File Explorer

1"use strict";2/*3 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.4 * SPDX-License-Identifier: Apache-2.0.5 */6var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {7    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }8    return new (P || (P = Promise))(function (resolve, reject) {9        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }10        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }11        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }12        step((generator = generator.apply(thisArg, _arguments || [])).next());13    });14};15var __importDefault = (this && this.__importDefault) || function (mod) {16    return (mod && mod.__esModule) ? mod : { "default": mod };17};18Object.defineProperty(exports, "__esModule", { value: true });19exports.aws_verify_sigv4a_signing = exports.aws_sign_request = exports.AwsSignedBodyHeaderType = exports.AwsSignedBodyValue = exports.AwsSignatureType = exports.AwsSigningAlgorithm = exports.AwsCredentialsProvider = void 0;20const binding_1 = __importDefault(require("./binding"));21const error_1 = require("./error");22const io_1 = require("./io");23/**24 * Credentials providers source the AwsCredentials needed to sign an authenticated AWS request.25 *26 * We don't currently expose an interface for fetching credentials from Javascript.27 *28 * @category Auth29 */30/* Subclass for the purpose of exposing a non-NativeHandle based API */31class AwsCredentialsProvider extends binding_1.default.AwsCredentialsProvider {32    /**33     * Creates a new default credentials provider to be used internally for AWS credentials resolution:34     *35     *   The CRT's default provider chain currently sources in this order:36     *37     *     1. Environment38     *     2. Profile39     *     3. (conditional, off by default) ECS40     *     4. (conditional, on by default) EC2 Instance Metadata41     *42     * @param bootstrap (optional) client bootstrap to be used to establish any required network connections43     *44     * @returns a new credentials provider using default credentials resolution rules45     */46    static newDefault(bootstrap = undefined) {47        return super.newDefault(bootstrap != null ? bootstrap.native_handle() : null);48    }49    /**50     * Creates a new credentials provider that returns a fixed set of credentials.51     *52     * @param access_key access key to use in the static credentials53     * @param secret_key secret key to use in the static credentials54     * @param session_token (optional) session token to use in the static credentials55     *56     * @returns a new credentials provider that will return a fixed set of AWS credentials57     */58    static newStatic(access_key, secret_key, session_token) {59        return super.newStatic(access_key, secret_key, session_token);60    }61    /**62     * Creates a new credentials provider that sources credentials from the AWS Cognito Identity service via the63     * GetCredentialsForIdentity http API.64     *65     * @param config provider configuration necessary to make GetCredentialsForIdentity web requests66     *67     * @returns a new credentials provider that returns credentials sourced from the AWS Cognito Identity service68     */69    static newCognito(config) {70        if (config == null || config == undefined) {71            throw new error_1.CrtError("AwsCredentialsProvider newCognito: Cognito config not defined");72        }73        return super.newCognito(config, config.tlsContext != null ? config.tlsContext.native_handle() : new io_1.ClientTlsContext().native_handle(), config.bootstrap != null ? config.bootstrap.native_handle() : null, config.httpProxyOptions ? config.httpProxyOptions.create_native_handle() : null);74    }75    /**76     * Creates a new credentials provider that sources credentials from the the X509 service on AWS IoT Core.77     *78     * @param config provider configuration necessary to source credentials via X50979     *80     * @returns a new credentials provider that returns credentials sourced from the AWS X509 service81     */82    static newX509(config) {83        if (config == null || config == undefined) {84            throw new error_1.CrtError("AwsCredentialsProvider newX509: X509 config not defined");85        }86        return super.newX509(config, config.tlsContext.native_handle(), config.httpProxyOptions ? config.httpProxyOptions.create_native_handle() : null);87    }88}89exports.AwsCredentialsProvider = AwsCredentialsProvider;90/**91 * AWS signing algorithm enumeration.92 *93 * @category Auth94 */95var AwsSigningAlgorithm;96(function (AwsSigningAlgorithm) {97    /** Use the Aws signature version 4 signing process to sign the request */98    AwsSigningAlgorithm[AwsSigningAlgorithm["SigV4"] = 0] = "SigV4";99    /** Use the Aws signature version 4 Asymmetric signing process to sign the request */100    AwsSigningAlgorithm[AwsSigningAlgorithm["SigV4Asymmetric"] = 1] = "SigV4Asymmetric";101})(AwsSigningAlgorithm = exports.AwsSigningAlgorithm || (exports.AwsSigningAlgorithm = {}));102/**103 * AWS signature type enumeration.104 *105 * @category Auth106 */107var AwsSignatureType;108(function (AwsSignatureType) {109    /** Sign an http request and apply the signing results as headers */110    AwsSignatureType[AwsSignatureType["HttpRequestViaHeaders"] = 0] = "HttpRequestViaHeaders";111    /** Sign an http request and apply the signing results as query params */112    AwsSignatureType[AwsSignatureType["HttpRequestViaQueryParams"] = 1] = "HttpRequestViaQueryParams";113    /** Sign an http request payload chunk */114    AwsSignatureType[AwsSignatureType["HttpRequestChunk"] = 2] = "HttpRequestChunk";115    /** Sign an event stream event */116    AwsSignatureType[AwsSignatureType["HttpRequestEvent"] = 3] = "HttpRequestEvent";117})(AwsSignatureType = exports.AwsSignatureType || (exports.AwsSignatureType = {}));118/**119 * Values for use with {@link AwsSigningConfig.signed_body_value}.120 *121 * Some services use special values (e.g. 