Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 doc.go // Package ssocreds provides a credential provider for retrieving temporary AWS credentials using an SSO access token. // // IMPORTANT: The provider in this package does not initiate or perform the AWS SSO login flow. The SDK provider // expects that you have already performed the SSO login flow using AWS CLI using the "aws sso login" command, or by // some other mechanism. The provider must find a valid non-expired access token for the AWS SSO user portal URL in // ~/.aws/sso/cache. If a cached token is not found, it is expired, or the file is malformed an error will be returned. // // Loading AWS SSO credentials with the AWS shared configuration file // // You can use configure AWS SSO credentials from the AWS shared configuration file by // providing the specifying the required keys in the profile: // // sso_account_id // sso_region // sso_role_name // sso_start_url // // For example, the following defines a profile "devsso" and specifies the AWS SSO parameters that defines the target // account, role, sign-on portal, and the region where the user portal is located. Note: all SSO arguments must be // provided, or an error will be returned. // // [profile devsso] // sso_start_url = https://my-sso-portal.awsapps.com/start // sso_role_name = SSOReadOnlyRole // sso_region = us-east-1 // sso_account_id = 123456789012 // // Using the config module, you can load the AWS SDK shared configuration, and specify that this profile be used to // retrieve credentials. For example: // // sess, err := session.NewSessionWithOptions(session.Options{ // SharedConfigState: session.SharedConfigEnable, // Profile: "devsso", // }) // if err != nil { // return err // } // // Programmatically loading AWS SSO credentials directly // // You can programmatically construct the AWS SSO Provider in your application, and provide the necessary information // to load and retrieve temporary credentials using an access token from ~/.aws/sso/cache. // // svc := sso.New(sess, &aws.Config{ // Region: aws.String("us-west-2"), // Client Region must correspond to the AWS SSO user portal region // }) // // provider := ssocreds.NewCredentialsWithClient(svc, "123456789012", "SSOReadOnlyRole", "https://my-sso-portal.awsapps.com/start") // // credentials, err := provider.Get() // if err != nil { // return err // } // // Additional Resources // // Configuring the AWS CLI to use AWS Single Sign-On: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html // // AWS Single Sign-On User Guide: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html package ssocreds	2.58 KB	2025-05-25 12:27
📄 os.go //go:build !windows // +build !windows package ssocreds import "os" func getHomeDirectory() string { return os.Getenv("HOME") }	132 B	2025-05-25 12:27
📄 os_windows.go package ssocreds import "os" func getHomeDirectory() string { return os.Getenv("USERPROFILE") }	99 B	2025-05-25 12:27
📄 provider.go package ssocreds import ( "crypto/sha1" "encoding/hex" "encoding/json" "io/ioutil" "path/filepath" "strings" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/auth/bearer" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/service/sso" "github.com/aws/aws-sdk-go/service/sso/ssoiface" ) // ErrCodeSSOProviderInvalidToken is the code type that is returned if loaded token has expired or is otherwise invalid. // To refresh the SSO session run aws sso login with the corresponding profile. const ErrCodeSSOProviderInvalidToken = "SSOProviderInvalidToken" const invalidTokenMessage = "the SSO session has expired or is invalid" func init() { nowTime = time.Now defaultCacheLocation = defaultCacheLocationImpl } var nowTime func() time.Time // ProviderName is the name of the provider used to specify the source of credentials. const ProviderName = "SSOProvider" var defaultCacheLocation func() string func defaultCacheLocationImpl() string { return filepath.Join(getHomeDirectory(), ".aws", "sso", "cache") } // Provider is an AWS credential provider that retrieves temporary AWS credentials by exchanging an SSO login token. type Provider struct { credentials.Expiry // The Client which is configured for the AWS Region where the AWS SSO user portal is located. Client ssoiface.SSOAPI // The AWS account that is assigned to the user. AccountID string // The role name that is assigned to the user. RoleName string // The URL that points to the organization's AWS Single Sign-On (AWS SSO) user portal. StartURL string // The filepath the cached token will be retrieved from. If unset Provider will // use the startURL to determine the filepath