Updating NPM dependencies

node_modules/google-auth-library/build/src/auth/oauth2client.js

@@ -1,24 +1,23 @@
 "use strict";
-/**
- * Copyright 2019 Google LLC. All Rights Reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
+// Copyright 2019 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2Client = exports.CertificateFormat = exports.CodeChallengeMethod = void 0;
 const querystring = require("querystring");
 const stream = require("stream");
+const formatEcdsa = require("ecdsa-sig-formatter");
 const crypto_1 = require("../crypto/crypto");
-const messages = require("../messages");
 const authclient_1 = require("./authclient");
 const loginticket_1 = require("./loginticket");
 var CodeChallengeMethod;
@@ -73,9 +72,12 @@ class OAuth2Client extends authclient_1.AuthClient {
         throw new Error('generateCodeVerifier is removed, please use generateCodeVerifierAsync instead.');
     }
     /**
-     * Convenience method to automatically generate a code_verifier, and it's
+     * Convenience method to automatically generate a code_verifier, and its
      * resulting SHA256. If used, this must be paired with a S256
      * code_challenge_method.
+     *
+     * For a full example see:
+     * https://github.com/googleapis/google-auth-library-nodejs/blob/master/samples/oauth2-codeVerifier.js
      */
     async generateCodeVerifierAsync() {
         // base64 encoding uses 6 bits per character, and we want to generate128
@@ -221,15 +223,6 @@ class OAuth2Client extends authclient_1.AuthClient {
             return { token: this.credentials.access_token };
         }
     }
-    getRequestMetadata(url, callback) {
-        messages.warn(messages.OAUTH_GET_REQUEST_METADATA_DEPRECATED);
-        if (callback) {
-            this.getRequestMetadataAsync(url).then(r => callback(null, r.headers, r.res), callback);
-        }
-        else {
-            return this.getRequestMetadataAsync();
-        }
-    }
     /**
      * The main authentication interface.  It takes an optional url which when
      * present is the endpoint being accessed, and returns a Promise which
@@ -240,10 +233,12 @@ class OAuth2Client extends authclient_1.AuthClient {
      * @param url The optional url being authorized
      */
     async getRequestHeaders(url) {
-        const res = await this.getRequestMetadataAsync(url);
-        return res.headers;
+        const headers = (await this.getRequestMetadataAsync(url)).headers;
+        return headers;
     }
-    async getRequestMetadataAsync(url) {
+    async getRequestMetadataAsync(
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    url) {
         const thisCreds = this.credentials;
         if (!thisCreds.access_token && !thisCreds.refresh_token && !this.apiKey) {
             throw new Error('No access, refresh token or API key is set.');
@@ -279,7 +274,7 @@ class OAuth2Client extends authclient_1.AuthClient {
         const headers = {
             Authorization: credentials.token_type + ' ' + tokens.access_token,
         };
-        return { headers, res: r.res };
+        return { headers: this.addSharedMetadataHeaders(headers), res: r.res };
     }
     /**
      * Generates an URL to revoke the given token.
@@ -335,12 +330,14 @@ class OAuth2Client extends authclient_1.AuthClient {
         let r2;
         try {
             const r = await this.getRequestMetadataAsync(opts.url);
+            opts.headers = opts.headers || {};
+            if (r.headers && r.headers['x-goog-user-project']) {
+                opts.headers['x-goog-user-project'] = r.headers['x-goog-user-project'];
+            }
             if (r.headers && r.headers.Authorization) {
-                opts.headers = opts.headers || {};
                 opts.headers.Authorization = r.headers.Authorization;
             }
             if (this.apiKey) {
-                opts.headers = opts.headers || {};
                 opts.headers['X-Goog-Api-Key'] = this.apiKey;
             }
             r2 = await this.transporter.request(opts);
@@ -406,9 +403,12 @@ class OAuth2Client extends authclient_1.AuthClient {
      */
     async getTokenInfo(accessToken) {
         const { data } = await this.transporter.request({
-            method: 'GET',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
             url: OAuth2Client.GOOGLE_TOKEN_INFO_URL,
-            params: { access_token: accessToken },
+            data: querystring.stringify({ access_token: accessToken }),
         });
         const info = Object.assign({
             expiry_date: new Date().getTime() + data.expires_in * 1000,
@@ -485,6 +485,26 @@ class OAuth2Client extends authclient_1.AuthClient {
         this.certificateCacheFormat = format;
         return { certs: certificates, format, res };
     }
+    getIapPublicKeys(callback) {
+        if (callback) {
+            this.getIapPublicKeysAsync().then(r => callback(null, r.pubkeys, r.res), callback);
+        }
+        else {
+            return this.getIapPublicKeysAsync();
+        }
+    }
+    async getIapPublicKeysAsync() {
+        let res;
+        const url = OAuth2Client.GOOGLE_OAUTH2_IAP_PUBLIC_KEY_URL_;
+        try {
+            res = await this.transporter.request({ url });
+        }
+        catch (e) {
+            e.message = `Failed to retrieve verification certificates: ${e.message}`;
+            throw e;
+        }
+        return { pubkeys: res.data, res };
+    }
     verifySignedJwtWithCerts() {
         // To make the code compatible with browser SubtleCrypto we need to make
         // this method async.
@@ -510,7 +530,7 @@ class OAuth2Client extends authclient_1.AuthClient {
             throw new Error('Wrong number of segments in token: ' + jwt);
         }
         const signed = segments[0] + '.' + segments[1];
-        const signature = segments[2];
+        let signature = segments[2];
         let envelope;
         let payload;
         try {
@@ -533,11 +553,14 @@ class OAuth2Client extends authclient_1.AuthClient {
         if (!payload) {
             throw new Error("Can't parse token payload: " + segments[1]);
         }
-        if (!certs.hasOwnProperty(envelope.kid)) {
+        if (!Object.prototype.hasOwnProperty.call(certs, envelope.kid)) {
             // If this is not present, then there's no reason to attempt verification
             throw new Error('No pem found for envelope: ' + JSON.stringify(envelope));
         }
         const cert = certs[envelope.kid];
+        if (envelope.alg === 'ES256') {
+            signature = formatEcdsa.joseToDer(signature, 'ES256').toString('base64');
+        }
         const verified = await crypto.verify(cert, signed, signature);
         if (!verified) {
             throw new Error('Invalid token signature: ' + jwt);
@@ -634,6 +657,10 @@ OAuth2Client.GOOGLE_OAUTH2_FEDERATED_SIGNON_PEM_CERTS_URL_ = 'https://www.google
  * Google Sign on certificates in JWK format.
  */
 OAuth2Client.GOOGLE_OAUTH2_FEDERATED_SIGNON_JWK_CERTS_URL_ = 'https://www.googleapis.com/oauth2/v3/certs';
+/**
+ * Google Sign on certificates in JWK format.
+ */
+OAuth2Client.GOOGLE_OAUTH2_IAP_PUBLIC_KEY_URL_ = 'https://www.gstatic.com/iap/verify/public_key';
 /**
  * Clock skew - five minutes in seconds
  */