@azure/identity 3.2.0-alpha.20230320.1 → 3.2.0-alpha.20230330.2

package/dist/index.js

@@ -667,7 +667,7 @@ function mapScopesToResource(scopes) {
  * Given a token response, return the expiration timestamp as the number of milliseconds from the Unix epoch.
  * @param body - A parsed response body from the authentication endpoint.
  */
-function parseExpiresOn(body) {
+function parseExpirationTimestamp(body) {
     if (typeof body.expires_on === "number") {
         return body.expires_on * 1000;
     }
@@ -686,6 +686,25 @@ function parseExpiresOn(body) {
     }
     throw new Error(`Failed to parse token expiration from body. expires_in="${body.expires_in}", expires_on="${body.expires_on}"`);
 }
+/**
+ * Given a token response, return the timestamp for refreshing token as the number of milliseconds from the Unix epoch.
+ * @param body - A parsed response body from the authentication endpoint.
+ */
+function parseRefreshTimestamp(body) {
+    if (typeof body.refresh_in === "number") {
+        return Date.now() + body.refresh_in * 1000;
+    }
+    else {
+        const durationInMilliseconds = parseExpirationTimestamp(body) - Date.now();
+        const durationInHours = Math.floor(durationInMilliseconds / 1000 / 60 / 60);
+        if (durationInHours >= 2) {
+            return Date.now() + durationInMilliseconds / 2;
+        }
+        else {
+            return Date.now() + durationInMilliseconds;
+        }
+    }
+}
 
 // Copyright (c) Microsoft Corporation.
 const noCorrelationId = "noCorrelationId";
@@ -743,8 +762,9 @@ class IdentityClient extends coreClient.ServiceClient {
             const token = {
                 accessToken: {
                     token: parsedBody.access_token,
-                    expiresOnTimestamp: parseExpiresOn(parsedBody),
+                    expiresOnTimestamp: parseExpirationTimestamp(parsedBody),
                 },
+                refreshesIn: parseRefreshTimestamp(parsedBody),
                 refreshToken: parsedBody.refresh_token,
             };
             logger$n.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
@@ -1548,7 +1568,8 @@ const appServiceMsi2017 = {
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
-        return (tokenResponse && tokenResponse.accessToken) || null;
+        return ((tokenResponse && Object.assign(Object.assign({}, tokenResponse.accessToken), { refreshesOn: tokenResponse.refreshesIn })) ||
+            null);
     },
 };
 
@@ -1619,7 +1640,8 @@ const cloudShellMsi = {
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
-        return (tokenResponse && tokenResponse.accessToken) || null;
+        return ((tokenResponse && Object.assign(Object.assign({}, tokenResponse.accessToken), { refreshesOn: tokenResponse.refreshesIn })) ||
+            null);
     },
 };
 
@@ -1740,7 +1762,8 @@ const imdsMsi = {
             try {
                 const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$3(scopes, clientId, resourceId)), { allowInsecureConnection: true }));
                 const tokenResponse = await identityClient.sendTokenRequest(request);
-                return (tokenResponse && tokenResponse.accessToken) || null;
+                return ((tokenResponse && Object.assign(Object.assign({}, tokenResponse.accessToken), { refreshesOn: tokenResponse.refreshesIn })) ||
+                    null);
             }
             catch (error) {
                 if (error.statusCode === 404) {
@@ -1861,7 +1884,8 @@ const arcMsi = {
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
-        return (tokenResponse && tokenResponse.accessToken) || null;
+        return ((tokenResponse && Object.assign(Object.assign({}, tokenResponse.accessToken), { refreshesOn: tokenResponse.refreshesIn })) ||
+            null);
     },
 };
 
@@ -2160,7 +2184,8 @@ const fabricMsi = {
             rejectUnauthorized: false,
         });
         const tokenResponse = await identityClient.sendTokenRequest(request);
-        return (tokenResponse && tokenResponse.accessToken) || null;
+        return ((tokenResponse && Object.assign(Object.assign({}, tokenResponse.accessToken), { refreshesOn: tokenResponse.refreshesIn })) ||
+            null);
     },
 };
 
@@ -2227,7 +2252,8 @@ const appServiceMsi2019 = {
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
-        return (tokenResponse && tokenResponse.accessToken) || null;
+        return ((tokenResponse && Object.assign(Object.assign({}, tokenResponse.accessToken), { refreshesOn: tokenResponse.refreshesIn })) ||
+            null);
     },
 };
 
