@xemahq/temporal-runtime 0.8.0 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -16
- package/dist/bin/controller-token-publisher.js +2 -2
- package/dist/bin/controller-token-publisher.js.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -2
- package/dist/index.js.map +1 -1
- package/dist/lib/access-token.d.ts +1 -1
- package/dist/lib/access-token.d.ts.map +1 -1
- package/dist/lib/access-token.js +5 -7
- package/dist/lib/access-token.js.map +1 -1
- package/dist/lib/biome-worker.d.ts.map +1 -1
- package/dist/lib/biome-worker.js +10 -1
- package/dist/lib/biome-worker.js.map +1 -1
- package/dist/lib/bounded-retry.d.ts +5 -0
- package/dist/lib/bounded-retry.d.ts.map +1 -1
- package/dist/lib/bounded-retry.js +10 -1
- package/dist/lib/bounded-retry.js.map +1 -1
- package/dist/lib/connection.d.ts +6 -10
- package/dist/lib/connection.d.ts.map +1 -1
- package/dist/lib/connection.js +23 -21
- package/dist/lib/connection.js.map +1 -1
- package/dist/lib/controller-token-publisher.d.ts +3 -2
- package/dist/lib/controller-token-publisher.d.ts.map +1 -1
- package/dist/lib/controller-token-publisher.js +5 -5
- package/dist/lib/controller-token-publisher.js.map +1 -1
- package/dist/lib/nexus-constants.d.ts +1 -0
- package/dist/lib/nexus-constants.d.ts.map +1 -1
- package/dist/lib/nexus-constants.js +2 -1
- package/dist/lib/nexus-constants.js.map +1 -1
- package/dist/lib/nexus-handler.d.ts +9 -1
- package/dist/lib/nexus-handler.d.ts.map +1 -1
- package/dist/lib/nexus-handler.js +22 -13
- package/dist/lib/nexus-handler.js.map +1 -1
- package/dist/lib/proactive-token-refresher.d.ts.map +1 -1
- package/dist/lib/proactive-token-refresher.js +5 -0
- package/dist/lib/proactive-token-refresher.js.map +1 -1
- package/dist/lib/workflow-credential-token-source.d.ts +24 -0
- package/dist/lib/workflow-credential-token-source.d.ts.map +1 -0
- package/dist/lib/workflow-credential-token-source.js +74 -0
- package/dist/lib/workflow-credential-token-source.js.map +1 -0
- package/package.json +9 -6
- package/dist/lib/client-credentials-token-source.d.ts +0 -23
- package/dist/lib/client-credentials-token-source.d.ts.map +0 -1
- package/dist/lib/client-credentials-token-source.js +0 -108
- package/dist/lib/client-credentials-token-source.js.map +0 -1
|
@@ -2,6 +2,7 @@ import type { AccessTokenSource } from './access-token';
|
|
|
2
2
|
import type { RetryClock } from './bounded-retry';
|
|
3
3
|
import type { TemporalEnvReader } from './namespace';
|
|
4
4
|
import { ProactiveTokenRefresher, type AccessTokenListener, type TokenRefresherLogger } from './proactive-token-refresher';
|
|
5
|
+
import { type WorkflowCredentialDeps } from './workflow-credential-token-source';
|
|
5
6
|
export declare const CONTROLLER_TOKEN_PUBLISHER_ENV: {
|
|
6
7
|
readonly secretName: "XEMA_TEMPORAL_CONTROLLER_TOKEN_SECRET";
|
|
7
8
|
readonly secretKey: "XEMA_TEMPORAL_CONTROLLER_TOKEN_KEY";
|
|
@@ -36,10 +37,10 @@ export declare class ControllerTokenSinkError extends Error {
|
|
|
36
37
|
export declare function kubernetesSecretTokenSink(target: KubernetesSecretTarget, deps?: KubernetesSecretSinkDeps): AccessTokenListener;
|
|
37
38
|
export interface ControllerTokenPublisherOptions {
|
|
38
39
|
readonly source: AccessTokenSource;
|
|
39
|
-
readonly
|
|
40
|
+
readonly description: string;
|
|
40
41
|
readonly target: KubernetesSecretTarget;
|
|
41
42
|
}
|
|
42
|
-
export declare function controllerTokenPublisherOptionsFromEnv(env: TemporalEnvReader, deps?: {
|
|
43
|
+
export declare function controllerTokenPublisherOptionsFromEnv(env: TemporalEnvReader, deps?: WorkflowCredentialDeps & {
|
|
43
44
|
readonly readFile?: (path: string) => Promise<string>;
|
|
44
45
|
readonly serviceAccountDir?: string;
|
|
45
46
|
}): Promise<ControllerTokenPublisherOptions>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"controller-token-publisher.d.ts","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"controller-token-publisher.d.ts","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,oCAAoC,CAAC;AAwB5C,eAAO,MAAM,8BAA8B;;;;;CAKjC,CAAC;AAGX,eAAO,MAAM,8BAA8B,kDAAkD,CAAC;AAG9F,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACvC;AAOD,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAoCD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,GAAE,wBAA6B,GAClC,mBAAmB,CAyBrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAEnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AAUD,wBAAsB,sCAAsC,CAC1D,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE,sBAAsB,GAAG;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAChC,GACL,OAAO,CAAC,+BAA+B,CAAC,CAwB1C;AASD,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,+BAA+B,EACxC,IAAI,GAAE,wBAAwB,GAAG;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CACxB,GACL,OAAO,CAAC,uBAAuB,CAAC,CAelC"}
|
|
@@ -6,9 +6,9 @@ exports.controllerTokenPublisherOptionsFromEnv = controllerTokenPublisherOptions
|
|
|
6
6
|
exports.startControllerTokenPublisher = startControllerTokenPublisher;
|
|
7
7
|
const promises_1 = require("node:fs/promises");
|
|
8
8
|
const node_https_1 = require("node:https");
|
|
9
|
-
const client_credentials_token_source_1 = require("./client-credentials-token-source");
|
|
10
9
|
const connection_1 = require("./connection");
|
|
11
10
|
const proactive_token_refresher_1 = require("./proactive-token-refresher");
|
|
11
|
+
const workflow_credential_token_source_1 = require("./workflow-credential-token-source");
|
|
12
12
|
exports.CONTROLLER_TOKEN_PUBLISHER_ENV = {
|
|
13
13
|
secretName: 'XEMA_TEMPORAL_CONTROLLER_TOKEN_SECRET',
|
|
14
14
|
secretKey: 'XEMA_TEMPORAL_CONTROLLER_TOKEN_KEY',
|
|
@@ -71,7 +71,7 @@ function kubernetesSecretTokenSink(target, deps = {}) {
|
|
|
71
71
|
};
|
|
72
72
|
}
|
|
73
73
|
async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
|
|
74
|
-
const credentials = (0, connection_1.
