feat: gdb support (#685)

Author: karenc-bq

.github/workflows/aurora_performance.yml

@@ -18,25 +18,25 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           fetch-depth: 50
 
       - name: "Set up JDK 8"
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654  # v5
         with:
           distribution: "corretto"
           java-version: 8
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: "22.x"
       - name: Install dependencies
         run: npm install --no-save
 
       - name: Configure AWS Credentials
         id: creds
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b  # v6
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_DEPLOY_ROLE }}
           role-session-name: nodejs_aurora_perf_tests
@@ -59,7 +59,7 @@ jobs:
       - name: "Get Github Action IP"
         if: always()
         id: ip
-        uses: haythem/public-ip@v1.3
+        uses: haythem/public-ip@bdddd92c198b0955f0b494a8ebeac529754262ff  # v1.3
 
       - name: "Remove Github Action IP"
         if: always()
@@ -73,7 +73,7 @@ jobs:
 
       - name: Archive Performance results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ matrix.db }}-performance-results
           path: ./tests/integration/container/reports

.github/workflows/dependabot_auto_merge.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98  # v2
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Approve PR

.github/workflows/main.yml

@@ -15,9 +15,9 @@ jobs:
   run-checks-and-unit-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: "22.x"
       - name: Install dependencies

.github/workflows/release.yml

@@ -11,9 +11,9 @@ jobs:
       contents: read
     steps:
       - name: "Clone Repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
       - name: "Set up Node.js"
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"

.github/workflows/release_draft.yml

@@ -19,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Clone Repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
       - name: "Set up Node.js"
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: "22.x"
       - name: "Install dependencies"
@@ -46,7 +46,7 @@ jobs:
           touch RELEASE_DETAILS.md
           echo "$RELEASE_DETAILS" > RELEASE_DETAILS.md
       - name: "Upload to Draft Release"
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd  # v1
         with:
           draft: true
           name: "AWS Advanced NodeJS Wrapper - v${{ env.RELEASE_VERSION }}"

.github/workflows/remove-old-artifacts.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Remove Old Artifacts
-        uses: c-hive/gha-remove-artifacts@v1
+        uses: c-hive/gha-remove-artifacts@44fc7acaf1b3d0987da0e8d4707a989d80e9554b  # v1
         with:
           age: "1 week"
           skip-tags: true

.github/workflows/run-autoscaling-tests.yml

@@ -21,21 +21,21 @@ jobs:
         dbEngine: [ "mysql", "postgres" ]
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           fetch-depth: 50
       - name: "Set up JDK 8"
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654  # v5
         with:
           distribution: "corretto"
           java-version: 8
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: "22.x"
       - name: Configure AWS credentials
         id: creds
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b  # v6
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_DEPLOY_ROLE }}
           role-session-name: nodejs_autoscaling_tests
@@ -56,7 +56,7 @@ jobs:
       - name: "Get Github Action IP"
         if: always()
         id: ip
-        uses: haythem/public-ip@v1.3
+        uses: haythem/public-ip@bdddd92c198b0955f0b494a8ebeac529754262ff  # v1.3
       - name: "Remove Github Action IP"
         if: always()
         run: |
@@ -68,7 +68,7 @@ jobs:
           2>&1 > /dev/null;
       - name: Archive results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: autoscaling-report
           path: ./tests/integration/container/reports

