@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/cognito-verifier.js

@@ -0,0 +1,158 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CognitoJwtVerifier = exports.validateCognitoJwtFields = void 0;
+const error_js_1 = require("./error.js");
+const jwt_rsa_js_1 = require("./jwt-rsa.js");
+const assert_js_1 = require("./assert.js");
+/**
+ * Validate claims of a decoded Cognito JWT.
+ * This function throws an error in case there's any validation issue.
+ *
+ * @param payload - The JSON parsed payload of the Cognito JWT
+ * @param options - Validation options
+ * @param options.groups - The cognito groups, of which at least one must be present in the JWT's cognito:groups claim
+ * @param options.tokenUse - The required token use of the JWT: "id" or "access"
+ * @param options.clientId - The required clientId of the JWT. May be an array of string, of which at least one must match
+ * @returns void
+ */
+function validateCognitoJwtFields(payload, options) {
+    // Check groups
+    if (options.groups != null) {
+        (0, assert_js_1.assertStringArraysOverlap)("Cognito group", payload["cognito:groups"], options.groups, error_js_1.CognitoJwtInvalidGroupError);
+    }
+    // Check token use
+    (0, assert_js_1.assertStringArrayContainsString)("Token use", payload.token_use, ["id", "access"], error_js_1.CognitoJwtInvalidTokenUseError);
+    if (options.tokenUse !== null) {
+        if (options.tokenUse === undefined) {
+            throw new error_js_1.ParameterValidationError("tokenUse must be provided or set to null explicitly");
+        }
+        (0, assert_js_1.assertStringEquals)("Token use", payload.token_use, options.tokenUse, error_js_1.CognitoJwtInvalidTokenUseError);
+    }
+    // Check clientId aka audience
+    if (options.clientId !== null) {
+        if (options.clientId === undefined) {
+            throw new error_js_1.ParameterValidationError("clientId must be provided or set to null explicitly");
+        }
+        if (payload.token_use === "id") {
+            (0, assert_js_1.assertStringArrayContainsString)('Client ID ("audience")', payload.aud, options.clientId, error_js_1.CognitoJwtInvalidClientIdError);
+        }
+        else {
+            (0, assert_js_1.assertStringArrayContainsString)("Client ID", payload.client_id, options.clientId, error_js_1.CognitoJwtInvalidClientIdError);
+        }
+    }
+}
+exports.validateCognitoJwtFields = validateCognitoJwtFields;
+/**
+ * Class representing a verifier for JWTs signed by Amazon Cognito
+ */
+class CognitoJwtVerifier extends jwt_rsa_js_1.JwtRsaVerifierBase {
+    constructor(props, jwksCache) {
+        const issuerConfig = Array.isArray(props)
+            ? props.map((p) => ({
+                ...p,
+                ...CognitoJwtVerifier.parseUserPoolId(p.userPoolId),
+                audience: null, // checked instead by validateCognitoJwtFields
+            }))
+            : {
+                ...props,
+                ...CognitoJwtVerifier.parseUserPoolId(props.userPoolId),
+                audience: null, // checked instead by validateCognitoJwtFields
+            };
+        super(issuerConfig, jwksCache);
+    }
+    /**
+     * Parse a User Pool ID, to extract the issuer and JWKS URI
+     *
+     * @param userPoolId The User Pool ID
+     * @returns The issuer and JWKS URI for the User Pool
+     */
+    static parseUserPoolId(userPoolId) {
+        // Disable safe regexp check as userPoolId is provided by developer, i.e. is not user input
+        // eslint-disable-next-line security/detect-unsafe-regex
+        const match = userPoolId.match(/^(?<region>(\w+-)?\w+-\w+-\d)+_\w+$/);
