@sap-cloud-sdk/connectivity/dist/scp-cf/environment-accessor/ias.js

SAP Cloud SDK for JavaScript connectivity

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.identityServicesCache = void 0;
exports.getIdentityServiceInstanceFromCredentials = getIdentityServiceInstanceFromCredentials;
const xssec_1 = require("@sap/xssec");
const util_1 = require("@sap-cloud-sdk/util");
const subdomain_replacer_1 = require("../subdomain-replacer");
const logger = (0, util_1.createLogger)({
    package: 'connectivity',
    messageContext: 'ias'
});
/**
 * @internal
 * A cache for `IdentityService` instances.
 * Direct access from outside this module outside tests is discouraged.
 */
exports.identityServicesCache = new Map();
/**
 * Extracts the subdomain from JWT and updates credentials if found.
 * @param credentials - Identity service credentials.
 * @param jwt - JWT string or payload to extract subdomain from.
 * @returns Updated credentials and extracted subdomain (if any).
 */
function extractSubdomainFromJwt(credentials, jwt) {
    const decodedJwt = typeof jwt === 'string' ? new xssec_1.IdentityServiceToken(jwt) : { payload: jwt };
    const payload = decodedJwt.payload;
    // For IAS tokens, prefer ias_iss claim over standard iss claim
    const subdomain = (0, subdomain_replacer_1.getIssuerSubdomain)(payload, true);
    if (!subdomain) {
        logger.warn('Could not extract subdomain from JWT assertion issuer. Falling back to service binding URL.');
        return { credentials, subdomain };
    }
    // Replace subdomain in the URL from the service binding
    // Reason: We don't want to blindly trust the URL in the assertion
    const updatedCredentials = {
        ...credentials,
        url: (0, subdomain_replacer_1.replaceSubdomain)(credentials.url, subdomain)
    };
    return { credentials: updatedCredentials, subdomain };
}
/**
 * @internal
 * @param credentials - Identity service credentials extracted from a service binding or re-use service. Required to create the xssec `IdentityService` instance.
 * @param jwt - Optional JWT string or payload to extract the issuer URL for bearer assertion flows.
 * @param disableCache - Value to enable or disable JWKS cache in the xssec library. Defaults to false.
 * @returns An instance of {@link @sap/xssec/IdentityService} for the provided credentials.
 */
function getIdentityServiceInstanceFromCredentials(credentials, jwt, disableCache = false) {
    const serviceConfig = disableCache
        ? {
            validation: {
                jwks: {
                    expirationTime: 0,
                    refreshPeriod: 0
                }
            }
        }
        : undefined;
    let subdomain;
    if (jwt) {
        const result = extractSubdomainFromJwt(credentials, jwt);
        credentials = result.credentials;
        subdomain = result.subdomain;
    }
    subdomain = subdomain ?? (0, subdomain_replacer_1.getIssuerSubdomain)({ iss: credentials.url });
    const cacheKey = `${credentials.clientid}:${subdomain}:${disableCache}`;
    // TODO: Use Map.prototype.getOrInsertComputed() when available
    let identityService = exports.identityServicesCache.get(cacheKey);
    if (identityService === undefined) {
        identityService = new xssec_1.IdentityService(credentials, serviceConfig);
        exports.identityServicesCache.set(cacheKey, identityService);
    }
    return identityService;
}
//# sourceMappingURL=ias.js.map