--- /dev/null
+/**
+ * @license
+ * Copyright 2015 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+/**
+ * Credentials module
+ *
+ * This module contains factory methods for two different credential types:
+ * CallCredentials and ChannelCredentials. ChannelCredentials are things like
+ * SSL credentials that can be used to secure a connection, and are used to
+ * construct a Client object. CallCredentials genrally modify metadata, so they
+ * can be attached to an individual method call.
+ *
+ * CallCredentials can be composed with other CallCredentials to create
+ * CallCredentials. ChannelCredentials can be composed with CallCredentials
+ * to create ChannelCredentials. No combined credential can have more than
+ * one ChannelCredentials.
+ *
+ * For example, to create a client secured with SSL that uses Google
+ * default application credentials to authenticate:
+ *
+ * @example
+ * var channel_creds = credentials.createSsl(root_certs);
+ * (new GoogleAuth()).getApplicationDefault(function(err, credential) {
+ * var call_creds = credentials.createFromGoogleCredential(credential);
+ * var combined_creds = credentials.combineChannelCredentials(
+ * channel_creds, call_creds);
+ * var client = new Client(address, combined_creds);
+ * });
+ *
+ * @namespace grpc.credentials
+ */
+
+'use strict';
+
+var grpc = require('./grpc_extension');
+
+/**
+ * This cannot be constructed directly. Instead, instances of this class should
+ * be created using the factory functions in {@link grpc.credentials}
+ * @constructor grpc.credentials~CallCredentials
+ */
+var CallCredentials = grpc.CallCredentials;
+
+/**
+ * This cannot be constructed directly. Instead, instances of this class should
+ * be created using the factory functions in {@link grpc.credentials}
+ * @constructor grpc.credentials~ChannelCredentials
+ */
+var ChannelCredentials = grpc.ChannelCredentials;
+
+var Metadata = require('./metadata.js');
+
+var common = require('./common.js');
+
+var constants = require('./constants');
+
+/**
+ * @external GoogleCredential
+ * @see https://github.com/google/google-auth-library-nodejs
+ */
+
+const PEM_CERT_HEADER = "-----BEGIN CERTIFICATE-----";
+const PEM_CERT_FOOTER = "-----END CERTIFICATE-----";
+
+function wrapCheckServerIdentityCallback(callback) {
+ return function(hostname, cert) {
+ // Parse cert from pem to a version that matches the tls.checkServerIdentity
+ // format.
+ // https://nodejs.org/api/tls.html#tls_tls_checkserveridentity_hostname_cert
+
+ var pemHeaderIndex = cert.indexOf(PEM_CERT_HEADER);
+ if (pemHeaderIndex === -1) {
+ return new Error("Unable to parse certificate PEM.");
+ }
+ cert = cert.substring(pemHeaderIndex);
+ var pemFooterIndex = cert.indexOf(PEM_CERT_FOOTER);
+ if (pemFooterIndex === -1) {
+ return new Error("Unable to parse certificate PEM.");
+ }
+ cert = cert.substring(PEM_CERT_HEADER.length, pemFooterIndex);
+ var rawBuffer = Buffer.from(cert.replace("\n", "").replace(" ", ""), "base64");
+
+ return callback(hostname, { raw: rawBuffer });
+ }
+}
+
+/**
+ * Create an SSL Credentials object. If using a client-side certificate, both
+ * the second and third arguments must be passed. Additional peer verification
+ * options can be passed in the fourth argument as described below.
+ * @memberof grpc.credentials
+ * @alias grpc.credentials.createSsl
+ * @kind function
+ * @param {Buffer=} root_certs The root certificate data
+ * @param {Buffer=} private_key The client certificate private key, if
+ * applicable
+ * @param {Buffer=} cert_chain The client certificate cert chain, if applicable
+ * @param {Function} verify_options.checkServerIdentity Optional callback
+ * receiving the expected hostname and peer certificate for additional
+ * verification. The callback should return an Error if verification
+ * fails and otherwise return undefined.
+ * @return {grpc.credentials~ChannelCredentials} The SSL Credentials object
+ */
+exports.createSsl = function(root_certs, private_key, cert_chain, verify_options) {
+ // The checkServerIdentity callback from gRPC core will receive the cert as a PEM.
+ // To better match the checkServerIdentity callback of Node, we wrap the callback
+ // to decode the PEM and populate a cert object.
+ if (verify_options && verify_options.checkServerIdentity) {
+ if (typeof verify_options.checkServerIdentity !== 'function') {
+ throw new TypeError("Value of checkServerIdentity must be a function.");
+ }
+ // Make a shallow clone of verify_options so our modification of the callback
+ // isn't reflected to the caller
+ var updated_verify_options = Object.assign({}, verify_options);
+ updated_verify_options.checkServerIdentity = wrapCheckServerIdentityCallback(
+ verify_options.checkServerIdentity);
+ arguments[3] = updated_verify_options;
+ }
+ return ChannelCredentials.createSsl.apply(this, arguments);
+}
+
+
+/**
+ * @callback grpc.credentials~metadataCallback
+ * @param {Error} error The error, if getting metadata failed
+ * @param {grpc.Metadata} metadata The metadata
+ */
+
+/**
+ * @callback grpc.credentials~generateMetadata
+ * @param {Object} params Parameters that can modify metadata generation
+ * @param {string} params.service_url The URL of the service that the call is
+ * going to
+ * @param {grpc.credentials~metadataCallback} callback
+ */
+
+/**
+ * Create a gRPC credentials object from a metadata generation function. This
+ * function gets the service URL and a callback as parameters. The error
+ * passed to the callback can optionally have a 'code' value attached to it,
+ * which corresponds to a status code that this library uses.