+        if (!match) {
+            throw new error_js_1.ParameterValidationError(`Invalid Cognito User Pool ID: ${userPoolId}`);
+        }
+        const region = match.groups.region;
+        const issuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
+        return {
+            issuer,
+            jwksUri: `${issuer}/.well-known/jwks.json`,
+        };
+    }
+    // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
+    static create(verifyProperties, additionalProperties) {
+        return new this(verifyProperties, additionalProperties?.jwksCache);
+    }
+    /**
+     * Verify (synchronously) a JWT that is signed by Amazon Cognito.
+     *
+     * @param jwt The JWT, as string
+     * @param props Verification properties
+     * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+     */
+    verifySync(...[jwt, properties]) {
+        const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
+        this.verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties);
+        try {
+            validateCognitoJwtFields(decomposedJwt.payload, verifyProperties);
+        }
+        catch (err) {
+            if (verifyProperties.includeRawJwtInErrors &&
+                err instanceof error_js_1.JwtInvalidClaimError) {
+                throw err.withRawJwt(decomposedJwt);
+            }
+            throw err;
+        }
+        return decomposedJwt.payload;
+    }
+    /**
+     * Verify (asynchronously) a JWT that is signed by Amazon Cognito.
+     * This call is asynchronous, and the JWKS will be fetched from the JWKS uri,
+     * in case it is not yet available in the cache.
+     *
+     * @param jwt The JWT, as string
+     * @param props Verification properties
+     * @returns Promise that resolves to the payload of the JWT––if the JWT is valid, otherwise the promise rejects
+     */
+    async verify(...[jwt, properties]) {
+        const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
+        await this.verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties);
+        try {
+            validateCognitoJwtFields(decomposedJwt.payload, verifyProperties);
+        }
+        catch (err) {
+            if (verifyProperties.includeRawJwtInErrors &&
+                err instanceof error_js_1.JwtInvalidClaimError) {
+                throw err.withRawJwt(decomposedJwt);
+            }
+            throw err;
+        }
+        return decomposedJwt.payload;
+    }
+    /**
+     * This method loads a JWKS that you provide, into the JWKS cache, so that it is
+     * available for JWT verification. Use this method to speed up the first JWT verification
+     * (when the JWKS would otherwise have to be downloaded from the JWKS uri), or to provide the JWKS
+     * in case the JwtVerifier does not have internet access to download the JWKS
+     *
+     * @param jwks The JWKS
+     * @param userPoolId The userPoolId for which you want to cache the JWKS
+     *  Supply this field, if you instantiated the CognitoJwtVerifier with multiple userPoolIds
+     * @returns void
+     */
+    cacheJwks(...[jwks, userPoolId]) {
+        let issuer;
+        if (userPoolId !== undefined) {
+            issuer = CognitoJwtVerifier.parseUserPoolId(userPoolId).issuer;
+        }
+        else if (this.expectedIssuers.length > 1) {
+            throw new error_js_1.ParameterValidationError("userPoolId must be provided");
+        }
+        const issuerConfig = this.getIssuerConfig(issuer);
+        super.cacheJwks(jwks, issuerConfig.issuer);
+    }
+}
+exports.CognitoJwtVerifier = CognitoJwtVerifier;

