@mindline/sync 1.0.63 → 1.0.65

package/index.ts

@@ -28,51 +28,52 @@ export class APIResult {
     array: Array<Object> | null;
     constructor() { this.result = true; this.status = 200; this.error = ""; this.version = version; this.array = null; }
 }
-export class graphConfig {
+export class mindlineConfig {
     static environmentTag: string = "dev";
     // config API endpoints
     static adminEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/admin`
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/admin`
     };
     static adminIncompleteEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/incomplete-admin`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/incomplete-admin`;
     };
     static adminsEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/admins`;
-    }; 
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/admins`;
+    };
     static configEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configuration`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configuration`;
     };
     static configsEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configurations`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configurations`;
     };
     static initEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configuration/init`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configuration/init`;
     };
     static readerStartSyncEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/startSync`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/startSync`;
     };
     static tenantEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/tenant`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/tenant`;
     };
     static tenantsEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/tenants`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/tenants`;
     };
     static workspaceEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/workspaces`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/workspaces`;
     };
     // SignalR endpoint
     static signalREndpoint(): string {
-        return `https://${graphConfig.environmentTag}-signalrdispatcher-westus.azurewebsites.net/statsHub`;
+        return `https://${mindlineConfig.environmentTag}-signalrdispatcher-westus.azurewebsites.net/statsHub`;
     };
-    // graph API endpoints
-    static graphGroupsEndpoint: string = "https://graph.microsoft.com/v1.0/groups";
-    static graphMailEndpoint: string = "https://graph.microsoft.com/v1.0/me/messages";
-    static graphMeEndpoint: string = "https://graph.microsoft.com/v1.0/me";
-    static graphOauth2PermissionGrants: string = "https://graph.microsoft.com/v1.0/oauth2PermissionGrants";
-    static graphServicePrincipalsEndpoint: string = "https://graph.microsoft.com/v1.0/servicePrincipals";
-    static graphUsersEndpoint: string = "https://graph.microsoft.com/v1.0/users";
-    // sovereign cloud tenant info endpoints
+}
+export class graphConfig {
+    // graph API predicates
+    static graphGroupsPredicate: string = "v1.0/groups";
+    static graphMailPredicate: string = "v1.0/me/messages";
+    static graphMePredicate: string = "v1.0/me";
+    static graphOauth2PermissionGrantsPredicate: string = "v1.0/oauth2PermissionGrants";
+    static graphServicePrincipalsPredicate: string = "v1.0/servicePrincipals";
+    static graphUsersPredicate: string = "v1.0/users";
     static graphTenantByDomainPredicate: string = "beta/tenantRelationships/findTenantInformationByDomainName";
     static graphTenantByIdPredicate: string = "beta/tenantRelationships/findTenantInformationByTenantId";
     // authority values are based on the well-known OIDC auth endpoints
@@ -172,6 +173,14 @@ export class Tenant {
         this.graphSP = "";
     }
 }
+function getAppId(authority: string): string {
+    switch (authority) {
+        case graphConfig.authorityWW: return "63100afe-506e-4bb2-8ff7-d8d5ab373129";
+        case graphConfig.authorityUS: return "762d313c-dcfd-4582-8cc5-53cc9844f62e";
+        case graphConfig.authorityCN: return "814e0ebd-ada6-42b4-b8ae-e26f3861a0aa";
+        default: debugger; return "";
+    }
+}
 function getGraphEndpoint(authority: string): string {
     switch (authority) {
         case graphConfig.authorityWW: return "https://graph.microsoft.com/";
