Backend half

This commit is contained in:
2025-07-11 19:56:28 +02:00
parent fa868e7c1d
commit 8600fa7c1d
19426 changed files with 3750448 additions and 8108 deletions
+13
View File
@@ -0,0 +1,13 @@
# @aws-sdk/nested-clients
## Description
This is an internal package. Do not install this as a direct dependency.
This package contains separate internal implementations of the STS and SSO-OIDC AWS SDK clients
to be used by the AWS SDK credential providers to break a cyclic dependency.
### Bundlers
This package may be marked as external if you do not use STS nor SSO-OIDC
in your credential resolution process.
@@ -0,0 +1,2 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
@@ -0,0 +1,56 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.resolveHttpAuthSchemeConfig = exports.defaultSSOOIDCHttpAuthSchemeProvider = exports.defaultSSOOIDCHttpAuthSchemeParametersProvider = void 0;
const core_1 = require("@aws-sdk/core");
const util_middleware_1 = require("@smithy/util-middleware");
const defaultSSOOIDCHttpAuthSchemeParametersProvider = async (config, context, input) => {
return {
operation: (0, util_middleware_1.getSmithyContext)(context).operation,
region: (await (0, util_middleware_1.normalizeProvider)(config.region)()) ||
(() => {
throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
})(),
};
};
exports.defaultSSOOIDCHttpAuthSchemeParametersProvider = defaultSSOOIDCHttpAuthSchemeParametersProvider;
function createAwsAuthSigv4HttpAuthOption(authParameters) {
return {
schemeId: "aws.auth#sigv4",
signingProperties: {
name: "sso-oauth",
region: authParameters.region,
},
propertiesExtractor: (config, context) => ({
signingProperties: {
config,
context,
},
}),
};
}
function createSmithyApiNoAuthHttpAuthOption(authParameters) {
return {
schemeId: "smithy.api#noAuth",
};
}
const defaultSSOOIDCHttpAuthSchemeProvider = (authParameters) => {
const options = [];
switch (authParameters.operation) {
case "CreateToken": {
options.push(createSmithyApiNoAuthHttpAuthOption(authParameters));
break;
}
default: {
options.push(createAwsAuthSigv4HttpAuthOption(authParameters));
}
}
return options;
};
exports.defaultSSOOIDCHttpAuthSchemeProvider = defaultSSOOIDCHttpAuthSchemeProvider;
const resolveHttpAuthSchemeConfig = (config) => {
const config_0 = (0, core_1.resolveAwsSdkSigV4Config)(config);
return Object.assign(config_0, {
authSchemePreference: (0, util_middleware_1.normalizeProvider)(config.authSchemePreference ?? []),
});
};
exports.resolveHttpAuthSchemeConfig = resolveHttpAuthSchemeConfig;
@@ -0,0 +1,18 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.defaultEndpointResolver = void 0;
const util_endpoints_1 = require("@aws-sdk/util-endpoints");
const util_endpoints_2 = require("@smithy/util-endpoints");
const ruleset_1 = require("./ruleset");
const cache = new util_endpoints_2.EndpointCache({
size: 50,
params: ["Endpoint", "Region", "UseDualStack", "UseFIPS"],
});
const defaultEndpointResolver = (endpointParams, context = {}) => {
return cache.get(endpointParams, () => (0, util_endpoints_2.resolveEndpoint)(ruleset_1.ruleSet, {
endpointParams: endpointParams,
logger: context.logger,
}));
};
exports.defaultEndpointResolver = defaultEndpointResolver;
util_endpoints_2.customEndpointFunctions.aws = util_endpoints_1.awsEndpointFunctions;
@@ -0,0 +1,7 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.ruleSet = void 0;
const u = "required", v = "fn", w = "argv", x = "ref";
const a = true, b = "isSet", c = "booleanEquals", d = "error", e = "endpoint", f = "tree", g = "PartitionResult", h = "getAttr", i = { [u]: false, "type": "String" }, j = { [u]: true, "default": false, "type": "Boolean" }, k = { [x]: "Endpoint" }, l = { [v]: c, [w]: [{ [x]: "UseFIPS" }, true] }, m = { [v]: c, [w]: [{ [x]: "UseDualStack" }, true] }, n = {}, o = { [v]: h, [w]: [{ [x]: g }, "supportsFIPS"] }, p = { [x]: g }, q = { [v]: c, [w]: [true, { [v]: h, [w]: [p, "supportsDualStack"] }] }, r = [l], s = [m], t = [{ [x]: "Region" }];
const _data = { version: "1.0", parameters: { Region: i, UseDualStack: j, UseFIPS: j, Endpoint: i }, rules: [{ conditions: [{ [v]: b, [w]: [k] }], rules: [{ conditions: r, error: "Invalid Configuration: FIPS and custom endpoint are not supported", type: d }, { conditions: s, error: "Invalid Configuration: Dualstack and custom endpoint are not supported", type: d }, { endpoint: { url: k, properties: n, headers: n }, type: e }], type: f }, { conditions: [{ [v]: b, [w]: t }], rules: [{ conditions: [{ [v]: "aws.partition", [w]: t, assign: g }], rules: [{ conditions: [l, m], rules: [{ conditions: [{ [v]: c, [w]: [a, o] }, q], rules: [{ endpoint: { url: "https://oidc-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", properties: n, headers: n }, type: e }], type: f }, { error: "FIPS and DualStack are enabled, but this partition does not support one or both", type: d }], type: f }, { conditions: r, rules: [{ conditions: [{ [v]: c, [w]: [o, a] }], rules: [{ conditions: [{ [v]: "stringEquals", [w]: [{ [v]: h, [w]: [p, "name"] }, "aws-us-gov"] }], endpoint: { url: "https://oidc.{Region}.amazonaws.com", properties: n, headers: n }, type: e }, { endpoint: { url: "https://oidc-fips.{Region}.{PartitionResult#dnsSuffix}", properties: n, headers: n }, type: e }], type: f }, { error: "FIPS is enabled but this partition does not support FIPS", type: d }], type: f }, { conditions: s, rules: [{ conditions: [q], rules: [{ endpoint: { url: "https://oidc.{Region}.{PartitionResult#dualStackDnsSuffix}", properties: n, headers: n }, type: e }], type: f }, { error: "DualStack is enabled but this partition does not support DualStack", type: d }], type: f }, { endpoint: { url: "https://oidc.{Region}.{PartitionResult#dnsSuffix}", properties: n, headers: n }, type: e }], type: f }], type: f }, { error: "Invalid Configuration: Missing Region", type: d }] };
exports.ruleSet = _data;
@@ -0,0 +1,872 @@
"use strict";
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
var __export = (target, all) => {
for (var name in all)
__defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
if (from && typeof from === "object" || typeof from === "function") {
for (let key of __getOwnPropNames(from))
if (!__hasOwnProp.call(to, key) && key !== except)
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
}
return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
// src/submodules/sso-oidc/index.ts
var index_exports = {};
__export(index_exports, {
$Command: () => import_smithy_client6.Command,
AccessDeniedException: () => AccessDeniedException,
AuthorizationPendingException: () => AuthorizationPendingException,
CreateTokenCommand: () => CreateTokenCommand,
CreateTokenRequestFilterSensitiveLog: () => CreateTokenRequestFilterSensitiveLog,
CreateTokenResponseFilterSensitiveLog: () => CreateTokenResponseFilterSensitiveLog,
ExpiredTokenException: () => ExpiredTokenException,
InternalServerException: () => InternalServerException,
InvalidClientException: () => InvalidClientException,
InvalidGrantException: () => InvalidGrantException,
InvalidRequestException: () => InvalidRequestException,
InvalidScopeException: () => InvalidScopeException,
SSOOIDC: () => SSOOIDC,
SSOOIDCClient: () => SSOOIDCClient,
SSOOIDCServiceException: () => SSOOIDCServiceException,
SlowDownException: () => SlowDownException,
UnauthorizedClientException: () => UnauthorizedClientException,
UnsupportedGrantTypeException: () => UnsupportedGrantTypeException,
__Client: () => import_smithy_client2.Client
});
module.exports = __toCommonJS(index_exports);
// src/submodules/sso-oidc/SSOOIDCClient.ts
var import_middleware_host_header = require("@aws-sdk/middleware-host-header");
var import_middleware_logger = require("@aws-sdk/middleware-logger");
var import_middleware_recursion_detection = require("@aws-sdk/middleware-recursion-detection");
var import_middleware_user_agent = require("@aws-sdk/middleware-user-agent");
var import_config_resolver = require("@smithy/config-resolver");
var import_core = require("@smithy/core");
var import_middleware_content_length = require("@smithy/middleware-content-length");
var import_middleware_endpoint = require("@smithy/middleware-endpoint");
var import_middleware_retry = require("@smithy/middleware-retry");
var import_smithy_client2 = require("@smithy/smithy-client");
var import_httpAuthSchemeProvider = require("./auth/httpAuthSchemeProvider");
// src/submodules/sso-oidc/endpoint/EndpointParameters.ts
var resolveClientEndpointParameters = /* @__PURE__ */ __name((options) => {
return Object.assign(options, {
useDualstackEndpoint: options.useDualstackEndpoint ?? false,
useFipsEndpoint: options.useFipsEndpoint ?? false,
defaultSigningName: "sso-oauth"
});
}, "resolveClientEndpointParameters");
var commonParams = {
UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
Endpoint: { type: "builtInParams", name: "endpoint" },
Region: { type: "builtInParams", name: "region" },
UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
};
// src/submodules/sso-oidc/SSOOIDCClient.ts
var import_runtimeConfig = require("./runtimeConfig");
// src/submodules/sso-oidc/runtimeExtensions.ts
var import_region_config_resolver = require("@aws-sdk/region-config-resolver");
var import_protocol_http = require("@smithy/protocol-http");
var import_smithy_client = require("@smithy/smithy-client");
// src/submodules/sso-oidc/auth/httpAuthExtensionConfiguration.ts
var getHttpAuthExtensionConfiguration = /* @__PURE__ */ __name((runtimeConfig) => {
const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
let _credentials = runtimeConfig.credentials;
return {
setHttpAuthScheme(httpAuthScheme) {
const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);
if (index === -1) {
_httpAuthSchemes.push(httpAuthScheme);
} else {
_httpAuthSchemes.splice(index, 1, httpAuthScheme);
}
},
httpAuthSchemes() {
return _httpAuthSchemes;
},
setHttpAuthSchemeProvider(httpAuthSchemeProvider) {
_httpAuthSchemeProvider = httpAuthSchemeProvider;
},
httpAuthSchemeProvider() {
return _httpAuthSchemeProvider;
},
setCredentials(credentials) {
_credentials = credentials;
},
credentials() {
return _credentials;
}
};
}, "getHttpAuthExtensionConfiguration");
var resolveHttpAuthRuntimeConfig = /* @__PURE__ */ __name((config) => {
return {
httpAuthSchemes: config.httpAuthSchemes(),
httpAuthSchemeProvider: config.httpAuthSchemeProvider(),
credentials: config.credentials()
};
}, "resolveHttpAuthRuntimeConfig");
// src/submodules/sso-oidc/runtimeExtensions.ts
var resolveRuntimeExtensions = /* @__PURE__ */ __name((runtimeConfig, extensions) => {
const extensionConfiguration = Object.assign(
(0, import_region_config_resolver.getAwsRegionExtensionConfiguration)(runtimeConfig),
(0, import_smithy_client.getDefaultExtensionConfiguration)(runtimeConfig),
(0, import_protocol_http.getHttpHandlerExtensionConfiguration)(runtimeConfig),
getHttpAuthExtensionConfiguration(runtimeConfig)
);
extensions.forEach((extension) => extension.configure(extensionConfiguration));
return Object.assign(
runtimeConfig,
(0, import_region_config_resolver.resolveAwsRegionExtensionConfiguration)(extensionConfiguration),
(0, import_smithy_client.resolveDefaultRuntimeConfig)(extensionConfiguration),
(0, import_protocol_http.resolveHttpHandlerRuntimeConfig)(extensionConfiguration),
resolveHttpAuthRuntimeConfig(extensionConfiguration)
);
}, "resolveRuntimeExtensions");
// src/submodules/sso-oidc/SSOOIDCClient.ts
var SSOOIDCClient = class extends import_smithy_client2.Client {
static {
__name(this, "SSOOIDCClient");
}
/**
* The resolved configuration of SSOOIDCClient class. This is resolved and normalized from the {@link SSOOIDCClientConfig | constructor configuration interface}.
*/
config;
constructor(...[configuration]) {
const _config_0 = (0, import_runtimeConfig.getRuntimeConfig)(configuration || {});
super(_config_0);
this.initConfig = _config_0;
const _config_1 = resolveClientEndpointParameters(_config_0);
const _config_2 = (0, import_middleware_user_agent.resolveUserAgentConfig)(_config_1);
const _config_3 = (0, import_middleware_retry.resolveRetryConfig)(_config_2);
const _config_4 = (0, import_config_resolver.resolveRegionConfig)(_config_3);
const _config_5 = (0, import_middleware_host_header.resolveHostHeaderConfig)(_config_4);
const _config_6 = (0, import_middleware_endpoint.resolveEndpointConfig)(_config_5);
const _config_7 = (0, import_httpAuthSchemeProvider.resolveHttpAuthSchemeConfig)(_config_6);
const _config_8 = resolveRuntimeExtensions(_config_7, configuration?.extensions || []);
this.config = _config_8;
this.middlewareStack.use((0, import_middleware_user_agent.getUserAgentPlugin)(this.config));
this.middlewareStack.use((0, import_middleware_retry.getRetryPlugin)(this.config));
this.middlewareStack.use((0, import_middleware_content_length.getContentLengthPlugin)(this.config));
this.middlewareStack.use((0, import_middleware_host_header.getHostHeaderPlugin)(this.config));
this.middlewareStack.use((0, import_middleware_logger.getLoggerPlugin)(this.config));
this.middlewareStack.use((0, import_middleware_recursion_detection.getRecursionDetectionPlugin)(this.config));
this.middlewareStack.use(
(0, import_core.getHttpAuthSchemeEndpointRuleSetPlugin)(this.config, {
httpAuthSchemeParametersProvider: import_httpAuthSchemeProvider.defaultSSOOIDCHttpAuthSchemeParametersProvider,
identityProviderConfigProvider: /* @__PURE__ */ __name(async (config) => new import_core.DefaultIdentityProviderConfig({
"aws.auth#sigv4": config.credentials
}), "identityProviderConfigProvider")
})
);
this.middlewareStack.use((0, import_core.getHttpSigningPlugin)(this.config));
}
/**
* Destroy underlying resources, like sockets. It's usually not necessary to do this.
* However in Node.js, it's best to explicitly shut down the client's agent when it is no longer needed.
* Otherwise, sockets might stay open for quite a long time before the server terminates them.
*/
destroy() {
super.destroy();
}
};
// src/submodules/sso-oidc/SSOOIDC.ts
var import_smithy_client7 = require("@smithy/smithy-client");
// src/submodules/sso-oidc/commands/CreateTokenCommand.ts
var import_middleware_endpoint2 = require("@smithy/middleware-endpoint");
var import_middleware_serde = require("@smithy/middleware-serde");
var import_smithy_client6 = require("@smithy/smithy-client");
// src/submodules/sso-oidc/models/models_0.ts
var import_smithy_client4 = require("@smithy/smithy-client");
// src/submodules/sso-oidc/models/SSOOIDCServiceException.ts
var import_smithy_client3 = require("@smithy/smithy-client");
var SSOOIDCServiceException = class _SSOOIDCServiceException extends import_smithy_client3.ServiceException {
static {
__name(this, "SSOOIDCServiceException");
}
/**
* @internal
*/
constructor(options) {
super(options);
Object.setPrototypeOf(this, _SSOOIDCServiceException.prototype);
}
};
// src/submodules/sso-oidc/models/models_0.ts
var AccessDeniedException = class _AccessDeniedException extends SSOOIDCServiceException {
static {
__name(this, "AccessDeniedException");
}
name = "AccessDeniedException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be <code>access_denied</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "AccessDeniedException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _AccessDeniedException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var AuthorizationPendingException = class _AuthorizationPendingException extends SSOOIDCServiceException {
static {
__name(this, "AuthorizationPendingException");
}
name = "AuthorizationPendingException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be
* <code>authorization_pending</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "AuthorizationPendingException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _AuthorizationPendingException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var CreateTokenRequestFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
...obj,
...obj.clientSecret && { clientSecret: import_smithy_client4.SENSITIVE_STRING },
...obj.refreshToken && { refreshToken: import_smithy_client4.SENSITIVE_STRING },
...obj.codeVerifier && { codeVerifier: import_smithy_client4.SENSITIVE_STRING }
}), "CreateTokenRequestFilterSensitiveLog");
var CreateTokenResponseFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
...obj,
...obj.accessToken && { accessToken: import_smithy_client4.SENSITIVE_STRING },
...obj.refreshToken && { refreshToken: import_smithy_client4.SENSITIVE_STRING },
...obj.idToken && { idToken: import_smithy_client4.SENSITIVE_STRING }
}), "CreateTokenResponseFilterSensitiveLog");
var ExpiredTokenException = class _ExpiredTokenException extends SSOOIDCServiceException {
static {
__name(this, "ExpiredTokenException");
}
name = "ExpiredTokenException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be <code>expired_token</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "ExpiredTokenException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _ExpiredTokenException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var InternalServerException = class _InternalServerException extends SSOOIDCServiceException {
static {
__name(this, "InternalServerException");
}
name = "InternalServerException";
$fault = "server";
/**
* <p>Single error code. For this exception the value will be <code>server_error</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "InternalServerException",
$fault: "server",
...opts
});
Object.setPrototypeOf(this, _InternalServerException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var InvalidClientException = class _InvalidClientException extends SSOOIDCServiceException {
static {
__name(this, "InvalidClientException");
}
name = "InvalidClientException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be
* <code>invalid_client</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "InvalidClientException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _InvalidClientException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var InvalidGrantException = class _InvalidGrantException extends SSOOIDCServiceException {
static {
__name(this, "InvalidGrantException");
}
name = "InvalidGrantException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be <code>invalid_grant</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "InvalidGrantException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _InvalidGrantException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var InvalidRequestException = class _InvalidRequestException extends SSOOIDCServiceException {
static {
__name(this, "InvalidRequestException");
}
name = "InvalidRequestException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be
* <code>invalid_request</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "InvalidRequestException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _InvalidRequestException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var InvalidScopeException = class _InvalidScopeException extends SSOOIDCServiceException {
static {
__name(this, "InvalidScopeException");
}
name = "InvalidScopeException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be <code>invalid_scope</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "InvalidScopeException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _InvalidScopeException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var SlowDownException = class _SlowDownException extends SSOOIDCServiceException {
static {
__name(this, "SlowDownException");
}
name = "SlowDownException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be <code>slow_down</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "SlowDownException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _SlowDownException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var UnauthorizedClientException = class _UnauthorizedClientException extends SSOOIDCServiceException {
static {
__name(this, "UnauthorizedClientException");
}
name = "UnauthorizedClientException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be
* <code>unauthorized_client</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "UnauthorizedClientException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _UnauthorizedClientException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
var UnsupportedGrantTypeException = class _UnsupportedGrantTypeException extends SSOOIDCServiceException {
static {
__name(this, "UnsupportedGrantTypeException");
}
name = "UnsupportedGrantTypeException";
$fault = "client";
/**
* <p>Single error code. For this exception the value will be
* <code>unsupported_grant_type</code>.</p>
* @public
*/
error;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description;
/**
* @internal
*/
constructor(opts) {
super({
name: "UnsupportedGrantTypeException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _UnsupportedGrantTypeException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
};
// src/submodules/sso-oidc/protocols/Aws_restJson1.ts
var import_core2 = require("@aws-sdk/core");
var import_core3 = require("@smithy/core");
var import_smithy_client5 = require("@smithy/smithy-client");
var se_CreateTokenCommand = /* @__PURE__ */ __name(async (input, context) => {
const b = (0, import_core3.requestBuilder)(input, context);
const headers = {
"content-type": "application/json"
};
b.bp("/token");
let body;
body = JSON.stringify(
(0, import_smithy_client5.take)(input, {
clientId: [],
clientSecret: [],
code: [],
codeVerifier: [],
deviceCode: [],
grantType: [],
redirectUri: [],
refreshToken: [],
scope: /* @__PURE__ */ __name((_) => (0, import_smithy_client5._json)(_), "scope")
})
);
b.m("POST").h(headers).b(body);
return b.build();
}, "se_CreateTokenCommand");
var de_CreateTokenCommand = /* @__PURE__ */ __name(async (output, context) => {
if (output.statusCode !== 200 && output.statusCode >= 300) {
return de_CommandError(output, context);
}
const contents = (0, import_smithy_client5.map)({
$metadata: deserializeMetadata(output)
});
const data = (0, import_smithy_client5.expectNonNull)((0, import_smithy_client5.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
const doc = (0, import_smithy_client5.take)(data, {
accessToken: import_smithy_client5.expectString,
expiresIn: import_smithy_client5.expectInt32,
idToken: import_smithy_client5.expectString,
refreshToken: import_smithy_client5.expectString,
tokenType: import_smithy_client5.expectString
});
Object.assign(contents, doc);
return contents;
}, "de_CreateTokenCommand");
var de_CommandError = /* @__PURE__ */ __name(async (output, context) => {
const parsedOutput = {
...output,
body: await (0, import_core2.parseJsonErrorBody)(output.body, context)
};
const errorCode = (0, import_core2.loadRestJsonErrorCode)(output, parsedOutput.body);
switch (errorCode) {
case "AccessDeniedException":
case "com.amazonaws.ssooidc#AccessDeniedException":
throw await de_AccessDeniedExceptionRes(parsedOutput, context);
case "AuthorizationPendingException":
case "com.amazonaws.ssooidc#AuthorizationPendingException":
throw await de_AuthorizationPendingExceptionRes(parsedOutput, context);
case "ExpiredTokenException":
case "com.amazonaws.ssooidc#ExpiredTokenException":
throw await de_ExpiredTokenExceptionRes(parsedOutput, context);
case "InternalServerException":
case "com.amazonaws.ssooidc#InternalServerException":
throw await de_InternalServerExceptionRes(parsedOutput, context);
case "InvalidClientException":
case "com.amazonaws.ssooidc#InvalidClientException":
throw await de_InvalidClientExceptionRes(parsedOutput, context);
case "InvalidGrantException":
case "com.amazonaws.ssooidc#InvalidGrantException":
throw await de_InvalidGrantExceptionRes(parsedOutput, context);
case "InvalidRequestException":
case "com.amazonaws.ssooidc#InvalidRequestException":
throw await de_InvalidRequestExceptionRes(parsedOutput, context);
case "InvalidScopeException":
case "com.amazonaws.ssooidc#InvalidScopeException":
throw await de_InvalidScopeExceptionRes(parsedOutput, context);
case "SlowDownException":
case "com.amazonaws.ssooidc#SlowDownException":
throw await de_SlowDownExceptionRes(parsedOutput, context);
case "UnauthorizedClientException":
case "com.amazonaws.ssooidc#UnauthorizedClientException":
throw await de_UnauthorizedClientExceptionRes(parsedOutput, context);
case "UnsupportedGrantTypeException":
case "com.amazonaws.ssooidc#UnsupportedGrantTypeException":
throw await de_UnsupportedGrantTypeExceptionRes(parsedOutput, context);
default:
const parsedBody = parsedOutput.body;
return throwDefaultError({
output,
parsedBody,
errorCode
});
}
}, "de_CommandError");
var throwDefaultError = (0, import_smithy_client5.withBaseException)(SSOOIDCServiceException);
var de_AccessDeniedExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new AccessDeniedException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_AccessDeniedExceptionRes");
var de_AuthorizationPendingExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new AuthorizationPendingException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_AuthorizationPendingExceptionRes");
var de_ExpiredTokenExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new ExpiredTokenException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_ExpiredTokenExceptionRes");
var de_InternalServerExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new InternalServerException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_InternalServerExceptionRes");
var de_InvalidClientExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new InvalidClientException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_InvalidClientExceptionRes");
var de_InvalidGrantExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new InvalidGrantException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_InvalidGrantExceptionRes");
var de_InvalidRequestExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new InvalidRequestException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_InvalidRequestExceptionRes");
var de_InvalidScopeExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new InvalidScopeException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_InvalidScopeExceptionRes");
var de_SlowDownExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new SlowDownException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_SlowDownExceptionRes");
var de_UnauthorizedClientExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new UnauthorizedClientException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_UnauthorizedClientExceptionRes");
var de_UnsupportedGrantTypeExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const contents = (0, import_smithy_client5.map)({});
const data = parsedOutput.body;
const doc = (0, import_smithy_client5.take)(data, {
error: import_smithy_client5.expectString,
error_description: import_smithy_client5.expectString
});
Object.assign(contents, doc);
const exception = new UnsupportedGrantTypeException({
$metadata: deserializeMetadata(parsedOutput),
...contents
});
return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
}, "de_UnsupportedGrantTypeExceptionRes");
var deserializeMetadata = /* @__PURE__ */ __name((output) => ({
httpStatusCode: output.statusCode,
requestId: output.headers["x-amzn-requestid"] ?? output.headers["x-amzn-request-id"] ?? output.headers["x-amz-request-id"],
extendedRequestId: output.headers["x-amz-id-2"],
cfId: output.headers["x-amz-cf-id"]
}), "deserializeMetadata");
// src/submodules/sso-oidc/commands/CreateTokenCommand.ts
var CreateTokenCommand = class extends import_smithy_client6.Command.classBuilder().ep(commonParams).m(function(Command, cs, config, o) {
return [
(0, import_middleware_serde.getSerdePlugin)(config, this.serialize, this.deserialize),
(0, import_middleware_endpoint2.getEndpointPlugin)(config, Command.getEndpointParameterInstructions())
];
}).s("AWSSSOOIDCService", "CreateToken", {}).n("SSOOIDCClient", "CreateTokenCommand").f(CreateTokenRequestFilterSensitiveLog, CreateTokenResponseFilterSensitiveLog).ser(se_CreateTokenCommand).de(de_CreateTokenCommand).build() {
static {
__name(this, "CreateTokenCommand");
}
};
// src/submodules/sso-oidc/SSOOIDC.ts
var commands = {
CreateTokenCommand
};
var SSOOIDC = class extends SSOOIDCClient {
static {
__name(this, "SSOOIDC");
}
};
(0, import_smithy_client7.createAggregatedClient)(commands, SSOOIDC);
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
$Command,
AccessDeniedException,
AuthorizationPendingException,
CreateTokenCommand,
CreateTokenRequestFilterSensitiveLog,
CreateTokenResponseFilterSensitiveLog,
ExpiredTokenException,
InternalServerException,
InvalidClientException,
InvalidGrantException,
InvalidRequestException,
InvalidScopeException,
SSOOIDC,
SSOOIDCClient,
SSOOIDCServiceException,
SlowDownException,
UnauthorizedClientException,
UnsupportedGrantTypeException,
__Client
});
@@ -0,0 +1,38 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getRuntimeConfig = void 0;
const tslib_1 = require("tslib");
const package_json_1 = tslib_1.__importDefault(require("../../../package.json"));
const sha256_browser_1 = require("@aws-crypto/sha256-browser");
const util_user_agent_browser_1 = require("@aws-sdk/util-user-agent-browser");
const config_resolver_1 = require("@smithy/config-resolver");
const fetch_http_handler_1 = require("@smithy/fetch-http-handler");
const invalid_dependency_1 = require("@smithy/invalid-dependency");
const util_body_length_browser_1 = require("@smithy/util-body-length-browser");
const util_retry_1 = require("@smithy/util-retry");
const runtimeConfig_shared_1 = require("./runtimeConfig.shared");
const smithy_client_1 = require("@smithy/smithy-client");
const util_defaults_mode_browser_1 = require("@smithy/util-defaults-mode-browser");
const getRuntimeConfig = (config) => {
const defaultsMode = (0, util_defaults_mode_browser_1.resolveDefaultsModeConfig)(config);
const defaultConfigProvider = () => defaultsMode().then(smithy_client_1.loadConfigsForDefaultMode);
const clientSharedValues = (0, runtimeConfig_shared_1.getRuntimeConfig)(config);
return {
...clientSharedValues,
...config,
runtime: "browser",
defaultsMode,
bodyLengthChecker: config?.bodyLengthChecker ?? util_body_length_browser_1.calculateBodyLength,
defaultUserAgentProvider: config?.defaultUserAgentProvider ??
(0, util_user_agent_browser_1.createDefaultUserAgentProvider)({ serviceId: clientSharedValues.serviceId, clientVersion: package_json_1.default.version }),
maxAttempts: config?.maxAttempts ?? util_retry_1.DEFAULT_MAX_ATTEMPTS,
region: config?.region ?? (0, invalid_dependency_1.invalidProvider)("Region is missing"),
requestHandler: fetch_http_handler_1.FetchHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
retryMode: config?.retryMode ?? (async () => (await defaultConfigProvider()).retryMode || util_retry_1.DEFAULT_RETRY_MODE),
sha256: config?.sha256 ?? sha256_browser_1.Sha256,
streamCollector: config?.streamCollector ?? fetch_http_handler_1.streamCollector,
useDualstackEndpoint: config?.useDualstackEndpoint ?? (() => Promise.resolve(config_resolver_1.DEFAULT_USE_DUALSTACK_ENDPOINT)),
useFipsEndpoint: config?.useFipsEndpoint ?? (() => Promise.resolve(config_resolver_1.DEFAULT_USE_FIPS_ENDPOINT)),
};
};
exports.getRuntimeConfig = getRuntimeConfig;
@@ -0,0 +1,54 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getRuntimeConfig = void 0;
const tslib_1 = require("tslib");
const package_json_1 = tslib_1.__importDefault(require("../../../package.json"));
const core_1 = require("@aws-sdk/core");
const util_user_agent_node_1 = require("@aws-sdk/util-user-agent-node");
const config_resolver_1 = require("@smithy/config-resolver");
const hash_node_1 = require("@smithy/hash-node");
const middleware_retry_1 = require("@smithy/middleware-retry");
const node_config_provider_1 = require("@smithy/node-config-provider");
const node_http_handler_1 = require("@smithy/node-http-handler");
const util_body_length_node_1 = require("@smithy/util-body-length-node");
const util_retry_1 = require("@smithy/util-retry");
const runtimeConfig_shared_1 = require("./runtimeConfig.shared");
const smithy_client_1 = require("@smithy/smithy-client");
const util_defaults_mode_node_1 = require("@smithy/util-defaults-mode-node");
const smithy_client_2 = require("@smithy/smithy-client");
const getRuntimeConfig = (config) => {
(0, smithy_client_2.emitWarningIfUnsupportedVersion)(process.version);
const defaultsMode = (0, util_defaults_mode_node_1.resolveDefaultsModeConfig)(config);
const defaultConfigProvider = () => defaultsMode().then(smithy_client_1.loadConfigsForDefaultMode);
const clientSharedValues = (0, runtimeConfig_shared_1.getRuntimeConfig)(config);
(0, core_1.emitWarningIfUnsupportedVersion)(process.version);
const loaderConfig = {
profile: config?.profile,
logger: clientSharedValues.logger,
};
return {
...clientSharedValues,
...config,
runtime: "node",
defaultsMode,
authSchemePreference: config?.authSchemePreference ?? (0, node_config_provider_1.loadConfig)(core_1.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
bodyLengthChecker: config?.bodyLengthChecker ?? util_body_length_node_1.calculateBodyLength,
defaultUserAgentProvider: config?.defaultUserAgentProvider ??
(0, util_user_agent_node_1.createDefaultUserAgentProvider)({ serviceId: clientSharedValues.serviceId, clientVersion: package_json_1.default.version }),
maxAttempts: config?.maxAttempts ?? (0, node_config_provider_1.loadConfig)(middleware_retry_1.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
region: config?.region ??
(0, node_config_provider_1.loadConfig)(config_resolver_1.NODE_REGION_CONFIG_OPTIONS, { ...config_resolver_1.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
requestHandler: node_http_handler_1.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
retryMode: config?.retryMode ??
