@microsoft/agents-hosting 1.7.1 → 1.8.0-beta.34.g5d543f96c0

package/dist/src/auth/jwt-middleware.js

@@ -8,10 +8,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authorizeJWT = void 0;
+exports.getAuthorizedAudience = getAuthorizedAudience;
 exports.clearJwksClients = clearJwksClients;
 exports.buildJwksUri = buildJwksUri;
 exports.getJwksClient = getJwksClient;
-const authConfiguration_1 = require("./authConfiguration");
+const settings_1 = require("./settings");
 const errorHelper_1 = require("../errorHelper");
 const agents_activity_1 = require("@microsoft/agents-activity");
 const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
@@ -20,12 +21,241 @@ const agents_telemetry_1 = require("@microsoft/agents-telemetry");
 const logger = (0, agents_telemetry_1.debug)('agents:jwt-middleware');
 const jwksClients = new Map();
 const maxJwksClients = 100;
+const authorizedAudience = Symbol('authorizedAudience');
+/**
+ * Gets the configured audience selected while authorizing a request.
+ * @param req The authorized request.
+ * @returns The matched configured client ID, or `undefined` for anonymous requests.
+ */
+function getAuthorizedAudience(req) {
+    return req[authorizedAudience];
+}
 /**
  * Clears process-wide JWKS clients.
  */
 function clearJwksClients() {
     jwksClients.clear();
 }
+/**
+ * Well-known Microsoft first-party token issuer tenant IDs that are always trusted,
+ * mirroring the default `ValidIssuers` set in the .NET SDK
+ * (Microsoft.Agents.Hosting.AspNetCore `AspNetExtensions.AddAgentAspNetAuthentication`).
+ *
+ * These identify Microsoft infrastructure tenants used by Azure Bot Service, Teams and
+ * skill and SDK-specific Activity callback flows. They are accepted in addition to a connection's configured
+ * issuers so that enabling issuer validation does not reject legitimate first-party traffic.
+ */
+const WELL_KNOWN_PUBLIC_TENANT_IDS = [
+    'd6d49420-f39b-4df7-a1dc-d59a935871db',
+    'f8cdef31-a31e-4b4a-93e4-5f571e91255a',
+    '69e9b82d-4842-4902-8d1e-abc5b98a55e8'
+];
+const WELL_KNOWN_GOV_TENANT_ID = 'cab8a31a-1906-4287-a0d8-4eef66b95f6e';
+/**
+ * Determines whether the configured authority targets the Azure US Government cloud.
+ * @param authority The configured Entra authority.
+ * @returns `true` when the authority is a US Government endpoint.
+ */
+function isGovAuthority(authority) {
+    return !!authority && /login\.microsoftonline\.us/i.test(authority);
+}
+function getAuthority(authConfig) {
+    var _a;
+    return (_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority;
+}
+/**
+ * Returns the well-known Microsoft first-party issuers that are always trusted for the
+ * cloud implied by `authority` (public by default, US Government when the authority is gov).
+ * @param authority The configured Entra authority.
+ * @returns The well-known first-party issuer list.
+ */
+function getWellKnownFirstPartyIssuers(authority) {
+    if (isGovAuthority(authority)) {
+        return [
+            'https://api.botframework.us',
+            `https://sts.windows.net/${WELL_KNOWN_GOV_TENANT_ID}/`,
+            `https://login.microsoftonline.us/${WELL_KNOWN_GOV_TENANT_ID}/v2.0`
+        ];
+    }
+    return [
+        'https://api.botframework.com',
+        ...WELL_KNOWN_PUBLIC_TENANT_IDS.flatMap((t) => [
+            `https://sts.windows.net/${t}/`,
+            `https://login.microsoftonline.com/${t}/v2.0`
+        ])
+    ];
+}
+/**
+ * Computes the lowercase issuer allow-list used to validate a token's `iss` claim against a
+ * matched connection. The list is the connection's configured issuers (or a tenant-scoped
+ * default when none are configured) unioned with the always-trusted Microsoft first-party
+ * issuers. Comparison is performed case-insensitively to tolerate operator-provided tenant
+ * GUID casing while still rejecting tokens from unrelated tenants.
+ * @param authConfig The matched connection configuration.
+ * @returns A de-duplicated, lowercased list of accepted issuers.
+ */
+function getValidIssuers(authConfig) {
+    var _a;
+    const authority = getAuthority(authConfig);
+    const configured = authConfig.issuers && authConfig.issuers.length > 0
+        ? authConfig.issuers
+        : (0, settings_1.getDefaultIssuers)((_a = authConfig.tenantId) !== null && _a !== void 0 ? _a : '', authority !== null && authority !== void 0 ? authority : 'https://login.microsoftonline.com');
+    const accepted = new Set();
+    for (const issuer of [...configured, ...getWellKnownFirstPartyIssuers(authority)]) {
+        accepted.add(issuer.toLowerCase());
+    }
+    return [...accepted];
+}
+/**
+ * Returns the effective tenant identifier for a connection: the tenant embedded in the authority
+ * path when present (which takes precedence, matching {@link resolveAuthority}), otherwise the
+ * configured `tenantId`.
