@xemahq/identity-client 0.9.7 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +85 -1
- package/dist/client.d.ts +10 -1
- package/dist/client.js +13 -0
- package/dist/client.js.map +1 -1
- package/dist/index.d.ts +4 -3
- package/dist/index.js +10 -1
- package/dist/index.js.map +1 -1
- package/dist/nestjs/identity-bootstrap.service.d.ts +12 -2
- package/dist/nestjs/identity-bootstrap.service.js +178 -79
- package/dist/nestjs/identity-bootstrap.service.js.map +1 -1
- package/dist/nestjs/index.d.ts +2 -1
- package/dist/nestjs/index.js +6 -1
- package/dist/nestjs/index.js.map +1 -1
- package/dist/nestjs/token-acquisition.d.ts +24 -0
- package/dist/nestjs/token-acquisition.js +96 -0
- package/dist/nestjs/token-acquisition.js.map +1 -0
- package/dist/types.d.ts +28 -0
- package/dist/types.js +6 -1
- package/dist/types.js.map +1 -1
- package/dist/workload-context.d.ts +27 -0
- package/dist/workload-context.js +122 -0
- package/dist/workload-context.js.map +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -150,6 +150,7 @@ IdentityBootstrapModule.forRootAsync({
|
|
|
150
150
|
maxRegistrationAttempts?: number; // Max retries (default: Infinity)
|
|
151
151
|
baseRetryDelay?: number; // Backoff base delay in ms (default: 5000)
|
|
152
152
|
maxRetryDelay?: number; // Backoff cap in ms (default: 300000)
|
|
153
|
+
tokenRequestTimeoutMs?: number; // Deadline per token-endpoint round trip in ms (default: 10000)
|
|
153
154
|
|
|
154
155
|
// Pre-configured credentials (skip auto-registration)
|
|
155
156
|
clientId?: string; // OAuth2 client_id
|
|
@@ -169,7 +170,13 @@ Manages service account lifecycle. Injected automatically when using `IdentityBo
|
|
|
169
170
|
```typescript
|
|
170
171
|
class IdentityBootstrapService {
|
|
171
172
|
// Get a valid JWT access token (cached, auto-refreshed)
|
|
172
|
-
getAccessToken(): Promise<string>;
|
|
173
|
+
getAccessToken(options?: { signal?: AbortSignal }): Promise<string>;
|
|
174
|
+
|
|
175
|
+
// Mint a tenant-scoped service token (cached, single-flight per scope)
|
|
176
|
+
getScopedAccessToken(
|
|
177
|
+
params: { scopedClaims: Record<string, string>; realm?: string },
|
|
178
|
+
options?: { signal?: AbortSignal },
|
|
179
|
+
): Promise<ScopedAccessToken>;
|
|
173
180
|
|
|
174
181
|
// Wait for registration to complete (with optional timeout)
|
|
175
182
|
waitForReady(timeoutMs?: number): Promise<boolean>;
|
|
@@ -190,6 +197,33 @@ class IdentityBootstrapService {
|
|
|
190
197
|
- Verifies credentials by obtaining an initial token
|
|
191
198
|
- Retries with exponential backoff on failure
|
|
192
199
|
|
|
200
|
+
**Cancellation and deadlines:**
|
|
201
|
+
|
|
202
|
+
Token refreshes and scoped mints are single-flight: concurrent callers share
|
|
203
|
+
one request. Two separate clocks govern them.
|
|
204
|
+
|
|
205
|
+
- `options.signal` ends **only that caller's wait**. It rejects the call with
|
|
206
|
+
`IdentityTokenWaitAbortedError` (`retryable: false`) and never cancels the
|
|
207
|
+
shared request, which keeps running for every other caller. An already-aborted
|
|
208
|
+
signal rejects before any request is started.
|
|
209
|
+
- `tokenRequestTimeoutMs` (default `DEFAULT_TOKEN_REQUEST_TIMEOUT_MS`, 10 000 ms)
|
|
210
|
+
bounds each token-endpoint round trip, body included. It governs the shared
|
|
211
|
+
request. When the endpoint does not answer in time, every waiter gets an
|
|
212
|
+
`IdentityTokenRequestTimeoutError` carrying `operation`, `timeoutMs` and
|
|
213
|
+
`endpoint`, and the miss is logged at warn. The failed request clears
|
|
214
|
+
itself, so the next caller starts a fresh one.
