare function resolveTokenEndpoint(host: string, configAccountId?: string): Promise<string>;
|
|
46
|
+
//#endregion
|
|
47
|
+
export { HostMetadata, getHostMetadata, resolveTokenEndpoint };
|
|
45
48
|
//# sourceMappingURL=host-metadata.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"host-metadata.d.ts","
|
|
1
|
+
{"version":3,"file":"host-metadata.d.ts","names":[],"sources":["../../src/credentials/host-metadata.ts"],"mappings":";;AAMA;;;UAAiB,YAAA;EAMf;;;;;EAAA,YAAA;EAqBmC;;;;EAfnC,SAAA;EAe2D;;;AAiD7D;EA1DE,WAAA;AAAA;;;;;;;iBASoB,eAAA,CAAgB,IAAA,WAAe,OAAA,CAAQ,YAAA;;;;;;;;;;;;;;;iBAiDvC,oBAAA,CACpB,IAAA,UACA,eAAA,YACC,OAAA"}
|
|
@@ -1,122 +1,101 @@
|
|
|
1
|
-
import { z } from
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
|
|
3
|
+
//#region src/credentials/host-metadata.ts
|
|
2
4
|
/**
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
...(parsed.account_id !== undefined && { accountId: parsed.account_id }),
|
|
33
|
-
...(parsed.workspace_id !== undefined && {
|
|
34
|
-
workspaceId: parsed.workspace_id,
|
|
35
|
-
}),
|
|
36
|
-
};
|
|
5
|
+
* getHostMetadata fetches the raw Databricks well-known configuration from
|
|
6
|
+
* {host}/.well-known/databricks-config. The returned HostMetadata contains
|
|
7
|
+
* raw values with no substitution (e.g., {account_id} placeholders are left
|
|
8
|
+
* as-is). Callers are responsible for interpreting the result.
|
|
9
|
+
*/
|
|
10
|
+
async function getHostMetadata(host) {
|
|
11
|
+
const url = `${trimTrailingSlash(host)}/.well-known/databricks-config`;
|
|
12
|
+
let response;
|
|
13
|
+
try {
|
|
14
|
+
response = await fetch(url);
|
|
15
|
+
} catch (e) {
|
|
16
|
+
throw new Error(`fetching host metadata from ${url} failed: ${stringifyError(e)}`);
|
|
17
|
+
}
|
|
18
|
+
if (!response.ok) {
|
|
19
|
+
const text = await safeReadText(response);
|
|
20
|
+
throw new Error(`fetching host metadata from ${url} failed with status ${response.status.toString()}: ${text}`);
|
|
21
|
+
}
|
|
22
|
+
let raw;
|
|
23
|
+
try {
|
|
24
|
+
raw = await response.json();
|
|
25
|
+
} catch (e) {
|
|
26
|
+
throw new Error(`parsing host metadata from ${url} failed: ${stringifyError(e)}`);
|
|
27
|
+
}
|
|
28
|
+
const parsed = hostMetadataSchema.parse(raw);
|
|
29
|
+
return {
|
|
30
|
+
oidcEndpoint: parsed.oidc_endpoint,
|
|
31
|
+
...parsed.account_id !== void 0 && { accountId: parsed.account_id },
|
|
32
|
+
...parsed.workspace_id !== void 0 && { workspaceId: parsed.workspace_id }
|
|
33
|
+
};
|
|
37
34
|
}
|
|
38
35
|
/**
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
const text = await safeReadText(response);
|
|
79
|
-
throw new Error(`fetching oauth authorization server metadata from ${discoveryUrl} ` +
|
|
80
|
-
`failed with status ${response.status.toString()}: ${text}`);
|
|
81
|
-
}
|
|
82
|
-
let raw;
|
|
83
|
-
try {
|
|
84
|
-
raw = await response.json();
|
|
85
|
-
}
|
|
86
|
-
catch (e) {
|
|
87
|
-
throw new Error(`parsing oauth authorization server metadata from ${discoveryUrl} ` +
|
|
88
|
-
`failed: ${stringifyError(e)}`);
|
|
89
|
-
}
|
|
90
|
-
const parsed = oauthServerSchema.parse(raw);
|
|
91
|
-
return parsed.token_endpoint;
|
|
36
|
+
* resolveTokenEndpoint resolves the OAuth `token_endpoint` for the given
|
|
37
|
+
* Databricks host via a two-step discovery:
|
|
38
|
+
*
|
|
39
|
+
* 1. `GET {host}/.well-known/databricks-config` to obtain the OIDC root.
|
|
40
|
+
* 2. `GET {oidcRoot}/.well-known/oauth-authorization-server` to obtain the
|
|
41
|
+
* RFC 8414 authorization server metadata.
|
|
42
|
+
*
|
|
43
|
+
* If the OIDC root contains an `{account_id}` placeholder, it is substituted
|
|
44
|
+
* with the first defined value from: `configAccountId` (caller-supplied),
|
|
45
|
+
* then the `account_id` field returned by the host metadata response.
|
|
46
|
+
* Throws when any step fails, required fields are missing, or the placeholder
|
|
47
|
+
* cannot be resolved.
|
|
48
|
+
*/
|
|
49
|
+
async function resolveTokenEndpoint(host, configAccountId) {
|
|
50
|
+
const meta = await getHostMetadata(host);
|
|
51
|
+
const accountId = configAccountId !== void 0 && configAccountId !== "" ? configAccountId : meta.accountId;
|
|
52
|
+
let oidcRoot = meta.oidcEndpoint;
|
|
53
|
+
if (oidcRoot.includes("{account_id}")) {
|
|
54
|
+
if (accountId === void 0 || accountId === "") throw new Error("host metadata oidc_endpoint contains {account_id} placeholder but no account_id was provided or returned by the metadata response");
|
|
55
|
+
oidcRoot = oidcRoot.replaceAll("{account_id}", accountId);
|
|
56
|
+
}
|
|
57
|
+
const discoveryUrl = `${trimTrailingSlash(oidcRoot)}/.well-known/oauth-authorization-server`;
|
|
58
|
+
let response;
|
|
59
|
+
try {
|
|
60
|
+
response = await fetch(discoveryUrl);
|
|
61
|
+
} catch (e) {
|
|
62
|
+
throw new Error(`fetching oauth authorization server metadata from ${discoveryUrl} failed: ${stringifyError(e)}`);
|
|
63
|
+
}
|
|
64
|
+
if (!response.ok) {
|
|
65
|
+
const text = await safeReadText(response);
|
|
66
|
+
throw new Error(`fetching oauth authorization server metadata from ${discoveryUrl} failed with status ${response.status.toString()}: ${text}`);
|
|
67
|
+
}
|
|
68
|
+
let raw;
|
|
69
|
+
try {
|
|
70
|
+
raw = await response.json();
|
|
71
|
+
} catch (e) {
|
|
72
|
+
throw new Error(`parsing oauth authorization server metadata from ${discoveryUrl} failed: ${stringifyError(e)}`);
|
|
73
|
+
}
|
|
74
|
+
return oauthServerSchema.parse(raw).token_endpoint;
|
|
92
75
|
}
|
|
93
76
|
const hostMetadataSchema = z.object({
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
});
|
|
98
|
-
const oauthServerSchema = z.object({
|
|
99
|
-
token_endpoint: z.string(),
|
|
77
|
+
oidc_endpoint: z.string(),
|
|
78
|
+
account_id: z.string().optional(),
|
|
79
|
+
workspace_id: z.string().optional()
|
|
100
80
|
});
|
|
81
|
+
const oauthServerSchema = z.object({ token_endpoint: z.string() });
|
|
101
82
|
function trimTrailingSlash(s) {
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
}
|
|
106
|
-
return s.slice(0, end);
|
|
83
|
+
let end = s.length;
|
|
84
|
+
while (end > 0 && s.charAt(end - 1) === "/") end--;
|
|
85
|
+
return s.slice(0, end);
|
|
107
86
|
}
|
|
108
87
|
async function safeReadText(response) {
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
}
|
|
88
|
+
try {
|
|
89
|
+
return await response.text();
|
|
90
|
+
} catch {
|
|
91
|
+
return "";
|
|
92
|
+
}
|
|
115
93
|
}
|
|
116
94
|
function stringifyError(e) {
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
}
|
|
120
|
-
return String(e);
|
|
95
|
+
if (e instanceof Error) return e.message;
|
|
96
|
+
return String(e);
|
|
121
97
|
}
|
|
98
|
+
|
|
99
|
+
//#endregion
|
|
100
|
+
export { getHostMetadata, resolveTokenEndpoint };
|
|
122
101
|
//# sourceMappingURL=host-metadata.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"host-metadata.js","
|
|
1
|
+