(0, node_config_provider_1.loadConfig)({
...middleware_retry_1.NODE_RETRY_MODE_CONFIG_OPTIONS,
default: async () => (await defaultConfigProvider()).retryMode || util_retry_1.DEFAULT_RETRY_MODE,
}, config),
sha256: config?.sha256 ?? hash_node_1.Hash.bind(null, "sha256"),
streamCollector: config?.streamCollector ?? node_http_handler_1.streamCollector,
useDualstackEndpoint: config?.useDualstackEndpoint ?? (0, node_config_provider_1.loadConfig)(config_resolver_1.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
useFipsEndpoint: config?.useFipsEndpoint ?? (0, node_config_provider_1.loadConfig)(config_resolver_1.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
userAgentAppId: config?.userAgentAppId ?? (0, node_config_provider_1.loadConfig)(util_user_agent_node_1.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig),
};
};
exports.getRuntimeConfig = getRuntimeConfig;
@@ -0,0 +1,15 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getRuntimeConfig = void 0;
const sha256_js_1 = require("@aws-crypto/sha256-js");
const runtimeConfig_browser_1 = require("./runtimeConfig.browser");
const getRuntimeConfig = (config) => {
const browserDefaults = (0, runtimeConfig_browser_1.getRuntimeConfig)(config);
return {
...browserDefaults,
...config,
runtime: "react-native",
sha256: config?.sha256 ?? sha256_js_1.Sha256,
};
};
exports.getRuntimeConfig = getRuntimeConfig;
@@ -0,0 +1,40 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getRuntimeConfig = void 0;
const core_1 = require("@aws-sdk/core");
const core_2 = require("@smithy/core");
const smithy_client_1 = require("@smithy/smithy-client");
const url_parser_1 = require("@smithy/url-parser");
const util_base64_1 = require("@smithy/util-base64");
const util_utf8_1 = require("@smithy/util-utf8");
const httpAuthSchemeProvider_1 = require("./auth/httpAuthSchemeProvider");
const endpointResolver_1 = require("./endpoint/endpointResolver");
const getRuntimeConfig = (config) => {
return {
apiVersion: "2019-06-10",
base64Decoder: config?.base64Decoder ?? util_base64_1.fromBase64,
base64Encoder: config?.base64Encoder ?? util_base64_1.toBase64,
disableHostPrefix: config?.disableHostPrefix ?? false,
endpointProvider: config?.endpointProvider ?? endpointResolver_1.defaultEndpointResolver,
extensions: config?.extensions ?? [],
httpAuthSchemeProvider: config?.httpAuthSchemeProvider ?? httpAuthSchemeProvider_1.defaultSSOOIDCHttpAuthSchemeProvider,
httpAuthSchemes: config?.httpAuthSchemes ?? [
{
schemeId: "aws.auth#sigv4",
identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4"),
signer: new core_1.AwsSdkSigV4Signer(),
},
{
schemeId: "smithy.api#noAuth",
identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
signer: new core_2.NoAuthSigner(),
},
],
logger: config?.logger ?? new smithy_client_1.NoOpLogger(),
serviceId: config?.serviceId ?? "SSO OIDC",
urlParser: config?.urlParser ?? url_parser_1.parseUrl,
utf8Decoder: config?.utf8Decoder ?? util_utf8_1.fromUtf8,
utf8Encoder: config?.utf8Encoder ?? util_utf8_1.toUtf8,
};
};
exports.getRuntimeConfig = getRuntimeConfig;
@@ -0,0 +1,52 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.STSClient = exports.__Client = void 0;
const middleware_host_header_1 = require("@aws-sdk/middleware-host-header");
const middleware_logger_1 = require("@aws-sdk/middleware-logger");
const middleware_recursion_detection_1 = require("@aws-sdk/middleware-recursion-detection");
const middleware_user_agent_1 = require("@aws-sdk/middleware-user-agent");
const config_resolver_1 = require("@smithy/config-resolver");
const core_1 = require("@smithy/core");
const middleware_content_length_1 = require("@smithy/middleware-content-length");
const middleware_endpoint_1 = require("@smithy/middleware-endpoint");
const middleware_retry_1 = require("@smithy/middleware-retry");
const smithy_client_1 = require("@smithy/smithy-client");
Object.defineProperty(exports, "__Client", { enumerable: true, get: function () { return smithy_client_1.Client; } });
const httpAuthSchemeProvider_1 = require("./auth/httpAuthSchemeProvider");
const EndpointParameters_1 = require("./endpoint/EndpointParameters");
const runtimeConfig_1 = require("./runtimeConfig");
const runtimeExtensions_1 = require("./runtimeExtensions");
class STSClient extends smithy_client_1.Client {
config;
constructor(...[configuration]) {
const _config_0 = (0, runtimeConfig_1.getRuntimeConfig)(configuration || {});
super(_config_0);
this.initConfig = _config_0;
const _config_1 = (0, EndpointParameters_1.resolveClientEndpointParameters)(_config_0);
const _config_2 = (0, middleware_user_agent_1.resolveUserAgentConfig)(_config_1);
const _config_3 = (0, middleware_retry_1.resolveRetryConfig)(_config_2);
const _config_4 = (0, config_resolver_1.resolveRegionConfig)(_config_3);
const _config_5 = (0, middleware_host_header_1.resolveHostHeaderConfig)(_config_4);
const _config_6 = (0, middleware_endpoint_1.resolveEndpointConfig)(_config_5);
const _config_7 = (0, httpAuthSchemeProvider_1.resolveHttpAuthSchemeConfig)(_config_6);
const _config_8 = (0, runtimeExtensions_1.resolveRuntimeExtensions)(_config_7, configuration?.extensions || []);
this.config = _config_8;
this.middlewareStack.use((0, middleware_user_agent_1.getUserAgentPlugin)(this.config));
this.middlewareStack.use((0, middleware_retry_1.getRetryPlugin)(this.config));
this.middlewareStack.use((0, middleware_content_length_1.getContentLengthPlugin)(this.config));
this.middlewareStack.use((0, middleware_host_header_1.getHostHeaderPlugin)(this.config));
this.middlewareStack.use((0, middleware_logger_1.getLoggerPlugin)(this.config));
this.middlewareStack.use((0, middleware_recursion_detection_1.getRecursionDetectionPlugin)(this.config));
this.middlewareStack.use((0, core_1.getHttpAuthSchemeEndpointRuleSetPlugin)(this.config, {
httpAuthSchemeParametersProvider: httpAuthSchemeProvider_1.defaultSTSHttpAuthSchemeParametersProvider,
identityProviderConfigProvider: async (config) => new core_1.DefaultIdentityProviderConfig({
"aws.auth#sigv4": config.credentials,
}),
}));
this.middlewareStack.use((0, core_1.getHttpSigningPlugin)(this.config));
}
destroy() {
super.destroy();
}
}
exports.STSClient = STSClient;
@@ -0,0 +1,43 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.resolveHttpAuthRuntimeConfig = exports.getHttpAuthExtensionConfiguration = void 0;
const getHttpAuthExtensionConfiguration = (runtimeConfig) => {
const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
let _credentials = runtimeConfig.credentials;
return {
setHttpAuthScheme(httpAuthScheme) {
const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);
if (index === -1) {
_httpAuthSchemes.push(httpAuthScheme);
}
else {
_httpAuthSchemes.splice(index, 1, httpAuthScheme);
}
},
httpAuthSchemes() {
return _httpAuthSchemes;
},
setHttpAuthSchemeProvider(httpAuthSchemeProvider) {
_httpAuthSchemeProvider = httpAuthSchemeProvider;
},
httpAuthSchemeProvider() {
return _httpAuthSchemeProvider;
},
setCredentials(credentials) {
_credentials = credentials;
},
credentials() {
return _credentials;
},
};
};
exports.getHttpAuthExtensionConfiguration = getHttpAuthExtensionConfiguration;
const resolveHttpAuthRuntimeConfig = (config) => {
return {
httpAuthSchemes: config.httpAuthSchemes(),
httpAuthSchemeProvider: config.httpAuthSchemeProvider(),
credentials: config.credentials(),
};
};
exports.resolveHttpAuthRuntimeConfig = resolveHttpAuthRuntimeConfig;
@@ -0,0 +1,62 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.resolveHttpAuthSchemeConfig = exports.resolveStsAuthConfig = exports.defaultSTSHttpAuthSchemeProvider = exports.defaultSTSHttpAuthSchemeParametersProvider = void 0;
const core_1 = require("@aws-sdk/core");
const util_middleware_1 = require("@smithy/util-middleware");
const STSClient_1 = require("../STSClient");
const defaultSTSHttpAuthSchemeParametersProvider = async (config, context, input) => {
return {
operation: (0, util_middleware_1.getSmithyContext)(context).operation,
region: (await (0, util_middleware_1.normalizeProvider)(config.region)()) ||
(() => {
throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
})(),
};
};
exports.defaultSTSHttpAuthSchemeParametersProvider = defaultSTSHttpAuthSchemeParametersProvider;
function createAwsAuthSigv4HttpAuthOption(authParameters) {
return {
schemeId: "aws.auth#sigv4",
signingProperties: {
name: "sts",
region: authParameters.region,
},
propertiesExtractor: (config, context) => ({
signingProperties: {
config,
context,
},
}),
};
}
function createSmithyApiNoAuthHttpAuthOption(authParameters) {
return {
schemeId: "smithy.api#noAuth",
};
}
const defaultSTSHttpAuthSchemeProvider = (authParameters) => {
const options = [];
switch (authParameters.operation) {
case "AssumeRoleWithWebIdentity": {
options.push(createSmithyApiNoAuthHttpAuthOption(authParameters));
break;
}
default: {
options.push(createAwsAuthSigv4HttpAuthOption(authParameters));
}
}
return options;
};
exports.defaultSTSHttpAuthSchemeProvider = defaultSTSHttpAuthSchemeProvider;
const resolveStsAuthConfig = (input) => Object.assign(input, {
stsClientCtor: STSClient_1.STSClient,
});
exports.resolveStsAuthConfig = resolveStsAuthConfig;
const resolveHttpAuthSchemeConfig = (config) => {
const config_0 = (0, exports.resolveStsAuthConfig)(config);
const config_1 = (0, core_1.resolveAwsSdkSigV4Config)(config_0);
return Object.assign(config_1, {
authSchemePreference: (0, util_middleware_1.normalizeProvider)(config.authSchemePreference ?? []),
});
};
exports.resolveHttpAuthSchemeConfig = resolveHttpAuthSchemeConfig;
@@ -0,0 +1,19 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.commonParams = exports.resolveClientEndpointParameters = void 0;
const resolveClientEndpointParameters = (options) => {
return Object.assign(options, {
useDualstackEndpoint: options.useDualstackEndpoint ?? false,
useFipsEndpoint: options.useFipsEndpoint ?? false,
useGlobalEndpoint: options.useGlobalEndpoint ?? false,
defaultSigningName: "sts",
});
};
exports.resolveClientEndpointParameters = resolveClientEndpointParameters;
exports.commonParams = {
UseGlobalEndpoint: { type: "builtInParams", name: "useGlobalEndpoint" },
UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
Endpoint: { type: "builtInParams", name: "endpoint" },
Region: { type: "builtInParams", name: "region" },
UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
};
@@ -0,0 +1,18 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.defaultEndpointResolver = void 0;
const util_endpoints_1 = require("@aws-sdk/util-endpoints");
const util_endpoints_2 = require("@smithy/util-endpoints");
const ruleset_1 = require("./ruleset");
const cache = new util_endpoints_2.EndpointCache({
size: 50,
params: ["Endpoint", "Region", "UseDualStack", "UseFIPS", "UseGlobalEndpoint"],
});
const defaultEndpointResolver = (endpointParams, context = {}) => {
return cache.get(endpointParams, () => (0, util_endpoints_2.resolveEndpoint)(ruleset_1.ruleSet, {
endpointParams: endpointParams,
logger: context.logger,
}));
};
exports.defaultEndpointResolver = defaultEndpointResolver;
util_endpoints_2.customEndpointFunctions.aws = util_endpoints_1.awsEndpointFunctions;
@@ -0,0 +1,7 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.ruleSet = void 0;
const F = "required", G = "type", H = "fn", I = "argv", J = "ref";
const a = false, b = true, c = "booleanEquals", d = "stringEquals", e = "sigv4", f = "sts", g = "us-east-1", h = "endpoint", i = "https://sts.{Region}.{PartitionResult#dnsSuffix}", j = "tree", k = "error", l = "getAttr", m = { [F]: false, [G]: "String" }, n = { [F]: true, "default": false, [G]: "Boolean" }, o = { [J]: "Endpoint" }, p = { [H]: "isSet", [I]: [{ [J]: "Region" }] }, q = { [J]: "Region" }, r = { [H]: "aws.partition", [I]: [q], "assign": "PartitionResult" }, s = { [J]: "UseFIPS" }, t = { [J]: "UseDualStack" }, u = { "url": "https://sts.amazonaws.com", "properties": { "authSchemes": [{ "name": e, "signingName": f, "signingRegion": g }] }, "headers": {} }, v = {}, w = { "conditions": [{ [H]: d, [I]: [q, "aws-global"] }], [h]: u, [G]: h }, x = { [H]: c, [I]: [s, true] }, y = { [H]: c, [I]: [t, true] }, z = { [H]: l, [I]: [{ [J]: "PartitionResult" }, "supportsFIPS"] }, A = { [J]: "PartitionResult" }, B = { [H]: c, [I]: [true, { [H]: l, [I]: [A, "supportsDualStack"] }] }, C = [{ [H]: "isSet", [I]: [o] }], D = [x], E = [y];
const _data = { version: "1.0", parameters: { Region: m, UseDualStack: n, UseFIPS: n, Endpoint: m, UseGlobalEndpoint: n }, rules: [{ conditions: [{ [H]: c, [I]: [{ [J]: "UseGlobalEndpoint" }, b] }, { [H]: "not", [I]: C }, p, r, { [H]: c, [I]: [s, a] }, { [H]: c, [I]: [t, a] }], rules: [{ conditions: [{ [H]: d, [I]: [q, "ap-northeast-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "ap-south-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "ap-southeast-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "ap-southeast-2"] }], endpoint: u, [G]: h }, w, { conditions: [{ [H]: d, [I]: [q, "ca-central-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-central-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-north-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-west-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-west-2"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-west-3"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "sa-east-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, g] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "us-east-2"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "us-west-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "us-west-2"] }], endpoint: u, [G]: h }, { endpoint: { url: i, properties: { authSchemes: [{ name: e, signingName: f, signingRegion: "{Region}" }] }, headers: v }, [G]: h }], [G]: j }, { conditions: C, rules: [{ conditions: D, error: "Invalid Configuration: FIPS and custom endpoint are not supported", [G]: k }, { conditions: E, error: "Invalid Configuration: Dualstack and custom endpoint are not supported", [G]: k }, { endpoint: { url: o, properties: v, headers: v }, [G]: h }], [G]: j }, { conditions: [p], rules: [{ conditions: [r], rules: [{ conditions: [x, y], rules: [{ conditions: [{ [H]: c, [I]: [b, z] }, B], rules: [{ endpoint: { url: "https://sts-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", properties: v, headers: v }, [G]: h }], [G]: j }, { error: "FIPS and DualStack are enabled, but this partition does not support one or both", [G]: k }], [G]: j }, { conditions: D, rules: [{ conditions: [{ [H]: c, [I]: [z, b] }], rules: [{ conditions: [{ [H]: d, [I]: [{ [H]: l, [I]: [A, "name"] }, "aws-us-gov"] }], endpoint: { url: "https://sts.{Region}.amazonaws.com", properties: v, headers: v }, [G]: h }, { endpoint: { url: "https://sts-fips.{Region}.{PartitionResult#dnsSuffix}", properties: v, headers: v }, [G]: h }], [G]: j }, { error: "FIPS is enabled but this partition does not support FIPS", [G]: k }], [G]: j }, { conditions: E, rules: [{ conditions: [B], rules: [{ endpoint: { url: "https://sts.{Region}.{PartitionResult#dualStackDnsSuffix}", properties: v, headers: v }, [G]: h }], [G]: j }, { error: "DualStack is enabled but this partition does not support DualStack", [G]: k }], [G]: j }, w, { endpoint: { url: i, properties: v, headers: v }, [G]: h }], [G]: j }], [G]: j }, { error: "Invalid Configuration: Missing Region", [G]: k }] };
exports.ruleSet = _data;
@@ -0,0 +1,951 @@
"use strict";
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
var __export = (target, all) => {
for (var name in all)
__defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
if (from && typeof from === "object" || typeof from === "function") {
for (let key of __getOwnPropNames(from))
if (!__hasOwnProp.call(to, key) && key !== except)
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
}
return to;
};
var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
// src/submodules/sts/index.ts
var index_exports = {};
__export(index_exports, {
AssumeRoleCommand: () => AssumeRoleCommand,
AssumeRoleResponseFilterSensitiveLog: () => AssumeRoleResponseFilterSensitiveLog,
AssumeRoleWithWebIdentityCommand: () => AssumeRoleWithWebIdentityCommand,
AssumeRoleWithWebIdentityRequestFilterSensitiveLog: () => AssumeRoleWithWebIdentityRequestFilterSensitiveLog,
AssumeRoleWithWebIdentityResponseFilterSensitiveLog: () => AssumeRoleWithWebIdentityResponseFilterSensitiveLog,
ClientInputEndpointParameters: () => import_EndpointParameters3.ClientInputEndpointParameters,
CredentialsFilterSensitiveLog: () => CredentialsFilterSensitiveLog,
ExpiredTokenException: () => ExpiredTokenException,
IDPCommunicationErrorException: () => IDPCommunicationErrorException,
IDPRejectedClaimException: () => IDPRejectedClaimException,
InvalidIdentityTokenException: () => InvalidIdentityTokenException,
MalformedPolicyDocumentException: () => MalformedPolicyDocumentException,
PackedPolicyTooLargeException: () => PackedPolicyTooLargeException,
RegionDisabledException: () => RegionDisabledException,
STS: () => STS,
STSServiceException: () => STSServiceException,
decorateDefaultCredentialProvider: () => decorateDefaultCredentialProvider,
getDefaultRoleAssumer: () => getDefaultRoleAssumer2,
getDefaultRoleAssumerWithWebIdentity: () => getDefaultRoleAssumerWithWebIdentity2
});
module.exports = __toCommonJS(index_exports);
__reExport(index_exports, require("./STSClient"), module.exports);
// src/submodules/sts/STS.ts
var import_smithy_client6 = require("@smithy/smithy-client");
// src/submodules/sts/commands/AssumeRoleCommand.ts
var import_middleware_endpoint = require("@smithy/middleware-endpoint");
var import_middleware_serde = require("@smithy/middleware-serde");
var import_smithy_client4 = require("@smithy/smithy-client");
var import_EndpointParameters = require("./endpoint/EndpointParameters");
// src/submodules/sts/models/models_0.ts
var import_smithy_client2 = require("@smithy/smithy-client");
// src/submodules/sts/models/STSServiceException.ts
var import_smithy_client = require("@smithy/smithy-client");
var STSServiceException = class _STSServiceException extends import_smithy_client.ServiceException {
static {
__name(this, "STSServiceException");
}
/**
* @internal
*/
constructor(options) {
super(options);
Object.setPrototypeOf(this, _STSServiceException.prototype);
}
};
// src/submodules/sts/models/models_0.ts
var CredentialsFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
...obj,
...obj.SecretAccessKey && { SecretAccessKey: import_smithy_client2.SENSITIVE_STRING }
}), "CredentialsFilterSensitiveLog");
var AssumeRoleResponseFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
...obj,
...obj.Credentials && { Credentials: CredentialsFilterSensitiveLog(obj.Credentials) }
}), "AssumeRoleResponseFilterSensitiveLog");
var ExpiredTokenException = class _ExpiredTokenException extends STSServiceException {
static {
__name(this, "ExpiredTokenException");
}
name = "ExpiredTokenException";
$fault = "client";
/**
* @internal
*/
constructor(opts) {
super({
name: "ExpiredTokenException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _ExpiredTokenException.prototype);
}
};
var MalformedPolicyDocumentException = class _MalformedPolicyDocumentException extends STSServiceException {
static {
__name(this, "MalformedPolicyDocumentException");
}
name = "MalformedPolicyDocumentException";
$fault = "client";
/**
* @internal
*/
constructor(opts) {
super({
name: "MalformedPolicyDocumentException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _MalformedPolicyDocumentException.prototype);
}
};
var PackedPolicyTooLargeException = class _PackedPolicyTooLargeException extends STSServiceException {
static {
__name(this, "PackedPolicyTooLargeException");
}
name = "PackedPolicyTooLargeException";
$fault = "client";
/**
* @internal
*/
constructor(opts) {
super({
name: "PackedPolicyTooLargeException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _PackedPolicyTooLargeException.prototype);
}
};
var RegionDisabledException = class _RegionDisabledException extends STSServiceException {
static {
__name(this, "RegionDisabledException");
}
name = "RegionDisabledException";
$fault = "client";
/**
* @internal
*/
constructor(opts) {
super({
name: "RegionDisabledException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _RegionDisabledException.prototype);
}
};
var IDPRejectedClaimException = class _IDPRejectedClaimException extends STSServiceException {
static {
__name(this, "IDPRejectedClaimException");
}
name = "IDPRejectedClaimException";
$fault = "client";
/**
* @internal
*/
constructor(opts) {
super({
name: "IDPRejectedClaimException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _IDPRejectedClaimException.prototype);
}
};
var InvalidIdentityTokenException = class _InvalidIdentityTokenException extends STSServiceException {
static {
__name(this, "InvalidIdentityTokenException");
}
name = "InvalidIdentityTokenException";
$fault = "client";
/**
* @internal
*/
constructor(opts) {
super({
name: "InvalidIdentityTokenException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _InvalidIdentityTokenException.prototype);
}
};
var AssumeRoleWithWebIdentityRequestFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
...obj,
...obj.WebIdentityToken && { WebIdentityToken: import_smithy_client2.SENSITIVE_STRING }
}), "AssumeRoleWithWebIdentityRequestFilterSensitiveLog");
var AssumeRoleWithWebIdentityResponseFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
...obj,
...obj.Credentials && { Credentials: CredentialsFilterSensitiveLog(obj.Credentials) }
}), "AssumeRoleWithWebIdentityResponseFilterSensitiveLog");
var IDPCommunicationErrorException = class _IDPCommunicationErrorException extends STSServiceException {
static {
__name(this, "IDPCommunicationErrorException");
}
name = "IDPCommunicationErrorException";
$fault = "client";
/**
* @internal
*/
constructor(opts) {
super({
name: "IDPCommunicationErrorException",
$fault: "client",
...opts
});
Object.setPrototypeOf(this, _IDPCommunicationErrorException.prototype);
}
};
// src/submodules/sts/protocols/Aws_query.ts
var import_core = require("@aws-sdk/core");
var import_protocol_http = require("@smithy/protocol-http");
var import_smithy_client3 = require("@smithy/smithy-client");
var se_AssumeRoleCommand = /* @__PURE__ */ __name(async (input, context) => {
const headers = SHARED_HEADERS;
let body;
body = buildFormUrlencodedString({
...se_AssumeRoleRequest(input, context),
[_A]: _AR,
[_V]: _
});
return buildHttpRpcRequest(context, headers, "/", void 0, body);
}, "se_AssumeRoleCommand");
var se_AssumeRoleWithWebIdentityCommand = /* @__PURE__ */ __name(async (input, context) => {
const headers = SHARED_HEADERS;
let body;
body = buildFormUrlencodedString({
...se_AssumeRoleWithWebIdentityRequest(input, context),
[_A]: _ARWWI,
[_V]: _
});
return buildHttpRpcRequest(context, headers, "/", void 0, body);
}, "se_AssumeRoleWithWebIdentityCommand");
var de_AssumeRoleCommand = /* @__PURE__ */ __name(async (output, context) => {
if (output.statusCode >= 300) {
return de_CommandError(output, context);
}
const data = await (0, import_core.parseXmlBody)(output.body, context);
let contents = {};
contents = de_AssumeRoleResponse(data.AssumeRoleResult, context);
const response = {
$metadata: deserializeMetadata(output),
...contents
};
return response;
}, "de_AssumeRoleCommand");
var de_AssumeRoleWithWebIdentityCommand = /* @__PURE__ */ __name(async (output, context) => {
if (output.statusCode >= 300) {
return de_CommandError(output, context);
}
const data = await (0, import_core.parseXmlBody)(output.body, context);
let contents = {};
contents = de_AssumeRoleWithWebIdentityResponse(data.AssumeRoleWithWebIdentityResult, context);
const response = {
$metadata: deserializeMetadata(output),
...contents
};
return response;
}, "de_AssumeRoleWithWebIdentityCommand");
var de_CommandError = /* @__PURE__ */ __name(async (output, context) => {
const parsedOutput = {
...output,
body: await (0, import_core.parseXmlErrorBody)(output.body, context)
};
const errorCode = loadQueryErrorCode(output, parsedOutput.body);
switch (errorCode) {
case "ExpiredTokenException":
case "com.amazonaws.sts#ExpiredTokenException":
throw await de_ExpiredTokenExceptionRes(parsedOutput, context);
case "MalformedPolicyDocument":
case "com.amazonaws.sts#MalformedPolicyDocumentException":
throw await de_MalformedPolicyDocumentExceptionRes(parsedOutput, context);
case "PackedPolicyTooLarge":
case "com.amazonaws.sts#PackedPolicyTooLargeException":
throw await de_PackedPolicyTooLargeExceptionRes(parsedOutput, context);
case "RegionDisabledException":
case "com.amazonaws.sts#RegionDisabledException":
throw await de_RegionDisabledExceptionRes(parsedOutput, context);
case "IDPCommunicationError":
case "com.amazonaws.sts#IDPCommunicationErrorException":
throw await de_IDPCommunicationErrorExceptionRes(parsedOutput, context);
case "IDPRejectedClaim":
case "com.amazonaws.sts#IDPRejectedClaimException":
throw await de_IDPRejectedClaimExceptionRes(parsedOutput, context);
case "InvalidIdentityToken":
case "com.amazonaws.sts#InvalidIdentityTokenException":
throw await de_InvalidIdentityTokenExceptionRes(parsedOutput, context);
default:
const parsedBody = parsedOutput.body;
return throwDefaultError({
output,
parsedBody: parsedBody.Error,
errorCode
});
}
}, "de_CommandError");
var de_ExpiredTokenExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_ExpiredTokenException(body.Error, context);
const exception = new ExpiredTokenException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized
});
return (0, import_smithy_client3.decorateServiceException)(exception, body);
}, "de_ExpiredTokenExceptionRes");
var de_IDPCommunicationErrorExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_IDPCommunicationErrorException(body.Error, context);
const exception = new IDPCommunicationErrorException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized
});
return (0, import_smithy_client3.decorateServiceException)(exception, body);
}, "de_IDPCommunicationErrorExceptionRes");
var de_IDPRejectedClaimExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_IDPRejectedClaimException(body.Error, context);
const exception = new IDPRejectedClaimException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized
});
return (0, import_smithy_client3.decorateServiceException)(exception, body);
}, "de_IDPRejectedClaimExceptionRes");
var de_InvalidIdentityTokenExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_InvalidIdentityTokenException(body.Error, context);
const exception = new InvalidIdentityTokenException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized
});
return (0, import_smithy_client3.decorateServiceException)(exception, body);
}, "de_InvalidIdentityTokenExceptionRes");
var de_MalformedPolicyDocumentExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_MalformedPolicyDocumentException(body.Error, context);
const exception = new MalformedPolicyDocumentException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized
});
return (0, import_smithy_client3.decorateServiceException)(exception, body);
}, "de_MalformedPolicyDocumentExceptionRes");
var de_PackedPolicyTooLargeExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_PackedPolicyTooLargeException(body.Error, context);
const exception = new PackedPolicyTooLargeException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized
});
return (0, import_smithy_client3.decorateServiceException)(exception, body);
}, "de_PackedPolicyTooLargeExceptionRes");
var de_RegionDisabledExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_RegionDisabledException(body.Error, context);
const exception = new RegionDisabledException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized
});
return (0, import_smithy_client3.decorateServiceException)(exception, body);
}, "de_RegionDisabledExceptionRes");
var se_AssumeRoleRequest = /* @__PURE__ */ __name((input, context) => {
const entries = {};
if (input[_RA] != null) {
entries[_RA] = input[_RA];
}
if (input[_RSN] != null) {
entries[_RSN] = input[_RSN];
}
if (input[_PA] != null) {
const memberEntries = se_policyDescriptorListType(input[_PA], context);
if (input[_PA]?.length === 0) {
entries.PolicyArns = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `PolicyArns.${key}`;
entries[loc] = value;
});
}
if (input[_P] != null) {
entries[_P] = input[_P];
}
if (input[_DS] != null) {
entries[_DS] = input[_DS];
}
if (input[_T] != null) {
const memberEntries = se_tagListType(input[_T], context);
if (input[_T]?.length === 0) {
entries.Tags = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `Tags.${key}`;
entries[loc] = value;
});
}
if (input[_TTK] != null) {
const memberEntries = se_tagKeyListType(input[_TTK], context);
if (input[_TTK]?.length === 0) {
entries.TransitiveTagKeys = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `TransitiveTagKeys.${key}`;
entries[loc] = value;
});
}
if (input[_EI] != null) {
entries[_EI] = input[_EI];
}
if (input[_SN] != null) {
entries[_SN] = input[_SN];
}
if (input[_TC] != null) {
entries[_TC] = input[_TC];
}
if (input[_SI] != null) {
entries[_SI] = input[_SI];
}
if (input[_PC] != null) {
const memberEntries = se_ProvidedContextsListType(input[_PC], context);
if (input[_PC]?.length === 0) {
entries.ProvidedContexts = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `ProvidedContexts.${key}`;
entries[loc] = value;
});
}
return entries;
}, "se_AssumeRoleRequest");
var se_AssumeRoleWithWebIdentityRequest = /* @__PURE__ */ __name((input, context) => {
const entries = {};
if (input[_RA] != null) {
entries[_RA] = input[_RA];
}
if (input[_RSN] != null) {
entries[_RSN] = input[_RSN];
}
if (input[_WIT] != null) {
entries[_WIT] = input[_WIT];
}
if (input[_PI] != null) {
entries[_PI] = input[_PI];
}
if (input[_PA] != null) {
const memberEntries = se_policyDescriptorListType(input[_PA], context);
if (input[_PA]?.length === 0) {
entries.PolicyArns = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `PolicyArns.${key}`;
entries[loc] = value;
});
}
if (input[_P] != null) {
entries[_P] = input[_P];
}
if (input[_DS] != null) {
entries[_DS] = input[_DS];
}
return entries;
}, "se_AssumeRoleWithWebIdentityRequest");
var se_policyDescriptorListType = /* @__PURE__ */ __name((input, context) => {
const entries = {};
let counter = 1;
for (const entry of input) {
if (entry === null) {
continue;
}
const memberEntries = se_PolicyDescriptorType(entry, context);
Object.entries(memberEntries).forEach(([key, value]) => {
entries[`member.${counter}.${key}`] = value;
});
counter++;
}
return entries;
}, "se_policyDescriptorListType");
var se_PolicyDescriptorType = /* @__PURE__ */ __name((input, context) => {
const entries = {};
if (input[_a] != null) {
entries[_a] = input[_a];
}
return entries;
}, "se_PolicyDescriptorType");
var se_ProvidedContext = /* @__PURE__ */ __name((input, context) => {
const entries = {};
if (input[_PAr] != null) {
entries[_PAr] = input[_PAr];
}
if (input[_CA] != null) {
entries[_CA] = input[_CA];
}
return entries;
}, "se_ProvidedContext");
var se_ProvidedContextsListType = /* @__PURE__ */ __name((input, context) => {
const entries = {};
let counter = 1;
for (const entry of input) {
if (entry === null) {
continue;
}
const memberEntries = se_ProvidedContext(entry, context);
Object.entries(memberEntries).forEach(([key, value]) => {
entries[`member.${counter}.${key}`] = value;
});
counter++;
}
return entries;
}, "se_ProvidedContextsListType");
var se_Tag = /* @__PURE__ */ __name((input, context) => {
const entries = {};
if (input[_K] != null) {
entries[_K] = input[_K];
}
if (input[_Va] != null) {
entries[_Va] = input[_Va];
}
return entries;
}, "se_Tag");
var se_tagKeyListType = /* @__PURE__ */ __name((input, context) => {
const entries = {};
let counter = 1;
for (const entry of input) {
if (entry === null) {
continue;
}
entries[`member.${counter}`] = entry;
counter++;
}
return entries;
}, "se_tagKeyListType");
var se_tagListType = /* @__PURE__ */ __name((input, context) => {
const entries = {};
let counter = 1;
for (const entry of input) {
if (entry === null) {
continue;
}
const memberEntries = se_Tag(entry, context);
Object.entries(memberEntries).forEach(([key, value]) => {
entries[`member.${counter}.${key}`] = value;
});
counter++;
}
return entries;
}, "se_tagListType");
var de_AssumedRoleUser = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_ARI] != null) {
contents[_ARI] = (0, import_smithy_client3.expectString)(output[_ARI]);
}
if (output[_Ar] != null) {
contents[_Ar] = (0, import_smithy_client3.expectString)(output[_Ar]);
}
return contents;
}, "de_AssumedRoleUser");
var de_AssumeRoleResponse = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_C] != null) {
contents[_C] = de_Credentials(output[_C], context);
}
if (output[_ARU] != null) {
contents[_ARU] = de_AssumedRoleUser(output[_ARU], context);
}
if (output[_PPS] != null) {
contents[_PPS] = (0, import_smithy_client3.strictParseInt32)(output[_PPS]);
}
if (output[_SI] != null) {
contents[_SI] = (0, import_smithy_client3.expectString)(output[_SI]);
}
return contents;
}, "de_AssumeRoleResponse");
var de_AssumeRoleWithWebIdentityResponse = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_C] != null) {
contents[_C] = de_Credentials(output[_C], context);
}
if (output[_SFWIT] != null) {
contents[_SFWIT] = (0, import_smithy_client3.expectString)(output[_SFWIT]);
}
if (output[_ARU] != null) {
contents[_ARU] = de_AssumedRoleUser(output[_ARU], context);
}
if (output[_PPS] != null) {
contents[_PPS] = (0, import_smithy_client3.strictParseInt32)(output[_PPS]);
}
if (output[_Pr] != null) {
contents[_Pr] = (0, import_smithy_client3.expectString)(output[_Pr]);
}
if (output[_Au] != null) {
contents[_Au] = (0, import_smithy_client3.expectString)(output[_Au]);
}
if (output[_SI] != null) {
contents[_SI] = (0, import_smithy_client3.expectString)(output[_SI]);
}
return contents;
}, "de_AssumeRoleWithWebIdentityResponse");
var de_Credentials = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_AKI] != null) {
contents[_AKI] = (0, import_smithy_client3.expectString)(output[_AKI]);
}
if (output[_SAK] != null) {
contents[_SAK] = (0, import_smithy_client3.expectString)(output[_SAK]);
}
if (output[_ST] != null) {
contents[_ST] = (0, import_smithy_client3.expectString)(output[_ST]);
}
if (output[_E] != null) {
contents[_E] = (0, import_smithy_client3.expectNonNull)((0, import_smithy_client3.parseRfc3339DateTimeWithOffset)(output[_E]));
}
return contents;
}, "de_Credentials");
var de_ExpiredTokenException = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = (0, import_smithy_client3.expectString)(output[_m]);
}
return contents;
}, "de_ExpiredTokenException");
var de_IDPCommunicationErrorException = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = (0, import_smithy_client3.expectString)(output[_m]);
}
return contents;
}, "de_IDPCommunicationErrorException");
var de_IDPRejectedClaimException = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = (0, import_smithy_client3.expectString)(output[_m]);
}
return contents;
}, "de_IDPRejectedClaimException");
var de_InvalidIdentityTokenException = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = (0, import_smithy_client3.expectString)(output[_m]);
}
return contents;
}, "de_InvalidIdentityTokenException");
var de_MalformedPolicyDocumentException = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = (0, import_smithy_client3.expectString)(output[_m]);
}
return contents;
}, "de_MalformedPolicyDocumentException");
var de_PackedPolicyTooLargeException = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = (0, import_smithy_client3.expectString)(output[_m]);
}
return contents;
}, "de_PackedPolicyTooLargeException");
var de_RegionDisabledException = /* @__PURE__ */ __name((output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = (0, import_smithy_client3.expectString)(output[_m]);
}
return contents;
}, "de_RegionDisabledException");
var deserializeMetadata = /* @__PURE__ */ __name((output) => ({
httpStatusCode: output.statusCode,
requestId: output.headers["x-amzn-requestid"] ?? output.headers["x-amzn-request-id"] ?? output.headers["x-amz-request-id"],
extendedRequestId: output.headers["x-amz-id-2"],
cfId: output.headers["x-amz-cf-id"]
}), "deserializeMetadata");
var throwDefaultError = (0, import_smithy_client3.withBaseException)(STSServiceException);
var buildHttpRpcRequest = /* @__PURE__ */ __name(async (context, headers, path, resolvedHostname, body) => {
const { hostname, protocol = "https", port, path: basePath } = await context.endpoint();
const contents = {
protocol,
hostname,
port,
method: "POST",
path: basePath.endsWith("/") ? basePath.slice(0, -1) + path : basePath + path,
headers
};
if (resolvedHostname !== void 0) {
contents.hostname = resolvedHostname;
}
if (body !== void 0) {
contents.body = body;
}
return new import_protocol_http.HttpRequest(contents);
}, "buildHttpRpcRequest");
var SHARED_HEADERS = {
"content-type": "application/x-www-form-urlencoded"
};
var _ = "2011-06-15";
var _A = "Action";
var _AKI = "AccessKeyId";
var _AR = "AssumeRole";
var _ARI = "AssumedRoleId";
var _ARU = "AssumedRoleUser";
var _ARWWI = "AssumeRoleWithWebIdentity";
var _Ar = "Arn";
var _Au = "Audience";
var _C = "Credentials";
var _CA = "ContextAssertion";
var _DS = "DurationSeconds";
var _E = "Expiration";
var _EI = "ExternalId";
var _K = "Key";
var _P = "Policy";
var _PA = "PolicyArns";
var _PAr = "ProviderArn";
var _PC = "ProvidedContexts";
var _PI = "ProviderId";
var _PPS = "PackedPolicySize";
var _Pr = "Provider";
var _RA = "RoleArn";
var _RSN = "RoleSessionName";
var _SAK = "SecretAccessKey";
var _SFWIT = "SubjectFromWebIdentityToken";
var _SI = "SourceIdentity";
var _SN = "SerialNumber";
var _ST = "SessionToken";
var _T = "Tags";
var _TC = "TokenCode";
var _TTK = "TransitiveTagKeys";
var _V = "Version";
var _Va = "Value";
var _WIT = "WebIdentityToken";
var _a = "arn";
var _m = "message";
var buildFormUrlencodedString = /* @__PURE__ */ __name((formEntries) => Object.entries(formEntries).map(([key, value]) => (0, import_smithy_client3.extendedEncodeURIComponent)(key) + "=" + (0, import_smithy_client3.extendedEncodeURIComponent)(value)).join("&"), "buildFormUrlencodedString");
var loadQueryErrorCode = /* @__PURE__ */ __name((output, data) => {
if (data.Error?.Code !== void 0) {
return data.Error.Code;
}
if (output.statusCode == 404) {
return "NotFound";
}
}, "loadQueryErrorCode");
// src/submodules/sts/commands/AssumeRoleCommand.ts
var AssumeRoleCommand = class extends import_smithy_client4.Command.classBuilder().ep(import_EndpointParameters.commonParams).m(function(Command, cs, config, o) {
return [
(0, import_middleware_serde.getSerdePlugin)(config, this.serialize, this.deserialize),
(0, import_middleware_endpoint.getEndpointPlugin)(config, Command.getEndpointParameterInstructions())
];
}).s("AWSSecurityTokenServiceV20110615", "AssumeRole", {}).n("STSClient", "AssumeRoleCommand").f(void 0, AssumeRoleResponseFilterSensitiveLog).ser(se_AssumeRoleCommand).de(de_AssumeRoleCommand).build() {
static {
__name(this, "AssumeRoleCommand");
}
};
// src/submodules/sts/commands/AssumeRoleWithWebIdentityCommand.ts
var import_middleware_endpoint2 = require("@smithy/middleware-endpoint");
var import_middleware_serde2 = require("@smithy/middleware-serde");
var import_smithy_client5 = require("@smithy/smithy-client");
var import_EndpointParameters2 = require("./endpoint/EndpointParameters");
var AssumeRoleWithWebIdentityCommand = class extends import_smithy_client5.Command.classBuilder().ep(import_EndpointParameters2.commonParams).m(function(Command, cs, config, o) {
return [
(0, import_middleware_serde2.getSerdePlugin)(config, this.serialize, this.deserialize),
(0, import_middleware_endpoint2.getEndpointPlugin)(config, Command.getEndpointParameterInstructions())
];
}).s("AWSSecurityTokenServiceV20110615", "AssumeRoleWithWebIdentity", {}).n("STSClient", "AssumeRoleWithWebIdentityCommand").f(AssumeRoleWithWebIdentityRequestFilterSensitiveLog, AssumeRoleWithWebIdentityResponseFilterSensitiveLog).ser(se_AssumeRoleWithWebIdentityCommand).de(de_AssumeRoleWithWebIdentityCommand).build() {
static {
__name(this, "AssumeRoleWithWebIdentityCommand");
}
};
// src/submodules/sts/STS.ts
var import_STSClient = require("./STSClient");
var commands = {
AssumeRoleCommand,
AssumeRoleWithWebIdentityCommand
};
var STS = class extends import_STSClient.STSClient {
static {
__name(this, "STS");
}
};
(0, import_smithy_client6.createAggregatedClient)(commands, STS);
// src/submodules/sts/index.ts
var import_EndpointParameters3 = require("./endpoint/EndpointParameters");
// src/submodules/sts/defaultStsRoleAssumers.ts
var import_client = require("@aws-sdk/core/client");
var ASSUME_ROLE_DEFAULT_REGION = "us-east-1";
var getAccountIdFromAssumedRoleUser = /* @__PURE__ */ __name((assumedRoleUser) => {
if (typeof assumedRoleUser?.Arn === "string") {
const arnComponents = assumedRoleUser.Arn.split(":");
if (arnComponents.length > 4 && arnComponents[4] !== "") {
return arnComponents[4];
}
}
return void 0;
}, "getAccountIdFromAssumedRoleUser");
var resolveRegion = /* @__PURE__ */ __name(async (_region, _parentRegion, credentialProviderLogger) => {
const region = typeof _region === "function" ? await _region() : _region;
const parentRegion = typeof _parentRegion === "function" ? await _parentRegion() : _parentRegion;
credentialProviderLogger?.debug?.(
"@aws-sdk/client-sts::resolveRegion",
"accepting first of:",
`${region} (provider)`,
`${parentRegion} (parent client)`,
`${ASSUME_ROLE_DEFAULT_REGION} (STS default)`
);
return region ?? parentRegion ?? ASSUME_ROLE_DEFAULT_REGION;
}, "resolveRegion");
var getDefaultRoleAssumer = /* @__PURE__ */ __name((stsOptions, STSClient3) => {
let stsClient;
let closureSourceCreds;
return async (sourceCreds, params) => {
closureSourceCreds = sourceCreds;
if (!stsClient) {
const {
logger = stsOptions?.parentClientConfig?.logger,
region,
requestHandler = stsOptions?.parentClientConfig?.requestHandler,
credentialProviderLogger
} = stsOptions;
const resolvedRegion = await resolveRegion(
region,
stsOptions?.parentClientConfig?.region,
credentialProviderLogger
);
const isCompatibleRequestHandler = !isH2(requestHandler);
stsClient = new STSClient3({
profile: stsOptions?.parentClientConfig?.profile,
// A hack to make sts client uses the credential in current closure.
