@dvsa/appdev-api-common 1.2.0 → 2.0.0-canary.0

package/auth/oidc.d.ts

@@ -0,0 +1,39 @@
+export interface AzureTokenResponse {
+    token_type: string;
+    expires_in: number;
+    ext_expires_in?: number;
+    access_token: string;
+}
+export declare class AwsToAzureFederatedCredentials {
+    private readonly tenantId;
+    private readonly clientID;
+    private readonly tokenDurationSeconds;
+    private readonly debugMode;
+    private static accessToken;
+    private static readonly stsClient;
+    /**
+     * Create a new instance of the AwsToAzureFederatedCredentials class
+     * @param tenantId - The Azure AD tenant ID
+     * @param clientID - The Azure AD application (client) ID
+     * @param tokenDurationSeconds - Duration for the AWS token (default: 300)
+     * @param debugMode - Whether to log debug messages
+     */
+    constructor(tenantId: string, clientID: string, tokenDurationSeconds?: number, debugMode?: boolean);
+    /**
+     * Get the Azure access token, fetching a new one if needed
+     * @returns {Promise<string>} - The Azure access token
+     */
+    getAccessToken(): Promise<string>;
+    /**
+     * Fetch the AWS JWT and exchange it for an Azure token
+     * @returns {Promise<AzureTokenResponse>} - The Azure token response
+     * @private
+     */
+    private fetchFederatedCredentials;
+    /**
+     * Check if the access token is expired
+     * @returns {boolean} - Whether the access token is expired
+     * @private
+     */
+    private isAccessTokenExpired;
+}

package/auth/oidc.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsToAzureFederatedCredentials = void 0;
+const client_sts_1 = require("@aws-sdk/client-sts");
+const jose_1 = require("jose");
+class AwsToAzureFederatedCredentials {
+    tenantId;
+    clientID;
+    tokenDurationSeconds;
+    debugMode;
+    static accessToken;
+    static stsClient = new client_sts_1.STSClient();
+    /**
+     * Create a new instance of the AwsToAzureFederatedCredentials class
+     * @param tenantId - The Azure AD tenant ID
+     * @param clientID - The Azure AD application (client) ID
+     * @param tokenDurationSeconds - Duration for the AWS token (default: 300)
+     * @param debugMode - Whether to log debug messages
+     */
+    constructor(tenantId, clientID, tokenDurationSeconds = 300, debugMode = false) {
+        this.tenantId = tenantId;
+        this.clientID = clientID;
+        this.tokenDurationSeconds = tokenDurationSeconds;
+        this.debugMode = debugMode;
+    }
+    /**
+     * Get the Azure access token, fetching a new one if needed
+     * @returns {Promise<string>} - The Azure access token
+     */
+    async getAccessToken() {
+        if (!AwsToAzureFederatedCredentials.accessToken || this.isAccessTokenExpired()) {
+            const { access_token } = await this.fetchFederatedCredentials();
+            if (this.debugMode) {
+                console.log('[DEBUG] New Azure access token fetched:', access_token);
+            }
+            AwsToAzureFederatedCredentials.accessToken = access_token;
+        }
+        else if (this.debugMode) {
+            console.log("[DEBUG] Using existing Azure access token:", AwsToAzureFederatedCredentials.accessToken);
+        }
+        return AwsToAzureFederatedCredentials.accessToken;
+    }
+    /**
+     * Fetch the AWS JWT and exchange it for an Azure token
+     * @returns {Promise<AzureTokenResponse>} - The Azure token response
+     * @private
+     */
+    async fetchFederatedCredentials() {
+        const tokenResp = await AwsToAzureFederatedCredentials.stsClient.send(new client_sts_1.GetWebIdentityTokenCommand({
+            Audience: [this.clientID],
+            SigningAlgorithm: "RS256",
+            DurationSeconds: this.tokenDurationSeconds,
+        }));
+        const awsJwt = tokenResp?.WebIdentityToken;
+        if (!awsJwt) {
+            throw new Error("STS did not return a WebIdentityToken");
+        }
+        if (this.debugMode)
+            console.log("[DEBUG] AWS JWT obtained");
+        const response = await fetch(`https://login.microsoftonline.com/${this.tenantId}/oauth2/v2.0/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: this.clientID,
+                client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+                client_assertion: awsJwt,
+                scope: `api://${this.clientID}/.default`,
+            }).toString(),
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            console.error("Error exchanging AWS JWT for Azure token:", response.status, errorBody);
+            throw new Error(`Azure token endpoint error: HTTP ${response.status} - ${errorBody}`);
+        }
+        return (await response.json());
+    }
+    /**
+     * Check if the access token is expired
+     * @returns {boolean} - Whether the access token is expired
+     * @private
+     */
+    isAccessTokenExpired() {
+        try {
+            const decodedAccessToken = (0, jose_1.decodeJwt)(AwsToAzureFederatedCredentials.accessToken);
+            const currentTime = Date.now() / 1000;
+            if (!decodedAccessToken?.exp) {
+                return true;
+            }
+            return currentTime > decodedAccessToken.exp;
+        }
+        catch (err) {
+            console.error("Error decoding access token:", err);
+            return true;
+        }
+    }
+}
+exports.AwsToAzureFederatedCredentials = AwsToAzureFederatedCredentials;

package/package.json

@@ -1,7 +1,11 @@
 {
 	"name": "@dvsa/appdev-api-common",
-	"version": "1.2.0",
-	"keywords": ["dvsa", "nodejs", "typescript"],
+	"version": "2.0.0-canary.0",
+	"keywords": [
+		"dvsa",
+		"nodejs",
+		"typescript"
+	],
 	"author": "DVSA",
 	"repository": {
 		"type": "git",
@@ -28,6 +32,7 @@
 		"gitSecrets": "git secrets --scan . && git log -p -- . | scanrepo"
 	},
 	"dependencies": {
+		"@aws-sdk/client-sts": "^3.989.0",
 		"ajv": "^8.17.1",
 		"ajv-formats": "^3.0.1",
 		"dayjs": "^1.11.13",