@owox/backend 0.38.0 → 0.39.0

package/dist/src/data-marts/credentials/services/credential-fetch.service.js

@@ -5,11 +5,18 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var CredentialFetchService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CredentialFetchService = void 0;
 const common_1 = require("@nestjs/common");
 const safe_url_helper_1 = require("../../../common/helpers/safe-url.helper");
 const guarded_dispatcher_1 = require("../../../common/helpers/guarded-dispatcher");
+const read_bounded_body_helper_1 = require("../../../common/helpers/read-bounded-body.helper");
+const credential_service_1 = require("./credential.service");
+const google_service_account_token_service_1 = require("./google-service-account-token.service");
 const MAX_REQUEST_BODY_BYTES = 1024 * 1024;
 const MAX_RESPONSE_BODY_BYTES = 5 * 1024 * 1024;
 const MAX_REDIRECTS = 5;
@@ -37,35 +44,65 @@ const FORWARDED_RESPONSE_HEADERS = new Set([
     'retry-after',
     'x-request-id',
 ]);
-let CredentialFetchService = class CredentialFetchService {
+let CredentialFetchService = CredentialFetchService_1 = class CredentialFetchService {
+    googleTokens;
+    credentials;
+    logger = new common_1.Logger(CredentialFetchService_1.name);
+    constructor(googleTokens, credentials) {
+        this.googleTokens = googleTokens;
+        this.credentials = credentials;
+    }
     async run(binding, input, limits = {}) {
         const response = await this.runRaw(binding, input, limits);
+        const body = await (0, read_bounded_body_helper_1.readBoundedBody)(response, limits.maxResponseBodyBytes ?? MAX_RESPONSE_BODY_BYTES);
+        if (body === null) {
+            throw new common_1.BadRequestException('Credential response body is too large');
+        }
         return {
             status: response.status,
             headers: pickResponseHeaders(response.headers),
-            bodyBase64: (await readBoundedBody(response, limits.maxResponseBodyBytes ?? MAX_RESPONSE_BODY_BYTES)).toString('base64'),
+            bodyBase64: body.toString('base64'),
         };
     }
     async runRaw(binding, input, limits = {}) {
-        let currentUrl = await this.assertAllowedUrl(input.url, binding.definition.origins);
-        let currentMethod = input.method.toUpperCase();
-        if (currentMethod.length === 0 ||
-            currentMethod.length > 32 ||
-            !HTTP_TOKEN_PATTERN.test(currentMethod) ||
-            FORBIDDEN_FETCH_METHODS.has(currentMethod)) {
+        const url = await this.assertAllowedUrl(input.url, binding.definition);
+        const method = input.method.toUpperCase();
+        if (method.length === 0 ||
+            method.length > 32 ||
+            !HTTP_TOKEN_PATTERN.test(method) ||
+            FORBIDDEN_FETCH_METHODS.has(method)) {
             throw new common_1.BadRequestException('Credential request method is not Fetch-compatible');
         }
-        let body = decodeBody(input.bodyBase64);
+        const body = decodeBody(input.bodyBase64);
         if (body.byteLength > MAX_REQUEST_BODY_BYTES) {
             throw new common_1.BadRequestException('Credential request body is too large');
         }
-        if ((currentMethod === 'GET' || currentMethod === 'HEAD') && body.byteLength > 0) {
-            throw new common_1.BadRequestException(`${currentMethod} requests cannot carry a body`);
+        if ((method === 'GET' || method === 'HEAD') && body.byteLength > 0) {
+            throw new common_1.BadRequestException(`${method} requests cannot carry a body`);
         }
         const timeoutSignal = AbortSignal.timeout(limits.timeoutMs ?? TIMEOUT_MS);
         const signal = limits.signal ? AbortSignal.any([timeoutSignal, limits.signal]) : timeoutSignal;
+        let googleToken;
+        const send = async () => {
+            const { header, token } = await this.authorization(binding, signal);
+            googleToken = token;
+            return this.send(binding, input.headers, url, method, body, header, signal, limits);
