@microsoft/agents-hosting 1.6.1 → 1.7.0-beta.1.g8bcd4f11a7

package/dist/src/auth/{msalConnectionManager.js → connectionManager.js}

@@ -4,41 +4,58 @@
  * Licensed under the MIT License.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MsalConnectionManager = void 0;
+exports.ConnectionManager = exports.defaultAuthProviderFactory = void 0;
 const agents_activity_1 = require("@microsoft/agents-activity");
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
 const authConfiguration_1 = require("./authConfiguration");
-const msalTokenProvider_1 = require("./msalTokenProvider");
+const msalTokenProvider_1 = require("./msal/msalTokenProvider");
+const sidecarAuthProvider_1 = require("./sidecar/sidecarAuthProvider");
+const errorHelper_1 = require("../errorHelper");
 const logger = (0, agents_telemetry_1.debug)('agents:authorization:connections');
-class MsalConnectionManager {
-    constructor(connectionsConfigurations = new Map(), connectionsMap = [], configuration = {}) {
-        var _a, _b, _c, _d;
+/**
+ * Default {@link AuthProviderFactory} that dispatches per-connection by `authType`: connections with
+ * `authType` set to `EntraAuthSideCar` use {@link SidecarAuthProvider}; all others use
+ * {@link MsalTokenProvider}.
+ * @param config The connection authentication configuration.
+ * @returns The auth provider for the connection.
+ */
+const defaultAuthProviderFactory = (config) => (config === null || config === void 0 ? void 0 : config.authType) === authConfiguration_1.AuthType.EntraAuthSideCar
+    ? new sidecarAuthProvider_1.SidecarAuthProvider(config)
+    : new msalTokenProvider_1.MsalTokenProvider(config);
+exports.defaultAuthProviderFactory = defaultAuthProviderFactory;
+/**
+ * Generic, provider-agnostic connection manager. Dispatches connections to any {@link AuthProvider}
+ * implementation produced by the supplied {@link AuthProviderFactory}, while owning the
+ * provider-independent connection routing logic (audience matching, service URL dispatch,
+ * `altBlueprintConnectionName` handling, default connection resolution).
+ */
+class ConnectionManager {
+    /**
+     * Creates a new {@link ConnectionManager}.
+     * @param providerFactory Factory used to instantiate an {@link AuthProvider} for each connection.
+     * @param connectionsConfigurations Map of connection names to their authentication configurations.
+     * @param connectionsMap Map items used to route activities to connections.
+     * @param configuration Fallback authentication configuration (used when the above are empty).
+     */
+    constructor(providerFactory = exports.defaultAuthProviderFactory, connectionsConfigurations = new Map(), connectionsMap = [], configuration = {}) {
+        var _a, _b, _c;
         this._connections = new Map();
         this._connectionsMap = connectionsMap.length > 0 ? connectionsMap : (configuration.connectionsMap || []);
         this._serviceConnectionConfiguration = {};
         const providedConnections = connectionsConfigurations.size > 0 ? connectionsConfigurations : (configuration.connections || new Map());
         for (const [name, config] of providedConnections) {
-            // Instantiate MsalTokenProvider for each connection
-            this._connections.set(name, new msalTokenProvider_1.MsalTokenProvider(config));
-            if (name === MsalConnectionManager.DEFAULT_CONNECTION) {
+            this._connections.set(name, providerFactory(config));
+            if (name === ConnectionManager.DEFAULT_CONNECTION) {
                 this._serviceConnectionConfiguration = config;
             }
         }
         for (const [name, provider] of this._connections.entries()) {
             const cfg = provider.connectionSettings;
-            const authType = (_a = cfg === null || cfg === void 0 ? void 0 : cfg.authType) !== null && _a !== void 0 ? _a : ((cfg === null || cfg === void 0 ? void 0 : cfg.certPemFile)
-                ? authConfiguration_1.AuthType.Certificate
-                : (cfg === null || cfg === void 0 ? void 0 : cfg.clientSecret)
-                    ? authConfiguration_1.AuthType.ClientSecret
-                    : (cfg === null || cfg === void 0 ? void 0 : cfg.WIDAssertionFile)
-                        ? authConfiguration_1.AuthType.WorkloadIdentity
-                        : (cfg === null || cfg === void 0 ? void 0 : cfg.federatedClientId) || (cfg === null || cfg === void 0 ? void 0 : cfg.FICClientId)
-                            ? authConfiguration_1.AuthType.FederatedCredentials
-                            : 'none');
-            logger.debug('connection "%s" clientId=%s tenantId=%s authType=%s', name, (_b = cfg === null || cfg === void 0 ? void 0 : cfg.clientId) !== null && _b !== void 0 ? _b : '<none>', (_c = cfg === null || cfg === void 0 ? void 0 : cfg.tenantId) !== null && _c !== void 0 ? _c : '<none>', authType);
+            const authType = (0, authConfiguration_1.resolveAuthType)(cfg);
+            logger.debug('connection "%s" clientId=%s tenantId=%s authType=%s', name, (_a = (0, agents_telemetry_1.redactString)(cfg === null || cfg === void 0 ? void 0 : cfg.clientId, true)) !== null && _a !== void 0 ? _a : '<none>', (_b = (0, agents_telemetry_1.redactString)(cfg === null || cfg === void 0 ? void 0 : cfg.tenantId, true)) !== null && _b !== void 0 ? _b : '<none>', authType);
