@azure/identity 4.13.0 → 4.13.2

package/dist/commonjs/client/identityClient.js

@@ -1,265 +1,276 @@
-"use strict";
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IdentityClient = void 0;
-exports.getIdentityClientAuthorityHost = getIdentityClientAuthorityHost;
-const core_client_1 = require("@azure/core-client");
-const core_util_1 = require("@azure/core-util");
-const core_rest_pipeline_1 = require("@azure/core-rest-pipeline");
-const errors_js_1 = require("../errors.js");
-const identityTokenEndpoint_js_1 = require("../util/identityTokenEndpoint.js");
-const constants_js_1 = require("../constants.js");
-const tracing_js_1 = require("../util/tracing.js");
-const logging_js_1 = require("../util/logging.js");
-const utils_js_1 = require("../credentials/managedIdentityCredential/utils.js");
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var identityClient_exports = {};
+__export(identityClient_exports, {
+  IdentityClient: () => IdentityClient,
+  getIdentityClientAuthorityHost: () => getIdentityClientAuthorityHost
+});
+module.exports = __toCommonJS(identityClient_exports);
+var import_core_client = require("@azure/core-client");
+var import_core_util = require("@azure/core-util");
+var import_core_rest_pipeline = require("@azure/core-rest-pipeline");
+var import_errors = require("../errors.js");
+var import_identityTokenEndpoint = require("../util/identityTokenEndpoint.js");
+var import_constants = require("../constants.js");
+var import_tracing = require("../util/tracing.js");
+var import_logging = require("../util/logging.js");
+var import_utils = require("../credentials/managedIdentityCredential/utils.js");
 const noCorrelationId = "noCorrelationId";
-/**
- * @internal
- */
 function getIdentityClientAuthorityHost(options) {
-    // The authorityHost can come from options or from the AZURE_AUTHORITY_HOST environment variable.
-    let authorityHost = options?.authorityHost;
-    // The AZURE_AUTHORITY_HOST environment variable can only be provided in Node.js.
-    if (core_util_1.isNode) {
-        authorityHost = authorityHost ?? process.env.AZURE_AUTHORITY_HOST;
-    }
-    // If the authorityHost is not provided, we use the default one from the public cloud: https://login.microsoftonline.com
-    return authorityHost ?? constants_js_1.DefaultAuthorityHost;
+  let authorityHost = options?.authorityHost;
+  if (import_core_util.isNode) {
+    authorityHost = authorityHost ?? process.env.AZURE_AUTHORITY_HOST;
+  }
+  return authorityHost ?? import_constants.DefaultAuthorityHost;
 }
-/**
- * The network module used by the Identity credentials.
- *
- * It allows for credentials to abort any pending request independently of the MSAL flow,
- * by calling to the `abortRequests()` method.
- *
- */
-class IdentityClient extends core_client_1.ServiceClient {
-    authorityHost;
-    allowLoggingAccountIdentifiers;
-    abortControllers;
-    allowInsecureConnection = false;
-    // used for WorkloadIdentity
-    tokenCredentialOptions;
-    constructor(options) {
-        const packageDetails = `azsdk-js-identity/${constants_js_1.SDK_VERSION}`;
-        const userAgentPrefix = options?.userAgentOptions?.userAgentPrefix
-            ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}`
-            : `${packageDetails}`;
-        const baseUri = getIdentityClientAuthorityHost(options);
-        if (!baseUri.startsWith("https:")) {
-            throw new Error("The authorityHost address must use the 'https' protocol.");
-        }
-        super({
-            requestContentType: "application/json; charset=utf-8",
-            retryOptions: {
-                maxRetries: 3,
-            },
-            ...options,
-            userAgentOptions: {
-                userAgentPrefix,
-            },
-            baseUri,
-        });
-        this.authorityHost = baseUri;
-        this.abortControllers = new Map();
-        this.allowLoggingAccountIdentifiers = options?.loggingOptions?.allowLoggingAccountIdentifiers;
-        // used for WorkloadIdentity
-        this.tokenCredentialOptions = { ...options };
-        // used for ManagedIdentity
-        if (options?.allowInsecureConnection) {
-            this.allowInsecureConnection = options.allowInsecureConnection;
-        }
-    }
-    async sendTokenRequest(request) {
-        logging_js_1.logger.info(`IdentityClient: sending token request to [${request.url}]`);
-        const response = await this.sendRequest(request);
-        if (response.bodyAsText && (response.status === 200 || response.status === 201)) {
-            const parsedBody = JSON.parse(response.bodyAsText);
-            if (!parsedBody.access_token) {
-                return null;
-            }
-            this.logIdentifiers(response);
-            const token = {
-                accessToken: {
-                    token: parsedBody.access_token,
-                    expiresOnTimestamp: (0, utils_js_1.parseExpirationTimestamp)(parsedBody),
-                    refreshAfterTimestamp: (0, utils_js_1.parseRefreshTimestamp)(parsedBody),
-                    tokenType: "Bearer",
-                },
-                refreshToken: parsedBody.refresh_token,
-            };
-            logging_js_1.logger.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
-            return token;
-        }
-        else {
-            const error = new errors_js_1.AuthenticationError(response.status, response.bodyAsText);
-            logging_js_1.logger.warning(`IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`);
-            throw error;
-        }
-    }
-    async refreshAccessToken(tenantId, clientId, scopes, refreshToken, clientSecret, options = {}) {
-        if (refreshToken === undefined) {
-            return null;
-        }
-        logging_js_1.logger.info(`IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`);
-        const refreshParams = {
-            grant_type: "refresh_token",
-            client_id: clientId,
-            refresh_token: refreshToken,
-            scope: scopes,
-        };
-        if (clientSecret !== undefined) {
-            refreshParams.client_secret = clientSecret;
-        }
-        const query = new URLSearchParams(refreshParams);
-        return tracing_js_1.tracingClient.withSpan("IdentityClient.refreshAccessToken", options, async (updatedOptions) => {
-            try {
-                const urlSuffix = (0, identityTokenEndpoint_js_1.getIdentityTokenEndpointSuffix)(tenantId);
-                const request = (0, core_rest_pipeline_1.createPipelineRequest)({
-                    url: `${this.authorityHost}/${tenantId}/${urlSuffix}`,
-                    method: "POST",
-                    body: query.toString(),
-                    abortSignal: options.abortSignal,
-                    headers: (0, core_rest_pipeline_1.createHttpHeaders)({
-                        Accept: "application/json",
-                        "Content-Type": "application/x-www-form-urlencoded",
-                    }),
-                    tracingOptions: updatedOptions.tracingOptions,
-                });
-                const response = await this.sendTokenRequest(request);
-                logging_js_1.logger.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
-                return response;
-            }
-            catch (err) {
-                if (err.name === errors_js_1.AuthenticationErrorName &&
-                    err.errorResponse.error === "interaction_required") {
-                    // It's likely that the refresh token has expired, so
-                    // return null so that the credential implementation will
-                    // initiate the authentication flow again.
-                    logging_js_1.logger.info(`IdentityClient: interaction required for client ID: ${clientId}`);
-                    return null;
-                }
-                else {
-                    logging_js_1.logger.warning(`IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`);
-                    throw err;
-                }
-            }
-        });
+class IdentityClient extends import_core_client.ServiceClient {
+  authorityHost;
+  allowLoggingAccountIdentifiers;
+  abortControllers;
+  allowInsecureConnection = false;
+  // used for WorkloadIdentity
+  tokenCredentialOptions;
+  constructor(options) {
+    const packageDetails = `azsdk-js-identity/${import_constants.SDK_VERSION}`;
+    const userAgentPrefix = options?.userAgentOptions?.userAgentPrefix ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}` : `${packageDetails}`;
+    const baseUri = getIdentityClientAuthorityHost(options);
+    if (!baseUri.startsWith("https:")) {
+      throw new Error("The authorityHost address must use the 'https' protocol.");
     }
-    // Here is a custom layer that allows us to abort requests that go through MSAL,
-    // since MSAL doesn't allow us to pass options all the way through.
