@deploybaseline/microsoft 0.0.0-stage → 0.14.1

package/dist/chunk-PBJS3RQA.js

@@ -0,0 +1,41 @@
+// src/manifest.ts
+var manifest = {
+  name: "microsoft",
+  seedKey: "microsoft",
+  aliases: [],
+  // 2: Outlook moved to one Exchange store (mail, calendar, contacts, To Do), replacing the mail collections.
+  stateVersion: 2,
+  identities: true,
+  label: "Microsoft Entra ID OAuth 2.0 / OpenID Connect, Microsoft Graph (users, groups, Outlook mail, calendar, contacts, To Do) and SharePoint Online (Graph and REST) emulator",
+  endpoints: "OAuth authorize, token exchange, userinfo, OIDC discovery, logout, token revocation; Graph /me, /users, /groups, mail folders, messages, sendMail, attachments, mailboxSettings, calendars, events, calendarView, getSchedule, findMeetingTimes, contacts, To Do, places, subscriptions, $batch; SharePoint sites, lists, items, drives, files, permissions, sharing and search on Graph, SharePoint REST /_api, upload sessions and download URLs",
+  async load() {
+    const mod = await import("./index.js");
+    return { plugin: mod.microsoftPlugin, seedFromConfig: mod.seedFromConfig, mapIdentity: mod.mapIdentity };
+  },
+  defaultFallback(cfg) {
+    const firstEmail = cfg?.users?.[0]?.email ?? "testuser@outlook.com";
+    return {
+      login: firstEmail,
+      id: 1,
+      scopes: ["openid", "email", "profile", "User.Read", "User.ReadWrite.All", "Mail.ReadWrite", "Mail.Send"]
+    };
+  },
+  initConfig: {
+    microsoft: {
+      users: [{ email: "testuser@outlook.com", name: "Test User" }],
+      oauth_clients: [
+        {
+          client_id: "example-client-id",
+          client_secret: "example-client-secret",
+          name: "My Microsoft App",
+          redirect_uris: ["http://localhost:3000/api/auth/callback/microsoft-entra-id"]
+        }
+      ]
+    }
+  }
+};
+
+export {
+  manifest
+};
+//# sourceMappingURL=chunk-PBJS3RQA.js.map

package/dist/chunk-PBJS3RQA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/manifest.ts"],"sourcesContent":["import type { ProviderManifest } from \"@deploybaseline/core\";\n\n// Cheap metadata for the CLI. Keep the provider behind load().\nexport const manifest: ProviderManifest<\"microsoft\"> = {\n  name: \"microsoft\",\n  seedKey: \"microsoft\",\n  aliases: [],\n  // 2: Outlook moved to one Exchange store (mail, calendar, contacts, To Do), replacing the mail collections.\n  stateVersion: 2,\n  identities: true,\n  label:\n    \"Microsoft Entra ID OAuth 2.0 / OpenID Connect, Microsoft Graph (users, groups, Outlook mail, calendar, contacts, To Do) and SharePoint Online (Graph and REST) emulator\",\n  endpoints:\n    \"OAuth authorize, token exchange, userinfo, OIDC discovery, logout, token revocation; Graph /me, /users, /groups, mail folders, messages, sendMail, attachments, mailboxSettings, calendars, events, calendarView, getSchedule, findMeetingTimes, contacts, To Do, places, subscriptions, $batch; SharePoint sites, lists, items, drives, files, permissions, sharing and search on Graph, SharePoint REST /_api, upload sessions and download URLs\",\n  async load() {\n    const mod = await import(\"./index.js\");\n    return { plugin: mod.microsoftPlugin, seedFromConfig: mod.seedFromConfig, mapIdentity: mod.mapIdentity };\n  },\n  defaultFallback(cfg) {\n    const firstEmail = (cfg?.users as Array<{ email?: string }> | undefined)?.