FM / auth

/opt/canhelp/node_modules/google-auth-library/build/src/auth/

/opt/canhelp/node_modules/google-auth-library/build/src/auth

Name	Size	Mode	Actions
authclient.d.ts	10764	0644	edit dl rm
authclient.js	11247	0644	edit dl rm
awsclient.d.ts	5315	0644	edit dl rm
awsclient.js	7556	0644	edit dl rm
awsrequestsigner.d.ts	1626	0644	edit dl rm
awsrequestsigner.js	9442	0644	edit dl rm
baseexternalclient.d.ts	13020	0644	edit dl rm
baseexternalclient.js	20857	0644	edit dl rm
certificatesubjecttokensupplier.d.ts	2202	0644	edit dl rm
certificatesubjecttokensupplier.js	10619	0644	edit dl rm
computeclient.d.ts	1359	0644	edit dl rm
computeclient.js	4497	0644	edit dl rm
credentials.d.ts	2359	0644	edit dl rm
credentials.js	704	0644	edit dl rm
defaultawssecuritycredentialssupplier.d.ts	3795	0644	edit dl rm
defaultawssecuritycredentialssupplier.js	9330	0644	edit dl rm
downscopedclient.d.ts	6693	0644	edit dl rm
downscopedclient.js	12353	0644	edit dl rm
envDetect.d.ts	363	0644	edit dl rm
envDetect.js	2831	0644	edit dl rm
executable-response.d.ts	4489	0644	edit dl rm
executable-response.js	7519	0644	edit dl rm
externalAccountAuthorizedUserClient.d.ts	3173	0644	edit dl rm
externalAccountAuthorizedUserClient.js	10005	0644	edit dl rm
externalclient.d.ts	1528	0644	edit dl rm
externalclient.js	3048	0644	edit dl rm
filesubjecttokensupplier.d.ts	1608	0644	edit dl rm
filesubjecttokensupplier.js	3515	0644	edit dl rm
googleauth.d.ts	23574	0644	edit dl rm
googleauth.js	36374	0644	edit dl rm
iam.d.ts	623	0644	edit dl rm
iam.js	1373	0644	edit dl rm
identitypoolclient.d.ts	5626	0644	edit dl rm
identitypoolclient.js	6775	0644	edit dl rm
idtokenclient.d.ts	938	0644	edit dl rm
idtokenclient.js	2106	0644	edit dl rm
impersonated.d.ts	5687	0644	edit dl rm
impersonated.js	8654	0644	edit dl rm
jwtaccess.d.ts	2336	0644	edit dl rm
jwtaccess.js	7213	0644	edit dl rm
jwtclient.d.ts	5122	0644	edit dl rm
jwtclient.js	11256	0644	edit dl rm
loginticket.d.ts	5367	0644	edit dl rm
loginticket.js	1795	0644	edit dl rm
oauth2client.d.ts	25326	0644	edit dl rm
oauth2client.js	33662	0644	edit dl rm
oauth2common.d.ts	4094	0644	edit dl rm
oauth2common.js	8080	0644	edit dl rm
passthrough.d.ts	1097	0644	edit dl rm
passthrough.js	1842	0644	edit dl rm
pluggable-auth-client.d.ts	5485	0644	edit dl rm
pluggable-auth-client.js	10002	0644	edit dl rm
pluggable-auth-handler.d.ts	2109	0644	edit dl rm
pluggable-auth-handler.js	7260	0644	edit dl rm
refreshclient.d.ts	3436	0644	edit dl rm
refreshclient.js	6650	0644	edit dl rm
stscredentials.d.ts	5261	0644	edit dl rm
stscredentials.js	4738	0644	edit dl rm
urlsubjecttokensupplier.d.ts	2186	0644	edit dl rm
urlsubjecttokensupplier.js	2859	0644	edit dl rm

Edit: /opt/canhelp/node_modules/google-auth-library/build/src/auth/certificatesubjecttokensupplier.js (10619B)