+ * @param authConfig The matched connection configuration.
+ * @returns The effective tenant identifier, or `undefined` when none is configured.
+ */
+function getEffectiveTenant(authConfig) {
+    const authority = getAuthority(authConfig);
+    if (authority) {
+        try {
+            const segment = new URL(authority.replace(/\/+$/, '')).pathname.split('/').filter(Boolean).pop();
+            if (segment) {
+                return segment;
+            }
+        }
+        catch {
+            // Non-URL authority — fall through to the configured tenantId.
+        }
+    }
+    return authConfig.tenantId;
+}
+/**
+ * Determines whether a connection is configured as a multi-tenant ("blueprint") agent, i.e. its
+ * effective tenant is the Entra `common` or `organizations` meta-tenant. For such agents the
+ * calling tenant is not known at configuration time, so the strict issuer allow-list cannot
+ * enumerate it and issuer validation must instead accept any canonical Entra issuer for the
+ * configured cloud (still bound to the token's `tid` by {@link validateTenantBinding} and anchored
+ * by the signature and audience checks).
+ * @param authConfig The matched connection configuration.
+ * @returns `true` when the connection targets the `common`/`organizations` meta-tenant.
+ */
+function isMultiTenant(authConfig) {
+    var _a;
+    const tenant = (_a = getEffectiveTenant(authConfig)) === null || _a === void 0 ? void 0 : _a.toLowerCase();
+    return tenant === 'common' || tenant === 'organizations';
+}
+/**
+ * Determines whether `iss` is a canonical Entra issuer that may be accepted for a multi-tenant
+ * connection. The issuer must carry a concrete tenant GUID and, for cloud-specific v2 issuers,
+ * belong to the same cloud as the configured authority (public vs US Government). The cloud-
+ * agnostic v1 `sts.windows.net` host is accepted in either cloud.
+ * @param iss The token issuer claim.
+ * @param authConfig The matched connection configuration.
+ * @returns `true` when the issuer is an acceptable Entra tenant issuer for the configured cloud.
+ */
+function isAcceptableTenantIssuer(iss, authConfig) {
+    const info = getEntraIssuerInfo(iss);
+    if (!info) {
+        return false;
+    }
+    return info.gov === undefined || info.gov === isGovAuthority(getAuthority(authConfig));
+}
+/**
+ * Validates that the token's `iss` claim is present and acceptable for the matched connection.
+ * Without this check a signature-valid token from any tenant (Entra signing keys are shared across
+ * tenants in a cloud) with a matching audience would be accepted, enabling a cross-tenant
+ * authentication bypass for multi-tenant app registrations.
+ *
+ * For single-tenant connections the issuer must be in the connection's allow-list. For multi-tenant
+ * ("blueprint") connections, where the calling tenant is unknown at configuration time, any
+ * canonical Entra issuer for the configured cloud is also accepted; the token's tenant is then
+ * bound to its `tid` claim by {@link validateTenantBinding} and ultimately anchored by the
+ * signature and audience (clientId) checks.
+ * @param iss The token issuer claim (from the decoded payload).
+ * @param authConfig The matched connection configuration.
+ * @throws When the issuer is missing, non-string, or not acceptable for the connection.
+ */
+function validateIssuer(iss, authConfig) {
+    if (typeof iss === 'string') {
+        if (getValidIssuers(authConfig).includes(iss.toLowerCase())) {
+            return;
+        }
+        if (isMultiTenant(authConfig) && isAcceptableTenantIssuer(iss, authConfig)) {
+            return;
+        }
+    }
+    const err = agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.JwtIssuerMismatch);
+    logger.error(err.message, iss);
+    throw err;
+}
+/**
+ * Matches a tenant GUID (the format Entra uses for the `tid` claim and the tenant segment of an
+ * Entra issuer). Operator-configured issuers may instead use a tenant domain alias, which cannot
+ * be compared to the GUID `tid` claim and is therefore left unbound.
+ */
+const ENTRA_TENANT_GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Parses a recognised public or US Government Entra issuer into its tenant GUID and cloud affinity,
+ * or returns `undefined` when the issuer is not such an Entra issuer or does not embed a tenant
+ * GUID.
+ *
+ * Only GUID tenants are recognised: the token's `tid` claim is always the tenant GUID, so an issuer
+ * whose tenant segment is a domain alias (e.g. `contoso.onmicrosoft.com`) cannot be compared to
+ * `tid` and is intentionally left unrecognised to preserve compatibility. Non-Entra issuers such as
+ * the Azure Bot Service `api.botframework.*` issuers carry no `tid` claim and are not matched here.
