ag-awsauth 0.0.7 → 0.0.10

package/dist/helpers/sso.js

@@ -1,137 +1,143 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.tryExistingCredentials = exports.getSamlAssertion = exports.appInstances = exports.getOIDCCredentialsFromAccessToken = exports.getAssumedRole = void 0;
-const client_sso_1 = require("@aws-sdk/client-sso");
-const log_1 = require("ag-common/dist/common/helpers/log");
-const string_1 = require("ag-common/dist/common/helpers/string");
-const node_fetch_1 = __importDefault(require("node-fetch"));
-const config_1 = require("../config");
-const awsconfig_1 = require("./awsconfig");
-const sts_1 = require("./sts");
-const getAssumedRole = (p) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b, _c, _d;
-    const sso = new client_sso_1.SSOClient({ region: config_1.identityCenterRegion });
-    let accountId = p.accountId;
-    if (!accountId) {
-        const accounts = yield sso.send(new client_sso_1.ListAccountsCommand({ accessToken: p.accessToken }));
-        accountId = (_b = (_a = accounts.accountList) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.accountId;
-    }
-    if (!accountId) {
-        throw new Error('no account id');
-    }
-    const rolesResult = yield sso.send(new client_sso_1.ListAccountRolesCommand({
-        accessToken: p.accessToken,
-        accountId,
-    }));
-    const roles = ((_d = (_c = rolesResult.roleList) === null || _c === void 0 ? void 0 : _c.map((r) => ({
-        accountId: r.accountId || '',
-        roleName: r.roleName || '',
-    }))) === null || _d === void 0 ? void 0 : _d.filter((r) => r.accountId && r.roleName)) || [];
-    if (roles.length === 0) {
-        throw new Error('no roles can be assumed');
-    }
-    if (roles.length > 1) {
-        throw new Error('too many roles' + JSON.stringify(roles, null, 2));
-    }
-    const role = roles[0];
-    return role;
-});
-exports.getAssumedRole = getAssumedRole;
-const getOIDCCredentialsFromAccessToken = (p) => __awaiter(void 0, void 0, void 0, function* () {
-    const sso = new client_sso_1.SSOClient({ region: config_1.identityCenterRegion });
-    const role = yield (0, exports.getAssumedRole)({ accessToken: p.accessToken });
-    const ssoResp = yield sso.send(new client_sso_1.GetRoleCredentialsCommand(Object.assign(Object.assign({}, role), { accessToken: p.accessToken })));
-    const rc = ssoResp.roleCredentials;
-    if (!(rc === null || rc === void 0 ? void 0 : rc.accessKeyId) ||
-        !(rc === null || rc === void 0 ? void 0 : rc.expiration) ||
-        !(rc === null || rc === void 0 ? void 0 : rc.secretAccessKey) ||
-        !(rc === null || rc === void 0 ? void 0 : rc.sessionToken)) {
-        throw new Error('role creds undefined:' + JSON.stringify(rc, null, 2));
-    }
-    return Object.assign(Object.assign({}, p), { accessKeyId: rc.accessKeyId, secretAccessKey: rc.secretAccessKey, sessionToken: rc.sessionToken, region: config_1.identityCenterRegion });
-});
-exports.getOIDCCredentialsFromAccessToken = getOIDCCredentialsFromAccessToken;
-function appInstances(p) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const ai = (yield (yield (0, node_fetch_1.default)(`https://portal.sso.${config_1.identityCenterRegion}.amazonaws.com/instance/appinstances`, { headers: { 'x-amz-sso_bearer_token': p.ssoAuthn } })).json());
-        if (!(ai === null || ai === void 0 ? void 0 : ai.result)) {
-            throw new Error('appinstance error' + JSON.stringify(ai, null, 2));
-        }
-        return ai.result;
-    });
-}
-exports.appInstances = appInstances;
-function getSamlAssertion(p, instance) {
-    var _a, _b;
-    return __awaiter(this, void 0, void 0, function* () {
-        const det = (yield (yield (0, node_fetch_1.default)(`https://portal.sso.${config_1.identityCenterRegion}.amazonaws.com/instance/appinstance/${instance.id}/profiles`, { headers: { 'x-amz-sso_bearer_token': p.ssoAuthn } })).json());
-        const asserturl = (_b = (_a = det === null || det === void 0 ? void 0 : det.result) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.url;