-    generateAbortSignal(correlationId) {
-        const controller = new AbortController();
-        const controllers = this.abortControllers.get(correlationId) || [];
-        controllers.push(controller);
-        this.abortControllers.set(correlationId, controllers);
-        const existingOnAbort = controller.signal.onabort;
-        controller.signal.onabort = (...params) => {
-            this.abortControllers.set(correlationId, undefined);
-            if (existingOnAbort) {
-                existingOnAbort.apply(controller.signal, params);
-            }
-        };
-        return controller.signal;
+    super({
+      requestContentType: "application/json; charset=utf-8",
+      retryOptions: {
+        maxRetries: 3
+      },
+      ...options,
+      userAgentOptions: {
+        userAgentPrefix
+      },
+      baseUri
+    });
+    this.authorityHost = baseUri;
+    this.abortControllers = /* @__PURE__ */ new Map();
+    this.allowLoggingAccountIdentifiers = options?.loggingOptions?.allowLoggingAccountIdentifiers;
+    this.tokenCredentialOptions = { ...options };
+    if (options?.allowInsecureConnection) {
+      this.allowInsecureConnection = options.allowInsecureConnection;
     }
-    abortRequests(correlationId) {
-        const key = correlationId || noCorrelationId;
-        const controllers = [
-            ...(this.abortControllers.get(key) || []),
-            // MSAL passes no correlation ID to the get requests...
-            ...(this.abortControllers.get(noCorrelationId) || []),
-        ];
-        if (!controllers.length) {
-            return;
-        }
-        for (const controller of controllers) {
-            controller.abort();
-        }
-        this.abortControllers.set(key, undefined);
+  }
+  async sendTokenRequest(request) {
+    import_logging.logger.info(`IdentityClient: sending token request to [${request.url}]`);
+    const response = await this.sendRequest(request);
+    if (response.bodyAsText && (response.status === 200 || response.status === 201)) {
+      const parsedBody = JSON.parse(response.bodyAsText);
+      if (!parsedBody.access_token) {
+        return null;
+      }
+      this.logIdentifiers(response);
+      const token = {
+        accessToken: {
+          token: parsedBody.access_token,
+          expiresOnTimestamp: (0, import_utils.parseExpirationTimestamp)(parsedBody),
+          refreshAfterTimestamp: (0, import_utils.parseRefreshTimestamp)(parsedBody),
+          tokenType: "Bearer"
+        },
+        refreshToken: parsedBody.refresh_token
+      };
+      import_logging.logger.info(
+        `IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`
+      );
+      return token;
+    } else {
+      const error = new import_errors.AuthenticationError(response.status, response.bodyAsText);
+      import_logging.logger.warning(
+        `IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`
+      );
+      throw error;
     }
-    getCorrelationId(options) {
-        const parameter = options?.body
-            ?.split("&")
-            .map((part) => part.split("="))
-            .find(([key]) => key === "client-request-id");
-        return parameter && parameter.length ? parameter[1] || noCorrelationId : noCorrelationId;
+  }
+  async refreshAccessToken(tenantId, clientId, scopes, refreshToken, clientSecret, options = {}) {
+    if (refreshToken === void 0) {
+      return null;
     }
-    // The MSAL network module methods follow
-    async sendGetRequestAsync(url, options) {
-        const request = (0, core_rest_pipeline_1.createPipelineRequest)({
-            url,
-            method: "GET",
-            body: options?.body,
-            allowInsecureConnection: this.allowInsecureConnection,
-            headers: (0, core_rest_pipeline_1.createHttpHeaders)(options?.headers),
-            abortSignal: this.generateAbortSignal(noCorrelationId),
-        });
-        const response = await this.sendRequest(request);
-        this.logIdentifiers(response);
-        return {
-            body: response.bodyAsText ? JSON.parse(response.bodyAsText) : undefined,
-            headers: response.headers.toJSON(),
-            status: response.status,
-        };
+    import_logging.logger.info(
+      `IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`
+    );
+    const refreshParams = {
+      grant_type: "refresh_token",
+      client_id: clientId,
+      refresh_token: refreshToken,
+      scope: scopes
+    };
+    if (clientSecret !== void 0) {
+      refreshParams.client_secret = clientSecret;
     }
-    async sendPostRequestAsync(url, options) {
-        const request = (0, core_rest_pipeline_1.createPipelineRequest)({
-            url,
+    const query = new URLSearchParams(refreshParams);
+    return import_tracing.tracingClient.withSpan(
+      "IdentityClient.refreshAccessToken",
+      options,
+      async (updatedOptions) => {
+        try {
+          const urlSuffix = (0, import_identityTokenEndpoint.getIdentityTokenEndpointSuffix)(tenantId);
+          const request = (0, import_core_rest_pipeline.createPipelineRequest)({
+            url: `${this.authorityHost}/${tenantId}/${urlSuffix}`,
             method: "POST",
-            body: options?.body,
-            headers: (0, core_rest_pipeline_1.createHttpHeaders)(options?.headers),
-            allowInsecureConnection: this.allowInsecureConnection,
-            // MSAL doesn't send the correlation ID on the get requests.
-            abortSignal: this.generateAbortSignal(this.getCorrelationId(options)),
-        });
-        const response = await this.sendRequest(request);
-        this.logIdentifiers(response);
-        return {
-            body: response.bodyAsText ? JSON.parse(response.bodyAsText) : undefined,
-            headers: response.headers.toJSON(),
-            status: response.status,
-        };
+            body: query.toString(),
+            abortSignal: options.abortSignal,
+            headers: (0, import_core_rest_pipeline.createHttpHeaders)({
+              Accept: "application/json",
+              "Content-Type": "application/x-www-form-urlencoded"
+            }),
+            tracingOptions: updatedOptions.tracingOptions
+          });
+          const response = await this.sendTokenRequest(request);
+          import_logging.logger.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
+          return response;
+        } catch (err) {
+          if (err.name === import_errors.AuthenticationErrorName && err.errorResponse.error === "interaction_required") {
+            import_logging.logger.info(`IdentityClient: interaction required for client ID: ${clientId}`);
+            return null;
+          } else {
+            import_logging.logger.warning(
+              `IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`
+            );
+            throw err;
+          }
+        }
+      }
+    );
+  }
+  // Here is a custom layer that allows us to abort requests that go through MSAL,
+  // since MSAL doesn't allow us to pass options all the way through.
+  generateAbortSignal(correlationId) {
+    const controller = new AbortController();
+    const controllers = this.abortControllers.get(correlationId) || [];
+    controllers.push(controller);
+    this.abortControllers.set(correlationId, controllers);
+    const existingOnAbort = controller.signal.onabort;
+    controller.signal.onabort = (...params) => {
+      this.abortControllers.set(correlationId, void 0);
+      if (existingOnAbort) {
+        existingOnAbort.apply(controller.signal, params);
+      }
+    };
+    return controller.signal;
+  }
+  abortRequests(correlationId) {
+    const key = correlationId || noCorrelationId;
+    const controllers = [
+      ...this.abortControllers.get(key) || [],
+      // MSAL passes no correlation ID to the get requests...
+      ...this.abortControllers.get(noCorrelationId) || []
+    ];
+    if (!controllers.length) {
+      return;
     }
-    /**
-     *
-     * @internal
-     */
-    getTokenCredentialOptions() {
-        return this.tokenCredentialOptions;
+    for (const controller of controllers) {
+      controller.abort();
     }
-    /**
-     * If allowLoggingAccountIdentifiers was set on the constructor options
-     * we try to log the account identifiers by parsing the received access token.
-     *
-     * The account identifiers we try to log are:
-     * - `appid`: The application or Client Identifier.