+ * @param iss The token issuer claim.
+ * @returns The issuer's tenant and cloud affinity, or `undefined` when not a recognised Entra issuer.
+ */
+function getEntraIssuerInfo(iss) {
+    const v1 = /^https:\/\/sts\.windows\.net\/([^/]+)\/$/i.exec(iss);
+    if (v1) {
+        return ENTRA_TENANT_GUID.test(v1[1]) ? { tenant: v1[1].toLowerCase() } : undefined;
+    }
+    const v2 = /^([^:]+):\/\/([^/]+)\/([^/]+)\/v2\.0$/.exec(iss);
+    const v2Host = v2 ? /^login\.microsoftonline\.(com|us)$/i.exec(v2[2]) : undefined;
+    if (v2 && v2Host && v2[1].toLowerCase() === 'https' && ENTRA_TENANT_GUID.test(v2[3])) {
+        return { tenant: v2[3].toLowerCase(), gov: v2Host[1].toLowerCase() === 'us' };
+    }
+    return undefined;
+}
+/**
+ * Extracts the tenant GUID embedded in a recognised public or US Government Entra issuer, or
+ * `undefined` when the issuer is not such an Entra issuer or does not embed a tenant GUID.
+ * @param iss The token issuer claim.
+ * @returns The lowercased tenant GUID, or `undefined` when no bindable tenant is present.
+ */
+function getIssuerTenant(iss) {
+    var _a;
+    return (_a = getEntraIssuerInfo(iss)) === null || _a === void 0 ? void 0 : _a.tenant;
+}
+/**
+ * Validates that an Entra token's `tid` (tenant id) claim matches the tenant GUID embedded in its
+ * `iss` claim. This binds the accepted issuer to the token's tenant. Because
+ * Entra signing keys are shared across tenants within a cloud, requiring the issuer's tenant and
+ * the `tid` claim to agree prevents a token whose `iss` was allow-listed (for example one of the
+ * always-trusted Microsoft first-party tenants) from being accepted on behalf of a different
+ * tenant.
+ *
+ * The binding only applies when both claims are strings and the issuer is a recognised Entra
+ * issuer carrying a GUID tenant. Missing/non-string claims, Azure Bot Service issuers, and
+ * alias-based issuers are skipped for backward compatibility.
+ * @param iss The token issuer claim.
+ * @param tid The token tenant id claim.
+ * @throws When both claims are strings and the issuer embeds a tenant GUID different from `tid`.
+ */
+function validateTenantBinding(iss, tid) {
+    if (typeof iss !== 'string' || typeof tid !== 'string') {
+        return;
+    }
+    const issuerTenant = getIssuerTenant(iss);
+    if (!issuerTenant) {
+        return;
+    }
+    if (tid.toLowerCase() !== issuerTenant) {
+        const err = agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.JwtTenantMismatch);
+        logger.error(err.message, tid);
+        throw err;
+    }
+}
 /**
  * Builds the JWKS URI for the given token issuer and auth configuration.
  * @param iss The token issuer claim.
@@ -34,9 +264,14 @@ function clearJwksClients() {
  */
 function buildJwksUri(iss, authConfig) {
     var _a;
-    return iss === 'https://api.botframework.com'
-        ? 'https://login.botframework.com/v1/.well-known/keys'
-        : `${(0, authConfiguration_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId)}/discovery/v2.0/keys`;
+    switch (typeof iss === 'string' ? iss.toLowerCase() : '') {
+        case 'https://api.botframework.com':
+            return 'https://login.botframework.com/v1/.well-known/keys';
+        case 'https://api.botframework.us':
+            return 'https://login.botframework.azure.us/v1/.well-known/keys';
+        default:
+            return `${(0, settings_1.resolveAuthority)((_a = authConfig.authorityEndpoint) !== null && _a !== void 0 ? _a : authConfig.authority, authConfig.tenantId)}/discovery/v2.0/keys`;
+    }
 }
 function getJwksClient(jwksUri) {
     // Check if a client for this JWKS URI already exists in the cache.
@@ -62,7 +297,7 @@ function getJwksClient(jwksUri) {
  * Verifies the JWT token.
  * @param raw The raw JWT token.
  * @param config The authentication configuration.
- * @returns A promise that resolves to the JWT payload.
+ * @returns A promise that resolves to the verified payload and matched configured audience.
