@sap/xssec - npm Package Compare versions

Comparing version 3.2.10 to 3.2.11

CHANGELOG.md

 # Change Log
 All notable changes to this project will be documented in this file.
 
+## 3.2.11 - 2021-11-30
+- add support for timeout setting for all requests-calls 
+- support for password token flow in requests module
+- support for setting scopes for all requests to XSUAA
 ## 3.2.10 - 2021-11-02
@@ -5,0 +9,0 @@ - fix correlationID header names to "x-vcap-request-id" or "x-correlationid"

doc/TokenFlows.md

@@ -36,2 +36,11 @@ # How to directly intiate token flows
 // cb: the callback function cb(err, encodedTokenAsString)
+```
+
+#### Password Token flow
+```js
+requests.requestPasswordUserToken(subdomain, serviceCredentials, additionalAttributes, cb);
+// subdomain: The subdomain of the xsuaa instance (or null)
+// serviceCredentials: the service credentials. (the config object from environment)
+// additionalAttributes: object if you need to set additional attributes (or null)
+// cb: the callback function cb(err, encodedTokenAsString)
 ```

lib/requests.js

@@ -49,3 +49,7 @@ 'use strict';
         const json = result.data;
-        cb(null, json.id_token || json.access_token || json, json);
+        if(options._responseToken) {
+            cb(null, json[options._responseToken], json);
+        } else {
+            cb(null, json.id_token || json.access_token || json, json);
+        }        
     } catch (e) {
@@ -124,3 +128,3 @@ return cb(e);
 
-function buildOptions(serviceCredentials, additionalAttributes, url, grantType, zoneId, timeout, attributes) {
+function buildOptions(serviceCredentials, additionalAttributes, url, grantType, zoneId, attributes) {
     // jwt bearer flow
@@ -136,3 +140,3 @@ const options = {
         },
-        timeout: timeout || DEFAULT_TIMEOUT
+        timeout: attributes.timeout
     };
@@ -156,8 +160,15 @@
 
-    if(attributes) {
-        if(attributes.correlationId) {
-            options.headers[CORRELATIONID_HEADER] = attributes.correlationId;
-        }
+    if(attributes.correlationId) {
+        options.headers[CORRELATIONID_HEADER] = attributes.correlationId;
     }
 
+    if(attributes.scopes) {
+        options.form.scope = attributes.scopes;
+    }
+
+    if(attributes.username) {
+        options.form.username = attributes.username;
+        options.form.password = attributes.password;
+    }
+
     return options;
@@ -182,3 +193,3 @@ }
         }
-    }    
+    }
 
@@ -221,8 +232,23 @@ return _requestToNetwork(".well-known", options, cb);
 
-function getAttributes(config) {
-    if(config.credentials) {
-        return config;
+function getAttributes(config, defaultTimeout, maxTimeout) {
+    if(config.credentials) {        
+        let timeout = config.timeout || defaultTimeout;
+        if(timeout > maxTimeout) {
+            timeout = maxTimeout;
+        } else if(timeout < DEFAULT_TIMEOUT) {
+            timeout = DEFAULT_TIMEOUT;
+        }
+
+        return {
+            scopes: config.scopes,
+            correlationId: config.correlationId,
+            timeout: timeout,
+            username: config.username,
+            password: config.password
+        };
     }
-    
-    return null;
+
+    return {
+        timeout: defaultTimeout
+    };
 }
@@ -238,3 +264,3 @@
     const serviceCredentials = getServiceCredentials(config);
-    const attributes = getAttributes(config);    
+    const attributes = getAttributes(config, DEFAULT_USER_TOKEN_TIMEOUT, 10*1000);
 
@@ -256,3 +282,2 @@ var error = validateParameters(serviceCredentials, cb);
             zoneId,
-            DEFAULT_USER_TOKEN_TIMEOUT,
             attributes);
@@ -275,2 +300,35 @@
 
+module.exports.requestPasswordUserToken = function (subdomain, config, additionalAttributes, cb) {
+    const serviceCredentials = getServiceCredentials(config);
+    const attributes = getAttributes(config, DEFAULT_USER_TOKEN_TIMEOUT, 10*1000);
+
+    // input validation
+    const error = validateParameters(serviceCredentials, cb);
+    if (error) {
+        error.statuscode = 500;
+        return cb(error, null);
+    }
+
+    // adapt subdomain in service url, if necessary
+    const urlWithCorrectSubdomain = buildSubdomain(serviceCredentials, subdomain);
+
+    try {
+        const options = buildOptions(serviceCredentials,
+            additionalAttributes,
+            urlWithCorrectSubdomain,
+            'password',
+            null,
+            attributes);
+
+            appendAdditonalAttributes(options, additionalAttributes);
+
+            options._responseToken = 'access_token';
+        return _requestToNetwork("requestPasswordUserToken", options, cb);
+    } catch (e) {
+        //the verification of the serviceCredentials fails
+        e.statuscode = 500;
+        return cb(e);
+    }
+};
+
 module.exports.requestClientCredentialsToken = function (subdomain, config, additionalAttributes, zoneId, cb) {
@@ -284,3 +342,3 @@ //make it backward-compatible (where zoneId is not provided at all)
     const serviceCredentials = getServiceCredentials(config);
-    const attributes = getAttributes(config);
+    const attributes = getAttributes(config, DEFAULT_TIMEOUT, 5*1000);
 
@@ -303,3 +361,2 @@ // input validation
             zoneId,
-            DEFAULT_TIMEOUT,
             attributes);
@@ -306,0 +363,0 @@

package.json

 {
   "name": "@sap/xssec",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "description": "XS Advanced Container Security API for node.js",
@@ -5,0 +5,0 @@ "main": "./lib",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

127862

increased by1.97%

Lines of code

1808

increased by2.73%

No dependency changes