|
|
215
|
+
|
|
216
|
+
```typescript
|
|
217
|
+
import {
|
|
218
|
+
IdentityTokenWaitAbortedError,
|
|
219
|
+
IdentityTokenRequestTimeoutError,
|
|
220
|
+
} from '@xemahq/identity-client';
|
|
221
|
+
|
|
222
|
+
const token = await identityBootstrap.getAccessToken({
|
|
223
|
+
signal: AbortSignal.timeout(2_000), // this caller waits at most 2s
|
|
224
|
+
});
|
|
225
|
+
```
|
|
226
|
+
|
|
193
227
|
### IdentityApiClient
|
|
194
228
|
|
|
195
229
|
Standalone HTTP client for direct identity-api calls. Does not require NestJS.
|
|
@@ -282,6 +316,47 @@ try {
|
|
|
282
316
|
}
|
|
283
317
|
```
|
|
284
318
|
|
|
319
|
+
## Workload mode (attested identity, no client secret)
|
|
320
|
+
|
|
321
|
+
A workload that holds a platform attestation — a Kubernetes projected
|
|
322
|
+
ServiceAccount token, a SPIFFE JWT-SVID, an OIDC federated credential — can
|
|
323
|
+
obtain its own short-lived principal context from the identity boundary
|
|
324
|
+
instead of holding any client credential:
|
|
325
|
+
|
|
326
|
+
```typescript
|
|
327
|
+
import { fileCredentialReader } from '@xemahq/identity-client';
|
|
328
|
+
|
|
329
|
+
IdentityBootstrapModule.forRootAsync({
|
|
330
|
+
inject: [ConfigService],
|
|
331
|
+
useFactory: (config: ConfigService) => ({
|
|
332
|
+
identityApiInternalToken: '',
|
|
333
|
+
serviceName: 'report-worker',
|
|
334
|
+
serviceDisplayName: 'Report worker',
|
|
335
|
+
workloadContext: {
|
|
336
|
+
identityApiUrl: config.getOrThrow('IDENTITY_API_URL'),
|
|
337
|
+
realm: config.getOrThrow('IDENTITY_REALM'),
|
|
338
|
+
audience: 'platform', // a trust domain the realm declares
|
|
339
|
+
readCredential: fileCredentialReader('/var/run/secrets/tokens/identity'),
|
|
340
|
+
},
|
|
341
|
+
}),
|
|
342
|
+
});
|
|
343
|
+
```
|
|
344
|
+
|
|
345
|
+
`getAccessToken()` then returns the context, refreshed before it expires; the
|
|
346
|
+
attestation file is re-read on every refresh because the platform rotates it.
|
|
347
|
+
Every failure throws `WorkloadContextError` — nothing falls back to another
|
|
348
|
+
credential — and the provider-credential features (`getAccessTokenForAudience`,
|
|
349
|
+
`getScopedAccessToken`, `getUserAccessToken`, `mintScopedClaimToken`) refuse
|
|
350
|
+
in this mode. `isMember` and `listOrgIds` present the workload context to
|
|
351
|
+
identity-api, which accepts it when the realm declares an `internalTrustDomain`
|
|
352
|
+
and refuses it (thrown as `IdentityApiError`) when it does not. The workload must be bound to a
|
|
353
|
+
service principal (`WorkloadIdentityBinding`) or the boundary refuses it.
|
|
354
|
+
|
|
355
|
+
`WorkloadContextSource` is also exported for use without NestJS.
|
|
356
|
+
|
|
357
|
+
The provider client-credentials mode below is a declared migration state: it is
|
|
358
|
+
retired once every receiver trusts only the identity boundary.
|
|
359
|
+
|
|
285
360
|
## Pre-configured Credentials
|
|
286
361
|
|
|
287
362
|
For production multi-replica deployments, you can skip auto-registration by providing credentials via environment variables. This avoids the secret regeneration race condition when multiple pods start simultaneously.