@@ -180,6 +189,14 @@ function getGraphEndpoint(authority: string): string {
         default: debugger; return "";
     }
 }
+function getLoginEndpoint(authority: string): string {
+    switch (authority) {
+        case graphConfig.authorityWW: return "https://login.microsoft.com/";
+        case graphConfig.authorityUS: return "https://login.microsoft.us/";
+        case graphConfig.authorityCN: return "https://login.partner.microsoftonline.cn/";
+        default: debugger; return "";
+    }
+}
 export enum TenantConfigType {
     source = 1,
     target = 2,
@@ -1112,7 +1129,7 @@ export class BatchArray {
         }
         // start SignalR connection based on each batchId
         batchIdArray.map((batchPair: Object) => {
-            const endpoint: string = graphConfig.signalREndpoint();
+            const endpoint: string = mindlineConfig.signalREndpoint();
             let endpointUrl: URL = new URL(endpoint);
             endpointUrl.searchParams.append("statsId", batchPair.BatchId);
             console.log(`Creating SignalR Hub for TID: ${batchPair.SourceId} ${endpointUrl.href}`);
@@ -1195,9 +1212,7 @@ export class TenantNode {
         }
     }
 }
-//
-// Azure AD Graph API
-//
+// ======================= Azure AD Graph API ===============================
 export async function groupsGet(instance: IPublicClientApplication, user: User | undefined, groupSearchString: string): Promise<{ groups: Group[], error: string }> {
     // need a logged in user to get graph users
     if (user == null || user.spacode == "") {
@@ -1208,7 +1223,8 @@ export async function groupsGet(instance: IPublicClientApplication, user: User |
     let options = { method: "GET", headers: headers };
     // make /groups endpoint call
     try {
-        let groupsEndpoint = `${graphConfig.graphGroupsEndpoint}/?$filter=startsWith(displayName, '${groupSearchString}')`;
+        let groupsEndpoint: string = getGraphEndpoint(user.authority) + graphConfig.graphGroupsPredicate;
+        groupsEndpoint += `/?$filter=startsWith(displayName, '${groupSearchString}')`;
         let response = await fetch(groupsEndpoint, options);
         let data = await response.json();
         if (typeof data.error !== "undefined") {
@@ -1221,10 +1237,10 @@ export async function groupsGet(instance: IPublicClientApplication, user: User |
         return { groups: [], error: `Exception: ${error}` };
     }
 }
-export async function oauth2PermissionGrantsGet(options: RequestInit, spid: string, oid: string): Promise<{ grants: string, id: string, error: string }> {
+export async function oauth2PermissionGrantsGet(options: RequestInit, user: User, spid: string, oid: string): Promise<{ grants: string, id: string, error: string }> {
     try {
         // make /oauth2PermissionGrants endpoint call
-        let spurl: string = graphConfig.graphOauth2PermissionGrants;
+        let spurl: string = getGraphEndpoint(user.authority) + graphConfig.graphOauth2PermissionGrantsPredicate;
         let url: URL = new URL(spurl);
         url.searchParams.append("$filter", `resourceId eq '${spid}' and consentType eq 'Principal' and principalId eq '${oid}'`);
         let response = await fetch(url.href, options);
@@ -1251,7 +1267,8 @@ export async function oauth2PermissionGrantsSet(instance: IPublicClientApplicati
     }
     // make /oauth2PermissionGrants endpoint call
     try {
-        let grantsurl: string = graphConfig.graphOauth2PermissionGrants + `/${id}`;
+        let grantsurl: string = getGraphEndpoint(loggedInUser.authority);
+        grantsurl += graphConfig.graphOauth2PermissionGrantsPredicate + `/${id}`;
         let scopesBody: string = `{ "scope": "${scopes}" }`;
         const headers = await defineHeaders(instance, loggedInUser);
         let options: RequestInit = { method: "PATCH", headers: headers, body: scopesBody };
@@ -1288,19 +1305,21 @@ export function requestAdminConsent(user: User, scope: string): void {
     // https://learn.microsoft.com/EN-US/azure/active-directory/develop/scopes-oidc#client-credentials-grant-flow-and-default
     // https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow#request-the-permissions-from-a-directory-admin
     //