[0]?.email ?? \"testuser@outlook.com\";\n    return {\n      login: firstEmail,\n      id: 1,\n      scopes: [\"openid\", \"email\", \"profile\", \"User.Read\", \"User.ReadWrite.All\", \"Mail.ReadWrite\", \"Mail.Send\"],\n    };\n  },\n  initConfig: {\n    microsoft: {\n      users: [{ email: \"testuser@outlook.com\", name: \"Test User\" }],\n      oauth_clients: [\n        {\n          client_id: \"example-client-id\",\n          client_secret: \"example-client-secret\",\n          name: \"My Microsoft App\",\n          redirect_uris: [\"http://localhost:3000/api/auth/callback/microsoft-entra-id\"],\n        },\n      ],\n    },\n  },\n};\n"],"mappings":";AAGO,IAAM,WAA0C;AAAA,EACrD,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS,CAAC;AAAA;AAAA,EAEV,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,OACE;AAAA,EACF,WACE;AAAA,EACF,MAAM,OAAO;AACX,UAAM,MAAM,MAAM,OAAO,YAAY;AACrC,WAAO,EAAE,QAAQ,IAAI,iBAAiB,gBAAgB,IAAI,gBAAgB,aAAa,IAAI,YAAY;AAAA,EACzG;AAAA,EACA,gBAAgB,KAAK;AACnB,UAAM,aAAc,KAAK,QAAkD,CAAC,GAAG,SAAS;AACxF,WAAO;AAAA,MACL,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,QAAQ,CAAC,UAAU,SAAS,WAAW,aAAa,sBAAsB,kBAAkB,WAAW;AAAA,IACzG;AAAA,EACF;AAAA,EACA,YAAY;AAAA,IACV,WAAW;AAAA,MACT,OAAO,CAAC,EAAE,OAAO,wBAAwB,MAAM,YAAY,CAAC;AAAA,MAC5D,eAAe;AAAA,QACb;AAAA,UACE,WAAW;AAAA,UACX,eAAe;AAAA,UACf,MAAM;AAAA,UACN,eAAe,CAAC,4DAA4D;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,355 @@
+import * as _deploybaseline_core from '@deploybaseline/core';
+import { Entity, Collection, Store, IdentityMapping, SigningKeySeed } from '@deploybaseline/core';
+export { manifest } from './manifest.js';
+
+interface MicrosoftSeedMessage {
+    /** The mailbox owner: a seeded user's email or userPrincipalName, or a shared mailbox address. */
+    user: string;
+    /** A distinguished folder (`inbox`, `sentitems`, `drafts`, `archive`, ...) or a folder name to create. Default `inbox`. */
+    folder?: string;
+    from: string;
+    to?: string[];
+    cc?: string[];
+    subject?: string;
+    body?: string;
+    body_type?: "text" | "html";
+    is_read?: boolean;
+    importance?: "low" | "normal" | "high";
+    categories?: string[];
+    flagged?: boolean;
+    /** ISO 8601; defaults to now. */
+    received_at?: string;
+}
+
+/**
+ * Seed configuration for SharePoint (the `sharepoint:` block of the
+ * Microsoft seed config): tenant hostname, site collections and subsites,
+ * site membership, lists and libraries with columns, items, folders and
+ * files, and Selected permission grants for applications.
+ */
+
+interface SharePointColumnSeed {
+    /** Internal name. */
+    name: string;
+    display_name?: string;
+    /**
+     * Shorthand type: text, note, number, currency, choice, multichoice,
+     * dateTime, dateOnly, boolean, person, personMulti, lookup, hyperlink.
+     * Alternatively pass a Graph columnDefinition facet under `graph`.