-        if (!asserturl) {
-            throw new Error('assertion url cant be found');
-        }
-        const assertion = (yield (yield (0, node_fetch_1.default)(asserturl, {
-            headers: { 'x-amz-sso_bearer_token': p.ssoAuthn },
-        })).json());
-        const decoded = (0, string_1.fromBase64)(assertion.encodedResponse);
-        const res = new RegExp(/<saml2:AttributeValue xmlns:xsi="http:\/\/www.w3.org\/2001\/XMLSchema-instance" xsi:type="xsd:string">(arn.*?)</gim).exec(decoded);
-        if (!(res === null || res === void 0 ? void 0 : res[1])) {
-            throw new Error('bad saml');
-        }
-        const [providerArn, roleArn] = res[1].split(',');
-        return { samlAssertion: assertion.encodedResponse, providerArn, roleArn };
-    });
-}
-exports.getSamlAssertion = getSamlAssertion;
-const tryExistingCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
-    const credraw = yield (0, awsconfig_1.getAwsCredentials)();
-    if (!credraw.default.aws_access_token) {
-        return undefined;
-    }
-    let credentials = {
-        accessKeyId: credraw.default.aws_access_key_id,
-        secretAccessKey: credraw.default.aws_secret_access_key,
-        sessionToken: credraw.default.aws_session_token,
-        accessToken: credraw.default.aws_access_token,
-        ssoAuthn: credraw.default.aws_sso_authn,
-        region: config_1.identityCenterRegion,
-    };
-    const v = yield (0, sts_1.validateCredentials)(credentials);
-    if (v) {
-        return credentials;
-    }
-    if (credraw.default.aws_access_token && credraw.default.aws_sso_authn) {
-        try {
-            (0, log_1.info)('trying oidc refresh');
-            credentials = yield (0, exports.getOIDCCredentialsFromAccessToken)({
-                accessToken: credraw.default.aws_access_token,
-                ssoAuthn: credraw.default.aws_sso_authn,
-            });
-            return credentials;
-        }
-        catch (e) {
-            //
-            (0, log_1.info)('access token or sso expired, need to wipe', e);
-        }
-    }
-    return {
-        accessToken: '',
-        ssoAuthn: '',
-        region: config_1.identityCenterRegion,
-        accessKeyId: '',
-        secretAccessKey: '',
-        sessionToken: '',
-    };
-});
-exports.tryExistingCredentials = tryExistingCredentials;
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tryExistingCredentials = exports.getSamlAssertion = exports.appInstances = exports.getOIDCCredentialsFromAccessToken = exports.getAssumedRole = void 0;
+const client_sso_1 = require("@aws-sdk/client-sso");
+const log_1 = require("ag-common/dist/common/helpers/log");
+const string_1 = require("ag-common/dist/common/helpers/string");
+const node_fetch_1 = __importDefault(require("node-fetch"));
+const config_1 = require("../config");
+const awsconfig_1 = require("./awsconfig");
+const sts_1 = require("./sts");
+const getAssumedRole = (p) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b, _c, _d;
+    const sso = new client_sso_1.SSOClient({ region: config_1.identityCenterRegion });
+    let accountId = p.accountId;
+    if (!accountId) {
+        const accounts = yield sso.send(new client_sso_1.ListAccountsCommand({ accessToken: p.accessToken }));
+        accountId = (_b = (_a = accounts.accountList) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.accountId;
+    }
+    if (!accountId) {
+        throw new Error('no account id');
+    }
+    const rolesResult = yield sso.send(new client_sso_1.ListAccountRolesCommand({
+        accessToken: p.accessToken,
+        accountId,
+    }));
+    const roles = ((_d = (_c = rolesResult.roleList) === null || _c === void 0 ? void 0 : _c.map((r) => ({
+        accountId: r.accountId || '',
+        roleName: r.roleName || '',
+    }))) === null || _d === void 0 ? void 0 : _d.filter((r) => r.accountId && r.roleName)) || [];
+    if (roles.length === 0) {
