@databricks/sdk-auth 0.33.0 → 0.35.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (79) hide show
  1. package/dist/auth.d.ts +42 -40
  2. package/dist/auth.d.ts.map +1 -1
  3. package/dist/auth.js +38 -42
  4. package/dist/auth.js.map +1 -1
  5. package/dist/credentials/default/chain.d.ts +26 -22
  6. package/dist/credentials/default/chain.d.ts.map +1 -1
  7. package/dist/credentials/default/chain.js +74 -84
  8. package/dist/credentials/default/chain.js.map +1 -1
  9. package/dist/credentials/default/default-credentials.d.ts +12 -9
  10. package/dist/credentials/default/default-credentials.d.ts.map +1 -1
  11. package/dist/credentials/default/default-credentials.js +29 -20
  12. package/dist/credentials/default/default-credentials.js.map +1 -1
  13. package/dist/credentials/default/errors.d.ts +7 -4
  14. package/dist/credentials/default/errors.d.ts.map +1 -1
  15. package/dist/credentials/default/errors.js +17 -13
  16. package/dist/credentials/default/errors.js.map +1 -1
  17. package/dist/credentials/default/u2m-strategy.d.ts +6 -2
  18. package/dist/credentials/default/u2m-strategy.d.ts.map +1 -1
  19. package/dist/credentials/default/u2m-strategy.js +21 -20
  20. package/dist/credentials/default/u2m-strategy.js.map +1 -1
  21. package/dist/credentials/errors.d.ts +15 -12
  22. package/dist/credentials/errors.d.ts.map +1 -1
  23. package/dist/credentials/errors.js +40 -41
  24. package/dist/credentials/errors.js.map +1 -1
  25. package/dist/credentials/host-metadata.d.ts +22 -19
  26. package/dist/credentials/host-metadata.d.ts.map +1 -1
  27. package/dist/credentials/host-metadata.js +88 -109
  28. package/dist/credentials/host-metadata.js.map +1 -1
  29. package/dist/credentials/index.browser.d.ts +4 -11
  30. package/dist/credentials/index.browser.js +5 -9
  31. package/dist/credentials/index.d.ts +7 -14
  32. package/dist/credentials/index.js +8 -10
  33. package/dist/credentials/m2m.d.ts +29 -28
  34. package/dist/credentials/m2m.d.ts.map +1 -1
  35. package/dist/credentials/m2m.js +66 -81
  36. package/dist/credentials/m2m.js.map +1 -1
  37. package/dist/credentials/pat.d.ts +6 -5
  38. package/dist/credentials/pat.d.ts.map +1 -1
  39. package/dist/credentials/pat.js +33 -37
  40. package/dist/credentials/pat.js.map +1 -1
  41. package/dist/credentials/u2m.d.ts +17 -20
  42. package/dist/credentials/u2m.d.ts.map +1 -1
  43. package/dist/credentials/u2m.js +107 -135
  44. package/dist/credentials/u2m.js.map +1 -1
  45. package/dist/index.d.ts +6 -8
  46. package/dist/index.d.ts.map +1 -1
  47. package/dist/index.js +12 -7
  48. package/dist/index.js.map +1 -1
  49. package/dist/oidc/env.d.ts +6 -2
  50. package/dist/oidc/env.d.ts.map +1 -1
  51. package/dist/oidc/env.js +19 -16
  52. package/dist/oidc/env.js.map +1 -1
  53. package/dist/oidc/file.d.ts +6 -2
  54. package/dist/oidc/file.d.ts.map +1 -1
  55. package/dist/oidc/file.js +23 -25
  56. package/dist/oidc/file.js.map +1 -1
  57. package/dist/oidc/index.browser.d.ts +3 -13
  58. package/dist/oidc/index.browser.js +4 -11
  59. package/dist/oidc/index.d.ts +5 -14
  60. package/dist/oidc/index.js +6 -12
  61. package/dist/oidc/oidc.d.ts +8 -5
