SWAMPy

✎ CARVE FLESH

EDITING: SsoTokenProvider.php

<?php
namespace Aws\Token;

use Aws\Exception\TokenException;
use Aws\SSOOIDC\SSOOIDCClient;
use GuzzleHttp\Promise;

/**
 * Token that comes from the SSO provider
 */
class SsoTokenProvider implements RefreshableTokenProviderInterface
{
    use ParsesIniTrait;

const ENV_PROFILE = 'AWS_PROFILE';
    const REFRESH_WINDOW_IN_SECS = 300;
    const REFRESH_ATTEMPT_WINDOW_IN_SECS = 30;

/** @var string $profileName */
    private $profileName;

/** @var string $configFilePath */
    private $configFilePath;

/** @var SSOOIDCClient $ssoOidcClient */
    private $ssoOidcClient;

/** @var string $ssoSessionName */
    private $ssoSessionName;

/**
     * Constructs a new SsoTokenProvider object, which will fetch a token from an authenticated SSO profile
     * @param string $profileName The name of the profile that contains the sso_session key
     * @param string|null $configFilePath Name of the config file to sso profile from
     * @param SSOOIDCClient|null $ssoOidcClient The sso client for generating a new token
     */
    public function __construct(
        $profileName,
        $configFilePath = null,
        ?SSOOIDCClient $ssoOidcClient = null
    ) {
        $this->profileName = $this->resolveProfileName($profileName);
        $this->configFilePath =  $this->resolveConfigFile($configFilePath);
        $this->ssoOidcClient = $ssoOidcClient;
    }

/**
     * This method resolves the profile name to be used. The
     * profile provided as instantiation argument takes precedence,
     * followed by AWS_PROFILE env variable, otherwise `default` is
     * used.
     *
     * @param string|null $argProfileName The profile provided as argument.
     *
     * @return string
     */
    private function resolveProfileName($argProfileName): string
    {
        if (empty($argProfileName)) {
            return getenv(self::ENV_PROFILE) ?: 'default';
        } else {
            return $argProfileName;
        }
    }

/**
     * This method resolves the config file from where the profiles
     * are going to be loaded from. If $argFileName is not empty then,
     * it takes precedence over the default config file location.
     *
     * @param string|null $argConfigFilePath The config path provided as argument.
     *
     * @return string
     */
    private function resolveConfigFile($argConfigFilePath): string
    {
        if (empty($argConfigFilePath)) {
            return self::getHomeDir() . '/.aws/config';
        } else{
            return $argConfigFilePath;
        }
    }

/**
     *  Loads cached sso credentials.
     *
     * @return Promise\PromiseInterface
     */
    public function __invoke()
    {
        return Promise\Coroutine::of(function () {
            if (empty($this->configFilePath) || !is_readable($this->configFilePath)) {
                throw new TokenException("Cannot read profiles from {$this->configFilePath}");
            }

$profiles = self::loadProfiles($this->configFilePath);
            if (!isset($profiles[$this->profileName])) {
                throw new TokenException("Profile `{$this->profileName}` does not exist in {$this->configFilePath}.");
            }

$profile = $profiles[$this->profileName];
            if (empty($profile['sso_session'])) {
                throw new TokenException(
                    "Profile `{$this->profileName}` in {$this->configFilePath} must contain an sso_session."
                );
            }

$ssoSessionName = $profile['sso_session'];
            $this->ssoSessionName = $ssoSessionName;
            $profileSsoSession = 'sso-session ' . $ssoSessionName;
            if (empty($profiles[$profileSsoSession])) {
                throw new TokenException(
                    "Sso session `{$ssoSessionName}` does not exist in {$this->configFilePath}"
                );
            }

$sessionProfileData = $profiles[$profileSsoSession];
            foreach (['sso_start_url', 'sso_region'] as $requiredProp) {
                if (empty($sessionProfileData[$requiredProp])) {
                    throw new TokenException(
                        "Sso session `{$ssoSessionName}` in {$this->configFilePath} is missing the required property `{$requiredProp}`"
                    );
                }
            }

$tokenData = $this->refresh();
            $tokenLocation = self::getTokenLocation($ssoSessionName);
            $this->validateTokenData($tokenLocation, $tokenData);
            $ssoToken = SsoToken::fromTokenData($tokenData);
            // To make sure the token is not expired
            if ($ssoToken->isExpired()) {
                throw new TokenException("Cached SSO token returned an expired token.");
            }

yield $ssoToken;
        });
    }

/**
     * This method attempt to refresh when possible.
     * If a refresh is not possible then it just returns
     * the current token data as it is.
     *
     * @return array
     * @throws TokenException
     */
    public function refresh(): array
    {
        $tokenLocation = self::getTokenLocation($this->ssoSessionName);
        $tokenData = $this->getTokenData($tokenLocation);
        if (!$this->shouldAttemptRefresh()) {
            return $tokenData;
        }

if (null === $this->ssoOidcClient) {
            throw new TokenException(
                "Cannot refresh this token without an 'ssooidcClient' "
            );
        }

foreach (['clientId', 'clientSecret', 'refreshToken'] as $requiredProp) {
            if (empty($tokenData[$requiredProp])) {
                throw new TokenException(
                    "Cannot refresh this token without `{$requiredProp}` being set"
                );
            }
        }

