@vercel/functions 1.3.0 → 1.4.0

package/README.md

@@ -0,0 +1,60 @@
+<p align="center">
+  <a href="https://vercel.com">
+    <img src="https://assets.vercel.com/image/upload/v1588805858/repositories/vercel/logo.png" height="96">
+    <h3 align="center">Vercel</h3>
+  </a>
+  <p align="center">Develop. Preview. Ship.</p>
+</p>
+
+[![Join the community on GitHub Discussions](https://badgen.net/badge/join%20the%20discussion/on%20github/black?icon=github)](https://github.com/vercel/vercel/discussions)
+
+## OIDC Support Functions
+
+### AWS S3 Example
+
+```ts
+import * as s3 from '@aws-sdk/client-s3';
+import { awsCredentialsProvider } from '@vercel/functions/oidc';
+
+const s3Client = new s3.S3Client({
+  credentials: awsCredentialsProvider({
+    roleArn: process.env.AWS_ROLE_ARN,
+  }),
+});
+
+export const GET = () => {
+  const result = await s3Client.send(
+    new s3.ListObjectsV2Command({
+      Bucket: process.env.BUCKET_NAME,
+    })
+  );
+  return Response.json({ objects: result.Contents });
+};
+```
+
+### Azure CosmosDB Example
+
+```ts
+import { ClientAssertionCredential } from '@azure/identity';
+import { CosmosClient } from '@azure/cosmos';
+import { getVercelOidcToken } from '@vercel/functions/oidc';
+
+const credentialsProvider = new ClientAssertionCredential(
+  process.env.AZURE_TENANT_ID,
+  process.env.AZURE_CLIENT_ID,
+  getVercelOidcToken
+);
+
+const cosmosClient = new CosmosClient({
+  endpoint: process.env.COSMOS_DB_ENDPOINT,
+  aadCredentials: credentialsProvider,
+});
+
+export const GET = () => {
+  const container = cosmosClient
+    .database(process.env.COSMOS_DB_NAME)
+    .container(process.env.COSMOS_DB_CONTAINER);
+  const items = await container.items.query('SELECT * FROM f').fetchAll();
+  return Response.json({ items: items.resources });
+};
+```

package/dist/get-context.d.ts

@@ -0,0 +1,7 @@
+type Context = {
+    waitUntil?: (promise: Promise<unknown>) => void;
+    headers?: Record<string, string>;
+};
+export declare const SYMBOL_FOR_REQ_CONTEXT: unique symbol;
+export declare function getContext(): Context;
+export {};

package/dist/get-context.js

@@ -0,0 +1,34 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var get_context_exports = {};
+__export(get_context_exports, {
+  SYMBOL_FOR_REQ_CONTEXT: () => SYMBOL_FOR_REQ_CONTEXT,
+  getContext: () => getContext
+});
+module.exports = __toCommonJS(get_context_exports);
+const SYMBOL_FOR_REQ_CONTEXT = Symbol.for("@vercel/request-context");
+function getContext() {
+  const fromSymbol = globalThis;
+  return fromSymbol[SYMBOL_FOR_REQ_CONTEXT]?.get?.() ?? {};
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SYMBOL_FOR_REQ_CONTEXT,
+  getContext
+});

package/dist/headers.d.ts

@@ -36,7 +36,7 @@ export declare const EMOJI_FLAG_UNICODE_STARTING_POSITION = 127397;
  * We define a new type so this function can be reused with
  * the global `Request`, `node-fetch` and other types.
  */
-interface Request {
+export interface Request {
     headers: {
         get(name: string): string | null;
     };
@@ -80,4 +80,3 @@ export declare function ipAddress(request: Request): string | undefined;
  * @param request The incoming request object which provides the geolocation data
  */
 export declare function geolocation(request: Request): Geo;
-export {};

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+export type { Request, Geo } from './headers';
 export { geolocation, ipAddress } from './headers';
 export { getEnv } from './get-env';
 export { waitUntil } from './wait-until';