credentialDefaultProvider: /* @__PURE__ */ __name(() => async () => closureSourceCreds, "credentialDefaultProvider"),
region: resolvedRegion,
requestHandler: isCompatibleRequestHandler ? requestHandler : void 0,
logger
});
}
const { Credentials: Credentials2, AssumedRoleUser: AssumedRoleUser2 } = await stsClient.send(new AssumeRoleCommand(params));
if (!Credentials2 || !Credentials2.AccessKeyId || !Credentials2.SecretAccessKey) {
throw new Error(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`);
}
const accountId = getAccountIdFromAssumedRoleUser(AssumedRoleUser2);
const credentials = {
accessKeyId: Credentials2.AccessKeyId,
secretAccessKey: Credentials2.SecretAccessKey,
sessionToken: Credentials2.SessionToken,
expiration: Credentials2.Expiration,
// TODO(credentialScope): access normally when shape is updated.
...Credentials2.CredentialScope && { credentialScope: Credentials2.CredentialScope },
...accountId && { accountId }
};
(0, import_client.setCredentialFeature)(credentials, "CREDENTIALS_STS_ASSUME_ROLE", "i");
return credentials;
};
}, "getDefaultRoleAssumer");
var getDefaultRoleAssumerWithWebIdentity = /* @__PURE__ */ __name((stsOptions, STSClient3) => {
let stsClient;
return async (params) => {
if (!stsClient) {
const {
logger = stsOptions?.parentClientConfig?.logger,
region,
requestHandler = stsOptions?.parentClientConfig?.requestHandler,
credentialProviderLogger
} = stsOptions;
const resolvedRegion = await resolveRegion(
region,
stsOptions?.parentClientConfig?.region,
credentialProviderLogger
);
const isCompatibleRequestHandler = !isH2(requestHandler);
stsClient = new STSClient3({
profile: stsOptions?.parentClientConfig?.profile,
region: resolvedRegion,
requestHandler: isCompatibleRequestHandler ? requestHandler : void 0,
logger
});
}
const { Credentials: Credentials2, AssumedRoleUser: AssumedRoleUser2 } = await stsClient.send(new AssumeRoleWithWebIdentityCommand(params));
if (!Credentials2 || !Credentials2.AccessKeyId || !Credentials2.SecretAccessKey) {
throw new Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${params.RoleArn}`);
}
const accountId = getAccountIdFromAssumedRoleUser(AssumedRoleUser2);
const credentials = {
accessKeyId: Credentials2.AccessKeyId,
secretAccessKey: Credentials2.SecretAccessKey,
sessionToken: Credentials2.SessionToken,
expiration: Credentials2.Expiration,
// TODO(credentialScope): access normally when shape is updated.
...Credentials2.CredentialScope && { credentialScope: Credentials2.CredentialScope },
...accountId && { accountId }
};
if (accountId) {
(0, import_client.setCredentialFeature)(credentials, "RESOLVED_ACCOUNT_ID", "T");
}
(0, import_client.setCredentialFeature)(credentials, "CREDENTIALS_STS_ASSUME_ROLE_WEB_ID", "k");
return credentials;
};
}, "getDefaultRoleAssumerWithWebIdentity");
var isH2 = /* @__PURE__ */ __name((requestHandler) => {
return requestHandler?.metadata?.handlerProtocol === "h2";
}, "isH2");
// src/submodules/sts/defaultRoleAssumers.ts
var import_STSClient2 = require("./STSClient");
var getCustomizableStsClientCtor = /* @__PURE__ */ __name((baseCtor, customizations) => {
if (!customizations) return baseCtor;
else
return class CustomizableSTSClient extends baseCtor {
static {
__name(this, "CustomizableSTSClient");
}
constructor(config) {
super(config);
for (const customization of customizations) {
this.middlewareStack.use(customization);
}
}
};
}, "getCustomizableStsClientCtor");
var getDefaultRoleAssumer2 = /* @__PURE__ */ __name((stsOptions = {}, stsPlugins) => getDefaultRoleAssumer(stsOptions, getCustomizableStsClientCtor(import_STSClient2.STSClient, stsPlugins)), "getDefaultRoleAssumer");
var getDefaultRoleAssumerWithWebIdentity2 = /* @__PURE__ */ __name((stsOptions = {}, stsPlugins) => getDefaultRoleAssumerWithWebIdentity(stsOptions, getCustomizableStsClientCtor(import_STSClient2.STSClient, stsPlugins)), "getDefaultRoleAssumerWithWebIdentity");
var decorateDefaultCredentialProvider = /* @__PURE__ */ __name((provider) => (input) => provider({
roleAssumer: getDefaultRoleAssumer2(input),
roleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity2(input),
...input
}), "decorateDefaultCredentialProvider");
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
AssumeRoleCommand,
AssumeRoleResponseFilterSensitiveLog,
AssumeRoleWithWebIdentityCommand,
AssumeRoleWithWebIdentityRequestFilterSensitiveLog,
AssumeRoleWithWebIdentityResponseFilterSensitiveLog,
ClientInputEndpointParameters,
CredentialsFilterSensitiveLog,
ExpiredTokenException,
IDPCommunicationErrorException,
IDPRejectedClaimException,
InvalidIdentityTokenException,
MalformedPolicyDocumentException,
PackedPolicyTooLargeException,
RegionDisabledException,
STS,
STSServiceException,
decorateDefaultCredentialProvider,
getDefaultRoleAssumer,
getDefaultRoleAssumerWithWebIdentity,
...require("./STSClient")
});
@@ -0,0 +1,39 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getRuntimeConfig = void 0;
const tslib_1 = require("tslib");
const package_json_1 = tslib_1.__importDefault(require("../../../package.json"));
const sha256_browser_1 = require("@aws-crypto/sha256-browser");
const util_user_agent_browser_1 = require("@aws-sdk/util-user-agent-browser");
const config_resolver_1 = require("@smithy/config-resolver");
const fetch_http_handler_1 = require("@smithy/fetch-http-handler");
const invalid_dependency_1 = require("@smithy/invalid-dependency");
const util_body_length_browser_1 = require("@smithy/util-body-length-browser");
const util_retry_1 = require("@smithy/util-retry");
const runtimeConfig_shared_1 = require("./runtimeConfig.shared");
const smithy_client_1 = require("@smithy/smithy-client");
const util_defaults_mode_browser_1 = require("@smithy/util-defaults-mode-browser");
const getRuntimeConfig = (config) => {
const defaultsMode = (0, util_defaults_mode_browser_1.resolveDefaultsModeConfig)(config);
const defaultConfigProvider = () => defaultsMode().then(smithy_client_1.loadConfigsForDefaultMode);
const clientSharedValues = (0, runtimeConfig_shared_1.getRuntimeConfig)(config);
return {
...clientSharedValues,
...config,
runtime: "browser",
defaultsMode,
bodyLengthChecker: config?.bodyLengthChecker ?? util_body_length_browser_1.calculateBodyLength,
credentialDefaultProvider: config?.credentialDefaultProvider ?? ((_) => () => Promise.reject(new Error("Credential is missing"))),
defaultUserAgentProvider: config?.defaultUserAgentProvider ??
(0, util_user_agent_browser_1.createDefaultUserAgentProvider)({ serviceId: clientSharedValues.serviceId, clientVersion: package_json_1.default.version }),
maxAttempts: config?.maxAttempts ?? util_retry_1.DEFAULT_MAX_ATTEMPTS,
region: config?.region ?? (0, invalid_dependency_1.invalidProvider)("Region is missing"),
requestHandler: fetch_http_handler_1.FetchHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
retryMode: config?.retryMode ?? (async () => (await defaultConfigProvider()).retryMode || util_retry_1.DEFAULT_RETRY_MODE),
sha256: config?.sha256 ?? sha256_browser_1.Sha256,
streamCollector: config?.streamCollector ?? fetch_http_handler_1.streamCollector,
useDualstackEndpoint: config?.useDualstackEndpoint ?? (() => Promise.resolve(config_resolver_1.DEFAULT_USE_DUALSTACK_ENDPOINT)),
useFipsEndpoint: config?.useFipsEndpoint ?? (() => Promise.resolve(config_resolver_1.DEFAULT_USE_FIPS_ENDPOINT)),
};
};
exports.getRuntimeConfig = getRuntimeConfig;
@@ -0,0 +1,68 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getRuntimeConfig = void 0;
const tslib_1 = require("tslib");
const package_json_1 = tslib_1.__importDefault(require("../../../package.json"));
const core_1 = require("@aws-sdk/core");
const util_user_agent_node_1 = require("@aws-sdk/util-user-agent-node");
const config_resolver_1 = require("@smithy/config-resolver");
const core_2 = require("@smithy/core");
const hash_node_1 = require("@smithy/hash-node");
const middleware_retry_1 = require("@smithy/middleware-retry");
const node_config_provider_1 = require("@smithy/node-config-provider");
const node_http_handler_1 = require("@smithy/node-http-handler");
const util_body_length_node_1 = require("@smithy/util-body-length-node");
const util_retry_1 = require("@smithy/util-retry");
const runtimeConfig_shared_1 = require("./runtimeConfig.shared");
const smithy_client_1 = require("@smithy/smithy-client");
const util_defaults_mode_node_1 = require("@smithy/util-defaults-mode-node");
const smithy_client_2 = require("@smithy/smithy-client");
const getRuntimeConfig = (config) => {
(0, smithy_client_2.emitWarningIfUnsupportedVersion)(process.version);
const defaultsMode = (0, util_defaults_mode_node_1.resolveDefaultsModeConfig)(config);
const defaultConfigProvider = () => defaultsMode().then(smithy_client_1.loadConfigsForDefaultMode);
const clientSharedValues = (0, runtimeConfig_shared_1.getRuntimeConfig)(config);
(0, core_1.emitWarningIfUnsupportedVersion)(process.version);
const loaderConfig = {
profile: config?.profile,
logger: clientSharedValues.logger,
};
return {
...clientSharedValues,
...config,
runtime: "node",
defaultsMode,
authSchemePreference: config?.authSchemePreference ?? (0, node_config_provider_1.loadConfig)(core_1.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
bodyLengthChecker: config?.bodyLengthChecker ?? util_body_length_node_1.calculateBodyLength,
defaultUserAgentProvider: config?.defaultUserAgentProvider ??
(0, util_user_agent_node_1.createDefaultUserAgentProvider)({ serviceId: clientSharedValues.serviceId, clientVersion: package_json_1.default.version }),
httpAuthSchemes: config?.httpAuthSchemes ?? [
{
schemeId: "aws.auth#sigv4",
identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4") ||
(async (idProps) => await config.credentialDefaultProvider(idProps?.__config || {})()),
signer: new core_1.AwsSdkSigV4Signer(),
},
{
schemeId: "smithy.api#noAuth",
identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
signer: new core_2.NoAuthSigner(),
},
],
maxAttempts: config?.maxAttempts ?? (0, node_config_provider_1.loadConfig)(middleware_retry_1.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
region: config?.region ??
(0, node_config_provider_1.loadConfig)(config_resolver_1.NODE_REGION_CONFIG_OPTIONS, { ...config_resolver_1.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
requestHandler: node_http_handler_1.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
retryMode: config?.retryMode ??
(0, node_config_provider_1.loadConfig)({
...middleware_retry_1.NODE_RETRY_MODE_CONFIG_OPTIONS,
default: async () => (await defaultConfigProvider()).retryMode || util_retry_1.DEFAULT_RETRY_MODE,
}, config),
sha256: config?.sha256 ?? hash_node_1.Hash.bind(null, "sha256"),
streamCollector: config?.streamCollector ?? node_http_handler_1.streamCollector,
useDualstackEndpoint: config?.useDualstackEndpoint ?? (0, node_config_provider_1.loadConfig)(config_resolver_1.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
useFipsEndpoint: config?.useFipsEndpoint ?? (0, node_config_provider_1.loadConfig)(config_resolver_1.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
userAgentAppId: config?.userAgentAppId ?? (0, node_config_provider_1.loadConfig)(util_user_agent_node_1.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig),
};
};
exports.getRuntimeConfig = getRuntimeConfig;
@@ -0,0 +1,15 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getRuntimeConfig = void 0;
const sha256_js_1 = require("@aws-crypto/sha256-js");
const runtimeConfig_browser_1 = require("./runtimeConfig.browser");
const getRuntimeConfig = (config) => {
const browserDefaults = (0, runtimeConfig_browser_1.getRuntimeConfig)(config);
return {
...browserDefaults,
...config,
runtime: "react-native",
sha256: config?.sha256 ?? sha256_js_1.Sha256,
};
};
exports.getRuntimeConfig = getRuntimeConfig;
@@ -0,0 +1,40 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getRuntimeConfig = void 0;
const core_1 = require("@aws-sdk/core");
const core_2 = require("@smithy/core");
const smithy_client_1 = require("@smithy/smithy-client");
const url_parser_1 = require("@smithy/url-parser");
const util_base64_1 = require("@smithy/util-base64");
const util_utf8_1 = require("@smithy/util-utf8");
const httpAuthSchemeProvider_1 = require("./auth/httpAuthSchemeProvider");
const endpointResolver_1 = require("./endpoint/endpointResolver");
const getRuntimeConfig = (config) => {
return {
apiVersion: "2011-06-15",
base64Decoder: config?.base64Decoder ?? util_base64_1.fromBase64,
base64Encoder: config?.base64Encoder ?? util_base64_1.toBase64,
disableHostPrefix: config?.disableHostPrefix ?? false,
endpointProvider: config?.endpointProvider ?? endpointResolver_1.defaultEndpointResolver,
extensions: config?.extensions ?? [],
httpAuthSchemeProvider: config?.httpAuthSchemeProvider ?? httpAuthSchemeProvider_1.defaultSTSHttpAuthSchemeProvider,
httpAuthSchemes: config?.httpAuthSchemes ?? [
{
schemeId: "aws.auth#sigv4",
identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4"),
signer: new core_1.AwsSdkSigV4Signer(),
},
{
schemeId: "smithy.api#noAuth",
identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
signer: new core_2.NoAuthSigner(),
},
],
logger: config?.logger ?? new smithy_client_1.NoOpLogger(),
serviceId: config?.serviceId ?? "STS",
urlParser: config?.urlParser ?? url_parser_1.parseUrl,
utf8Decoder: config?.utf8Decoder ?? util_utf8_1.fromUtf8,
utf8Encoder: config?.utf8Encoder ?? util_utf8_1.toUtf8,
};
};
exports.getRuntimeConfig = getRuntimeConfig;
@@ -0,0 +1,13 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.resolveRuntimeExtensions = void 0;
const region_config_resolver_1 = require("@aws-sdk/region-config-resolver");
const protocol_http_1 = require("@smithy/protocol-http");
const smithy_client_1 = require("@smithy/smithy-client");
const httpAuthExtensionConfiguration_1 = require("./auth/httpAuthExtensionConfiguration");
const resolveRuntimeExtensions = (runtimeConfig, extensions) => {
const extensionConfiguration = Object.assign((0, region_config_resolver_1.getAwsRegionExtensionConfiguration)(runtimeConfig), (0, smithy_client_1.getDefaultExtensionConfiguration)(runtimeConfig), (0, protocol_http_1.getHttpHandlerExtensionConfiguration)(runtimeConfig), (0, httpAuthExtensionConfiguration_1.getHttpAuthExtensionConfiguration)(runtimeConfig));
extensions.forEach((extension) => extension.configure(extensionConfiguration));
return Object.assign(runtimeConfig, (0, region_config_resolver_1.resolveAwsRegionExtensionConfiguration)(extensionConfiguration), (0, smithy_client_1.resolveDefaultRuntimeConfig)(extensionConfiguration), (0, protocol_http_1.resolveHttpHandlerRuntimeConfig)(extensionConfiguration), (0, httpAuthExtensionConfiguration_1.resolveHttpAuthRuntimeConfig)(extensionConfiguration));
};
exports.resolveRuntimeExtensions = resolveRuntimeExtensions;
@@ -0,0 +1 @@
export {};
@@ -0,0 +1,9 @@
import { createAggregatedClient } from "@smithy/smithy-client";
import { CreateTokenCommand } from "./commands/CreateTokenCommand";
import { SSOOIDCClient } from "./SSOOIDCClient";
const commands = {
CreateTokenCommand,
};
export class SSOOIDC extends SSOOIDCClient {
}
createAggregatedClient(commands, SSOOIDC);
@@ -0,0 +1,48 @@
import { getHostHeaderPlugin, resolveHostHeaderConfig, } from "@aws-sdk/middleware-host-header";
import { getLoggerPlugin } from "@aws-sdk/middleware-logger";
import { getRecursionDetectionPlugin } from "@aws-sdk/middleware-recursion-detection";
import { getUserAgentPlugin, resolveUserAgentConfig, } from "@aws-sdk/middleware-user-agent";
import { resolveRegionConfig } from "@smithy/config-resolver";
import { DefaultIdentityProviderConfig, getHttpAuthSchemeEndpointRuleSetPlugin, getHttpSigningPlugin, } from "@smithy/core";
import { getContentLengthPlugin } from "@smithy/middleware-content-length";
import { resolveEndpointConfig } from "@smithy/middleware-endpoint";
import { getRetryPlugin, resolveRetryConfig } from "@smithy/middleware-retry";
import { Client as __Client, } from "@smithy/smithy-client";
import { defaultSSOOIDCHttpAuthSchemeParametersProvider, resolveHttpAuthSchemeConfig, } from "./auth/httpAuthSchemeProvider";
import { resolveClientEndpointParameters, } from "./endpoint/EndpointParameters";
import { getRuntimeConfig as __getRuntimeConfig } from "./runtimeConfig";
import { resolveRuntimeExtensions } from "./runtimeExtensions";
export { __Client };
export class SSOOIDCClient extends __Client {
config;
constructor(...[configuration]) {
const _config_0 = __getRuntimeConfig(configuration || {});
super(_config_0);
this.initConfig = _config_0;
const _config_1 = resolveClientEndpointParameters(_config_0);
const _config_2 = resolveUserAgentConfig(_config_1);
const _config_3 = resolveRetryConfig(_config_2);
const _config_4 = resolveRegionConfig(_config_3);
const _config_5 = resolveHostHeaderConfig(_config_4);
const _config_6 = resolveEndpointConfig(_config_5);
const _config_7 = resolveHttpAuthSchemeConfig(_config_6);
const _config_8 = resolveRuntimeExtensions(_config_7, configuration?.extensions || []);
this.config = _config_8;
this.middlewareStack.use(getUserAgentPlugin(this.config));
this.middlewareStack.use(getRetryPlugin(this.config));
this.middlewareStack.use(getContentLengthPlugin(this.config));
this.middlewareStack.use(getHostHeaderPlugin(this.config));
this.middlewareStack.use(getLoggerPlugin(this.config));
this.middlewareStack.use(getRecursionDetectionPlugin(this.config));
this.middlewareStack.use(getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
httpAuthSchemeParametersProvider: defaultSSOOIDCHttpAuthSchemeParametersProvider,
identityProviderConfigProvider: async (config) => new DefaultIdentityProviderConfig({
"aws.auth#sigv4": config.credentials,
}),
}));
this.middlewareStack.use(getHttpSigningPlugin(this.config));
}
destroy() {
super.destroy();
}
}
@@ -0,0 +1,38 @@
export const getHttpAuthExtensionConfiguration = (runtimeConfig) => {
const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
let _credentials = runtimeConfig.credentials;
return {
setHttpAuthScheme(httpAuthScheme) {
const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);
if (index === -1) {
_httpAuthSchemes.push(httpAuthScheme);
}
else {
_httpAuthSchemes.splice(index, 1, httpAuthScheme);
}
},
httpAuthSchemes() {
return _httpAuthSchemes;
},
setHttpAuthSchemeProvider(httpAuthSchemeProvider) {
_httpAuthSchemeProvider = httpAuthSchemeProvider;
},
httpAuthSchemeProvider() {
return _httpAuthSchemeProvider;
},
setCredentials(credentials) {
_credentials = credentials;
},
credentials() {
return _credentials;
},
};
};
export const resolveHttpAuthRuntimeConfig = (config) => {
return {
httpAuthSchemes: config.httpAuthSchemes(),
httpAuthSchemeProvider: config.httpAuthSchemeProvider(),
credentials: config.credentials(),
};
};
@@ -0,0 +1,50 @@
import { resolveAwsSdkSigV4Config, } from "@aws-sdk/core";
import { getSmithyContext, normalizeProvider } from "@smithy/util-middleware";
export const defaultSSOOIDCHttpAuthSchemeParametersProvider = async (config, context, input) => {
return {
operation: getSmithyContext(context).operation,
region: (await normalizeProvider(config.region)()) ||
(() => {
throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
})(),
};
};
function createAwsAuthSigv4HttpAuthOption(authParameters) {
return {
schemeId: "aws.auth#sigv4",
signingProperties: {
name: "sso-oauth",
region: authParameters.region,
},
propertiesExtractor: (config, context) => ({
signingProperties: {
config,
context,
},
}),
};
}
function createSmithyApiNoAuthHttpAuthOption(authParameters) {
return {
schemeId: "smithy.api#noAuth",
};
}
export const defaultSSOOIDCHttpAuthSchemeProvider = (authParameters) => {
const options = [];
switch (authParameters.operation) {
case "CreateToken": {
options.push(createSmithyApiNoAuthHttpAuthOption(authParameters));
break;
}
default: {
options.push(createAwsAuthSigv4HttpAuthOption(authParameters));
}
}
return options;
};
export const resolveHttpAuthSchemeConfig = (config) => {
const config_0 = resolveAwsSdkSigV4Config(config);
return Object.assign(config_0, {
authSchemePreference: normalizeProvider(config.authSchemePreference ?? []),
});
};
@@ -0,0 +1,23 @@
import { getEndpointPlugin } from "@smithy/middleware-endpoint";
import { getSerdePlugin } from "@smithy/middleware-serde";
import { Command as $Command } from "@smithy/smithy-client";
import { commonParams } from "../endpoint/EndpointParameters";
import { CreateTokenRequestFilterSensitiveLog, CreateTokenResponseFilterSensitiveLog, } from "../models/models_0";
import { de_CreateTokenCommand, se_CreateTokenCommand } from "../protocols/Aws_restJson1";
export { $Command };
export class CreateTokenCommand extends $Command
.classBuilder()
.ep(commonParams)
.m(function (Command, cs, config, o) {
return [
getSerdePlugin(config, this.serialize, this.deserialize),
getEndpointPlugin(config, Command.getEndpointParameterInstructions()),
];
})
.s("AWSSSOOIDCService", "CreateToken", {})
.n("SSOOIDCClient", "CreateTokenCommand")
.f(CreateTokenRequestFilterSensitiveLog, CreateTokenResponseFilterSensitiveLog)
.ser(se_CreateTokenCommand)
.de(de_CreateTokenCommand)
.build() {
}
@@ -0,0 +1 @@
export * from "./CreateTokenCommand";
@@ -0,0 +1,13 @@
export const resolveClientEndpointParameters = (options) => {
return Object.assign(options, {
useDualstackEndpoint: options.useDualstackEndpoint ?? false,
useFipsEndpoint: options.useFipsEndpoint ?? false,
defaultSigningName: "sso-oauth",
});
};
export const commonParams = {
UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
Endpoint: { type: "builtInParams", name: "endpoint" },
Region: { type: "builtInParams", name: "region" },
UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
};
@@ -0,0 +1,14 @@
import { awsEndpointFunctions } from "@aws-sdk/util-endpoints";
import { customEndpointFunctions, EndpointCache, resolveEndpoint } from "@smithy/util-endpoints";
import { ruleSet } from "./ruleset";
const cache = new EndpointCache({
size: 50,
params: ["Endpoint", "Region", "UseDualStack", "UseFIPS"],
});
export const defaultEndpointResolver = (endpointParams, context = {}) => {
return cache.get(endpointParams, () => resolveEndpoint(ruleSet, {
endpointParams: endpointParams,
logger: context.logger,
}));
};
customEndpointFunctions.aws = awsEndpointFunctions;
@@ -0,0 +1,4 @@
const u = "required", v = "fn", w = "argv", x = "ref";
const a = true, b = "isSet", c = "booleanEquals", d = "error", e = "endpoint", f = "tree", g = "PartitionResult", h = "getAttr", i = { [u]: false, "type": "String" }, j = { [u]: true, "default": false, "type": "Boolean" }, k = { [x]: "Endpoint" }, l = { [v]: c, [w]: [{ [x]: "UseFIPS" }, true] }, m = { [v]: c, [w]: [{ [x]: "UseDualStack" }, true] }, n = {}, o = { [v]: h, [w]: [{ [x]: g }, "supportsFIPS"] }, p = { [x]: g }, q = { [v]: c, [w]: [true, { [v]: h, [w]: [p, "supportsDualStack"] }] }, r = [l], s = [m], t = [{ [x]: "Region" }];
const _data = { version: "1.0", parameters: { Region: i, UseDualStack: j, UseFIPS: j, Endpoint: i }, rules: [{ conditions: [{ [v]: b, [w]: [k] }], rules: [{ conditions: r, error: "Invalid Configuration: FIPS and custom endpoint are not supported", type: d }, { conditions: s, error: "Invalid Configuration: Dualstack and custom endpoint are not supported", type: d }, { endpoint: { url: k, properties: n, headers: n }, type: e }], type: f }, { conditions: [{ [v]: b, [w]: t }], rules: [{ conditions: [{ [v]: "aws.partition", [w]: t, assign: g }], rules: [{ conditions: [l, m], rules: [{ conditions: [{ [v]: c, [w]: [a, o] }, q], rules: [{ endpoint: { url: "https://oidc-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", properties: n, headers: n }, type: e }], type: f }, { error: "FIPS and DualStack are enabled, but this partition does not support one or both", type: d }], type: f }, { conditions: r, rules: [{ conditions: [{ [v]: c, [w]: [o, a] }], rules: [{ conditions: [{ [v]: "stringEquals", [w]: [{ [v]: h, [w]: [p, "name"] }, "aws-us-gov"] }], endpoint: { url: "https://oidc.{Region}.amazonaws.com", properties: n, headers: n }, type: e }, { endpoint: { url: "https://oidc-fips.{Region}.{PartitionResult#dnsSuffix}", properties: n, headers: n }, type: e }], type: f }, { error: "FIPS is enabled but this partition does not support FIPS", type: d }], type: f }, { conditions: s, rules: [{ conditions: [q], rules: [{ endpoint: { url: "https://oidc.{Region}.{PartitionResult#dualStackDnsSuffix}", properties: n, headers: n }, type: e }], type: f }, { error: "DualStack is enabled but this partition does not support DualStack", type: d }], type: f }, { endpoint: { url: "https://oidc.{Region}.{PartitionResult#dnsSuffix}", properties: n, headers: n }, type: e }], type: f }], type: f }, { error: "Invalid Configuration: Missing Region", type: d }] };
export const ruleSet = _data;
@@ -0,0 +1,5 @@
export * from "./SSOOIDCClient";
export * from "./SSOOIDC";
export * from "./commands";
export * from "./models";
export { SSOOIDCServiceException } from "./models/SSOOIDCServiceException";
@@ -0,0 +1,8 @@
import { ServiceException as __ServiceException, } from "@smithy/smithy-client";
export { __ServiceException };
export class SSOOIDCServiceException extends __ServiceException {
constructor(options) {
super(options);
Object.setPrototypeOf(this, SSOOIDCServiceException.prototype);
}
}
@@ -0,0 +1 @@
export * from "./models_0";
@@ -0,0 +1,190 @@
import { SENSITIVE_STRING } from "@smithy/smithy-client";
import { SSOOIDCServiceException as __BaseException } from "./SSOOIDCServiceException";
export class AccessDeniedException extends __BaseException {
name = "AccessDeniedException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "AccessDeniedException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, AccessDeniedException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export class AuthorizationPendingException extends __BaseException {
name = "AuthorizationPendingException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "AuthorizationPendingException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, AuthorizationPendingException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export const CreateTokenRequestFilterSensitiveLog = (obj) => ({
...obj,
...(obj.clientSecret && { clientSecret: SENSITIVE_STRING }),
...(obj.refreshToken && { refreshToken: SENSITIVE_STRING }),
...(obj.codeVerifier && { codeVerifier: SENSITIVE_STRING }),
});
export const CreateTokenResponseFilterSensitiveLog = (obj) => ({
...obj,
...(obj.accessToken && { accessToken: SENSITIVE_STRING }),
...(obj.refreshToken && { refreshToken: SENSITIVE_STRING }),
...(obj.idToken && { idToken: SENSITIVE_STRING }),
});
export class ExpiredTokenException extends __BaseException {
name = "ExpiredTokenException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "ExpiredTokenException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, ExpiredTokenException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export class InternalServerException extends __BaseException {
name = "InternalServerException";
$fault = "server";
error;
error_description;
constructor(opts) {
super({
name: "InternalServerException",
$fault: "server",
...opts,
});
Object.setPrototypeOf(this, InternalServerException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export class InvalidClientException extends __BaseException {
name = "InvalidClientException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "InvalidClientException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, InvalidClientException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export class InvalidGrantException extends __BaseException {
name = "InvalidGrantException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "InvalidGrantException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, InvalidGrantException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export class InvalidRequestException extends __BaseException {
name = "InvalidRequestException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "InvalidRequestException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, InvalidRequestException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export class InvalidScopeException extends __BaseException {
name = "InvalidScopeException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "InvalidScopeException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, InvalidScopeException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export class SlowDownException extends __BaseException {
name = "SlowDownException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "SlowDownException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, SlowDownException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export class UnauthorizedClientException extends __BaseException {
name = "UnauthorizedClientException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "UnauthorizedClientException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, UnauthorizedClientException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
export class UnsupportedGrantTypeException extends __BaseException {
name = "UnsupportedGrantTypeException";
$fault = "client";
error;
error_description;
constructor(opts) {
super({
name: "UnsupportedGrantTypeException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, UnsupportedGrantTypeException.prototype);
this.error = opts.error;
this.error_description = opts.error_description;
}
}
@@ -0,0 +1,255 @@
import { loadRestJsonErrorCode, parseJsonBody as parseBody, parseJsonErrorBody as parseErrorBody } from "@aws-sdk/core";
import { requestBuilder as rb } from "@smithy/core";
import { _json, collectBody, decorateServiceException as __decorateServiceException, expectInt32 as __expectInt32, expectNonNull as __expectNonNull, expectObject as __expectObject, expectString as __expectString, map, take, withBaseException, } from "@smithy/smithy-client";