+     */
+    type?: string;
+    choices?: string[];
+    required?: boolean;
+    indexed?: boolean;
+    /** Lookup target list title (same web) and column. */
+    lookup_list?: string;
+    lookup_column?: string;
+    default_value?: string;
+    /** Raw Graph columnDefinition body (overrides the shorthand). */
+    graph?: Record<string, unknown>;
+}
+interface SharePointListSeed {
+    title: string;
+    /** genericList (default), documentLibrary, or a template number. */
+    template?: string | number;
+    /** URL segment (e.g. "Lists/Tasks" or "Contracts"). */
+    url?: string;
+    description?: string;
+    columns?: SharePointColumnSeed[];
+    /** List items: field values by internal name. Person fields take an email. */
+    items?: Record<string, unknown>[];
+    /** Folders relative to the list root, e.g. "Reports/2026". */
+    folders?: string[];
+    /** Files relative to the library root, with text or base64 content. */
+    files?: Array<{
+        path: string;
+        content?: string;
+        content_base64?: string;
+        fields?: Record<string, unknown>;
+        author?: string;
+    }>;
+    /** Break inheritance and grant these users (email to role: read, contribute, edit, full). */
+    permissions?: Record<string, "read" | "contribute" | "edit" | "design" | "full">;
+    versioning?: {
+        major?: boolean;
+        minor?: boolean;
+        require_checkout?: boolean;
+        content_approval?: boolean;
+    };
+}
+/** What a site collection and a subsite both have. */
+interface SharePointWebSeed {
+    /** Server-relative URL: "/" for the root site, "/sites/alpha", "/teams/x". */
+    url: string;
+    title: string;
+    description?: string;
+    owners?: string[];
+    members?: string[];
+    visitors?: string[];
+    lists?: SharePointListSeed[];
+    /** Allow custom script on the site (default false, as on modern sites: AddAndCustomizePages is withheld). */
+    custom_script?: boolean;
+    /** Sites.Selected grants: app client id and roles (read, write, manage, fullcontrol). */
+    grants?: Array<{
+        app_id: string;
+        app_name?: string;
+        roles: string[];
+        list?: string;
+        item?: number;
+    }>;
+}
+interface SharePointSiteSeed extends SharePointWebSeed {
+    /** Email of a Microsoft 365 group from `groups:` (group-connected team site). */
+    group?: string;
+    subsites?: SharePointSubsiteSeed[];
+}
+/** A subsite: a site with no group of its own and no subsites. */
+interface SharePointSubsiteSeed extends SharePointWebSeed {
+    /** Break role inheritance from the parent site. */
+    unique_permissions?: boolean;
+}
+interface SharePointSeedConfig {
+    /** Tenant hostname (default contoso.sharepoint.com). */
+    hostname?: string;
+    /** Origin of issued download/upload/monitor URLs (default: the emulator base URL). */
+    access_origin?: string;
+    /** Virtual delay for asynchronous copy jobs in ms (default 0: done on first poll). */
+    copy_delay_ms?: number;
+    /** Virtual delay before a write becomes visible to search in ms (default 0). */
+    search_index_delay_ms?: number;
+    /** How long an upload session stays usable after its stated expiration in ms (default 3600000, as observed; 0: strict). */
+    upload_session_grace_ms?: number;
+    /** Graph page size for list items (default 200). */
+    graph_page_size?: number;
+    /** REST page size for list items (default 100). */
+    rest_page_size?: number;
+    /** false: refuse new subsites (web/webs/add), like tenants with subsite creation turned off (default true). */
+    allow_subsite_creation?: boolean;
+    sites?: SharePointSiteSeed[];
+}
+
+interface MicrosoftUser extends Entity {
+    /** Object ID (oid): the user's Graph `id`. */
+    oid: string;
+    /** Sign-in name, the OAuth `email` claim. Kept equal to `preferred_username`. */
+    email: string;
+    name: string;
+    given_name: string;
+    family_name: string;
+    email_verified: boolean;
+    /** Microsoft tenant ID */
+    tenant_id: string;
+    /** User principal name (usually email) */
+    preferred_username: string;
+    /** Graph `mail`. Undefined reads as `email`; null means the user has no mail address. */
+    mail?: string | null;
+    account_enabled?: boolean;
+    job_title?: string | null;
+    department?: string | null;
+    office_location?: string | null;
+    mobile_phone?: string | null;
+    business_phones?: string[];
+    mail_nickname?: string;
+    user_type?: "Member" | "Guest";
+    usage_location?: string | null;
+    company_name?: string | null;
+    employee_id?: string | null;
+    city?: string | null;
+    country?: string | null;