package/dist/oidc/aws-credentials-provider.d.ts

@@ -0,0 +1,57 @@
+import type { AwsCredentialIdentityProvider } from '@smithy/types';
+import type { FromWebTokenInit } from '@aws-sdk/credential-provider-web-identity';
+/**
+ * The init object for the `awsCredentialsProvider` function.
+ *
+ * @typedef {Object} AwsCredentialsProviderInit
+ * @property {string} roleArn - ARN of the role that the caller is assuming.
+ * @property {Object} [clientConfig] - Custom STS client configurations overriding the default ones.
+ * @property {Array} [clientPlugins] - Custom STS client middleware plugin to modify the client default behavior.
+ * @property {Function} [roleAssumerWithWebIdentity] - A function that assumes a role with web identity and returns a promise fulfilled with credentials for the assumed role.
+ * @property {string} [roleSessionName] - An identifier for the assumed role session.
+ * @property {string} [providerId] - The fully qualified host component of the domain name of the identity provider.
+ * @property {Array} [policyArns] - ARNs of the IAM managed policies that you want to use as managed session policies.
+ * @property {string} [policy] - An IAM policy in JSON format that you want to use as an inline session policy.
+ * @property {number} [durationSeconds=3600] - The duration, in seconds, of the role session. Defaults to 3600 seconds.
+ */
+export interface AwsCredentialsProviderInit// eslint-disable-line @typescript-eslint/no-empty-interface
+ extends Omit<FromWebTokenInit, 'webIdentityToken'> {
+}
+/**
+ * Obtains the Vercel OIDC token and creates an AWS credential provider function
+ * that gets AWS credentials by calling STS AssumeRoleWithWebIdentity API.
+ *
+ * @param {AwsCredentialsProviderInit} init - The initialization object.
+ * @param {string} init.roleArn - ARN of the role that the caller is assuming.
+ * @param {Object} [init.clientConfig] - Custom STS client configurations overriding the default ones.
+ * @param {Array} [init.clientPlugins] - Custom STS client middleware plugin to modify the client default behavior.
+ * @param {Function} [init.roleAssumerWithWebIdentity] - A function that assumes a role with web identity and returns a promise fulfilled with credentials for the assumed role.
+ * @param {string} [init.roleSessionName] - An identifier for the assumed role session.
+ * @param {string} [init.providerId] - The fully qualified host component of the domain name of the identity provider.
+ * @param {Array} [init.policyArns] - ARNs of the IAM managed policies that you want to use as managed session policies.
+ * @param {string} [init.policy] - An IAM policy in JSON format that you want to use as an inline session policy.
+ * @param {number} [init.durationSeconds=3600] - The duration, in seconds, of the role session. Defaults to 3600 seconds.
+ *
+ * @returns {AwsCredentialIdentityProvider} A function that provides AWS credentials.
+ *
+ * @example
+ * ```javascript
+ * import * as s3 from '@aws-sdk/client-s3';
+ * import { awsCredentialsProvider } from '@vercel/functions/oidc';
+ *
+ * const s3Client = new s3.S3Client({
+ *   credentials: awsCredentialsProvider({
+ *     roleArn: "arn:aws:iam::1234567890:role/RoleA",
+ *     clientConfig: { region: "us-west-2" },
+ *     clientPlugins: [addFooHeadersPlugin],
+ *     roleAssumerWithWebIdentity: customRoleAssumer,
+ *     roleSessionName: "session_123",
+ *     providerId: "graph.facebook.com",
+ *     policyArns: [{ arn: "arn:aws:iam::1234567890:policy/SomePolicy" }],
+ *     policy: "{\"Statement\": [{\"Effect\": \"Allow\", \"Action\": \"s3:ListBucket\", \"Resource\": \"*\"}]}",
+ *     durationSeconds: 7200
+ *   }),
+ * });
+ * ```
+ */
+export declare function awsCredentialsProvider(init: AwsCredentialsProviderInit): AwsCredentialIdentityProvider;

package/dist/oidc/aws-credentials-provider.js

@@ -0,0 +1,47 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var aws_credentials_provider_exports = {};
+__export(aws_credentials_provider_exports, {
+  awsCredentialsProvider: () => awsCredentialsProvider
+});
+module.exports = __toCommonJS(aws_credentials_provider_exports);
+var import_get_vercel_oidc_token = require("./get-vercel-oidc-token");
+function awsCredentialsProvider(init) {
+  return async () => {
+    const { fromWebToken } = await import("@aws-sdk/credential-provider-web-identity");
+    return fromWebToken({
+      ...init,
+      webIdentityToken: await (0, import_get_vercel_oidc_token.getVercelOidcToken)()
+    })();
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  awsCredentialsProvider
+});

package/dist/oidc/get-vercel-oidc-token.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Returns the OIDC token from the request context or the environment variable.
+ *
+ * This function first checks if the OIDC token is available in the environment variable
+ * `VERCEL_OIDC_TOKEN`. If it is not found there, it retrieves the token from the request
+ * context headers.
+ *
+ * @async
+ * @function
+ * @returns {Promise<string>} A promise that resolves to the OIDC token.
+ * @throws {Error} If the `x-vercel-oidc-token` header is missing from the request context and the environment variable `VERCEL_OIDC_TOKEN` is not set.
+ *
+ * @example
+ * // Using the OIDC token
+ * getVercelOidcToken().then((token) => {
+ *   console.log('OIDC Token:', token);
+ * }).catch((error) => {
+ *   console.error('Error:', error.message);
+ * });
+ */
+export declare function getVercelOidcToken(): Promise<string>;

