Skip to content

Commit 84d6c18

Browse files
kuhekuhe
authored
chore(credential-providers): move base fromTempCreds impl to non-browser file (#6836)
1 parent 62ba401 commit 84d6c18

File tree

4 files changed

+80
-79
lines changed

4 files changed

+80
-79
lines changed

‎packages/credential-providers/src/fromTemporaryCredentials.base.ts‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
import type { AssumeRoleCommandInput, STSClient, STSClientConfig } from "@aws-sdk/nested-clients/sts";
2+
import type {
3+
AwsIdentityProperties,
4+
CredentialProviderOptions,
5+
RuntimeConfigAwsCredentialIdentityProvider,
6+
} from "@aws-sdk/types";
7+
import { CredentialsProviderError } from "@smithy/property-provider";
8+
import { AwsCredentialIdentity, AwsCredentialIdentityProvider, Pluggable } from "@smithy/types";
9+
10+
export interface FromTemporaryCredentialsOptions extends CredentialProviderOptions {
11+
params: Omit<AssumeRoleCommandInput, "RoleSessionName"> & { RoleSessionName?: string };
12+
masterCredentials?: AwsCredentialIdentity | AwsCredentialIdentityProvider;
13+
clientConfig?: STSClientConfig;
14+
clientPlugins?: Pluggable<any, any>[];
15+
mfaCodeProvider?: (mfaSerial: string) => Promise<string>;
16+
}
17+
18+
export const fromTemporaryCredentials = (
19+
options: FromTemporaryCredentialsOptions,
20+
credentialDefaultProvider?: () => AwsCredentialIdentityProvider
21+
): RuntimeConfigAwsCredentialIdentityProvider => {
22+
let stsClient: STSClient;
23+
return async (awsIdentityProperties: AwsIdentityProperties = {}): Promise<AwsCredentialIdentity> => {
24+
options.logger?.debug("@aws-sdk/credential-providers - fromTemporaryCredentials (STS)");
25+
const params = { ...options.params, RoleSessionName: options.params.RoleSessionName ?? "aws-sdk-js-" + Date.now() };
26+
if (params?.SerialNumber) {
27+
if (!options.mfaCodeProvider) {
28+
throw new CredentialsProviderError(
29+
`Temporary credential requires multi-factor authentication, but no MFA code callback was provided.`,
30+
{
31+
tryNextLink: false,
32+
logger: options.logger,
33+
}
34+
);
35+
}
36+
params.TokenCode = await options.mfaCodeProvider(params?.SerialNumber);
37+
}
38+
39+
const { AssumeRoleCommand, STSClient } = await import("./loadSts");
40+
41+
if (!stsClient) {
42+
const defaultCredentialsOrError =
43+
typeof credentialDefaultProvider === "function" ? credentialDefaultProvider() : undefined;
44+
45+
const { callerClientConfig } = awsIdentityProperties;
46+
stsClient = new STSClient({
47+
...options.clientConfig,
48+
credentials:
49+
options.masterCredentials ??
50+
options.clientConfig?.credentials ??
51+
callerClientConfig?.credentialDefaultProvider?.() ??
52+
defaultCredentialsOrError,
53+
});
54+
}
55+
if (options.clientPlugins) {
56+
for (const plugin of options.clientPlugins) {
57+
stsClient.middlewareStack.use(plugin);
58+
}
59+
}
60+
const { Credentials } = await stsClient.send(new AssumeRoleCommand(params));
61+
if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
62+
throw new CredentialsProviderError(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`, {
63+
logger: options.logger,
64+
});
65+
}
66+
return {
67+
accessKeyId: Credentials.AccessKeyId,
68+
secretAccessKey: Credentials.SecretAccessKey,
69+
sessionToken: Credentials.SessionToken,
70+
expiration: Credentials.Expiration,
71+
// TODO(credentialScope): access normally when shape is updated.
72+
credentialScope: (Credentials as any).CredentialScope,
73+
};
74+
};
75+
};