at. // // ~/.aws/sso/cache/<sha1-hex-encoded-startURL>.json // // If custom cached token filepath is used, the Provider's startUrl // parameter will be ignored. CachedTokenFilepath string // Used by the SSOCredentialProvider if a token configuration // profile is used in the shared config TokenProvider bearer.TokenProvider } // NewCredentials returns a new AWS Single Sign-On (AWS SSO) credential provider. The ConfigProvider is expected to be configured // for the AWS Region where the AWS SSO user portal is located. func NewCredentials(configProvider client.ConfigProvider, accountID, roleName, startURL string, optFns ...func(provider Provider)) credentials.Credentials { return NewCredentialsWithClient(sso.New(configProvider), accountID, roleName, startURL, optFns...) } // NewCredentialsWithClient returns a new AWS Single Sign-On (AWS SSO) credential provider. The provided client is expected to be configured // for the AWS Region where the AWS SSO user portal is located. func NewCredentialsWithClient(client ssoiface.SSOAPI, accountID, roleName, startURL string, optFns ...func(provider Provider)) credentials.Credentials { p := &Provider{ Client: client, AccountID: accountID, RoleName: roleName, StartURL: startURL, } for _, fn := range optFns { fn(p) } return credentials.NewCredentials(p) } // Retrieve retrieves temporary AWS credentials from the configured Amazon Single Sign-On (AWS SSO) user portal // by exchanging the accessToken present in ~/.aws/sso/cache. func (p Provider) Retrieve() (credentials.Value, error) { return p.RetrieveWithContext(aws.BackgroundContext()) } // RetrieveWithContext retrieves temporary AWS credentials from the configured Amazon Single Sign-On (AWS SSO) user portal // by exchanging the accessToken present in ~/.aws/sso/cache. func (p Provider) RetrieveWithContext(ctx credentials.Context) (credentials.Value, error) { var accessToken string if p.TokenProvider != nil { token, err := p.TokenProvider.RetrieveBearerToken(ctx) if err != nil { return credentials.Value{}, err } accessToken = &token.Value } else { if p.CachedTokenFilepath == "" { cachedTokenFilePath, err := getCachedFilePath(p.StartURL) if err != nil { return credentials.Value{}, err } p.CachedTokenFilepath = cachedTokenFilePath } tokenFile, err := loadTokenFile(p.CachedTokenFilepath) if err != nil { return credentials.Value{}, err } accessToken = &tokenFile.AccessToken } output, err := p.Client.GetRoleCredentialsWithContext(ctx, &sso.GetRoleCredentialsInput{ AccessToken: accessToken, AccountId: &p.AccountID, RoleName: &p.RoleName, }) if err != nil { return credentials.Value{}, err } expireTime := time.Unix(0, aws.Int64Value(output.RoleCredentials.Expiration)int64(time.Millisecond)).UTC() p.SetExpiration(expireTime, 0) return credentials.Value{ AccessKeyID: aws.StringValue(output.RoleCredentials.AccessKeyId), SecretAccessKey: aws.StringValue(output.RoleCredentials.SecretAccessKey), SessionToken: aws.StringValue(output.RoleCredentials.SessionToken), ProviderName: ProviderName, }, nil } func getCachedFilePath(startUrl string) (string, error) { hash := sha1.New() _, err := hash.Write([]byte(startUrl)) if err != nil { return "", err } return filepath.Join(defaultCacheLocation(), strings.ToLower(hex.EncodeToString(hash.Sum(nil)))+".json"), nil } type token struct { AccessToken string `json:"accessToken"` ExpiresAt rfc3339 `json:"expiresAt"` Region string `json:"region,omitempty"` StartURL string `json:"startUrl,omitempty"` } func (t token) Expired() bool { return nowTime().Round(0).After(time.Time(t.ExpiresAt)) } func loadTokenFile(cachedTokenPath string) (t token, err error) { fileBytes, err := ioutil.ReadFile(cachedTokenPath) if err != nil { return token{}, awserr.New(ErrCodeSSOProviderInvalidToken, invalidTokenMessage, err) } if err := json.Unmarshal(fileBytes, &t); err != nil { return token{}, awserr.New(ErrCodeSSOProviderInvalidToken, invalidTokenMessage, err) } if len(t.AccessToken) == 0 { return token{}, awserr.New(ErrCodeSSOProviderInvalidToken, invalidTokenMessage, nil) } if t.Expired() { return token{}, awserr.New(ErrCodeSSOProviderInvalidToken, invalidTokenMessage, nil) } return t, nil }	6 KB	2025-05-25 12:27