|
|
@@ -317,6 +392,15 @@ export { IdentityBootstrapModule } from './nestjs';
|
|
|
317
392
|
export { IdentityBootstrapService } from './nestjs';
|
|
318
393
|
export { IDENTITY_BOOTSTRAP_CONFIG } from './nestjs';
|
|
319
394
|
|
|
395
|
+
// Token acquisition
|
|
396
|
+
export {
|
|
397
|
+
DEFAULT_TOKEN_REQUEST_TIMEOUT_MS,
|
|
398
|
+
IdentityTokenOperation,
|
|
399
|
+
IdentityTokenRequestTimeoutError,
|
|
400
|
+
IdentityTokenWaitAbortedError,
|
|
401
|
+
} from './nestjs';
|
|
402
|
+
export type { TokenAcquisitionOptions } from './nestjs';
|
|
403
|
+
|
|
320
404
|
// Types
|
|
321
405
|
export type {
|
|
322
406
|
IdentityApiClientOptions,
|
package/dist/client.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { CreateOrganizationRequest, EnsureSystemOrgRequest, EnsureSystemOrgResult, IdentityApiClientOptions, DelegatedPrincipalTokenRequest, DelegatedPrincipalTokenResponse, OnBehalfOfTokenRequest, OnBehalfOfTokenResponse, OrganizationListParams, OrganizationListResponse, OrganizationMemberListParams, OrganizationMemberListResponse, OrganizationRecord, RegisterServiceRequest, RegisterServiceResponse, ScopedClaimGrantRequest, ScopedClaimGrantResponse, ScopedClaimTokenRequest, ScopedClaimTokenResponse, ServiceCredentials, SystemOrgRecord, UpdateOrganizationRequest, VerifyMembershipResponse } from './types';
|
|
1
|
+
import type { CreateOrganizationRequest, EnsureSystemOrgRequest, EnsureSystemOrgResult, IdentityApiClientOptions, DelegatedPrincipalTokenRequest, DelegatedPrincipalTokenResponse, OnBehalfOfTokenRequest, OnBehalfOfTokenResponse, OrganizationListParams, OrganizationListResponse, OrganizationMemberListParams, OrganizationMemberListResponse, OrganizationRecord, RegisterServiceRequest, RegisterServiceResponse, CreateDelegationRequest, DelegatedContextResponse, DelegationRecordResponse, ScopedClaimGrantRequest, ScopedClaimGrantResponse, ScopedClaimTokenRequest, ScopedClaimTokenResponse, ServiceCredentials, SystemOrgRecord, UpdateOrganizationRequest, VerifyMembershipResponse } from './types';
|
|
2
2
|
export declare class IdentityApiClient {
|
|
3
3
|
private readonly baseUrl;
|
|
4
4
|
private readonly internalToken;
|
|
@@ -16,6 +16,7 @@ export declare class IdentityApiClient {
|
|
|
16
16
|
getSystemOrg(name: string): Promise<SystemOrgRecord>;
|
|
17
17
|
listOrgIds(realm: string): Promise<string[]>;
|
|
18
18
|
listOrganizations(realm: string, params?: OrganizationListParams): Promise<OrganizationListResponse>;
|
|
19
|
+
listPrincipalOrganizations(principalId: string, realm?: string): Promise<OrganizationRecord[]>;
|
|
19
20
|
getOrganization(id: string, realm: string): Promise<OrganizationRecord>;
|
|
20
21
|
createOrganization(input: CreateOrganizationRequest): Promise<OrganizationRecord>;
|
|
21
22
|
updateOrganization(id: string, input: UpdateOrganizationRequest): Promise<OrganizationRecord>;
|
|
@@ -25,6 +26,14 @@ export declare class IdentityApiClient {
|
|
|
25
26
|
grantScopedClaim(request: ScopedClaimGrantRequest): Promise<ScopedClaimGrantResponse>;
|
|
26
27
|
revokeScopedClaim(request: ScopedClaimGrantRequest): Promise<void>;
|
|
27
28
|
mintScopedClaimToken(request: ScopedClaimTokenRequest): Promise<ScopedClaimTokenResponse>;
|
|
29
|
+
createDelegation(request: CreateDelegationRequest): Promise<DelegationRecordResponse>;
|
|
30
|
+
mintDelegatedContext(delegationId: string, audience: string, realm?: string): Promise<DelegatedContextResponse>;
|
|
31
|
+
revokeDelegation(delegationId: string, options?: {
|
|
32
|
+
subjectContext?: string;
|
|
33
|
+
realm?: string;
|
|
34
|
+
}): Promise<{
|
|
35
|
+
revoked: number;
|
|
36
|
+
}>;
|
|
28
37
|
private get;
|
|
29
38
|
private post;
|
|
30
39
|
private patch;
|
package/dist/client.js
CHANGED
|
@@ -112,6 +112,10 @@ class IdentityApiClient {
|
|
|
112
