@mcp-consultant-tools/azure-b2c 33.0.0 → 35.0.0-beta.1

package/build/AzureB2CService.js

@@ -1,876 +0,0 @@
-/**
- * Azure AD B2C Integration
- *
- * Provides user management capabilities for Azure AD B2C tenants via Microsoft Graph API.
- * Supports user listing, search, password management, and group operations.
- *
- * Security Model:
- * - Read-only operations: Always enabled (list, get, search users/groups)
- * - Password operations: Requires AZURE_B2C_ENABLE_PASSWORD_RESET=true
- * - User creation: Requires AZURE_B2C_ENABLE_USER_CREATE=true
- * - User deletion: Requires AZURE_B2C_ENABLE_USER_DELETE=true
- *
- * Authentication:
- * - Uses Microsoft Graph API with client credentials flow
- * - Requires app registration with User.ReadWrite.All permission
- * - App must have "User Administrator" role for password operations
- */
-import { ClientSecretCredential } from '@azure/identity';
-import { Client } from '@microsoft/microsoft-graph-client';
-import { TokenCredentialAuthenticationProvider } from '@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials/index.js';
-import { auditLogger } from '@mcp-consultant-tools/core';
-// ============================================================================
-// AzureB2CService Class
-// ============================================================================
-export class AzureB2CService {
-    config;
-    graphClient = null;
-    credential = null;
-    // Cache for user/group lists
-    usersCache = null;
-    groupsCache = null;
-    constructor(config) {
-        // Apply defaults
-        this.config = {
-            maxResults: 100,
-            cacheUsersTTL: 300,
-            ...config,
-        };
-        // Validate required fields
-        if (!this.config.tenantId || !this.config.clientId || !this.config.clientSecret) {
-            throw new Error('Azure B2C requires tenantId, clientId, and clientSecret configuration');
-        }
-    }
-    // ==========================================================================
-    // Authentication / Client Setup
-    // ==========================================================================
-    /**
-     * Get or create the Microsoft Graph client
-     */
-    getClient() {
-        if (!this.graphClient) {
-            // Create credential
-            this.credential = new ClientSecretCredential(this.config.tenantId, this.config.clientId, this.config.clientSecret);
-            // Create auth provider
-            const authProvider = new TokenCredentialAuthenticationProvider(this.credential, {
-                scopes: ['https://graph.microsoft.com/.default'],
-            });
-            // Create Graph client
-            this.graphClient = Client.initWithMiddleware({
-                authProvider,
-            });
-        }
-        return this.graphClient;
-    }
-    // ==========================================================================
-    // Read-Only User Operations (Always Enabled)
-    // ==========================================================================
-    /**
-     * List all users with pagination
-     * @param top Maximum number of users to return
-     * @param filter OData filter expression
-     * @param skipCache Skip the cache and fetch fresh data
-     * @param includeAllFields Return raw Graph API response with all fields (including extension attributes)
-     */
-    async listUsers(top = 50, filter, skipCache = false, includeAllFields = false) {
-        const timer = auditLogger.startTimer();
-        // Check cache if not skipping (only for mapped responses)
-        if (!skipCache && !filter && !includeAllFields && this.usersCache && this.usersCache.expires > Date.now()) {
-            console.error('Returning cached user list');
-            return this.usersCache.data.slice(0, top);
-        }
-        try {
-            const client = this.getClient();
-            const limit = Math.min(top, this.config.maxResults);
-            let request = client
-                .api('/users')
-                .top(limit);
-            // Only apply .select() if not requesting all fields
-            if (!includeAllFields) {
-                request = request.select([
-                    'id',
-                    'displayName',
-                    'givenName',
-                    'surname',
-                    'userPrincipalName',
-                    'mail',
-                    'otherMails',
-                    'identities',
-                    'accountEnabled',
-                    'createdDateTime',
-                    'jobTitle',
-                    'department',
-                    'mobilePhone',
-                    'city',
-                    'country',
-                ]);
-            }
-            if (filter) {
-                request = request.filter(filter);
-            }
-            const response = await request.get();
-            // Return raw or mapped based on flag
-            if (includeAllFields) {
-                auditLogger.log({
-                    operation: 'list-users',
-                    operationType: 'READ',
-                    componentType: 'User',
-                    parameters: { top: limit, filter: filter || 'none', includeAllFields: true },
-                    success: true,
-                    executionTimeMs: timer(),
-                });
-                return response.value;
-            }
