ag-awsauth 0.0.290 → 0.0.292

package/README.md

@@ -2,8 +2,45 @@
 
 ## Usage
 
-npm i -g awsauth
+npm i -g ag-awsauth
 
 ag-awsauth -c
 
-ag-awsauth
+ag-awsauth
+
+## Session duration
+
+- SAML role sessions request 8 hours. The IAM role maximum session duration and
+  the SAML assertion can shorten this.
+- Native IAM Identity Center role sessions use the duration configured on the
+  selected permission set. Set that permission set to 8 hours in IAM Identity
+  Center; the API does not accept a per-request duration.
+- OIDC access tokens are refreshed automatically after the next interactive
+  sign-in. The refresh token and client registration are stored with the other
+  session details in the AWS credentials file.
+- The AWS access portal has a separate user interactive session duration. Its
+  default is 8 hours, but an administrator can change it under IAM Identity
+  Center **Settings > Authentication > Session duration**. An external IdP or
+  Active Directory policy can impose a shorter duration.
+
+## Repeated sign-in prompts
+
+Expired AWS role credentials do not necessarily mean the SSO session has
+expired. A valid portal session can renew SAML role credentials directly;
+native AWS accounts use the OIDC access token, refreshing it when AWS rejects
+it. Rotated refresh tokens are saved immediately, even if a later request fails.
+
+When AWS rejects the refresh token (`InvalidGrantException`), another sign-in
+is required. An unexpired client registration alone does not make a refresh
+token valid. The warning before the MFA prompt reports the reason. Portal
+outages and network failures are reported as errors instead of requesting login.
+
+Changes in a source checkout do not update a separately installed global
+`ag-awsauth`. On PowerShell, `(Get-Command ag-awsauth).Source` shows which
+installation the terminal runs.
+
+## Tests
+
+Run `npm test`. Returning-user regressions run the real application entry point
+in separate processes with temporary AWS files, simulated external AWS APIs,
+and a prompt trap. They never contact AWS or use real credentials.

package/dist/config.d.ts

@@ -1,6 +1,5 @@
 export declare const logPath = "log.txt";
 export declare const stsDurationSeconds: number;
-export declare const nativeStsDurationSeconds: number;
 export declare let basePath: string;
 export declare const setBasePath: (bp: string) => void;
 export declare let identityCenterRegion: string;

package/dist/config.js

@@ -3,13 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.timeoutMedMs = exports.timeoutShortMs = exports.timeoutMs = exports.runConfig = exports.setConfig = exports.validateConfig = exports.targetRegion = exports.ssoStartUrl = exports.identityCenterRegion = exports.setBasePath = exports.basePath = exports.nativeStsDurationSeconds = exports.stsDurationSeconds = exports.logPath = void 0;
+exports.timeoutMedMs = exports.timeoutShortMs = exports.timeoutMs = exports.runConfig = exports.setConfig = exports.validateConfig = exports.targetRegion = exports.ssoStartUrl = exports.identityCenterRegion = exports.setBasePath = exports.basePath = exports.stsDurationSeconds = exports.logPath = void 0;
 const envfile_1 = require("envfile");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 exports.logPath = 'log.txt';
-exports.stsDurationSeconds = 60 * 60 * 4; //4h
-exports.nativeStsDurationSeconds = 60 * 60 * 1; //1h
+exports.stsDurationSeconds = 60 * 60 * 8;
 exports.basePath = '';
 const setBasePath = (bp) => {
     exports.basePath = bp;

package/dist/helpers/awsconfig.js

@@ -44,6 +44,26 @@ const updateAwsCredentials = (p) => __awaiter(void 0, void 0, void 0, function*
         creds.default.aws_session_token = p.sessionToken;
         creds.default.aws_access_token = p.accessToken;
         creds.default.aws_sso_authn = p.ssoAuthn;
+        if (p.refreshToken &&
+            p.clientId &&
+            p.clientSecret &&
+            p.clientSecretExpiresAt &&
+            p.accessTokenExpiresAt) {
+            creds.default.aws_sso_refresh_token = p.refreshToken;
+            creds.default.aws_sso_client_id = p.clientId;
+            creds.default.aws_sso_client_secret = p.clientSecret;
+            creds.default.aws_sso_client_secret_expires_at =
+                p.clientSecretExpiresAt.toString();
+            creds.default.aws_sso_access_token_expires_at =
+                p.accessTokenExpiresAt.toString();
+        }
+        else {
+            delete creds.default.aws_sso_refresh_token;
+            delete creds.default.aws_sso_client_id;
+            delete creds.default.aws_sso_client_secret;
+            delete creds.default.aws_sso_client_secret_expires_at;
+            delete creds.default.aws_sso_access_token_expires_at;
+        }
     }
     const newcreds = (0, ini_1.stringify)(creds);
     (0, log_1.info)(`saving updated default creds to .aws/credentials`);

