@microsoft/omnichannel-chat-widget 1.8.7 → 2.0.0-main.ba244dd

package/README.md

@@ -11,6 +11,7 @@
 
 1. [Introduction](#introduction)
 1. [Installation](#installation)
+1. [WebChat dependency constraint](#webchat-dependency-constraint)
 1. [Example Usage](#example-usage)
 1. [Components](#components)
 1. [See Also](#see-also)
@@ -47,6 +48,34 @@ or
 yarn add @microsoft/omnichannel-chat-components
 ```
 
+This package requires Node.js `>=22.12.0` for consumer builds. Node 20 is not supported.
+
+TypeScript consumers that imported the exported Web Chat middleware factories now receive Redux 5 `unknown` actions. Narrow with `isWebChatAction` before reading `type` or `payload`. Runtime behavior is unchanged.
+
+## WebChat dependency constraint
+
+The widget must use `botframework-webchat@4.18.1-hotfix.20260308.b15b405`.
+
+Do not upgrade or replace this version. It contains a required product hotfix. The PR workflow rejects a different version.
+
+This hotfix still declares these vulnerable transitive versions:
+
+| Package | Hotfix version |
+| --- | --- |
+| `adaptivecards` | `3.0.2` |
+| `markdown-it` | `13.0.2` |
+| `linkify-it` | `4.0.1` |
+| `@babel/runtime` | `7.14.8`, `7.15.4`, and `7.19.0` |
+| `@babel/runtime-corejs3` | `7.20.13` |
+| `sanitize-html` | `2.14.0` |
+| `swiper` | `8.4.7` |
+| `valibot` | `1.1.0` |
+| `uuid` | `3.4.0`, `8.3.2`, and `9.0.1` |
+
+The consumer audit permits only the reviewed advisories from this hotfix. It rejects each new advisory.
+
+A new WebChat hotfix must preserve the product fix and update these dependencies.
+
 ## Example Usage
 
 The basic example below takes in the ```<LiveChatWidget/>``` component along with the Chat SDK to create a customized Omnichannel chat widget.
@@ -177,7 +206,7 @@ Header's and Footer's child components consist of three parts:
 1. "middleGroup" - adding child components in the middle of the Header/Footer
 1. "rightGroup" - adding child components at the right of the Header/Footer
 
-By default Header has the header icon and title on the left and minimize and close buttons on the right, and Footer has Download Transcript and Email Transcript buttons on the left and audio notification button on the right. These components can be overriden with [ComponentOverrides](#ComponentOverrides). In addition, other custom child components can be added to both Header and Footer by creating custom react nodes and adding them to attributes "leftGroup", "middleGroup" or "rightGroup" of "controlProps".
+By default Header has the header icon and title on the left and minimize and close buttons on the right, and Footer has Download Transcript and Email Transcript buttons on the left and audio notification button on the right. These components can be overriden with [ComponentOverrides](#componentoverrides). In addition, other custom child components can be added to both Header and Footer by creating custom react nodes and adding them to attributes "leftGroup", "middleGroup" or "rightGroup" of "controlProps".
 
 ```js
 const buttonStyleProps: IButtonStyles = {
@@ -224,8 +253,10 @@ const customizedFooterProp: IFooterProps = {
 > :pushpin: Note that [WebChat hooks](https://github.com/microsoft/BotFramework-WebChat/blob/main/docs/HOOKS.md) can also be used in any custom components.
 
 #### Bidirectional Custom Events
+
 - Sending events from a hosting web page to bots/agents
-    - Register a function to post event
+  - Register a function to post event
+
         ```js
         //define sendCustomEvent function
         const sendCustomEvent = (payload) => {
@@ -253,7 +284,9 @@ const customizedFooterProp: IFooterProps = {
             }
         })
         ```
-    - Receiving events from bots/agents
+
+  - Receiving events from bots/agents
+
         ```js
         //define setOnCustomEvent function
         const setOnCustomEvent = (callback) => {
@@ -269,8 +302,10 @@ const customizedFooterProp: IFooterProps = {
         ```
 
 #### Trigger initiateEndChat event
+
 Customer can trigger the initiateEndChat event via BroadcastService to end a chat session.
 When needed, the payload below could be triggered:
+
 ```js
 const endChatEvent = {
     eventName: "InitiateEndChat",
@@ -283,18 +318,21 @@ BroadcastService.postMessage(endChatEvent);
 
 The payload of the event is optional, only needed when force closing of a persistent chat session is not required.