-            const users = this.mapUsersResponse(response.value);
-            // Cache if no filter
-            if (!filter) {
-                this.usersCache = {
-                    data: users,
-                    expires: Date.now() + this.config.cacheUsersTTL * 1000,
-                };
-            }
-            auditLogger.log({
-                operation: 'list-users',
-                operationType: 'READ',
-                componentType: 'User',
-                parameters: { top: limit, filter: filter || 'none', includeAllFields: false },
-                success: true,
-                executionTimeMs: timer(),
-            });
-            return users;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'list-users',
-                operationType: 'READ',
-                componentType: 'User',
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'list users');
-        }
-    }
-    /**
-     * Get user by ID or email
-     * @param userIdOrEmail User ID (GUID) or email address
-     * @param includeAllFields Return raw Graph API response with all fields (including extension attributes)
-     */
-    async getUser(userIdOrEmail, includeAllFields = false) {
-        const timer = auditLogger.startTimer();
-        try {
-            const client = this.getClient();
-            let request = client.api(`/users/${userIdOrEmail}`);
-            // Only apply .select() if not requesting all fields
-            if (!includeAllFields) {
-                request = request.select([
-                    'id',
-                    'displayName',
-                    'givenName',
-                    'surname',
-                    'userPrincipalName',
-                    'mail',
-                    'otherMails',
-                    'identities',
-                    'accountEnabled',
-                    'createdDateTime',
-                    'jobTitle',
-                    'department',
-                    'mobilePhone',
-                    'city',
-                    'country',
-                ]);
-            }
-            const response = await request.get();
-            // Return raw or mapped based on flag
-            if (includeAllFields) {
-                auditLogger.log({
-                    operation: 'get-user',
-                    operationType: 'READ',
-                    componentType: 'User',
-                    componentName: userIdOrEmail,
-                    parameters: { includeAllFields: true },
-                    success: true,
-                    executionTimeMs: timer(),
-                });
-                return response;
-            }
-            const user = this.mapUserResponse(response);
-            auditLogger.log({
-                operation: 'get-user',
-                operationType: 'READ',
-                componentType: 'User',
-                componentName: userIdOrEmail,
-                parameters: { includeAllFields: false },
-                success: true,
-                executionTimeMs: timer(),
-            });
-            return user;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'get-user',
-                operationType: 'READ',
-                componentType: 'User',
-                componentName: userIdOrEmail,
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'get user');
-        }
-    }
-    /**
-     * Search users by display name, email, or other criteria
-     * @param searchTerm Term to search for
-     * @param searchFields Fields to search in
-     * @param top Maximum results to return
-     * @param includeAllFields Return raw Graph API response with all fields (including extension attributes)
-     */
-    async searchUsers(searchTerm, searchFields = ['displayName', 'mail'], top = 25, includeAllFields = false) {
-        const timer = auditLogger.startTimer();
-        try {
-            const client = this.getClient();
-            const limit = Math.min(top, this.config.maxResults);
-            // Build filter using startswith for each field
-            const filters = searchFields.map((field) => `startswith(${field}, '${searchTerm.replace(/'/g, "''")}')`);
-            const filterString = filters.join(' or ');
-            let request = client
-                .api('/users')
-                .top(limit)
-                .filter(filterString);
-            // Only apply .select() if not requesting all fields
-            if (!includeAllFields) {
-                request = request.select([
-                    'id',
-                    'displayName',
-                    'givenName',
-                    'surname',
-                    'userPrincipalName',
-                    'mail',
-                    'otherMails',
-                    'identities',
-                    'accountEnabled',
-                    'createdDateTime',
-                ]);
-            }
-            const response = await request.get();
-            // Return raw or mapped based on flag
-            if (includeAllFields) {
-                auditLogger.log({
-                    operation: 'search-users',
-                    operationType: 'READ',
-                    componentType: 'User',
-                    parameters: { searchTerm, searchFields, resultCount: response.value.length, includeAllFields: true },
-                    success: true,
-                    executionTimeMs: timer(),
-                });
-                return response.value;