package/dist/helpers/browser.d.ts

@@ -2,6 +2,7 @@ import type { Page } from 'puppeteer';
 export declare const closeBrowser: () => Promise<void>;
 export declare const launchBrowser: () => Promise<void>;
 export declare const goToPage: (url: string) => Promise<Page>;
+export declare const allowAccessIfRequested: (page: Page) => Promise<void>;
 export declare function getMFA(p: {
     verificationUriComplete: string;
     creds: {

package/dist/helpers/browser.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.goToPage = exports.launchBrowser = exports.closeBrowser = void 0;
+exports.allowAccessIfRequested = exports.goToPage = exports.launchBrowser = exports.closeBrowser = void 0;
 exports.getMFA = getMFA;
 const log_1 = require("ag-common/dist/common/helpers/log");
 const puppeteer_1 = require("puppeteer");
@@ -83,6 +83,15 @@ const goToPage = (url) => __awaiter(void 0, void 0, void 0, function* () {
     }
 });
 exports.goToPage = goToPage;
+const allowAccessIfRequested = (page) => __awaiter(void 0, void 0, void 0, function* () {
+    const allowAccess = yield page.waitForSelector('[data-testid="allow-access-button"]', { timeout: config_1.timeoutMs, visible: true });
+    if (!allowAccess) {
+        throw new Error('allow access button not found');
+    }
+    (0, log_1.info)('click allow-access-button');
+    yield allowAccess.click();
+});
+exports.allowAccessIfRequested = allowAccessIfRequested;
 function getMFA(p) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
@@ -208,33 +217,28 @@ function getMFA(p) {
         catch (e) {
             (0, log_1.debug)('error accepting user code:', e);
         }
+        let accessStateFound = false;
         try {
             (0, log_1.info)('allow-access-button');
-            const messageDiv = yield page.waitForSelector('[data-testid="allow-access-button"]', {
-                timeout: config_1.timeoutMedMs,
-            });
-            if (messageDiv) {
-                (0, log_1.info)('click allow-access-button');
-                yield messageDiv.click();
-            }
-            else {
-                throw new Error('access prompt not found');
-            }
+            yield (0, exports.allowAccessIfRequested)(page);
+            accessStateFound = true;
         }
         catch (e) {
             (0, log_1.debug)('error clicking allow-access-button:', e);
         }
-        try {
-            const verif = yield page.waitForSelector('#cli_verification_btn', {
-                timeout: config_1.timeoutShortMs,
-            });
-            if (verif) {
-                (0, log_1.info)('clicking auth request button');
-                yield verif.click();
+        if (!accessStateFound) {
+            try {
+                const verif = yield page.waitForSelector('#cli_verification_btn', {
+                    timeout: config_1.timeoutShortMs,
+                });
+                if (verif) {
+                    (0, log_1.info)('clicking auth request button');
+                    yield verif.click();
+                }
+            }
+            catch (e) {
+                (0, log_1.debug)('error clicking auth request button:', e);
             }
-        }
-        catch (e) {
-            (0, log_1.debug)('error clicking auth request button:', e);
         }
         //
         (0, log_1.info)('waiting for success');

package/dist/helpers/oidc.d.ts

@@ -1,4 +1,5 @@
 import type { IAwsCreds } from '../types';
+export { refreshAccessToken } from './oidcRefresh';
 export declare function requestMFA(p: {
     identityCenterRegion: string;
     ssoStartUrl: string;