         }
         for (const item of this._connectionsMap) {
-            logger.debug('connectionsMap: %s -> %s audience=%s', item.serviceUrl, item.connection, (_d = item.audience) !== null && _d !== void 0 ? _d : '');
+            logger.debug('connectionsMap: %s -> %s audience=%s', item.serviceUrl, item.connection, (_c = item.audience) !== null && _c !== void 0 ? _c : '');
         }
     }
     /**
@@ -49,7 +66,7 @@ class MsalConnectionManager {
     getConnection(connectionName) {
         const conn = this._connections.get(connectionName);
         if (!conn) {
-            throw new Error(`Connection not found: ${connectionName}`);
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.ConnectionNotFound, undefined, { connectionName });
         }
         return this.applyConnectionDefaults(conn);
     }
@@ -59,7 +76,7 @@ class MsalConnectionManager {
      */
     getDefaultConnection() {
         if (this._connections.size === 0) {
-            throw new Error('No connections found for this Agent in the Connections Configuration.');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.NoConnectionsFoundInConfiguration);
         }
         // Return the wildcard map item instance.
         for (const item of this._connectionsMap) {
@@ -90,7 +107,7 @@ class MsalConnectionManager {
      */
     getTokenProvider(identity, serviceUrl) {
         if (!identity) {
-            throw new Error('Identity is required to get the token provider.');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.IdentityRequiredForTokenProvider);
         }
         let audience;
         if (Array.isArray(identity === null || identity === void 0 ? void 0 : identity.aud)) {
@@ -100,7 +117,7 @@ class MsalConnectionManager {
             audience = identity.aud;
         }
         if (!audience || !serviceUrl)
-            throw new Error('Audience and Service URL are required to get the token provider.');
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.AudienceAndServiceUrlRequiredForTokenProvider);
         if (this._connectionsMap.length === 0) {
             logger.debug('no connectionsMap, using default connection for serviceUrl=%s', serviceUrl);
             return this.getDefaultConnection();
@@ -123,7 +140,7 @@ class MsalConnectionManager {
                 }
             }
         }
-        throw new Error(`No connection found for audience: ${audience} and serviceUrl: ${serviceUrl}`);
+        throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.NoConnectionForAudienceAndServiceUrl, undefined, { audience: String(audience), serviceUrl });
     }
     /**
      * Finds a connection based on an activity's blueprint.
@@ -152,31 +169,16 @@ class MsalConnectionManager {
     getDefaultConnectionConfiguration() {
         return this._serviceConnectionConfiguration;
     }
+    /**
+     * Applies provider-specific defaults to a resolved connection before returning it. The generic
+     * base performs no mutation; provider-specific managers may override this.
+     * @param conn The resolved auth provider.
+     * @returns The auth provider, possibly with defaults applied.
+     */
     applyConnectionDefaults(conn) {
-        var _a, _b, _c, _d, _e;
-        var _f, _g, _h;
-        if (conn.connectionSettings) {
-            (_a = (_f = conn.connectionSettings).authorityEndpoint) !== null && _a !== void 0 ? _a : (_f.authorityEndpoint = conn.connectionSettings.authority || 'https://login.microsoftonline.com');
-            (_b = (_g = conn.connectionSettings).authority) !== null && _b !== void 0 ? _b : (_g.authority = conn.connectionSettings.authorityEndpoint);
-            (_c = (_h = conn.connectionSettings).issuers) !== null && _c !== void 0 ? _c : (_h.issuers = [
-                'https://api.botframework.com',
-                `${(0, authConfiguration_1.resolveAuthority)('https://sts.windows.net', conn.connectionSettings.tenantId)}/`,
-                `${(0, authConfiguration_1.resolveAuthority)(conn.connectionSettings.authorityEndpoint, conn.connectionSettings.tenantId)}/v2.0`
-            ]);
-            // For backward compatibility
-            if (conn.connectionSettings.federatedClientId) {
-                conn.connectionSettings.FICClientId = conn.connectionSettings.federatedClientId;
-            }
-            if ((_d = conn.connectionSettings.scopes) === null || _d === void 0 ? void 0 : _d.length) {
-                conn.connectionSettings.scope = (_e = conn.connectionSettings.scopes) === null || _e === void 0 ? void 0 : _e[0];
-            }
-            if (conn.connectionSettings.authorityEndpoint) {
-                conn.connectionSettings.authority = conn.connectionSettings.authorityEndpoint;
-            }
-        }
         return conn;
     }
 }
-exports.MsalConnectionManager = MsalConnectionManager;
-MsalConnectionManager.DEFAULT_CONNECTION = 'serviceConnection';
-//# sourceMappingURL=msalConnectionManager.js.map
+exports.ConnectionManager = ConnectionManager;
+ConnectionManager.DEFAULT_CONNECTION = 'serviceConnection';
+//# sourceMappingURL=connectionManager.js.map

