@microsoft/teamsfx 0.2.8-alpha.9ef5081b.0 → 0.2.8-alpha.b4c7969d.0

package/dist/index.js

@@ -3,14 +3,15 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var tslib = require('tslib');
-var identity = require('@azure/identity');
 var jwt_decode = require('jwt-decode');
+var crypto = require('crypto');
 var coreHttp = require('@azure/core-http');
 var msalNode = require('@azure/msal-node');
 var botbuilder = require('botbuilder');
 var botbuilderDialogs = require('botbuilder-dialogs');
 var uuid = require('uuid');
 var microsoftGraphClient = require('@microsoft/microsoft-graph-client');
+var identity = require('@azure/identity');
 
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
@@ -32,6 +33,10 @@ exports.ErrorCode = void 0;
      * Invalid configuration error.
      */
     ErrorCode["InvalidConfiguration"] = "InvalidConfiguration";
+    /**
+     * Invalid certificate error.
+     */
+    ErrorCode["InvalidCertificate"] = "InvalidCertificate";
     /**
      * Internal error.
      */
@@ -330,6 +335,43 @@ function validateScopesType(value) {
     internalLogger.error(errorMsg);
     throw new ErrorWithCode(errorMsg, exports.ErrorCode.InvalidParameter);
 }
+/**
+ * @internal
+ */
+function getScopesArray(scopes) {
+    const scopesArray = typeof scopes === "string" ? scopes.split(" ") : scopes;
+    return scopesArray.filter((x) => x !== null && x !== "");
+}
+/**
+ * @internal
+ */
+function getAuthority(authorityHost, tenantId) {
+    const normalizedAuthorityHost = authorityHost.replace(/\/+$/g, "");
+    return normalizedAuthorityHost + "/" + tenantId;
+}
+/**
+ * @internal
+ */
+function parseCertificate(certificateContent) {
+    if (!certificateContent) {
+        return undefined;
+    }
+    const certificatePattern = /(-+BEGIN CERTIFICATE-+)(\n\r?|\r\n?)([A-Za-z0-9+/\n\r]+=*)(\n\r?|\r\n?)(-+END CERTIFICATE-+)/;
+    const match = certificatePattern.exec(certificateContent);
+    if (!match) {
+        const errorMsg = "The certificate content does not contain a PEM-encoded certificate.";
+        internalLogger.error(errorMsg);
+        throw new ErrorWithCode(errorMsg, exports.ErrorCode.InvalidCertificate);
+    }
+    const thumbprint = crypto.createHash("sha1")
+        .update(Buffer.from(match[3], "base64"))
+        .digest("hex")
+        .toUpperCase();
+    return {
+        thumbprint: thumbprint,
+        privateKey: certificateContent,
+    };
+}
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
@@ -469,6 +511,27 @@ function getAuthenticationConfiguration() {
     throw new ErrorWithCode(formatString(ErrorMessage.ConfigurationNotExists, errorMsg), exports.ErrorCode.InvalidConfiguration);
 }
 
