@mindline/sync 1.0.110 → 1.0.112

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindline/sync",
-  "version": "1.0.110",
+  "version": "1.0.112",
   "description": "sync is a node.js package encapsulating JavaScript classes required for configuring Mindline sync service.",
   "main": "dist/sync.es.js",
   "types": "dist/index.d.ts",

package/src/api-client.ts

@@ -0,0 +1,382 @@
+/**
+ * API Client for backend proxy endpoints
+ * This file contains functions that call backend controllers instead of directly calling
+ * Microsoft Graph API and Azure Management API from the frontend.
+ * This prevents token exposure in the browser.
+ */
+
+// ======================= Backend Response Types =======================
+
+interface ApiResponse<T> {
+    data?: T;
+    error: string;
+    success: boolean;
+}
+
+// Backend DTOs (match the C# DTOs)
+interface GroupDto {
+    id: string;
+    displayName: string;
+    description?: string;
+    mail?: string;
+}
+
+interface GroupsResponseDto {
+    groups: GroupDto[];
+}
+
+interface OAuth2PermissionGrantDto {
+    grants: string | null;
+    id: string | null;
+}
+
+interface ServicePrincipalDto {
+    servicePrincipalId: string;
+    displayName: string;
+}
+
+interface UserDto {
+    id: string;
+    displayName: string;
+    mail?: string;
+    userPrincipalName?: string;
+}
+
+interface UsersResponseDto {
+    users: UserDto[];
+}
+
+interface CanListRootAssignmentsResponseDto {
+    canList: boolean;
+}
+
+interface ElevateAccessResponseDto {
+    success: boolean;
+}
+
+interface ResourceDto {
+    id: string;
+    name: string;
+    type: string;
+    location: string;
+    tags?: { [key: string]: string };
+}
+
+interface ResourcesResponseDto {
+    resources: ResourceDto[];
+}
+
+// ======================= Frontend Types (for return values) =======================
+// These match the types expected by index.ts callers
+
+export interface Group {
+    id: string;
+    displayName: string;
+    description: string;
+}
+
+export interface Resource {
+    id: string;
+    name: string;
+    type: string;
+    location: string;
+    tags?: { [key: string]: string };
+}
+
+// ======================= Microsoft Graph API Proxy Functions =======================
+
+/**
+ * Search for groups by display name
+ * Calls backend: GET /api/graphapi/groups
+ */
+export async function groupsGet(groupSearchString: string): Promise<{ groups: Group[], error: string }> {
+    try {
+        if (!groupSearchString) {
+            return { groups: [], error: '400: Search string is required' };
+        }
+
+        const url = `/api/graphapi/groups?search=${encodeURIComponent(groupSearchString)}`;
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+
+        if (!response.ok) {
+            return { groups: [], error: `${response.status}: Failed to retrieve groups` };
+        }
+
+        const apiResponse: ApiResponse<GroupsResponseDto> = await response.json();
+
+        if (!apiResponse.success || !apiResponse.data) {
+            return { groups: [], error: apiResponse.error || 'Unknown error' };
+        }
+
+        // Convert backend types to frontend types
+        const groups: Group[] = apiResponse.data.groups.map(g => ({
+            id: g.id,
+            displayName: g.displayName,
+            description: g.description || ''
+        }));
+
+        return { groups, error: '' };
+    } catch (error: any) {
+        console.error('Error in groupsGet:', error);
+        return { groups: [], error: `Exception: ${error.message}` };
+    }
+}
+
+/**
+ * Get OAuth2 permission grants for a service principal and principal
+ * Calls backend: GET /api/graphapi/oauth2-permission-grants
+ */
+export async function oauth2PermissionGrantsGet(
+    spid: string,
+    oid: string
+): Promise<{ grants: string | null, id: string | null, error: string }> {
+    try {
+        if (!spid || !oid) {
+            return { grants: null, id: null, error: '400: Service Principal ID and Principal ID are required' };
+        }
+
+        const url = `/api/graphapi/oauth2-permission-grants?spid=${encodeURIComponent(spid)}&oid=${encodeURIComponent(oid)}`;
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+
+        if (!response.ok) {
+            return { grants: null, id: null, error: `${response.status}: Failed to retrieve permission grants` };
+        }
+
+        const apiResponse: ApiResponse<OAuth2PermissionGrantDto> = await response.json();
+
+        if (!apiResponse.success || !apiResponse.data) {
+            return { grants: null, id: null, error: apiResponse.error || 'Unknown error' };
+        }
+
+        return {
+            grants: apiResponse.data.grants,
+            id: apiResponse.data.id,
+            error: ''
+        };
+    } catch (error: any) {
+        console.error('Error in oauth2PermissionGrantsGet:', error);
+        return { grants: null, id: null, error: `Exception: ${error.message}` };
+    }
+}
+
+/**
+ * Update OAuth2 permission grants
+ * Calls backend: PATCH /api/graphapi/oauth2-permission-grants/{id}
+ */
+export async function oauth2PermissionGrantsSet(id: string, scopes: string): Promise<boolean> {
+    try {
+        if (!id || !scopes) {
+            console.error('oauth2PermissionGrantsSet: ID and scopes are required');
+            return false;
+        }
+
+        const url = `/api/graphapi/oauth2-permission-grants/${encodeURIComponent(id)}`;
+        const response = await fetch(url, {
+            method: 'PATCH',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ scopes }),
+        });
+
+        if (!response.ok) {
+            console.error(`oauth2PermissionGrantsSet: PATCH failed with status ${response.status}`);
+            return false;
+        }
+