package/dist/helpers/oidc.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshAccessToken = void 0;
 exports.requestMFA = requestMFA;
 /* eslint-disable no-await-in-loop */
 const client_sso_oidc_1 = require("@aws-sdk/client-sso-oidc");
@@ -18,6 +19,9 @@ const config_1 = require("../config");
 const browser_1 = require("./browser");
 const input_1 = require("./input");
 const version_1 = require("./version");
+var oidcRefresh_1 = require("./oidcRefresh");
+Object.defineProperty(exports, "refreshAccessToken", { enumerable: true, get: function () { return oidcRefresh_1.refreshAccessToken; } });
+const deviceCodeGrant = 'urn:ietf:params:oauth:grant-type:device_code';
 function requestMFA(p) {
     return __awaiter(this, void 0, void 0, function* () {
         const sso_oidc = new client_sso_oidc_1.SSOOIDCClient({ region: p.identityCenterRegion });
@@ -27,7 +31,12 @@ function requestMFA(p) {
         const rcc = yield sso_oidc.send(new client_sso_oidc_1.RegisterClientCommand({
             clientName: creds.username,
             clientType: 'public',
+            grantTypes: [deviceCodeGrant, 'refresh_token'],
+            scopes: ['sso:account:access'],
         }));
+        if (!rcc.clientId || !rcc.clientSecret || !rcc.clientSecretExpiresAt) {
+            throw new Error('OIDC client registration details are missing');
+        }
         const sda = yield sso_oidc.send(new client_sso_oidc_1.StartDeviceAuthorizationCommand({
             clientId: rcc.clientId,
             clientSecret: rcc.clientSecret,
@@ -54,12 +63,28 @@ function requestMFA(p) {
                     clientSecret: rcc.clientSecret,
                     code: sda.userCode,
                     deviceCode: sda.deviceCode,
-                    grantType: 'urn:ietf:params:oauth:grant-type:device_code',
+                    grantType: deviceCodeGrant,
                 }));
                 accessToken = ctc.accessToken;
                 if (!accessToken) {
                     throw new Error('no access token');
                 }
+                if (!ctc.refreshToken || !ctc.expiresIn) {
+                    throw new Error('OIDC refresh details are missing');
+                }
+                return {
+                    accessToken,
+                    ssoAuthn,
+                    refreshToken: ctc.refreshToken,
+                    clientId: rcc.clientId,
+                    clientSecret: rcc.clientSecret,
+                    clientSecretExpiresAt: rcc.clientSecretExpiresAt,
+                    accessTokenExpiresAt: Date.now() + ctc.expiresIn * 1000,
+                    region: config_1.identityCenterRegion,
+                    accessKeyId: '',
+                    secretAccessKey: '',
+                    sessionToken: '',
+                };
             }
             catch (e) {
                 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -71,13 +96,6 @@ function requestMFA(p) {
                 yield (0, sleep_1.sleep)(5000);
             }
         } while (!accessToken);
-        return {
-            accessToken,
-            ssoAuthn,
-            region: config_1.identityCenterRegion,
-            accessKeyId: '',
-            secretAccessKey: '',
-            sessionToken: '',
-        };
+        throw new Error('no access token');
     });
 }

package/dist/helpers/oidcRefresh.d.ts

@@ -0,0 +1,6 @@
+import type { IAwsCreds } from '../types';
+export declare class InteractiveSignInRequiredError extends Error {
+    name: string;
+}
+export declare function requiresInteractiveSignIn(e: unknown): boolean;
+export declare function refreshAccessToken(p: IAwsCreds): Promise<IAwsCreds>;