-    let adminConsentURL: string = "https://login.microsoftonline.com/";
+    let adminConsentURL: string = getLoginEndpoint(user.authority);
     adminConsentURL += user.tid;
     adminConsentURL += "/adminconsent";
     let url: URL = new URL(adminConsentURL);
-    url.searchParams.append("client_id", "63100afe-506e-4bb2-8ff7-d8d5ab373129");
+    let clientId: string = getAppId(user.authority);
+    url.searchParams.append("client_id", clientId);
     url.searchParams.append("redirect_uri", window.location.origin);
     url.searchParams.append("domain_hint", user.companyDomain);
     window.location.assign(url.href);
 }
-export async function servicePrincipalGet(options: RequestInit, appid: string): Promise<{ spid: string, error: string }> {
+export async function servicePrincipalGet(options: RequestInit, user: User, appid: string): Promise<{ spid: string, error: string }> {
     try {
         // make /servicePrincipals endpoint call to get the Service Principal ID
-        let spurl: string = graphConfig.graphServicePrincipalsEndpoint;
+        let spurl: string = getGraphEndpoint(user.authority);
+        spurl += graphConfig.graphServicePrincipalsPredicate;
         spurl += `(appId='${appid}')`;
         let url: URL = new URL(spurl);
         url.searchParams.append("$select", "id,appId,displayName");
@@ -1335,52 +1354,52 @@ export async function signIn(user: User, tasks: TaskArray): Promise<boolean> {
             return false;
         }
     }
+    // SignIn by an admin consents the app, Challenge adds incremental permissions dynamically, but requires a consented app - TEST THIS
+    let signinURL: string = window.location.href;
     switch (user.authority) {
         case graphConfig.authorityWW:
-            // SignIn by an admin consents the app, Challenge adds incremental permissions dynamically, but requires a consented app
-            let tenantURL: string = window.location.href;
-            tenantURL += "MicrosoftIdentity/Account/SignIn";
-            let url: URL = new URL(tenantURL);
-            url.searchParams.append("redirectUri", window.location.origin);
-            url.searchParams.append("domainHint", "organizations");
-            if (user.oid !== "1") { // "1" means no mail has been set by admin initially in the app, oid and mail should be same if user has set and not yet signed in
-                url.searchParams.append("loginHint", user.mail);
-            }
-            tasks.setTaskStart("initialization", new Date());
-            tasks.setTaskStart("authenticate user", new Date());
-            window.location.assign(url.href);
-            return true;
+            signinURL += "MicrosoftIdentity/Account/SignIn";
+            break;
         case graphConfig.authorityUS:
-            // retrieve controller protected by USGov authorization
-            let usURL: string = window.location.href;
-            usURL += "USGov";
-            let urlUS: URL = new URL(usURL);
-            urlUS.searchParams.append("redirectUri", window.location.origin);
-            urlUS.searchParams.append("domainHint", user.companyDomain);
-            if (user.oid !== "1") {
-                urlUS.searchParams.append("loginHint", user.mail);
-            }
-            tasks.setTaskStart("initialization", new Date());
-            tasks.setTaskStart("authenticate user", new Date());
-            window.location.assign(urlUS.href);
-            return true;
+            signinURL += "USGov/SignIn";
+            break;
         case graphConfig.authorityCN:
-            // unsupported
+            signinURL += "China/SignIn";
             break;
         default:
             // unknown authority
-            debugger;
+            return false;
     }
-    return false;
+    let url: URL = new URL(signinURL);
+    url.searchParams.append("redirectUri", window.location.origin);
+    url.searchParams.append("domainHint", "organizations");
+    if (user.oid !== "1") { // "1" means no mail has been set by admin initially in the app, oid and mail should be same if user has set and not yet signed in
+        url.searchParams.append("loginHint", user.mail);
+    }
+    tasks.setTaskStart("initialization", new Date());
+    tasks.setTaskStart("authenticate user", new Date());
+    window.location.assign(url.href);