📄 provider_test.go //go:build go1.9 // +build go1.9 package ssocreds import ( "fmt" "path/filepath" "reflect" "testing" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/auth/bearer" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/service/sso" "github.com/aws/aws-sdk-go/service/sso/ssoiface" ) type mockClient struct { ssoiface.SSOAPI t testing.T Output sso.GetRoleCredentialsOutput Err error ExpectedAccountID string ExpectedAccessToken string ExpectedRoleName string Response func(mockClient) (sso.GetRoleCredentialsOutput, error) } type mockTokenProvider struct { Response func() (bearer.Token, error) } func (p mockTokenProvider) RetrieveBearerToken(ctx aws.Context) (bearer.Token, error) { if p.Response == nil { return bearer.Token{}, nil } return p.Response() } func (m mockClient) GetRoleCredentialsWithContext(ctx aws.Context, params sso.GetRoleCredentialsInput, _ ...request.Option) (sso.GetRoleCredentialsOutput, error) { m.t.Helper() if len(m.ExpectedAccountID) > 0 { if e, a := m.ExpectedAccountID, aws.StringValue(params.AccountId); e != a { m.t.Errorf("expect %v, got %v", e, a) } } if len(m.ExpectedAccessToken) > 0 { if e, a := m.ExpectedAccessToken, aws.StringValue(params.AccessToken); e != a { m.t.Errorf("expect %v, got %v", e, a) } } if len(m.ExpectedRoleName) > 0 { if e, a := m.ExpectedRoleName, aws.StringValue(params.RoleName); e != a { m.t.Errorf("expect %v, got %v", e, a) } } if m.Response == nil { return &sso.GetRoleCredentialsOutput{}, nil } return m.Response(m) } func swapCacheLocation(dir string) func() { original := defaultCacheLocation defaultCacheLocation = func() string { return dir } return func() { defaultCacheLocation = original } } func swapNowTime(referenceTime time.Time) func() { original := nowTime nowTime = func() time.Time { return referenceTime } return func() { nowTime = original } } func TestProvider(t testing.T) { restoreCache := swapCacheLocation("testdata") defer restoreCache() restoreTime := swapNowTime(time.Date(2021, 01, 19, 19, 50, 0, 0, time.UTC)) defer restoreTime() cases := map[string]struct { Client mockClient AccountID string RoleName string StartURL string CachedTokenFilePath string TokenProvider mockTokenProvider ExpectedErr bool ExpectedCredentials credentials.Value ExpectedExpire time.Time }{ "missing required parameter values": { StartURL: "https://invalid-required", ExpectedErr: true, }, "valid required parameter values": { Client: mockClient{ ExpectedAccountID: "012345678901", ExpectedRoleName: "TestRole", ExpectedAccessToken: "dGhpcyBpcyBub3QgYSByZWFsIHZhbHVl", Response: func(mock mockClient) (sso.GetRoleCredentialsOutput, error) { return &sso.GetRoleCredentialsOutput{ RoleCredentials: &sso.RoleCredentials{ AccessKeyId: aws.String("AccessKey"), SecretAccessKey: aws.String("SecretKey"), SessionToken: aws.String("SessionToken"), Expiration: aws.Int64(1611177743123), }, }, nil }, }, AccountID: "012345678901", RoleName: "TestRole", StartURL: "https://valid-required-only", ExpectedCredentials: credentials.Value{ AccessKeyID: "AccessKey", SecretAccessKey: "SecretKey", SessionToken: "SessionToken", ProviderName: ProviderName, }, ExpectedExpire: time.Date(2021, 01, 20, 21, 22, 23, 0.123e9, time.UTC), }, "custom cached token file": { Client: mockClient{ ExpectedAccountID: "012345678901", ExpectedRoleName: "TestRole", ExpectedAccessToken: "ZhbHVldGhpcyBpcyBub3QgYSByZWFsIH", Response: func(mock mockClient) (sso.GetRoleCredentialsOutput, error) { return &sso.GetRoleCredentialsOutput{ RoleCredentials: &sso.RoleCredentials{ AccessKeyId: aws.String("AccessKey"), SecretAccessKey: aws.String("SecretKey"), SessionToken: aws.String("SessionToken"), Expiration: aws.Int64(1611177743123), }, }, nil }, }, CachedTokenFilePath: filepath.Join("testdata", "custom_cached_token.json"), AccountID: "012345678901", RoleName: "TestRole", ExpectedCredentials: credentials.Value{ AccessKeyID: "AccessKey", SecretAccessKey: "SecretKey", SessionToken: "SessionToken", ProviderName: ProviderName, }, ExpectedExpire: time.Date(2021, 01, 20, 21, 22, 23, 0.123e9, time.UTC), }, "access token retrieved by token provider": { Client: mockClient{ ExpectedAccountID: "012345678901", ExpectedRoleName: "TestRole", ExpectedAccessToken: "WFsIHZhbHVldGhpcyBpcyBub3QgYSByZ", Response: func(mock mockClient) (sso.GetRoleCredentialsOutput, error) { return &sso.GetRoleCredentialsOutput{ RoleCredentials: &sso.RoleCredentials{ AccessKeyId: aws.String("AccessKey"), SecretAccessKey: aws.String("SecretKey"), SessionToken: aws.String("SessionToken"), Expiration: aws.Int64(1611177743123), }, }, nil }, }, TokenProvider: &mockTokenProvider{ Response: func() (bearer.Token, error) { return bearer.Token{ Value: "WFsIHZhbHVldGhpcyBpcyBub3QgYSByZ", }, nil }, }, AccountID: "012345678901", RoleName: "TestRole", StartURL: "ignored value", ExpectedCredentials: credentials.Value{ AccessKeyID: "AccessKey", SecretAccessKey: "SecretKey", SessionToken: "SessionToken", ProviderName: ProviderName, }, ExpectedExpire: time.Date(2021, 01, 20, 21, 22, 23, 0.123e9, time.UTC), }, "token