+        };
+        const response = await send();
+        if (binding.definition.auth.type !== 'google-service-account' || response.status !== 401) {
+            return response;
+        }
+        void response.body?.cancel().catch(() => undefined);
+        if (googleToken)
+            this.googleTokens.drop(googleTokenRequest(binding), googleToken);
+        return send();
+    }
+    async send(binding, supplied, startUrl, startMethod, startBody, authorization, signal, limits) {
+        let currentUrl = startUrl;
+        let currentMethod = startMethod;
+        let body = startBody;
         for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
-            const headers = this.buildRequestHeaders(binding, input.headers);
+            const headers = this.buildRequestHeaders(supplied, authorization);
             let response;
             try {
                 response = await fetch(currentUrl, (0, guarded_dispatcher_1.withGuardedDispatcher)({
@@ -88,7 +125,7 @@ let CredentialFetchService = class CredentialFetchService {
                 if (hop === MAX_REDIRECTS) {
                     throw new common_1.ForbiddenException('Credential request exceeded the redirect limit');
                 }
-                currentUrl = await this.assertAllowedUrl(new URL(location, currentUrl).toString(), binding.definition.origins);
+                currentUrl = await this.assertAllowedUrl(new URL(location, currentUrl).toString(), binding.definition);
                 if (response.status === 303 ||
                     ((response.status === 301 || response.status === 302) && currentMethod === 'POST')) {
                     currentMethod = currentMethod === 'HEAD' ? 'HEAD' : 'GET';
@@ -100,7 +137,46 @@ let CredentialFetchService = class CredentialFetchService {
         }
         throw new common_1.ForbiddenException('Credential request exceeded the redirect limit');
     }
-    async assertAllowedUrl(rawUrl, origins) {
+    async authorization(binding, signal) {
+        const { auth } = binding.definition;
+        if (auth.type === 'header') {
+            return { header: [auth.headerName, `${auth.prefix ?? ''}${binding.secret.value}`] };
+        }
+        if (binding.requirement.scopes.length === 0) {
+            throw new common_1.BadRequestException({
+                code: 'CREDENTIAL_SCOPE_INVALID',
+                message: 'Google issued no access token for the scopes this plugin declares',
+            });
+        }
+        try {
+            const token = await this.googleTokens.getAccessToken({
+                ...googleTokenRequest(binding),
+                signal,
+            });
+            return { header: ['authorization', `Bearer ${token}`], token };
+        }
+        catch (error) {
+            if (!(error instanceof google_service_account_token_service_1.GoogleTokenError))
+                throw error;
+            if (error.failure === 'rejected') {
+                await this.credentials
+                    .markRejected(binding.credentialId, binding.secret, error.message)
+                    .catch(() => this.logger.warn(`Could not record the rejected key of Credential ${binding.credentialId}`));
+                throw new common_1.ForbiddenException({
+                    code: 'CREDENTIAL_REJECTED',
+                    message: `Google rejected the service account key: ${error.message}`,
+                });
+            }
+            if (error.failure === 'scope') {
+                throw new common_1.BadRequestException({
+                    code: 'CREDENTIAL_SCOPE_INVALID',
+                    message: 'Google issued no access token for the scopes this plugin declares',
+                });
+            }
+            throw new common_1.BadGatewayException('Credential request could not be completed');
+        }
+    }
+    async assertAllowedUrl(rawUrl, definition) {
         let url;
         try {
