@microsoft/agents-hosting 1.6.0-beta.9.gce9d8facd2 → 1.7.0-beta.1.g8bcd4f11a7

package/dist/src/auth/msal/msalTokenProvider.js

@@ -0,0 +1,733 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MsalTokenProvider = void 0;
+const msal_node_1 = require("@azure/msal-node");
+const authConfiguration_1 = require("../authConfiguration");
+const agents_telemetry_1 = require("@microsoft/agents-telemetry");
+const crypto_1 = require("crypto");
+const MemoryCache_1 = require("../MemoryCache");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const fs_1 = __importDefault(require("fs"));
+const crypto_2 = __importDefault(require("crypto"));
+const observability_1 = require("../../observability");
+const agents_activity_1 = require("@microsoft/agents-activity");
+const errorHelper_1 = require("../../errorHelper");
+const audience = 'api://AzureADTokenExchange';
+const logger = (0, agents_telemetry_1.debug)('agents:msal');
+const agenticTokenRequestTimeoutMs = 30000;
+function isAbortError(error) {
+    return error instanceof Error && error.name === 'AbortError';
+}
+function createTokenRequestTimeoutError(timeoutMs) {
+    return agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.TokenRequestTimeout, undefined, { timeoutMs: timeoutMs.toString() });
+}
+/**
+ * Provides tokens using MSAL.
+ */
+class MsalTokenProvider {
+    constructor(connectionSettings) {
+        this.sysOptions = {
+            loggerOptions: {
+                logLevel: msal_node_1.LogLevel.Trace,
+                loggerCallback: (level, message, containsPii) => {
+                    if (containsPii) {
+                        return;
+                    }
+                    switch (level) {
+                        case msal_node_1.LogLevel.Error:
+                            logger.error(message);
+                            return;
+                        case msal_node_1.LogLevel.Info:
+                            logger.debug(message);
+                            return;
+                        case msal_node_1.LogLevel.Warning:
+                            if (!message.includes('Warning - No client info in response')) {
+                                logger.warn(message);
+                            }
+                            return;
+                        case msal_node_1.LogLevel.Verbose:
+                            logger.debug(message);
+                    }
+                },
+                piiLoggingEnabled: false
+            }
+        };
+        this.connectionSettings = connectionSettings;
+    }
+    /**
+     * Clears process-wide auth caches.
+     */
+    static clearSharedCaches() {
+        MsalTokenProvider._accessTokenCache.clear();
+        MsalTokenProvider._agenticTokenCache.clear();
+        MsalTokenProvider._confidentialClients.clear();
+    }
+    static cacheKey(...parts) {
+        return JSON.stringify(parts.map(part => part !== null && part !== void 0 ? part : ''));
+    }
+    static digest(value) {
+        return value ? crypto_2.default.createHash('sha256').update(value).digest('base64url') : '';
+    }
+    getOrCreateConfidentialClient(cacheKey, createClient) {
+        const existing = MsalTokenProvider._confidentialClients.get(cacheKey);
+        if (existing) {
+            MsalTokenProvider._confidentialClients.delete(cacheKey);
+            MsalTokenProvider._confidentialClients.set(cacheKey, existing);
+            return existing;
+        }
+        const created = createClient();
+        MsalTokenProvider._confidentialClients.set(cacheKey, created);
+        while (MsalTokenProvider._confidentialClients.size > MsalTokenProvider._maxConfidentialClients) {
+            const oldestKey = MsalTokenProvider._confidentialClients.keys().next().value;
+            if (oldestKey === undefined) {
+                break;
+            }
+            MsalTokenProvider._confidentialClients.delete(oldestKey);
+        }
+        return created;
+    }
+    getFileCacheIdentity(path) {
+        if (!path) {
+            return '';
+        }
+        try {
+            const stat = fs_1.default.statSync(path);
+            return `${path}:${stat.size}:${stat.mtimeMs}`;
+        }
+        catch {
+            return path;
+        }
+    }
+    getAccessTokenCacheKey(authConfig, scope) {
+        var _a, _b, _c, _d, _e;
+        const authType = (0, authConfiguration_1.resolveAuthType)(authConfig);
+        let authority = (0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId);
+        let credentialIdentity = '';
+        switch (authType) {
+            case authConfiguration_1.AuthType.ClientSecret:
+                credentialIdentity = MsalTokenProvider.digest(authConfig.clientSecret);
+                break;
+            case authConfiguration_1.AuthType.Certificate:
+            case authConfiguration_1.AuthType.CertificateSubjectName:
+                credentialIdentity = MsalTokenProvider.cacheKey(this.getFileCacheIdentity(authConfig.certPemFile), this.getFileCacheIdentity(authConfig.certKeyFile), authConfig.sendX5C);
+                break;
+            case authConfiguration_1.AuthType.WorkloadIdentity:
+                authority = `https://login.microsoftonline.com/${authConfig.tenantId}`;
+                credentialIdentity = this.getFileCacheIdentity((_b = authConfig.federatedTokenFile) !== null && _b !== void 0 ? _b : authConfig.WIDAssertionFile);
+                break;
+            case authConfiguration_1.AuthType.FederatedCredentials:
+                credentialIdentity = (_d = (_c = authConfig.federatedClientId) !== null && _c !== void 0 ? _c : authConfig.FICClientId) !== null && _d !== void 0 ? _d : '';
+                break;
+            case authConfiguration_1.AuthType.UserManagedIdentity:
+                authority = 'managed-identity';
+                credentialIdentity = (_e = authConfig.clientId) !== null && _e !== void 0 ? _e : '';
+                break;
+            case authConfiguration_1.AuthType.SystemManagedIdentity:
+                authority = 'managed-identity';
+                credentialIdentity = 'system';
+                break;
+            default:
+                credentialIdentity = 'unknown';
+        }
+        return MsalTokenProvider.cacheKey('access-token', authType, authority, authConfig.clientId, scope, authConfig.azureRegion, credentialIdentity);
+    }
+    cacheAccessToken(cacheKey, token, expiresOn) {
+        const ttlSeconds = this.getTokenCacheTtlSeconds(token, expiresOn);
+        if (ttlSeconds > 0) {
+            MsalTokenProvider._accessTokenCache.set(cacheKey, token, ttlSeconds);
+        }
+    }
+    cacheAgenticToken(cacheKey, token, ttlSeconds) {
+        const safeTtlSeconds = Math.floor(ttlSeconds) - 300;
+        if (safeTtlSeconds > 0) {
+            MsalTokenProvider._agenticTokenCache.set(cacheKey, token, safeTtlSeconds);
+        }
+    }
+    cacheAgenticAuthenticationResult(cacheKey, token) {
+        const ttlSeconds = this.getTokenCacheTtlSeconds(token.accessToken, token.expiresOn);
+        if (ttlSeconds > 0) {
+            MsalTokenProvider._agenticTokenCache.set(cacheKey, token.accessToken, ttlSeconds);
+        }
+    }
+    getAgenticTokenCacheKey(tenantId, clientId, scopes, tokenBodyParameters) {
+        const bodyKey = Object.keys(tokenBodyParameters)
+            .sort()
+            .filter(key => key !== 'user_federated_identity_credential')
+            .map(key => `${key}=${MsalTokenProvider.digest(String(tokenBodyParameters[key]))}`)
+            .join('&');
+        return MsalTokenProvider.cacheKey('agentic-token', this.resolveAuthority(tenantId), clientId, scopes.join(' '), bodyKey);
+    }
+    getTokenCacheTtlSeconds(token, expiresOn) {
+        var _a;
+        const expiresAtMs = (_a = expiresOn === null || expiresOn === void 0 ? void 0 : expiresOn.getTime()) !== null && _a !== void 0 ? _a : this.getJwtExpiresAtMs(token);
+        if (!expiresAtMs) {
+            return 0;
+        }
+        return Math.floor((expiresAtMs - Date.now()) / 1000) - 300;
+    }
+    getJwtExpiresAtMs(token) {
+        const payload = jsonwebtoken_1.default.decode(token);
+        if (!payload || typeof payload === 'string' || typeof payload.exp !== 'number') {
+            return undefined;
+        }
+        return payload.exp * 1000;
+    }
+    getClientSecretClient(authConfig) {
+        var _a;
+        const cacheKey = MsalTokenProvider.cacheKey('confidential-client', authConfiguration_1.AuthType.ClientSecret, authConfig.clientId, (0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId), MsalTokenProvider.digest(authConfig.clientSecret));
+        return this.getOrCreateConfidentialClient(cacheKey, () => {
+            var _a;
+            return new msal_node_1.ConfidentialClientApplication({
+                auth: {
+                    clientId: authConfig.clientId,
+                    authority: (0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId),
+                    clientSecret: authConfig.clientSecret
+                },
+                system: this.sysOptions
+            });
+        });
+    }
+    getCertificateClient(authConfig) {
+        var _a, _b;
+        const cacheKey = MsalTokenProvider.cacheKey('confidential-client', (_a = authConfig.authType) !== null && _a !== void 0 ? _a : authConfiguration_1.AuthType.Certificate, authConfig.clientId, (0, authConfiguration_1.resolveAuthority)((_b = authConfig.authorityEndpoint) !== null && _b !== void 0 ? _b : authConfig.authority, authConfig.tenantId), this.getFileCacheIdentity(authConfig.certPemFile), this.getFileCacheIdentity(authConfig.certKeyFile), authConfig.sendX5C);