  62. package/dist/oidc/oidc.d.ts.map +1 -1
  63. package/dist/oidc/oidc.js +11 -7
  64. package/dist/oidc/oidc.js.map +1 -1
  65. package/dist/oidc/tokensource.d.ts +41 -41
  66. package/dist/oidc/tokensource.d.ts.map +1 -1
  67. package/dist/oidc/tokensource.js +47 -52
  68. package/dist/oidc/tokensource.js.map +1 -1
  69. package/dist/package.js +6 -0
  70. package/dist/package.js.map +1 -0
  71. package/package.json +3 -3
  72. package/dist/credentials/index.browser.d.ts.map +0 -1
  73. package/dist/credentials/index.browser.js.map +0 -1
  74. package/dist/credentials/index.d.ts.map +0 -1
  75. package/dist/credentials/index.js.map +0 -1
  76. package/dist/oidc/index.browser.d.ts.map +0 -1
  77. package/dist/oidc/index.browser.js.map +0 -1
  78. package/dist/oidc/index.d.ts.map +0 -1
  79. package/dist/oidc/index.js.map +0 -1
@@ -1 +1 @@
1
- {"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../src/oidc/oidc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACzC,eAAe,CAEjB"}
1
+ {"version":3,"file":"oidc.d.ts","names":[],"sources":["../../src/oidc/oidc.ts"],"mappings":";;AAIA;;;UAAiB,OAAA;EACf,KAAA;AAAA;;;;UAMe,eAAA;EACf,OAAA,CAAQ,QAAA,WAAmB,OAAA,CAAQ,OAAA;AAAA;;;;AASrC;;;iBAAgB,iBAAA,CACd,EAAA,GAAK,QAAA,aAAqB,OAAA,CAAQ,OAAA,IACjC,eAAA"}
package/dist/oidc/oidc.js CHANGED
@@ -1,10 +1,14 @@
1
+ //#region src/oidc/oidc.ts
1
2
  /**
2
- * Adapter to allow the use of ordinary functions as IdTokenProvider.
3
- *
4
- * @example
5
- * const provider = idTokenProviderFn(async () => ({ value: 'my-id-token' }));
6
- */
7
- export function idTokenProviderFn(fn) {
8
- return { idToken: fn };
3
+ * Adapter to allow the use of ordinary functions as IdTokenProvider.
4
+ *
5
+ * @example
6
+ * const provider = idTokenProviderFn(async () => ({ value: 'my-id-token' }));
7
+ */
8
+ function idTokenProviderFn(fn) {
9
+ return { idToken: fn };
9
10
  }
11
+
12
+ //#endregion
13
+ export { idTokenProviderFn };
10
14
  //# sourceMappingURL=oidc.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/oidc/oidc.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAA0C;IAE1C,OAAO,EAAC,OAAO,EAAE,EAAE,EAAC,CAAC;AACvB,CAAC"}
1
+ {"version":3,"file":"oidc.js","names":[],"sources":["../../src/oidc/oidc.ts"],"sourcesContent":["/**\n * IdToken represents an OIDC ID token that can be exchanged for a Databricks\n * access token.\n */\nexport interface IdToken {\n value: string;\n}\n\n/**\n * IdTokenProvider is anything that returns an IdToken given an audience.\n */\nexport interface IdTokenProvider {\n idToken(audience: string): Promise<IdToken>;\n}\n\n/**\n * Adapter to allow the use of ordinary functions as IdTokenProvider.\n *\n * @example\n * const provider = idTokenProviderFn(async () => ({ value: 'my-id-token' }));\n */\nexport function idTokenProviderFn(\n fn: (audience: string) => Promise<IdToken>\n): IdTokenProvider {\n return {idToken: fn};\n}\n"],"mappings":";;;;;;;AAqBA,SAAgB,kBACd,IACiB;AACjB,QAAO,EAAC,SAAS,IAAG"}
@@ -1,56 +1,56 @@
1
- /**
2
- * Databricks OIDC token-exchange provider. Exchanges an OIDC ID token for a
3
- * Databricks access token using the OAuth 2.0 token-exchange grant.