+        throw new Error('no roles can be assumed');
+    }
+    if (roles.length > 1) {
+        throw new Error('too many roles' + JSON.stringify(roles, null, 2));
+    }
+    const role = roles[0];
+    return role;
+});
+exports.getAssumedRole = getAssumedRole;
+const getOIDCCredentialsFromAccessToken = (p) => __awaiter(void 0, void 0, void 0, function* () {
+    const sso = new client_sso_1.SSOClient({ region: config_1.identityCenterRegion });
+    const role = yield (0, exports.getAssumedRole)({ accessToken: p.accessToken });
+    const ssoResp = yield sso.send(new client_sso_1.GetRoleCredentialsCommand(Object.assign(Object.assign({}, role), { accessToken: p.accessToken })));
+    const rc = ssoResp.roleCredentials;
+    if (!(rc === null || rc === void 0 ? void 0 : rc.accessKeyId) ||
+        !(rc === null || rc === void 0 ? void 0 : rc.expiration) ||
+        !(rc === null || rc === void 0 ? void 0 : rc.secretAccessKey) ||
+        !(rc === null || rc === void 0 ? void 0 : rc.sessionToken)) {
+        throw new Error('role creds undefined:' + JSON.stringify(rc, null, 2));
+    }
+    return Object.assign(Object.assign({}, p), { accessKeyId: rc.accessKeyId, secretAccessKey: rc.secretAccessKey, sessionToken: rc.sessionToken, region: config_1.identityCenterRegion });
+});
+exports.getOIDCCredentialsFromAccessToken = getOIDCCredentialsFromAccessToken;
+function appInstances(p) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const ai = (yield (yield (0, node_fetch_1.default)(`https://portal.sso.${config_1.identityCenterRegion}.amazonaws.com/instance/appinstances`, { headers: { 'x-amz-sso_bearer_token': p.ssoAuthn } })).json());
+        if (!(ai === null || ai === void 0 ? void 0 : ai.result)) {
+            throw new Error('appinstance error' + JSON.stringify(ai, null, 2));
+        }
+        return ai.result;
+    });
+}
+exports.appInstances = appInstances;
+function getSamlAssertion(p, instance) {
+    var _a, _b;
+    return __awaiter(this, void 0, void 0, function* () {
+        const det = (yield (yield (0, node_fetch_1.default)(`https://portal.sso.${config_1.identityCenterRegion}.amazonaws.com/instance/appinstance/${instance.id}/profiles`, { headers: { 'x-amz-sso_bearer_token': p.ssoAuthn } })).json());
+        const asserturl = (_b = (_a = det === null || det === void 0 ? void 0 : det.result) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.url;
+        if (!asserturl) {
+            throw new Error('assertion url cant be found');
+        }
+        const assertion = (yield (yield (0, node_fetch_1.default)(asserturl, {
+            headers: { 'x-amz-sso_bearer_token': p.ssoAuthn },
+        })).json());
+        const decoded = (0, string_1.fromBase64)(assertion.encodedResponse);
+        const res = new RegExp(/<saml2:AttributeValue xmlns:xsi="http:\/\/www.w3.org\/2001\/XMLSchema-instance" xsi:type="xsd:string">(arn.*?)</gim).exec(decoded);
+        if (!(res === null || res === void 0 ? void 0 : res[1])) {
+            throw new Error('bad saml');
+        }
+        const [providerArn, roleArn] = res[1].split(',');
+        return { samlAssertion: assertion.encodedResponse, providerArn, roleArn };
+    });
+}
+exports.getSamlAssertion = getSamlAssertion;
+const tryExistingCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
+    const credraw = yield (0, awsconfig_1.getAwsCredentials)();
+    if (!credraw.default.aws_access_token) {
+        return undefined;
+    }
+    let credentials = {
+        accessKeyId: credraw.default.aws_access_key_id,
+        secretAccessKey: credraw.default.aws_secret_access_key,
+        sessionToken: credraw.default.aws_session_token,
+        accessToken: credraw.default.aws_access_token,
+        ssoAuthn: credraw.default.aws_sso_authn,
+        region: config_1.identityCenterRegion,
+    };
+    const v = yield (0, sts_1.validateCredentials)(credentials);
+    if (v) {
+        return credentials;
+    }
+    if (credraw.default.aws_access_token && credraw.default.aws_sso_authn) {
