File Explorer

1const { ProviderError, booleanSelector, SelectorType, loadConfig } = require("@smithy/core/config");2const { setCredentialFeature } = require("@aws-sdk/core/client");3const { normalizeProvider, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require("@smithy/core");4const { SignatureV4 } = require("@smithy/signature-v4");5const { HttpResponse, HttpRequest } = require("@smithy/core/protocols");6 7const getDateHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.date ?? response.headers?.Date) : undefined;8const getAgeHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.age ?? response.headers?.Age) : undefined;9 10const getSkewCorrectedDate = (systemClockOffset) => new Date(Date.now() + systemClockOffset);11 12const getUpdatedSystemClockOffset = (clockTime, currentSystemClockOffset, timeRequestSent, ageHeader) => {13    if (ageHeader !== undefined) {14        return currentSystemClockOffset;15    }16    const serverTime = Date.parse(clockTime);17    const timeResponseReceived = Date.now();18    if (timeRequestSent !== undefined && timeResponseReceived - timeRequestSent > 900_000) {19        return currentSystemClockOffset;20    }21    const candidateSkew = timeRequestSent !== undefined22        ? serverTime - (timeRequestSent + timeResponseReceived) / 223        : serverTime - timeResponseReceived;24    return candidateSkew;25};26 27const throwSigningPropertyError = (name, property) => {28    if (!property) {29        throw new Error(`Property \`${name}\` is not resolved for AWS SDK SigV4Auth`);30    }31    return property;32};33const validateSigningProperties = async (signingProperties) => {34    const context = throwSigningPropertyError("context", signingProperties.context);35    const config = throwSigningPropertyError("config", signingProperties.config);36    const authScheme = context.endpointV2?.properties?.authSchemes?.[0];37    const signerFunction = throwSigningPropertyError("signer", config.signer);38    const signer = await signerFunction(authScheme);39    const signingRegion = signingProperties?.signingRegion;40    const signingRegionSet = signingProperties?.signingRegionSet;41    const signingName = signingProperties?.signingName;42    return {43        config,44        signer,45        signingRegion,46        signingRegionSet,47        signingName,48    };49};50class AwsSdkSigV4Signer {51    async sign(httpRequest, identity, signingProperties) {52        if (!HttpRequest.isInstance(httpRequest)) {53            throw new Error("The request is not an instance of `HttpRequest` and cannot be signed");54        }55        const validatedProps = await validateSigningProperties(signingProperties);56        const { config, signer } = validatedProps;57        let { signingRegion, signingName } = validatedProps;58        const handlerExecutionContext = signingProperties.context;59        if (handlerExecutionContext?.authSchemes?.length ?? 0 > 1) {60            const [first, second] = handlerExecutionContext.authSchemes;61            if (first?.name === "sigv4a" && second?.name === "sigv4") {62                signingRegion = second?.signingRegion ?? signingRegion;63                signingName = second?.signingName ?? signingName;64            }65        }66        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;67        signingProperties._disableClockSkewCorrection = noSkewCorrection;68        if (!noSkewCorrection) {69            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;70            signingProperties._requestSentAt = Date.now();71        }72        const signedRequest = await signer.sign(httpRequest, {73            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),74            signingRegion: signingRegion,75            signingService: signingName,76        });77        return signedRequest;78    }79    errorHandler(signingProperties) {80        return (error) => {81            const errorException = error;82            if (!signingProperties._disableClockSkewCorrection) {83                const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);84                if (serverTime) {85                    const config = throwSigningPropertyError("config", signingProperties.config);86                    const preRequestOffset = signingProperties._preRequestSystemClockOffset;87                    const timeRequestSent = signingProperties._requestSentAt;88                    const ageHeader = getAgeHeader(errorException.