@michaelschnyder/teams-cli 0.1.0

package/dist/storage.js

@@ -0,0 +1,147 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export function identityKey(identity) {
+    return createHash("sha256")
+        .update(identity.tenantId)
+        .update("\0")
+        .update(identity.userId)
+        .digest("hex");
+}
+export function storagePaths(root = join(homedir(), ".teams-cli")) {
+    const authDirectory = join(root, "auth");
+    const browserProfilesDirectory = join(root, "browser-profiles");
+    const browserStagingDirectory = join(browserProfilesDirectory, ".staging");
+    return {
+        root,
+        configFile: join(root, "config.yaml"),
+        authDirectory,
+        browserProfilesDirectory,
+        browserStagingDirectory,
+        policiesDirectory: join(root, "policies"),
+        sessionFile: (identity) => join(authDirectory, `${identityKey(identity)}.json`),
+        browserProfile: (identity, browser) => join(browserProfilesDirectory, identityKey(identity), browser),
+        browserStagingProfile: (identifier, browser) => join(browserStagingDirectory, identifier, browser),
+    };
+}
+async function preparePrivateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    await chmod(path, 0o700);
+}
+export async function prepareBrowserProfile(paths, identity, browser) {
+    await preparePrivateDirectory(paths.root);
+    await preparePrivateDirectory(paths.browserProfilesDirectory);
+    const profile = paths.browserProfile(identity, browser);
+    await preparePrivateDirectory(profile);
+    return profile;
+}
+export async function prepareStagingBrowserProfile(paths, browser) {
+    await preparePrivateDirectory(paths.root);
+    await preparePrivateDirectory(paths.browserProfilesDirectory);
+    await preparePrivateDirectory(paths.browserStagingDirectory);
+    const identifier = randomUUID();
+    const directory = paths.browserStagingProfile(identifier, browser);
+    await preparePrivateDirectory(directory);
+    return { identifier, directory };
+}
+export async function promoteStagingBrowserProfile(paths, identifier, identity, browser) {
+    const sourceRoot = join(paths.browserStagingDirectory, identifier);
+    const source = paths.browserStagingProfile(identifier, browser);
+    const destination = paths.browserProfile(identity, browser);
+    const backup = `${destination}.backup-${randomUUID()}`;
+    await preparePrivateDirectory(join(paths.browserProfilesDirectory, identityKey(identity)));
+    let backedUp = false;
+    try {
+        try {
+            await rename(destination, backup);
+            backedUp = true;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        await rename(source, destination);
+        await chmod(destination, 0o700);
+        if (backedUp)
+            await rm(backup, { recursive: true, force: true });
+        await rm(sourceRoot, { recursive: true, force: true });
+    }
+    catch (error) {
+        if (backedUp) {
+            await rm(destination, { recursive: true, force: true });
+            await rename(backup, destination);
+        }
+        throw error;
+    }
+}
+export async function discardStagingBrowserProfile(paths, identifier) {
+    await rm(join(paths.browserStagingDirectory, identifier), { recursive: true, force: true });
+}
+export async function saveSession(paths, session) {
+    await preparePrivateDirectory(paths.root);
+    await preparePrivateDirectory(paths.authDirectory);
+    const file = paths.sessionFile(session);
+    const temporary = join(paths.authDirectory, `.session-${randomUUID()}.tmp`);
+    await writeFile(temporary, `${JSON.stringify(session, null, 2)}\n`, { mode: 0o600 });
+    await rename(temporary, file);
+    await chmod(file, 0o600);
+}
+function isStoredToken(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const token = value;
+    return typeof token.value === "string" && typeof token.expiresAt === "string";
+}
+function isAnyStoredSession(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const session = value;
+    const common = (session.browser === "edge" || session.browser === "chrome") &&
+        typeof session.tenantId === "string" &&
+        typeof session.savedAt === "string" &&
+        isStoredToken(session.accessToken) &&
+        isStoredToken(session.skypeToken);
+    if (!common)
+        return false;
+    if (session.version === 1 || session.version === 2)
+        return true;
+    if (session.version !== 3)
+        return false;
+    const current = session;
+    return typeof current.userId === "string" && current.userId.length > 0 &&
+        typeof current.region === "string" &&
+        isStoredToken(current.chatToken) &&
+        isStoredToken(current.searchToken) &&
+        typeof current.endpoints?.chatService === "string";
+}
+export async function loadSession(paths, identity) {
+    const file = paths.sessionFile(identity);
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new Error("Not logged in for the selected tenant and user. Run `teams-cli auth login`.");
+        }
+        throw error;
+    }
+    const parsed = JSON.parse(raw);
+    if (!isAnyStoredSession(parsed))
+        throw new Error("Stored Teams session is invalid. Log in again.");
+    if (parsed.tenantId !== identity.tenantId || parsed.version !== 3 || parsed.userId !== identity.userId) {
+        throw new Error("Stored Teams session belongs to a different identity or is outdated. Log in again.");
+    }
+    return parsed;
+}
+export function requireCurrentSession(session) {
+    if (session.version !== 3) {
+        throw new Error("Stored Teams session is outdated. Run `teams-cli auth login` again.");
+    }
+    return session;
+}
+export async function clearAuthentication(paths, identity) {
+    await rm(paths.sessionFile(identity), { force: true });
+    await rm(join(paths.browserProfilesDirectory, identityKey(identity)), { recursive: true, force: true });
+}

package/dist/teams-auth.js

@@ -0,0 +1,54 @@
+import { TEAMS_AUTHZ_URL } from "./constants.js";
+import { observedFetch } from "./diagnostics.js";
+export class TeamsAuthError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "TeamsAuthError";
+    }
+}
+export async function exchangeInitialToken(initialToken) {
+    const response = await observedFetch(fetch, TEAMS_AUTHZ_URL, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${initialToken}`,
+            "ms-teams-authz-type": "TokenRefresh",
+        },
+    });
+    const raw = await response.text();
+    if (!response.ok) {
+        let message = raw.slice(0, 300);
+        try {
+            const parsed = JSON.parse(raw);
+            message = parsed.errorCode ?? parsed.message ?? message;
+        }
+        catch {
+            // Preserve the bounded text response for diagnostics.
+        }
+        throw new TeamsAuthError(response.status, `Teams auth exchange failed (${response.status}): ${message}`);
+    }
+    const payload = JSON.parse(raw);
+    const skypeToken = payload.tokens?.skypeToken;
+    if (!skypeToken)
+        throw new Error("Teams auth exchange returned no Skype token");
+    return {
+        skypeToken,
+        ...(payload.tokens?.expiresIn !== undefined
+            ? { expiresIn: payload.tokens.expiresIn }
+            : {}),
+        ...(payload.region ? { region: payload.region } : {}),
+        ...(payload.partition ? { partition: payload.partition } : {}),
+        endpoints: {
+            ...(payload.regionGtms?.chatService
+                ? { chatService: payload.regionGtms.chatService }
+                : {}),
+            ...(payload.regionGtms?.chatServiceAggregator
+                ? { chatServiceAggregator: payload.regionGtms.chatServiceAggregator }
+                : {}),
+            ...(payload.regionGtms?.middleTier
+                ? { middleTier: payload.regionGtms.middleTier }
+                : {}),
+        },
+    };
+}