@kwiz/node 1.0.0

package/.madgerc

@@ -0,0 +1,3 @@
+{
+    "fileExtensions": ["js", "ts"]
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 KWIZ Corp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,2 @@
+# node
+Common utilities for node applications

package/dist/SPO/common.d.ts

@@ -0,0 +1,3 @@
+import { AuthContextType, ITenantInfo } from "@kwiz/common";
+export declare function ConfigureSPOAuth(config?: AuthContextType): void;
+export declare function getAxiosConfigSharePoint(tenantInfo: ITenantInfo, siteUrl: string): Promise<import("axios").AxiosRequestConfig<any>>;

package/dist/SPO/common.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAxiosConfigSharePoint = exports.ConfigureSPOAuth = void 0;
+const common_1 = require("@kwiz/common");
+const msal_1 = require("../auth/msal");
+const axios_1 = require("../axios");
+var auth = null;
+function ConfigureSPOAuth(config) {
+    auth = config;
+}
+exports.ConfigureSPOAuth = ConfigureSPOAuth;
+async function getAxiosConfigSharePoint(tenantInfo, siteUrl) {
+    if ((0, common_1.isNullOrUndefined)(auth))
+        throw Error("Call ConfigureSPOAuth first");
+    // only certificate supported
+    // DisableCustomAppAuthentication property, that disable this kind of auth., however it can be overriden using this command:
+    // Set-SPOTenant -DisableCustomAppAuthentication $false
+    let token = await (0, msal_1.GetMSALToken)(tenantInfo, (0, common_1.GetMSALSiteScope)(siteUrl), auth);
+    let config = (0, axios_1.getAxiosConfigBearer)(token, { contantType: "application/json; odata=nometadata" });
+    return config;
+}
+exports.getAxiosConfigSharePoint = getAxiosConfigSharePoint;
+//# sourceMappingURL=common.js.map

package/dist/SPO/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/SPO/common.ts"],"names":[],"mappings":";;;AAAA,yCAAiG;AACjG,uCAA4C;AAC5C,oCAAgD;AAEhD,IAAI,IAAI,GAAoB,IAAI,CAAC;AACjC,SAAgB,gBAAgB,CAAC,MAAwB;IACrD,IAAI,GAAG,MAAM,CAAC;AAClB,CAAC;AAFD,4CAEC;AACM,KAAK,UAAU,wBAAwB,CAAC,UAAuB,EAAE,OAAe;IACnF,IAAI,IAAA,0BAAiB,EAAC,IAAI,CAAC;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACxE,6BAA6B;IAC7B,4HAA4H;IAC5H,uDAAuD;IACvD,IAAI,KAAK,GAAG,MAAM,IAAA,mBAAY,EAAC,UAAU,EAAE,IAAA,yBAAgB,EAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,IAAI,MAAM,GAAG,IAAA,4BAAoB,EAAC,KAAK,EAAE,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC;AAClB,CAAC;AARD,4DAQC"}

package/dist/auth/discovery.d.ts

@@ -0,0 +1,2 @@
+import { ITenantInfo } from "@kwiz/common";
+export declare function DiscoverTenantInfo(hostName: string): Promise<ITenantInfo>;