"use strict";
// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
Object.defineProperty(exports, "__esModule", { value: true });
exports.CertificateSubjectTokenSupplier = exports.InvalidConfigurationError = exports.CertificateSourceUnavailableError = exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE = void 0;
const util_1 = require("../util");
const fs = require("fs");
const crypto_1 = require("crypto");
const https = require("https");
exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE = 'GOOGLE_API_CERTIFICATE_CONFIG';
/**
 * Thrown when the certificate source cannot be located or accessed.
 */
class CertificateSourceUnavailableError extends Error {
    constructor(message) {
        super(message);
        this.name = 'CertificateSourceUnavailableError';
    }
}
exports.CertificateSourceUnavailableError = CertificateSourceUnavailableError;
/**
 * Thrown for invalid configuration that is not related to file availability.
 */
class InvalidConfigurationError extends Error {
    constructor(message) {
        super(message);
        this.name = 'InvalidConfigurationError';
    }
}
exports.InvalidConfigurationError = InvalidConfigurationError;
/**
 * A subject token supplier that uses a client certificate for authentication.
 * It provides the certificate chain as the subject token for identity federation.
 */
class CertificateSubjectTokenSupplier {
    certificateConfigPath;
    trustChainPath;
    cert;
    key;
    /**
     * Initializes a new instance of the CertificateSubjectTokenSupplier.
     * @param opts The configuration options for the supplier.
     */
    constructor(opts) {
        if (!opts.useDefaultCertificateConfig && !opts.certificateConfigLocation) {
            throw new InvalidConfigurationError('Either `useDefaultCertificateConfig` must be true or a `certificateConfigLocation` must be provided.');
        }
        if (opts.useDefaultCertificateConfig && opts.certificateConfigLocation) {
            throw new InvalidConfigurationError('Both `useDefaultCertificateConfig` and `certificateConfigLocation` cannot be provided.');
        }
        this.trustChainPath = opts.trustChainPath;
        this.certificateConfigPath = opts.certificateConfigLocation ?? '';
    }
    /**
     * Creates an HTTPS agent configured with the client certificate and private key for mTLS.
     * @returns An mTLS-configured https.Agent.
     */
    async createMtlsHttpsAgent() {
        if (!this.key || !this.cert) {
            throw new InvalidConfigurationError('Cannot create mTLS Agent with missing certificate or key');
        }
        return new https.Agent({ key: this.key, cert: this.cert });
    }
    /**
     * Constructs the subject token, which is the base64-encoded certificate chain.
     * @returns A promise that resolves with the subject token.
     */
    async getSubjectToken() {
        // The "subject token" in this context is the processed certificate chain.
        this.certificateConfigPath = await this.#resolveCertificateConfigFilePath();
        const { certPath, keyPath } = await this.#getCertAndKeyPaths();
        ({ cert: this.cert, key: this.key } = await this.#getKeyAndCert(certPath, keyPath));
        return await this.#processChainFromPaths(this.cert);
    }
    /**
     * Resolves the absolute path to the certificate configuration file
     * by checking the "certificate_config_location" provided in the ADC file,
     * or the "GOOGLE_API_CERTIFICATE_CONFIG" environment variable
     * or in the default gcloud path.
     * @param overridePath An optional path to check first.
     * @returns The resolved file path.
     */
    async #resolveCertificateConfigFilePath() {
        // 1. Check for the override path from constructor options.
        const overridePath = this.certificateConfigPath;
        if (overridePath) {
            if (await (0, util_1.isValidFile)(overridePath)) {
                return overridePath;
            }
            throw new CertificateSourceUnavailableError(`Provided certificate config path is invalid: ${overridePath}`);
        }
        // 2. Check the standard environment variable.
        const envPath = process.env[exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE];
        if (envPath) {
            if (await (0, util_1.isValidFile)(envPath)) {
                return envPath;
            }
            throw new CertificateSourceUnavailableError(`Path from environment variable "${exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE}" is invalid: ${envPath}`);
        }
        // 3. Check the well-known gcloud config location.
        const wellKnownPath = (0, util_1.getWellKnownCertificateConfigFileLocation)();
        if (await (0, util_1.isValidFile)(wellKnownPath)) {
            return wellKnownPath;
        }
        // 4. If none are found, throw an error.
        throw new CertificateSourceUnavailableError('Could not find certificate configuration file. Searched override path, ' +
            `the "${exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE}" env var, and the gcloud path (${wellKnownPath}).`);
