FM / auth

/opt/canhelp/node_modules/google-auth-library/build/src/auth/

/opt/canhelp/node_modules/google-auth-library/build/src/auth

Name	Size	Mode	Actions
authclient.d.ts	10764	0644	edit dl rm
authclient.js	11247	0644	edit dl rm
awsclient.d.ts	5315	0644	edit dl rm
awsclient.js	7556	0644	edit dl rm
awsrequestsigner.d.ts	1626	0644	edit dl rm
awsrequestsigner.js	9442	0644	edit dl rm
baseexternalclient.d.ts	13020	0644	edit dl rm
baseexternalclient.js	20857	0644	edit dl rm
certificatesubjecttokensupplier.d.ts	2202	0644	edit dl rm
certificatesubjecttokensupplier.js	10619	0644	edit dl rm
computeclient.d.ts	1359	0644	edit dl rm
computeclient.js	4497	0644	edit dl rm
credentials.d.ts	2359	0644	edit dl rm
credentials.js	704	0644	edit dl rm
defaultawssecuritycredentialssupplier.d.ts	3795	0644	edit dl rm
defaultawssecuritycredentialssupplier.js	9330	0644	edit dl rm
downscopedclient.d.ts	6693	0644	edit dl rm
downscopedclient.js	12353	0644	edit dl rm
envDetect.d.ts	363	0644	edit dl rm
envDetect.js	2831	0644	edit dl rm
executable-response.d.ts	4489	0644	edit dl rm
executable-response.js	7519	0644	edit dl rm
externalAccountAuthorizedUserClient.d.ts	3173	0644	edit dl rm
externalAccountAuthorizedUserClient.js	10005	0644	edit dl rm
externalclient.d.ts	1528	0644	edit dl rm
externalclient.js	3048	0644	edit dl rm
filesubjecttokensupplier.d.ts	1608	0644	edit dl rm
filesubjecttokensupplier.js	3515	0644	edit dl rm
googleauth.d.ts	23574	0644	edit dl rm
googleauth.js	36374	0644	edit dl rm
iam.d.ts	623	0644	edit dl rm
iam.js	1373	0644	edit dl rm
identitypoolclient.d.ts	5626	0644	edit dl rm
identitypoolclient.js	6775	0644	edit dl rm
idtokenclient.d.ts	938	0644	edit dl rm
idtokenclient.js	2106	0644	edit dl rm
impersonated.d.ts	5687	0644	edit dl rm
impersonated.js	8654	0644	edit dl rm
jwtaccess.d.ts	2336	0644	edit dl rm
jwtaccess.js	7213	0644	edit dl rm
jwtclient.d.ts	5122	0644	edit dl rm
jwtclient.js	11256	0644	edit dl rm
loginticket.d.ts	5367	0644	edit dl rm
loginticket.js	1795	0644	edit dl rm
oauth2client.d.ts	25326	0644	edit dl rm
oauth2client.js	33662	0644	edit dl rm
oauth2common.d.ts	4094	0644	edit dl rm
oauth2common.js	8080	0644	edit dl rm
passthrough.d.ts	1097	0644	edit dl rm
passthrough.js	1842	0644	edit dl rm
pluggable-auth-client.d.ts	5485	0644	edit dl rm
pluggable-auth-client.js	10002	0644	edit dl rm
pluggable-auth-handler.d.ts	2109	0644	edit dl rm
pluggable-auth-handler.js	7260	0644	edit dl rm
refreshclient.d.ts	3436	0644	edit dl rm
refreshclient.js	6650	0644	edit dl rm
stscredentials.d.ts	5261	0644	edit dl rm
stscredentials.js	4738	0644	edit dl rm
urlsubjecttokensupplier.d.ts	2186	0644	edit dl rm
urlsubjecttokensupplier.js	2859	0644	edit dl rm

Edit: /opt/canhelp/node_modules/google-auth-library/build/src/auth/impersonated.js (8654B)