-     * - `upn`: User Principal Name.
-     *   - It might not be available in some authentication scenarios.
-     *   - If it's not available, we put a placeholder: "No User Principal Name available".
-     * - `tid`: Tenant Identifier.
-     * - `oid`: Object Identifier of the authenticated user.
-     */
-    logIdentifiers(response) {
-        if (!this.allowLoggingAccountIdentifiers || !response.bodyAsText) {
-            return;
-        }
-        const unavailableUpn = "No User Principal Name available";
-        try {
-            const parsed = response.parsedBody || JSON.parse(response.bodyAsText);
-            const accessToken = parsed.access_token;
-            if (!accessToken) {
-                // Without an access token allowLoggingAccountIdentifiers isn't useful.
-                return;
-            }
-            const base64Metadata = accessToken.split(".")[1];
-            const { appid, upn, tid, oid } = JSON.parse(Buffer.from(base64Metadata, "base64").toString("utf8"));
-            logging_js_1.logger.info(`[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`);
-        }
-        catch (e) {
-            logging_js_1.logger.warning("allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:", e.message);
-        }
+    this.abortControllers.set(key, void 0);
+  }
+  getCorrelationId(options) {
+    const parameter = options?.body?.split("&").map((part) => part.split("=")).find(([key]) => key === "client-request-id");
+    return parameter && parameter.length ? parameter[1] || noCorrelationId : noCorrelationId;
+  }
+  // The MSAL network module methods follow
+  async sendGetRequestAsync(url, options) {
+    const request = (0, import_core_rest_pipeline.createPipelineRequest)({
+      url,
+      method: "GET",
+      body: options?.body,
+      allowInsecureConnection: this.allowInsecureConnection,
+      headers: (0, import_core_rest_pipeline.createHttpHeaders)(options?.headers),
+      abortSignal: this.generateAbortSignal(noCorrelationId)
+    });
+    const response = await this.sendRequest(request);
+    this.logIdentifiers(response);
+    return {
+      body: response.bodyAsText ? JSON.parse(response.bodyAsText) : void 0,
+      headers: response.headers.toJSON(),
+      status: response.status
+    };
+  }
+  async sendPostRequestAsync(url, options) {
+    const request = (0, import_core_rest_pipeline.createPipelineRequest)({
+      url,
+      method: "POST",
+      body: options?.body,
+      headers: (0, import_core_rest_pipeline.createHttpHeaders)(options?.headers),
+      allowInsecureConnection: this.allowInsecureConnection,
+      // MSAL doesn't send the correlation ID on the get requests.
+      abortSignal: this.generateAbortSignal(this.getCorrelationId(options))
+    });
+    const response = await this.sendRequest(request);
+    this.logIdentifiers(response);
+    return {
+      body: response.bodyAsText ? JSON.parse(response.bodyAsText) : void 0,
+      headers: response.headers.toJSON(),
+      status: response.status
+    };
+  }
+  /**
+   *
+   * @internal
+   */
+  getTokenCredentialOptions() {
+    return this.tokenCredentialOptions;
+  }
+  /**
+   * If allowLoggingAccountIdentifiers was set on the constructor options
+   * we try to log the account identifiers by parsing the received access token.
+   *
+   * The account identifiers we try to log are:
+   * - `appid`: The application or Client Identifier.
+   * - `upn`: User Principal Name.
+   *   - It might not be available in some authentication scenarios.
+   *   - If it's not available, we put a placeholder: "No User Principal Name available".
+   * - `tid`: Tenant Identifier.
+   * - `oid`: Object Identifier of the authenticated user.
+   */
+  logIdentifiers(response) {
+    if (!this.allowLoggingAccountIdentifiers || !response.bodyAsText) {
+      return;
+    }
+    const unavailableUpn = "No User Principal Name available";
+    try {
+      const parsed = response.parsedBody || JSON.parse(response.bodyAsText);
+      const accessToken = parsed.access_token;
+      if (!accessToken) {
+        return;
+      }
+      const base64Metadata = accessToken.split(".")[1];
+      const { appid, upn, tid, oid } = JSON.parse(
+        Buffer.from(base64Metadata, "base64").toString("utf8")
+      );
+      import_logging.logger.info(
+        `[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`
+      );
+    } catch (e) {
+      import_logging.logger.warning(
+        "allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:",
+        e.message
+      );
     }
+  }
 }
-exports.IdentityClient = IdentityClient;
-//# sourceMappingURL=identityClient.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IdentityClient,
+  getIdentityClientAuthorityHost
+});
+//# sourceMappingURL=identityClient.js.map

package/dist/commonjs/client/identityClient.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"identityClient.js","sourceRoot":"","sources":["../../../src/client/identityClient.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAyClC,wEAWC;AAhDD,oDAAmD;AACnD,gDAA0C;AAE1C,kEAAqF;AAErF,4CAA4E;AAC5E,+EAAkF;AAClF,kDAAoE;AACpE,mDAAmD;AACnD,mDAA4C;AAG5C,gFAG2D;AAE3D,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAiB1C;;GAEG;AACH,SAAgB,8BAA8B,CAAC,OAAgC;IAC7E,iGAAiG;IACjG,IAAI,aAAa,GAAG,OAAO,EAAE,aAAa,CAAC;IAE3C,iFAAiF;IACjF,IAAI,kBAAM,EAAE,CAAC;QACX,aAAa,GAAG,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpE,CAAC;IAED,wHAAwH;IACxH,OAAO,aAAa,IAAI,mCAAoB,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAa,cAAe,SAAQ,2BAAa;IACxC,aAAa,CAAS;IACrB,8BAA8B,CAAW;IACzC,gBAAgB,CAA6C;IAC7D,uBAAuB,GAAY,KAAK,CAAC;IACjD,4BAA4B;IACpB,sBAAsB,CAAyB;IAEvD,YAAY,OAAgC;QAC1C,MAAM,cAAc,GAAG,qBAAqB,0BAAW,EAAE,CAAC;QAC1D,MAAM,eAAe,GAAG,OAAO,EAAE,gBAAgB,EAAE,eAAe;YAChE,CAAC,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,eAAe,IAAI,cAAc,EAAE;YACjE,CAAC,CAAC,GAAG,cAAc,EAAE,CAAC;QAExB,MAAM,OAAO,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QAED,KAAK,CAAC;YACJ,kBAAkB,EAAE,iCAAiC;YACrD,YAAY,EAAE;gBACZ,UAAU,EAAE,CAAC;aACd;YACD,GAAG,OAAO;YACV,gBAAgB,EAAE;gBAChB,eAAe;aAChB;YACD,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,8BAA8B,GAAG,OAAO,EAAE,cAAc,EAAE,8BAA8B,CAAC;QAC9F,4BAA4B;QAC5B,IAAI,CAAC,sBAAsB,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAE7C,2BAA2B;QAC3B,IAAI,OAAO,EAAE,uBAAuB,EAAE,CAAC;YACrC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;QACjE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAwB;QAC7C,mBAAM,CAAC,IAAI,CAAC,6CAA6C,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAChF,MAAM,UAAU,GAA4B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAE5E,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAE9B,MAAM,KAAK,GAAG;gBACZ,WAAW,EAAE;oBACX,KAAK,EAAE,UAAU,CAAC,YAAY;oBAC9B,kBAAkB,EAAE,IAAA,mCAAwB,EAAC,UAAU,CAAC;oBACxD,qBAAqB,EAAE,IAAA,gCAAqB,EAAC,UAAU,CAAC;oBACxD,SAAS,EAAE,QAAQ;iBACL;gBAChB,YAAY,EAAE,UAAU,CAAC,aAAa;aACvC,CAAC;YAEF,mBAAM,CAAC,IAAI,CACT,oBAAoB,OAAO,CAAC,GAAG,gCAAgC,KAAK,CAAC,WAAW,CAAC,kBAAkB,EAAE,CACtG,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,+BAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC5E,mBAAM,CAAC,OAAO,CACZ,sDAAsD,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,gBAAgB,EAAE,CACjH,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,QAAgB,EAChB,QAAgB,EAChB,MAAc,EACd,YAAgC,EAChC,YAAgC,EAChC,UAA2B,EAAE;QAE7B,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mBAAM,CAAC,IAAI,CACT,2DAA2D,QAAQ,aAAa,MAAM,UAAU,CACjG,CAAC;QAEF,MAAM,aAAa,GAAG;YACpB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,MAAM;SACd,CAAC;QAEF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC9B,aAAqB,CAAC,aAAa,GAAG,YAAY,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC;QAEjD,OAAO,0BAAa,CAAC,QAAQ,CAC3B,mCAAmC,EACnC,OAAO,EACP,KAAK,EAAE,cAAc,EAAE,EAAE;YACvB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAA,yDAA8B,EAAC,QAAQ,CAAC,CAAC;gBAC3D,MAAM,OAAO,GAAG,IAAA,0CAAqB,EAAC;oBACpC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,IAAI,SAAS,EAAE;oBACrD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE;oBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,OAAO,EAAE,IAAA,sCAAiB,EAAC;wBACzB,MAAM,EAAE,kBAAkB;wBAC1B,cAAc,EAAE,mCAAmC;qBACpD,CAAC;oBACF,cAAc,EAAE,cAAc,CAAC,cAAc;iBAC9C,CAAC,CAAC;gBAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACtD,mBAAM,CAAC,IAAI,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAC;gBAC1E,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IACE,GAAG,CAAC,IAAI,KAAK,mCAAuB;oBACpC,GAAG,CAAC,aAAa,CAAC,KAAK,KAAK,sBAAsB,EAClD,CAAC;oBACD,qDAAqD;oBACrD,yDAAyD;oBACzD,0CAA0C;oBAC1C,mBAAM,CAAC,IAAI,CAAC,uDAAuD,QAAQ,EAAE,CAAC,CAAC;oBAC/E,OAAO,IAAI,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACN,mBAAM,CAAC,OAAO,CACZ,0DAA0D,QAAQ,KAAK,GAAG,EAAE,CAC7E,CAAC;oBACF,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,mEAAmE;IAEnE,mBAAmB,CAAC,aAAqB;QACvC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACnE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QAClD,UAAU,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,EAAE,EAAE;YACxC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YACpD,IAAI,eAAe,EAAE,CAAC;gBACpB,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC;QACF,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,aAAa,CAAC,aAAsB;QAClC,MAAM,GAAG,GAAG,aAAa,IAAI,eAAe,CAAC;QAC7C,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzC,uDAAuD;YACvD,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;SACtD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,gBAAgB,CAAC,OAA+B;QAC9C,MAAM,SAAS,GAAG,OAAO,EAAE,IAAI;YAC7B,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;QAChD,OAAO,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC;IAC3F,CAAC;IAED,yCAAyC;IAEzC,KAAK,CAAC,mBAAmB,CACvB,GAAW,EACX,OAA+B;QAE/B,MAAM,OAAO,GAAG,IAAA,0CAAqB,EAAC;YACpC,GAAG;YACH,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO,EAAE,IAAI;YACnB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,OAAO,EAAE,IAAA,sCAAiB,EAAC,OAAO,EAAE,OAAO,CAAC;YAC5C,WAAW,EAAE,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;SACvD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE9B,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACvE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;YAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,GAAW,EACX,OAA+B;QAE/B,MAAM,OAAO,GAAG,IAAA,0CAAqB,EAAC;YACpC,GAAG;YACH,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO,EAAE,IAAI;YACnB,OAAO,EAAE,IAAA,sCAAiB,EAAC,OAAO,EAAE,OAAO,CAAC;YAC5C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,4DAA4D;YAC5D,WAAW,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;SACtE,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE9B,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACvE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;YAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,yBAAyB;QACvB,OAAO,IAAI,CAAC,sBAAsB,CAAC;IACrC,CAAC;IACD;;;;;;;;;;;OAWG;IACK,cAAc,CAAC,QAA0B;QAC/C,IAAI,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,kCAAkC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,GAAI,QAAgB,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;YACxC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,uEAAuE;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CACzC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACvD,CAAC;YAEF,mBAAM,CAAC,IAAI,CACT,sCAAsC,KAAK,gBAAgB,GAAG,0BAC5D,GAAG,IAAI,cACT,uBAAuB,GAAG,EAAE,CAC7B,CAAC;QACJ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,mBAAM,CAAC,OAAO,CACZ,6FAA6F,EAC7F,CAAC,CAAC,OAAO,CACV,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAjSD,wCAiSC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { INetworkModule, NetworkRequestOptions, NetworkResponse } from \"@azure/msal-node\";\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport { ServiceClient } from \"@azure/core-client\";\nimport { isNode } from \"@azure/core-util\";\nimport type { PipelineRequest, PipelineResponse } from \"@azure/core-rest-pipeline\";\nimport { createHttpHeaders, createPipelineRequest } from \"@azure/core-rest-pipeline\";\nimport type { AbortSignalLike } from \"@azure/abort-controller\";\nimport { AuthenticationError, AuthenticationErrorName } from \"../errors.js\";\nimport { getIdentityTokenEndpointSuffix } from \"../util/identityTokenEndpoint.js\";\nimport { DefaultAuthorityHost, SDK_VERSION } from \"../constants.js\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { logger } from \"../util/logging.js\";\nimport type { TokenCredentialOptions } from \"../tokenCredentialOptions.js\";\nimport type { TokenResponseParsedBody } from \"../credentials/managedIdentityCredential/utils.js\";\nimport {\n  parseExpirationTimestamp,\n  parseRefreshTimestamp,\n} from \"../credentials/managedIdentityCredential/utils.js\";\n\nconst noCorrelationId = \"noCorrelationId\";\n\n/**\n * An internal type used to communicate details of a token request's\n * response that should not be sent back as part of the access token.\n */\nexport interface TokenResponse {\n  /**\n   * The AccessToken to be returned from getToken.\n   */\n  accessToken: AccessToken;\n  /**\n   * The refresh token if the 'offline_access' scope was used.\n   */\n  refreshToken?: string;\n}\n\n/**\n * @internal\n */\nexport function getIdentityClientAuthorityHost(options?: TokenCredentialOptions): string {\n  // The authorityHost can come from options or from the AZURE_AUTHORITY_HOST environment variable.\n  let authorityHost = options?.authorityHost;\n\n  // The AZURE_AUTHORITY_HOST environment variable can only be provided in Node.js.\n  if (isNode) {\n    authorityHost = authorityHost ?? process.env.AZURE_AUTHORITY_HOST;\n  }\n\n  // If the authorityHost is not provided, we use the default one from the public cloud: https://login.microsoftonline.com\n  return authorityHost ?? DefaultAuthorityHost;\n}\n\n/**\n * The network module used by the Identity credentials.\n *\n * It allows for credentials to abort any pending request independently of the MSAL flow,\n * by calling to the `abortRequests()` method.