4
- */
5
- import type { TokenProvider } from '../auth';
6
- import type { IdTokenProvider } from './oidc';
1
+ import { TokenProvider } from "../auth.js";
2
+ import { IdTokenProvider } from "./oidc.js";
3
+
4
+ //#region src/oidc/tokensource.d.ts
7
5
  /**
8
6
  * OAuthAuthorizationServer describes the OAuth endpoints used to mint
9
7
  * Databricks access tokens.
10
8
  */
11
- export interface OAuthAuthorizationServer {
12
- tokenEndpoint: string;
9
+ interface OAuthAuthorizationServer {
10
+ tokenEndpoint: string;
13
11
  }
14
12
  /**
15
13
  * DatabricksOidcTokenProviderConfig is the configuration for a Databricks OIDC
16
14
  * TokenProvider.
17
15
  */
18
- export interface DatabricksOidcTokenProviderConfig {
19
- /**
20
- * Client ID of the Databricks OIDC application. It corresponds to the
21
- * Application ID of the Databricks Service Principal.
22
- *
23
- * This field is only required for Workload Identity Federation and should
24
- * be empty for Account-wide token federation.
25
- */
26
- clientId?: string;
27
- /**
28
- * Account ID of the Databricks Account. This field is only required for
29
- * Account-wide token federation.
30
- */
31
- accountId?: string;
32
- /**
33
- * Host is the host of the Databricks account or workspace.
34
- */
35
- host: string;
36
- /**
37
- * TokenEndpointProvider returns the token endpoint for the Databricks OIDC
38
- * application.
39
- */
40
- tokenEndpointProvider: () => Promise<OAuthAuthorizationServer>;
41
- /**
42
- * Audience is the audience of the Databricks OIDC application.
43
- * This is only used for Workspace level tokens.
44
- */
45
- audience?: string;
46
- /**
47
- * IdTokenProvider returns the ID token to be used for the token exchange.
48
- */
49
- idTokenProvider: IdTokenProvider;
16
+ interface DatabricksOidcTokenProviderConfig {
17
+ /**
18
+ * Client ID of the Databricks OIDC application. It corresponds to the
19
+ * Application ID of the Databricks Service Principal.
20
+ *
21
+ * This field is only required for Workload Identity Federation and should
22
+ * be empty for Account-wide token federation.
23
+ */
24
+ clientId?: string;
25
+ /**
26
+ * Account ID of the Databricks Account. This field is only required for
27
+ * Account-wide token federation.
28
+ */
29
+ accountId?: string;
30
+ /**
31
+ * Host is the host of the Databricks account or workspace.
32
+ */
33
+ host: string;
34
+ /**
35
+ * TokenEndpointProvider returns the token endpoint for the Databricks OIDC
36
+ * application.
37
+ */
38
+ tokenEndpointProvider: () => Promise<OAuthAuthorizationServer>;
39
+ /**
40
+ * Audience is the audience of the Databricks OIDC application.
41
+ * This is only used for Workspace level tokens.
42
+ */
43
+ audience?: string;
44
+ /**
45
+ * IdTokenProvider returns the ID token to be used for the token exchange.
46
+ */
47
+ idTokenProvider: IdTokenProvider;
50
48
  }
51
49
  /**
52
50
  * Returns a new Databricks OIDC TokenProvider that exchanges an OIDC ID token
53
51
  * for a Databricks access token using the OAuth 2.0 token-exchange grant.