+        const apiResponse: ApiResponse<boolean> = await response.json();
+
+        if (!apiResponse.success || !apiResponse.data) {
+            console.error(`oauth2PermissionGrantsSet: ${apiResponse.error}`);
+            return false;
+        }
+
+        return apiResponse.data;
+    } catch (error: any) {
+        console.error('Error in oauth2PermissionGrantsSet:', error);
+        return false;
+    }
+}
+
+/**
+ * Get service principal by application ID
+ * Calls backend: GET /api/graphapi/service-principals
+ */
+export async function servicePrincipalGet(appid: string): Promise<{ spid: string, error: string }> {
+    try {
+        if (!appid) {
+            return { spid: '', error: '400: Application ID is required' };
+        }
+
+        const url = `/api/graphapi/service-principals?appId=${encodeURIComponent(appid)}`;
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+
+        if (!response.ok) {
+            return { spid: '', error: `${response.status}: Failed to retrieve service principal` };
+        }
+
+        const apiResponse: ApiResponse<ServicePrincipalDto> = await response.json();
+
+        if (!apiResponse.success || !apiResponse.data) {
+            return { spid: '', error: apiResponse.error || 'Unknown error' };
+        }
+
+        return { spid: apiResponse.data.servicePrincipalId, error: '' };
+    } catch (error: any) {
+        console.error('Error in servicePrincipalGet:', error);
+        return { spid: '', error: `Exception: ${error.message}` };
+    }
+}
+
+/**
+ * Search for users. When no search string is provided, lists all users (matching original behavior).
+ * Calls backend: GET /api/graphapi/users
+ */
+export async function usersGet(userSearchString?: string): Promise<{ users: string[], error: string }> {
+    try {
+        const url = userSearchString
+            ? `/api/graphapi/users?search=${encodeURIComponent(userSearchString)}`
+            : `/api/graphapi/users`;
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+
+        if (!response.ok) {
+            return { users: [], error: `${response.status}: Failed to retrieve users` };
+        }
+
+        const apiResponse: ApiResponse<UsersResponseDto> = await response.json();
+
+        if (!apiResponse.success || !apiResponse.data) {
+            return { users: [], error: apiResponse.error || 'Unknown error' };
+        }
+
+        // Convert to array of mail addresses (matching original behavior that returned user.mail)
+        const users = apiResponse.data.users.map(u => u.mail || u.userPrincipalName || u.displayName);
+
+        return { users, error: '' };
+    } catch (error: any) {
+        console.error('Error in usersGet:', error);
+        return { users: [], error: `Exception: ${error.message}` };
+    }
+}
+
+// ======================= Azure Management API Proxy Functions =======================
+
+/**
+ * Check if the current user can list root assignments
+ * Calls backend: GET /api/azuremanagement/can-list-root-assignments
+ */
+export async function canListRootAssignments(): Promise<boolean> {
+    try {
+        const url = '/api/azuremanagement/can-list-root-assignments';
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+
+        if (!response.ok) {
+            console.error(`canListRootAssignments: Request failed with status ${response.status}`);
+            return false;
+        }
+
+        const apiResponse: ApiResponse<CanListRootAssignmentsResponseDto> = await response.json();
+
+        if (!apiResponse.success || !apiResponse.data) {
+            console.error(`canListRootAssignments: ${apiResponse.error}`);
+            return false;
+        }
+
+        return apiResponse.data.canList;
+    } catch (error: any) {
+        console.error('Error in canListRootAssignments:', error);
+        return false;
+    }
+}
+
+/**
+ * Elevate Global Admin to User Access Administrator role
+ * WARNING: This is a highly sensitive operation
+ * Calls backend: POST /api/azuremanagement/elevate-access
+ */
+export async function elevateGlobalAdminToUserAccessAdmin(): Promise<boolean> {
+    try {
+        const url = '/api/azuremanagement/elevate-access';
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+
+        if (!response.ok) {
+            console.error(`elevateGlobalAdminToUserAccessAdmin: Request failed with status ${response.status}`);
+            return false;
+        }
+
+        const apiResponse: ApiResponse<ElevateAccessResponseDto> = await response.json();
+
+        if (!apiResponse.success || !apiResponse.data) {
+            console.error(`elevateGlobalAdminToUserAccessAdmin: ${apiResponse.error}`);
+            return false;
+        }
+
+        return apiResponse.data.success;
+    } catch (error: any) {
+        console.error('Error in elevateGlobalAdminToUserAccessAdmin:', error);
+        return false;
+    }
+}
+
+/**
+ * Read Azure resources accessible to the current user
+ * Calls backend: GET /api/azuremanagement/resources
+ */
+export async function readResources(): Promise<Resource[]> {
+    try {
+        const url = '/api/azuremanagement/resources';
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+
+        if (!response.ok) {
+            console.error(`readResources: Request failed with status ${response.status}`);
+            return [];
+        }
+
+        const apiResponse: ApiResponse<ResourcesResponseDto> = await response.json();
+
+        if (!apiResponse.success || !apiResponse.data) {
+            console.error(`readResources: ${apiResponse.error}`);
+            return [];
+        }
+
+        return apiResponse.data.resources;
+    } catch (error: any) {
+        console.error('Error in readResources:', error);
+        return [];
+    }
+}