ag-awsauth 0.0.294 → 0.0.295

package/dist/config.d.ts

@@ -11,3 +11,6 @@ export declare const runConfig: () => void;
 export declare const timeoutMs = 30000;
 export declare const timeoutShortMs = 3000;
 export declare const timeoutMedMs = 6000;
+export declare const refreshWindowMs: number;
+export declare const credentialsLockTimeoutMs: number;
+export declare const credentialsLockStaleMs: number;

package/dist/config.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.timeoutMedMs = exports.timeoutShortMs = exports.timeoutMs = exports.runConfig = exports.setConfig = exports.validateConfig = exports.targetRegion = exports.ssoStartUrl = exports.identityCenterRegion = exports.setBasePath = exports.basePath = exports.stsDurationSeconds = exports.logPath = void 0;
+exports.credentialsLockStaleMs = exports.credentialsLockTimeoutMs = exports.refreshWindowMs = exports.timeoutMedMs = exports.timeoutShortMs = exports.timeoutMs = exports.runConfig = exports.setConfig = exports.validateConfig = exports.targetRegion = exports.ssoStartUrl = exports.identityCenterRegion = exports.setBasePath = exports.basePath = exports.stsDurationSeconds = exports.logPath = void 0;
 const envfile_1 = require("envfile");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -53,3 +53,10 @@ exports.runConfig = runConfig;
 exports.timeoutMs = 30000;
 exports.timeoutShortMs = 3000;
 exports.timeoutMedMs = 6000;
+// Refresh the OIDC access token this far ahead of expiry so the rotating
+// refresh-token chain stays alive instead of being used lazily after a 401.
+exports.refreshWindowMs = 5 * 60 * 1000;
+// Serialise credential file updates across processes. A refresh token is
+// single-use, so two concurrent runs must never refresh at the same time.
+exports.credentialsLockTimeoutMs = 10 * 1000;
+exports.credentialsLockStaleMs = 30 * 1000;

package/dist/helpers/awsconfig.d.ts

@@ -1,3 +1,12 @@
 import type { IAwsCreds, IAwsCredsRaw } from '../types';
 export declare const getAwsCredentials: () => Promise<Record<string, IAwsCredsRaw>>;
+export declare const readAwsCredentials: () => Promise<IAwsCreds | undefined>;
+/**
+ * Read-modify-write of the credentials file. Callers must already hold the
+ * credentials lock (use `updateAwsCredentials` unless you are inside one).
+ *
+ * OIDC refresh material is preserved unless explicitly replaced: a partial
+ * credentials object must never wipe the only token that avoids a full login.
+ */
+export declare const saveAwsCredentialsUnlocked: (p: IAwsCreds | undefined) => Promise<void>;
 export declare const updateAwsCredentials: (p: IAwsCreds | undefined) => Promise<void>;

