@azure/msal-common 14.0.1 → 14.0.3

package/src/client/SilentFlowClient.ts

@@ -0,0 +1,186 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { BaseClient } from "./BaseClient";
+import { ClientConfiguration } from "../config/ClientConfiguration";
+import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest";
+import { AuthenticationResult } from "../response/AuthenticationResult";
+import { TimeUtils } from "../utils/TimeUtils";
+import { RefreshTokenClient } from "./RefreshTokenClient";
+import {
+    ClientAuthError,
+    ClientAuthErrorMessage,
+} from "../error/ClientAuthError";
+import { ClientConfigurationError } from "../error/ClientConfigurationError";
+import { ResponseHandler } from "../response/ResponseHandler";
+import { CacheRecord } from "../cache/entities/CacheRecord";
+import { CacheOutcome } from "../utils/Constants";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
+import { StringUtils } from "../utils/StringUtils";
+import { checkMaxAge, extractTokenClaims } from "../account/AuthToken";
+import { TokenClaims } from "../account/TokenClaims";
+
+/** @internal */
+export class SilentFlowClient extends BaseClient {
+    constructor(
+        configuration: ClientConfiguration,
+        performanceClient?: IPerformanceClient
+    ) {
+        super(configuration, performanceClient);
+    }
+
+    /**
+     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
+     * the given token and returns the renewed token
+     * @param request
+     */
+    async acquireToken(
+        request: CommonSilentFlowRequest
+    ): Promise<AuthenticationResult> {
+        try {
+            return await this.acquireCachedToken(request);
+        } catch (e) {
+            if (
+                e instanceof ClientAuthError &&
+                e.errorCode === ClientAuthErrorMessage.tokenRefreshRequired.code
+            ) {
+                const refreshTokenClient = new RefreshTokenClient(
+                    this.config,
+                    this.performanceClient
+                );
+                return refreshTokenClient.acquireTokenByRefreshToken(request);
+            } else {
+                throw e;
+            }
+        }
+    }
+
+    /**
+     * Retrieves token from cache or throws an error if it must be refreshed.
+     * @param request
+     */
+    async acquireCachedToken(
+        request: CommonSilentFlowRequest
+    ): Promise<AuthenticationResult> {
+        // Cannot renew token if no request object is given.
+        if (!request) {
+            throw ClientConfigurationError.createEmptyTokenRequestError();
+        }
+
+        if (request.forceRefresh) {
+            // Must refresh due to present force_refresh flag.
+            this.serverTelemetryManager?.setCacheOutcome(
+                CacheOutcome.FORCE_REFRESH
+            );
+            this.logger.info(
+                "SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true."
+            );
+            throw ClientAuthError.createRefreshRequiredError();
+        } else if (
+            !this.config.cacheOptions.claimsBasedCachingEnabled &&
+            !StringUtils.isEmptyObj(request.claims)
+        ) {
+            // Must refresh due to request parameters.
+            this.logger.info(
+                "SilentFlowClient:acquireCachedToken - Skipping cache because claims-based caching is disabled and claims were requested."
+            );
+            throw ClientAuthError.createRefreshRequiredError();
+        }
+
+        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+        if (!request.account) {
+            throw ClientAuthError.createNoAccountInSilentRequestError();
+        }
+
+        const environment =
+            request.authority || this.authority.getPreferredCache();
+
+        const cacheRecord = this.cacheManager.readCacheRecord(
+            request.account,
+            request,
+            environment
+        );
+
+        if (!cacheRecord.accessToken) {
+            // Must refresh due to non-existent access_token.
+            this.serverTelemetryManager?.setCacheOutcome(
+                CacheOutcome.NO_CACHED_ACCESS_TOKEN
+            );
+            this.logger.info(
+                "SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties."
+            );
+            throw ClientAuthError.createRefreshRequiredError();
+        } else if (
+            TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
+            TimeUtils.isTokenExpired(
+                cacheRecord.accessToken.expiresOn,
+                this.config.systemOptions.tokenRenewalOffsetSeconds
+            )
+        ) {
+            // Must refresh due to expired access_token.
+            this.serverTelemetryManager?.setCacheOutcome(
+                CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED
+            );
+            this.logger.info(
+                `SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`
+            );
+            throw ClientAuthError.createRefreshRequiredError();
+        } else if (
+            cacheRecord.accessToken.refreshOn &&
+            TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)
+        ) {
+            // Must refresh due to the refresh_in value.
+            this.serverTelemetryManager?.setCacheOutcome(
+                CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN
+            );
+            this.logger.info(
+                "SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'."
+            );
+            throw ClientAuthError.createRefreshRequiredError();
+        }
+
+        if (this.config.serverTelemetryManager) {
+            this.config.serverTelemetryManager.incrementCacheHits();
+        }
+
+        return await this.generateResultFromCacheRecord(cacheRecord, request);
+    }
+
+    /**
+     * Helper function to build response object from the CacheRecord
+     * @param cacheRecord
+     */
+    private async generateResultFromCacheRecord(
+        cacheRecord: CacheRecord,
+        request: CommonSilentFlowRequest
+    ): Promise<AuthenticationResult> {
+        let idTokenClaims: TokenClaims | undefined;
+        if (cacheRecord.idToken) {
+            idTokenClaims = extractTokenClaims(
+                cacheRecord.idToken.secret,
+                this.config.cryptoInterface.base64Decode
+            );
+        }
+
+        // token max_age check
+        if (request.maxAge || request.maxAge === 0) {
+            const authTime = idTokenClaims?.auth_time;
+            if (!authTime) {
+                throw ClientAuthError.createAuthTimeNotFoundError();
+            }
+
+            checkMaxAge(authTime, request.maxAge);
+        }
+
+        return await ResponseHandler.generateAuthenticationResult(
+            this.cryptoUtils,
+            this.authority,
+            cacheRecord,
+            true,
+            request,
+            idTokenClaims
+        );
+    }
+}