112
|
}
|
|
113
113
|
return this.getEnvelope(`/internal/organizations?${search.toString()}`);
|
|
114
114
|
}
|
|
115
|
+
async listPrincipalOrganizations(principalId, realm) {
|
|
116
|
+
const query = realm ? `?realm=${encodeURIComponent(realm)}` : '';
|
|
117
|
+
return this.get(`/internal/principals/${encodeURIComponent(principalId)}/organizations${query}`);
|
|
118
|
+
}
|
|
115
119
|
async getOrganization(id, realm) {
|
|
116
120
|
const search = new URLSearchParams({ realm });
|
|
117
121
|
return this.get(`/internal/organizations/${encodeURIComponent(id)}?${search.toString()}`);
|
|
@@ -141,6 +145,15 @@ class IdentityApiClient {
|
|
|
141
145
|
async mintScopedClaimToken(request) {
|
|
142
146
|
return this.post('/internal/scoped-claim-authority/tokens', request);
|
|
143
147
|
}
|
|
148
|
+
async createDelegation(request) {
|
|
149
|
+
return this.post('/internal/delegations', request);
|
|
150
|
+
}
|
|
151
|
+
async mintDelegatedContext(delegationId, audience, realm) {
|
|
152
|
+
return this.post(`/internal/delegations/${encodeURIComponent(delegationId)}/context`, { audience, ...(realm ? { realm } : {}) });
|
|
153
|
+
}
|
|
154
|
+
async revokeDelegation(delegationId, options = {}) {
|
|
155
|
+
return this.post(`/internal/delegations/${encodeURIComponent(delegationId)}/revoke`, options);
|
|
156
|
+
}
|
|
144
157
|
async get(path) {
|
|
145
158
|
const response = await this.request('GET', path);
|
|
146
159
|
const envelope = (await response.json());
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAmDA,MAAa,iBAAiB;IACX,OAAO,CAAgB;IACvB,aAAa,CAAS;IACtB,SAAS,CAAS;IAClB,oBAAoB,CAEvB;IACG,0BAA0B,CAAU;IAErD,YAAY,OAAiC;QAM3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;QAC3D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,0BAA0B;YAC7B,OAAO,CAAC,0BAA0B,IAAI,KAAK,CAAC;IAChD,CAAC;IAqCO,KAAK,CAAC,aAAa,CACzB,UAAgC,EAChC,MAAc,EACd,IAAY;QAEZ,IAAI,UAAU,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAGvD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,MAAM,IAAI,IAAI,sCAAsC;YAClE,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,0BAA0B,EAC5B,CAAC,CACF,CAAC;IACJ,CAAC;IAaO,qBAAqB,CAAC,OAA+B;QAC3D,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,aAAa,CAAU,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,gBAAgB,CACxB,8DAA8D;oBAC5D,IAAI,KAAK,qCACP,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAC1D,yDAAyD;oBACzD,mCAAmC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,GAAG;oBAC/E,kDAAkD,EACpD,CAAC,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAOD,KAAK,CAAC,eAAe,CACnB,OAA+B;QAE/B,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAA2B;YACnC,WAAW,EAAE,SAAS;YACtB,GAAG,OAAO;SACX,CAAC;QAIF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAC9B,6BAA6B,EAC7B,IAAI,EACJ,WAAW,CACZ,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACvB,OAA+B;QAE/B,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAA2B;YACnC,WAAW,EAAE,SAAS;YACtB,GAAG,OAAO;SACX,CAAC;QAMF,OAAO,IAAI,CAAC,IAAI,CACd,6BAA6B,EAC7B,IAAI,EACJ,WAAW,CACZ,CAAC;IACJ,CAAC;IAOD,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,KAAa,EACb,KAAc;QAEd,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CACb,+BAA+B,MAAM,CAAC,QAAQ,EAAE,EAAE,CACnD,CAAC;IACJ,CAAC;IA2BD,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EACb,MAAqC;QAErC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,WAAW,CAIrB,2BAA2B,kBAAkB,CAAC,KAAK,CAAC,WAClD,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EACxB,EAAE,CACH,CAAC;IACJ,CAAC;IAOD,KAAK,CAAC,eAAe,CACnB,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,uCAAuC,EACvC,OAAO,CACR,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,GAAG,CACb,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IAUD,KAAK,CAAC,UAAU,CAAC,KAAa;QAQ5B,OAAO,IAAI,CAAC,GAAG,CACb,yCAAyC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