+        return this.getOrCreateConfidentialClient(cacheKey, () => {
+            var _a;
+            const privateKeySource = fs_1.default.readFileSync(authConfig.certKeyFile);
+            const privateKeyObject = crypto_2.default.createPrivateKey({
+                key: privateKeySource,
+                format: 'pem'
+            });
+            const privateKey = privateKeyObject.export({
+                format: 'pem',
+                type: 'pkcs8'
+            });
+            const pemFile = fs_1.default.readFileSync(authConfig.certPemFile);
+            const pubKeyObject = new crypto_2.default.X509Certificate(pemFile);
+            return new msal_node_1.ConfidentialClientApplication({
+                auth: {
+                    clientId: authConfig.clientId || '',
+                    authority: (0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId),
+                    clientCertificate: {
+                        privateKey: privateKey,
+                        thumbprint: pubKeyObject.fingerprint.replaceAll(':', ''),
+                        x5c: pemFile.toString()
+                    }
+                },
+                system: this.sysOptions
+            });
+        });
+    }
+    async getAccessToken(authConfigOrScope, scope) {
+        return (0, agents_telemetry_1.trace)(observability_1.AuthenticationTraceDefinitions.getAccessToken, async ({ record }) => {
+            var _a;
+            let authConfig;
+            let actualScope;
+            if (typeof authConfigOrScope === 'string') {
+                // Called as getAccessToken(scope)
+                if (!this.connectionSettings) {
+                    throw new Error('Connection settings must be provided to constructor when calling getAccessToken(scope)');
+                }
+                authConfig = this.connectionSettings;
+                actualScope = authConfigOrScope;
+            }
+            else {
+                // Called as getAccessToken(authConfig, scope)
+                authConfig = authConfigOrScope;
+                actualScope = scope;
+            }
+            record({ scope: actualScope });
+            if (!authConfig.clientId && process.env.NODE_ENV !== 'production') {
+                record({ method: 'unknown' });
+                return '';
+            }
+            const accessTokenCacheKey = this.getAccessTokenCacheKey(authConfig, actualScope);
+            const cachedAccessToken = MsalTokenProvider._accessTokenCache.get(accessTokenCacheKey);
+            if (cachedAccessToken) {
+                logger.debug('getAccessToken cache hit clientId=%s scope=%s', authConfig.clientId, actualScope);
+                return cachedAccessToken;
+            }
+            let token;
+            const authType = (0, authConfiguration_1.resolveAuthType)(authConfig);
+            record({ method: authType });
+            logger.debug('getAccessToken via method=%s clientId=%s scope=%s', authType, authConfig.clientId, actualScope);
+            switch (authType) {
+                case authConfiguration_1.AuthType.WorkloadIdentity: {
+                    const tokenFilePath = (_a = authConfig.federatedTokenFile) !== null && _a !== void 0 ? _a : authConfig.WIDAssertionFile;
+                    if (!tokenFilePath) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.WorkloadIdentityTokenFileRequired);
+                    }
+                    token = await this.acquireAccessTokenViaWID(authConfig, actualScope);
+                    break;
+                }
+                case authConfiguration_1.AuthType.FederatedCredentials:
+                    if (!authConfig.federatedClientId && !authConfig.FICClientId) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FICClientIdRequired);
+                    }
+                    token = await this.acquireAccessTokenViaFIC(authConfig, actualScope);
+                    break;
+                case authConfiguration_1.AuthType.ClientSecret:
+                    if (!authConfig.clientSecret) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ClientSecretRequired);
+                    }
+                    token = await this.acquireAccessTokenViaSecret(authConfig, actualScope);
+                    break;
+                case authConfiguration_1.AuthType.Certificate:
+                case authConfiguration_1.AuthType.CertificateSubjectName:
+                    if (!authConfig.certPemFile || !authConfig.certKeyFile) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.CertificateFilesRequired);
+                    }
+                    token = await this.acquireTokenWithCertificate(authConfig, actualScope);
+                    break;
+                case authConfiguration_1.AuthType.UserManagedIdentity:
+                    if (!authConfig.clientId) {
