@knowttl/mg-axi 0.1.0

package/dist/app-auth.js

@@ -0,0 +1,47 @@
+import { AxiError } from "axi-sdk-js";
+import { validateApplicationProfile } from "./profiles.js";
+// The configured Graph audience is the app's consented application grants, never a per-command subset.
+export const graphAudience = (profile) => `https://graph.microsoft.com/.default`;
+// This service is the application credential boundary for CORE-01; tokens never reach CLI output.
+// It has no login method: application profiles never invoke interactive login or delegated fallback.
+export class ApplicationAuth {
+    provider;
+    now;
+    cache = new Map();
+    constructor(provider, now = Date.now) {
+        this.provider = provider;
+        this.now = now;
+    }
+    async credential(profile, scopes = [graphAudience(profile)]) {
+        profile = validateApplicationProfile(profile);
+        const requested = this.audience(profile, scopes);
+        const key = this.key(profile, requested);
+        const hit = this.cache.get(key);
+        if (hit && hit.expiresAt > this.now() + 60_000)
+            return { ...hit };
+        this.cache.delete(key);
+        try {
+            const credential = this.check(profile, await this.provider.acquire(profile, requested));
+            // One identity per profile: a replacement wipes rather than merges.
+            this.cache.clear();
+            this.cache.set(key, credential);
+            return { ...credential };
+        }
+        catch {
+            throw this.failure();
+        }
+    }
+    audience(profile, scopes) {
+        const configured = [graphAudience(profile)];
+        if (scopes.length !== 1 || scopes[0] !== configured[0])
+            throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", ["mg-axi profile show --profile <name>", "Application permissions apply to the app registration, not to individual commands"]);
+        return configured;
+    }
+    key(profile, scopes) { return JSON.stringify([profile.credentialRef, profile.tenantId, profile.clientId, profile.cloud, scopes]); }
+    check(profile, credential) {
+        if (!credential.token || credential.tenantId.toLowerCase() !== profile.tenantId.toLowerCase() || credential.clientId.toLowerCase() !== profile.clientId.toLowerCase() || !Number.isFinite(credential.expiresAt) || credential.expiresAt <= this.now() + 60_000)
+            throw new Error("Invalid credential context");
+        return { ...credential };
+    }
+    failure() { return new AxiError("Application authentication failed for the configured identity; no user or device-code fallback was attempted", "AUTH_REQUIRED", ["mg-axi profile show --profile <name>", "Ask an administrator to grant application consent for the Graph .default audience on this app registration", "Confirm the certificate thumbprint or federated credential mapping on the app registration"]); }
+}

package/dist/auth.js

@@ -0,0 +1,59 @@
+import { AxiError } from "axi-sdk-js";
+import { validateDelegatedProfile } from "./profiles.js";
+// This service is the credential boundary for CORE-01; tokens never reach CLI output.
+export class DelegatedAuth {
+    provider;
+    now;
+    cache = new Map();
+    constructor(provider, now = Date.now) {
+        this.provider = provider;
+        this.now = now;
+    }
+    async login(profile, method = "browser", scopes = []) {
+        profile = validateDelegatedProfile(profile);
+        if (method !== "browser" && method !== "device-code")
+            throw new AxiError("Login method must be browser or device-code", "VALIDATION_ERROR", ["mg-axi login --help"]);
+        if (method === "device-code" && !profile.allowDeviceCode)
+            throw new AxiError("Device code is disabled for this profile", "VALIDATION_ERROR", ["Enable device code only when organization policy permits it; browser login is the default"]);
+        const requested = this.scopes(scopes);
+        const key = this.key(profile, requested);
+        this.cache.clear();
+        try {
+            const credential = this.check(profile, await this.provider.login(profile, method, requested));
+            this.cache.set(key, credential);
+            return { status: "authenticated", mode: "delegated", storage: this.provider.storage };
+        }
+        catch {
+            throw this.failure("LOGIN_FAILED");
+        }
+    }
+    async credential(profile, scopes) {
+        profile = validateDelegatedProfile(profile);
+        const requested = this.scopes(scopes);
+        const key = this.key(profile, requested);
+        const hit = this.cache.get(key);
+        if (hit && hit.expiresAt > this.now() + 60_000)
+            return { ...hit };
+        this.cache.delete(key);
+        try {
+            const credential = this.check(profile, await this.provider.silent(profile, requested));
+            this.cache.set(key, credential);
+            return { ...credential };
+        }
+        catch {
+            throw this.failure("AUTH_REQUIRED");
+        }
+    }
+    scopes(scopes) {
+        if (!scopes.length || scopes.some(scope => !/^https:\/\/graph\.microsoft\.com\/[A-Za-z][A-Za-z.-]+$/.test(scope) || scope.endsWith("/.default")))
+            throw new AxiError("Explicit delegated Graph scopes are required", "VALIDATION_ERROR", ["mg-axi login --profile <name> --scopes <comma-separated-Graph-scopes>"]);
+        return [...new Set(scopes)].sort();
+    }
+    key(profile, scopes) { return JSON.stringify([profile.credentialRef, profile.tenantId, profile.clientId, profile.cloud, scopes]); }
+    check(profile, credential) {
+        if (!credential.token || !credential.accountId || credential.tenantId.toLowerCase() !== profile.tenantId.toLowerCase() || credential.clientId.toLowerCase() !== profile.clientId.toLowerCase() || !Number.isFinite(credential.expiresAt) || credential.expiresAt <= this.now() + 60_000)
+            throw new Error("Invalid credential context");
+        return { ...credential };
+    }
+    failure(code) { return new AxiError("Authentication unavailable for the configured identity; no interactive fallback was attempted", code, ["mg-axi login --profile <name> --scopes <comma-separated-Graph-scopes>", "Check dedicated app consent and organization sign-in policy", "Restore OS credential store access before retrying login; prior stored accounts must be invalidated before replacement"]); }
+}

package/dist/bin/mg-axi.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { tryFastPath } from "axi-sdk-js/fast-path";
+import { VERSION } from "../version.js";
+if (!tryFastPath(process.argv.slice(2), { version: VERSION })) {
+    const { main } = await import("../cli.js");
+    await main();
+}