  */
 const verifyToken = async (raw, config) => {
     const payload = jsonwebtoken_1.default.decode(raw);
@@ -70,18 +305,23 @@ const verifyToken = async (raw, config) => {
     if (!payload) {
         throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.InvalidJwtToken);
     }
-    const audience = payload.aud;
+    const audiences = Array.isArray(payload.aud)
+        ? payload.aud
+        : typeof payload.aud === 'string'
+            ? [payload.aud]
+            : [];
     const matchingEntry = config.connections && config.connections.size > 0
-        ? [...config.connections.entries()].find(([_, configuration]) => configuration.clientId === audience)
+        ? [...config.connections.entries()].find(([_, configuration]) => typeof configuration.clientId === 'string' && audiences.includes(configuration.clientId))
         : undefined;
     if (!matchingEntry) {
         const err = agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.JwtAudienceMismatch);
-        logger.error(err.message, audience);
+        logger.error(err.message, audiences);
         throw err;
     }
     const [key, authConfig] = matchingEntry;
     logger.debug(`Audience found at key: ${key}`);
-    const jwksUri = buildJwksUri(payload.iss, authConfig);
+    const issuer = typeof payload.iss === 'string' ? payload.iss : '';
+    const jwksUri = buildJwksUri(issuer, authConfig);
     logger.debug(`fetching keys from ${jwksUri}`);
     const jwksClient = getJwksClient(jwksUri);
     const getKey = (header, callback) => {
@@ -103,7 +343,7 @@ const verifyToken = async (raw, config) => {
         algorithms: ['RS256'],
         clockTolerance: 300
     };
-    return await new Promise((resolve, reject) => {
+    const verifiedPayload = await new Promise((resolve, reject) => {
         jsonwebtoken_1.default.verify(raw, getKey, verifyOptions, (err, user) => {
             if (err) {
                 logger.error('jwt.verify ', JSON.stringify(err));
@@ -113,6 +353,14 @@ const verifyToken = async (raw, config) => {
             resolve(user);
         });
     });
+    if (authConfig.validateIssuer) {
+        validateIssuer(verifiedPayload.iss, authConfig);
+    }
+    validateTenantBinding(verifiedPayload.iss, verifiedPayload.tid);
+    return {
+        payload: verifiedPayload,
+        audience: authConfig.clientId
+    };
 };
 /**
  * Determines whether an `Authorization` header value is present (non-empty).
@@ -195,9 +443,11 @@ const authorizeJWT = (authConfig) => {
             const token = extractBearerToken(req.headers.authorization);
             if (token) {
                 try {
-                    const user = await verifyToken(token, authConfig);
-                    logger.debug('token verified for ', user);
-                    req.user = user;
+                    const verifiedToken = await verifyToken(token, authConfig);
+                    logger.debug('token verified for ', verifiedToken.payload);
+                    req.user = verifiedToken.payload;
+                    const authorizedRequest = req;
+                    authorizedRequest[authorizedAudience] = verifiedToken.audience;
                 }
                 catch (err) {
                     failed = true;

package/dist/src/auth/jwt-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-middleware.js","sourceRoot":"","sources":["../../../src/auth/jwt-middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAkBH,4CAEC;AAQD,oCAIC;AAED,sCAkBC;AAlDD,2DAAyE;AAGzE,gDAAuC;AACvC,gEAA4D;AAC5D,wDAA0D;AAC1D,gEAA6F;AAC7F,kEAAmD;AAEnD,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,uBAAuB,CAAC,CAAA;AAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAA;AACjD,MAAM,cAAc,GAAG,GAAG,CAAA;AAE1B;;GAEG;AACH,SAAgB,gBAAgB;IAC9B,WAAW,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAE,GAAW,EAAE,UAA6B;;IACtE,OAAO,GAAG,KAAK,8BAA8B;QAC3C,CAAC,CAAC,oDAAoD;QACtD,CAAC,CAAC,GAAG,IAAA,oCAAgB,EAAC,MAAA,UAAU,CAAC,iBAAiB,mCAAI,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,sBAAsB,CAAA;AAC1H,CAAC;AAED,SAAgB,aAAa,CAAE,OAAe;IAC5C,mEAAmE;IACnE,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAA,kBAAO,EAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7B,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,OAAO,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAK;YACP,CAAC;YACD,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3B,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,MAAyB,EAAuB,EAAE;IACxF,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,GAAG,CAAe,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,eAAe,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAA;IAE5B,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;QACrE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACrG,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,mBAAmB,CAAC,CAAA;QAChF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACnC,MAAM,GAAG,CAAA;IACX,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,aAAa,CAAA;IACvC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IAE7C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAa,EAAE,UAAU,CAAC,CAAA;IAE/D,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAEzC,MAAM,MAAM,GAAyB,CAAC,MAAiB,EAAE,QAAsB,EAAE,EAAE;QACjF,2GAA2G;QAC3G,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAiB,EAAE,GAA2B,EAAQ,EAAE;YAC5F,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,YAAY,EAAE,CAAA;YACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,aAAa,GAAsB;QACvC,QAAQ,EAAE,CAAC,UAAU,CAAC,QAAS,EAAE,8BAA8B,CAAC;QAChE,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,GAAG;KACpB,CAAA;IAED,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,sBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACnD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChD,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAkB,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAE,aAA4C;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAE,WAA+B;IACxD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;IAC7B,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAChD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAE,aAA4C;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IAC7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAAC,UAA6B,EAAE,EAAE;IAC5D,OAAO,KAAK,WAAW,GAAY,EAAE,GAAgB,EAAE,IAAkB;;QACvE,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,MAAM,GAAG,IAAI,CAAA;YACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YAC3D,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBACjD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;oBACzC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;gBACjB,CAAC;gBAAC,OAAO,GAAgB,EAAE,CAAC;oBAC1B,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACjB,2DAA2D;oBAC3D,sEAAsE;oBACtE,uEAAuE;oBACvE,sEAAsE;oBACtE,mEAAmE;oBACnE,MAAM,WAAW,GAAW,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,WAAW,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,cAAc,CAAA;oBAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAA;gBACzD,CAAC;YACH,CAAC;iBAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7D,uEAAuE;gBACvE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,GAAG,IAAI,CAAA;gBACb,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,CAAC,CAAA;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;oBACnC,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;oBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,CAAC,CAAA;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,EAAE,CAAA;QACR,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA;AAhDY,QAAA,YAAY,gBAgDxB"}
+{"version":3,"file":"jwt-middleware.js","sourceRoot":"","sources":["../../../src/auth/jwt-middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AA+BH,sDAEC;AAKD,4CAEC;AA0PD,oCASC;AAED,sCAkBC;AA5TD,yCAAgE;AAGhE,gDAAuC;AACvC,gEAA4D;AAC5D,wDAA0D;AAC1D,gEAA6F;AAC7F,kEAAmD;AAEnD,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,uBAAuB,CAAC,CAAA;AAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAA;AACjD,MAAM,cAAc,GAAG,GAAG,CAAA;AAC1B,MAAM,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAA;AAWvD;;;;GAIG;AACH,SAAgB,qBAAqB,CAAE,GAAY;IACjD,OAAQ,GAAyB,CAAC,kBAAkB,CAAC,CAAA;AACvD,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB;IAC9B,WAAW,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,4BAA4B,GAAG;IACnC,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;CACvC,CAAA;AACD,MAAM,wBAAwB,GAAG,sCAAsC,CAAA;AAEvE;;;;GAIG;AACH,SAAS,cAAc,CAAE,SAAkB;IACzC,OAAO,CAAC,CAAC,SAAS,IAAI,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,YAAY,CAAE,UAA6B;;IAClD,OAAO,MAAA,UAAU,CAAC,iBAAiB,mCAAI,UAAU,CAAC,SAAS,CAAA;AAC7D,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CAAE,SAAkB;IACxD,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,6BAA6B;YAC7B,2BAA2B,wBAAwB,GAAG;YACtD,oCAAoC,wBAAwB,OAAO;SACpE,CAAA;IACH,CAAC;IACD,OAAO;QACL,8BAA8B;QAC9B,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7C,2BAA2B,CAAC,GAAG;YAC/B,qCAAqC,CAAC,OAAO;SAC9C,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAE,UAA6B;;IACrD,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;IAC1C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACpE,CAAC,CAAC,UAAU,CAAC,OAAO;QACpB,CAAC,CAAC,IAAA,4BAAiB,EAAC,MAAA,UAAU,CAAC,QAAQ,mCAAI,EAAE,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,mCAAmC,CAAC,CAAA;IAClG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,UAAU,EAAE,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAClF,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAA;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAE,UAA6B;IACxD,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAA;YAChG,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAA;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAE,UAA6B;;IACnD,MAAM,MAAM,GAAG,MAAA,kBAAkB,CAAC,UAAU,CAAC,0CAAE,WAAW,EAAE,CAAA;IAC5D,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,eAAe,CAAA;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAE,GAAW,EAAE,UAA6B;IAC3E,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAA;AACxF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,cAAc,CAAE,GAAY,EAAE,UAA6B;IAClE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC5D,OAAM;QACR,CAAC;QACD,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3E,OAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,iBAAiB,CAAC,CAAA;IAC9E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC9B,MAAM,GAAG,CAAA;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,iEAAiE,CAAA;AAgB3F;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAE,GAAW;IACtC,MAAM,EAAE,GAAG,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChE,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACpF,CAAC;IACD,MAAM,EAAE,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjF,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAA;IAC/E,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAE,GAAW;;IACnC,OAAO,MAAA,kBAAkB,CAAC,GAAG,CAAC,0CAAE,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,qBAAqB,CAAE,GAAY,EAAE,GAAY;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAM;IACR,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAM;IACR,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,iBAAiB,CAAC,CAAA;QAC9E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAE,GAAW,EAAE,UAA6B;;IACtE,QAAQ,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzD,KAAK,8BAA8B;YACjC,OAAO,oDAAoD,CAAA;QAC7D,KAAK,6BAA6B;YAChC,OAAO,