@mindline/sync 1.0.41 → 1.0.43

package/.vs/VSWorkspaceState.json

@@ -2,5 +2,6 @@
   "ExpandedNodes": [
     ""
   ],
+  "SelectedNode": "\\index.ts",
   "PreviewInSolutionExplorer": false
 }

package/index.d.ts

@@ -104,7 +104,7 @@ declare module "@mindline/sync" {
     export type TaskType = "initialization" | 
                             "authenticate user" | 
                             "reload React" | 
-                            "PUT access token" | 
+                            "PUT tenant" | 
                             "GET tenant details" | 
                             "POST config init" |
                             "GET workspaces" |
@@ -221,7 +221,7 @@ declare module "@mindline/sync" {
     export function groupsGet(instance: IPublicClientApplication, user: User | undefined, groupSearchString: string): Promise<{groups: Group[], error: string}>;
     export function signIn(user: User, tasks: TaskArray): void;
     export function signInIncrementally(user: User, scope: string): void;
-    export function signOut(user: User): void;
+    export function signOut(user: User): boolean;
     export function tenantRelationshipsGetByDomain(loggedInuser: User, tenant: Tenant, instance: IPublicClientApplication, debug: boolean): boolean;
     export function tenantRelationshipsGetById(user: User, ii: InitInfo, instance: IPublicClientApplication, tasks: TaskArray, debug: boolean): boolean;
     export function tenantUnauthenticatedLookup(tenant: Tenant, debug: boolean): Promise<boolean>;