package/dist/src/auth/connectionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectionManager.js","sourceRoot":"","sources":["../../../src/auth/connectionManager.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,gEAAiF;AACjF,kEAAiE;AACjE,2DAAkF;AAGlF,gEAA4D;AAC5D,uEAAmE;AAEnE,gDAAuC;AAGvC,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,kCAAkC,CAAC,CAAA;AAQxD;;;;;;GAMG;AACI,MAAM,0BAA0B,GAAwB,CAAC,MAAyB,EAAgB,EAAE,CACzG,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,MAAK,4BAAQ,CAAC,gBAAgB;IAC5C,CAAC,CAAC,IAAI,yCAAmB,CAAC,MAAM,CAAC;IACjC,CAAC,CAAC,IAAI,qCAAiB,CAAC,MAAM,CAAC,CAAA;AAHtB,QAAA,0BAA0B,8BAGJ;AAEnC;;;;;GAKG;AACH,MAAa,iBAAiB;IAM5B;;;;;;OAMG;IACH,YACE,kBAAuC,kCAA0B,EACjE,4BAA4D,IAAI,GAAG,EAAE,EACrE,iBAAsC,EAAE,EACxC,gBAAmC,EAAE;;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,EAAE,CAAA;QAC7B,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;QACxG,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAA;QAEzC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;QAErI,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;YACpD,IAAI,IAAI,KAAK,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;gBAClD,IAAI,CAAC,+BAA+B,GAAG,MAAM,CAAA;YAC/C,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,kBAAkB,CAAA;YACvC,MAAM,QAAQ,GAAG,IAAA,mCAAe,EAAC,GAAG,CAAC,CAAA;YACrC,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,IAAI,EAAE,MAAA,IAAA,+BAAY,EAAC,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,EAAE,IAAI,CAAC,mCAAI,QAAQ,EAAE,MAAA,IAAA,+BAAY,EAAC,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,EAAE,IAAI,CAAC,mCAAI,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACnL,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAA,IAAI,CAAC,QAAQ,mCAAI,EAAE,CAAC,CAAA;QAC7G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAE,cAAsB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,kBAAkB,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,CAAC,CAAA;QAC1G,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAC3C,CAAC;IAED;;;OAGG;IACH,oBAAoB;QAClB,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,iCAAiC,CAAC,CAAA;QAC1F,CAAC;QAED,yCAAyC;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAqB,CAAA;QAEpE,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,CAAE,QAAoB,EAAE,UAAkB;QACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,gCAAgC,CAAC,CAAA;QACzF,CAAC;QAED,IAAI,QAAQ,CAAA;QACZ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,GAAG,CAAC,EAAE,CAAC;YACjC,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAA;QACzB,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;YAAE,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,6CAA6C,CAAC,CAAA;QAElI,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CAAC,+DAA+D,EAAE,UAAU,CAAC,CAAA;YACzF,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAA;QACpC,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,IAAI,aAAa,GAAG,IAAI,CAAA;YAExB,qDAAqD;YACrD,IAAI,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBAC9B,aAAa,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAA;YAC5C,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChD,MAAM,CAAC,KAAK,CAAC,kEAAkE,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;oBAC3G,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5C,CAAC;gBAED,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAC9C,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC3B,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;oBAC5G,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,oCAAoC,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACpJ,CAAC;IAED;;;;;OAKG;IACH,4BAA4B,CAAE,QAAoB,EAAE,QAAkB;;QACpE,IAAI,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;QAE3E,kFAAkF;QAClF,IAAI,UAAU;YACZ,CAAC,CAAA,MAAA,QAAQ,CAAC,SAAS,0CAAE,IAAI,MAAK,2BAAS,CAAC,eAAe;gBACrD,CAAA,MAAA,QAAQ,CAAC,SAAS,0CAAE,IAAI,MAAK,2BAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,IAAI,CAAA,MAAA,UAAU,CAAC,kBAAkB,0CAAE,0BAA0B;gBACzD,UAAU,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3E,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAA,UAAU,CAAC,kBAAkB,0CAAE,0BAAoC,CAAC,CAAA;YACtG,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;;OAGG;IACH,iCAAiC;QAC/B,OAAO,IAAI,CAAC,+BAA+B,CAAA;IAC7C,CAAC;IAED;;;;;OAKG;IACO,uBAAuB,CAAE,IAAkB;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;;AA9KH,8CA+KC;AA3K2B,oCAAkB,GAAG,mBAAmB,CAAA"}