package/src/config/AppTokenProvider.ts

@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * Extensibility interface, which allows the app developer to return a token, based on the passed-in parameters, instead of fetching tokens from
+ * the Identity Provider (AAD).
+ * Developers need to construct and return an AppTokenProviderResult object back to MSAL. MSAL will cache the token response
+ * in the same way it would do if the result were comming from AAD.
+ * This extensibility point is only defined for the client_credential flow, i.e. acquireTokenByClientCredential and
+ * meant for Azure SDK to enhance Managed Identity support.
+ */
+export interface IAppTokenProvider {
+    (
+        appTokenProviderParameters: AppTokenProviderParameters
+    ): Promise<AppTokenProviderResult>;
+}
+
+/**
+ * Input object for the IAppTokenProvider extensiblity. MSAL will create this object, which can be used
+ * to help create an AppTokenProviderResult.
+ *
+ * - correlationId           - the correlation Id associated with the request
+ * - tenantId                - the tenant Id for which the token must be provided
+ * - scopes                  - the scopes for which the token must be provided
+ * - claims                  - any extra claims that the token must satisfy
+ */
+export type AppTokenProviderParameters = {
+    readonly correlationId?: string;
+    readonly tenantId: string;
+    readonly scopes: Array<string>;
+    readonly claims?: string;
+};
+
+/**
+ * Output object for IAppTokenProvider extensiblity.
+ *
+ * - accessToken            - the actual access token, typically in JWT format, that satisfies the request data AppTokenProviderParameters
+ * - expiresInSeconds       - how long the tokens has before expiry, in seconds. Similar to the "expires_in" field in an AAD token response.
+ * - refreshInSeconds       - how long the token has before it should be proactively refreshed. Similar to the "refresh_in" field in an AAD token response.
+ */
+export type AppTokenProviderResult = {
+    accessToken: string;
+    expiresInSeconds: number;
+    refreshInSeconds?: number;
+};