 When chat widget receives the event without any payload, it will:
+
 1. set the widget to closed state, the widget panel will be minimized. Post chat survey will not be displayed.
 2. trigger a sessionclose service network request to OmniChannel services.
 
 If skipSessionCloseForPersistentChat is set to true. The session close network request will not be triggered, instead, if postChat survey is available, post chat survey will be displayed.
 
 After successfully processed initiateEndChat event. The CloseChat event is broadcasted.
+
 ```js
 BroadcastService.getMessageByEventName("CloseChat").subscribe(async (msg) => {
     console.log("close chat received: ", msg);
     //more actions to unmount component and resources
 })
 ```
+
 ## See Also
 
 [Customizations Dev Guide](https://github.com/microsoft/omnichannel-chat-widget/blob/main/docs/customizations/getstarted.md)\
@@ -302,6 +340,7 @@ BroadcastService.getMessageByEventName("CloseChat").subscribe(async (msg) => {
 [Create LiveChatWidget with Webpack5 and TypeScript](https://github.com/microsoft/omnichannel-chat-widget/blob/main/docs/BuildingUsingWebpack5.md)\
 [Omnichannel Features](https://github.com/microsoft/omnichannel-chat-widget/blob/main/docs/Features.md)\
 [How to Add Visual Regression Tests](https://github.com/microsoft/omnichannel-chat-widget/blob/main/docs/VisualRegressionTestingGuide.md)\
+[Accessibility Tooling](https://github.com/microsoft/omnichannel-chat-widget/blob/main/docs/accessibility/README.md)\
 [Security](https://github.com/microsoft/omnichannel-chat-widget/blob/main/SECURITY.md)\
 [Third Party Cookie Support](https://github.com/microsoft/omnichannel-chat-widget/blob/main/docs/Tpc.md)\
 [Storybook](https://microsoft.github.io/omnichannel-chat-widget/docs/storybook/)

package/lib/cjs/common/Constants.js

@@ -81,6 +81,8 @@ _defineProperty(Constants, "audioMediaRegex", /(\.)(aac|aiff|alac|amr|flac|mp2|m
 _defineProperty(Constants, "videoMediaRegex", /(\.)(avchd|avi|flv|mpe|mpeg|mpg|mpv|mp4|m4p|m4v|mov|qt|swf|webm|wmv)$/i);
 _defineProperty(Constants, "chromeSupportedInlineMediaRegex", /(\.)(aac|mp3|wav|mp4)$/i);
 _defineProperty(Constants, "firefoxSupportedInlineMediaRegex", /(\.)(aac|flac|mp3|wav|mp4|mov)$/i);
+_defineProperty(Constants, "AdaptiveCardType", "adaptivecard");
+_defineProperty(Constants, "SuggestedActionsType", "suggestedactions");
 // calling container event names
 _defineProperty(Constants, "CallAdded", "callAdded");
 _defineProperty(Constants, "LocalVideoStreamAdded", "localVideoStreamAdded");
@@ -143,6 +145,9 @@ _defineProperty(Constants, "customEventValue", "customEventValue");
 _defineProperty(Constants, "Hidden", "Hidden");
 _defineProperty(Constants, "EndConversationDueToOverflow", "endconversationduetooverflow");
 _defineProperty(Constants, "SkipSessionCloseForPersistentChatFlag", "skipSessionCloseForPersistentChat");
+// Minimum font-size for input fields to prevent iOS Safari auto-zoom on focus
+_defineProperty(Constants, "minInputFontSizePx", 16);
+_defineProperty(Constants, "minInputFontSize", "16px");
 const Regex = exports.Regex = (_Class = /*#__PURE__*/_createClass(function Regex() {
   _classCallCheck(this, Regex);
 }), _defineProperty(_Class, "EmailRegex", "^(?:[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+)*|\"[^\"\\\\]*(?:\\\\.[^\"\\\\]*)*\")@(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?)*|\\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\])$"), _Class);

package/lib/cjs/common/facades/FacadeChatSDK.js

@@ -26,6 +26,8 @@ let FacadeChatSDK = exports.FacadeChatSDK = /*#__PURE__*/function () {
     _defineProperty(this, "getAuthToken", void 0);
     _defineProperty(this, "sdkMocked", void 0);
     _defineProperty(this, "disableReauthentication", void 0);
+    // Stays true so CASE 1 re-triggers on every startChat to set deferInitialAuth
+    _defineProperty(this, "pendingMidAuthUnauthenticatedState", false);
     this.chatSDK = input.chatSDK;
     this.chatConfig = input.chatConfig;
     this.getAuthToken = input.getAuthToken;
@@ -50,6 +52,12 @@ let FacadeChatSDK = exports.FacadeChatSDK = /*#__PURE__*/function () {
     value: function destroy() {
       this.token = null;
       this.expiration = 0;
+      if ((0, _authHelper.isMidAuthEnabled)(this.chatConfig)) {
+        this.pendingMidAuthUnauthenticatedState = false;
+        this.isAuthenticated = true;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        this.chatSDK.deferInitialAuth = false;
+      }
     }
   }, {
     key: "isTokenSet",
@@ -214,6 +222,10 @@ let FacadeChatSDK = exports.FacadeChatSDK = /*#__PURE__*/function () {
           message: "Token is valid"
         };
       }
+
+      // Token missing or expired - need to get a new one via getAuthToken
+      // For mid-auth: getAuthToken receives { isMidAuthEnabled: true } so customer implementations
+      // can check portal state and return null for logged-out users
       _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.INFO, {
         Event: _TelemetryConstants.TelemetryEvent.NewTokenValidationStarted,
         Description: "Token validation started."