package/dist/src/auth/index.d.ts

@@ -1,7 +1,9 @@
 export * from './authConfiguration';
 export * from './authConstants';
 export * from './authProvider';
-export * from './msalTokenProvider';
+export * from './msal/msalTokenProvider';
 export * from './request';
-export * from './msalTokenCredential';
-export * from './msalConnectionManager';
+export * from './msal/msalTokenCredential';
+export * from './connectionManager';
+export * from './msal/msalConnectionManager';
+export * from './sidecar/sidecarAuthProvider';

package/dist/src/auth/index.js

@@ -17,8 +17,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./authConfiguration"), exports);
 __exportStar(require("./authConstants"), exports);
 __exportStar(require("./authProvider"), exports);
-__exportStar(require("./msalTokenProvider"), exports);
+__exportStar(require("./msal/msalTokenProvider"), exports);
 __exportStar(require("./request"), exports);
-__exportStar(require("./msalTokenCredential"), exports);
-__exportStar(require("./msalConnectionManager"), exports);
+__exportStar(require("./msal/msalTokenCredential"), exports);
+__exportStar(require("./connectionManager"), exports);
+__exportStar(require("./msal/msalConnectionManager"), exports);
+__exportStar(require("./sidecar/sidecarAuthProvider"), exports);
 //# sourceMappingURL=index.js.map

package/dist/src/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAmC;AACnC,kDAA+B;AAC/B,iDAA8B;AAC9B,sDAAmC;AACnC,4CAAyB;AACzB,wDAAqC;AACrC,0DAAuC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAmC;AACnC,kDAA+B;AAC/B,iDAA8B;AAC9B,2DAAwC;AACxC,4CAAyB;AACzB,6DAA0C;AAC1C,sDAAmC;AACnC,+DAA4C;AAC5C,gEAA6C"}

package/dist/src/auth/jwt-middleware.d.ts

@@ -5,6 +5,11 @@
 import { AuthConfiguration } from './authConfiguration';
 import { Response, NextFunction } from 'express';
 import { Request } from './request';
+import { JwksClient } from 'jwks-rsa';
+/**
+ * Clears process-wide JWKS clients.
+ */
+export declare function clearJwksClients(): void;
 /**
  * Builds the JWKS URI for the given token issuer and auth configuration.
  * @param iss The token issuer claim.
@@ -12,6 +17,7 @@ import { Request } from './request';
  * @returns The JWKS URI string.
  */
 export declare function buildJwksUri(iss: string, authConfig: AuthConfiguration): string;
+export declare function getJwksClient(jwksUri: string): JwksClient;
 /**
  * Middleware to authorize JWT tokens.
  * @param authConfig The authentication configuration.

package/dist/src/auth/jwt-middleware.js

@@ -8,12 +8,22 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authorizeJWT = void 0;
+exports.clearJwksClients = clearJwksClients;
 exports.buildJwksUri = buildJwksUri;
+exports.getJwksClient = getJwksClient;
 const authConfiguration_1 = require("./authConfiguration");
 const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
 const logger = (0, agents_telemetry_1.debug)('agents:jwt-middleware');
+const jwksClients = new Map();
+const maxJwksClients = 100;
+/**
+ * Clears process-wide JWKS clients.
+ */
+function clearJwksClients() {
+    jwksClients.clear();
+}
 /**
  * Builds the JWKS URI for the given token issuer and auth configuration.
  * @param iss The token issuer claim.
@@ -26,6 +36,26 @@ function buildJwksUri(iss, authConfig) {
         ? 'https://login.botframework.com/v1/.well-known/keys'
         : `${(0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId)}/discovery/v2.0/keys`;
 }
+function getJwksClient(jwksUri) {
+    // Check if a client for this JWKS URI already exists in the cache.
+    let client = jwksClients.get(jwksUri);
+    if (!client) {
+        client = (0, jwks_rsa_1.default)({ jwksUri });
+        jwksClients.set(jwksUri, client);
+        while (jwksClients.size > maxJwksClients) {
+            const oldestKey = jwksClients.keys().next().value;
+            if (oldestKey === undefined) {
+                break;
+            }
+            jwksClients.delete(oldestKey);
+        }
+    }
+    else {
+        jwksClients.delete(jwksUri);
+        jwksClients.set(jwksUri, client);
+    }
+    return client;
+}
 /**
  * Verifies the JWT token.
  * @param raw The raw JWT token.
@@ -51,8 +81,9 @@ const verifyToken = async (raw, config) => {
     logger.debug(`Audience found at key: ${key}`);
     const jwksUri = buildJwksUri(payload.iss, authConfig);
     logger.debug(`fetching keys from ${jwksUri}`);
-    const jwksClient = (0, jwks_rsa_1.default)({ jwksUri });
+    const jwksClient = getJwksClient(jwksUri);
     const getKey = (header, callback) => {
+        // Retrieve the public, issuer-wide signing key from the JWKS endpoint using the kid from the token header.
         jwksClient.getSigningKey(header.kid, (err, key) => {
             if (err) {
                 logger.error('jwksClient.getSigningKey ', JSON.stringify(err));

