422 lines
18 KiB
JavaScript
422 lines
18 KiB
JavaScript
'use strict';
|
|
|
|
var client$1 = require('@aws-sdk/core/client');
|
|
var core = require('@smithy/core');
|
|
var client = require('@smithy/core/client');
|
|
var config = require('@smithy/core/config');
|
|
var endpoints = require('@smithy/core/endpoints');
|
|
var protocols = require('@smithy/core/protocols');
|
|
var retry = require('@smithy/core/retry');
|
|
var schema = require('@smithy/core/schema');
|
|
var httpAuthSchemeProvider = require('./auth/httpAuthSchemeProvider');
|
|
var runtimeConfig = require('./runtimeConfig');
|
|
var schemas_0 = require('./schemas/schemas_0');
|
|
var errors = require('./models/errors');
|
|
var STSServiceException = require('./models/STSServiceException');
|
|
|
|
const resolveClientEndpointParameters = (options) => {
|
|
return Object.assign(options, {
|
|
useDualstackEndpoint: options.useDualstackEndpoint ?? false,
|
|
useFipsEndpoint: options.useFipsEndpoint ?? false,
|
|
useGlobalEndpoint: options.useGlobalEndpoint ?? false,
|
|
defaultSigningName: "sts",
|
|
});
|
|
};
|
|
const commonParams = {
|
|
UseGlobalEndpoint: { type: "builtInParams", name: "useGlobalEndpoint" },
|
|
UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
|
|
Endpoint: { type: "builtInParams", name: "endpoint" },
|
|
Region: { type: "builtInParams", name: "region" },
|
|
UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
|
|
};
|
|
|
|
const getHttpAuthExtensionConfiguration = (runtimeConfig) => {
|
|
const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
|
|
let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
|
|
let _credentials = runtimeConfig.credentials;
|
|
return {
|
|
setHttpAuthScheme(httpAuthScheme) {
|
|
const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);
|
|
if (index === -1) {
|
|
_httpAuthSchemes.push(httpAuthScheme);
|
|
}
|
|
else {
|
|
_httpAuthSchemes.splice(index, 1, httpAuthScheme);
|
|
}
|
|
},
|
|
httpAuthSchemes() {
|
|
return _httpAuthSchemes;
|
|
},
|
|
setHttpAuthSchemeProvider(httpAuthSchemeProvider) {
|
|
_httpAuthSchemeProvider = httpAuthSchemeProvider;
|
|
},
|
|
httpAuthSchemeProvider() {
|
|
return _httpAuthSchemeProvider;
|
|
},
|
|
setCredentials(credentials) {
|
|
_credentials = credentials;
|
|
},
|
|
credentials() {
|
|
return _credentials;
|
|
},
|
|
};
|
|
};
|
|
const resolveHttpAuthRuntimeConfig = (config) => {
|
|
return {
|
|
httpAuthSchemes: config.httpAuthSchemes(),
|
|
httpAuthSchemeProvider: config.httpAuthSchemeProvider(),
|
|
credentials: config.credentials(),
|
|
};
|
|
};
|
|
|
|
const resolveRuntimeExtensions = (runtimeConfig, extensions) => {
|
|
const extensionConfiguration = Object.assign(client$1.getAwsRegionExtensionConfiguration(runtimeConfig), client.getDefaultExtensionConfiguration(runtimeConfig), protocols.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration(runtimeConfig));
|
|
extensions.forEach((extension) => extension.configure(extensionConfiguration));
|
|
return Object.assign(runtimeConfig, client$1.resolveAwsRegionExtensionConfiguration(extensionConfiguration), client.resolveDefaultRuntimeConfig(extensionConfiguration), protocols.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig(extensionConfiguration));
|
|
};
|
|
|
|
class STSClient extends client.Client {
|
|
config;
|
|
constructor(...[configuration]) {
|
|
const _config_0 = runtimeConfig.getRuntimeConfig(configuration || {});
|
|
super(_config_0);
|
|
this.initConfig = _config_0;
|
|
const _config_1 = resolveClientEndpointParameters(_config_0);
|
|
const _config_2 = client$1.resolveUserAgentConfig(_config_1);
|
|
const _config_3 = retry.resolveRetryConfig(_config_2);
|
|
const _config_4 = config.resolveRegionConfig(_config_3);
|
|
const _config_5 = client$1.resolveHostHeaderConfig(_config_4);
|
|
const _config_6 = endpoints.resolveEndpointConfig(_config_5);
|
|
const _config_7 = httpAuthSchemeProvider.resolveHttpAuthSchemeConfig(_config_6);