$response);89                    const newOffset = getUpdatedSystemClockOffset(serverTime, config.systemClockOffset, timeRequestSent, ageHeader);90                    config.systemClockOffset = newOffset;91                    const skewExceedsThreshold = Math.abs(newOffset) >= 240_000;92                    const isLocalCorrection = newOffset !== preRequestOffset;93                    const isConcurrentCorrection = preRequestOffset !== undefined && preRequestOffset !== newOffset;94                    if (skewExceedsThreshold && (isLocalCorrection || isConcurrentCorrection) && errorException.$metadata) {95                        errorException.$metadata.clockSkewCorrected = true;96                    }97                }98            }99            throw error;100        };101    }102    successHandler(httpResponse, signingProperties) {103        if (signingProperties._disableClockSkewCorrection) {104            return;105        }106        const dateHeader = getDateHeader(httpResponse);107        if (dateHeader) {108            const config = throwSigningPropertyError("config", signingProperties.config);109            const timeRequestSent = signingProperties._requestSentAt;110            const ageHeader = getAgeHeader(httpResponse);111            config.systemClockOffset = getUpdatedSystemClockOffset(dateHeader, config.systemClockOffset, timeRequestSent, ageHeader);112        }113    }114}115const AWSSDKSigV4Signer = AwsSdkSigV4Signer;116 117class AwsSdkSigV4ASigner extends AwsSdkSigV4Signer {118    async sign(httpRequest, identity, signingProperties) {119        if (!HttpRequest.isInstance(httpRequest)) {120            throw new Error("The request is not an instance of `HttpRequest` and cannot be signed");121        }122        const { config, signer, signingRegion, signingRegionSet, signingName } = await validateSigningProperties(signingProperties);123        const configResolvedSigningRegionSet = await config.sigv4aSigningRegionSet?.();124        const multiRegionOverride = (configResolvedSigningRegionSet ??125            signingRegionSet ?? [signingRegion]).join(",");126        const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;127        signingProperties._disableClockSkewCorrection = noSkewCorrection;128        if (!noSkewCorrection) {129            signingProperties._preRequestSystemClockOffset = config.systemClockOffset;130            signingProperties._requestSentAt = Date.now();131        }132        const signedRequest = await signer.sign(httpRequest, {133            signingDate: noSkewCorrection ? new Date() : getSkewCorrectedDate(config.systemClockOffset),134            signingRegion: multiRegionOverride,135            signingService: signingName,136        });137        return signedRequest;138    }139}140 141const getArrayForCommaSeparatedString = (str) => typeof str === "string" && str.length > 0 ? str.split(",").map((item) => item.trim()) : [];142 143const getBearerTokenEnvKey = (signingName) => `AWS_BEARER_TOKEN_${signingName.replace(/[\s-]/g, "_").toUpperCase()}`;144 145const NODE_AUTH_SCHEME_PREFERENCE_ENV_KEY = "AWS_AUTH_SCHEME_PREFERENCE";146const NODE_AUTH_SCHEME_PREFERENCE_CONFIG_KEY = "auth_scheme_preference";147const NODE_AUTH_SCHEME_PREFERENCE_OPTIONS = {148    environmentVariableSelector: (env, options) => {149        if (options?.signingName) {150            const bearerTokenKey = getBearerTokenEnvKey(options.signingName);151            if (bearerTokenKey in env)152                return ["httpBearerAuth"];153        }154        if (!(NODE_AUTH_SCHEME_PREFERENCE_ENV_KEY in env))155            return undefined;156        return getArrayForCommaSeparatedString(env[NODE_AUTH_SCHEME_PREFERENCE_ENV_KEY]);157    },158    configFileSelector: (profile) => {159        if (!