|
|
74
|
+
const credentials = (0, connection_1.temporalWorkflowCredentialFromEnv)(env);
|
|
75
75
|
const required = (name) => {
|
|
76
76
|
const value = env(name)?.trim();
|
|
77
77
|
if (!value)
|
|
@@ -84,8 +84,8 @@ async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
|
|
|
84
84
|
const port = required(exports.CONTROLLER_TOKEN_PUBLISHER_ENV.apiPort);
|
|
85
85
|
const namespace = (await read(`${dir}/namespace`)).trim();
|
|
86
86
|
return {
|
|
87
|
-
source: (0,
|
|
88
|
-
|
|
87
|
+
source: (0, workflow_credential_token_source_1.createWorkflowCredentialTokenSource)(credentials, deps),
|
|
88
|
+
description: credentials.attestationFile,
|
|
89
89
|
target: {
|
|
90
90
|
apiServer: `https://${host.includes(':') ? `[${host}]` : host}:${port}`,
|
|
91
91
|
namespace,
|
|
@@ -99,7 +99,7 @@ async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
|
|
|
99
99
|
async function startControllerTokenPublisher(options, deps = {}) {
|
|
100
100
|
const refresher = await proactive_token_refresher_1.ProactiveTokenRefresher.start({
|
|
101
101
|
source: options.source,
|
|
102
|
-
description: `${options.
|
|
102
|
+
description: `${options.description} (Worker Controller credential → ${options.target.namespace}/${options.target.secretName})`,
|
|
103
103
|
...(deps.logger ? { logger: deps.logger } : {}),
|
|
104
104
|
...(deps.onFatal ? { onFatal: deps.onFatal } : {}),
|
|
105
105
|
...(deps.clock ? { clock: deps.clock } : {}),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":";;;AA0HA,8DA4BC;AAiBD,wFA8BC;AASD,sEAsBC;AApOD,+CAA4C;AAC5C,2CAAqD;AAIrD,6CAAiE;AAEjE,2EAIqC;AACrC,yFAG4C;AAwB/B,QAAA,8BAA8B,GAAG;IAC5C,UAAU,EAAE,uCAAuC;IACnD,SAAS,EAAE,oCAAoC;IAC/C,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,yBAAyB;CAC1B,CAAC;AAGE,QAAA,8BAA8B,GAAG,+CAA+C,CAAC;AA6B9F,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAC7D,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAGlC,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,MAAM,cAAc,GAAuB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACvE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,GAAG,GAAG,IAAA,oBAAY,EACtB,GAAG,EACH;QACE,MAAM,EAAE,OAAO;QACf,EAAE;QACF,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,8BAA8B;YAC9C,MAAM,EAAE,kBAAkB;YAC1B,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;SAC1C;KACF,EACD,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,oBAAoB,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AASL,SAAgB,yBAAyB,CACvC,MAA8B,EAC9B,OAAiC,EAAE;IAEnC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,wBAAwB,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,GAAG,GACP,GAAG,MAAM,CAAC,SAAS,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAC/E,YAAY,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IACtD,OAAO,KAAK,EAAE,KAAkB,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,wBAAwB,CAChC,SAAS,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,aAAa,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAiBM,KAAK,UAAU,sCAAsC,CAC1D,GAAsB,EACtB,OAGI,EAAE;IAEN,MAAM,WAAW,GAAG,IAAA,8CAAiC,EAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;QAChH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,sCAA8B,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,IAAA,sEAAmC,EAAC,WAAW,EAAE,IAAI,CAAC;QAC9D,WAAW,EAAE,WAAW,CAAC,eAAe;QACxC,MAAM,EAAE;YACN,SAAS,EAAE,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE;YACvE,SAAS;YACT,UAAU,EAAE,QAAQ,CAAC,sCAA8B,CAAC,UAAU,CAAC;YAC/D,SAAS,EAAE,QAAQ,CAAC,sCAA8B,CAAC,SAAS,CAAC;YAC7D,uBAAuB,EAAE,GAAG,GAAG,QAAQ;YACvC,MAAM,EAAE,GAAG,GAAG,SAAS;SACxB;KACF,CAAC;AACJ,CAAC;AASM,KAAK,UAAU,6BAA6B,CACjD,OAAwC,EACxC,OAII,EAAE;IAEN,MAAM,SAAS,GAAG,MAAM,mDAAuB,CAAC,KAAK,CAAC;QACpD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,oCAAoC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG;QAC/H,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -2,6 +2,7 @@ export declare const NEXUS_ENDPOINTS_DEFINE = "__XEMA_NEXUS_ENDPOINTS__";
|
|
|
2
2
|
export declare const NEXUS_SERVICE_NOT_BOUND = "NEXUS_SERVICE_NOT_BOUND";
|
|
3
3
|
export declare const NEXUS_ENDPOINTS_NOT_DEFINED = "NEXUS_ENDPOINTS_NOT_DEFINED";
|
|
4
4
|
export declare const NEXUS_CALLER_NOT_BOUND = "NEXUS_CALLER_NOT_BOUND";
|
|
5
|
+
export declare const NEXUS_CALLER_UNVERIFIABLE = "NEXUS_CALLER_UNVERIFIABLE";
|
|
5
6
|
export declare const NEXUS_ORG_MISSING = "NEXUS_ORG_MISSING";
|
|
6
7
|
export declare function nexusServiceKey(service: string, version: string): string;
|
|
7
8
|
export declare const NEXUS_OPERATION_TIMED_OUT = "NEXUS_OPERATION_TIMED_OUT";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nexus-constants.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAOjE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAGjE,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAGzE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"nexus-constants.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAOjE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAGjE,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAGzE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAO/D,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAGrE,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAGrD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAExE;AAMD,eAAO,MAAM,yBAAyB,8BAA8B,CAAC"}
|
|
@@ -1,11 +1,12 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ORG_MISSING = exports.NEXUS_CALLER_NOT_BOUND = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ENDPOINTS_DEFINE = void 0;
|
|
3
|
+
exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ORG_MISSING = exports.NEXUS_CALLER_UNVERIFIABLE = exports.NEXUS_CALLER_NOT_BOUND = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ENDPOINTS_DEFINE = void 0;
|
|
4
4
|
exports.nexusServiceKey = nexusServiceKey;
|
|
5
5
|
exports.NEXUS_ENDPOINTS_DEFINE = '__XEMA_NEXUS_ENDPOINTS__';
|
|
6
6
|
exports.NEXUS_SERVICE_NOT_BOUND = 'NEXUS_SERVICE_NOT_BOUND';
|
|
7
7
|
exports.NEXUS_ENDPOINTS_NOT_DEFINED = 'NEXUS_ENDPOINTS_NOT_DEFINED';
|
|
8
8
|
exports.NEXUS_CALLER_NOT_BOUND = 'NEXUS_CALLER_NOT_BOUND';
|
|
9
|
+