|
|
const _config_8 = resolveRuntimeExtensions(_config_7, configuration?.extensions || []);
|
|
this.config = _config_8;
|
|
this.middlewareStack.use(schema.getSchemaSerdePlugin(this.config));
|
|
this.middlewareStack.use(client$1.getUserAgentPlugin(this.config));
|
|
this.middlewareStack.use(retry.getRetryPlugin(this.config));
|
|
this.middlewareStack.use(protocols.getContentLengthPlugin(this.config));
|
|
this.middlewareStack.use(client$1.getHostHeaderPlugin(this.config));
|
|
this.middlewareStack.use(client$1.getLoggerPlugin(this.config));
|
|
this.middlewareStack.use(client$1.getRecursionDetectionPlugin(this.config));
|
|
this.middlewareStack.use(core.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
|
|
httpAuthSchemeParametersProvider: httpAuthSchemeProvider.defaultSTSHttpAuthSchemeParametersProvider,
|
|
identityProviderConfigProvider: async (config) => new core.DefaultIdentityProviderConfig({
|
|
"aws.auth#sigv4": config.credentials,
|
|
"aws.auth#sigv4a": config.credentials,
|
|
}),
|
|
}));
|
|
this.middlewareStack.use(core.getHttpSigningPlugin(this.config));
|
|
}
|
|
destroy() {
|
|
super.destroy();
|
|
}
|
|
}
|
|
|
|
class AssumeRoleCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "AssumeRole", {})
|
|
.n("STSClient", "AssumeRoleCommand")
|
|
.sc(schemas_0.AssumeRole$)
|
|
.build() {
|
|
}
|
|
|
|
class AssumeRoleWithSAMLCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "AssumeRoleWithSAML", {})
|
|
.n("STSClient", "AssumeRoleWithSAMLCommand")
|
|
.sc(schemas_0.AssumeRoleWithSAML$)
|
|
.build() {
|
|
}
|
|
|
|
class AssumeRoleWithWebIdentityCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "AssumeRoleWithWebIdentity", {})
|
|
.n("STSClient", "AssumeRoleWithWebIdentityCommand")
|
|
.sc(schemas_0.AssumeRoleWithWebIdentity$)
|
|
.build() {
|
|
}
|
|
|
|
class AssumeRootCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "AssumeRoot", {})
|
|
.n("STSClient", "AssumeRootCommand")
|
|
.sc(schemas_0.AssumeRoot$)
|
|
.build() {
|
|
}
|
|
|
|
class DecodeAuthorizationMessageCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "DecodeAuthorizationMessage", {})
|
|
.n("STSClient", "DecodeAuthorizationMessageCommand")
|
|
.sc(schemas_0.DecodeAuthorizationMessage$)
|
|
.build() {
|
|
}
|
|
|
|
class GetAccessKeyInfoCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "GetAccessKeyInfo", {})
|
|
.n("STSClient", "GetAccessKeyInfoCommand")
|
|
.sc(schemas_0.GetAccessKeyInfo$)
|
|
.build() {
|
|
}
|
|
|
|
class GetCallerIdentityCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "GetCallerIdentity", {})
|
|
.n("STSClient", "GetCallerIdentityCommand")
|
|
.sc(schemas_0.GetCallerIdentity$)
|
|
.build() {
|
|
}
|
|
|
|
class GetDelegatedAccessTokenCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "GetDelegatedAccessToken", {})
|
|
.n("STSClient", "GetDelegatedAccessTokenCommand")
|
|
.sc(schemas_0.GetDelegatedAccessToken$)
|
|
.build() {
|
|
}
|
|
|
|
class GetFederationTokenCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "GetFederationToken", {})
|
|
.n("STSClient", "GetFederationTokenCommand")
|
|
.sc(schemas_0.GetFederationToken$)
|
|
.build() {
|
|
}
|
|
|
|
class GetSessionTokenCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "GetSessionToken", {})
|
|
.n("STSClient", "GetSessionTokenCommand")
|
|
.sc(schemas_0.GetSessionToken$)
|
|
.build() {
|
|
}
|
|
|
|
class GetWebIdentityTokenCommand extends client.Command
|
|
.classBuilder()
|
|
.ep(commonParams)
|
|
.m(function (Command, cs, config, o) {
|
|
return [endpoints.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
|
|
})
|
|
.s("AWSSecurityTokenServiceV20110615", "GetWebIdentityToken", {})
|
|
.n("STSClient", "GetWebIdentityTokenCommand")
|
|
.sc(schemas_0.GetWebIdentityToken$)
|
|
.build() {
|
|
}
|
|
|
|
const commands = {
|
|
AssumeRoleCommand,
|
|
AssumeRoleWithSAMLCommand,
|
|
AssumeRoleWithWebIdentityCommand,
|
|
AssumeRootCommand,
|
|
DecodeAuthorizationMessageCommand,
|
|