provider return error": { TokenProvider: &mockTokenProvider{ Response: func() (bearer.Token, error) { return bearer.Token{}, fmt.Errorf("mock token provider return error") }, }, ExpectedErr: true, }, "expired access token": { StartURL: "https://expired", ExpectedErr: true, }, "api error": { Client: mockClient{ ExpectedAccountID: "012345678901", ExpectedRoleName: "TestRole", ExpectedAccessToken: "dGhpcyBpcyBub3QgYSByZWFsIHZhbHVl", Response: func(mock mockClient) (sso.GetRoleCredentialsOutput, error) { return nil, fmt.Errorf("api error") }, }, AccountID: "012345678901", RoleName: "TestRole", StartURL: "https://valid-required-only", ExpectedErr: true, }, } for name, tt := range cases { t.Run(name, func(t *testing.T) { tt.Client.t = t provider := &Provider{ Client: tt.Client, AccountID: tt.AccountID, RoleName: tt.RoleName, StartURL: tt.StartURL, CachedTokenFilepath: tt.CachedTokenFilePath, } if tt.TokenProvider != nil { provider.TokenProvider = tt.TokenProvider } provider.Expiry.CurrentTime = nowTime credentials, err := provider.Retrieve() if (err != nil) != tt.ExpectedErr { t.Errorf("expect error: %v", tt.ExpectedErr) } if e, a := tt.ExpectedCredentials, credentials; !reflect.DeepEqual(e, a) { t.Errorf("expect %v, got %v", e, a) } if !tt.ExpectedExpire.IsZero() { if e, a := tt.ExpectedExpire, provider.ExpiresAt(); !e.Equal(a) { t.Errorf("expect %v, got %v", e, a) } } }) } }	7.26 KB	2025-05-25 12:27
📄 sso_cached_token.go package ssocreds import ( "crypto/sha1" "encoding/hex" "encoding/json" "fmt" "github.com/aws/aws-sdk-go/internal/shareddefaults" "io/ioutil" "os" "path/filepath" "strconv" "strings" "time" ) var resolvedOsUserHomeDir = shareddefaults.UserHomeDir // StandardCachedTokenFilepath returns the filepath for the cached SSO token file, or // error if unable get derive the path. Key that will be used to compute a SHA1 // value that is hex encoded. // // Derives the filepath using the Key as: // // ~/.aws/sso/cache/<sha1-hex-encoded-key>.json func StandardCachedTokenFilepath(key string) (string, error) { homeDir := resolvedOsUserHomeDir() if len(homeDir) == 0 { return "", fmt.Errorf("unable to get USER's home directory for cached token") } hash := sha1.New() if _, err := hash.Write([]byte(key)); err != nil { return "", fmt.Errorf("unable to compute cached token filepath key SHA1 hash, %v", err) } cacheFilename := strings.ToLower(hex.EncodeToString(hash.Sum(nil))) + ".json" return filepath.Join(homeDir, ".aws", "sso", "cache", cacheFilename), nil } type tokenKnownFields struct { AccessToken string `json:"accessToken,omitempty"` ExpiresAt rfc3339 `json:"expiresAt,omitempty"` RefreshToken string `json:"refreshToken,omitempty"` ClientID string `json:"clientId,omitempty"` ClientSecret string `json:"clientSecret,omitempty"` } type cachedToken struct { tokenKnownFields UnknownFields map[string]interface{} `json:"-"` } // MarshalJSON provides custom marshalling because the standard library Go marshaller ignores unknown/unspecified fields // when marshalling from a struct: https://pkg.go.dev/encoding/json#Marshal // This function adds some extra validation to the known fields and captures unknown fields. func (t cachedToken) MarshalJSON() ([]byte, error) { fields := map[string]interface{}{} setTokenFieldString(fields, "accessToken", t.AccessToken) setTokenFieldRFC3339(fields, "expiresAt", t.ExpiresAt) setTokenFieldString(fields, "refreshToken", t.RefreshToken) setTokenFieldString(fields, "clientId", t.ClientID) setTokenFieldString(fields, "clientSecret", t.ClientSecret) for k, v := range t.UnknownFields { if _, ok := fields[k]; ok { return nil, fmt.Errorf("unknown token field %v, duplicates known field", k) } fields[k] = v } return json.Marshal(fields) } func setTokenFieldString(fields map[string]interface{}, key, value string) { if value == "" { return } fields[key] = value } func setTokenFieldRFC3339(fields map[string]interface{}, key string, value rfc3339) { if value == nil { return } fields[key] = value } // UnmarshalJSON provides custom unmarshalling because the standard library Go unmarshaller ignores unknown/unspecified // fields when unmarshalling from a struct: https://pkg.go.dev/encoding/json#Unmarshal // This function adds some extra validation to the known fields and captures unknown fields. func (t cachedToken) UnmarshalJSON(b []byte) error { var fields map[string]interface{} if err := json.Unmarshal(b, &fields); err != nil { return nil } t.UnknownFields = map[string]interface{}{} for k, v := range fields { var err error switch k { case "accessToken": err = getTokenFieldString(v, &t.AccessToken) case "expiresAt": err = getTokenFieldRFC3339(v, &t.ExpiresAt) case "refreshToken": err = getTokenFieldString(v, &t.RefreshToken) case "clientId": err = getTokenFieldString(v, &t.ClientID) case "clientSecret": err = getTokenFieldString(v, &t.ClientSecret) default: t.UnknownFields[k] = v } if err != nil { return fmt.Errorf("field %q, %v", k, err) } } return nil } func getTokenFieldString(v interface{}, value string) error { var ok bool value, ok = v.