@@ -234,6 +246,7 @@ let FacadeChatSDK = exports.FacadeChatSDK = /*#__PURE__*/function () {
       this.token = "";
       this.expiration = 0;
       try {
+        var _ring$error, _ring$error2;
         const ring = await (0, _authHelper.handleAuthentication)(this.chatSDK, this.chatConfig, this.getAuthToken);
         if ((ring === null || ring === void 0 ? void 0 : ring.result) === true && ring !== null && ring !== void 0 && ring.token) {
           await this.setToken(ring.token);
@@ -248,18 +261,35 @@ let FacadeChatSDK = exports.FacadeChatSDK = /*#__PURE__*/function () {
             result: true,
             message: "New Token obtained"
           };
-        } else {
-          var _ring$error, _ring$error2;
-          _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.ERROR, {
-            Event: _TelemetryConstants.TelemetryEvent.NewTokenValidationFailed,
-            Description: (_ring$error = ring.error) === null || _ring$error === void 0 ? void 0 : _ring$error.message,
-            ExceptionDetails: ring === null || ring === void 0 ? void 0 : ring.error
+        }
+
+        // Mid-auth: no token available - set pending flag for startChat to handle
+        const isEmptyTokenWithoutError = (0, _utils.isNullOrEmptyString)(ring === null || ring === void 0 ? void 0 : ring.token) && ((ring === null || ring === void 0 ? void 0 : ring.result) === true || (ring === null || ring === void 0 ? void 0 : ring.result) === false && !(ring !== null && ring !== void 0 && ring.error));
+        if ((0, _authHelper.isMidAuthEnabled)(this.chatConfig) && isEmptyTokenWithoutError) {
+          // Clear Facade and SDK token state so API calls use unauthenticated endpoints
+          this.token = "";
+          this.expiration = 0;
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          this.chatSDK.authenticatedUserToken = null;
+          this.pendingMidAuthUnauthenticatedState = true;
+          _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.INFO, {
+            Event: _TelemetryConstants.TelemetryEvent.NewTokenValidationCompleted,
+            Description: "Mid-auth enabled: no token returned; proceeding as unauthenticated"
           });
           return {
-            result: false,
-            message: (ring === null || ring === void 0 || (_ring$error2 = ring.error) === null || _ring$error2 === void 0 ? void 0 : _ring$error2.message) || "Failed to get token"
+            result: true,
+            message: "Mid-auth: proceeding as unauthenticated"
           };
         }
+        _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.ERROR, {
+          Event: _TelemetryConstants.TelemetryEvent.NewTokenValidationFailed,
+          Description: (_ring$error = ring.error) === null || _ring$error === void 0 ? void 0 : _ring$error.message,
+          ExceptionDetails: ring === null || ring === void 0 ? void 0 : ring.error
+        });
+        return {
+          result: false,
+          message: (ring === null || ring === void 0 || (_ring$error2 = ring.error) === null || _ring$error2 === void 0 ? void 0 : _ring$error2.message) || "Failed to get token"
+        };
       } catch (e) {
         console.error("Unexpected error while getting token", e);
         _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.ERROR, {
@@ -273,6 +303,155 @@ let FacadeChatSDK = exports.FacadeChatSDK = /*#__PURE__*/function () {
         };
       }
     }
+
+    /**
+     * Sets unauthenticated state for mid-auth flow.
