@webpieces/gcp-identity 0.3.316 → 0.3.318
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/src/index.d.ts +1 -1
- package/src/index.js +2 -1
- package/src/index.js.map +1 -1
- package/src/urls.d.ts +13 -0
- package/src/urls.js +20 -0
- package/src/urls.js.map +1 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@webpieces/gcp-identity",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.318",
|
|
4
4
|
"description": "GCP runtime identity: project/region metadata, Cloud Run URLs, OIDC mint/verify",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
"access": "public"
|
|
24
24
|
},
|
|
25
25
|
"dependencies": {
|
|
26
|
-
"@webpieces/core-util": "0.3.
|
|
26
|
+
"@webpieces/core-util": "0.3.318",
|
|
27
27
|
"google-auth-library": "9.15.1",
|
|
28
28
|
"gcp-metadata": "6.1.1"
|
|
29
29
|
}
|
package/src/index.d.ts
CHANGED
|
@@ -9,5 +9,5 @@
|
|
|
9
9
|
* via an app-bound AuthConfig) and the RPC + Cloud Tasks clients.
|
|
10
10
|
*/
|
|
11
11
|
export { isOnGcp } from './metadata';
|
|
12
|
-
export { getServiceName, getProjectId, getRegion, getRuntimeServiceAccountEmail, getSelfCloudRunUrl, getCloudRunUrl, LOCAL_SERVICE_ACCOUNT_EMAIL, } from './urls';
|
|
12
|
+
export { getServiceName, getProjectId, getRegion, getRuntimeServiceAccountEmail, getSelfCloudRunUrl, getCloudRunUrl, resolveTargetUrl, LOCAL_SERVICE_ACCOUNT_EMAIL, } from './urls';
|
|
13
13
|
export { mintIdToken, verifyOidcFromCallers, OidcVerifyResult } from './oidc';
|
package/src/index.js
CHANGED
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
* via an app-bound AuthConfig) and the RPC + Cloud Tasks clients.
|
|
11
11
|
*/
|
|
12
12
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
13
|
-
exports.OidcVerifyResult = exports.verifyOidcFromCallers = exports.mintIdToken = exports.LOCAL_SERVICE_ACCOUNT_EMAIL = exports.getCloudRunUrl = exports.getSelfCloudRunUrl = exports.getRuntimeServiceAccountEmail = exports.getRegion = exports.getProjectId = exports.getServiceName = exports.isOnGcp = void 0;
|
|
13
|
+
exports.OidcVerifyResult = exports.verifyOidcFromCallers = exports.mintIdToken = exports.LOCAL_SERVICE_ACCOUNT_EMAIL = exports.resolveTargetUrl = exports.getCloudRunUrl = exports.getSelfCloudRunUrl = exports.getRuntimeServiceAccountEmail = exports.getRegion = exports.getProjectId = exports.getServiceName = exports.isOnGcp = void 0;
|
|
14
14
|
var metadata_1 = require("./metadata");
|
|
15
15
|
Object.defineProperty(exports, "isOnGcp", { enumerable: true, get: function () { return metadata_1.isOnGcp; } });
|
|
16
16
|
var urls_1 = require("./urls");
|
|
@@ -20,6 +20,7 @@ Object.defineProperty(exports, "getRegion", { enumerable: true, get: function ()
|
|
|
20
20
|
Object.defineProperty(exports, "getRuntimeServiceAccountEmail", { enumerable: true, get: function () { return urls_1.getRuntimeServiceAccountEmail; } });
|
|
21
21
|
Object.defineProperty(exports, "getSelfCloudRunUrl", { enumerable: true, get: function () { return urls_1.getSelfCloudRunUrl; } });
|
|
22
22
|
Object.defineProperty(exports, "getCloudRunUrl", { enumerable: true, get: function () { return urls_1.getCloudRunUrl; } });
|
|
23
|
+
Object.defineProperty(exports, "resolveTargetUrl", { enumerable: true, get: function () { return urls_1.resolveTargetUrl; } });
|
|
23
24
|
Object.defineProperty(exports, "LOCAL_SERVICE_ACCOUNT_EMAIL", { enumerable: true, get: function () { return urls_1.LOCAL_SERVICE_ACCOUNT_EMAIL; } });
|
|
24
25
|
var oidc_1 = require("./oidc");
|
|
25
26
|
Object.defineProperty(exports, "mintIdToken", { enumerable: true, get: function () { return oidc_1.mintIdToken; } });
|
package/src/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/cloud/gcp-identity/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,+
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/cloud/gcp-identity/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,+BASgB;AARZ,sGAAA,cAAc,OAAA;AACd,oGAAA,YAAY,OAAA;AACZ,iGAAA,SAAS,OAAA;AACT,qHAAA,6BAA6B,OAAA;AAC7B,0GAAA,kBAAkB,OAAA;AAClB,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,mHAAA,2BAA2B,OAAA;AAE/B,+BAA8E;AAArE,mGAAA,WAAW,OAAA;AAAE,6GAAA,qBAAqB,OAAA;AAAE,wGAAA,gBAAgB,OAAA","sourcesContent":["/**\n * @webpieces/gcp-identity\n *\n * GCP runtime identity (Node-only). Metadata, Cloud Run URLs, and OIDC mint/verify,\n * all read from the metadata server / ADC at runtime with deterministic localhost\n * fallbacks off-GCP so local dev and tests never touch GCP.\n *\n * Underpins the @AuthOidc service-to-service auth mode (enforced by the framework AuthFilter\n * via an app-bound AuthConfig) and the RPC + Cloud Tasks clients.\n */\n\nexport { isOnGcp } from './metadata';\nexport {\n getServiceName,\n getProjectId,\n getRegion,\n getRuntimeServiceAccountEmail,\n getSelfCloudRunUrl,\n getCloudRunUrl,\n resolveTargetUrl,\n LOCAL_SERVICE_ACCOUNT_EMAIL,\n} from './urls';\nexport { mintIdToken, verifyOidcFromCallers, OidcVerifyResult } from './oidc';\n"]}
|
package/src/urls.d.ts
CHANGED
|
@@ -23,3 +23,16 @@ export declare function getSelfCloudRunUrl(): Promise<string>;
|
|
|
23
23
|
* via the CLOUD_RUN_URL_<UPPER_SNAKE_NAME> env var.
|
|
24
24
|
*/
|
|
25
25
|
export declare function getCloudRunUrl(serviceName: string): Promise<string>;
|
|
26
|
+
/**
|
|
27
|
+
* Resolve the base URL a client should call.
|
|
28
|
+
*
|
|
29
|
+
* We lookup your service in the same project, same region, and form the url from the container
|
|
30
|
+
* information unless you pass in a targetUrl, so you do not have to maintain targetUrls. This
|
|
31
|
+
* works across your demo, qa, prod environments as long as each environment is in its own
|
|
32
|
+
* projectId, which is typical.
|
|
33
|
+
*
|
|
34
|
+
* Supply `targetUrl` only to reach somewhere that lookup cannot describe — another region,
|
|
35
|
+
* another project, or a non-Cloud-Run host. It wins over `svcName`, which is then used purely
|
|
36
|
+
* as the logging name.
|
|
37
|
+
*/
|
|
38
|
+
export declare function resolveTargetUrl(svcName: string, targetUrl?: string): Promise<string>;
|
package/src/urls.js
CHANGED
|
@@ -7,6 +7,7 @@ exports.getRegion = getRegion;
|
|
|
7
7
|
exports.getRuntimeServiceAccountEmail = getRuntimeServiceAccountEmail;
|
|
8
8
|
exports.getSelfCloudRunUrl = getSelfCloudRunUrl;
|
|
9
9
|
exports.getCloudRunUrl = getCloudRunUrl;
|
|
10
|
+
exports.resolveTargetUrl = resolveTargetUrl;
|
|
10
11
|
const metadata_1 = require("./metadata");
|
|
11
12
|
/** Local fallback SA email used off-GCP so 'self' caller checks are deterministic. */
|
|
12
13
|
exports.LOCAL_SERVICE_ACCOUNT_EMAIL = 'local@localhost.invalid';
|
|
@@ -74,6 +75,25 @@ async function getCloudRunUrl(serviceName) {
|
|
|
74
75
|
const region = await (0, metadata_1.readRegion)();
|
|
75
76
|
return `https://${serviceName}-${numericProjectId}.${region}.run.app`;
|
|
76
77
|
}
|
|
78
|
+
/**
|
|
79
|
+
* Resolve the base URL a client should call.
