@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/assert.js

@@ -0,0 +1,101 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utilities to assert that supplied values match with expected values
+import { FailedAssertionError } from "./error.js";
+/**
+ * Assert value is a non-empty string and equal to the expected value,
+ * or throw an error otherwise
+ *
+ * @param name - Name for the value being checked
+ * @param actual - The value to check
+ * @param expected - The expected value
+ * @param errorConstructor - Constructor for the concrete error to be thrown
+ */
+export function assertStringEquals(name, actual, expected, errorConstructor = FailedAssertionError) {
+    if (!actual) {
+        throw new errorConstructor(`Missing ${name}. Expected: ${expected}`, actual, expected);
+    }
+    if (typeof actual !== "string") {
+        throw new errorConstructor(`${name} is not of type string`, actual, expected);
+    }
+    if (expected !== actual) {
+        throw new errorConstructor(`${name} not allowed: ${actual}. Expected: ${expected}`, actual, expected);
+    }
+}
+/**
+ * Assert value is a non-empty string and is indeed one of the expected values,
+ * or throw an error otherwise
+ *
+ * @param name - Name for the value being checked
+ * @param actual - The value to check
+ * @param expected - The array of expected values. For your convenience you can provide
+ * @param errorConstructor - Constructor for the concrete error to be thrown
+ * a string here as well, which will mean an array with just that string
+ */
+export function assertStringArrayContainsString(name, actual, expected, errorConstructor = FailedAssertionError) {
+    if (!actual) {
+        throw new errorConstructor(`Missing ${name}. ${expectationMessage(expected)}`, actual, expected);
+    }
+    if (typeof actual !== "string") {
+        throw new errorConstructor(`${name} is not of type string`, actual, expected);
+    }
+    return assertStringArraysOverlap(name, actual, expected, errorConstructor);
+}
+/**
+ * Assert value is an array of strings, where at least one of the strings is indeed one of the expected values,
+ * or throw an error otherwise
+ *
+ * @param name - Name for the value being checked
+ * @param actual - The value to check, must be an array of strings, or a single string (which will be treated
+ * as an array with just that string)
+ * @param expected - The array of expected values. For your convenience you can provide
+ * a string here as well, which will mean an array with just that string
+ * @param errorConstructor - Constructor for the concrete error to be thrown
+ */
+export function assertStringArraysOverlap(name, actual, expected, errorConstructor = FailedAssertionError) {
+    if (!actual) {
+        throw new errorConstructor(`Missing ${name}. ${expectationMessage(expected)}`, actual, expected);
+    }
+    const expectedAsSet = new Set(Array.isArray(expected) ? expected : [expected]);
+    if (typeof actual === "string") {
+        actual = [actual];
+    }
+    if (!Array.isArray(actual)) {
+        throw new errorConstructor(`${name} is not an array`, actual, expected);
+    }
+    const overlaps = actual.some((actualItem) => {
+        if (typeof actualItem !== "string") {
+            throw new errorConstructor(`${name} includes elements that are not of type string`, actual, expected);
+        }
+        return expectedAsSet.has(actualItem);
+    });
+    if (!overlaps) {
+        throw new errorConstructor(`${name} not allowed: ${actual.join(", ")}. ${expectationMessage(expected)}`, actual, expected);
+    }
+}
+/**
+ * Get a nicely readable message regarding an expectation
+ *
+ * @param expected - The expected value.
+ */
+function expectationMessage(expected) {
+    if (Array.isArray(expected)) {
+        if (expected.length > 1) {
+            return `Expected one of: ${expected.join(", ")}`;
+        }
+        return `Expected: ${expected[0]}`;
+    }
+    return `Expected: ${expected}`;
+}
+/**
+ * Assert value is not a promise, or throw an error otherwise
+ *
+ * @param actual - The value to check
+ * @param errorFactory - Function that returns the error to be thrown
+ */
+export function assertIsNotPromise(actual, errorFactory) {
+    if (actual && typeof actual.then === "function") {
+        throw errorFactory();
+    }
+}

