playwright-smart-test 0.0.0-stage → 1.0.1

package/node_modules/google-auth-library/build/src/auth/credentials.d.ts

@@ -0,0 +1,75 @@
+export interface Credentials {
+    /**
+     * This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.
+     */
+    refresh_token?: string | null;
+    /**
+     * The time in ms at which this token is thought to expire.
+     */
+    expiry_date?: number | null;
+    /**
+     * A token that can be sent to a Google API.
+     */
+    access_token?: string | null;
+    /**
+     * Identifies the type of token returned. At this time, this field always has the value Bearer.
+     */
+    token_type?: string | null;
+    /**
+     * A JWT that contains identity information about the user that is digitally signed by Google.
+     */
+    id_token?: string | null;
+    /**
+     * The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.
+     */
+    scope?: string;
+}
+export interface CredentialRequest {
+    /**
+     * This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.
+     */
+    refresh_token?: string;
+    /**
+     * A token that can be sent to a Google API.
+     */
+    access_token?: string;
+    /**
+     * Identifies the type of token returned. At this time, this field always has the value Bearer.
+     */
+    token_type?: string;
+    /**
+     * The remaining lifetime of the access token in seconds.
+     */
+    expires_in?: number;
+    /**
+     * A JWT that contains identity information about the user that is digitally signed by Google.
+     */
+    id_token?: string;
+    /**
+     * The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.
+     */
+    scope?: string;
+}
+export interface JWTInput {
+    type?: string;
+    client_email?: string;
+    private_key?: string;
+    private_key_id?: string;
+    project_id?: string;
+    client_id?: string;
+    client_secret?: string;
+    refresh_token?: string;
+    quota_project_id?: string;
+    universe_domain?: string;
+}
+export interface ImpersonatedJWTInput {
+    type?: string;
+    source_credentials?: JWTInput;
+    service_account_impersonation_url?: string;
+    delegates?: string[];
+}
+export interface CredentialBody {
+    client_email?: string;
+    private_key?: string;
+    universe_domain?: string;
+}

package/node_modules/google-auth-library/build/src/auth/credentials.js

@@ -0,0 +1,15 @@
+"use strict";
+// Copyright 2014 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });

package/node_modules/google-auth-library/build/src/auth/defaultawssecuritycredentialssupplier.d.ts

@@ -0,0 +1,79 @@
+import { ExternalAccountSupplierContext } from './baseexternalclient';
+import { GaxiosOptions } from 'gaxios';
+import { AwsSecurityCredentialsSupplier } from './awsclient';
+import { AwsSecurityCredentials } from './awsrequestsigner';
+/**
+ * Interface defining the options used to build a {@link DefaultAwsSecurityCredentialsSupplier}.
+ */
+export interface DefaultAwsSecurityCredentialsSupplierOptions {
+    /**
+     * The URL to call to retrieve the active AWS region.
+     **/
+    regionUrl?: string;
+    /**
+     * The URL to call to retrieve AWS security credentials.
+     **/
+    securityCredentialsUrl?: string;
+    /**
+     ** The URL to call to retrieve the IMDSV2 session token.
+     **/
+    imdsV2SessionTokenUrl?: string;
+    /**
+     * Additional Gaxios options to use when making requests to the AWS metadata
+     * endpoints.
+     */
+    additionalGaxiosOptions?: GaxiosOptions;
+}
+/**
+ * Internal AWS security credentials supplier implementation used by {@link AwsClient}
+ * when a credential source is provided instead of a user defined supplier.
+ * The logic is summarized as:
+ * 1. If imdsv2_session_token_url is provided in the credential source, then
+ *    fetch the aws session token and include it in the headers of the
+ *    metadata requests. This is a requirement for IDMSv2 but optional
+ *    for IDMSv1.
+ * 2. Retrieve AWS region from availability-zone.
+ * 3a. Check AWS credentials in environment variables. If not found, get
+ *     from security-credentials endpoint.
+ * 3b. Get AWS credentials from security-credentials endpoint. In order
+ *     to retrieve this, the AWS role needs to be determined by calling
+ *     security-credentials endpoint without any argument. Then the
+ *     credentials can be retrieved via: security-credentials/role_name
+ * 4. Generate the signed request to AWS STS GetCallerIdentity action.
+ * 5. Inject x-goog-cloud-target-resource into header and serialize the
+ *    signed request. This will be the subject-token to pass to GCP STS.
+ */
+export declare class DefaultAwsSecurityCredentialsSupplier implements AwsSecurityCredentialsSupplier {
+    #private;
+    private readonly regionUrl?;
+    private readonly securityCredentialsUrl?;
+    private readonly imdsV2SessionTokenUrl?;
+    private readonly additionalGaxiosOptions?;
+    /**
+     * Instantiates a new DefaultAwsSecurityCredentialsSupplier using information
+     * from the credential_source stored in the ADC file.
+     * @param opts The default aws security credentials supplier options object to
+     *   build the supplier with.
+     */
+    constructor(opts: DefaultAwsSecurityCredentialsSupplierOptions);
+    /**
+     * Returns the active AWS region. This first checks to see if the region
+     * is available as an environment variable. If it is not, then the supplier
+     * will call the region URL.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity.
+     * @return A promise that resolves with the AWS region string.
+     */
+    getAwsRegion(context: ExternalAccountSupplierContext): Promise<string>;
+    /**
+     * Returns AWS security credentials. This first checks to see if the credentials
+     * is available as environment variables. If it is not, then the supplier
+     * will call the security credentials URL.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity.
+     * @return A promise that resolves with the AWS security credentials.
+     */
+    getAwsSecurityCredentials(context: ExternalAccountSupplierContext): Promise<AwsSecurityCredentials>;
+}

