sdk-js | Tanker client-side encryption SDK for JavaScript | Cryptography library

Your libraries are defining probably an "intent_filter" on an activity

The short answer is:

You need to obtain a refresh-token. You can then use this token for as long as you want. But in order to get it is necessary to go through at least one oauth flow in the browser. Then capturing the generated refresh-token in the backend. Then store it and use it to initialize the API. So it's kind of "hacky" (IMO).

For example, you can use the mentioned example code, and log/store the obtained refresh token in this line (as per Greg's accepted answer in the forum). Then use that value as a constant to immediately call the setRefreshToken method (as done in that very same line) upon initialization.

The long answer is:

1. ClientId + Client secret are not enough to programmatically generate a refresh token.
2. Going through the oauth flow at least once is mandatory to obtain a refresh token
3. If you want to hide such flow from your clients, you'll need to do what the short answer says.
4. The intended flow of usage according to Dropbox is: each user access his own files. Having several users accessing a single folder is not officially supported.

The longer answer is:

Check out the conversation we had in the dropbox forum

I suggested to replace the "Generate Access Token" button in the console for a "Generate Refresh Token" button instead. At least it made sense to me according to what we discussed. Maybe if it gets some likes... ;).

The CLI you are using is going to be deprecated soon and is therefore not maintained. That's a potential failure reason.

Please use the new SAP Cloud SDK's Odata generator to generate your custom clients. You can install the client by running:

So, after almost two entire days of trial and error plus digging into the source code, I finally found a solution! To make it short: unauthenticated access and MediaConvert will not work!

The entire problem is Cognito which does not allow access to MediaConvert operations on unauthenticated access. Here is the access list.

Since I am using Auth0 for my user authentication I was simply following this guide and basically all my problems were gone! To attach the token I was using

I'm not entirely sure this gets you on the right track, but one thing that has helped me out with package import weirdness, especially when it's between dev and build, is vite's optimizedDeps config directive. Perhaps something within the AWS package(s) is not liking the pre-bundling that vite is doing and you need to exclude it? This might help explain why things run fine while in dev.

What I did was following:

It looks like the resources defined in the iot:Connect statement of the policy were to blame: the only resource needed is the actual client itself. The following policy has resolved the issue for me:

I am confused with your explanation of your existing system (sorry!), but the general approach would be one of the following:

Using Cognito

Your back-end can use Cognito to authenticate the user and then use AssumeRoleWithWebIdentity to return a set of credentials. The user's client can then use those credentials to directly access AWS services based on the the assigned permissions.

For example, they might be permitted to access their own subdirectory in an Amazon S3 bucket, or read from a specific DynamoDB table. This can be done by sending requests directly to AWS rather than going via the back-end.

Using pre-signed URLs

If your goal is purely to grant access to private objects in Amazon S3, then instead of using Cognito, your back-end can generate Amazon S3 pre-signed URLs that provide time-limited access to private objects.

Whenever the back-end is generating a page that contains a reference to a private object (eg via tags), it can do the following:

• The app verifies that the user is entitled to access the private object by checking information in the app's database
• If the user is entitled to access the private object, the back-end generates a pre-signed URL
• The pre-signed URL is returned in the HTML page (or even as a direct link)
• When S3 receives the pre-signed URL, it verifies the signature and, if it is correct, returns the private object

The benefit of this approach is that the app can determine fine-grained access to individual objects rather than simply using buckets and prefixes to define access. This can be very useful in situations where data is shared between users (eg a photo-sharing app where users can share photos with other users) on a per-object basis.

Don't mix

In looking through your code samples, it appears that your Cognito roles are granting access to specific parts of an S3 bucket:

Wasn't able to identify why I couldn't use AwsCredentialsProvider as expected but found a work-around. Instead, I was able to initialize the builder with const config_builder = iot.AwsIotMqttConnectionConfigBuilder.new_with_websockets();. Anyway, didn't figure out why I couldn't utilize AwsCredentialsProvider as expected. Might be something to look into if the dev team has time. 👍