{"version":3,"file":"host-metadata.js","names":[],"sources":["../../src/credentials/host-metadata.ts"],"sourcesContent":["import {z} from 'zod';\n\n/**\n * HostMetadata holds the parsed response from the\n * /.well-known/databricks-config discovery endpoint.\n */\nexport interface HostMetadata {\n /**\n * oidcEndpoint is the OIDC discovery URL for this host. For account hosts,\n * this may contain an {account_id} placeholder that callers must\n * substitute.\n */\n oidcEndpoint: string;\n\n /**\n * accountId is the Databricks account ID associated with this host, if\n * available.\n */\n accountId?: string;\n\n /**\n * workspaceId is the Databricks workspace ID associated with this host, if\n * available.\n */\n workspaceId?: string;\n}\n\n/**\n * getHostMetadata fetches the raw Databricks well-known configuration from\n * {host}/.well-known/databricks-config. The returned HostMetadata contains\n * raw values with no substitution (e.g., {account_id} placeholders are left\n * as-is). Callers are responsible for interpreting the result.\n */\nexport async function getHostMetadata(host: string): Promise<HostMetadata> {\n const url = `${trimTrailingSlash(host)}/.well-known/databricks-config`;\n let response: Response;\n try {\n response = await fetch(url);\n } catch (e) {\n throw new Error(\n `fetching host metadata from ${url} failed: ${stringifyError(e)}`\n );\n }\n if (!response.ok) {\n const text = await safeReadText(response);\n throw new Error(\n `fetching host metadata from ${url} failed with status ` +\n `${response.status.toString()}: ${text}`\n );\n }\n let raw: unknown;\n try {\n raw = await response.json();\n } catch (e) {\n throw new Error(\n `parsing host metadata from ${url} failed: ${stringifyError(e)}`\n );\n }\n const parsed = hostMetadataSchema.parse(raw);\n return {\n oidcEndpoint: parsed.oidc_endpoint,\n ...(parsed.account_id !== undefined && {accountId: parsed.account_id}),\n ...(parsed.workspace_id !== undefined && {\n workspaceId: parsed.workspace_id,\n }),\n };\n}\n\n/**\n * resolveTokenEndpoint resolves the OAuth `token_endpoint` for the given\n * Databricks host via a two-step discovery:\n *\n * 1. `GET {host}/.well-known/databricks-config` to obtain the OIDC root.\n * 2. `GET {oidcRoot}/.well-known/oauth-authorization-server` to obtain the\n * RFC 8414 authorization server metadata.\n *\n * If the OIDC root contains an `{account_id}` placeholder, it is substituted\n * with the first defined value from: `configAccountId` (caller-supplied),\n * then the `account_id` field returned by the host metadata response.\n * Throws when any step fails, required fields are missing, or the placeholder\n * cannot be resolved.\n */\nexport async function resolveTokenEndpoint(\n host: string,\n configAccountId?: string\n): Promise<string> {\n const meta = await getHostMetadata(host);\n // Precedence mirrors the legacy SDK: a caller-supplied account ID\n // overrides any value returned by the host metadata. The metadata\n // back-fills only when the caller did not provide one.\n const accountId =\n configAccountId !== undefined && configAccountId !== ''\n ? configAccountId\n : meta.accountId;\n let oidcRoot = meta.oidcEndpoint;\n if (oidcRoot.includes('{account_id}')) {\n if (accountId === undefined || accountId === '') {\n throw new Error(\n 'host metadata oidc_endpoint contains {account_id} placeholder but ' +\n 'no account_id was provided or returned by the metadata response'\n );\n }\n oidcRoot = oidcRoot.replaceAll('{account_id}', accountId);\n }\n const discoveryUrl = `${trimTrailingSlash(oidcRoot)}/.well-known/oauth-authorization-server`;\n let response: Response;\n try {\n response = await fetch(discoveryUrl);\n } catch (e) {\n throw new Error(\n `fetching oauth authorization server metadata from ${discoveryUrl} ` +\n `failed: ${stringifyError(e)}`\n );\n }\n if (!response.ok) {\n const text = await safeReadText(response);\n throw new Error(\n `fetching oauth authorization server metadata from ${discoveryUrl} ` +\n `failed with status ${response.status.toString()}: ${text}`\n );\n }\n let raw: unknown;\n