+    return true;
 }
 export function signInIncrementally(user: User, scope: string): void {
     if (user.oid == "1") return;
-    //
-    // for delegated permissions, we can use the Microsoft Identity Web Account Controller Challenge method
-    //
-    let tenantURL: string = window.location.href;
-    tenantURL += "MicrosoftIdentity/Account/Challenge";
-    let url: URL = new URL(tenantURL);
+    // for dynamic delegated permissions, we can use the Microsoft Identity Web Account Controller Challenge method
+    let challengeURL: string = window.location.href;
+    switch (user.authority) {
+        case graphConfig.authorityWW:
+            challengeURL += "MicrosoftIdentity/Account/Challenge";
+            break;
+        case graphConfig.authorityUS:
+            challengeURL += "USGov/Challenge";
+            break;
+        case graphConfig.authorityCN:
+            challengeURL += "China/Challenge";
+            break;
+        default:
+            // unknown authority
+            return;
+    }
+    let url: URL = new URL(challengeURL);
     url.searchParams.append("redirectUri", window.location.origin);
     url.searchParams.append("scope", scope);
     url.searchParams.append("domainHint", "organizations");
@@ -1410,8 +1429,23 @@ export async function signOut(user: User): Promise<boolean>{
     //      OnRedirectToIdentityProviderForSignOut - this is where we set the logout_hint for user we are trying to logout
     //      OnSignedOutCallbackRedirect - called when the call sucessfully completes
     let signoutURL: string = window.location.href;
-    signoutURL += "MicrosoftIdentity/Account/SignOut";
-    window.location.assign(signoutURL);
+    switch (user.authority) {
+        case graphConfig.authorityWW:
+            signoutURL += "MicrosoftIdentity/Account/SignOut";
+            break;
+        case graphConfig.authorityUS:
+            signoutURL += "USGov/SignOut";
+            break;
+        case graphConfig.authorityCN:
+            signoutURL += "China/SignOut";
+            break;
+        default:
+            // unknown authority
+            return false;
+    }
+    url = new URL(signoutURL);
+    url.searchParams.append("redirectUri", window.location.origin);
+    window.location.assign(url.href);
     return true;
 }
 //tenantRelationshipsGetByDomain - query AAD for associated company name and id
@@ -1564,11 +1598,16 @@ export async function tenantUnauthenticatedLookup(tenant: Tenant, debug: boolean
                 if (data) {
                     // store tenant ID and authority
                     var tenantAuthEndpoint = data.authorization_endpoint;
-                    var authMatches = tenantAuthEndpoint.match(regexes[j]);
-                    tenant.tid = authMatches[2];
-                    tenant.authority = authMatches[1];  // USGov tenants are registered in WW with USGov authority values!
-                    console.log(`Successful GET from openid well-known endpoint: tid: ${tenant.tid} authority: ${tenant.authority}`);
-                    return true;  // success, need UX to re-render
+                    // USGov/China tenants are registered in WW with USGov/China authority values!
+                    for (let k = 0; k < 3; k++) {
+                        var authMatches = tenantAuthEndpoint.match(regexes[k]);
+                        if (authMatches != null) {
+                            tenant.tid = authMatches[2];
+                            tenant.authority = authMatches[1];
+                            console.log(`Successful GET from openid well-known endpoint: tid: ${tenant.tid} authority: ${tenant.authority}`);
+                            return true;  // success, need UX to re-render
+                        }
+                    }
                 }
                 else {
                     console.log(`Failed JSON parse of openid well-known endpoint response ${openidEndpoint}.`);
@@ -1599,7 +1638,7 @@ export async function userDelegatedScopesGet(instance: IPublicClientApplication,
     try {
         // first, cache Graph resource ID (service principal) for this tenant if we don't have it already
         if (tenant.graphSP == "") {
-            let { spid, error } = await servicePrincipalGet(options, "00000003-0000-0000-c000-000000000000");