package/index.ts

@@ -1074,11 +1074,11 @@ export async function groupsGet(instance: IPublicClientApplication, user: User |
     }
 }
 export function signIn(user: User, tasks: TaskArray): void {
+    // SignIn by an admin consents the full set of permissions, unlike Challenge which requires a consented app
     let tenantURL: string = window.location.href;
-    tenantURL += "MicrosoftIdentity/Account/Challenge";
+    tenantURL += "MicrosoftIdentity/Account/SignIn";
     let url: URL = new URL(tenantURL);
     url.searchParams.append("redirectUri", window.location.origin);
-    url.searchParams.append("scope", "openid offline_access Directory.AccessAsUser.All CrossTenantInformation.ReadBasic.All");
     url.searchParams.append("domainHint", "organizations");
     if (user.oid !== "1") {
         url.searchParams.append("loginHint", user.mail);
@@ -1099,18 +1099,31 @@ export function signInIncrementally(user: User, scope: string): void {
     url.searchParams.append("loginHint", user.mail);
     window.location.assign(url.href);
 }
-export function signOut(user: User): void {
+export async function signOut(user: User): Promise<boolean>{
     if (user.oid == "1") return;
-    // these lines provide more callbacks during logout
-    //let tenantURL: string = window.location.href;
-    //tenantURL += "MicrosoftIdentity/Account/SignOut";
-    // this line takes advantage of our saved loginHint to logout right away, but requires additional  cleanup logic
-    // https://aaddevsup.azurewebsites.net/2022/03/how-to-logout-of-an-oauth2-application-without-getting-prompted-to-select-a-user/
-    let tenantURL: string = "https://login.microsoftonline.com/common/oauth2/logout";
-    let url: URL = new URL(tenantURL);
-    url.searchParams.append("post_logout_redirect_uri", window.location.origin);
-    url.searchParams.append("logout_hint", user.loginHint);
-    window.location.assign(url.href);
+    // set logout_hint in the .NET session for streamlined logout
+    let userEndpoint: string = window.location.href;
+    userEndpoint += "user";
+    let url = new URL(userEndpoint);
+    url.searchParams.append("oid", user.oid);
+    url.searchParams.append("tid", user.tid);
+    url.searchParams.append("loginHint", user.loginHint);
+    url.searchParams.append("verb", "LOGOUT");
+    let options = { method: "PATCH" };
+    let userLogoutResponse: Response = await fetch(url.href, options);
+    if (userLogoutResponse.status == 200 && userLogoutResponse.statusText == "OK") {
+        console.log(`Successfully set admin ${user.mail} logout_hint`);
+    }
+    else {
+        console.log(`Failed to set admin ${user.mail} logout_hint`);
+        return;
+    }
+    // start the logout process triggering callbacks during logout
+    //      OnRedirectToIdentityProviderForSignOut - this is where we set the logout_hint for user we are trying to logout
+    //      OnSignedOutCallbackRedirect - called when the call sucessfully completes
+    let signoutURL: string = window.location.href;
+    signoutURL += "MicrosoftIdentity/Account/SignOut";
+    window.location.assign(signoutURL);
 }
 //tenantRelationshipsGetByDomain - query AAD for associated company name and id
 export async function tenantRelationshipsGetByDomain(loggedInUser: User, tenant: Tenant, instance: IPublicClientApplication, debug: boolean): Promise<boolean> {
@@ -1174,8 +1187,8 @@ export async function tenantRelationshipsGetByDomain(loggedInUser: User, tenant:
 //tenantRelationshipsGetById - query AAD for associated company name and domain
 export async function tenantRelationshipsGetById(user: User, ii: InitInfo, instance: IPublicClientApplication, tasks: TaskArray, debug: boolean): Promise<boolean> {
     if (debug) debugger;
-    // do we already have a valid company name? if so, nothing to add, no need for UX to re-render
-    if (user.companyName != "") return false;
+    // since we should mainly be called when a user has newly logged in, we can afford the performance hit of looking up the tenant name and domain again
+    // if (user.companyName != "") return false;
     // if needed, retrieve and cache access token
     if (user.accessToken === "") {
         try {
@@ -1263,7 +1276,7 @@ export async function tenantUnauthenticatedLookup(tenant: Tenant, debug: boolean
                     var authMatches = tenantAuthEndpoint.match(regexes[j]);
                     tenant.tid = authMatches[2];
                     tenant.authority = authMatches[1];  // USGov tenants are registered in WW with USGov authority values!
-                    console.log("Successful GET from openid well-known endpoint");
+                    console.log(`Successful GET from openid well-known endpoint: tid: ${tenant.tid} authority: ${tenant.authority}`);
                     return true;  // success, need UX to re-render
                 }
                 else {
@@ -1363,12 +1376,12 @@ export async function initGet(instance: IPublicClientApplication, authorizedUser
     tenant.domain = user.tid;
     let bResult: boolean = await tenantUnauthenticatedLookup(tenant, debug);
     if (bResult) {
-        // success, we at least got authority as a new bit of information at this point
+        // success, we now know instance of this tenant
         user.authority = tenant.authority;
         // do we have a logged in user from the same authority as this newly proposed tenant?
         let loggedInUser: User | undefined = ii.us.find((u: User) => (u.session === "Sign Out" && u.authority === user.authority));
         if (loggedInUser != null) {
-            // get tenant name and domain from AAD
+            // get tenant name and domain from AAD to pass to Configuration API
             result.result = await tenantRelationshipsGetById(user, ii, instance, tasks, debug);
             // if this is the first time, we have just gotten tenant info, then we must POST user and not-yet-onboarded tenant to back end
             if (result.result) {
@@ -1387,7 +1400,7 @@ export async function initGet(instance: IPublicClientApplication, authorizedUser
             return result;
         }
         else {
-            result.error = `${user.mail} insufficient privileges to lookup under authority: ${user.authority}.`;
+            result.error = `${user.mail} with insufficient privileges to lookup under authority: ${user.authority}.`;
             result.result = false;
             return result;
         }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mindline/sync",
   "type": "module",
-  "version": "1.0.41",
+  "version": "1.0.43",
   "types": "index.d.ts",
   "exports": "./index.ts",
   "description": "sync is a node.js package encapsulating javscript classes required for configuring Mindline sync service.",

package/tasks.ts

@@ -26,7 +26,7 @@ const data: any[] = [
             },
             {
                 id: 4,
-                task: "PUT access token",
+                task: "PUT tenant",
                 start: "1970-01-01T00:00:00",
                 end: "1970-01-01T00:00:00",
                 expected: "0:01",