Credentials Management

package.nls.json

@@ -89,7 +89,7 @@
     "AWS.message.credentials.error": "There was an issue trying to use credentials profile {0}: {1}",
     "AWS.message.credentials.invalid": "Invalid Credentials {0}, see logs for more information.",
     "AWS.message.credentials.invalid.help": "Get Help...",
-    "AWS.message.credentials.invalid.logs": "View logs...",
+    "AWS.message.credentials.invalid.logs": "View Logs...",
     "AWS.message.enterProfileName": "Enter the name of the credential profile to use",
     "AWS.message.info.cloudFormation.delete": "Deleted CloudFormation Stack {0}",
     "AWS.message.error.cloudFormation.delete": "An error occurred while deleting CloudFormation Stack {0}. Please check the stack events on the AWS Console",

src/credentials/activation.ts

@@ -9,7 +9,7 @@ import { profileSettingKey } from '../shared/constants'
 import { CredentialsProfileMru } from '../shared/credentials/credentialsProfileMru'
 import { SettingsConfiguration } from '../shared/settingsConfiguration'
 import { LoginManager } from './loginManager'
-import { CREDENTIALS_PROVIDER_ID_SEPARATOR, makeCredentialsProviderId } from './providers/credentialsProviderId'
+import { CredentialsProviderId, fromString } from './providers/credentialsProviderId'
 import { SharedCredentialsProvider } from './providers/sharedCredentialsProvider'
 
 export interface CredentialsInitializeParameters {
@@ -31,18 +31,16 @@ export async function loginWithMostRecentCredentials(
     toolkitSettings: SettingsConfiguration,
     loginManager: LoginManager
 ): Promise<void> {
-    let previousCredentialsId = toolkitSettings.readSetting<string>(profileSettingKey, '')
+    const previousCredentialsId = toolkitSettings.readSetting<string>(profileSettingKey, '')
     if (previousCredentialsId) {
         // Migrate from older Toolkits - If the last providerId isn't in the new CredentialProviderId format,
         // treat it like a Shared Crdentials Provider.
-        if (previousCredentialsId.indexOf(CREDENTIALS_PROVIDER_ID_SEPARATOR) === -1) {
-            previousCredentialsId = makeCredentialsProviderId({
-                credentialType: SharedCredentialsProvider.getCredentialsType(),
-                credentialTypeId: previousCredentialsId
-            })
+        const loginCredentialsId = tryMakeCredentialsProviderId(previousCredentialsId) ?? {
+            credentialType: SharedCredentialsProvider.getCredentialsType(),
+            credentialTypeId: previousCredentialsId
         }
 
-        await loginManager.login(previousCredentialsId)
+        await loginManager.login(loginCredentialsId)
     } else {
         await loginManager.logout()
     }
@@ -79,3 +77,11 @@ function updateConfigurationWhenAwsContextChanges(
         })
     )
 }
+
+function tryMakeCredentialsProviderId(credentialsProviderId: string): CredentialsProviderId | undefined {
+    try {
+        return fromString(credentialsProviderId)
+    } catch (err) {
+        return undefined
+    }
+}

src/credentials/credentialsStore.ts

@@ -1,11 +1,13 @@
 /*!
- * Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * Copyright 2019-2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
 import * as AWS from 'aws-sdk'
+import { CredentialsProvider } from './providers/credentialsProvider'
+import { asString, CredentialsProviderId } from './providers/credentialsProviderId'
 
-interface CredentialsData {
+export interface CachedCredentials {
     credentials: AWS.Credentials
     credentialsHashCode: number
 }
@@ -14,7 +16,7 @@ interface CredentialsData {
  * Simple cache for credentials
  */
 export class CredentialsStore {
-    private readonly credentialsCache: { [key: string]: CredentialsData }
+    private readonly credentialsCache: { [key: string]: CachedCredentials }
 
     public constructor() {
         this.credentialsCache = {}
@@ -23,41 +25,36 @@ export class CredentialsStore {
     /**
      * Returns undefined if credentials are not stored for given ID
      */
-    public async getCredentials(credentialsId: string): Promise<AWS.Credentials | undefined> {
-        return this.credentialsCache[credentialsId]?.credentials
+    public async getCredentials(credentialsProviderId: CredentialsProviderId): Promise<CachedCredentials | undefined> {
+        return this.credentialsCache[asString(credentialsProviderId)]
     }
 