+        try {
+            (0, log_1.info)('trying oidc refresh');
+            credentials = yield (0, exports.getOIDCCredentialsFromAccessToken)({
+                accessToken: credraw.default.aws_access_token,
+                ssoAuthn: credraw.default.aws_sso_authn,
+            });
+            return credentials;
+        }
+        catch (e) {
+            //
+            const em = e.toString();
+            if (em.includes('is expired') || em.includes('or invalid')) {
+                (0, log_1.info)('access token or sso expired, need to wipe');
+            }
+            else {
+                (0, log_1.info)(e);
+            }
+        }
+    }
+    return {
+        accessToken: '',
+        ssoAuthn: '',
+        region: config_1.identityCenterRegion,
+        accessKeyId: '',
+        secretAccessKey: '',
+        sessionToken: '',
+    };
+});
+exports.tryExistingCredentials = tryExistingCredentials;

package/dist/helpers/sts.d.ts

@@ -1,24 +1,24 @@
-import { IAwsCreds, SearchMetadata } from '../types';
-export declare function validateCredentials(credentials: IAwsCreds): Promise<{
-    accountId: string;
-    principalArn: string;
-} | undefined>;
-export declare function getApplicationCreds(p: {
-    originCreds: IAwsCreds;
-    targetRegion: string;
-    samlAssertion: string;
-    providerArn: string;
-    roleArn: string;
-}): Promise<IAwsCreds>;
-export declare function directStsAssume(p: {
-    credentials: IAwsCreds;
-    targetRegion: string;
-    metadata: SearchMetadata;
-}): Promise<{
-    region: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    sessionToken: string;
-    accessToken: string;
-    ssoAuthn: string;
-}>;
+import { IAwsCreds, SearchMetadata } from '../types';
+export declare function validateCredentials(credentials: IAwsCreds): Promise<{
+    accountId: string;
+    principalArn: string;
+} | undefined>;
+export declare function getApplicationCreds(p: {
+    originCreds: IAwsCreds;
+    targetRegion: string;
+    samlAssertion: string;
+    providerArn: string;
+    roleArn: string;
+}): Promise<IAwsCreds>;
+export declare function directStsAssume(p: {
+    credentials: IAwsCreds;
+    targetRegion: string;
+    metadata: SearchMetadata;
+}): Promise<{
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+    accessToken: string;
+    ssoAuthn: string;
+}>;

package/dist/helpers/sts.js

@@ -1,98 +1,98 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.directStsAssume = exports.getApplicationCreds = exports.validateCredentials = void 0;
-const client_sts_1 = require("@aws-sdk/client-sts");
-const log_1 = require("ag-common/dist/common/helpers/log");
-const config_1 = require("../config");
-const sso_1 = require("./sso");
-function validateCredentials(credentials) {
-    var _a, _b;
-    return __awaiter(this, void 0, void 0, function* () {
-        const sts = new client_sts_1.STS({
-            credentials,
-            region: credentials.region,
-        });
-        try {
-            const stub = yield sts.getCallerIdentity({});
-            yield (0, sso_1.appInstances)(credentials);
-            if (((_b = (_a = stub === null || stub === void 0 ? void 0 : stub.$metadata) === null || _a === void 0 ? void 0 : _a.httpStatusCode) !== null && _b !== void 0 ? _b : 500) < 400 &&
-                stub.Account &&
-                stub.Arn) {
-                (0, log_1.info)(`test cached credentials OK`);
-                return { accountId: stub.Account, principalArn: stub.Arn };
-            }
-        }
-        catch (e) {
-            const es = e.toString();
-            if (es.includes('expired')) {
-                (0, log_1.warn)('creds have expired');
-            }
-            (0, log_1.warn)('other saml error:' + es);
-            return undefined;
-        }
-    });
-}
-exports.validateCredentials = validateCredentials;
-function getApplicationCreds(p) {
-    var _a, _b, _c, _d;
-    return __awaiter(this, void 0, void 0, function* () {
