/**
 * Copyright 2021 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */ import { GetTokenResponse , OAuth2Client , RefreshOptions } from './oauth2client' ; import { AuthClient } from './authclient' ; export interface ImpersonatedOptions extends RefreshOptions { /**
     * Client used to perform exchange for impersonated client.
     */ sourceClient ? : AuthClient ; /**
     * The service account to impersonate.
     */ targetPrincipal ? : string ; /**
     * Scopes to request during the authorization grant.
     */ targetScopes ? : string [ ] ; /**
     * The chained list of delegates required to grant the final access_token.
     */ delegates ? : string [ ] ; /**
     * Number of seconds the delegated credential should be valid.
     */ lifetime ? : number | 3600 ; /**
     * API endpoint to fetch token from.
     */ endpoint ? : string ; } export interface TokenResponse { accessToken : string ; expireTime : string ; } export class Impersonated extends OAuth2Client { private sourceClient : AuthClient ; private targetPrincipal : string ; private targetScopes : string [ ] ; private delegates : string [ ] ; private lifetime : number ; private endpoint : string ; param options param { object } options . sourceClient param { string } options . targetPrincipal param { string [ ] } options . delegates param { string [ ] } options . targetScopes param { number } options . lifetime param { string } options . endpoint constructor ( options = { } ) { super ( options ) ; this . credentials = { expiry_date : 1 , refresh_token : 'impersonated-placeholder' , } ; this . sourceClient = options . sourceClient ?? new OAuth2Client ( ) ; this . targetPrincipal = options . targetPrincipal ?? '' ; this . delegates = options . delegates ?? [ ] ; this . targetScopes = options . targetScopes ?? [ ] ; this . lifetime = options . lifetime ?? 3600 ; this . endpoint = options . endpoint ?? 'https://iamcredentials.googleapis.com' ; } param refreshToken protected async refreshToken ( refreshToken ? ) { try { await this . sourceClient . getAccessToken ( ) ; const name = 'projects/-/serviceAccounts/' + this . targetPrincipal ; const u = `${ this . endpoint }/v1/${ name }:generateAccessToken` ; const body = { delegates : this . delegates , scope : this . targetScopes , lifetime : this . lifetime + 's' , } ; const res = await this . sourceClient . request < TokenResponse > ( { url : u , data : body , method : 'POST' , } ) ; const tokenResponse = res . data ; this . credentials . access_token = tokenResponse . accessToken ; this . credentials . expiry_date = Date . parse ( tokenResponse . expireTime ) ; return { tokens : this . credentials , res , } ; } catch ( error ) { const status = error ?. response ?. data ?. error ?. status ; const message = error ?. response ?. data ?. error ?. message ; if ( status && message ) { error . message = `${ status }: unable to impersonate: ${ message }` ; throw error ; } else { error . message = `unable to impersonate: ${ error }` ; throw error ; } } } }