(string) if !ok { return fmt.Errorf("expect value to be string, got %T", v) } return nil } func getTokenFieldRFC3339(v interface{}, value rfc3339) error { var stringValue string if err := getTokenFieldString(v, &stringValue); err != nil { return err } timeValue, err := parseRFC3339(stringValue) if err != nil { return err } value = &timeValue return nil } func loadCachedToken(filename string) (cachedToken, error) { fileBytes, err := ioutil.ReadFile(filename) if err != nil { return cachedToken{}, fmt.Errorf("failed to read cached SSO token file, %v", err) } var t cachedToken if err := json.Unmarshal(fileBytes, &t); err != nil { return cachedToken{}, fmt.Errorf("failed to parse cached SSO token file, %v", err) } if len(t.AccessToken) == 0 \|\| t.ExpiresAt == nil \|\| time.Time(t.ExpiresAt).IsZero() { return cachedToken{}, fmt.Errorf( "cached SSO token must contain accessToken and expiresAt fields") } return t, nil } func storeCachedToken(filename string, t cachedToken, fileMode os.FileMode) (err error) { tmpFilename := filename + ".tmp-" + strconv.FormatInt(nowTime().UnixNano(), 10) if err := writeCacheFile(tmpFilename, fileMode, t); err != nil { return err } if err := os.Rename(tmpFilename, filename); err != nil { return fmt.Errorf("failed to replace old cached SSO token file, %v", err) } return nil } func writeCacheFile(filename string, fileMode os.FileMode, t cachedToken) (err error) { var f os.File f, err = os.OpenFile(filename, os.O_CREATE\|os.O_TRUNC\|os.O_RDWR, fileMode) if err != nil { return fmt.Errorf("failed to create cached SSO token file %v", err) } defer func() { closeErr := f.Close() if err == nil && closeErr != nil { err = fmt.Errorf("failed to close cached SSO token file, %v", closeErr) } }() encoder := json.NewEncoder(f) if err = encoder.Encode(t); err != nil { return fmt.Errorf("failed to serialize cached SSO token, %v", err) } return nil } type rfc3339 time.Time // UnmarshalJSON decode rfc3339 from JSON format func (r rfc3339) UnmarshalJSON(bytes []byte) error { var value string var err error if err = json.Unmarshal(bytes, &value); err != nil { return err } r, err = parseRFC3339(value) return err } func parseRFC3339(v string) (rfc3339, error) { parsed, err := time.Parse(time.RFC3339, v) if err != nil { return rfc3339{}, fmt.Errorf("expected RFC3339 timestamp: %v", err) } return rfc3339(parsed), nil } // MarshalJSON encode rfc3339 to JSON format time func (r rfc3339) MarshalJSON() ([]byte, error) { value := time.Time(r).Format(time.RFC3339) // Use JSON unmarshal to unescape the quoted value making use of JSON's // quoting rules. return json.Marshal(value) }	6.32 KB	2025-05-25 12:27
📄 sso_cached_token_test.go //go:build go1.9 // +build go1.9 package ssocreds import ( "io/ioutil" "os" "path/filepath" "reflect" "strings" "testing" "time" ) func TestStandardSSOCacheTokenFilepath(t testing.T) { origHomeDur := resolvedOsUserHomeDir defer func() { resolvedOsUserHomeDir = origHomeDur }() cases := map[string]struct { key string osUserHomeDir func() string expectFilename string expectErr string }{ "success": { key: "https://example.awsapps.com/start", osUserHomeDir: func() string { return os.TempDir() }, expectFilename: filepath.Join(os.TempDir(), ".aws", "sso", "cache", "e8be5486177c5b5392bd9aa76563515b29358e6e.json"), }, "failure": { key: "https://example.awsapps.com/start", osUserHomeDir: func() string { return "" }, expectErr: "some error", }, } for name, c := range cases { t.Run(name, func(t testing.T) { resolvedOsUserHomeDir = c.osUserHomeDir actual, err := StandardCachedTokenFilepath(c.key) if c.expectErr != "" { if err == nil { t.Fatalf("expect error, got none") } return } if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := c.expectFilename, actual; e != a { t.Errorf("expect %v filename, got %v", e, a) } }) } } func TestLoadCachedToken(t testing.T) { cases := map[string]struct { filename string expectToken cachedToken expectErr string }{ "file not found": { filename: filepath.Join("testdata", "does_not_exist.json"), expectErr: "failed to read cached SSO token file", }, "invalid json": { filename: filepath.Join("testdata", "invalid_json.json"), expectErr: "failed to parse cached SSO token file", }, "missing accessToken": { filename: filepath.Join("testdata", "missing_accessToken.json"), expectErr: "must contain accessToken and expiresAt fields", }, "missing expiresAt": { filename: filepath.Join("testdata", "missing_expiresAt.json"), expectErr: "must contain accessToken and expiresAt fields", }, "standard token": { filename: filepath.Join("testdata", "valid_token.json"), expectToken: cachedToken{ tokenKnownFields: tokenKnownFields{ AccessToken: "dGhpcyBpcyBub3QgYSByZWFsIHZhbHVl", ExpiresAt: (rfc3339)(Time(time.Date(2044, 4, 4, 7, 0, 1, 0, time.UTC))), ClientID: "client id", ClientSecret: "client secret", RefreshToken: "refresh token", }, UnknownFields: map[string]interface{}{ "unknownField": "some value", "registrationExpiresAt": "2044-04-04T07:00:01Z", "region": "region", "startURL": "start URL", }, }, }, } for name, c := range cases { t.Run(name, func(t testing.T) { actualToken, err := loadCachedToken(c.filename) if c.expectErr != "" { if err == nil { t.Fatalf("expect %v error, got none", c.expectErr) } if e, a := c.expectErr, err.Error(); !strings.Contains(a, e) { t.Fatalf("expect %v error, got %v", e, a) } return } if err != nil { t.Fatalf("expect no error, got %v", err) } if !reflect.DeepEqual(c.expectToken, actualToken) { t.Errorf("expect token file %v but got actual %v", c.expectToken, actualToken) } }) } } func TestStoreCachedToken(t testing.T) { tempDir, err := ioutil.TempDir(os.TempDir(), "aws-sdk-go-"+t.Name()) if err != nil { t.Fatalf("failed to create temporary test directory, %v", err) } defer func() { if err := os.RemoveAll(tempDir); err != nil { t.Errorf("failed to cleanup temporary test directory, %v", err) } }() cases := map[string]struct { token cachedToken filename string fileMode os.FileMode }{ "standard token": { filename: filepath.Join(tempDir, "token_file.json"), fileMode: 0600, token: cachedToken{ tokenKnownFields: tokenKnownFields{ AccessToken: "dGhpcyBpcyBub3QgYSByZWFsIHZhbHVl", ExpiresAt: (rfc3339)(Time(time.Date(2044, 4, 4, 7, 0, 1, 0, time.UTC))), ClientID: "client id", ClientSecret: "client secret", RefreshToken: "refresh token", }, UnknownFields: map[string]interface{}{ "unknownField": "some value", "registrationExpiresAt": "2044-04-04T07:00:01Z", "region": "region", "startURL": "start URL", }, }, }, } for name, c := range cases { t.Run(name, func(t testing.T) { err := storeCachedToken(c.filename, c.token, c.fileMode) if err != nil { t.Fatalf("expect no error, got %v", err) } actual, err := loadCachedToken(c.filename) if err != nil { t.Fatalf("failed to load stored token, %v", err) } if !reflect.DeepEqual(c.token, actual) { t.Errorf("expect token file %v but got actual %v", c.token, actual) } }) } } // Time returns a pointer value for the time.Time value passed in. func Time(v time.Time) *time.Time { return &v }	4.81 KB	2025-05-25 12:27
📁 testdata	-	2025-05-25 12:27
📄 token_provider.go package ssocreds import ( "fmt" "os" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/auth/bearer" "github.com/aws/aws-sdk-go/service/ssooidc" ) // CreateTokenAPIClient provides the interface for the SSOTokenProvider's API // client for calling CreateToken operation to refresh the SSO token. type CreateTokenAPIClient interface { CreateToken(input ssooidc.CreateTokenInput) (ssooidc.CreateTokenOutput, error) } // SSOTokenProviderOptions provides the options for configuring the // SSOTokenProvider. type SSOTokenProviderOptions struct { // Client that can be overridden Client CreateTokenAPIClient // The path the file containing the cached SSO token will be read from. // Initialized the NewSSOTokenProvider's cachedTokenFilepath parameter. CachedTokenFilepath string } // SSOTokenProvider provides a utility for refreshing SSO AccessTokens for // Bearer Authentication. The SSOTokenProvider can only be used to refresh // already cached SSO Tokens. This utility cannot perform the initial SSO // create token. // // The initial SSO create token should be preformed with the AWS CLI before the // Go application using the SSOTokenProvider will need to retrieve the SSO // token. If the AWS CLI has not created the token cache file, this provider // will return an error when attempting to retrieve the cached token. // // This provider will attempt to refresh the cached SSO token periodically if // needed when RetrieveBearerToken is called. // // A utility such as the AWS CLI must be used to initially create the SSO // session and cached token file. // https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html type SSOTokenProvider struct { options SSOTokenProviderOptions } // NewSSOTokenProvider returns an initialized SSOTokenProvider that will // periodically refresh the SSO token cached stored in the cachedTokenFilepath. // The cachedTokenFilepath file's content will be rewritten by the token // provider when the token is refreshed. // // The client must be configured for the AWS region the SSO token was created for. func NewSSOTokenProvider(client CreateTokenAPIClient, cachedTokenFilepath string, optFns ...func(o SSOTokenProviderOptions)) SSOTokenProvider { options := SSOTokenProviderOptions{ Client: client, CachedTokenFilepath: cachedTokenFilepath, } for _, fn := range optFns { fn(&options) } provider := &SSOTokenProvider{ options: options, } return provider } // RetrieveBearerToken returns the SSO token stored in the cachedTokenFilepath // the SSOTokenProvider was created with. If the token has expired // RetrieveBearerToken will attempt to refresh it. If the token cannot be // refreshed or is not present an error will be returned. // // A utility such as the AWS CLI must be used to initially create the SSO // session and cached token file. https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html func (p SSOTokenProvider) RetrieveBearerToken(ctx aws.Context) (bearer.Token, error) { cachedToken, err := loadCachedToken(p.options.CachedTokenFilepath) if err != nil { return bearer.Token{}, err } if cachedToken.ExpiresAt != nil && nowTime().After(time.Time(cachedToken.ExpiresAt)) { cachedToken, err = p.refreshToken(cachedToken) if err != nil { return bearer.Token{}, fmt.Errorf("refresh cached SSO token failed, %v", err) } } expiresAt := toTime((time.Time)(cachedToken.ExpiresAt)) return bearer.Token{ Value: cachedToken.AccessToken, CanExpire: !expiresAt.IsZero(), Expires: expiresAt, }, nil } func (p SSOTokenProvider) refreshToken(token cachedToken) (cachedToken, error) { if token.ClientSecret == "" \|\| token.ClientID == "" \|\| token.RefreshToken == "" { return cachedToken{}, fmt.Errorf("cached SSO token is expired, or not present, and cannot be refreshed") } createResult, err := p.options.Client.CreateToken(&ssooidc.CreateTokenInput{ ClientId: &token.ClientID, ClientSecret: &token.ClientSecret, RefreshToken: &token.RefreshToken, GrantType: aws.String("refresh_token"), }) if err != nil { return cachedToken{}, fmt.Errorf("unable to refresh SSO token, %v", err) } if createResult.ExpiresIn == nil { return cachedToken{}, fmt.Errorf("missing required field ExpiresIn") } if createResult.AccessToken == nil { return cachedToken{}, fmt.Errorf("missing required field AccessToken") } if createResult.RefreshToken == nil { return cachedToken{}, fmt.Errorf("missing required field RefreshToken") } expiresAt := nowTime().Add(time.Duration(createResult.ExpiresIn) time.Second) token.AccessToken = createResult.AccessToken token.ExpiresAt = (rfc3339)(&expiresAt) token.RefreshToken = createResult.RefreshToken fileInfo, err := os.Stat(p.options.CachedTokenFilepath) if err != nil { return cachedToken{}, fmt.Errorf("failed to stat cached SSO token file %v", err) } if err = storeCachedToken(p.options.CachedTokenFilepath, token, fileInfo.Mode()); err != nil { return cachedToken{}, fmt.Errorf("unable to cache refreshed SSO token, %v", err) } return token, nil } func toTime(p time.Time) (v time.Time) { if p == nil { return v } return *p }	5.07 KB	2025-05-25 12:27
📄 token_provider_test.go //go:build go1.16 // +build go1.16 package ssocreds import ( "fmt" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/auth/bearer" "github.com/aws/aws-sdk-go/service/ssooidc" "io/ioutil" "os" "path/filepath" "reflect" "strings" "testing" "time" ) func TestSSOTokenProvider(t testing.T) { restoreTime := swapNowTime(time.Date(2021, 12, 21, 12, 21, 1, 0, time.UTC)) defer restoreTime() tempDir, err := ioutil.TempDir(os.TempDir(), "aws-sdk-go-"+t.Name()) if err != nil { t.Fatalf("failed to create temporary test directory, %v", err) } defer func() { if err := os.RemoveAll(tempDir); err != nil { t.Errorf("failed to cleanup temporary test directory, %v", err) } }() cases := map[string]struct { setup func() error postRetrieve func() error client CreateTokenAPIClient cacheFilePath string optFns []func(SSOTokenProviderOptions) expectToken bearer.Token expectErr string }{ "no cache file": { cacheFilePath: filepath.Join("testdata", "file_not_exists"), expectErr: "failed to read cached SSO token file", }, "invalid json cache file": { cacheFilePath: filepath.Join("testdata", "invalid_json.json"), expectErr: "failed to parse cached SSO token file", }, "missing accessToken": { cacheFilePath: filepath.Join("testdata", "missing_accessToken.json"), expectErr: "must contain accessToken and expiresAt fields", }, "missing expiresAt": { cacheFilePath: filepath.Join("testdata", "missing_expiresAt.json"), expectErr: "must contain accessToken and expiresAt fields", }, "expired no clientSecret": { cacheFilePath: filepath.Join("testdata", "missing_clientSecret.json"), expectErr: "cached SSO token is expired, or not present", }, "expired no clientId": { cacheFilePath: filepath.Join("testdata", "missing_clientId.json"), expectErr: "cached SSO token is expired, or not present", }, "expired no refreshToken": { cacheFilePath: filepath.Join("testdata", "missing_refreshToken.json"), expectErr: "cached SSO token is expired, or not present", }, "valid sso token": { cacheFilePath: filepath.Join("testdata", "valid_token.json"), expectToken: bearer.Token{ Value: "dGhpcyBpcyBub3QgYSByZWFsIHZhbHVl", CanExpire: true, Expires: time.Date(2044, 4, 4, 7, 0, 1, 0, time.UTC), }, }, "refresh expired token": { setup: func() error { testFile, err := os.ReadFile(filepath.Join("testdata", "expired_token.json")) if err != nil { return err } return os.WriteFile(filepath.Join(tempDir, "expired_token.json"), testFile, 0600) }, postRetrieve: func() error { actual, err := loadCachedToken(filepath.Join(tempDir, "expired_token.json")) if err != nil { return err } expect := cachedToken{ tokenKnownFields: tokenKnownFields{ AccessToken: "updated access token", ExpiresAt: (rfc3339)(aws.Time(time.Date(2021, 12, 21, 12, 31, 1, 0, time.UTC))), RefreshToken: "updated refresh token", ClientID: "client id", ClientSecret: "client secret", }, UnknownFields: map[string]interface{}{ "unknownField": "some value", }, } if !reflect.DeepEqual(expect, actual) { return fmt.Errorf("expect token file %v but got actual %v", expect, actual) } return nil }, cacheFilePath: filepath.Join(tempDir, "expired_token.json"), client: &mockCreateTokenAPIClient{ expectInput: &ssooidc.CreateTokenInput{ ClientId: aws.String("client id"), ClientSecret: aws.String("client secret"), RefreshToken: aws.String("refresh token"), GrantType: aws.String("refresh_token"), }, output: &ssooidc.CreateTokenOutput{ AccessToken: aws.String("updated access token"), ExpiresIn: aws.Int64(600), RefreshToken: aws.String("updated refresh token"), }, }, expectToken: bearer.Token{ Value: "updated access token", CanExpire: true, Expires: time.Date(2021, 12, 21, 12, 31, 1, 0, time.UTC), }, }, "fail refresh expired token": { setup: func() error { testFile, err := os.ReadFile(filepath.Join("testdata", "expired_token.json")) if err != nil { return err } return os.WriteFile(filepath.Join(tempDir, "expired_token.json"), testFile, 0600) }, postRetrieve: func() error { actual, err := loadCachedToken(filepath.Join(tempDir, "expired_token.json")) if err != nil { return err } expect := cachedToken{ tokenKnownFields: tokenKnownFields{ AccessToken: "access token", ExpiresAt: (rfc3339)(aws.Time(time.Date(2021, 12, 21, 12, 21, 1, 0, time.UTC))), RefreshToken: "refresh token", ClientID: "client id", ClientSecret: "client secret", }, } if !reflect.DeepEqual(expect, actual) { return fmt.Errorf("expect token file %v but got actual %v", expect, actual) } return nil }, cacheFilePath: filepath.Join(tempDir, "expired_token.json"), client: &mockCreateTokenAPIClient{ err: fmt.Errorf("sky is falling"), }, expectErr: "unable to refresh SSO token, sky is falling", }, } for name, c := range cases { t.Run(name, func(t testing.T) { if c.setup != nil { if err := c.setup(); err != nil { t.Fatalf("failed to setup test, %v", err) } } provider := NewSSOTokenProvider(c.client, c.cacheFilePath, c.optFns...) token, err := provider.RetrieveBearerToken(aws.BackgroundContext()) if c.expectErr != "" { if err == nil { t.Fatalf("expect %v error, got none", c.expectErr) } if e, a := c.expectErr, err.Error(); !strings.Contains(a, e) { t.Fatalf("expect %v error, got %v", e, a) } return } if err != nil { t.Fatalf("expect no error, got %v", err) } if !reflect.DeepEqual(c.expectToken, token) { t.Errorf("expect %v, got %v", c.expectToken, token) } if c.postRetrieve != nil { if err := c.postRetrieve(); err != nil { t.Fatalf("post retrieve failed, %v", err) } } }) } } type mockCreateTokenAPIClient struct { expectInput ssooidc.CreateTokenInput output ssooidc.CreateTokenOutput err error } func (c mockCreateTokenAPIClient) CreateToken(input ssooidc.CreateTokenInput) ( ssooidc.CreateTokenOutput, error, ) { if c.expectInput != nil { if !reflect.DeepEqual(c.expectInput, input) { return nil, fmt.Errorf("expect token file %v but got actual %v", c.expectInput, input) } } return c.output, c.err }	6.41 KB	2025-05-25 12:27

Terminal