package/dist/auth/discovery.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DiscoverTenantInfo = void 0;
+const common_1 = require("@kwiz/common");
+const axios_1 = require("axios");
+function DiscoverTenantInfo(hostName) {
+    hostName = hostName.toLowerCase();
+    return (0, common_1.promiseOnce)(`DiscoverTenantInfo|${hostName}`, async () => {
+        let data = {
+            environment: common_1.$AzureEnvironment.Production,
+            idOrName: null,
+            authorityUrl: null,
+            valid: false
+        };
+        let tenantId = null;
+        let friendlyName = null;
+        try {
+            if (hostName.indexOf(".sharepoint.") !== -1) {
+                let hostParts = hostName.split('.'); //should be xxx.sharepoint.com or xxx.sharepoint.us
+                let firstHostPart = hostParts[0];
+                let lastHostPart = hostParts[hostParts.length - 1] === "us" || hostParts[hostParts.length - 1] === "de" ? hostParts[hostParts.length - 1] : "com";
+                if (firstHostPart.endsWith("-admin"))
+                    firstHostPart = firstHostPart.substring(0, firstHostPart.length - 6);
+                friendlyName = `${firstHostPart}.onmicrosoft.${lastHostPart}`;
+            }
+            else
+                friendlyName = hostName; //could be an exchange email domain, or bpos customer
+            let config = await axios_1.default.get(`https://login.microsoftonline.com/${friendlyName}/v2.0/.well-known/openid-configuration`);
+            let endpoint = config.data.token_endpoint; //https://xxxx/{tenant}/....
+            tenantId = endpoint.replace("//", "/").split('/')[2]; //replace :// with :/ split by / and take the second part.
+            let instance = config.data.cloud_instance_name; //microsoftonline.us
+            data.environment = (0, common_1.GetEnvironmentFromACSEndPoint)(instance);
+            if (!(0, common_1.isNullOrEmptyString)(tenantId) || (0, common_1.isValidGuid)(tenantId))
+                data.idOrName = tenantId;
+            else
+                data.idOrName = friendlyName;
+            data.authorityUrl = `${(0, common_1.GetAzureADLoginEndPoint)(data.environment)}/${data.idOrName}`;
+            data.valid = true;
+        }
+        catch (e) { }
+        return data;
+    });
+}
+exports.DiscoverTenantInfo = DiscoverTenantInfo;
+//# sourceMappingURL=discovery.js.map

package/dist/auth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/auth/discovery.ts"],"names":[],"mappings":";;;AAAA,yCAAqK;AACrK,iCAA0B;AAE1B,SAAgB,kBAAkB,CAAC,QAAgB;IAC/C,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,IAAA,oBAAW,EAAC,sBAAsB,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE;QAC5D,IAAI,IAAI,GAAgB;YACpB,WAAW,EAAE,0BAAiB,CAAC,UAAU;YACzC,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,KAAK;SACf,CAAC;QAEF,IAAI,QAAQ,GAAW,IAAI,CAAC;QAC5B,IAAI,YAAY,GAAW,IAAI,CAAC;QAEhC,IAAI,CAAC;YACD,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1C,IAAI,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA,mDAAmD;gBACvF,IAAI,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAClJ,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC3G,YAAY,GAAG,GAAG,aAAa,gBAAgB,YAAY,EAAE,CAAC;YAClE,CAAC;;gBACI,YAAY,GAAG,QAAQ,CAAC,CAAA,qDAAqD;YAElF,IAAI,MAAM,GAAG,MAAM,eAAK,CAAC,GAAG,CAezB,qCAAqC,YAAY,wCAAwC,CAAC,CAAC;YAE9F,IAAI,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA,4BAA4B;YACtE,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA,0DAA0D;YAC/G,IAAI,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA,oBAAoB;YAEnE,IAAI,CAAC,WAAW,GAAG,IAAA,sCAA6B,EAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAA,4BAAmB,EAAC,QAAQ,CAAC,IAAI,IAAA,oBAAW,EAAC,QAAQ,CAAC;gBACvD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;;gBAEzB,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;YAEjC,IAAI,CAAC,YAAY,GAAG,GAAG,IAAA,gCAAuB,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAEb,OAAO,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;AACP,CAAC;AAzDD,gDAyDC"}

package/dist/auth/msal.d.ts

@@ -0,0 +1,3 @@
+import { AuthContextType, ITenantInfo } from "@kwiz/common";
+/** client secret not supported by SharePoint, must use certificate */
+export declare function GetMSALToken(tenantInfo: ITenantInfo, scope: string, auth: AuthContextType): Promise<string>;