\n *\n */\nexport class IdentityClient extends ServiceClient implements INetworkModule {\n  public authorityHost: string;\n  private allowLoggingAccountIdentifiers?: boolean;\n  private abortControllers: Map<string, AbortController[] | undefined>;\n  private allowInsecureConnection: boolean = false;\n  // used for WorkloadIdentity\n  private tokenCredentialOptions: TokenCredentialOptions;\n\n  constructor(options?: TokenCredentialOptions) {\n    const packageDetails = `azsdk-js-identity/${SDK_VERSION}`;\n    const userAgentPrefix = options?.userAgentOptions?.userAgentPrefix\n      ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}`\n      : `${packageDetails}`;\n\n    const baseUri = getIdentityClientAuthorityHost(options);\n    if (!baseUri.startsWith(\"https:\")) {\n      throw new Error(\"The authorityHost address must use the 'https' protocol.\");\n    }\n\n    super({\n      requestContentType: \"application/json; charset=utf-8\",\n      retryOptions: {\n        maxRetries: 3,\n      },\n      ...options,\n      userAgentOptions: {\n        userAgentPrefix,\n      },\n      baseUri,\n    });\n\n    this.authorityHost = baseUri;\n    this.abortControllers = new Map();\n    this.allowLoggingAccountIdentifiers = options?.loggingOptions?.allowLoggingAccountIdentifiers;\n    // used for WorkloadIdentity\n    this.tokenCredentialOptions = { ...options };\n\n    // used for ManagedIdentity\n    if (options?.allowInsecureConnection) {\n      this.allowInsecureConnection = options.allowInsecureConnection;\n    }\n  }\n\n  async sendTokenRequest(request: PipelineRequest): Promise<TokenResponse | null> {\n    logger.info(`IdentityClient: sending token request to [${request.url}]`);\n    const response = await this.sendRequest(request);\n    if (response.bodyAsText && (response.status === 200 || response.status === 201)) {\n      const parsedBody: TokenResponseParsedBody = JSON.parse(response.bodyAsText);\n\n      if (!parsedBody.access_token) {\n        return null;\n      }\n\n      this.logIdentifiers(response);\n\n      const token = {\n        accessToken: {\n          token: parsedBody.access_token,\n          expiresOnTimestamp: parseExpirationTimestamp(parsedBody),\n          refreshAfterTimestamp: parseRefreshTimestamp(parsedBody),\n          tokenType: \"Bearer\",\n        } as AccessToken,\n        refreshToken: parsedBody.refresh_token,\n      };\n\n      logger.info(\n        `IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`,\n      );\n      return token;\n    } else {\n      const error = new AuthenticationError(response.status, response.bodyAsText);\n      logger.warning(\n        `IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`,\n      );\n      throw error;\n    }\n  }\n\n  async refreshAccessToken(\n    tenantId: string,\n    clientId: string,\n    scopes: string,\n    refreshToken: string | undefined,\n    clientSecret: string | undefined,\n    options: GetTokenOptions = {},\n  ): Promise<TokenResponse | null> {\n    if (refreshToken === undefined) {\n      return null;\n    }\n    logger.info(\n      `IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`,\n    );\n\n    const refreshParams = {\n      grant_type: \"refresh_token\",\n      client_id: clientId,\n      refresh_token: refreshToken,\n      scope: scopes,\n    };\n\n    if (clientSecret !== undefined) {\n      (refreshParams as any).client_secret = clientSecret;\n    }\n\n    const query = new URLSearchParams(refreshParams);\n\n    return tracingClient.withSpan(\n      \"IdentityClient.refreshAccessToken\",\n      options,\n      async (updatedOptions) => {\n        try {\n          const urlSuffix = getIdentityTokenEndpointSuffix(tenantId);\n          const request = createPipelineRequest({\n            url: `${this.authorityHost}/${tenantId}/${urlSuffix}`,\n            method: \"POST\",\n            body: query.toString(),\n            abortSignal: options.abortSignal,\n            headers: createHttpHeaders({\n              Accept: \"application/json\",\n              \"Content-Type\": \"application/x-www-form-urlencoded\",\n            }),\n            tracingOptions: updatedOptions.tracingOptions,\n          });\n\n          const response = await this.sendTokenRequest(request);\n          logger.info(`IdentityClient: refreshed token for client ID: ${clientId}`);\n          return response;\n        } catch (err: any) {\n          if (\n            err.name === AuthenticationErrorName &&\n            err.errorResponse.error === \"interaction_required\"\n          ) {\n            // It's likely that the refresh token has expired, so\n            // return null so that the credential implementation will\n            // initiate the authentication flow again.\n            logger.info(`IdentityClient: interaction required for client ID: ${clientId}`);\n            return null;\n          } else {\n            logger.warning(\n              `IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`,\n            );\n            throw err;\n          }\n        }\n      },\n    );\n  }\n\n  // Here is a custom layer that allows us to abort requests that go through MSAL,\n  // since MSAL doesn't allow us to pass options all the way through.\n\n  generateAbortSignal(correlationId: string): AbortSignalLike {\n    const controller = new AbortController();\n    const controllers = this.abortControllers.get(correlationId) || [];\n    controllers.push(controller);\n    this.abortControllers.set(correlationId, controllers);\n    const existingOnAbort = controller.signal.onabort;\n    controller.signal.onabort = (...params) => {\n      this.abortControllers.set(correlationId, undefined);\n      if (existingOnAbort) {\n        existingOnAbort.apply(controller.signal, params);\n      }\n    };\n    return controller.signal;\n  }\n\n  abortRequests(correlationId?: string): void {\n    const key = correlationId || noCorrelationId;\n    const controllers = [\n      ...(this.abortControllers.get(key) || []),\n      // MSAL passes no correlation ID to the get requests...\n      ...(this.abortControllers.get(noCorrelationId) || []),\n    ];\n    if (!controllers.length) {\n      return;\n    }\n    for (const controller of controllers) {\n      controller.abort();\n    }\n    this.abortControllers.set(key, undefined);\n  }\n\n  getCorrelationId(options?: NetworkRequestOptions): string {\n    const parameter = options?.body\n      ?.split(\"&\")\n      .map((part) => part.split(\"=\"))\n      .find(([key]) => key === \"client-request-id\");\n    return parameter && parameter.length ? parameter[1] || noCorrelationId : noCorrelationId;\n  }\n\n  // The MSAL network module methods follow\n\n  async sendGetRequestAsync<T>(\n    url: string,\n    options?: NetworkRequestOptions,\n  ): Promise<NetworkResponse<T>> {\n    const request = createPipelineRequest({\n      url,\n      method: \"GET\",\n      body: options?.body,\n      allowInsecureConnection: this.allowInsecureConnection,\n      headers: createHttpHeaders(options?.headers),\n      abortSignal: this.generateAbortSignal(noCorrelationId),\n    });\n\n    const response = await this.sendRequest(request);\n\n    this.logIdentifiers(response);\n\n    return {\n      body: response.bodyAsText ? JSON.parse(response.bodyAsText) : undefined,\n      headers: response.headers.toJSON(),\n      status: response.status,\n    };\n  }\n\n  async sendPostRequestAsync<T>(\n    url: string,\n    options?: NetworkRequestOptions,\n  ): Promise<NetworkResponse<T>> {\n    const request = createPipelineRequest({\n      url,\n      method: \"POST\",\n      body: options?.body,\n      headers: createHttpHeaders(options?.headers),\n      allowInsecureConnection: this.allowInsecureConnection,\n      // MSAL doesn't send the correlation ID on the get requests.