@mindline/sync 1.0.64 → 1.0.66

package/.vs/ProjectSettings.json

@@ -0,0 +1,3 @@
+{
+  "CurrentProjectSetting": null
+}

package/.vs/sync/v17/DocumentLayout.json

@@ -1,15 +1,28 @@
 {
   "Version": 1,
   "WorkspaceRootPath": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\",
-  "Documents": [],
+  "Documents": [
+    {
+      "AbsoluteMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}",
+      "RelativeMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|solutionrelative:index.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}"
+    },
+    {
+      "AbsoluteMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\hybridspa.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}",
+      "RelativeMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|solutionrelative:hybridspa.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}"
+    },
+    {
+      "AbsoluteMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.d.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}",
+      "RelativeMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|solutionrelative:index.d.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}"
+    }
+  ],
   "DocumentGroupContainers": [
     {
       "Orientation": 0,
       "VerticalTabListWidth": 256,
       "DocumentGroups": [
         {
-          "DockedWidth": 200,
-          "SelectedChildIndex": -1,
+          "DockedWidth": 179,
+          "SelectedChildIndex": 10,
           "Children": [
             {
               "$type": "Bookmark",
@@ -43,6 +56,59 @@
               "$type": "Bookmark",
               "Name": "ST:1:0:{d212f56b-c48a-434c-a121-1c5d80b59b9f}"
             },
+            {
+              "$type": "Document",
+              "DocumentIndex": 2,
+              "Title": "index.d.ts",
+              "DocumentMoniker": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.d.ts",
+              "RelativeDocumentMoniker": "index.d.ts",
+              "ToolTip": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.d.ts",
+              "RelativeToolTip": "index.d.ts",
+              "ViewState": "AQIAAP0AAAAAAAAAAAAhwA4BAABQAAAA",
+              "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.003213|",
+              "WhenOpened": "2023-11-25T03:36:49.251Z"
+            },
+            {
+              "$type": "Document",
+              "DocumentIndex": 1,
+              "Title": "hybridspa.ts",
+              "DocumentMoniker": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\hybridspa.ts",
+              "RelativeDocumentMoniker": "hybridspa.ts",
+              "ToolTip": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\hybridspa.ts",
+              "RelativeToolTip": "hybridspa.ts",
+              "ViewState": "AQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+              "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.003213|",
+              "WhenOpened": "2023-11-25T02:18:34.862Z"
+            },
+            {
+              "$type": "Document",
+              "DocumentIndex": 0,
+              "Title": "index.ts",
+              "DocumentMoniker": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.ts",
+              "RelativeDocumentMoniker": "index.ts",
+              "ToolTip": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.ts",
+              "RelativeToolTip": "index.ts",
+              "ViewState": "AQIAAAAAAAAAAAAAAAAAAFAAAAAEAAAA",
+              "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.003213|",
+              "WhenOpened": "2023-11-25T04:05:46.842Z",
+              "EditorCaption": ""
+            }
+          ]
+        },
+        {
+          "DockedWidth": 221,
+          "SelectedChildIndex": -1,
+          "Children": [
+            {
+              "$type": "Bookmark",
+              "Name": "ST:0:0:{004be353-6879-467c-9d1e-9ac23cdf6d49}"
+            }
+          ]
+        },
+        {
+          "DockedWidth": 294,
+          "SelectedChildIndex": -1,
+          "Children": [
             {
               "$type": "Bookmark",
               "Name": "ST:0:0:{633c14d1-94e6-4de0-b649-bde18d3de13d}"