exports.NEXUS_CALLER_UNVERIFIABLE = 'NEXUS_CALLER_UNVERIFIABLE';
|
|
9
10
|
exports.NEXUS_ORG_MISSING = 'NEXUS_ORG_MISSING';
|
|
10
11
|
function nexusServiceKey(service, version) {
|
|
11
12
|
return `${service}@${version}`;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nexus-constants.js","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"nexus-constants.js","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":";;;AAqCA,0CAEC;AA5BY,QAAA,sBAAsB,GAAG,0BAA0B,CAAC;AAOpD,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAGpD,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAG5D,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAOlD,QAAA,yBAAyB,GAAG,2BAA2B,CAAC;AAGxD,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAGrD,SAAgB,eAAe,CAAC,OAAe,EAAE,OAAe;IAC9D,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACjC,CAAC;AAMY,QAAA,yBAAyB,GAAG,2BAA2B,CAAC"}
|
|
@@ -26,7 +26,15 @@ export interface XemaNexusServiceImplementation {
|
|
|
26
26
|
readonly operations: ReadonlyMap<string, BiomeNexusOperationMode>;
|
|
27
27
|
bind(policy: NexusCallerPolicy): PlatformNexusServiceHandler;
|
|
28
28
|
}
|
|
29
|
-
export
|
|
29
|
+
export type CallerNamespaceRefusal = 'none' | 'ambiguous' | 'malformed';
|
|
30
|
+
export type CallerNamespaceResult = {
|
|
31
|
+
readonly ok: true;
|
|
32
|
+
readonly namespace: string;
|
|
33
|
+
} | {
|
|
34
|
+
readonly ok: false;
|
|
35
|
+
readonly reason: CallerNamespaceRefusal;
|
|
36
|
+
};
|
|
37
|
+
export declare function callerNamespaceOf(links: readonly nexus.Link[]): CallerNamespaceResult;
|
|
30
38
|
export declare function nexusHandlerFor<Ops extends XemaNexusOperationMap>(contract: XemaNexusContract<Ops>, impl: XemaNexusServiceImpl<Ops>): XemaNexusServiceImplementation;
|
|
31
39
|
export type { NexusOperationInputOf, NexusOperationOutputOf };
|
|
32
40
|
//# sourceMappingURL=nexus-handler.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nexus-handler.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"nexus-handler.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":"AA8BA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,oBAAoB,IAAI,yBAAyB,EACvD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,KAAK,MAAM,WAAW,CAAC;AAKnC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOjF,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,QAAQ,IAAI,IAAI,CACjE,yBAAyB,CAAC,CAAC,CAAC,EAC5B,UAAU,GAAG,kBAAkB,GAAG,uBAAuB,CAC1D,GAAG;IACF,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;CACnD,CAAC;AAGF,MAAM,WAAW,yBAAyB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB;IAE5F,QAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,mBAAmB,CAAC,GAAG,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAEhF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC;IAQ5C,aAAa,CAAC,CAAC,SAAS,QAAQ,EAC9B,kBAAkB,EAAE,MAAM,GAAG,CAAC,EAC9B,OAAO,EAAE,4BAA4B,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACnD;AAED,KAAK,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;AAGjF,MAAM,MAAM,sBAAsB,CAAC,EAAE,IACnC,EAAE,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,uBAAuB,CAAC,KAAK,CAAC,GAC1E,CAAC,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GACrF,EAAE,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAC3E,CAAC,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACrE,KAAK,CAAC;AAEd,MAAM,MAAM,oBAAoB,CAAC,GAAG,SAAS,qBAAqB,IAAI;IACpE,QAAQ,EAAE,CAAC,IAAI,MAAM,GAAG,GAAG,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACnE,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvD;AAGD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAElE,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,2BAA2B,CAAC;CAC9D;AAaD,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,WAAW,GAAG,WAAW,CAAC;AAExE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAcpE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE,GAAG,qBAAqB,CAarF;AA4ED,wBAAgB,eAAe,CAAC,GAAG,SAAS,qBAAqB,EAC/D,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAChC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAC9B,8BAA8B,CA6ChC;AAED,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,CAAC"}
|
|
@@ -44,20 +44,28 @@ const nexus_contract_1 = require("./nexus-contract");
|
|
|
44
44
|
const search_attribute_constants_1 = require("./search-attribute-constants");
|
|
45
45
|
const WORKFLOW_EVENT_LINK_TYPE = 'temporal.api.common.v1.Link.WorkflowEvent';
|
|
46
46
|
const WORKFLOW_EVENT_LINK_PATH = /^\/namespaces\/([^/]+)\/workflows\//;
|
|
47
|
+
const CALLER_REFUSALS = new Set([nexus_constants_1.NEXUS_CALLER_NOT_BOUND, nexus_constants_1.NEXUS_CALLER_UNVERIFIABLE]);
|
|
47
48
|
function refuse(code, message) {
|
|
48
|
-
return new nexus.HandlerError(code
|
|
49
|
+
return new nexus.HandlerError(CALLER_REFUSALS.has(code) ? 'UNAUTHORIZED' : 'BAD_REQUEST', `[${code}] ${message}`, { retryableOverride: false });
|
|
49
50
|
}
|
|
50
51
|
function callerNamespaceOf(links) {
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
}
|
|
52
|
+
const events = links.filter((link) => link.type === WORKFLOW_EVENT_LINK_TYPE);
|
|
53
|
+
if (events.length === 0)
|
|
54
|
+
return { ok: false, reason: 'none' };
|
|
55
|
+
if (events.length > 1)
|
|
56
|
+
return { ok: false, reason: 'ambiguous' };
|
|
57
|
+
const [event] = events;
|
|
58
|
+
if (event.url.protocol !== 'temporal:')
|
|
59
|
+
return { ok: false, reason: 'malformed' };
|
|
60
|
+
const match = WORKFLOW_EVENT_LINK_PATH.exec(event.url.pathname);
|
|
61
|
+
if (match?.[1] === undefined)
|
|
62
|
+
return { ok: false, reason: 'malformed' };
|
|
63
|
+
try {
|
|
64
|
+
return { ok: true, namespace: decodeURIComponent(match[1]) };
|
|
65
|
+
}
|
|
66
|
+
catch {
|
|
67
|
+
return { ok: false, reason: 'malformed' };
|
|
59
68
|
}
|
|
60
|
-
return undefined;
|
|
61
69
|
}
|
|
62
70
|
function headerValue(headers, name) {
|
|
63
71
|
for (const [key, value] of Object.entries(headers)) {
|
|
@@ -67,10 +75,11 @@ function headerValue(headers, name) {
|
|
|
67
75
|
return undefined;
|
|
68
76
|
}
|
|
69
77
|
function admit(where, op, policy, ctx) {
|
|
70
|
-
const
|
|
71
|
-
if (
|
|
72
|
-
throw refuse(nexus_constants_1.