package/dist/auth/msal.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetMSALToken = void 0;
+const msal_node_1 = require("@azure/msal-node");
+//find tenant id? https://login.microsoftonline.com/kwizcom.onmicrosoft.com/.well-known/openid-configuration
+//https://stackoverflow.com/questions/54771270/msal-ad-token-not-valid-with-sharepoint-online-csom
+var apps = {};
+function GetApp(tenantInfo, auth) {
+    let key = `${tenantInfo.idOrName}|${auth.authenticationMode}`;
+    if (!apps[key]) {
+        auth.authenticationMode === "secret" /* AuthenticationModes.clientSecret */
+            ? apps[key] = new msal_node_1.ConfidentialClientApplication({
+                auth: {
+                    clientId: auth.clientId,
+                    authority: tenantInfo.authorityUrl,
+                    clientSecret: auth.clientSecret
+                },
+            })
+            : apps[key] = new msal_node_1.ConfidentialClientApplication({
+                auth: {
+                    clientId: auth.clientId,
+                    authority: tenantInfo.authorityUrl,
+                    clientCertificate: {
+                        thumbprint: auth.thumbprint,
+                        privateKey: auth.privateKey
+                    }
+                },
+            });
+    }
+    return apps[key];
+}
+/** client secret not supported by SharePoint, must use certificate */
+async function GetMSALToken(tenantInfo, scope, auth) {
+    let token = await GetApp(tenantInfo, auth).acquireTokenByClientCredential({
+        scopes: [`${scope}/.default`]
+    });
+    return token.accessToken;
+}
+exports.GetMSALToken = GetMSALToken;
+//# sourceMappingURL=msal.js.map

package/dist/auth/msal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal.js","sourceRoot":"","sources":["../../src/auth/msal.ts"],"names":[],"mappings":";;;AAAA,gDAAiE;AAEjE,4GAA4G;AAC5G,kGAAkG;AAElG,IAAI,IAAI,GAAwD,EAAE,CAAC;AAEnE,SAAS,MAAM,CAAC,UAAuB,EAAE,IAAqB;IAC1D,IAAI,GAAG,GAAG,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAA;IAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,IAAI,CAAC,kBAAkB,oDAAqC;YACxD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,yCAA6B,CAAC;gBAC5C,IAAI,EAAE;oBACF,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,UAAU,CAAC,YAAY;oBAClC,YAAY,EAAE,IAAI,CAAC,YAAY;iBAClC;aAEJ,CAAC;YACF,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,yCAA6B,CAAC;gBAC5C,IAAI,EAAE;oBACF,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,UAAU,CAAC,YAAY;oBAClC,iBAAiB,EAAE;wBACf,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;qBAC9B;iBACJ;aAEJ,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,sEAAsE;AAC/D,KAAK,UAAU,YAAY,CAAC,UAAuB,EAAE,KAAa,EAAE,IAAqB;IAC5F,IAAI,KAAK,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,8BAA8B,CAAC;QACtE,MAAM,EAAE,CAAC,GAAG,KAAK,WAAW,CAAC;KAChC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,WAAW,CAAC;AAC7B,CAAC;AALD,oCAKC"}

package/dist/axios.d.ts

@@ -0,0 +1,7 @@
+import { AxiosRequestConfig } from "axios";
+type axiosConfigOptions = {
+    contantType?: "application/json" | "application/json; odata=nometadata" | "application/xml";
+};
+export declare function getAxiosConfigBearer(token: string, options?: axiosConfigOptions): AxiosRequestConfig<any>;
+export declare function getAxiosConfig(token?: string, options?: axiosConfigOptions): AxiosRequestConfig<any>;
+export {};

package/dist/axios.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAxiosConfig = exports.getAxiosConfigBearer = void 0;
+const common_1 = require("@kwiz/common");
+const https_1 = require("https");
+function getAxiosConfigBearer(token, options) {
+    return getAxiosConfig(`Bearer ${token}`, options);
+}
+exports.getAxiosConfigBearer = getAxiosConfigBearer;
+function getAxiosConfig(token, options) {
+    //allow self sign ssl certificates
+    https_1.globalAgent.options.rejectUnauthorized = false;
+    const config = {
+        httpAgent: new https_1.Agent({
+            rejectUnauthorized: false
+        }),
+        headers: {}
+    };
+    if (!(0, common_1.isNullOrEmptyString)(token))
+        config.headers.Authorization = token;
+    if (options) {
+        if (!(0, common_1.isNullOrEmptyString)(options.contantType)) {
+            config.headers["Content-Type"] = options.contantType;
+            config.headers["Accept"] = options.contantType;
+        }
+    }
+    return config;
+}
+exports.getAxiosConfig = getAxiosConfig;
+//# sourceMappingURL=axios.js.map

package/dist/axios.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"axios.js","sourceRoot":"","sources":["../src/axios.ts"],"names":[],"mappings":";;;AAAA,yCAAmD;AAEnD,iCAA2C;AAK3C,SAAgB,oBAAoB,CAAC,KAAa,EAAE,OAA4B;IAC5E,OAAO,cAAc,CAAC,UAAU,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAFD,oDAEC;AAED,SAAgB,cAAc,CAAC,KAAc,EAAE,OAA4B;IACvE,kCAAkC;IAClC,mBAAW,CAAC,OAAO,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAC/C,MAAM,MAAM,GAA4B;QACpC,SAAS,EAAE,IAAI,aAAK,CAAC;YACjB,kBAAkB,EAAE,KAAK;SAC5B,CAAC;QACF,OAAO,EAAE,EAAE;KACd,CAAC;IAEF,IAAI,CAAC,IAAA,4BAAmB,EAAC,KAAK,CAAC;QAC3B,MAAM,CAAC,OAAQ,CAAC,aAAa,GAAG,KAAK,CAAC;IAE1C,IAAI,OAAO,EAAE,CAAC;QACV,IAAI,CAAC,IAAA,4BAAmB,EAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,OAAQ,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;YACtD,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACpD,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AApBD,wCAoBC"}

package/dist/index.js

@@ -0,0 +1 @@
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@kwiz/node",
+  "version": "1.0.0",
+  "description": "KWIZ utilities and helpers for node applications",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "watch": "tsc -watch",
+    "build": "npm run test && tsc",
+    "build-explain": "tsc --explainFiles",
+    "check-dependencies": "madge --circular ./src",
+    "create-link": "npm link",
+    "test": "node --import tsx --test src",
+    "npm-v-patch": "npm version patch",
+    "npm-v-major": "npm version major",
+    "npm-publish": "npm publish --access public",
+    "reset-repo": "git fetch origin && git reset --hard origin/main",
+    "link-local-common": "npm link @kwiz/common"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/KWizCom/node.git"
+  },
+  "keywords": [
+    "KWIZ",
+    "SharePoint",
+    "SPO",
+    "Teams",
+    "Utilities",
+    "Helpers",
+    "Node"
+  ],
+  "author": "Shai Petel",
+  "contributors": [
+    "Shai Petel",
+    "Kevin Vieira"
+  ],
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/KWizCom/node/issues",
+    "email": "support@kwizcom.com"
+  },
+  "homepage": "https://github.com/KWizCom/node#readme",
+  "private": false,
+  "engines": {
+    "node": ">=16"
+  },
+  "packageManager": "npm@9.5.1",
+  "devDependencies": {
+    "@types/node": "^20.11.24",
+    "madge": "^6.1.0",
+    "tsx": "^4.7.1",
+    "typescript": "^5.3.3"
+  },
+  "dependencies": {
+    "@azure/msal-node": "^2.6.4",
+    "@kwiz/common": "^1.0.7",
+    "axios": "^1.6.7",
+    "esbuild": "^0.19.12",
+    "get-tsconfig": "^4.7.2",
+    "resolve-pkg-maps": "^1.0.0"
+  }
+}