+ * @memberof grpc.credentials
+ * @alias grpc.credentials.createFromMetadataGenerator
+ * @param {grpc.credentials~generateMetadata} metadata_generator The function
+ * that generates metadata
+ * @return {grpc.credentials~CallCredentials} The credentials object
+ */
+exports.createFromMetadataGenerator = function(metadata_generator) {
+ return CallCredentials.createFromPlugin(function(service_url, cb_data,
+ callback) {
+ metadata_generator({service_url: service_url}, function(error, metadata) {
+ var code = constants.status.OK;
+ var message = '';
+ if (error) {
+ message = error.message;
+ if (error.hasOwnProperty('code') && Number.isFinite(error.code)) {
+ code = error.code;
+ } else {
+ code = constants.status.UNAUTHENTICATED;
+ }
+ if (!metadata) {
+ metadata = new Metadata();
+ }
+ }
+ callback(code, message, metadata._getCoreRepresentation(), cb_data);
+ });
+ });
+};
+
+function getAuthorizationHeaderFromGoogleCredential(google_credential, url, callback) {
+ // google-auth-library pre-v2.0.0 does not have getRequestHeaders
+ // but has getRequestMetadata, which is deprecated in v2.0.0
+ if (typeof google_credential.getRequestHeaders === 'function') {
+ google_credential.getRequestHeaders(url)
+ .then(function(header) {
+ callback(null, header.Authorization);
+ })
+ .catch(function(err) {
+ callback(err);
+ return;
+ });
+ } else {
+ google_credential.getRequestMetadata(url, function(err, header) {
+ if (err) {
+ callback(err);
+ return;
+ }
+ callback(null, header.Authorization);
+ });
+ }
+}
+
+/**
+ * Create a gRPC credential from a Google credential object.
+ * @memberof grpc.credentials
+ * @alias grpc.credentials.createFromGoogleCredential
+ * @param {external:GoogleCredential} google_credential The Google credential
+ * object to use
+ * @return {grpc.credentials~CallCredentials} The resulting credentials object
+ */
+exports.createFromGoogleCredential = function(google_credential) {
+ return exports.createFromMetadataGenerator(function(auth_context, callback) {
+ var service_url = auth_context.service_url;
+ getAuthorizationHeaderFromGoogleCredential(google_credential, service_url,
+ function(err, authHeader) {
+ if (err) {
+ common.log(constants.logVerbosity.INFO, 'Auth error:' + err);
+ callback(err);
+ return;
+ }
+ var metadata = new Metadata();
+ metadata.add('authorization', authHeader);
+ callback(null, metadata);
+ });
+ });
+};
+
+/**
+ * Combine a ChannelCredentials with any number of CallCredentials into a single
+ * ChannelCredentials object.
+ * @memberof grpc.credentials
+ * @alias grpc.credentials.combineChannelCredentials
+ * @param {grpc.credentials~ChannelCredentials} channel_credential The ChannelCredentials to
+ * start with
+ * @param {...grpc.credentials~CallCredentials} credentials The CallCredentials to compose
+ * @return {grpc.credentials~ChannelCredentials} A credentials object that combines all of the
+ * input credentials
+ */
+exports.combineChannelCredentials = function(channel_credential) {
+ var current = channel_credential;
+ for (var i = 1; i < arguments.length; i++) {
+ current = current.compose(arguments[i]);
+ }
+ return current;
+};
+
+/**
+ * Combine any number of CallCredentials into a single CallCredentials object
+ * @memberof grpc.credentials
+ * @alias grpc.credentials.combineCallCredentials
+ * @param {...grpc.credentials~CallCredentials} credentials The CallCredentials to compose
+ * @return {grpc.credentials~CallCredentials} A credentials object that combines all of the input
+ * credentials
+ */
+exports.combineCallCredentials = function() {
+ var current = arguments[0];
+ for (var i = 1; i < arguments.length; i++) {
+ current = current.compose(arguments[i]);
+ }
+ return current;
+};
+
+/**
+ * Create an insecure credentials object. This is used to create a channel that
+ * does not use SSL. This cannot be composed with anything.
+ * @memberof grpc.credentials
+ * @alias grpc.credentials.createInsecure
+ * @kind function
+ * @return {grpc.credentials~ChannelCredentials} The insecure credentials object
+ */
+exports.createInsecure = ChannelCredentials.createInsecure;
git://repos.xcallymotion.com / motion2.git / blobdiff