\n      abortSignal: this.generateAbortSignal(this.getCorrelationId(options)),\n    });\n\n    const response = await this.sendRequest(request);\n\n    this.logIdentifiers(response);\n\n    return {\n      body: response.bodyAsText ? JSON.parse(response.bodyAsText) : undefined,\n      headers: response.headers.toJSON(),\n      status: response.status,\n    };\n  }\n\n  /**\n   *\n   * @internal\n   */\n  getTokenCredentialOptions(): TokenCredentialOptions {\n    return this.tokenCredentialOptions;\n  }\n  /**\n   * If allowLoggingAccountIdentifiers was set on the constructor options\n   * we try to log the account identifiers by parsing the received access token.\n   *\n   * The account identifiers we try to log are:\n   * - `appid`: The application or Client Identifier.\n   * - `upn`: User Principal Name.\n   *   - It might not be available in some authentication scenarios.\n   *   - If it's not available, we put a placeholder: \"No User Principal Name available\".\n   * - `tid`: Tenant Identifier.\n   * - `oid`: Object Identifier of the authenticated user.\n   */\n  private logIdentifiers(response: PipelineResponse): void {\n    if (!this.allowLoggingAccountIdentifiers || !response.bodyAsText) {\n      return;\n    }\n    const unavailableUpn = \"No User Principal Name available\";\n    try {\n      const parsed = (response as any).parsedBody || JSON.parse(response.bodyAsText);\n      const accessToken = parsed.access_token;\n      if (!accessToken) {\n        // Without an access token allowLoggingAccountIdentifiers isn't useful.\n        return;\n      }\n      const base64Metadata = accessToken.split(\".\")[1];\n      const { appid, upn, tid, oid } = JSON.parse(\n        Buffer.from(base64Metadata, \"base64\").toString(\"utf8\"),\n      );\n\n      logger.info(\n        `[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${\n          upn || unavailableUpn\n        }. Object ID (user): ${oid}`,\n      );\n    } catch (e: any) {\n      logger.warning(\n        \"allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:\",\n        e.message,\n      );\n    }\n  }\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../../../src/client/identityClient.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { INetworkModule, NetworkRequestOptions, NetworkResponse } from \"@azure/msal-node\";\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport { ServiceClient } from \"@azure/core-client\";\nimport { isNode } from \"@azure/core-util\";\nimport type { PipelineRequest, PipelineResponse } from \"@azure/core-rest-pipeline\";\nimport { createHttpHeaders, createPipelineRequest } from \"@azure/core-rest-pipeline\";\nimport type { AbortSignalLike } from \"@azure/abort-controller\";\nimport { AuthenticationError, AuthenticationErrorName } from \"../errors.js\";\nimport { getIdentityTokenEndpointSuffix } from \"../util/identityTokenEndpoint.js\";\nimport { DefaultAuthorityHost, SDK_VERSION } from \"../constants.js\";\nimport { tracingClient } from \"../util/tracing.js\";\nimport { logger } from \"../util/logging.js\";\nimport type { TokenCredentialOptions } from \"../tokenCredentialOptions.js\";\nimport type { TokenResponseParsedBody } from \"../credentials/managedIdentityCredential/utils.js\";\nimport {\n  parseExpirationTimestamp,\n  parseRefreshTimestamp,\n} from \"../credentials/managedIdentityCredential/utils.js\";\n\nconst noCorrelationId = \"noCorrelationId\";\n\n/**\n * An internal type used to communicate details of a token request's\n * response that should not be sent back as part of the access token.\n */\nexport interface TokenResponse {\n  /**\n   * The AccessToken to be returned from getToken.\n   */\n  accessToken: AccessToken;\n  /**\n   * The refresh token if the 'offline_access' scope was used.\n   */\n  refreshToken?: string;\n}\n\n/**\n * @internal\n */\nexport function getIdentityClientAuthorityHost(options?: TokenCredentialOptions): string {\n  // The authorityHost can come from options or from the AZURE_AUTHORITY_HOST environment variable.\n  let authorityHost = options?.authorityHost;\n\n  // The AZURE_AUTHORITY_HOST environment variable can only be provided in Node.js.\n  if (isNode) {\n    authorityHost = authorityHost ?? process.env.AZURE_AUTHORITY_HOST;\n  }\n\n  // If the authorityHost is not provided, we use the default one from the public cloud: https://login.microsoftonline.com\n  return authorityHost ?? DefaultAuthorityHost;\n}\n\n/**\n * The network module used by the Identity credentials.\n *\n * It allows for credentials to abort any pending request independently of the MSAL flow,\n * by calling to the `abortRequests()` method.\n *\n */\nexport class IdentityClient extends ServiceClient implements INetworkModule {\n  public authorityHost: string;\n  private allowLoggingAccountIdentifiers?: boolean;\n  private abortControllers: Map<string, AbortController[] | undefined>;\n  private allowInsecureConnection: boolean = false;\n  // used for WorkloadIdentity\n  private tokenCredentialOptions: TokenCredentialOptions;\n\n  constructor(options?: TokenCredentialOptions) {\n    const packageDetails = `azsdk-js-identity/${SDK_VERSION}`;\n    const userAgentPrefix = options?.userAgentOptions?.userAgentPrefix\n      ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}`\n      : `${packageDetails}`;\n\n    const baseUri = getIdentityClientAuthorityHost(options);\n    if (!baseUri.startsWith(\"https:\")) {\n      throw new Error(\"The authorityHost address must use the 'https' protocol.