package/dist/helpers/awsconfig.js

@@ -12,15 +12,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateAwsCredentials = exports.getAwsCredentials = void 0;
+exports.updateAwsCredentials = exports.saveAwsCredentialsUnlocked = exports.readAwsCredentials = exports.getAwsCredentials = void 0;
 const shared_ini_file_loader_1 = require("@aws-sdk/shared-ini-file-loader");
 const log_1 = require("ag-common/dist/common/helpers/log");
 const fs_1 = __importDefault(require("fs"));
 const ini_1 = require("ini");
 const path_1 = require("path");
+const config_1 = require("../config");
+const credentialsLock_1 = require("./credentialsLock");
 const getCredentialsFilepath_1 = require("./getCredentialsFilepath");
 const getAwsCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
-    const config = yield (0, shared_ini_file_loader_1.loadSharedConfigFiles)();
+    // Read fresh from disk: the SDK caches file contents per path, which hides
+    // tokens rotated by another process (or by an earlier step of this run).
+    const config = yield (0, shared_ini_file_loader_1.loadSharedConfigFiles)({ ignoreCache: true });
     const creds = config.credentialsFile;
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
     if (!creds.default) {
@@ -31,7 +35,34 @@ const getAwsCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
     return ret;
 });
 exports.getAwsCredentials = getAwsCredentials;
-const updateAwsCredentials = (p) => __awaiter(void 0, void 0, void 0, function* () {
+const readAwsCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
+    const credraw = yield (0, exports.getAwsCredentials)();
+    if (!credraw.default.aws_access_token) {
+        return undefined;
+    }
+    return {
+        accessKeyId: credraw.default.aws_access_key_id,
+        secretAccessKey: credraw.default.aws_secret_access_key,
+        sessionToken: credraw.default.aws_session_token,
+        accessToken: credraw.default.aws_access_token,
+        ssoAuthn: credraw.default.aws_sso_authn,
+        refreshToken: credraw.default.aws_sso_refresh_token,
+        clientId: credraw.default.aws_sso_client_id,
+        clientSecret: credraw.default.aws_sso_client_secret,
+        clientSecretExpiresAt: Number(credraw.default.aws_sso_client_secret_expires_at) || undefined,
+        accessTokenExpiresAt: Number(credraw.default.aws_sso_access_token_expires_at) || undefined,
+        region: config_1.identityCenterRegion,
+    };
+});
+exports.readAwsCredentials = readAwsCredentials;
+/**
+ * Read-modify-write of the credentials file. Callers must already hold the
+ * credentials lock (use `updateAwsCredentials` unless you are inside one).
+ *
+ * OIDC refresh material is preserved unless explicitly replaced: a partial
+ * credentials object must never wipe the only token that avoids a full login.
+ */
+const saveAwsCredentialsUnlocked = (p) => __awaiter(void 0, void 0, void 0, function* () {
     const creds = yield (0, exports.getAwsCredentials)();
     if (!p) {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -44,26 +75,23 @@ const updateAwsCredentials = (p) => __awaiter(void 0, void 0, void 0, function*
         creds.default.aws_session_token = p.sessionToken;
         creds.default.aws_access_token = p.accessToken;
         creds.default.aws_sso_authn = p.ssoAuthn;
-        if (p.refreshToken &&
-            p.clientId &&
-            p.clientSecret &&
-            p.clientSecretExpiresAt &&
-            p.accessTokenExpiresAt) {
+        if (p.refreshToken) {
             creds.default.aws_sso_refresh_token = p.refreshToken;
+        }
+        if (p.clientId) {
             creds.default.aws_sso_client_id = p.clientId;
+        }
+        if (p.clientSecret) {
             creds.default.aws_sso_client_secret = p.clientSecret;
+        }
+        if (p.clientSecretExpiresAt) {
             creds.default.aws_sso_client_secret_expires_at =
                 p.clientSecretExpiresAt.toString();
+        }
+        if (p.accessTokenExpiresAt) {
             creds.default.aws_sso_access_token_expires_at =
                 p.accessTokenExpiresAt.toString();
         }
-        else {
-            delete creds.default.aws_sso_refresh_token;
-            delete creds.default.aws_sso_client_id;
-            delete creds.default.aws_sso_client_secret;
-            delete creds.default.aws_sso_client_secret_expires_at;
-            delete creds.default.aws_sso_access_token_expires_at;
-        }
     }
     const newcreds = (0, ini_1.stringify)(creds);
     (0, log_1.info)(`saving updated default creds to .aws/credentials`);
@@ -73,6 +101,8 @@ const updateAwsCredentials = (p) => __awaiter(void 0, void 0, void 0, function*
         fs_1.default.mkdirSync(credentialsDir, { recursive: true });
         (0, log_1.info)(`created AWS credentials directory: ${credentialsDir}`);
     }
-    fs_1.default.writeFileSync(credspath, newcreds);
+    (0, credentialsLock_1.writeFileAtomic)(credspath, newcreds);
 });
+exports.saveAwsCredentialsUnlocked = saveAwsCredentialsUnlocked;
+const updateAwsCredentials = (p) => __awaiter(void 0, void 0, void 0, function* () { return (0, credentialsLock_1.withCredentialsLock)(() => (0, exports.saveAwsCredentialsUnlocked)(p)); });
 exports.updateAwsCredentials = updateAwsCredentials;

package/dist/helpers/credentialsLock.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Runs `fn` while holding an exclusive, cross-process lock next to the
+ * credentials file. Credential updates must be serialised because a rotated
+ * OIDC refresh token is single-use: two overlapping runs that refresh at the
+ * same time leave a dead token on disk.
+ */
+export declare function withCredentialsLock<T>(fn: () => Promise<T>): Promise<T>;
+/**
+ * Writes via a temp file and an atomic rename so a crash can never leave a
+ * truncated credentials file (which would lose the refresh token).
+ */
+export declare const writeFileAtomic: (filePath: string, contents: string) => void;