package/dist/src/auth/jwt-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-middleware.js","sourceRoot":"","sources":["../../../src/auth/jwt-middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAiBH,oCAIC;AAnBD,2DAAyE;AAGzE,wDAA0D;AAC1D,gEAA6F;AAC7F,kEAAmD;AAEnD,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,uBAAuB,CAAC,CAAA;AAE7C;;;;;GAKG;AACH,SAAgB,YAAY,CAAE,GAAW,EAAE,UAA6B;;IACtE,OAAO,GAAG,KAAK,8BAA8B;QAC3C,CAAC,CAAC,oDAAoD;QACtD,CAAC,CAAC,GAAG,IAAA,oCAAgB,EAAC,MAAA,UAAU,CAAC,iBAAiB,mCAAI,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,sBAAsB,CAAA;AAC1H,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,MAAyB,EAAuB,EAAE;IACxF,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,GAAG,CAAe,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAA;IAE5B,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;QACrE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACrG,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACnC,MAAM,GAAG,CAAA;IACX,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,aAAa,CAAA;IACvC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IAE7C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAa,EAAE,UAAU,CAAC,CAAA;IAE/D,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAe,IAAA,kBAAO,EAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAEnD,MAAM,MAAM,GAAyB,CAAC,MAAiB,EAAE,QAAsB,EAAE,EAAE;QACjF,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAiB,EAAE,GAA2B,EAAQ,EAAE;YAC5F,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,YAAY,EAAE,CAAA;YACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,aAAa,GAAsB;QACvC,QAAQ,EAAE,CAAC,UAAU,CAAC,QAAS,EAAE,8BAA8B,CAAC;QAChE,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,GAAG;KACpB,CAAA;IAED,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,sBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACnD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChD,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAkB,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAAC,UAA6B,EAAE,EAAE;IAC5D,OAAO,KAAK,WAAW,GAAY,EAAE,GAAa,EAAE,IAAkB;QACpE,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,MAAM,GAAG,IAAI,CAAA;YACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAuB,CAAA;YACtD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,KAAK,GAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,2CAA2C;gBAC1F,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBACjD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;oBACzC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;gBACjB,CAAC;gBAAC,OAAO,GAAgB,EAAE,CAAC;oBAC1B,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACzD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;oBACnC,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;oBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,CAAC,CAAA;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,EAAE,CAAA;QACR,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA;AApCY,QAAA,YAAY,gBAoCxB"}
+{"version":3,"file":"jwt-middleware.js","sourceRoot":"","sources":["../../../src/auth/jwt-middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAgBH,4CAEC;AAQD,oCAIC;AAED,sCAkBC;AAhDD,2DAAyE;AAGzE,wDAA0D;AAC1D,gEAA6F;AAC7F,kEAAmD;AAEnD,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,uBAAuB,CAAC,CAAA;AAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAA;AACjD,MAAM,cAAc,GAAG,GAAG,CAAA;AAE1B;;GAEG;AACH,SAAgB,gBAAgB;IAC9B,WAAW,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAE,GAAW,EAAE,UAA6B;;IACtE,OAAO,GAAG,KAAK,8BAA8B;QAC3C,CAAC,CAAC,oDAAoD;QACtD,CAAC,CAAC,GAAG,IAAA,oCAAgB,EAAC,MAAA,UAAU,CAAC,iBAAiB,mCAAI,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,sBAAsB,CAAA;AAC1H,CAAC;AAED,SAAgB,aAAa,CAAE,OAAe;IAC5C,mEAAmE;IACnE,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAA,kBAAO,EAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7B,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,OAAO,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAK;YACP,CAAC;YACD,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3B,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,MAAyB,EAAuB,EAAE;IACxF,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,GAAG,CAAe,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAA;IAE5B,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;QACrE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACrG,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACnC,MAAM,GAAG,CAAA;IACX,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,aAAa,CAAA;IACvC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IAE7C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAa,EAAE,UAAU,CAAC,CAAA;IAE/D,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAEzC,MAAM,MAAM,GAAyB,CAAC,MAAiB,EAAE,QAAsB,EAAE,EAAE;QACjF,2GAA2G;QAC3G,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAiB,EAAE,GAA2B,EAAQ,EAAE;YAC5F,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,YAAY,EAAE,CAAA;YACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,aAAa,GAAsB;QACvC,QAAQ,EAAE,CAAC,UAAU,CAAC,QAAS,EAAE,8BAA8B,CAAC;QAChE,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,GAAG;KACpB,CAAA;IAED,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,sBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACnD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChD,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAkB,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAAC,UAA6B,EAAE,EAAE;IAC5D,OAAO,KAAK,WAAW,GAAY,EAAE,GAAa,EAAE,IAAkB;QACpE,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,MAAM,GAAG,IAAI,CAAA;YACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAuB,CAAA;YACtD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,KAAK,GAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,2CAA2C;gBAC1F,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBACjD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;oBACzC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;gBACjB,CAAC;gBAAC,OAAO,GAAgB,EAAE,CAAC;oBAC1B,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACzD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;oBACnC,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;oBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,CAAC,CAAA;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,EAAE,CAAA;QACR,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA;AApCY,QAAA,YAAY,gBAoCxB"}