package/src/SPO/common.ts

@@ -0,0 +1,17 @@
+import { AuthContextType, GetMSALSiteScope, ITenantInfo, isNullOrUndefined } from "@kwiz/common";
+import { GetMSALToken } from "../auth/msal";
+import { getAxiosConfigBearer } from "../axios";
+
+var auth: AuthContextType = null;
+export function ConfigureSPOAuth(config?: AuthContextType) {
+    auth = config;
+}
+export async function getAxiosConfigSharePoint(tenantInfo: ITenantInfo, siteUrl: string) {
+    if (isNullOrUndefined(auth)) throw Error("Call ConfigureSPOAuth first");
+    // only certificate supported
+    // DisableCustomAppAuthentication property, that disable this kind of auth., however it can be overriden using this command:
+    // Set-SPOTenant -DisableCustomAppAuthentication $false
+    let token = await GetMSALToken(tenantInfo, GetMSALSiteScope(siteUrl), auth);
+    let config = getAxiosConfigBearer(token, { contantType: "application/json; odata=nometadata" });
+    return config;
+}

package/src/auth/discovery.test.js

@@ -0,0 +1,9 @@
+import assert from 'assert/strict';
+import test from 'node:test';
+import { DiscoverTenantInfo } from "./discovery";
+
+test('DiscoverTenantInfo', async t => {
+    const tenantName = "kwizcom.com";
+    const tenantInfo = await DiscoverTenantInfo(tenantName);
+    assert.strictEqual(tenantInfo.idOrName, "7d034656-be03-457d-8d82-60e90cf5f400");
+});

package/src/auth/discovery.ts

@@ -0,0 +1,61 @@
+import { $AzureEnvironment, GetAzureADLoginEndPoint, GetEnvironmentFromACSEndPoint, ITenantInfo, isNullOrEmptyString, isValidGuid, promiseOnce } from "@kwiz/common";
+import axios from "axios";
+
+export function DiscoverTenantInfo(hostName: string) {
+    hostName = hostName.toLowerCase();
+    return promiseOnce(`DiscoverTenantInfo|${hostName}`, async () => {
+        let data: ITenantInfo = {
+            environment: $AzureEnvironment.Production,
+            idOrName: null,
+            authorityUrl: null,
+            valid: false
+        };
+
+        let tenantId: string = null;
+        let friendlyName: string = null;
+
+        try {
+            if (hostName.indexOf(".sharepoint.") !== -1) {
+                let hostParts = hostName.split('.');//should be xxx.sharepoint.com or xxx.sharepoint.us
+                let firstHostPart = hostParts[0];
+                let lastHostPart = hostParts[hostParts.length - 1] === "us" || hostParts[hostParts.length - 1] === "de" ? hostParts[hostParts.length - 1] : "com";
+                if (firstHostPart.endsWith("-admin")) firstHostPart = firstHostPart.substring(0, firstHostPart.length - 6);
+                friendlyName = `${firstHostPart}.onmicrosoft.${lastHostPart}`;
+            }
+            else friendlyName = hostName;//could be an exchange email domain, or bpos customer
+
+            let config = await axios.get<{
+                token_endpoint: string;//https://login.microsoftonline.com/7d034656-be03-457d-8d82-60e90cf5f400/oauth2/token
+                cloud_instance_name: string;//microsoftonline.com
+                token_endpoint_auth_methods_supported: string[];// ["client_secret_post", "private_key_jwt", "client_secret_basic"]
+                response_modes_supported: string[];// ["query", "fragment", "form_post"]
+                response_types_supported: string[];// ["code", "id_token", "code id_token", "token id_token", "token"]
+                scopes_supported: string[];// ["openid"]
+                issuer: string;//https://sts.windows.net/7d034656-be03-457d-8d82-60e90cf5f400/
+                authorization_endpoint: string;//https://login.microsoftonline.com/7d034656-be03-457d-8d82-60e90cf5f400/oauth2/authorize
+                device_authorization_endpoint: string;//https://login.microsoftonline.com/7d034656-be03-457d-8d82-60e90cf5f400/oauth2/devicecode
+                end_session_endpoint: string;//https://login.microsoftonline.com/7d034656-be03-457d-8d82-60e90cf5f400/oauth2/logout
+                userinfo_endpoint: string;//https://login.microsoftonline.com/7d034656-be03-457d-8d82-60e90cf5f400/openid/userinfo
+                tenant_region_scope: string;//NA
+                cloud_graph_host_name: string;//graph.windows.net
+                msgraph_host: string;//graph.microsoft.com
+            }>(`https://login.microsoftonline.com/${friendlyName}/v2.0/.well-known/openid-configuration`);
+
+            let endpoint = config.data.token_endpoint;//https://xxxx/{tenant}/....
+            tenantId = endpoint.replace("//", "/").split('/')[2];//replace :// with :/ split by / and take the second part.
+            let instance = config.data.cloud_instance_name;//microsoftonline.us
+
+            data.environment = GetEnvironmentFromACSEndPoint(instance);
+            if (!isNullOrEmptyString(tenantId) || isValidGuid(tenantId))
+                data.idOrName = tenantId;
+            else
+                data.idOrName = friendlyName;
+
+            data.authorityUrl = `${GetAzureADLoginEndPoint(data.environment)}/${data.idOrName}`;
+            data.valid = true;
+        }
+        catch (e) { }
+
+        return data;
+    });
+}