-            }
-            const users = this.mapUsersResponse(response.value);
-            auditLogger.log({
-                operation: 'search-users',
-                operationType: 'READ',
-                componentType: 'User',
-                parameters: { searchTerm, searchFields, resultCount: users.length, includeAllFields: false },
-                success: true,
-                executionTimeMs: timer(),
-            });
-            return users;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'search-users',
-                operationType: 'READ',
-                componentType: 'User',
-                parameters: { searchTerm },
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'search users');
-        }
-    }
-    // ==========================================================================
-    // Read-Only Group Operations (Always Enabled)
-    // ==========================================================================
-    /**
-     * List all groups
-     */
-    async listGroups(top = 50) {
-        const timer = auditLogger.startTimer();
-        // Check cache
-        if (this.groupsCache && this.groupsCache.expires > Date.now()) {
-            console.error('Returning cached group list');
-            return this.groupsCache.data.slice(0, top);
-        }
-        try {
-            const client = this.getClient();
-            const limit = Math.min(top, this.config.maxResults);
-            const response = await client
-                .api('/groups')
-                .top(limit)
-                .select(['id', 'displayName', 'description', 'mailEnabled', 'securityEnabled'])
-                .get();
-            const groups = this.mapGroupsResponse(response.value);
-            // Cache the result
-            this.groupsCache = {
-                data: groups,
-                expires: Date.now() + this.config.cacheUsersTTL * 1000,
-            };
-            auditLogger.log({
-                operation: 'list-groups',
-                operationType: 'READ',
-                componentType: 'Group',
-                parameters: { top: limit, groupCount: groups.length },
-                success: true,
-                executionTimeMs: timer(),
-            });
-            return groups;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'list-groups',
-                operationType: 'READ',
-                componentType: 'Group',
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'list groups');
-        }
-    }
-    /**
-     * Get groups a user belongs to
-     */
-    async getUserGroups(userId) {
-        const timer = auditLogger.startTimer();
-        try {
-            const client = this.getClient();
-            const response = await client
-                .api(`/users/${userId}/memberOf`)
-                .select(['id', 'displayName', 'description', 'mailEnabled', 'securityEnabled'])
-                .get();
-            // Filter to only groups (memberOf can include roles too)
-            const groups = response.value
-                .filter((item) => item['@odata.type'] === '#microsoft.graph.group')
-                .map((g) => this.mapGroupResponse(g));
-            auditLogger.log({
-                operation: 'get-user-groups',
-                operationType: 'READ',
-                componentType: 'Group',
-                componentName: userId,
-                parameters: { groupCount: groups.length },
-                success: true,
-                executionTimeMs: timer(),
-            });
-            return groups;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'get-user-groups',
-                operationType: 'READ',
-                componentType: 'Group',
-                componentName: userId,
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'get user groups');
-        }
-    }
-    /**
-     * Get members of a group
-     * @param groupId Group ID (GUID)
-     * @param top Maximum members to return
-     * @param includeAllFields Return raw Graph API response with all fields (including extension attributes)
-     */
-    async getGroupMembers(groupId, top = 50, includeAllFields = false) {
-        const timer = auditLogger.startTimer();
-        try {
-            const client = this.getClient();
-            const limit = Math.min(top, this.config.maxResults);
-            let request = client
-                .api(`/groups/${groupId}/members`)
-                .top(limit);
-            // Only apply .select() if not requesting all fields
-            if (!includeAllFields) {
-                request = request.select([
-                    'id',
-                    'displayName',
-                    'givenName',
-                    'surname',
-                    'userPrincipalName',
-                    'mail',
-                    'accountEnabled',
-                ]);
-            }
-            const response = await request.get();
-            // Filter to only users
-            const userItems = response.value.filter((item) => item['@odata.type'] === '#microsoft.graph.user');
-            // Return raw or mapped based on flag
-            if (includeAllFields) {
-                auditLogger.log({
-                    operation: 'get-group-members',
-                    operationType: 'READ',
-                    componentType: 'Group',
-                    componentName: groupId,