|
|
80
|
+
*
|
|
81
|
+
* We lookup your service in the same project, same region, and form the url from the container
|
|
82
|
+
* information unless you pass in a targetUrl, so you do not have to maintain targetUrls. This
|
|
83
|
+
* works across your demo, qa, prod environments as long as each environment is in its own
|
|
84
|
+
* projectId, which is typical.
|
|
85
|
+
*
|
|
86
|
+
* Supply `targetUrl` only to reach somewhere that lookup cannot describe — another region,
|
|
87
|
+
* another project, or a non-Cloud-Run host. It wins over `svcName`, which is then used purely
|
|
88
|
+
* as the logging name.
|
|
89
|
+
*/
|
|
90
|
+
// webpieces-disable no-function-outside-class -- pure GCP url helper; every sibling in this module is a free function
|
|
91
|
+
async function resolveTargetUrl(svcName, targetUrl) {
|
|
92
|
+
if (targetUrl) {
|
|
93
|
+
return targetUrl;
|
|
94
|
+
}
|
|
95
|
+
return getCloudRunUrl(svcName);
|
|
96
|
+
}
|
|
77
97
|
function toEnvKey(serviceName) {
|
|
78
98
|
return serviceName.toUpperCase().replace(/[^A-Z0-9]+/g, '_');
|
|
79
99
|
}
|
package/src/urls.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"urls.js","sourceRoot":"","sources":["../../../../../packages/cloud/gcp-identity/src/urls.ts"],"names":[],"mappings":";;;AASA,wCAMC;AAGD,oCAKC;AAGD,8BAKC;AAGD,sEAKC;AAMD,gDASC;AAQD,wCAWC;
|
|
1
|
+
{"version":3,"file":"urls.js","sourceRoot":"","sources":["../../../../../packages/cloud/gcp-identity/src/urls.ts"],"names":[],"mappings":";;;AASA,wCAMC;AAGD,oCAKC;AAGD,8BAKC;AAGD,sEAKC;AAMD,gDASC;AAQD,wCAWC;AAeD,4CAKC;AA7FD,yCAAsH;AAEtH,sFAAsF;AACzE,QAAA,2BAA2B,GAAG,yBAAyB,CAAC;AAErE;;;GAGG;AACH,SAAgB,cAAc;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpF,CAAC;AAED,kDAAkD;AAC3C,KAAK,UAAU,YAAY;IAC9B,IAAI,CAAC,CAAC,MAAM,IAAA,kBAAO,GAAE,CAAC,EAAE,CAAC;QACrB,OAAO,eAAe,CAAC;IAC3B,CAAC;IACD,OAAO,IAAA,wBAAa,GAAE,CAAC;AAC3B,CAAC;AAED,4CAA4C;AACrC,KAAK,UAAU,SAAS;IAC3B,IAAI,CAAC,CAAC,MAAM,IAAA,kBAAO,GAAE,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,IAAA,qBAAU,GAAE,CAAC;AACxB,CAAC;AAED,8DAA8D;AACvD,KAAK,UAAU,6BAA6B;IAC/C,IAAI,CAAC,CAAC,MAAM,IAAA,kBAAO,GAAE,CAAC,EAAE,CAAC;QACrB,OAAO,mCAA2B,CAAC;IACvC,CAAC;IACD,OAAO,IAAA,yCAA8B,GAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,kBAAkB;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,IAAA,kBAAO,GAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QAC3C,OAAO,oBAAoB,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,IAAA,+BAAoB,GAAE,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAU,GAAE,CAAC;IAClC,OAAO,WAAW,QAAQ,IAAI,gBAAgB,IAAI,MAAM,UAAU,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,cAAc,CAAC,WAAmB;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,kBAAO,GAAE,CAAC,EAAE,CAAC;QACrB,OAAO,UAAU,WAAW,oBAAoB,CAAC;IACrD,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,IAAA,+BAAoB,GAAE,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAU,GAAE,CAAC;IAClC,OAAO,WAAW,WAAW,IAAI,gBAAgB,IAAI,MAAM,UAAU,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,sHAAsH;AAC/G,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAkB;IACtE,IAAI,SAAS,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,WAAmB;IACjC,OAAO,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import { isOnGcp, readNumericProjectId, readRegion, readProjectId, readRuntimeServiceAccountEmail } from './metadata';\n\n/** Local fallback SA email used off-GCP so 'self' caller checks are deterministic. */\nexport const LOCAL_SERVICE_ACCOUNT_EMAIL = 'local@localhost.invalid';\n\n/**\n * Logical service name from K_SERVICE (Cloud Run sets this), stripping a leading\n * 'tf-' Terraform prefix. Off-GCP returns 'local'. Synchronous — env only.