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/error.js

@@ -0,0 +1,131 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NotSupportedError = exports.NonRetryableFetchError = exports.FetchError = exports.JwkInvalidKtyError = exports.JwkInvalidUseError = exports.JwksNotAvailableInCacheError = exports.WaitPeriodNotYetEndedJwkError = exports.KidNotFoundInJwksError = exports.JwtWithoutValidKidError = exports.JwkValidationError = exports.JwksValidationError = exports.Asn1DecodingError = exports.CognitoJwtInvalidClientIdError = exports.CognitoJwtInvalidTokenUseError = exports.CognitoJwtInvalidGroupError = exports.JwtNotBeforeError = exports.JwtExpiredError = exports.JwtInvalidScopeError = exports.JwtInvalidAudienceError = exports.JwtInvalidIssuerError = exports.JwtInvalidClaimError = exports.JwtInvalidSignatureAlgorithmError = exports.JwtInvalidSignatureError = exports.ParameterValidationError = exports.JwtParseError = exports.FailedAssertionError = exports.JwtBaseError = void 0;
+/**
+ * Base Error for all other errors in this file
+ */
+class JwtBaseError extends Error {
+}
+exports.JwtBaseError = JwtBaseError;
+/**
+ * An error that is raised because an actual value does not match with the expected value
+ */
+class FailedAssertionError extends JwtBaseError {
+    constructor(msg, actual, expected) {
+        super(msg);
+        this.failedAssertion = {
+            actual,
+            expected,
+        };
+    }
+}
+exports.FailedAssertionError = FailedAssertionError;
+/**
+ * JWT errors
+ */
+class JwtParseError extends JwtBaseError {
+    constructor(msg, error) {
+        const message = error != null ? `${msg}: ${error}` : msg;
+        super(message);
+    }
+}
+exports.JwtParseError = JwtParseError;
+class ParameterValidationError extends JwtBaseError {
+}
+exports.ParameterValidationError = ParameterValidationError;
+class JwtInvalidSignatureError extends JwtBaseError {
+}
+exports.JwtInvalidSignatureError = JwtInvalidSignatureError;
+class JwtInvalidSignatureAlgorithmError extends FailedAssertionError {
+}
+exports.JwtInvalidSignatureAlgorithmError = JwtInvalidSignatureAlgorithmError;
+class JwtInvalidClaimError extends FailedAssertionError {
+    withRawJwt({ header, payload }) {
+        this.rawJwt = {
+            header,
+            payload,
+        };
+        return this;
+    }
+}
+exports.JwtInvalidClaimError = JwtInvalidClaimError;
+class JwtInvalidIssuerError extends JwtInvalidClaimError {
+}
+exports.JwtInvalidIssuerError = JwtInvalidIssuerError;
+class JwtInvalidAudienceError extends JwtInvalidClaimError {
+}
+exports.JwtInvalidAudienceError = JwtInvalidAudienceError;
+class JwtInvalidScopeError extends JwtInvalidClaimError {
+}
+exports.JwtInvalidScopeError = JwtInvalidScopeError;
+class JwtExpiredError extends JwtInvalidClaimError {
+}
+exports.JwtExpiredError = JwtExpiredError;
+class JwtNotBeforeError extends JwtInvalidClaimError {
+}
+exports.JwtNotBeforeError = JwtNotBeforeError;
+/**
+ * Amazon Cognito specific erros
+ */
+class CognitoJwtInvalidGroupError extends JwtInvalidClaimError {
+}
+exports.CognitoJwtInvalidGroupError = CognitoJwtInvalidGroupError;
+class CognitoJwtInvalidTokenUseError extends JwtInvalidClaimError {
+}
+exports.CognitoJwtInvalidTokenUseError = CognitoJwtInvalidTokenUseError;
+class CognitoJwtInvalidClientIdError extends JwtInvalidClaimError {
+}
+exports.CognitoJwtInvalidClientIdError = CognitoJwtInvalidClientIdError;
+/**
+ * ASN.1 errors
+ */
+class Asn1DecodingError extends JwtBaseError {
+}
+exports.Asn1DecodingError = Asn1DecodingError;
+/**
+ * JWK errors
+ */
+class JwksValidationError extends JwtBaseError {
+}
+exports.JwksValidationError = JwksValidationError;
+class JwkValidationError extends JwtBaseError {
+}
+exports.JwkValidationError = JwkValidationError;
+class JwtWithoutValidKidError extends JwtBaseError {
+}
+exports.JwtWithoutValidKidError = JwtWithoutValidKidError;
+class KidNotFoundInJwksError extends JwtBaseError {
+}
+exports.KidNotFoundInJwksError = KidNotFoundInJwksError;
+class WaitPeriodNotYetEndedJwkError extends JwtBaseError {
+}
+exports.WaitPeriodNotYetEndedJwkError = WaitPeriodNotYetEndedJwkError;
+class JwksNotAvailableInCacheError extends JwtBaseError {
+}
+exports.JwksNotAvailableInCacheError = JwksNotAvailableInCacheError;
+class JwkInvalidUseError extends FailedAssertionError {
+}
+exports.JwkInvalidUseError = JwkInvalidUseError;
+class JwkInvalidKtyError extends FailedAssertionError {
+}
+exports.JwkInvalidKtyError = JwkInvalidKtyError;
+/**
+ * HTTPS fetch errors
+ */
+class FetchError extends JwtBaseError {
+    constructor(uri, msg) {
+        super(`Failed to fetch ${uri}: ${msg}`);
+    }
+}
+exports.FetchError = FetchError;
+class NonRetryableFetchError extends FetchError {
+}
+exports.NonRetryableFetchError = NonRetryableFetchError;
+/**
+ * Web compatibility errors
+ */
+class NotSupportedError extends JwtBaseError {
+}
+exports.NotSupportedError = NotSupportedError;