$response = $this->ssoOidcClient->createToken([
            'clientId' => $tokenData['clientId'],
            'clientSecret' => $tokenData['clientSecret'],
            'grantType' => 'refresh_token', // REQUIRED
            'refreshToken' => $tokenData['refreshToken'],
        ]);
        if ($response['@metadata']['statusCode'] !== 200) {
            throw new TokenException('Unable to create a new sso token');
        }

$tokenData['accessToken'] = $response['accessToken'];
        $tokenData['expiresAt'] = time () + $response['expiresIn'];
        $tokenData['refreshToken'] = $response['refreshToken'];

return $this->writeNewTokenDataToDisk($tokenData, $tokenLocation);
    }

/**
     * This method checks for whether a token refresh should happen.
     * It will return true just if more than 30 seconds has happened
     * since last refresh, and if the expiration is within a 5-minutes
     * window from the current time.
     *
     * @return bool
     */
    public function shouldAttemptRefresh(): bool
    {
        $tokenLocation = self::getTokenLocation($this->ssoSessionName);
        $tokenData = $this->getTokenData($tokenLocation);
        if (empty($tokenData['expiresAt'])) {
            throw new TokenException(
                "Token file at $tokenLocation must contain an expiration date"
            );
        }

$tokenExpiresAt = strtotime($tokenData['expiresAt']);
        $lastRefreshAt = filemtime($tokenLocation);
        $now = \time();

// If last refresh happened after 30 seconds
        // and if the token expiration is in the 5 minutes window
        return ($now - $lastRefreshAt) > self::REFRESH_ATTEMPT_WINDOW_IN_SECS
            && ($tokenExpiresAt - $now) < self::REFRESH_WINDOW_IN_SECS;
    }

/**
     * @param $sso_session
     * @return string
     */
    public static function getTokenLocation($sso_session): string
    {
        return self::getHomeDir()
            . '/.aws/sso/cache/'
            . mb_convert_encoding(sha1($sso_session), "UTF-8")
            . ".json";
    }

/**
     * @param $tokenLocation
     * @return array
     */
    function getTokenData($tokenLocation): array
    {
        if (empty($tokenLocation) || !is_readable($tokenLocation)) {
            throw new TokenException("Unable to read token file at {$tokenLocation}");
        }

return json_decode(file_get_contents($tokenLocation), true);
    }

/**
     * @param $tokenData
     * @param $tokenLocation
     * @return mixed
     */
    private function validateTokenData($tokenLocation, $tokenData)
    {
        foreach (['accessToken', 'expiresAt'] as $requiredProp) {
            if (empty($tokenData[$requiredProp])) {
                throw new TokenException(
                    "Token file at {$tokenLocation} must contain the required property `{$requiredProp}`"
                );
            }
        }

$expiration = strtotime($tokenData['expiresAt']);
        if ($expiration === false) {
            throw new TokenException("Cached SSO token returned an invalid expiration");
        } elseif ($expiration < time()) {
            throw new TokenException("Cached SSO token returned an expired token");
        }

return $tokenData;
    }

/**
     * @param array $tokenData
     * @param string $tokenLocation
     *
     * @return array
     */
    private function writeNewTokenDataToDisk(array $tokenData, $tokenLocation): array
    {
        $tokenData['expiresAt'] = gmdate(
            'Y-m-d\TH:i:s\Z',
            $tokenData['expiresAt']
        );
        file_put_contents($tokenLocation, json_encode(array_filter($tokenData)));

return $tokenData;
    }
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 BearerTokenAuthorization.php	PHP	1 KB	2026-02-11 01:44	EDIT
📄 ParsesIniTrait.php	PHP	1.3 KB	2026-02-11 01:44	EDIT
📄 RefreshableTokenProviderInterface.php	PHP	423 B	2026-02-11 01:44	EDIT
📄 SsoToken.php	PHP	3.6 KB	2026-02-11 01:44	EDIT
📄 SsoTokenProvider.php	PHP	9.3 KB	2026-02-11 01:44	EDIT
📄 Token.php	PHP	2.2 KB	2026-02-11 01:44	EDIT
📄 TokenAuthorization.php	PHP	645 B	2026-02-11 01:44	EDIT
📄 TokenInterface.php	PHP	641 B	2026-02-11 01:44	EDIT
📄 TokenProvider.php	PHP	8.4 KB	2026-02-11 01:44	EDIT