@n8n/n8n-nodes-langchain/dist/utils/aws/resolveAwsCredentials.js

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.resolveAwsCredentials = resolveAwsCredentials;
const ai_utilities_1 = require("@n8n/ai-utilities");
const node_http_handler_1 = require("@smithy/node-http-handler");
const aws_credentials_1 = require("n8n-nodes-base/aws-credentials");
const n8n_workflow_1 = require("n8n-workflow");
async function resolveAwsCredentials(context, itemIndex = 0) {
    const authentication = context.getNodeParameter('authentication', itemIndex, 'iam');
    if (authentication !== 'assumeRole') {
        const creds = (await context.getCredentials('aws'));
        (0, aws_credentials_1.assertSupportedAwsRegion)(creds.region);
        const identity = {
            accessKeyId: creds.accessKeyId,
            secretAccessKey: creds.secretAccessKey,
            ...(creds.temporaryCredentials && creds.sessionToken
                ? { sessionToken: creds.sessionToken }
                : {}),
        };
        return {
            region: creds.region,
            credentials: identity,
            bedrockRuntimeEndpoint: creds.bedrockRuntimeEndpoint,
        };
    }
    const creds = (await context.getCredentials('awsAssumeRole'));
    (0, aws_credentials_1.assertSupportedAwsRegion)(creds.region);
    if (!creds.roleArn || creds.roleArn.trim() === '') {
        throw new n8n_workflow_1.UserError('Role ARN is required when assuming a role.');
    }
    if (!creds.externalId || creds.externalId.trim() === '') {
        throw new n8n_workflow_1.UserError('External ID is required when assuming a role.');
    }
    if (!creds.roleSessionName || creds.roleSessionName.trim() === '') {
        throw new n8n_workflow_1.UserError('Role Session Name is required when assuming a role.');
    }
    let masterCredentials;
    if (creds.useSystemCredentialsForRole) {
        masterCredentials = async () => {
            const sys = await (0, aws_credentials_1.getSystemCredentials)(creds.region);
            if (!sys) {
                throw new n8n_workflow_1.UserError('System AWS credentials are required for role assumption. Please ensure AWS credentials are available via environment variables, instance metadata, or container role.');
            }
            return {
                accessKeyId: sys.accessKeyId,
                secretAccessKey: sys.secretAccessKey,
                ...(sys.sessionToken ? { sessionToken: sys.sessionToken } : {}),
            };
        };
    }
    else {
        if (!creds.stsAccessKeyId || creds.stsAccessKeyId.trim() === '') {
            throw new n8n_workflow_1.UserError('STS Access Key ID is required when not using system credentials.');
        }
        if (!creds.stsSecretAccessKey || creds.stsSecretAccessKey.trim() === '') {
            throw new n8n_workflow_1.UserError('STS Secret Access Key is required when not using system credentials.');
        }
        masterCredentials = {
            accessKeyId: creds.stsAccessKeyId.trim(),
            secretAccessKey: creds.stsSecretAccessKey.trim(),
            ...(creds.stsSessionToken?.trim() ? { sessionToken: creds.stsSessionToken.trim() } : {}),
        };
    }
    const stsTarget = `https://sts.${creds.region}.${(0, aws_credentials_1.getAwsDomain)(creds.region)}`;
    const proxyAgent = (0, ai_utilities_1.getNodeProxyAgent)(stsTarget);
    const requestHandler = proxyAgent
        ? new node_http_handler_1.NodeHttpHandler({ httpAgent: proxyAgent, httpsAgent: proxyAgent })
        : undefined;
    const { fromTemporaryCredentials } = await import('@aws-sdk/credential-providers');
    const provider = fromTemporaryCredentials({
        params: {
            RoleArn: creds.roleArn.trim(),
            RoleSessionName: creds.roleSessionName.trim(),
            ExternalId: creds.externalId.trim(),
        },
        masterCredentials,
        clientConfig: {
            region: creds.region,
            ...(requestHandler ? { requestHandler } : {}),
        },
    });
    return {
        region: creds.region,
        credentials: provider,
        bedrockRuntimeEndpoint: creds.bedrockRuntimeEndpoint,
    };
}
//# sourceMappingURL=resolveAwsCredentials.js.map