common/lib/authentication/aws_secrets_manager_plugin.ts

@@ -37,7 +37,7 @@ export class AwsSecretsManagerPlugin extends AbstractConnectionPlugin implements
   private static readonly TELEMETRY_UPDATE_SECRETS = "fetch credentials";
   private static readonly TELEMETRY_FETCH_CREDENTIALS_COUNTER = "secretsManager.fetchCredentials.count";
   private static SUBSCRIBED_METHODS: Set<string> = new Set<string>(["connect", "forceConnect"]);
-  private static SECRETS_ARN_PATTERN: RegExp = new RegExp("^arn:aws:secretsmanager:(?<region>[^:\\n]*):[^:\\n]*:([^:/\\n]*[:/])?(.*)$");
+  private static SECRETS_ARN_PATTERN: RegExp = new RegExp("^arn:aws[^:]*:secretsmanager:(?<region>[^:\\n]*):[^:\\n]*:([^:/\\n]*[:/])?(.*)$");
   private readonly pluginService: PluginService;
   private readonly fetchCredentialsCounter;
   private readonly expirationSec: number;
@@ -129,20 +129,18 @@ export class AwsSecretsManagerPlugin extends AbstractConnectionPlugin implements
       this.pluginService.updateConfigWithProperties(props);
       return await connectFunc();
     } catch (error) {
-      if (error instanceof Error) {
-        if ((error.message.includes("password authentication failed") || error.message.includes("Access denied")) && !secretWasFetched) {
-          // Login unsuccessful with cached credentials
-          // Try to re-fetch credentials and try again
-
-          secretWasFetched = await this.updateSecret(true);
-          if (secretWasFetched) {
-            WrapperProperties.USER.set(props, this.secret?.username ?? "");
-            WrapperProperties.PASSWORD.set(props, this.secret?.password ?? "");
-            return await connectFunc();
-          }
+      if ((error.message.includes("password authentication failed") || error.message.includes("Access denied")) && !secretWasFetched) {
+        // Login unsuccessful with cached credentials
+        // Try to re-fetch credentials and try again
+
+        secretWasFetched = await this.updateSecret(true);
+        if (secretWasFetched) {
+          WrapperProperties.USER.set(props, this.secret?.username ?? "");
+          WrapperProperties.PASSWORD.set(props, this.secret?.password ?? "");
+          return await connectFunc();
         }
-        logger.debug(Messages.get("AwsSecretsManagerConnectionPlugin.unhandledError", error.name, error.message));
       }
+      logger.debug(Messages.get("AwsSecretsManagerConnectionPlugin.unhandledError", `${error.name}: ${error.message}`));
       throw error;
     }
   }

common/lib/authentication/aws_secrets_manager_plugin_factory.ts

@@ -15,20 +15,20 @@
 */
 
 import { ConnectionPluginFactory } from "../plugin_factory";
-import { PluginService } from "../plugin_service";
 import { ConnectionPlugin } from "../connection_plugin";
 import { AwsWrapperError } from "../utils/errors";
 import { Messages } from "../utils/messages";
+import { FullServicesContainer } from "../utils/full_services_container";
 
 export class AwsSecretsManagerPluginFactory extends ConnectionPluginFactory {
   private static awsSecretsManagerPlugin: any;
 
-  async getInstance(pluginService: PluginService, properties: Map<string, any>): Promise<ConnectionPlugin> {
+  async getInstance(servicesContainer: FullServicesContainer, properties: Map<string, any>): Promise<ConnectionPlugin> {
     try {
       if (!AwsSecretsManagerPluginFactory.awsSecretsManagerPlugin) {
         AwsSecretsManagerPluginFactory.awsSecretsManagerPlugin = await import("./aws_secrets_manager_plugin");
       }
-      return new AwsSecretsManagerPluginFactory.awsSecretsManagerPlugin.AwsSecretsManagerPlugin(pluginService, new Map(properties));
+      return new AwsSecretsManagerPluginFactory.awsSecretsManagerPlugin.AwsSecretsManagerPlugin(servicesContainer.pluginService, new Map(properties));
     } catch (error: any) {
       if (error.code === "MODULE_NOT_FOUND") {
         throw new AwsWrapperError(Messages.get("ConnectionPluginChainBuilder.errorImportingPlugin", error.message, "AwsSecretsManagerPlugin"));

common/lib/authentication/iam_authentication_plugin.ts

@@ -26,19 +26,26 @@ import { IamAuthUtils, TokenInfo } from "../utils/iam_auth_utils";
 import { ClientWrapper } from "../client_wrapper";
 import { RegionUtils } from "../utils/region_utils";
 import { CanReleaseResources } from "../can_release_resources";
+import { RdsUrlType } from "../utils/rds_url_type";
+import { RdsUtils } from "../utils/rds_utils";
+import { GDBRegionUtils } from "../utils/gdb_region_utils";
 
 export class IamAuthenticationPlugin extends AbstractConnectionPlugin implements CanReleaseResources {
   private static readonly SUBSCRIBED_METHODS = new Set<string>(["connect", "forceConnect"]);
   protected static readonly tokenCache = new Map<string, TokenInfo>();
   private readonly telemetryFactory;
   private readonly fetchTokenCounter;
-  private pluginService: PluginService;
+  private readonly pluginService: PluginService;
+  private readonly rdsUtils: RdsUtils = new RdsUtils();
+  protected regionUtils: RegionUtils;
+  protected readonly iamAuthUtils: IamAuthUtils;
 
-  constructor(pluginService: PluginService) {
+  constructor(pluginService: PluginService, iamAuthUtils: IamAuthUtils = new IamAuthUtils()) {
     super();
     this.pluginService = pluginService;
     this.telemetryFactory = this.pluginService.getTelemetryFactory();
     this.fetchTokenCounter = this.telemetryFactory.createCounter("iam.fetchTokenCount");
+    this.iamAuthUtils = iamAuthUtils;
   }
 
   getSubscribedMethods(): Set<string> {
@@ -74,14 +81,22 @@ export class IamAuthenticationPlugin extends AbstractConnectionPlugin implements
       throw new AwsWrapperError(`${WrapperProperties.USER.name} is null or empty`);
     }
 
-    const host = IamAuthUtils.getIamHost(props, hostInfo);
-    const region: string = RegionUtils.getRegion(props.get(WrapperProperties.IAM_REGION.name), host);
-    const port = IamAuthUtils.getIamPort(props, hostInfo, this.pluginService.getCurrentClient().defaultPort);
+    const host = this.iamAuthUtils.getIamHost(props, hostInfo);
+    const port = this.iamAuthUtils.getIamPort(props, hostInfo, this.pluginService.getCurrentClient().defaultPort);
+
+    const type: RdsUrlType = this.rdsUtils.identifyRdsType(host.host);
+    this.regionUtils = type == RdsUrlType.RDS_GLOBAL_WRITER_CLUSTER ? new GDBRegionUtils() : new RegionUtils();
+    const region: string | null = await this.regionUtils.getRegion(WrapperProperties.IAM_REGION.name, host, props);
+
+    if (!region) {
+      throw new AwsWrapperError(Messages.get("SamlAuthPlugin.unableToDetermineRegion", WrapperProperties.IAM_REGION.name));
+    }
+
     const tokenExpirationSec = WrapperProperties.IAM_TOKEN_EXPIRATION.get(props);
     if (tokenExpirationSec < 0) {
       throw new AwsWrapperError(Messages.get("AuthenticationToken.tokenExpirationLessThanZero"));
     }
-    const cacheKey: string = IamAuthUtils.getCacheKey(port, user, host, region);
+    const cacheKey: string = this.iamAuthUtils.getCacheKey(port, user, host.host, region);
 
     const tokenInfo = IamAuthenticationPlugin.tokenCache.get(cacheKey);
     const isCachedToken: boolean = tokenInfo !== undefined && !tokenInfo.isExpired();
@@ -91,8 +106,8 @@ export class IamAuthenticationPlugin extends AbstractConnectionPlugin implements
       WrapperProperties.PASSWORD.set(props, tokenInfo.token);
     } else {
       const tokenExpiry: number = Date.now() + tokenExpirationSec * 1000;
-      const token = await IamAuthUtils.generateAuthenticationToken(
-        host,
+      const token = await this.iamAuthUtils.generateAuthenticationToken(
+        host.host,
         port,
         region,
         user,
@@ -118,8 +133,8 @@ export class IamAuthenticationPlugin extends AbstractConnectionPlugin implements
       // Try to generate a new token and try to connect again
 
       const tokenExpiry: number = Date.now() + tokenExpirationSec * 1000;
-      const token = await IamAuthUtils.generateAuthenticationToken(
-        host,
+      const token = await this.iamAuthUtils.generateAuthenticationToken(
+        host.host,
         port,
         region,
         user,