@azure/identity 4.8.1-alpha.20250410.1 → 4.9.1-alpha.20250416.4

package/dist/workerd/msal/browserFlows/msalBrowserCommon.js

@@ -0,0 +1,291 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import * as msalBrowser from "@azure/msal-browser";
+import { defaultLoggerCallback, ensureValidMsalToken, getAuthority, getKnownAuthorities, getMSALLogLevel, handleMsalError, msalToPublic, publicToMsal, } from "../utils.js";
+import { AuthenticationRequiredError, CredentialUnavailableError } from "../../errors.js";
+import { getLogLevel } from "@azure/logger";
+import { formatSuccess } from "../../util/logging.js";
+import { processMultiTenantRequest, resolveAdditionallyAllowedTenantIds, resolveTenantId, } from "../../util/tenantIdUtils.js";
+import { DefaultTenantId } from "../../constants.js";
+/**
+ * Generates a MSAL configuration that generally works for browsers
+ * @internal
+ */
+function generateMsalBrowserConfiguration(options) {
+    var _a;
+    const tenantId = options.tenantId || DefaultTenantId;
+    const authority = getAuthority(tenantId, options.authorityHost);
+    return {
+        auth: {
+            clientId: options.clientId,
+            authority,
+            knownAuthorities: getKnownAuthorities(tenantId, authority, options.disableInstanceDiscovery),
+            // If the users picked redirect as their login style,
+            // but they didn't provide a redirectUri,
+            // we can try to use the current page we're in as a default value.
+            redirectUri: options.redirectUri || self.location.origin,
+        },
+        cache: {
+            cacheLocation: "sessionStorage",
+            storeAuthStateInCookie: true, // Set to true to improve the experience on IE11 and Edge.
+        },
+        system: {
+            loggerOptions: {
+                loggerCallback: defaultLoggerCallback(options.logger, "Browser"),
+                logLevel: getMSALLogLevel(getLogLevel()),
+                piiLoggingEnabled: (_a = options.loggingOptions) === null || _a === void 0 ? void 0 : _a.enableUnsafeSupportLogging,
+            },
+        },
+    };
+}
+// We keep a copy of the redirect hash.
+const redirectHash = self.location.hash;
+/**
+ * Uses MSAL Browser 2.X for browser authentication,
+ * which uses the [Auth Code Flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow).
+ * @internal
+ */
+export function createMsalBrowserClient(options) {
+    var _a;
+    const loginStyle = options.loginStyle;
+    if (!options.clientId) {
+        throw new CredentialUnavailableError("A client ID is required in browsers");
+    }
+    const clientId = options.clientId;
+    const logger = options.logger;
+    const tenantId = resolveTenantId(logger, options.tenantId, options.clientId);
+    const additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds((_a = options === null || options === void 0 ? void 0 : options.tokenCredentialOptions) === null || _a === void 0 ? void 0 : _a.additionallyAllowedTenants);
+    const authorityHost = options.authorityHost;
+    const msalConfig = generateMsalBrowserConfiguration(options);
+    const disableAutomaticAuthentication = options.disableAutomaticAuthentication;
+    const loginHint = options.loginHint;
+    let account;
+    if (options.authenticationRecord) {
+        account = Object.assign(Object.assign({}, options.authenticationRecord), { tenantId });
+    }
+    // This variable should only be used through calling `getApp` function
+    let app;
+    /**
+     * Return the MSAL account if not set yet
+     * @returns MSAL application
+     */
+    async function getApp() {
+        if (!app) {
+            // Prepare the MSAL application
+            app = await msalBrowser.PublicClientApplication.createPublicClientApplication(msalConfig);
+            // setting the account right after the app is created.
+            if (account) {
+                app.setActiveAccount(publicToMsal(account));
+            }
+        }
+        return app;
+    }
+    /**
+     * Loads the account based on the result of the authentication.
+     * If no result was received, tries to load the account from the cache.
+     * @param result - Result object received from MSAL.
+     */
+    async function handleBrowserResult(result) {
+        try {
+            const msalApp = await getApp();
+            if (result && result.account) {
+                logger.info(`MSAL Browser V2 authentication successful.`);
+                msalApp.setActiveAccount(result.account);
+                return msalToPublic(clientId, result.account);
+            }
+            // If by this point we happen to have an active account, we should stop trying to parse this.
+            const activeAccount = msalApp.getActiveAccount();
+            if (activeAccount) {
+                return msalToPublic(clientId, activeAccount);
+            }
+            // If we don't have an active account, we try to activate it from all the already loaded accounts.
+            const allAccounts = app.getAllAccounts();
+            if (allAccounts.length > 1) {
+                // If there's more than one account in memory, we force the user to authenticate again.
+                // At this point we can't identify which account should this credential work with,
+                // since at this point the user won't have provided enough information.
+                // We log a message in case that helps.
+                logger.info(`More than one account was found authenticated for this Client ID and Tenant ID.
+  However, no "authenticationRecord" has been provided for this credential,
+  therefore we're unable to pick between these accounts.
+  A new login attempt will be requested, to ensure the correct account is picked.
+  To work with multiple accounts for the same Client ID and Tenant ID, please provide an "authenticationRecord" when initializing "InteractiveBrowserCredential".`);
+                // To safely trigger a new login, we're also ensuring the local cache is cleared up for this MSAL object.
+                // However, we want to avoid kicking the user out of their authentication on the Azure side.
+                // We do this by calling to logout while specifying a `onRedirectNavigate` that returns false.
+                await msalApp.logout({
+                    onRedirectNavigate: () => false,
+                });
+                return;
+            }
+            // If there's only one account for this MSAL object, we can safely activate it.
+            if (allAccounts.length === 1) {
+                const msalAccount = allAccounts[0];
+                msalApp.setActiveAccount(msalAccount);
+                return msalToPublic(clientId, msalAccount);
+            }
+            logger.info(`No accounts were found through MSAL.`);
