@equinor/fusion-framework-cli 10.7.5-apploader-be21a6b60eb13eee8bf869e75002d8634e9c50a9 → 11.0.0-next.1

package/bin/build/create-auth-client-7P8K_6Vu.js

@@ -0,0 +1,89 @@
+import { PublicClientApplication } from '@azure/msal-node';
+import { PersistenceCachePlugin, PersistenceCreator, DataProtectionScope, Environment } from '@azure/msal-node-extensions';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+/**
+ * Resolves the directory path for storing the authentication cache.
+ *
+ * Uses the user's root directory if available, otherwise falls back to the OS temp directory.
+ *
+ * @returns The resolved cache directory path as a string.
+ */
+const resolveCachePath = () => {
+    return Environment?.getUserRootDirectory() ?? tmpdir();
+};
+/**
+ * Resolves the file path for the authentication cache based on tenant and client IDs.
+ *
+ * @param tenantId - The Azure AD tenant ID.
+ * @param clientId - The Azure AD client/application ID.
+ * @returns The full file path for the cache file.
+ */
+const resolveCacheFilePath = (tenantId, clientId) => {
+    return path.join(resolveCachePath(), `.token-cache-${tenantId}_${clientId}`);
+};
+/**
+ * Creates a persistence cache for storing authentication data securely on disk.
+ *
+ * The cache is encrypted and scoped to the current user for security. It is uniquely identified
+ * by the provided tenant and client IDs, and is associated with the 'fusion-framework' service.
+ *
+ * @param tenantId - The Azure AD tenant ID used to identify the cache.
+ * @param clientId - The Azure AD client/application ID used to identify the cache.
+ * @returns A promise that resolves to the created persistence cache instance.
+ */
+const createPersistenceCache = async (tenantId, clientId) => {
+    return PersistenceCreator.createPersistence({
+        cachePath: resolveCacheFilePath(tenantId, clientId),
+        serviceName: 'fusion-framework',
+        accountName: [tenantId, clientId].join('_'),
+        dataProtectionScope: DataProtectionScope.CurrentUser,
+    });
+};
+/**
+ * Creates a `PersistenceCachePlugin` instance for use with MSAL, using the provided tenant and client IDs.
+ *
+ * This plugin enables MSAL to use the secure persistence cache for token storage.
+ *
+ * @param tenantId - The Azure AD tenant ID.
+ * @param clientId - The Azure AD client/application ID.
+ * @returns A promise that resolves to an instance of `PersistenceCachePlugin`.
+ */
+const createPersistenceCachePlugin = async (tenantId, clientId) => {
+    return new PersistenceCachePlugin(await createPersistenceCache(tenantId, clientId));
+};
+
+/**
+ * Creates and configures a new MSAL PublicClientApplication instance for Azure AD authentication.
+ *
+ * This function sets up the client with the specified tenant and client IDs, and attaches a secure
+ * persistence cache plugin for storing authentication tokens on disk. The resulting client can be used
+ * for both silent and interactive authentication flows, depending on how it is integrated.
+ *
+ * @param tenantId - The Azure Active Directory tenant ID (directory identifier).
+ * @param clientId - The client/application ID registered in Azure AD.
+ * @returns A Promise that resolves to a configured instance of `PublicClientApplication`.
+ *
+ * @remarks
+ * The returned client uses a secure, user-scoped cache for token storage. This is recommended for CLI tools,
+ * background services, and other Node.js applications that require persistent authentication.
+ *
+ * @example
+ * ```typescript
+ * const client = await createAuthClient('your-tenant-id', 'your-client-id');
+ * // Use the client with MSAL APIs for authentication flows
+ * ```
+ */
+const createAuthClient = async (tenantId, clientId) => {
+    const cachePlugin = await createPersistenceCachePlugin(tenantId, clientId);
+    return new PublicClientApplication({
+        auth: {
+            clientId: clientId,
+            authority: `https://login.microsoftonline.com/${tenantId}`,
+        },
+        cache: { cachePlugin },
+    });
+};
+
+export { createAuthClient, createAuthClient as default };