+     * Clears SDK internal state to prevent reconnection to previous authenticated session.
+     */
+  }, {
+    key: "setMidAuthUnauthenticatedState",
+    value: function setMidAuthUnauthenticatedState() {
+      var _sdk$chatToken, _sdk$chatToken2;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const sdk = this.chatSDK;
+      const hadExistingChat = !!((_sdk$chatToken = sdk.chatToken) !== null && _sdk$chatToken !== void 0 && _sdk$chatToken.chatId);
+      const previousChatId = (_sdk$chatToken2 = sdk.chatToken) === null || _sdk$chatToken2 === void 0 ? void 0 : _sdk$chatToken2.chatId;
+      this.clearAuthState();
+
+      // Clear SDK internal state for fresh unauthenticated chat
+      sdk.chatToken = {};
+      sdk.reconnectId = null;
+      sdk.requestId = null;
+      sdk.sessionId = null;
+      sdk.conversation = null;
+      _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.INFO, {
+        Event: _TelemetryConstants.TelemetryEvent.MidConversationAuthReset,
+        Description: hadExistingChat ? "Mid-auth without token: local state cleared" : "Mid-auth: initialized as unauthenticated (no prior chat)",
+        Data: hadExistingChat ? {
+          previousChatId
+        } : undefined
+      });
+    }
+
+    /** Clears authentication state in both FacadeChatSDK and underlying SDK */
+  }, {
+    key: "clearAuthState",
+    value: function clearAuthState() {
+      this.token = "";
+      this.expiration = 0;
+      this.isAuthenticated = false;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      this.chatSDK.authenticatedUserToken = null;
+    }
+
+    /**
+     * Migrates conversation from unauthenticated to authenticated via authenticateChat.
+     * Called after startChat() when user has a valid token but the backend conversation
+     * was started as unauthenticated.
+     */
+  }, {
+    key: "migrateConversationToAuthenticated",
+    value: async function migrateConversationToAuthenticated() {
+      try {
+        await this.chatSDK.authenticateChat(this.token, {
+          refreshChatToken: true
+        });
+        this.isAuthenticated = true;
+        _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.INFO, {
+          Event: _TelemetryConstants.TelemetryEvent.MidConversationAuthSucceeded,
+          Description: "Mid-auth: authenticateChat completed, conversation migrated to authenticated"
+        });
+      } catch (e) {
+        // Non-fatal: Chat is already active via startChat, will retry on next reconnect
+        _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.WARN, {
+          Event: _TelemetryConstants.TelemetryEvent.MidConversationAuthFailed,
+          Description: "Mid-auth: authenticateChat returned error after startChat, chat still active",
+          ExceptionDetails: {
+            message: e === null || e === void 0 ? void 0 : e.message
+          }
+        });
+      }
+    }
+
+    /**
+     * Configures SDK auth state before startChat.
+     * CASE 1: Pending unauthenticated (no token) - sets deferInitialAuth=true
+     * CASE 2: Authenticated with valid token - sets SDK token and deferInitialAuth based on scenario
+     */
+  }, {
+    key: "configureMidAuthState",
+    value: function configureMidAuthState(isReconnect, wasPreviousSessionAuthenticated) {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const sdk = this.chatSDK;
+
+      // CASE 1: No token available (user not logged in)
+      // pendingMidAuthUnauthenticatedState stays true until user logs in (cleared in tokenRing)
+      if (this.pendingMidAuthUnauthenticatedState) {
+        const shouldClear = this.handlePendingUnauthenticatedState(wasPreviousSessionAuthenticated);
+        sdk.deferInitialAuth = true;
+        _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.INFO, {
+          Event: _TelemetryConstants.TelemetryEvent.MidConversationAuthReset,
+          Description: "Mid-auth configureMidAuthState: CASE 1 - unauthenticated, deferInitialAuth=true",
+          Data: {
+            isReconnect: String(isReconnect),
+            wasPreviousSessionAuthenticated: String(wasPreviousSessionAuthenticated),
+            shouldClearReconnectParams: String(shouldClear)
+          }
+        });
+        return {
+          shouldClearReconnectParams: shouldClear
+        };
+      }
+
+      // CASE 2: Authenticated with valid token
+      if (this.isTokenSet() && !this.isTokenExpired()) {
+        this.handleAuthenticatedState(isReconnect, wasPreviousSessionAuthenticated);
+      }
+      return {
+        shouldClearReconnectParams: false
+      };
+    }
+
+    /**
+     * CASE 1 handler: Returns true if reconnect params should be cleared (Auth -> Unauth transition)
+     */
+  }, {
+    key: "handlePendingUnauthenticatedState",
+    value: function handlePendingUnauthenticatedState(wasPreviousSessionAuthenticated) {
+      if (wasPreviousSessionAuthenticated) {
+        // Auth -> Unauth: user logged out, clear state for fresh chat
+        this.setMidAuthUnauthenticatedState();
+        return true;
+      }
+
+      // Unauth -> Unauth: keep liveChatContext for reconnection
+      this.isAuthenticated = false;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      this.chatSDK.authenticatedUserToken = null;
+      return false;
+    }
+
+    /**
+     * CASE 2 handler: Sets deferInitialAuth only for reconnects to unauthenticated sessions (need migration).