|
|
78
|
+
const caller = callerNamespaceOf(ctx.inboundLinks);
|
|
79
|
+
if (!caller.ok) {
|
|
80
|
+
throw refuse(nexus_constants_1.NEXUS_CALLER_UNVERIFIABLE, `${where}: the request does not carry exactly one well-formed calling-workflow link (${caller.reason}), so its caller cannot be verified.`);
|
|
73
81
|
}
|
|
82
|
+
const callerNamespace = caller.namespace;
|
|
74
83
|
if (!policy.allowedCallerNamespaces.has(callerNamespace)) {
|
|
75
84
|
throw refuse(nexus_constants_1.NEXUS_CALLER_NOT_BOUND, `${where}: namespace ${callerNamespace} is not bound to this service by the distribution lock.`);
|
|
76
85
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nexus-handler.js","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"nexus-handler.js","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmJA,8CAaC;AA4ED,0CAgDC;AA9PD,6CAK2B;AAC3B,iDAAmC;AAEnC,yCAA4C;AAC5C,6DAA6D;AAC7D,uDAAyG;AACzG,qDAQ0B;AAC1B,6EAAkE;AAMlE,MAAM,wBAAwB,GAAG,2CAA2C,CAAC;AAC7E,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AA6DvE,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,wCAAsB,EAAE,2CAAyB,CAAC,CAAC,CAAC;AAE1G,SAAS,MAAM,CAAC,IAAY,EAAE,OAAe;IAC3C,OAAO,IAAI,KAAK,CAAC,YAAY,CAC3B,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAC1D,IAAI,IAAI,KAAK,OAAO,EAAE,EACtB,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAC7B,CAAC;AACJ,CAAC;AAqBD,SAAgB,iBAAiB,CAAC,KAA4B;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAsB,CAAC;IACvC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClF,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAA+B,EAAE,IAAY;IAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,KAAK,CACZ,KAAa,EACb,EAAwC,EACxC,MAAyB,EACzB,GAAgC;IAEhC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,MAAM,CACV,2CAAyB,EACzB,GAAG,KAAK,+EAA+E,MAAM,CAAC,MAAM,sCAAsC,CAC3I,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,CACV,wCAAsB,EACtB,GAAG,KAAK,eAAe,eAAe,yDAAyD,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,0CAAqB,CAAC,CAAC;IAC/D,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,GAAG,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,mCAAiB,EAAE,GAAG,KAAK,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,oCAAmB,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,MAAM,CACV,mCAAiB,EACjB,GAAG,KAAK,gDAAgD,0CAAqB,KAAK;YAChF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK;QACL,eAAe;QACf,KAAK,EAAE,GAAG;QACV,aAAa,CAAC,kBAAkB,EAAE,OAAO;YACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAgC,CAAC;YAC1D,IAAI,QAAQ,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,kFAAkF,CAC3F,CAAC;YACJ,CAAC;YACD,OAAO,IAAA,qBAAkB,EAAC,GAAG,EAAE,kBAAkB,EAAE;gBACjD,GAAG,OAAO;gBACV,GAAG,CAAC,KAAK,KAAK,SAAS;oBACrB,CAAC,CAAC;wBACE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;wBAC7C,gBAAgB,EAAE,EAAE,CAAC,+CAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE;qBACpD;oBACH,CAAC,CAAC,EAAE,CAAC;aACC,CAAC,CAAC;QACd,CAAC;KAC2B,CAAC;AACjC,CAAC;AASD,SAAgB,eAAe,CAC7B,QAAgC,EAChC,IAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,IAAgC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,4CAA4C;YACjG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CACN,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAA0C,CAAC,IAAI,CAAC,CAAC,CAC7F,CAAC;IAEF,SAAS,IAAI,CAAC,MAAyB;QACrC,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAyC,CAAC;YAC7E,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAChE,MAAM,GAAG,GAAI,IAAuF,CAAC,IAAI,CAGpF,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,CAAC,IAAI,KAAK,wCAAuB,CAAC,KAAK;oBACvC,CAAC,CAAC,IAAI,mCAA2B,CAC7B,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAqC,CAC9F;oBACH,CAAC,CAAC,CAAC,GAAgC,EAAE,KAAc,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CACzB,QAAQ,CAAC,UAAU,EACnB,QAA0C,CACD,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proactive-token-refresher.d.ts","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,
|
|
1
|
+
{"version":3,"file":"proactive-token-refresher.d.ts","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAG/E,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAEnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAM7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAE3C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IASzC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAOD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AA8BD,qBAAa,uBAAuB;IAchC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAb1B,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IAEjD,OAAO;WAmBM,KAAK,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAwB7F,KAAK,IAAI,MAAM;IAKf,YAAY,IAAI,WAAW;IAerB,SAAS,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IASnE,IAAI,IAAI,IAAI;IASZ,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,GAAG;YAQG,OAAO;IA0DrB,OAAO,CAAC,IAAI;CAMb"}
|
|
@@ -100,6 +100,11 @@ class ProactiveTokenRefresher {
|
|
|
100
100
|
catch (error) {
|
|
101
101
|
if (this.stopped)
|
|
102
102
|
return;
|
|
103
|
+
if (error instanceof bounded_retry_1.PermanentFailureError) {
|
|
104
|
+
this.fail(new TokenRefreshFatalError(`The Temporal access token for ${this.options.description} cannot be refreshed: ` +
|
|
105
|
+
`${describe(error)}. Refusing to continue without a valid credential.`, error));
|
|
106
|
+
return;
|
|
107
|
+
}
|
|
103
108
|
const now = this.clock.now();
|
|
104
109
|
const delay = Math.min(this.retryMaxMs, this.retryInitialMs * 2 ** (attempt - 1));
|
|
105
110
|
if (now + delay >= this.current.expiresAt) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proactive-token-refresher.js","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":";;;AACA,
|
|
1
|
+