package/src/config/ClientConfiguration.ts

@@ -0,0 +1,287 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { INetworkModule } from "../network/INetworkModule";
+import { DEFAULT_CRYPTO_IMPLEMENTATION, ICrypto } from "../crypto/ICrypto";
+import { AuthError } from "../error/AuthError";
+import { ILoggerCallback, Logger, LogLevel } from "../logger/Logger";
+import { Constants } from "../utils/Constants";
+import { version } from "../packageMetadata";
+import { Authority } from "../authority/Authority";
+import { AzureCloudInstance } from "../authority/AuthorityOptions";
+import { CacheManager, DefaultStorageClass } from "../cache/CacheManager";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager";
+import { ICachePlugin } from "../cache/interface/ICachePlugin";
+import { ISerializableTokenCache } from "../cache/interface/ISerializableTokenCache";
+import { ClientCredentials } from "../account/ClientCredentials";
+import { ProtocolMode } from "../authority/ProtocolMode";
+
+// Token renewal offset default in seconds
+const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
+
+/**
+ * Use the configuration object to configure MSAL Modules and initialize the base interfaces for MSAL.
+ *
+ * This object allows you to configure important elements of MSAL functionality:
+ * - authOptions                - Authentication for application
+ * - cryptoInterface            - Implementation of crypto functions
+ * - libraryInfo                - Library metadata
+ * - telemetry                  - Telemetry options and data
+ * - loggerOptions              - Logging for application
+ * - networkInterface           - Network implementation
+ * - storageInterface           - Storage implementation
+ * - systemOptions              - Additional library options
+ * - clientCredentials          - Credentials options for confidential clients
+ * @internal
+ */
+export type ClientConfiguration = {
+    authOptions: AuthOptions;
+    systemOptions?: SystemOptions;
+    loggerOptions?: LoggerOptions;
+    cacheOptions?: CacheOptions;
+    storageInterface?: CacheManager;
+    networkInterface?: INetworkModule;
+    cryptoInterface?: ICrypto;
+    clientCredentials?: ClientCredentials;
+    libraryInfo?: LibraryInfo;
+    telemetry?: TelemetryOptions;
+    serverTelemetryManager?: ServerTelemetryManager | null;
+    persistencePlugin?: ICachePlugin | null;
+    serializableCache?: ISerializableTokenCache | null;
+};
+
+export type CommonClientConfiguration = {
+    authOptions: Required<AuthOptions>;
+    systemOptions: Required<SystemOptions>;
+    loggerOptions: Required<LoggerOptions>;
+    cacheOptions: Required<CacheOptions>;
+    storageInterface: CacheManager;
+    networkInterface: INetworkModule;
+    cryptoInterface: Required<ICrypto>;
+    libraryInfo: LibraryInfo;
+    telemetry: Required<TelemetryOptions>;
+    serverTelemetryManager: ServerTelemetryManager | null;
+    clientCredentials: ClientCredentials;
+    persistencePlugin: ICachePlugin | null;
+    serializableCache: ISerializableTokenCache | null;
+};
+
+/**
+ * Use this to configure the auth options in the ClientConfiguration object
+ *
+ * - clientId                    - Client ID of your app registered with our Application registration portal : https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredAppsPreview in Microsoft Identity Platform
+ * - authority                   - You can configure a specific authority, defaults to " " or "https://login.microsoftonline.com/common"
+ * - knownAuthorities            - An array of URIs that are known to be valid. Used in B2C scenarios.
+ * - cloudDiscoveryMetadata      - A string containing the cloud discovery response. Used in AAD scenarios.
+ * - clientCapabilities          - Array of capabilities which will be added to the claims.access_token.xms_cc request property on every network request.
+ * - protocolMode                - Enum that represents the protocol that msal follows. Used for configuring proper endpoints.
+ * - skipAuthorityMetadataCache      - A flag to choose whether to use or not use the local metadata cache during authority initialization. Defaults to false.
+ * @internal
+ */
+export type AuthOptions = {
+    clientId: string;
+    authority: Authority;
+    clientCapabilities?: Array<string>;
+    azureCloudOptions?: AzureCloudOptions;
+    skipAuthorityMetadataCache?: boolean;
+};
+
+/**
+ * Use this to configure token renewal info in the Configuration object
+ *
+ * - tokenRenewalOffsetSeconds    - Sets the window of offset needed to renew the token before expiry
+ */
+export type SystemOptions = {
+    tokenRenewalOffsetSeconds?: number;
+    preventCorsPreflight?: boolean;
+};
+
+/**
+ *  Use this to configure the logging that MSAL does, by configuring logger options in the Configuration object
+ *
+ * - loggerCallback                - Callback for logger
+ * - piiLoggingEnabled             - Sets whether pii logging is enabled
+ * - logLevel                      - Sets the level at which logging happens
+ * - correlationId                 - Sets the correlationId printed by the logger
+ */
+export type LoggerOptions = {
+    loggerCallback?: ILoggerCallback;
+    piiLoggingEnabled?: boolean;
+    logLevel?: LogLevel;