IAWD,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,MAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CACrB,2BAA2B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAC/C,CAAC;IACJ,CAAC;IAWD,KAAK,CAAC,0BAA0B,CAC9B,WAAmB,EACnB,KAAc;QAEd,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CACb,wBAAwB,kBAAkB,CAAC,WAAW,CAAC,iBAAiB,KAAK,EAAE,CAChF,CAAC;IACJ,CAAC;IASD,KAAK,CAAC,eAAe,CACnB,EAAU,EACV,KAAa;QAEb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,GAAG,CACb,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CACzE,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,kBAAkB,CACtB,KAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CAAqB,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IASD,KAAK,CAAC,kBAAkB,CACtB,EAAU,EACV,KAAgC;QAEhC,OAAO,IAAI,CAAC,KAAK,CACf,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EACnD,KAAK,CACN,CAAC;IACJ,CAAC;IAQD,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,KAAa;QAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,OAAO,CAChB,QAAQ,EACR,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CACzE,CAAC;IACJ,CAAC;IAUD,KAAK,CAAC,mBAAmB,CACvB,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,+BAA+B,EAC/B,OAAO,CACR,CAAC;IACJ,CAAC;IAaD,KAAK,CAAC,2BAA2B,CAC/B,OAAuC;QAEvC,OAAO,IAAI,CAAC,IAAI,CACd,sCAAsC,EACtC,OAAO,CACR,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,gBAAgB,CACpB,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CACd,yCAAyC,EACzC,OAAO,EACP,WAAW,CACZ,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,iBAAiB,CAAC,OAAgC;QACtD,MAAM,IAAI,CAAC,OAAO,CAChB,MAAM,EACN,oDAAoD,EACpD,OAAO,EACP,WAAW,CACZ,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,oBAAoB,CACxB,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CACd,yCAAyC,EACzC,OAAO,CACR,CAAC;IACJ,CAAC;IASD,KAAK,CAAC,gBAAgB,CACpB,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CAA2B,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAOD,KAAK,CAAC,oBAAoB,CACxB,YAAoB,EACpB,QAAgB,EAChB,KAAc;QAEd,OAAO,IAAI,CAAC,IAAI,CACd,yBAAyB,kBAAkB,CAAC,YAAY,CAAC,UAAU,EACnE,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC1C,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,UAAuD,EAAE;QAEzD,OAAO,IAAI,CAAC,IAAI,CACd,yBAAyB,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAClE,OAAO,CACR,CAAC;IACJ,CAAC;IAIO,KAAK,CAAC,GAAG,CAAI,IAAY;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;QAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,IAAa,EACb,aAAmC,SAAS;QAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;QAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAa;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;QAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAMO,KAAK,CAAC,WAAW,CACvB,IAAY;QAEZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAc,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,aAAmC,SAAS;QAE5C,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,4BAA4B,MAAM,IAAI,IAAI,yBAAyB;gBACjE,8DAA8D;gBAC9D,sEAAsE;gBACtE,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM;gBACN,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAKnD,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,MAAM,IAAI,IAAI,YAAY,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE;oBAChF,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAC9B,QAAQ,CAAC,MAAM,EACf,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBAAA,MAAM,KAAK,CAAC;YAAA,CAAC;YACrD,IAAK,KAAe,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC3C,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,MAAM,IAAI,IAAI,oBAAoB,IAAI,CAAC,SAAS,IAAI,EACpE,CAAC,CACF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,MAAM,IAAI,IAAI,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClG,CAAC,CACF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAtlBD,8CAslBC;AAUD,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,GAAG,OAAO,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;QAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IACD,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,MAAM,OAAO,EAAE,CAAC;AACzB,CAAC;AAGD,MAAa,gBAAiB,SAAQ,KAAK;IAGvB;IACA;IAHlB,YACE,OAAe,EACC,UAAkB,EAClB,YAAqB;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,eAAU,GAAV,UAAU,CAAQ;QAClB,iBAAY,GAAZ,YAAY,CAAS;QAGrC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AATD,4CASC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