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/https-common.js

@@ -0,0 +1,29 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Lower-level HTTPS functionalities, common for Node.js and Web
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateHttpsJsonResponse = void 0;
+const error_js_1 = require("./error.js");
+/**
+ * Sanity check a HTTPS response where we expect to get JSON data back
+ *
+ * @param uri the uri that was being requested
+ * @param statusCode the HTTP status code, should be 200
+ * @param contentType the value of the "Content-Type" header in the response, should start with "application/json"
+ * @returns void - throws an error if the status code or content type aren't as expected
+ */
+function validateHttpsJsonResponse(uri, statusCode, contentType) {
+    if (statusCode === 429) {
+        throw new error_js_1.FetchError(uri, "Too many requests");
+    }
+    else if (statusCode !== 200) {
+        throw new error_js_1.NonRetryableFetchError(uri, `Status code is ${statusCode}, expected 200`);
+    }
+    if (!contentType ||
+        !contentType.toLowerCase().startsWith("application/json")) {
+        throw new error_js_1.NonRetryableFetchError(uri, `Content-type is "${contentType}", expected "application/json"`);
+    }
+}
+exports.validateHttpsJsonResponse = validateHttpsJsonResponse;

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/https-node.js

@@ -0,0 +1,89 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// NodeJS implementation for fetching JSON documents over HTTPS
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchJson = void 0;
+const https_1 = require("https");
+const https_common_js_1 = require("./https-common.js");
+const stream_1 = require("stream");
+const util_1 = require("util");
+const safe_json_parse_js_1 = require("./safe-json-parse.js");
+const error_js_1 = require("./error.js");
+/**
+ * Execute a HTTPS request
+ * @param uri - The URI
+ * @param requestOptions - The RequestOptions to use
+ * @param data - Data to send to the URI (e.g. POST data)
+ * @returns - The response as parsed JSON
+ */
+async function fetchJson(uri, requestOptions, data) {
+    let responseTimeout;
+    return new Promise((resolve, reject) => {
+        const req = (0, https_1.request)(uri, {
+            method: "GET",
+            ...requestOptions,
+        }, (response) => {
+            // Capture response data
+            // @types/node is incomplete so cast to any
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            stream_1.pipeline([
+                response,
+                getJsonDestination(uri, response.statusCode, response.headers),
+            ], done);
+        });
+        if (requestOptions?.responseTimeout) {
+            responseTimeout = setTimeout(() => done(new error_js_1.FetchError(uri, `Response time-out (after ${requestOptions.responseTimeout} ms.)`)), requestOptions.responseTimeout);
+            responseTimeout.unref(); // Don't block Node from exiting
+        }
+        function done(...args) {
+            if (responseTimeout)
+                clearTimeout(responseTimeout);
+            if (args[0] == null) {
+                resolve(args[1]);
+                return;
+            }
+            // In case of errors, let the Agent (if any) know to abandon the socket
+            // This is probably best, because the socket may have become stale
+            /* istanbul ignore next */
+            req.socket?.emit("agentRemove");
+            // Turn error into FetchError so the URI is nicely captured in the message
+            let error = args[0];
+            if (!(error instanceof error_js_1.FetchError)) {
+                error = new error_js_1.FetchError(uri, error.message);
+            }
+            req.destroy();
+            reject(error);
+        }
+        // Handle errors while sending request
+        req.on("error", done);
+        // Signal end of request (include optional data)
+        req.end(data);
+    });
+}
+exports.fetchJson = fetchJson;
+/**
+ * Ensures the HTTPS response contains valid JSON
+ *
+ * @param uri - The URI you were requesting
+ * @param statusCode - The response status code to your HTTPS request
+ * @param headers - The response headers to your HTTPS request
+ *
+ * @returns - Async function that can be used as destination in a stream.pipeline, it will return the JSON, if valid, or throw an error otherwise
+ */
+function getJsonDestination(uri, statusCode, headers) {
+    return async (responseIterable) => {
+        (0, https_common_js_1.validateHttpsJsonResponse)(uri, statusCode, headers["content-type"]);
+        const collected = [];
+        for await (const chunk of responseIterable) {
+            collected.push(chunk);
+        }
+        try {
+            return (0, safe_json_parse_js_1.safeJsonParse)(new util_1.TextDecoder("utf8", { fatal: true, ignoreBOM: true }).decode(Buffer.concat(collected)));
+        }
+        catch (err) {
+            throw new error_js_1.NonRetryableFetchError(uri, err);
+        }
+    };
+}

