ag-awsauth 0.0.299 → 0.0.300
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -1
- package/dist/helpers/oidcRefresh.js +3 -3
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -30,7 +30,8 @@ expired. A valid portal session can renew SAML role credentials directly;
|
|
|
30
30
|
native AWS accounts use the OIDC access token, refreshing it when AWS rejects
|
|
31
31
|
it. Rotated refresh tokens are saved immediately, even if a later request fails.
|
|
32
32
|
|
|
33
|
-
When AWS rejects the refresh token
|
|
33
|
+
When AWS rejects the refresh token or cached refresh request
|
|
34
|
+
(`InvalidGrantException` or `InvalidRequestException`), another sign-in
|
|
34
35
|
is required. An unexpired client registration alone does not make a refresh
|
|
35
36
|
token valid. The warning before the MFA prompt reports the reason. Portal
|
|
36
37
|
outages and network failures are reported as errors instead of requesting login.
|
|
@@ -26,11 +26,12 @@ class InteractiveSignInRequiredError extends Error {
|
|
|
26
26
|
}
|
|
27
27
|
}
|
|
28
28
|
exports.InteractiveSignInRequiredError = InteractiveSignInRequiredError;
|
|
29
|
-
//
|
|
29
|
+
// Cached refresh failures that require a new sign-in.
|
|
30
30
|
const terminalErrorNames = [
|
|
31
31
|
'InteractiveSignInRequiredError',
|
|
32
32
|
'InvalidGrantException',
|
|
33
33
|
'InvalidClientException',
|
|
34
|
+
'InvalidRequestException',
|
|
34
35
|
'UnauthorizedClientException',
|
|
35
36
|
];
|
|
36
37
|
function requiresInteractiveSignIn(e) {
|
|
@@ -50,7 +51,6 @@ function needsRefresh(p) {
|
|
|
50
51
|
}
|
|
51
52
|
return p.accessTokenExpiresAt - Date.now() <= config_1.refreshWindowMs;
|
|
52
53
|
}
|
|
53
|
-
const fingerprint = (t) => (t ? `${t.slice(0, 8)}...` : 'none');
|
|
54
54
|
function refreshAccessToken(p) {
|
|
55
55
|
return __awaiter(this, void 0, void 0, function* () {
|
|
56
56
|
if (!hasRefreshMaterial(p)) {
|
|
@@ -60,7 +60,7 @@ function refreshAccessToken(p) {
|
|
|
60
60
|
p.clientSecretExpiresAt <= Math.floor(Date.now() / 1000)) {
|
|
61
61
|
throw new InteractiveSignInRequiredError('OIDC client registration has expired');
|
|
62
62
|
}
|
|
63
|
-
(0, log_1.info)(
|
|
63
|
+
(0, log_1.info)('refreshing OIDC access token');
|
|
64
64
|
const response = yield new client_sso_oidc_1.SSOOIDCClient({
|
|
65
65
|
region: config_1.identityCenterRegion,
|
|
66
66
|
}).send(new client_sso_oidc_1.CreateTokenCommand({
|