(NODE_AUTH_SCHEME_PREFERENCE_CONFIG_KEY in profile))160            return undefined;161        return getArrayForCommaSeparatedString(profile[NODE_AUTH_SCHEME_PREFERENCE_CONFIG_KEY]);162    },163    default: [],164};165 166const resolveAwsSdkSigV4AConfig = (config) => {167    config.sigv4aSigningRegionSet = normalizeProvider(config.sigv4aSigningRegionSet);168    return config;169};170const NODE_SIGV4A_CONFIG_OPTIONS = {171    environmentVariableSelector(env) {172        if (env.AWS_SIGV4A_SIGNING_REGION_SET) {173            return env.AWS_SIGV4A_SIGNING_REGION_SET.split(",").map((_) => _.trim());174        }175        throw new ProviderError("AWS_SIGV4A_SIGNING_REGION_SET not set in env.", {176            tryNextLink: true,177        });178    },179    configFileSelector(profile) {180        if (profile.sigv4a_signing_region_set) {181            return (profile.sigv4a_signing_region_set ?? "").split(",").map((_) => _.trim());182        }183        throw new ProviderError("sigv4a_signing_region_set not set in profile.", {184            tryNextLink: true,185        });186    },187    default: undefined,188};189 190const bindResolveAwsSdkSigV4Config = (defaultDisableClockSkewCorrection) => (config) => {191    let inputCredentials = config.credentials;192    let isUserSupplied = !!config.credentials;193    let resolvedCredentials = undefined;194    Object.defineProperty(config, "credentials", {195        set(credentials) {196            if (credentials && credentials !== inputCredentials && credentials !== resolvedCredentials) {197                isUserSupplied = true;198            }199            inputCredentials = credentials;200            const memoizedProvider = normalizeCredentialProvider(config, {201                credentials: inputCredentials,202                credentialDefaultProvider: config.credentialDefaultProvider,203            });204            const boundProvider = bindCallerConfig(config, memoizedProvider);205            if (isUserSupplied && !boundProvider.attributed) {206                const isCredentialObject = typeof inputCredentials === "object" && inputCredentials !== null;207                resolvedCredentials = async (options) => {208                    const creds = await boundProvider(options);209                    const attributedCreds = creds;210                    if (isCredentialObject && (!attributedCreds.$source || Object.keys(attributedCreds.$source).length === 0)) {211                        return setCredentialFeature(attributedCreds, "CREDENTIALS_CODE", "e");212                    }213                    return attributedCreds;214                };215                resolvedCredentials.memoized = boundProvider.memoized;216                resolvedCredentials.configBound = boundProvider.configBound;217                resolvedCredentials.attributed = true;218            }219            else {220                resolvedCredentials = boundProvider;221            }222        },223        get() {224            return resolvedCredentials;225        },226        enumerable: true,227        configurable: true,228    });229    config.credentials = inputCredentials;230    const { signingEscapePath = true, systemClockOffset = config.systemClockOffset || 0, sha256, } = config;231    let signer;232    if (config.signer) {233        signer = normalizeProvider(config.signer);234    }235    else if (config.regionInfoProvider) {236        signer = () => normalizeProvider(config.region)()237            .then(async (region) => [238            (await config.regionInfoProvider(region, {239                useFipsEndpoint: await config.useFipsEndpoint(),240                useDualstackEndpoint: await config.useDualstackEndpoint(),241            })) || {},242            region,243        ])244            .then(([regionInfo, region]) => {245            const { signingRegion, signingService } = regionInfo;246            config.signingRegion = config.signingRegion || signingRegion || region;247            config.signingName = config.signingName || signingService || config.serviceId;248            const params = {249                ...config,250                credentials: config.credentials,251                region: config.signingRegion,252                service: config.signingName,253                sha256,254                uriEscapePath: signingEscapePath,255            };256            const SignerCtor = config.signerConstructor || SignatureV4;257            