Frodo Library - v5.0.0-17
    Preparing search index...

    Type Alias Authenticate

    type Authenticate = {
        applyAccessToken(token: AccessTokenMetaType): Promise<Tokens>;
        getTokens(
            forceLoginAsUser?: boolean,
            autoRefresh?: boolean,
            types?: string[],
            callbackHandler?: CallbackHandler,
            useDeviceFlow?: boolean,
            promptHandler?: BrowserLoginPromptHandler,
            credentialOverride?: "svcacct" | "user" | "amster" | "browser",
        ): Promise<Tokens>;
        getTokensInteractive(options: BrowserLoginOptions): Promise<Tokens>;
        hasCachedBrowserSession(host: string): boolean;
        probeDeploymentType(host: string): Promise<DeploymentTypeProbe>;
    }
    Index
    applyAccessToken getTokens getTokensInteractive hasCachedBrowserSession probeDeploymentType

    • Applies an already-obtained, externally-issued OAuth2 access token to state, ready for immediate use. Unlike getTokens()/ getTokensInteractive(), this never talks to an authorization endpoint itself — the token was already minted (and, by the caller's own contract, already verified) elsewhere; this only wires it onto state using the exact same deployment-type-specific handling a real browser login uses. Intended for hosts that resolve their own caller identity per request (e.g. an MCP server acting as an OAuth2 resource server) rather than performing a login themselves.

      Parameters

      Returns Promise<Tokens>

      object containing the tokens

    • Get tokens and store them in State

      Parameters

      • OptionalforceLoginAsUser: boolean

        true to force login as user even if a service account or Amster account is available (default: false)

      • OptionalautoRefresh: boolean

        true to automatically refresh tokens before they expire (default: true)

      • Optionaltypes: string[]

        Array of supported deployment types. The function will throw an error if an unsupported type is detected (default: ['classic', 'cloud', 'forgeops'])

      • OptionalcallbackHandler: CallbackHandler

        function allowing the library to collect responses from the user through callbacks

      • OptionaluseDeviceFlow: boolean

        only consulted when a loaded connection profile prefers browser login (preferredCredential: 'browser', or the legacy authMode: 'interactive' for a profile predating that field) — falls back to the profile's own preferredDeviceFlow when not explicitly passed; see getTokensInteractive() (default: false)

      • OptionalpromptHandler: BrowserLoginPromptHandler

        required only when a loaded connection profile prefers browser login; every other case ignores it

      • OptionalcredentialOverride: "svcacct" | "user" | "amster" | "browser"

      Returns Promise<Tokens>

      object containing the tokens

    • Get tokens via a real interactive browser login (loopback-redirect or device-authorization grant) instead of a CLI-driven password/service- account/Amster login. Alongside getTokens(), not a replacement for it.

      Parameters

      Returns Promise<Tokens>

      object containing the tokens

    • Whether a browser-login session is cached for the host and would be reused: the cache holds one for the host's full URL (an alias or a unique substring of a saved profile is resolved to it) that is still fresh, with the same 30 seconds of headroom the cache read requires. Reads the local cache file only: no network call, nothing decrypted, nothing written to state. A session that passes can still be refused by the server later; getTokens() then falls back to its own login.

      Intended for callers that decide whether a command still needs input (a prompt, a connection form) before they log in.

      Parameters

      • host: string

        host URL, unique substring or alias of a saved connection profile

      Returns boolean

      true if a fresh browser-login session is cached for the host

    • Anonymous deployment-type probe: identifies the deployment type of a host WITHOUT any credentials or session — two POSTs to /oauth2/authorize with the built-in admin client ids (no cookie, no CSRF token) and elimination:

      • idmAdminClient (cloud built-in) answers 302 → cloud
      • idm-admin-ui (ForgeOps built-in) answers 302 → forgeops
      • both answer 400 (neither client exists) → classic
      • anything else (no answer, a 404 or 403, an HTML page, both redirecting) is inconclusive: conclusive is false and deploymentType is 'classic' only for backward compatibility

      A 302 means "client exists AND its registered redirect URI matches" — the same clients with an unregistered redirect answer 400 redirect_uri_mismatch, and an unknown client answers 400 invalid_client. Verified live (2026-10-12) against a real AIC tenant (302/400) and a real ForgeOps deployment (400/302). Classic is inferred from two 400 answers and has not been verified live.

      Intended for pre-auth flows: prompts and previews that want the deployment type (realm map, cloud-only gating, help text) before any login is possible — e.g. a host that appears on the command line or via an env variable with no saved connection profile.

      Each request times out after 8 seconds. NOTE: reads nothing from state except the connection settings that shape the HTTP calls (allow-insecure, proxies, header overrides); never writes to it. Safe to call at any time.

      Parameters

      • host: string

        the AM base URL to probe, e.g. https://cdk.iam.example.com/am

      Returns Promise<DeploymentTypeProbe>

      the detected deployment type, whether the evidence supports it (conclusive), plus the raw per-client responses (for callers that want to log or branch on the evidence)

    Settings
    Member Visibility

    On This Page
    Methods