package/dist/helpers/credentialsLock.js

@@ -0,0 +1,102 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeFileAtomic = void 0;
+exports.withCredentialsLock = withCredentialsLock;
+/* eslint-disable no-await-in-loop */
+const sleep_1 = require("ag-common/dist/common/helpers/sleep");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = require("path");
+const config_1 = require("../config");
+const getCredentialsFilepath_1 = require("./getCredentialsFilepath");
+const getLockPath = () => `${(0, getCredentialsFilepath_1.getCredentialsFilepath)()}.lock`;
+const ensureCredentialsDir = () => {
+    const dir = (0, path_1.dirname)((0, getCredentialsFilepath_1.getCredentialsFilepath)());
+    if (!fs_1.default.existsSync(dir)) {
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    }
+};
+const tryAcquire = () => {
+    try {
+        fs_1.default.mkdirSync(getLockPath());
+        return true;
+    }
+    catch (e) {
+        if (e.code === 'EEXIST') {
+            return false;
+        }
+        throw e;
+    }
+};
+const isStale = () => {
+    try {
+        return (Date.now() - fs_1.default.statSync(getLockPath()).mtimeMs > config_1.credentialsLockStaleMs);
+    }
+    catch (_a) {
+        return false;
+    }
+};
+const release = () => {
+    try {
+        fs_1.default.rmSync(getLockPath(), { recursive: true, force: true });
+    }
+    catch (_a) {
+        //
+    }
+};
+/**
+ * Runs `fn` while holding an exclusive, cross-process lock next to the
+ * credentials file. Credential updates must be serialised because a rotated
+ * OIDC refresh token is single-use: two overlapping runs that refresh at the
+ * same time leave a dead token on disk.
+ */
+function withCredentialsLock(fn) {
+    return __awaiter(this, void 0, void 0, function* () {
+        ensureCredentialsDir();
+        const deadline = Date.now() + config_1.credentialsLockTimeoutMs;
+        while (!tryAcquire()) {
+            if (isStale()) {
+                release();
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                // Another process is holding the lock. Proceed best-effort rather than
+                // blocking the user forever; stale-lock handling bounds the risk.
+                return fn();
+            }
+            yield (0, sleep_1.sleep)(100);
+        }
+        try {
+            const result = yield fn();
+            return result;
+        }
+        finally {
+            release();
+        }
+    });
+}
+/**
+ * Writes via a temp file and an atomic rename so a crash can never leave a
+ * truncated credentials file (which would lose the refresh token).
+ */
+const writeFileAtomic = (filePath, contents) => {
+    const dir = (0, path_1.dirname)(filePath);
+    if (!fs_1.default.existsSync(dir)) {
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    }
+    const tmp = (0, path_1.join)(dir, `.${process.pid}.${Date.now()}.tmp`);
+    fs_1.default.writeFileSync(tmp, contents);
+    fs_1.default.renameSync(tmp, filePath);
+};
+exports.writeFileAtomic = writeFileAtomic;

package/dist/helpers/oidcRefresh.d.ts

@@ -3,4 +3,18 @@ export declare class InteractiveSignInRequiredError extends Error {
     name: string;
 }
 export declare function requiresInteractiveSignIn(e: unknown): boolean;
+/**
+ * True when the access token is missing, has unknown expiry, or is within the
+ * proactive refresh window of expiring.
+ */
+export declare function needsRefresh(p: IAwsCreds): boolean;
 export declare function refreshAccessToken(p: IAwsCreds): Promise<IAwsCreds>;
+/**
+ * Refreshes the OIDC access token ahead of expiry so the rotating refresh
+ * token chain stays alive, then persists the result atomically under a lock.
+ *
+ * Terminal failures (rejected/expired refresh token) are rethrown so the
+ * caller can start an interactive sign-in. Transient failures keep the cached
+ * token and never wipe it.
+ */
+export declare function ensureFreshCredentials(p: IAwsCreds): Promise<IAwsCreds>;