package/node_modules/google-auth-library/build/src/auth/defaultawssecuritycredentialssupplier.js

@@ -0,0 +1,196 @@
+"use strict";
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _DefaultAwsSecurityCredentialsSupplier_instances, _DefaultAwsSecurityCredentialsSupplier_getImdsV2SessionToken, _DefaultAwsSecurityCredentialsSupplier_getAwsRoleName, _DefaultAwsSecurityCredentialsSupplier_retrieveAwsSecurityCredentials, _DefaultAwsSecurityCredentialsSupplier_regionFromEnv_get, _DefaultAwsSecurityCredentialsSupplier_securityCredentialsFromEnv_get;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultAwsSecurityCredentialsSupplier = void 0;
+/**
+ * Internal AWS security credentials supplier implementation used by {@link AwsClient}
+ * when a credential source is provided instead of a user defined supplier.
+ * The logic is summarized as:
+ * 1. If imdsv2_session_token_url is provided in the credential source, then
+ *    fetch the aws session token and include it in the headers of the
+ *    metadata requests. This is a requirement for IDMSv2 but optional
+ *    for IDMSv1.
+ * 2. Retrieve AWS region from availability-zone.
+ * 3a. Check AWS credentials in environment variables. If not found, get
+ *     from security-credentials endpoint.
+ * 3b. Get AWS credentials from security-credentials endpoint. In order
+ *     to retrieve this, the AWS role needs to be determined by calling
+ *     security-credentials endpoint without any argument. Then the
+ *     credentials can be retrieved via: security-credentials/role_name
+ * 4. Generate the signed request to AWS STS GetCallerIdentity action.
+ * 5. Inject x-goog-cloud-target-resource into header and serialize the
+ *    signed request. This will be the subject-token to pass to GCP STS.
+ */
+class DefaultAwsSecurityCredentialsSupplier {
+    /**
+     * Instantiates a new DefaultAwsSecurityCredentialsSupplier using information
+     * from the credential_source stored in the ADC file.
+     * @param opts The default aws security credentials supplier options object to
+     *   build the supplier with.
+     */
+    constructor(opts) {
+        _DefaultAwsSecurityCredentialsSupplier_instances.add(this);
+        this.regionUrl = opts.regionUrl;
+        this.securityCredentialsUrl = opts.securityCredentialsUrl;
+        this.imdsV2SessionTokenUrl = opts.imdsV2SessionTokenUrl;
+        this.additionalGaxiosOptions = opts.additionalGaxiosOptions;
+    }
+    /**
+     * Returns the active AWS region. This first checks to see if the region
+     * is available as an environment variable. If it is not, then the supplier
+     * will call the region URL.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity.
+     * @return A promise that resolves with the AWS region string.
+     */
+    async getAwsRegion(context) {
+        // Priority order for region determination:
+        // AWS_REGION > AWS_DEFAULT_REGION > metadata server.
+        if (__classPrivateFieldGet(this, _DefaultAwsSecurityCredentialsSupplier_instances, "a", _DefaultAwsSecurityCredentialsSupplier_regionFromEnv_get)) {
+            return __classPrivateFieldGet(this, _DefaultAwsSecurityCredentialsSupplier_instances, "a", _DefaultAwsSecurityCredentialsSupplier_regionFromEnv_get);
+        }
+        const metadataHeaders = {};
+        if (!__classPrivateFieldGet(this, _DefaultAwsSecurityCredentialsSupplier_instances, "a", _DefaultAwsSecurityCredentialsSupplier_regionFromEnv_get) && this.imdsV2SessionTokenUrl) {
+            metadataHeaders['x-aws-ec2-metadata-token'] =
+                await __classPrivateFieldGet(this, _DefaultAwsSecurityCredentialsSupplier_instances, "m", _DefaultAwsSecurityCredentialsSupplier_getImdsV2SessionToken).call(this, context.transporter);
+        }
+        if (!this.regionUrl) {
+            throw new Error('Unable to determine AWS region due to missing ' +
+                '"options.credential_source.region_url"');
+        }
+        const opts = {
+            ...this.additionalGaxiosOptions,
+            url: this.regionUrl,
+            method: 'GET',
+            responseType: 'text',
+            headers: metadataHeaders,
+        };
+        const response = await context.transporter.request(opts);
+        // Remove last character. For example, if us-east-2b is returned,
+        // the region would be us-east-2.
+        return response.data.substr(0, response.data.length - 1);
+    }
+    /**
+     * Returns AWS security credentials. This first checks to see if the credentials
+     * is available as environment variables. If it is not, then the supplier
+     * will call the security credentials URL.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity.
+     * @return A promise that resolves with the AWS security credentials.
+     */
+    async getAwsSecurityCredentials(context) {
+        // Check environment variables for permanent credentials first.
+        // https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html
