@equinor/fusion-framework-module-msal 5.1.1 → 6.0.0-next.0

package/src/v2/client/request.ts

@@ -1,66 +0,0 @@
-import type { PopupRequest, RedirectRequest } from '@azure/msal-browser';
-
-/**
- * Request object passed by user to retrieve a Code from the
- * server (first leg of authorization code grant flow).
- *
- * **scopes**\
- * Array of scopes the application is requesting access to.
- *
- * **authority**\
- * Url of the authority which the application acquires tokens from.
- *
- * **correlationId**\
- * Unique GUID set per request to trace a request end-to-end for telemetry purposes.
- *
- * **redirectUri**\
- * The redirect URI where authentication responses can be received by your application. It must exactly match one of the redirect URIs registered in the Azure portal.
- *
- * **extraScopesToConsent**\
- * Scopes for a different resource when the user needs consent upfront.
- *
- * **responseMode**\
- * Specifies the method that should be used to send the authentication result to your app. Fragment is the only valid option for msal-browser.
- *
- * **codeChallenge**\
- * Used to secure authorization code grant via Proof of Key for Code Exchange (PKCE). For more information, see the PKCE RCF:https://tools.ietf.org/html/rfc7636
- *
- * **codeChallengeMethod**\
- * The method used to encode the code verifier for the code challenge parameter. Can be "plain" or "S256". If excluded, code challenge is assumed to be plaintext. For more information, see the PKCE RCF: https://tools.ietf.org/html/rfc7636
- *
- * **state**\
- * A value included in the request that is also returned in the token response. A randomly generated unique value is typically used for preventing cross site request forgery attacks. The state is also used to encode information about the user's state in the app before the authentication request occurred.
- *
- * **prompt**\
- * Indicates the type of user interaction that is required.
- * - login: will force the user to enter their credentials on that request, negating single-sign on
- * - none:  will ensure that the user isn't presented with any interactive prompt. if request can't be completed via single-sign on, the endpoint will return an interaction_required error
- * - consent: will the trigger the OAuth consent dialog after the user signs in, asking the user to grant permissions to the app
- * - select_account: will interrupt single sign-=on providing account selection experience listing all the accounts in session or any remembered accounts or an option to choose to use a different account
- *
- * **loginHint**\
- * Can be used to pre-fill the username/email address field of the sign-in page for the user, if you know the username/email address ahead of time. Often apps use this parameter during re-authentication, having already extracted the username from a previous sign-in using the preferred_username claim.
- *
- * **sid**\
- * Session ID, unique identifier for the session. Available as an optional claim on ID tokens.
- *
- * **domainHint**\
- * Provides a hint about the tenant or domain that the user should use to sign in. The value of the domain hint is a registered domain for the tenant.
- *
- * **extraQueryParameters**\
- * String to string map of custom query parameters.
- *
- * **claims**\
- * In cases where Azure AD tenant admin has enabled conditional access policies, and the policy has not been met, exceptions will contain claims that need to be consented to.
- *
- * **nonce**\
- * A value included in the request that is returned in the id token. A randomly generated unique value is typically used to mitigate replay attacks.
- *
- * **redirectStartPage**\
- * The page that should be returned to after loginRedirect or acquireTokenRedirect.
- * This should only be used if this is different from the redirectUri and will default to the page that initiates the request.
- * When the navigateToLoginRequestUrl config option is set to false this parameter will be ignored.
- *
- * @see [microsoft-authentication-library-for-js](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/lib/msal-browser/src/request)
- */
-export type AuthRequest = PopupRequest | RedirectRequest;

package/src/v2/configurator.ts

@@ -1,58 +0,0 @@
-import z from 'zod';
-
-import { BaseConfigBuilder } from '@equinor/fusion-framework-module';
-
-import { MsalModuleVersion } from '../static';
-import semver from 'semver';
-import type { IAuthProvider } from './provider';
-
-const VersionSchema = z.string().transform((x: string) => String(semver.coerce(x)));
-
-const AuthClientConfigSchema = z.object({
-  clientId: z.string(),
-  tenantId: z.string(),
-  redirectUri: z.string().optional(),
-});
-
-// NOTE: this might need refinement to validate the provider
-const AuthClientSchema = z.custom<IAuthProvider>();
-
-const AuthConfigSchema = z.object({
-  client: AuthClientConfigSchema.optional(),
-  provider: AuthClientSchema.optional(),
-  requiresAuth: z.boolean().optional(),
-  version: VersionSchema,
-});
-
-export type AuthClientConfig = z.infer<typeof AuthClientConfigSchema>;
-export type AuthConfig = z.infer<typeof AuthConfigSchema>;
-
-export class AuthConfigurator extends BaseConfigBuilder<AuthConfig> {
-  public version = MsalModuleVersion.Latest as const;
-
-  constructor() {
-    super();
-    this._set('version', async () => this.version);
-  }
-
-  setClientConfig(config?: z.infer<typeof AuthClientConfigSchema>): void {
-    this._set('client', async () => config);
-  }
-
-  setRequiresAuth(requiresAuth: boolean): void {
-    this._set('requiresAuth', async () => requiresAuth);
-  }
-
-  setProvider(provider?: z.infer<typeof AuthClientSchema>): void {
-    this._set('provider', async () => provider);
-  }
-
-  setVersion(version: string): void {
-    this._set('version', async () => version);
-  }
-
-  async _processConfig(config: AuthConfig): Promise<AuthConfig> {
-    // TODO: handle parsing of clientConfig
-    return AuthConfigSchema.parseAsync(config);
-  }
-}

