@microsoft/windows-admin-center-sdk 6.0.0 → 6.1.0

package/core/security/authorization-manager.js

@@ -4,6 +4,7 @@ import { Crypto } from '../data/crypto';
 import { headerConstants } from '../data/http-constants';
 import { Net } from '../data/net';
 import { Logging } from '../diagnostics/logging';
+import { EnvironmentModule } from '../manifest/environment-modules';
 import { RpcForwarder, RpcServiceForwarder } from '../rpc/rpc-forwarder';
 import { SignOnManager } from './sign-on-manager';
 /**
@@ -11,6 +12,7 @@ import { SignOnManager } from './sign-on-manager';
  */
 export class AuthorizationManager extends RpcServiceForwarder {
     authorize;
+    options;
     /**
      * Cache key for session storage of authorization cache
      */
@@ -26,6 +28,7 @@ export class AuthorizationManager extends RpcServiceForwarder {
         setNodeTokenError: 'setNodeTokenError',
         setJeaContext: 'setJeaContext',
         clearNodeTokens: 'clearNodeTokens',
+        clearScopedTokens: 'clearScopedTokens',
         getNewToken: 'getNewToken',
         secureToken: 'secureToken',
         encrypt: 'encrypt',
@@ -49,6 +52,10 @@ export class AuthorizationManager extends RpcServiceForwarder {
      * The JSON Web Key. Single string with JSON.stringify format.
      */
     jwk;
+    /**
+     * The canonical origin that owns the cached credentials.
+     */
+    gatewayOrigin;
     /**
      * Credentials expiration time, used to determine the lifetime of new tokens. Value in milliseconds.
      */
@@ -88,6 +95,21 @@ export class AuthorizationManager extends RpcServiceForwarder {
      * The token awaiter subject.
      */
     tokenAwaiter;
+    /** Direct child frames participating in the current shared credential request. */
+    sharedTokenRequesters = new Set();
+    /**
+     * Token awaiters for credential requests from specific child requesters, keyed by requester RPC name.
+     * Used only when requester scoping is enabled, so one requester's prompt is never shared with another.
+     */
+    requesterTokenAwaiters = new Map();
+    /**
+     * Shell instance only: credentials that apply to a single requester, keyed by requester RPC name.
+     */
+    scopedTokens = {};
+    /** Child-only scoped tokens that currently take precedence over shared tokens in the effective public state. */
+    scopedTokenState = null;
+    /** Child-only shared tokens retained beneath scoped tokens and restored when scoped state clears. */
+    sharedTokenState = null;
     /**
      * The subject observable of sign on token awaiter.
      */
@@ -134,6 +156,20 @@ export class AuthorizationManager extends RpcServiceForwarder {
     get gatewayJwk() {
         return this.jwk;
     }
+    /**
+     * Binds cached credentials to a canonical gateway origin.
+     * Credentials and gateway encryption state are cleared before a changed origin is recorded.
+     */
+    setGatewayOrigin(origin) {
+        if (this.gatewayOrigin === origin) {
+            return;
+        }
+        this.resetAllTokens();
+        this.jwk = null;
+        this.gatewayJwkChangedSubject.next(null);
+        this.gatewayOrigin = origin;
+        this.updateCache();
+    }
     /**
      * Gets an observable the emits when the authorization token is ready
      */
@@ -149,10 +185,12 @@ export class AuthorizationManager extends RpcServiceForwarder {
      * Initializes a new instance of the Authorization Manager class
      * @param authorize An AuthorizationHandler with which to retrieve user credentials
      * @param rpc The rpc to forward auth requests to a parent window
+     * @param options Optional behavior switches
      */
-    constructor(authorize, rpc) {
+    constructor(authorize, rpc, options = {}) {
         super('authorization-manager', rpc);
         this.authorize = authorize;
+        this.options = options;
         this.gatewayJwkChangedSubject = new Subject();
         this.gatewayJwkChanged = this.gatewayJwkChangedSubject.asObservable();
         this.credentialExpirationChangedSubject = new Subject();
@@ -166,7 +204,9 @@ export class AuthorizationManager extends RpcServiceForwarder {
                 try {
                     const cachedData = JSON.parse(cachedDataString);
                     // verify data and set properties
+                    this.gatewayOrigin = cachedData.gatewayOrigin || null;
                     this.jwk = cachedData.jwk || null;
+                    this.scopedTokens = cachedData.scopedTokens || {};
                     this.manageAsToken = cachedData.manageAsToken || null;
                     this.nodeTokens = cachedData.nodeTokens || {};
                     this.nodePowershellEndpoints = cachedData.nodePowershellEndpoints || {};
@@ -179,6 +219,19 @@ export class AuthorizationManager extends RpcServiceForwarder {
         }
         this.signOnManager = new SignOnManager(() => this.refreshSignOnToken());
     }
+    /**
+     * Attributes requests to direct children, preserving requester names relayed by hosted shells.