             url = await (0, safe_url_helper_1.assertPublicHttpUrl)(rawUrl, { allowedProtocols: ['https:'] });
@@ -108,15 +184,14 @@ let CredentialFetchService = class CredentialFetchService {
         catch {
             throw new common_1.ForbiddenException('Credential request URL is not allowed');
         }
-        const allowedOrigins = new Set(origins.map(origin => new URL(origin).origin));
-        if (!allowedOrigins.has(url.origin)) {
+        if (!definition.origins.some(origin => originAllows(origin, url, definition.auth.type))) {
             throw new common_1.ForbiddenException('Credential request origin is not declared by the definition');
         }
         return url.toString();
     }
-    buildRequestHeaders(binding, supplied) {
+    buildRequestHeaders(supplied, [authName, authValue]) {
         const headers = new Headers();
-        const secretHeader = binding.definition.auth.headerName.toLowerCase();
+        const secretHeader = authName.toLowerCase();
         const entries = Object.entries(supplied ?? {});
         if (entries.length > 100) {
             throw new common_1.BadRequestException('Credential request contains too many headers');
@@ -135,18 +210,36 @@ let CredentialFetchService = class CredentialFetchService {
             }
             headers.set(name, value);
         }
-        headers.set(binding.definition.auth.headerName, `${binding.definition.auth.prefix ?? ''}${binding.secret.value}`);
+        headers.set(authName, authValue);
         return headers;
     }
 };
 exports.CredentialFetchService = CredentialFetchService;
-exports.CredentialFetchService = CredentialFetchService = __decorate([
-    (0, common_1.Injectable)()
+exports.CredentialFetchService = CredentialFetchService = CredentialFetchService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [google_service_account_token_service_1.GoogleServiceAccountTokenService,
+        credential_service_1.CredentialService])
 ], CredentialFetchService);
+function googleTokenRequest(binding) {
+    return {
+        credentialId: binding.credentialId,
+        secret: binding.secret,
+        scopes: binding.requirement.scopes,
+    };
+}
+function originAllows(origin, url, authType) {
+    const declared = new URL(origin);
+    if (authType === 'google-service-account' && declared.hostname.startsWith('*.')) {
+        return (url.protocol === 'https:' &&
+            url.port === '' &&
+            url.hostname.endsWith(declared.hostname.slice(1)));
+    }
+    return declared.origin === url.origin;
+}
 function boundResponseBody(response, maxBytes) {
     const declaredLength = Number(response.headers.get('content-length'));
     if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
-        void response.body?.cancel();
+        void response.body?.cancel().catch(() => undefined);
         throw new common_1.BadRequestException('Credential response body is too large');
     }
     if (!response.body)
@@ -192,30 +285,6 @@ function decodeBody(encoded) {
     }
     return body;
 }
-async function readBoundedBody(response, maxBytes) {
-    const declaredLength = Number(response.headers.get('content-length'));
-    if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
-        await response.body?.cancel();
-        throw new common_1.BadRequestException('Credential response body is too large');
-    }
-    if (!response.body)
-        return Buffer.alloc(0);
-    const reader = response.body.getReader();
-    const chunks = [];
-    let total = 0;
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        total += value.byteLength;
-        if (total > maxBytes) {
-            await reader.cancel();
-            throw new common_1.BadRequestException('Credential response body is too large');
-        }
-        chunks.push(value);
-    }
-    return Buffer.concat(chunks.map(chunk => Buffer.from(chunk)), total);
-}
 function pickResponseHeaders(headers) {
     const result = {};
     headers.forEach((value, name) => {