yDAAyD,CAAA;QAClE;YACE,OAAO,GAAG,IAAA,2BAAgB,EAAC,MAAA,UAAU,CAAC,iBAAiB,mCAAI,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,sBAAsB,CAAA;IAC/H,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAE,OAAe;IAC5C,mEAAmE;IACnE,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAA,kBAAO,EAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7B,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,OAAO,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAK;YACP,CAAC;YACD,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3B,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,MAAyB,EAA0B,EAAE;IAC3F,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,GAAG,CAAe,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,eAAe,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC,GAAG;QACb,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;QACrE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE,CAC5D,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CACzF;QACH,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,mBAAmB,CAAC,CAAA;QAChF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QACpC,MAAM,GAAG,CAAA;IACX,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,aAAa,CAAA;IACvC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IAE7C,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAEhD,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAEzC,MAAM,MAAM,GAAyB,CAAC,MAAiB,EAAE,QAAsB,EAAE,EAAE;QACjF,2GAA2G;QAC3G,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAiB,EAAE,GAA2B,EAAQ,EAAE;YAC5F,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACxB,OAAM;YACR,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,YAAY,EAAE,CAAA;YACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,aAAa,GAAsB;QACvC,QAAQ,EAAE,CAAC,UAAU,CAAC,QAAS,EAAE,8BAA8B,CAAC;QAChE,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,GAAG;KACpB,CAAA;IAED,MAAM,eAAe,GAAG,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxE,sBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACnD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAChD,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAkB,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAC9B,cAAc,CAAC,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IACjD,CAAC;IACD,qBAAqB,CAAC,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO;QACL,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU,CAAC,QAAS;KAC/B,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAE,aAA4C;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAE,WAA+B;IACxD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;IAC7B,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAChD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAE,aAA4C;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IAC7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAAC,UAA6B,EAAE,EAAE;IAC5D,OAAO,KAAK,WAAW,GAAY,EAAE,GAAgB,EAAE,IAAkB;;QACvE,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,MAAM,GAAG,IAAI,CAAA;YACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YAC3D,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;oBAC1D,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;oBAC1D,GAAG,CAAC,IAAI,GAAG,aAAa,CAAC,OAAO,CAAA;oBAChC,MAAM,iBAAiB,GAAG,GAAwB,CAAA;oBAClD,iBAAiB,CAAC,kBAAkB,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAA;gBAChE,CAAC;gBAAC,OAAO,GAAgB,EAAE,CAAC;oBAC1B,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACjB,2DAA2D;oBAC3D,sEAAsE;oBACtE,uEAAuE;oBACvE,sEAAsE;oBACtE,mEAAmE;oBACnE,MAAM,WAAW,GAAW,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,WAAW,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,cAAc,CAAA;oBAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAA;gBACzD,CAAC;YACH,CAAC;iBAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7D,uEAAuE;gBACvE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,GAAG,IAAI,CAAA;gBACb,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,CAAC,CAAA;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;oBACnC,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,IAAI,CAAA;oBACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;oBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,CAAC,CAAA;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,EAAE,CAAA;QACR,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA;AAlDY,QAAA,YAAY,gBAkDxB"}

package/dist/src/auth/msal/msalConnectionSettings.d.ts

@@ -65,4 +65,12 @@ export interface MsalConnectionSettings extends ConnectionSettingsBase {
      * The federated client ID for the authentication configuration, used for workload identity federation scenarios.
      */
     federatedClientId?: string;
+    /**
+     * Maximum number of retries for an MSAL HTTP request that returns status 408.
+     *
+     * @remarks
+     * The initial request is not included in this count. Set to `0` to disable retries.
+     * Defaults to `2`.
+     */
+    msalRetryCount?: number;
 }

package/dist/src/auth/msal/msalHttpRetryHandlerHelper.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import { INetworkModule, NetworkRequestOptions, NetworkResponse } from '@azure/msal-node';
+/**
+ * The default number of retries made for an MSAL HTTP request.
+ */
+export declare const DEFAULT_MSAL_RETRY_COUNT = 2;
+/**
+ * Converts a configured MSAL retry count to its effective runtime value.
+ */
+export declare function normalizeMsalRetryCount(retryCount: number | undefined): number;
+/**
+ * MSAL network client that retries responses with HTTP status 408 (Request Timeout).
+ *
+ * @remarks
+ * `maxRetryCount` is the number of retries after the initial request. Responses with
+ * any other status are returned immediately and retries have no additional delay.