     /**
-     * If credentials are not stored, the provided create function is called. Created credentials are then stored.
+     * If credentials are not stored, the credentialsProvider is used to produce credentials (which are then stored).
      */
-    public async getCredentialsOrCreate(
-        credentialsId: string,
-        createCredentialsFn: (credentialsId: string) => Promise<CredentialsData>
-    ): Promise<AWS.Credentials> {
-        const credentials = await this.getCredentials(credentialsId)
-
-        if (credentials) {
-            return credentials
+    public async getOrCreateCredentials(
+        credentialsProviderId: CredentialsProviderId,
+        credentialsProvider: CredentialsProvider
+    ): Promise<CachedCredentials> {
+        let credentials = await this.getCredentials(credentialsProviderId)
+
+        if (!credentials) {
+            credentials = {
+                credentials: await credentialsProvider.getCredentials(),
+                credentialsHashCode: credentialsProvider.getHashCode()
+            }
+
+            this.credentialsCache[asString(credentialsProviderId)] = credentials
         }
 
-        const newCredentials = await createCredentialsFn(credentialsId)
-        this.credentialsCache[credentialsId] = newCredentials
-
-        return newCredentials.credentials
-    }
-
-    /**
-     * Returns undefined if credentials are not stored for given ID
-     */
-    public getCredentialsHashCode(credentialsId: string): number | undefined {
-        return this.credentialsCache[credentialsId]?.credentialsHashCode
+        return credentials
     }
 
     /**
      * Evicts credentials from storage
      */
-    public invalidateCredentials(credentialsId: string) {
+    public invalidateCredentials(credentialsProviderId: CredentialsProviderId) {
         // tslint:disable-next-line:no-dynamic-delete
-        delete this.credentialsCache[credentialsId]
+        delete this.credentialsCache[asString(credentialsProviderId)]
     }
 }

src/credentials/loginManager.ts

@@ -13,7 +13,8 @@ import { getAccountId } from '../shared/credentials/accountId'
 import { getLogger } from '../shared/logger'
 import { CredentialsStore } from './credentialsStore'
 import { CredentialsProvider } from './providers/credentialsProvider'
-import { getCredentialsProviderManagerInstance } from './providers/credentialsProviderManager'
+import { asString, CredentialsProviderId } from './providers/credentialsProviderId'
+import { CredentialsProviderManager } from './providers/credentialsProviderManager'
 
 export class LoginManager {
     private readonly credentialsStore: CredentialsStore = new CredentialsStore()
@@ -24,42 +25,46 @@ export class LoginManager {
      * Establishes a Credentials for the Toolkit to use. Essentially the Toolkit becomes "logged in".
      * If an error occurs while trying to set up and verify these credentials, the Toolkit is "logged out".
      */
-    public async login(credentialsId: string): Promise<void> {
+    public async login(credentialsProviderId: CredentialsProviderId): Promise<void> {
         try {
-            const provider = await getCredentialsProviderManagerInstance().getCredentialsProvider(credentialsId)
+            const provider = await CredentialsProviderManager.getInstance().getCredentialsProvider(
+                credentialsProviderId
+            )
             if (!provider) {
-                throw new Error(`Could not find Credentials Provider for ${credentialsId}`)
+                throw new Error(`Could not find Credentials Provider for ${asString(credentialsProviderId)}`)
             }
 
-            await this.updateCredentialsStore(credentialsId, provider)
+            await this.updateCredentialsStore(credentialsProviderId, provider)
 
-            const credentials = await this.credentialsStore.getCredentials(credentialsId)
-            if (!credentials) {
-                throw new Error(`No credentials found for id ${credentialsId}`)
+            const storedCredentials = await this.credentialsStore.getCredentials(credentialsProviderId)
+            if (!storedCredentials) {
+                throw new Error(`No credentials found for id ${asString(credentialsProviderId)}`)
             }
 
             // TODO : Get a region relevant to the partition for these credentials -- https://github.com/aws/aws-toolkit-vscode/issues/188
-            const accountId = await getAccountId(credentials, 'us-east-1')
+            const accountId = await getAccountId(storedCredentials.credentials, 'us-east-1')
             if (!accountId) {
                 throw new Error('Could not determine Account Id for credentials')
             }
 
             await this.awsContext.setCredentials({
-                credentials: credentials,
-                credentialsId: credentialsId,
+                credentials: storedCredentials.credentials,
+                credentialsId: asString(credentialsProviderId),
                 accountId: accountId,
                 defaultRegion: provider.getDefaultRegion()
             })
         } catch (err) {
             getLogger().error(
-                `Error trying to connect to AWS with Credentials Provider ${credentialsId}. Toolkit will now disconnect from AWS.`,
+                `Error trying to connect to AWS with Credentials Provider ${asString(
+                    credentialsProviderId
+                )}. Toolkit will now disconnect from AWS.`,
                 err as Error
             )
-            this.credentialsStore.invalidateCredentials(credentialsId)
+            this.credentialsStore.invalidateCredentials(credentialsProviderId)
 
             await this.logout()
 