+     * Creates requester-only error data when the caller supplies none.
+     *
+     * @param errorData the error data received from the child, if any.
+     * @param sourceName the RPC name of the direct child that sent the request.
+     */
+    static withRequesterName(errorData, sourceName) {
+        if (!sourceName || EnvironmentModule.isShellName(sourceName)) {
+            return errorData;
+        }
+        return { ...(errorData || {}), requesterName: sourceName };
+    }
     /**
      * defines the conditions under which the AuthorizationManager can handle an ajax error
      */
@@ -274,20 +327,33 @@ export class AuthorizationManager extends RpcServiceForwarder {
         this.updateCache();
     }
     getNewToken(nodeNames, errorData) {
+        return this.requestNewToken(nodeNames, errorData, this.getRequesterAwaiterKey(errorData));
+    }
+    requestNewToken(nodeNames, errorData, requesterKey, sourceName) {
         // if we are already awaiting a token, then hook into the current request and try using that token
-        if (this.tokenAwaiter && !this.tokenAwaiter.closed) {
-            return this.tokenAwaiter;
+        const pendingAwaiter = this.getPendingAwaiter(requesterKey);
+        if (!requesterKey) {
+            if (!pendingAwaiter) {
+                this.sharedTokenRequesters.clear();
+            }
+            if (sourceName) {
+                this.sharedTokenRequesters.add(sourceName);
+            }
+        }
+        if (pendingAwaiter) {
+            return pendingAwaiter;
         }
         // ensure input is an array only if not null.
         if (nodeNames && !Array.isArray(nodeNames)) {
             nodeNames = [nodeNames];
         }
         // define a new subject for multiple requests to wait on
-        this.tokenAwaiter = new Subject();
+        const awaiter = new Subject();
+        this.setPendingAwaiter(requesterKey, awaiter);
         // try to forward execute getNewToken from our parent
         const parentExecuter = this.forwardExecute(0 /* RpcRelationshipType.Parent */, AuthorizationManager.rpcCommands.getNewToken, [nodeNames, errorData]);
         if (parentExecuter) {
-            return this.tokenAwaiter;
+            return awaiter;
         }
         // Need to clear the endpoints before we acquire a new token,
         // because we must try new credentials in an admin context before any fallback happens.