-                    parameters: { memberCount: userItems.length, includeAllFields: true },
-                    success: true,
-                    executionTimeMs: timer(),
-                });
-                return userItems;
-            }
-            const users = userItems.map((u) => this.mapUserResponse(u));
-            auditLogger.log({
-                operation: 'get-group-members',
-                operationType: 'READ',
-                componentType: 'Group',
-                componentName: groupId,
-                parameters: { memberCount: users.length, includeAllFields: false },
-                success: true,
-                executionTimeMs: timer(),
-            });
-            return users;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'get-group-members',
-                operationType: 'READ',
-                componentType: 'Group',
-                componentName: groupId,
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'get group members');
-        }
-    }
-    // ==========================================================================
-    // Password Operations (Requires enablePasswordReset=true)
-    // ==========================================================================
-    /**
-     * Reset user password
-     * Requires: AZURE_B2C_ENABLE_PASSWORD_RESET=true
-     */
-    async resetUserPassword(userId, newPassword, forceChangeOnNextLogin = false) {
-        this.checkPermission('password reset', this.config.enablePasswordReset);
-        const timer = auditLogger.startTimer();
-        try {
-            const client = this.getClient();
-            await client.api(`/users/${userId}`).update({
-                passwordProfile: {
-                    password: newPassword,
-                    forceChangePasswordNextSignIn: forceChangeOnNextLogin,
-                },
-            });
-            auditLogger.log({
-                operation: 'reset-password',
-                operationType: 'UPDATE',
-                componentType: 'User',
-                componentName: userId,
-                parameters: { forceChangeOnNextLogin },
-                success: true,
-                executionTimeMs: timer(),
-            });
-            // Invalidate user cache
-            this.usersCache = null;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'reset-password',
-                operationType: 'UPDATE',
-                componentType: 'User',
-                componentName: userId,
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'reset password');
-        }
-    }
-    /**
-     * Force password change on next login
-     * Requires: AZURE_B2C_ENABLE_PASSWORD_RESET=true
-     */
-    async forcePasswordChange(userId) {
-        this.checkPermission('password reset', this.config.enablePasswordReset);
-        const timer = auditLogger.startTimer();
-        try {
-            const client = this.getClient();
-            await client.api(`/users/${userId}`).update({
-                passwordProfile: {
-                    forceChangePasswordNextSignIn: true,
-                },
-            });
-            auditLogger.log({
-                operation: 'force-password-change',
-                operationType: 'UPDATE',
-                componentType: 'User',
-                componentName: userId,
-                success: true,
-                executionTimeMs: timer(),
-            });
-            // Invalidate user cache
-            this.usersCache = null;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'force-password-change',
-                operationType: 'UPDATE',
-                componentType: 'User',
-                componentName: userId,
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'force password change');
-        }
-    }
-    // ==========================================================================
-    // User Creation Operations (Requires enableUserCreate=true)
-    // ==========================================================================
-    /**
-     * Create a new local account user
-     * Requires: AZURE_B2C_ENABLE_USER_CREATE=true
-     */
-    async createUser(request) {
-        this.checkPermission('user creation', this.config.enableUserCreate);
-        const timer = auditLogger.startTimer();
-        try {
-            const client = this.getClient();
-            const response = await client.api('/users').post({
-                displayName: request.displayName,
-                identities: request.identities,
-                passwordProfile: request.passwordProfile,
-                givenName: request.givenName,
-                surname: request.surname,
-                jobTitle: request.jobTitle,
-                department: request.department,
-                mobilePhone: request.mobilePhone,
-                city: request.city,
-                country: request.country,
-            });
-            const user = this.mapUserResponse(response);
-            auditLogger.log({
-                operation: 'create-user',
-                operationType: 'CREATE',
-                componentType: 'User',
-                componentName: request.displayName,
-                success: true,
-                executionTimeMs: timer(),
-            });
-            // Invalidate user cache
-            this.usersCache = null;
-            return user;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'create-user',
-                operationType: 'CREATE',