import { AccessDeniedException, AuthorizationPendingException, ExpiredTokenException, InternalServerException, InvalidClientException, InvalidGrantException, InvalidRequestException, InvalidScopeException, SlowDownException, UnauthorizedClientException, UnsupportedGrantTypeException, } from "../models/models_0";
import { SSOOIDCServiceException as __BaseException } from "../models/SSOOIDCServiceException";
export const se_CreateTokenCommand = async (input, context) => {
const b = rb(input, context);
const headers = {
"content-type": "application/json",
};
b.bp("/token");
let body;
body = JSON.stringify(take(input, {
clientId: [],
clientSecret: [],
code: [],
codeVerifier: [],
deviceCode: [],
grantType: [],
redirectUri: [],
refreshToken: [],
scope: (_) => _json(_),
}));
b.m("POST").h(headers).b(body);
return b.build();
};
export const de_CreateTokenCommand = async (output, context) => {
if (output.statusCode !== 200 && output.statusCode >= 300) {
return de_CommandError(output, context);
}
const contents = map({
$metadata: deserializeMetadata(output),
});
const data = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
const doc = take(data, {
accessToken: __expectString,
expiresIn: __expectInt32,
idToken: __expectString,
refreshToken: __expectString,
tokenType: __expectString,
});
Object.assign(contents, doc);
return contents;
};
const de_CommandError = async (output, context) => {
const parsedOutput = {
...output,
body: await parseErrorBody(output.body, context),
};
const errorCode = loadRestJsonErrorCode(output, parsedOutput.body);
switch (errorCode) {
case "AccessDeniedException":
case "com.amazonaws.ssooidc#AccessDeniedException":
throw await de_AccessDeniedExceptionRes(parsedOutput, context);
case "AuthorizationPendingException":
case "com.amazonaws.ssooidc#AuthorizationPendingException":
throw await de_AuthorizationPendingExceptionRes(parsedOutput, context);
case "ExpiredTokenException":
case "com.amazonaws.ssooidc#ExpiredTokenException":
throw await de_ExpiredTokenExceptionRes(parsedOutput, context);
case "InternalServerException":
case "com.amazonaws.ssooidc#InternalServerException":
throw await de_InternalServerExceptionRes(parsedOutput, context);
case "InvalidClientException":
case "com.amazonaws.ssooidc#InvalidClientException":
throw await de_InvalidClientExceptionRes(parsedOutput, context);
case "InvalidGrantException":
case "com.amazonaws.ssooidc#InvalidGrantException":
throw await de_InvalidGrantExceptionRes(parsedOutput, context);
case "InvalidRequestException":
case "com.amazonaws.ssooidc#InvalidRequestException":
throw await de_InvalidRequestExceptionRes(parsedOutput, context);
case "InvalidScopeException":
case "com.amazonaws.ssooidc#InvalidScopeException":
throw await de_InvalidScopeExceptionRes(parsedOutput, context);
case "SlowDownException":
case "com.amazonaws.ssooidc#SlowDownException":
throw await de_SlowDownExceptionRes(parsedOutput, context);
case "UnauthorizedClientException":
case "com.amazonaws.ssooidc#UnauthorizedClientException":
throw await de_UnauthorizedClientExceptionRes(parsedOutput, context);
case "UnsupportedGrantTypeException":
case "com.amazonaws.ssooidc#UnsupportedGrantTypeException":
throw await de_UnsupportedGrantTypeExceptionRes(parsedOutput, context);
default:
const parsedBody = parsedOutput.body;
return throwDefaultError({
output,
parsedBody,
errorCode,
});
}
};
const throwDefaultError = withBaseException(__BaseException);
const de_AccessDeniedExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new AccessDeniedException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_AuthorizationPendingExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new AuthorizationPendingException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_ExpiredTokenExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new ExpiredTokenException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_InternalServerExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new InternalServerException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_InvalidClientExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new InvalidClientException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_InvalidGrantExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new InvalidGrantException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_InvalidRequestExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new InvalidRequestException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_InvalidScopeExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new InvalidScopeException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_SlowDownExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new SlowDownException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_UnauthorizedClientExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new UnauthorizedClientException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const de_UnsupportedGrantTypeExceptionRes = async (parsedOutput, context) => {
const contents = map({});
const data = parsedOutput.body;
const doc = take(data, {
error: __expectString,
error_description: __expectString,
});
Object.assign(contents, doc);
const exception = new UnsupportedGrantTypeException({
$metadata: deserializeMetadata(parsedOutput),
...contents,
});
return __decorateServiceException(exception, parsedOutput.body);
};
const deserializeMetadata = (output) => ({
httpStatusCode: output.statusCode,
requestId: output.headers["x-amzn-requestid"] ?? output.headers["x-amzn-request-id"] ?? output.headers["x-amz-request-id"],
extendedRequestId: output.headers["x-amz-id-2"],
cfId: output.headers["x-amz-cf-id"],
});
const collectBodyString = (streamBody, context) => collectBody(streamBody, context).then((body) => context.utf8Encoder(body));
@@ -0,0 +1,33 @@
import packageInfo from "../../../package.json";
import { Sha256 } from "@aws-crypto/sha256-browser";
import { createDefaultUserAgentProvider } from "@aws-sdk/util-user-agent-browser";
import { DEFAULT_USE_DUALSTACK_ENDPOINT, DEFAULT_USE_FIPS_ENDPOINT } from "@smithy/config-resolver";
import { FetchHttpHandler as RequestHandler, streamCollector } from "@smithy/fetch-http-handler";
import { invalidProvider } from "@smithy/invalid-dependency";
import { calculateBodyLength } from "@smithy/util-body-length-browser";
import { DEFAULT_MAX_ATTEMPTS, DEFAULT_RETRY_MODE } from "@smithy/util-retry";
import { getRuntimeConfig as getSharedRuntimeConfig } from "./runtimeConfig.shared";
import { loadConfigsForDefaultMode } from "@smithy/smithy-client";
import { resolveDefaultsModeConfig } from "@smithy/util-defaults-mode-browser";
export const getRuntimeConfig = (config) => {
const defaultsMode = resolveDefaultsModeConfig(config);
const defaultConfigProvider = () => defaultsMode().then(loadConfigsForDefaultMode);
const clientSharedValues = getSharedRuntimeConfig(config);
return {
...clientSharedValues,
...config,
runtime: "browser",
defaultsMode,
bodyLengthChecker: config?.bodyLengthChecker ?? calculateBodyLength,
defaultUserAgentProvider: config?.defaultUserAgentProvider ??
createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }),
maxAttempts: config?.maxAttempts ?? DEFAULT_MAX_ATTEMPTS,
region: config?.region ?? invalidProvider("Region is missing"),
requestHandler: RequestHandler.create(config?.requestHandler ?? defaultConfigProvider),
retryMode: config?.retryMode ?? (async () => (await defaultConfigProvider()).retryMode || DEFAULT_RETRY_MODE),
sha256: config?.sha256 ?? Sha256,
streamCollector: config?.streamCollector ?? streamCollector,
useDualstackEndpoint: config?.useDualstackEndpoint ?? (() => Promise.resolve(DEFAULT_USE_DUALSTACK_ENDPOINT)),
useFipsEndpoint: config?.useFipsEndpoint ?? (() => Promise.resolve(DEFAULT_USE_FIPS_ENDPOINT)),
};
};
@@ -0,0 +1,49 @@
import packageInfo from "../../../package.json";
import { NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, emitWarningIfUnsupportedVersion as awsCheckVersion } from "@aws-sdk/core";
import { NODE_APP_ID_CONFIG_OPTIONS, createDefaultUserAgentProvider } from "@aws-sdk/util-user-agent-node";
import { NODE_REGION_CONFIG_FILE_OPTIONS, NODE_REGION_CONFIG_OPTIONS, NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, } from "@smithy/config-resolver";
import { Hash } from "@smithy/hash-node";
import { NODE_MAX_ATTEMPT_CONFIG_OPTIONS, NODE_RETRY_MODE_CONFIG_OPTIONS } from "@smithy/middleware-retry";
import { loadConfig as loadNodeConfig } from "@smithy/node-config-provider";
import { NodeHttpHandler as RequestHandler, streamCollector } from "@smithy/node-http-handler";
import { calculateBodyLength } from "@smithy/util-body-length-node";
import { DEFAULT_RETRY_MODE } from "@smithy/util-retry";
import { getRuntimeConfig as getSharedRuntimeConfig } from "./runtimeConfig.shared";
import { loadConfigsForDefaultMode } from "@smithy/smithy-client";
import { resolveDefaultsModeConfig } from "@smithy/util-defaults-mode-node";
import { emitWarningIfUnsupportedVersion } from "@smithy/smithy-client";
export const getRuntimeConfig = (config) => {
emitWarningIfUnsupportedVersion(process.version);
const defaultsMode = resolveDefaultsModeConfig(config);
const defaultConfigProvider = () => defaultsMode().then(loadConfigsForDefaultMode);
const clientSharedValues = getSharedRuntimeConfig(config);
awsCheckVersion(process.version);
const loaderConfig = {
profile: config?.profile,
logger: clientSharedValues.logger,
};
return {
...clientSharedValues,
...config,
runtime: "node",
defaultsMode,
authSchemePreference: config?.authSchemePreference ?? loadNodeConfig(NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
bodyLengthChecker: config?.bodyLengthChecker ?? calculateBodyLength,
defaultUserAgentProvider: config?.defaultUserAgentProvider ??
createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }),
maxAttempts: config?.maxAttempts ?? loadNodeConfig(NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
region: config?.region ??
loadNodeConfig(NODE_REGION_CONFIG_OPTIONS, { ...NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
requestHandler: RequestHandler.create(config?.requestHandler ?? defaultConfigProvider),
retryMode: config?.retryMode ??
loadNodeConfig({
...NODE_RETRY_MODE_CONFIG_OPTIONS,
default: async () => (await defaultConfigProvider()).retryMode || DEFAULT_RETRY_MODE,
}, config),
sha256: config?.sha256 ?? Hash.bind(null, "sha256"),
streamCollector: config?.streamCollector ?? streamCollector,
useDualstackEndpoint: config?.useDualstackEndpoint ?? loadNodeConfig(NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
useFipsEndpoint: config?.useFipsEndpoint ?? loadNodeConfig(NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
userAgentAppId: config?.userAgentAppId ?? loadNodeConfig(NODE_APP_ID_CONFIG_OPTIONS, loaderConfig),
};
};
@@ -0,0 +1,11 @@
import { Sha256 } from "@aws-crypto/sha256-js";
import { getRuntimeConfig as getBrowserRuntimeConfig } from "./runtimeConfig.browser";
export const getRuntimeConfig = (config) => {
const browserDefaults = getBrowserRuntimeConfig(config);
return {
...browserDefaults,
...config,
runtime: "react-native",
sha256: config?.sha256 ?? Sha256,
};
};
@@ -0,0 +1,36 @@
import { AwsSdkSigV4Signer } from "@aws-sdk/core";
import { NoAuthSigner } from "@smithy/core";
import { NoOpLogger } from "@smithy/smithy-client";
import { parseUrl } from "@smithy/url-parser";
import { fromBase64, toBase64 } from "@smithy/util-base64";
import { fromUtf8, toUtf8 } from "@smithy/util-utf8";
import { defaultSSOOIDCHttpAuthSchemeProvider } from "./auth/httpAuthSchemeProvider";
import { defaultEndpointResolver } from "./endpoint/endpointResolver";
export const getRuntimeConfig = (config) => {
return {
apiVersion: "2019-06-10",
base64Decoder: config?.base64Decoder ?? fromBase64,
base64Encoder: config?.base64Encoder ?? toBase64,
disableHostPrefix: config?.disableHostPrefix ?? false,
endpointProvider: config?.endpointProvider ?? defaultEndpointResolver,
extensions: config?.extensions ?? [],
httpAuthSchemeProvider: config?.httpAuthSchemeProvider ?? defaultSSOOIDCHttpAuthSchemeProvider,
httpAuthSchemes: config?.httpAuthSchemes ?? [
{
schemeId: "aws.auth#sigv4",
identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4"),
signer: new AwsSdkSigV4Signer(),
},
{
schemeId: "smithy.api#noAuth",
identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
signer: new NoAuthSigner(),
},
],
logger: config?.logger ?? new NoOpLogger(),
serviceId: config?.serviceId ?? "SSO OIDC",
urlParser: config?.urlParser ?? parseUrl,
utf8Decoder: config?.utf8Decoder ?? fromUtf8,
utf8Encoder: config?.utf8Encoder ?? toUtf8,
};
};
@@ -0,0 +1,9 @@
import { getAwsRegionExtensionConfiguration, resolveAwsRegionExtensionConfiguration, } from "@aws-sdk/region-config-resolver";
import { getHttpHandlerExtensionConfiguration, resolveHttpHandlerRuntimeConfig } from "@smithy/protocol-http";
import { getDefaultExtensionConfiguration, resolveDefaultRuntimeConfig } from "@smithy/smithy-client";
import { getHttpAuthExtensionConfiguration, resolveHttpAuthRuntimeConfig } from "./auth/httpAuthExtensionConfiguration";
export const resolveRuntimeExtensions = (runtimeConfig, extensions) => {
const extensionConfiguration = Object.assign(getAwsRegionExtensionConfiguration(runtimeConfig), getDefaultExtensionConfiguration(runtimeConfig), getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration(runtimeConfig));
extensions.forEach((extension) => extension.configure(extensionConfiguration));
return Object.assign(runtimeConfig, resolveAwsRegionExtensionConfiguration(extensionConfiguration), resolveDefaultRuntimeConfig(extensionConfiguration), resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig(extensionConfiguration));
};
@@ -0,0 +1,11 @@
import { createAggregatedClient } from "@smithy/smithy-client";
import { AssumeRoleCommand } from "./commands/AssumeRoleCommand";
import { AssumeRoleWithWebIdentityCommand, } from "./commands/AssumeRoleWithWebIdentityCommand";
import { STSClient } from "./STSClient";
const commands = {
AssumeRoleCommand,
AssumeRoleWithWebIdentityCommand,
};
export class STS extends STSClient {
}
createAggregatedClient(commands, STS);
@@ -0,0 +1,48 @@
import { getHostHeaderPlugin, resolveHostHeaderConfig, } from "@aws-sdk/middleware-host-header";
import { getLoggerPlugin } from "@aws-sdk/middleware-logger";
import { getRecursionDetectionPlugin } from "@aws-sdk/middleware-recursion-detection";
import { getUserAgentPlugin, resolveUserAgentConfig, } from "@aws-sdk/middleware-user-agent";
import { resolveRegionConfig } from "@smithy/config-resolver";
import { DefaultIdentityProviderConfig, getHttpAuthSchemeEndpointRuleSetPlugin, getHttpSigningPlugin, } from "@smithy/core";
import { getContentLengthPlugin } from "@smithy/middleware-content-length";
import { resolveEndpointConfig } from "@smithy/middleware-endpoint";
import { getRetryPlugin, resolveRetryConfig } from "@smithy/middleware-retry";
import { Client as __Client, } from "@smithy/smithy-client";
import { defaultSTSHttpAuthSchemeParametersProvider, resolveHttpAuthSchemeConfig, } from "./auth/httpAuthSchemeProvider";
import { resolveClientEndpointParameters, } from "./endpoint/EndpointParameters";
import { getRuntimeConfig as __getRuntimeConfig } from "./runtimeConfig";
import { resolveRuntimeExtensions } from "./runtimeExtensions";
export { __Client };
export class STSClient extends __Client {
config;
constructor(...[configuration]) {
const _config_0 = __getRuntimeConfig(configuration || {});
super(_config_0);
this.initConfig = _config_0;
const _config_1 = resolveClientEndpointParameters(_config_0);
const _config_2 = resolveUserAgentConfig(_config_1);
const _config_3 = resolveRetryConfig(_config_2);
const _config_4 = resolveRegionConfig(_config_3);
const _config_5 = resolveHostHeaderConfig(_config_4);
const _config_6 = resolveEndpointConfig(_config_5);
const _config_7 = resolveHttpAuthSchemeConfig(_config_6);
const _config_8 = resolveRuntimeExtensions(_config_7, configuration?.extensions || []);
this.config = _config_8;
this.middlewareStack.use(getUserAgentPlugin(this.config));
this.middlewareStack.use(getRetryPlugin(this.config));
this.middlewareStack.use(getContentLengthPlugin(this.config));
this.middlewareStack.use(getHostHeaderPlugin(this.config));
this.middlewareStack.use(getLoggerPlugin(this.config));
this.middlewareStack.use(getRecursionDetectionPlugin(this.config));
this.middlewareStack.use(getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
httpAuthSchemeParametersProvider: defaultSTSHttpAuthSchemeParametersProvider,
identityProviderConfigProvider: async (config) => new DefaultIdentityProviderConfig({
"aws.auth#sigv4": config.credentials,
}),
}));
this.middlewareStack.use(getHttpSigningPlugin(this.config));
}
destroy() {
super.destroy();
}
}
@@ -0,0 +1,38 @@
export const getHttpAuthExtensionConfiguration = (runtimeConfig) => {
const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
let _credentials = runtimeConfig.credentials;
return {
setHttpAuthScheme(httpAuthScheme) {
const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);
if (index === -1) {
_httpAuthSchemes.push(httpAuthScheme);
}
else {
_httpAuthSchemes.splice(index, 1, httpAuthScheme);
}
},
httpAuthSchemes() {
return _httpAuthSchemes;
},
setHttpAuthSchemeProvider(httpAuthSchemeProvider) {
_httpAuthSchemeProvider = httpAuthSchemeProvider;
},
httpAuthSchemeProvider() {
return _httpAuthSchemeProvider;
},
setCredentials(credentials) {
_credentials = credentials;
},
credentials() {
return _credentials;
},
};
};
export const resolveHttpAuthRuntimeConfig = (config) => {
return {
httpAuthSchemes: config.httpAuthSchemes(),
httpAuthSchemeProvider: config.httpAuthSchemeProvider(),
credentials: config.credentials(),
};
};
@@ -0,0 +1,55 @@
import { resolveAwsSdkSigV4Config, } from "@aws-sdk/core";
import { getSmithyContext, normalizeProvider } from "@smithy/util-middleware";
import { STSClient } from "../STSClient";
export const defaultSTSHttpAuthSchemeParametersProvider = async (config, context, input) => {
return {
operation: getSmithyContext(context).operation,
region: (await normalizeProvider(config.region)()) ||
(() => {
throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
})(),
};
};
function createAwsAuthSigv4HttpAuthOption(authParameters) {
return {
schemeId: "aws.auth#sigv4",
signingProperties: {
name: "sts",
region: authParameters.region,
},
propertiesExtractor: (config, context) => ({
signingProperties: {
config,
context,
},
}),
};
}
function createSmithyApiNoAuthHttpAuthOption(authParameters) {
return {
schemeId: "smithy.api#noAuth",
};
}
export const defaultSTSHttpAuthSchemeProvider = (authParameters) => {
const options = [];
switch (authParameters.operation) {
case "AssumeRoleWithWebIdentity": {
options.push(createSmithyApiNoAuthHttpAuthOption(authParameters));
break;
}
default: {
options.push(createAwsAuthSigv4HttpAuthOption(authParameters));
}
}
return options;
};
export const resolveStsAuthConfig = (input) => Object.assign(input, {
stsClientCtor: STSClient,
});
export const resolveHttpAuthSchemeConfig = (config) => {
const config_0 = resolveStsAuthConfig(config);
const config_1 = resolveAwsSdkSigV4Config(config_0);
return Object.assign(config_1, {
authSchemePreference: normalizeProvider(config.authSchemePreference ?? []),
});
};
@@ -0,0 +1,23 @@
import { getEndpointPlugin } from "@smithy/middleware-endpoint";
import { getSerdePlugin } from "@smithy/middleware-serde";
import { Command as $Command } from "@smithy/smithy-client";
import { commonParams } from "../endpoint/EndpointParameters";
import { AssumeRoleResponseFilterSensitiveLog } from "../models/models_0";
import { de_AssumeRoleCommand, se_AssumeRoleCommand } from "../protocols/Aws_query";
export { $Command };
export class AssumeRoleCommand extends $Command
.classBuilder()
.ep(commonParams)
.m(function (Command, cs, config, o) {
return [
getSerdePlugin(config, this.serialize, this.deserialize),
getEndpointPlugin(config, Command.getEndpointParameterInstructions()),
];
})
.s("AWSSecurityTokenServiceV20110615", "AssumeRole", {})
.n("STSClient", "AssumeRoleCommand")
.f(void 0, AssumeRoleResponseFilterSensitiveLog)
.ser(se_AssumeRoleCommand)
.de(de_AssumeRoleCommand)
.build() {
}
@@ -0,0 +1,23 @@
import { getEndpointPlugin } from "@smithy/middleware-endpoint";
import { getSerdePlugin } from "@smithy/middleware-serde";
import { Command as $Command } from "@smithy/smithy-client";
import { commonParams } from "../endpoint/EndpointParameters";
import { AssumeRoleWithWebIdentityRequestFilterSensitiveLog, AssumeRoleWithWebIdentityResponseFilterSensitiveLog, } from "../models/models_0";
import { de_AssumeRoleWithWebIdentityCommand, se_AssumeRoleWithWebIdentityCommand } from "../protocols/Aws_query";
export { $Command };
export class AssumeRoleWithWebIdentityCommand extends $Command
.classBuilder()
.ep(commonParams)
.m(function (Command, cs, config, o) {
return [
getSerdePlugin(config, this.serialize, this.deserialize),
getEndpointPlugin(config, Command.getEndpointParameterInstructions()),
];
})
.s("AWSSecurityTokenServiceV20110615", "AssumeRoleWithWebIdentity", {})
.n("STSClient", "AssumeRoleWithWebIdentityCommand")
.f(AssumeRoleWithWebIdentityRequestFilterSensitiveLog, AssumeRoleWithWebIdentityResponseFilterSensitiveLog)
.ser(se_AssumeRoleWithWebIdentityCommand)
.de(de_AssumeRoleWithWebIdentityCommand)
.build() {
}
@@ -0,0 +1,2 @@
export * from "./AssumeRoleCommand";
export * from "./AssumeRoleWithWebIdentityCommand";
@@ -0,0 +1,22 @@
import { getDefaultRoleAssumer as StsGetDefaultRoleAssumer, getDefaultRoleAssumerWithWebIdentity as StsGetDefaultRoleAssumerWithWebIdentity, } from "./defaultStsRoleAssumers";
import { STSClient } from "./STSClient";
const getCustomizableStsClientCtor = (baseCtor, customizations) => {
if (!customizations)
return baseCtor;
else
return class CustomizableSTSClient extends baseCtor {
constructor(config) {
super(config);
for (const customization of customizations) {
this.middlewareStack.use(customization);
}
}
};
};
export const getDefaultRoleAssumer = (stsOptions = {}, stsPlugins) => StsGetDefaultRoleAssumer(stsOptions, getCustomizableStsClientCtor(STSClient, stsPlugins));
export const getDefaultRoleAssumerWithWebIdentity = (stsOptions = {}, stsPlugins) => StsGetDefaultRoleAssumerWithWebIdentity(stsOptions, getCustomizableStsClientCtor(STSClient, stsPlugins));
export const decorateDefaultCredentialProvider = (provider) => (input) => provider({
roleAssumer: getDefaultRoleAssumer(input),
roleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity(input),
...input,
});
@@ -0,0 +1,95 @@
import { setCredentialFeature } from "@aws-sdk/core/client";
import { AssumeRoleCommand } from "./commands/AssumeRoleCommand";
import { AssumeRoleWithWebIdentityCommand, } from "./commands/AssumeRoleWithWebIdentityCommand";
const ASSUME_ROLE_DEFAULT_REGION = "us-east-1";
const getAccountIdFromAssumedRoleUser = (assumedRoleUser) => {
if (typeof assumedRoleUser?.Arn === "string") {
const arnComponents = assumedRoleUser.Arn.split(":");
if (arnComponents.length > 4 && arnComponents[4] !== "") {
return arnComponents[4];
}
}
return undefined;
};
const resolveRegion = async (_region, _parentRegion, credentialProviderLogger) => {
const region = typeof _region === "function" ? await _region() : _region;
const parentRegion = typeof _parentRegion === "function" ? await _parentRegion() : _parentRegion;
credentialProviderLogger?.debug?.("@aws-sdk/client-sts::resolveRegion", "accepting first of:", `${region} (provider)`, `${parentRegion} (parent client)`, `${ASSUME_ROLE_DEFAULT_REGION} (STS default)`);
return region ?? parentRegion ?? ASSUME_ROLE_DEFAULT_REGION;
};
export const getDefaultRoleAssumer = (stsOptions, STSClient) => {
let stsClient;
let closureSourceCreds;
return async (sourceCreds, params) => {
closureSourceCreds = sourceCreds;
if (!stsClient) {
const { logger = stsOptions?.parentClientConfig?.logger, region, requestHandler = stsOptions?.parentClientConfig?.requestHandler, credentialProviderLogger, } = stsOptions;
const resolvedRegion = await resolveRegion(region, stsOptions?.parentClientConfig?.region, credentialProviderLogger);
const isCompatibleRequestHandler = !isH2(requestHandler);
stsClient = new STSClient({
profile: stsOptions?.parentClientConfig?.profile,
credentialDefaultProvider: () => async () => closureSourceCreds,
region: resolvedRegion,
requestHandler: isCompatibleRequestHandler ? requestHandler : undefined,
logger: logger,
});
}
const { Credentials, AssumedRoleUser } = await stsClient.send(new AssumeRoleCommand(params));
if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
throw new Error(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`);
}
const accountId = getAccountIdFromAssumedRoleUser(AssumedRoleUser);
const credentials = {
accessKeyId: Credentials.AccessKeyId,
secretAccessKey: Credentials.SecretAccessKey,
sessionToken: Credentials.SessionToken,
expiration: Credentials.Expiration,
...(Credentials.CredentialScope && { credentialScope: Credentials.CredentialScope }),
...(accountId && { accountId }),
};
setCredentialFeature(credentials, "CREDENTIALS_STS_ASSUME_ROLE", "i");
return credentials;
};
};
export const getDefaultRoleAssumerWithWebIdentity = (stsOptions, STSClient) => {
let stsClient;
return async (params) => {
if (!stsClient) {
const { logger = stsOptions?.parentClientConfig?.logger, region, requestHandler = stsOptions?.parentClientConfig?.requestHandler, credentialProviderLogger, } = stsOptions;
const resolvedRegion = await resolveRegion(region, stsOptions?.parentClientConfig?.region, credentialProviderLogger);
const isCompatibleRequestHandler = !isH2(requestHandler);
stsClient = new STSClient({
profile: stsOptions?.parentClientConfig?.profile,
region: resolvedRegion,
requestHandler: isCompatibleRequestHandler ? requestHandler : undefined,
logger: logger,
});
}
const { Credentials, AssumedRoleUser } = await stsClient.send(new AssumeRoleWithWebIdentityCommand(params));
if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
throw new Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${params.RoleArn}`);
}
const accountId = getAccountIdFromAssumedRoleUser(AssumedRoleUser);
const credentials = {
accessKeyId: Credentials.AccessKeyId,
secretAccessKey: Credentials.SecretAccessKey,
sessionToken: Credentials.SessionToken,
expiration: Credentials.Expiration,
...(Credentials.CredentialScope && { credentialScope: Credentials.CredentialScope }),
...(accountId && { accountId }),
};
if (accountId) {
setCredentialFeature(credentials, "RESOLVED_ACCOUNT_ID", "T");
}
setCredentialFeature(credentials, "CREDENTIALS_STS_ASSUME_ROLE_WEB_ID", "k");
return credentials;
};
};
export const decorateDefaultCredentialProvider = (provider) => (input) => provider({
roleAssumer: getDefaultRoleAssumer(input, input.stsClientCtor),
roleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity(input, input.stsClientCtor),
...input,
});
const isH2 = (requestHandler) => {
return requestHandler?.metadata?.handlerProtocol === "h2";
};
@@ -0,0 +1,15 @@
export const resolveClientEndpointParameters = (options) => {
return Object.assign(options, {
useDualstackEndpoint: options.useDualstackEndpoint ?? false,
useFipsEndpoint: options.useFipsEndpoint ?? false,
useGlobalEndpoint: options.useGlobalEndpoint ?? false,
defaultSigningName: "sts",
});
};
export const commonParams = {
UseGlobalEndpoint: { type: "builtInParams", name: "useGlobalEndpoint" },
UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
Endpoint: { type: "builtInParams", name: "endpoint" },
Region: { type: "builtInParams", name: "region" },
UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
};
@@ -0,0 +1,14 @@
import { awsEndpointFunctions } from "@aws-sdk/util-endpoints";
import { customEndpointFunctions, EndpointCache, resolveEndpoint } from "@smithy/util-endpoints";
import { ruleSet } from "./ruleset";
const cache = new EndpointCache({
size: 50,
params: ["Endpoint", "Region", "UseDualStack", "UseFIPS", "UseGlobalEndpoint"],
});
export const defaultEndpointResolver = (endpointParams, context = {}) => {
return cache.get(endpointParams, () => resolveEndpoint(ruleSet, {
endpointParams: endpointParams,
logger: context.logger,
}));
};
customEndpointFunctions.aws = awsEndpointFunctions;
@@ -0,0 +1,4 @@
const F = "required", G = "type", H = "fn", I = "argv", J = "ref";
const a = false, b = true, c = "booleanEquals", d = "stringEquals", e = "sigv4", f = "sts", g = "us-east-1", h = "endpoint", i = "https://sts.{Region}.{PartitionResult#dnsSuffix}", j = "tree", k = "error", l = "getAttr", m = { [F]: false, [G]: "String" }, n = { [F]: true, "default": false, [G]: "Boolean" }, o = { [J]: "Endpoint" }, p = { [H]: "isSet", [I]: [{ [J]: "Region" }] }, q = { [J]: "Region" }, r = { [H]: "aws.partition", [I]: [q], "assign": "PartitionResult" }, s = { [J]: "UseFIPS" }, t = { [J]: "UseDualStack" }, u = { "url": "https://sts.amazonaws.com", "properties": { "authSchemes": [{ "name": e, "signingName": f, "signingRegion": g }] }, "headers": {} }, v = {}, w = { "conditions": [{ [H]: d, [I]: [q, "aws-global"] }], [h]: u, [G]: h }, x = { [H]: c, [I]: [s, true] }, y = { [H]: c, [I]: [t, true] }, z = { [H]: l, [I]: [{ [J]: "PartitionResult" }, "supportsFIPS"] }, A = { [J]: "PartitionResult" }, B = { [H]: c, [I]: [true, { [H]: l, [I]: [A, "supportsDualStack"] }] }, C = [{ [H]: "isSet", [I]: [o] }], D = [x], E = [y];
