@sap-cloud-sdk/connectivity
Version:
SAP Cloud SDK for JavaScript connectivity
116 lines • 4.14 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.isSubscriberToken = isSubscriberToken;
exports.getSubscriberToken = getSubscriberToken;
exports.getRequiredSubscriberToken = getRequiredSubscriberToken;
exports.hasTokens = hasTokens;
exports.getJwtForTenant = getJwtForTenant;
exports.getJwtForUser = getJwtForUser;
const util_1 = require("@sap-cloud-sdk/util");
const jwt_1 = require("../jwt");
const token_accessor_1 = require("../token-accessor");
const subdomain_replacer_1 = require("../subdomain-replacer");
const logger = (0, util_1.createLogger)({
package: 'connectivity',
messageContext: 'destination-accessor-service'
});
/**
* @internal
* @param token - The token to check
* @returns Whether the given token is a subscriber token.
*/
function isSubscriberToken(token) {
return token.userJwt || token.serviceJwt;
}
/**
* @internal
*/
async function getSubscriberToken(options) {
const userJwt = options.jwt ? (0, jwt_1.getJwtPair)(options.jwt) : undefined;
const serviceJwt = await retrieveServiceToken(options, userJwt?.decoded);
return { userJwt, serviceJwt };
}
async function retrieveServiceToken(options, decodedUserJwt) {
const jwt = getJwtForServiceToken(options.iss, decodedUserJwt);
if (jwt) {
try {
return (0, jwt_1.getJwtPair)(await (0, token_accessor_1.serviceToken)('destination', {
...options,
jwt
}));
}
catch (err) {
logger.warn(`Failed to fetch subscriber service token for destination. This is only relevant if you are using subscriber destinations. Failure caused by: ${err.message}`);
}
}
}
function getJwtForServiceToken(iss, decodedUserJwt) {
if (iss) {
logger.warn('Using `iss` option instead of a full JWT to fetch a destination. No validation is performed.' +
'Passing a user-supplied value without verifying it may lead to unintended cross-tenant destination access.');
return { ext_attr: { zdn: (0, subdomain_replacer_1.getIssuerSubdomain)({ iss }) } };
}
if (decodedUserJwt?.zid || decodedUserJwt?.app_tid) {
return decodedUserJwt;
}
}
/**
* @internal
* Get a subscriber token pair with required fields. Checks that at least one of the tokens exists and sets defaults if needed.
* @returns The decoded subscriber tokens.
*/
function getRequiredSubscriberToken(token) {
if (token) {
const { userJwt, serviceJwt } = token;
const requiredToken = {
userJwt: userJwt || serviceJwt,
serviceJwt: serviceJwt || userJwt
};
if (isRequired(requiredToken)) {
return requiredToken;
}
}
throw new Error('Could not get subscriber token: Token value is undefined.');
}
/**
* Type guard to check whether a token has both `userJwt` and `serviceJwt` defined.
* @param token - Token to check.
* @returns Whether both tokens are defined.
*/
function isRequired(token) {
return !!(token?.userJwt && token.serviceJwt);
}
/**
* @internal
* Check whether the subscriber token has one of the tokens set
* @param token - Subscriber token pair to check
* @returns True if at least one of the tokens exist.
*/
function hasTokens(token) {
return !!token?.userJwt || !!token?.serviceJwt;
}
/**
* @internal
* Retrieve the token to use for tenant identification.
*
* If `iss` or XSUAA user JWT was passed, this is the `serviceJwt`.
* If a custom user JWT was passed, this is used.
* @param token - The subscriber token for service and user.
* @returns The decoded JWT to use for tenant identification.
*/
function getJwtForTenant(token) {
return token.serviceJwt;
}
/**
* @internal
* Retrieve the token to use for user identification.
*
* If a user token was passed, this is used.
* If only `iss` was passed try to get the user from the service token.
* @param token - The subscriber token for service and user.
* @returns The decoded JWT to use for user identification.
*/
function getJwtForUser(token) {
return token.userJwt;
}
//# sourceMappingURL=get-subscriber-token.js.map