+ */
+export declare class MsalHttpRetryHandlerHelper implements INetworkModule {
+    private readonly networkClient;
+    private readonly maxRetryCount;
+    constructor(networkClient?: INetworkModule, maxRetryCount?: number);
+    /**
+     * Sends an HTTP GET request, retrying only Request Timeout responses.
+     */
+    sendGetRequestAsync<T>(url: string, options?: NetworkRequestOptions, timeout?: number): Promise<NetworkResponse<T>>;
+    /**
+     * Sends an HTTP POST request, retrying only Request Timeout responses.
+     */
+    sendPostRequestAsync<T>(url: string, options?: NetworkRequestOptions): Promise<NetworkResponse<T>>;
+    private sendWithRetries;
+}

package/dist/src/auth/msal/msalHttpRetryHandlerHelper.js

@@ -0,0 +1,126 @@
+"use strict";
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MsalHttpRetryHandlerHelper = exports.DEFAULT_MSAL_RETRY_COUNT = void 0;
+exports.normalizeMsalRetryCount = normalizeMsalRetryCount;
+const agents_activity_1 = require("@microsoft/agents-activity");
+const agents_telemetry_1 = require("@microsoft/agents-telemetry");
+const errorHelper_1 = require("../../errorHelper");
+const logger = (0, agents_telemetry_1.debug)('agents:msal');
+const requestTimeoutStatus = 408;
+/**
+ * The default number of retries made for an MSAL HTTP request.
+ */
+exports.DEFAULT_MSAL_RETRY_COUNT = 2;
+/**
+ * Converts a configured MSAL retry count to its effective runtime value.
+ */
+function normalizeMsalRetryCount(retryCount) {
+    if (!Number.isFinite(retryCount)) {
+        return exports.DEFAULT_MSAL_RETRY_COUNT;
+    }
+    return Math.max(0, Math.floor(retryCount));
+}
+/**
+ * MSAL network client that retries responses with HTTP status 408 (Request Timeout).
+ *
+ * @remarks
+ * `maxRetryCount` is the number of retries after the initial request. Responses with
+ * any other status are returned immediately and retries have no additional delay.
+ */
+class MsalHttpRetryHandlerHelper {
+    constructor(networkClient = new MsalHttpClient(), maxRetryCount = exports.DEFAULT_MSAL_RETRY_COUNT) {
+        this.networkClient = networkClient;
+        this.maxRetryCount = normalizeMsalRetryCount(maxRetryCount);
+    }
+    /**
+     * Sends an HTTP GET request, retrying only Request Timeout responses.
+     */
+    async sendGetRequestAsync(url, options, timeout) {
+        return this.sendWithRetries(() => this.networkClient.sendGetRequestAsync(url, options, timeout));
+    }
+    /**
+     * Sends an HTTP POST request, retrying only Request Timeout responses.
+     */
+    async sendPostRequestAsync(url, options) {
+        return this.sendWithRetries(() => this.networkClient.sendPostRequestAsync(url, options));
+    }
+    async sendWithRetries(send) {
+        let response = await send();
+        let attempt;
+        for (attempt = 0; response.status === requestTimeoutStatus && attempt < this.maxRetryCount; attempt++) {
+            logger.debug('MSAL retry on request timeout (retry %d/%d)', attempt + 1, this.maxRetryCount);
+            response = await send();
+        }
+        logger.debug('MSAL request completed with status %d after %d attempt(s)', response.status, attempt + 1);
+        return response;
+    }
+}
+exports.MsalHttpRetryHandlerHelper = MsalHttpRetryHandlerHelper;
+/**
+ * Default MSAL-compatible network implementation. MSAL Node does not export its
+ * built-in HTTP client, so the retry handler uses the same native fetch contract.