+     * For new chats or reconnects to authenticated sessions, SDK handles auth internally.
+     */
+  }, {
+    key: "handleAuthenticatedState",
+    value: function handleAuthenticatedState(isReconnect, wasPreviousSessionAuthenticated) {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const sdk = this.chatSDK;
+      sdk.authenticatedUserToken = this.token;
+      if (isReconnect && !wasPreviousSessionAuthenticated) {
+        sdk.deferInitialAuth = true;
+        _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.INFO, {
+          Event: _TelemetryConstants.TelemetryEvent.MidConversationAuthSucceeded,
+          Description: "Mid-auth handleAuthenticatedState: CASE 2 - reconnect to unauth session, deferInitialAuth=true (migration needed)"
+        });
+      } else {
+        // Reset to prevent inheriting deferInitialAuth=true from a previous unauthenticated chat
+        sdk.deferInitialAuth = false;
+      }
+    }
   }, {
     key: "validateAndExecuteCall",
     value: async function validateAndExecuteCall(functionName, fn) {
@@ -307,7 +486,52 @@ let FacadeChatSDK = exports.FacadeChatSDK = /*#__PURE__*/function () {
     key: "startChat",
     value: async function startChat() {
       let optionalParams = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
-      return this.validateAndExecuteCall("startChat", () => this.chatSDK.startChat(optionalParams));
+      const midAuthEnabled = (0, _authHelper.isMidAuthEnabled)(this.chatConfig);
+      const isReconnect = !!optionalParams.liveChatContext || !!optionalParams.reconnectId;
+      const wasPreviousSessionAuthenticated = optionalParams.wasAuthenticated === true;
+      return this.validateAndExecuteCall("startChat", async () => {
+        if (midAuthEnabled) {
+          const _this$configureMidAut = this.configureMidAuthState(isReconnect, wasPreviousSessionAuthenticated),
+            shouldClearReconnectParams = _this$configureMidAut.shouldClearReconnectParams;
+          if (shouldClearReconnectParams) {
+            delete optionalParams.liveChatContext;
+            delete optionalParams.reconnectId;
+          }
+        }
+        await this.chatSDK.startChat(optionalParams);
+
+        // Migrate to authenticated if needed (reconnects to unauthenticated sessions only)
+        if (midAuthEnabled) {
+          const shouldMigrateToAuth = isReconnect && this.isTokenSet() && !this.isTokenExpired() && !wasPreviousSessionAuthenticated;
+          if (shouldMigrateToAuth) {
+            _TelemetryHelper.TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(_TelemetryConstants.LogLevel.INFO, {
+              Event: _TelemetryConstants.TelemetryEvent.MidConversationAuthSucceeded,
+              Description: "Mid-auth startChat: initiating migration to authenticated",
+              Data: {
+                isReconnect: String(isReconnect),
+                wasPreviousSessionAuthenticated: String(wasPreviousSessionAuthenticated)
+              }
+            });
+            await this.migrateConversationToAuthenticated();
+          }
+        }
+
+        // Broadcast final auth state after startChat completes (only on state change)
+        if (midAuthEnabled) {
+          const isAuthenticatedAfterStart = this.isTokenSet() && !this.isTokenExpired();
+          const authStateChanged = !isReconnect || isAuthenticatedAfterStart !== wasPreviousSessionAuthenticated;
+          if (authStateChanged) {
+            _omnichannelChatComponents.BroadcastService.postMessage({
+              eventName: isAuthenticatedAfterStart ? _TelemetryConstants.BroadcastEvent.MidConversationAuthSucceeded : _TelemetryConstants.BroadcastEvent.MidConversationAuthReset,
+              payload: {
+                isAuthenticated: isAuthenticatedAfterStart,
+                isStartChatComplete: true,
+                isReconnect
+              }
+            });
+          }
+        }
+      });
     }
   }, {
     key: "endChat",
@@ -445,6 +669,7 @@ let FacadeChatSDK = exports.FacadeChatSDK = /*#__PURE__*/function () {