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/cognito-verifier.js

@@ -0,0 +1,153 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { CognitoJwtInvalidClientIdError, CognitoJwtInvalidGroupError, CognitoJwtInvalidTokenUseError, JwtInvalidClaimError, ParameterValidationError, } from "./error.js";
+import { JwtRsaVerifierBase } from "./jwt-rsa.js";
+import { assertStringArrayContainsString, assertStringEquals, assertStringArraysOverlap, } from "./assert.js";
+/**
+ * Validate claims of a decoded Cognito JWT.
+ * This function throws an error in case there's any validation issue.
+ *
+ * @param payload - The JSON parsed payload of the Cognito JWT
+ * @param options - Validation options
+ * @param options.groups - The cognito groups, of which at least one must be present in the JWT's cognito:groups claim
+ * @param options.tokenUse - The required token use of the JWT: "id" or "access"
+ * @param options.clientId - The required clientId of the JWT. May be an array of string, of which at least one must match
+ * @returns void
+ */
+export function validateCognitoJwtFields(payload, options) {
+    // Check groups
+    if (options.groups != null) {
+        assertStringArraysOverlap("Cognito group", payload["cognito:groups"], options.groups, CognitoJwtInvalidGroupError);
+    }
+    // Check token use
+    assertStringArrayContainsString("Token use", payload.token_use, ["id", "access"], CognitoJwtInvalidTokenUseError);
+    if (options.tokenUse !== null) {
+        if (options.tokenUse === undefined) {
+            throw new ParameterValidationError("tokenUse must be provided or set to null explicitly");
+        }
+        assertStringEquals("Token use", payload.token_use, options.tokenUse, CognitoJwtInvalidTokenUseError);
+    }
+    // Check clientId aka audience
+    if (options.clientId !== null) {
+        if (options.clientId === undefined) {
+            throw new ParameterValidationError("clientId must be provided or set to null explicitly");
+        }
+        if (payload.token_use === "id") {
+            assertStringArrayContainsString('Client ID ("audience")', payload.aud, options.clientId, CognitoJwtInvalidClientIdError);
+        }
+        else {
+            assertStringArrayContainsString("Client ID", payload.client_id, options.clientId, CognitoJwtInvalidClientIdError);
+        }
+    }
+}
+/**
+ * Class representing a verifier for JWTs signed by Amazon Cognito
+ */
+export class CognitoJwtVerifier extends JwtRsaVerifierBase {
+    constructor(props, jwksCache) {
+        const issuerConfig = Array.isArray(props)
+            ? props.map((p) => ({
+                ...p,
+                ...CognitoJwtVerifier.parseUserPoolId(p.userPoolId),
+                audience: null, // checked instead by validateCognitoJwtFields
+            }))
+            : {
+                ...props,
+                ...CognitoJwtVerifier.parseUserPoolId(props.userPoolId),
+                audience: null, // checked instead by validateCognitoJwtFields
+            };
+        super(issuerConfig, jwksCache);
+    }
+    /**
+     * Parse a User Pool ID, to extract the issuer and JWKS URI
+     *
+     * @param userPoolId The User Pool ID
+     * @returns The issuer and JWKS URI for the User Pool
+     */
+    static parseUserPoolId(userPoolId) {
+        // Disable safe regexp check as userPoolId is provided by developer, i.e. is not user input
+        // eslint-disable-next-line security/detect-unsafe-regex
+        const match = userPoolId.match(/^(?<region>(\w+-)?\w+-\w+-\d)+_\w+$/);