{"version":3,"file":"proactive-token-refresher.js","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":";;;AACA,mDAOyB;AAyCzB,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAG5C,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,SAAS,aAAa,CAAC,KAAY;IACjC,YAAY,CAAC,GAAG,EAAE;QAChB,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAyB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;AAsB/F,MAAa,uBAAuB;IAcf;IAbX,OAAO,CAAc;IACrB,UAAU,CAAS;IACnB,KAAK,GAAY,IAAI,CAAC;IACtB,OAAO,GAAG,KAAK,CAAC;IACP,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,CAAa;IAClB,MAAM,CAAuB;IAC7B,QAAQ,CAAS;IACjB,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,OAAO,CAAyB;IAEjD,YACmB,OAAuC,EACxD,KAAkB;QADD,YAAO,GAAP,OAAO,CAAgC;QAGxD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,4BAAY,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,0BAA0B,IAAI,gCAAgC,CAAC;QAC7F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,sBAAsB,IAAI,4BAA4B,CAAC;QACjF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;IAOD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAuC;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QAC1E,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,4BAAY,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAgB,EAClC,2CAA2C,OAAO,CAAC,WAAW,EAAE,EAChE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,YAAY,IAAI,4CAA4B,EACpD,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,IAAI,CACT,6BAA6B,OAAO,CAAC,WAAW,aAAa,OAAO,UAAU;YAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAClD,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,SAAS,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAGD,KAAK;QACH,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC;IACnC,CAAC;IAGD,YAAY;QACV,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAsB,CAC9B,2CAA2C,IAAI,CAAC,OAAO,CAAC,WAAW,cAAc,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAQD,KAAK,CAAC,SAAS,CAAC,QAA6B;QAC3C,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAGD,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,YAAY;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAEO,GAAG,CAAC,OAAe,EAAE,OAAe;QAC1C,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAe;QACnC,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,IAAI,KAAK,YAAY,qCAAqB,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,iCAAiC,IAAI,CAAC,OAAO,CAAC,WAAW,wBAAwB;oBAC/E,GAAG,QAAQ,CAAC,KAAK,CAAC,oDAAoD,EACxE,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YAClF,IAAI,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1C,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,iCAAiC,IAAI,CAAC,OAAO,CAAC,WAAW,kBAAkB;oBACzE,mDAAmD,OAAO,WAAW;oBACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,qDAAqD,EACzE,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,IAAI,CAAC,OAAO,CAAC,WAAW,aAAa,OAAO,GAAG;gBAClF,WAAW,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK;gBACtD,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,uBAAuB,CAC1D,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,6CAA6C,IAAI,CAAC,OAAO,CAAC,WAAW,SAAS;oBAC5E,kCAAkC,QAAQ,CAAC,KAAK,CAAC,EAAE,EACrD,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;QAC3B,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,IAAI,CAAC,KAA6B;QACxC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;CACF;AA5KD,0DA4KC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
import { type AccessTokenSource } from './access-token';
|
|
2
|
+
import { PermanentFailureError } from './bounded-retry';
|
|
3
|
+
import type { TokenRefresherLogger } from './proactive-token-refresher';
|
|
4
|
+
export interface WorkflowCredentialOptions {
|
|
5
|
+
readonly identityApiUrl: string;
|
|
6
|
+
readonly attestationFile: string;
|
|
7
|
+
}
|
|
8
|
+
export interface WorkflowCredentialDeps {
|
|
9
|
+
readonly fetch?: typeof fetch;
|
|
10
|
+
readonly readAttestationFile?: (path: string) => Promise<string>;
|
|
11
|
+
readonly now?: () => number;
|
|
12
|
+
readonly logger?: TokenRefresherLogger;
|
|
13
|
+
}
|
|
14
|
+
export declare class TemporalCredentialRefusedError extends PermanentFailureError {
|
|
15
|
+
readonly code: string;
|
|
16
|
+
readonly status: number | undefined;
|
|
17
|
+
constructor(message: string, code: string, status: number | undefined, cause: unknown);
|
|
18
|
+
}
|
|
19
|
+
export declare class TemporalCredentialMalformedError extends PermanentFailureError {
|
|
20
|
+
constructor(message: string);
|
|
21
|
+
}
|
|
22
|
+
export declare function validateWorkflowCredentialOptions(options: WorkflowCredentialOptions): void;
|
|
23
|
+
export declare function createWorkflowCredentialTokenSource(options: WorkflowCredentialOptions, deps?: WorkflowCredentialDeps): AccessTokenSource;
|
|
24
|
+
//# sourceMappingURL=workflow-credential-token-source.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"workflow-credential-token-source.d.ts","sourceRoot":"","sources":["../../src/lib/workflow-credential-token-source.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAaxE,MAAM,WAAW,yBAAyB;IAExC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAMhC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAGD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;CACxC;AAOD,qBAAa,8BAA+B,SAAQ,qBAAqB;IAIrE,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;gBAHnC,OAAO,EAAE,MAAM,EAEN,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO;CAKjB;AAGD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAa1F;AAcD,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,sBAA2B,GAChC,iBAAiB,CAsCnB"}
|
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.TemporalCredentialMalformedError = exports.TemporalCredentialRefusedError = void 0;
|
|
4
|
+
