@azure/identity 4.5.0 → 4.5.1-alpha.20241021.1

package/dist/index.js

@@ -44,7 +44,7 @@ var child_process__namespace = /*#__PURE__*/_interopNamespaceDefault(child_proce
 /**
  * Current version of the `@azure/identity` package.
  */
-const SDK_VERSION = `4.5.0`;
+const SDK_VERSION = `4.5.1`;
 /**
  * The default client ID for authentication
  * @internal
@@ -2486,6 +2486,19 @@ function getScopeResource(scope) {
     return scope.replace(/\/.default$/, "");
 }
 
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+/**
+ * @internal
+ */
+function checkSubscription(logger, subscription) {
+    if (!subscription.match(/^[0-9a-zA-Z-._ ]+$/)) {
+        const error = new Error("Invalid subscription provided. You can locate your subscription by following the instructions listed here: https://learn.microsoft.com/azure/azure-portal/get-subscription-tenant-id.");
+        logger.info(formatError("", error));
+        throw error;
+    }
+}
+
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 /**
@@ -2512,11 +2525,16 @@ const cliCredentialInternals = {
      * @param resource - The resource to use when getting the token
      * @internal
      */
-    async getAzureCliAccessToken(resource, tenantId, timeout) {
+    async getAzureCliAccessToken(resource, tenantId, subscription, timeout) {
         let tenantSection = [];
+        let subscriptionSection = [];
         if (tenantId) {
             tenantSection = ["--tenant", tenantId];
         }
+        if (subscription) {
+            // Add quotes around the subscription to handle subscriptions with spaces
+            subscriptionSection = ["--subscription", `"${subscription}"`];
+        }
         return new Promise((resolve, reject) => {
             try {
                 child_process.execFile("az", [
@@ -2527,6 +2545,7 @@ const cliCredentialInternals = {
                     "--resource",
                     resource,
                     ...tenantSection,
+                    ...subscriptionSection,
                 ], { cwd: cliCredentialInternals.getSafeWorkingDir(), shell: true, timeout }, (error, stdout, stderr) => {
                     resolve({ stdout: stdout, stderr: stderr, error });
                 });
@@ -2558,6 +2577,10 @@ class AzureCliCredential {
             checkTenantId(logger$d, options === null || options === void 0 ? void 0 : options.tenantId);
             this.tenantId = options === null || options === void 0 ? void 0 : options.tenantId;
         }
+        if (options === null || options === void 0 ? void 0 : options.subscription) {
+            checkSubscription(logger$d, options === null || options === void 0 ? void 0 : options.subscription);
+            this.subscription = options === null || options === void 0 ? void 0 : options.subscription;
+        }
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options === null || options === void 0 ? void 0 : options.additionallyAllowedTenants);
         this.timeout = options === null || options === void 0 ? void 0 : options.processTimeoutInMs;
     }
@@ -2574,6 +2597,9 @@ class AzureCliCredential {
         if (tenantId) {
             checkTenantId(logger$d, tenantId);
         }
+        if (this.subscription) {
+            checkSubscription(logger$d, this.subscription);
+        }
         const scope = typeof scopes === "string" ? scopes : scopes[0];
         logger$d.getToken.info(`Using the scope ${scope}`);
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
@@ -2581,7 +2607,7 @@ class AzureCliCredential {
             try {
                 ensureValidScopeForDevTimeCreds(scope, logger$d);
                 const resource = getScopeResource(scope);
-                const obj = await cliCredentialInternals.getAzureCliAccessToken(resource, tenantId, this.timeout);
+                const obj = await cliCredentialInternals.getAzureCliAccessToken(resource, tenantId, this.subscription, this.timeout);
                 const specificScope = (_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("(.*)az login --scope(.*)");
                 const isLoginError = ((_b = obj.stderr) === null || _b === void 0 ? void 0 : _b.match("(.*)az login(.*)")) && !specificScope;
                 const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("az:(.*)not found")) || ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'az' is not recognized"));
@@ -3081,8 +3107,9 @@ async function parseJsonToken(result) {
  */
 const logger$a = credentialLogger("ChainedTokenCredential");
 /**
- * Enables multiple `TokenCredential` implementations to be tried in order
- * until one of the getToken methods returns an access token.
+ * Enables multiple `TokenCredential` implementations to be tried in order until
+ * one of the getToken methods returns an access token. For more information, see
+ * [ChainedTokenCredential overview](https://aka.ms/azsdk/js/identity/credential-chains#use-chainedtokencredential-for-granularity).
  */
 class ChainedTokenCredential {
     /**
@@ -3623,8 +3650,21 @@ class UnavailableDefaultCredential {
     }
 }
 /**
- * Provides a default {@link ChainedTokenCredential} configuration that should
- * work for most applications that use the Azure SDK.
+ * Provides a default {@link ChainedTokenCredential} configuration that works for most
+ * applications that use Azure SDK client libraries. For more information, see
+ * [DefaultAzureCredential overview](https://aka.ms/azsdk/js/identity/credential-chains#use-defaultazurecredential-for-flexibility).
+ *
+ * The following credential types will be tried, in order:
+ *
+ * - {@link EnvironmentCredential}
+ * - {@link WorkloadIdentityCredential}
+ * - {@link ManagedIdentityCredential}
+ * - {@link AzureCliCredential}
+ * - {@link AzurePowerShellCredential}
+ * - {@link AzureDeveloperCliCredential}
+ *
+ * Consult the documentation of these credential types for more information
+ * on how they attempt authentication.
  */
 class DefaultAzureCredential extends ChainedTokenCredential {
     constructor(options) {