@mindline/sync 1.0.41 → 1.0.42

package/.vs/VSWorkspaceState.json

@@ -2,5 +2,6 @@
   "ExpandedNodes": [
     ""
   ],
+  "SelectedNode": "\\index.ts",
   "PreviewInSolutionExplorer": false
 }

package/index.d.ts

@@ -26,6 +26,7 @@ declare module "@mindline/sync" {
         loginHint: string;
         scopes: string[];
         authTS: Date;
+        claimsprincipal: string; // claims principal cached at login to allow clearing cache at logout
         constructor();
     }
     // tenant (Azure AD tenant, AD domain, Google workspace)
@@ -104,7 +105,7 @@ declare module "@mindline/sync" {
     export type TaskType = "initialization" | 
                             "authenticate user" | 
                             "reload React" | 
-                            "PUT access token" | 
+                            "PUT tenant" | 
                             "GET tenant details" | 
                             "POST config init" |
                             "GET workspaces" |
@@ -221,7 +222,7 @@ declare module "@mindline/sync" {
     export function groupsGet(instance: IPublicClientApplication, user: User | undefined, groupSearchString: string): Promise<{groups: Group[], error: string}>;
     export function signIn(user: User, tasks: TaskArray): void;
     export function signInIncrementally(user: User, scope: string): void;
-    export function signOut(user: User): void;
+    export function signOut(user: User): boolean;
     export function tenantRelationshipsGetByDomain(loggedInuser: User, tenant: Tenant, instance: IPublicClientApplication, debug: boolean): boolean;
     export function tenantRelationshipsGetById(user: User, ii: InitInfo, instance: IPublicClientApplication, tasks: TaskArray, debug: boolean): boolean;
     export function tenantUnauthenticatedLookup(tenant: Tenant, debug: boolean): Promise<boolean>;

package/index.ts

@@ -1074,11 +1074,11 @@ export async function groupsGet(instance: IPublicClientApplication, user: User |
     }
 }
 export function signIn(user: User, tasks: TaskArray): void {
+    // SignIn by an admin consents the full set of permissions, unlike Challenge which requires a consented app
     let tenantURL: string = window.location.href;
-    tenantURL += "MicrosoftIdentity/Account/Challenge";
+    tenantURL += "MicrosoftIdentity/Account/SignIn";
     let url: URL = new URL(tenantURL);
     url.searchParams.append("redirectUri", window.location.origin);
-    url.searchParams.append("scope", "openid offline_access Directory.AccessAsUser.All CrossTenantInformation.ReadBasic.All");
     url.searchParams.append("domainHint", "organizations");
     if (user.oid !== "1") {
         url.searchParams.append("loginHint", user.mail);
@@ -1099,18 +1099,31 @@ export function signInIncrementally(user: User, scope: string): void {
     url.searchParams.append("loginHint", user.mail);
     window.location.assign(url.href);
 }
-export function signOut(user: User): void {
+export async function signOut(user: User): Promise<boolean>{
     if (user.oid == "1") return;
-    // these lines provide more callbacks during logout
-    //let tenantURL: string = window.location.href;
-    //tenantURL += "MicrosoftIdentity/Account/SignOut";
-    // this line takes advantage of our saved loginHint to logout right away, but requires additional  cleanup logic
-    // https://aaddevsup.azurewebsites.net/2022/03/how-to-logout-of-an-oauth2-application-without-getting-prompted-to-select-a-user/
-    let tenantURL: string = "https://login.microsoftonline.com/common/oauth2/logout";
-    let url: URL = new URL(tenantURL);
-    url.searchParams.append("post_logout_redirect_uri", window.location.origin);
-    url.searchParams.append("logout_hint", user.loginHint);
-    window.location.assign(url.href);
+    // set logout_hint in the .NET session for streamlined logout
+    let userEndpoint: string = window.location.href;
+    userEndpoint += "user";
+    let url = new URL(userEndpoint);
+    url.searchParams.append("oid", user.oid);
+    url.searchParams.append("tid", user.tid);
+    url.searchParams.append("loginHint", user.loginHint);
+    url.searchParams.append("verb", "LOGOUT");
+    let options = { method: "PATCH" };
+    let userLogoutResponse: Response = await fetch(url.href, options);
+    if (userLogoutResponse.status == 200 && userLogoutResponse.statusText == "OK") {
+        console.log(`Successfully set admin ${user.mail} logout_hint`);
+    }
+    else {
+        console.log(`Failed to set admin ${user.mail} logout_hint`);
+        return;
+    }
+    // start the logout process triggering callbacks during logout
+    //      OnRedirectToIdentityProviderForSignOut - this is where we set the logout_hint for user we are trying to logout
+    //      OnSignedOutCallbackRedirect - called when the call sucessfully completes
+    let signoutURL: string = window.location.href;
+    signoutURL += "MicrosoftIdentity/Account/SignOut";
+    window.location.assign(signoutURL);
 }
 //tenantRelationshipsGetByDomain - query AAD for associated company name and id
 export async function tenantRelationshipsGetByDomain(loggedInUser: User, tenant: Tenant, instance: IPublicClientApplication, debug: boolean): Promise<boolean> {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mindline/sync",
   "type": "module",
-  "version": "1.0.41",
+  "version": "1.0.42",
   "types": "index.d.ts",
   "exports": "./index.ts",
   "description": "sync is a node.js package encapsulating javscript classes required for configuring Mindline sync service.",

package/tasks.ts

@@ -26,7 +26,7 @@ const data: any[] = [
             },
             {
                 id: 4,
-                task: "PUT access token",
+                task: "PUT tenant",
                 start: "1970-01-01T00:00:00",
                 end: "1970-01-01T00:00:00",
                 expected: "0:01",