54
52
  */
55
- export declare function newDatabricksOidcTokenProvider(config: DatabricksOidcTokenProviderConfig): TokenProvider;
53
+ declare function newDatabricksOidcTokenProvider(config: DatabricksOidcTokenProviderConfig): TokenProvider;
54
+ //#endregion
55
+ export { DatabricksOidcTokenProviderConfig, OAuthAuthorizationServer, newDatabricksOidcTokenProvider };
56
56
  //# sourceMappingURL=tokensource.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"tokensource.d.ts","sourceRoot":"","sources":["../../src/oidc/tokensource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAQ,aAAa,EAAC,MAAM,SAAS,CAAC;AAGlD,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,QAAQ,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,qBAAqB,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAE/D;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,eAAe,EAAE,eAAe,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,iCAAiC,GACxC,aAAa,CAEf"}
1
+ {"version":3,"file":"tokensource.d.ts","names":[],"sources":["../../src/oidc/tokensource.ts"],"mappings":";;;;;;;AAwBA;UARiB,wBAAA;EACf,aAAA;AAAA;;;;;UAOe,iCAAA;EAcf;;;;;;;EANA,QAAA;EA4BgC;;AAOlC;;EA7BE,SAAA;EA+Bc;;;EA1Bd,IAAA;EA0Bc;;;;EApBd,qBAAA,QAA6B,OAAA,CAAQ,wBAAA;;;;;EAMrC,QAAA;;;;EAKA,eAAA,EAAiB,eAAA;AAAA;;;;;iBAOH,8BAAA,CACd,MAAA,EAAQ,iCAAA,GACP,aAAA"}
@@ -1,62 +1,57 @@
1
+ import { tokenProviderFn } from "../auth.js";
2
+ import { z } from "zod";
3
+
4
+ //#region src/oidc/tokensource.ts
1
5
  /**
2
- * Databricks OIDC token-exchange provider. Exchanges an OIDC ID token for a
3
- * Databricks access token using the OAuth 2.0 token-exchange grant.
4
- */
5
- import { z } from 'zod';
6
- import { tokenProviderFn } from '../auth';
6
+ * Databricks OIDC token-exchange provider. Exchanges an OIDC ID token for a
7
+ * Databricks access token using the OAuth 2.0 token-exchange grant.
8
+ */
7
9
  /**
8
- * Returns a new Databricks OIDC TokenProvider that exchanges an OIDC ID token
9
- * for a Databricks access token using the OAuth 2.0 token-exchange grant.
10
- */
11
- export function newDatabricksOidcTokenProvider(config) {
12
- return tokenProviderFn(() => exchangeIdToken(config));
10
+ * Returns a new Databricks OIDC TokenProvider that exchanges an OIDC ID token
11
+ * for a Databricks access token using the OAuth 2.0 token-exchange grant.
12
+ */
13
+ function newDatabricksOidcTokenProvider(config) {
14
+ return tokenProviderFn(() => exchangeIdToken(config));
13
15
  }
14
16
  async function exchangeIdToken(config) {
15
- if (config.host === '') {
16
- throw new Error('missing Host');
17
- }
18
- const endpoints = await config.tokenEndpointProvider();
19
- const audience = determineAudience(config, endpoints);
20
- const idToken = await config.idTokenProvider.idToken(audience);
21
- const params = new URLSearchParams();
22
- if (config.clientId !== undefined && config.clientId !== '') {
23
- params.set('client_id', config.clientId);
24
- }
25
- params.set('scope', 'all-apis');
26
- params.set('subject_token_type', 'urn:ietf:params:oauth:token-type:jwt');
27
- params.set('subject_token', idToken.value);
28
- params.set('grant_type', 'urn:ietf:params:oauth:grant-type:token-exchange');
29
- const response = await fetch(endpoints.tokenEndpoint, {
30
- method: 'POST',
31
- headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
32
- body: params.toString(),
33
- });
34
- if (!response.ok) {
35
- const text = await response.text();
36
- throw new Error(`token request failed with status ${response.status.toString()}: ${text}`);
37
- }
38
- const parsed = tokenResponseSchema.parse(await response.json());
39
- const expiry = parsed.expires_in !== undefined
40
- ? new Date(Date.now() + parsed.expires_in * 1000)
41
- : undefined;
42
- return {
43
- value: parsed.access_token,
44
- ...(parsed.token_type !== undefined && { type: parsed.token_type }),