package/dist/src/data-marts/credentials/services/credential-validation-probe.service.d.ts

@@ -1,8 +1,10 @@
 import type { CredentialSecret, CredentialValidationResult } from '../credential.types';
 import type { ResolvedCredentialDefinition } from '../dto/credential-api.dto';
 import { CredentialFetchService } from './credential-fetch.service';
+import { GoogleServiceAccountTokenService } from './google-service-account-token.service';
 export declare class CredentialValidationProbeService {
     private readonly credentialFetch;
-    constructor(credentialFetch: CredentialFetchService);
+    private readonly googleTokens;
+    constructor(credentialFetch: CredentialFetchService, googleTokens: GoogleServiceAccountTokenService);
     run(definition: ResolvedCredentialDefinition, secret: CredentialSecret): Promise<CredentialValidationResult>;
 }

package/dist/src/data-marts/credentials/services/credential-validation-probe.service.js

@@ -12,15 +12,21 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CredentialValidationProbeService = void 0;
 const common_1 = require("@nestjs/common");
 const credential_fetch_service_1 = require("./credential-fetch.service");
+const google_service_account_token_service_1 = require("./google-service-account-token.service");
 const PROBE_TIMEOUT_MS = 10_000;
 const PROBE_MAX_RESPONSE_BODY_BYTES = 64 * 1024;
 const DEFAULT_REJECTED_STATUSES = new Set([400, 401, 403]);
 let CredentialValidationProbeService = class CredentialValidationProbeService {
     credentialFetch;
-    constructor(credentialFetch) {
+    googleTokens;
+    constructor(credentialFetch, googleTokens) {
         this.credentialFetch = credentialFetch;
+        this.googleTokens = googleTokens;
     }
     async run(definition, secret) {
+        if (definition.contract.auth.type === 'google-service-account') {
+            return this.googleTokens.verify(secret);
+        }
         const validatedAt = new Date();
         const probe = definition.contract.validation;
         if (!probe) {
@@ -37,6 +43,7 @@ let CredentialValidationProbeService = class CredentialValidationProbeService {
                 definitionId: definition.contract.id,
                 optional: false,
                 models: [],
+                scopes: [],
             },
             secret,
             definition: definition.contract,
@@ -81,7 +88,8 @@ let CredentialValidationProbeService = class CredentialValidationProbeService {
 exports.CredentialValidationProbeService = CredentialValidationProbeService;
 exports.CredentialValidationProbeService = CredentialValidationProbeService = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [credential_fetch_service_1.CredentialFetchService])
+    __metadata("design:paramtypes", [credential_fetch_service_1.CredentialFetchService,
+        google_service_account_token_service_1.GoogleServiceAccountTokenService])
 ], CredentialValidationProbeService);
 function isSuccessful(status) {
     return status >= 200 && status < 300;

package/dist/src/data-marts/credentials/services/credential.service.d.ts

@@ -1,5 +1,6 @@
 import { Repository } from 'typeorm';
 import { CredentialConsumerBinding } from '../entities/credential-consumer-binding.entity';
+import type { CredentialSecret, CredentialValidationResult } from '../credential.types';
 import { Credential } from '../entities/credential.entity';
 export declare class CredentialService {
     private readonly credentials;
@@ -14,6 +15,9 @@ export declare class CredentialService {
     getLastUsedAt(credentialId: string): Promise<Date | null>;
     countActiveBindings(credentialId: string): Promise<number>;
     softDelete(id: string, projectId: string): Promise<void>;
+    writeValidation(id: string, checkedSecret: CredentialSecret, result: CredentialValidationResult): Promise<void>;
+    markRejected(id: string, rejectedSecret: CredentialSecret, message: string): Promise<void>;
+    private updateValidationWhileSecret;
     markLastUsed(input: {
         readonly credentialId: string;
         readonly consumerType: 'plugin-installation';