package/dist/oidc/get-vercel-oidc-token.js

@@ -0,0 +1,39 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var get_vercel_oidc_token_exports = {};
+__export(get_vercel_oidc_token_exports, {
+  getVercelOidcToken: () => getVercelOidcToken
+});
+module.exports = __toCommonJS(get_vercel_oidc_token_exports);
+var import_get_context = require("../get-context");
+async function getVercelOidcToken() {
+  if (process.env.VERCEL_OIDC_TOKEN)
+    return process.env.VERCEL_OIDC_TOKEN;
+  const token = (0, import_get_context.getContext)().headers?.["x-vercel-oidc-token"];
+  if (!token) {
+    throw new Error(
+      `The 'x-vercel-oidc-token' header is missing from the request. Do you have the OIDC option enabled in the Vercel project settings?`
+    );
+  }
+  return token;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getVercelOidcToken
+});

package/dist/oidc/index.d.ts

@@ -0,0 +1,3 @@
+export type { AwsCredentialsProviderInit } from './aws-credentials-provider';
+export { awsCredentialsProvider } from './aws-credentials-provider';
+export { getVercelOidcToken } from './get-vercel-oidc-token';

package/dist/oidc/index.js

@@ -0,0 +1,31 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var oidc_exports = {};
+__export(oidc_exports, {
+  awsCredentialsProvider: () => import_aws_credentials_provider.awsCredentialsProvider,
+  getVercelOidcToken: () => import_get_vercel_oidc_token.getVercelOidcToken
+});
+module.exports = __toCommonJS(oidc_exports);
+var import_aws_credentials_provider = require("./aws-credentials-provider");
+var import_get_vercel_oidc_token = require("./get-vercel-oidc-token");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  awsCredentialsProvider,
+  getVercelOidcToken
+});

package/dist/wait-until.d.ts

@@ -1,4 +1,3 @@
-export declare const SYMBOL_FOR_REQ_CONTEXT: unique symbol;
 /**
  * Extends the lifetime of the request handler for the lifetime of the given {@link Promise}
  * @see https://developer.mozilla.org/en-US/docs/Web/API/ExtendableEvent/waitUntil

package/dist/wait-until.js

@@ -18,25 +18,19 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var wait_until_exports = {};
 __export(wait_until_exports, {
-  SYMBOL_FOR_REQ_CONTEXT: () => SYMBOL_FOR_REQ_CONTEXT,
   waitUntil: () => waitUntil
 });
 module.exports = __toCommonJS(wait_until_exports);
-const SYMBOL_FOR_REQ_CONTEXT = Symbol.for("@vercel/request-context");
+var import_get_context = require("./get-context");
 const waitUntil = (promise) => {
   if (promise === null || typeof promise !== "object" || typeof promise.then !== "function") {
     throw new TypeError(
       `waitUntil can only be called with a Promise, got ${typeof promise}`
     );
   }
-  return getContext().waitUntil?.(promise);
+  return (0, import_get_context.getContext)().waitUntil?.(promise);
 };
-function getContext() {
-  const fromSymbol = globalThis;
-  return fromSymbol[SYMBOL_FOR_REQ_CONTEXT]?.get?.() ?? {};
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  SYMBOL_FOR_REQ_CONTEXT,
   waitUntil
 });

package/package.json

@@ -3,13 +3,20 @@
   "description": "Runtime functions to be used with your Vercel Functions",
   "homepage": "https://vercel.com",
   "exports": {
-    ".": "./dist/index.js"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./oidc": {
+      "types": "./dist/oidc/index.d.ts",
+      "default": "./dist/oidc/index.js"
+    }
   },
   "files": [
     "dist"
   ],
   "types": "./dist/index.d.ts",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "repository": {
     "directory": "packages/functions",
     "type": "git",
@@ -19,12 +26,23 @@
     "url": "https://github.com/vercel/vercel/issues"
   },
   "devDependencies": {
+    "@aws-sdk/client-s3": "3.609.0",
+    "@aws-sdk/credential-provider-web-identity": "3.609.0",
+    "@smithy/types": "3.3.0",
     "tinyspawn": "1.3.1",
     "typedoc": "0.24.6",
-    "typedoc-plugin-markdown": "3.15.2",
-    "typedoc-plugin-mdn-links": "3.0.3",
+    "typedoc-plugin-markdown": "4.1.2",
+    "typedoc-plugin-mdn-links": "3.2.3",
     "typescript": "4.9.5",
-    "vitest": "1.3.1"
+    "vitest": "2.0.1"
+  },
+  "peerDependencies": {
+    "@aws-sdk/credential-provider-web-identity": "*"
+  },
+  "peerDependenciesMeta": {
+    "@aws-sdk/credential-provider-web-identity": {
+      "optional": true
+    }
   },
   "engines": {
     "node": ">= 16"
@@ -34,9 +52,10 @@
     "access": "public"
   },
   "scripts": {
-    "pretest": "pnpm run build",
+    "pretest": "pnpm run build:code",
     "test": "vitest",
-    "build": "node ../../utils/build.mjs",
+    "build": "pnpm run build:code && pnpm run build:docs",
+    "build:code": "node ../../utils/build.mjs",
     "build:docs": "typedoc && prettier --write docs/**/*.md docs/*.md"
   }
 }