const _data = { version: "1.0", parameters: { Region: m, UseDualStack: n, UseFIPS: n, Endpoint: m, UseGlobalEndpoint: n }, rules: [{ conditions: [{ [H]: c, [I]: [{ [J]: "UseGlobalEndpoint" }, b] }, { [H]: "not", [I]: C }, p, r, { [H]: c, [I]: [s, a] }, { [H]: c, [I]: [t, a] }], rules: [{ conditions: [{ [H]: d, [I]: [q, "ap-northeast-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "ap-south-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "ap-southeast-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "ap-southeast-2"] }], endpoint: u, [G]: h }, w, { conditions: [{ [H]: d, [I]: [q, "ca-central-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-central-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-north-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-west-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-west-2"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "eu-west-3"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "sa-east-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, g] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "us-east-2"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "us-west-1"] }], endpoint: u, [G]: h }, { conditions: [{ [H]: d, [I]: [q, "us-west-2"] }], endpoint: u, [G]: h }, { endpoint: { url: i, properties: { authSchemes: [{ name: e, signingName: f, signingRegion: "{Region}" }] }, headers: v }, [G]: h }], [G]: j }, { conditions: C, rules: [{ conditions: D, error: "Invalid Configuration: FIPS and custom endpoint are not supported", [G]: k }, { conditions: E, error: "Invalid Configuration: Dualstack and custom endpoint are not supported", [G]: k }, { endpoint: { url: o, properties: v, headers: v }, [G]: h }], [G]: j }, { conditions: [p], rules: [{ conditions: [r], rules: [{ conditions: [x, y], rules: [{ conditions: [{ [H]: c, [I]: [b, z] }, B], rules: [{ endpoint: { url: "https://sts-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", properties: v, headers: v }, [G]: h }], [G]: j }, { error: "FIPS and DualStack are enabled, but this partition does not support one or both", [G]: k }], [G]: j }, { conditions: D, rules: [{ conditions: [{ [H]: c, [I]: [z, b] }], rules: [{ conditions: [{ [H]: d, [I]: [{ [H]: l, [I]: [A, "name"] }, "aws-us-gov"] }], endpoint: { url: "https://sts.{Region}.amazonaws.com", properties: v, headers: v }, [G]: h }, { endpoint: { url: "https://sts-fips.{Region}.{PartitionResult#dnsSuffix}", properties: v, headers: v }, [G]: h }], [G]: j }, { error: "FIPS is enabled but this partition does not support FIPS", [G]: k }], [G]: j }, { conditions: E, rules: [{ conditions: [B], rules: [{ endpoint: { url: "https://sts.{Region}.{PartitionResult#dualStackDnsSuffix}", properties: v, headers: v }, [G]: h }], [G]: j }, { error: "DualStack is enabled but this partition does not support DualStack", [G]: k }], [G]: j }, w, { endpoint: { url: i, properties: v, headers: v }, [G]: h }], [G]: j }], [G]: j }, { error: "Invalid Configuration: Missing Region", [G]: k }] };
export const ruleSet = _data;
@@ -0,0 +1 @@
export {};
@@ -0,0 +1,6 @@
export * from "./STSClient";
export * from "./STS";
export * from "./commands";
export * from "./models";
export * from "./defaultRoleAssumers";
export { STSServiceException } from "./models/STSServiceException";
@@ -0,0 +1,8 @@
import { ServiceException as __ServiceException, } from "@smithy/smithy-client";
export { __ServiceException };
export class STSServiceException extends __ServiceException {
constructor(options) {
super(options);
Object.setPrototypeOf(this, STSServiceException.prototype);
}
}
@@ -0,0 +1 @@
export * from "./models_0";
@@ -0,0 +1,102 @@
import { SENSITIVE_STRING } from "@smithy/smithy-client";
import { STSServiceException as __BaseException } from "./STSServiceException";
export const CredentialsFilterSensitiveLog = (obj) => ({
...obj,
...(obj.SecretAccessKey && { SecretAccessKey: SENSITIVE_STRING }),
});
export const AssumeRoleResponseFilterSensitiveLog = (obj) => ({
...obj,
...(obj.Credentials && { Credentials: CredentialsFilterSensitiveLog(obj.Credentials) }),
});
export class ExpiredTokenException extends __BaseException {
name = "ExpiredTokenException";
$fault = "client";
constructor(opts) {
super({
name: "ExpiredTokenException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, ExpiredTokenException.prototype);
}
}
export class MalformedPolicyDocumentException extends __BaseException {
name = "MalformedPolicyDocumentException";
$fault = "client";
constructor(opts) {
super({
name: "MalformedPolicyDocumentException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, MalformedPolicyDocumentException.prototype);
}
}
export class PackedPolicyTooLargeException extends __BaseException {
name = "PackedPolicyTooLargeException";
$fault = "client";
constructor(opts) {
super({
name: "PackedPolicyTooLargeException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, PackedPolicyTooLargeException.prototype);
}
}
export class RegionDisabledException extends __BaseException {
name = "RegionDisabledException";
$fault = "client";
constructor(opts) {
super({
name: "RegionDisabledException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, RegionDisabledException.prototype);
}
}
export class IDPRejectedClaimException extends __BaseException {
name = "IDPRejectedClaimException";
$fault = "client";
constructor(opts) {
super({
name: "IDPRejectedClaimException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, IDPRejectedClaimException.prototype);
}
}
export class InvalidIdentityTokenException extends __BaseException {
name = "InvalidIdentityTokenException";
$fault = "client";
constructor(opts) {
super({
name: "InvalidIdentityTokenException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, InvalidIdentityTokenException.prototype);
}
}
export const AssumeRoleWithWebIdentityRequestFilterSensitiveLog = (obj) => ({
...obj,
...(obj.WebIdentityToken && { WebIdentityToken: SENSITIVE_STRING }),
});
export const AssumeRoleWithWebIdentityResponseFilterSensitiveLog = (obj) => ({
...obj,
...(obj.Credentials && { Credentials: CredentialsFilterSensitiveLog(obj.Credentials) }),
});
export class IDPCommunicationErrorException extends __BaseException {
name = "IDPCommunicationErrorException";
$fault = "client";
constructor(opts) {
super({
name: "IDPCommunicationErrorException",
$fault: "client",
...opts,
});
Object.setPrototypeOf(this, IDPCommunicationErrorException.prototype);
}
}
@@ -0,0 +1,528 @@
import { parseXmlBody as parseBody, parseXmlErrorBody as parseErrorBody } from "@aws-sdk/core";
import { HttpRequest as __HttpRequest } from "@smithy/protocol-http";
import { collectBody, decorateServiceException as __decorateServiceException, expectNonNull as __expectNonNull, expectString as __expectString, extendedEncodeURIComponent as __extendedEncodeURIComponent, parseRfc3339DateTimeWithOffset as __parseRfc3339DateTimeWithOffset, strictParseInt32 as __strictParseInt32, withBaseException, } from "@smithy/smithy-client";
import { ExpiredTokenException, IDPCommunicationErrorException, IDPRejectedClaimException, InvalidIdentityTokenException, MalformedPolicyDocumentException, PackedPolicyTooLargeException, RegionDisabledException, } from "../models/models_0";
import { STSServiceException as __BaseException } from "../models/STSServiceException";
export const se_AssumeRoleCommand = async (input, context) => {
const headers = SHARED_HEADERS;
let body;
body = buildFormUrlencodedString({
...se_AssumeRoleRequest(input, context),
[_A]: _AR,
[_V]: _,
});
return buildHttpRpcRequest(context, headers, "/", undefined, body);
};
export const se_AssumeRoleWithWebIdentityCommand = async (input, context) => {
const headers = SHARED_HEADERS;
let body;
body = buildFormUrlencodedString({
...se_AssumeRoleWithWebIdentityRequest(input, context),
[_A]: _ARWWI,
[_V]: _,
});
return buildHttpRpcRequest(context, headers, "/", undefined, body);
};
export const de_AssumeRoleCommand = async (output, context) => {
if (output.statusCode >= 300) {
return de_CommandError(output, context);
}
const data = await parseBody(output.body, context);
let contents = {};
contents = de_AssumeRoleResponse(data.AssumeRoleResult, context);
const response = {
$metadata: deserializeMetadata(output),
...contents,
};
return response;
};
export const de_AssumeRoleWithWebIdentityCommand = async (output, context) => {
if (output.statusCode >= 300) {
return de_CommandError(output, context);
}
const data = await parseBody(output.body, context);
let contents = {};
contents = de_AssumeRoleWithWebIdentityResponse(data.AssumeRoleWithWebIdentityResult, context);
const response = {
$metadata: deserializeMetadata(output),
...contents,
};
return response;
};
const de_CommandError = async (output, context) => {
const parsedOutput = {
...output,
body: await parseErrorBody(output.body, context),
};
const errorCode = loadQueryErrorCode(output, parsedOutput.body);
switch (errorCode) {
case "ExpiredTokenException":
case "com.amazonaws.sts#ExpiredTokenException":
throw await de_ExpiredTokenExceptionRes(parsedOutput, context);
case "MalformedPolicyDocument":
case "com.amazonaws.sts#MalformedPolicyDocumentException":
throw await de_MalformedPolicyDocumentExceptionRes(parsedOutput, context);
case "PackedPolicyTooLarge":
case "com.amazonaws.sts#PackedPolicyTooLargeException":
throw await de_PackedPolicyTooLargeExceptionRes(parsedOutput, context);
case "RegionDisabledException":
case "com.amazonaws.sts#RegionDisabledException":
throw await de_RegionDisabledExceptionRes(parsedOutput, context);
case "IDPCommunicationError":
case "com.amazonaws.sts#IDPCommunicationErrorException":
throw await de_IDPCommunicationErrorExceptionRes(parsedOutput, context);
case "IDPRejectedClaim":
case "com.amazonaws.sts#IDPRejectedClaimException":
throw await de_IDPRejectedClaimExceptionRes(parsedOutput, context);
case "InvalidIdentityToken":
case "com.amazonaws.sts#InvalidIdentityTokenException":
throw await de_InvalidIdentityTokenExceptionRes(parsedOutput, context);
default:
const parsedBody = parsedOutput.body;
return throwDefaultError({
output,
parsedBody: parsedBody.Error,
errorCode,
});
}
};
const de_ExpiredTokenExceptionRes = async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_ExpiredTokenException(body.Error, context);
const exception = new ExpiredTokenException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized,
});
return __decorateServiceException(exception, body);
};
const de_IDPCommunicationErrorExceptionRes = async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_IDPCommunicationErrorException(body.Error, context);
const exception = new IDPCommunicationErrorException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized,
});
return __decorateServiceException(exception, body);
};
const de_IDPRejectedClaimExceptionRes = async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_IDPRejectedClaimException(body.Error, context);
const exception = new IDPRejectedClaimException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized,
});
return __decorateServiceException(exception, body);
};
const de_InvalidIdentityTokenExceptionRes = async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_InvalidIdentityTokenException(body.Error, context);
const exception = new InvalidIdentityTokenException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized,
});
return __decorateServiceException(exception, body);
};
const de_MalformedPolicyDocumentExceptionRes = async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_MalformedPolicyDocumentException(body.Error, context);
const exception = new MalformedPolicyDocumentException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized,
});
return __decorateServiceException(exception, body);
};
const de_PackedPolicyTooLargeExceptionRes = async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_PackedPolicyTooLargeException(body.Error, context);
const exception = new PackedPolicyTooLargeException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized,
});
return __decorateServiceException(exception, body);
};
const de_RegionDisabledExceptionRes = async (parsedOutput, context) => {
const body = parsedOutput.body;
const deserialized = de_RegionDisabledException(body.Error, context);
const exception = new RegionDisabledException({
$metadata: deserializeMetadata(parsedOutput),
...deserialized,
});
return __decorateServiceException(exception, body);
};
const se_AssumeRoleRequest = (input, context) => {
const entries = {};
if (input[_RA] != null) {
entries[_RA] = input[_RA];
}
if (input[_RSN] != null) {
entries[_RSN] = input[_RSN];
}
if (input[_PA] != null) {
const memberEntries = se_policyDescriptorListType(input[_PA], context);
if (input[_PA]?.length === 0) {
entries.PolicyArns = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `PolicyArns.${key}`;
entries[loc] = value;
});
}
if (input[_P] != null) {
entries[_P] = input[_P];
}
if (input[_DS] != null) {
entries[_DS] = input[_DS];
}
if (input[_T] != null) {
const memberEntries = se_tagListType(input[_T], context);
if (input[_T]?.length === 0) {
entries.Tags = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `Tags.${key}`;
entries[loc] = value;
});
}
if (input[_TTK] != null) {
const memberEntries = se_tagKeyListType(input[_TTK], context);
if (input[_TTK]?.length === 0) {
entries.TransitiveTagKeys = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `TransitiveTagKeys.${key}`;
entries[loc] = value;
});
}
if (input[_EI] != null) {
entries[_EI] = input[_EI];
}
if (input[_SN] != null) {
entries[_SN] = input[_SN];
}
if (input[_TC] != null) {
entries[_TC] = input[_TC];
}
if (input[_SI] != null) {
entries[_SI] = input[_SI];
}
if (input[_PC] != null) {
const memberEntries = se_ProvidedContextsListType(input[_PC], context);
if (input[_PC]?.length === 0) {
entries.ProvidedContexts = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `ProvidedContexts.${key}`;
entries[loc] = value;
});
}
return entries;
};
const se_AssumeRoleWithWebIdentityRequest = (input, context) => {
const entries = {};
if (input[_RA] != null) {
entries[_RA] = input[_RA];
}
if (input[_RSN] != null) {
entries[_RSN] = input[_RSN];
}
if (input[_WIT] != null) {
entries[_WIT] = input[_WIT];
}
if (input[_PI] != null) {
entries[_PI] = input[_PI];
}
if (input[_PA] != null) {
const memberEntries = se_policyDescriptorListType(input[_PA], context);
if (input[_PA]?.length === 0) {
entries.PolicyArns = [];
}
Object.entries(memberEntries).forEach(([key, value]) => {
const loc = `PolicyArns.${key}`;
entries[loc] = value;
});
}
if (input[_P] != null) {
entries[_P] = input[_P];
}
if (input[_DS] != null) {
entries[_DS] = input[_DS];
}
return entries;
};
const se_policyDescriptorListType = (input, context) => {
const entries = {};
let counter = 1;
for (const entry of input) {
if (entry === null) {
continue;
}
const memberEntries = se_PolicyDescriptorType(entry, context);
Object.entries(memberEntries).forEach(([key, value]) => {
entries[`member.${counter}.${key}`] = value;
});
counter++;
}
return entries;
};
const se_PolicyDescriptorType = (input, context) => {
const entries = {};
if (input[_a] != null) {
entries[_a] = input[_a];
}
return entries;
};
const se_ProvidedContext = (input, context) => {
const entries = {};
if (input[_PAr] != null) {
entries[_PAr] = input[_PAr];
}
if (input[_CA] != null) {
entries[_CA] = input[_CA];
}
return entries;
};
const se_ProvidedContextsListType = (input, context) => {
const entries = {};
let counter = 1;
for (const entry of input) {
if (entry === null) {
continue;
}
const memberEntries = se_ProvidedContext(entry, context);
Object.entries(memberEntries).forEach(([key, value]) => {
entries[`member.${counter}.${key}`] = value;
});
counter++;
}
return entries;
};
const se_Tag = (input, context) => {
const entries = {};
if (input[_K] != null) {
entries[_K] = input[_K];
}
if (input[_Va] != null) {
entries[_Va] = input[_Va];
}
return entries;
};
const se_tagKeyListType = (input, context) => {
const entries = {};
let counter = 1;
for (const entry of input) {
if (entry === null) {
continue;
}
entries[`member.${counter}`] = entry;
counter++;
}
return entries;
};
const se_tagListType = (input, context) => {
const entries = {};
let counter = 1;
for (const entry of input) {
if (entry === null) {
continue;
}
const memberEntries = se_Tag(entry, context);
Object.entries(memberEntries).forEach(([key, value]) => {
entries[`member.${counter}.${key}`] = value;
});
counter++;
}
return entries;
};
const de_AssumedRoleUser = (output, context) => {
const contents = {};
if (output[_ARI] != null) {
contents[_ARI] = __expectString(output[_ARI]);
}
if (output[_Ar] != null) {
contents[_Ar] = __expectString(output[_Ar]);
}
return contents;
};
const de_AssumeRoleResponse = (output, context) => {
const contents = {};
if (output[_C] != null) {
contents[_C] = de_Credentials(output[_C], context);
}
if (output[_ARU] != null) {
contents[_ARU] = de_AssumedRoleUser(output[_ARU], context);
}
if (output[_PPS] != null) {
contents[_PPS] = __strictParseInt32(output[_PPS]);
}
if (output[_SI] != null) {
contents[_SI] = __expectString(output[_SI]);
}
return contents;
};
const de_AssumeRoleWithWebIdentityResponse = (output, context) => {
const contents = {};
if (output[_C] != null) {
contents[_C] = de_Credentials(output[_C], context);
}
if (output[_SFWIT] != null) {
contents[_SFWIT] = __expectString(output[_SFWIT]);
}
if (output[_ARU] != null) {
contents[_ARU] = de_AssumedRoleUser(output[_ARU], context);
}
if (output[_PPS] != null) {
contents[_PPS] = __strictParseInt32(output[_PPS]);
}
if (output[_Pr] != null) {
contents[_Pr] = __expectString(output[_Pr]);
}
if (output[_Au] != null) {
contents[_Au] = __expectString(output[_Au]);
}
if (output[_SI] != null) {
contents[_SI] = __expectString(output[_SI]);
}
return contents;
};
const de_Credentials = (output, context) => {
const contents = {};
if (output[_AKI] != null) {
contents[_AKI] = __expectString(output[_AKI]);
}
if (output[_SAK] != null) {
contents[_SAK] = __expectString(output[_SAK]);
}
if (output[_ST] != null) {
contents[_ST] = __expectString(output[_ST]);
}
if (output[_E] != null) {
contents[_E] = __expectNonNull(__parseRfc3339DateTimeWithOffset(output[_E]));
}
return contents;
};
const de_ExpiredTokenException = (output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = __expectString(output[_m]);
}
return contents;
};
const de_IDPCommunicationErrorException = (output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = __expectString(output[_m]);
}
return contents;
};
const de_IDPRejectedClaimException = (output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = __expectString(output[_m]);
}
return contents;
};
const de_InvalidIdentityTokenException = (output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = __expectString(output[_m]);
}
return contents;
};
const de_MalformedPolicyDocumentException = (output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = __expectString(output[_m]);
}
return contents;
};
const de_PackedPolicyTooLargeException = (output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = __expectString(output[_m]);
}
return contents;
};
const de_RegionDisabledException = (output, context) => {
const contents = {};
if (output[_m] != null) {
contents[_m] = __expectString(output[_m]);
}
return contents;
};
const deserializeMetadata = (output) => ({
httpStatusCode: output.statusCode,
requestId: output.headers["x-amzn-requestid"] ?? output.headers["x-amzn-request-id"] ?? output.headers["x-amz-request-id"],
extendedRequestId: output.headers["x-amz-id-2"],
cfId: output.headers["x-amz-cf-id"],
});
const collectBodyString = (streamBody, context) => collectBody(streamBody, context).then((body) => context.utf8Encoder(body));
const throwDefaultError = withBaseException(__BaseException);
const buildHttpRpcRequest = async (context, headers, path, resolvedHostname, body) => {
const { hostname, protocol = "https", port, path: basePath } = await context.endpoint();
const contents = {
protocol,
hostname,
port,
method: "POST",
path: basePath.endsWith("/") ? basePath.slice(0, -1) + path : basePath + path,
headers,
};
if (resolvedHostname !== undefined) {
contents.hostname = resolvedHostname;
}
if (body !== undefined) {
contents.body = body;
}
return new __HttpRequest(contents);
};
const SHARED_HEADERS = {
"content-type": "application/x-www-form-urlencoded",
};
const _ = "2011-06-15";
const _A = "Action";
const _AKI = "AccessKeyId";
const _AR = "AssumeRole";
const _ARI = "AssumedRoleId";
const _ARU = "AssumedRoleUser";
const _ARWWI = "AssumeRoleWithWebIdentity";
const _Ar = "Arn";
const _Au = "Audience";
const _C = "Credentials";
const _CA = "ContextAssertion";
const _DS = "DurationSeconds";
const _E = "Expiration";
const _EI = "ExternalId";
const _K = "Key";
const _P = "Policy";
const _PA = "PolicyArns";
const _PAr = "ProviderArn";
const _PC = "ProvidedContexts";
const _PI = "ProviderId";
const _PPS = "PackedPolicySize";
const _Pr = "Provider";
const _RA = "RoleArn";
const _RSN = "RoleSessionName";
const _SAK = "SecretAccessKey";
const _SFWIT = "SubjectFromWebIdentityToken";
const _SI = "SourceIdentity";
const _SN = "SerialNumber";
const _ST = "SessionToken";
const _T = "Tags";
const _TC = "TokenCode";
const _TTK = "TransitiveTagKeys";
const _V = "Version";
const _Va = "Value";
const _WIT = "WebIdentityToken";
const _a = "arn";
const _m = "message";
const buildFormUrlencodedString = (formEntries) => Object.entries(formEntries)
.map(([key, value]) => __extendedEncodeURIComponent(key) + "=" + __extendedEncodeURIComponent(value))
.join("&");
const loadQueryErrorCode = (output, data) => {
if (data.Error?.Code !== undefined) {
return data.Error.Code;
}
if (output.statusCode == 404) {
return "NotFound";
}
};
@@ -0,0 +1,34 @@
import packageInfo from "../../../package.json";
import { Sha256 } from "@aws-crypto/sha256-browser";
import { createDefaultUserAgentProvider } from "@aws-sdk/util-user-agent-browser";
import { DEFAULT_USE_DUALSTACK_ENDPOINT, DEFAULT_USE_FIPS_ENDPOINT } from "@smithy/config-resolver";
import { FetchHttpHandler as RequestHandler, streamCollector } from "@smithy/fetch-http-handler";
import { invalidProvider } from "@smithy/invalid-dependency";
import { calculateBodyLength } from "@smithy/util-body-length-browser";
import { DEFAULT_MAX_ATTEMPTS, DEFAULT_RETRY_MODE } from "@smithy/util-retry";
import { getRuntimeConfig as getSharedRuntimeConfig } from "./runtimeConfig.shared";
import { loadConfigsForDefaultMode } from "@smithy/smithy-client";
import { resolveDefaultsModeConfig } from "@smithy/util-defaults-mode-browser";
export const getRuntimeConfig = (config) => {
const defaultsMode = resolveDefaultsModeConfig(config);
const defaultConfigProvider = () => defaultsMode().then(loadConfigsForDefaultMode);
const clientSharedValues = getSharedRuntimeConfig(config);
return {
...clientSharedValues,
...config,
runtime: "browser",
defaultsMode,
bodyLengthChecker: config?.bodyLengthChecker ?? calculateBodyLength,
credentialDefaultProvider: config?.credentialDefaultProvider ?? ((_) => () => Promise.reject(new Error("Credential is missing"))),
defaultUserAgentProvider: config?.defaultUserAgentProvider ??
createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }),
maxAttempts: config?.maxAttempts ?? DEFAULT_MAX_ATTEMPTS,
region: config?.region ?? invalidProvider("Region is missing"),
requestHandler: RequestHandler.create(config?.requestHandler ?? defaultConfigProvider),
retryMode: config?.retryMode ?? (async () => (await defaultConfigProvider()).retryMode || DEFAULT_RETRY_MODE),
sha256: config?.sha256 ?? Sha256,
streamCollector: config?.streamCollector ?? streamCollector,
useDualstackEndpoint: config?.useDualstackEndpoint ?? (() => Promise.resolve(DEFAULT_USE_DUALSTACK_ENDPOINT)),
useFipsEndpoint: config?.useFipsEndpoint ?? (() => Promise.resolve(DEFAULT_USE_FIPS_ENDPOINT)),
};
};
@@ -0,0 +1,63 @@
import packageInfo from "../../../package.json";
import { AwsSdkSigV4Signer, NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, emitWarningIfUnsupportedVersion as awsCheckVersion, } from "@aws-sdk/core";
import { NODE_APP_ID_CONFIG_OPTIONS, createDefaultUserAgentProvider } from "@aws-sdk/util-user-agent-node";
import { NODE_REGION_CONFIG_FILE_OPTIONS, NODE_REGION_CONFIG_OPTIONS, NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, } from "@smithy/config-resolver";
import { NoAuthSigner } from "@smithy/core";
import { Hash } from "@smithy/hash-node";
import { NODE_MAX_ATTEMPT_CONFIG_OPTIONS, NODE_RETRY_MODE_CONFIG_OPTIONS } from "@smithy/middleware-retry";
import { loadConfig as loadNodeConfig } from "@smithy/node-config-provider";
import { NodeHttpHandler as RequestHandler, streamCollector } from "@smithy/node-http-handler";
import { calculateBodyLength } from "@smithy/util-body-length-node";
import { DEFAULT_RETRY_MODE } from "@smithy/util-retry";
import { getRuntimeConfig as getSharedRuntimeConfig } from "./runtimeConfig.shared";
import { loadConfigsForDefaultMode } from "@smithy/smithy-client";
import { resolveDefaultsModeConfig } from "@smithy/util-defaults-mode-node";
import { emitWarningIfUnsupportedVersion } from "@smithy/smithy-client";
export const getRuntimeConfig = (config) => {
emitWarningIfUnsupportedVersion(process.version);
const defaultsMode = resolveDefaultsModeConfig(config);
const defaultConfigProvider = () => defaultsMode().then(loadConfigsForDefaultMode);
const clientSharedValues = getSharedRuntimeConfig(config);
awsCheckVersion(process.version);
const loaderConfig = {
profile: config?.profile,
logger: clientSharedValues.logger,
};
return {
...clientSharedValues,
...config,
runtime: "node",
defaultsMode,
authSchemePreference: config?.authSchemePreference ?? loadNodeConfig(NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
bodyLengthChecker: config?.bodyLengthChecker ?? calculateBodyLength,
defaultUserAgentProvider: config?.defaultUserAgentProvider ??
createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }),
httpAuthSchemes: config?.httpAuthSchemes ?? [
{
schemeId: "aws.auth#sigv4",
identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4") ||
(async (idProps) => await config.credentialDefaultProvider(idProps?.__config || {})()),
signer: new AwsSdkSigV4Signer(),
},
{
schemeId: "smithy.api#noAuth",
identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
signer: new NoAuthSigner(),
},
],
maxAttempts: config?.maxAttempts ?? loadNodeConfig(NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
region: config?.region ??
loadNodeConfig(NODE_REGION_CONFIG_OPTIONS, { ...NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
requestHandler: RequestHandler.create(config?.requestHandler ?? defaultConfigProvider),
retryMode: config?.retryMode ??
loadNodeConfig({
...NODE_RETRY_MODE_CONFIG_OPTIONS,
default: async () => (await defaultConfigProvider()).retryMode || DEFAULT_RETRY_MODE,
}, config),
sha256: config?.sha256 ?? Hash.bind(null, "sha256"),
streamCollector: config?.streamCollector ?? streamCollector,
useDualstackEndpoint: config?.useDualstackEndpoint ?? loadNodeConfig(NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
useFipsEndpoint: config?.useFipsEndpoint ?? loadNodeConfig(NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
userAgentAppId: config?.userAgentAppId ?? loadNodeConfig(NODE_APP_ID_CONFIG_OPTIONS, loaderConfig),
};
};
@@ -0,0 +1,11 @@
import { Sha256 } from "@aws-crypto/sha256-js";
import { getRuntimeConfig as getBrowserRuntimeConfig } from "./runtimeConfig.browser";
export const getRuntimeConfig = (config) => {
const browserDefaults = getBrowserRuntimeConfig(config);
return {
...browserDefaults,
...config,
runtime: "react-native",
sha256: config?.sha256 ?? Sha256,
};
};
@@ -0,0 +1,36 @@
import { AwsSdkSigV4Signer } from "@aws-sdk/core";
import { NoAuthSigner } from "@smithy/core";
import { NoOpLogger } from "@smithy/smithy-client";
import { parseUrl } from "@smithy/url-parser";
import { fromBase64, toBase64 } from "@smithy/util-base64";
import { fromUtf8, toUtf8 } from "@smithy/util-utf8";
import { defaultSTSHttpAuthSchemeProvider } from "./auth/httpAuthSchemeProvider";
import { defaultEndpointResolver } from "./endpoint/endpointResolver";
export const getRuntimeConfig = (config) => {
return {
apiVersion: "2011-06-15",
base64Decoder: config?.base64Decoder ?? fromBase64,
base64Encoder: config?.base64Encoder ?? toBase64,
disableHostPrefix: config?.disableHostPrefix ?? false,
endpointProvider: config?.endpointProvider ?? defaultEndpointResolver,
extensions: config?.extensions ?? [],
httpAuthSchemeProvider: config?.httpAuthSchemeProvider ?? defaultSTSHttpAuthSchemeProvider,
httpAuthSchemes: config?.httpAuthSchemes ?? [
{
schemeId: "aws.auth#sigv4",
identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4"),
signer: new AwsSdkSigV4Signer(),
},
{
schemeId: "smithy.api#noAuth",
identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
signer: new NoAuthSigner(),
},
],
logger: config?.logger ?? new NoOpLogger(),
serviceId: config?.serviceId ?? "STS",
urlParser: config?.urlParser ?? parseUrl,
utf8Decoder: config?.utf8Decoder ?? fromUtf8,
utf8Encoder: config?.utf8Encoder ?? toUtf8,
};
};
@@ -0,0 +1,9 @@
import { getAwsRegionExtensionConfiguration, resolveAwsRegionExtensionConfiguration, } from "@aws-sdk/region-config-resolver";
import { getHttpHandlerExtensionConfiguration, resolveHttpHandlerRuntimeConfig } from "@smithy/protocol-http";
import { getDefaultExtensionConfiguration, resolveDefaultRuntimeConfig } from "@smithy/smithy-client";
import { getHttpAuthExtensionConfiguration, resolveHttpAuthRuntimeConfig } from "./auth/httpAuthExtensionConfiguration";
export const resolveRuntimeExtensions = (runtimeConfig, extensions) => {
const extensionConfiguration = Object.assign(getAwsRegionExtensionConfiguration(runtimeConfig), getDefaultExtensionConfiguration(runtimeConfig), getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration(runtimeConfig));
extensions.forEach((extension) => extension.configure(extensionConfiguration));
return Object.assign(runtimeConfig, resolveAwsRegionExtensionConfiguration(extensionConfiguration), resolveDefaultRuntimeConfig(extensionConfiguration), resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig(extensionConfiguration));
};
@@ -0,0 +1,7 @@
/**
* This package exports nothing at the root.
* Use submodules e.g. \@aws-sdk/nested-clients/client-sts.