return new SignerCtor(params);258        });259    }260    else {261        signer = async (authScheme) => {262            authScheme = Object.assign({}, {263                name: "sigv4",264                signingName: config.signingName || config.defaultSigningName,265                signingRegion: await normalizeProvider(config.region)(),266                properties: {},267            }, authScheme);268            const signingRegion = authScheme.signingRegion;269            const signingService = authScheme.signingName;270            config.signingRegion = config.signingRegion || signingRegion;271            config.signingName = config.signingName || signingService || config.serviceId;272            const params = {273                ...config,274                credentials: config.credentials,275                region: config.signingRegion,276                service: config.signingName,277                sha256,278                uriEscapePath: signingEscapePath,279            };280            const SignerCtor = config.signerConstructor || SignatureV4;281            return new SignerCtor(params);282        };283    }284    const resolvedConfig = Object.assign(config, {285        systemClockOffset,286        signingEscapePath,287        signer,288        disableClockSkewCorrection: normalizeProvider(config.disableClockSkewCorrection ?? defaultDisableClockSkewCorrection),289    });290    return resolvedConfig;291};292function normalizeCredentialProvider(config, { credentials, credentialDefaultProvider }) {293    let credentialsProvider;294    if (credentials) {295        if (!credentials?.memoized) {296            credentialsProvider = memoizeIdentityProvider(credentials, isIdentityExpired, doesIdentityRequireRefresh);297        }298        else {299            credentialsProvider = credentials;300        }301    }302    else {303        if (credentialDefaultProvider) {304            credentialsProvider = normalizeProvider(credentialDefaultProvider(Object.assign({}, config, {305                parentClientConfig: config,306            })));307        }308        else {309            credentialsProvider = async () => {310                throw new Error("@aws-sdk/core::resolveAwsSdkSigV4Config - `credentials` not provided and no credentialDefaultProvider was configured.");311            };312        }313    }314    credentialsProvider.memoized = true;315    return credentialsProvider;316}317function bindCallerConfig(config, credentialsProvider) {318    if (credentialsProvider.configBound) {319        return credentialsProvider;320    }321    const fn = async (options) => credentialsProvider({ ...options, callerClientConfig: config });322    fn.memoized = credentialsProvider.memoized;323    fn.configBound = true;324    return fn;325}326 327const ENV_DISABLE_CLOCK_SKEW_CORRECTION = "AWS_DISABLE_CLOCK_SKEW_CORRECTION";328const CONFIG_DISABLE_CLOCK_SKEW_CORRECTION = "disable_clock_skew_correction";329const NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS = {330    environmentVariableSelector: (env) => booleanSelector(env, ENV_DISABLE_CLOCK_SKEW_CORRECTION, SelectorType.ENV),331    configFileSelector: (profile) => booleanSelector(profile, CONFIG_DISABLE_CLOCK_SKEW_CORRECTION, SelectorType.CONFIG),332    default: false,333};334 335const DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION = loadConfig(NODE_DISABLE_CLOCK_SKEW_CORRECTION_CONFIG_OPTIONS);336 337const resolveAwsSdkSigV4Config = bindResolveAwsSdkSigV4Config(DEFAULT_DISABLE_CLOCK_SKEW_CORRECTION);338const resolveAWSSDKSigV4Config = resolveAwsSdkSigV4Config;339 340exports.AWSSDKSigV4Signer = AWSSDKSigV4Signer;341exports.AwsSdkSigV4ASigner = AwsSdkSigV4ASigner;342exports.AwsSdkSigV4Signer = AwsSdkSigV4Signer;343exports.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS = NODE_AUTH_SCHEME_PREFERENCE_OPTIONS;344exports.NODE_SIGV4A_CONFIG_OPTIONS = NODE_SIGV4A_CONFIG_OPTIONS;345exports.getBearerTokenEnvKey = getBearerTokenEnvKey;346exports.resolveAWSSDKSigV4Config = resolveAWSSDKSigV4Config;347exports.resolveAwsSdkSigV4AConfig = resolveAwsSdkSigV4AConfig;348exports.resolveAwsSdkSigV4Config = resolveAwsSdkSigV4Config;349exports.validateSigningProperties = validateSigningProperties;350