runcloud 0.1.117 → 0.1.118

package/dist/diagnose.js

@@ -1,6 +1,6 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { GoogleAuth, Impersonated } from 'google-auth-library';
+import { GoogleAuth } from 'google-auth-library';
 import { renderSessionDiagnosticTerminal, writeSessionDiagnosticBundle, } from './sessionDiagnostics.js';
 const execFileAsync = promisify(execFile);
 const AUTH_ATTEMPT_TIMEOUT_MS = 10_000;
@@ -87,10 +87,8 @@ function extractAuthorization(headers) {
     const h = headers;
     return h?.Authorization ?? h?.authorization;
 }
-async function gcloudIdentityToken(audience, serviceAccount) {
-    const args = ['auth', 'print-identity-token', `--audiences=${audience}`];
-    if (serviceAccount)
-        args.push(`--impersonate-service-account=${serviceAccount}`);
+async function gcloudIdentityToken(audience) {
+    const args = ['auth', 'print-identity-token', '--audiences=' + audience];
     const { stdout } = await execFileAsync('gcloud', args, { timeout: 15_000, maxBuffer: 1024 * 1024 });
     const token = stdout.trim();
     if (!token)
@@ -123,22 +121,32 @@ function exactAudienceAuthorization(authorization, audience) {
     }
     return authorization;
 }
-async function impersonatedIdentityToken(audience, serviceAccount) {
-    return withDeadline('service-account impersonation', async (signal) => {
+async function serviceAccountIdentityToken(audience, serviceAccount) {
+    return withDeadline('service-account ID-token minting', async (signal) => {
         const sourceClient = await new GoogleAuth({
             projectId: AUTH_DISCOVERY_PROJECT_ID,
             scopes: ['https://www.googleapis.com/auth/cloud-platform'],
             clientOptions: { transporterOptions: { signal, timeout: AUTH_ATTEMPT_TIMEOUT_MS } },
         }).getClient();
-        const impersonated = new Impersonated({
-            sourceClient,
-            targetPrincipal: serviceAccount,
-            targetScopes: ['https://www.googleapis.com/auth/cloud-platform'],
-            lifetime: 600,
-            transporterOptions: { signal, timeout: AUTH_ATTEMPT_TIMEOUT_MS },
+        const sourceToken = await sourceClient.getAccessToken();
+        const authorization = typeof sourceToken === 'string' ? sourceToken : sourceToken.token;
+        if (!authorization)
+            throw new Error('ADC returned an empty source access token');
+        const response = await fetch('https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/' +
+            encodeURIComponent(serviceAccount) + ':generateIdToken', {
+            method: "POST",
+            headers: {
+                Authorization: 'Bearer ' + authorization,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ audience, includeEmail: true }),
+            signal,
         });
-        const token = await impersonated.fetchIdToken(audience, { includeEmail: true });
-        return exactAudienceAuthorization(`Bearer ${token}`, audience);
+        const body = await response.json().catch(() => ({}));
+        if (!response.ok || typeof body.token !== 'string') {
+            throw new Error("generateIdToken failed (" + response.status + "): " + JSON.stringify(body.error ?? body));
+        }
+        return exactAudienceAuthorization('Bearer ' + body.token, audience);
     });
 }
 export async function resolveOpsAuthHeader(env = process.env, requestedAudience, requestedServiceAccount) {
@@ -158,13 +166,13 @@ export async function resolveOpsAuthHeader(env = process.env, requestedAudience,
     catch (error) {
         adcError = error instanceof Error ? error.message : String(error);
     }
-    let impersonationError = 'not configured';
+    let serviceAccountError = 'not configured';
     if (serviceAccount && env.DIAGNOSE_DISABLE_IMPERSONATION !== '1') {
         try {
-            return await impersonatedIdentityToken(audience, serviceAccount);
+            return await serviceAccountIdentityToken(audience, serviceAccount);
         }
         catch (error) {
-            impersonationError = error instanceof Error ? error.message : String(error);
+            serviceAccountError = error instanceof Error ? error.message : String(error);
         }
     }
     const token = env.DIAGNOSE_OPS_TOKEN;
@@ -173,13 +181,13 @@ export async function resolveOpsAuthHeader(env = process.env, requestedAudience,
     }
     if (env.DIAGNOSE_DISABLE_GCLOUD !== '1') {
         try {
-            return exactAudienceAuthorization(`Bearer ${await gcloudIdentityToken(audience, serviceAccount)}`, audience);
+            return exactAudienceAuthorization(`Bearer ${await gcloudIdentityToken(audience)}`, audience);
         }
         catch (error) {
             const gcloudError = error instanceof Error ? error.message : String(error);
             throw new Error(`No usable ops credential for audience ${audience}.\n` +
                 `ADC failed: ${truncate(adcError, 500)}\n` +
-                `Service-account impersonation failed: ${truncate(impersonationError, 500)}\n` +
+                `Service-account ID-token minting failed: ${truncate(serviceAccountError, 500)}\n` +
                 `gcloud failed: ${truncate(gcloudError, 500)}\n\n` +
                 'Repair access by adding the Google identity to control-plane `operators`, applying Terraform, ' +
                 'and running `gcloud auth application-default login`, then rerun. ' +
@@ -188,7 +196,7 @@ export async function resolveOpsAuthHeader(env = process.env, requestedAudience,
     }
     throw new Error(`No ops credential available for audience ${audience}. ` +
         `ADC failed: ${truncate(adcError, 300)}. ` +
-        `Service-account impersonation failed: ${truncate(impersonationError, 300)}. ` +
+        `Service-account ID-token minting failed: ${truncate(serviceAccountError, 300)}. ` +
         'Run `gcloud auth application-default login` after the operator Terraform has been applied, or export DIAGNOSE_OPS_TOKEN.');
 }
 function truncate(value, max = 200) {

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.117';
+export const CLI_VERSION = '0.1.118';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.1.117",
+  "version": "0.1.118",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [