oracledb 7.0.0 → 26.0.0

package/plugins/token/extensionAzure/index.js

@@ -26,9 +26,27 @@
 'use strict';
 const oracledb = require('oracledb');
 const msal = require('@azure/msal-node');
+const { TokenCache, hashValue } = require('../cache.js');
 
+const OBO_DEFAULT_CLOCK_SKEW_MS = 60 * 1000;
+const TOKEN_CACHE_MAX_ENTRIES = 100;
+// Process-wide, bounded LRU cache of completed OBO exchanges. Connections
+// safely share entries only when their cache key has the same caller-token
+// hash and every Azure credential/request input that can change the result.
+// Values are obfuscated at rest.
+const oboTokenCache = new TokenCache(TOKEN_CACHE_MAX_ENTRIES);
+// Process-wide, bounded cache of service-principal tokens. Its key includes
+// every credential and request input that can change the resulting token, so
+// pools can share only compatible entries. Values are obfuscated at rest.
+const appTokenCache = new TokenCache(TOKEN_CACHE_MAX_ENTRIES);
 
-async function getToken(params) {
+
+// Internal Deep Security API. The driver's ordinary token-authentication hook
+// below returns this result's access-token string.
+async function getTokenResult(params) {
+  if (typeof params?.authType !== 'string') {
+    throwErr('Azure authentication type is required.');
+  }
   switch (params.authType.toLowerCase()) {
     case 'azureserviceprincipal':
       return await servicePrincipalCredentials(params);
@@ -46,9 +64,7 @@ function throwErr(message) {
 
 //---------------------------------------------------------------------------
 // Returns the access token for authentication as a service principal. This
-// authentication method requires a client ID along with either a secret or
-// certificate. These values may be provided as config parameters read by
-// the Azure SDK.
+// authentication method requires a client ID and client secret.
 // ---------------------------------------------------------------------------
 async function servicePrincipalCredentials(params) {
   const clientId = params.clientId ??
@@ -57,31 +73,24 @@ async function servicePrincipalCredentials(params) {
     throwErr("Token based authentication config parameter authority is missing for azureServicePrincipal in extensionAzure plugins.");
   const clientSecret = params.clientSecret ??
     throwErr("Token based authentication config parameter clientSecret is missing for azureServicePrincipal in extensionAzure plugins.");
-  const msalConfig = {
-    auth: {
-      clientId: clientId,
-      authority: authority,
-      clientSecret: clientSecret,
-    },
-    system: {
-      // Use it while generating azure tokens behind proxy
-      // Otherwise can remove this option
-      networkClient: params.proxy,
-    },
-  };
-
-  if (!msalConfig.system.networkClient) {
-    delete msalConfig.system.networkClient;
-  }
-
   const scopes = params.scopes ??
     throwErr("Token based authentication config parameter scopes is missing for azureServicePrincipal in extensionAzure plugins.");
-  const tokenRequest = {
-    scopes: [scopes],
-  };
-  const cca = new msal.ConfidentialClientApplication(msalConfig);
-  const authResponse = await cca.acquireTokenByClientCredential(tokenRequest);
-  return authResponse.accessToken;
+  const normalizedScopes = normalizeScopes(scopes);
+  const config = { ...params, clientId, authority, clientSecret };
+  const cacheKey = computeAppCacheKey(config, normalizedScopes);
+  const result = await appTokenCache.get(cacheKey, async () => {
+    const authResponse = await createClient(config).acquireTokenByClientCredential({
+      scopes: normalizedScopes,
+    });
+    if (!authResponse?.accessToken) {
+      throwErr('Failed to acquire application access token from Azure.');
+    }
+    return {
+      value: authResponse.accessToken,
+      validUntil: calculateExpiry(authResponse, OBO_DEFAULT_CLOCK_SKEW_MS),
+    };
+  });
+  return { accessToken: result.value, isNewToken: !result.isCacheHit };
 }
 