-            this.notifyUserInvalidCredentials(credentialsId)
+            this.notifyUserInvalidCredentials(credentialsProviderId)
         }
     }
 
@@ -73,31 +78,31 @@ export class LoginManager {
     /**
      * Updates the CredentialsStore if the credentials are considered different
      */
-    private async updateCredentialsStore(credentialsId: string, provider: CredentialsProvider): Promise<void> {
-        const currentHash = this.credentialsStore.getCredentialsHashCode(credentialsId)
-        if (provider.getHashCode() !== currentHash) {
-            getLogger().verbose(`Credentials for ${credentialsId} have changed, using updated credentials.`)
-            this.credentialsStore.invalidateCredentials(credentialsId)
+    private async updateCredentialsStore(
+        credentialsProviderId: CredentialsProviderId,
+        provider: CredentialsProvider
+    ): Promise<void> {
+        const storedCredentials = await this.credentialsStore.getCredentials(credentialsProviderId)
+        if (provider.getHashCode() !== storedCredentials?.credentialsHashCode) {
+            getLogger().verbose(
+                `Credentials for ${asString(credentialsProviderId)} have changed, using updated credentials.`
+            )
+            this.credentialsStore.invalidateCredentials(credentialsProviderId)
         }
 
-        await this.credentialsStore.getCredentialsOrCreate(credentialsId, async () => {
-            return {
-                credentials: await provider.getCredentials(),
-                credentialsHashCode: provider.getHashCode()
-            }
-        })
+        await this.credentialsStore.getOrCreateCredentials(credentialsProviderId, provider)
     }
 
-    private notifyUserInvalidCredentials(credentialProviderId: string) {
+    private notifyUserInvalidCredentials(credentialProviderId: CredentialsProviderId) {
         const getHelp = localize('AWS.message.credentials.invalid.help', 'Get Help...')
-        const viewLogs = localize('AWS.message.credentials.invalid.logs', 'View logs...')
+        const viewLogs = localize('AWS.message.credentials.invalid.logs', 'View Logs...')
 
         vscode.window
             .showErrorMessage(
                 localize(
                     'AWS.message.credentials.invalid',
                     'Invalid Credentials {0}, see logs for more information.',
-                    credentialProviderId
+                    asString(credentialProviderId)
                 ),
                 getHelp,
                 viewLogs

src/credentials/providers/credentialsProvider.ts

@@ -3,8 +3,10 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import { CredentialsProviderId } from './credentialsProviderId'
+
 export interface CredentialsProvider {
-    getCredentialsProviderId(): string
+    getCredentialsProviderId(): CredentialsProviderId
     getDefaultRegion(): string | undefined
     getHashCode(): number
     getCredentials(): Promise<AWS.Credentials>

src/credentials/providers/credentialsProviderFactory.ts

@@ -4,14 +4,15 @@
  */
 
 import { CredentialsProvider } from './credentialsProvider'
+import { CredentialsProviderId, isEqual } from './credentialsProviderId'
 
 /**
  * Responsible for producing CredentialsProvider objects for a Credential Type
  */
 export interface CredentialsProviderFactory {
     getCredentialType(): string
     listProviders(): CredentialsProvider[]
-    getProvider(credentialsProviderId: string): CredentialsProvider | undefined
+    getProvider(credentialsProviderId: CredentialsProviderId): CredentialsProvider | undefined
     refresh(): Promise<void>
 }
 
@@ -24,9 +25,9 @@ export abstract class BaseCredentialsProviderFactory<T extends CredentialsProvid
         return [...this.providers]
     }
 
-    public getProvider(credentialsProviderId: string): CredentialsProvider | undefined {
+    public getProvider(credentialsProviderId: CredentialsProviderId): CredentialsProvider | undefined {
         for (const provider of this.providers) {
-            if (provider.getCredentialsProviderId() === credentialsProviderId) {
+            if (isEqual(provider.getCredentialsProviderId(), credentialsProviderId)) {
                 return provider
             }
         }

src/credentials/providers/credentialsProviderId.ts

@@ -3,28 +3,32 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-export const CREDENTIALS_PROVIDER_ID_SEPARATOR = ':'
+const CREDENTIALS_PROVIDER_ID_SEPARATOR = ':'
 