'UNSIGNED-PAYLOAD') when the body122 * is not being signed in the usual way.123 *124 * @category Auth125 */126var AwsSignedBodyValue;127(function (AwsSignedBodyValue) {128    /** Use the SHA-256 of the empty string as the canonical request payload value */129    AwsSignedBodyValue["EmptySha256"] = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";130    /** Use the literal string 'UNSIGNED-PAYLOAD' as the canonical request payload value  */131    AwsSignedBodyValue["UnsignedPayload"] = "UNSIGNED-PAYLOAD";132    /** Use the literal string 'STREAMING-AWS4-HMAC-SHA256-PAYLOAD' as the canonical request payload value  */133    AwsSignedBodyValue["StreamingAws4HmacSha256Payload"] = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD";134    /** Use the literal string 'STREAMING-AWS4-HMAC-SHA256-EVENTS' as the canonical request payload value  */135    AwsSignedBodyValue["StreamingAws4HmacSha256Events"] = "STREAMING-AWS4-HMAC-SHA256-EVENTS";136})(AwsSignedBodyValue = exports.AwsSignedBodyValue || (exports.AwsSignedBodyValue = {}));137/**138 * AWS signed body header enumeration.139 *140 * @category Auth141 */142var AwsSignedBodyHeaderType;143(function (AwsSignedBodyHeaderType) {144    /** Do not add a header containing the canonical request payload value */145    AwsSignedBodyHeaderType[AwsSignedBodyHeaderType["None"] = 0] = "None";146    /** Add the X-Amz-Content-Sha256 header with the canonical request payload value */147    AwsSignedBodyHeaderType[AwsSignedBodyHeaderType["XAmzContentSha256"] = 1] = "XAmzContentSha256";148})(AwsSignedBodyHeaderType = exports.AwsSignedBodyHeaderType || (exports.AwsSignedBodyHeaderType = {}));149/**150 * Perform AWS HTTP request signing.151 *152 * The {@link HttpRequest} is transformed asynchronously,153 * according to the {@link AwsSigningConfig}.154 *155 * When signing:156 *  1.  It is good practice to use a new config for each signature,157 *      or the date might get too old.158 *159 *  2.  Do not add the following headers to requests before signing, they may be added by the signer:160 *      x-amz-content-sha256,161 *      X-Amz-Date,162 *      Authorization163 *164 *  3.  Do not add the following query params to requests before signing, they may be added by the signer:165 *      X-Amz-Signature,166 *      X-Amz-Date,167 *      X-Amz-Credential,168 *      X-Amz-Algorithm,169 *      X-Amz-SignedHeaders170 * @param request The HTTP request to sign.171 * @param config Configuration for signing.172 * @returns A promise whose result will be the signed173 *       {@link HttpRequest}. The future will contain an exception174 *       if the signing process fails.175 *176 * @category Auth177 */178function aws_sign_request(request, config) {179    return __awaiter(this, void 0, void 0, function* () {180        return new Promise((resolve, reject) => {181            try {182                /* Note: if the body of request has not fully loaded, it will lead to an endless loop.183                 * User should set the signed_body_value of config to prevent this endless loop in this case */184                binding_1.default.aws_sign_request(request, config, (error_code) => {185                    if (error_code == 0) {186                        resolve(request);187                    }188                    else {189                        reject(new error_1.CrtError(error_code));190                    }191                });192            }193            catch (error) {194                reject(error);195            }196        });197    });198}199exports.aws_sign_request = aws_sign_request;200/**201 *202 * @internal203 *204 * Test only.205 * Verifies:206 *  (1) The canonical request generated during sigv4a signing of the request matches what is passed in207 *  (2) The signature passed in is a valid ECDSA signature of the hashed string-to-sign derived from the208 *  canonical request209 *210 * @param request The HTTP request to sign.211 * @param config Configuration for signing.212 * @param expected_canonical_request String type of expected canonical request. Refer to XXX(link to doc?)213 * @param signature The generated signature string from {@link aws_sign_request}, which is verified here.214 * @param ecc_key_pub_x the x coordinate of the public part of the ecc key to verify the signature.215 * @param ecc_key_pub_y the y coordinate of the public part of the ecc key to verify the signature216 * @returns True, if the verification succeed. Otherwise, false.217 */218function aws_verify_sigv4a_signing(request, config, expected_canonical_request, signature, ecc_key_pub_x, ecc_key_pub_y) {219    return binding_1.default.aws_verify_sigv4a_signing(request, config, expected_canonical_request, signature, ecc_key_pub_x, ecc_key_pub_y);220}221exports.aws_verify_sigv4a_signing = aws_verify_sigv4a_signing;222//# sourceMappingURL=auth.js.map