+        }
+        catch (e) {
+            logger.info(`Failed to acquire token through MSAL. ${e.message}`);
+        }
+        return;
+    }
+    /**
+     * Handles the MSAL authentication result.
+     * If the result has an account, we update the local account reference.
+     * If the token received is invalid, an error will be thrown depending on what's missing.
+     */
+    function handleResult(scopes, result, getTokenOptions) {
+        var _a;
+        if (result === null || result === void 0 ? void 0 : result.account) {
+            account = msalToPublic(clientId, result.account);
+        }
+        ensureValidMsalToken(scopes, result, getTokenOptions);
+        logger.getToken.info(formatSuccess(scopes));
+        return {
+            token: result.accessToken,
+            expiresOnTimestamp: result.expiresOn.getTime(),
+            refreshAfterTimestamp: (_a = result.refreshOn) === null || _a === void 0 ? void 0 : _a.getTime(),
+            tokenType: "Bearer",
+        };
+    }
+    /**
+     * Uses MSAL to handle the redirect.
+     */
+    async function handleRedirect() {
+        const msalApp = await getApp();
+        return handleBrowserResult((await msalApp.handleRedirectPromise(redirectHash)) || undefined);
+    }
+    /**
+     * Uses MSAL to retrieve the active account.
+     */
+    async function getActiveAccount() {
+        const msalApp = await getApp();
+        const activeAccount = msalApp.getActiveAccount();
+        if (!activeAccount) {
+            return;
+        }
+        return msalToPublic(clientId, activeAccount);
+    }
+    /**
+     * Uses MSAL to trigger a redirect or a popup login.
+     */
+    async function login(scopes = []) {
+        const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
+        const loginRequest = {
+            scopes: arrayScopes,
+            loginHint: loginHint,
+        };
+        const msalApp = await getApp();
+        switch (loginStyle) {
+            case "redirect": {
+                await app.loginRedirect(loginRequest);
+                return;
+            }
+            case "popup":
+                return handleBrowserResult(await msalApp.loginPopup(loginRequest));
+        }
+    }
+    /**
+     * Tries to retrieve the token silently using MSAL.
+     */
+    async function getTokenSilent(scopes, getTokenOptions) {
+        const activeAccount = await getActiveAccount();
+        if (!activeAccount) {
+            throw new AuthenticationRequiredError({
+                scopes,
+                getTokenOptions,
+                message: "Silent authentication failed. We couldn't retrieve an active account from the cache.",
+            });
+        }
+        const parameters = {
+            authority: (getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.authority) || msalConfig.auth.authority,
+            correlationId: getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.correlationId,
+            claims: getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.claims,
+            account: publicToMsal(activeAccount),
+            forceRefresh: false,
+            scopes,
+        };
+        try {
+            logger.info("Attempting to acquire token silently");
+            const msalApp = await getApp();
+            const response = await msalApp.acquireTokenSilent(parameters);
+            return handleResult(scopes, response);
+        }
+        catch (err) {
+            throw handleMsalError(scopes, err, options);
+        }
+    }
+    /**
+     * Attempts to retrieve the token in the browser through interactive methods.
+     */
+    async function getTokenInteractive(scopes, getTokenOptions) {
+        const activeAccount = await getActiveAccount();
+        if (!activeAccount) {
+            throw new AuthenticationRequiredError({
+                scopes,
+                getTokenOptions,
+                message: "Silent authentication failed. We couldn't retrieve an active account from the cache.",
+            });
+        }
+        const parameters = {
+            authority: (getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.authority) || msalConfig.auth.authority,
+            correlationId: getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.correlationId,
+            claims: getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.claims,
+            account: publicToMsal(activeAccount),
+            loginHint: loginHint,
+            scopes,
+        };
+        const msalApp = await getApp();
+        switch (loginStyle) {
+            case "redirect":
+                // This will go out of the page.
+                // Once the InteractiveBrowserCredential is initialized again,
+                // we'll load the MSAL account in the constructor.
+                await msalApp.acquireTokenRedirect(parameters);
+                return { token: "", expiresOnTimestamp: 0, tokenType: "Bearer" };
+            case "popup":
+                return handleResult(scopes, await app.acquireTokenPopup(parameters));
+        }
+    }
+    /**
+     * Attempts to get token through the silent flow.
+     * If failed, get token through interactive method with `doGetToken` method.
+     */
+    async function getToken(scopes, getTokenOptions = {}) {
+        const getTokenTenantId = processMultiTenantRequest(tenantId, getTokenOptions, additionallyAllowedTenantIds) ||
+            tenantId;
+        if (!getTokenOptions.authority) {
+            getTokenOptions.authority = getAuthority(getTokenTenantId, authorityHost);
+        }
+        // We ensure that redirection is handled at this point.
+        await handleRedirect();
+        if (!(await getActiveAccount()) && !disableAutomaticAuthentication) {
+            await login(scopes);
+        }
+        // Attempts to get the token silently; else, falls back to interactive method.
+        try {
+            return await getTokenSilent(scopes, getTokenOptions);
+        }
+        catch (err) {
+            if (err.name !== "AuthenticationRequiredError") {
+                throw err;
+            }
+            if (getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.disableAutomaticAuthentication) {
+                throw new AuthenticationRequiredError({
+                    scopes,
+                    getTokenOptions,
+                    message: "Automatic authentication has been disabled. You may call the authenticate() method.",
+                });
+            }
+            logger.info(`Silent authentication failed, falling back to interactive method ${loginStyle}`);
+            return getTokenInteractive(scopes, getTokenOptions);
+        }
+    }
+    return {
+        getActiveAccount,
+        getToken,
+    };
+}
+//# sourceMappingURL=msalBrowserCommon.js.map