export { PRINCIPAL_ID_CLAIM, CREDENTIAL_REVISION_CLAIM, } from './claims';
|
|
2
2
|
export { IdentityApiClient, IdentityApiError } from './client';
|
|
3
|
-
export {
|
|
4
|
-
export
|
|
5
|
-
export {
|
|
3
|
+
export { WorkloadContextError, WorkloadContextSource, fileCredentialReader, type WorkloadContextConfig, } from './workload-context';
|
|
4
|
+
export { DelegationActorKind, InternalTokenScope, OrgRole, ORG_ADMIN_ROLES, SystemOrgEnsureOutcome, } from './types';
|
|
5
|
+
export type { ApiEnvelope, CreateDelegationRequest, CreateOrganizationRequest, DelegatedContextResponse, DelegationRecordResponse, DelegatedPrincipalTokenRequest, DelegatedPrincipalTokenResponse, EnsureSystemOrgRequest, EnsureSystemOrgResult, IdentityApiClientOptions, OrganizationListPagination, OrganizationListParams, OrganizationListResponse, OrganizationMemberListParams, OrganizationMemberListResponse, OrganizationDirectoryEntry, OrganizationRecord, OnBehalfOfTokenRequest, OnBehalfOfTokenResponse, RegisterServiceRequest, RegisterServiceResponse, ServiceCredentials, ServiceType, SystemOrgRecord, ScopedClaimGrantRequest, ScopedClaimGrantResponse, ScopedClaimTokenRequest, ScopedClaimTokenResponse, UpdateOrganizationRequest, VerifyMembershipParams, VerifyMembershipResponse, } from './types';
|
|
6
|
+
export { IdentityBootstrapModule, IdentityBootstrapModuleAsyncOptions, IdentityBootstrapService, IdentityBootstrapConfig, IDENTITY_BOOTSTRAP_CONFIG, type ScopedAccessToken, type TokenAcquisitionOptions, DEFAULT_TOKEN_REQUEST_TIMEOUT_MS, IdentityTokenOperation, IdentityTokenRequestTimeoutError, IdentityTokenWaitAbortedError, } from './nestjs';
|
|
6
7
|
export { OrgAuthModule, OrgAdminGuard, ORG_AUTH_CONFIG, type OrgAuthConfig, type OrgAuthModuleAsyncOptions, } from './nestjs';
|
package/dist/index.js
CHANGED
|
@@ -1,13 +1,18 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.ORG_AUTH_CONFIG = exports.OrgAdminGuard = exports.OrgAuthModule = exports.IDENTITY_BOOTSTRAP_CONFIG = exports.IdentityBootstrapService = exports.IdentityBootstrapModule = exports.SystemOrgEnsureOutcome = exports.ORG_ADMIN_ROLES = exports.OrgRole = exports.InternalTokenScope = exports.IdentityApiError = exports.IdentityApiClient = exports.CREDENTIAL_REVISION_CLAIM = exports.PRINCIPAL_ID_CLAIM = void 0;
|
|
3
|
+
exports.ORG_AUTH_CONFIG = exports.OrgAdminGuard = exports.OrgAuthModule = exports.IdentityTokenWaitAbortedError = exports.IdentityTokenRequestTimeoutError = exports.IdentityTokenOperation = exports.DEFAULT_TOKEN_REQUEST_TIMEOUT_MS = exports.IDENTITY_BOOTSTRAP_CONFIG = exports.IdentityBootstrapService = exports.IdentityBootstrapModule = exports.SystemOrgEnsureOutcome = exports.ORG_ADMIN_ROLES = exports.OrgRole = exports.InternalTokenScope = exports.DelegationActorKind = exports.fileCredentialReader = exports.WorkloadContextSource = exports.WorkloadContextError = exports.IdentityApiError = exports.IdentityApiClient = exports.CREDENTIAL_REVISION_CLAIM = exports.PRINCIPAL_ID_CLAIM = void 0;
|
|
4
4
|
var claims_1 = require("./claims");
|
|
5
5
|
Object.defineProperty(exports, "PRINCIPAL_ID_CLAIM", { enumerable: true, get: function () { return claims_1.PRINCIPAL_ID_CLAIM; } });
|
|
6
6
|