package/dist/src/data-marts/credentials/services/credential.service.js

@@ -81,6 +81,42 @@ let CredentialService = class CredentialService {
     async softDelete(id, projectId) {
         await this.credentials.softDelete({ id, projectId });
     }
+    async writeValidation(id, checkedSecret, result) {
+        await this.updateValidationWhileSecret(id, checkedSecret, {
+            validationState: result.state,
+            validationMessage: result.message.slice(0, 2000),
+            validatedAt: result.validatedAt,
+        });
+    }
+    async markRejected(id, rejectedSecret, message) {
+        const cut = message.slice(0, 2000);
+        const stored = await this.credentials.findOne({
+            where: { id },
+            select: { id: true, validationState: true, validationMessage: true },
+        });
+        if (!stored || (stored.validationState === 'rejected' && stored.validationMessage === cut)) {
+            return;
+        }
+        await this.updateValidationWhileSecret(id, rejectedSecret, {
+            validationState: 'rejected',
+            validationMessage: cut,
+            validatedAt: new Date(),
+        });
+    }
+    async updateValidationWhileSecret(id, secret, values) {
+        const type = this.credentials.manager.connection.options.type;
+        const storedValue = type === 'mysql' || type === 'mariadb'
+            ? "JSON_UNQUOTE(JSON_EXTRACT(secret, '$.value'))"
+            : "JSON_EXTRACT(secret, '$.value')";
+        await this.credentials
+            .createQueryBuilder()
+            .update(credential_entity_1.Credential)
+            .set(values)
+            .where('id = :id', { id })
+            .andWhere('deletedAt IS NULL')
+            .andWhere(`${storedValue} = :secretValue`, { secretValue: secret.value })
+            .execute();
+    }
     async markLastUsed(input, now = new Date()) {
         const threshold = new Date(now.getTime() - 5 * 60 * 1000);
         try {

package/dist/src/data-marts/credentials/services/google-service-account-key.d.ts

@@ -0,0 +1,6 @@
+import { type GoogleServiceAccountKey } from '../../../common/schemas/google-service-account-key.schema';
+import type { CredentialPublicMetadata } from '../credential.types';
+export declare function parseGoogleServiceAccountKey(value: string): {
+    readonly key: GoogleServiceAccountKey;
+    readonly metadata: CredentialPublicMetadata;
+};

package/dist/src/data-marts/credentials/services/google-service-account-key.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseGoogleServiceAccountKey = parseGoogleServiceAccountKey;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const google_service_account_key_schema_1 = require("../../../common/schemas/google-service-account-key.schema");
+function parseGoogleServiceAccountKey(value) {
+    let raw;
+    try {
+        raw = JSON.parse(value);
+    }
+    catch {
+        throw new common_1.BadRequestException('The key is not valid JSON');
+    }
+    const parsed = google_service_account_key_schema_1.GoogleServiceAccountKeySchema.safeParse(raw);
+    if (!parsed.success) {
+        const [issue] = parsed.error.issues;
+        const path = issue.path.join('.');
+        throw new common_1.BadRequestException(path ? `${path}: ${issue.message}` : issue.message);
+    }
+    const key = parsed.data;
+    if (!key.client_email.toLowerCase().endsWith('.gserviceaccount.com')) {
+        throw new common_1.BadRequestException('client_email must be a service account address');
+    }
+    let rsa = false;
+    try {
+        rsa = (0, node_crypto_1.createPrivateKey)(key.private_key).asymmetricKeyType === 'rsa';
+    }
+    catch {
+    }
+    if (!rsa) {
+        throw new common_1.BadRequestException('private_key must be an RSA key');
+    }
+    if (key.universe_domain !== 'googleapis.com') {
+        throw new common_1.BadRequestException('Only the googleapis.com universe is supported');
+    }
+    return {
+        key,
+        metadata: {
+            clientEmail: key.client_email,
+            projectId: key.project_id,
+            privateKeyId: key.private_key_id,
+        },
+    };
+}
+//# sourceMappingURL=google-service-account-key.js.map

package/dist/src/data-marts/credentials/services/google-service-account-token.service.d.ts

@@ -0,0 +1,25 @@
+import { type JWTOptions } from 'google-auth-library';
+import type { CredentialSecret, CredentialValidationResult } from '../credential.types';
+export declare const GOOGLE_TOKEN_TRANSPORTER: unique symbol;
+export type GoogleTokenTransporter = NonNullable<JWTOptions['transporter']>;
+export type GoogleTokenFailure = 'rejected' | 'scope' | 'unavailable';
+export declare class GoogleTokenError extends Error {
+    readonly failure: GoogleTokenFailure;
+    constructor(failure: GoogleTokenFailure, message: string);
+}
+export interface GoogleTokenRequest {
+    readonly credentialId: string;
+    readonly secret: CredentialSecret;
+    readonly scopes: readonly string[];
+}
+export declare class GoogleServiceAccountTokenService {
+    private readonly transporter?;
+    private readonly clients;
+    constructor(transporter?: GoogleTokenTransporter | undefined);
+    verify(secret: CredentialSecret): Promise<CredentialValidationResult>;
+    getAccessToken(input: GoogleTokenRequest & {
+        readonly signal: AbortSignal;
+    }): Promise<string>;
+    drop(input: GoogleTokenRequest, staleToken: string): void;
+    private createClient;
+}