       let optionalParams = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
       return this.validateAndExecuteCall("getAgentAvailability", () => this.chatSDK.getAgentAvailability(optionalParams));
     }
+
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
   }, {
     key: "getReconnectableChats",

package/lib/cjs/common/telemetry/TelemetryConstants.js

@@ -71,6 +71,9 @@ let BroadcastEvent = exports.BroadcastEvent = /*#__PURE__*/function (BroadcastEv
   BroadcastEvent["FMLTrackingCompletedAck"] = "FMLTrackingCompletedAck";
   BroadcastEvent["FMLTrackingCompleted"] = "FMLTrackingCompleted";
   BroadcastEvent["PersistentConversationReset"] = "PersistentConversationReset";
+  BroadcastEvent["MidConversationAuthSucceeded"] = "MidConversationAuthSucceeded";
+  // Emitted when mid-conversation auth succeeds (for reconnect support)
+  BroadcastEvent["MidConversationAuthReset"] = "MidConversationAuthReset"; // Emitted when mid-auth falls back to unauthenticated mode (token null/empty)
   return BroadcastEvent;
 }({}); // Events being logged
 let TelemetryEvent = exports.TelemetryEvent = /*#__PURE__*/function (TelemetryEvent) {
@@ -105,6 +108,9 @@ let TelemetryEvent = exports.TelemetryEvent = /*#__PURE__*/function (TelemetryEv
   TelemetryEvent["CallingSDKInitFailed"] = "CallingSDKInitFailed";
   TelemetryEvent["CallingSDKLoadSuccess"] = "CallingSDKLoadSuccess";
   TelemetryEvent["CallingSDKLoadFailed"] = "CallingSDKLoadFailed";
+  TelemetryEvent["MidConversationAuthSucceeded"] = "MidConversationAuthSucceeded";
+  TelemetryEvent["MidConversationAuthFailed"] = "MidConversationAuthFailed";
+  TelemetryEvent["MidConversationAuthReset"] = "MidConversationAuthReset";
   TelemetryEvent["GetConversationDetailsCallStarted"] = "GetConversationDetailsCallStarted";
   TelemetryEvent["GetConversationDetailsCallFailed"] = "GetConversationDetailsCallFailed";
   TelemetryEvent["EndChatSDKCallFailed"] = "EndChatSDKCallFailed";
@@ -195,6 +201,7 @@ let TelemetryEvent = exports.TelemetryEvent = /*#__PURE__*/function (TelemetryEv
   //WebChat Middleware Events
   TelemetryEvent["ProcessingHTMLTextMiddlewareFailed"] = "ProcessingHTMLTextMiddlewareFailed";
   TelemetryEvent["ProcessingSanitizationMiddlewareFailed"] = "ProcessingSanitizationMiddlewareFailed";
+  TelemetryEvent["HTMLSanitized"] = "HTMLSanitized";
   TelemetryEvent["FormatTagsMiddlewareJSONStringifyFailed"] = "FormatTagsMiddlewareJSONStringifyFailed";
   TelemetryEvent["AttachmentUploadValidatorMiddlewareFailed"] = "AttachmentUploadValidatorMiddlewareFailed";
   TelemetryEvent["CitationMiddlewareFailed"] = "CitationMiddlewareFailed";
@@ -321,11 +328,19 @@ let TelemetryEvent = exports.TelemetryEvent = /*#__PURE__*/function (TelemetryEv
   TelemetryEvent["LCWLazyLoadNoMoreHistory"] = "LCWLazyLoadNoMoreHistory";
   TelemetryEvent["LCWLazyLoadHistoryError"] = "LCWLazyLoadHistoryError";
   TelemetryEvent["LCWLazyLoadDestroyed"] = "LCWLazyLoadDestroyed";
+  TelemetryEvent["LCWLazyLoadTriggerFired"] = "LCWLazyLoadTriggerFired";
+  TelemetryEvent["LCWLazyLoadBatchReceived"] = "LCWLazyLoadBatchReceived";
+  TelemetryEvent["LCWLazyLoadInitialLoadComplete"] = "LCWLazyLoadInitialLoadComplete";
+  TelemetryEvent["LCWLazyLoadScrollAnchorApplied"] = "LCWLazyLoadScrollAnchorApplied";
   // SecureEventBus events
   TelemetryEvent["SecureEventBusUnauthorizedDispatch"] = "SecureEventBusUnauthorizedDispatch";
   TelemetryEvent["SecureEventBusListenerError"] = "SecureEventBusListenerError";
   TelemetryEvent["SecureEventBusDispatchError"] = "SecureEventBusDispatchError";
   TelemetryEvent["StartChatComplete"] = "StartChatComplete";
+  // Queue & Agent Assignment
+  TelemetryEvent["AgentJoinedConversation"] = "AgentJoinedConversation";
+  // Browser Close Detection
+  TelemetryEvent["BrowserTabHidden"] = "BrowserTabHidden";
   return TelemetryEvent;
 }({});
 let TelemetryConstants = exports.TelemetryConstants = /*#__PURE__*/function () {
@@ -397,6 +412,8 @@ let TelemetryConstants = exports.TelemetryConstants = /*#__PURE__*/function () {
         case TelemetryEvent.SecureEventBusUnauthorizedDispatch:
         case TelemetryEvent.SecureEventBusListenerError:
         case TelemetryEvent.SecureEventBusDispatchError:
+        case TelemetryEvent.AgentJoinedConversation:
+        case TelemetryEvent.BrowserTabHidden:
           return ScenarioType.ACTIONS;
         case TelemetryEvent.StartChatSDKCall:
         case TelemetryEvent.StartChatEventReceived:

package/lib/cjs/common/telemetry/TelemetryManager.js

@@ -11,6 +11,7 @@ var _appInsightsLogger = require("./loggers/appInsightsLogger");
 var _ariaTelemetryLogger = require("./loggers/ariaTelemetryLogger");
 var _consoleLogger = require("./loggers/consoleLogger");
 var _defaultAriaConfig = require("./defaultConfigs/defaultAriaConfig");
+var _sanitizeSasInPayload = require("./sanitizeSasInPayload");
 function _defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, _toPropertyKey(o.key), o); } }
 function _createClass(e, r, t) { return r && _defineProperties(e.prototype, r), t && _defineProperties(e, t), Object.defineProperty(e, "prototype", { writable: !1 }), e; }
 function _classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
@@ -79,11 +80,15 @@ const RegisterLoggers = () => {
     };
   };
   const logTelemetry = telemetryEvent => {
+    // Redact Azure SAS credentials in any URL embedded in the payload (e.g.
+    // customer-supplied blob asset URLs in widget customization props) before
+    // it fans out to console, Aria, AppInsights, or any custom logger.
+    const sanitizedPayload = (0, _sanitizeSasInPayload.sanitizeSasInPayload)(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload);
     loggers.map(logger => {
       var _payload, _telemetryInput$paylo;
       const logLevel = telemetryEvent.logLevel ?? _TelemetryConstants.LogLevel.INFO;
       const scenarioType = ((_payload = telemetryEvent.payload) === null || _payload === void 0 ? void 0 : _payload.scenarioType) ?? _TelemetryConstants.ScenarioType.UNDEFINED;
-      const telemetryInput = parseInput(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload, scenarioType);
+      const telemetryInput = parseInput(sanitizedPayload, scenarioType);
       telemetryInput.telemetryInfo = {
         telemetryInfo: _TelemetryHelper.TelemetryHelper.buildTelemetryEvent(logLevel, telemetryInput)
       };

package/lib/cjs/common/telemetry/loggers/appInsightsLogger.js

@@ -42,9 +42,8 @@ const appInsightsLogger = appInsightsKey => {
       }
       try {
         // Dynamically import Application Insights
-        const {
-          ApplicationInsights
-        } = await Promise.resolve().then(() => _interopRequireWildcard(require("@microsoft/applicationinsights-web")));
+        const _await$import = await Promise.resolve().then(() => _interopRequireWildcard(require("@microsoft/applicationinsights-web"))),
+          ApplicationInsights = _await$import.ApplicationInsights;
         const config = {
           ...(appInsightsKey.includes("IngestionEndpoint") ? {
             connectionString: appInsightsKey

package/lib/cjs/common/telemetry/sanitizeSasInPayload.js

@@ -0,0 +1,91 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.sanitizeSasInPayload = void 0;
+function _slicedToArray(r, e) { return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest(); }
+function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function _iterableToArrayLimit(r, l) { var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (null != t) { var e, n, i, u, a = [], f = !0, o = !1; try { if (i = (t = t.call(r)).next, 0 === l) { if (Object(t) !== t) return; f = !1; } else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = !0); } catch (r) { o = !0, n = r; } finally { try { if (!f && null != t.return && (u = t.return(), Object(u) !== u)) return; } finally { if (o) throw n; } } return a; } }
+function _arrayWithHoles(r) { if (Array.isArray(r)) return r; }
+/**
+ * Redacts the values of Azure Shared Access Signature (SAS) query parameters in any
+ * URL embedded in a telemetry payload, so customer-supplied SAS URLs (e.g. blob asset
+ * URLs in widget customization props) cannot leak credentials through Aria/AppInsights.