45
- ...(expiry !== undefined && { expiry }),
46
- };
17
+ if (config.host === "") throw new Error("missing Host");
18
+ const endpoints = await config.tokenEndpointProvider();
19
+ const audience = determineAudience(config, endpoints);
20
+ const idToken = await config.idTokenProvider.idToken(audience);
21
+ const params = new URLSearchParams();
22
+ if (config.clientId !== void 0 && config.clientId !== "") params.set("client_id", config.clientId);
23
+ params.set("scope", "all-apis");
24
+ params.set("subject_token_type", "urn:ietf:params:oauth:token-type:jwt");
25
+ params.set("subject_token", idToken.value);
26
+ params.set("grant_type", "urn:ietf:params:oauth:grant-type:token-exchange");
27
+ const response = await fetch(endpoints.tokenEndpoint, {
28
+ method: "POST",
29
+ headers: { "Content-Type": "application/x-www-form-urlencoded" },
30
+ body: params.toString()
31
+ });
32
+ if (!response.ok) {
33
+ const text = await response.text();
34
+ throw new Error(`token request failed with status ${response.status.toString()}: ${text}`);
35
+ }
36
+ const parsed = tokenResponseSchema.parse(await response.json());
37
+ const expiry = parsed.expires_in !== void 0 ? new Date(Date.now() + parsed.expires_in * 1e3) : void 0;
38
+ return {
39
+ value: parsed.access_token,
40
+ ...parsed.token_type !== void 0 && { type: parsed.token_type },
41
+ ...expiry !== void 0 && { expiry }
42
+ };
47
43
  }
48
44
  function determineAudience(config, endpoints) {
49
- if (config.audience !== undefined && config.audience !== '') {
50
- return config.audience;
51
- }
52
- if (config.accountId !== undefined && config.accountId !== '') {
53
- return config.accountId;
54
- }
55
- return endpoints.tokenEndpoint;
45
+ if (config.audience !== void 0 && config.audience !== "") return config.audience;
46
+ if (config.accountId !== void 0 && config.accountId !== "") return config.accountId;
47
+ return endpoints.tokenEndpoint;
56
48
  }
57
49
  const tokenResponseSchema = z.object({
58
- access_token: z.string(),
59
- token_type: z.string().optional(),
60
- expires_in: z.number().optional(),
50
+ access_token: z.string(),
51
+ token_type: z.string().optional(),
52
+ expires_in: z.number().optional()
61
53
  });
54
+
55
+ //#endregion
56
+ export { newDatabricksOidcTokenProvider };
62
57
  //# sourceMappingURL=tokensource.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"tokensource.js","sourceRoot":"","sources":["../../src/oidc/tokensource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,OAAO,EAAC,eAAe,EAAC,MAAM,SAAS,CAAC;AAuDxC;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAyC;IAEzC,OAAO,eAAe,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,MAAyC;IAEzC,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,sCAAsC,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,iDAAiD,CAAC,CAAC;IAE5E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAC,cAAc,EAAE,mCAAmC,EAAC;QAC9D,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,MAAM,GACV,MAAM,CAAC,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QACjD,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,EAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAC,CAAC;QACjE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAC,MAAM,EAAC,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAyC,EACzC,SAAmC;IAEnC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,CAAC;AACjC,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}
1