-        const sts = new client_sts_1.STS({
-            credentials: p.originCreds,
-            region: p.targetRegion,
-        });
-        const ret = yield sts.assumeRoleWithSAML({
-            PrincipalArn: p.providerArn,
-            RoleArn: p.roleArn,
-            SAMLAssertion: p.samlAssertion,
-            DurationSeconds: config_1.stsDurationSeconds,
-        });
-        if (((_a = ret.$metadata.httpStatusCode) !== null && _a !== void 0 ? _a : 500) >= 400) {
-            (0, log_1.error)('bad assume saml role', ret);
-            throw new Error('bad assume saml role');
-        }
-        if (!((_b = ret === null || ret === void 0 ? void 0 : ret.Credentials) === null || _b === void 0 ? void 0 : _b.AccessKeyId) ||
-            !((_c = ret === null || ret === void 0 ? void 0 : ret.Credentials) === null || _c === void 0 ? void 0 : _c.SecretAccessKey) ||
-            !((_d = ret === null || ret === void 0 ? void 0 : ret.Credentials) === null || _d === void 0 ? void 0 : _d.SessionToken)) {
-            throw new Error('no creds');
-        }
-        return Object.assign(Object.assign({}, p.originCreds), { region: p.targetRegion, accessKeyId: ret.Credentials.AccessKeyId, secretAccessKey: ret.Credentials.SecretAccessKey, sessionToken: ret.Credentials.SessionToken });
-    });
-}
-exports.getApplicationCreds = getApplicationCreds;
-function directStsAssume(p) {
-    var _a, _b, _c, _d;
-    return __awaiter(this, void 0, void 0, function* () {
-        const role = yield (0, sso_1.getAssumedRole)({
-            accessToken: p.credentials.accessToken,
-            accountId: p.metadata.AccountId,
-        });
-        const sts = new client_sts_1.STS({
-            credentials: p.credentials,
-            region: p.targetRegion,
-        });
-        const ar = yield sts.assumeRole({
-            RoleArn: `arn:aws:iam::${role.accountId}:role/${role.roleName}`,
-            RoleSessionName: 'awsauth',
-            DurationSeconds: config_1.nativeStsDurationSeconds,
-        });
-        if (((_a = ar.$metadata.httpStatusCode) !== null && _a !== void 0 ? _a : 500) >= 400) {
-            throw new Error('assume role error' + JSON.stringify(ar, null, 2));
-        }
-        if (!((_b = ar === null || ar === void 0 ? void 0 : ar.Credentials) === null || _b === void 0 ? void 0 : _b.AccessKeyId) ||
-            !((_c = ar === null || ar === void 0 ? void 0 : ar.Credentials) === null || _c === void 0 ? void 0 : _c.SecretAccessKey) ||
-            !((_d = ar === null || ar === void 0 ? void 0 : ar.Credentials) === null || _d === void 0 ? void 0 : _d.SessionToken)) {
-            throw new Error('no creds');
-        }
-        return Object.assign(Object.assign({}, p.credentials), { region: p.targetRegion, accessKeyId: ar.Credentials.AccessKeyId, secretAccessKey: ar.Credentials.SecretAccessKey, sessionToken: ar.Credentials.SessionToken });
-    });
-}
-exports.directStsAssume = directStsAssume;
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.directStsAssume = exports.getApplicationCreds = exports.validateCredentials = void 0;
+const client_sts_1 = require("@aws-sdk/client-sts");
+const log_1 = require("ag-common/dist/common/helpers/log");
+const config_1 = require("../config");
+const sso_1 = require("./sso");
+function validateCredentials(credentials) {
+    var _a, _b;
+    return __awaiter(this, void 0, void 0, function* () {
+        const sts = new client_sts_1.STS({
+            credentials,
+            region: credentials.region,
+        });
+        try {
+            const stub = yield sts.getCallerIdentity({});
+            yield (0, sso_1.appInstances)(credentials);
+            if (((_b = (_a = stub === null || stub === void 0 ? void 0 : stub.$metadata) === null || _a === void 0 ? void 0 : _a.httpStatusCode) !== null && _b !== void 0 ? _b : 500) < 400 &&
+                stub.Account &&
+                stub.Arn) {
+                (0, log_1.info)(`test cached credentials OK`);
