@mindconnect/mindconnect-nodejs
Version:
NodeJS Library for Siemens Insights Hub Connectivity - TypeScript SDK for Insights Hub and Industrial IoT - Command Line Interface - Insights Hub Development Proxy (Siemens Insights Hub was formerly known as MindSphere)
142 lines • 5.93 kB
JavaScript
;
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.AuthBase = void 0;
const cross_fetch_1 = require("cross-fetch");
const debug = require("debug");
const jwt = require("jsonwebtoken");
const mindconnect_base_1 = require("./mindconnect-base");
const utils_1 = require("./utils");
const log = debug("mindconnect-authbase");
class AuthBase extends mindconnect_base_1.MindConnectBase {
ValidateToken() {
return __awaiter(this, void 0, void 0, function* () {
yield (0, utils_1.retry)(5, () => this.AcquirePublicKey());
const fullToken = jwt.decode(this._accessToken.access_token, {
complete: true,
});
const tokenkey = fullToken.header.kid;
// console.log(tokenkey);
let publicKey = this.getPublicKey(tokenkey);
if (!publicKey) {
this._oauthResponse = undefined; // maybe we have an old token and there was a key rotation
yield (0, utils_1.retry)(5, () => this.AcquirePublicKey());
publicKey = this.getPublicKey(tokenkey);
}
if (!publicKey) {
throw new Error(`Token validation error, can't find certificate for ${tokenkey}`);
}
if (!this._accessToken.access_token)
throw new Error("Invalid access token");
const result = jwt.verify(this._accessToken.access_token, publicKey);
log("Token validated, still good");
return result ? true : false;
});
}
getPublicKey(tokenkey) {
let publicKey = undefined;
for (const key of this._oauthResponse.keys) {
if (key.kid === tokenkey) {
publicKey = key.value;
}
break;
}
return publicKey;
}
AcquirePublicKey() {
return __awaiter(this, void 0, void 0, function* () {
if (!this._oauthResponse) {
const headers = this._headers;
const url = `${(0, utils_1.getPiamUrl)(this._gateway, this._tenant)}token_keys`;
log(`AcquirePublicKey Headers: ${JSON.stringify(headers)} Url: ${url}`);
try {
const response = yield (0, cross_fetch_1.default)(url, {
method: "GET",
headers: headers,
agent: this._proxyHttpAgent,
});
if (!response.ok) {
throw new Error(`${response.statusText} ${yield response.text()}`);
}
if (response.status >= 200 && response.status <= 299) {
const json = yield response.json();
log(`OauthPublicKey Response ${JSON.stringify(json)}`);
this._oauthResponse = json;
}
else {
throw new Error(`invalid response ${JSON.stringify(response)}`);
}
}
catch (err) {
log(err);
throw new Error(`Network error occured ${err.message}`);
}
}
return true;
});
}
RenewToken() {
return __awaiter(this, void 0, void 0, function* () {
if (this._accessToken) {
try {
yield this.ValidateToken();
}
catch (err) {
log(`jwt exchange token expired - renewing : ${err}`);
this._accessToken = undefined;
if (err.name === "JsonWebTokenError" && err.message === "invalid signature") {
log("invalid certificate - renewing");
this._oauthResponse = undefined;
}
}
}
if (!this._accessToken) {
yield this.AcquireToken();
yield this.ValidateToken();
if (!this._accessToken) {
throw new Error("Error aquiering the new token!");
}
}
return true;
});
}
/**
* Creates an instance of CredentialAuth.
* @param {string} _gateway
* @param {string} _basicAuth
* @param {string} _tenant
*
* @memberOf CredentialAuth
*/
constructor(_gateway, _basicAuth, _tenant) {
super();
this._gateway = _gateway;
this._basicAuth = _basicAuth;
this._tenant = _tenant;
if (!_basicAuth || !_basicAuth.startsWith("Basic")) {
throw new Error("You have to pass the basic authentication header (Basic: <base64encoded login:password> in the constructor. Wrong Passkey in CLI?");
}
if (!(0, utils_1.isUrl)(_gateway)) {
throw new Error("the gateway must be an URL (e.g. https://gateway.eu1.mindsphere.io");
}
if (!_tenant) {
throw new Error("You have to provide a tenant");
}
}
GetTenant() {
return this._tenant;
}
GetGateway() {
return this._gateway;
}
}
exports.AuthBase = AuthBase;
//# sourceMappingURL=auth-base.js.map