\");\n    }\n\n    super({\n      requestContentType: \"application/json; charset=utf-8\",\n      retryOptions: {\n        maxRetries: 3,\n      },\n      ...options,\n      userAgentOptions: {\n        userAgentPrefix,\n      },\n      baseUri,\n    });\n\n    this.authorityHost = baseUri;\n    this.abortControllers = new Map();\n    this.allowLoggingAccountIdentifiers = options?.loggingOptions?.allowLoggingAccountIdentifiers;\n    // used for WorkloadIdentity\n    this.tokenCredentialOptions = { ...options };\n\n    // used for ManagedIdentity\n    if (options?.allowInsecureConnection) {\n      this.allowInsecureConnection = options.allowInsecureConnection;\n    }\n  }\n\n  async sendTokenRequest(request: PipelineRequest): Promise<TokenResponse | null> {\n    logger.info(`IdentityClient: sending token request to [${request.url}]`);\n    const response = await this.sendRequest(request);\n    if (response.bodyAsText && (response.status === 200 || response.status === 201)) {\n      const parsedBody: TokenResponseParsedBody = JSON.parse(response.bodyAsText);\n\n      if (!parsedBody.access_token) {\n        return null;\n      }\n\n      this.logIdentifiers(response);\n\n      const token = {\n        accessToken: {\n          token: parsedBody.access_token,\n          expiresOnTimestamp: parseExpirationTimestamp(parsedBody),\n          refreshAfterTimestamp: parseRefreshTimestamp(parsedBody),\n          tokenType: \"Bearer\",\n        } as AccessToken,\n        refreshToken: parsedBody.refresh_token,\n      };\n\n      logger.info(\n        `IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`,\n      );\n      return token;\n    } else {\n      const error = new AuthenticationError(response.status, response.bodyAsText);\n      logger.warning(\n        `IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`,\n      );\n      throw error;\n    }\n  }\n\n  async refreshAccessToken(\n    tenantId: string,\n    clientId: string,\n    scopes: string,\n    refreshToken: string | undefined,\n    clientSecret: string | undefined,\n    options: GetTokenOptions = {},\n  ): Promise<TokenResponse | null> {\n    if (refreshToken === undefined) {\n      return null;\n    }\n    logger.info(\n      `IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`,\n    );\n\n    const refreshParams = {\n      grant_type: \"refresh_token\",\n      client_id: clientId,\n      refresh_token: refreshToken,\n      scope: scopes,\n    };\n\n    if (clientSecret !== undefined) {\n      (refreshParams as any).client_secret = clientSecret;\n    }\n\n    const query = new URLSearchParams(refreshParams);\n\n    return tracingClient.withSpan(\n      \"IdentityClient.refreshAccessToken\",\n      options,\n      async (updatedOptions) => {\n        try {\n          const urlSuffix = getIdentityTokenEndpointSuffix(tenantId);\n          const request = createPipelineRequest({\n            url: `${this.authorityHost}/${tenantId}/${urlSuffix}`,\n            method: \"POST\",\n            body: query.toString(),\n            abortSignal: options.abortSignal,\n            headers: createHttpHeaders({\n              Accept: \"application/json\",\n              \"Content-Type\": \"application/x-www-form-urlencoded\",\n            }),\n            tracingOptions: updatedOptions.tracingOptions,\n          });\n\n          const response = await this.sendTokenRequest(request);\n          logger.info(`IdentityClient: refreshed token for client ID: ${clientId}`);\n          return response;\n        } catch (err: any) {\n          if (\n            err.name === AuthenticationErrorName &&\n            err.errorResponse.error === \"interaction_required\"\n          ) {\n            // It's likely that the refresh token has expired, so\n            // return null so that the credential implementation will\n            // initiate the authentication flow again.\n            logger.info(`IdentityClient: interaction required for client ID: ${clientId}`);\n            return null;\n          } else {\n            logger.warning(\n              `IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`,\n            );\n            throw err;\n          }\n        }\n      },\n    );\n  }\n\n  // Here is a custom layer that allows us to abort requests that go through MSAL,\n  // since MSAL doesn't allow us to pass options all the way through.\n\n  generateAbortSignal(correlationId: string): AbortSignalLike {\n    const controller = new AbortController();\n    const controllers = this.abortControllers.get(correlationId) || [];\n    controllers.push(controller);\n    this.abortControllers.set(correlationId, controllers);\n    const existingOnAbort = controller.signal.onabort;\n    controller.signal.onabort = (...params) => {\n      this.abortControllers.set(correlationId, undefined);\n      if (existingOnAbort) {\n        existingOnAbort.apply(controller.signal, params);\n      }\n    };\n    return controller.signal;\n  }\n\n  abortRequests(correlationId?: string): void {\n    const key = correlationId || noCorrelationId;\n    const controllers = [\n      ...(this.abortControllers.get(key) || []),\n      // MSAL passes no correlation ID to the get requests...\n      ...(this.abortControllers.get(noCorrelationId) || []),\n    ];\n    if (!controllers.length) {\n      return;\n    }\n    for (const controller of controllers) {\n      controller.abort();\n    }\n    this.abortControllers.set(key, undefined);\n  }\n\n  getCorrelationId(options?: NetworkRequestOptions): string {\n    const parameter = options?.body\n      ?.split(\"&\")\n      .map((part) => part.split(\"=\"))\n      .find(([key]) => key === \"client-request-id\");\n    return parameter && parameter.length ? parameter[1] || noCorrelationId : noCorrelationId;\n  }\n\n  // The MSAL network module methods follow\n\n  async sendGetRequestAsync<T>(\n    url: string,\n    options?: NetworkRequestOptions,\n  ): Promise<NetworkResponse<T>> {\n    const request = createPipelineRequest({\n      url,\n      method: \"GET\",\n      body: options?.body,\n      allowInsecureConnection: this.allowInsecureConnection,\n      headers: createHttpHeaders(options?.headers),\n      abortSignal: this.generateAbortSignal(noCorrelationId),\n    });\n\n    const response = await this.sendRequest(request);\n\n    this.logIdentifiers(response);\n\n    return {\n      body: response.bodyAsText ? JSON.parse(response.bodyAsText) : undefined,\n      headers: response.headers.toJSON(),\n      status: response.status,\n    };\n  }\n\n  async sendPostRequestAsync<T>(\n    url: string,\n    options?: NetworkRequestOptions,\n  ): Promise<NetworkResponse<T>> {\n    const request = createPipelineRequest({\n      url,\n      method: \"POST\",\n      body: options?.body,\n      headers: createHttpHeaders(options?.headers),\n      allowInsecureConnection: this.allowInsecureConnection,\n      // MSAL doesn't send the correlation ID on the get requests.\n      abortSignal: this.generateAbortSignal(this.getCorrelationId(options)),\n    });\n\n    const response = await this.sendRequest(request);\n\n    this.logIdentifiers(response);\n\n    return {\n      body: response.bodyAsText ? JSON.parse(response.bodyAsText) : undefined,\n      headers: response.headers.toJSON(),\n      status: response.status,\n    };\n  }\n\n  /**\n   *\n   * @internal\n   */\n  getTokenCredentialOptions(): TokenCredentialOptions {\n    return this.tokenCredentialOptions;\n  }\n  /**\n   * If allowLoggingAccountIdentifiers was set on the constructor options\n   * we try to log the account identifiers by parsing the received access token.