package/dist/src/data-marts/credentials/services/google-service-account-token.service.js

@@ -0,0 +1,177 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GoogleServiceAccountTokenService = exports.GoogleTokenError = exports.GOOGLE_TOKEN_TRANSPORTER = void 0;
+const common_1 = require("@nestjs/common");
+const google_auth_library_1 = require("google-auth-library");
+const node_crypto_1 = require("node:crypto");
+const google_service_account_key_1 = require("./google-service-account-key");
+exports.GOOGLE_TOKEN_TRANSPORTER = Symbol('GOOGLE_TOKEN_TRANSPORTER');
+class GoogleTokenError extends Error {
+    failure;
+    constructor(failure, message) {
+        super(message);
+        this.failure = failure;
+        this.name = 'GoogleTokenError';
+    }
+}
+exports.GoogleTokenError = GoogleTokenError;
+const IDLE_MS = 60 * 60 * 1000;
+const VERIFY_TIMEOUT_MS = 10_000;
+const TOKEN_REQUEST_TIMEOUT_MS = 10_000;
+const NEW_KEY_HINT = ' A key created in the last minute may not work yet.';
+const VERIFY_SCOPES = ['https://www.googleapis.com/auth/userinfo.email'];
+const NO_ACCESS_TOKEN_MESSAGE = 'Could not refresh access token.';
+let GoogleServiceAccountTokenService = class GoogleServiceAccountTokenService {
+    transporter;
+    clients = new Map();
+    constructor(transporter) {
+        this.transporter = transporter;
+    }
+    async verify(secret) {
+        const validatedAt = new Date();
+        let client;
+        try {
+            client = this.createClient(secret, VERIFY_SCOPES);
+        }
+        catch (error) {
+            return {
+                state: 'rejected',
+                message: error instanceof Error ? error.message : 'The key is not valid',
+                validatedAt,
+            };
+        }
+        try {
+            await mint(client, AbortSignal.timeout(VERIFY_TIMEOUT_MS));
+            return { state: 'verified', message: 'Google issued a token for this key', validatedAt };
+        }
+        catch (error) {
+            if (error instanceof GoogleTokenError && error.failure === 'rejected') {
+                return { state: 'rejected', message: `${error.message}${NEW_KEY_HINT}`, validatedAt };
+            }
+            return {
+                state: 'unknown',
+                message: 'Google could not be reached to check the key',
+                validatedAt,
+            };
+        }
+    }
+    async getAccessToken(input) {
+        const now = Date.now();
+        for (const [key, entry] of this.clients) {
+            if (now - entry.lastUsedAt > IDLE_MS)
+                this.clients.delete(key);
+        }
+        const key = cacheKey(input);
+        let entry = this.clients.get(key);
+        if (!entry) {
+            entry = { client: this.createClient(input.secret, input.scopes), lastUsedAt: now };
+            this.clients.set(key, entry);
+        }
+        entry.lastUsedAt = now;
+        try {
+            return await mint(entry.client, input.signal);
+        }
+        catch (error) {
+            if (!input.signal.aborted && this.clients.get(key) === entry)
+                this.clients.delete(key);
+            throw error;
+        }
+    }
+    drop(input, staleToken) {
+        const key = cacheKey(input);
+        if (this.clients.get(key)?.client.credentials.access_token === staleToken) {
+            this.clients.delete(key);
+        }
+    }
+    createClient(secret, scopes) {
+        let key;
+        try {
+            ({ key } = (0, google_service_account_key_1.parseGoogleServiceAccountKey)(secret.value));
+        }
+        catch (error) {
+            throw new GoogleTokenError('rejected', error instanceof Error ? error.message : 'The key is not valid');
+        }