"use strict";
/**
 * Copyright 2021 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.Impersonated = exports.IMPERSONATED_ACCOUNT_TYPE = void 0;
const oauth2client_1 = require("./oauth2client");
const gaxios_1 = require("gaxios");
const util_1 = require("../util");
exports.IMPERSONATED_ACCOUNT_TYPE = 'impersonated_service_account';
class Impersonated extends oauth2client_1.OAuth2Client {
    sourceClient;
    targetPrincipal;
    targetScopes;
    delegates;
    lifetime;
    endpoint;
    /**
     * Impersonated service account credentials.
     *
     * Create a new access token by impersonating another service account.
     *
     * Impersonated Credentials allowing credentials issued to a user or
     * service account to impersonate another. The source project using
     * Impersonated Credentials must enable the "IAMCredentials" API.
     * Also, the target service account must grant the orginating principal
     * the "Service Account Token Creator" IAM role.
     *
     * **IMPORTANT**: This method does not validate the credential configuration.
     * A security risk occurs when a credential configuration configured with
     * malicious URLs is used. When the credential configuration is accepted from
     * an untrusted source, you should validate it before using it with this
     * method. For more details, see
     * https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
     *
     * @param {object} options - The configuration object.
     * @param {object} [options.sourceClient] the source credential used as to
     * acquire the impersonated credentials.
     * @param {string} [options.targetPrincipal] the service account to
     * impersonate.
     * @param {string[]} [options.delegates] the chained list of delegates
     * required to grant the final access_token. If set, the sequence of
     * identities must have "Service Account Token Creator" capability granted to
     * the preceding identity. For example, if set to [serviceAccountB,
     * serviceAccountC], the sourceCredential must have the Token Creator role on
     * serviceAccountB. serviceAccountB must have the Token Creator on
     * serviceAccountC. Finally, C must have Token Creator on target_principal.
     * If left unset, sourceCredential must have that role on targetPrincipal.
     * @param {string[]} [options.targetScopes] scopes to request during the
     * authorization grant.
     * @param {number} [options.lifetime] number of seconds the delegated
     * credential should be valid for up to 3600 seconds by default, or 43,200
     * seconds by extending the token's lifetime, see:
     * https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth
     * @param {string} [options.endpoint] api endpoint override.
     */
    constructor(options = {}) {
        super(options);
        // Start with an expired refresh token, which will automatically be
        // refreshed before the first API call is made.
        this.credentials = {
            expiry_date: 1,
            refresh_token: 'impersonated-placeholder',
        };
        this.sourceClient = options.sourceClient ?? new oauth2client_1.OAuth2Client();
        this.targetPrincipal = options.targetPrincipal ?? '';
        this.delegates = options.delegates ?? [];
        this.targetScopes = options.targetScopes ?? [];
        this.lifetime = options.lifetime ?? 3600;
        const usingExplicitUniverseDomain = !!(0, util_1.originalOrCamelOptions)(options).get('universe_domain');
        if (!usingExplicitUniverseDomain) {
            // override the default universe with the source's universe
            this.universeDomain = this.sourceClient.universeDomain;
        }
        else if (this.sourceClient.universeDomain !== this.universeDomain) {
            // non-default universe and is not matching the source - this could be a credential leak
            throw new RangeError(`Universe domain ${this.sourceClient.universeDomain} in source credentials does not match ${this.universeDomain} universe domain set for impersonated credentials.`);
        }
        this.endpoint =
            options.endpoint ?? `https://iamcredentials.${this.universeDomain}`;
    }
    /**
     * Signs some bytes.
     *
     * {@link https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob Reference Documentation}
     * @param blobToSign String to sign.
     *
     * @returns A {@link SignBlobResponse} denoting the keyID and signedBlob in base64 string
     */
    async sign(blobToSign) {
        await this.sourceClient.getAccessToken();
        const name = `projects/-/serviceAccounts/${this.targetPrincipal}`;
        const u = `${this.endpoint}/v1/${name}:signBlob`;
        const body = {
            delegates: this.delegates,
            payload: Buffer.from(blobToSign).toString('base64'),
        };
        const res = await this.sourceClient.request({
            ...Impersonated.RETRY_CONFIG,
            url: u,
            data: body,
            method: 'POST',
        });
        return res.data;
    }
    /** The service account email to be impersonated. */
    getTargetPrincipal() {
        return this.targetPrincipal;
    }
    /**
     * Refreshes the access token.
     */
    async refreshToken() {
        try {
            await this.sourceClient.getAccessToken();
            const name = 'projects/-/serviceAccounts/' + this.targetPrincipal;
            const u = `${this.endpoint}/v1/${name}:generateAccessToken`;
            const body = {
                delegates: this.delegates,
                scope: this.targetScopes,
                lifetime: this.lifetime + 's',
            };
            const res = await this.sourceClient.request({
                ...Impersonated.RETRY_CONFIG,
                url: u,
                data: body,
                method: 'POST',
            });
            const tokenResponse = res.data;
            this.credentials.access_token = tokenResponse.accessToken;
            this.credentials.expiry_date = Date.parse(tokenResponse.expireTime);
            return {
                tokens: this.credentials,
                res,
            };
        }
        catch (error) {
            if (!(error instanceof Error))
                throw error;
            let status = 0;
            let message = '';
            if (error instanceof gaxios_1.GaxiosError) {
                status = error?.response?.data?.error?.status;
                message = error?.response?.data?.error?.message;
            }
            if (status && message) {
                error.message = `${status}: unable to impersonate: ${message}`;
                throw error;
            }
            else {
                error.message = `unable to impersonate: ${error}`;
                throw error;
            }
        }
    }
    /**
     * Generates an OpenID Connect ID token for a service account.
     *
     * {@link https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateIdToken Reference Documentation}
     *
     * @param targetAudience the audience for the fetched ID token.
     * @param options the for the request
     * @return an OpenID Connect ID token
     */
    async fetchIdToken(targetAudience, options) {
        await this.sourceClient.getAccessToken();
        const name = `projects/-/serviceAccounts/${this.targetPrincipal}`;
        const u = `${this.endpoint}/v1/${name}:generateIdToken`;
        const body = {
            delegates: this.delegates,
            audience: targetAudience,
            includeEmail: options?.includeEmail ?? true,
            useEmailAzp: options?.includeEmail ?? true,
        };
        const res = await this.sourceClient.request({
            ...Impersonated.RETRY_CONFIG,
            url: u,
            data: body,
            method: 'POST',
        });
        return res.data.token;
    }
}
exports.Impersonated = Impersonated;
//# sourceMappingURL=impersonated.js.map

cmd: