@sebspark/gcp-iam 0.3.1 → 0.4.1

package/README.md

@@ -1,3 +1,10 @@
 # `@sebspark/gcp-iam`
 
 Google IAM utilities. This package is intended to be run in GCP contexts, such as running under a GKE service account using Workload Identity.
+
+
+# Explanation
+
+It generates the JWT that we put into the proxy-authorization header. That JWT is signed by the GCP service account and the aud part of the JWT is set to the URL we are going to call in the API Gateway.
+ 
+Generating and signing the JWT uses a bunch of CPU cycles, so it makes sense to cache them for a short time.

package/dist/index.d.mts

@@ -8,6 +8,11 @@ import { Logger } from 'winston';
  * @param logger An optional logger to use for logging.
  * @returns A JWT.
  */
-declare const getApiGatewayToken: (apiURL: string, logger?: Logger) => Promise<string>;
+declare const getApiGatewayToken: ({ apiURL, key, ttl, logger, }: {
+    apiURL: string;
+    key?: string;
+    ttl?: number;
+    logger?: Logger;
+}) => Promise<string>;
 
 export { getApiGatewayToken };

package/dist/index.d.ts

@@ -8,6 +8,11 @@ import { Logger } from 'winston';
  * @param logger An optional logger to use for logging.
  * @returns A JWT.
  */
-declare const getApiGatewayToken: (apiURL: string, logger?: Logger) => Promise<string>;
+declare const getApiGatewayToken: ({ apiURL, key, ttl, logger, }: {
+    apiURL: string;
+    key?: string;
+    ttl?: number;
+    logger?: Logger;
+}) => Promise<string>;
 
 export { getApiGatewayToken };

package/dist/index.js

@@ -18,11 +18,11 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
-var src_exports = {};
-__export(src_exports, {
+var index_exports = {};
+__export(index_exports, {
   getApiGatewayToken: () => getApiGatewayToken
 });
-module.exports = __toCommonJS(src_exports);
+module.exports = __toCommonJS(index_exports);
 
 // src/apiGatewayToken.ts
 var import_iam_credentials = require("@google-cloud/iam-credentials");
@@ -32,17 +32,17 @@ var import_google_auth_library = require("google-auth-library");
 var LruCache = class {
   values = /* @__PURE__ */ new Map();
   maxEntries = 1e4;
-  ttl = 1e3 * 60 * 10;
-  // 1 minute
+  defaultTTL = 1e3 * 10;
+  // 10 seconds
   constructor(props) {
-    this.ttl = (props == null ? void 0 : props.ttl) ?? this.ttl;
-    this.maxEntries = (props == null ? void 0 : props.maxEntries) ?? this.maxEntries;
+    this.defaultTTL = props?.ttl ?? this.defaultTTL;
+    this.maxEntries = props?.maxEntries ?? this.maxEntries;
   }
   get(key) {
     const hasKey = this.values.has(key);
     if (hasKey) {
       const entry = this.values.get(key);
-      if (Date.now() - entry.timestamp > this.ttl) {
+      if (Date.now() - entry.timestamp > entry.ttl) {
         this.values.delete(key);
         return void 0;
       }
@@ -51,22 +51,29 @@ var LruCache = class {
       return entry.data;
     }
   }
-  put(key, value) {
+  put(key, value, ttl) {
     if (this.values.size >= this.maxEntries) {
       const keyToDelete = this.values.keys().next().value;
       this.values.delete(keyToDelete);
     }
-    this.values.set(key, { data: value, timestamp: Date.now() });
+    this.values.set(key, {
+      data: value,
+      timestamp: Date.now(),
+      ttl: ttl || this.defaultTTL
+    });
   }
 };
 
 // src/apiGatewayToken.ts
 var expInSeconds = 60 * 60;
-var apiGatewayJwtCache = new LruCache({
-  ttl: 1e3 * expInSeconds / 2
-});
-var getApiGatewayToken = async (apiURL, logger) => {
-  const cachedJwt = apiGatewayJwtCache.get(apiURL);
+var apiGatewayJwtCache = new LruCache();
+var getApiGatewayToken = async ({
+  apiURL,
+  key,
+  ttl,
+  logger
+}) => {
+  const cachedJwt = apiGatewayJwtCache.get(key || apiURL);
   if (cachedJwt) {
     return cachedJwt;
   }
@@ -78,7 +85,7 @@ var getApiGatewayToken = async (apiURL, logger) => {
     if (!serviceAccountEmail) {
       throw new Error("No service account e-mail could be found.");
     }
-    logger == null ? void 0 : logger.info(`Serice account e-mail beeing used: ${serviceAccountEmail}`);
+    logger?.info(`Serice account e-mail beeing used: ${serviceAccountEmail}`);
     const header = {
       alg: "RS256",
       typ: "JWT"
@@ -106,16 +113,17 @@ var getApiGatewayToken = async (apiURL, logger) => {
         "signBlob(...) returned an empty response. Cannot sign JWT."
       );
     }
+    console.log("IAM KeyID", response.keyId);
     const signature = Buffer.from(response.signedBlob).toString("base64");
     const signedJWT = `${unsignedJWT}.${signature}`;
-    apiGatewayJwtCache.put(apiURL, signedJWT);
+    apiGatewayJwtCache.put(key || apiURL, signedJWT, ttl);
     return signedJWT;
   } catch (error) {
     if (process.env.GCP_IAM_SOFT_FAIL === "true") {
-      logger == null ? void 0 : logger.warn("Soft fail enabled, returning empty JWT");
+      logger?.warn("Soft fail enabled, returning empty JWT");
       return "";
     }
-    logger == null ? void 0 : logger.error("Error generating system JWT", error);
+    logger?.error("Error generating system JWT", error);
     throw new Error(`Error generating system JWT: ${JSON.stringify(error)}`);
   }
 };