+        return new google_auth_library_1.JWT({
+            email: key.client_email,
+            key: key.private_key,
+            scopes: [...scopes],
+            transporter: this.transporter,
+            useAuthRequestParameters: false,
+            transporterOptions: { timeout: TOKEN_REQUEST_TIMEOUT_MS },
+        });
+    }
+};
+exports.GoogleServiceAccountTokenService = GoogleServiceAccountTokenService;
+exports.GoogleServiceAccountTokenService = GoogleServiceAccountTokenService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __param(0, (0, common_1.Inject)(exports.GOOGLE_TOKEN_TRANSPORTER)),
+    __metadata("design:paramtypes", [Object])
+], GoogleServiceAccountTokenService);
+function cacheKey(input) {
+    const secretHash = (0, node_crypto_1.createHash)('sha256').update(input.secret.value).digest('hex');
+    return `${input.credentialId}:${secretHash}:${input.scopes.join(' ')}`;
+}
+async function mint(client, signal) {
+    let token;
+    try {
+        ({ token } = await raceSignal(client.getAccessToken(), signal));
+    }
+    catch (error) {
+        throw classify(error);
+    }
+    if (!token)
+        throw new GoogleTokenError('scope', 'Google issued no access token');
+    return token;
+}
+function raceSignal(promise, signal) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason ?? new Error('aborted'));
+        if (signal.aborted) {
+            onAbort();
+        }
+        else {
+            signal.addEventListener('abort', onAbort, { once: true });
+        }
+        promise.then(value => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(error);
+        });
+    });
+}
+function classify(error) {
+    if (error instanceof GoogleTokenError)
+        return error;
+    const response = error?.response;
+    if (!response) {
+        return error instanceof Error && error.message === NO_ACCESS_TOKEN_MESSAGE
+            ? new GoogleTokenError('scope', 'Google issued no access token')
+            : new GoogleTokenError('unavailable', 'Google could not be reached');
+    }
+    const status = response.status ?? 0;
+    const code = response.data?.error;
+    if (status >= 400 && status < 500 && status !== 429 && typeof code === 'string') {
+        if (code === 'invalid_scope') {
+            return new GoogleTokenError('scope', 'Google issued no access token');
+        }
+        const description = response.data?.error_description;
+        return new GoogleTokenError('rejected', typeof description === 'string' && description ? `${code}: ${description}` : code);
+    }
+    return new GoogleTokenError('unavailable', 'Google could not be reached');
+}
+//# sourceMappingURL=google-service-account-token.service.js.map

package/dist/src/data-marts/credentials/use-cases/create-credential.service.d.ts

@@ -22,6 +22,7 @@ export declare class CreateCredentialService {
     private readonly credentialContexts;
     constructor(credentials: CredentialService, definitions: CredentialDefinitionService, view: CredentialViewService, validationProbe: CredentialValidationProbeService, contexts: ContextService, idpProjections: IdpProjectionsFacade, owners: Repository<CredentialOwner>, credentialContexts: Repository<CredentialContext>);
     run(context: AuthorizationContext, input: CreateCredentialApiDto): Promise<CredentialDto>;
+    private persist;
 }
 export declare function validateAiMappings(mappings: CredentialAiModelMappings | null | undefined, ai: CredentialDefinitionContract['ai'] | undefined): void;
 export declare function normalizeAiConfiguration(mappings: CredentialAiModelMappings | null | undefined, modes: CredentialAiModelMappingModes | null | undefined, ai: CredentialDefinitionContract['ai'] | undefined, current?: {