@@ -297,9 +363,11 @@ export class AuthorizationManager extends RpcServiceForwarder {
             }
         }
         // since we could not forward the request We must ask for the auth token ourselves
-        this.authorize(nodeNames, errorData)
+        const authorizeErrorData = this.isRequesterScopingEnabled() ? { ...(errorData || {}), requesterScope: requesterKey || null } : errorData;
+        this.authorize(nodeNames, authorizeErrorData)
             .pipe(mergeMap(credentials => {
-            if (credentials.applyToAllNodes) {
+            // scoped credentials never replace the credentials shared by every tool
+            if (credentials.applyToAllNodes && !this.getCredentialScope(credentials, requesterKey)) {
                 this.nodeTokens = {};
                 this.updateCache();
                 const forward = this.forwardExecute(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.clearNodeTokens, []);
@@ -309,6 +377,7 @@ export class AuthorizationManager extends RpcServiceForwarder {
             }
             return of(credentials);
         }), mergeMap(credentials => {
+            const scope = this.getCredentialScope(credentials, requesterKey);
             const appliesTo = credentials.applyToAllNodes ? null : nodeNames || null;
             return this.createSecureToken({
                 username: credentials.username,
@@ -316,26 +385,53 @@ export class AuthorizationManager extends RpcServiceForwarder {
                 useLaps: credentials.useLaps,
                 lapsLocalAdminName: credentials.lapsLocalAdminName
             }).pipe(map(token => {
-                return {
+                const response = {
                     token: token,
                     appliesTo: appliesTo
                 };
+                if (scope) {
+                    response.scope = scope;
+                }
+                return response;
             }));
+        }), mergeMap(result => {
+            if (result.scope && !result.appliesTo) {
+                // Older core prefers node tokens over a global token and does not understand scope.
+                const forward = this.forwardExecuteToChildren(result.scope, AuthorizationManager.rpcCommands.clearNodeTokens, []);
+                if (forward) {
+                    return forward.pipe(map(() => result));
+                }
+            }
+            return of(result);
         }), 
         // take the next 1 result and use it for our token.
         // We can now notify anyone waiting for auth and save the token
         take(1))
             .subscribe({
             next: result => {
-                this.completeTokenAwaiter(result);
-                this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.setNodeToken, result);
+                if (result.scope) {
+                    this.saveScopedToken(result);
+                    const awaiter = this.requesterTokenAwaiters.get(requesterKey);
+                    if (awaiter) {
+                        this.requesterTokenAwaiters.delete(requesterKey);
+                        awaiter.next(result);
+                        awaiter.complete();
+                    }
+                    this.forwardNotifyToChildren(result.scope, AuthorizationManager.rpcCommands.setNodeToken, result);
+                    return;
+                }
+                this.completeTokenAwaiter(result, null, requesterKey);
+                const pendingRequesters = Array.from(this.requesterTokenAwaiters.keys());
+                const notification = pendingRequesters.length ? { ...result, pendingRequesters } : result;
+                this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.setNodeToken, notification);
             },
             error: error => {
-                this.completeTokenAwaiter(null, error);
-                this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.setNodeTokenError, RpcForwarder.ensureSerializable(error));
+                const sharedRequesters = Array.from(this.sharedTokenRequesters);
+                this.completeTokenAwaiter(null, error, requesterKey);
+                this.notifyTokenError(requesterKey, error, sharedRequesters);
             }
         });
-        return this.tokenAwaiter;
+        return awaiter;
     }
     refreshSignOnToken() {
         // if we are already awaiting a token, then hook into the current request and try using that token
@@ -433,8 +529,17 @@ export class AuthorizationManager extends RpcServiceForwarder {
      * @param nodeName The nodeName to get token for.