package/dist/index.mjs

@@ -6,17 +6,17 @@ import { GoogleAuth } from "google-auth-library";
 var LruCache = class {
   values = /* @__PURE__ */ new Map();
   maxEntries = 1e4;
-  ttl = 1e3 * 60 * 10;
-  // 1 minute
+  defaultTTL = 1e3 * 10;
+  // 10 seconds
   constructor(props) {
-    this.ttl = (props == null ? void 0 : props.ttl) ?? this.ttl;
-    this.maxEntries = (props == null ? void 0 : props.maxEntries) ?? this.maxEntries;
+    this.defaultTTL = props?.ttl ?? this.defaultTTL;
+    this.maxEntries = props?.maxEntries ?? this.maxEntries;
   }
   get(key) {
     const hasKey = this.values.has(key);
     if (hasKey) {
       const entry = this.values.get(key);
-      if (Date.now() - entry.timestamp > this.ttl) {
+      if (Date.now() - entry.timestamp > entry.ttl) {
         this.values.delete(key);
         return void 0;
       }
@@ -25,22 +25,29 @@ var LruCache = class {
       return entry.data;
     }
   }
-  put(key, value) {
+  put(key, value, ttl) {
     if (this.values.size >= this.maxEntries) {
       const keyToDelete = this.values.keys().next().value;
       this.values.delete(keyToDelete);
     }
-    this.values.set(key, { data: value, timestamp: Date.now() });
+    this.values.set(key, {
+      data: value,
+      timestamp: Date.now(),
+      ttl: ttl || this.defaultTTL
+    });
   }
 };
 
 // src/apiGatewayToken.ts
 var expInSeconds = 60 * 60;
-var apiGatewayJwtCache = new LruCache({
-  ttl: 1e3 * expInSeconds / 2
-});
-var getApiGatewayToken = async (apiURL, logger) => {
-  const cachedJwt = apiGatewayJwtCache.get(apiURL);
+var apiGatewayJwtCache = new LruCache();
+var getApiGatewayToken = async ({
+  apiURL,
+  key,
+  ttl,
+  logger
+}) => {
+  const cachedJwt = apiGatewayJwtCache.get(key || apiURL);
   if (cachedJwt) {
     return cachedJwt;
   }
@@ -52,7 +59,7 @@ var getApiGatewayToken = async (apiURL, logger) => {
     if (!serviceAccountEmail) {
       throw new Error("No service account e-mail could be found.");
     }
-    logger == null ? void 0 : logger.info(`Serice account e-mail beeing used: ${serviceAccountEmail}`);
+    logger?.info(`Serice account e-mail beeing used: ${serviceAccountEmail}`);
     const header = {
       alg: "RS256",
       typ: "JWT"
@@ -80,16 +87,17 @@ var getApiGatewayToken = async (apiURL, logger) => {
         "signBlob(...) returned an empty response. Cannot sign JWT."
       );
     }
+    console.log("IAM KeyID", response.keyId);
     const signature = Buffer.from(response.signedBlob).toString("base64");
     const signedJWT = `${unsignedJWT}.${signature}`;
-    apiGatewayJwtCache.put(apiURL, signedJWT);
+    apiGatewayJwtCache.put(key || apiURL, signedJWT, ttl);
     return signedJWT;
   } catch (error) {
     if (process.env.GCP_IAM_SOFT_FAIL === "true") {
-      logger == null ? void 0 : logger.warn("Soft fail enabled, returning empty JWT");
+      logger?.warn("Soft fail enabled, returning empty JWT");
       return "";
     }
-    logger == null ? void 0 : logger.error("Error generating system JWT", error);
+    logger?.error("Error generating system JWT", error);
     throw new Error(`Error generating system JWT: ${JSON.stringify(error)}`);
   }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebspark/gcp-iam",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -20,6 +20,6 @@
   },
   "dependencies": {
     "@google-cloud/iam-credentials": "3.3.0",
-    "google-auth-library": "^9.15.0"
+    "google-auth-library": "9.15.1"
   }
 }