+        if (__classPrivateFieldGet(this, _DefaultAwsSecurityCredentialsSupplier_instances, "a", _DefaultAwsSecurityCredentialsSupplier_securityCredentialsFromEnv_get)) {
+            return __classPrivateFieldGet(this, _DefaultAwsSecurityCredentialsSupplier_instances, "a", _DefaultAwsSecurityCredentialsSupplier_securityCredentialsFromEnv_get);
+        }
+        const metadataHeaders = {};
+        if (this.imdsV2SessionTokenUrl) {
+            metadataHeaders['x-aws-ec2-metadata-token'] =
+                await __classPrivateFieldGet(this, _DefaultAwsSecurityCredentialsSupplier_instances, "m", _DefaultAwsSecurityCredentialsSupplier_getImdsV2SessionToken).call(this, context.transporter);
+        }
+        // Since the role on a VM can change, we don't need to cache it.
+        const roleName = await __classPrivateFieldGet(this, _DefaultAwsSecurityCredentialsSupplier_instances, "m", _DefaultAwsSecurityCredentialsSupplier_getAwsRoleName).call(this, metadataHeaders, context.transporter);
+        // Temporary credentials typically last for several hours.
+        // Expiration is returned in response.
+        // Consider future optimization of this logic to cache AWS tokens
+        // until their natural expiration.
+        const awsCreds = await __classPrivateFieldGet(this, _DefaultAwsSecurityCredentialsSupplier_instances, "m", _DefaultAwsSecurityCredentialsSupplier_retrieveAwsSecurityCredentials).call(this, roleName, metadataHeaders, context.transporter);
+        return {
+            accessKeyId: awsCreds.AccessKeyId,
+            secretAccessKey: awsCreds.SecretAccessKey,
+            token: awsCreds.Token,
+        };
+    }
+}
+exports.DefaultAwsSecurityCredentialsSupplier = DefaultAwsSecurityCredentialsSupplier;
+_DefaultAwsSecurityCredentialsSupplier_instances = new WeakSet(), _DefaultAwsSecurityCredentialsSupplier_getImdsV2SessionToken = 
+/**
+ * @param transporter The transporter to use for requests.
+ * @return A promise that resolves with the IMDSv2 Session Token.
+ */
+async function _DefaultAwsSecurityCredentialsSupplier_getImdsV2SessionToken(transporter) {
+    const opts = {
+        ...this.additionalGaxiosOptions,
+        url: this.imdsV2SessionTokenUrl,
+        method: 'PUT',
+        responseType: 'text',
+        headers: { 'x-aws-ec2-metadata-token-ttl-seconds': '300' },
+    };
+    const response = await transporter.request(opts);
+    return response.data;
+}, _DefaultAwsSecurityCredentialsSupplier_getAwsRoleName = 
+/**
+ * @param headers The headers to be used in the metadata request.
+ * @param transporter The transporter to use for requests.
+ * @return A promise that resolves with the assigned role to the current
+ *   AWS VM. This is needed for calling the security-credentials endpoint.
+ */
+async function _DefaultAwsSecurityCredentialsSupplier_getAwsRoleName(headers, transporter) {
+    if (!this.securityCredentialsUrl) {
+        throw new Error('Unable to determine AWS role name due to missing ' +
+            '"options.credential_source.url"');
+    }
+    const opts = {
+        ...this.additionalGaxiosOptions,
+        url: this.securityCredentialsUrl,
+        method: 'GET',
+        responseType: 'text',
+        headers: headers,
+    };
+    const response = await transporter.request(opts);
+    return response.data;
+}, _DefaultAwsSecurityCredentialsSupplier_retrieveAwsSecurityCredentials = 
+/**
+ * Retrieves the temporary AWS credentials by calling the security-credentials
+ * endpoint as specified in the `credential_source` object.
+ * @param roleName The role attached to the current VM.
+ * @param headers The headers to be used in the metadata request.
+ * @param transporter The transporter to use for requests.
+ * @return A promise that resolves with the temporary AWS credentials
+ *   needed for creating the GetCallerIdentity signed request.
+ */
+async function _DefaultAwsSecurityCredentialsSupplier_retrieveAwsSecurityCredentials(roleName, headers, transporter) {
+    const response = await transporter.request({
+        ...this.additionalGaxiosOptions,
+        url: `${this.securityCredentialsUrl}/${roleName}`,
+        responseType: 'json',
+        headers: headers,
+    });
+    return response.data;
+}, _DefaultAwsSecurityCredentialsSupplier_regionFromEnv_get = function _DefaultAwsSecurityCredentialsSupplier_regionFromEnv_get() {
+    // The AWS region can be provided through AWS_REGION or AWS_DEFAULT_REGION.
+    // Only one is required.
+    return (process.env['AWS_REGION'] || process.env['AWS_DEFAULT_REGION'] || null);
+}, _DefaultAwsSecurityCredentialsSupplier_securityCredentialsFromEnv_get = function _DefaultAwsSecurityCredentialsSupplier_securityCredentialsFromEnv_get() {
+    // Both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are required.
+    if (process.env['AWS_ACCESS_KEY_ID'] &&
+        process.env['AWS_SECRET_ACCESS_KEY']) {
+        return {
+            accessKeyId: process.env['AWS_ACCESS_KEY_ID'],
+            secretAccessKey: process.env['AWS_SECRET_ACCESS_KEY'],
+            token: process.env['AWS_SESSION_TOKEN'],
+        };
+    }
+    return null;
+};