+ {"version":3,"file":"tokensource.js","names":[],"sources":["../../src/oidc/tokensource.ts"],"sourcesContent":["/**\n * Databricks OIDC token-exchange provider. Exchanges an OIDC ID token for a\n * Databricks access token using the OAuth 2.0 token-exchange grant.\n */\n\nimport {z} from 'zod';\n\nimport type {Token, TokenProvider} from '../auth';\nimport {tokenProviderFn} from '../auth';\n\nimport type {IdTokenProvider} from './oidc';\n\n/**\n * OAuthAuthorizationServer describes the OAuth endpoints used to mint\n * Databricks access tokens.\n */\nexport interface OAuthAuthorizationServer {\n tokenEndpoint: string;\n}\n\n/**\n * DatabricksOidcTokenProviderConfig is the configuration for a Databricks OIDC\n * TokenProvider.\n */\nexport interface DatabricksOidcTokenProviderConfig {\n /**\n * Client ID of the Databricks OIDC application. It corresponds to the\n * Application ID of the Databricks Service Principal.\n *\n * This field is only required for Workload Identity Federation and should\n * be empty for Account-wide token federation.\n */\n clientId?: string;\n\n /**\n * Account ID of the Databricks Account. This field is only required for\n * Account-wide token federation.\n */\n accountId?: string;\n\n /**\n * Host is the host of the Databricks account or workspace.\n */\n host: string;\n\n /**\n * TokenEndpointProvider returns the token endpoint for the Databricks OIDC\n * application.\n */\n tokenEndpointProvider: () => Promise<OAuthAuthorizationServer>;\n\n /**\n * Audience is the audience of the Databricks OIDC application.\n * This is only used for Workspace level tokens.\n */\n audience?: string;\n\n /**\n * IdTokenProvider returns the ID token to be used for the token exchange.\n */\n idTokenProvider: IdTokenProvider;\n}\n\n/**\n * Returns a new Databricks OIDC TokenProvider that exchanges an OIDC ID token\n * for a Databricks access token using the OAuth 2.0 token-exchange grant.\n */\nexport function newDatabricksOidcTokenProvider(\n config: DatabricksOidcTokenProviderConfig\n): TokenProvider {\n return tokenProviderFn(() => exchangeIdToken(config));\n}\n\nasync function exchangeIdToken(\n config: DatabricksOidcTokenProviderConfig\n): Promise<Token> {\n if (config.host === '') {\n throw new Error('missing Host');\n }\n const endpoints = await config.tokenEndpointProvider();\n const audience = determineAudience(config, endpoints);\n const idToken = await config.idTokenProvider.idToken(audience);\n\n const params = new URLSearchParams();\n if (config.clientId !== undefined && config.clientId !== '') {\n params.set('client_id', config.clientId);\n }\n params.set('scope', 'all-apis');\n params.set('subject_token_type', 'urn:ietf:params:oauth:token-type:jwt');\n params.set('subject_token', idToken.value);\n params.set('grant_type', 'urn:ietf:params:oauth:grant-type:token-exchange');\n\n const response = await fetch(endpoints.tokenEndpoint, {\n method: 'POST',\n headers: {'Content-Type': 'application/x-www-form-urlencoded'},\n body: params.toString(),\n });\n if (!response.ok) {\n const text = await response.text();\n throw new Error(\n `token request failed with status ${response.status.toString()}: ${text}`\n );\n }\n const parsed = tokenResponseSchema.parse(await response.json());\n const expiry =\n parsed.expires_in !== undefined\n ? new Date(Date.now() + parsed.expires_in * 1000)\n : undefined;\n return {\n value: parsed.access_token,\n ...(parsed.token_type !== undefined && {type: parsed.token_type}),\n ...(expiry !== undefined && {expiry}),\n };\n}\n\nfunction determineAudience(\n config: DatabricksOidcTokenProviderConfig,\n endpoints: OAuthAuthorizationServer\n): string {\n if (config.audience !== undefined && config.audience !== '') {\n return config.audience;\n }\n if (config.accountId !== undefined && config.accountId !