@googleapis/sts 4.0.0 → 4.0.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [4.0.1](https://github.com/googleapis/google-api-nodejs-client/compare/sts-v4.0.0...sts-v4.0.1) (2024-05-02)
+
+
+### Bug Fixes
+
+* **sts:** update the API ([bce176a](https://github.com/googleapis/google-api-nodejs-client/commit/bce176a17c9e5ff821d2e6a058720f9f744e18b4))
+
 ## [4.0.0](https://github.com/googleapis/google-api-nodejs-client/compare/sts-v3.3.5...sts-v4.0.0) (2024-04-04)
 
 

package/build/v1.d.ts

@@ -182,7 +182,7 @@ export declare namespace sts_v1 {
          */
         scope?: string | null;
         /**
-         * Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc. For workforce pools, this must match the client ID specified in the provider configuration. See https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers#oidc. Example header: ``` { "alg": "RS256", "kid": "us-east-11" \} ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" \} \} ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { "headers": [ {"key": "x-amz-date", "value": "20200815T015049Z"\}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"\}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/"\}, {"key": "host", "value": "sts.amazonaws.com"\} . ], "method": "POST", "url": "https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" \} ``` If the token is a SAML 2.0 assertion, it must use the format defined in [the SAML 2.0 spec](https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:saml2`. See [Verification of external credentials](https://cloud.google.com/iam/docs/using-workload-identity-federation#verification_of_external_credentials) for details on how SAML 2.0 assertions are validated during token exchanges. You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
+         * Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc. For workforce pools, this must match the client ID specified in the provider configuration. See https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers#oidc. Example header: ``` { "alg": "RS256", "kid": "us-east-11" \} ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" \} \} ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { "headers": [ {"key": "x-amz-date", "value": "20200815T015049Z"\}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"\}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/"\}, {"key": "host", "value": "sts.amazonaws.com"\} . ], "method": "POST", "url": "https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" \} ``` If the token is a SAML 2.0 assertion, it must use the format defined in [the SAML 2.0 spec](https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.pdf), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:saml2`. See [Verification of external credentials](https://cloud.google.com/iam/docs/using-workload-identity-federation#verification_of_external_credentials) for details on how SAML 2.0 assertions are validated during token exchanges. You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
          */
         subjectToken?: string | null;
         /**

package/build/v1.js

@@ -63,6 +63,7 @@ var sts_v1;
                 options: Object.assign({
                     url: (rootUrl + '/v1/token').replace(/([^:]\/)\/+/g, '$1'),
                     method: 'POST',
+                    apiVersion: '',
                 }, options),
                 params,
                 requiredParams: [],

package/build/v1.js.map

@@ -1 +1 @@
-{"version":3,"file":"v1.js","sourceRoot":"","sources":["../v1.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;AAEjC,uDAAuD;AACvD,sDAAsD;AACtD,0DAA0D;AAC1D,oDAAoD;AACpD,4CAA4C;AAE5C,yDAe2B;AAG3B,IAAiB,MAAM,CAqXtB;AArXD,WAAiB,MAAM;IAgErB;;;;;;;;;;OAUG;IACH,MAAa,GAAG;QAId,YAAY,OAAsB,EAAE,MAA2B;YAC7D,IAAI,CAAC,OAAO,GAAG;gBACb,QAAQ,EAAE,OAAO,IAAI,EAAE;gBACvB,MAAM;aACP,CAAC;YAEF,IAAI,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;KACF;IAZY,UAAG,MAYf,CAAA;IAqLD,MAAa,WAAW;QAEtB,YAAY,OAA0B;YACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QAqCD,KAAK,CACH,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAA6B,CAAC;YAClE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAA8B,CAAC;gBACxC,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,WAAW,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC1D,MAAM,EAAE,MAAM;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,IAAA,oCAAgB,EACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,IAAA,oCAAgB,EACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;KACF;IAjGY,kBAAW,cAiGvB,CAAA;AAQH,CAAC,EArXgB,MAAM,GAAN,cAAM,KAAN,cAAM,QAqXtB"}
+{"version":3,"file":"v1.js","sourceRoot":"","sources":["../v1.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;AAEjC,uDAAuD;AACvD,sDAAsD;AACtD,0DAA0D;AAC1D,oDAAoD;AACpD,4CAA4C;AAE5C,yDAe2B;AAG3B,IAAiB,MAAM,CAsXtB;AAtXD,WAAiB,MAAM;IAgErB;;;;;;;;;;OAUG;IACH,MAAa,GAAG;QAId,YAAY,OAAsB,EAAE,MAA2B;YAC7D,IAAI,CAAC,OAAO,GAAG;gBACb,QAAQ,EAAE,OAAO,IAAI,EAAE;gBACvB,MAAM;aACP,CAAC;YAEF,IAAI,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;KACF;IAZY,UAAG,MAYf,CAAA;IAqLD,MAAa,WAAW;QAEtB,YAAY,OAA0B;YACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QAqCD,KAAK,CACH,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAA6B,CAAC;YAClE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAA8B,CAAC;gBACxC,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,WAAW,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC1D,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,EAAE;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,IAAA,oCAAgB,EACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,IAAA,oCAAgB,EACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;KACF;IAlGY,kBAAW,cAkGvB,CAAA;AAQH,CAAC,EAtXgB,MAAM,GAAN,cAAM,KAAN,cAAM,QAsXtB"}