package/node_modules/google-auth-library/build/src/auth/downscopedclient.d.ts

@@ -0,0 +1,139 @@
+import { GaxiosOptions, GaxiosPromise, GaxiosResponse } from 'gaxios';
+import { BodyResponseCallback } from '../transporters';
+import { Credentials } from './credentials';
+import { AuthClient, AuthClientOptions } from './authclient';
+import { GetAccessTokenResponse, Headers } from './oauth2client';
+/**
+ * The maximum number of access boundary rules a Credential Access Boundary
+ * can contain.
+ */
+export declare const MAX_ACCESS_BOUNDARY_RULES_COUNT = 10;
+/**
+ * Offset to take into account network delays and server clock skews.
+ */
+export declare const EXPIRATION_TIME_OFFSET: number;
+/**
+ * Internal interface for tracking the access token expiration time.
+ */
+interface CredentialsWithResponse extends Credentials {
+    res?: GaxiosResponse | null;
+}
+/**
+ * Internal interface for tracking and returning the Downscoped access token
+ * expiration time in epoch time (seconds).
+ */
+interface DownscopedAccessTokenResponse extends GetAccessTokenResponse {
+    expirationTime?: number | null;
+}
+/**
+ * Defines an upper bound of permissions available for a GCP credential.
+ */
+export interface CredentialAccessBoundary {
+    accessBoundary: {
+        accessBoundaryRules: AccessBoundaryRule[];
+    };
+}
+/** Defines an upper bound of permissions on a particular resource. */
+interface AccessBoundaryRule {
+    availablePermissions: string[];
+    availableResource: string;
+    availabilityCondition?: AvailabilityCondition;
+}
+/**
+ * An optional condition that can be used as part of a
+ * CredentialAccessBoundary to further restrict permissions.
+ */
+interface AvailabilityCondition {
+    expression: string;
+    title?: string;
+    description?: string;
+}
+/**
+ * Defines a set of Google credentials that are downscoped from an existing set
+ * of Google OAuth2 credentials. This is useful to restrict the Identity and
+ * Access Management (IAM) permissions that a short-lived credential can use.
+ * The common pattern of usage is to have a token broker with elevated access
+ * generate these downscoped credentials from higher access source credentials
+ * and pass the downscoped short-lived access tokens to a token consumer via
+ * some secure authenticated channel for limited access to Google Cloud Storage
+ * resources.
+ */
+export declare class DownscopedClient extends AuthClient {
+    private readonly authClient;
+    private readonly credentialAccessBoundary;
+    private cachedDownscopedAccessToken;
+    private readonly stsCredential;
+    /**
+     * Instantiates a downscoped client object using the provided source
+     * AuthClient and credential access boundary rules.
+     * To downscope permissions of a source AuthClient, a Credential Access
+     * Boundary that specifies which resources the new credential can access, as
+     * well as an upper bound on the permissions that are available on each
+     * resource, has to be defined. A downscoped client can then be instantiated
+     * using the source AuthClient and the Credential Access Boundary.
+     * @param authClient The source AuthClient to be downscoped based on the
+     *   provided Credential Access Boundary rules.
+     * @param credentialAccessBoundary The Credential Access Boundary which