package/dist/src/auth/msal/msalConnectionManager.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import { AuthConfiguration } from '../authConfiguration';
+import type { ConnectionMapItem } from '../settings';
+import { AuthProvider } from '../authProvider';
+import { ConnectionManager } from '../connectionManager';
+/**
+ * Connection manager backed by MSAL (and, for `EntraAuthSideCar` connections, the Entra sidecar
+ * provider). A thin convenience subclass of {@link ConnectionManager} that supplies the default
+ * provider factory and applies MSAL-specific connection defaults.
+ */
+export declare class MsalConnectionManager extends ConnectionManager {
+    constructor(connectionsConfigurations?: Map<string, AuthConfiguration>, connectionsMap?: ConnectionMapItem[], configuration?: AuthConfiguration);
+    protected applyConnectionDefaults(conn: AuthProvider): AuthProvider;
+}

package/dist/src/auth/msal/msalConnectionManager.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MsalConnectionManager = void 0;
+const authConfiguration_1 = require("../authConfiguration");
+const connectionManager_1 = require("../connectionManager");
+/**
+ * Connection manager backed by MSAL (and, for `EntraAuthSideCar` connections, the Entra sidecar
+ * provider). A thin convenience subclass of {@link ConnectionManager} that supplies the default
+ * provider factory and applies MSAL-specific connection defaults.
+ */
+class MsalConnectionManager extends connectionManager_1.ConnectionManager {
+    constructor(connectionsConfigurations = new Map(), connectionsMap = [], configuration = {}) {
+        super(connectionManager_1.defaultAuthProviderFactory, connectionsConfigurations, connectionsMap, configuration);
+    }
+    applyConnectionDefaults(conn) {
+        var _a, _b, _c, _d, _e, _f;
+        var _g, _h, _j, _k;
+        if (conn.connectionSettings) {
+            (_a = (_g = conn.connectionSettings).authorityEndpoint) !== null && _a !== void 0 ? _a : (_g.authorityEndpoint = conn.connectionSettings.authority || 'https://login.microsoftonline.com');
+            (_b = (_h = conn.connectionSettings).authority) !== null && _b !== void 0 ? _b : (_h.authority = conn.connectionSettings.authorityEndpoint);
+            (_c = (_j = conn.connectionSettings).issuers) !== null && _c !== void 0 ? _c : (_j.issuers = [
+                'https://api.botframework.com',
+                `${(0, authConfiguration_1.resolveAuthority)('https://sts.windows.net', conn.connectionSettings.tenantId)}/`,
+                `${(0, authConfiguration_1.resolveAuthority)(conn.connectionSettings.authorityEndpoint, conn.connectionSettings.tenantId)}/v2.0`
+            ]);
+            // For backward compatibility
+            if (conn.connectionSettings.federatedClientId) {
+                conn.connectionSettings.FICClientId = conn.connectionSettings.federatedClientId;
+            }
+            if ((_d = conn.connectionSettings.scopes) === null || _d === void 0 ? void 0 : _d.length) {
+                conn.connectionSettings.scope = (_e = conn.connectionSettings.scopes) === null || _e === void 0 ? void 0 : _e[0];
+            }
+            if (conn.connectionSettings.authorityEndpoint) {
+                conn.connectionSettings.authority = conn.connectionSettings.authorityEndpoint;
+            }
+            // .NET parity alias: keep altBlueprintConnectionName and alternateBlueprintConnectionName in sync.
+            (_f = (_k = conn.connectionSettings).altBlueprintConnectionName) !== null && _f !== void 0 ? _f : (_k.altBlueprintConnectionName = conn.connectionSettings.alternateBlueprintConnectionName);
+            if (conn.connectionSettings.altBlueprintConnectionName) {
+                conn.connectionSettings.alternateBlueprintConnectionName = conn.connectionSettings.altBlueprintConnectionName;
+            }
+        }
+        return conn;
+    }
+}
+exports.MsalConnectionManager = MsalConnectionManager;
+//# sourceMappingURL=msalConnectionManager.js.map