@@ -2249,6 +2275,7 @@ class ManagedIdentityCredential {
     constructor(clientIdOrOptions, options) {
         var _a;
         this.isEndpointUnavailable = null;
+        this.isAppTokenProviderInitialized = false;
         let _options;
         if (typeof clientIdOrOptions === "string") {
             this.clientId = clientIdOrOptions;
@@ -2357,27 +2384,37 @@ class ManagedIdentityCredential {
                         scopes: Array.isArray(scopes) ? scopes : [scopes],
                         claims: options === null || options === void 0 ? void 0 : options.claims,
                     };
-                    this.confidentialApp.SetAppTokenProvider(async (appTokenProviderParameters = appTokenParameters) => {
-                        logger$c.info(`SetAppTokenProvider invoked with parameters- ${JSON.stringify(appTokenProviderParameters)}`);
-                        const resultToken = await this.authenticateManagedIdentity(scopes, Object.assign(Object.assign({}, updatedOptions), appTokenProviderParameters));
-                        if (resultToken) {
-                            logger$c.info(`SetAppTokenProvider has saved the token in cache`);
-                            const expiresInSeconds = (resultToken === null || resultToken === void 0 ? void 0 : resultToken.expiresOnTimestamp)
-                                ? Math.floor((resultToken.expiresOnTimestamp - Date.now()) / 1000)
-                                : 0;
-                            return {
-                                accessToken: resultToken === null || resultToken === void 0 ? void 0 : resultToken.token,
-                                expiresInSeconds,
-                            };
-                        }
-                        else {
-                            logger$c.info(`SetAppTokenProvider token has "no_access_token_returned" as the saved token`);
-                            return {
-                                accessToken: "no_access_token_returned",
-                                expiresInSeconds: 0,
-                            };
-                        }
-                    });
+                    // Added a check to see if SetAppTokenProvider was already defined.
+                    // Don't redefine it if it's already defined, since it should be static method.
+                    if (!this.isAppTokenProviderInitialized) {
+                        this.confidentialApp.SetAppTokenProvider(async (appTokenProviderParameters = appTokenParameters) => {
+                            logger$c.info(`SetAppTokenProvider invoked with parameters- ${JSON.stringify(appTokenProviderParameters)}`);
+                            const resultToken = await this.authenticateManagedIdentity(scopes, Object.assign(Object.assign({}, updatedOptions), appTokenProviderParameters));
+                            if (resultToken) {
+                                logger$c.info(`SetAppTokenProvider has saved the token in cache`);
+                                const expiresInSeconds = (resultToken === null || resultToken === void 0 ? void 0 : resultToken.expiresOnTimestamp)
+                                    ? Math.floor((resultToken.expiresOnTimestamp - Date.now()) / 1000)
+                                    : 0;
+                                const refreshInSeconds = (resultToken === null || resultToken === void 0 ? void 0 : resultToken.refreshesOn)
+                                    ? Math.floor((resultToken.refreshesOn - Date.now()) / 1000)
+                                    : 0;
+                                return {
+                                    accessToken: resultToken === null || resultToken === void 0 ? void 0 : resultToken.token,
+                                    expiresInSeconds,
+                                    refreshInSeconds,
+                                };
+                            }
+                            else {
+                                logger$c.info(`SetAppTokenProvider token has "no_access_token_returned" as the saved token`);
+                                return {
+                                    accessToken: "no_access_token_returned",
+                                    expiresInSeconds: 0,
+                                    refreshInSeconds: 0,
+                                };
+                            }
+                        });
+                        this.isAppTokenProviderInitialized = true;
+                    }
                     const authenticationResult = await this.confidentialApp.acquireTokenByClientCredential(Object.assign({}, appTokenParameters));
                     result = this.handleResult(scopes, authenticationResult || undefined);
                 }
@@ -2547,7 +2584,7 @@ const cliCredentialInternals = {
      * @param resource - The resource to use when getting the token
      * @internal
      */
-    async getAzureCliAccessToken(resource, tenantId) {
+    async getAzureCliAccessToken(resource, tenantId, timeout) {
         let tenantSection = [];
         if (tenantId) {
             tenantSection = ["--tenant", tenantId];
@@ -2562,7 +2599,7 @@ const cliCredentialInternals = {
                     "--resource",
                     resource,
                     ...tenantSection,
-                ], { cwd: cliCredentialInternals.getSafeWorkingDir(), shell: true }, (error, stdout, stderr) => {
+                ], { cwd: cliCredentialInternals.getSafeWorkingDir(), shell: true, timeout }, (error, stdout, stderr) => {
                     resolve({ stdout: stdout, stderr: stderr, error });
                 });
             }
@@ -2591,6 +2628,7 @@ class AzureCliCredential {
     constructor(options) {
         this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         this.additionallyAllowedTenantIds = resolveAddionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.timeout = options === null || options === void 0 ? void 0 : options.processTimeoutInMs;
     }
     /**
      * Authenticates with Azure Active Directory and returns an access token if successful.
@@ -2609,7 +2647,7 @@ class AzureCliCredential {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
             var _a, _b, _c, _d;
             try {
-                const obj = await cliCredentialInternals.getAzureCliAccessToken(resource, tenantId);