package/dist/workerd/msal/browserFlows/msalBrowserCommon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalBrowserCommon.js","sourceRoot":"","sources":["../../../../src/msal/browserFlows/msalBrowserCommon.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,KAAK,WAAW,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,YAAY,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE1F,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,eAAe,GAChB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD;;;GAGG;AACH,SAAS,gCAAgC,CACvC,OAA+B;;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IACrD,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE;YACJ,QAAQ,EAAE,OAAO,CAAC,QAAS;YAC3B,SAAS;YACT,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,wBAAwB,CAAC;YAC5F,qDAAqD;YACrD,yCAAyC;YACzC,kEAAkE;YAClE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM;SACzD;QACD,KAAK,EAAE;YACL,aAAa,EAAE,gBAAgB;YAC/B,sBAAsB,EAAE,IAAI,EAAE,0DAA0D;SACzF;QACD,MAAM,EAAE;YACN,aAAa,EAAE;gBACb,cAAc,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;gBAChE,QAAQ,EAAE,eAAe,CAAC,WAAW,EAAE,CAAC;gBACxC,iBAAiB,EAAE,MAAA,OAAO,CAAC,cAAc,0CAAE,0BAA0B;aACtE;SACF;KACF,CAAC;AACJ,CAAC;AAWD,uCAAuC;AACvC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA+B;;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,0BAA0B,CAAC,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,4BAA4B,GAAa,mCAAmC,CAChF,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,sBAAsB,0CAAE,0BAA0B,CAC5D,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,UAAU,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC;IAC9E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAEpC,IAAI,OAAyC,CAAC;IAC9C,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACjC,OAAO,mCACF,OAAO,CAAC,oBAAoB,KAC/B,QAAQ,GACT,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,GAAyC,CAAC;IAC9C;;;OAGG;IACH,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,+BAA+B;YAC/B,GAAG,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;YAE1F,sDAAsD;YACtD,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,mBAAmB,CAChC,MAAyC;QAEzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;YAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBAC1D,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACzC,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,6FAA6F;YAC7F,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACjD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC/C,CAAC;YAED,kGAAkG;YAClG,MAAM,WAAW,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,uFAAuF;gBACvF,kFAAkF;gBAClF,uEAAuE;gBACvE,uCAAuC;gBACvC,MAAM,CAAC,IAAI,CACT;;;;kKAIwJ,CACzJ,CAAC;gBACF,yGAAyG;gBACzG,4FAA4F;gBAC5F,8FAA8F;gBAC9F,MAAM,OAAO,CAAC,MAAM,CAAC;oBACnB,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK;iBAChC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,+EAA+E;YAC/E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBACnC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACtC,OAAO,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;IACT,CAAC;IAED;;;;OAIG;IACH,SAAS,YAAY,CACnB,MAAyB,EACzB,MAAmB,EACnB,eAAiC;;QAEjC,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;YAC9C,qBAAqB,EAAE,MAAA,MAAM,CAAC,SAAS,0CAAE,OAAO,EAAE;YAClD,SAAS,EAAE,QAAQ;SACpB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,cAAc;QAC3B,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;QAC/B,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IAC/F,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,gBAAgB;QAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACjD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,KAAK,CAAC,SAA4B,EAAE;QACjD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAgC;YAChD,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,SAAS;SACrB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;QAC/B,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,KAAK,OAAO;gBACV,OAAO,mBAAmB,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,cAAc,CAC3B,MAAgB,EAChB,eAA+C;QAE/C,MAAM,aAAa,GAAG,MAAM,gBAAgB,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,2BAA2B,CAAC;gBACpC,MAAM;gBACN,eAAe;gBACf,OAAO,EACL,sFAAsF;aACzF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAA8B;YAC5C,SAAS,EAAE,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,SAAS,KAAI,UAAU,CAAC,IAAI,CAAC,SAAU;YACnE,aAAa,EAAE,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,aAAa;YAC7C,MAAM,EAAE,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,MAAM;YAC/B,OAAO,EAAE,YAAY,CAAC,aAAa,CAAC;YACpC,YAAY,EAAE,KAAK;YACnB,MAAM;SACP,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC9D,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,mBAAmB,CAChC,MAAgB,EAChB,eAA+C;QAE/C,MAAM,aAAa,GAAG,MAAM,gBAAgB,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,2BAA2B,CAAC;gBACpC,MAAM;gBACN,eAAe;gBACf,OAAO,EACL,sFAAsF;aACzF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAgC;YAC9C,SAAS,EAAE,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,SAAS,KAAI,UAAU,CAAC,IAAI,CAAC,SAAU;YACnE,aAAa,EAAE,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,aAAa;YAC7C,MAAM,EAAE,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,MAAM;YAC/B,OAAO,EAAE,YAAY,CAAC,aAAa,CAAC;YACpC,SAAS,EAAE,SAAS;YACpB,MAAM;SACP,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;QAC/B,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,UAAU;gBACb,gCAAgC;gBAChC,8DAA8D;gBAC9D,kDAAkD;gBAElD,MAAM,OAAO,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;gBAC/C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;YACnE,KAAK,OAAO;gBACV,OAAO,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,QAAQ,CACrB,MAAgB,EAChB,kBAAiD,EAAE;QAEnD,MAAM,gBAAgB,GACpB,yBAAyB,CAAC,QAAQ,EAAE,eAAe,EAAE,4BAA4B,CAAC;YAClF,QAAQ,CAAC;QAEX,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC;YAC/B,eAAe,CAAC,SAAS,GAAG,YAAY,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAC5E,CAAC;QAED,uDAAuD;QACvD,MAAM,cAAc,EAAE,CAAC;QAEvB,IAAI,CAAC,CAAC,MAAM,gBAAgB,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;YACnE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAED,8EAA8E;QAC9E,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;gBAC/C,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,8BAA8B,EAAE,CAAC;gBACpD,MAAM,IAAI,2BAA2B,CAAC;oBACpC,MAAM;oBACN,eAAe;oBACf,OAAO,EACL,qFAAqF;iBACxF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,oEAAoE,UAAU,EAAE,CAAC,CAAC;YAC9F,OAAO,mBAAmB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO;QACL,gBAAgB;QAChB,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport * as msalBrowser from \"@azure/msal-browser\";\n\nimport type { MsalBrowserFlowOptions } from \"./msalBrowserOptions.js\";\nimport {\n  defaultLoggerCallback,\n  ensureValidMsalToken,\n  getAuthority,\n  getKnownAuthorities,\n  getMSALLogLevel,\n  handleMsalError,\n  msalToPublic,\n  publicToMsal,\n} from \"../utils.js\";\n\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport type { AuthenticationRecord, MsalResult } from \"../types.js\";\nimport { AuthenticationRequiredError, CredentialUnavailableError } from \"../../errors.js\";\nimport type { CredentialFlowGetTokenOptions } from \"../credentials.js\";\nimport { getLogLevel } from \"@azure/logger\";\nimport { formatSuccess } from \"../../util/logging.js\";\nimport {\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n  resolveTenantId,\n} from \"../../util/tenantIdUtils.js\";\nimport { DefaultTenantId } from \"../../constants.js\";\n\n/**\n * Generates a MSAL configuration that generally works for browsers\n * @internal\n */\nfunction generateMsalBrowserConfiguration(\n  options: MsalBrowserFlowOptions,\n): msalBrowser.Configuration {\n  const tenantId = options.tenantId || DefaultTenantId;\n  const authority = getAuthority(tenantId, options.authorityHost);\n  return {\n    auth: {\n      clientId: options.clientId!,\n      authority,\n      knownAuthorities: getKnownAuthorities(tenantId, authority, options.disableInstanceDiscovery),\n      // If the users picked redirect as their login style,\n      // but they didn't provide a redirectUri,\n      // we can try to use the current page we're in as a default value.\n      redirectUri: options.redirectUri || self.location.origin,\n    },\n    cache: {\n      cacheLocation: \"sessionStorage\",\n      storeAuthStateInCookie: true, // Set to true to improve the experience on IE11 and Edge.\n    },\n    system: {\n      loggerOptions: {\n        loggerCallback: defaultLoggerCallback(options.logger, \"Browser\"),\n        logLevel: getMSALLogLevel(getLogLevel()),\n        piiLoggingEnabled: options.loggingOptions?.enableUnsafeSupportLogging,\n      },\n    },\n  };\n}\n\n/**\n * Methods that are used by InteractiveBrowserCredential\n * @internal\n */\nexport interface MsalBrowserClient {\n  getActiveAccount(): Promise<AuthenticationRecord | undefined>;\n  getToken(scopes: string[], options: CredentialFlowGetTokenOptions): Promise<AccessToken>;\n}\n\n// We keep a copy of the redirect hash.\nconst redirectHash = self.location.hash;\n\n/**\n * Uses MSAL Browser 2.X for browser authentication,\n * which uses the [Auth Code Flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow).\n * @internal\n */\nexport function createMsalBrowserClient(options: MsalBrowserFlowOptions): MsalBrowserClient {\n  const loginStyle = options.loginStyle;\n  if (!options.clientId) {\n    throw new CredentialUnavailableError(\"A client ID is required in browsers\");\n  }\n  const clientId = options.clientId;\n  const logger = options.logger;\n  const tenantId = resolveTenantId(logger, options.tenantId, options.clientId);\n  const additionallyAllowedTenantIds: string[] = resolveAdditionallyAllowedTenantIds(\n    options?.tokenCredentialOptions?.additionallyAllowedTenants,\n  );\n  const authorityHost = options.authorityHost;\n  const msalConfig = generateMsalBrowserConfiguration(options);\n  const disableAutomaticAuthentication = options.disableAutomaticAuthentication;\n  const loginHint = options.loginHint;\n\n  let account: AuthenticationRecord | undefined;\n  if (options.authenticationRecord) {\n    account = {\n      ...options.authenticationRecord,\n      tenantId,\n    };\n  }\n\n  // This variable should only be used through calling `getApp` function\n  let app: msalBrowser.IPublicClientApplication;\n  /**\n   * Return the MSAL account if not set yet\n   * @returns MSAL application\n   */\n  async function getApp(): Promise<msalBrowser.IPublicClientApplication> {\n    if (!app) {\n      // Prepare the MSAL application\n      app = await msalBrowser.PublicClientApplication.createPublicClientApplication(msalConfig);\n\n      // setting the account right after the app is created.\n      if (account) {\n        app.setActiveAccount(publicToMsal(account));\n      }\n    }\n\n    return app;\n  }\n\n  /**\n   * Loads the account based on the result of the authentication.\n   * If no result was received, tries to load the account from the cache.\n   * @param result - Result object received from MSAL.\n   */\n  async function handleBrowserResult(\n    result?: msalBrowser.AuthenticationResult,\n  ): Promise<AuthenticationRecord | undefined> {\n    try {\n      const msalApp = await getApp();\n      if (result && result.account) {\n        logger.info(`MSAL Browser V2 authentication successful.`);\n        msalApp.setActiveAccount(result.account);\n        return msalToPublic(clientId, result.account);\n      }\n\n      // If by this point we happen to have an active account, we should stop trying to parse this.\n      const activeAccount = msalApp.getActiveAccount();\n      if (activeAccount) {\n        return msalToPublic(clientId, activeAccount);\n      }\n\n      // If we don't have an active account, we try to activate it from all the already loaded accounts.\n      const allAccounts = app.getAllAccounts();\n      if (allAccounts.length > 1) {\n        // If there's more than one account in memory, we force the user to authenticate again.\n        // At this point we can't identify which account should this credential work with,\n        // since at this point the user won't have provided enough information.\n        // We log a message in case that helps.\n        logger.info(\n          `More than one account was found authenticated for this Client ID and Tenant ID.\n  However, no \"authenticationRecord\" has been provided for this credential,\n  therefore we're unable to pick between these accounts.\n  A new login attempt will be requested, to ensure the correct account is picked.\n  To work with multiple accounts for the same Client ID and Tenant ID, please provide an \"authenticationRecord\" when initializing \"InteractiveBrowserCredential\".`,\n        );\n        // To safely trigger a new login, we're also ensuring the local cache is cleared up for this MSAL object.\n        // However, we want to avoid kicking the user out of their authentication on the Azure side.\n        // We do this by calling to logout while specifying a `onRedirectNavigate` that returns false.\n        await msalApp.logout({\n          onRedirectNavigate: () => false,\n        });\n        return;\n      }\n\n      // If there's only one account for this MSAL object, we can safely activate it.