+                        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ClientIdRequiredForUserManagedIdentity);
+                    }
+                    token = await this.acquireTokenWithUserAssignedIdentity(authConfig, actualScope);
+                    break;
+                case authConfiguration_1.AuthType.SystemManagedIdentity:
+                    token = await this.acquireTokenWithSystemAssignedIdentity(authConfig, actualScope);
+                    break;
+                default:
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.UnsupportedAuthType, undefined, { authType });
+            }
+            if (token === undefined) {
+                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FailedToAcquireToken);
+            }
+            this.cacheAccessToken(accessTokenCacheKey, token);
+            return token;
+        });
+    }
+    async acquireTokenOnBehalfOf(authConfigOrScopes, scopesOrOboAssertion, oboAssertion) {
+        return (0, agents_telemetry_1.trace)(observability_1.AuthenticationTraceDefinitions.acquireTokenOnBehalfOf, async ({ record }) => {
+            let authConfig;
+            let actualScopes;
+            let actualOboAssertion;
+            if (Array.isArray(authConfigOrScopes)) {
+                // Called as acquireTokenOnBehalfOf(scopes, oboAssertion)
+                if (!this.connectionSettings) {
+                    throw new Error('Connection settings must be provided to constructor when calling acquireTokenOnBehalfOf(scopes, oboAssertion)');
+                }
+                authConfig = this.connectionSettings;
+                actualScopes = authConfigOrScopes;
+                actualOboAssertion = scopesOrOboAssertion;
+            }
+            else {
+                // Called as acquireTokenOnBehalfOf(authConfig, scopes, oboAssertion)
+                authConfig = authConfigOrScopes;
+                actualScopes = scopesOrOboAssertion;
+                actualOboAssertion = oboAssertion;
+            }
+            record({ scopes: actualScopes });
+            logger.debug('acquireTokenOnBehalfOf clientId=%s scopes=%o', authConfig.clientId, actualScopes);
+            const cca = this.getClientSecretClient(authConfig);
+            const token = await cca.acquireTokenOnBehalfOf({
+                oboAssertion: actualOboAssertion,
+                scopes: actualScopes
+            });
+            if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
+                throw new Error('Failed to acquire token on behalf of user');
+            }
+            return token.accessToken;
+        });
+    }
+    async getAgenticInstanceToken(tenantId, agentAppInstanceId) {
+        return (0, agents_telemetry_1.trace)(observability_1.AuthenticationTraceDefinitions.getAgenticInstanceToken, async ({ record }) => {
+            var _a;
+            logger.debug('getAgenticInstanceToken tenantId=%s agentAppInstanceId=%s', tenantId, agentAppInstanceId);
+            record({ agenticInstanceId: agentAppInstanceId });
+            if (!this.connectionSettings) {
+                throw new Error('Connection settings must be provided when calling getAgenticInstanceToken');
+            }
+            const instanceTokenCacheKey = MsalTokenProvider.cacheKey('agentic-instance-token', this.resolveAuthority(tenantId), agentAppInstanceId, this.connectionSettings.clientId, this.connectionSettings.azureRegion);
+            const cachedInstanceToken = MsalTokenProvider._agenticTokenCache.get(instanceTokenCacheKey);
+            if (cachedInstanceToken) {
+                return cachedInstanceToken;
+            }
+            const appToken = await this.getAgenticApplicationToken(tenantId, agentAppInstanceId);
+            const cca = new msal_node_1.ConfidentialClientApplication({
+                auth: {
+                    clientId: agentAppInstanceId,
+                    clientAssertion: appToken,
+                    authority: this.resolveAuthority(tenantId),
+                },
+                system: this.sysOptions
+            });
+            const token = await cca.acquireTokenByClientCredential({
+                scopes: ['api://AzureAdTokenExchange/.default'],
+                correlationId: (0, crypto_1.randomUUID)(),
+                azureRegion: (_a = this.connectionSettings) === null || _a === void 0 ? void 0 : _a.azureRegion
+            });
+            if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
+                throw new Error(`Failed to acquire instance token for agent instance: ${agentAppInstanceId}`);
+            }
+            this.cacheAgenticAuthenticationResult(instanceTokenCacheKey, token);
+            return token.accessToken;
+        });
+    }
+    /**
+     * This method can optionally accept a tenant ID that overrides the tenant ID in the connection settings.