+    preferred_language?: string | null;
+    force_change_password?: boolean;
+    /** Other Graph user properties by their Graph names (seed `profile`), e.g. `{ employeeType: "Contractor" }`. They win over the typed fields. */
+    profile?: Record<string, unknown>;
+}
+interface MicrosoftOAuthClient extends Entity {
+    client_id: string;
+    /** Empty for an app that signs in only with a certificate. */
+    client_secret: string;
+    name: string;
+    redirect_uris: string[];
+    /** Tenant ID this app is registered in */
+    tenant_id: string;
+    /** Graph application permissions (app roles) granted to the app; client credentials tokens carry them as `roles`. */
+    application_permissions?: string[];
+    /** Graph delegated permissions configured on the app; what a delegated `.default` request grants. */
+    delegated_permissions?: string[];
+    /** PEM certificates registered on the app; client_credentials accepts assertions signed by their keys. */
+    certificates?: string[];
+    /** App roles per non-Graph resource URI (client_credentials tokens for that resource carry these). */
+    resource_permissions?: Record<string, string[]>;
+}
+
+interface MicrosoftStore {
+    users: Collection<MicrosoftUser>;
+    oauthClients: Collection<MicrosoftOAuthClient>;
+}
+declare function getMicrosoftStore(store: Store): MicrosoftStore;
+
+/** How a shared identity (`identities:` in the config) becomes a user in this provider's seed. */
+declare const mapIdentity: IdentityMapping;
+
+interface MicrosoftSeedUser {
+    email: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    tenant_id?: string;
+    /** Graph `mail`, which is also the mailbox address; defaults to `email`. `null` gives the user no mailbox. */
+    mail?: string | null;
+    account_enabled?: boolean;
+    job_title?: string;
+    department?: string;
+    office_location?: string;
+    mobile_phone?: string;
+    business_phones?: string[];
+    company_name?: string;
+    employee_id?: string;
+    city?: string;
+    country?: string;
+    usage_location?: string;
+    preferred_language?: string;
+    user_type?: "Member" | "Guest";
+    /** Other Graph user properties by their Graph names, e.g. `{ employeeType: "Contractor" }`. They win over the fields above. */
+    profile?: Record<string, unknown>;
+    /** Exchange REST id form for this mailbox: "compact" (AQMk..., default) or "standard" (AAMk...). */
+    id_format?: "compact" | "standard";
+    /**
+     * The user has opened Focused Inbox in Outlook on the web, which leaves two
+     * search folders under searchfolders: OwaFV15.1AllFocused and
+     * OwaFV15.1AllOther followed by the Inbox id (default false).
+     */
+    outlook_web?: boolean;
+    /**
+     * Regional settings the user chose on first sign-in to Outlook. Without them
+     * the mailbox reports no timeZone, language { lCID: 0 } and workingHours {}.
+     */
+    mailbox_settings?: {
+        /** Windows time zone name, e.g. "Pacific Standard Time". Also used for working hours. */
+        time_zone?: string;
+        /** Locale, e.g. "en-US" (default when time_zone is set). */
+        locale?: string;
+    };
+}
+interface MicrosoftSeedConfig {
+    /** Directory (tenant) ID placed in tokens and transport headers. Default `9188040d-6c67-4c5b-b112-36a304b66dad`. */
+    tenant_id?: string;
+    /** Primary SMTP domain. Defaults to the domain of the first user. */
+    domain?: string;
+    /** Pin the token signing key: an RSA private JWK. */
+    signing_key?: SigningKeySeed;
+    users?: MicrosoftSeedUser[];
+    /** Mailboxes without a sign-in account (Exchange shared mailboxes). */
+    shared_mailboxes?: Array<{
+        email: string;
+        name?: string;
+        id_format?: "compact" | "standard";
+    }>;
+    oauth_clients?: Array<{
+        client_id: string;
+        /** Omit for an app that signs in only with a certificate: secret authentication is then refused. */
+        client_secret?: string;
+        name: string;
+        /** Omit for an app that only uses client credentials. */
+        redirect_uris?: string[];
+        tenant_id?: string;
+        /** Graph application permissions granted to the app (client credentials `roles`). Omit for every modeled one. */
+        application_permissions?: string[];
+        /** Graph delegated permissions a delegated `.default` request grants. Omit for every modeled one. */
+        delegated_permissions?: string[];
+        /** PEM certificates (public part) registered on the app, for certificate credentials (private_key_jwt). */
+        certificates?: string[];
+        /** App roles per non-Graph resource, keyed by resource URI, e.g. `{ "https://contoso.sharepoint.com": ["Sites.Manage.All"] }`. */