\n      if (allAccounts.length === 1) {\n        const msalAccount = allAccounts[0];\n        msalApp.setActiveAccount(msalAccount);\n        return msalToPublic(clientId, msalAccount);\n      }\n\n      logger.info(`No accounts were found through MSAL.`);\n    } catch (e: any) {\n      logger.info(`Failed to acquire token through MSAL. ${e.message}`);\n    }\n    return;\n  }\n\n  /**\n   * Handles the MSAL authentication result.\n   * If the result has an account, we update the local account reference.\n   * If the token received is invalid, an error will be thrown depending on what's missing.\n   */\n  function handleResult(\n    scopes: string | string[],\n    result?: MsalResult,\n    getTokenOptions?: GetTokenOptions,\n  ): AccessToken {\n    if (result?.account) {\n      account = msalToPublic(clientId, result.account);\n    }\n    ensureValidMsalToken(scopes, result, getTokenOptions);\n    logger.getToken.info(formatSuccess(scopes));\n    return {\n      token: result.accessToken,\n      expiresOnTimestamp: result.expiresOn.getTime(),\n      refreshAfterTimestamp: result.refreshOn?.getTime(),\n      tokenType: \"Bearer\",\n    };\n  }\n\n  /**\n   * Uses MSAL to handle the redirect.\n   */\n  async function handleRedirect(): Promise<AuthenticationRecord | undefined> {\n    const msalApp = await getApp();\n    return handleBrowserResult((await msalApp.handleRedirectPromise(redirectHash)) || undefined);\n  }\n\n  /**\n   * Uses MSAL to retrieve the active account.\n   */\n  async function getActiveAccount(): Promise<AuthenticationRecord | undefined> {\n    const msalApp = await getApp();\n    const activeAccount = msalApp.getActiveAccount();\n    if (!activeAccount) {\n      return;\n    }\n    return msalToPublic(clientId, activeAccount);\n  }\n\n  /**\n   * Uses MSAL to trigger a redirect or a popup login.\n   */\n  async function login(scopes: string | string[] = []): Promise<AuthenticationRecord | undefined> {\n    const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];\n    const loginRequest: msalBrowser.RedirectRequest = {\n      scopes: arrayScopes,\n      loginHint: loginHint,\n    };\n    const msalApp = await getApp();\n    switch (loginStyle) {\n      case \"redirect\": {\n        await app.loginRedirect(loginRequest);\n        return;\n      }\n      case \"popup\":\n        return handleBrowserResult(await msalApp.loginPopup(loginRequest));\n    }\n  }\n\n  /**\n   * Tries to retrieve the token silently using MSAL.\n   */\n  async function getTokenSilent(\n    scopes: string[],\n    getTokenOptions?: CredentialFlowGetTokenOptions,\n  ): Promise<AccessToken> {\n    const activeAccount = await getActiveAccount();\n    if (!activeAccount) {\n      throw new AuthenticationRequiredError({\n        scopes,\n        getTokenOptions,\n        message:\n          \"Silent authentication failed. We couldn't retrieve an active account from the cache.\",\n      });\n    }\n\n    const parameters: msalBrowser.SilentRequest = {\n      authority: getTokenOptions?.authority || msalConfig.auth.authority!,\n      correlationId: getTokenOptions?.correlationId,\n      claims: getTokenOptions?.claims,\n      account: publicToMsal(activeAccount),\n      forceRefresh: false,\n      scopes,\n    };\n\n    try {\n      logger.info(\"Attempting to acquire token silently\");\n      const msalApp = await getApp();\n      const response = await msalApp.acquireTokenSilent(parameters);\n      return handleResult(scopes, response);\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  /**\n   * Attempts to retrieve the token in the browser through interactive methods.\n   */\n  async function getTokenInteractive(\n    scopes: string[],\n    getTokenOptions?: CredentialFlowGetTokenOptions,\n  ): Promise<AccessToken> {\n    const activeAccount = await getActiveAccount();\n    if (!activeAccount) {\n      throw new AuthenticationRequiredError({\n        scopes,\n        getTokenOptions,\n        message:\n          \"Silent authentication failed. We couldn't retrieve an active account from the cache.\",\n      });\n    }\n\n    const parameters: msalBrowser.RedirectRequest = {\n      authority: getTokenOptions?.authority || msalConfig.auth.authority!,\n      correlationId: getTokenOptions?.correlationId,\n      claims: getTokenOptions?.claims,\n      account: publicToMsal(activeAccount),\n      loginHint: loginHint,\n      scopes,\n    };\n    const msalApp = await getApp();\n    switch (loginStyle) {\n      case \"redirect\":\n        // This will go out of the page.\n        // Once the InteractiveBrowserCredential is initialized again,\n        // we'll load the MSAL account in the constructor.\n\n        await msalApp.acquireTokenRedirect(parameters);\n        return { token: \"\", expiresOnTimestamp: 0, tokenType: \"Bearer\" };\n      case \"popup\":\n        return handleResult(scopes, await app.acquireTokenPopup(parameters));\n    }\n  }\n\n  /**\n   * Attempts to get token through the silent flow.\n   * If failed, get token through interactive method with `doGetToken` method.\n   */\n  async function getToken(\n    scopes: string[],\n    getTokenOptions: CredentialFlowGetTokenOptions = {},\n  ): Promise<AccessToken> {\n    const getTokenTenantId =\n      processMultiTenantRequest(tenantId, getTokenOptions, additionallyAllowedTenantIds) ||\n      tenantId;\n\n    if (!getTokenOptions.authority) {\n      getTokenOptions.authority = getAuthority(getTokenTenantId, authorityHost);\n    }\n\n    // We ensure that redirection is handled at this point.\n    await handleRedirect();\n\n    if (!(await getActiveAccount()) && !disableAutomaticAuthentication) {\n      await login(scopes);\n    }\n\n    // Attempts to get the token silently; else, falls back to interactive method.\n    try {\n      return await getTokenSilent(scopes, getTokenOptions);\n    } catch (err: any) {\n      if (err.name !== \"AuthenticationRequiredError\") {\n        throw err;\n      }\n      if (getTokenOptions?.disableAutomaticAuthentication) {\n        throw new AuthenticationRequiredError({\n          scopes,\n          getTokenOptions,\n          message:\n            \"Automatic authentication has been disabled. You may call the authenticate() method.\",\n        });\n      }\n      logger.info(`Silent authentication failed, falling back to interactive method ${loginStyle}`);\n      return getTokenInteractive(scopes, getTokenOptions);\n    }\n  }\n  return {\n    getActiveAccount,\n    getToken,\n  };\n}\n"]}

