@microsoft/rayfin-auth-provider-fabric 1.36.0-alpha.1756 → 1.36.0-beta.0

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export type { FabricAuthOptions } from './types.js';
 export type { EntraTokenSignInOptions } from './signInWithEntraToken.js';
-export { signInWithEntraToken } from './signInWithEntraToken.js';
+export { signInWithEntraToken, signInWithBrokeredToken, } from './signInWithEntraToken.js';
 export { bridgeFabricCallback } from './bridgeFabricCallback.js';
 export { embeddedFabricLogin } from './embeddedFabricLogin.js';
 export { ensureSignedInWithFabric } from './ensureSignedInWithFabric.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { signInWithEntraToken } from './signInWithEntraToken.js';
+export { signInWithEntraToken, signInWithBrokeredToken, } from './signInWithEntraToken.js';
 // Functions
 export { bridgeFabricCallback } from './bridgeFabricCallback.js';
 export { embeddedFabricLogin } from './embeddedFabricLogin.js';

package/dist/signInWithEntraToken.d.ts

@@ -1,4 +1,4 @@
-import type { Auth, OpaqueSession } from '@microsoft/rayfin-auth';
+import type { Auth, OpaqueSession, TokenResponse } from '@microsoft/rayfin-auth';
 /** Options for signing in to a Fabric AppBackend with an existing Entra token. */
 export interface EntraTokenSignInOptions {
     /** Already-acquired delegated Entra access token, without a Bearer prefix. */
@@ -24,5 +24,29 @@ export interface EntraTokenSignInOptions {
  * const session = await signInWithEntraToken(client.auth, { entraToken });
  * ```
  */
+/**
+ * Establishes an authenticated session on `auth` from a token response that
+ * was already obtained from this backend's brokered-token exchange
+ * (`POST /api/auth/v1/brokered/token`) by a trusted caller other than the
+ * browser -- for example a local development host that performed the
+ * exchange itself so it can reach an HTTP-only local backend, which
+ * {@link signInWithEntraToken}'s HTTPS requirement would otherwise reject.
+ * No network request is made here; the response is validated and installed
+ * directly.
+ *
+ * Prefer {@link signInWithEntraToken} when the raw Entra token is available
+ * in-browser and the configured backend is HTTPS-reachable -- it performs
+ * this exchange for you.
+ *
+ * @param auth - The Auth instance used by your SDK clients.
+ * @param tokenResponse - The token response returned by the brokered exchange.
+ * @returns The installed session metadata, without access or refresh tokens.
+ * @throws `AuthError` when the token response is malformed.
+ * @example
+ * ```typescript
+ * const session = await signInWithBrokeredToken(client.auth, tokenResponse);
+ * ```
+ */
+export declare function signInWithBrokeredToken(auth: Auth, tokenResponse: TokenResponse): Promise<OpaqueSession>;
 export declare function signInWithEntraToken(auth: Auth, options: EntraTokenSignInOptions): Promise<OpaqueSession>;
 //# sourceMappingURL=signInWithEntraToken.d.ts.map

package/dist/signInWithEntraToken.js

@@ -103,6 +103,35 @@ function sanitizeSignInFailure(error) {
  * const session = await signInWithEntraToken(client.auth, { entraToken });
  * ```
  */
+/**
+ * Establishes an authenticated session on `auth` from a token response that
+ * was already obtained from this backend's brokered-token exchange
+ * (`POST /api/auth/v1/brokered/token`) by a trusted caller other than the
+ * browser -- for example a local development host that performed the
+ * exchange itself so it can reach an HTTP-only local backend, which
+ * {@link signInWithEntraToken}'s HTTPS requirement would otherwise reject.
+ * No network request is made here; the response is validated and installed
+ * directly.
+ *
+ * Prefer {@link signInWithEntraToken} when the raw Entra token is available
+ * in-browser and the configured backend is HTTPS-reachable -- it performs
+ * this exchange for you.
+ *
+ * @param auth - The Auth instance used by your SDK clients.
+ * @param tokenResponse - The token response returned by the brokered exchange.
+ * @returns The installed session metadata, without access or refresh tokens.
+ * @throws `AuthError` when the token response is malformed.
+ * @example
+ * ```typescript
+ * const session = await signInWithBrokeredToken(client.auth, tokenResponse);
+ * ```
+ */
+export async function signInWithBrokeredToken(auth, tokenResponse) {
+    const validated = validateTokenResponse(tokenResponse);
+    return runProviderSignIn(auth, () => createSessionFromTokenResponse(auth, validated, {
+        persistBeforeCommit: true,
+    })).catch(sanitizeSignInFailure);
+}
 export async function signInWithEntraToken(auth, options) {
     const token = options?.entraToken;
     if (typeof token !== 'string' ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microsoft/rayfin-auth-provider-fabric",
-  "version": "1.36.0-alpha.1756",
+  "version": "1.36.0-beta.0",
   "description": "Fabric brokered authentication provider for Rayfin SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,9 +13,9 @@
   ],
   "type": "module",
   "dependencies": {
-    "@microsoft/rayfin-auth": "1.36.0-alpha.1756",
-    "@microsoft/rayfin-lib": "1.36.0-alpha.1756",
-    "@microsoft/fabric-embedded-host": "1.36.0-alpha.1756"
+    "@microsoft/rayfin-auth": "1.36.0-beta.0",
+    "@microsoft/rayfin-lib": "1.36.0-beta.0",
+    "@microsoft/fabric-embedded-host": "1.36.0-beta.0"
   },
   "devDependencies": {
     "typescript": "^5.8.3",