package/dist/src/auth/msal/msalConnectionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalConnectionManager.js","sourceRoot":"","sources":["../../../../src/auth/msal/msalConnectionManager.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,4DAA0E;AAG1E,4DAAoF;AAEpF;;;;GAIG;AACH,MAAa,qBAAsB,SAAQ,qCAAiB;IAC1D,YACE,4BAA4D,IAAI,GAAG,EAAE,EACrE,iBAAsC,EAAE,EACxC,gBAAmC,EAAE;QACrC,KAAK,CAAC,8CAA0B,EAAE,yBAAyB,EAAE,cAAc,EAAE,aAAa,CAAC,CAAA;IAC7F,CAAC;IAES,uBAAuB,CAAE,IAAkB;;;QACnD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,YAAA,IAAI,CAAC,kBAAkB,EAAC,iBAAiB,uCAAjB,iBAAiB,GAAK,IAAI,CAAC,kBAAkB,CAAC,SAAS,IAAI,mCAAmC,EAAA;YACtH,YAAA,IAAI,CAAC,kBAAkB,EAAC,SAAS,uCAAT,SAAS,GAAK,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAA;YAC/E,YAAA,IAAI,CAAC,kBAAkB,EAAC,OAAO,uCAAP,OAAO,GAAK;gBAClC,8BAA8B;gBAC9B,GAAG,IAAA,oCAAgB,EAAC,yBAAyB,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG;gBACnF,GAAG,IAAA,oCAAgB,EAAC,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO;aACxG,EAAA;YACD,6BAA6B;YAC7B,IAAI,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;gBAC9C,IAAI,CAAC,kBAAkB,CAAC,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAA;YACjF,CAAC;YAED,IAAI,MAAA,IAAI,CAAC,kBAAkB,CAAC,MAAM,0CAAE,MAAM,EAAE,CAAC;gBAC3C,IAAI,CAAC,kBAAkB,CAAC,KAAK,GAAG,MAAA,IAAI,CAAC,kBAAkB,CAAC,MAAM,0CAAG,CAAC,CAAC,CAAA;YACrE,CAAC;YAED,IAAI,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;gBAC9C,IAAI,CAAC,kBAAkB,CAAC,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAA;YAC/E,CAAC;YAED,mGAAmG;YACnG,YAAA,IAAI,CAAC,kBAAkB,EAAC,0BAA0B,uCAA1B,0BAA0B,GAAK,IAAI,CAAC,kBAAkB,CAAC,gCAAgC,EAAA;YAC/G,IAAI,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,EAAE,CAAC;gBACvD,IAAI,CAAC,kBAAkB,CAAC,gCAAgC,GAAG,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAAA;YAC/G,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAvCD,sDAuCC"}

package/dist/src/auth/msal/msalConnectionSettings.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import type { ConnectionSettingsBase } from '../settings';
+/**
+ * Connection settings for the MSAL-backed authentication providers (the default providers used for
+ * every {@link AuthType} except `EntraAuthSideCar`).
+ *
+ * @remarks
+ * Mirrors the .NET `Microsoft.Agents.Authentication.Msal.Model.ConnectionSettings` class. Node.js uses
+ * PEM certificate files (`certPemFile`/`certKeyFile`) rather than the Windows certificate store, so the
+ * .NET `CertThumbprint`/`CertSubjectName`/`CertStoreName`/`ValidCertificateOnly` settings have no JS
+ * equivalent; all other MSAL properties map one-to-one.
+ */
+export interface MsalConnectionSettings extends ConnectionSettingsBase {
+    /**
+     * The client secret for the authentication configuration.
+     */
+    clientSecret?: string;
+    /**
+     * The path to the certificate PEM file.
+     */
+    certPemFile?: string;
+    /**
+     * The path to the certificate key file.
+     */
+    certKeyFile?: string;
+    /**
+     * Indicates whether to send the X5C param or not (for SNI authentication).
+     */
+    sendX5C?: boolean;
+    /**
+     * @deprecated Use federatedClientId instead.
+     *
+     * The FIC (First-Party Integration Channel) client ID.
+     */
+    FICClientId?: string;
+    /**
+     * @deprecated Use `authType` set to `'WorkloadIdentity'` and `federatedTokenFile` instead.
+     *
+     * The path to K8s provided token.
+     */
+    WIDAssertionFile?: string;
+    /**
+     * The Azure region for ESTS-R regional token acquisition (e.g. 'westus', 'eastus').
+     * When set, MSAL routes token requests to the specified regional endpoint.
+     * See https://learn.microsoft.com/en-us/entra/msal/javascript/node/regional-authorities for details.
+     */
+    azureRegion?: string;
+    /**
+     * The path to the federated token file used for Workload Identity authentication.
+     */
+    federatedTokenFile?: string;
+    /**
+     * Sets the resource URL for Identity Proxy Manager (IDPM).
+     *
+     * @remarks
+     * Set this to the appropriate resource identifier when the application is running in an environment,
+     * such as a Foundry container, that exposes Managed Identity through a container-specific IMDS endpoint.
+     * This setting is only meaningful when using Identity Proxy Manager (AuthType.IdentityProxyManager) for authentication.
+     */
+    idpmResource?: string;
+    /**
+     * The federated client ID for the authentication configuration, used for workload identity federation scenarios.
+     */
+    federatedClientId?: string;
+}