-                componentType: 'User',
-                componentName: request.displayName,
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'create user');
-        }
-    }
-    /**
-     * Update user profile (non-password fields)
-     * Requires: AZURE_B2C_ENABLE_USER_UPDATE=true
-     */
-    async updateUser(userId, updates) {
-        this.checkPermission('user update', this.config.enableUserUpdate);
-        const timer = auditLogger.startTimer();
-        try {
-            const client = this.getClient();
-            await client.api(`/users/${userId}`).update(updates);
-            // Fetch updated user
-            const user = await this.getUser(userId);
-            auditLogger.log({
-                operation: 'update-user',
-                operationType: 'UPDATE',
-                componentType: 'User',
-                componentName: userId,
-                parameters: { updatedFields: Object.keys(updates) },
-                success: true,
-                executionTimeMs: timer(),
-            });
-            // Invalidate user cache
-            this.usersCache = null;
-            return user;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'update-user',
-                operationType: 'UPDATE',
-                componentType: 'User',
-                componentName: userId,
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'update user');
-        }
-    }
-    // ==========================================================================
-    // User Deletion Operations (Requires enableUserDelete=true)
-    // ==========================================================================
-    /**
-     * Delete a user (irreversible)
-     * Requires: AZURE_B2C_ENABLE_USER_DELETE=true
-     */
-    async deleteUser(userId) {
-        this.checkPermission('user deletion', this.config.enableUserDelete);
-        const timer = auditLogger.startTimer();
-        try {
-            const client = this.getClient();
-            await client.api(`/users/${userId}`).delete();
-            auditLogger.log({
-                operation: 'delete-user',
-                operationType: 'DELETE',
-                componentType: 'User',
-                componentName: userId,
-                success: true,
-                executionTimeMs: timer(),
-            });
-            // Invalidate user cache
-            this.usersCache = null;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'delete-user',
-                operationType: 'DELETE',
-                componentType: 'User',
-                componentName: userId,
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'delete user');
-        }
-    }
-    // ==========================================================================
-    // Utility Methods
-    // ==========================================================================
-    /**
-     * Get tenant summary (user/group counts)
-     */
-    async getTenantSummary() {
-        const timer = auditLogger.startTimer();
-        try {
-            const [users, groups] = await Promise.all([
-                this.listUsers(1000), // Get up to 1000 users for counting
-                this.listGroups(1000),
-            ]);
-            const enabledUsers = users.filter((u) => u.accountEnabled);
-            const disabledUsers = users.filter((u) => !u.accountEnabled);
-            // Count by identity type
-            let localAccountCount = 0;
-            let federatedAccountCount = 0;
-            for (const user of users) {
-                if (user.identities) {
-                    const hasLocal = user.identities.some((i) => i.signInType === 'emailAddress' || i.signInType === 'userName');
-                    const hasFederated = user.identities.some((i) => i.signInType === 'federated');
-                    if (hasLocal)
-                        localAccountCount++;
-                    if (hasFederated)
-                        federatedAccountCount++;
-                }
-            }
-            const summary = {
-                tenantId: this.config.tenantId,
-                userCount: users.length,
-                groupCount: groups.length,
-                enabledUserCount: enabledUsers.length,
-                disabledUserCount: disabledUsers.length,
-                localAccountCount,
-                federatedAccountCount,
-            };
-            auditLogger.log({
-                operation: 'get-tenant-summary',
-                operationType: 'READ',
-                componentType: 'Tenant',
-                success: true,
-                executionTimeMs: timer(),
-            });
-            return summary;
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'get-tenant-summary',
-                operationType: 'READ',
-                componentType: 'Tenant',
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            throw this.enhanceError(error, 'get tenant summary');
-        }
-    }
-    /**
-     * Test connection to the B2C tenant
-     */
-    async testConnection() {
-        const timer = auditLogger.startTimer();
-        try {
-            let canReadUsers = false;
-            let canReadGroups = false;
-            // Test user read
-            try {
-                await this.listUsers(1);
-                canReadUsers = true;
-            }
-            catch (e) {
-                console.error(`Cannot read users: ${e.message}`);