      */
     getSavedNodeToken(nodeName) {
-        if (nodeName && this.nodeTokens[nodeName.toLocaleLowerCase()]) {
-            return this.nodeTokens[nodeName.toLocaleLowerCase()];
+        const normalizedNodeName = nodeName && nodeName.toLocaleLowerCase();
+        if (this.scopedTokenState) {
+            if (normalizedNodeName && this.scopedTokenState.nodeTokens[normalizedNodeName]) {
+                return this.scopedTokenState.nodeTokens[normalizedNodeName];
+            }
+            if (this.scopedTokenState.manageAsToken) {
+                return this.scopedTokenState.manageAsToken;
+            }
+        }
+        if (normalizedNodeName && this.nodeTokens[normalizedNodeName]) {
+            return this.nodeTokens[normalizedNodeName];
         }
         return this.manageAsToken;
     }
@@ -529,6 +634,10 @@ export class AuthorizationManager extends RpcServiceForwarder {
         }
     }
     resetAllTokens() {
+        this.scopedTokens = {};
+        this.scopedTokenState = null;
+        this.sharedTokenState = null;
+        this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.clearScopedTokens, null);
         this.manageAsToken = null;
         this.nodePowershellEndpoints = {};
         this.nodeTokens = {};
@@ -559,19 +668,39 @@ export class AuthorizationManager extends RpcServiceForwarder {
         this.nodeTokens = data.result.nodeTokens;
         this.nodePowershellEndpoints = data.result.nodePowershellEndpoints;
         this.signOnManager.signedHttpRequestToken = data.result.signOnToken;
+        this.scopedTokenState = data.result.scopedTokens || null;
+        const sharedTokens = data.result.sharedTokens || { nodeTokens: {} };
+        this.sharedTokenState = this.scopedTokenState
+            ? {
+                manageAsToken: sharedTokens.manageAsToken,
+                nodeTokens: { ...sharedTokens.nodeTokens }
+            }
+            : null;
+        this.recomputeEffectiveTokenState();
     }
     /**
      * Called when a new instance of the service in another window is initialized and needs to synchronize with its parent
-     * @param from The RpcRelationshipType that this request is from
+     * @param sourceName The RPC name of the initializing child, used to include the credentials scoped to it
      * @returns an observable for the all the values needed to initialize the service
      */
-    onForwardInit() {
-        // authorization manager doesn't pass any properties to child services at this time.
+    onForwardInit(sourceName) {
+        const sharedTokenState = this.scopedTokenState ? this.sharedTokenState : null;
+        const scoped = this.scopedTokenState || (sourceName && this.isRequesterScopingEnabled() ? this.scopedTokens[sourceName] : null);
+        const sharedManageAsToken = sharedTokenState ? sharedTokenState.manageAsToken : this.manageAsToken;
+        const sharedNodeTokens = sharedTokenState ? sharedTokenState.nodeTokens : this.nodeTokens;
         return of({
-            manageAsToken: this.manageAsToken,
-            nodeTokens: this.nodeTokens,
-            nodePowershellEndpoints: this.nodePowershellEndpoints,
-            signOnToken: this.signOnManager.signedHttpRequestToken
+            manageAsToken: (scoped && scoped.manageAsToken) || sharedManageAsToken,
+            nodeTokens: scoped ? (scoped.manageAsToken ? { ...scoped.nodeTokens } : { ...sharedNodeTokens, ...scoped.nodeTokens }) : this.nodeTokens,
+            sharedTokens: scoped
+                ? {
+                    manageAsToken: sharedManageAsToken,
+                    nodeTokens: sharedNodeTokens
+                }
+                : undefined,
+            // Shared JEA fallbacks may belong to a different identity than the scoped all-connections token.
+            nodePowershellEndpoints: scoped && scoped.manageAsToken ? {} : this.nodePowershellEndpoints,
+            signOnToken: this.signOnManager.signedHttpRequestToken,
+            scopedTokens: scoped || null
         });
     }
     /**
@@ -581,18 +710,19 @@ export class AuthorizationManager extends RpcServiceForwarder {
      * @param args The arguments of the method
      * @returns an observable for the result of the method call
      */
-    onForwardExecute(from, name, args) {
+    onForwardExecute(from, name, args, sourceName) {
         // command comes from child
         if (from === 1 /* RpcRelationshipType.Child */) {
             switch (name) {
                 case AuthorizationManager.rpcCommands.getNewToken: {
+                    const errorData = AuthorizationManager.withRequesterName(args ? args[1] : null, sourceName);
+                    // only a direct child can be scoped, because scoped tokens are delivered to the direct child frame by name
+                    const isDirectRequester = !!errorData && errorData.requesterName === sourceName;
+                    const requesterKey = isDirectRequester ? this.getRequesterAwaiterKey(errorData) : '';
                     // start getting the new token, but return immediately to avoid timeout
-                    const subscription = this.getNewToken(args ? args[0] : null, args ? args[1] : null).subscribe({
+                    const subscription = this.requestNewToken(args ? args[0] : null, errorData, requesterKey, sourceName).subscribe({
                         next: () => subscription.unsubscribe(),
-                        error: error => {
-                            subscription.unsubscribe();
-                            this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.setNodeTokenError, RpcForwarder.ensureSerializable(error));
-                        }
+                        error: () => subscription.unsubscribe()
                     });
                     return of(null);
                 }
@@ -633,7 +763,14 @@ export class AuthorizationManager extends RpcServiceForwarder {
         // command comes from parent
         if (from === 0 /* RpcRelationshipType.Parent */) {
             if (name === AuthorizationManager.rpcCommands.clearNodeTokens) {
-                this.nodeTokens = {};
+                // Clear shared node-specific credentials without removing requester-scoped state.