+        if (!match) {
+            throw new ParameterValidationError(`Invalid Cognito User Pool ID: ${userPoolId}`);
+        }
+        const region = match.groups.region;
+        const issuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
+        return {
+            issuer,
+            jwksUri: `${issuer}/.well-known/jwks.json`,
+        };
+    }
+    // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
+    static create(verifyProperties, additionalProperties) {
+        return new this(verifyProperties, additionalProperties?.jwksCache);
+    }
+    /**
+     * Verify (synchronously) a JWT that is signed by Amazon Cognito.
+     *
+     * @param jwt The JWT, as string
+     * @param props Verification properties
+     * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+     */
+    verifySync(...[jwt, properties]) {
+        const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
+        this.verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties);
+        try {
+            validateCognitoJwtFields(decomposedJwt.payload, verifyProperties);
+        }
+        catch (err) {
+            if (verifyProperties.includeRawJwtInErrors &&
+                err instanceof JwtInvalidClaimError) {
+                throw err.withRawJwt(decomposedJwt);
+            }
+            throw err;
+        }
+        return decomposedJwt.payload;
+    }
+    /**
+     * Verify (asynchronously) a JWT that is signed by Amazon Cognito.
+     * This call is asynchronous, and the JWKS will be fetched from the JWKS uri,
+     * in case it is not yet available in the cache.
+     *
+     * @param jwt The JWT, as string
+     * @param props Verification properties
+     * @returns Promise that resolves to the payload of the JWT––if the JWT is valid, otherwise the promise rejects
+     */
+    async verify(...[jwt, properties]) {
+        const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
+        await this.verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties);
+        try {
+            validateCognitoJwtFields(decomposedJwt.payload, verifyProperties);
+        }
+        catch (err) {
+            if (verifyProperties.includeRawJwtInErrors &&
+                err instanceof JwtInvalidClaimError) {
+                throw err.withRawJwt(decomposedJwt);
+            }
+            throw err;
+        }
+        return decomposedJwt.payload;
+    }
+    /**
+     * This method loads a JWKS that you provide, into the JWKS cache, so that it is
+     * available for JWT verification. Use this method to speed up the first JWT verification
+     * (when the JWKS would otherwise have to be downloaded from the JWKS uri), or to provide the JWKS
+     * in case the JwtVerifier does not have internet access to download the JWKS
+     *
+     * @param jwks The JWKS
+     * @param userPoolId The userPoolId for which you want to cache the JWKS
+     *  Supply this field, if you instantiated the CognitoJwtVerifier with multiple userPoolIds
+     * @returns void
+     */
+    cacheJwks(...[jwks, userPoolId]) {
+        let issuer;
+        if (userPoolId !== undefined) {
+            issuer = CognitoJwtVerifier.parseUserPoolId(userPoolId).issuer;
+        }
+        else if (this.expectedIssuers.length > 1) {
+            throw new ParameterValidationError("userPoolId must be provided");
+        }
+        const issuerConfig = this.getIssuerConfig(issuer);
+        super.cacheJwks(jwks, issuerConfig.issuer);
+    }
+}