+/**
+ * @internal
+ */
+function createConfidentialClientApplication(authentication) {
+    const authority = getAuthority(authentication.authorityHost, authentication.tenantId);
+    const clientCertificate = parseCertificate(authentication.certificateContent);
+    const auth = {
+        clientId: authentication.clientId,
+        authority: authority,
+    };
+    if (clientCertificate) {
+        auth.clientCertificate = clientCertificate;
+    }
+    else {
+        auth.clientSecret = authentication.clientSecret;
+    }
+    return new msalNode.ConfidentialClientApplication({
+        auth,
+    });
+}
+
 // Copyright (c) Microsoft Corporation.
 /**
  * Represent Microsoft 365 tenant identity, and it is usually used when user is not involved like time-triggered automation job.
@@ -499,10 +562,7 @@ class M365TenantCredential {
     constructor() {
         internalLogger.info("Create M365 tenant credential");
         const config = this.loadAndValidateConfig();
-        const tokenCredentialOptions = {
-            authorityHost: config.authorityHost,
-        };
-        this.clientSecretCredential = new identity.ClientSecretCredential(config.tenantId, config.clientId, config.clientSecret, tokenCredentialOptions);
+        this.msalClient = createConfidentialClientApplication(config);
     }
     /**
      * Get access token for credential.
@@ -537,20 +597,21 @@ class M365TenantCredential {
             const scopesStr = typeof scopes === "string" ? scopes : scopes.join(" ");
             internalLogger.info("Get access token with scopes: " + scopesStr);
             try {
-                accessToken = yield this.clientSecretCredential.getToken(scopes);
+                const scopesArray = getScopesArray(scopes);
+                const authenticationResult = yield this.msalClient.acquireTokenByClientCredential({
+                    scopes: scopesArray,
+                });
+                if (authenticationResult) {
+                    accessToken = {
+                        token: authenticationResult.accessToken,
+                        expiresOnTimestamp: authenticationResult.expiresOn.getTime(),
+                    };
+                }
             }
             catch (err) {
-                if (err instanceof identity.AuthenticationError) {
-                    const authError = err;
-                    const errorMsg = `Get M365 tenant credential with authentication error: status code ${authError.statusCode}, error messages: ${authError.message}`;
-                    internalLogger.error(errorMsg);
-                    throw new ErrorWithCode(errorMsg, exports.ErrorCode.ServiceError);
-                }
-                else {
-                    const errorMsg = "Get M365 tenant credential failed with error: " + err.message;
-                    internalLogger.error(errorMsg);
-                    throw new ErrorWithCode(errorMsg, exports.ErrorCode.InternalError);
-                }
+                const errorMsg = "Get M365 tenant credential failed with error: " + err.message;
+                internalLogger.error(errorMsg);
+                throw new ErrorWithCode(errorMsg, exports.ErrorCode.ServiceError);
             }
             if (!accessToken) {
                 const errorMsg = "Get M365 tenant credential access token failed with empty access token";
@@ -571,15 +632,15 @@ class M365TenantCredential {
             internalLogger.error(ErrorMessage.AuthenticationConfigurationNotExists);
             throw new ErrorWithCode(ErrorMessage.AuthenticationConfigurationNotExists, exports.ErrorCode.InvalidConfiguration);
         }
-        if (config.clientId && config.clientSecret && config.tenantId) {
+        if (config.clientId && (config.clientSecret || config.certificateContent) && config.tenantId) {
             return config;
         }
         const missingValues = [];
         if (!config.clientId) {
             missingValues.push("clientId");
         }
-        if (!config.clientSecret) {
-            missingValues.push("clientSecret");
+        if (!config.clientSecret && !config.certificateContent) {
+            missingValues.push("clientSecret or certificateContent");
         }
         if (!config.tenantId) {
             missingValues.push("tenantId");
@@ -614,7 +675,7 @@ class OnBehalfOfUserCredential {
      *
      * @param {string} ssoToken - User token provided by Teams SSO feature.
      *
-     * @throws {@link ErrorCode|InvalidConfiguration} when client id, client secret, authority host or tenant id is not found in config.
+     * @throws {@link ErrorCode|InvalidConfiguration} when client id, client secret, certificate content, authority host or tenant id is not found in config.
      * @throws {@link ErrorCode|InternalError} when SSO token is not valid.
      * @throws {@link ErrorCode|RuntimeNotSupported} when runtime is browser.
      *
@@ -630,10 +691,10 @@ class OnBehalfOfUserCredential {
         if (!((_b = config === null || config === void 0 ? void 0 : config.authentication) === null || _b === void 0 ? void 0 : _b.authorityHost)) {
             missingConfigurations.push("authorityHost");
         }
-        if (!((_c = config === null || config === void 0 ? void 0 : config.authentication) === null || _c === void 0 ? void 0 : _c.clientSecret)) {
-            missingConfigurations.push("clientSecret");
+        if (!((_c = config === null || config === void 0 ? void 0 : config.authentication) === null || _c === void 0 ? void 0 : _c.clientSecret) && !((_d = config === null || config === void 0 ? void 0 : config.authentication) === null || _d === void 0 ? void 0 : _d.certificateContent)) {
+            missingConfigurations.push("clientSecret or certificateContent");
         }
-        if (!((_d = config === null || config === void 0 ? void 0 : config.authentication) === null || _d === void 0 ? void 0 : _d.tenantId)) {
+        if (!((_e = config === null || config === void 0 ? void 0 : config.authentication) === null || _e === void 0 ? void 0 : _e.tenantId)) {
             missingConfigurations.push("tenantId");
         }
         if (missingConfigurations.length != 0) {
@@ -641,15 +702,7 @@ class OnBehalfOfUserCredential {
             internalLogger.error(errorMsg);
             throw new ErrorWithCode(errorMsg, exports.ErrorCode.InvalidConfiguration);
         }
-        const normalizedAuthorityHost = config.authentication.authorityHost.replace(/\/+$/g, "");
-        const authority = normalizedAuthorityHost + "/" + ((_e = config.authentication) === null || _e === void 0 ? void 0 : _e.tenantId);
-        this.msalClient = new msalNode.ConfidentialClientApplication({
-            auth: {
-                clientId: config.authentication.clientId,
-                authority: authority,
-                clientSecret: config.authentication.clientSecret,
-            },
-        });
+        this.msalClient = createConfidentialClientApplication(config.authentication);
         const decodedSsoToken = parseJwt(ssoToken);
         this.ssoToken = {
             token: ssoToken,
@@ -694,8 +747,7 @@ class OnBehalfOfUserCredential {
     getToken(scopes, options) {
         return tslib.__awaiter(this, void 0, void 0, function* () {
             validateScopesType(scopes);
-            let scopesArray = typeof scopes === "string" ? scopes.split(" ") : scopes;
-            scopesArray = scopesArray.filter((x) => x !== null && x !== "");
+            const scopesArray = getScopesArray(scopes);
             let result;
             if (!scopesArray.length) {
                 internalLogger.info("Get SSO token.");