\n   *\n   * The account identifiers we try to log are:\n   * - `appid`: The application or Client Identifier.\n   * - `upn`: User Principal Name.\n   *   - It might not be available in some authentication scenarios.\n   *   - If it's not available, we put a placeholder: \"No User Principal Name available\".\n   * - `tid`: Tenant Identifier.\n   * - `oid`: Object Identifier of the authenticated user.\n   */\n  private logIdentifiers(response: PipelineResponse): void {\n    if (!this.allowLoggingAccountIdentifiers || !response.bodyAsText) {\n      return;\n    }\n    const unavailableUpn = \"No User Principal Name available\";\n    try {\n      const parsed = (response as any).parsedBody || JSON.parse(response.bodyAsText);\n      const accessToken = parsed.access_token;\n      if (!accessToken) {\n        // Without an access token allowLoggingAccountIdentifiers isn't useful.\n        return;\n      }\n      const base64Metadata = accessToken.split(\".\")[1];\n      const { appid, upn, tid, oid } = JSON.parse(\n        Buffer.from(base64Metadata, \"base64\").toString(\"utf8\"),\n      );\n\n      logger.info(\n        `[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${\n          upn || unavailableUpn\n        }. Object ID (user): ${oid}`,\n      );\n    } catch (e: any) {\n      logger.warning(\n        \"allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:\",\n        e.message,\n      );\n    }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,yBAA8B;AAC9B,uBAAuB;AAEvB,gCAAyD;AAEzD,oBAA6D;AAC7D,mCAA+C;AAC/C,uBAAkD;AAClD,qBAA8B;AAC9B,qBAAuB;AAGvB,mBAGO;AAEP,MAAM,kBAAkB;AAoBjB,SAAS,+BAA+B,SAA0C;AAEvF,MAAI,gBAAgB,SAAS;AAG7B,MAAI,yBAAQ;AACV,oBAAgB,iBAAiB,QAAQ,IAAI;AAAA,EAC/C;AAGA,SAAO,iBAAiB;AAC1B;AASO,MAAM,uBAAuB,iCAAwC;AAAA,EACnE;AAAA,EACC;AAAA,EACA;AAAA,EACA,0BAAmC;AAAA;AAAA,EAEnC;AAAA,EAER,YAAY,SAAkC;AAC5C,UAAM,iBAAiB,qBAAqB,4BAAW;AACvD,UAAM,kBAAkB,SAAS,kBAAkB,kBAC/C,GAAG,QAAQ,iBAAiB,eAAe,IAAI,cAAc,KAC7D,GAAG,cAAc;AAErB,UAAM,UAAU,+BAA+B,OAAO;AACtD,QAAI,CAAC,QAAQ,WAAW,QAAQ,GAAG;AACjC,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAEA,UAAM;AAAA,MACJ,oBAAoB;AAAA,MACpB,cAAc;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,MACA,GAAG;AAAA,MACH,kBAAkB;AAAA,QAChB;AAAA,MACF;AAAA,MACA;AAAA,IACF,CAAC;AAED,SAAK,gBAAgB;AACrB,SAAK,mBAAmB,oBAAI,IAAI;AAChC,SAAK,iCAAiC,SAAS,gBAAgB;AAE/D,SAAK,yBAAyB,EAAE,GAAG,QAAQ;AAG3C,QAAI,SAAS,yBAAyB;AACpC,WAAK,0BAA0B,QAAQ;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAyD;AAC9E,0BAAO,KAAK,6CAA6C,QAAQ,GAAG,GAAG;AACvE,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO;AAC/C,QAAI,SAAS,eAAe,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC/E,YAAM,aAAsC,KAAK,MAAM,SAAS,UAAU;AAE1E,UAAI,CAAC,WAAW,cAAc;AAC5B,eAAO;AAAA,MACT;AAEA,WAAK,eAAe,QAAQ;AAE5B,YAAM,QAAQ;AAAA,QACZ,aAAa;AAAA,UACX,OAAO,WAAW;AAAA,UAClB,wBAAoB,uCAAyB,UAAU;AAAA,UACvD,2BAAuB,oCAAsB,UAAU;AAAA,UACvD,WAAW;AAAA,QACb;AAAA,QACA,cAAc,WAAW;AAAA,MAC3B;AAEA,4BAAO;AAAA,QACL,oBAAoB,QAAQ,GAAG,gCAAgC,MAAM,YAAY,kBAAkB;AAAA,MACrG;AACA,aAAO;AAAA,IACT,OAAO;AACL,YAAM,QAAQ,IAAI,kCAAoB,SAAS,QAAQ,SAAS,UAAU;AAC1E,4BAAO;AAAA,QACL,sDAAsD,SAAS,MAAM,KAAK,MAAM,cAAc,gBAAgB;AAAA,MAChH;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,UACA,UACA,QACA,cACA,cACA,UAA2B,CAAC,GACG;AAC/B,QAAI,iBAAiB,QAAW;AAC9B,aAAO;AAAA,IACT;AACA,0BAAO;AAAA,MACL,2DAA2D,QAAQ,aAAa,MAAM;AAAA,IACxF;AAEA,UAAM,gBAAgB;AAAA,MACpB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,MACf,OAAO;AAAA,IACT;AAEA,QAAI,iBAAiB,QAAW;AAC9B,MAAC,cAAsB,gBAAgB;AAAA,IACzC;AAEA,UAAM,QAAQ,IAAI,gBAAgB,aAAa;AAE/C,WAAO,6BAAc;AAAA,MACnB;AAAA,MACA;AAAA,MACA,OAAO,mBAAmB;AACxB,YAAI;AACF,gBAAM,gBAAY,6DAA+B,QAAQ;AACzD,gBAAM,cAAU,iDAAsB;AAAA,YACpC,KAAK,GAAG,KAAK,aAAa,IAAI,QAAQ,IAAI,SAAS;AAAA,YACnD,QAAQ;AAAA,YACR,MAAM,MAAM,SAAS;AAAA,YACrB,aAAa,QAAQ;AAAA,YACrB,aAAS,6CAAkB;AAAA,cACzB,QAAQ;AAAA,cACR,gBAAgB;AAAA,YAClB,CAAC;AAAA,YACD,gBAAgB,eAAe;AAAA,UACjC,CAAC;AAED,gBAAM,WAAW,MAAM,KAAK,iBAAiB,OAAO;AACpD,gCAAO,KAAK,kDAAkD,QAAQ,EAAE;AACxE,iBAAO;AAAA,QACT,SAAS,KAAU;AACjB,cACE,IAAI,SAAS,yCACb,IAAI,cAAc,UAAU,wBAC5B;AAIA,kCAAO,KAAK,uDAAuD,QAAQ,EAAE;AAC7E,mBAAO;AAAA,UACT,OAAO;AACL,kCAAO;AAAA,cACL,0DAA0D,QAAQ,KAAK,GAAG;AAAA,YAC5E;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,oBAAoB,eAAwC;AAC1D,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,cAAc,KAAK,iBAAiB,IAAI,aAAa,KAAK,CAAC;AACjE,gBAAY,KAAK,UAAU;AAC3B,SAAK,iBAAiB,IAAI,eAAe,WAAW;AACpD,UAAM,kBAAkB,WAAW,OAAO;AAC1C,eAAW,OAAO,UAAU,IAAI,WAAW;AACzC,WAAK,iBAAiB,IAAI,eAAe,MAAS;AAClD,UAAI,iBAAiB;AACnB,wBAAgB,MAAM,WAAW,QAAQ,MAAM;AAAA,MACjD;AAAA,IACF;AACA,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,cAAc,eAA8B;AAC1C,UAAM,MAAM,iBAAiB;AAC7B,UAAM,cAAc;AAAA,MAClB,GAAI,KAAK,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAAA;AAAA,MAEvC,GAAI,KAAK,iBAAiB,IAAI,eAAe,KAAK,CAAC;AAAA,IACrD;AACA,QAAI,CAAC,YAAY,QAAQ;AACvB;AAAA,IACF;AACA,eAAW,cAAc,aAAa;AACpC,iBAAW,MAAM;AAAA,IACnB;AACA,SAAK,iBAAiB,IAAI,KAAK,MAAS;AAAA,EAC1C;AAAA,EAEA,iBAAiB,SAAyC;AACxD,UAAM,YAAY,SAAS,MACvB,MAAM,GAAG,EACV,IAAI,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC,EAC7B,KAAK,CAAC,CAAC,GAAG,MAAM,QAAQ,mBAAmB;AAC9C,WAAO,aAAa,UAAU,SAAS,UAAU,CAAC,KAAK,kBAAkB;AAAA,EAC3E;AAAA;AAAA,EAIA,MAAM,oBACJ,KACA,SAC6B;AAC7B,UAAM,cAAU,iDAAsB;AAAA,MACpC;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,SAAS;AAAA,MACf,yBAAyB,KAAK;AAAA,MAC9B,aAAS,6CAAkB,SAAS,OAAO;AAAA,MAC3C,aAAa,KAAK,oBAAoB,eAAe;AAAA,IACvD,CAAC;AAED,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO;AAE/C,SAAK,eAAe,QAAQ;AAE5B,WAAO;AAAA,MACL,MAAM,SAAS,aAAa,KAAK,MAAM,SAAS,UAAU,IAAI;AAAA,MAC9D,SAAS,SAAS,QAAQ,OAAO;AAAA,MACjC,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,KACA,SAC6B;AAC7B,UAAM,cAAU,iDAAsB;AAAA,MACpC;AAAA,MACA,QAAQ;AAAA,MACR,MAAM,SAAS;AAAA,MACf,aAAS,6CAAkB,SAAS,OAAO;AAAA,MAC3C,yBAAyB,KAAK;AAAA;AAAA,MAE9B,aAAa,KAAK,oBAAoB,KAAK,iBAAiB,OAAO,CAAC;AAAA,IACtE,CAAC;AAED,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO;AAE/C,SAAK,eAAe,QAAQ;AAE5B,WAAO;AAAA,MACL,MAAM,SAAS,aAAa,KAAK,MAAM,SAAS,UAAU,IAAI;AAAA,MAC9D,SAAS,SAAS,QAAQ,OAAO;AAAA,MACjC,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,4BAAoD;AAClD,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,eAAe,UAAkC;AACvD,QAAI,CAAC,KAAK,kCAAkC,CAAC,SAAS,YAAY;AAChE;AAAA,IACF;AACA,UAAM,iBAAiB;AACvB,QAAI;AACF,YAAM,SAAU,SAAiB,cAAc,KAAK,MAAM,SAAS,UAAU;AAC7E,YAAM,cAAc,OAAO;AAC3B,UAAI,CAAC,aAAa;AAEhB;AAAA,MACF;AACA,YAAM,iBAAiB,YAAY,MAAM,GAAG,EAAE,CAAC;AAC/C,YAAM,EAAE,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK;AAAA,QACpC,OAAO,KAAK,gBAAgB,QAAQ,EAAE,SAAS,MAAM;AAAA,MACvD;AAEA,4BAAO;AAAA,QACL,sCAAsC,KAAK,gBAAgB,GAAG,0BAC5D,OAAO,cACT,uBAAuB,GAAG;AAAA,MAC5B;AAAA,IACF,SAAS,GAAQ;AACf,4BAAO;AAAA,QACL;AAAA,QACA,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/commonjs/constants.d.ts

@@ -1,7 +1,7 @@
 /**
  * Current version of the `@azure/identity` package.
  */
-export declare const SDK_VERSION = "4.13.0";
+export declare const SDK_VERSION = "4.13.2";
 /**
  * The default client ID for authentication
  * @internal