try {\n raw = await response.json();\n } catch (e) {\n throw new Error(\n `parsing oauth authorization server metadata from ${discoveryUrl} ` +\n `failed: ${stringifyError(e)}`\n );\n }\n const parsed = oauthServerSchema.parse(raw);\n return parsed.token_endpoint;\n}\n\nconst hostMetadataSchema = z.object({\n oidc_endpoint: z.string(),\n account_id: z.string().optional(),\n workspace_id: z.string().optional(),\n});\n\nconst oauthServerSchema = z.object({\n token_endpoint: z.string(),\n});\n\nfunction trimTrailingSlash(s: string): string {\n let end = s.length;\n while (end > 0 && s.charAt(end - 1) === '/') {\n end--;\n }\n return s.slice(0, end);\n}\n\nasync function safeReadText(response: Response): Promise<string> {\n try {\n return await response.text();\n } catch {\n return '';\n }\n}\n\nfunction stringifyError(e: unknown): string {\n if (e instanceof Error) {\n return e.message;\n }\n return String(e);\n}\n"],"mappings":";;;;;;;;;AAiCA,eAAsB,gBAAgB,MAAqC;CACzE,MAAM,MAAM,GAAG,kBAAkB,KAAK,CAAC;CACvC,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,MAAM,IAAI;UACpB,GAAG;AACV,QAAM,IAAI,MACR,+BAA+B,IAAI,WAAW,eAAe,EAAE,GAChE;;AAEH,KAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,aAAa,SAAS;AACzC,QAAM,IAAI,MACR,+BAA+B,IAAI,sBAC9B,SAAS,OAAO,UAAU,CAAC,IAAI,OACrC;;CAEH,IAAI;AACJ,KAAI;AACF,QAAM,MAAM,SAAS,MAAM;UACpB,GAAG;AACV,QAAM,IAAI,MACR,8BAA8B,IAAI,WAAW,eAAe,EAAE,GAC/D;;CAEH,MAAM,SAAS,mBAAmB,MAAM,IAAI;AAC5C,QAAO;EACL,cAAc,OAAO;EACrB,GAAI,OAAO,eAAe,UAAa,EAAC,WAAW,OAAO,YAAW;EACrE,GAAI,OAAO,iBAAiB,UAAa,EACvC,aAAa,OAAO,cACrB;EACF;;;;;;;;;;;;;;;;AAiBH,eAAsB,qBACpB,MACA,iBACiB;CACjB,MAAM,OAAO,MAAM,gBAAgB,KAAK;CAIxC,MAAM,YACJ,oBAAoB,UAAa,oBAAoB,KACjD,kBACA,KAAK;CACX,IAAI,WAAW,KAAK;AACpB,KAAI,SAAS,SAAS,eAAe,EAAE;AACrC,MAAI,cAAc,UAAa,cAAc,GAC3C,OAAM,IAAI,MACR,oIAED;AAEH,aAAW,SAAS,WAAW,gBAAgB,UAAU;;CAE3D,MAAM,eAAe,GAAG,kBAAkB,SAAS,CAAC;CACpD,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,MAAM,aAAa;UAC7B,GAAG;AACV,QAAM,IAAI,MACR,qDAAqD,aAAa,WACrD,eAAe,EAAE,GAC/B;;AAEH,KAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,aAAa,SAAS;AACzC,QAAM,IAAI,MACR,qDAAqD,aAAa,sBAC1C,SAAS,OAAO,UAAU,CAAC,IAAI,OACxD;;CAEH,IAAI;AACJ,KAAI;AACF,QAAM,MAAM,SAAS,MAAM;UACpB,GAAG;AACV,QAAM,IAAI,MACR,oDAAoD,aAAa,WACpD,eAAe,EAAE,GAC/B;;AAGH,QADe,kBAAkB,MAAM,IAAI,CAC7B;;AAGhB,MAAM,qBAAqB,EAAE,OAAO;CAClC,eAAe,EAAE,QAAQ;CACzB,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,cAAc,EAAE,QAAQ,CAAC,UAAU;CACpC,CAAC;AAEF,MAAM,oBAAoB,EAAE,OAAO,EACjC,gBAAgB,EAAE,QAAQ,EAC3B,CAAC;AAEF,SAAS,kBAAkB,GAAmB;CAC5C,IAAI,MAAM,EAAE;AACZ,QAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,KAAK,IACtC;AAEF,QAAO,EAAE,MAAM,GAAG,IAAI;;AAGxB,eAAe,aAAa,UAAqC;AAC/D,KAAI;AACF,SAAO,MAAM,SAAS,MAAM;SACtB;AACN,SAAO;;;AAIX,SAAS,eAAe,GAAoB;AAC1C,KAAI,aAAa,MACf,QAAO,EAAE;AAEX,QAAO,OAAO,EAAE"}
|
|
@@ -1,11 +1,4 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
*/
|
|
6
|
-
export { M2mCredentialsError, PatCredentialsError } from './errors';
|
|
7
|
-
export type { M2mCredentialsErrorCode, PatCredentialsErrorCode } from './errors';
|
|
8
|
-
export { newM2mCredentials } from './m2m';
|
|
9
|
-
export type { M2mCredentialsOptions } from './m2m';
|
|
10
|
-
export { newPatCredentials } from './pat';
|
|
11
|
-
//# sourceMappingURL=index.browser.d.ts.map
|
|
1
|
+
import { M2mCredentialsError, M2mCredentialsErrorCode, PatCredentialsError, PatCredentialsErrorCode } from "./errors.js";
|
|
2
|
+
import { M2mCredentialsOptions, newM2mCredentials } from "./m2m.js";
|
|
3
|
+
import { newPatCredentials } from "./pat.js";
|
|
4
|
+
export { M2mCredentialsError, type M2mCredentialsErrorCode, type M2mCredentialsOptions, PatCredentialsError, type PatCredentialsErrorCode, newM2mCredentials, newPatCredentials };
|