Allowing for a SAS key to be directly specified in a connection string.

Azure · Aug 31, 2020 · bd8deac · bd8deac
1 parent 970ff62
commit bd8deac
Show file tree

Hide file tree

Showing 4 changed files with 111 additions and 5 deletions.
diff --git a/sdk/core/core-amqp/review/core-amqp.api.md b/sdk/core/core-amqp/review/core-amqp.api.md
@@ -684,6 +684,7 @@ export class SharedKeyCredential {
     getToken(audience: string): AccessToken;
     key: string;
     keyName: string;
+    renewable: boolean;
 }
 
 // @public

diff --git a/sdk/core/core-amqp/src/auth/sas.ts b/sdk/core/core-amqp/src/auth/sas.ts
@@ -22,6 +22,11 @@ export class SharedKeyCredential {
    */
   key: string;
 
+  /**
+   * @property {boolean} renewable - Whether the credential is renewable.
+   */
+  renewable: boolean;
+
   /**
    * Initializes a new instance of SharedKeyCredential
    * @constructor
@@ -31,6 +36,7 @@ export class SharedKeyCredential {
   constructor(keyName: string, key: string) {
     this.keyName = keyName;
     this.key = key;
+    this.renewable = true;
   }
 
   /**
@@ -78,7 +84,98 @@ export class SharedKeyCredential {
    * @param {string} connectionString - The EventHub/ServiceBus connection string
    */
   static fromConnectionString(connectionString: string): SharedKeyCredential {
-    const parsed = parseConnectionString<ServiceBusConnectionStringModel>(connectionString);
-    return new SharedKeyCredential(parsed.SharedAccessKeyName, parsed.SharedAccessKey);
+    const parsed = parseConnectionString<
+      ServiceBusConnectionStringModel & { SharedAccessSignature: string }
+    >(connectionString);
+
+    if (parsed.SharedAccessSignature == null) {
+      return new SharedKeyCredential(parsed.SharedAccessKeyName, parsed.SharedAccessKey);
+    } else {
+      return new SharedAccessSignatureCredential(parsed.SharedAccessSignature);
+    }
+  }
+}
+
+/**
+ * A credential that takes a SharedAccessSignature of two forms:
+ * `SharedAccessSignature sr=<resource>&sig=<signature>&se=<expiry>&skn=<keyname>`
+ * or
+ * `sr=<resource>&sig=<signature>&se=<expiry>&skn=<keyname>`
+ *
+ * @internal
+ * @ignore
+ */
+export class SharedAccessSignatureCredential extends SharedKeyCredential {
+  private _accessToken: AccessToken;
+
+  /**
+   * @param sharedAccessSignature A shared access signature of the form `sr=<resource>&sig=<signature>&se=<expiry>&skn=<keyname>`
+   */
+  constructor(sharedAccessSignature: string) {
+    super("", "");
+
+    const {
+      keyName,
+      expiry: expiresOnTimestamp,
+      token
+    } = SharedAccessSignatureCredential.extractSasProperties(sharedAccessSignature);
+
+    this.keyName = keyName;
+    this.key = "<none>";
+    this._accessToken = {
+      token,
+      expiresOnTimestamp
+    };
+
+    this.renewable = false;
+  }
+
+  /**
+   * Retrieve a valid token for authenticaton.
+   *
+   * @param _audience Not used for SAS tokens.
+   */
+  getToken(_audience: string): AccessToken {
+    return this._accessToken;
+  }
+
+  private static extractSasProperties(
+    sharedAccessSignature: string
+  ): {
+    expiry: number;
+    keyName: string;
+    token: string;
+  } {
+    let expiry: number | undefined;
+    let keyName: string | undefined;
+
+    sharedAccessSignature = sharedAccessSignature.replace(/^SharedAccessSignature\s+/, "");
+
+    for (const part of sharedAccessSignature.split("&")) {
+      const [key, value] = part.split("=");
+
+      if (expiry != null && keyName != null) {
+        break;
+      }
+
+      switch (key) {
+        case "se":
+          expiry = Number(decodeURIComponent(value));
+          break;
+        case "skn":
+          keyName = decodeURIComponent(value);
+          break;
+      }
+    }
+
+    if (expiry == null || keyName == null) {
+      throw new Error("Invalid se/skn field.");
+    }
+
+    return {
+      token: `SharedAccessSignature ${sharedAccessSignature}`,
+      expiry,
+      keyName
+    };
   }
 }
diff --git a/sdk/servicebus/service-bus/src/constructorHelpers.ts b/sdk/servicebus/service-bus/src/constructorHelpers.ts
@@ -48,7 +48,12 @@ export function createConnectionContextForConnectionString(
   config.webSocketEndpointPath = "$servicebus/websocket";
   config.webSocketConstructorOptions = options?.webSocketOptions?.webSocketConstructorOptions;
 
-  const credential = new SharedKeyCredential(config.sharedAccessKeyName, config.sharedAccessKey);
+  const credential = SharedKeyCredential.fromConnectionString(connectionString);
+
+  // TODO: silly workaround for purely SAS credentials.
+  config.sharedAccessKey = config.sharedAccessKey ?? credential.key;
+  config.sharedAccessKeyName = config.sharedAccessKeyName ?? credential.keyName;
+
   validate(config);
   return ConnectionContext.create(config, credential, options);
 }

diff --git a/sdk/servicebus/service-bus/src/core/linkEntity.ts b/sdk/servicebus/service-bus/src/core/linkEntity.ts
@@ -437,8 +437,11 @@ export abstract class LinkEntity<LinkT extends Receiver | AwaitableSender | Requ
     if (this._context.tokenCredential instanceof SharedKeyCredential) {
       tokenObject = this._context.tokenCredential.getToken(this.audience);
       tokenType = TokenType.CbsTokenTypeSas;
-      // renew sas token in every 45 minutess
-      this._tokenTimeout = (3600 - 900) * 1000;
+
+      if (this._context.tokenCredential.renewable) {
+        // renew sas token in every 45 minutes
+        this._tokenTimeout = (3600 - 900) * 1000;
+      }
     } else {
       const aadToken = await this._context.tokenCredential.getToken(Constants.aadServiceBusScope);
       if (!aadToken) {