package/dist/workerd/msal/browserFlows/msalBrowserOptions.d.ts

@@ -0,0 +1,87 @@
+import type { AuthenticationRecord } from "../types.js";
+import type { BrowserLoginStyle } from "../../credentials/interactiveBrowserCredentialOptions.js";
+import type { LogPolicyOptions } from "@azure/core-rest-pipeline";
+import type { MultiTenantTokenCredentialOptions } from "../../credentials/multiTenantTokenCredentialOptions.js";
+import type { CredentialLogger } from "../../util/logging.js";
+/**
+ * Options for the MSAL browser flows.
+ * @internal
+ */
+export interface MsalBrowserFlowOptions {
+    logger: CredentialLogger;
+    /**
+     * The Client ID of the Microsoft Entra application that users will sign into.
+     * This parameter is required on the browser.
+     */
+    clientId?: string;
+    /**
+     * The Microsoft Entra tenant (directory) ID.
+     */
+    tenantId?: string;
+    /**
+     * The authority host to use for authentication requests.
+     * Possible values are available through {@link AzureAuthorityHosts}.
+     * The default is "https://login.microsoftonline.com".
+     */
+    authorityHost?: string;
+    /**
+     * Result of a previous authentication that can be used to retrieve the cached credentials of each individual account.
+     * This is necessary to provide in case the application wants to work with more than one account per
+     * Client ID and Tenant ID pair.
+     *
+     * This record can be retrieved by calling to the credential's `authenticate()` method, as follows:
+     *
+     *     const authenticationRecord = await credential.authenticate();
+     *
+     */
+    authenticationRecord?: AuthenticationRecord;
+    /**
+     * Makes getToken throw if a manual authentication is necessary.
+     * Developers will need to call to `authenticate()` to control when to manually authenticate.
+     */
+    disableAutomaticAuthentication?: boolean;
+    /**
+     * The field determines whether instance discovery is performed when attempting to authenticate.
+     * Setting this to `true` will completely disable both instance discovery and authority validation.
+     * As a result, it's crucial to ensure that the configured authority host is valid and trustworthy.
+     * This functionality is intended for use in scenarios where the metadata endpoint cannot be reached, such as in private clouds or Azure Stack.
+     * The process of instance discovery entails retrieving authority metadata from https://login.microsoft.com/ to validate the authority.
+     */
+    disableInstanceDiscovery?: boolean;
+    /**
+     * Options for multi-tenant applications which allows for additionally allowed tenants.
+     */
+    tokenCredentialOptions: MultiTenantTokenCredentialOptions;
+    /**
+     * Gets the redirect URI of the application. This should be same as the value
+     * in the application registration portal.  Defaults to `window.location.href`.
+     * This field is no longer required for Node.js.
+     */
+    redirectUri?: string;
+    /**
+     * Specifies whether a redirect or a popup window should be used to
+     * initiate the user authentication flow. Possible values are "redirect"
+     * or "popup" (default) for browser and "popup" (default) for node.
+     *
+     */
+    loginStyle: BrowserLoginStyle;
+    /**
+     * loginHint allows a user name to be pre-selected for interactive logins.
+     * Setting this option skips the account selection prompt and immediately attempts to login with the specified account.
+     */
+    loginHint?: string;
+    /**
+     * Allows users to configure settings for logging policy options, allow logging account information and personally identifiable information for customer support.
+     */
+    loggingOptions?: LogPolicyOptions & {
+        /**
+         * Allows logging account information once the authentication flow succeeds.
+         */
+        allowLoggingAccountIdentifiers?: boolean;
+        /**
+         * Allows logging personally identifiable information for customer support.
+         */
+        enableUnsafeSupportLogging?: boolean;
+    };
+}
+//# sourceMappingURL=msalBrowserOptions.d.ts.map

package/dist/workerd/msal/browserFlows/msalBrowserOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalBrowserOptions.d.ts","sourceRoot":"","sources":["../../../../src/msal/browserFlows/msalBrowserOptions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,wDAAwD,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,gBAAgB,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAE5C;;;OAGG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAEzC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;OAEG;IACH,sBAAsB,EAAE,iCAAiC,CAAC;IAE1D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,UAAU,EAAE,iBAAiB,CAAC;IAE9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,cAAc,CAAC,EAAE,gBAAgB,GAAG;QAClC;;WAEG;QACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;QACzC;;WAEG;QACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;KACtC,CAAC;CACH"}

package/dist/workerd/msal/browserFlows/msalBrowserOptions.js

@@ -0,0 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+export {};
+//# sourceMappingURL=msalBrowserOptions.js.map