    }
    /**
     * Reads and parses the certificate config JSON file to extract the certificate and key paths.
     * @returns An object containing the certificate and key paths.
     */
    async #getCertAndKeyPaths() {
        const configPath = this.certificateConfigPath;
        let fileContents;
        try {
            fileContents = await fs.promises.readFile(configPath, 'utf8');
        }
        catch (err) {
            throw new CertificateSourceUnavailableError(`Failed to read certificate config file at: ${configPath}`);
        }
        try {
            const config = JSON.parse(fileContents);
            const certPath = config?.cert_configs?.workload?.cert_path;
            const keyPath = config?.cert_configs?.workload?.key_path;
            if (!certPath || !keyPath) {
                throw new InvalidConfigurationError(`Certificate config file (${configPath}) is missing required "cert_path" or "key_path" in the workload config.`);
            }
            return { certPath, keyPath };
        }
        catch (e) {
            if (e instanceof InvalidConfigurationError)
                throw e;
            throw new InvalidConfigurationError(`Failed to parse certificate config from ${configPath}: ${e.message}`);
        }
    }
    /**
     * Reads and parses the cert and key files get their content and check valid format.
     * @returns An object containing the cert content and key content in buffer format.
     */
    async #getKeyAndCert(certPath, keyPath) {
        let cert, key;
        try {
            cert = await fs.promises.readFile(certPath);
            new crypto_1.X509Certificate(cert);
        }
        catch (err) {
            const message = err instanceof Error ? err.message : String(err);
            throw new CertificateSourceUnavailableError(`Failed to read certificate file at ${certPath}: ${message}`);
        }
        try {
            key = await fs.promises.readFile(keyPath);
            (0, crypto_1.createPrivateKey)(key);
        }
        catch (err) {
            const message = err instanceof Error ? err.message : String(err);
            throw new CertificateSourceUnavailableError(`Failed to read private key file at ${keyPath}: ${message}`);
        }
        return { cert, key };
    }
    /**
     * Reads the leaf certificate and trust chain, combines them,
     * and returns a JSON array of base64-encoded certificates.
     * @returns A stringified JSON array of the certificate chain.
     */
    async #processChainFromPaths(leafCertBuffer) {
        const leafCert = new crypto_1.X509Certificate(leafCertBuffer);
        // If no trust chain is provided, just use the successfully parsed leaf certificate.
        if (!this.trustChainPath) {
            return JSON.stringify([leafCert.raw.toString('base64')]);
        }
        // Handle the trust chain logic.
        try {
            const chainPems = await fs.promises.readFile(this.trustChainPath, 'utf8');
            const pemBlocks = chainPems.match(/-----BEGIN CERTIFICATE-----[^-]+-----END CERTIFICATE-----/g) ?? [];
            const chainCerts = pemBlocks.map((pem, index) => {
                try {
                    return new crypto_1.X509Certificate(pem);
                }
                catch (err) {
                    const message = err instanceof Error ? err.message : String(err);
                    // Throw a more precise error if a single certificate in the chain is invalid.
                    throw new InvalidConfigurationError(`Failed to parse certificate at index ${index} in trust chain file ${this.trustChainPath}: ${message}`);
                }
            });
            const leafIndex = chainCerts.findIndex(chainCert => leafCert.raw.equals(chainCert.raw));
            let finalChain;
            if (leafIndex === -1) {
                // Leaf not found, so prepend it to the chain.
                finalChain = [leafCert, ...chainCerts];
            }
            else if (leafIndex === 0) {
                // Leaf is already the first element, so the chain is correctly ordered.
                finalChain = chainCerts;
            }
            else {
                // Leaf is in the chain but not at the top, which is invalid.
                throw new InvalidConfigurationError(`Leaf certificate exists in the trust chain but is not the first entry (found at index ${leafIndex}).`);
            }
            return JSON.stringify(finalChain.map(cert => cert.raw.toString('base64')));
        }
        catch (err) {
            // Re-throw our specific configuration errors.
            if (err instanceof InvalidConfigurationError)
                throw err;
            const message = err instanceof Error ? err.message : String(err);
            throw new CertificateSourceUnavailableError(`Failed to process certificate chain from ${this.trustChainPath}: ${message}`);
        }
    }
}
exports.CertificateSubjectTokenSupplier = CertificateSubjectTokenSupplier;
//# sourceMappingURL=certificatesubjecttokensupplier.js.map

cmd: