Skip to content

Commit 05e017e

Browse files
smilkurismilkuri
authored
fix(core): make CREDENTIALS_CODE mutually exclusive with other credential sources (#7615)
1 parent 1d6d16a commit 05e017e

12 files changed

Lines changed: 13 additions & 58 deletions

‎packages/core/src/submodules/httpAuthSchemes/aws_sdk/resolveAwsSdkSigV4Config.spec.ts‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,9 +93,6 @@ describe(resolveAwsSdkSigV4Config.name, () => {
9393
expect(await config.credentials()).toEqual({
9494
accessKeyId: "unit-test",
9595
secretAccessKey: "unit-test",
96-
$source: {
97-
CREDENTIALS_CODE: "e",
98-
},
9996
});
10097

10198
{

‎packages/core/src/submodules/httpAuthSchemes/aws_sdk/resolveAwsSdkSigV4Config.ts‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -139,10 +139,19 @@ export const resolveAwsSdkSigV4Config = <T>(
139139
});
140140
const boundProvider = bindCallerConfig(config, memoizedProvider);
141141
if (isUserSupplied && !boundProvider.attributed) {
142-
resolvedCredentials = async (options: Record<string, any> | undefined) =>
143-
boundProvider(options).then((creds: AttributedAwsCredentialIdentity) =>
144-
setCredentialFeature(creds, "CREDENTIALS_CODE", "e")
145-
);
142+
// Check if the original input was a credential object
143+
const isCredentialObject = typeof inputCredentials === "object" && inputCredentials !== null;
144+
145+
resolvedCredentials = async (options: Record<string, any> | undefined) => {
146+
const creds = await boundProvider(options);
147+
const attributedCreds = creds as AttributedAwsCredentialIdentity;
148+
149+
// Only set CREDENTIALS_CODE if user provided a credential object and no source attribution exists
150+
if (isCredentialObject && (!attributedCreds.$source || Object.keys(attributedCreds.$source).length === 0)) {
151+
return setCredentialFeature(attributedCreds, "CREDENTIALS_CODE", "e");
152+
}
153+
return attributedCreds;
154+
};
146155
resolvedCredentials.memoized = boundProvider.memoized;
147156
resolvedCredentials.configBound = boundProvider.configBound;
148157
resolvedCredentials.attributed = true;

‎packages/credential-provider-node/tests/credential-provider-node.integ.spec.ts‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,6 @@ describe("credential-provider-node integration test", () => {
236236
sessionToken: "SSO_SESSION_TOKEN_us-sso-region-1",
237237
expiration: new Date("3000-01-01T00:00:00.000Z"),
238238
$source: {
239-
CREDENTIALS_CODE: "e",
240239
CREDENTIALS_SSO_LEGACY: "u",
241240
},
242241
});
@@ -523,7 +522,6 @@ describe("credential-provider-node integration test", () => {
523522
sessionToken: "STS_AR_SESSION_TOKEN_us-west-2",
524523
expiration: new Date("3000-01-01T00:00:00.000Z"),
525524
$source: {
526-
CREDENTIALS_CODE: "e",
527525
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
528526
CREDENTIALS_STS_ASSUME_ROLE: "i",
529527
},
@@ -567,7 +565,6 @@ describe("credential-provider-node integration test", () => {
567565
sessionToken: "STS_AR_SESSION_TOKEN_us-west-2",
568566
expiration: new Date("3000-01-01T00:00:00.000Z"),
569567
$source: {
570-
CREDENTIALS_CODE: "e",
571568
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
572569
CREDENTIALS_STS_ASSUME_ROLE: "i",
573570
},
@@ -613,7 +610,6 @@ describe("credential-provider-node integration test", () => {
613610
sessionToken: "STS_AR_SESSION_TOKEN_us-west-2",
614611
expiration: new Date("3000-01-01T00:00:00.000Z"),
615612
$source: {
616-
CREDENTIALS_CODE: "e",
617613
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
618614
CREDENTIALS_STS_ASSUME_ROLE: "i",
619615
},
@@ -666,7 +662,6 @@ describe("credential-provider-node integration test", () => {
666662
sessionToken: "STS_AR_SESSION_TOKEN_us-west-2",
667663
expiration: new Date("3000-01-01T00:00:00.000Z"),
668664
$source: {
669-
CREDENTIALS_CODE: "e",
670665
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
671666
CREDENTIALS_STS_ASSUME_ROLE: "i",
672667
},
@@ -724,7 +719,6 @@ describe("credential-provider-node integration test", () => {
724719
sessionToken: "STS_ARWI_SESSION_TOKEN_ap-northeast-1",
725720
expiration: new Date("3000-01-01T00:00:00.000Z"),
726721
$source: {
727-
CREDENTIALS_CODE: "e",
728722
CREDENTIALS_STS_ASSUME_ROLE_WEB_ID: "k",
729723
},
730724
});
@@ -765,7 +759,6 @@ describe("credential-provider-node integration test", () => {
765759
sessionToken: "STS_ARWI_SESSION_TOKEN_eu-west-2",
766760
expiration: new Date("3000-01-01T00:00:00.000Z"),
767761
$source: {
768-
CREDENTIALS_CODE: "e",
769762
CREDENTIALS_STS_ASSUME_ROLE_WEB_ID: "k",
770763
},
771764
});
@@ -827,7 +820,6 @@ describe("credential-provider-node integration test", () => {
827820
sessionToken: "COGNITO_SESSION_TOKEN_ap-northeast-1",
828821
identityId: "",
829822
expiration: new Date("3000-01-01T00:00:00.000Z"),
830-
$source: { CREDENTIALS_CODE: "e" },
831823
});
832824
});
833825

@@ -846,7 +838,6 @@ describe("credential-provider-node integration test", () => {
846838
sessionToken: "COGNITO_SESSION_TOKEN_ap-northeast-1",
847839
identityId: "ap-northeast-1:COGNITO_IDENTITY_ID",
848840
expiration: new Date("3000-01-01T00:00:00.000Z"),
849-
$source: { CREDENTIALS_CODE: "e" },
850841
});
851842
});
852843

@@ -875,7 +866,6 @@ describe("credential-provider-node integration test", () => {
875866
sessionToken: "STS_AR_SESSION_TOKEN_eu-west-1",
876867
expiration: new Date("3000-01-01T00:00:00.000Z"),
877868
$source: {
878-
CREDENTIALS_CODE: "e",
879869
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
880870
CREDENTIALS_STS_ASSUME_ROLE: "i",
881871
},
@@ -907,7 +897,6 @@ describe("credential-provider-node integration test", () => {
907897
sessionToken: "STS_AR_SESSION_TOKEN_eu-west-2",
908898
expiration: new Date("3000-01-01T00:00:00.000Z"),
909899
$source: {
910-
CREDENTIALS_CODE: "e",
911900
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
912901
CREDENTIALS_STS_ASSUME_ROLE: "i",
913902
},
@@ -930,7 +919,6 @@ describe("credential-provider-node integration test", () => {
930919
sessionToken: "STS_ARWI_SESSION_TOKEN_ap-northeast-1",
931920
expiration: new Date("3000-01-01T00:00:00.000Z"),
932921
$source: {
933-
CREDENTIALS_CODE: "e",
934922
CREDENTIALS_STS_ASSUME_ROLE_WEB_ID: "k",
935923
},
936924
});
@@ -1108,7 +1096,6 @@ describe("credential-provider-node integration test", () => {
11081096
sessionToken: "STS_AR_SESSION_TOKEN_ap-northeast-1",
11091097
expiration: new Date("3000-01-01T00:00:00.000Z"),
11101098
$source: {
1111-
CREDENTIALS_CODE: "e",
11121099
CREDENTIALS_PROFILE_SOURCE_PROFILE: "o",
11131100
CREDENTIALS_STS_ASSUME_ROLE: "i",
11141101
},
@@ -1156,7 +1143,6 @@ describe("credential-provider-node integration test", () => {
11561143
secretAccessKey: "DEFAULT",
11571144
sessionToken: undefined,
11581145
$source: {
1159-
CREDENTIALS_CODE: "e",
11601146
CREDENTIALS_PROFILE: "n",
11611147
},
11621148
});
@@ -1232,7 +1218,6 @@ describe("credential-provider-node integration test", () => {
12321218
sessionToken: "SSO_SESSION_TOKEN_us-sso-region-2",
12331219
expiration: new Date("3000-01-01T00:00:00.000Z"),
12341220
$source: {
1235-
CREDENTIALS_CODE: "e",
12361221
CREDENTIALS_PROFILE_SSO: "r",
12371222
CREDENTIALS_SSO: "s",
12381223
},
@@ -1306,9 +1291,6 @@ describe("credential-provider-node integration test", () => {
13061291
expect(credentials).toEqual({
13071292
accessKeyId: "STS_AK1",
13081293
secretAccessKey: "STS_SAK1",
1309-
$source: {
1310-
CREDENTIALS_CODE: "e",
1311-
},
13121294
});
13131295
});
13141296

@@ -1321,18 +1303,12 @@ describe("credential-provider-node integration test", () => {
13211303
expect(credentials1).toEqual({
13221304
accessKeyId: "STS_AK1",
13231305
secretAccessKey: "STS_SAK1",
1324-
$source: {
1325-
CREDENTIALS_CODE: "e",
1326-
},
13271306
});
13281307

13291308
const credentials2 = await client.config.credentials({});
13301309
expect(credentials2).toEqual({
13311310
accessKeyId: "STS_AK1",
13321311
secretAccessKey: "STS_SAK1",
1333-
$source: {
1334-
CREDENTIALS_CODE: "e",
1335-
},
13361312
});
13371313

13381314
const credentials3 = await client.config.credentials({
@@ -1341,18 +1317,12 @@ describe("credential-provider-node integration test", () => {
13411317
expect(credentials3).toEqual({
13421318
accessKeyId: "STS_AK2",
13431319
secretAccessKey: "STS_SAK2",
1344-
$source: {
1345-
CREDENTIALS_CODE: "e",
1346-
},
13471320
});
13481321

13491322
const credentials4 = await client.config.credentials({});
13501323
expect(credentials4).toEqual({
13511324
accessKeyId: "STS_AK2",
13521325
secretAccessKey: "STS_SAK2",
1353-
$source: {
1354-
CREDENTIALS_CODE: "e",
1355-
},
13561326
});
13571327
});
13581328
});

‎packages/credential-providers/tests/fromCognitoIdentity.integ.spec.ts‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,6 @@ describe(fromCognitoIdentity.name, () => {
4141
});
4242
await s3.listBuckets();
4343
expect(await s3.config.credentials()).toEqual({
44-
$source: {
45-
CREDENTIALS_CODE: "e",
46-
},
4744
accessKeyId: "COGNITO_ACCESS_KEY_ID",
4845
expiration: new Date("3000-01-01T00:00:00.000Z"),
4946
identityId: "us-east-2:128d0a74-c82f-4553-916d-90053example",

‎packages/credential-providers/tests/fromCognitoIdentityPool.integ.spec.ts‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,6 @@ describe(fromCognitoIdentityPool.name, () => {
4141
});
4242
await s3.listBuckets();
4343
expect(await s3.config.credentials()).toEqual({
44-
$source: {
45-
CREDENTIALS_CODE: "e",
46-
},
4744
accessKeyId: "COGNITO_ACCESS_KEY_ID",
4845
expiration: new Date("3000-01-01T00:00:00.000Z"),
4946
identityId: "us-east-2:COGNITO_IDENTITY_ID",

‎packages/credential-providers/tests/fromHttp.integ.spec.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ describe(fromHttp.name, () => {
2020
expect(await s3.config.credentials()).toEqual({
2121
$source: {
2222
CREDENTIALS_HTTP: "z",
23-
CREDENTIALS_CODE: "e",
2423
},
2524
accessKeyId: "CONTAINER_ACCESS_KEY",
2625
expiration: new Date("3000-01-01T00:00:00.000Z"),
@@ -48,7 +47,6 @@ describe(fromHttp.name, () => {
4847
expect(await s3.config.credentials()).toEqual({
4948
$source: {
5049
CREDENTIALS_HTTP: "z",
51-
CREDENTIALS_CODE: "e",
5250
},
5351
accessKeyId: "CONTAINER_ACCESS_KEY",
5452
expiration: new Date("3000-01-01T00:00:00.000Z"),

‎packages/credential-providers/tests/fromIni.integ.spec.ts‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ describe(fromIni.name, () => {
3131
await s3.listBuckets();
3232
expect(await s3.config.credentials()).toEqual({
3333
$source: {
34-
CREDENTIALS_CODE: "e",
3534
CREDENTIALS_PROFILE: "n",
3635
},
3736
accessKeyId: "A",
@@ -57,7 +56,6 @@ describe(fromIni.name, () => {
5756
await s3.listBuckets();
5857
expect(await s3.config.credentials()).toEqual({
5958
$source: {
60-
CREDENTIALS_CODE: "e",
6159
CREDENTIALS_PROFILE: "n",
6260
},
6361
accessKeyId: "A",
@@ -84,7 +82,6 @@ describe(fromIni.name, () => {
8482
await s3.listBuckets();
8583
expect(await s3.config.credentials()).toEqual({
8684
$source: {
87-
CREDENTIALS_CODE: "e",
8885
CREDENTIALS_PROFILE: "n",
8986
},
9087
accessKeyId: "A",

‎packages/credential-providers/tests/fromLoginCredentials.integ.spec.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,6 @@ describe(fromLoginCredentials.name, () => {
7575
await s3.listBuckets();
7676
expect(await s3.config.credentials()).toEqual({
7777
$source: {
78-
CREDENTIALS_CODE: "e",
7978
CREDENTIALS_LOGIN: "AD",
8079
},
8180
accessKeyId: "LOGIN_ACCESS_KEY_ID",
@@ -123,7 +122,6 @@ describe(fromLoginCredentials.name, () => {
123122
await s3.listBuckets();
124123
expect(await s3.config.credentials()).toEqual({
125124
$source: {
126-
CREDENTIALS_CODE: "e",
127125
CREDENTIALS_LOGIN: "AD",
128126
},
129127
accessKeyId: "LOGIN_ACCESS_KEY_ID",

‎packages/credential-providers/tests/fromProcess.integ.spec.ts‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ describe(fromProcess.name, () => {
2424
await s3.listBuckets();
2525
expect(await s3.config.credentials()).toEqual({
2626
$source: {
27-
CREDENTIALS_CODE: "e",
2827
CREDENTIALS_PROCESS: "w",
2928
},
3029
accessKeyId: "PROCESS_ACCESS_KEY_ID",
@@ -48,7 +47,6 @@ describe(fromProcess.name, () => {
4847
await s3.listBuckets();
4948
expect(await s3.config.credentials()).toEqual({
5049
$source: {
51-
CREDENTIALS_CODE: "e",
5250
CREDENTIALS_PROCESS: "w",
5351
},
5452
accessKeyId: "PROCESS_ACCESS_KEY_ID",
@@ -73,7 +71,6 @@ describe(fromProcess.name, () => {
7371
await s3.listBuckets();
7472
expect(await s3.config.credentials()).toEqual({
7573
$source: {
76-
CREDENTIALS_CODE: "e",
7774
CREDENTIALS_PROCESS: "w",
7875
},
7976
accessKeyId: "PROCESS_ACCESS_KEY_ID",

‎packages/credential-providers/tests/fromSSO.integ.spec.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ describe(fromSSO.name, () => {
4545
await s3.listBuckets();
4646
expect(await s3.config.credentials()).toEqual({
4747
$source: {
48-
CREDENTIALS_CODE: "e",
4948
CREDENTIALS_SSO_LEGACY: "u",
5049
},
5150
accessKeyId: "SSO_ACCESS_KEY_ID",
@@ -69,7 +68,6 @@ describe(fromSSO.name, () => {
6968
await s3.listBuckets();
7069
expect(await s3.config.credentials()).toEqual({
7170
$source: {
72-
CREDENTIALS_CODE: "e",
7371
CREDENTIALS_SSO_LEGACY: "u",
7472
},
7573
accessKeyId: "SSO_ACCESS_KEY_ID",

0 commit comments

Comments
 (0)
⚡