+     *   contains a list of access boundary rules. Each rule contains information
+     *   on the resource that the rule applies to, the upper bound of the
+     *   permissions that are available on that resource and an optional
+     *   condition to further restrict permissions.
+     * @param additionalOptions **DEPRECATED, set this in the provided `authClient`.**
+     *   Optional additional behavior customization options.
+     * @param quotaProjectId **DEPRECATED, set this in the provided `authClient`.**
+     *   Optional quota project id for setting up in the x-goog-user-project header.
+     */
+    constructor(authClient: AuthClient, credentialAccessBoundary: CredentialAccessBoundary, additionalOptions?: AuthClientOptions, quotaProjectId?: string);
+    /**
+     * Provides a mechanism to inject Downscoped access tokens directly.
+     * The expiry_date field is required to facilitate determination of the token
+     * expiration which would make it easier for the token consumer to handle.
+     * @param credentials The Credentials object to set on the current client.
+     */
+    setCredentials(credentials: Credentials): void;
+    getAccessToken(): Promise<DownscopedAccessTokenResponse>;
+    /**
+     * The main authentication interface. It takes an optional url which when
+     * present is the endpoint being accessed, and returns a Promise which
+     * resolves with authorization header fields.
+     *
+     * The result has the form:
+     * { Authorization: 'Bearer <access_token_value>' }
+     */
+    getRequestHeaders(): Promise<Headers>;
+    /**
+     * Provides a request implementation with OAuth 2.0 flow. In cases of
+     * HTTP 401 and 403 responses, it automatically asks for a new access token
+     * and replays the unsuccessful request.
+     * @param opts Request options.
+     * @param callback callback.
+     * @return A promise that resolves with the HTTP response when no callback
+     *   is provided.
+     */
+    request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
+    request<T>(opts: GaxiosOptions, callback: BodyResponseCallback<T>): void;
+    /**
+     * Authenticates the provided HTTP request, processes it and resolves with the
+     * returned response.
+     * @param opts The HTTP request options.
+     * @param reAuthRetried Whether the current attempt is a retry after a failed attempt due to an auth failure
+     * @return A promise that resolves with the successful response.
+     */
+    protected requestAsync<T>(opts: GaxiosOptions, reAuthRetried?: boolean): Promise<GaxiosResponse<T>>;
+    /**
+     * Forces token refresh, even if unexpired tokens are currently cached.
+     * GCP access tokens are retrieved from authclient object/source credential.
+     * Then GCP access tokens are exchanged for downscoped access tokens via the
+     * token exchange endpoint.
+     * @return A promise that resolves with the fresh downscoped access token.
+     */
+    protected refreshAccessTokenAsync(): Promise<CredentialsWithResponse>;
+    /**
+     * Returns whether the provided credentials are expired or not.
+     * If there is no expiry time, assumes the token is not expired or expiring.
+     * @param downscopedAccessToken The credentials to check for expiration.
+     * @return Whether the credentials are expired or not.
+     */
+    private isExpired;
+}
+export {};