+            let { spid, error } = await servicePrincipalGet(options, loggedInUser, "00000003-0000-0000-c000-000000000000");
             if (error != "") {
                 debugger;
                 return { scopes: null, id: null, error: `${error}` };
@@ -1607,7 +1646,7 @@ export async function userDelegatedScopesGet(instance: IPublicClientApplication,
             tenant.graphSP = spid;
         }
         // then, retrieve the delegated Graph permissions assigned to this user
-        let { grants, id, error } = await oauth2PermissionGrantsGet(options, tenant.graphSP, loggedInUser.oid);
+        let { grants, id, error } = await oauth2PermissionGrantsGet(options, loggedInUser, tenant.graphSP, loggedInUser.oid);
         if (error != "") {
             debugger;
             return { scopes: null, id: null, error: `${error}` };
@@ -1657,7 +1696,9 @@ export async function usersGet(instance: IPublicClientApplication, user: User |
         // create headers
         const headers = await defineHeaders(instance, user);
         let options = { method: "GET", headers: headers };
-        let response = await fetch(graphConfig.graphUsersEndpoint, options);
+        let usersEndpoint = getGraphEndpoint(user.authority);
+        usersEndpoint += graphConfig.graphUsersPredicate;
+        let response = await fetch(usersEndpoint, options);
         let data = await response.json();
         if (typeof data.error !== "undefined") {
             return { users: [], error: `${data.error.code}: ${data.error.message}` };
@@ -1796,9 +1837,7 @@ export async function userAdd(instance: IPublicClientApplication, authorizedUser
 export async function userRemove(instance: IPublicClientApplication, authorizedUser: User, user: User, workspaceId: string): Promise<APIResult> {
     return adminDelete(instance, authorizedUser, user, workspaceId);
 }
-//
 // Mindline Config API internal helper functions
-//
 function processReturnedAdmins(workspace: Workspace, ii: InitInfo, returnedAdmins: Array<Object>) {
     returnedAdmins.map((item) => {
         // are we already tracking this user?

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mindline/sync",
   "type": "module",
-  "version": "1.0.63",
+  "version": "1.0.65",
   "types": "index.d.ts",
   "exports": "./index.ts",
   "description": "sync is a node.js package encapsulating javscript classes required for configuring Mindline sync service.",

package/tsconfig.json

@@ -1,27 +1,27 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "lib": [ "DOM", "DOM.Iterable", "ESNext" ],
-    "types": [ "vite/client", "vite-plugin-svgr/client", "node", "jest" ],
-    "allowJs": false,
-    "skipLibCheck": false,
-    "esModuleInterop": false,
-    "allowSyntheticDefaultImports": true,
-    "forceConsistentCasingInFileNames": true,
-    "module": "esnext",
-    "moduleResolution": "node",
-    "resolveJsonModule": true,
-    "isolatedModules": true,
-    "noEmit": true,
-    "jsx": "react-jsx",
-    "composite": false,
-
-    /* Linting */
-    "strict": true,
-    "noUnusedLocals": true,
-    "noUnusedParameters": true,
-    "noFallthroughCasesInSwitch": true
-  },
-  "include": ["src"],
-  "references": [{ "path": "./tsconfig.node.json" }]
-}
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "lib": [ "DOM", "DOM.Iterable", "ESNext" ],
+    "types": [ "vite/client", "vite-plugin-svgr/client", "node", "jest" ],
+    "allowJs": false,
+    "skipLibCheck": false,
+    "esModuleInterop": false,
+    "allowSyntheticDefaultImports": true,
+    "forceConsistentCasingInFileNames": true,
+    "module": "esnext",
+    "moduleResolution": "node",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "composite": false,
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["src"],
+  "references": [{ "path": "./tsconfig.node.json" }]
+}

package/tsconfig.node.json

@@ -1,9 +1,9 @@
-{
-  "compilerOptions": {
-    "composite": true,
-    "skipLibCheck": true,
-    "module": "ESNext",
-    "moduleResolution": "node",
-    "allowSyntheticDefaultImports": true
-  }
-}
+{
+  "compilerOptions": {
+    "composite": true,
+    "skipLibCheck": true,
+    "module": "ESNext",
+    "moduleResolution": "node",
+    "allowSyntheticDefaultImports": true
+  }
+}