@itentialopensource/adapter-kafkav2 1.0.5 → 1.0.7

package/CHANGELOG.md

@@ -1,4 +1,20 @@
 
+## 1.0.7 [07-17-2026]
+
+* Add SASL OAUTHBEARER support
+
+See merge request itentialopensource/adapters/adapter-kafkav2!80
+
+---
+
+## 1.0.6 [07-13-2026]
+
+* Upgrade kafka-lz4-lite
+
+See merge request itentialopensource/adapters/adapter-kafkav2!82
+
+---
+
 ## 1.0.5 [07-01-2026]
 
 * Changes made at 2026.07.01_14:21PM

package/adapter.js

@@ -29,6 +29,152 @@ const DEFAULT_SOCKET_TIMEOUT = 30000; // 30s
 
 const axios = require('axios');
 
+/**
+ * Builds an oauthBearerProvider function for KafkaJS using the OAuth 2.0
+ * client_credentials grant. Called by resolveSaslConfig when mechanism is 'oauthbearer'.
+ *
+ * Token lifecycle:
+ *  - Caches the access token and only fetches a new one when within REFRESH_BUFFER_MS
+ *    of expiry, avoiding unnecessary round-trips on every KafkaJS (re)authentication.
+ *  - If the token endpoint returns a refresh_token, it is stored and used on subsequent
+ *    refreshes via grant_type=refresh_token. This avoids re-sending client credentials on every cycle.
+ *  - If the refresh_token grant fails (token expired, rotated, or revoked) the stored
+ *    refresh_token is cleared and the provider automatically falls back to a fresh
+ *    client_credentials grant, so the adapter self-heals without operator intervention.
+ *
+ * @param {object} oauthConfig - The sasl.oauth config block from adapter properties.
+ * @param {string} oauthConfig.tokenEndpoint - Token endpoint URL.
+ * @param {string} oauthConfig.clientId - OAuth client ID.
+ * @param {string} oauthConfig.clientSecret - OAuth client secret.
+ * @param {string} [oauthConfig.scope] - Optional OAuth scope.
+ * @param {number} [oauthConfig.tokenRefreshBuffer=30000] - Milliseconds before token expiry
+ *   to proactively refresh. Defaults to 30000 (30s).
+ * @returns {Function} Async provider function returning { value }.
+ */
+function buildOAuthBearerProvider(oauthConfig) {
+  const {
+    tokenEndpoint, clientId, clientSecret, scope, tokenRefreshBuffer
+  } = oauthConfig;
+
+  const REFRESH_BUFFER_MS = Number.isInteger(tokenRefreshBuffer) && tokenRefreshBuffer > 0
+    ? tokenRefreshBuffer
+    : 30000;
+  let cachedToken = null;
+  let tokenExpiresAt = 0;
+  let storedRefreshToken = null;
+  // Single in-flight refresh promise (promise coalescing / single-flight pattern).
+  // Concurrent callers that arrive while a refresh is in-flight await this same
+  // promise instead of each issuing their own HTTP request to the token endpoint.
+  let refreshPromise = null;
+
+  /**
+   * POSTs to the token endpoint and returns response data.
+   * Validates that access_token is present, stores any issued refresh_token.
+   */
+  async function postToTokenEndpoint(params) {
+    const grantType = params.get('grant_type');
+    log.debug(`Kafka OAuth: requesting token via grant_type=${grantType}`);
+    const response = await axios.post(tokenEndpoint, params.toString(), {
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
+    });
+    const { data } = response;
+    if (!data || !data.access_token) {
+      throw new Error(`Kafka adapter: token endpoint returned an invalid response: ${JSON.stringify(data)}`);
+    }
+    if (data.refresh_token) {
+      log.debug('Kafka OAuth: refresh_token received and stored');
+      storedRefreshToken = data.refresh_token;
+    }
+    return data;
+  }
+
+  /**
+   * Fetches a new token from the token endpoint. Tries grant_type=refresh_token first
+   * if a refresh token is available, falling back to client_credentials on failure.
+   */
+  async function fetchToken() {
+    if (storedRefreshToken) {
+      try {
+        const data = await postToTokenEndpoint(new URLSearchParams({
+          grant_type: 'refresh_token',
+          refresh_token: storedRefreshToken,
+          client_id: clientId,
+          client_secret: clientSecret
+        }));
+        return data;
+      } catch (_refreshErr) {
+        log.warn(`Kafka adapter: refresh_token grant failed, falling back to client_credentials. Reason: ${_refreshErr.message}`);
+        storedRefreshToken = null;
+      }
+    }
+
+    const data = await postToTokenEndpoint(new URLSearchParams({
+      grant_type: 'client_credentials',
+      client_id: clientId,
+      client_secret: clientSecret,
+      ...(scope ? { scope } : {})
+    }));
+    return data;
+  }
+
+  function hasValidCachedToken() {
+    return cachedToken !== null && Date.now() < tokenExpiresAt - REFRESH_BUFFER_MS;
+  }
+
+  return async () => {
+    if (hasValidCachedToken()) {
+      log.debug('Kafka OAuth: returning cached token');
+      return cachedToken;
+    }
+
+    if (!refreshPromise) {
+      refreshPromise = (async () => {
+        try {
+          // eslint-disable-next-line camelcase
+          const { access_token: accessToken, expires_in: expiresIn } = await fetchToken();
+
+          cachedToken = { value: accessToken };
+
+          tokenExpiresAt = Date.now() + (expiresIn ?? 3600) * 1000;
+          log.info(`Kafka OAuth: new token cached, expires in ${expiresIn ?? 3600}s`);
+          return cachedToken;
+        } finally {
+          refreshPromise = null;
+        }
+      })();
+    }
+
+    return refreshPromise;
+  };
+}
+
+/**
+ * Resolves a SASL config object for KafkaJS. For non-oauthbearer mechanisms the
+ * config is returned unchanged. For oauthbearer it builds the oauthBearerProvider
+ * function from the sasl.oauth sub-object.
+ *
+ * @param {object|null} saslConfig - SASL config from adapter properties.
+ * @returns {object|null} KafkaJS-compatible SASL config.
+ */
+function resolveSaslConfig(saslConfig) {
+  if (!saslConfig) return saslConfig;
+
+  const mechanism = (saslConfig.mechanism || '').toLowerCase();
+  if (mechanism !== 'oauthbearer') return saslConfig;
+
+  if (!saslConfig.oauth) {
+    throw new Error(
+      'Kafka adapter: SASL mechanism is "oauthbearer" but sasl.oauth config is missing. '
+      + 'Provide tokenEndpoint, clientId, and clientSecret under sasl.oauth.'
+    );
+  }
+
+  return {
+    mechanism: 'oauthbearer',
+    oauthBearerProvider: buildOAuthBearerProvider(saslConfig.oauth)
+  };
+}
+
 let needRestart = false;
 