package/dist/helpers/oidcRefresh.js

@@ -11,9 +11,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InteractiveSignInRequiredError = void 0;
 exports.requiresInteractiveSignIn = requiresInteractiveSignIn;
+exports.needsRefresh = needsRefresh;
 exports.refreshAccessToken = refreshAccessToken;
+exports.ensureFreshCredentials = ensureFreshCredentials;
 const client_sso_oidc_1 = require("@aws-sdk/client-sso-oidc");
+const log_1 = require("ag-common/dist/common/helpers/log");
 const config_1 = require("../config");
+const awsconfig_1 = require("./awsconfig");
+const credentialsLock_1 = require("./credentialsLock");
 class InteractiveSignInRequiredError extends Error {
     constructor() {
         super(...arguments);
@@ -21,24 +26,41 @@ class InteractiveSignInRequiredError extends Error {
     }
 }
 exports.InteractiveSignInRequiredError = InteractiveSignInRequiredError;
+// Errors that mean the stored registration/token can never be reused.
+const terminalErrorNames = [
+    'InteractiveSignInRequiredError',
+    'InvalidGrantException',
+    'InvalidClientException',
+    'UnauthorizedClientException',
+];
 function requiresInteractiveSignIn(e) {
-    return (e instanceof Error &&
-        [
-            'InteractiveSignInRequiredError',
-            'InvalidGrantException',
-            'InvalidClientException',
-            'UnauthorizedClientException',
-        ].includes(e.name));
+    return e instanceof Error && terminalErrorNames.includes(e.name);
 }
+const hasRefreshMaterial = (p) => Boolean(p.refreshToken && p.clientId && p.clientSecret);
+/**
+ * True when the access token is missing, has unknown expiry, or is within the
+ * proactive refresh window of expiring.
+ */
+function needsRefresh(p) {
+    if (!p.accessToken) {
+        return true;
+    }
+    if (!p.accessTokenExpiresAt) {
+        return true;
+    }
+    return p.accessTokenExpiresAt - Date.now() <= config_1.refreshWindowMs;
+}
+const fingerprint = (t) => (t ? `${t.slice(0, 8)}...` : 'none');
 function refreshAccessToken(p) {
     return __awaiter(this, void 0, void 0, function* () {
-        if (!p.refreshToken || !p.clientId || !p.clientSecret) {
+        if (!hasRefreshMaterial(p)) {
             throw new InteractiveSignInRequiredError('OIDC refresh details are missing');
         }
         if (p.clientSecretExpiresAt &&
             p.clientSecretExpiresAt <= Math.floor(Date.now() / 1000)) {
             throw new InteractiveSignInRequiredError('OIDC client registration has expired');
         }
+        (0, log_1.info)(`refreshing OIDC token with refresh token ${fingerprint(p.refreshToken)}`);
         const response = yield new client_sso_oidc_1.SSOOIDCClient({
             region: config_1.identityCenterRegion,
         }).send(new client_sso_oidc_1.CreateTokenCommand({
@@ -50,6 +72,45 @@ function refreshAccessToken(p) {
         if (!response.accessToken || !response.expiresIn) {
             throw new Error('OIDC refresh did not return an access token');
         }
+        const rotated = Boolean(response.refreshToken && response.refreshToken !== p.refreshToken);
+        (0, log_1.info)(`OIDC refresh succeeded; refresh token ${rotated ? 'rotated' : 'reused'}`);
         return Object.assign(Object.assign({}, p), { accessToken: response.accessToken, refreshToken: response.refreshToken || p.refreshToken, accessTokenExpiresAt: Date.now() + response.expiresIn * 1000 });
     });
 }
+/**
+ * Refreshes the OIDC access token ahead of expiry so the rotating refresh
+ * token chain stays alive, then persists the result atomically under a lock.
+ *
+ * Terminal failures (rejected/expired refresh token) are rethrown so the
+ * caller can start an interactive sign-in. Transient failures keep the cached
+ * token and never wipe it.
+ */
+function ensureFreshCredentials(p) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!hasRefreshMaterial(p) || !needsRefresh(p)) {
+            return p;
+        }
+        try {
+            const refreshed = yield (0, credentialsLock_1.withCredentialsLock)(() => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                // Another process may have refreshed while we waited for the lock.
+                const latest = (_a = (yield (0, awsconfig_1.readAwsCredentials)())) !== null && _a !== void 0 ? _a : p;
+                if (!hasRefreshMaterial(latest) || !needsRefresh(latest)) {
+                    (0, log_1.info)('OIDC token already refreshed by another process; reusing it');
+                    return latest;
+                }
+                const rotated = yield refreshAccessToken(latest);
+                yield (0, awsconfig_1.saveAwsCredentialsUnlocked)(rotated);
+                return rotated;
+            }));
+            return refreshed;
+        }
+        catch (e) {
+            if (requiresInteractiveSignIn(e)) {
+                throw e;
+            }
+            (0, log_1.warn)(`Unable to refresh OIDC token (${e instanceof Error ? e.name : 'unknown error'}); using cached token`);
+            return p;
+        }
+    });
+}