exports.validateWorkflowCredentialOptions = validateWorkflowCredentialOptions;
|
|
5
|
+
exports.createWorkflowCredentialTokenSource = createWorkflowCredentialTokenSource;
|
|
6
|
+
const identity_client_1 = require("@xemahq/identity-client");
|
|
7
|
+
const access_token_1 = require("./access-token");
|
|
8
|
+
const bounded_retry_1 = require("./bounded-retry");
|
|
9
|
+
class TemporalCredentialRefusedError extends bounded_retry_1.PermanentFailureError {
|
|
10
|
+
code;
|
|
11
|
+
status;
|
|
12
|
+
constructor(message, code, status, cause) {
|
|
13
|
+
super(message, { cause });
|
|
14
|
+
this.code = code;
|
|
15
|
+
this.status = status;
|
|
16
|
+
this.name = 'TemporalCredentialRefusedError';
|
|
17
|
+
}
|
|
18
|
+
}
|
|
19
|
+
exports.TemporalCredentialRefusedError = TemporalCredentialRefusedError;
|
|
20
|
+
class TemporalCredentialMalformedError extends bounded_retry_1.PermanentFailureError {
|
|
21
|
+
constructor(message) {
|
|
22
|
+
super(message);
|
|
23
|
+
this.name = 'TemporalCredentialMalformedError';
|
|
24
|
+
}
|
|
25
|
+
}
|
|
26
|
+
exports.TemporalCredentialMalformedError = TemporalCredentialMalformedError;
|
|
27
|
+
function validateWorkflowCredentialOptions(options) {
|
|
28
|
+
let url;
|
|
29
|
+
try {
|
|
30
|
+
url = new URL(options.identityApiUrl);
|
|
31
|
+
}
|
|
32
|
+
catch {
|
|
33
|
+
throw new Error(`Temporal identity-api URL is not a URL: ${options.identityApiUrl}`);
|
|
34
|
+
}
|
|
35
|
+
if (url.protocol !== 'https:' && url.protocol !== 'http:') {
|
|
36
|
+
throw new Error(`Temporal identity-api URL must be http(s): ${options.identityApiUrl}`);
|
|
37
|
+
}
|
|
38
|
+
if (options.attestationFile.trim().length === 0) {
|
|
39
|
+
throw new Error('Temporal workflow credential: attestationFile is required.');
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
function createWorkflowCredentialTokenSource(options, deps = {}) {
|
|
43
|
+
validateWorkflowCredentialOptions(options);
|
|
44
|
+
const now = deps.now ?? Date.now;
|
|
45
|
+
const source = new identity_client_1.WorkflowCredentialSource({
|
|
46
|
+
identityApiUrl: options.identityApiUrl,
|
|
47
|
+
readCredential: (0, identity_client_1.fileCredentialReader)(options.attestationFile, deps.readAttestationFile),
|
|
48
|
+
...(deps.fetch !== undefined ? { fetch: deps.fetch } : {}),
|
|
49
|
+
now,
|
|
50
|
+
});
|
|
51
|
+
return async () => {
|
|
52
|
+
source.invalidate();
|
|
53
|
+
const sentAt = now();
|
|
54
|
+
let value;
|
|
55
|
+
try {
|
|
56
|
+
value = await source.get();
|
|
57
|
+
}
|
|
58
|
+
catch (error) {
|
|
59
|
+
if (error instanceof identity_client_1.WorkflowCredentialError && error.code !== undefined) {
|
|
60
|
+
const refused = new TemporalCredentialRefusedError(`identity-api refused the Temporal workflow credential: ${error.code} ` +
|
|
61
|
+
`(HTTP ${error.status ?? 'unknown'}). ${error.message}`, error.code, error.status, error);
|
|
62
|
+
deps.logger?.error(refused.message);
|
|
63
|
+
throw refused;
|
|
64
|
+
}
|
|
65
|
+
throw error;
|
|
66
|
+
}
|
|
67
|
+
const { iat, exp } = (0, access_token_1.decodeAccessTokenClaims)(value);
|
|
68
|
+
if (iat === undefined || exp === undefined || exp <= iat) {
|
|
69
|
+
throw new TemporalCredentialMalformedError('The Temporal workflow credential carries no usable iat/exp; its refresh cannot be scheduled.');
|
|
70
|
+
}
|
|
71
|
+
return { value, expiresAt: sentAt + (exp - iat) * 1000 };
|
|
72
|
+
};
|
|
73
|
+
}
|
|
74
|
+
//# sourceMappingURL=workflow-credential-token-source.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"workflow-credential-token-source.js","sourceRoot":"","sources":["../../src/lib/workflow-credential-token-source.ts"],"names":[],"mappings":";;;AAuEA,8EAaC;AAcD,kFAyCC;AA3ID,6DAIiC;AAEjC,iDAIwB;AACxB,mDAAwD;AAsCxD,MAAa,8BAA+B,SAAQ,qCAAqB;IAI5D;IACA;IAJX,YACE,OAAe,EAEN,IAAY,EACZ,MAA0B,EACnC,KAAc;QAEd,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAJjB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAoB;QAInC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAXD,wEAWC;AAGD,MAAa,gCAAiC,SAAQ,qCAAqB;IACzE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AALD,4EAKC;AAGD,SAAgB,iCAAiC,CAAC,OAAkC;IAClF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAcD,SAAgB,mCAAmC,CACjD,OAAkC,EAClC,OAA+B,EAAE;IAEjC,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,0CAAwB,CAAC;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,cAAc,EAAE,IAAA,sCAAoB,EAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;QACvF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO,KAAK,IAA0B,EAAE;QACtC,MAAM,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yCAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACzE,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAChD,0DAA0D,KAAK,CAAC,IAAI,GAAG;oBACrE,SAAS,KAAK,CAAC,MAAM,IAAI,SAAS,MAAM,KAAK,CAAC,OAAO,EAAE,EACzD,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,MAAM,EACZ,KAAK,CACN,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,OAAO,CAAC;YAChB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAA,sCAAuB,EAAC,KAAK,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,gCAAgC,CACxC,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/temporal-runtime",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.10.0",
|
|
4
4
|
"description": "Temporal workers and clients for Xema — connection management, on-behalf-of auth interceptors, schedules, and search attributes.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -28,8 +28,8 @@
|
|
|
28
28
|
"@temporalio/activity": "^1.24.0",
|
|
29
29
|
"@types/jest": "^30.0.0",
|
|
30
30
|
"@types/node": "25.2.3",
|
|
31
|
-
"@xemahq/contracts": "^0.
