@hahnpro/hpc-api 5.2.8 → 5.3.0

package/dist/api.d.ts

@@ -35,5 +35,7 @@ export declare class API {
     users: UserService;
     vault: VaultService;
     notifications: NotificationService;
-    constructor(httpClient?: HttpClient);
+    constructor(httpClient?: HttpClient, context?: {
+        tokenSubject?: string;
+    });
 }

package/dist/api.js

@@ -20,7 +20,7 @@ const label_service_1 = require("./label.service");
 const vault_service_1 = require("./vault.service");
 const notification_service_1 = require("./notification.service");
 class API {
-    constructor(httpClient) {
+    constructor(httpClient, context) {
         this.httpClient = httpClient;
         if (!httpClient) {
             const normalizePath = (value = '', defaultValue = '') => value.replace(/(?:^\/+)|(?:\/+$)/g, '') || defaultValue;
@@ -38,7 +38,7 @@ class API {
             if (!secret) {
                 throw new Error('"API_BASE_URL", "API_USER", "AUTH_REALM" and "AUTH_SECRET" environment variables must be set');
             }
-            this.httpClient = new http_service_1.HttpClient(apiUrl, authUrl, realm, client, secret);
+            this.httpClient = new http_service_1.HttpClient(apiUrl, authUrl, realm, client, secret, context === null || context === void 0 ? void 0 : context.tokenSubject);
         }
         this.assets = new asset_service_1.AssetService(this.httpClient);
         this.assetTypes = new assettypes_service_1.AssetTypesService(this.httpClient);

package/dist/http.service.d.ts

@@ -1,22 +1,25 @@
 import { AxiosInstance, AxiosRequestConfig, Method } from 'axios';
 import EventSource from 'eventsource';
 import { Queue } from './Queue';
+import { TokenSet } from './token-set';
 export declare class HttpClient {
     protected readonly baseURL: string;
     protected readonly authBaseURL: string;
     protected readonly realm: string;
     protected readonly clientId: string;
     protected readonly clientSecret: string;
+    protected readonly tokenSubject?: string;
     protected readonly axiosInstance: AxiosInstance;
     protected readonly authAxiosInstance: AxiosInstance;
     protected readonly requestQueue: Queue;
     private tokenSet;
+    private exchangedTokenSet;
     eventSourcesMap: Map<string, {
         eventSource: EventSource;
         listener: (event: MessageEvent) => void;
         errListener: (event: MessageEvent) => void;
     }>;
-    constructor(baseURL: string, authBaseURL: string, realm: string, clientId: string, clientSecret: string);
+    constructor(baseURL: string, authBaseURL: string, realm: string, clientId: string, clientSecret: string, tokenSubject?: string);
     getQueueStats: () => {
         peak: number;
         pending: number;
@@ -34,7 +37,8 @@ export declare class HttpClient {
     getAccessToken: (forceRefresh?: boolean) => Promise<string>;
     protected validateIssuer(issuer: Issuer): Issuer;
     protected discoverIssuer(uri: string): Promise<Issuer>;
-    protected requestAccessToken(): Promise<string>;
+    protected requestAccessToken(additionalOpts?: {}): Promise<TokenSet>;
+    protected exchangeAccessToken(accessToken: string): Promise<TokenSet>;
 }
 interface Issuer {
     issuer: string;

