|
| 1 | +/** |
| 2 | + * Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved. |
| 3 | + * This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license. |
| 4 | + */ |
| 5 | +import { readFileSync } from "fs"; |
| 6 | +import FederationClient from "./models/federation-client"; |
| 7 | +import SessionKeySupplier from "./models/session-key-supplier"; |
| 8 | +import SecurityTokenAdapter from "./security-token-adapter"; |
| 9 | + |
| 10 | +/** |
| 11 | + * This class gets a security token from file. |
| 12 | + */ |
| 13 | +export default class FileBasedResourcePrincipalFederationClient implements FederationClient { |
| 14 | + private securityTokenAdapter: SecurityTokenAdapter; |
| 15 | + constructor( |
| 16 | + private sessionKeySupplier: SessionKeySupplier, |
| 17 | + private resourcePrincipalSessionTokenPath: string |
| 18 | + ) { |
| 19 | + this.sessionKeySupplier = sessionKeySupplier; |
| 20 | + this.securityTokenAdapter = new SecurityTokenAdapter("", sessionKeySupplier); |
| 21 | + this.resourcePrincipalSessionTokenPath = resourcePrincipalSessionTokenPath; |
| 22 | + } |
| 23 | + |
| 24 | + /** |
| 25 | + * Gets a security token. If there is already a valid token cached, it will be returned. Else this will make a call |
| 26 | + * to the auth service to get a new token, using the provided suppliers. |
| 27 | + * |
| 28 | + * This method is thread-safe. |
| 29 | + * @return the security token |
| 30 | + * @throws OciError If there is any issue with getting a token from the auth server |
| 31 | + */ |
| 32 | + async getSecurityToken(): Promise<string> { |
| 33 | + if (this.securityTokenAdapter.isValid()) { |
| 34 | + return this.securityTokenAdapter.getSecurityToken(); |
| 35 | + } |
| 36 | + return await this.refreshAndGetSecurityTokenInner(true); |
| 37 | + } |
| 38 | + |
| 39 | + /** |
| 40 | + * Return a claim embedded in the security token |
| 41 | + * @param key the name of the claim |
| 42 | + * @return the value of the claim or null if unable to find |
| 43 | + */ |
| 44 | + async getStringClaim(key: string): Promise<string | null> { |
| 45 | + await this.refreshAndGetSecurityToken(); |
| 46 | + return this.securityTokenAdapter.getStringClaim(key); |
| 47 | + } |
| 48 | + |
| 49 | + async refreshAndGetSecurityToken(): Promise<string> { |
| 50 | + return await this.refreshAndGetSecurityTokenInner(false); |
| 51 | + } |
| 52 | + |
| 53 | + private async refreshAndGetSecurityTokenInner( |
| 54 | + doFinalTokenValidityCheck: boolean |
| 55 | + ): Promise<string> { |
| 56 | + // Check again to see if the JWT is still invalid, unless we want to skip that check |
| 57 | + if (!doFinalTokenValidityCheck || !this.securityTokenAdapter.isValid()) { |
| 58 | + this.sessionKeySupplier.refreshKeys(); |
| 59 | + this.securityTokenAdapter = this.getSecurityTokenFromFile(); |
| 60 | + return this.securityTokenAdapter.getSecurityToken(); |
| 61 | + } |
| 62 | + return this.securityTokenAdapter.getSecurityToken(); |
| 63 | + } |
| 64 | + |
| 65 | + /** |
| 66 | + * Gets a security token from file |
| 67 | + * @return the security token, which is basically a JWT token string |
| 68 | + */ |
| 69 | + protected getSecurityTokenFromFile(): SecurityTokenAdapter { |
| 70 | + const keyPair = this.sessionKeySupplier.getKeyPair(); |
| 71 | + if (!keyPair) { |
| 72 | + throw Error("Keypair for session was not provided"); |
| 73 | + } |
| 74 | + let securityToken = ""; |
| 75 | + try { |
| 76 | + securityToken = readFileSync(this.resourcePrincipalSessionTokenPath, "utf8"); |
| 77 | + } catch (e) { |
| 78 | + throw Error(`Failed to read token due to error: ${e}`); |
| 79 | + } |
| 80 | + return new SecurityTokenAdapter(securityToken, this.sessionKeySupplier); |
| 81 | + } |
| 82 | +} |
0 commit comments