package/dist/helpers/oidcRefresh.js

@@ -0,0 +1,55 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InteractiveSignInRequiredError = void 0;
+exports.requiresInteractiveSignIn = requiresInteractiveSignIn;
+exports.refreshAccessToken = refreshAccessToken;
+const client_sso_oidc_1 = require("@aws-sdk/client-sso-oidc");
+const config_1 = require("../config");
+class InteractiveSignInRequiredError extends Error {
+    constructor() {
+        super(...arguments);
+        this.name = 'InteractiveSignInRequiredError';
+    }
+}
+exports.InteractiveSignInRequiredError = InteractiveSignInRequiredError;
+function requiresInteractiveSignIn(e) {
+    return (e instanceof Error &&
+        [
+            'InteractiveSignInRequiredError',
+            'InvalidGrantException',
+            'InvalidClientException',
+            'UnauthorizedClientException',
+        ].includes(e.name));
+}
+function refreshAccessToken(p) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!p.refreshToken || !p.clientId || !p.clientSecret) {
+            throw new InteractiveSignInRequiredError('OIDC refresh details are missing');
+        }
+        if (p.clientSecretExpiresAt &&
+            p.clientSecretExpiresAt <= Math.floor(Date.now() / 1000)) {
+            throw new InteractiveSignInRequiredError('OIDC client registration has expired');
+        }
+        const response = yield new client_sso_oidc_1.SSOOIDCClient({
+            region: config_1.identityCenterRegion,
+        }).send(new client_sso_oidc_1.CreateTokenCommand({
+            clientId: p.clientId,
+            clientSecret: p.clientSecret,
+            grantType: 'refresh_token',
+            refreshToken: p.refreshToken,
+        }));
+        if (!response.accessToken || !response.expiresIn) {
+            throw new Error('OIDC refresh did not return an access token');
+        }
+        return Object.assign(Object.assign({}, p), { accessToken: response.accessToken, refreshToken: response.refreshToken || p.refreshToken, accessTokenExpiresAt: Date.now() + response.expiresIn * 1000 });
+    });
+}

package/dist/helpers/sso.d.ts

@@ -6,13 +6,8 @@ export declare const getAssumedRole: (p: {
     accountId: string;
     roleName: string;
 }>;
-export declare const getOIDCCredentialsFromAccessToken: (p: {
-    accessToken: string;
-    ssoAuthn: string;
-}) => Promise<IAwsCreds>;
-export declare function appInstances(p: {
-    ssoAuthn: string;
-}): Promise<IAppInstance[]>;
+export declare const getOIDCCredentialsFromAccessToken: (p: IAwsCreds, accountId?: string) => Promise<IAwsCreds>;
+export declare function appInstances(p: Pick<IAwsCreds, 'accessToken' | 'ssoAuthn'>): Promise<IAppInstance[]>;
 export declare function getSamlAssertion(p: IAwsCreds, instance: IAppInstance): Promise<{
     samlAssertion: string;
     providerArn: string;