‎packages/credential-providers/src/fromTemporaryCredentials.browser.ts‎

Lines changed: 1 addition & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1 @@
1-
import type { AssumeRoleCommandInput, STSClient, STSClientConfig } from "@aws-sdk/nested-clients/sts";
2-
import type {
3-
AwsIdentityProperties,
4-
CredentialProviderOptions,
5-
RuntimeConfigAwsCredentialIdentityProvider,
6-
} from "@aws-sdk/types";
7-
import { CredentialsProviderError } from "@smithy/property-provider";
8-
import { AwsCredentialIdentity, AwsCredentialIdentityProvider, Pluggable } from "@smithy/types";
9-
10-
export interface FromTemporaryCredentialsOptions extends CredentialProviderOptions {
11-
params: Omit<AssumeRoleCommandInput, "RoleSessionName"> & { RoleSessionName?: string };
12-
masterCredentials?: AwsCredentialIdentity | AwsCredentialIdentityProvider;
13-
clientConfig?: STSClientConfig;
14-
clientPlugins?: Pluggable<any, any>[];
15-
mfaCodeProvider?: (mfaSerial: string) => Promise<string>;
16-
}
17-
18-
export const fromTemporaryCredentials = (
19-
options: FromTemporaryCredentialsOptions,
20-
credentialDefaultProvider?: () => AwsCredentialIdentityProvider
21-
): RuntimeConfigAwsCredentialIdentityProvider => {
22-
let stsClient: STSClient;
23-
return async (awsIdentityProperties: AwsIdentityProperties = {}): Promise<AwsCredentialIdentity> => {
24-
options.logger?.debug("@aws-sdk/credential-providers - fromTemporaryCredentials (STS)");
25-
const params = { ...options.params, RoleSessionName: options.params.RoleSessionName ?? "aws-sdk-js-" + Date.now() };
26-
if (params?.SerialNumber) {
27-
if (!options.mfaCodeProvider) {
28-
throw new CredentialsProviderError(
29-
`Temporary credential requires multi-factor authentication, but no MFA code callback was provided.`,
30-
{
31-
tryNextLink: false,
32-
logger: options.logger,
33-
}
34-
);
35-
}
36-
params.TokenCode = await options.mfaCodeProvider(params?.SerialNumber);
37-
}
38-
39-
const { AssumeRoleCommand, STSClient } = await import("./loadSts");
40-
41-
if (!stsClient) {
42-
const defaultCredentialsOrError =
43-
typeof credentialDefaultProvider === "function" ? credentialDefaultProvider() : undefined;
44-
45-
const { callerClientConfig } = awsIdentityProperties;
46-
stsClient = new STSClient({
47-
...options.clientConfig,
48-
credentials:
49-
options.masterCredentials ??
50-
options.clientConfig?.credentials ??
51-
callerClientConfig?.credentialDefaultProvider?.() ??
52-
defaultCredentialsOrError,
53-
});
54-
}
55-
if (options.clientPlugins) {
56-
for (const plugin of options.clientPlugins) {
57-
stsClient.middlewareStack.use(plugin);
58-
}
59-
}
60-
const { Credentials } = await stsClient.send(new AssumeRoleCommand(params));
61-
if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
62-
throw new CredentialsProviderError(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`, {
63-
logger: options.logger,
64-
});
65-
}
66-
return {
67-
accessKeyId: Credentials.AccessKeyId,
68-
secretAccessKey: Credentials.SecretAccessKey,
69-
sessionToken: Credentials.SessionToken,
70-
expiration: Credentials.Expiration,
71-
// TODO(credentialScope): access normally when shape is updated.
72-
credentialScope: (Credentials as any).CredentialScope,
73-
};
74-
};
75-
};
1+
export { FromTemporaryCredentialsOptions, fromTemporaryCredentials } from "./fromTemporaryCredentials.base";

‎packages/credential-providers/src/fromTemporaryCredentials.spec.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
import { AssumeRoleCommand, STSClient } from "@aws-sdk/nested-clients/sts";
2-
import { afterEach, beforeEach, describe, expect, test as it, vi } from "vitest";
2+
import { beforeEach, describe, expect, test as it, vi } from "vitest";
33

44
import { fromTemporaryCredentials as fromTemporaryCredentialsNode } from "./fromTemporaryCredentials";
5-
import { fromTemporaryCredentials } from "./fromTemporaryCredentials.browser";
5+
import { fromTemporaryCredentials } from "./fromTemporaryCredentials.base";
66

77
const mockSend = vi.fn();
88
const mockUsePlugin = vi.fn();

‎packages/credential-providers/src/fromTemporaryCredentials.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
import type { RuntimeConfigAwsCredentialIdentityProvider } from "@aws-sdk/types";
22

33
import { fromNodeProviderChain } from "./fromNodeProviderChain";
4-
import type { FromTemporaryCredentialsOptions } from "./fromTemporaryCredentials.browser";
5-
import { fromTemporaryCredentials as fromTemporaryCredentialsBase } from "./fromTemporaryCredentials.browser";
4+
import type { FromTemporaryCredentialsOptions } from "./fromTemporaryCredentials.base";
5+
import { fromTemporaryCredentials as fromTemporaryCredentialsBase } from "./fromTemporaryCredentials.base";
66

77
/**
88
* @public

0 commit comments

Comments
 (0)