@azure/identity/dist/commonjs/credentials/workloadIdentityCredential.js

Provides credential implementations for Azure SDK libraries that can authenticate with Microsoft Entra ID

var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
var workloadIdentityCredential_exports = {};
__export(workloadIdentityCredential_exports, {
  SupportedWorkloadEnvironmentVariables: () => SupportedWorkloadEnvironmentVariables,
  WorkloadIdentityCredential: () => WorkloadIdentityCredential
});
module.exports = __toCommonJS(workloadIdentityCredential_exports);
var import_logging = require("../util/logging.js");
var import_clientAssertionCredential = require("./clientAssertionCredential.js");
var import_errors = require("../errors.js");
var import_tenantIdUtils = require("../util/tenantIdUtils.js");
var import_promises = require("node:fs/promises");
const credentialName = "WorkloadIdentityCredential";
const SupportedWorkloadEnvironmentVariables = [
  "AZURE_TENANT_ID",
  "AZURE_CLIENT_ID",
  "AZURE_FEDERATED_TOKEN_FILE"
];
const logger = (0, import_logging.credentialLogger)(credentialName);
class WorkloadIdentityCredential {
  client;
  azureFederatedTokenFileContent = void 0;
  cacheDate = void 0;
  federatedTokenFilePath;
  /**
   * WorkloadIdentityCredential supports Microsoft Entra Workload ID on Kubernetes.
   *
   * @param options - The identity client options to use for authentication.
   */
  constructor(options) {
    const assignedEnv = (0, import_logging.processEnvVars)(SupportedWorkloadEnvironmentVariables).assigned.join(", ");
    logger.info(`Found the following environment variables: ${assignedEnv}`);
    const workloadIdentityCredentialOptions = options ?? {};
    const tenantId = workloadIdentityCredentialOptions.tenantId || process.env.AZURE_TENANT_ID;
    const clientId = workloadIdentityCredentialOptions.clientId || process.env.AZURE_CLIENT_ID;
    this.federatedTokenFilePath = workloadIdentityCredentialOptions.tokenFilePath || process.env.AZURE_FEDERATED_TOKEN_FILE;
    if (tenantId) {
      (0, import_tenantIdUtils.checkTenantId)(logger, tenantId);
    }
    if (!clientId) {
      throw new import_errors.CredentialUnavailableError(
        `${credentialName}: is unavailable. clientId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_CLIENT_ID".
        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
      );
    }
    if (!tenantId) {
      throw new import_errors.CredentialUnavailableError(
        `${credentialName}: is unavailable. tenantId is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_TENANT_ID".
        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
      );
    }
    if (!this.federatedTokenFilePath) {
      throw new import_errors.CredentialUnavailableError(
        `${credentialName}: is unavailable. federatedTokenFilePath is a required parameter. In DefaultAzureCredential and ManagedIdentityCredential, this can be provided as an environment variable - "AZURE_FEDERATED_TOKEN_FILE".
        See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`
      );
    }
    logger.info(
      `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${workloadIdentityCredentialOptions.clientId} and federated token path: [REDACTED]`
    );
    this.client = new import_clientAssertionCredential.ClientAssertionCredential(
      tenantId,
      clientId,
      this.readFileContents.bind(this),
      options
    );
  }
  /**
   * Authenticates with Microsoft Entra ID and returns an access token if successful.
   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
   *
   * @param scopes - The list of scopes for which the token will have access.
   * @param options - The options used to configure any requests this
   *                TokenCredential implementation might make.
   */
  async getToken(scopes, options) {
    if (!this.client) {
      const errorMessage = `${credentialName}: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters. 
      In DefaultAzureCredential and ManagedIdentityCredential, these can be provided as environment variables - 
      "AZURE_TENANT_ID",
      "AZURE_CLIENT_ID",
      "AZURE_FEDERATED_TOKEN_FILE". See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/workloadidentitycredential/troubleshoot`;
      logger.info(errorMessage);
      throw new import_errors.CredentialUnavailableError(errorMessage);
    }
    logger.info("Invoking getToken() of Client Assertion Credential");
    return this.client.getToken(scopes, options);
  }
  async readFileContents() {
    if (this.cacheDate !== void 0 && Date.now() - this.cacheDate >= 1e3 * 60 * 5) {
      this.azureFederatedTokenFileContent = void 0;
    }
    if (!this.federatedTokenFilePath) {
      throw new import_errors.CredentialUnavailableError(
        `${credentialName}: is unavailable. Invalid file path provided ${this.federatedTokenFilePath}.`
      );
    }
    if (!this.azureFederatedTokenFileContent) {
      const file = await (0, import_promises.readFile)(this.federatedTokenFilePath, "utf8");
      const value = file.trim();
      if (!value) {
        throw new import_errors.CredentialUnavailableError(
          `${credentialName}: is unavailable. No content on the file ${this.federatedTokenFilePath}.`
        );
      } else {
        this.azureFederatedTokenFileContent = value;
        this.cacheDate = Date.now();
      }
    }
    return this.azureFederatedTokenFileContent;
  }
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  SupportedWorkloadEnvironmentVariables,
  WorkloadIdentityCredential
});
//# sourceMappingURL=workloadIdentityCredential.js.map