\n */\nexport function getServiceName(): string {\n const kService = process.env['K_SERVICE'];\n if (!kService) {\n return 'local';\n }\n return kService.startsWith('tf-') ? kService.substring('tf-'.length) : kService;\n}\n\n/** GCP project id, or 'local-project' off-GCP. */\nexport async function getProjectId(): Promise<string> {\n if (!(await isOnGcp())) {\n return 'local-project';\n }\n return readProjectId();\n}\n\n/** Cloud Run region, or 'local' off-GCP. */\nexport async function getRegion(): Promise<string> {\n if (!(await isOnGcp())) {\n return 'local';\n }\n return readRegion();\n}\n\n/** The runtime SA email, or the local placeholder off-GCP. */\nexport async function getRuntimeServiceAccountEmail(): Promise<string> {\n if (!(await isOnGcp())) {\n return LOCAL_SERVICE_ACCOUNT_EMAIL;\n }\n return readRuntimeServiceAccountEmail();\n}\n\n/**\n * This service's own base URL (its Cloud Tasks self-enqueue target / public base).\n * Off-GCP → http://localhost:<PORT>.\n */\nexport async function getSelfCloudRunUrl(): Promise<string> {\n const kService = process.env['K_SERVICE'];\n if (!(await isOnGcp()) || !kService) {\n const port = process.env['PORT'] ?? '8080';\n return `http://localhost:${port}`;\n }\n const numericProjectId = await readNumericProjectId();\n const region = await readRegion();\n return `https://${kService}-${numericProjectId}.${region}.run.app`;\n}\n\n/**\n * Deterministic base URL for another Cloud Run service in the same project/region.\n * Off-GCP returns a non-routable placeholder (in-memory task/rpc dispatch never\n * actually fetches it during tests); a real local multi-service run can override\n * via the CLOUD_RUN_URL_<UPPER_SNAKE_NAME> env var.\n */\nexport async function getCloudRunUrl(serviceName: string): Promise<string> {\n const override = process.env[`CLOUD_RUN_URL_${toEnvKey(serviceName)}`];\n if (override) {\n return override;\n }\n if (!(await isOnGcp())) {\n return `http://${serviceName}.localhost.invalid`;\n }\n const numericProjectId = await readNumericProjectId();\n const region = await readRegion();\n return `https://${serviceName}-${numericProjectId}.${region}.run.app`;\n}\n\n/**\n * Resolve the base URL a client should call.\n *\n * We lookup your service in the same project, same region, and form the url from the container\n * information unless you pass in a targetUrl, so you do not have to maintain targetUrls. This\n * works across your demo, qa, prod environments as long as each environment is in its own\n * projectId, which is typical.\n *\n * Supply `targetUrl` only to reach somewhere that lookup cannot describe — another region,\n * another project, or a non-Cloud-Run host. It wins over `svcName`, which is then used purely\n * as the logging name.\n */\n// webpieces-disable no-function-outside-class -- pure GCP url helper; every sibling in this module is a free function\nexport async function resolveTargetUrl(svcName: string, targetUrl?: string): Promise<string> {\n if (targetUrl) {\n return targetUrl;\n }\n return getCloudRunUrl(svcName);\n}\n\nfunction toEnvKey(serviceName: string): string {\n return serviceName.toUpperCase().replace(/[^A-Z0-9]+/g, '_');\n}\n"]}
|