File Explorer

1"use strict";2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {3    if (k2 === undefined) k2 = k;4    var desc = Object.getOwnPropertyDescriptor(m, k);5    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {6      desc = { enumerable: true, get: function() { return m[k]; } };7    }8    Object.defineProperty(o, k2, desc);9}) : (function(o, m, k, k2) {10    if (k2 === undefined) k2 = k;11    o[k2] = m[k];12}));13var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {14    Object.defineProperty(o, "default", { enumerable: true, value: v });15}) : function(o, v) {16    o["default"] = v;17});18var __importStar = (this && this.__importStar) || (function () {19    var ownKeys = function(o) {20        ownKeys = Object.getOwnPropertyNames || function (o) {21            var ar = [];22            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;23            return ar;24        };25        return ownKeys(o);26    };27    return function (mod) {28        if (mod && mod.__esModule) return mod;29        var result = {};30        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);31        __setModuleDefault(result, mod);32        return result;33    };34})();35Object.defineProperty(exports, "__esModule", { value: true });36exports.fromTemporaryCredentials = void 0;37const core_1 = require("@smithy/core");38const property_provider_1 = require("@smithy/property-provider");39const ASSUME_ROLE_DEFAULT_REGION = "us-east-1";40const fromTemporaryCredentials = (options, credentialDefaultProvider, regionProvider) => {41    let stsClient;42    return async (awsIdentityProperties = {}) => {43        const { callerClientConfig } = awsIdentityProperties;44        const profile = options.clientConfig?.profile ?? callerClientConfig?.profile;45        const logger = options.logger ?? callerClientConfig?.logger;46        logger?.debug("@aws-sdk/credential-providers - fromTemporaryCredentials (STS)");47        const params = { ...options.params, RoleSessionName: options.params.RoleSessionName ?? "aws-sdk-js-" + Date.now() };48        if (params?.SerialNumber) {49            if (!options.mfaCodeProvider) {50                throw new property_provider_1.CredentialsProviderError(`Temporary credential requires multi-factor authentication, but no MFA code callback was provided.`, {51                    tryNextLink: false,52                    logger,53                });54            }55            params.TokenCode = await options.mfaCodeProvider(params?.SerialNumber);56        }57        const { AssumeRoleCommand, STSClient } = await Promise.resolve().then(() => __importStar(require("./loadSts")));58        if (!stsClient) {59            const defaultCredentialsOrError = typeof credentialDefaultProvider === "function" ? credentialDefaultProvider() : undefined;60            const credentialSources = [61                options.masterCredentials,62                options.clientConfig?.credentials,63                void callerClientConfig?.credentials,64                callerClientConfig?.credentialDefaultProvider?.(),65                defaultCredentialsOrError,66            ];67            let credentialSource = "STS client default credentials";68            if (credentialSources[0]) {69                credentialSource = "options.masterCredentials";70            }71            else if (credentialSources[1]) {72                credentialSource = "options.clientConfig.credentials";73            }74            else if (credentialSources[2]) {75                credentialSource = "caller client's credentials";76                throw new Error("fromTemporaryCredentials recursion in callerClientConfig.credentials");77            }78            else if (credentialSources[3]) {79                credentialSource = "caller client's credentialDefaultProvider";80            }81            else if (credentialSources[4]) {82                credentialSource = "AWS SDK default credentials";83            }84            const regionSources = [85                options.clientConfig?.region,86                callerClientConfig?.region,87                await regionProvider?.({88                    profile,89                }),90                ASSUME_ROLE_DEFAULT_REGION,91            ];92            let regionSource = "default partition's default region";93            if (regionSources[0]) {94                regionSource = "options.clientConfig.region";95            }96            else if (regionSources[1]) {97                regionSource = "caller client's region";98            }99            else if (regionSources[2]) {100                regionSource = "file or env region";101            }102            const requestHandlerSources = [103                filterRequestHandler(options.clientConfig?.requestHandler),104                filterRequestHandler(callerClientConfig?.requestHandler),105            ];106            let requestHandlerSource = "STS default requestHandler";107            if (requestHandlerSources[0]) {108                requestHandlerSource = "options.clientConfig.requestHandler";109            }110            else if (requestHandlerSources[1]) {111                requestHandlerSource = "caller client's requestHandler";112            }113            logger?.debug?.(`@aws-sdk/credential-providers - fromTemporaryCredentials STS client init with ` +114                `${regionSource}=${await (0, core_1.normalizeProvider)(coalesce(regionSources))()}, ${credentialSource}, ${requestHandlerSource}.`);115            stsClient = new STSClient({116                ...options.clientConfig,117                credentials: coalesce(credentialSources),118                logger,119                profile,120                region: coalesce(regionSources),121                requestHandler: coalesce(requestHandlerSources),122            });123        }124        if (options.clientPlugins) {125            for (const plugin of options.clientPlugins) {126                stsClient.middlewareStack.use(plugin);127            }128        }129        const { Credentials } = await stsClient.send(new AssumeRoleCommand(params));130        if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {131            throw new property_provider_1.CredentialsProviderError(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`, {132                logger,133            });134        }135        return {136            accessKeyId: Credentials.AccessKeyId,137            secretAccessKey: Credentials.SecretAccessKey,138            sessionToken: Credentials.SessionToken,139            expiration: Credentials.Expiration,140            credentialScope: Credentials.CredentialScope,141        };142    };143};144exports.fromTemporaryCredentials = fromTemporaryCredentials;145const filterRequestHandler = (requestHandler) => {146    return requestHandler?.metadata?.handlerProtocol === "h2" ? undefined : requestHandler;147};148const coalesce = (args) => {149    for (const item of args) {150        if (item !== undefined) {151            return item;152        }153    }154};155