+ */
+class MsalHttpClient {
+    async sendGetRequestAsync(url, options, timeout) {
+        return this.sendRequest(url, 'GET', options, timeout);
+    }
+    async sendPostRequestAsync(url, options) {
+        return this.sendRequest(url, 'POST', options);
+    }
+    async sendRequest(url, method, options, timeout) {
+        var _a;
+        const controller = new AbortController();
+        const timeoutId = timeout
+            ? setTimeout(() => controller.abort(), timeout)
+            : undefined;
+        let response;
+        try {
+            response = await fetch(url, {
+                method,
+                headers: options === null || options === void 0 ? void 0 : options.headers,
+                body: method === 'POST' ? options === null || options === void 0 ? void 0 : options.body : undefined,
+                signal: controller.signal
+            });
+        }
+        catch (error) {
+            const innerException = error instanceof Error ? error : undefined;
+            if ((innerException === null || innerException === void 0 ? void 0 : innerException.name) === 'AbortError') {
+                throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.TokenRequestTimeout, innerException, { timeoutMs: String(timeout) });
+            }
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.MsalHttpRequestFailed, innerException, {
+                message: (_a = innerException === null || innerException === void 0 ? void 0 : innerException.message) !== null && _a !== void 0 ? _a : 'unknown'
+            });
+        }
+        finally {
+            if (timeoutId) {
+                clearTimeout(timeoutId);
+            }
+        }
+        const headers = {};
+        response.headers.forEach((value, key) => {
+            headers[key] = value;
+        });
+        return {
+            headers,
+            body: await this.parseBody(response),
+            status: response.status
+        };
+    }
+    async parseBody(response) {
+        const text = await response.text();
+        try {
+            return JSON.parse(text);
+        }
+        catch (error) {
+            if (response.status === requestTimeoutStatus) {
+                return {};
+            }
+            throw agents_activity_1.ExceptionHelper.generateException(Error, errorHelper_1.Errors.MsalResponseUnparsable, error instanceof Error ? error : undefined);
+        }
+    }
+}
+//# sourceMappingURL=msalHttpRetryHandlerHelper.js.map

package/dist/src/auth/msal/msalHttpRetryHandlerHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalHttpRetryHandlerHelper.js","sourceRoot":"","sources":["../../../../src/auth/msal/msalHttpRetryHandlerHelper.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAkBH,0DAMC;AArBD,gEAA4D;AAC5D,kEAAmD;AACnD,mDAA0C;AAE1C,MAAM,MAAM,GAAG,IAAA,wBAAK,EAAC,aAAa,CAAC,CAAA;AACnC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC;;GAEG;AACU,QAAA,wBAAwB,GAAG,CAAC,CAAA;AAEzC;;GAEG;AACH,SAAgB,uBAAuB,CAAE,UAA8B;IACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,gCAAwB,CAAA;IACjC,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAoB,CAAC,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAa,0BAA0B;IAGrC,YACmB,gBAAgC,IAAI,cAAc,EAAE,EACrE,gBAAwB,gCAAwB;QAD/B,kBAAa,GAAb,aAAa,CAAuC;QAGrE,IAAI,CAAC,aAAa,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAA;IAC7D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB,CAC9B,GAAW,EACX,OAA+B,EAC/B,OAAgB;QAEhB,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;IACrG,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAC/B,GAAW,EACX,OAA+B;QAE/B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAI,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;IAC7F,CAAC;IAEO,KAAK,CAAC,eAAe,CAAK,IAAuC;QACvE,IAAI,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;QAC3B,IAAI,OAAO,CAAA;QACX,KAAK,OAAO,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,KAAK,oBAAoB,IAAI,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC;YACtG,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;YAC5F,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;QACzB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC,CAAC,CAAA;QACvG,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF;AAzCD,gEAyCC;AAED;;;GAGG;AACH,MAAM,cAAc;IACX,KAAK,CAAC,mBAAmB,CAC9B,GAAW,EACX,OAA+B,EAC/B,OAAgB;QAEhB,OAAO,IAAI,CAAC,WAAW,CAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,GAAW,EACX,OAA+B;QAE/B,OAAO,IAAI,CAAC,WAAW,CAAI,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAClD,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,GAAW,EACX,MAAsB,EACtB,OAA+B,EAC/B,OAAgB;;QAEhB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,SAAS,GAAG,OAAO;YACvB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAA;QAEb,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,MAAM;gBACN,OAAO,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO;gBACzB,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,CAAC,CAAC,SAAS;gBACnD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YACjE,IAAI,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,IAAI,MAAK,YAAY,EAAE,CAAC;gBAC1C,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,mBAAmB,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC5H,CAAC;YACD,MAAM,iCAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,oBAAM,CAAC,qBAAqB,EAAE,cAAc,EAAE;gBAC3F,OAAO,EAAE,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,OAAO,mCAAI,SAAS;aAC9C,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,CAAC,SAAS,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAA2B,EAAE,CAAA;QAC1C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACtB,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,OAAO;YACP,IAAI,EAAE,MAAM,IAAI,CAAC,SAAS,CAAI,QAAQ,CAAC;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAK,QAAkB;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAElC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;gBAC7C,OAAO,EAAO,CAAA;YAChB,CAAC;YACD,MAAM,iCAAe,CAAC,iBAAiB,CACrC,KAAK,EACL,oBAAM,CAAC,sBAAsB,EAC7B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAA;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/src/auth/msal/msalTokenProvider.d.ts

@@ -69,6 +69,7 @@ export declare class MsalTokenProvider implements AuthProvider {
     getAgenticUserToken(tenantId: string, agentAppInstanceId: string, agenticUserId: string, scopes: string[]): Promise<string>;
     getAgenticApplicationToken(tenantId: string, agentAppInstanceId: string): Promise<string>;
     private readonly sysOptions;
+    private getSystemOptions;
     /**
      * Generates the client assertion using the provided certificate.
      * @param authConfig The authentication configuration.