Object.defineProperty(exports, "CREDENTIAL_REVISION_CLAIM", { enumerable: true, get: function () { return claims_1.CREDENTIAL_REVISION_CLAIM; } });
|
|
7
7
|
var client_1 = require("./client");
|
|
8
8
|
Object.defineProperty(exports, "IdentityApiClient", { enumerable: true, get: function () { return client_1.IdentityApiClient; } });
|
|
9
9
|
Object.defineProperty(exports, "IdentityApiError", { enumerable: true, get: function () { return client_1.IdentityApiError; } });
|
|
10
|
+
var workload_context_1 = require("./workload-context");
|
|
11
|
+
Object.defineProperty(exports, "WorkloadContextError", { enumerable: true, get: function () { return workload_context_1.WorkloadContextError; } });
|
|
12
|
+
Object.defineProperty(exports, "WorkloadContextSource", { enumerable: true, get: function () { return workload_context_1.WorkloadContextSource; } });
|
|
13
|
+
Object.defineProperty(exports, "fileCredentialReader", { enumerable: true, get: function () { return workload_context_1.fileCredentialReader; } });
|
|
10
14
|
var types_1 = require("./types");
|
|
15
|
+
Object.defineProperty(exports, "DelegationActorKind", { enumerable: true, get: function () { return types_1.DelegationActorKind; } });
|
|
11
16
|
Object.defineProperty(exports, "InternalTokenScope", { enumerable: true, get: function () { return types_1.InternalTokenScope; } });
|
|
12
17
|
Object.defineProperty(exports, "OrgRole", { enumerable: true, get: function () { return types_1.OrgRole; } });
|
|
13
18
|
Object.defineProperty(exports, "ORG_ADMIN_ROLES", { enumerable: true, get: function () { return types_1.ORG_ADMIN_ROLES; } });
|
|
@@ -16,6 +21,10 @@ var nestjs_1 = require("./nestjs");
|
|
|
16
21
|
Object.defineProperty(exports, "IdentityBootstrapModule", { enumerable: true, get: function () { return nestjs_1.IdentityBootstrapModule; } });
|
|
17
22
|
Object.defineProperty(exports, "IdentityBootstrapService", { enumerable: true, get: function () { return nestjs_1.IdentityBootstrapService; } });
|
|
18
23
|
Object.defineProperty(exports, "IDENTITY_BOOTSTRAP_CONFIG", { enumerable: true, get: function () { return nestjs_1.IDENTITY_BOOTSTRAP_CONFIG; } });
|
|
24
|
+
Object.defineProperty(exports, "DEFAULT_TOKEN_REQUEST_TIMEOUT_MS", { enumerable: true, get: function () { return nestjs_1.DEFAULT_TOKEN_REQUEST_TIMEOUT_MS; } });
|
|
25
|
+
Object.defineProperty(exports, "IdentityTokenOperation", { enumerable: true, get: function () { return nestjs_1.IdentityTokenOperation; } });
|
|
26
|
+
Object.defineProperty(exports, "IdentityTokenRequestTimeoutError", { enumerable: true, get: function () { return nestjs_1.IdentityTokenRequestTimeoutError; } });
|
|
27
|
+
Object.defineProperty(exports, "IdentityTokenWaitAbortedError", { enumerable: true, get: function () { return nestjs_1.IdentityTokenWaitAbortedError; } });
|
|
19
28
|
var nestjs_2 = require("./nestjs");
|
|
20
29
|
Object.defineProperty(exports, "OrgAuthModule", { enumerable: true, get: function () { return nestjs_2.OrgAuthModule; } });
|
|
21
30
|
Object.defineProperty(exports, "OrgAdminGuard", { enumerable: true, get: function () { return nestjs_2.OrgAdminGuard; } });
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,mCAGkB;AAFhB,4GAAA,kBAAkB,OAAA;AAClB,mHAAA,yBAAyB,OAAA;AAE3B,mCAA+D;AAAtD,2GAAA,iBAAiB,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AAC5C,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,mCAGkB;AAFhB,4GAAA,kBAAkB,OAAA;AAClB,mHAAA,yBAAyB,OAAA;AAE3B,mCAA+D;AAAtD,2GAAA,iBAAiB,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AAC5C,uDAK4B;AAJ1B,wHAAA,oBAAoB,OAAA;AACpB,yHAAA,qBAAqB,OAAA;AACrB,wHAAA,oBAAoB,OAAA;AAGtB,iCAMiB;AALf,4GAAA,mBAAmB,OAAA;AACnB,2GAAA,kBAAkB,OAAA;AAClB,gGAAA,OAAO,OAAA;AACP,wGAAA,eAAe,OAAA;AACf,+GAAA,sBAAsB,OAAA;AAqCxB,mCAYkB;AAXhB,iHAAA,uBAAuB,OAAA;AAEvB,kHAAA,wBAAwB,OAAA;AAExB,mHAAA,yBAAyB,OAAA;AAGzB,0HAAA,gCAAgC,OAAA;AAChC,gHAAA,sBAAsB,OAAA;AACtB,0HAAA,gCAAgC,OAAA;AAChC,uHAAA,6BAA6B,OAAA;AAI/B,mCAMkB;AALhB,uGAAA,aAAa,OAAA;AACb,uGAAA,aAAa,OAAA;AACb,yGAAA,eAAe,OAAA"}