== '') {\n return config.accountId;\n }\n return endpoints.tokenEndpoint;\n}\n\nconst tokenResponseSchema = z.object({\n access_token: z.string(),\n token_type: z.string().optional(),\n expires_in: z.number().optional(),\n});\n"],"mappings":";;;;;;;;;;;;AAmEA,SAAgB,+BACd,QACe;AACf,QAAO,sBAAsB,gBAAgB,OAAO,CAAC;;AAGvD,eAAe,gBACb,QACgB;AAChB,KAAI,OAAO,SAAS,GAClB,OAAM,IAAI,MAAM,eAAe;CAEjC,MAAM,YAAY,MAAM,OAAO,uBAAuB;CACtD,MAAM,WAAW,kBAAkB,QAAQ,UAAU;CACrD,MAAM,UAAU,MAAM,OAAO,gBAAgB,QAAQ,SAAS;CAE9D,MAAM,SAAS,IAAI,iBAAiB;AACpC,KAAI,OAAO,aAAa,UAAa,OAAO,aAAa,GACvD,QAAO,IAAI,aAAa,OAAO,SAAS;AAE1C,QAAO,IAAI,SAAS,WAAW;AAC/B,QAAO,IAAI,sBAAsB,uCAAuC;AACxE,QAAO,IAAI,iBAAiB,QAAQ,MAAM;AAC1C,QAAO,IAAI,cAAc,kDAAkD;CAE3E,MAAM,WAAW,MAAM,MAAM,UAAU,eAAe;EACpD,QAAQ;EACR,SAAS,EAAC,gBAAgB,qCAAoC;EAC9D,MAAM,OAAO,UAAU;EACxB,CAAC;AACF,KAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,QAAM,IAAI,MACR,oCAAoC,SAAS,OAAO,UAAU,CAAC,IAAI,OACpE;;CAEH,MAAM,SAAS,oBAAoB,MAAM,MAAM,SAAS,MAAM,CAAC;CAC/D,MAAM,SACJ,OAAO,eAAe,SAClB,IAAI,KAAK,KAAK,KAAK,GAAG,OAAO,aAAa,IAAK,GAC/C;AACN,QAAO;EACL,OAAO,OAAO;EACd,GAAI,OAAO,eAAe,UAAa,EAAC,MAAM,OAAO,YAAW;EAChE,GAAI,WAAW,UAAa,EAAC,QAAO;EACrC;;AAGH,SAAS,kBACP,QACA,WACQ;AACR,KAAI,OAAO,aAAa,UAAa,OAAO,aAAa,GACvD,QAAO,OAAO;AAEhB,KAAI,OAAO,cAAc,UAAa,OAAO,cAAc,GACzD,QAAO,OAAO;AAEhB,QAAO,UAAU;;AAGnB,MAAM,sBAAsB,EAAE,OAAO;CACnC,cAAc,EAAE,QAAQ;CACxB,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,YAAY,EAAE,QAAQ,CAAC,UAAU;CAClC,CAAC"}
@@ -0,0 +1,6 @@
1
+ //#region package.json
2
+ var version = "0.35.0";
3
+
4
+ //#endregion
5
+ export { version };
6
+ //# sourceMappingURL=package.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"package.js","names":[],"sources":["../package.json"],"sourcesContent":[""],"mappings":""}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@databricks/sdk-auth",
3
- "version": "0.33.0",
3
+ "version": "0.35.0",
4
4
  "description": "Databricks authentication library for JavaScript/TypeScript",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
@@ -37,7 +37,7 @@
37
37
  "LICENSE"
38
38
  ],
39
39
  "scripts": {
40
- "build": "tsc -b",
40
+ "build": "tsdown",
41
41
  "lint": "eslint src tests --ext .ts",
42
42
  "lint:fix": "eslint src tests --ext .ts --fix",
43
43
  "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",
@@ -53,7 +53,7 @@
53
53
  "node": ">=22.0.0"
54
54
  },
55
55
  "dependencies": {
56
- "@databricks/sdk-core": ">=0.33.0 <1.0.0",
56
+ "@databricks/sdk-core": ">=0.35.0 <1.0.0",
57
57
  "zod": "^4.3.6"
58
58
  }
59
59
  }
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../../src/credentials/index.browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAClE,YAAY,EAAC,uBAAuB,EAAE,uBAAuB,EAAC,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,YAAY,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AACjD,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../../src/credentials/index.browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAElE,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,YAAY,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AACjD,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,YAAY,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AACjD,OAAO,EAAC,kBAAkB,EAAC,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AACzD,YAAY,EAAC,2BAA2B,EAAC,MAAM,kBAAkB,CAAC"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAMlB,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC,OAAO,EAAC,kBAAkB,EAAC,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../../src/oidc/index.browser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EAAC,OAAO,EAAE,eAAe,EAAC,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,8BAA8B,EAAC,MAAM,eAAe,CAAC"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../../src/oidc/index.browser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AAKzC,OAAO,EAAC,8BAA8B,EAAC,MAAM,eAAe,CAAC"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EAAC,OAAO,EAAE,eAAe,EAAC,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAC,oBAAoB,EAAC,MAAM,QAAQ,CAAC;AAC5C,YAAY,EACV,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,8BAA8B,EAAC,MAAM,eAAe,CAAC"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAC,oBAAoB,EAAC,MAAM,QAAQ,CAAC;AAK5C,OAAO,EAAC,8BAA8B,EAAC,MAAM,eAAe,CAAC"}