*
* @internal
*/
export {};
@@ -0,0 +1,55 @@
import { HttpHandlerOptions as __HttpHandlerOptions } from "@smithy/types";
import { CreateTokenCommandInput, CreateTokenCommandOutput } from "./commands/CreateTokenCommand";
import { SSOOIDCClient } from "./SSOOIDCClient";
export interface SSOOIDC {
/**
* @see {@link CreateTokenCommand}
*/
createToken(args: CreateTokenCommandInput, options?: __HttpHandlerOptions): Promise<CreateTokenCommandOutput>;
createToken(args: CreateTokenCommandInput, cb: (err: any, data?: CreateTokenCommandOutput) => void): void;
createToken(args: CreateTokenCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: CreateTokenCommandOutput) => void): void;
}
/**
* <p>IAM Identity Center OpenID Connect (OIDC) is a web service that enables a client (such as CLI or a
* native application) to register with IAM Identity Center. The service also enables the client to fetch the
* users access token upon successful authentication and authorization with IAM Identity Center.</p>
* <p>
* <b>API namespaces</b>
* </p>
* <p>IAM Identity Center uses the <code>sso</code> and <code>identitystore</code> API namespaces. IAM Identity Center
* OpenID Connect uses the <code>sso-oidc</code> namespace.</p>
* <p>
* <b>Considerations for using this guide</b>
* </p>
* <p>Before you begin using this guide, we recommend that you first review the following
* important information about how the IAM Identity Center OIDC service works.</p>
* <ul>
* <li>
* <p>The IAM Identity Center OIDC service currently implements only the portions of the OAuth 2.0 Device
* Authorization Grant standard (<a href="https://tools.ietf.org/html/rfc8628">https://tools.ietf.org/html/rfc8628</a>) that are necessary to enable single
* sign-on authentication with the CLI. </p>
* </li>
* <li>
* <p>With older versions of the CLI, the service only emits OIDC access tokens, so to
* obtain a new token, users must explicitly re-authenticate. To access the OIDC flow that
* supports token refresh and doesnt require re-authentication, update to the latest CLI
* version (1.27.10 for CLI V1 and 2.9.0 for CLI V2) with support for OIDC token refresh
* and configurable IAM Identity Center session durations. For more information, see <a href="https://docs.aws.amazon.com/singlesignon/latest/userguide/configure-user-session.html">Configure Amazon Web Services access portal session duration </a>. </p>
* </li>
* <li>
* <p>The access tokens provided by this service grant access to all Amazon Web Services account
* entitlements assigned to an IAM Identity Center user, not just a particular application.</p>
* </li>
* <li>
* <p>The documentation in this guide does not describe the mechanism to convert the access
* token into Amazon Web Services Auth (“sigv4”) credentials for use with IAM-protected Amazon Web Services service
* endpoints. For more information, see <a href="https://docs.aws.amazon.com/singlesignon/latest/PortalAPIReference/API_GetRoleCredentials.html">GetRoleCredentials</a> in the <i>IAM Identity Center Portal API Reference
* Guide</i>.</p>
* </li>
* </ul>
* <p>For general information about IAM Identity Center, see <a href="https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html">What is
* IAM Identity Center?</a> in the <i>IAM Identity Center User Guide</i>.</p>
* @public
*/
export declare class SSOOIDC extends SSOOIDCClient implements SSOOIDC {
}
@@ -0,0 +1,220 @@
import { HostHeaderInputConfig, HostHeaderResolvedConfig } from "@aws-sdk/middleware-host-header";
import { UserAgentInputConfig, UserAgentResolvedConfig } from "@aws-sdk/middleware-user-agent";
import { RegionInputConfig, RegionResolvedConfig } from "@smithy/config-resolver";
import { EndpointInputConfig, EndpointResolvedConfig } from "@smithy/middleware-endpoint";
import { RetryInputConfig, RetryResolvedConfig } from "@smithy/middleware-retry";
import { HttpHandlerUserInput as __HttpHandlerUserInput } from "@smithy/protocol-http";
import { Client as __Client, DefaultsMode as __DefaultsMode, SmithyConfiguration as __SmithyConfiguration, SmithyResolvedConfiguration as __SmithyResolvedConfiguration } from "@smithy/smithy-client";
import { BodyLengthCalculator as __BodyLengthCalculator, CheckOptionalClientConfig as __CheckOptionalClientConfig, ChecksumConstructor as __ChecksumConstructor, Decoder as __Decoder, Encoder as __Encoder, HashConstructor as __HashConstructor, HttpHandlerOptions as __HttpHandlerOptions, Logger as __Logger, Provider as __Provider, Provider, StreamCollector as __StreamCollector, UrlParser as __UrlParser, UserAgent as __UserAgent } from "@smithy/types";
import { HttpAuthSchemeInputConfig, HttpAuthSchemeResolvedConfig } from "./auth/httpAuthSchemeProvider";
import { CreateTokenCommandInput, CreateTokenCommandOutput } from "./commands/CreateTokenCommand";
import { ClientInputEndpointParameters, ClientResolvedEndpointParameters, EndpointParameters } from "./endpoint/EndpointParameters";
import { RuntimeExtension, RuntimeExtensionsConfig } from "./runtimeExtensions";
export { __Client };
/**
* @public
*/
export type ServiceInputTypes = CreateTokenCommandInput;
/**
* @public
*/
export type ServiceOutputTypes = CreateTokenCommandOutput;
/**
* @public
*/
export interface ClientDefaults extends Partial<__SmithyConfiguration<__HttpHandlerOptions>> {
/**
* The HTTP handler to use or its constructor options. Fetch in browser and Https in Nodejs.
*/
requestHandler?: __HttpHandlerUserInput;
/**
* A constructor for a class implementing the {@link @smithy/types#ChecksumConstructor} interface
* that computes the SHA-256 HMAC or checksum of a string or binary buffer.
* @internal
*/
sha256?: __ChecksumConstructor | __HashConstructor;
/**
* The function that will be used to convert strings into HTTP endpoints.
* @internal
*/
urlParser?: __UrlParser;
/**
* A function that can calculate the length of a request body.
* @internal
*/
bodyLengthChecker?: __BodyLengthCalculator;
/**
* A function that converts a stream into an array of bytes.
* @internal
*/
streamCollector?: __StreamCollector;
/**
* The function that will be used to convert a base64-encoded string to a byte array.
* @internal
*/
base64Decoder?: __Decoder;
/**
* The function that will be used to convert binary data to a base64-encoded string.
* @internal
*/
base64Encoder?: __Encoder;
/**
* The function that will be used to convert a UTF8-encoded string to a byte array.
* @internal
*/
utf8Decoder?: __Decoder;
/**
* The function that will be used to convert binary data to a UTF-8 encoded string.
* @internal
*/
utf8Encoder?: __Encoder;
/**
* The runtime environment.
* @internal
*/
runtime?: string;
/**
* Disable dynamically changing the endpoint of the client based on the hostPrefix
* trait of an operation.
*/
disableHostPrefix?: boolean;
/**
* Unique service identifier.
* @internal
*/
serviceId?: string;
/**
* Enables IPv6/IPv4 dualstack endpoint.
*/
useDualstackEndpoint?: boolean | __Provider<boolean>;
/**
* Enables FIPS compatible endpoints.
*/
useFipsEndpoint?: boolean | __Provider<boolean>;
/**
* The AWS region to which this client will send requests
*/
region?: string | __Provider<string>;
/**
* Setting a client profile is similar to setting a value for the
* AWS_PROFILE environment variable. Setting a profile on a client
* in code only affects the single client instance, unlike AWS_PROFILE.
*
* When set, and only for environments where an AWS configuration
* file exists, fields configurable by this file will be retrieved
* from the specified profile within that file.
* Conflicting code configuration and environment variables will
* still have higher priority.
*
* For client credential resolution that involves checking the AWS
* configuration file, the client's profile (this value) will be
* used unless a different profile is set in the credential
* provider options.
*
*/
profile?: string;
/**
* The provider populating default tracking information to be sent with `user-agent`, `x-amz-user-agent` header
* @internal
*/
defaultUserAgentProvider?: Provider<__UserAgent>;
/**
* Value for how many times a request will be made at most in case of retry.
*/
maxAttempts?: number | __Provider<number>;
/**
* Specifies which retry algorithm to use.
* @see https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-smithy-util-retry/Enum/RETRY_MODES/
*
*/
retryMode?: string | __Provider<string>;
/**
* Optional logger for logging debug/info/warn/error.
*/
logger?: __Logger;
/**
* Optional extensions
*/
extensions?: RuntimeExtension[];
/**
* The {@link @smithy/smithy-client#DefaultsMode} that will be used to determine how certain default configuration options are resolved in the SDK.
*/
defaultsMode?: __DefaultsMode | __Provider<__DefaultsMode>;
}
/**
* @public
*/
export type SSOOIDCClientConfigType = Partial<__SmithyConfiguration<__HttpHandlerOptions>> & ClientDefaults & UserAgentInputConfig & RetryInputConfig & RegionInputConfig & HostHeaderInputConfig & EndpointInputConfig<EndpointParameters> & HttpAuthSchemeInputConfig & ClientInputEndpointParameters;
/**
* @public
*
* The configuration interface of SSOOIDCClient class constructor that set the region, credentials and other options.
*/
export interface SSOOIDCClientConfig extends SSOOIDCClientConfigType {
}
/**
* @public
*/
export type SSOOIDCClientResolvedConfigType = __SmithyResolvedConfiguration<__HttpHandlerOptions> & Required<ClientDefaults> & RuntimeExtensionsConfig & UserAgentResolvedConfig & RetryResolvedConfig & RegionResolvedConfig & HostHeaderResolvedConfig & EndpointResolvedConfig<EndpointParameters> & HttpAuthSchemeResolvedConfig & ClientResolvedEndpointParameters;
/**
* @public
*
* The resolved configuration interface of SSOOIDCClient class. This is resolved and normalized from the {@link SSOOIDCClientConfig | constructor configuration interface}.
*/
export interface SSOOIDCClientResolvedConfig extends SSOOIDCClientResolvedConfigType {
}
/**
* <p>IAM Identity Center OpenID Connect (OIDC) is a web service that enables a client (such as CLI or a
* native application) to register with IAM Identity Center. The service also enables the client to fetch the
* users access token upon successful authentication and authorization with IAM Identity Center.</p>
* <p>
* <b>API namespaces</b>
* </p>
* <p>IAM Identity Center uses the <code>sso</code> and <code>identitystore</code> API namespaces. IAM Identity Center
* OpenID Connect uses the <code>sso-oidc</code> namespace.</p>
* <p>
* <b>Considerations for using this guide</b>
* </p>
* <p>Before you begin using this guide, we recommend that you first review the following
* important information about how the IAM Identity Center OIDC service works.</p>
* <ul>
* <li>
* <p>The IAM Identity Center OIDC service currently implements only the portions of the OAuth 2.0 Device
* Authorization Grant standard (<a href="https://tools.ietf.org/html/rfc8628">https://tools.ietf.org/html/rfc8628</a>) that are necessary to enable single
* sign-on authentication with the CLI. </p>
* </li>
* <li>
* <p>With older versions of the CLI, the service only emits OIDC access tokens, so to
* obtain a new token, users must explicitly re-authenticate. To access the OIDC flow that
* supports token refresh and doesnt require re-authentication, update to the latest CLI
* version (1.27.10 for CLI V1 and 2.9.0 for CLI V2) with support for OIDC token refresh
* and configurable IAM Identity Center session durations. For more information, see <a href="https://docs.aws.amazon.com/singlesignon/latest/userguide/configure-user-session.html">Configure Amazon Web Services access portal session duration </a>. </p>
* </li>
* <li>
* <p>The access tokens provided by this service grant access to all Amazon Web Services account
* entitlements assigned to an IAM Identity Center user, not just a particular application.</p>
* </li>
* <li>
* <p>The documentation in this guide does not describe the mechanism to convert the access
* token into Amazon Web Services Auth (“sigv4”) credentials for use with IAM-protected Amazon Web Services service
* endpoints. For more information, see <a href="https://docs.aws.amazon.com/singlesignon/latest/PortalAPIReference/API_GetRoleCredentials.html">GetRoleCredentials</a> in the <i>IAM Identity Center Portal API Reference
* Guide</i>.</p>
* </li>
* </ul>
* <p>For general information about IAM Identity Center, see <a href="https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html">What is
* IAM Identity Center?</a> in the <i>IAM Identity Center User Guide</i>.</p>
* @public
*/
export declare class SSOOIDCClient extends __Client<__HttpHandlerOptions, ServiceInputTypes, ServiceOutputTypes, SSOOIDCClientResolvedConfig> {
/**
* The resolved configuration of SSOOIDCClient class. This is resolved and normalized from the {@link SSOOIDCClientConfig | constructor configuration interface}.
*/
readonly config: SSOOIDCClientResolvedConfig;
constructor(...[configuration]: __CheckOptionalClientConfig<SSOOIDCClientConfig>);
/**
* Destroy underlying resources, like sockets. It's usually not necessary to do this.
* However in Node.js, it's best to explicitly shut down the client's agent when it is no longer needed.
* Otherwise, sockets might stay open for quite a long time before the server terminates them.
*/
destroy(): void;
}
@@ -0,0 +1,29 @@
import { AwsCredentialIdentity, AwsCredentialIdentityProvider, HttpAuthScheme } from "@smithy/types";
import { SSOOIDCHttpAuthSchemeProvider } from "./httpAuthSchemeProvider";
/**
* @internal
*/
export interface HttpAuthExtensionConfiguration {
setHttpAuthScheme(httpAuthScheme: HttpAuthScheme): void;
httpAuthSchemes(): HttpAuthScheme[];
setHttpAuthSchemeProvider(httpAuthSchemeProvider: SSOOIDCHttpAuthSchemeProvider): void;
httpAuthSchemeProvider(): SSOOIDCHttpAuthSchemeProvider;
setCredentials(credentials: AwsCredentialIdentity | AwsCredentialIdentityProvider): void;
credentials(): AwsCredentialIdentity | AwsCredentialIdentityProvider | undefined;
}
/**
* @internal
*/
export type HttpAuthRuntimeConfig = Partial<{
httpAuthSchemes: HttpAuthScheme[];
httpAuthSchemeProvider: SSOOIDCHttpAuthSchemeProvider;
credentials: AwsCredentialIdentity | AwsCredentialIdentityProvider;
}>;
/**
* @internal
*/
export declare const getHttpAuthExtensionConfiguration: (runtimeConfig: HttpAuthRuntimeConfig) => HttpAuthExtensionConfiguration;
/**
* @internal
*/
export declare const resolveHttpAuthRuntimeConfig: (config: HttpAuthExtensionConfiguration) => HttpAuthRuntimeConfig;
@@ -0,0 +1,75 @@
import { AwsSdkSigV4AuthInputConfig, AwsSdkSigV4AuthResolvedConfig, AwsSdkSigV4PreviouslyResolved } from "@aws-sdk/core";
import { HandlerExecutionContext, HttpAuthScheme, HttpAuthSchemeParameters, HttpAuthSchemeParametersProvider, HttpAuthSchemeProvider, Provider } from "@smithy/types";
import { SSOOIDCClientResolvedConfig } from "../SSOOIDCClient";
/**
* @internal
*/
export interface SSOOIDCHttpAuthSchemeParameters extends HttpAuthSchemeParameters {
region?: string;
}
/**
* @internal
*/
export interface SSOOIDCHttpAuthSchemeParametersProvider extends HttpAuthSchemeParametersProvider<SSOOIDCClientResolvedConfig, HandlerExecutionContext, SSOOIDCHttpAuthSchemeParameters, object> {
}
/**
* @internal
*/
export declare const defaultSSOOIDCHttpAuthSchemeParametersProvider: (config: SSOOIDCClientResolvedConfig, context: HandlerExecutionContext, input: object) => Promise<SSOOIDCHttpAuthSchemeParameters>;
/**
* @internal
*/
export interface SSOOIDCHttpAuthSchemeProvider extends HttpAuthSchemeProvider<SSOOIDCHttpAuthSchemeParameters> {
}
/**
* @internal
*/
export declare const defaultSSOOIDCHttpAuthSchemeProvider: SSOOIDCHttpAuthSchemeProvider;
/**
* @internal
*/
export interface HttpAuthSchemeInputConfig extends AwsSdkSigV4AuthInputConfig {
/**
* A comma-separated list of case-sensitive auth scheme names.
* An auth scheme name is a fully qualified auth scheme ID with the namespace prefix trimmed.
* For example, the auth scheme with ID aws.auth#sigv4 is named sigv4.
* @public
*/
authSchemePreference?: string[] | Provider<string[]>;
/**
* Configuration of HttpAuthSchemes for a client which provides default identity providers and signers per auth scheme.
* @internal
*/
httpAuthSchemes?: HttpAuthScheme[];
/**
* Configuration of an HttpAuthSchemeProvider for a client which resolves which HttpAuthScheme to use.
* @internal
*/
httpAuthSchemeProvider?: SSOOIDCHttpAuthSchemeProvider;
}
/**
* @internal
*/
export interface HttpAuthSchemeResolvedConfig extends AwsSdkSigV4AuthResolvedConfig {
/**
* A comma-separated list of case-sensitive auth scheme names.
* An auth scheme name is a fully qualified auth scheme ID with the namespace prefix trimmed.
* For example, the auth scheme with ID aws.auth#sigv4 is named sigv4.
* @public
*/
readonly authSchemePreference: Provider<string[]>;
/**
* Configuration of HttpAuthSchemes for a client which provides default identity providers and signers per auth scheme.
* @internal
*/
readonly httpAuthSchemes: HttpAuthScheme[];
/**
* Configuration of an HttpAuthSchemeProvider for a client which resolves which HttpAuthScheme to use.
* @internal
*/
readonly httpAuthSchemeProvider: SSOOIDCHttpAuthSchemeProvider;
}
/**
* @internal
*/
export declare const resolveHttpAuthSchemeConfig: <T>(config: T & HttpAuthSchemeInputConfig & AwsSdkSigV4PreviouslyResolved) => T & HttpAuthSchemeResolvedConfig;
@@ -0,0 +1,174 @@
import { Command as $Command } from "@smithy/smithy-client";
import { MetadataBearer as __MetadataBearer } from "@smithy/types";
import { CreateTokenRequest, CreateTokenResponse } from "../models/models_0";
import { SSOOIDCClientResolvedConfig } from "../SSOOIDCClient";
/**
* @public
*/
export type { __MetadataBearer };
export { $Command };
/**
* @public
*
* The input for {@link CreateTokenCommand}.
*/
export interface CreateTokenCommandInput extends CreateTokenRequest {
}
/**
* @public
*
* The output of {@link CreateTokenCommand}.
*/
export interface CreateTokenCommandOutput extends CreateTokenResponse, __MetadataBearer {
}
declare const CreateTokenCommand_base: {
new (input: CreateTokenCommandInput): import("@smithy/smithy-client").CommandImpl<CreateTokenCommandInput, CreateTokenCommandOutput, SSOOIDCClientResolvedConfig, CreateTokenCommandInput, CreateTokenCommandOutput>;
new (input: CreateTokenCommandInput): import("@smithy/smithy-client").CommandImpl<CreateTokenCommandInput, CreateTokenCommandOutput, SSOOIDCClientResolvedConfig, CreateTokenCommandInput, CreateTokenCommandOutput>;
getEndpointParameterInstructions(): import("@smithy/middleware-endpoint").EndpointParameterInstructions;
};
/**
* <p>Creates and returns access and refresh tokens for clients that are authenticated using
* client secrets. The access token can be used to fetch short-lived credentials for the assigned
* AWS accounts or to access application APIs using <code>bearer</code> authentication.</p>
* @example
* Use a bare-bones client and the command you need to make an API call.
* ```javascript
* import { SSOOIDCClient, CreateTokenCommand } from "@aws-sdk/client-sso-oidc"; // ES Modules import
* // const { SSOOIDCClient, CreateTokenCommand } = require("@aws-sdk/client-sso-oidc"); // CommonJS import
* const client = new SSOOIDCClient(config);
* const input = { // CreateTokenRequest
* clientId: "STRING_VALUE", // required
* clientSecret: "STRING_VALUE", // required
* grantType: "STRING_VALUE", // required
* deviceCode: "STRING_VALUE",
* code: "STRING_VALUE",
* refreshToken: "STRING_VALUE",
* scope: [ // Scopes
* "STRING_VALUE",
* ],
* redirectUri: "STRING_VALUE",
* codeVerifier: "STRING_VALUE",
* };
* const command = new CreateTokenCommand(input);
* const response = await client.send(command);
* // { // CreateTokenResponse
* // accessToken: "STRING_VALUE",
* // tokenType: "STRING_VALUE",
* // expiresIn: Number("int"),
* // refreshToken: "STRING_VALUE",
* // idToken: "STRING_VALUE",
* // };
*
* ```
*
* @param CreateTokenCommandInput - {@link CreateTokenCommandInput}
* @returns {@link CreateTokenCommandOutput}
* @see {@link CreateTokenCommandInput} for command's `input` shape.
* @see {@link CreateTokenCommandOutput} for command's `response` shape.
* @see {@link SSOOIDCClientResolvedConfig | config} for SSOOIDCClient's `config` shape.
*
* @throws {@link AccessDeniedException} (client fault)
* <p>You do not have sufficient access to perform this action.</p>
*
* @throws {@link AuthorizationPendingException} (client fault)
* <p>Indicates that a request to authorize a client with an access user session token is
* pending.</p>
*
* @throws {@link ExpiredTokenException} (client fault)
* <p>Indicates that the token issued by the service is expired and is no longer valid.</p>
*
* @throws {@link InternalServerException} (server fault)
* <p>Indicates that an error from the service occurred while trying to process a
* request.</p>
*
* @throws {@link InvalidClientException} (client fault)
* <p>Indicates that the <code>clientId</code> or <code>clientSecret</code> in the request is
* invalid. For example, this can occur when a client sends an incorrect <code>clientId</code> or
* an expired <code>clientSecret</code>.</p>
*
* @throws {@link InvalidGrantException} (client fault)
* <p>Indicates that a request contains an invalid grant. This can occur if a client makes a
* <a>CreateToken</a> request with an invalid grant type.</p>
*
* @throws {@link InvalidRequestException} (client fault)
* <p>Indicates that something is wrong with the input to the request. For example, a required
* parameter might be missing or out of range.</p>
*
* @throws {@link InvalidScopeException} (client fault)
* <p>Indicates that the scope provided in the request is invalid.</p>
*
* @throws {@link SlowDownException} (client fault)
* <p>Indicates that the client is making the request too frequently and is more than the
* service can handle. </p>
*
* @throws {@link UnauthorizedClientException} (client fault)
* <p>Indicates that the client is not currently authorized to make the request. This can happen
* when a <code>clientId</code> is not issued for a public client.</p>
*
* @throws {@link UnsupportedGrantTypeException} (client fault)
* <p>Indicates that the grant type in the request is not supported by the service.</p>
*
* @throws {@link SSOOIDCServiceException}
* <p>Base exception class for all service exceptions from SSOOIDC service.</p>
*
*
* @example Call OAuth/OIDC /token endpoint for Device Code grant with Secret authentication
* ```javascript
* //
* const input = {
* clientId: "_yzkThXVzLWVhc3QtMQEXAMPLECLIENTID",
* clientSecret: "VERYLONGSECRETeyJraWQiOiJrZXktMTU2NDAyODA5OSIsImFsZyI6IkhTMzg0In0",
* deviceCode: "yJraWQiOiJrZXktMTU2Njk2ODA4OCIsImFsZyI6IkhTMzIn0EXAMPLEDEVICECODE",
* grantType: "urn:ietf:params:oauth:grant-type:device-code"
* };
* const command = new CreateTokenCommand(input);
* const response = await client.send(command);
* /* response is
* {
* accessToken: "aoal-YigITUDiNX1xZwOMXM5MxOWDL0E0jg9P6_C_jKQPxS_SKCP6f0kh1Up4g7TtvQqkMnD-GJiU_S1gvug6SrggAkc0:MGYCMQD3IatVjV7jAJU91kK3PkS/SfA2wtgWzOgZWDOR7sDGN9t0phCZz5It/aes/3C1Zj0CMQCKWOgRaiz6AIhza3DSXQNMLjRKXC8F8ceCsHlgYLMZ7hZidEXAMPLEACCESSTOKEN",
* expiresIn: 1579729529,
* refreshToken: "aorvJYubGpU6i91YnH7Mfo-AT2fIVa1zCfA_Rvq9yjVKIP3onFmmykuQ7E93y2I-9Nyj-A_sVvMufaLNL0bqnDRtgAkc0:MGUCMFrRsktMRVlWaOR70XGMFGLL0SlcCw4DiYveIiOVx1uK9BbD0gvAddsW3UTLozXKMgIxAJ3qxUvjpnlLIOaaKOoa/FuNgqJVvr9GMwDtnAtlh9iZzAkEXAMPLEREFRESHTOKEN",
* tokenType: "Bearer"
* }
* *\/
* ```
*
* @example Call OAuth/OIDC /token endpoint for Refresh Token grant with Secret authentication
* ```javascript
* //
* const input = {
* clientId: "_yzkThXVzLWVhc3QtMQEXAMPLECLIENTID",
* clientSecret: "VERYLONGSECRETeyJraWQiOiJrZXktMTU2NDAyODA5OSIsImFsZyI6IkhTMzg0In0",
* grantType: "refresh_token",
* refreshToken: "aorvJYubGpU6i91YnH7Mfo-AT2fIVa1zCfA_Rvq9yjVKIP3onFmmykuQ7E93y2I-9Nyj-A_sVvMufaLNL0bqnDRtgAkc0:MGUCMFrRsktMRVlWaOR70XGMFGLL0SlcCw4DiYveIiOVx1uK9BbD0gvAddsW3UTLozXKMgIxAJ3qxUvjpnlLIOaaKOoa/FuNgqJVvr9GMwDtnAtlh9iZzAkEXAMPLEREFRESHTOKEN",
* scope: [
* "codewhisperer:completions"
* ]
* };
* const command = new CreateTokenCommand(input);
* const response = await client.send(command);
* /* response is
* {
* accessToken: "aoal-YigITUDiNX1xZwOMXM5MxOWDL0E0jg9P6_C_jKQPxS_SKCP6f0kh1Up4g7TtvQqkMnD-GJiU_S1gvug6SrggAkc0:MGYCMQD3IatVjV7jAJU91kK3PkS/SfA2wtgWzOgZWDOR7sDGN9t0phCZz5It/aes/3C1Zj0CMQCKWOgRaiz6AIhza3DSXQNMLjRKXC8F8ceCsHlgYLMZ7hZidEXAMPLEACCESSTOKEN",
* expiresIn: 1579729529,
* refreshToken: "aorvJYubGpU6i91YnH7Mfo-AT2fIVa1zCfA_Rvq9yjVKIP3onFmmykuQ7E93y2I-9Nyj-A_sVvMufaLNL0bqnDRtgAkc0:MGUCMFrRsktMRVlWaOR70XGMFGLL0SlcCw4DiYveIiOVx1uK9BbD0gvAddsW3UTLozXKMgIxAJ3qxUvjpnlLIOaaKOoa/FuNgqJVvr9GMwDtnAtlh9iZzAkEXAMPLEREFRESHTOKEN",
* tokenType: "Bearer"
* }
* *\/
* ```
*
* @public
*/
export declare class CreateTokenCommand extends CreateTokenCommand_base {
/** @internal type navigation helper, not in runtime. */
protected static __types: {
api: {
input: CreateTokenRequest;
output: CreateTokenResponse;
};
sdk: {
input: CreateTokenCommandInput;
output: CreateTokenCommandOutput;
};
};
}
@@ -0,0 +1 @@
export * from "./CreateTokenCommand";
@@ -0,0 +1,38 @@
import { Endpoint, EndpointParameters as __EndpointParameters, EndpointV2, Provider } from "@smithy/types";
/**
* @public
*/
export interface ClientInputEndpointParameters {
region?: string | undefined | Provider<string | undefined>;
useDualstackEndpoint?: boolean | undefined | Provider<boolean | undefined>;
useFipsEndpoint?: boolean | undefined | Provider<boolean | undefined>;
endpoint?: string | Provider<string> | Endpoint | Provider<Endpoint> | EndpointV2 | Provider<EndpointV2>;
}
export type ClientResolvedEndpointParameters = Omit<ClientInputEndpointParameters, "endpoint"> & {
defaultSigningName: string;
};
export declare const resolveClientEndpointParameters: <T>(options: T & ClientInputEndpointParameters) => T & ClientResolvedEndpointParameters;
export declare const commonParams: {
readonly UseFIPS: {
readonly type: "builtInParams";
readonly name: "useFipsEndpoint";
};
readonly Endpoint: {
readonly type: "builtInParams";
readonly name: "endpoint";
};
readonly Region: {
readonly type: "builtInParams";
readonly name: "region";
};
readonly UseDualStack: {
readonly type: "builtInParams";
readonly name: "useDualstackEndpoint";
};
};
export interface EndpointParameters extends __EndpointParameters {
Region?: string | undefined;
UseDualStack?: boolean | undefined;
UseFIPS?: boolean | undefined;
Endpoint?: string | undefined;
}
@@ -0,0 +1,5 @@
import { EndpointV2, Logger } from "@smithy/types";
import { EndpointParameters } from "./EndpointParameters";
export declare const defaultEndpointResolver: (endpointParams: EndpointParameters, context?: {
logger?: Logger;
}) => EndpointV2;
@@ -0,0 +1,2 @@
import { RuleSetObject } from "@smithy/types";
export declare const ruleSet: RuleSetObject;
@@ -0,0 +1,9 @@
import { AwsRegionExtensionConfiguration } from "@aws-sdk/types";
import { HttpHandlerExtensionConfiguration } from "@smithy/protocol-http";
import { DefaultExtensionConfiguration } from "@smithy/types";
import { HttpAuthExtensionConfiguration } from "./auth/httpAuthExtensionConfiguration";
/**
* @internal
*/
export interface SSOOIDCExtensionConfiguration extends HttpHandlerExtensionConfiguration, DefaultExtensionConfiguration, AwsRegionExtensionConfiguration, HttpAuthExtensionConfiguration {
}
@@ -0,0 +1,51 @@
/**
* <p>IAM Identity Center OpenID Connect (OIDC) is a web service that enables a client (such as CLI or a
* native application) to register with IAM Identity Center. The service also enables the client to fetch the
* users access token upon successful authentication and authorization with IAM Identity Center.</p>
* <p>
* <b>API namespaces</b>
* </p>
* <p>IAM Identity Center uses the <code>sso</code> and <code>identitystore</code> API namespaces. IAM Identity Center
* OpenID Connect uses the <code>sso-oidc</code> namespace.</p>
* <p>
* <b>Considerations for using this guide</b>
* </p>
* <p>Before you begin using this guide, we recommend that you first review the following
* important information about how the IAM Identity Center OIDC service works.</p>
* <ul>
* <li>
* <p>The IAM Identity Center OIDC service currently implements only the portions of the OAuth 2.0 Device
* Authorization Grant standard (<a href="https://tools.ietf.org/html/rfc8628">https://tools.ietf.org/html/rfc8628</a>) that are necessary to enable single
* sign-on authentication with the CLI. </p>
* </li>
* <li>
* <p>With older versions of the CLI, the service only emits OIDC access tokens, so to
* obtain a new token, users must explicitly re-authenticate. To access the OIDC flow that
* supports token refresh and doesnt require re-authentication, update to the latest CLI
* version (1.27.10 for CLI V1 and 2.9.0 for CLI V2) with support for OIDC token refresh
* and configurable IAM Identity Center session durations. For more information, see <a href="https://docs.aws.amazon.com/singlesignon/latest/userguide/configure-user-session.html">Configure Amazon Web Services access portal session duration </a>. </p>
* </li>
* <li>
* <p>The access tokens provided by this service grant access to all Amazon Web Services account
* entitlements assigned to an IAM Identity Center user, not just a particular application.</p>
* </li>
* <li>
* <p>The documentation in this guide does not describe the mechanism to convert the access
* token into Amazon Web Services Auth (“sigv4”) credentials for use with IAM-protected Amazon Web Services service
* endpoints. For more information, see <a href="https://docs.aws.amazon.com/singlesignon/latest/PortalAPIReference/API_GetRoleCredentials.html">GetRoleCredentials</a> in the <i>IAM Identity Center Portal API Reference
* Guide</i>.</p>
* </li>
* </ul>
* <p>For general information about IAM Identity Center, see <a href="https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html">What is
* IAM Identity Center?</a> in the <i>IAM Identity Center User Guide</i>.</p>
*
* @packageDocumentation
*/
export * from "./SSOOIDCClient";
export * from "./SSOOIDC";
export { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
export type { RuntimeExtension } from "./runtimeExtensions";
export type { SSOOIDCExtensionConfiguration } from "./extensionConfiguration";
export * from "./commands";
export * from "./models";
export { SSOOIDCServiceException } from "./models/SSOOIDCServiceException";
@@ -0,0 +1,14 @@
import { ServiceException as __ServiceException, ServiceExceptionOptions as __ServiceExceptionOptions } from "@smithy/smithy-client";
export type { __ServiceExceptionOptions };
export { __ServiceException };
/**
* @public
*
* Base exception class for all service exceptions from SSOOIDC service.