+     * The passed tenantId is always preferred over the configured tenantId when present.
+     * @param tenantId
+     * @returns
+     */
+    resolveAuthority(tenantId) {
+        var _a;
+        const { authorityEndpoint: configuredAuth, authority, tenantId: configuredTenantId } = (_a = this.connectionSettings) !== null && _a !== void 0 ? _a : {};
+        if (!tenantId) {
+            // No agentic tenant override — delegate to shared utility
+            return (0, authConfiguration_1.resolveAuthority)(configuredAuth !== null && configuredAuth !== void 0 ? configuredAuth : authority, configuredTenantId);
+        }
+        // Agentic override: build a clean base using the override tenant, then replace any
+        // /common or GUID placeholder left in the authority (e.g. from a multi-tenant config)
+        const base = (0, authConfiguration_1.resolveAuthority)(configuredAuth !== null && configuredAuth !== void 0 ? configuredAuth : authority, tenantId);
+        const guidPattern = /\/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+        if (base.endsWith('/common') || guidPattern.test(base)) {
+            return base.replace(/\/(?:common|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})(?=\/|$)/, `/${tenantId}`);
+        }
+        return base;
+    }
+    /**
+     * Does a direct HTTP call to acquire a token for agentic scenarios - do not use this directly!
+     * This method will be removed once MSAL is updated with the necessary features.
+     * (This is required in order to pass additional parameters into the auth call)
+     * @param tenantId
+     * @param clientId
+     * @param clientAssertion
+     * @param scopes
+     * @param tokenBodyParameters
+     * @returns
+     */
+    async acquireTokenForAgenticScenarios(tenantId, clientId, clientAssertion, scopes, tokenBodyParameters) {
+        if (!this.connectionSettings) {
+            throw new Error('Connection settings must be provided when calling getAgenticInstanceToken');
+        }
+        logger.debug('acquireTokenForAgenticScenarios clientId=%s tenantId=%s scopes=%o grant_type=%s', clientId, tenantId, scopes, tokenBodyParameters.grant_type);
+        // Check cache first
+        const cacheKey = this.getAgenticTokenCacheKey(tenantId, clientId, scopes, tokenBodyParameters);
+        if (MsalTokenProvider._agenticTokenCache.get(cacheKey)) {
+            return MsalTokenProvider._agenticTokenCache.get(cacheKey);
+        }
+        const url = `${this.resolveAuthority(tenantId)}/oauth2/v2.0/token`;
+        const data = {
+            client_id: clientId,
+            scope: scopes.join(' '),
+            ...tokenBodyParameters
+        };
+        if (clientAssertion) {
+            data.client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+            data.client_assertion = clientAssertion;
+        }
+        else {
+            data.client_secret = this.connectionSettings.clientSecret;
+        }
+        if (data.grant_type !== 'user_fic') {
+            data.client_info = '2';
+        }
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => {
+            controller.abort(createTokenRequestTimeoutError(agenticTokenRequestTimeoutMs));
+        }, agenticTokenRequestTimeoutMs);
+        const token = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8'
+            },
+            body: new URLSearchParams(data).toString(),
+            signal: controller.signal
+        }).then(async (response) => {
+            if (!response.ok) {
+                const errorBody = await response.text();
+                const error = new Error(`Token request failed with status ${response.status}: ${errorBody}`);
+                error.toJSON = () => ({ status: response.status, body: errorBody });
+                throw error;
+            }
+            return response.json();
+        }).catch((error) => {
+            const resolvedError = isAbortError(error)
+                ? (controller.signal.reason instanceof Error ? controller.signal.reason : createTokenRequestTimeoutError(agenticTokenRequestTimeoutMs))
+                : error;
+            logger.error('Error acquiring token: ', resolvedError.toJSON ? resolvedError.toJSON() : resolvedError);
+            throw resolvedError;
+        }).finally(() => {
+            clearTimeout(timeoutId);
+        });
+        // capture token, expire local cache 5 minutes early
+        this.cacheAgenticToken(cacheKey, token.access_token, token.expires_in);