package/dist/workerd/msal/browserFlows/msalBrowserOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalBrowserOptions.js","sourceRoot":"","sources":["../../../../src/msal/browserFlows/msalBrowserOptions.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AuthenticationRecord } from \"../types.js\";\nimport type { BrowserLoginStyle } from \"../../credentials/interactiveBrowserCredentialOptions.js\";\nimport type { LogPolicyOptions } from \"@azure/core-rest-pipeline\";\nimport type { MultiTenantTokenCredentialOptions } from \"../../credentials/multiTenantTokenCredentialOptions.js\";\nimport type { CredentialLogger } from \"../../util/logging.js\";\n\n/**\n * Options for the MSAL browser flows.\n * @internal\n */\nexport interface MsalBrowserFlowOptions {\n  logger: CredentialLogger;\n\n  /**\n   * The Client ID of the Microsoft Entra application that users will sign into.\n   * This parameter is required on the browser.\n   */\n  clientId?: string;\n\n  /**\n   * The Microsoft Entra tenant (directory) ID.\n   */\n  tenantId?: string;\n\n  /**\n   * The authority host to use for authentication requests.\n   * Possible values are available through {@link AzureAuthorityHosts}.\n   * The default is \"https://login.microsoftonline.com\".\n   */\n  authorityHost?: string;\n\n  /**\n   * Result of a previous authentication that can be used to retrieve the cached credentials of each individual account.\n   * This is necessary to provide in case the application wants to work with more than one account per\n   * Client ID and Tenant ID pair.\n   *\n   * This record can be retrieved by calling to the credential's `authenticate()` method, as follows:\n   *\n   *     const authenticationRecord = await credential.authenticate();\n   *\n   */\n  authenticationRecord?: AuthenticationRecord;\n\n  /**\n   * Makes getToken throw if a manual authentication is necessary.\n   * Developers will need to call to `authenticate()` to control when to manually authenticate.\n   */\n  disableAutomaticAuthentication?: boolean;\n\n  /**\n   * The field determines whether instance discovery is performed when attempting to authenticate.\n   * Setting this to `true` will completely disable both instance discovery and authority validation.\n   * As a result, it's crucial to ensure that the configured authority host is valid and trustworthy.\n   * This functionality is intended for use in scenarios where the metadata endpoint cannot be reached, such as in private clouds or Azure Stack.\n   * The process of instance discovery entails retrieving authority metadata from https://login.microsoft.com/ to validate the authority.\n   */\n  disableInstanceDiscovery?: boolean;\n\n  /**\n   * Options for multi-tenant applications which allows for additionally allowed tenants.\n   */\n  tokenCredentialOptions: MultiTenantTokenCredentialOptions;\n\n  /**\n   * Gets the redirect URI of the application. This should be same as the value\n   * in the application registration portal.  Defaults to `window.location.href`.\n   * This field is no longer required for Node.js.\n   */\n  redirectUri?: string;\n\n  /**\n   * Specifies whether a redirect or a popup window should be used to\n   * initiate the user authentication flow. Possible values are \"redirect\"\n   * or \"popup\" (default) for browser and \"popup\" (default) for node.\n   *\n   */\n  loginStyle: BrowserLoginStyle;\n\n  /**\n   * loginHint allows a user name to be pre-selected for interactive logins.\n   * Setting this option skips the account selection prompt and immediately attempts to login with the specified account.\n   */\n  loginHint?: string;\n\n  /**\n   * Allows users to configure settings for logging policy options, allow logging account information and personally identifiable information for customer support.\n   */\n  loggingOptions?: LogPolicyOptions & {\n    /**\n     * Allows logging account information once the authentication flow succeeds.\n     */\n    allowLoggingAccountIdentifiers?: boolean;\n    /**\n     * Allows logging personally identifiable information for customer support.\n     */\n    enableUnsafeSupportLogging?: boolean;\n  };\n}\n"]}

package/dist/workerd/msal/credentials.d.ts

@@ -0,0 +1,52 @@
+import type { AccessToken, GetTokenOptions } from "@azure/core-auth";
+import type { AuthenticationRecord } from "./types.js";
+/**
+ * The MSAL clients `getToken` requests can receive a `correlationId` and `disableAutomaticAuthentication`.
+ * (which is used to prevent `getToken` from triggering the manual authentication if `getTokenSilent`  fails).
+ * @internal
+ */
+export interface CredentialFlowGetTokenOptions extends GetTokenOptions {
+    /**
+     * Unique identifier useful to track outgoing requests.
+     */
+    correlationId?: string;
+    /**
+     * Makes getToken throw if a manual authentication is necessary.
+     */
+    disableAutomaticAuthentication?: boolean;
+    /**
+     * Authority, to overwrite the default one, if necessary.
+     */
+    authority?: string;
+    /**
+     * Claims received from challenges.
+     */
+    claims?: string;
+    /**
+     * Indicates to allow Continuous Access Evaluation or not
+     */
+    enableCae?: boolean;
+    /**
+     * Client Assertion
+     */
+    getAssertion?: () => Promise<string>;
+}
+/**
+ * Simplified representation of the internal authentication flow.
+ * @internal
+ */
+export interface CredentialFlow {
+    /**
+     * Clears the MSAL cache.
+     */
+    logout(): Promise<void>;
+    /**
+     * Tries to load the active account, either from memory or from MSAL.
+     */
+    getActiveAccount(): Promise<AuthenticationRecord | undefined>;
+    /**
+     * Calls to the implementation's doGetToken method.
+     */
+    getToken(scopes?: string[], options?: CredentialFlowGetTokenOptions): Promise<AccessToken | null>;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/workerd/msal/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/msal/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,6BAA8B,SAAQ,eAAe;IACpE;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;OAEG;IACH,gBAAgB,IAAI,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC9D;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACnG"}

package/dist/workerd/msal/credentials.js

@@ -0,0 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+export {};
+//# sourceMappingURL=credentials.js.map