package/src/auth/msal.ts

@@ -0,0 +1,41 @@
+import { ConfidentialClientApplication } from "@azure/msal-node";
+import { AuthContextType, AuthenticationModes, ITenantInfo } from "@kwiz/common";
+//find tenant id? https://login.microsoftonline.com/kwizcom.onmicrosoft.com/.well-known/openid-configuration
+//https://stackoverflow.com/questions/54771270/msal-ad-token-not-valid-with-sharepoint-online-csom
+
+var apps: { [tenant: string]: ConfidentialClientApplication } = {};
+
+function GetApp(tenantInfo: ITenantInfo, auth: AuthContextType) {
+    let key = `${tenantInfo.idOrName}|${auth.authenticationMode}`
+    if (!apps[key]) {
+        auth.authenticationMode === AuthenticationModes.clientSecret
+            ? apps[key] = new ConfidentialClientApplication({
+                auth: {
+                    clientId: auth.clientId,
+                    authority: tenantInfo.authorityUrl,
+                    clientSecret: auth.clientSecret
+                },
+
+            })
+            : apps[key] = new ConfidentialClientApplication({
+                auth: {
+                    clientId: auth.clientId,
+                    authority: tenantInfo.authorityUrl,
+                    clientCertificate: {
+                        thumbprint: auth.thumbprint,
+                        privateKey: auth.privateKey
+                    }
+                },
+
+            });
+    }
+    return apps[key];
+}
+
+/** client secret not supported by SharePoint, must use certificate */
+export async function GetMSALToken(tenantInfo: ITenantInfo, scope: string, auth: AuthContextType) {
+    let token = await GetApp(tenantInfo, auth).acquireTokenByClientCredential({
+        scopes: [`${scope}/.default`]
+    });
+    return token.accessToken;
+}

package/src/axios.ts

@@ -0,0 +1,32 @@
+import { isNullOrEmptyString } from "@kwiz/common";
+import { AxiosRequestConfig } from "axios";
+import { Agent, globalAgent } from "https";
+
+type axiosConfigOptions = {
+    contantType?: "application/json" | "application/json; odata=nometadata" | "application/xml";
+}
+export function getAxiosConfigBearer(token: string, options?: axiosConfigOptions) {
+    return getAxiosConfig(`Bearer ${token}`, options);
+}
+
+export function getAxiosConfig(token?: string, options?: axiosConfigOptions) {
+    //allow self sign ssl certificates
+    globalAgent.options.rejectUnauthorized = false;
+    const config: AxiosRequestConfig<any> = {
+        httpAgent: new Agent({
+            rejectUnauthorized: false
+        }),
+        headers: {}
+    };
+
+    if (!isNullOrEmptyString(token))
+        config.headers!.Authorization = token;
+
+    if (options) {
+        if (!isNullOrEmptyString(options.contantType)) {
+            config.headers!["Content-Type"] = options.contantType;
+            config.headers!["Accept"] = options.contantType;
+        }
+    }
+    return config;
+}