|
|
32
|
-
"@xemahq/identity-client": "^0.
|
|
31
|
+
"@xemahq/contracts": "^0.60.0",
|
|
32
|
+
"@xemahq/identity-client": "^0.18.0",
|
|
33
33
|
"jest": "^30.3.0",
|
|
34
34
|
"prettier": "3.6.2",
|
|
35
35
|
"reflect-metadata": "0.2.2",
|
|
@@ -40,8 +40,8 @@
|
|
|
40
40
|
"peerDependencies": {
|
|
41
41
|
"@nestjs/common": "^11.0.0",
|
|
42
42
|
"reflect-metadata": "^0.2",
|
|
43
|
-
"@xemahq/identity-client": ">=0.
|
|
44
|
-
"@xemahq/contracts": ">=0.
|
|
43
|
+
"@xemahq/identity-client": ">=0.18.0",
|
|
44
|
+
"@xemahq/contracts": ">=0.60.0"
|
|
45
45
|
},
|
|
46
46
|
"dependencies": {
|
|
47
47
|
"@temporalio/client": "^1.24.0",
|
|
@@ -80,5 +80,8 @@
|
|
|
80
80
|
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
81
81
|
"test": "jest --config jest.config.ts && jest --config jest.dev-server.config.ts",
|
|
82
82
|
"test:integration": "jest --config jest.integration.config.ts --runInBand"
|
|
83
|
+
},
|
|
84
|
+
"xemaRelease": {
|
|
85
|
+
"sourceDigest": "sha256:cfeb8e0b6cc78f1ce2e36651dc51c1f62f793c5e5f0cabe7cb89cc849e66e0e0"
|
|
83
86
|
}
|
|
84
|
-
}
|
|
87
|
+
}
|
|
@@ -1,23 +0,0 @@
|
|
|
1
|
-
import { type AccessTokenSource } from './access-token';
|
|
2
|
-
export interface ClientCredentialsOptions {
|
|
3
|
-
readonly tokenEndpoint: string;
|
|
4
|
-
readonly clientId: string;
|
|
5
|
-
readonly clientSecretFile: string;
|
|
6
|
-
readonly audience: string;
|
|
7
|
-
readonly requestTimeoutMs?: number;
|
|
8
|
-
}
|
|
9
|
-
export interface ClientCredentialsDeps {
|
|
10
|
-
readonly fetch?: typeof fetch;
|
|
11
|
-
readonly readSecretFile?: (path: string) => Promise<string>;
|
|
12
|
-
readonly now?: () => number;
|
|
13
|
-
}
|
|
14
|
-
export declare class ClientCredentialsTokenError extends Error {
|
|
15
|
-
readonly status: number | undefined;
|
|
16
|
-
constructor(message: string, options?: {
|
|
17
|
-
status?: number;
|
|
18
|
-
cause?: unknown;
|
|
19
|
-
});
|
|
20
|
-
}
|
|
21
|
-
export declare function createClientCredentialsTokenSource(options: ClientCredentialsOptions, deps?: ClientCredentialsDeps): AccessTokenSource;
|
|
22
|
-
export declare function validateClientCredentialsOptions(options: ClientCredentialsOptions): void;
|
|
23
|
-
//# sourceMappingURL=client-credentials-token-source.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"client-credentials-token-source.d.ts","sourceRoot":"","sources":["../../src/lib/client-credentials-token-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AAYxB,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAK1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAOlC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAKD,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAExB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAKhF;AAWD,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,qBAA0B,GAC/B,iBAAiB,CAsCnB;AAuDD,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAmBxF"}
|
|
@@ -1,108 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.ClientCredentialsTokenError = void 0;
|
|
4
|
-
exports.createClientCredentialsTokenSource = createClientCredentialsTokenSource;
|
|
5
|
-
exports.validateClientCredentialsOptions = validateClientCredentialsOptions;
|
|
6
|
-
const promises_1 = require("node:fs/promises");
|
|
7
|
-
const access_token_1 = require("./access-token");
|
|
8
|
-
const DEFAULT_REQUEST_TIMEOUT_MS = 10_000;
|
|
9
|
-
class ClientCredentialsTokenError extends Error {
|
|
10
|
-
status;
|
|
11
|
-
constructor(message, options = {}) {
|
|
12
|
-
super(message, options.cause === undefined ? undefined : { cause: options.cause });
|
|
13
|
-
this.name = 'ClientCredentialsTokenError';
|
|
14
|
-
this.status = options.status;
|
|
15
|
-
}
|
|
16
|
-
}
|
|
17
|
-
exports.ClientCredentialsTokenError = ClientCredentialsTokenError;
|
|
18
|
-
function createClientCredentialsTokenSource(options, deps = {}) {
|
|
19
|
-
validateClientCredentialsOptions(options);
|
|
20
|
-
const doFetch = deps.fetch ?? fetch;
|
|
21
|
-
const readSecret = deps.readSecretFile ?? ((path) => (0, promises_1.readFile)(path, 'utf8'));
|
|
22
|
-
const now = deps.now ?? Date.now;
|
|
23
|
-
const timeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
|
|
24
|
-
return async () => {
|
|
25
|
-
const secret = (await readSecret(options.clientSecretFile)).trim();
|
|
26
|
-
if (secret.length === 0) {
|
|
27
|
-
throw new ClientCredentialsTokenError(`Temporal client secret file ${options.clientSecretFile} is empty.`);
|
|
28
|
-
}
|
|
29
|
-
const sentAt = now();
|
|
30
|
-
const response = await doFetch(options.tokenEndpoint, {
|
|
31
|
-
method: 'POST',
|
|
32
|
-
headers: {
|
|
33
|
-
'Content-Type': 'application/x-www-form-urlencoded',
|
|
34
|
-
Accept: 'application/json',
|
|
35
|
-
},
|
|
36
|
-
body: new URLSearchParams({
|
|
37
|
-
grant_type: 'client_credentials',
|
|
38
|
-
client_id: options.clientId,
|
|
39
|
-
client_secret: secret,
|
|
40
|
-
}).toString(),
|
|
41
|
-
signal: AbortSignal.timeout(timeoutMs),
|
|
42
|
-
});
|
|
43
|
-
const text = await response.text();
|
|
44
|
-
if (!response.ok) {
|
|
45
|
-
throw new ClientCredentialsTokenError(`Temporal token request for client ${options.clientId} was refused ` +
|
|
46
|
-
`(HTTP ${response.status}): ${text.slice(0, 300)}`, { status: response.status });