+ *
+ * Trigger: any URL whose query string contains `sig=`. When detected, every well-known
+ * SAS parameter value in that query is replaced with `[REDACTED]`. Other URLs and other
+ * substrings of the payload pass through unchanged.
+ *
+ * Coverage of SAS parameter names:
+ *  - Service/Blob SAS:        sig, sv, se, st, sp, spr, sr, sip
+ *  - Account SAS:             ss, srt
+ *  - User-delegation key SAS: skoid, sktid, skt, ske, sks, skv, saoid, suoid, sce, sdd
+ *  - Response header overrides: rscc, rscd, rsce, rscl, rsct
+ *
+ * Reference: https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas
+ */
+
+const SAS_PARAM_NAMES = new Set(["sig", "sv", "se", "st", "sp", "spr", "sr", "sip", "ss", "srt", "skoid", "sktid", "skt", "ske", "sks", "skv", "saoid", "suoid", "sce", "sdd", "rscc", "rscd", "rsce", "rscl", "rsct"]);
+const REDACTED_VALUE = "[REDACTED]";
+
+// Matches any http(s) URL substring up to whitespace / closing quote / angle-bracket / paren.
+const URL_REGEX = /\bhttps?:\/\/[^\s"'<>)]+/gi;
+const redactQueryIfSas = url => {
+  const queryIdx = url.indexOf("?");
+  if (queryIdx < 0) {
+    return url;
+  }
+  // Separate the fragment (#...) before processing the query — fragments come
+  // after the query string in URL syntax and must not be folded into the last
+  // query parameter's value when we split on `&`.
+  const afterQuestionMark = url.slice(queryIdx + 1);
+  const fragIdx = afterQuestionMark.indexOf("#");
+  const query = fragIdx < 0 ? afterQuestionMark : afterQuestionMark.slice(0, fragIdx);
+  const fragment = fragIdx < 0 ? "" : afterQuestionMark.slice(fragIdx); // includes the leading '#'
+  if (!/(^|&)sig=/i.test(query)) {
+    // No SAS signature present — leave the URL alone so legitimate non-SAS query
+    // strings (e.g. ?utm_source=...) are not mangled.
+    return url;
+  }
+  const base = url.slice(0, queryIdx);
+  const sanitizedQuery = query.split("&").map(pair => {
+    const eqIdx = pair.indexOf("=");
+    if (eqIdx < 0) {
+      return pair;
+    }
+    const name = pair.slice(0, eqIdx).toLowerCase();
+    return SAS_PARAM_NAMES.has(name) ? `${pair.slice(0, eqIdx)}=${REDACTED_VALUE}` : pair;
+  }).join("&");
+  return `${base}?${sanitizedQuery}${fragment}`;
+};
+const sanitizeString = s => s.replace(URL_REGEX, redactQueryIfSas);
+
+/**
+ * Deep-walk a value and redact SAS credentials in any string it contains.
+ * Returns a new object/array (originals are not mutated); non-string leaves are
+ * passed through. Tree-shaped, JSON-like values only — not designed for class
+ * instances, prototype-bound objects, or cyclic graphs.
+ */
+const sanitizeSasInPayload = value => {
+  if (typeof value === "string") {
+    return sanitizeString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map(sanitizeSasInPayload);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const _ref of Object.entries(value)) {
+      var _ref2 = _slicedToArray(_ref, 2);
+      const k = _ref2[0];
+      const v = _ref2[1];
+      out[k] = sanitizeSasInPayload(v);
+    }
+    return out;
+  }
+  return value;
+};
+exports.sanitizeSasInPayload = sanitizeSasInPayload;