+                if (this.scopedTokenState) {
+                    this.sharedTokenState.nodeTokens = {};
+                    this.recomputeEffectiveTokenState();
+                }
+                else {
+                    this.nodeTokens = {};
+                }
                 this.nodePowershellEndpoints = {};
                 // if we also have children, forward the request on
                 const forward = this.forwardExecute(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.clearNodeTokens, args);
@@ -654,17 +791,66 @@ export class AuthorizationManager extends RpcServiceForwarder {
         // allow our parent to give us a new token.
         if (from === 0 /* RpcRelationshipType.Parent */) {
             if (name === AuthorizationManager.rpcCommands.manageAsToken) {
-                this.manageAsToken = value;
+                if (this.scopedTokenState) {
+                    this.sharedTokenState.manageAsToken = value;
+                    this.nodePowershellEndpoints = {};
+                    this.recomputeEffectiveTokenState();
+                }
+                else {
+                    this.manageAsToken = value;
+                }
                 // if we also have children, forward the notification on
                 const forward = this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.manageAsToken, value);
                 return forward || of(null);
             }
+            if (name === AuthorizationManager.rpcCommands.clearScopedTokens) {
+                this.clearScopedOverlay();
+                const forward = this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.clearScopedTokens, value);
+                return forward || of(null);
+            }
+            // resetAllTokens sends clearNodeTokens as a notification; applyToAllNodes sends it as an execute
+            if (name === AuthorizationManager.rpcCommands.clearNodeTokens) {
+                // Clear shared node-specific credentials without removing requester-scoped state.
+                if (this.scopedTokenState) {
+                    this.sharedTokenState.nodeTokens = {};
+                    this.recomputeEffectiveTokenState();
+                }
+                else {
+                    this.nodeTokens = {};
+                }
+                const forward = this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.clearNodeTokens, value);
+                return forward || of(null);
+            }
             if (name === AuthorizationManager.rpcCommands.setNodeToken) {
                 if (!value) {
                     const message = MsftSme.getStrings().MsftSmeShell.Core.Error.InvalidValue.message;
                     return throwError(() => message.format(AuthorizationManager.rpcCommands.setNodeToken));
                 }
-                this.completeTokenAwaiter(value);
+                const response = value;
+                if (response.pendingRequesters && response.pendingRequesters.indexOf(MsftSme.self().Environment.name) >= 0) {
+                    // this requester is still waiting for its own credentials, so only save the shared token
+                    if (this.scopedTokenState) {
+                        this.applyChildSharedTokenResponse(response);
+                    }
+                    else {
+                        if (!response.appliesTo) {
+                            this.manageAsToken = response.token;
+                        }
+                        else if (Array.isArray(response.appliesTo)) {
+                            response.appliesTo.forEach(nodeName => {
+                                this.nodeTokens[nodeName.toLocaleLowerCase()] = response.token;
+                            });
+                            this.updateCache();
+                        }
+                        else {
+                            this.nodeTokens[response.appliesTo.toLocaleLowerCase()] = response.token;
+                            this.updateCache();
+                        }
+                    }
+                }
+                else {
+                    this.completeTokenAwaiter(response);
+                }
                 const forward = this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.setNodeToken, value);
                 return forward || of(null);
             }
@@ -759,36 +945,180 @@ export class AuthorizationManager extends RpcServiceForwarder {
     /**
      * Completes the token awaiter
      */
-    completeTokenAwaiter(result, error) {
+    completeTokenAwaiter(result, error, requesterKey = '') {
+        if (!requesterKey) {