-            }
-            // Test group read
-            try {
-                await this.listGroups(1);
-                canReadGroups = true;
-            }
-            catch (e) {
-                console.error(`Cannot read groups: ${e.message}`);
-            }
-            auditLogger.log({
-                operation: 'test-connection',
-                operationType: 'READ',
-                componentType: 'Tenant',
-                success: true,
-                executionTimeMs: timer(),
-            });
-            return {
-                connected: canReadUsers || canReadGroups,
-                tenantId: this.config.tenantId,
-                canReadUsers,
-                canReadGroups,
-            };
-        }
-        catch (error) {
-            auditLogger.log({
-                operation: 'test-connection',
-                operationType: 'READ',
-                componentType: 'Tenant',
-                success: false,
-                error: error.message,
-                executionTimeMs: timer(),
-            });
-            return {
-                connected: false,
-                tenantId: this.config.tenantId,
-                canReadUsers: false,
-                canReadGroups: false,
-                error: error.message,
-            };
-        }
-    }
-    /**
-     * Get current configuration status
-     */
-    getConfigStatus() {
-        return {
-            tenantId: this.config.tenantId,
-            enablePasswordReset: this.config.enablePasswordReset,
-            enableUserCreate: this.config.enableUserCreate,
-            enableUserUpdate: this.config.enableUserUpdate,
-            enableUserDelete: this.config.enableUserDelete,
-        };
-    }
-    // ==========================================================================
-    // Helper Methods
-    // ==========================================================================
-    /**
-     * Check if operation is permitted
-     */
-    checkPermission(operation, enabled) {
-        if (!enabled) {
-            throw new Error(`${operation} is not enabled. ` +
-                `Set the appropriate environment variable to enable this operation.`);
-        }
-    }
-    /**
-     * Map Graph API user response to B2CUser
-     */
-    mapUserResponse(response) {
-        return {
-            id: response.id,
-            displayName: response.displayName,
-            givenName: response.givenName,
-            surname: response.surname,
-            userPrincipalName: response.userPrincipalName,
-            mail: response.mail,
-            otherMails: response.otherMails,
-            identities: response.identities,
-            accountEnabled: response.accountEnabled,
-            createdDateTime: response.createdDateTime,
-            jobTitle: response.jobTitle,
-            department: response.department,
-            mobilePhone: response.mobilePhone,
-            city: response.city,
-            country: response.country,
-        };
-    }
-    /**
-     * Map array of Graph API user responses
-     */
-    mapUsersResponse(responses) {
-        return responses.map((r) => this.mapUserResponse(r));
-    }
-    /**
-     * Map Graph API group response to B2CGroup
-     */
-    mapGroupResponse(response) {
-        return {
-            id: response.id,
-            displayName: response.displayName,
-            description: response.description,
-            mailEnabled: response.mailEnabled,
-            securityEnabled: response.securityEnabled,
-        };
-    }
-    /**
-     * Map array of Graph API group responses
-     */
-    mapGroupsResponse(responses) {
-        return responses.map((r) => this.mapGroupResponse(r));
-    }
-    /**
-     * Enhance error with helpful context
-     */
-    enhanceError(error, operation) {
-        const message = error.message || String(error);
-        // Handle common Graph API errors
-        if (error.statusCode === 401 || message.includes('Unauthorized')) {
-            return new Error(`Unauthorized to ${operation}. ` +
-                `Verify app registration has correct API permissions (User.ReadWrite.All) ` +
-                `and "User Administrator" role assignment. ` +
-                `Original error: ${message}`);
-        }
-        if (error.statusCode === 403 || message.includes('Forbidden')) {
-            return new Error(`Forbidden to ${operation}. ` +
-                `The app may lack required permissions or role assignments. ` +
-                `Original error: ${message}`);
-        }
-        if (error.statusCode === 404 || message.includes('Request_ResourceNotFound')) {
-            return new Error(`Resource not found when attempting to ${operation}. ` +
-                `Verify the user/group ID is correct. ` +
-                `Original error: ${message}`);
-        }
-        if (message.includes('Invalid password')) {
-            return new Error(`Invalid password format. Password must meet Azure AD B2C complexity requirements: ` +
-                `8-256 characters, at least 3 of: lowercase, uppercase, digit, symbol. ` +
-                `Original error: ${message}`);
-        }
-        return new Error(`Failed to ${operation}: ${message}`);
-    }
-    /**
-     * Clear all caches
-     */
-    clearCache() {
-        this.usersCache = null;
-        this.groupsCache = null;
-    }
-}
-//# sourceMappingURL=AzureB2CService.js.map