+        resource_permissions?: Record<string, string[]>;
+    }>;
+    /** Domains `POST /users` accepts in a userPrincipalName, besides those of seeded users. */
+    verified_domains?: string[];
+    /** Messages placed in seeded mailboxes. */
+    messages?: MicrosoftSeedMessage[];
+    /** Room mailboxes (places API, free/busy and automatic meeting processing). */
+    rooms?: Array<{
+        email: string;
+        name?: string;
+        capacity?: number;
+        building?: string;
+        floor_number?: number;
+        floor_label?: string;
+        label?: string;
+        phone?: string;
+        nickname?: string;
+        is_wheelchair_accessible?: boolean;
+        booking_type?: "standard" | "reserved";
+        tags?: string[];
+        audio_device_name?: string;
+        video_device_name?: string;
+        display_device_name?: string;
+        address?: {
+            street?: string;
+            city?: string;
+            state?: string;
+            country_or_region?: string;
+            postal_code?: string;
+        };
+        /** Room list addresses this room belongs to. */
+        room_lists?: string[];
+    }>;
+    /** Room lists (distribution groups of rooms). */
+    room_lists?: Array<{
+        email: string;
+        name?: string;
+        phone?: string;
+    }>;
+    /** Microsoft 365 groups with a group mailbox and calendar. Members and owners are user addresses. */
+    groups?: Array<{
+        email: string;
+        name?: string;
+        description?: string;
+        members?: string[];
+        owners?: string[];
+        visibility?: "Public" | "Private";
+        /** Team-backed group: creationOptions and resource options as Teams sets them. */
+        team?: boolean;
+    }>;
+    /** Exchange mailbox delegation (Add-MailboxPermission and Add-RecipientPermission). */
+    mailbox_permissions?: Array<{
+        mailbox: string;
+        user: string;
+        rights: Array<"FullAccess" | "SendAs" | "SendOnBehalf">;
+    }>;
+    /** SharePoint Online: hostname, sites, lists, libraries, files and app grants. */
+    sharepoint?: SharePointSeedConfig;
+    graph?: {
+        /** Milliseconds between send and delivery (default 1000). 0 delivers synchronously. */
+        delivery_delay_ms?: number;
+        /** Reject unknown bearer tokens with 401 like Graph does, instead of acting as the CLI's fallback user (default false). */
+        strict_auth?: boolean;
+        /** Restrict app-only access per client ID to these mailboxes (ApplicationAccessPolicy). */
+        application_access_policies?: Record<string, string[]>;
+        /** Skip the subscription notificationUrl validation handshake. */
+        skip_subscription_validation?: boolean;
+        /** Accept http:// notification URLs (Graph requires https; default false). */
+        allow_http_notifications?: boolean;
+        /** Refuse directory ids other than the seeded tenants (AADSTS90002), as Entra ID does (default false). */
+        strict_tenants?: boolean;
+        /**
+         * Add the To Do "Flagged Emails" list, synced from message flags (default false).
+         * true turns it on for every mailbox; a list of addresses turns it on for those
+         * only (each user turns it on in To Do settings).
+         */
+        todo_flagged_emails?: boolean | string[];
+        /** Online meeting provider of the tenant: "teamsForBusiness" or "unknown" (default, no Teams). */
+        online_meeting_provider?: "teamsForBusiness" | "unknown";
+    };
+}
+/** The modules in registration order: OAuth, the Graph request layer, Graph's API modules, then SharePoint. */
+declare const microsoftModules: readonly [_deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule, _deploybaseline_core.ServiceModule];
+/** Entra ID and Microsoft Graph: one service, one store, one seed key (`microsoft:`). */
+declare const microsoftPlugin: _deploybaseline_core.ComposedService;
+declare function seedFromConfig(store: Store, _baseUrl: string, config: MicrosoftSeedConfig): void;
+/**
+ * Deliver every message waiting in the emulated transport now (tests and
+ * tooling). `advanceMs` also runs background processing due within that time.
+ */
+declare function flushTransport(store: Store, advanceMs?: number): number;
+
+export { microsoftPlugin as default, flushTransport, getMicrosoftStore, mapIdentity, microsoftModules, microsoftPlugin, seedFromConfig };
+export type { MicrosoftOAuthClient, MicrosoftSeedConfig, MicrosoftSeedMessage, MicrosoftSeedUser, MicrosoftStore, MicrosoftUser, SharePointColumnSeed, SharePointListSeed, SharePointSeedConfig, SharePointSiteSeed };