+            this.sharedTokenRequesters.clear();
+        }
         if (error) {
-            if (this.tokenAwaiter) {
-                const awaiter = this.tokenAwaiter;
-                this.tokenAwaiter = null;
+            const awaiter = requesterKey ? this.requesterTokenAwaiters.get(requesterKey) : this.tokenAwaiter;
+            if (awaiter) {
+                if (requesterKey) {
+                    this.requesterTokenAwaiters.delete(requesterKey);
+                }
+                else {
+                    this.tokenAwaiter = null;
+                }
                 awaiter.error(error);
             }
         }
         else {
-            if (!result.appliesTo) {
-                this.manageAsToken = result.token;
-            }
-            else if (Array.isArray(result.appliesTo)) {
-                result.appliesTo.forEach(nodeName => {
-                    this.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;
-                });
-                this.updateCache();
+            if (result.scope || this.scopedTokenState) {
+                if (result.scope) {
+                    if (!this.scopedTokenState) {
+                        this.sharedTokenState = {
+                            manageAsToken: this.token,
+                            nodeTokens: { ...(this.nodeTokens || {}) }
+                        };
+                        this.scopedTokenState = { nodeTokens: {} };
+                    }
+                    AuthorizationManager.addToScope(this.scopedTokenState, result);
+                    this.recomputeEffectiveTokenState();
+                }
+                else {
+                    this.applyChildSharedTokenResponse(result);
+                }
             }
             else {
-                this.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;
-                this.updateCache();
+                if (!result.appliesTo) {
+                    this.manageAsToken = result.token;
+                }
+                else if (Array.isArray(result.appliesTo)) {
+                    result.appliesTo.forEach(nodeName => {
+                        this.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;
+                    });
+                    this.updateCache();
+                }
+                else {
+                    this.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;
+                    this.updateCache();
+                }
             }
-            if (this.tokenAwaiter) {
-                const awaiter = this.tokenAwaiter;
-                this.tokenAwaiter = null;
+            const awaiter = requesterKey ? this.requesterTokenAwaiters.get(requesterKey) : this.tokenAwaiter;
+            if (awaiter) {
+                if (requesterKey) {
+                    this.requesterTokenAwaiters.delete(requesterKey);
+                }
+                else {
+                    this.tokenAwaiter = null;
+                }
                 awaiter.next(result);
                 awaiter.complete();
             }
         }
     }
+    /**
+     * Adds a token response to a set of scoped credentials.
+     */
+    static addToScope(scoped, result) {
+        if (!result.appliesTo) {
+            scoped.manageAsToken = result.token;
+            scoped.nodeTokens = {};
+            return;
+        }
+        const nodeNames = Array.isArray(result.appliesTo) ? result.appliesTo : [result.appliesTo];
+        nodeNames.forEach(nodeName => {
+            scoped.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;
+        });
+    }
+    /**
+     * Shell instance: saves a token that applies only to the requester named by result.scope.
+     * The tokens shared by every tool are left unchanged.
+     */
+    saveScopedToken(result) {
+        const scoped = this.scopedTokens[result.scope] || { nodeTokens: {} };
+        AuthorizationManager.addToScope(scoped, result);
+        this.scopedTokens[result.scope] = scoped;
+        this.updateCache();
+    }
+    /**
+     * Child instance: re-applies requester-scoped credentials over the shared ones.
+     */
+    recomputeEffectiveTokenState() {
+        if (!this.scopedTokenState) {
+            return;
+        }
+        const sharedState = this.sharedTokenState;
+        this.token = this.scopedTokenState.manageAsToken || sharedState.manageAsToken;
+        this.nodeTokens = this.scopedTokenState.manageAsToken ? { ...this.scopedTokenState.nodeTokens } : { ...sharedState.nodeTokens, ...this.scopedTokenState.nodeTokens };
+    }
+    /**
+     * Child instance: forgets requester-scoped credentials.