|
|
47
|
-
}
|
|
48
|
-
return parseTokenResponse(text, options, sentAt);
|
|
49
|
-
};
|
|
50
|
-
}
|
|
51
|
-
function parseTokenResponse(text, options, sentAt) {
|
|
52
|
-
let body;
|
|
53
|
-
try {
|
|
54
|
-
body = JSON.parse(text);
|
|
55
|
-
}
|
|
56
|
-
catch (cause) {
|
|
57
|
-
throw new ClientCredentialsTokenError(`Temporal token response for client ${options.clientId} is not JSON.`, { cause });
|
|
58
|
-
}
|
|
59
|
-
const record = (typeof body === 'object' && body !== null ? body : {});
|
|
60
|
-
const value = record['access_token'];
|
|
61
|
-
if (typeof value !== 'string' || value.length === 0) {
|
|
62
|
-
throw new ClientCredentialsTokenError(`Temporal token response for client ${options.clientId} carries no access_token.`);
|
|
63
|
-
}
|
|
64
|
-
const claims = (0, access_token_1.decodeAccessTokenClaims)(value);
|
|
65
|
-
if (!claims.aud.includes(options.audience)) {
|
|
66
|
-
throw new ClientCredentialsTokenError(`Temporal token for client ${options.clientId} does not carry the required ` +
|
|
67
|
-
`audience "${options.audience}" (aud=${JSON.stringify(claims.aud)}). ` +
|
|
68
|
-
'The frontend would refuse it; the issuer-side audience mapper is missing.');
|
|
69
|
-
}
|
|
70
|
-
const expiresIn = record['expires_in'];
|
|
71
|
-
let expiresAt;
|
|
72
|
-
if (typeof expiresIn === 'number' && expiresIn > 0) {
|
|
73
|
-
expiresAt = sentAt + expiresIn * 1000;
|
|
74
|
-
}
|
|
75
|
-
else if (claims.exp !== undefined) {
|
|
76
|
-
expiresAt = claims.exp * 1000;
|
|
77
|
-
}
|
|
78
|
-
else {
|
|
79
|
-
throw new ClientCredentialsTokenError(`Temporal token for client ${options.clientId} has neither expires_in nor exp; ` +
|
|
80
|
-
'its refresh cannot be scheduled.');
|
|
81
|
-
}
|
|
82
|
-
if (expiresAt <= sentAt) {
|
|
83
|
-
throw new ClientCredentialsTokenError(`Temporal token for client ${options.clientId} was already expired when issued.`);
|
|
84
|
-
}
|
|
85
|
-
return { value, expiresAt };
|
|
86
|
-
}
|
|
87
|
-
function validateClientCredentialsOptions(options) {
|
|
88
|
-
let url;
|
|
89
|
-
try {
|
|
90
|
-
url = new URL(options.tokenEndpoint);
|
|
91
|
-
}
|
|
92
|
-
catch {
|
|
93
|
-
throw new Error(`Temporal token endpoint is not a URL: ${options.tokenEndpoint}`);
|
|
94
|
-
}
|
|
95
|
-
if (url.protocol !== 'https:' && url.protocol !== 'http:') {
|
|
96
|
-
throw new Error(`Temporal token endpoint must be http(s): ${options.tokenEndpoint}`);
|
|
97
|
-
}
|
|
98
|
-
for (const [name, value] of [
|
|
99
|
-
['clientId', options.clientId],
|
|
100
|
-
['clientSecretFile', options.clientSecretFile],
|
|
101
|
-
['audience', options.audience],
|
|
102
|
-
]) {
|
|
103
|
-
if (value.trim().length === 0) {
|
|
104
|
-
throw new Error(`Temporal client credentials: ${name} is required.`);
|
|
105
|
-
}
|
|
106
|
-
}
|
|
107
|
-
}
|
|
108
|
-
//# sourceMappingURL=client-credentials-token-source.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"client-credentials-token-source.js","sourceRoot":"","sources":["../../src/lib/client-credentials-token-source.ts"],"names":[],"mappings":";;;AAoEA,gFAyCC;AAuDD,4EAmBC;AAvLD,+CAA4C;AAE5C,iDAIwB;AAwCxB,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAG1C,MAAa,2BAA4B,SAAQ,KAAK;IAC3C,MAAM,CAAqB;IAEpC,YAAY,OAAe,EAAE,UAAgD,EAAE;QAC7E,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF;AARD,kEAQC;AAWD,SAAgB,kCAAkC,CAChD,OAAiC,EACjC,OAA8B,EAAE;IAEhC,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAEzE,OAAO,KAAK,IAA0B,EAAE;QACtC,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,2BAA2B,CACnC,+BAA+B,OAAO,CAAC,gBAAgB,YAAY,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,aAAa,EAAE,MAAM;aACtB,CAAC,CAAC,QAAQ,EAAE;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,2BAA2B,CACnC,qCAAqC,OAAO,CAAC,QAAQ,eAAe;gBAClE,SAAS,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EACpD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,OAAiC,EACjC,MAAc;IAEd,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,2BAA2B,CACnC,sCAAsC,OAAO,CAAC,QAAQ,eAAe,EACrE,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAGpE,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,2BAA2B,CACnC,sCAAsC,OAAO,CAAC,QAAQ,2BAA2B,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,sCAAuB,EAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,2BAA2B,CACnC,6BAA6B,OAAO,CAAC,QAAQ,+BAA+B;YAC1E,aAAa,OAAO,CAAC,QAAQ,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;YACtE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,SAAiB,CAAC;IACtB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACnD,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACxC,CAAC;SAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpC,SAAS,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,2BAA2B,CACnC,6BAA6B,OAAO,CAAC,QAAQ,mCAAmC;YAC9E,kCAAkC,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,6BAA6B,OAAO,CAAC,QAAQ,mCAAmC,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAGD,SAAgB,gCAAgC,CAAC,OAAiC;IAChF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC9B,CAAC,kBAAkB,EAAE,OAAO,CAAC,gBAAgB,CAAC;QAC9C,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;KACtB,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,eAAe,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC"}
|