 // ---------------------------------------------------------------------------
@@ -92,9 +101,132 @@ async function servicePrincipalCredentials(params) {
 function hookFn(options) {
   if (options.tokenAuthConfigAzure) {
     options.accessToken = async function callbackFn(refresh, config) {
-      return await getToken(config);
+      return (await getTokenResult(config)).accessToken;
     };
     options.accessTokenConfig = options.tokenAuthConfigAzure;
   }
 }
 oracledb.registerProcessConfigurationHook(hookFn);
+
+//---------------------------------------------------------------------------
+// normalizeScopes()
+//---------------------------------------------------------------------------
+function normalizeScopes(scopes) {
+  const normalized = Array.isArray(scopes)
+    ? scopes
+    : (typeof scopes === 'string' ? [scopes] : null);
+  if (!normalized || normalized.some((scope) =>
+    typeof scope !== 'string' || !scope.trim())) {
+    throwErr('Azure scopes must be a string or an array of non-empty strings.');
+  }
+  return normalized.map((scope) => scope.trim()).sort();
+}
+
+//---------------------------------------------------------------------------
+// buildNetworkClient()
+//---------------------------------------------------------------------------
+function buildNetworkClient(proxyConfig) {
+  if (!proxyConfig) {
+    return null;
+  }
+  if (typeof proxyConfig.sendGetRequestAsync === 'function' &&
+      typeof proxyConfig.sendPostRequestAsync === 'function') {
+    return proxyConfig;
+  }
+  throwErr('Azure proxy configuration must implement sendGetRequestAsync() and sendPostRequestAsync().');
+}
+
+//---------------------------------------------------------------------------
+// computeOboCacheKey()
+//---------------------------------------------------------------------------
+function computeOboCacheKey(config, scopes, endUserToken) {
+  // Do not put the assertion or client secret itself in a process-wide Map.
+  // The secret hash separates entries if a client secret is rotated while the
+  // process is running.
+  return JSON.stringify([
+    config.authType?.toLowerCase(), config.clientId,
+    hashValue(config.clientSecret), config.authority, scopes,
+    hashValue(endUserToken),
+  ]);
+}
+
+function computeAppCacheKey(config, scopes) {
+  // Hash the secret rather than retaining it in the process-wide key. A
+  // changed secret creates a new entry, leaving the old one bounded and
+  // eligible for LRU eviction.
+  return JSON.stringify([
+    config.authType?.toLowerCase(), config.clientId,
+    hashValue(config.clientSecret), config.authority, scopes,
+  ]);
+}
+
+function createClient(config) {
+  const networkClient = buildNetworkClient(config.proxy);
+  const msalConfig = {
+    auth: {
+      clientId: config.clientId ?? throwErr("OBO configuration requires clientId."),
+      authority: config.authority ?? throwErr("OBO configuration requires authority."),
+      clientSecret: config.clientSecret ?? throwErr("OBO configuration requires clientSecret."),
+    }
+  };
+  if (networkClient) {
+    msalConfig.system = { networkClient };
+  }
+
+  return new msal.ConfidentialClientApplication(msalConfig);
+}
+
+//---------------------------------------------------------------------------
+// calculateExpiry()
+//---------------------------------------------------------------------------
+function calculateExpiry(result, clockSkewMs) {
+  if (result?.expiresOn instanceof Date) {
+    return result.expiresOn.getTime() - clockSkewMs;
+  }
+  throwErr('Azure token response did not include an expiration time.');
+}
+
+//---------------------------------------------------------------------------
+// getOnBehalfOfToken()
+//---------------------------------------------------------------------------
+async function getOnBehalfOfToken({ endUserToken, oboConfig, cacheOptions }) {
+  if (!endUserToken) {
+    throwErr('An end user access token must be supplied for OBO exchange.');
+  }
+  if (!oboConfig) {
+    throwErr('OBO configuration is required.');
+  }
+
+  const scopes = normalizeScopes(oboConfig.scopes);
+  const cacheEnabled = cacheOptions?.enabled !== false;
+  const clockSkewMs = cacheOptions?.clockSkewMs ?? OBO_DEFAULT_CLOCK_SKEW_MS;
+  // This process-wide bounded cache is authoritative. Do not use MSAL's
+  // per-client cache because clients are intentionally short-lived so they do
+  // not retain credentials in a long-lived object graph.
+
+  const cacheKey = computeOboCacheKey(oboConfig, scopes, endUserToken);
+  const result = await oboTokenCache.get(cacheKey, async () => {
+    const authResponse = await createClient(oboConfig).acquireTokenOnBehalfOf({
+      oboAssertion: endUserToken,
+      scopes,
+      skipCache: true
+    });
+    if (!authResponse?.accessToken) {
+      throwErr('Failed to acquire on-behalf-of access token from Azure.');
+    }
+    return {
+      value: authResponse.accessToken,
+      validUntil: calculateExpiry(authResponse, clockSkewMs),
+    };
+  }, { enabled: cacheEnabled });
+  return {
+    accessToken: result.value,
+    expiresOn: new Date(result.validUntil + clockSkewMs),
+    isNewToken: !result.isCacheHit,
+  };
+}
+
+module.exports = {
+  getTokenResult,
+  getOnBehalfOfToken
+};