+    correlationId?: string;
+};
+
+/**
+ *  Use this to configure credential cache preferences in the ClientConfiguration object
+ *
+ * - claimsBasedCachingEnabled   - Sets whether tokens should be cached based on the claims hash. Default is false.
+ */
+export type CacheOptions = {
+    claimsBasedCachingEnabled?: boolean;
+};
+
+/**
+ * Library-specific options
+ */
+export type LibraryInfo = {
+    sku: string;
+    version: string;
+    cpu: string;
+    os: string;
+};
+
+/**
+ * AzureCloudInstance specific options
+ *
+ * - azureCloudInstance             - string enum providing short notation for soverign and public cloud authorities
+ * - tenant                         - provision to provide the tenant info
+ */
+export type AzureCloudOptions = {
+    azureCloudInstance: AzureCloudInstance;
+    tenant?: string;
+};
+
+export type TelemetryOptions = {
+    application: ApplicationTelemetry;
+};
+
+/**
+ * Telemetry information sent on request
+ * - appName: Unique string name of an application
+ * - appVersion: Version of the application using MSAL
+ */
+export type ApplicationTelemetry = {
+    appName: string;
+    appVersion: string;
+};
+
+export const DEFAULT_SYSTEM_OPTIONS: Required<SystemOptions> = {
+    tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+    preventCorsPreflight: false,
+};
+
+const DEFAULT_LOGGER_IMPLEMENTATION: Required<LoggerOptions> = {
+    loggerCallback: () => {
+        // allow users to not set loggerCallback
+    },
+    piiLoggingEnabled: false,
+    logLevel: LogLevel.Info,
+    correlationId: Constants.EMPTY_STRING,
+};
+
+const DEFAULT_CACHE_OPTIONS: Required<CacheOptions> = {
+    claimsBasedCachingEnabled: false,
+};
+
+const DEFAULT_NETWORK_IMPLEMENTATION: INetworkModule = {
+    async sendGetRequestAsync<T>(): Promise<T> {
+        const notImplErr =
+            "Network interface - sendGetRequestAsync() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async sendPostRequestAsync<T>(): Promise<T> {
+        const notImplErr =
+            "Network interface - sendPostRequestAsync() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+};
+
+const DEFAULT_LIBRARY_INFO: LibraryInfo = {
+    sku: Constants.SKU,
+    version: version,
+    cpu: Constants.EMPTY_STRING,
+    os: Constants.EMPTY_STRING,
+};
+
+const DEFAULT_CLIENT_CREDENTIALS: ClientCredentials = {
+    clientSecret: Constants.EMPTY_STRING,
+    clientAssertion: undefined,
+};
+
+const DEFAULT_AZURE_CLOUD_OPTIONS: AzureCloudOptions = {
+    azureCloudInstance: AzureCloudInstance.None,
+    tenant: `${Constants.DEFAULT_COMMON_TENANT}`,
+};
+
+const DEFAULT_TELEMETRY_OPTIONS: Required<TelemetryOptions> = {
+    application: {
+        appName: "",
+        appVersion: "",
+    },
+};
+
+/**
+ * Function that sets the default options when not explicitly configured from app developer
+ *
+ * @param Configuration
+ *
+ * @returns Configuration
+ */
+export function buildClientConfiguration({
+    authOptions: userAuthOptions,
+    systemOptions: userSystemOptions,
+    loggerOptions: userLoggerOption,
+    cacheOptions: userCacheOptions,
+    storageInterface: storageImplementation,
+    networkInterface: networkImplementation,
+    cryptoInterface: cryptoImplementation,
+    clientCredentials: clientCredentials,
+    libraryInfo: libraryInfo,
+    telemetry: telemetry,
+    serverTelemetryManager: serverTelemetryManager,
+    persistencePlugin: persistencePlugin,
+    serializableCache: serializableCache,
+}: ClientConfiguration): CommonClientConfiguration {
+    const loggerOptions = {
+        ...DEFAULT_LOGGER_IMPLEMENTATION,
+        ...userLoggerOption,
+    };
+
+    return {
+        authOptions: buildAuthOptions(userAuthOptions),
+        systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
+        loggerOptions: loggerOptions,
+        cacheOptions: { ...DEFAULT_CACHE_OPTIONS, ...userCacheOptions },
+        storageInterface:
+            storageImplementation ||
+            new DefaultStorageClass(
+                userAuthOptions.clientId,
+                DEFAULT_CRYPTO_IMPLEMENTATION,
+                new Logger(loggerOptions)
+            ),
+        networkInterface:
+            networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
+        cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
+        libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
+        telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },
+        serverTelemetryManager: serverTelemetryManager || null,
+        persistencePlugin: persistencePlugin || null,
+        serializableCache: serializableCache || null,
+    };
+}
+
+/**
+ * Construct authoptions from the client and platform passed values
+ * @param authOptions
+ */
+function buildAuthOptions(authOptions: AuthOptions): Required<AuthOptions> {
+    return {
+        clientCapabilities: [],
+        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
+        skipAuthorityMetadataCache: false,
+        ...authOptions,
+    };
+}
+
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+export function isOidcProtocolMode(config: ClientConfiguration): boolean {
+    return (
+        config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC
+    );
+}