-export interface CredentialsProviderIdComponents {
-    credentialType: string
-    credentialTypeId: string
+export interface CredentialsProviderId {
+    readonly credentialType: string
+    readonly credentialTypeId: string
 }
 
-export function makeCredentialsProviderIdComponents(credentialsProviderId: string): CredentialsProviderIdComponents {
-    const chunks = credentialsProviderId.split(CREDENTIALS_PROVIDER_ID_SEPARATOR)
+export function asString(credentialsProviderId: CredentialsProviderId): string {
+    return [credentialsProviderId.credentialType, credentialsProviderId.credentialTypeId].join(
+        CREDENTIALS_PROVIDER_ID_SEPARATOR
+    )
+}
 
-    if (chunks.length !== 2) {
+export function fromString(credentialsProviderId: string): CredentialsProviderId {
+    const separatorPos = credentialsProviderId.indexOf(CREDENTIALS_PROVIDER_ID_SEPARATOR)
+
+    if (separatorPos === -1) {
         throw new Error(`Unexpected credentialsProviderId format: ${credentialsProviderId}`)
     }
 
     return {
-        credentialType: chunks[0],
-        credentialTypeId: chunks[1]
+        credentialType: credentialsProviderId.substring(0, separatorPos),
+        credentialTypeId: credentialsProviderId.substring(separatorPos + 1)
     }
 }
 
-export function makeCredentialsProviderId(credentialsProviderIdComponents: CredentialsProviderIdComponents): string {
-    return [credentialsProviderIdComponents.credentialType, credentialsProviderIdComponents.credentialTypeId].join(
-        CREDENTIALS_PROVIDER_ID_SEPARATOR
-    )
+export function isEqual(idA: CredentialsProviderId, idB: CredentialsProviderId): boolean {
+    return idA.credentialType === idB.credentialType && idA.credentialTypeId === idB.credentialTypeId
 }

src/credentials/providers/credentialsProviderManager.ts

@@ -5,22 +5,13 @@
 
 import { CredentialsProvider } from './credentialsProvider'
 import { CredentialsProviderFactory } from './credentialsProviderFactory'
-import { makeCredentialsProviderIdComponents } from './credentialsProviderId'
-
-let credentialsProviderManagerInstance: CredentialsProviderManager | undefined
-
-export function getCredentialsProviderManagerInstance(): CredentialsProviderManager {
-    if (!credentialsProviderManagerInstance) {
-        credentialsProviderManagerInstance = new CredentialsProviderManager()
-    }
-
-    return credentialsProviderManagerInstance
-}
+import { CredentialsProviderId } from './credentialsProviderId'
 
 /**
  * Responsible for providing the Toolkit with all available CredentialsProviders.
  */
 export class CredentialsProviderManager {
+    private static INSTANCE: CredentialsProviderManager | undefined
     private readonly providerFactories: CredentialsProviderFactory[] = []
 
     public async getAllCredentialsProviders(): Promise<CredentialsProvider[]> {
@@ -35,10 +26,10 @@ export class CredentialsProviderManager {
         return providers
     }
 
-    public async getCredentialsProvider(credentialsProviderId: string): Promise<CredentialsProvider | undefined> {
-        const credentialsType = makeCredentialsProviderIdComponents(credentialsProviderId).credentialType
-
-        const factories = this.getFactories(credentialsType)
+    public async getCredentialsProvider(
+        credentialsProviderId: CredentialsProviderId
+    ): Promise<CredentialsProvider | undefined> {
+        const factories = this.getFactories(credentialsProviderId.credentialType)
         for (const factory of factories) {
             await factory.refresh()
 
@@ -55,7 +46,15 @@ export class CredentialsProviderManager {
         this.providerFactories.push(factory)
     }
 
-    private getFactories(credentialsType: string) {
+    private getFactories(credentialsType: string): CredentialsProviderFactory[] {
         return this.providerFactories.filter(f => f.getCredentialType() === credentialsType)
     }
+
+    public static getInstance(): CredentialsProviderManager {
+        if (!CredentialsProviderManager.INSTANCE) {
+            CredentialsProviderManager.INSTANCE = new CredentialsProviderManager()
+        }
+
+        return CredentialsProviderManager.INSTANCE
+    }
 }