package/plugins/token/extensionOci/index.js

@@ -29,18 +29,59 @@ const identitydataplane = require("oci-identitydataplane");
 const common = require("oci-common");
 const { generateKeyPair } = require('crypto');
 const fs = require('fs');
+const https = require('https');
+const { URL } = require('url');
+const { TokenCache, hashValue } = require('../cache.js');
+const TOKEN_REQUEST_TIMEOUT_MS = 30000;
+const APP_TOKEN_CACHE_CLOCK_SKEW_MS = 60 * 1000;
+const APP_TOKEN_CACHE_MAX_ENTRIES = 100;
+// Process-wide, bounded LRU cache for OCI client-credentials tokens. Its key
+// includes the authentication inputs that can change a token. Other OCI
+// authentication modes retain their pre-cache behavior.
+const appTokenCache = new TokenCache(APP_TOKEN_CACHE_MAX_ENTRIES);
 
-async function getToken(params) {
+// Internal Deep Security API. The driver's ordinary token-authentication hook
+// below formats this result as a string or token/private-key pair.
+async function getTokenResult(params) {
+  if (typeof params?.authType !== 'string') {
+    throwErr('OCI authentication type is required.');
+  }
+  const authType = params.authType.toLowerCase();
+  let result;
+  if (authType === 'clientcredentials') {
+    const cacheKey = computeAppCacheKey(params);
+    result = await appTokenCache.get(cacheKey, () => acquireToken(params));
+  } else {
+    result = { value: (await acquireToken(params)).value, isCacheHit: false };
+  }
+  if (typeof result.value === 'string') {
+    return { accessToken: result.value, isNewToken: !result.isCacheHit };
+  }
+  return { ...result.value, isNewToken: !result.isCacheHit };
+}
+
+async function acquireToken(params) {
+  let result;
   switch (params.authType.toLowerCase()) {
     case 'configfilebasedauthentication':
-      return await configFileBasedAuthentication(params);
+      result = await configFileBasedAuthentication(params);
+      break;
     case 'simpleauthentication':
-      return await simpleAuthentication(params);
+      result = await simpleAuthentication(params);
+      break;
     case 'instanceprincipal':
-      return await instancePrincipalAuthentication(params);
+      result = await instancePrincipalAuthentication(params);
+      break;
+    case 'clientcredentials':
+      result = await clientCredentialsAuthentication(params);
+      break;
+    case 'resourceprincipal':
+      result = await resourcePrincipalAuthentication(params);
+      break;
     default:
       throwErr(`Invalid authentication type ${params.authType} in extensionOci plugins.`);
   }
+  return { value: result.value, validUntil: calculateValidUntil(result) };
 }
 
 //---------------------------------------------------------------------------
@@ -81,9 +122,16 @@ async function generateAccessToken(provider, scope) {
   const generateScopedAccessTokenResponse =
     await client.generateScopedAccessToken(generateScopedAccessTokenRequest);
 
+  const securityToken = generateScopedAccessTokenResponse.securityToken;
+  if (typeof securityToken?.token !== 'string' || !securityToken.token.trim()) {
+    throwErr('OCI scoped access token response is missing a token.');
+  }
   return {
-    token: generateScopedAccessTokenResponse.securityToken.token,
-    privateKey: keyPair.privateKey
+    value: {
+      token: securityToken.token,
+      privateKey: keyPair.privateKey
+    },
+    expiresOn: securityToken.expirationTime
   };
 }
 