*/
export declare class SSOOIDCServiceException extends __ServiceException {
/**
* @internal
*/
constructor(options: __ServiceExceptionOptions);
}
@@ -0,0 +1 @@
export * from "./models_0";
@@ -0,0 +1,387 @@
import { ExceptionOptionType as __ExceptionOptionType } from "@smithy/smithy-client";
import { SSOOIDCServiceException as __BaseException } from "./SSOOIDCServiceException";
/**
* <p>You do not have sufficient access to perform this action.</p>
* @public
*/
export declare class AccessDeniedException extends __BaseException {
readonly name: "AccessDeniedException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be <code>access_denied</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<AccessDeniedException, __BaseException>);
}
/**
* <p>Indicates that a request to authorize a client with an access user session token is
* pending.</p>
* @public
*/
export declare class AuthorizationPendingException extends __BaseException {
readonly name: "AuthorizationPendingException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be
* <code>authorization_pending</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<AuthorizationPendingException, __BaseException>);
}
/**
* @public
*/
export interface CreateTokenRequest {
/**
* <p>The unique identifier string for the client or application. This value comes from the
* result of the <a>RegisterClient</a> API.</p>
* @public
*/
clientId: string | undefined;
/**
* <p>A secret string generated for the client. This value should come from the persisted result
* of the <a>RegisterClient</a> API.</p>
* @public
*/
clientSecret: string | undefined;
/**
* <p>Supports the following OAuth grant types: Authorization Code, Device Code, and Refresh
* Token. Specify one of the following values, depending on the grant type that you want:</p>
* <p>* Authorization Code - <code>authorization_code</code>
* </p>
* <p>* Device Code - <code>urn:ietf:params:oauth:grant-type:device_code</code>
* </p>
* <p>* Refresh Token - <code>refresh_token</code>
* </p>
* @public
*/
grantType: string | undefined;
/**
* <p>Used only when calling this API for the Device Code grant type. This short-lived code is
* used to identify this authorization request. This comes from the result of the <a>StartDeviceAuthorization</a> API.</p>
* @public
*/
deviceCode?: string | undefined;
/**
* <p>Used only when calling this API for the Authorization Code grant type. The short-lived
* code is used to identify this authorization request.</p>
* @public
*/
code?: string | undefined;
/**
* <p>Used only when calling this API for the Refresh Token grant type. This token is used to
* refresh short-lived tokens, such as the access token, that might expire.</p>
* <p>For more information about the features and limitations of the current IAM Identity Center OIDC
* implementation, see <i>Considerations for Using this Guide</i> in the <a href="https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/Welcome.html">IAM Identity Center
* OIDC API Reference</a>.</p>
* @public
*/
refreshToken?: string | undefined;
/**
* <p>The list of scopes for which authorization is requested. The access token that is issued
* is limited to the scopes that are granted. If this value is not specified, IAM Identity Center authorizes
* all scopes that are configured for the client during the call to <a>RegisterClient</a>.</p>
* @public
*/
scope?: string[] | undefined;
/**
* <p>Used only when calling this API for the Authorization Code grant type. This value
* specifies the location of the client or application that has registered to receive the
* authorization code.</p>
* @public
*/
redirectUri?: string | undefined;
/**
* <p>Used only when calling this API for the Authorization Code grant type. This value is
* generated by the client and presented to validate the original code challenge value the client
* passed at authorization time.</p>
* @public
*/
codeVerifier?: string | undefined;
}
/**
* @internal
*/
export declare const CreateTokenRequestFilterSensitiveLog: (obj: CreateTokenRequest) => any;
/**
* @public
*/
export interface CreateTokenResponse {
/**
* <p>A bearer token to access Amazon Web Services accounts and applications assigned to a user.</p>
* @public
*/
accessToken?: string | undefined;
/**
* <p>Used to notify the client that the returned token is an access token. The supported token
* type is <code>Bearer</code>.</p>
* @public
*/
tokenType?: string | undefined;
/**
* <p>Indicates the time in seconds when an access token will expire.</p>
* @public
*/
expiresIn?: number | undefined;
/**
* <p>A token that, if present, can be used to refresh a previously issued access token that
* might have expired.</p>
* <p>For more information about the features and limitations of the current IAM Identity Center OIDC
* implementation, see <i>Considerations for Using this Guide</i> in the <a href="https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/Welcome.html">IAM Identity Center
* OIDC API Reference</a>.</p>
* @public
*/
refreshToken?: string | undefined;
/**
* <p>The <code>idToken</code> is not implemented or supported. For more information about the
* features and limitations of the current IAM Identity Center OIDC implementation, see
* <i>Considerations for Using this Guide</i> in the <a href="https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/Welcome.html">IAM Identity Center
* OIDC API Reference</a>.</p>
* <p>A JSON Web Token (JWT) that identifies who is associated with the issued access token.
* </p>
* @public
*/
idToken?: string | undefined;
}
/**
* @internal
*/
export declare const CreateTokenResponseFilterSensitiveLog: (obj: CreateTokenResponse) => any;
/**
* <p>Indicates that the token issued by the service is expired and is no longer valid.</p>
* @public
*/
export declare class ExpiredTokenException extends __BaseException {
readonly name: "ExpiredTokenException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be <code>expired_token</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<ExpiredTokenException, __BaseException>);
}
/**
* <p>Indicates that an error from the service occurred while trying to process a
* request.</p>
* @public
*/
export declare class InternalServerException extends __BaseException {
readonly name: "InternalServerException";
readonly $fault: "server";
/**
* <p>Single error code. For this exception the value will be <code>server_error</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<InternalServerException, __BaseException>);
}
/**
* <p>Indicates that the <code>clientId</code> or <code>clientSecret</code> in the request is
* invalid. For example, this can occur when a client sends an incorrect <code>clientId</code> or
* an expired <code>clientSecret</code>.</p>
* @public
*/
export declare class InvalidClientException extends __BaseException {
readonly name: "InvalidClientException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be
* <code>invalid_client</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<InvalidClientException, __BaseException>);
}
/**
* <p>Indicates that a request contains an invalid grant. This can occur if a client makes a
* <a>CreateToken</a> request with an invalid grant type.</p>
* @public
*/
export declare class InvalidGrantException extends __BaseException {
readonly name: "InvalidGrantException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be <code>invalid_grant</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<InvalidGrantException, __BaseException>);
}
/**
* <p>Indicates that something is wrong with the input to the request. For example, a required
* parameter might be missing or out of range.</p>
* @public
*/
export declare class InvalidRequestException extends __BaseException {
readonly name: "InvalidRequestException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be
* <code>invalid_request</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<InvalidRequestException, __BaseException>);
}
/**
* <p>Indicates that the scope provided in the request is invalid.</p>
* @public
*/
export declare class InvalidScopeException extends __BaseException {
readonly name: "InvalidScopeException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be <code>invalid_scope</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<InvalidScopeException, __BaseException>);
}
/**
* <p>Indicates that the client is making the request too frequently and is more than the
* service can handle. </p>
* @public
*/
export declare class SlowDownException extends __BaseException {
readonly name: "SlowDownException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be <code>slow_down</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<SlowDownException, __BaseException>);
}
/**
* <p>Indicates that the client is not currently authorized to make the request. This can happen
* when a <code>clientId</code> is not issued for a public client.</p>
* @public
*/
export declare class UnauthorizedClientException extends __BaseException {
readonly name: "UnauthorizedClientException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be
* <code>unauthorized_client</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<UnauthorizedClientException, __BaseException>);
}
/**
* <p>Indicates that the grant type in the request is not supported by the service.</p>
* @public
*/
export declare class UnsupportedGrantTypeException extends __BaseException {
readonly name: "UnsupportedGrantTypeException";
readonly $fault: "client";
/**
* <p>Single error code. For this exception the value will be
* <code>unsupported_grant_type</code>.</p>
* @public
*/
error?: string | undefined;
/**
* <p>Human-readable text providing additional information, used to assist the client developer
* in understanding the error that occurred.</p>
* @public
*/
error_description?: string | undefined;
/**
* @internal
*/
constructor(opts: __ExceptionOptionType<UnsupportedGrantTypeException, __BaseException>);
}
@@ -0,0 +1,11 @@
import { HttpRequest as __HttpRequest, HttpResponse as __HttpResponse } from "@smithy/protocol-http";
import { SerdeContext as __SerdeContext } from "@smithy/types";
import { CreateTokenCommandInput, CreateTokenCommandOutput } from "../commands/CreateTokenCommand";
/**
* serializeAws_restJson1CreateTokenCommand
*/
export declare const se_CreateTokenCommand: (input: CreateTokenCommandInput, context: __SerdeContext) => Promise<__HttpRequest>;
/**
* deserializeAws_restJson1CreateTokenCommand
*/
export declare const de_CreateTokenCommand: (output: __HttpResponse, context: __SerdeContext) => Promise<CreateTokenCommandOutput>;
@@ -0,0 +1,57 @@
import { FetchHttpHandler as RequestHandler } from "@smithy/fetch-http-handler";
import { SSOOIDCClientConfig } from "./SSOOIDCClient";
/**
* @internal
*/
export declare const getRuntimeConfig: (config: SSOOIDCClientConfig) => {
runtime: string;
defaultsMode: import("@smithy/types").Provider<import("@smithy/smithy-client").ResolvedDefaultsMode>;
bodyLengthChecker: import("@smithy/types").BodyLengthCalculator;
defaultUserAgentProvider: (config?: import("@aws-sdk/util-user-agent-browser").PreviouslyResolved) => Promise<import("@smithy/types").UserAgent>;
maxAttempts: number | import("@smithy/types").Provider<number>;
region: string | import("@smithy/types").Provider<any>;
requestHandler: import("@smithy/protocol-http").HttpHandler<any> | RequestHandler;
retryMode: string | import("@smithy/types").Provider<string>;
sha256: import("@smithy/types").HashConstructor;
streamCollector: import("@smithy/types").StreamCollector;
useDualstackEndpoint: (boolean | import("@smithy/types").Provider<boolean>) & (boolean | import("@smithy/types").Provider<boolean | undefined>);
useFipsEndpoint: (boolean | import("@smithy/types").Provider<boolean>) & (boolean | import("@smithy/types").Provider<boolean | undefined>);
apiVersion: string;
cacheMiddleware?: boolean | undefined;
urlParser: import("@smithy/types").UrlParser;
base64Decoder: import("@smithy/types").Decoder;
base64Encoder: (_input: Uint8Array | string) => string;
utf8Decoder: import("@smithy/types").Decoder;
utf8Encoder: (input: Uint8Array | string) => string;
disableHostPrefix: boolean;
serviceId: string;
profile?: string;
logger: import("@smithy/types").Logger;
extensions: import("./runtimeExtensions").RuntimeExtension[];
customUserAgent?: string | import("@smithy/types").UserAgent;
userAgentAppId?: string | undefined | import("@smithy/types").Provider<string | undefined>;
retryStrategy?: import("@smithy/types").RetryStrategy | import("@smithy/types").RetryStrategyV2;
endpoint?: ((string | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>) & (string | import("@smithy/types").Provider<string> | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>)) | undefined;
endpointProvider: (endpointParams: import("./endpoint/EndpointParameters").EndpointParameters, context?: {
logger?: import("@smithy/types").Logger;
}) => import("@smithy/types").EndpointV2;
tls?: boolean;
serviceConfiguredEndpoint?: never;
authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
httpAuthSchemes: import("@smithy/types").HttpAuthScheme[] | ({
schemeId: string;
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | undefined;
signer: import("@aws-sdk/core").AwsSdkSigV4Signer;
} | {
schemeId: string;
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | (() => Promise<{}>);
signer: import("@smithy/core").NoAuthSigner;
})[];
httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").SSOOIDCHttpAuthSchemeProvider;
credentials?: import("@smithy/types").AwsCredentialIdentity | import("@smithy/types").AwsCredentialIdentityProvider;
signer?: import("@smithy/types").RequestSigner | ((authScheme?: import("@smithy/types").AuthScheme) => Promise<import("@smithy/types").RequestSigner>);
signingEscapePath?: boolean;
systemClockOffset?: number;
signingRegion?: string;
signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
};
@@ -0,0 +1,57 @@
import { NodeHttpHandler as RequestHandler } from "@smithy/node-http-handler";
import { SSOOIDCClientConfig } from "./SSOOIDCClient";
/**
* @internal
*/
export declare const getRuntimeConfig: (config: SSOOIDCClientConfig) => {
runtime: string;
defaultsMode: import("@smithy/types").Provider<import("@smithy/smithy-client").ResolvedDefaultsMode>;
authSchemePreference: string[] | import("@smithy/types").Provider<string[]>;
bodyLengthChecker: import("@smithy/types").BodyLengthCalculator;
defaultUserAgentProvider: (config?: import("@aws-sdk/util-user-agent-node").PreviouslyResolved) => Promise<import("@smithy/types").UserAgent>;
maxAttempts: number | import("@smithy/types").Provider<number>;
region: string | import("@smithy/types").Provider<string>;
requestHandler: RequestHandler | import("@smithy/protocol-http").HttpHandler<any>;
retryMode: string | import("@smithy/types").Provider<string>;
sha256: import("@smithy/types").HashConstructor;
streamCollector: import("@smithy/types").StreamCollector;
useDualstackEndpoint: boolean | import("@smithy/types").Provider<boolean>;
useFipsEndpoint: boolean | import("@smithy/types").Provider<boolean>;
userAgentAppId: string | import("@smithy/types").Provider<string | undefined>;
apiVersion: string;
cacheMiddleware?: boolean | undefined;
urlParser: import("@smithy/types").UrlParser;
base64Decoder: import("@smithy/types").Decoder;
base64Encoder: (_input: Uint8Array | string) => string;
utf8Decoder: import("@smithy/types").Decoder;
utf8Encoder: (input: Uint8Array | string) => string;
disableHostPrefix: boolean;
serviceId: string;
profile?: string;
logger: import("@smithy/types").Logger;
extensions: import("./runtimeExtensions").RuntimeExtension[];
customUserAgent?: string | import("@smithy/types").UserAgent;
retryStrategy?: import("@smithy/types").RetryStrategy | import("@smithy/types").RetryStrategyV2;
endpoint?: ((string | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>) & (string | import("@smithy/types").Provider<string> | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>)) | undefined;
endpointProvider: (endpointParams: import("./endpoint/EndpointParameters").EndpointParameters, context?: {
logger?: import("@smithy/types").Logger;
}) => import("@smithy/types").EndpointV2;
tls?: boolean;
serviceConfiguredEndpoint?: never;
httpAuthSchemes: import("@smithy/types").HttpAuthScheme[] | ({
schemeId: string;
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | undefined;
signer: import("@aws-sdk/core").AwsSdkSigV4Signer;
} | {
schemeId: string;
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | (() => Promise<{}>);
signer: import("@smithy/core").NoAuthSigner;
})[];
httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").SSOOIDCHttpAuthSchemeProvider;
credentials?: import("@smithy/types").AwsCredentialIdentity | import("@smithy/types").AwsCredentialIdentityProvider;
signer?: import("@smithy/types").RequestSigner | ((authScheme?: import("@smithy/types").AuthScheme) => Promise<import("@smithy/types").RequestSigner>);
signingEscapePath?: boolean;
systemClockOffset?: number;
signingRegion?: string;
signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
};
@@ -0,0 +1,56 @@
import { SSOOIDCClientConfig } from "./SSOOIDCClient";
/**
* @internal
*/
export declare const getRuntimeConfig: (config: SSOOIDCClientConfig) => {
runtime: string;
sha256: import("@smithy/types").HashConstructor;
requestHandler: import("@smithy/types").NodeHttpHandlerOptions | import("@smithy/types").FetchHttpHandlerOptions | Record<string, unknown> | import("@smithy/protocol-http").HttpHandler<any> | import("@smithy/fetch-http-handler").FetchHttpHandler;
apiVersion: string;
cacheMiddleware?: boolean;
urlParser: import("@smithy/types").UrlParser;
bodyLengthChecker: import("@smithy/types").BodyLengthCalculator;
streamCollector: import("@smithy/types").StreamCollector;
base64Decoder: import("@smithy/types").Decoder;
base64Encoder: (_input: Uint8Array | string) => string;
utf8Decoder: import("@smithy/types").Decoder;
utf8Encoder: (input: Uint8Array | string) => string;
disableHostPrefix: boolean;
serviceId: string;
useDualstackEndpoint: (boolean | import("@smithy/types").Provider<boolean>) & (boolean | import("@smithy/types").Provider<boolean | undefined>);
useFipsEndpoint: (boolean | import("@smithy/types").Provider<boolean>) & (boolean | import("@smithy/types").Provider<boolean | undefined>);
region: string | import("@smithy/types").Provider<any>;
profile?: string;
defaultUserAgentProvider: (config?: import("@aws-sdk/util-user-agent-browser").PreviouslyResolved) => Promise<import("@smithy/types").UserAgent>;
maxAttempts: number | import("@smithy/types").Provider<number>;
retryMode: string | import("@smithy/types").Provider<string>;
logger: import("@smithy/types").Logger;
extensions: import("./runtimeExtensions").RuntimeExtension[];
defaultsMode: import("@smithy/smithy-client").DefaultsMode | import("@smithy/types").Provider<import("@smithy/smithy-client").DefaultsMode>;
customUserAgent?: string | import("@smithy/types").UserAgent;
userAgentAppId?: string | undefined | import("@smithy/types").Provider<string | undefined>;
retryStrategy?: import("@smithy/types").RetryStrategy | import("@smithy/types").RetryStrategyV2;
endpoint?: ((string | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>) & (string | import("@smithy/types").Provider<string> | import("@smithy/types").Endpoint | import("@smithy/types").Provider<import("@smithy/types").Endpoint> | import("@smithy/types").EndpointV2 | import("@smithy/types").Provider<import("@smithy/types").EndpointV2>)) | undefined;
endpointProvider: (endpointParams: import("./endpoint/EndpointParameters").EndpointParameters, context?: {
logger?: import("@smithy/types").Logger;
}) => import("@smithy/types").EndpointV2;
tls?: boolean;
serviceConfiguredEndpoint?: never;
authSchemePreference?: string[] | import("@smithy/types").Provider<string[]>;
httpAuthSchemes: import("@smithy/types").HttpAuthScheme[] | ({
schemeId: string;
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | undefined;
signer: import("@aws-sdk/core").AwsSdkSigV4Signer;
} | {
schemeId: string;
identityProvider: (ipc: import("@smithy/types").IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | (() => Promise<{}>);
signer: import("@smithy/core").NoAuthSigner;
})[];
httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").SSOOIDCHttpAuthSchemeProvider;
credentials?: import("@smithy/types").AwsCredentialIdentity | import("@smithy/types").AwsCredentialIdentityProvider;
signer?: import("@smithy/types").RequestSigner | ((authScheme?: import("@smithy/types").AuthScheme) => Promise<import("@smithy/types").RequestSigner>);
signingEscapePath?: boolean;
systemClockOffset?: number;
signingRegion?: string;
signerConstructor?: new (options: import("@smithy/signature-v4").SignatureV4Init & import("@smithy/signature-v4").SignatureV4CryptoInit) => import("@smithy/types").RequestSigner;
};
@@ -0,0 +1,32 @@
import { AwsSdkSigV4Signer } from "@aws-sdk/core";
import { NoAuthSigner } from "@smithy/core";
import { IdentityProviderConfig } from "@smithy/types";
import { SSOOIDCClientConfig } from "./SSOOIDCClient";
/**
* @internal
*/
export declare const getRuntimeConfig: (config: SSOOIDCClientConfig) => {
apiVersion: string;
base64Decoder: import("@smithy/types").Decoder;
base64Encoder: (_input: Uint8Array | string) => string;
disableHostPrefix: boolean;
endpointProvider: (endpointParams: import("./endpoint/EndpointParameters").EndpointParameters, context?: {
logger?: import("@smithy/types").Logger;
}) => import("@smithy/types").EndpointV2;
extensions: import("./runtimeExtensions").RuntimeExtension[];
httpAuthSchemeProvider: import("./auth/httpAuthSchemeProvider").SSOOIDCHttpAuthSchemeProvider;
httpAuthSchemes: import("@smithy/types").HttpAuthScheme[] | ({
schemeId: string;
identityProvider: (ipc: IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | undefined;
signer: AwsSdkSigV4Signer;
} | {
schemeId: string;
identityProvider: (ipc: IdentityProviderConfig) => import("@smithy/types").IdentityProvider<import("@smithy/types").Identity> | (() => Promise<{}>);
signer: NoAuthSigner;
})[];
logger: import("@smithy/types").Logger;
serviceId: string;
urlParser: import("@smithy/types").UrlParser;
utf8Decoder: import("@smithy/types").Decoder;
utf8Encoder: (input: Uint8Array | string) => string;
};
@@ -0,0 +1,17 @@
import { SSOOIDCExtensionConfiguration } from "./extensionConfiguration";
/**
* @public
*/
export interface RuntimeExtension {
configure(extensionConfiguration: SSOOIDCExtensionConfiguration): void;
}
/**
* @public
*/
export interface RuntimeExtensionsConfig {
extensions: RuntimeExtension[];
}
/**
* @internal
*/
export declare const resolveRuntimeExtensions: (runtimeConfig: any, extensions: RuntimeExtension[]) => any;
@@ -0,0 +1,27 @@
import { HttpHandlerOptions as __HttpHandlerOptions } from "@smithy/types";
import { AssumeRoleCommandInput, AssumeRoleCommandOutput } from "./commands/AssumeRoleCommand";
import { AssumeRoleWithWebIdentityCommandInput, AssumeRoleWithWebIdentityCommandOutput } from "./commands/AssumeRoleWithWebIdentityCommand";
import { STSClient } from "./STSClient";
export interface STS {
/**
* @see {@link AssumeRoleCommand}
*/
assumeRole(args: AssumeRoleCommandInput, options?: __HttpHandlerOptions): Promise<AssumeRoleCommandOutput>;
assumeRole(args: AssumeRoleCommandInput, cb: (err: any, data?: AssumeRoleCommandOutput) => void): void;
assumeRole(args: AssumeRoleCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: AssumeRoleCommandOutput) => void): void;
/**
* @see {@link AssumeRoleWithWebIdentityCommand}
*/
assumeRoleWithWebIdentity(args: AssumeRoleWithWebIdentityCommandInput, options?: __HttpHandlerOptions): Promise<AssumeRoleWithWebIdentityCommandOutput>;
assumeRoleWithWebIdentity(args: AssumeRoleWithWebIdentityCommandInput, cb: (err: any, data?: AssumeRoleWithWebIdentityCommandOutput) => void): void;
assumeRoleWithWebIdentity(args: AssumeRoleWithWebIdentityCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: AssumeRoleWithWebIdentityCommandOutput) => void): void;
}
/**
* <fullname>Security Token Service</fullname>
* <p>Security Token Service (STS) enables you to request temporary, limited-privilege
* credentials for users. This guide provides descriptions of the STS API. For
* more information about using this service, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html">Temporary Security Credentials</a>.</p>
* @public
*/
export declare class STS extends STSClient implements STS {
}
@@ -0,0 +1,192 @@
import { HostHeaderInputConfig, HostHeaderResolvedConfig } from "@aws-sdk/middleware-host-header";
import { UserAgentInputConfig, UserAgentResolvedConfig } from "@aws-sdk/middleware-user-agent";
import { RegionInputConfig, RegionResolvedConfig } from "@smithy/config-resolver";
import { EndpointInputConfig, EndpointResolvedConfig } from "@smithy/middleware-endpoint";
import { RetryInputConfig, RetryResolvedConfig } from "@smithy/middleware-retry";
import { HttpHandlerUserInput as __HttpHandlerUserInput } from "@smithy/protocol-http";
import { Client as __Client, DefaultsMode as __DefaultsMode, SmithyConfiguration as __SmithyConfiguration, SmithyResolvedConfiguration as __SmithyResolvedConfiguration } from "@smithy/smithy-client";
import { AwsCredentialIdentityProvider, BodyLengthCalculator as __BodyLengthCalculator, CheckOptionalClientConfig as __CheckOptionalClientConfig, ChecksumConstructor as __ChecksumConstructor, Decoder as __Decoder, Encoder as __Encoder, HashConstructor as __HashConstructor, HttpHandlerOptions as __HttpHandlerOptions, Logger as __Logger, Provider as __Provider, Provider, StreamCollector as __StreamCollector, UrlParser as __UrlParser, UserAgent as __UserAgent } from "@smithy/types";
import { HttpAuthSchemeInputConfig, HttpAuthSchemeResolvedConfig } from "./auth/httpAuthSchemeProvider";
import { AssumeRoleCommandInput, AssumeRoleCommandOutput } from "./commands/AssumeRoleCommand";
import { AssumeRoleWithWebIdentityCommandInput, AssumeRoleWithWebIdentityCommandOutput } from "./commands/AssumeRoleWithWebIdentityCommand";
import { ClientInputEndpointParameters, ClientResolvedEndpointParameters, EndpointParameters } from "./endpoint/EndpointParameters";
import { RuntimeExtension, RuntimeExtensionsConfig } from "./runtimeExtensions";
export { __Client };
/**
* @public
*/
export type ServiceInputTypes = AssumeRoleCommandInput | AssumeRoleWithWebIdentityCommandInput;
/**
* @public
*/
export type ServiceOutputTypes = AssumeRoleCommandOutput | AssumeRoleWithWebIdentityCommandOutput;
/**
* @public
*/
export interface ClientDefaults extends Partial<__SmithyConfiguration<__HttpHandlerOptions>> {
/**
* The HTTP handler to use or its constructor options. Fetch in browser and Https in Nodejs.
*/
requestHandler?: __HttpHandlerUserInput;
/**
* A constructor for a class implementing the {@link @smithy/types#ChecksumConstructor} interface
* that computes the SHA-256 HMAC or checksum of a string or binary buffer.
* @internal
*/
sha256?: __ChecksumConstructor | __HashConstructor;
/**
* The function that will be used to convert strings into HTTP endpoints.
* @internal
*/
urlParser?: __UrlParser;
/**
* A function that can calculate the length of a request body.
* @internal
*/
bodyLengthChecker?: __BodyLengthCalculator;
/**
* A function that converts a stream into an array of bytes.
* @internal
*/
streamCollector?: __StreamCollector;
/**
* The function that will be used to convert a base64-encoded string to a byte array.
* @internal
*/
base64Decoder?: __Decoder;
/**
* The function that will be used to convert binary data to a base64-encoded string.
* @internal
*/
base64Encoder?: __Encoder;
/**
* The function that will be used to convert a UTF8-encoded string to a byte array.
* @internal
*/
utf8Decoder?: __Decoder;
/**
* The function that will be used to convert binary data to a UTF-8 encoded string.
* @internal
*/
utf8Encoder?: __Encoder;
/**
* The runtime environment.
* @internal
*/
runtime?: string;
/**
* Disable dynamically changing the endpoint of the client based on the hostPrefix
* trait of an operation.
*/
disableHostPrefix?: boolean;
/**
* Unique service identifier.
* @internal
*/
serviceId?: string;
/**
* Enables IPv6/IPv4 dualstack endpoint.
*/
useDualstackEndpoint?: boolean | __Provider<boolean>;
/**
* Enables FIPS compatible endpoints.
*/
useFipsEndpoint?: boolean | __Provider<boolean>;
/**
* The AWS region to which this client will send requests
*/
region?: string | __Provider<string>;
/**
* Setting a client profile is similar to setting a value for the
* AWS_PROFILE environment variable. Setting a profile on a client
* in code only affects the single client instance, unlike AWS_PROFILE.
*
* When set, and only for environments where an AWS configuration
* file exists, fields configurable by this file will be retrieved
* from the specified profile within that file.
* Conflicting code configuration and environment variables will
* still have higher priority.
*
* For client credential resolution that involves checking the AWS
* configuration file, the client's profile (this value) will be
* used unless a different profile is set in the credential
* provider options.
*
*/
profile?: string;
/**
* The provider populating default tracking information to be sent with `user-agent`, `x-amz-user-agent` header
* @internal
*/
defaultUserAgentProvider?: Provider<__UserAgent>;
/**
* Default credentials provider; Not available in browser runtime.
* @deprecated
* @internal
*/
credentialDefaultProvider?: (input: any) => AwsCredentialIdentityProvider;
/**
* Value for how many times a request will be made at most in case of retry.
*/
maxAttempts?: number | __Provider<number>;
/**
* Specifies which retry algorithm to use.
* @see https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-smithy-util-retry/Enum/RETRY_MODES/
*
*/
retryMode?: string | __Provider<string>;
/**
* Optional logger for logging debug/info/warn/error.
*/
logger?: __Logger;
/**
* Optional extensions
*/
extensions?: RuntimeExtension[];
/**
* The {@link @smithy/smithy-client#DefaultsMode} that will be used to determine how certain default configuration options are resolved in the SDK.
*/
defaultsMode?: __DefaultsMode | __Provider<__DefaultsMode>;
}
/**
* @public
*/
export type STSClientConfigType = Partial<__SmithyConfiguration<__HttpHandlerOptions>> & ClientDefaults & UserAgentInputConfig & RetryInputConfig & RegionInputConfig & HostHeaderInputConfig & EndpointInputConfig<EndpointParameters> & HttpAuthSchemeInputConfig & ClientInputEndpointParameters;
/**
* @public
*
* The configuration interface of STSClient class constructor that set the region, credentials and other options.
*/
export interface STSClientConfig extends STSClientConfigType {
}
/**
* @public
*/
export type STSClientResolvedConfigType = __SmithyResolvedConfiguration<__HttpHandlerOptions> & Required<ClientDefaults> & RuntimeExtensionsConfig & UserAgentResolvedConfig & RetryResolvedConfig & RegionResolvedConfig & HostHeaderResolvedConfig & EndpointResolvedConfig<EndpointParameters> & HttpAuthSchemeResolvedConfig & ClientResolvedEndpointParameters;
/**
* @public
*
* The resolved configuration interface of STSClient class. This is resolved and normalized from the {@link STSClientConfig | constructor configuration interface}.
*/
export interface STSClientResolvedConfig extends STSClientResolvedConfigType {
}
/**
* <fullname>Security Token Service</fullname>
* <p>Security Token Service (STS) enables you to request temporary, limited-privilege
* credentials for users. This guide provides descriptions of the STS API. For
* more information about using this service, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html">Temporary Security Credentials</a>.</p>
* @public
*/
export declare class STSClient extends __Client<__HttpHandlerOptions, ServiceInputTypes, ServiceOutputTypes, STSClientResolvedConfig> {
/**
* The resolved configuration of STSClient class. This is resolved and normalized from the {@link STSClientConfig | constructor configuration interface}.
*/
readonly config: STSClientResolvedConfig;
constructor(...[configuration]: __CheckOptionalClientConfig<STSClientConfig>);
/**
* Destroy underlying resources, like sockets. It's usually not necessary to do this.
* However in Node.js, it's best to explicitly shut down the client's agent when it is no longer needed.
* Otherwise, sockets might stay open for quite a long time before the server terminates them.
*/
destroy(): void;
}
@@ -0,0 +1,29 @@
import { AwsCredentialIdentity, AwsCredentialIdentityProvider, HttpAuthScheme } from "@smithy/types";
import { STSHttpAuthSchemeProvider } from "./httpAuthSchemeProvider";
/**
* @internal
*/
export interface HttpAuthExtensionConfiguration {
setHttpAuthScheme(httpAuthScheme: HttpAuthScheme): void;
httpAuthSchemes(): HttpAuthScheme[];
setHttpAuthSchemeProvider(httpAuthSchemeProvider: STSHttpAuthSchemeProvider): void;
httpAuthSchemeProvider(): STSHttpAuthSchemeProvider;
setCredentials(credentials: AwsCredentialIdentity | AwsCredentialIdentityProvider): void;
credentials(): AwsCredentialIdentity | AwsCredentialIdentityProvider | undefined;
}
/**
* @internal
*/
export type HttpAuthRuntimeConfig = Partial<{
httpAuthSchemes: HttpAuthScheme[];
httpAuthSchemeProvider: STSHttpAuthSchemeProvider;
credentials: AwsCredentialIdentity | AwsCredentialIdentityProvider;
}>;
/**
* @internal
*/
export declare const getHttpAuthExtensionConfiguration: (runtimeConfig: HttpAuthRuntimeConfig) => HttpAuthExtensionConfiguration;
/**
* @internal
*/
export declare const resolveHttpAuthRuntimeConfig: (config: HttpAuthExtensionConfiguration) => HttpAuthRuntimeConfig;
@@ -0,0 +1,85 @@
import { AwsSdkSigV4AuthInputConfig, AwsSdkSigV4AuthResolvedConfig, AwsSdkSigV4PreviouslyResolved } from "@aws-sdk/core";
import { Client, HandlerExecutionContext, HttpAuthScheme, HttpAuthSchemeParameters, HttpAuthSchemeParametersProvider, HttpAuthSchemeProvider, Provider } from "@smithy/types";
import { STSClientResolvedConfig } from "../STSClient";
/**
* @internal
*/
export interface STSHttpAuthSchemeParameters extends HttpAuthSchemeParameters {
region?: string;
}
/**
* @internal
*/
export interface STSHttpAuthSchemeParametersProvider extends HttpAuthSchemeParametersProvider<STSClientResolvedConfig, HandlerExecutionContext, STSHttpAuthSchemeParameters, object> {
}
/**
* @internal
*/
export declare const defaultSTSHttpAuthSchemeParametersProvider: (config: STSClientResolvedConfig, context: HandlerExecutionContext, input: object) => Promise<STSHttpAuthSchemeParameters>;
/**
* @internal
*/
export interface STSHttpAuthSchemeProvider extends HttpAuthSchemeProvider<STSHttpAuthSchemeParameters> {
}
/**
* @internal
*/
export declare const defaultSTSHttpAuthSchemeProvider: STSHttpAuthSchemeProvider;
export interface StsAuthInputConfig {
}
export interface StsAuthResolvedConfig {
/**
* Reference to STSClient class constructor.
* @internal
*/
stsClientCtor: new (clientConfig: any) => Client<any, any, any>;
}
export declare const resolveStsAuthConfig: <T>(input: T & StsAuthInputConfig) => T & StsAuthResolvedConfig;
/**
* @internal
*/
export interface HttpAuthSchemeInputConfig extends StsAuthInputConfig, AwsSdkSigV4AuthInputConfig {
/**
* A comma-separated list of case-sensitive auth scheme names.
* An auth scheme name is a fully qualified auth scheme ID with the namespace prefix trimmed.
* For example, the auth scheme with ID aws.auth#sigv4 is named sigv4.