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/error.js

@@ -0,0 +1,101 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Base Error for all other errors in this file
+ */
+export class JwtBaseError extends Error {
+}
+/**
+ * An error that is raised because an actual value does not match with the expected value
+ */
+export class FailedAssertionError extends JwtBaseError {
+    constructor(msg, actual, expected) {
+        super(msg);
+        this.failedAssertion = {
+            actual,
+            expected,
+        };
+    }
+}
+/**
+ * JWT errors
+ */
+export class JwtParseError extends JwtBaseError {
+    constructor(msg, error) {
+        const message = error != null ? `${msg}: ${error}` : msg;
+        super(message);
+    }
+}
+export class ParameterValidationError extends JwtBaseError {
+}
+export class JwtInvalidSignatureError extends JwtBaseError {
+}
+export class JwtInvalidSignatureAlgorithmError extends FailedAssertionError {
+}
+export class JwtInvalidClaimError extends FailedAssertionError {
+    withRawJwt({ header, payload }) {
+        this.rawJwt = {
+            header,
+            payload,
+        };
+        return this;
+    }
+}
+export class JwtInvalidIssuerError extends JwtInvalidClaimError {
+}
+export class JwtInvalidAudienceError extends JwtInvalidClaimError {
+}
+export class JwtInvalidScopeError extends JwtInvalidClaimError {
+}
+export class JwtExpiredError extends JwtInvalidClaimError {
+}
+export class JwtNotBeforeError extends JwtInvalidClaimError {
+}
+/**
+ * Amazon Cognito specific erros
+ */
+export class CognitoJwtInvalidGroupError extends JwtInvalidClaimError {
+}
+export class CognitoJwtInvalidTokenUseError extends JwtInvalidClaimError {
+}
+export class CognitoJwtInvalidClientIdError extends JwtInvalidClaimError {
+}
+/**
+ * ASN.1 errors
+ */
+export class Asn1DecodingError extends JwtBaseError {
+}
+/**
+ * JWK errors
+ */
+export class JwksValidationError extends JwtBaseError {
+}
+export class JwkValidationError extends JwtBaseError {
+}
+export class JwtWithoutValidKidError extends JwtBaseError {
+}
+export class KidNotFoundInJwksError extends JwtBaseError {
+}
+export class WaitPeriodNotYetEndedJwkError extends JwtBaseError {
+}
+export class JwksNotAvailableInCacheError extends JwtBaseError {
+}
+export class JwkInvalidUseError extends FailedAssertionError {
+}
+export class JwkInvalidKtyError extends FailedAssertionError {
+}
+/**
+ * HTTPS fetch errors
+ */
+export class FetchError extends JwtBaseError {
+    constructor(uri, msg) {
+        super(`Failed to fetch ${uri}: ${msg}`);
+    }
+}
+export class NonRetryableFetchError extends FetchError {
+}
+/**
+ * Web compatibility errors
+ */
+export class NotSupportedError extends JwtBaseError {
+}

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/https-common.js

@@ -0,0 +1,25 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Lower-level HTTPS functionalities, common for Node.js and Web
+import { FetchError, NonRetryableFetchError } from "./error.js";
+/**
+ * Sanity check a HTTPS response where we expect to get JSON data back
+ *
+ * @param uri the uri that was being requested
+ * @param statusCode the HTTP status code, should be 200
+ * @param contentType the value of the "Content-Type" header in the response, should start with "application/json"
+ * @returns void - throws an error if the status code or content type aren't as expected
+ */
+export function validateHttpsJsonResponse(uri, statusCode, contentType) {
+    if (statusCode === 429) {
+        throw new FetchError(uri, "Too many requests");
+    }
+    else if (statusCode !== 200) {
+        throw new NonRetryableFetchError(uri, `Status code is ${statusCode}, expected 200`);
+    }
+    if (!contentType ||
+        !contentType.toLowerCase().startsWith("application/json")) {
+        throw new NonRetryableFetchError(uri, `Content-type is "${contentType}", expected "application/json"`);
+    }
+}