package/dist/workerd/msal/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/msal/credentials.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport type { AuthenticationRecord } from \"./types.js\";\n\n/**\n * The MSAL clients `getToken` requests can receive a `correlationId` and `disableAutomaticAuthentication`.\n * (which is used to prevent `getToken` from triggering the manual authentication if `getTokenSilent`  fails).\n * @internal\n */\nexport interface CredentialFlowGetTokenOptions extends GetTokenOptions {\n  /**\n   * Unique identifier useful to track outgoing requests.\n   */\n  correlationId?: string;\n  /**\n   * Makes getToken throw if a manual authentication is necessary.\n   */\n  disableAutomaticAuthentication?: boolean;\n  /**\n   * Authority, to overwrite the default one, if necessary.\n   */\n  authority?: string;\n  /**\n   * Claims received from challenges.\n   */\n  claims?: string;\n  /**\n   * Indicates to allow Continuous Access Evaluation or not\n   */\n  enableCae?: boolean;\n  /**\n   * Client Assertion\n   */\n  getAssertion?: () => Promise<string>;\n}\n\n/**\n * Simplified representation of the internal authentication flow.\n * @internal\n */\nexport interface CredentialFlow {\n  /**\n   * Clears the MSAL cache.\n   */\n  logout(): Promise<void>;\n  /**\n   * Tries to load the active account, either from memory or from MSAL.\n   */\n  getActiveAccount(): Promise<AuthenticationRecord | undefined>;\n  /**\n   * Calls to the implementation's doGetToken method.\n   */\n  getToken(scopes?: string[], options?: CredentialFlowGetTokenOptions): Promise<AccessToken | null>;\n}\n"]}

package/dist/workerd/msal/msal.d.ts

@@ -0,0 +1,3 @@
+import * as msalCommon from "@azure/msal-node";
+export { msalCommon };
+//# sourceMappingURL=msal.d.ts.map

package/dist/workerd/msal/msal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal.d.ts","sourceRoot":"","sources":["../../../src/msal/msal.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/workerd/msal/msal.js

@@ -0,0 +1,5 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import * as msalCommon from "@azure/msal-node";
+export { msalCommon };
+//# sourceMappingURL=msal.js.map

package/dist/workerd/msal/msal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal.js","sourceRoot":"","sources":["../../../src/msal/msal.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport * as msalCommon from \"@azure/msal-node\";\n\nexport { msalCommon };\n"]}

package/dist/workerd/msal/nodeFlows/brokerOptions.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Parameters that enable WAM broker authentication in the InteractiveBrowserCredential.
+ */
+export type BrokerOptions = BrokerEnabledOptions | BrokerDisabledOptions;
+/**
+ * Parameters when WAM broker authentication is disabled.
+ */
+export interface BrokerDisabledOptions {
+    /**
+     * If set to true, broker will be enabled for WAM support on Windows.
+     */
+    enabled: false;
+    /**
+     * If set to true, MSA account will be passed through, required for WAM authentication.
+     */
+    legacyEnableMsaPassthrough?: undefined;
+    /**
+     * Window handle for parent window, required for WAM authentication.
+     */
+    parentWindowHandle: undefined;
+}
+/**
+ * Parameters when WAM broker authentication is enabled.
+ */
+export interface BrokerEnabledOptions {
+    /**
+     * If set to true, broker will be enabled for WAM support on Windows.
+     */
+    enabled: true;
+    /**
+     * If set to true, MSA account will be passed through, required for WAM authentication.
+     */
+    legacyEnableMsaPassthrough?: boolean;
+    /**
+     * Window handle for parent window, required for WAM authentication.
+     */
+    parentWindowHandle: Uint8Array;
+    /**
+     * If set to true, the credential will attempt to use the default broker account for authentication before falling back to interactive authentication.
+     * Default is set to false.
+     */
+    useDefaultBrokerAccount?: boolean;
+}
+//# sourceMappingURL=brokerOptions.d.ts.map

package/dist/workerd/msal/nodeFlows/brokerOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brokerOptions.d.ts","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/brokerOptions.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,KAAK,CAAC;IAEf;;OAEG;IACH,0BAA0B,CAAC,EAAE,SAAS,CAAC;IACvC;;OAEG;IACH,kBAAkB,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,IAAI,CAAC;IACd;;OAEG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;OAEG;IACH,kBAAkB,EAAE,UAAU,CAAC;IAE/B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC"}

package/dist/workerd/msal/nodeFlows/brokerOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=brokerOptions.js.map

package/dist/workerd/msal/nodeFlows/brokerOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brokerOptions.js","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/brokerOptions.ts"],"names":[],"mappings":"","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n/**\n * Parameters that enable WAM broker authentication in the InteractiveBrowserCredential.\n */\nexport type BrokerOptions = BrokerEnabledOptions | BrokerDisabledOptions;\n\n/**\n * Parameters when WAM broker authentication is disabled.\n */\nexport interface BrokerDisabledOptions {\n  /**\n   * If set to true, broker will be enabled for WAM support on Windows.\n   */\n  enabled: false;\n\n  /**\n   * If set to true, MSA account will be passed through, required for WAM authentication.\n   */\n  legacyEnableMsaPassthrough?: undefined;\n  /**\n   * Window handle for parent window, required for WAM authentication.\n   */\n  parentWindowHandle: undefined;\n}\n\n/**\n * Parameters when WAM broker authentication is enabled.\n */\nexport interface BrokerEnabledOptions {\n  /**\n   * If set to true, broker will be enabled for WAM support on Windows.\n   */\n  enabled: true;\n  /**\n   * If set to true, MSA account will be passed through, required for WAM authentication.\n   */\n  legacyEnableMsaPassthrough?: boolean;\n  /**\n   * Window handle for parent window, required for WAM authentication.\n   */\n  parentWindowHandle: Uint8Array;\n\n  /**\n   * If set to true, the credential will attempt to use the default broker account for authentication before falling back to interactive authentication.\n   * Default is set to false.\n   */\n  useDefaultBrokerAccount?: boolean;\n}\n"]}