package/dist/http.service.js

@@ -10,12 +10,13 @@ const uuid_1 = require("uuid");
 const Queue_1 = require("./Queue");
 const token_set_1 = require("./token-set");
 class HttpClient {
-    constructor(baseURL, authBaseURL, realm, clientId, clientSecret) {
+    constructor(baseURL, authBaseURL, realm, clientId, clientSecret, tokenSubject) {
         this.baseURL = baseURL;
         this.authBaseURL = authBaseURL;
         this.realm = realm;
         this.clientId = clientId;
         this.clientSecret = clientSecret;
+        this.tokenSubject = tokenSubject;
         this.eventSourcesMap = new Map();
         this.getQueueStats = () => { var _a; return (_a = this.requestQueue) === null || _a === void 0 ? void 0 : _a.getStats(); };
         this.delete = (url, config) => this.request('DELETE', url, config);
@@ -34,10 +35,23 @@ class HttpClient {
             }));
         };
         this.getAccessToken = (...args_1) => tslib_1.__awaiter(this, [...args_1], void 0, function* (forceRefresh = false) {
+            let accessToken;
             if (forceRefresh || !this.tokenSet || this.tokenSet.isExpired()) {
-                return this.requestAccessToken();
+                this.tokenSet = yield this.requestAccessToken();
+                accessToken = this.tokenSet.accessToken;
+            }
+            else {
+                accessToken = this.tokenSet.accessToken;
+            }
+            if (this.tokenSubject) {
+                if (forceRefresh || !this.exchangedTokenSet || this.exchangedTokenSet.isExpired()) {
+                    this.exchangedTokenSet = yield this.exchangeAccessToken(accessToken);
+                }
+                return this.exchangedTokenSet.accessToken;
+            }
+            else {
+                return accessToken;
             }
-            return this.tokenSet.accessToken;
         });
         this.axiosInstance = axios_1.default.create({ baseURL, timeout: 60000 });
         this.authAxiosInstance = axios_1.default.create({ baseURL: authBaseURL || baseURL, timeout: 10000 });
@@ -95,7 +109,7 @@ class HttpClient {
         });
     }
     requestAccessToken() {
-        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (additionalOpts = {}) {
             var _a, _b;
             const issuer = yield this.discoverIssuer(`${this.authBaseURL}/realms/${this.realm}`);
             const timestamp = Date.now() / 1000;
@@ -116,23 +130,32 @@ class HttpClient {
             const assertion = yield new jose_1.CompactSign(Buffer.from(JSON.stringify(assertionPayload)))
                 .setProtectedHeader({ alg })
                 .sign(new TextEncoder().encode(this.clientSecret));
-            const opts = {
-                client_id: this.clientId,
-                client_assertion: assertion,
-                client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
-                grant_type: 'client_credentials',
-            };
+            const opts = Object.assign({ client_id: this.clientId, client_assertion: assertion, client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer', grant_type: 'client_credentials' }, additionalOpts);
             const authResponse = yield this.authAxiosInstance.post(issuer.token_endpoint, (0, querystring_1.stringify)(opts), {
                 headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },
             });
             if (((_b = authResponse === null || authResponse === void 0 ? void 0 : authResponse.data) === null || _b === void 0 ? void 0 : _b.access_token) && authResponse.data.expires_in) {
-                this.tokenSet = new token_set_1.TokenSet(authResponse.data.access_token, authResponse.data.expires_in);
-                return authResponse.data.access_token;
+                return new token_set_1.TokenSet(authResponse.data.access_token, authResponse.data.expires_in);
             }
             else {
                 throw new Error('Invalid access token received');
             }
         });
     }
+    exchangeAccessToken(accessToken) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!accessToken || !this.tokenSubject) {
+                throw new Error('Could not exchange access token');
+            }
+            const opts = {
+                grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+                subject_token: accessToken,
+                audience: this.clientId,
+                requested_token_type: 'urn:ietf:params:oauth:token-type:access_token',
+                requested_subject: this.tokenSubject,
+            };
+            return this.requestAccessToken(opts);
+        });
+    }
 }
 exports.HttpClient = HttpClient;

package/dist/resource.interface.d.ts

@@ -5,6 +5,7 @@ export interface ResourceReference {
 }
 export interface Resource {
     id: string;
+    owner?: Owner;
     name: string;
     readPermissions: string[];
     readWritePermissions: string[];
@@ -16,4 +17,16 @@ export interface Resource {
     updatedAt?: string | Date;
     deletedAt?: string | Date;
     revision?: string;
+    createdBy?: Author;
+    updatedBy?: Author;
+}
+export interface Author {
+    id: string;
+    username: string;
+    impersonatorId?: string;
+    impersonatorUsername?: string;
+}
+export interface Owner {
+    id: string;
+    type: 'org' | 'user';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hahnpro/hpc-api",
-  "version": "5.2.8",
+  "version": "5.3.0",
   "description": "Module for easy access to the HahnPRO API",
   "license": "MIT",
   "author": {
@@ -27,7 +27,7 @@
     "axios": "1.7.4",
     "eventsource": "2.0.2",
     "form-data": "4.0.0",
-    "jose": "5.6.3",
+    "jose": "5.7.0",
     "jwt-decode": "4.0.0",
     "p-queue": "6.6.2",
     "ts-mixer": "6.0.4",