* @public
*/
authSchemePreference?: string[] | Provider<string[]>;
/**
* Configuration of HttpAuthSchemes for a client which provides default identity providers and signers per auth scheme.
* @internal
*/
httpAuthSchemes?: HttpAuthScheme[];
/**
* Configuration of an HttpAuthSchemeProvider for a client which resolves which HttpAuthScheme to use.
* @internal
*/
httpAuthSchemeProvider?: STSHttpAuthSchemeProvider;
}
/**
* @internal
*/
export interface HttpAuthSchemeResolvedConfig extends StsAuthResolvedConfig, AwsSdkSigV4AuthResolvedConfig {
/**
* A comma-separated list of case-sensitive auth scheme names.
* An auth scheme name is a fully qualified auth scheme ID with the namespace prefix trimmed.
* For example, the auth scheme with ID aws.auth#sigv4 is named sigv4.
* @public
*/
readonly authSchemePreference: Provider<string[]>;
/**
* Configuration of HttpAuthSchemes for a client which provides default identity providers and signers per auth scheme.
* @internal
*/
readonly httpAuthSchemes: HttpAuthScheme[];
/**
* Configuration of an HttpAuthSchemeProvider for a client which resolves which HttpAuthScheme to use.
* @internal
*/
readonly httpAuthSchemeProvider: STSHttpAuthSchemeProvider;
}
/**
* @internal
*/
export declare const resolveHttpAuthSchemeConfig: <T>(config: T & HttpAuthSchemeInputConfig & AwsSdkSigV4PreviouslyResolved) => T & HttpAuthSchemeResolvedConfig;
@@ -0,0 +1,269 @@
import { Command as $Command } from "@smithy/smithy-client";
import { MetadataBearer as __MetadataBearer } from "@smithy/types";
import { AssumeRoleRequest, AssumeRoleResponse } from "../models/models_0";
import { ServiceInputTypes, ServiceOutputTypes, STSClientResolvedConfig } from "../STSClient";
/**
* @public
*/
export type { __MetadataBearer };
export { $Command };
/**
* @public
*
* The input for {@link AssumeRoleCommand}.
*/
export interface AssumeRoleCommandInput extends AssumeRoleRequest {
}
/**
* @public
*
* The output of {@link AssumeRoleCommand}.
*/
export interface AssumeRoleCommandOutput extends AssumeRoleResponse, __MetadataBearer {
}
declare const AssumeRoleCommand_base: {
new (input: AssumeRoleCommandInput): import("@smithy/smithy-client").CommandImpl<AssumeRoleCommandInput, AssumeRoleCommandOutput, STSClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
new (input: AssumeRoleCommandInput): import("@smithy/smithy-client").CommandImpl<AssumeRoleCommandInput, AssumeRoleCommandOutput, STSClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
getEndpointParameterInstructions(): import("@smithy/middleware-endpoint").EndpointParameterInstructions;
};
/**
* <p>Returns a set of temporary security credentials that you can use to access Amazon Web Services
* resources. These temporary credentials consist of an access key ID, a secret access key,
* and a security token. Typically, you use <code>AssumeRole</code> within your account or for
* cross-account access. For a comparison of <code>AssumeRole</code> with other API operations
* that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting Temporary Security
* Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_sts-comparison.html">Compare STS
* credentials</a> in the <i>IAM User Guide</i>.</p>
* <p>
* <b>Permissions</b>
* </p>
* <p>The temporary security credentials created by <code>AssumeRole</code> can be used to
* make API calls to any Amazon Web Services service with the following exception: You cannot call the
* Amazon Web Services STS <code>GetFederationToken</code> or <code>GetSessionToken</code> API
* operations.</p>
* <p>(Optional) You can pass inline or managed session policies to this operation. You can
* pass a single JSON policy document to use as an inline session policy. You can also specify
* up to 10 managed policy Amazon Resource Names (ARNs) to use as managed session policies.
* The plaintext that you use for both inline and managed session policies can't exceed 2,048
* characters. Passing policies to this operation returns new
* temporary credentials. The resulting session's permissions are the intersection of the
* role's identity-based policy and the session policies. You can use the role's temporary
* credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
* the role. You cannot use session policies to grant more permissions than those allowed
* by the identity-based policy of the role that is being assumed. For more information, see
* <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
* Policies</a> in the <i>IAM User Guide</i>.</p>
* <p>When you create a role, you create two policies: a role trust policy that specifies
* <i>who</i> can assume the role, and a permissions policy that specifies
* <i>what</i> can be done with the role. You specify the trusted principal
* that is allowed to assume the role in the role trust policy.</p>
* <p>To assume a role from a different account, your Amazon Web Services account must be trusted by the
* role. The trust relationship is defined in the role's trust policy when the role is
* created. That trust policy states which accounts are allowed to delegate that access to
* users in the account. </p>
* <p>A user who wants to access a role in a different account must also have permissions that
* are delegated from the account administrator. The administrator must attach a policy that
* allows the user to call <code>AssumeRole</code> for the ARN of the role in the other
* account.</p>
* <p>To allow a user to assume a role in the same account, you can do either of the
* following:</p>
* <ul>
* <li>
* <p>Attach a policy to the user that allows the user to call <code>AssumeRole</code>
* (as long as the role's trust policy trusts the account).</p>
* </li>
* <li>
* <p>Add the user as a principal directly in the role's trust policy.</p>
* </li>
* </ul>
* <p>You can do either because the roles trust policy acts as an IAM resource-based
* policy. When a resource-based policy grants access to a principal in the same account, no
* additional identity-based policy is required. For more information about trust policies and
* resource-based policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html">IAM Policies</a> in the
* <i>IAM User Guide</i>.</p>
* <p>
* <b>Tags</b>
* </p>
* <p>(Optional) You can pass tag key-value pairs to your session. These tags are called
* session tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in the
* <i>IAM User Guide</i>.</p>
* <p>An administrator must grant you the permissions necessary to pass session tags. The
* administrator can also create granular permissions to allow you to pass only specific
* session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial: Using Tags
* for Attribute-Based Access Control</a> in the
* <i>IAM User Guide</i>.</p>
* <p>You can set the session tags as transitive. Transitive tags persist during role
* chaining. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining Roles
* with Session Tags</a> in the <i>IAM User Guide</i>.</p>
* <p>
* <b>Using MFA with AssumeRole</b>
* </p>
* <p>(Optional) You can include multi-factor authentication (MFA) information when you call
* <code>AssumeRole</code>. This is useful for cross-account scenarios to ensure that the
* user that assumes the role has been authenticated with an Amazon Web Services MFA device. In that
* scenario, the trust policy of the role being assumed includes a condition that tests for
* MFA authentication. If the caller does not include valid MFA information, the request to
* assume the role is denied. The condition in a trust policy that tests for MFA
* authentication might look like the following example.</p>
* <p>
* <code>"Condition": \{"Bool": \{"aws:MultiFactorAuthPresent": true\}\}</code>
* </p>
* <p>For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html">Configuring MFA-Protected API Access</a>
* in the <i>IAM User Guide</i> guide.</p>
* <p>To use MFA with <code>AssumeRole</code>, you pass values for the
* <code>SerialNumber</code> and <code>TokenCode</code> parameters. The
* <code>SerialNumber</code> value identifies the user's hardware or virtual MFA device.
* The <code>TokenCode</code> is the time-based one-time password (TOTP) that the MFA device
* produces. </p>
* @example
* Use a bare-bones client and the command you need to make an API call.
* ```javascript
* import { STSClient, AssumeRoleCommand } from "@aws-sdk/client-sts"; // ES Modules import
* // const { STSClient, AssumeRoleCommand } = require("@aws-sdk/client-sts"); // CommonJS import
* const client = new STSClient(config);
* const input = { // AssumeRoleRequest
* RoleArn: "STRING_VALUE", // required
* RoleSessionName: "STRING_VALUE", // required
* PolicyArns: [ // policyDescriptorListType
* { // PolicyDescriptorType
* arn: "STRING_VALUE",
* },
* ],
* Policy: "STRING_VALUE",
* DurationSeconds: Number("int"),
* Tags: [ // tagListType
* { // Tag
* Key: "STRING_VALUE", // required
* Value: "STRING_VALUE", // required
* },
* ],
* TransitiveTagKeys: [ // tagKeyListType
* "STRING_VALUE",
* ],
* ExternalId: "STRING_VALUE",
* SerialNumber: "STRING_VALUE",
* TokenCode: "STRING_VALUE",
* SourceIdentity: "STRING_VALUE",
* ProvidedContexts: [ // ProvidedContextsListType
* { // ProvidedContext
* ProviderArn: "STRING_VALUE",
* ContextAssertion: "STRING_VALUE",
* },
* ],
* };
* const command = new AssumeRoleCommand(input);
* const response = await client.send(command);
* // { // AssumeRoleResponse
* // Credentials: { // Credentials
* // AccessKeyId: "STRING_VALUE", // required
* // SecretAccessKey: "STRING_VALUE", // required
* // SessionToken: "STRING_VALUE", // required
* // Expiration: new Date("TIMESTAMP"), // required
* // },
* // AssumedRoleUser: { // AssumedRoleUser
* // AssumedRoleId: "STRING_VALUE", // required
* // Arn: "STRING_VALUE", // required
* // },
* // PackedPolicySize: Number("int"),
* // SourceIdentity: "STRING_VALUE",
* // };
*
* ```
*
* @param AssumeRoleCommandInput - {@link AssumeRoleCommandInput}
* @returns {@link AssumeRoleCommandOutput}
* @see {@link AssumeRoleCommandInput} for command's `input` shape.
* @see {@link AssumeRoleCommandOutput} for command's `response` shape.
* @see {@link STSClientResolvedConfig | config} for STSClient's `config` shape.
*
* @throws {@link ExpiredTokenException} (client fault)
* <p>The web identity token that was passed is expired or is not valid. Get a new identity
* token from the identity provider and then retry the request.</p>
*
* @throws {@link MalformedPolicyDocumentException} (client fault)
* <p>The request was rejected because the policy document was malformed. The error message
* describes the specific error.</p>
*
* @throws {@link PackedPolicyTooLargeException} (client fault)
* <p>The request was rejected because the total packed size of the session policies and
* session tags combined was too large. An Amazon Web Services conversion compresses the session policy
* document, session policy ARNs, and session tags into a packed binary format that has a
* separate limit. The error message indicates by percentage how close the policies and
* tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in
* the <i>IAM User Guide</i>.</p>
* <p>You could receive this error even though you meet other defined session policy and
* session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM and STS Entity Character Limits</a> in the <i>IAM User
* Guide</i>.</p>
*
* @throws {@link RegionDisabledException} (client fault)
* <p>STS is not activated in the requested region for the account that is being asked to
* generate credentials. The account administrator must use the IAM console to activate
* STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating and
* Deactivating STS in an Amazon Web Services Region</a> in the <i>IAM User
* Guide</i>.</p>
*
* @throws {@link STSServiceException}
* <p>Base exception class for all service exceptions from STS service.</p>
*
*
* @example To assume a role
* ```javascript
* //
* const input = {
* ExternalId: "123ABC",
* Policy: `{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}]}`,
* RoleArn: "arn:aws:iam::123456789012:role/demo",
* RoleSessionName: "testAssumeRoleSession",
* Tags: [
* {
* Key: "Project",
* Value: "Unicorn"
* },
* {
* Key: "Team",
* Value: "Automation"
* },
* {
* Key: "Cost-Center",
* Value: "12345"
* }
* ],
* TransitiveTagKeys: [
* "Project",
* "Cost-Center"
* ]
* };
* const command = new AssumeRoleCommand(input);
* const response = await client.send(command);
* /* response is
* {
* AssumedRoleUser: {
* Arn: "arn:aws:sts::123456789012:assumed-role/demo/Bob",
* AssumedRoleId: "ARO123EXAMPLE123:Bob"
* },
* Credentials: {
* AccessKeyId: "AKIAIOSFODNN7EXAMPLE",
* Expiration: "2011-07-15T23:28:33.359Z",
* SecretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
* SessionToken: "AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA=="
* },
* PackedPolicySize: 8
* }
* *\/
* ```
*
* @public
*/
export declare class AssumeRoleCommand extends AssumeRoleCommand_base {
/** @internal type navigation helper, not in runtime. */
protected static __types: {
api: {
input: AssumeRoleRequest;
output: AssumeRoleResponse;
};
sdk: {
input: AssumeRoleCommandInput;
output: AssumeRoleCommandOutput;
};
};
}
@@ -0,0 +1,288 @@
import { Command as $Command } from "@smithy/smithy-client";
import { MetadataBearer as __MetadataBearer } from "@smithy/types";
import { AssumeRoleWithWebIdentityRequest, AssumeRoleWithWebIdentityResponse } from "../models/models_0";
import { ServiceInputTypes, ServiceOutputTypes, STSClientResolvedConfig } from "../STSClient";
/**
* @public
*/
export type { __MetadataBearer };
export { $Command };
/**
* @public
*
* The input for {@link AssumeRoleWithWebIdentityCommand}.
*/
export interface AssumeRoleWithWebIdentityCommandInput extends AssumeRoleWithWebIdentityRequest {
}
/**
* @public
*
* The output of {@link AssumeRoleWithWebIdentityCommand}.
*/
export interface AssumeRoleWithWebIdentityCommandOutput extends AssumeRoleWithWebIdentityResponse, __MetadataBearer {
}
declare const AssumeRoleWithWebIdentityCommand_base: {
new (input: AssumeRoleWithWebIdentityCommandInput): import("@smithy/smithy-client").CommandImpl<AssumeRoleWithWebIdentityCommandInput, AssumeRoleWithWebIdentityCommandOutput, STSClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
new (input: AssumeRoleWithWebIdentityCommandInput): import("@smithy/smithy-client").CommandImpl<AssumeRoleWithWebIdentityCommandInput, AssumeRoleWithWebIdentityCommandOutput, STSClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
getEndpointParameterInstructions(): import("@smithy/middleware-endpoint").EndpointParameterInstructions;
};
/**
* <p>Returns a set of temporary security credentials for users who have been authenticated in
* a mobile or web application with a web identity provider. Example providers include the
* OAuth 2.0 providers Login with Amazon and Facebook, or any OpenID Connect-compatible
* identity provider such as Google or <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html">Amazon Cognito federated identities</a>.</p>
* <note>
* <p>For mobile applications, we recommend that you use Amazon Cognito. You can use Amazon Cognito with the
* <a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK for iOS Developer Guide</a> and the <a href="http://aws.amazon.com/sdkforandroid/">Amazon Web Services SDK for Android Developer Guide</a> to uniquely
* identify a user. You can also supply the user with a consistent identity throughout the
* lifetime of an application.</p>
* <p>To learn more about Amazon Cognito, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html">Amazon Cognito identity
* pools</a> in <i>Amazon Cognito Developer Guide</i>.</p>
* </note>
* <p>Calling <code>AssumeRoleWithWebIdentity</code> does not require the use of Amazon Web Services
* security credentials. Therefore, you can distribute an application (for example, on mobile
* devices) that requests temporary security credentials without including long-term Amazon Web Services
* credentials in the application. You also don't need to deploy server-based proxy services
* that use long-term Amazon Web Services credentials. Instead, the identity of the caller is validated by
* using a token from the web identity provider. For a comparison of
* <code>AssumeRoleWithWebIdentity</code> with the other API operations that produce
* temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting Temporary Security
* Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_sts-comparison.html">Compare STS
* credentials</a> in the <i>IAM User Guide</i>.</p>
* <p>The temporary security credentials returned by this API consist of an access key ID, a
* secret access key, and a security token. Applications can use these temporary security
* credentials to sign calls to Amazon Web Services service API operations.</p>
* <p>
* <b>Session Duration</b>
* </p>
* <p>By default, the temporary security credentials created by
* <code>AssumeRoleWithWebIdentity</code> last for one hour. However, you can use the
* optional <code>DurationSeconds</code> parameter to specify the duration of your session.
* You can provide a value from 900 seconds (15 minutes) up to the maximum session duration
* setting for the role. This setting can have a value from 1 hour to 12 hours. To learn how
* to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_update-role-settings.html#id_roles_update-session-duration">Update the maximum session duration for a role </a> in the
* <i>IAM User Guide</i>. The maximum session duration limit applies when
* you use the <code>AssumeRole*</code> API operations or the <code>assume-role*</code> CLI
* commands. However the limit does not apply when you use those operations to create a
* console URL. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using IAM Roles</a> in the
* <i>IAM User Guide</i>. </p>
* <p>
* <b>Permissions</b>
* </p>
* <p>The temporary security credentials created by <code>AssumeRoleWithWebIdentity</code> can
* be used to make API calls to any Amazon Web Services service with the following exception: you cannot
* call the STS <code>GetFederationToken</code> or <code>GetSessionToken</code> API
* operations.</p>
* <p>(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session policies</a> to
* this operation. You can pass a single JSON policy document to use as an inline session
* policy. You can also specify up to 10 managed policy Amazon Resource Names (ARNs) to use as
* managed session policies. The plaintext that you use for both inline and managed session
* policies can't exceed 2,048 characters. Passing policies to this operation returns new
* temporary credentials. The resulting session's permissions are the intersection of the
* role's identity-based policy and the session policies. You can use the role's temporary
* credentials in subsequent Amazon Web Services API calls to access resources in the account that owns
* the role. You cannot use session policies to grant more permissions than those allowed
* by the identity-based policy of the role that is being assumed. For more information, see
* <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
* Policies</a> in the <i>IAM User Guide</i>.</p>
* <p>
* <b>Tags</b>
* </p>
* <p>(Optional) You can configure your IdP to pass attributes into your web identity token as
* session tags. Each session tag consists of a key name and an associated value. For more
* information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in the
* <i>IAM User Guide</i>.</p>
* <p>You can pass up to 50 session tags. The plaintext session tag keys cant exceed 128
* characters and the values cant exceed 256 characters. For these and additional limits, see
* <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
* and STS Character Limits</a> in the <i>IAM User Guide</i>.</p>
* <note>
* <p>An Amazon Web Services conversion compresses the passed inline session policy, managed policy ARNs,
* and session tags into a packed binary format that has a separate limit. Your request can
* fail for this limit even if your plaintext meets the other requirements. The
* <code>PackedPolicySize</code> response element indicates by percentage how close the
* policies and tags for your request are to the upper size limit.</p>
* </note>
* <p>You can pass a session tag with the same key as a tag that is attached to the role. When
* you do, the session tag overrides the role tag with the same key.</p>
* <p>An administrator must grant you the permissions necessary to pass session tags. The
* administrator can also create granular permissions to allow you to pass only specific
* session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial: Using Tags
* for Attribute-Based Access Control</a> in the
* <i>IAM User Guide</i>.</p>
* <p>You can set the session tags as transitive. Transitive tags persist during role
* chaining. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining Roles
* with Session Tags</a> in the <i>IAM User Guide</i>.</p>
* <p>
* <b>Identities</b>
* </p>
* <p>Before your application can call <code>AssumeRoleWithWebIdentity</code>, you must have
* an identity token from a supported identity provider and create a role that the application
* can assume. The role that your application assumes must trust the identity provider that is
* associated with the identity token. In other words, the identity provider must be specified
* in the role's trust policy. </p>
* <important>
* <p>Calling <code>AssumeRoleWithWebIdentity</code> can result in an entry in your
* CloudTrail logs. The entry includes the <a href="http://openid.net/specs/openid-connect-core-1_0.html#Claims">Subject</a> of
* the provided web identity token. We recommend that you avoid using any personally
* identifiable information (PII) in this field. For example, you could instead use a GUID
* or a pairwise identifier, as <a href="http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes">suggested
* in the OIDC specification</a>.</p>
* </important>
* <p>For more information about how to use OIDC federation and the
* <code>AssumeRoleWithWebIdentity</code> API, see the following resources: </p>
* <ul>
* <li>
* <p>
* <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html">Using Web Identity Federation API Operations for Mobile Apps</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation Through a Web-based Identity Provider</a>. </p>
* </li>
* <li>
* <p>
* <a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK for iOS Developer Guide</a> and <a href="http://aws.amazon.com/sdkforandroid/">Amazon Web Services SDK for Android Developer Guide</a>. These toolkits
* contain sample apps that show how to invoke the identity providers. The toolkits then
* show how to use the information from these providers to get and use temporary
* security credentials. </p>
* </li>
* </ul>
* @example
* Use a bare-bones client and the command you need to make an API call.
* ```javascript
* import { STSClient, AssumeRoleWithWebIdentityCommand } from "@aws-sdk/client-sts"; // ES Modules import
* // const { STSClient, AssumeRoleWithWebIdentityCommand } = require("@aws-sdk/client-sts"); // CommonJS import
* const client = new STSClient(config);
* const input = { // AssumeRoleWithWebIdentityRequest
* RoleArn: "STRING_VALUE", // required
* RoleSessionName: "STRING_VALUE", // required
* WebIdentityToken: "STRING_VALUE", // required
* ProviderId: "STRING_VALUE",
* PolicyArns: [ // policyDescriptorListType
* { // PolicyDescriptorType
* arn: "STRING_VALUE",
* },
* ],
* Policy: "STRING_VALUE",
* DurationSeconds: Number("int"),
* };
* const command = new AssumeRoleWithWebIdentityCommand(input);
* const response = await client.send(command);
* // { // AssumeRoleWithWebIdentityResponse
* // Credentials: { // Credentials
* // AccessKeyId: "STRING_VALUE", // required
* // SecretAccessKey: "STRING_VALUE", // required
* // SessionToken: "STRING_VALUE", // required
* // Expiration: new Date("TIMESTAMP"), // required
* // },
* // SubjectFromWebIdentityToken: "STRING_VALUE",
* // AssumedRoleUser: { // AssumedRoleUser
* // AssumedRoleId: "STRING_VALUE", // required
* // Arn: "STRING_VALUE", // required
* // },
* // PackedPolicySize: Number("int"),
* // Provider: "STRING_VALUE",
* // Audience: "STRING_VALUE",
* // SourceIdentity: "STRING_VALUE",
* // };
*
* ```
*
* @param AssumeRoleWithWebIdentityCommandInput - {@link AssumeRoleWithWebIdentityCommandInput}
* @returns {@link AssumeRoleWithWebIdentityCommandOutput}
* @see {@link AssumeRoleWithWebIdentityCommandInput} for command's `input` shape.
* @see {@link AssumeRoleWithWebIdentityCommandOutput} for command's `response` shape.
* @see {@link STSClientResolvedConfig | config} for STSClient's `config` shape.
*
* @throws {@link ExpiredTokenException} (client fault)
* <p>The web identity token that was passed is expired or is not valid. Get a new identity
* token from the identity provider and then retry the request.</p>
*
* @throws {@link IDPCommunicationErrorException} (client fault)
* <p>The request could not be fulfilled because the identity provider (IDP) that was asked
* to verify the incoming identity token could not be reached. This is often a transient
* error caused by network conditions. Retry the request a limited number of times so that
* you don't exceed the request rate. If the error persists, the identity provider might be
* down or not responding.</p>
*
* @throws {@link IDPRejectedClaimException} (client fault)
* <p>The identity provider (IdP) reported that authentication failed. This might be because
* the claim is invalid.</p>
* <p>If this error is returned for the <code>AssumeRoleWithWebIdentity</code> operation, it
* can also mean that the claim has expired or has been explicitly revoked. </p>
*
* @throws {@link InvalidIdentityTokenException} (client fault)
* <p>The web identity token that was passed could not be validated by Amazon Web Services. Get a new
* identity token from the identity provider and then retry the request.</p>
*
* @throws {@link MalformedPolicyDocumentException} (client fault)
* <p>The request was rejected because the policy document was malformed. The error message
* describes the specific error.</p>
*
* @throws {@link PackedPolicyTooLargeException} (client fault)
* <p>The request was rejected because the total packed size of the session policies and
* session tags combined was too large. An Amazon Web Services conversion compresses the session policy
* document, session policy ARNs, and session tags into a packed binary format that has a
* separate limit. The error message indicates by percentage how close the policies and
* tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing Session Tags in STS</a> in
* the <i>IAM User Guide</i>.</p>
* <p>You could receive this error even though you meet other defined session policy and
* session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM and STS Entity Character Limits</a> in the <i>IAM User
* Guide</i>.</p>
*
* @throws {@link RegionDisabledException} (client fault)
* <p>STS is not activated in the requested region for the account that is being asked to
* generate credentials. The account administrator must use the IAM console to activate
* STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating and
* Deactivating STS in an Amazon Web Services Region</a> in the <i>IAM User
* Guide</i>.</p>
*
* @throws {@link STSServiceException}
* <p>Base exception class for all service exceptions from STS service.</p>
*
*
* @example To assume a role as an OpenID Connect-federated user
* ```javascript
* //
* const input = {
* DurationSeconds: 3600,
* Policy: `{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}]}`,
* ProviderId: "www.amazon.com",
* RoleArn: "arn:aws:iam::123456789012:role/FederatedWebIdentityRole",
* RoleSessionName: "app1",
* WebIdentityToken: "Atza%7CIQEBLjAsAhRFiXuWpUXuRvQ9PZL3GMFcYevydwIUFAHZwXZXXXXXXXXJnrulxKDHwy87oGKPznh0D6bEQZTSCzyoCtL_8S07pLpr0zMbn6w1lfVZKNTBdDansFBmtGnIsIapjI6xKR02Yc_2bQ8LZbUXSGm6Ry6_BG7PrtLZtj_dfCTj92xNGed-CrKqjG7nPBjNIL016GGvuS5gSvPRUxWES3VYfm1wl7WTI7jn-Pcb6M-buCgHhFOzTQxod27L9CqnOLio7N3gZAGpsp6n1-AJBOCJckcyXe2c6uD0srOJeZlKUm2eTDVMf8IehDVI0r1QOnTV6KzzAI3OY87Vd_cVMQ"
* };
* const command = new AssumeRoleWithWebIdentityCommand(input);
* const response = await client.send(command);
* /* response is
* {
* AssumedRoleUser: {
* Arn: "arn:aws:sts::123456789012:assumed-role/FederatedWebIdentityRole/app1",
* AssumedRoleId: "AROACLKWSDQRAOEXAMPLE:app1"
* },
* Audience: "client.5498841531868486423.1548@apps.example.com",
* Credentials: {
* AccessKeyId: "AKIAIOSFODNN7EXAMPLE",
* Expiration: "2014-10-24T23:00:23Z",
* SecretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
* SessionToken: "AQoDYXdzEE0a8ANXXXXXXXXNO1ewxE5TijQyp+IEXAMPLE"
* },
* PackedPolicySize: 123,
* Provider: "www.amazon.com",
* SubjectFromWebIdentityToken: "amzn1.account.AF6RHO7KZU5XRVQJGXK6HEXAMPLE"
* }
* *\/
* ```
*
* @public
*/
export declare class AssumeRoleWithWebIdentityCommand extends AssumeRoleWithWebIdentityCommand_base {
/** @internal type navigation helper, not in runtime. */
protected static __types: {
api: {
input: AssumeRoleWithWebIdentityRequest;
output: AssumeRoleWithWebIdentityResponse;
};
sdk: {
input: AssumeRoleWithWebIdentityCommandInput;
output: AssumeRoleWithWebIdentityCommandOutput;
};
};
}
@@ -0,0 +1,2 @@
export * from "./AssumeRoleCommand";
export * from "./AssumeRoleWithWebIdentityCommand";
@@ -0,0 +1,23 @@
import { Pluggable } from "@smithy/types";
import { DefaultCredentialProvider, RoleAssumer, RoleAssumerWithWebIdentity, STSRoleAssumerOptions } from "./defaultStsRoleAssumers";
import { ServiceInputTypes, ServiceOutputTypes } from "./STSClient";
/**
* The default role assumer that used by credential providers when sts:AssumeRole API is needed.
*/
export declare const getDefaultRoleAssumer: (stsOptions?: STSRoleAssumerOptions, stsPlugins?: Pluggable<ServiceInputTypes, ServiceOutputTypes>[]) => RoleAssumer;
/**
* The default role assumer that used by credential providers when sts:AssumeRoleWithWebIdentity API is needed.
*/
export declare const getDefaultRoleAssumerWithWebIdentity: (stsOptions?: STSRoleAssumerOptions, stsPlugins?: Pluggable<ServiceInputTypes, ServiceOutputTypes>[]) => RoleAssumerWithWebIdentity;
/**
* The default credential providers depend STS client to assume role with desired API: sts:assumeRole,
* sts:assumeRoleWithWebIdentity, etc. This function decorates the default credential provider with role assumers which
* encapsulates the process of calling STS commands. This can only be imported by AWS client packages to avoid circular
* dependencies.
*
* @internal
*
* @deprecated this is no longer needed. Use the defaultProvider directly,
* which will load STS if needed.
*/
export declare const decorateDefaultCredentialProvider: (provider: DefaultCredentialProvider) => DefaultCredentialProvider;
@@ -0,0 +1,43 @@
import type { CredentialProviderOptions } from "@aws-sdk/types";
import { AwsCredentialIdentity, Logger, Provider } from "@smithy/types";
import { AssumeRoleCommandInput } from "./commands/AssumeRoleCommand";
import { AssumeRoleWithWebIdentityCommandInput } from "./commands/AssumeRoleWithWebIdentityCommand";
import type { STSClient, STSClientConfig } from "./STSClient";
/**
* @public
*/
export type STSRoleAssumerOptions = Pick<STSClientConfig, "logger" | "region" | "requestHandler"> & {
credentialProviderLogger?: Logger;
parentClientConfig?: CredentialProviderOptions["parentClientConfig"];
};
/**
* @internal
*/
export type RoleAssumer = (sourceCreds: AwsCredentialIdentity, params: AssumeRoleCommandInput) => Promise<AwsCredentialIdentity>;
/**
* The default role assumer that used by credential providers when sts:AssumeRole API is needed.
* @internal
*/
export declare const getDefaultRoleAssumer: (stsOptions: STSRoleAssumerOptions, STSClient: new (options: STSClientConfig) => STSClient) => RoleAssumer;
/**
* @internal
*/
export type RoleAssumerWithWebIdentity = (params: AssumeRoleWithWebIdentityCommandInput) => Promise<AwsCredentialIdentity>;
/**
* The default role assumer that used by credential providers when sts:AssumeRoleWithWebIdentity API is needed.
* @internal
*/
export declare const getDefaultRoleAssumerWithWebIdentity: (stsOptions: STSRoleAssumerOptions, STSClient: new (options: STSClientConfig) => STSClient) => RoleAssumerWithWebIdentity;
/**
* @internal
*/
export type DefaultCredentialProvider = (input: any) => Provider<AwsCredentialIdentity>;
/**
* The default credential providers depend STS client to assume role with desired API: sts:assumeRole,
* sts:assumeRoleWithWebIdentity, etc. This function decorates the default credential provider with role assumers which
* encapsulates the process of calling STS commands. This can only be imported by AWS client packages to avoid circular
* dependencies.
*
* @internal
*/
export declare const decorateDefaultCredentialProvider: (provider: DefaultCredentialProvider) => DefaultCredentialProvider;
@@ -0,0 +1,44 @@
import { Endpoint, EndpointParameters as __EndpointParameters, EndpointV2, Provider } from "@smithy/types";
/**
* @public
*/
export interface ClientInputEndpointParameters {
region?: string | undefined | Provider<string | undefined>;
useDualstackEndpoint?: boolean | undefined | Provider<boolean | undefined>;
useFipsEndpoint?: boolean | undefined | Provider<boolean | undefined>;
endpoint?: string | Provider<string> | Endpoint | Provider<Endpoint> | EndpointV2 | Provider<EndpointV2>;
useGlobalEndpoint?: boolean | undefined | Provider<boolean | undefined>;
}
export type ClientResolvedEndpointParameters = Omit<ClientInputEndpointParameters, "endpoint"> & {
defaultSigningName: string;
};
export declare const resolveClientEndpointParameters: <T>(options: T & ClientInputEndpointParameters) => T & ClientResolvedEndpointParameters;
export declare const commonParams: {
readonly UseGlobalEndpoint: {
readonly type: "builtInParams";
readonly name: "useGlobalEndpoint";
};
readonly UseFIPS: {
readonly type: "builtInParams";
readonly name: "useFipsEndpoint";
};
readonly Endpoint: {
readonly type: "builtInParams";
readonly name: "endpoint";
};
readonly Region: {
readonly type: "builtInParams";
readonly name: "region";
};
readonly UseDualStack: {
readonly type: "builtInParams";
readonly name: "useDualstackEndpoint";
};
};
export interface EndpointParameters extends __EndpointParameters {
Region?: string | undefined;
UseDualStack?: boolean | undefined;
UseFIPS?: boolean | undefined;
Endpoint?: string | undefined;
UseGlobalEndpoint?: boolean | undefined;
}
@@ -0,0 +1,5 @@
import { EndpointV2, Logger } from "@smithy/types";
import { EndpointParameters } from "./EndpointParameters";
export declare const defaultEndpointResolver: (endpointParams: EndpointParameters, context?: {
logger?: Logger;
}) => EndpointV2;
@@ -0,0 +1,2 @@
import { RuleSetObject } from "@smithy/types";
export declare const ruleSet: RuleSetObject;
@@ -0,0 +1,9 @@
import { AwsRegionExtensionConfiguration } from "@aws-sdk/types";
import { HttpHandlerExtensionConfiguration } from "@smithy/protocol-http";
import { DefaultExtensionConfiguration } from "@smithy/types";
import { HttpAuthExtensionConfiguration } from "./auth/httpAuthExtensionConfiguration";
/**
* @internal
*/
export interface STSExtensionConfiguration extends HttpHandlerExtensionConfiguration, DefaultExtensionConfiguration, AwsRegionExtensionConfiguration, HttpAuthExtensionConfiguration {
}

Some files were not shown because too many files have changed in this diff Show More