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { OnModuleInit, OnModuleDestroy } from '@nestjs/common';
|
|
2
2
|
import { type ScopedClaimTokenRequest, type ScopedClaimTokenResponse } from '../types';
|
|
3
|
+
import { type WorkloadContextConfig } from '../workload-context';
|
|
3
4
|
export declare const IDENTITY_BOOTSTRAP_CONFIG: unique symbol;
|
|
4
5
|
export declare enum IdentityBringUpState {
|
|
5
6
|
NotStarted = "not_started",
|
|
@@ -9,6 +10,7 @@ export declare enum IdentityBringUpState {
|
|
|
9
10
|
Exhausted = "exhausted"
|
|
10
11
|
}
|
|
11
12
|
export interface IdentityBootstrapConfig {
|
|
13
|
+
workloadContext?: WorkloadContextConfig;
|
|
12
14
|
identityApiUrl?: string;
|
|
13
15
|
identityApiInternalToken: string;
|
|
14
16
|
serviceName: string;
|
|
@@ -24,6 +26,10 @@ export interface IdentityBootstrapConfig {
|
|
|
24
26
|
maxRegistrationAttempts?: number;
|
|
25
27
|
baseRetryDelay?: number;
|
|
26
28
|
maxRetryDelay?: number;
|
|
29
|
+
tokenRequestTimeoutMs?: number;
|
|
30
|
+
}
|
|
31
|
+
export interface TokenAcquisitionOptions {
|
|
32
|
+
signal?: AbortSignal;
|
|
27
33
|
}
|
|
28
34
|
export interface ScopedAccessToken {
|
|
29
35
|
accessToken: string;
|
|
@@ -33,6 +39,7 @@ export declare class IdentityBootstrapService implements OnModuleInit, OnModuleD
|
|
|
33
39
|
private readonly config;
|
|
34
40
|
private readonly logger;
|
|
35
41
|
private readonly client;
|
|
42
|
+
private readonly workload;
|
|
36
43
|
private clientId;
|
|
37
44
|
private clientSecret;
|
|
38
45
|
private tokenEndpoint;
|
|
@@ -57,6 +64,7 @@ export declare class IdentityBootstrapService implements OnModuleInit, OnModuleD
|
|
|
57
64
|
private readonly maxRegistrationAttempts;
|
|
58
65
|
private readonly baseRetryDelay;
|
|
59
66
|
private readonly maxRetryDelay;
|
|
67
|
+
private readonly tokenRequestTimeoutMs;
|
|
60
68
|
private readyResolve;
|
|
61
69
|
private readyPromise;
|
|
62
70
|
private bringUpState;
|
|
@@ -69,7 +77,7 @@ export declare class IdentityBootstrapService implements OnModuleInit, OnModuleD
|
|
|
69
77
|
private bringUpIdentity;
|
|
70
78
|
private performBringUp;
|
|
71
79
|
onModuleDestroy(): void;
|
|
72
|
-
getAccessToken(): Promise<string>;
|
|
80
|
+
getAccessToken(options?: TokenAcquisitionOptions): Promise<string>;
|
|
73
81
|
getAccessTokenForAudience(audience: string): Promise<string>;
|
|
74
82
|
private mintExactAudienceToken;
|
|
75
83
|
getUserAccessToken(params: {
|
|
@@ -84,7 +92,7 @@ export declare class IdentityBootstrapService implements OnModuleInit, OnModuleD
|
|
|
84
92
|
getScopedAccessToken(params: {
|
|
85
93
|
scopedClaims: Record<string, string>;
|
|
86
94
|
realm?: string;
|
|
87
|
-
}): Promise<ScopedAccessToken>;
|
|
95
|
+
}, options?: TokenAcquisitionOptions): Promise<ScopedAccessToken>;
|
|
88
96
|
private mintScopedAccessToken;
|
|
89
97
|
private buildRealmTokenEndpoint;
|
|
90
98
|
private canonicalizeScopedClaims;
|
|
@@ -101,12 +109,14 @@ export declare class IdentityBootstrapService implements OnModuleInit, OnModuleD
|
|
|
101
109
|
private resolveUserTokenRealm;
|
|
102
110
|
private scheduleRetry;
|
|
103
111
|
private clientSecretWasSelfRegistered;
|
|
112
|
+
private boundedTokenRequest;
|
|
104
113
|
private refreshToken;
|
|
105
114
|
private refreshTokenWithRecovery;
|
|
106
115
|
private fetchCurrentCredentials;
|
|
107
116
|
private requireIdentityApiUrl;
|
|
108
117
|
private checkCredentialRecoveryState;
|
|
109
118
|
private recordCredentialRecovery;
|
|
119
|
+
private refuseInWorkloadMode;
|
|
110
120
|
private markReady;
|
|
111
121
|
private markAttemptFailed;
|
|
112
122
|
private markExhausted;
|