package/dist/helpers/sso.js

@@ -15,13 +15,37 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.tryExistingCredentials = exports.getOIDCCredentialsFromAccessToken = exports.getAssumedRole = void 0;
 exports.appInstances = appInstances;
 exports.getSamlAssertion = getSamlAssertion;
+/* eslint-disable no-await-in-loop */
 const client_sso_1 = require("@aws-sdk/client-sso");
 const log_1 = require("ag-common/dist/common/helpers/log");
 const string_1 = require("ag-common/dist/common/helpers/string");
 const node_fetch_1 = __importDefault(require("node-fetch"));
 const config_1 = require("../config");
 const awsconfig_1 = require("./awsconfig");
-const sts_1 = require("./sts");
+const oidcRefresh_1 = require("./oidcRefresh");
+const portalTokens = (p) => [...new Set([p.ssoAuthn, p.accessToken])].filter(Boolean);
+function fetchPortalJson(url, p, isValid) {
+    return __awaiter(this, void 0, void 0, function* () {
+        // Each token is tried in order because portal and OIDC sessions can expire independently.
+        for (const token of portalTokens(p)) {
+            const response = yield (0, node_fetch_1.default)(url, {
+                headers: { 'x-amz-sso_bearer_token': token },
+            });
+            if (response.status === 401) {
+                continue;
+            }
+            if (response.status >= 400) {
+                throw new Error(`AWS portal request failed (HTTP ${response.status})`);
+            }
+            const body = (yield response.json());
+            if (!isValid(body)) {
+                throw new Error('AWS portal returned an unexpected response');
+            }
+            return body;
+        }
+        throw new oidcRefresh_1.InteractiveSignInRequiredError('Cached portal tokens were rejected');
+    });
+}
 const getAssumedRole = (p) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b, _c, _d;
     const sso = new client_sso_1.SSOClient({ region: config_1.identityCenterRegion });
@@ -51,9 +75,9 @@ const getAssumedRole = (p) => __awaiter(void 0, void 0, void 0, function* () {
     return role;
 });
 exports.getAssumedRole = getAssumedRole;
-const getOIDCCredentialsFromAccessToken = (p) => __awaiter(void 0, void 0, void 0, function* () {
+const getOIDCCredentialsFromAccessToken = (p, accountId) => __awaiter(void 0, void 0, void 0, function* () {
     const sso = new client_sso_1.SSOClient({ region: config_1.identityCenterRegion });
-    const role = yield (0, exports.getAssumedRole)({ accessToken: p.accessToken });
+    const role = yield (0, exports.getAssumedRole)({ accessToken: p.accessToken, accountId });
     const ssoResp = yield sso.send(new client_sso_1.GetRoleCredentialsCommand(Object.assign(Object.assign({}, role), { accessToken: p.accessToken })));
     const rc = ssoResp.roleCredentials;
     if (!(rc === null || rc === void 0 ? void 0 : rc.accessKeyId) ||
@@ -67,25 +91,19 @@ const getOIDCCredentialsFromAccessToken = (p) => __awaiter(void 0, void 0, void
 exports.getOIDCCredentialsFromAccessToken = getOIDCCredentialsFromAccessToken;
 function appInstances(p) {
     return __awaiter(this, void 0, void 0, function* () {
-        const ai = (yield (yield (0, node_fetch_1.default)(`https://portal.sso.${config_1.identityCenterRegion}.amazonaws.com/instance/appinstances`, { headers: { 'x-amz-sso_bearer_token': p.ssoAuthn } })).json());
-        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
-        if (!ai.result) {
-            throw new Error('appinstance error' + JSON.stringify(ai, null, 2));
-        }
+        const ai = yield fetchPortalJson(`https://portal.sso.${config_1.identityCenterRegion}.amazonaws.com/instance/appinstances`, p, (body) => Boolean(body.result));
         return ai.result.sort((a, b) => (a.name < b.name ? -1 : 1));
     });
 }
 function getSamlAssertion(p, instance) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
-        const det = (yield (yield (0, node_fetch_1.default)(`https://portal.sso.${config_1.identityCenterRegion}.amazonaws.com/instance/appinstance/${instance.id}/profiles`, { headers: { 'x-amz-sso_bearer_token': p.ssoAuthn } })).json());
+        const det = yield fetchPortalJson(`https://portal.sso.${config_1.identityCenterRegion}.amazonaws.com/instance/appinstance/${instance.id}/profiles`, p, (body) => { var _a; return Boolean((_a = body.result[0]) === null || _a === void 0 ? void 0 : _a.url); });
         const asserturl = (_a = det.result[0]) === null || _a === void 0 ? void 0 : _a.url;
         if (!asserturl) {
             throw new Error('assertion url cant be found');
         }
-        const assertion = (yield (yield (0, node_fetch_1.default)(asserturl, {
-            headers: { 'x-amz-sso_bearer_token': p.ssoAuthn },
-        })).json());
+        const assertion = yield fetchPortalJson(asserturl, p, (body) => Boolean(body.encodedResponse));
         const decoded = (0, string_1.fromBase64)(assertion.encodedResponse);
         const res = new RegExp(/<saml2:AttributeValue xmlns:xsi="http:\/\/www.w3.org\/2001\/XMLSchema-instance" xsi:type="xsd:string">(arn.*?)</gim).exec(decoded);
         if (!(res === null || res === void 0 ? void 0 : res[1])) {
@@ -96,7 +114,6 @@ function getSamlAssertion(p, instance) {
     });
 }
 const tryExistingCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
-    var _a;
     const credraw = yield (0, awsconfig_1.getAwsCredentials)();
     if (!credraw.default.aws_access_token) {
         return undefined;
@@ -107,40 +124,46 @@ const tryExistingCredentials = () => __awaiter(void 0, void 0, void 0, function*
         sessionToken: credraw.default.aws_session_token,
         accessToken: credraw.default.aws_access_token,
         ssoAuthn: credraw.default.aws_sso_authn,
+        refreshToken: credraw.default.aws_sso_refresh_token,
+        clientId: credraw.default.aws_sso_client_id,
+        clientSecret: credraw.default.aws_sso_client_secret,
+        clientSecretExpiresAt: Number(credraw.default.aws_sso_client_secret_expires_at) || undefined,
+        accessTokenExpiresAt: Number(credraw.default.aws_sso_access_token_expires_at) || undefined,
         region: config_1.identityCenterRegion,
     };
-    const v = yield (0, sts_1.validateCredentials)(credentials);
-    if (v) {
-        return credentials;
+    const refresh = () => __awaiter(void 0, void 0, void 0, function* () {
+        credentials = yield (0, oidcRefresh_1.refreshAccessToken)(credentials);
+        yield (0, awsconfig_1.updateAwsCredentials)(credentials);
+    });
+    try {
+        yield appInstances(credentials);
     }
-    if (credraw.default.aws_access_token && credraw.default.aws_sso_authn) {
+    catch (e) {
+        if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(e)) {
+            throw e;
+        }
         try {
-            (0, log_1.info)('trying oidc refresh');
-            credentials = yield (0, exports.getOIDCCredentialsFromAccessToken)({
-                accessToken: credraw.default.aws_access_token,
-                ssoAuthn: credraw.default.aws_sso_authn,
-            });
-            return credentials;
+            yield refresh();
+            yield appInstances(credentials);
         }
         catch (e) {
-            //
-            const em = e.toString();
-            // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
-            if ((_a = em.includes('is expired')) !== null && _a !== void 0 ? _a : em.includes('or invalid')) {
-                (0, log_1.info)('access token or sso expired, need to wipe');
-            }
-            else {
-                (0, log_1.info)(e);
+            if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(e)) {
+                throw e;
             }
+            (0, log_1.warn)(`Unable to reuse the cached SSO session (${e instanceof Error ? e.name : 'unknown error'}); interactive sign-in required.`);
+            return emptyCredentials();
         }
     }
-    return {
-        accessToken: '',
-        ssoAuthn: '',
-        region: config_1.identityCenterRegion,
-        accessKeyId: '',
-        secretAccessKey: '',
-        sessionToken: '',
-    };
+    // Role credentials and portal sessions expire independently. Renew the role
+    // only after the user selects an application; SAML does not need OIDC.
+    return credentials;
 });
 exports.tryExistingCredentials = tryExistingCredentials;
+const emptyCredentials = () => ({
+    accessToken: '',
+    ssoAuthn: '',
+    region: config_1.identityCenterRegion,
+    accessKeyId: '',
+    secretAccessKey: '',
+    sessionToken: '',
+});