package/src/v2/index.ts

@@ -1,2 +0,0 @@
-export { type AuthConfig, AuthConfigurator, AuthClientConfig } from './configurator';
-export { type IAuthProvider, AuthProvider } from './provider';

package/src/v2/provider.ts

@@ -1,178 +0,0 @@
-import { type AuthClient, createAuthClient, type AuthRequest, ConsoleLogger } from './client';
-
-import { MsalModuleVersion } from '../static';
-
-import type { AuthClientConfig } from './configurator';
-import type { AccountInfo, AuthenticationResult } from './types';
-import type { IProxyProvider } from '../types';
-import { resolveVersion } from '../versioning/resolve-version';
-import { BaseModuleProvider } from '@equinor/fusion-framework-module/provider';
-
-export interface IAuthProvider {
-  // readonly defaultClient: AuthClient;
-  /**
-   * @deprecated
-   */
-  // biome-ignore lint/suspicious/noExplicitAny: this is deprecated
-  readonly defaultConfig: any | undefined;
-  readonly defaultAccount: AccountInfo | undefined;
-
-  readonly client: AuthClient;
-
-  /**
-   * Acquire token from default auth client
-   * @param req Auth request options
-   */
-  acquireToken(req: AuthRequest): Promise<AuthenticationResult | void>;
-
-  /**
-   * Acquire access token from default auth client
-   * @param req Auth request options
-   */
-  acquireAccessToken(req: AuthRequest): Promise<string | undefined>;
-
-  /**
-   * Login to default auth client
-   */
-  login(): Promise<void>;
-
-  /**
-   * Logout
-   */
-  logout(options?: { redirectUri?: string }): Promise<void>;
-
-  /**
-   * Handle default client redirect callback
-   */
-  handleRedirect(): Promise<void | null>;
-}
-
-export class AuthProvider
-  extends BaseModuleProvider<AuthClientConfig>
-  implements IAuthProvider, IProxyProvider
-{
-  #client: AuthClient;
-
-  get defaultAccount(): AccountInfo | undefined {
-    return this.client.account;
-  }
-
-  /** @deprecated */
-  get defaultConfig(): AuthClientConfig | undefined {
-    return this._config;
-  }
-
-  constructor(protected _config: AuthClientConfig) {
-    super({
-      version: MsalModuleVersion.Latest,
-      config: _config,
-    });
-    this.#client = this.createClient();
-  }
-
-  get client(): AuthClient {
-    return this.#client;
-  }
-
-  /** @deprecated */
-  createClient(): AuthClient {
-    const client = createAuthClient(
-      this._config.tenantId,
-      this._config.clientId,
-      this._config.redirectUri,
-    );
-    // TODO - fix with log streamer
-    client.setLogger(new ConsoleLogger(0));
-
-    return client;
-  }
-
-  async handleRedirect() {
-    const { redirectUri } = this.defaultConfig || {};
-    if (window.location.pathname === redirectUri) {
-      const logger = this.client.getLogger();
-      const { requestOrigin } = this.client;
-
-      await this.client.handleRedirectPromise();
-      if (requestOrigin === redirectUri) {
-        logger.warning(`detected callback loop from url ${redirectUri}, redirecting to root`);
-        window.location.replace('/');
-      } else {
-        window.location.replace(requestOrigin || '/');
-      }
-    }
-    return null;
-  }
-
-  acquireToken(req: AuthRequest): ReturnType<IAuthProvider['acquireToken']> {
-    return this.client.acquireToken(req);
-  }
-
-  async acquireAccessToken(req: AuthRequest) {
-    const token = await this.acquireToken(req);
-    return token ? token.accessToken : undefined;
-  }
-
-  async login(options?: { onlyIfRequired?: boolean }) {
-    // skip login if already logged in and has valid claims
-    if (options?.onlyIfRequired && this.client.hasValidClaims) {
-      return;
-    }
-    await this.client.login();
-  }
-
-  async logout(options?: { redirectUri?: string }): Promise<void> {
-    // TODO - might have an option for popup or redirect
-    await this.client.logoutRedirect({
-      postLogoutRedirectUri: options?.redirectUri,
-      account: this.defaultAccount,
-    });
-  }
-
-  createProxyProvider<T = IAuthProvider>(version: string): T {
-    // TODO - check if version is supported and telemetry
-    const { enumVersion } = resolveVersion(version);
-    switch (enumVersion) {
-      case MsalModuleVersion.V2:
-      case MsalModuleVersion.Latest:
-        return this._createProxyProvider_v2() as T;
-      default:
-        throw new Error(`Version ${version} is not supported`);
-    }
-  }
-
-  _createProxyProvider_v2(): IAuthProvider {
-    const proxy = new Proxy(this, {
-      get: (target: AuthProvider, prop: keyof AuthProvider) => {
-        switch (prop) {
-          case 'version':
-            return target.version;
-          case 'dispose':
-            return target.dispose.bind(target);
-          case 'client':
-            return target.client;
-          // @ts-expect-error this is deprecated since version 5.0.1
-          case 'defaultClient':
-            console.warn('defaultClient is deprecated, use client instead');
-            return target.client;
-          case 'defaultAccount':
-            return target.defaultAccount;
-          case 'defaultConfig':
-            return target.defaultConfig;
-          case 'acquireToken':
-            return target.acquireToken.bind(target);
-          case 'acquireAccessToken':
-            return target.acquireAccessToken.bind(target);
-          case 'login':
-            return target.login.bind(target);
-          case 'handleRedirect':
-            return target.handleRedirect.bind(target);
-          case 'createProxyProvider':
-            return target.createProxyProvider.bind(target);
-        }
-      },
-    });
-
-    return proxy;
-  }
-}