+                return { accountId: stub.Account, principalArn: stub.Arn };
+            }
+        }
+        catch (e) {
+            const es = e.toString();
+            if (es.includes('expired')) {
+                (0, log_1.warn)('creds have expired');
+            }
+            (0, log_1.warn)('other saml error:' + es);
+            return undefined;
+        }
+    });
+}
+exports.validateCredentials = validateCredentials;
+function getApplicationCreds(p) {
+    var _a, _b, _c, _d;
+    return __awaiter(this, void 0, void 0, function* () {
+        const sts = new client_sts_1.STS({
+            credentials: p.originCreds,
+            region: p.targetRegion,
+        });
+        const ret = yield sts.assumeRoleWithSAML({
+            PrincipalArn: p.providerArn,
+            RoleArn: p.roleArn,
+            SAMLAssertion: p.samlAssertion,
+            DurationSeconds: config_1.stsDurationSeconds,
+        });
+        if (((_a = ret.$metadata.httpStatusCode) !== null && _a !== void 0 ? _a : 500) >= 400) {
+            (0, log_1.error)('bad assume saml role', ret);
+            throw new Error('bad assume saml role');
+        }
+        if (!((_b = ret === null || ret === void 0 ? void 0 : ret.Credentials) === null || _b === void 0 ? void 0 : _b.AccessKeyId) ||
+            !((_c = ret === null || ret === void 0 ? void 0 : ret.Credentials) === null || _c === void 0 ? void 0 : _c.SecretAccessKey) ||
+            !((_d = ret === null || ret === void 0 ? void 0 : ret.Credentials) === null || _d === void 0 ? void 0 : _d.SessionToken)) {
+            throw new Error('no creds');
+        }
+        return Object.assign(Object.assign({}, p.originCreds), { region: p.targetRegion, accessKeyId: ret.Credentials.AccessKeyId, secretAccessKey: ret.Credentials.SecretAccessKey, sessionToken: ret.Credentials.SessionToken });
+    });
+}
+exports.getApplicationCreds = getApplicationCreds;
+function directStsAssume(p) {
+    var _a, _b, _c, _d;
+    return __awaiter(this, void 0, void 0, function* () {
+        const role = yield (0, sso_1.getAssumedRole)({
+            accessToken: p.credentials.accessToken,
+            accountId: p.metadata.AccountId,
+        });
+        const sts = new client_sts_1.STS({
+            credentials: p.credentials,
+            region: p.targetRegion,
+        });
+        const ar = yield sts.assumeRole({
+            RoleArn: `arn:aws:iam::${role.accountId}:role/${role.roleName}`,
+            RoleSessionName: 'awsauth',
+            DurationSeconds: config_1.nativeStsDurationSeconds,
+        });
+        if (((_a = ar.$metadata.httpStatusCode) !== null && _a !== void 0 ? _a : 500) >= 400) {
+            throw new Error('assume role error' + JSON.stringify(ar, null, 2));
+        }
+        if (!((_b = ar === null || ar === void 0 ? void 0 : ar.Credentials) === null || _b === void 0 ? void 0 : _b.AccessKeyId) ||
+            !((_c = ar === null || ar === void 0 ? void 0 : ar.Credentials) === null || _c === void 0 ? void 0 : _c.SecretAccessKey) ||
+            !((_d = ar === null || ar === void 0 ? void 0 : ar.Credentials) === null || _d === void 0 ? void 0 : _d.SessionToken)) {
+            throw new Error('no creds');
+        }
+        return Object.assign(Object.assign({}, p.credentials), { region: p.targetRegion, accessKeyId: ar.Credentials.AccessKeyId, secretAccessKey: ar.Credentials.SecretAccessKey, sessionToken: ar.Credentials.SessionToken });
+    });
+}
+exports.directStsAssume = directStsAssume;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { IApplicationArgs } from './types';
-export declare let globalargs: IApplicationArgs | undefined;
-export declare function main(args: IApplicationArgs): Promise<void>;
-export declare function run(): Promise<void>;
+import { IApplicationArgs } from './types';
+export declare let globalargs: IApplicationArgs | undefined;
+export declare function main(args: IApplicationArgs): Promise<void>;
+export declare function run(): Promise<void>;