package/dist/helpers/sts.d.ts

@@ -1,4 +1,4 @@
-import type { IAwsCreds, SearchMetadata } from '../types';
+import type { IAwsCreds } from '../types';
 export declare function validateCredentials(credentials: IAwsCreds): Promise<{
     accountId: string;
     principalArn: string;
@@ -10,15 +10,3 @@ export declare function getApplicationCreds(p: {
     providerArn: string;
     roleArn: string;
 }): Promise<IAwsCreds>;
-export declare function directStsAssume(p: {
-    credentials: IAwsCreds;
-    targetRegion: string;
-    metadata: SearchMetadata;
-}): Promise<{
-    region: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    sessionToken: string;
-    accessToken: string;
-    ssoAuthn: string;
-}>;

package/dist/helpers/sts.js

@@ -11,11 +11,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateCredentials = validateCredentials;
 exports.getApplicationCreds = getApplicationCreds;
-exports.directStsAssume = directStsAssume;
 const client_sts_1 = require("@aws-sdk/client-sts");
 const log_1 = require("ag-common/dist/common/helpers/log");
 const config_1 = require("../config");
-const sso_1 = require("./sso");
 function validateCredentials(credentials) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
@@ -25,7 +23,6 @@ function validateCredentials(credentials) {
         });
         try {
             const stub = yield sts.getCallerIdentity({});
-            yield (0, sso_1.appInstances)(credentials);
             if (((_a = stub.$metadata.httpStatusCode) !== null && _a !== void 0 ? _a : 500) < 400 &&
                 stub.Account &&
                 stub.Arn) {
@@ -68,30 +65,3 @@ function getApplicationCreds(p) {
         return Object.assign(Object.assign({}, p.originCreds), { region: p.targetRegion, accessKeyId: ret.Credentials.AccessKeyId, secretAccessKey: ret.Credentials.SecretAccessKey, sessionToken: ret.Credentials.SessionToken });
     });
 }
-function directStsAssume(p) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        const role = yield (0, sso_1.getAssumedRole)({
-            accessToken: p.credentials.accessToken,
-            accountId: p.metadata.AccountId,
-        });
-        const sts = new client_sts_1.STS({
-            credentials: p.credentials,
-            region: p.targetRegion,
-        });
-        const ar = yield sts.assumeRole({
-            RoleArn: `arn:aws:iam::${role.accountId}:role/${role.roleName}`,
-            RoleSessionName: 'awsauth',
-            DurationSeconds: config_1.nativeStsDurationSeconds,
-        });
-        if (((_a = ar.$metadata.httpStatusCode) !== null && _a !== void 0 ? _a : 500) >= 400) {
-            throw new Error('assume role error' + JSON.stringify(ar, null, 2));
-        }
-        if (!((_b = ar.Credentials) === null || _b === void 0 ? void 0 : _b.AccessKeyId) ||
-            !ar.Credentials.SecretAccessKey ||
-            !ar.Credentials.SessionToken) {
-            throw new Error('no creds');
-        }
-        return Object.assign(Object.assign({}, p.credentials), { region: p.targetRegion, accessKeyId: ar.Credentials.AccessKeyId, secretAccessKey: ar.Credentials.SecretAccessKey, sessionToken: ar.Credentials.SessionToken });
-    });
-}