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/https-node.js

@@ -0,0 +1,85 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// NodeJS implementation for fetching JSON documents over HTTPS
+import { request } from "https";
+import { validateHttpsJsonResponse } from "./https-common.js";
+import { pipeline } from "stream";
+import { TextDecoder } from "util";
+import { safeJsonParse } from "./safe-json-parse.js";
+import { FetchError, NonRetryableFetchError } from "./error.js";
+/**
+ * Execute a HTTPS request
+ * @param uri - The URI
+ * @param requestOptions - The RequestOptions to use
+ * @param data - Data to send to the URI (e.g. POST data)
+ * @returns - The response as parsed JSON
+ */
+export async function fetchJson(uri, requestOptions, data) {
+    let responseTimeout;
+    return new Promise((resolve, reject) => {
+        const req = request(uri, {
+            method: "GET",
+            ...requestOptions,
+        }, (response) => {
+            // Capture response data
+            // @types/node is incomplete so cast to any
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            pipeline([
+                response,
+                getJsonDestination(uri, response.statusCode, response.headers),
+            ], done);
+        });
+        if (requestOptions?.responseTimeout) {
+            responseTimeout = setTimeout(() => done(new FetchError(uri, `Response time-out (after ${requestOptions.responseTimeout} ms.)`)), requestOptions.responseTimeout);
+            responseTimeout.unref(); // Don't block Node from exiting
+        }
+        function done(...args) {
+            if (responseTimeout)
+                clearTimeout(responseTimeout);
+            if (args[0] == null) {
+                resolve(args[1]);
+                return;
+            }
+            // In case of errors, let the Agent (if any) know to abandon the socket
+            // This is probably best, because the socket may have become stale
+            /* istanbul ignore next */
+            req.socket?.emit("agentRemove");
+            // Turn error into FetchError so the URI is nicely captured in the message
+            let error = args[0];
+            if (!(error instanceof FetchError)) {
+                error = new FetchError(uri, error.message);
+            }
+            req.destroy();
+            reject(error);
+        }
+        // Handle errors while sending request
+        req.on("error", done);
+        // Signal end of request (include optional data)
+        req.end(data);
+    });
+}
+/**
+ * Ensures the HTTPS response contains valid JSON
+ *
+ * @param uri - The URI you were requesting
+ * @param statusCode - The response status code to your HTTPS request
+ * @param headers - The response headers to your HTTPS request
+ *
+ * @returns - Async function that can be used as destination in a stream.pipeline, it will return the JSON, if valid, or throw an error otherwise
+ */
+function getJsonDestination(uri, statusCode, headers) {
+    return async (responseIterable) => {
+        validateHttpsJsonResponse(uri, statusCode, headers["content-type"]);
+        const collected = [];
+        for await (const chunk of responseIterable) {
+            collected.push(chunk);
+        }
+        try {
+            return safeJsonParse(new TextDecoder("utf8", { fatal: true, ignoreBOM: true }).decode(Buffer.concat(collected)));
+        }
+        catch (err) {
+            throw new NonRetryableFetchError(uri, err);
+        }
+    };
+}

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/https.js

@@ -0,0 +1,48 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utilities for fetching the JWKS URI, to get the public keys with which to verify JWTs
+import { NonRetryableFetchError } from "./error.js";
+import { nodeWebCompat } from "#node-web-compat";
+/**
+ * Execute a HTTPS request
+ * @param uri - The URI
+ * @param requestOptions - The RequestOptions to use (depending on the runtime context, either Node.js RequestOptions or Web Fetch init)
+ * @param data - Data to send to the URI (e.g. POST data)
+ * @returns - The response as parsed JSON
+ */
+export const fetchJson = nodeWebCompat.fetchJson;
+/**
+ * HTTPS Fetcher for URIs with JSON body
+ *
+ * @param defaultRequestOptions - The default RequestOptions to use on individual HTTPS requests
+ */
+export class SimpleJsonFetcher {
+    constructor(props) {
+        this.defaultRequestOptions = {
+            timeout: nodeWebCompat.defaultFetchTimeouts.socketIdle,
+            responseTimeout: nodeWebCompat.defaultFetchTimeouts.response,
+            ...props?.defaultRequestOptions,
+        };
+    }
+    /**
+     * Execute a HTTPS request (with 1 immediate retry in case of errors)
+     * @param uri - The URI
+     * @param requestOptions - The RequestOptions to use
+     * @param data - Data to send to the URI (e.g. POST data)
+     * @returns - The response as parsed JSON
+     */
+    async fetch(uri, requestOptions, data) {
+        requestOptions = { ...this.defaultRequestOptions, ...requestOptions };
+        try {
+            return await fetchJson(uri, requestOptions, data);
+        }
+        catch (err) {
+            if (err instanceof NonRetryableFetchError) {
+                throw err;
+            }
+            // Retry once, immediately
+            return fetchJson(uri, requestOptions, data);
+        }
+    }
+}

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/index.js

@@ -0,0 +1,4 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+export { JwtRsaVerifier } from "./jwt-rsa.js";
+export { CognitoJwtVerifier } from "./cognito-verifier.js";