import { Credentials , Provider } from "@aws-sdk/types" ; import { AssumeRoleCommand , AssumeRoleCommandInput } from "./commands/AssumeRoleCommand" ; import { AssumeRoleWithWebIdentityCommand , AssumeRoleWithWebIdentityCommandInput , } from "./commands/AssumeRoleWithWebIdentityCommand" ; import type { STSClient , STSClientConfig , STSClientResolvedConfig } from "./STSClient" ; internal export type RoleAssumer = ( sourceCreds : Credentials , params : AssumeRoleCommandInput ) => Promise < Credentials > ; const ASSUME_ROLE_DEFAULT_REGION = "us-east-1" ; /**
 * Inject the fallback STS region of us-east-1.
 */ const decorateDefaultRegion = ( region ) : string | Provider < string > => { if ( typeof region !== "function" ) { return region === undefined ? ASSUME_ROLE_DEFAULT_REGION : region ; } return async ( ) => { try { return await region ( ) ; } catch ( e ) { return ASSUME_ROLE_DEFAULT_REGION ; } } ; } ; internal export const getDefaultRoleAssumer = ( stsOptions , stsClientCtor ) : RoleAssumer => { let stsClient ; let closureSourceCreds ; return async ( sourceCreds , params ) => { closureSourceCreds = sourceCreds ; if ( ! stsClient ) { const { logger , region , requestHandler } = stsOptions ; stsClient = new stsClientCtor ( { logger , credentialDefaultProvider : ( ) => async ( ) => closureSourceCreds , region : decorateDefaultRegion ( region || stsOptions . region ) , ... ( requestHandler ? { requestHandler } : { } ) , } ) ; } const { Credentials } = await stsClient . send ( new AssumeRoleCommand ( params ) ) ; if ( ! Credentials || ! Credentials . AccessKeyId || ! Credentials . SecretAccessKey ) { throw new Error ( `Invalid response from STS.assumeRole call with role ${ params . RoleArn }` ) ; } return { accessKeyId : Credentials . AccessKeyId , secretAccessKey : Credentials . SecretAccessKey , sessionToken : Credentials . SessionToken , expiration : Credentials . Expiration , } ; } ; } ; internal export type RoleAssumerWithWebIdentity = ( params : AssumeRoleWithWebIdentityCommandInput ) => Promise < Credentials > ; internal export const getDefaultRoleAssumerWithWebIdentity = ( stsOptions , stsClientCtor ) : RoleAssumerWithWebIdentity => { let stsClient ; return async ( params ) => { if ( ! stsClient ) { const { logger , region , requestHandler } = stsOptions ; stsClient = new stsClientCtor ( { logger , region : decorateDefaultRegion ( region || stsOptions . region ) , ... ( requestHandler ? { requestHandler } : { } ) , } ) ; } const { Credentials } = await stsClient . send ( new AssumeRoleWithWebIdentityCommand ( params ) ) ; if ( ! Credentials || ! Credentials . AccessKeyId || ! Credentials . SecretAccessKey ) { throw new Error ( `Invalid response from STS.assumeRoleWithWebIdentity call with role ${ params . RoleArn }` ) ; } return { accessKeyId : Credentials . AccessKeyId , secretAccessKey : Credentials . SecretAccessKey , sessionToken : Credentials . SessionToken , expiration : Credentials . Expiration , } ; } ; } ; internal export type DefaultCredentialProvider = ( input : any ) => Provider < Credentials > ; internal export const decorateDefaultCredentialProvider = ( provider ) : DefaultCredentialProvider => ( input ) => provider ( { roleAssumer : getDefaultRoleAssumer ( input , input . stsClientCtor ) , roleAssumerWithWebIdentity : getDefaultRoleAssumerWithWebIdentity ( input , input . stsClientCtor ) , ... input , } ) ;