GetAccessKeyInfoCommand,
|
|
GetCallerIdentityCommand,
|
|
GetDelegatedAccessTokenCommand,
|
|
GetFederationTokenCommand,
|
|
GetSessionTokenCommand,
|
|
GetWebIdentityTokenCommand,
|
|
};
|
|
class STS extends STSClient {
|
|
}
|
|
client.createAggregatedClient(commands, STS);
|
|
|
|
const getAccountIdFromAssumedRoleUser = (assumedRoleUser) => {
|
|
if (typeof assumedRoleUser?.Arn === "string") {
|
|
const arnComponents = assumedRoleUser.Arn.split(":");
|
|
if (arnComponents.length > 4 && arnComponents[4] !== "") {
|
|
return arnComponents[4];
|
|
}
|
|
}
|
|
return undefined;
|
|
};
|
|
const resolveRegion = async (_region, _parentRegion, credentialProviderLogger, loaderConfig = {}) => {
|
|
const region = typeof _region === "function" ? await _region() : _region;
|
|
const parentRegion = typeof _parentRegion === "function" ? await _parentRegion() : _parentRegion;
|
|
let stsDefaultRegion = "";
|
|
const resolvedRegion = region ?? parentRegion ?? (stsDefaultRegion = await client$1.stsRegionDefaultResolver(loaderConfig)());
|
|
credentialProviderLogger?.debug?.("@aws-sdk/client-sts::resolveRegion", "accepting first of:", `${region} (credential provider clientConfig)`, `${parentRegion} (contextual client)`, `${stsDefaultRegion} (STS default: AWS_REGION, profile region, or us-east-1)`);
|
|
return resolvedRegion;
|
|
};
|
|
const getDefaultRoleAssumer$1 = (stsOptions, STSClient) => {
|
|
let stsClient;
|
|
let closureSourceCreds;
|
|
return async (sourceCreds, params) => {
|
|
closureSourceCreds = sourceCreds;
|
|
if (!stsClient) {
|
|
const { logger = stsOptions?.parentClientConfig?.logger, profile = stsOptions?.parentClientConfig?.profile, region, requestHandler = stsOptions?.parentClientConfig?.requestHandler, credentialProviderLogger, userAgentAppId = stsOptions?.parentClientConfig?.userAgentAppId, } = stsOptions;
|
|
const resolvedRegion = await resolveRegion(region, stsOptions?.parentClientConfig?.region, credentialProviderLogger, {
|
|
logger,
|
|
profile,
|
|
});
|
|
const isCompatibleRequestHandler = !isH2(requestHandler);
|
|
stsClient = new STSClient({
|
|
...stsOptions,
|
|
userAgentAppId,
|
|
profile,
|
|
credentialDefaultProvider: () => async () => closureSourceCreds,
|
|
region: resolvedRegion,
|
|
requestHandler: isCompatibleRequestHandler ? requestHandler : undefined,
|
|
logger: logger,
|
|
});
|
|
}
|
|
const { Credentials, AssumedRoleUser } = await stsClient.send(new AssumeRoleCommand(params));
|
|
if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
|
|
throw new Error(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`);
|
|
}
|
|
const accountId = getAccountIdFromAssumedRoleUser(AssumedRoleUser);
|
|
const credentials = {
|
|
accessKeyId: Credentials.AccessKeyId,
|
|
secretAccessKey: Credentials.SecretAccessKey,
|
|
sessionToken: Credentials.SessionToken,
|
|
expiration: Credentials.Expiration,
|
|
...(Credentials.CredentialScope && { credentialScope: Credentials.CredentialScope }),
|
|
...(accountId && { accountId }),
|
|
};
|
|
client$1.setCredentialFeature(credentials, "CREDENTIALS_STS_ASSUME_ROLE", "i");
|
|
return credentials;
|
|
};
|
|
};
|
|
const getDefaultRoleAssumerWithWebIdentity$1 = (stsOptions, STSClient) => {
|
|
let stsClient;
|
|
return async (params) => {
|
|
if (!stsClient) {
|
|
const { logger = stsOptions?.parentClientConfig?.logger, profile = stsOptions?.parentClientConfig?.profile, region, requestHandler = stsOptions?.parentClientConfig?.requestHandler, credentialProviderLogger, userAgentAppId = stsOptions?.parentClientConfig?.userAgentAppId, } = stsOptions;
|
|
const resolvedRegion = await resolveRegion(region, stsOptions?.parentClientConfig?.region, credentialProviderLogger, {
|
|
logger,
|
|
profile,
|
|
});
|
|
const isCompatibleRequestHandler = !isH2(requestHandler);
|
|
stsClient = new STSClient({
|
|
...stsOptions,
|
|
userAgentAppId,
|
|
profile,
|
|
region: resolvedRegion,
|
|
requestHandler: isCompatibleRequestHandler ? requestHandler : undefined,