+                const obj = await cliCredentialInternals.getAzureCliAccessToken(resource, tenantId, this.timeout);
                 const specificScope = (_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("(.*)az login --scope(.*)");
                 const isLoginError = ((_b = obj.stderr) === null || _b === void 0 ? void 0 : _b.match("(.*)az login(.*)")) && !specificScope;
                 const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("az:(.*)not found")) || ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'az' is not recognized"));
@@ -2702,11 +2740,14 @@ function formatCommand(commandName) {
  * If anything fails, an error is thrown.
  * @internal
  */
-async function runCommands(commands) {
+async function runCommands(commands, timeout) {
     const results = [];
     for (const command of commands) {
         const [file, ...parameters] = command;
-        const result = (await processUtils.execFile(file, parameters, { encoding: "utf8" }));
+        const result = (await processUtils.execFile(file, parameters, {
+            encoding: "utf8",
+            timeout,
+        }));
         results.push(result);
     }
     return results;
@@ -2761,16 +2802,17 @@ class AzurePowerShellCredential {
     constructor(options) {
         this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         this.additionallyAllowedTenantIds = resolveAddionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.timeout = options === null || options === void 0 ? void 0 : options.processTimeoutInMs;
     }
     /**
      * Gets the access token from Azure PowerShell
      * @param resource - The resource to use when getting the token
      */
-    async getAzurePowerShellAccessToken(resource, tenantId) {
+    async getAzurePowerShellAccessToken(resource, tenantId, timeout) {
         // Clone the stack to avoid mutating it while iterating
         for (const powerShellCommand of [...commandStack]) {
             try {
-                await runCommands([[powerShellCommand, "/?"]]);
+                await runCommands([[powerShellCommand, "/?"]], timeout);
             }
             catch (e) {
                 // Remove this credential from the original stack so that we don't try it again.
@@ -2818,7 +2860,7 @@ class AzurePowerShellCredential {
             logger$a.getToken.info(`Using the scope ${scope}`);
             const resource = getScopeResource(scope);
             try {
-                const response = await this.getAzurePowerShellAccessToken(resource, tenantId);
+                const response = await this.getAzurePowerShellAccessToken(resource, tenantId, this.timeout);
                 logger$a.getToken.info(formatSuccess(scopes));
                 return {
                     token: response.Token,
@@ -3376,7 +3418,7 @@ const developerCliCredentialInternals = {
      * @param scopes - The scopes to use when getting the token
      * @internal
      */
-    async getAzdAccessToken(scopes, tenantId) {
+    async getAzdAccessToken(scopes, tenantId, timeout) {
         let tenantSection = [];
         if (tenantId) {
             tenantSection = ["--tenant-id", tenantId];
@@ -3390,7 +3432,11 @@ const developerCliCredentialInternals = {
                     "json",
                     ...scopes.reduce((previous, current) => previous.concat("--scope", current), []),
                     ...tenantSection,
-                ], { cwd: developerCliCredentialInternals.getSafeWorkingDir(), shell: true }, (error, stdout, stderr) => {
+                ], {
+                    cwd: developerCliCredentialInternals.getSafeWorkingDir(),
+                    shell: true,
+                    timeout,
+                }, (error, stdout, stderr) => {
                     resolve({ stdout, stderr, error });
                 });
             }
@@ -3419,6 +3465,7 @@ class AzureDeveloperCliCredential {
     constructor(options) {
         this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         this.additionallyAllowedTenantIds = resolveAddionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
+        this.timeout = options === null || options === void 0 ? void 0 : options.processTimeoutInMs;
     }
     /**
      * Authenticates with Azure Active Directory and returns an access token if successful.
@@ -3441,7 +3488,7 @@ class AzureDeveloperCliCredential {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
             var _a, _b, _c;
             try {
-                const obj = await developerCliCredentialInternals.getAzdAccessToken(scopeList, tenantId);
+                const obj = await developerCliCredentialInternals.getAzdAccessToken(scopeList, tenantId, this.timeout);
                 const isNotLoggedInError = (_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("not logged in, run `azd login` to login");
                 const isNotInstallError = ((_b = obj.stderr) === null || _b === void 0 ? void 0 : _b.match("azd:(.*)not found")) ||
                     ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.startsWith("'azd' is not recognized"));
@@ -3516,13 +3563,28 @@ class DefaultManagedIdentityCredential extends ManagedIdentityCredential {
         }
     }
 }
+class DefaultAzureDeveloperCliCredential extends AzureDeveloperCliCredential {
+    constructor(options) {
+        super(Object.assign({ processTimeoutInMs: options === null || options === void 0 ? void 0 : options.developerCredentialTimeOutInMs }, options));
+    }
+}
+class DefaultAzureCliCredential extends AzureCliCredential {
+    constructor(options) {
+        super(Object.assign({ processTimeoutInMs: options === null || options === void 0 ? void 0 : options.developerCredentialTimeOutInMs }, options));
+    }
+}
+class DefaultAzurePowershellCredential extends AzurePowerShellCredential {
+    constructor(options) {
+        super(Object.assign({ processTimeoutInMs: options === null || options === void 0 ? void 0 : options.developerCredentialTimeOutInMs }, options));
+    }
+}
 const defaultCredentials = [
     EnvironmentCredential,
     WorkloadIdentityCredential,
     DefaultManagedIdentityCredential,
-    AzureDeveloperCliCredential,
-    AzureCliCredential,
-    AzurePowerShellCredential,
+    DefaultAzureDeveloperCliCredential,
+    DefaultAzureCliCredential,
+    DefaultAzurePowershellCredential,
 ];
 /**
  * Provides a default {@link ChainedTokenCredential} configuration that should