+        return token.access_token;
+    }
+    async getAgenticUserToken(tenantId, agentAppInstanceId, agenticUserId, scopes) {
+        return (0, agents_telemetry_1.trace)(observability_1.AuthenticationTraceDefinitions.getAgenticUserToken, async ({ record }) => {
+            logger.debug('getAgenticUserToken tenantId=%s agentAppInstanceId=%s scopes=%o', tenantId, agentAppInstanceId, scopes);
+            record({ agenticInstanceId: agentAppInstanceId, agenticUserId, scopes });
+            const userTokenParameters = {
+                user_id: agenticUserId,
+                grant_type: 'user_fic',
+            };
+            const userTokenCacheKey = this.getAgenticTokenCacheKey(tenantId, agentAppInstanceId, scopes, userTokenParameters);
+            const cachedUserToken = MsalTokenProvider._agenticTokenCache.get(userTokenCacheKey);
+            if (cachedUserToken) {
+                return cachedUserToken;
+            }
+            const agentToken = await this.getAgenticApplicationToken(tenantId, agentAppInstanceId);
+            const instanceToken = await this.getAgenticInstanceToken(tenantId, agentAppInstanceId);
+            const token = await this.acquireTokenForAgenticScenarios(tenantId, agentAppInstanceId, agentToken, scopes, {
+                ...userTokenParameters,
+                user_federated_identity_credential: instanceToken,
+            });
+            if (!token) {
+                throw new Error(`Failed to acquire instance token for user token: ${agentAppInstanceId}`);
+            }
+            return token;
+        });
+    }
+    async getAgenticApplicationToken(tenantId, agentAppInstanceId) {
+        var _a, _b;
+        if (!((_a = this.connectionSettings) === null || _a === void 0 ? void 0 : _a.clientId)) {
+            throw new Error('Connection settings must be provided when calling getAgenticApplicationToken');
+        }
+        logger.debug('getAgenticApplicationToken clientId=%s tenantId=%s agentAppInstanceId=%s', this.connectionSettings.clientId, tenantId, agentAppInstanceId);
+        const authType = (0, authConfiguration_1.resolveAuthType)(this.connectionSettings);
+        if (authType === authConfiguration_1.AuthType.IdentityProxyManager) {
+            let resource;
+            if (!this.connectionSettings.idpmResource) {
+                resource = 'api://AzureAdTokenExchange/.default';
+            }
+            else if (!URL.canParse(this.connectionSettings.idpmResource)) {
+                throw new Error('idpmResource must be a valid absolute URI');
+            }
+            else {
+                resource = this.connectionSettings.idpmResource;
+            }
+            const msiApp = new msal_node_1.ManagedIdentityApplication({
+                managedIdentityIdParams: {
+                    userAssignedClientId: this.connectionSettings.clientId
+                },
+                system: this.sysOptions
+            });
+            const tokenResult = await msiApp.acquireToken({ resource });
+            if (!(tokenResult === null || tokenResult === void 0 ? void 0 : tokenResult.accessToken)) {
+                throw new Error(`Failed to acquire token via IdentityProxyManager for agent instance: ${agentAppInstanceId}`);
+            }
+            logger.debug('getAgenticApplicationToken via IdentityProxyManager clientId=%s resource=%s', this.connectionSettings.clientId, resource);
+            return tokenResult.accessToken;
+        }
+        let clientAssertion;
+        switch (authType) {
+            case authConfiguration_1.AuthType.WorkloadIdentity: {
+                const tokenFilePath = (_b = this.connectionSettings.federatedTokenFile) !== null && _b !== void 0 ? _b : this.connectionSettings.WIDAssertionFile;
+                if (tokenFilePath === undefined) {
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.WorkloadIdentityTokenFileRequired);
+                }
+                clientAssertion = fs_1.default.readFileSync(tokenFilePath, 'utf8');
+                break;
+            }
+            case authConfiguration_1.AuthType.FederatedCredentials:
+                if (!this.connectionSettings.federatedClientId && !this.connectionSettings.FICClientId) {
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.FICClientIdRequired);
+                }
+                clientAssertion = await this.fetchExternalToken(this.connectionSettings.federatedClientId || this.connectionSettings.FICClientId);