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/https.js

@@ -0,0 +1,52 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utilities for fetching the JWKS URI, to get the public keys with which to verify JWTs
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SimpleJsonFetcher = exports.fetchJson = void 0;
+const error_js_1 = require("./error.js");
+const _node_web_compat_1 = require("#node-web-compat");
+/**
+ * Execute a HTTPS request
+ * @param uri - The URI
+ * @param requestOptions - The RequestOptions to use (depending on the runtime context, either Node.js RequestOptions or Web Fetch init)
+ * @param data - Data to send to the URI (e.g. POST data)
+ * @returns - The response as parsed JSON
+ */
+exports.fetchJson = _node_web_compat_1.nodeWebCompat.fetchJson;
+/**
+ * HTTPS Fetcher for URIs with JSON body
+ *
+ * @param defaultRequestOptions - The default RequestOptions to use on individual HTTPS requests
+ */
+class SimpleJsonFetcher {
+    constructor(props) {
+        this.defaultRequestOptions = {
+            timeout: _node_web_compat_1.nodeWebCompat.defaultFetchTimeouts.socketIdle,
+            responseTimeout: _node_web_compat_1.nodeWebCompat.defaultFetchTimeouts.response,
+            ...props?.defaultRequestOptions,
+        };
+    }
+    /**
+     * Execute a HTTPS request (with 1 immediate retry in case of errors)
+     * @param uri - The URI
+     * @param requestOptions - The RequestOptions to use
+     * @param data - Data to send to the URI (e.g. POST data)
+     * @returns - The response as parsed JSON
+     */
+    async fetch(uri, requestOptions, data) {
+        requestOptions = { ...this.defaultRequestOptions, ...requestOptions };
+        try {
+            return await (0, exports.fetchJson)(uri, requestOptions, data);
+        }
+        catch (err) {
+            if (err instanceof error_js_1.NonRetryableFetchError) {
+                throw err;
+            }
+            // Retry once, immediately
+            return (0, exports.fetchJson)(uri, requestOptions, data);
+        }
+    }
+}
+exports.SimpleJsonFetcher = SimpleJsonFetcher;

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/index.js

@@ -0,0 +1,9 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CognitoJwtVerifier = exports.JwtRsaVerifier = void 0;
+var jwt_rsa_js_1 = require("./jwt-rsa.js");
+Object.defineProperty(exports, "JwtRsaVerifier", { enumerable: true, get: function () { return jwt_rsa_js_1.JwtRsaVerifier; } });
+var cognito_verifier_js_1 = require("./cognito-verifier.js");
+Object.defineProperty(exports, "CognitoJwtVerifier", { enumerable: true, get: function () { return cognito_verifier_js_1.CognitoJwtVerifier; } });