package/dist/index.js

@@ -23,6 +23,7 @@ const config_1 = require("./config");
 const awsconfig_1 = require("./helpers/awsconfig");
 const input_1 = require("./helpers/input");
 const oidc_1 = require("./helpers/oidc");
+const oidcRefresh_1 = require("./helpers/oidcRefresh");
 const sso_1 = require("./helpers/sso");
 const sts_1 = require("./helpers/sts");
 const version_1 = require("./helpers/version");
@@ -85,11 +86,28 @@ function main(args) {
         let debugRole = '';
         if (instance.searchMetadata) {
             (0, log_1.info)('account is native aws, directly  connecting');
-            credentials = yield (0, sts_1.directStsAssume)({
-                credentials,
-                targetRegion: config_1.targetRegion,
-                metadata: instance.searchMetadata,
-            });
+            try {
+                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, instance.searchMetadata.AccountId);
+            }
+            catch (e) {
+                if (!(e instanceof Error) || e.name !== 'UnauthorizedException') {
+                    throw e;
+                }
+                try {
+                    credentials = yield (0, oidcRefresh_1.refreshAccessToken)(credentials);
+                }
+                catch (e) {
+                    if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(e)) {
+                        throw e;
+                    }
+                    (0, log_1.warn)(`Unable to reuse the cached SSO session (${e instanceof Error ? e.name : 'unknown error'}); interactive sign-in required.`);
+                    credentials = yield (0, oidc_1.requestMFA)({ identityCenterRegion: config_1.identityCenterRegion, ssoStartUrl: config_1.ssoStartUrl });
+                }
+                // Save rotated tokens before another AWS request can fail.
+                yield (0, awsconfig_1.updateAwsCredentials)(credentials);
+                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, instance.searchMetadata.AccountId);
+            }
+            credentials.region = config_1.targetRegion;
             debugRole = instance.searchMetadata.AccountId;
         }
         else {

package/dist/types.d.ts

@@ -5,6 +5,11 @@ export interface IAwsCreds {
     region: string;
     accessToken: string;
     ssoAuthn: string;
+    refreshToken?: string;
+    clientId?: string;
+    clientSecret?: string;
+    clientSecretExpiresAt?: number;
+    accessTokenExpiresAt?: number;
 }
 export interface IAwsCredsRaw {
     region: string;
@@ -13,6 +18,11 @@ export interface IAwsCredsRaw {
     aws_session_token: string;
     aws_access_token: string;
     aws_sso_authn: string;
+    aws_sso_refresh_token?: string;
+    aws_sso_client_id?: string;
+    aws_sso_client_secret?: string;
+    aws_sso_client_secret_expires_at?: string;
+    aws_sso_access_token_expires_at?: string;
     aws_application_id: string;
 }
 export interface IAppInstances {

package/package.json

@@ -5,7 +5,7 @@
   "author": "andreigec@hotmail.com",
   "license": "ISC",
   "private": false,
-  "version": "0.0.290",
+  "version": "0.0.292",
   "preferGlobal": true,
   "bin": {
     "ag-awsauth": "./bin/awsauth.js"
@@ -49,6 +49,7 @@
   "scripts": {
     "lint": "eslint src",
     "format": "eslint src --fix",
+    "test": "tsc && node --test test/*.test.js",
     "start": "tsc && node bin/awsauth.js",
     "build": "tsc"
   }