@@ -153,21 +201,19 @@ async function simpleAuthentication(accessTokenConfig) {
     throwErr("Token based authentication config parameter user is missing for simpleauthentication in extensionOci plugins.");
   const fingerprint = accessTokenConfig.fingerprint ??
     throwErr("Token based authentication config parameter fingerprint is missing for simpleauthentication in extensionOci plugins.");
-  const passphrase = accessTokenConfig.passphrase |= null; // optional
+  const passphrase = accessTokenConfig.passphrase ?? null; // optional
   const privateKeyLocation = accessTokenConfig.privateKeyLocation ??
     throwErr("Token based authentication config parameter privateKeyLocation is missing for simpleauthentication in extensionOci plugins.");
   const privateKey = fs.readFileSync(privateKeyLocation, 'utf-8'); // ~/.oci/oci_api_key.pem
   const regionId = accessTokenConfig.regionId ??      // ex : us-ashburn-1
     throwErr("Token based authentication config parameter regionId is missing for simpleauthentication in extensionOci plugins.");
 
-  let region;
-  const regionsList = common.Region.values();
-  regionsList.forEach(regions => {
-    if (regions.regionId === regionId) {
-      region = regions;
-      return;
-    }
-  });
+  const region = common.Region.values().find(
+    (item) => item.regionId === regionId
+  );
+  if (!region) {
+    throwErr(`Invalid OCI regionId ${regionId}.`);
+  }
   const provider = new common.SimpleAuthenticationDetailsProvider(
     tenancy,
     user,
@@ -194,6 +240,157 @@ async function instancePrincipalAuthentication(accessTokenConfig) {
   return await generateAccessToken(provider, accessTokenConfig.scope);
 }
 