+     */
+    clearScopedOverlay() {
+        const sharedState = this.sharedTokenState;
+        this.scopedTokenState = null;
+        this.sharedTokenState = null;
+        if (!sharedState) {
+            return;
+        }
+        this.token = sharedState.manageAsToken;
+        this.nodeTokens = { ...sharedState.nodeTokens };
+    }
+    /**
+     * Child instance: saves a shared token update without allowing it to replace scoped effective credentials.
+     */
+    applyChildSharedTokenResponse(result) {
+        const sharedState = this.sharedTokenState;
+        if (!result.appliesTo) {
+            sharedState.manageAsToken = result.token;
+        }
+        else if (Array.isArray(result.appliesTo)) {
+            result.appliesTo.forEach(nodeName => {
+                sharedState.nodeTokens[nodeName.toLocaleLowerCase()] = result.token;
+            });
+        }
+        else {
+            sharedState.nodeTokens[result.appliesTo.toLocaleLowerCase()] = result.token;
+        }
+        this.recomputeEffectiveTokenState();
+    }
+    /**
+     * Returns the key of the token awaiter for a request: the requester RPC name when requester scoping is
+     * enabled on this shell instance, otherwise an empty string for the shared awaiter.
+     */
+    getRequesterAwaiterKey(errorData) {
+        if (!errorData || !errorData.requesterName) {
+            return '';
+        }
+        return this.isRequesterScopingEnabled() ? errorData.requesterName : '';
+    }
+    isRequesterScopingEnabled() {
+        const isEnabled = this.options && this.options.isRequesterScopingEnabled;
+        return MsftSme.isShell() && !!isEnabled && isEnabled();
+    }
+    /**
+     * Returns the scope for authorized credentials, or null when they apply to every tool.
+     */
+    getCredentialScope(credentials, requesterKey) {
+        return credentials && credentials.scopeToRequester && requesterKey ? requesterKey : null;
+    }
+    getPendingAwaiter(requesterKey) {
+        const awaiter = requesterKey ? this.requesterTokenAwaiters.get(requesterKey) : this.tokenAwaiter;
+        return awaiter && !awaiter.closed ? awaiter : null;
+    }
+    setPendingAwaiter(requesterKey, awaiter) {
+        if (requesterKey) {
+            this.requesterTokenAwaiters.set(requesterKey, awaiter);
+        }
+        else {
+            this.tokenAwaiter = awaiter;
+        }
+    }
+    /**
+     * Routes failures to the requesting frames. Legacy shells retain shared error broadcasts.
+     */
+    notifyTokenError(requesterKey, error, sharedRequesters) {
+        const value = RpcForwarder.ensureSerializable(error);
+        if (requesterKey) {
+            this.forwardNotifyToChildren(requesterKey, AuthorizationManager.rpcCommands.setNodeTokenError, value);
+        }
+        else if (this.isRequesterScopingEnabled()) {
+            sharedRequesters.forEach(sourceName => this.forwardNotifyToChildren(sourceName, AuthorizationManager.rpcCommands.setNodeTokenError, value));
+        }
+        else {
+            this.forwardNotify(1 /* RpcRelationshipType.Child */, AuthorizationManager.rpcCommands.setNodeTokenError, value);
+        }
+    }
     /**
      * Completes the sign on token awaiter
      */
@@ -836,10 +1166,12 @@ export class AuthorizationManager extends RpcServiceForwarder {
         }
         // update cached data
         const cacheData = {
+            gatewayOrigin: this.gatewayOrigin,
             jwk: this.jwk,
             manageAsToken: this.manageAsToken,
             nodePowershellEndpoints: this.nodePowershellEndpoints,
-            nodeTokens: this.nodeTokens
+            nodeTokens: this.nodeTokens,
+            scopedTokens: this.scopedTokens
         };
         MsftSme.SessionStorageHandler.setItem(AuthorizationManager.cacheKey, JSON.stringify(cacheData));
     }