+                break;
+            case authConfiguration_1.AuthType.Certificate:
+            case authConfiguration_1.AuthType.CertificateSubjectName:
+                if (!this.connectionSettings.certPemFile || !this.connectionSettings.certKeyFile) {
+                    throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.CertificateFilesRequired);
+                }
+                clientAssertion = this.getAssertionFromCert(this.connectionSettings);
+                break;
+        }
+        const token = await this.acquireTokenForAgenticScenarios(tenantId, this.connectionSettings.clientId, clientAssertion, ['api://AzureAdTokenExchange/.default'], {
+            grant_type: 'client_credentials',
+            fmi_path: agentAppInstanceId,
+        });
+        if (!token) {
+            throw new Error(`Failed to acquire token for agent instance: ${agentAppInstanceId}`);
+        }
+        return token;
+    }
+    /**
+     * Generates the client assertion using the provided certificate.
+     * @param authConfig The authentication configuration.
+     * @returns The client assertion.
+     */
+    getAssertionFromCert(authConfig) {
+        const base64url = (buf) => buf.toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+        const privateKeyPem = fs_1.default.readFileSync(authConfig.certKeyFile);
+        const pemFile = fs_1.default.readFileSync(authConfig.certPemFile);
+        const pubKeyObject = new crypto_2.default.X509Certificate(pemFile);
+        const der = pubKeyObject.raw;
+        const x5tS256 = base64url(crypto_2.default.createHash('sha256').update(der).digest());
+        let x5c;
+        if (authConfig.sendX5C) {
+            x5c = pemFile.toString();
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const payload = {
+            aud: `${this.resolveAuthority(authConfig.tenantId)}/oauth2/v2.0/token`,
+            iss: authConfig.clientId,
+            sub: authConfig.clientId,
+            jti: (0, crypto_1.randomUUID)(),
+            nbf: now,
+            iat: now,
+            exp: now + 600, // 10 minutes
+        };
+        return jsonwebtoken_1.default.sign(payload, privateKeyPem, {
+            algorithm: 'PS256',
+            header: { alg: 'PS256', typ: 'JWT', 'x5t#S256': x5tS256, x5c }
+        });
+    }
+    /**
+     * Acquires a token using a user-assigned identity.
+     * @param authConfig The authentication configuration.
+     * @param scope The scope for the token.
+     * @returns A promise that resolves to the access token.
+     */
+    async acquireTokenWithUserAssignedIdentity(authConfig, scope) {
+        const mia = new msal_node_1.ManagedIdentityApplication({
+            managedIdentityIdParams: {
+                userAssignedClientId: authConfig.clientId || ''
+            },
+            system: this.sysOptions
+        });
+        const token = await mia.acquireToken({
+            resource: scope
+        });
+        return token === null || token === void 0 ? void 0 : token.accessToken;
+    }
+    /**
+     * Acquires a token using a system-assigned identity.
+     * @param authConfig The authentication configuration.
+     * @param scope The scope for the token.
+     * @returns A promise that resolves to the access token.
+     */
+    async acquireTokenWithSystemAssignedIdentity(authConfig, scope) {
+        const mia = new msal_node_1.ManagedIdentityApplication({
+            system: this.sysOptions
+        });
+        const token = await mia.acquireToken({
+            resource: scope
+        });
+        return token === null || token === void 0 ? void 0 : token.accessToken;
+    }
+    /**
+     * Acquires a token using a certificate.
+     * @param authConfig The authentication configuration.
+     * @param scope The scope for the token.
+     * @returns A promise that resolves to the access token.
+     */
+    async acquireTokenWithCertificate(authConfig, scope) {
+        const cca = this.getCertificateClient(authConfig);
+        const token = await cca.acquireTokenByClientCredential({
+            scopes: [`${scope}/.default`],
+            correlationId: (0, crypto_1.randomUUID)(),
+            azureRegion: authConfig.azureRegion
+        });
+        if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
+            throw new Error('Failed to acquire token using certificate');
+        }
+        return token.accessToken;
+    }
+    /**
+     * Acquires a token using a client secret.