+//---------------------------------------------------------------------------
+// clientCredentialsAuthentication()
+//
+// Requests an access token from an OCI Identity Domain using the OAuth 2.0
+// client-credentials grant.
+//---------------------------------------------------------------------------
+async function clientCredentialsAuthentication(config) {
+  const authority = config.authority ??
+    throwErr("Token based authentication config parameter authority is missing for clientcredentials in extensionOci plugins.");
+  const clientId = config.clientId ??
+    throwErr("Token based authentication config parameter clientId is missing for clientcredentials in extensionOci plugins.");
+  const clientSecret = config.clientSecret ??
+    throwErr("Token based authentication config parameter clientSecret is missing for clientcredentials in extensionOci plugins.");
+  if (config.scopes !== undefined && typeof config.scopes !== 'string') {
+    throwErr('OCI OAuth scopes must be a string.');
+  }
+
+  const params = new URLSearchParams();
+
+  params.set("grant_type", "client_credentials");
+  if (config.scopes) {
+    // OAuth defines a singular form parameter; the driver configuration uses
+    // the same plural `scopes` spelling as the Azure token configuration.
+    params.set("scope", config.scopes);
+  }
+
+  const basicAuth = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
+  const requestBody = params.toString();
+  const response = await postForm(authority, {
+    'Authorization': `Basic ${basicAuth}`
+  }, requestBody, config.tokenRequestTimeoutMs);
+
+  let payload = null;
+  if (response && response.body) {
+    try {
+      payload = JSON.parse(response.body);
+    } catch {
+      payload = null;
+    }
+  }
+
+  const statusCode = Number(response?.statusCode ?? 0);
+  if (statusCode < 200 || statusCode >= 300) {
+    const statusText = response?.statusMessage || `HTTP ${statusCode}`;
+    const errorMessage =
+      payload?.error_description ||
+      payload?.error ||
+      statusText;
+    throwErr(`OCI client credentials token request failed: ${errorMessage}`);
+  }
+
+  const accessToken = payload?.access_token;
+  if (!accessToken) {
+    throwErr("OCI client credentials token response is missing access_token.");
+  }
+
+  return { value: accessToken, expiresIn: payload?.expires_in };
+}
+
+function calculateValidUntil(result) {
+  let expiresAt;
+  if (result.expiresOn instanceof Date) {
+    expiresAt = result.expiresOn.getTime();
+  } else if (typeof result.expiresOn === 'number') {
+    expiresAt = result.expiresOn;
+  } else if (typeof result.expiresOn === 'string') {
+    expiresAt = Date.parse(result.expiresOn);
+  } else if (Number.isFinite(Number(result.expiresIn)) &&
+      Number(result.expiresIn) > 0) {
+    expiresAt = Date.now() + (Number(result.expiresIn) * 1000);
+  }
+  return Number.isFinite(expiresAt) ?
+    expiresAt - APP_TOKEN_CACHE_CLOCK_SKEW_MS : undefined;
+}
+
+function computeAppCacheKey(config) {
+  // This function is called only for clientcredentials. Array positions are
+  // fixed, and JSON serialization makes the result unambiguous.
+  return JSON.stringify([
+    config.authType.toLowerCase(), config.authority, config.clientId,
+    hashValue(config.clientSecret), config.scopes,
+  ]);
+}
+
+//---------------------------------------------------------------------------
+// postForm()
+//
+// Minimal HTTPS helper for posting x-www-form-urlencoded payloads.
+//---------------------------------------------------------------------------
+function postForm(endpoint, extraHeaders, body, timeoutMs = TOKEN_REQUEST_TIMEOUT_MS) {
+  return new Promise((resolve, reject) => {
+    try {
+      const url = new URL(endpoint);
+      if (url.protocol !== 'https:') {
+        throwErr('OCI token endpoint must use HTTPS.');
+      }
+      if (!Number.isInteger(timeoutMs) || timeoutMs < 1) {
+        throwErr('OCI token request timeout must be a positive integer.');
+      }
+      const headers = Object.assign({
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Content-Length': Buffer.byteLength(body)
+      }, extraHeaders);
+
+      const requestOptions = {
+        method: 'POST',
+        protocol: url.protocol,
+        hostname: url.hostname,
+        port: url.port || (url.protocol === 'https:' ? 443 : undefined),
+        path: `${url.pathname}${url.search}`,
+        headers
+      };
+
+      const req = https.request(requestOptions, (res) => {
+        let responseBody = '';
+        res.setEncoding('utf8');
+        res.on('data', chunk => {
+          responseBody += chunk;
+        });
+        res.on('end', () => {
+          resolve({
+            statusCode: res.statusCode,
+            statusMessage: res.statusMessage,
+            body: responseBody
+          });
+        });
+      });
+
+      req.on('error', reject);
+      req.setTimeout(timeoutMs, () => {
+        req.destroy(new Error('OCI token request timed out.'));
+      });
+      req.write(body);
+      req.end();
+    } catch (err) {
+      reject(err);
+    }
+  });
+}
+
+// resourcePrincipalAuthentication()
+//
+// Authentication in an OCI resource-principal-enabled service. Credentials
+// are supplied by the OCI runtime, so no API key material is needed.
+//---------------------------------------------------------------------------
+async function resourcePrincipalAuthentication(accessTokenConfig) {
+  const provider = common.ResourcePrincipalAuthenticationDetailsProvider.builder();
+
+  return await generateAccessToken(provider, accessTokenConfig.scope);
+}
+
 //---------------------------------------------------------------------------
 //  hookFn()
 //  hookFn will get registerd to driver while loading plugins.
@@ -201,9 +398,17 @@ async function instancePrincipalAuthentication(accessTokenConfig) {
 function hookFn(options) {
   if (options.tokenAuthConfigOci) {
     options.accessToken = async function callbackFn(refresh, config) {
-      return await getToken(config);
+      const result = await getTokenResult(config);
+      if (result.privateKey !== undefined) {
+        return { token: result.token, privateKey: result.privateKey };
+      }
+      return result.accessToken;
     };
     options.accessTokenConfig = options.tokenAuthConfigOci;
   }
 }
 oracledb.registerProcessConfigurationHook(hookFn);
+
+module.exports = {
+  getTokenResult
+};