package/dist/helpers/sso.js

@@ -114,23 +114,24 @@ function getSamlAssertion(p, instance) {
     });
 }
 const tryExistingCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
-    const credraw = yield (0, awsconfig_1.getAwsCredentials)();
-    if (!credraw.default.aws_access_token) {
+    const loaded = yield (0, awsconfig_1.readAwsCredentials)();
+    if (!loaded) {
         return undefined;
     }
-    let credentials = {
-        accessKeyId: credraw.default.aws_access_key_id,
-        secretAccessKey: credraw.default.aws_secret_access_key,
-        sessionToken: credraw.default.aws_session_token,
-        accessToken: credraw.default.aws_access_token,
-        ssoAuthn: credraw.default.aws_sso_authn,
-        refreshToken: credraw.default.aws_sso_refresh_token,
-        clientId: credraw.default.aws_sso_client_id,
-        clientSecret: credraw.default.aws_sso_client_secret,
-        clientSecretExpiresAt: Number(credraw.default.aws_sso_client_secret_expires_at) || undefined,
-        accessTokenExpiresAt: Number(credraw.default.aws_sso_access_token_expires_at) || undefined,
-        region: config_1.identityCenterRegion,
-    };
+    let credentials = loaded;
+    // Refresh proactively, independent of the portal session: the portal token
+    // can still be valid while the OIDC token is stale, and letting the refresh
+    // token go unused is what eventually kills it.
+    try {
+        credentials = yield (0, oidcRefresh_1.ensureFreshCredentials)(credentials);
+    }
+    catch (e) {
+        if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(e)) {
+            throw e;
+        }
+        (0, log_1.warn)(`Unable to reuse the cached SSO session (${e instanceof Error ? e.name : 'unknown error'}); interactive sign-in required.`);
+        return emptyCredentials();
+    }
     const refresh = () => __awaiter(void 0, void 0, void 0, function* () {
         credentials = yield (0, oidcRefresh_1.refreshAccessToken)(credentials);
         yield (0, awsconfig_1.updateAwsCredentials)(credentials);

package/dist/index.js

@@ -74,6 +74,9 @@ function main(args) {
                 identityCenterRegion: config_1.identityCenterRegion,
                 ssoStartUrl: config_1.ssoStartUrl,
             });
+            // Persist the fresh refresh registration before any AWS call can fail;
+            // otherwise a later error would throw away the only non-interactive token.
+            yield (0, awsconfig_1.updateAwsCredentials)(credentials);
             (0, log_1.info)('get oidc creds');
             credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials);
         }
@@ -86,8 +89,20 @@ function main(args) {
         let debugRole = '';
         if (instance.searchMetadata) {
             (0, log_1.info)('account is native aws, directly  connecting');
+            const accountId = instance.searchMetadata.AccountId;
             try {
-                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, instance.searchMetadata.AccountId);
+                credentials = yield (0, oidcRefresh_1.ensureFreshCredentials)(credentials);
+            }
+            catch (e) {
+                if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(e)) {
+                    throw e;
+                }
+                (0, log_1.warn)(`Unable to reuse the cached SSO session (${e instanceof Error ? e.name : 'unknown error'}); interactive sign-in required.`);
+                credentials = yield (0, oidc_1.requestMFA)({ identityCenterRegion: config_1.identityCenterRegion, ssoStartUrl: config_1.ssoStartUrl });
+                yield (0, awsconfig_1.updateAwsCredentials)(credentials);
+            }
+            try {
+                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, accountId);
             }
             catch (e) {
                 if (!(e instanceof Error) || e.name !== 'UnauthorizedException') {
@@ -95,20 +110,20 @@ function main(args) {
                 }
                 try {
                     credentials = yield (0, oidcRefresh_1.refreshAccessToken)(credentials);
+                    yield (0, awsconfig_1.updateAwsCredentials)(credentials);
                 }
-                catch (e) {
-                    if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(e)) {
-                        throw e;
+                catch (refreshError) {
+                    if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(refreshError)) {
+                        throw refreshError;
                     }
-                    (0, log_1.warn)(`Unable to reuse the cached SSO session (${e instanceof Error ? e.name : 'unknown error'}); interactive sign-in required.`);
+                    (0, log_1.warn)(`Unable to reuse the cached SSO session (${refreshError instanceof Error ? refreshError.name : 'unknown error'}); interactive sign-in required.`);
                     credentials = yield (0, oidc_1.requestMFA)({ identityCenterRegion: config_1.identityCenterRegion, ssoStartUrl: config_1.ssoStartUrl });
+                    yield (0, awsconfig_1.updateAwsCredentials)(credentials);
                 }
-                // Save rotated tokens before another AWS request can fail.
-                yield (0, awsconfig_1.updateAwsCredentials)(credentials);
-                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, instance.searchMetadata.AccountId);
+                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, accountId);
             }
             credentials.region = config_1.targetRegion;
-            debugRole = instance.searchMetadata.AccountId;
+            debugRole = accountId;
         }
         else {
             (0, log_1.info)('account is external app, getting saml');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ag-awsauth",
-  "version": "0.0.294",
+  "version": "0.0.295",
   "private": false,
   "description": "auth to aws sso/iamv2 easily",
   "license": "ISC",