package/dist/src/auth/msal/msalConnectionSettings.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=msalConnectionSettings.js.map

package/dist/src/auth/msal/msalConnectionSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalConnectionSettings.js","sourceRoot":"","sources":["../../../../src/auth/msal/msalConnectionSettings.ts"],"names":[],"mappings":";AAAA;;;GAGG"}

package/dist/src/auth/{msalTokenCredential.d.ts → msal/msalTokenCredential.d.ts}

@@ -1,5 +1,5 @@
 import { GetTokenOptions, TokenCredential } from '@azure/core-auth';
-import { AuthConfiguration } from './';
+import { AuthConfiguration } from '../authConfiguration';
 /**
  * Token credential implementation that uses MSAL (Microsoft Authentication Library) to acquire access tokens.
  * Implements the Azure Core Auth TokenCredential interface for authentication scenarios.

package/dist/src/auth/{msalTokenCredential.js → msal/msalTokenCredential.js}

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MsalTokenCredential = void 0;
-const _1 = require("./");
+const msalTokenProvider_1 = require("./msalTokenProvider");
 const agents_telemetry_1 = require("@microsoft/agents-telemetry");
 const logger = (0, agents_telemetry_1.debug)('agents:msal');
 /**
@@ -25,7 +25,7 @@ class MsalTokenCredential {
     async getToken(scopes, options) {
         logger.debug('getToken scopes=%o', scopes);
         const scope = scopes[0].substring(0, scopes[0].lastIndexOf('/'));
-        const token = await new _1.MsalTokenProvider().getAccessToken(this.authConfig, scope);
+        const token = await new msalTokenProvider_1.MsalTokenProvider().getAccessToken(this.authConfig, scope);
         return {
             token,
             expiresOnTimestamp: Date.now() + 10000

package/dist/src/auth/msal/msalTokenCredential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalTokenCredential.js","sourceRoot":"","sources":["../../../../src/auth/msal/msalTokenCredential.ts"],"names":[],"mappings":";;;AAEA,2DAAuD;AACvD,kEAAmD;AAEnD,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,aAAa,CAAC,CAAA;AAEnC;;;GAGG;AACH,MAAa,mBAAmB;IAC9B;;;OAGG;IACH,YAAqB,UAA6B;QAA7B,eAAU,GAAV,UAAU,CAAmB;IAAG,CAAC;IAEtD;;;;;OAKG;IACI,KAAK,CAAC,QAAQ,CAAE,MAAgB,EAAE,OAAyB;QAChE,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,qCAAiB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAClF,OAAO;YACL,KAAK;YACL,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACvC,CAAA;IACH,CAAC;CACF;AAtBD,kDAsBC"}

package/dist/src/auth/{msalTokenProvider.d.ts → msal/msalTokenProvider.d.ts}

@@ -2,15 +2,35 @@
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-import { AuthConfiguration } from './authConfiguration';
-import { AuthProvider } from './authProvider';
+import { AuthConfiguration } from '../authConfiguration';
+import { AuthProvider } from '../authProvider';
 /**
  * Provides tokens using MSAL.
  */
 export declare class MsalTokenProvider implements AuthProvider {
-    private readonly _agenticTokenCache;
+    private static readonly _accessTokenCache;
+    private static readonly _agenticTokenCache;
+    private static readonly _confidentialClients;
+    private static readonly _maxConfidentialClients;
     readonly connectionSettings?: AuthConfiguration;
     constructor(connectionSettings?: AuthConfiguration);
+    /**
+     * Clears process-wide auth caches.
+     */
+    static clearSharedCaches(): void;
+    private static cacheKey;
+    private static digest;
+    private getOrCreateConfidentialClient;
+    private getFileCacheIdentity;
+    private getAccessTokenCacheKey;
+    private cacheAccessToken;
+    private cacheAgenticToken;
+    private cacheAgenticAuthenticationResult;
+    private getAgenticTokenCacheKey;
+    private getTokenCacheTtlSeconds;
+    private getJwtExpiresAtMs;
+    private getClientSecretClient;
+    private getCertificateClient;
     /**
      * Gets an access token using the auth configuration from the MsalTokenProvider instance and the provided scope.
      * @param scope The scope for the token.