|
|
logger: logger,
|
|
});
|
|
}
|
|
const { Credentials, AssumedRoleUser } = await stsClient.send(new AssumeRoleWithWebIdentityCommand(params));
|
|
if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
|
|
throw new Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${params.RoleArn}`);
|
|
}
|
|
const accountId = getAccountIdFromAssumedRoleUser(AssumedRoleUser);
|
|
const credentials = {
|
|
accessKeyId: Credentials.AccessKeyId,
|
|
secretAccessKey: Credentials.SecretAccessKey,
|
|
sessionToken: Credentials.SessionToken,
|
|
expiration: Credentials.Expiration,
|
|
...(Credentials.CredentialScope && { credentialScope: Credentials.CredentialScope }),
|
|
...(accountId && { accountId }),
|
|
};
|
|
if (accountId) {
|
|
client$1.setCredentialFeature(credentials, "RESOLVED_ACCOUNT_ID", "T");
|
|
}
|
|
client$1.setCredentialFeature(credentials, "CREDENTIALS_STS_ASSUME_ROLE_WEB_ID", "k");
|
|
return credentials;
|
|
};
|
|
};
|
|
const isH2 = (requestHandler) => {
|
|
return requestHandler?.metadata?.handlerProtocol === "h2";
|
|
};
|
|
|
|
const getCustomizableStsClientCtor = (baseCtor, customizations) => {
|
|
if (!customizations)
|
|
return baseCtor;
|
|
else
|
|
return class CustomizableSTSClient extends baseCtor {
|
|
constructor(config) {
|
|
super(config);
|
|
for (const customization of customizations) {
|
|
this.middlewareStack.use(customization);
|
|
}
|
|
}
|
|
};
|
|
};
|
|
const getDefaultRoleAssumer = (stsOptions = {}, stsPlugins) => getDefaultRoleAssumer$1(stsOptions, getCustomizableStsClientCtor(STSClient, stsPlugins));
|
|
const getDefaultRoleAssumerWithWebIdentity = (stsOptions = {}, stsPlugins) => getDefaultRoleAssumerWithWebIdentity$1(stsOptions, getCustomizableStsClientCtor(STSClient, stsPlugins));
|
|
const decorateDefaultCredentialProvider = (provider) => (input) => provider({
|
|
roleAssumer: getDefaultRoleAssumer(input),
|
|
roleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity(input),
|
|
...input,
|
|
});
|
|
|
|
exports.$Command = client.Command;
|
|
exports.__Client = client.Client;
|
|
exports.STSServiceException = STSServiceException.STSServiceException;
|
|
exports.AssumeRoleCommand = AssumeRoleCommand;
|
|
exports.AssumeRoleWithSAMLCommand = AssumeRoleWithSAMLCommand;
|
|
exports.AssumeRoleWithWebIdentityCommand = AssumeRoleWithWebIdentityCommand;
|
|
exports.AssumeRootCommand = AssumeRootCommand;
|
|
exports.DecodeAuthorizationMessageCommand = DecodeAuthorizationMessageCommand;
|
|
exports.GetAccessKeyInfoCommand = GetAccessKeyInfoCommand;
|
|
exports.GetCallerIdentityCommand = GetCallerIdentityCommand;
|
|
exports.GetDelegatedAccessTokenCommand = GetDelegatedAccessTokenCommand;
|
|
exports.GetFederationTokenCommand = GetFederationTokenCommand;
|
|
exports.GetSessionTokenCommand = GetSessionTokenCommand;
|
|
exports.GetWebIdentityTokenCommand = GetWebIdentityTokenCommand;
|
|
exports.STS = STS;
|
|
exports.STSClient = STSClient;
|
|
exports.decorateDefaultCredentialProvider = decorateDefaultCredentialProvider;
|
|
exports.getDefaultRoleAssumer = getDefaultRoleAssumer;
|
|
exports.getDefaultRoleAssumerWithWebIdentity = getDefaultRoleAssumerWithWebIdentity;
|
|
Object.prototype.hasOwnProperty.call(schemas_0, '__proto__') &&
|
|
!Object.prototype.hasOwnProperty.call(exports, '__proto__') &&
|
|
Object.defineProperty(exports, '__proto__', {
|
|
enumerable: true,
|
|
value: schemas_0['__proto__']
|
|
});
|
|
|
|
Object.keys(schemas_0).forEach(function (k) {
|
|
if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = schemas_0[k];
|
|
});
|
|
Object.prototype.hasOwnProperty.call(errors, '__proto__') &&
|
|
!Object.prototype.hasOwnProperty.call(exports, '__proto__') &&
|
|
Object.defineProperty(exports, '__proto__', {
|
|
enumerable: true,
|
|
value: errors['__proto__']
|
|
});
|
|
|
|
Object.keys(errors).forEach(function (k) {
|
|
if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = errors[k];
|
|
});
|