package/build/v1beta.js

@@ -63,6 +63,7 @@ var sts_v1beta;
                 options: Object.assign({
                     url: (rootUrl + '/v1beta/token').replace(/([^:]\/)\/+/g, '$1'),
                     method: 'POST',
+                    apiVersion: '',
                 }, options),
                 params,
                 requiredParams: [],

package/build/v1beta.js.map

@@ -1 +1 @@
-{"version":3,"file":"v1beta.js","sourceRoot":"","sources":["../v1beta.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;AAEjC,uDAAuD;AACvD,sDAAsD;AACtD,0DAA0D;AAC1D,oDAAoD;AACpD,4CAA4C;AAE5C,yDAe2B;AAG3B,IAAiB,UAAU,CAqX1B;AArXD,WAAiB,UAAU;IAgEzB;;;;;;;;;;OAUG;IACH,MAAa,GAAG;QAId,YAAY,OAAsB,EAAE,MAA2B;YAC7D,IAAI,CAAC,OAAO,GAAG;gBACb,QAAQ,EAAE,OAAO,IAAI,EAAE;gBACvB,MAAM;aACP,CAAC;YAEF,IAAI,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;KACF;IAZY,cAAG,MAYf,CAAA;IAqLD,MAAa,eAAe;QAE1B,YAAY,OAA0B;YACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QAqCD,KAAK,CACH,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAiC,CAAC;YACtE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAAkC,CAAC;gBAC5C,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,eAAe,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC9D,MAAM,EAAE,MAAM;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,IAAA,oCAAgB,EACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,IAAA,oCAAgB,EACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;KACF;IAjGY,0BAAe,kBAiG3B,CAAA;AAQH,CAAC,EArXgB,UAAU,GAAV,kBAAU,KAAV,kBAAU,QAqX1B"}
+{"version":3,"file":"v1beta.js","sourceRoot":"","sources":["../v1beta.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;AAEjC,uDAAuD;AACvD,sDAAsD;AACtD,0DAA0D;AAC1D,oDAAoD;AACpD,4CAA4C;AAE5C,yDAe2B;AAG3B,IAAiB,UAAU,CAsX1B;AAtXD,WAAiB,UAAU;IAgEzB;;;;;;;;;;OAUG;IACH,MAAa,GAAG;QAId,YAAY,OAAsB,EAAE,MAA2B;YAC7D,IAAI,CAAC,OAAO,GAAG;gBACb,QAAQ,EAAE,OAAO,IAAI,EAAE;gBACvB,MAAM;aACP,CAAC;YAEF,IAAI,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;KACF;IAZY,cAAG,MAYf,CAAA;IAqLD,MAAa,eAAe;QAE1B,YAAY,OAA0B;YACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QAqCD,KAAK,CACH,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAiC,CAAC;YACtE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAAkC,CAAC;gBAC5C,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,eAAe,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC9D,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,EAAE;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,IAAA,oCAAgB,EACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,IAAA,oCAAgB,EACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;KACF;IAlGY,0BAAe,kBAkG3B,CAAA;AAQH,CAAC,EAtXgB,UAAU,GAAV,kBAAU,KAAV,kBAAU,QAsX1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@googleapis/sts",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "sts",
   "main": "build/index.js",
   "types": "build/index.d.ts",

package/v1.ts

@@ -235,7 +235,7 @@ export namespace sts_v1 {
      */
     scope?: string | null;
     /**
-     * Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc. For workforce pools, this must match the client ID specified in the provider configuration. See https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers#oidc. Example header: ``` { "alg": "RS256", "kid": "us-east-11" \} ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" \} \} ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { "headers": [ {"key": "x-amz-date", "value": "20200815T015049Z"\}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"\}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/"\}, {"key": "host", "value": "sts.amazonaws.com"\} . ], "method": "POST", "url": "https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" \} ``` If the token is a SAML 2.0 assertion, it must use the format defined in [the SAML 2.0 spec](https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:saml2`. See [Verification of external credentials](https://cloud.google.com/iam/docs/using-workload-identity-federation#verification_of_external_credentials) for details on how SAML 2.0 assertions are validated during token exchanges. You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
+     * Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc. For workforce pools, this must match the client ID specified in the provider configuration. See https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers#oidc. Example header: ``` { "alg": "RS256", "kid": "us-east-11" \} ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" \} \} ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { "headers": [ {"key": "x-amz-date", "value": "20200815T015049Z"\}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"\}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/"\}, {"key": "host", "value": "sts.amazonaws.com"\} . ], "method": "POST", "url": "https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" \} ``` If the token is a SAML 2.0 assertion, it must use the format defined in [the SAML 2.0 spec](https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.pdf), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:saml2`. See [Verification of external credentials](https://cloud.google.com/iam/docs/using-workload-identity-federation#verification_of_external_credentials) for details on how SAML 2.0 assertions are validated during token exchanges. You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
      */
     subjectToken?: string | null;
     /**
@@ -381,6 +381,7 @@ export namespace sts_v1 {
           {
             url: (rootUrl + '/v1/token').replace(/([^:]\/)\/+/g, '$1'),
             method: 'POST',
+            apiVersion: '',
           },
           options
         ),

package/v1beta.ts

@@ -381,6 +381,7 @@ export namespace sts_v1beta {
           {
             url: (rootUrl + '/v1beta/token').replace(/([^:]\/)\/+/g, '$1'),
             method: 'POST',
+            apiVersion: '',
           },
           options
         ),