 function consoleLoggerProvider(name) {
@@ -733,10 +879,13 @@ class Kafkav2 extends AdapterBaseCl {
         if (this.props.client.ssl && this.props.client.ssl.key) {
           combinedProps.ssl.key = fs.readFileSync(this.props.client.ssl.key, 'utf-8');
         }
+        if (combinedProps.sasl) {
+          combinedProps.sasl = resolveSaslConfig(combinedProps.sasl);
+        }
         this.KafkaClient = new Kafka(combinedProps);
 
         if (this.props.client && this.props.client.producersasl) {
-          combinedProps.sasl = this.props.client.producersasl;
+          combinedProps.sasl = resolveSaslConfig(this.props.client.producersasl);
           this.KafkaProducerClient = new Kafka(combinedProps);
           this.producer = this.KafkaProducerClient.producer(this.props.producer || {});
         } else {
@@ -750,7 +899,7 @@ class Kafkav2 extends AdapterBaseCl {
         }
 
         if (this.props.client && this.props.client.consumersasl) {
-          combinedProps.sasl = this.props.client.consumersasl;
+          combinedProps.sasl = resolveSaslConfig(this.props.client.consumersasl);
           this.KafkaConsumerClient = new Kafka(combinedProps);
           this.consumer = this.KafkaConsumerClient.consumer(consumerConfig);
         } else {
@@ -1029,7 +1178,7 @@ class Kafkav2 extends AdapterBaseCl {
         });
       } catch (ex) {
         const errorObj = formatErrorObject(origin, 'Caught Exception', null, null, null, ex);
-        log.error(JSON.stringify(ex));
+        log.error(ex instanceof Error ? ex.message : JSON.stringify(ex));
         log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
         return (null, errorObj);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itentialopensource/adapter-kafkav2",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Itential adapter to connect to kafka",
   "main": "adapter.js",
   "scripts": {
@@ -44,11 +44,11 @@
     "fs-extra": "11.3.6",
     "json-query": "2.2.2",
     "kafkajs": "2.2.4",
-    "kafka-lz4-lite": "1.0.5",
+    "kafka-lz4-lite": "2.0.1",
     "kafkajs-snappy": "1.1.0",
     "mongodb": "4.17.2",
     "readline-sync": "1.4.10",
-    "uuid": "3.0.1",
+    "uuid": "11.1.1",
     "mocha": "12.0.0-rc.1",
     "winston": "3.17.0"
   },

package/propertiesSchema.json

@@ -80,7 +80,38 @@
           "type": "object"
         },
         "sasl": {
-          "type": "object"
+          "type": "object",
+          "description": "SASL authentication. Supports plain, scram-sha-256, scram-sha-512, and oauthbearer. For oauthbearer, omit username/password and provide an 'oauth' sub-object instead.",
+          "properties": {
+            "mechanism": {
+              "type": "string",
+              "description": "SASL mechanism: plain | scram-sha-256 | scram-sha-512 | oauthbearer"
+            },
+            "username": { "type": "string" },
+            "password": { "type": "string" },
+            "oauth": {
+              "type": "object",
+              "description": "OAuth 2.0 client_credentials config. Required when mechanism is oauthbearer.",
+              "properties": {
+                "tokenEndpoint": {
+                  "type": "string",
+                  "description": "Token endpoint URL (e.g. https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token)."
+                },
+                "clientId": { "type": "string" },
+                "clientSecret": { "type": "string" },
+                "scope": {
+                  "type": "string",
+                  "description": "Optional OAuth scope (e.g. https://eventhubs.azure.net/.default)."
+                },
+                "tokenRefreshBuffer": {
+                  "type": "integer",
+                  "description": "Milliseconds before token expiry to proactively refresh. Must be a positive integer. Defaults to 30000 (30s).",
+                  "minimum": 1
+                }
+              },
+              "required": ["tokenEndpoint", "clientId", "clientSecret"]
+            }
+          }
         },
         "socketOptions": {
           "type": "object",

package/utils/dbUtil.js

@@ -5,7 +5,7 @@
 /* eslint no-unused-vars:warn */
 
 const fs = require('fs-extra');
-const uuid = require('uuid');
+const { v4: uuidv4 } = require('uuid');
 
 /* Fetch in the other needed components for the this Adaptor */
 const {
@@ -983,7 +983,7 @@ class DBUtil {
     // create the unique identifier (should we let mongo do this?)
     const dataInfo = data;
     if (!{}.hasOwnProperty.call(dataInfo, '_id')) {
-      dataInfo._id = uuid.v4();
+      dataInfo._id = uuidv4();
     }
 
     let res;