Using MFA and Zowe team configuration profiles with the RSE API Node.js SDK

import { ProfileUtils, ProfileSession } from "@ibm/rse-api-for-zowe-cli";

// Reads ~/.zowe/zowe.config.json (or the nearest project-level config)
// and returns the profile marked as the default RSE profile.
const profile = await ProfileUtils.getDefaultRseProfile();

// Builds an imperative.Session from the loaded profile.
// If the profile has a valid, non-expired JWT, the session uses it.
// If the token is expired or absent, the session falls back to the
// stored username and password credentials.
const session = ProfileSession.getProfileSession(profile);

import { CheckStatus } from "@ibm/rse-api-for-zowe-cli";

const status = await CheckStatus.getRseStatus(session);
console.log(status);

import * as imperative from "@zowe/imperative";
import { ProfileUtils, ProfileSession } from "@ibm/rse-api-for-zowe-cli";

// Retrieve the ProfileInfo object that represents the zowe.config.json
const profileInfo = await ProfileUtils.getProfileInfo();
await profileInfo.readProfilesFromDisk();

// Merge all properties for the named profile, resolving values inherited from
// parent and base profiles that are defined in the team configuration file.
const mergedArgs = profileInfo.mergeArgsForProfile(
  profileInfo
    .getAllProfiles("rse")
    .find((p) => p.profName === "my-rse-profile")!
);

// Convert the merged arguments into a loaded profile and then create a session
const loadedProfile: imperative.IProfileLoaded = {
  name: "my-rse-profile",
  type: "rse",
  profile: mergedArgs.knownArgs.reduce<Record<string, unknown>>(
    (acc, arg) => ({ ...acc, [arg.argName]: arg.argValue }),
    {}
  ),
  failNotFound: false,
  message: ""
};

const session = ProfileSession.getProfileSession(loadedProfile);

import { ProfileUtils } from "@ibm/rse-api-for-zowe-cli";

console.log(ProfileUtils.getConfigLocation());
// e.g. /home/myuser/.zowe/zowe.config.json

import { ZoweVsCodeExtension } from "@zowe/zowe-explorer-api";
import { ProfileUtils } from "@ibm/rse-api-for-zowe-cli";

const zoweExplorerApi = ZoweVsCodeExtension.getZoweExplorerApi("3.0.0");
if (zoweExplorerApi) {
  const profilesCache = zoweExplorerApi
    .getExplorerExtenderApi()
    .getProfilesCache();
  const zeRegister = zoweExplorerApi.getExplorerExtenderApi();

  const profile = await ProfileUtils.getDefaultRseProfile();

  const success = await ZoweVsCodeExtension.ssoLogin({
    serviceProfile: profile, // the RSE profile needing a token
    defaultTokenType: "apimlAuthenticationToken",
    zeProfiles: profilesCache, // ProfilesCache instance from Zowe Explorer
    zeRegister, // IApiExplorerExtender instance
    preferBaseToken: false // set true to reuse a base profile token if available
  });

  if (!success) {
    throw new Error("MFA login was not completed.");
  }
}

import * as imperative from "@zowe/imperative";
import {
  AuthLogin,
  ProfileUtils,
  ProfileSession
} from "@ibm/rse-api-for-zowe-cli";
import * as readline from "node:readline/promises";

async function loginWithMfa(): Promise<imperative.Session> {
  const profile = await ProfileUtils.getDefaultRseProfile();
  const session = ProfileSession.getProfileSession(profile);

  const rl = readline.createInterface({
    input: process.stdin,
    output: process.stdout
  });

  // Prompt for any credentials that are not already defined in the profile.
  if (!session.ISession.user) {
    session.ISession.user = await rl.question("Enter your user ID: ");
  }
  const mfaToken = await rl.question("Enter your MFA token: ");
  rl.close();

  // Use the MFA token as the password for the login request.
  session.ISession.password = mfaToken;

  // Exchange the MFA token for a JWT.
  // The SDK updates session.ISession.tokenValue in place and, because
  // autoStore is set to true in the team configuration file, also stores the JWT in the
  // credential manager.
  await AuthLogin.getToken(
    session,
    profile.name!,
    profile.profile as imperative.IProfile,
    /*autoRefreshToken=*/ false // MFA tokens cannot be auto-refreshed
  );

  return session;
}

const session = await loginWithMfa();

import * as imperative from "@zowe/imperative";
import { ProfileUtils, ProfileSession } from "@ibm/rse-api-for-zowe-cli";

// Inside a Zowe CLI plug-in ICommandHandler.process() implementation:
const isession = ProfileSession.getProfileSession(
  await ProfileUtils.getDefaultRseProfile()
).ISession;

const sessCfgWithCreds =
  await imperative.ConnectionPropsForSessCfg.addPropsOrPrompt<imperative.ISession>(
    isession,
    this.params.arguments,
    {
      parms: this.params,
      doPrompting: true,
      autoStore: this.params?.definition?.name !== "login",
      defaultTokenType: "jwtToken",
      serviceDescription: "RSEAPI"
    }
  );

return new imperative.Session(sessCfgWithCreds);

import { ProfileUtils, ProfileSession, List } from "@ibm/rse-api-for-zowe-cli";

// On subsequent calls, the stored JWT is used automatically.
// No MFA prompt is required until the JWT expires.
const profile = await ProfileUtils.getDefaultRseProfile();
const session = ProfileSession.getProfileSession(profile);

const response = await List.allMembers(session, "MY.PDS");
console.log(response.apiResponse.items.map((i: any) => i.memberName));

import {
  AuthLogout,
  ProfileUtils,
  ProfileSession
} from "@ibm/rse-api-for-zowe-cli";

const profile = await ProfileUtils.getDefaultRseProfile();
const session = ProfileSession.getProfileSession(profile);

await AuthLogout.logout(session);
// The JWT is invalidated on the server and removed from the credential manager.

import * as imperative from "@zowe/imperative";
import { CheckStatus } from "@ibm/rse-api-for-zowe-cli";

const session = new imperative.Session({
  hostname: "myzos.example.com",
  port: 6800,
  user: "MYUSERID",
  password: "mypassword:123456", // combined password:mfaToken
  protocol: "https",
  type: "basic"
});

const status = await CheckStatus.getRseStatus(session);
console.log(status);