+     * @param authConfig The authentication configuration.
+     * @param scope The scope for the token.
+     * @returns A promise that resolves to the access token.
+     */
+    async acquireAccessTokenViaSecret(authConfig, scope) {
+        const cca = this.getClientSecretClient(authConfig);
+        const token = await cca.acquireTokenByClientCredential({
+            scopes: [`${scope}/.default`],
+            correlationId: (0, crypto_1.randomUUID)(),
+            azureRegion: authConfig.azureRegion
+        });
+        if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
+            throw new Error('Failed to acquire token using client secret');
+        }
+        return token.accessToken;
+    }
+    /**
+     * Acquires a token using a FIC client assertion.
+     * @param authConfig The authentication configuration.
+     * @param scope The scope for the token.
+     * @returns A promise that resolves to the access token.
+     */
+    async acquireAccessTokenViaFIC(authConfig, scope) {
+        var _a;
+        const scopes = [`${scope}/.default`];
+        const clientAssertion = await this.fetchExternalToken(authConfig.federatedClientId || authConfig.FICClientId);
+        const cca = new msal_node_1.ConfidentialClientApplication({
+            auth: {
+                clientId: authConfig.clientId,
+                authority: `${(_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority}/${authConfig.tenantId}`,
+                clientAssertion
+            },
+            system: this.sysOptions
+        });
+        const token = await cca.acquireTokenByClientCredential({ scopes, azureRegion: authConfig.azureRegion });
+        logger.debug('got token using FIC client assertion');
+        if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
+            throw new Error('Failed to acquire token using FIC client assertion');
+        }
+        return token.accessToken;
+    }
+    /**
+     * Acquires a token using a Workload Identity client assertion.
+     * @param authConfig The authentication configuration.
+     * @param scope The scope for the token.
+     * @returns A promise that resolves to the access token.
+     */
+    async acquireAccessTokenViaWID(authConfig, scope) {
+        var _a;
+        const scopes = [`${scope}/.default`];
+        const tokenFilePath = (_a = authConfig.federatedTokenFile) !== null && _a !== void 0 ? _a : authConfig.WIDAssertionFile;
+        const clientAssertion = fs_1.default.readFileSync(tokenFilePath, 'utf8');
+        const cca = new msal_node_1.ConfidentialClientApplication({
+            auth: {
+                clientId: authConfig.clientId,
+                authority: `https://login.microsoftonline.com/${authConfig.tenantId}`,
+                clientAssertion
+            },
+            system: this.sysOptions
+        });
+        const token = await cca.acquireTokenByClientCredential({ scopes, azureRegion: authConfig.azureRegion });
+        logger.debug('got token using WID client assertion');
+        if (!(token === null || token === void 0 ? void 0 : token.accessToken)) {
+            throw new Error('Failed to acquire token using WID client assertion');
+        }
+        return token.accessToken;
+    }
+    /**
+     * Fetches an external token.
+     * @param FICClientId The FIC client ID.
+     * @returns A promise that resolves to the external token.
+     */
+    async fetchExternalToken(FICClientId) {
+        const managedIdentityClientAssertion = new msal_node_1.ManagedIdentityApplication({
+            managedIdentityIdParams: {
+                userAssignedClientId: FICClientId
+            },
+            system: this.sysOptions
+        });
+        const response = await managedIdentityClientAssertion.acquireToken({
+            resource: audience,
+            forceRefresh: true
+        });
+        logger.debug('got token for FIC');
+        if (!(response === null || response === void 0 ? void 0 : response.accessToken)) {
+            throw new Error('Failed to acquire external token for FIC client assertion');
+        }
+        return response.accessToken;
+    }
+}
+exports.MsalTokenProvider = MsalTokenProvider;
+MsalTokenProvider._accessTokenCache = new MemoryCache_1.MemoryCache();
+MsalTokenProvider._agenticTokenCache = new MemoryCache_1.MemoryCache();
+MsalTokenProvider._confidentialClients = new Map();
+MsalTokenProvider._maxConfidentialClients = 100;
+//# sourceMappingURL=msalTokenProvider.js.map