package/src/crypto/ICrypto.ts

@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "../error/AuthError";
+import { BaseAuthRequest } from "../request/BaseAuthRequest";
+import { SignedHttpRequest } from "./SignedHttpRequest";
+
+/**
+ * The PkceCodes type describes the structure
+ * of objects that contain PKCE code
+ * challenge and verifier pairs
+ */
+export type PkceCodes = {
+    verifier: string;
+    challenge: string;
+};
+
+export type SignedHttpRequestParameters = Pick<
+    BaseAuthRequest,
+    "resourceRequestMethod" | "resourceRequestUri" | "shrClaims" | "shrNonce"
+> & {
+    correlationId?: string;
+};
+
+/**
+ * Interface for crypto functions used by library
+ */
+export interface ICrypto {
+    /**
+     * Creates a guid randomly.
+     */
+    createNewGuid(): string;
+    /**
+     * base64 Encode string
+     * @param input
+     */
+    base64Encode(input: string): string;
+    /**
+     * base64 decode string
+     * @param input
+     */
+    base64Decode(input: string): string;
+    /**
+     * Generate PKCE codes for OAuth. See RFC here: https://tools.ietf.org/html/rfc7636
+     */
+    generatePkceCodes(): Promise<PkceCodes>;
+    /**
+     * Generates an JWK RSA S256 Thumbprint
+     * @param request
+     */
+    getPublicKeyThumbprint(
+        request: SignedHttpRequestParameters
+    ): Promise<string>;
+    /**
+     * Removes cryptographic keypair from key store matching the keyId passed in
+     * @param kid
+     */
+    removeTokenBindingKey(kid: string): Promise<boolean>;
+    /**
+     * Removes all cryptographic keys from IndexedDB storage
+     */
+    clearKeystore(): Promise<boolean>;
+    /**
+     * Returns a signed proof-of-possession token with a given acces token that contains a cnf claim with the required kid.
+     * @param accessToken
+     */
+    signJwt(
+        payload: SignedHttpRequest,
+        kid: string,
+        correlationId?: string
+    ): Promise<string>;
+    /**
+     * Returns the SHA-256 hash of an input string
+     * @param plainText
+     */
+    hashString(plainText: string): Promise<string>;
+}
+
+export const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {
+    createNewGuid: (): string => {
+        const notImplErr =
+            "Crypto interface - createNewGuid() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    base64Decode: (): string => {
+        const notImplErr =
+            "Crypto interface - base64Decode() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    base64Encode: (): string => {
+        const notImplErr =
+            "Crypto interface - base64Encode() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async generatePkceCodes(): Promise<PkceCodes> {
+        const notImplErr =
+            "Crypto interface - generatePkceCodes() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async getPublicKeyThumbprint(): Promise<string> {
+        const notImplErr =
+            "Crypto interface - getPublicKeyThumbprint() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async removeTokenBindingKey(): Promise<boolean> {
+        const notImplErr =
+            "Crypto interface - removeTokenBindingKey() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async clearKeystore(): Promise<boolean> {
+        const notImplErr =
+            "Crypto interface - clearKeystore() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async signJwt(): Promise<string> {
+        const notImplErr =
+            "Crypto interface - signJwt() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+    async hashString(): Promise<string> {
+        const notImplErr =
+            "Crypto interface - hashString() has not been implemented";
+        throw AuthError.createUnexpectedError(notImplErr);
+    },
+};

package/src/crypto/IGuidGenerator.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export interface IGuidGenerator {
+    generateGuid(): string;
+    isGuid(guid: string): boolean;
+}