package/hybridspa.ts

@@ -2,7 +2,7 @@
 import {
     APIResult,
     Config,
-    graphConfig,
+    mindlineConfig,
     Tenant,
     TenantConfigInfo,
     User
@@ -80,12 +80,12 @@ export async function adminDelete(
     // are we performing deletion of a full admin?
     let url: URL | null = null;
     if (user.oid !== user.mail) {
-        url = new URL(graphConfig.adminEndpoint());
+        url = new URL(mindlineConfig.adminEndpoint());
         url.searchParams.append("workspaceId", workspaceId);
     }
     // or of an incomplete admin?
     else if (user.mail !== "") {
-        url = new URL(graphConfig.adminIncompleteEndpoint());
+        url = new URL(mindlineConfig.adminIncompleteEndpoint());
         url.searchParams.append("email", user.mail);
         url.searchParams.append("workspaceId", workspaceId);
     }
@@ -131,7 +131,7 @@ export async function adminsGet(
         return result;
     }
     // create endpoint
-    let endpoint: string = graphConfig.adminsEndpoint();
+    let endpoint: string = mindlineConfig.adminsEndpoint();
     // add parameter to endpoint
     let url: URL = new URL(endpoint);
     url.searchParams.append("workspaceId", workspaceID);
@@ -191,7 +191,7 @@ export async function adminPost(
         return result;
     }
     // create admin endpoint
-    let endpoint: string = graphConfig.adminEndpoint();
+    let endpoint: string = mindlineConfig.adminEndpoint();
     // create headers
     const headers = await defineHeaders(instance, authorizedUser);
     // create admin body
@@ -240,7 +240,7 @@ export async function configDelete(
         return result;
     }
     let url: URL | null = null;
-    url = new URL(graphConfig.configEndpoint());
+    url = new URL(mindlineConfig.configEndpoint());
     url.searchParams.append("configurationId", config.id);
     // create headers
     const headers = await defineHeaders(instance, authorizedUser);
@@ -286,7 +286,7 @@ export async function configPost(
         return result;
     }
     // create no parameter config endpoint
-    let endpoint: string = graphConfig.configEndpoint();
+    let endpoint: string = mindlineConfig.configEndpoint();
     // create config headers
     const headers = await defineHeaders(instance, authorizedUser);
     // create config body
@@ -362,7 +362,7 @@ export async function configPut(
         return result;
     }
     // create parametrized config endpoint
-    let endpoint: string = graphConfig.configEndpoint();
+    let endpoint: string = mindlineConfig.configEndpoint();
     let url: URL = new URL(endpoint);
     url.searchParams.append("configurationId", config.id);
     // create config headers
@@ -437,7 +437,7 @@ export async function configsGet(
         return result;
     }
     // create endpoint
-    let endpoint: string = graphConfig.configsEndpoint();
+    let endpoint: string = mindlineConfig.configsEndpoint();
     // add parameter to endpoint
     let url: URL = new URL(endpoint);
     url.searchParams.append("workspaceId", workspaceID);
@@ -498,7 +498,7 @@ export async function initPost(
         return result;
     }
     // create init endpoint
-    let endpoint: string = graphConfig.initEndpoint();
+    let endpoint: string = mindlineConfig.initEndpoint();
     // create init headers
     const headers = await defineHeaders(instance, authorizedUser);
     // create init body
@@ -556,7 +556,7 @@ export async function tenantDelete(
         return result;
     }
     // create parametrized tenant endpoint
-    let url: URL = new URL(graphConfig.tenantEndpoint());
+    let url: URL = new URL(mindlineConfig.tenantEndpoint());
     url.searchParams.append("tenantId", tenant.tid);
     url.searchParams.append("workspaceId", workspaceId);
     // create headers
@@ -603,7 +603,7 @@ export async function tenantsGet(
         return result;
     }
     // create endpoint
-    let endpoint: string = graphConfig.tenantsEndpoint();
+    let endpoint: string = mindlineConfig.tenantsEndpoint();
     // add parameter to endpoint
     let url: URL = new URL(endpoint);
     url.searchParams.append("workspaceId", workspaceID);
@@ -664,7 +664,7 @@ export async function tenantPost(
         return result;
     }
     // create parametrized tenant endpoint
-    let endpoint: string = graphConfig.tenantEndpoint();
+    let endpoint: string = mindlineConfig.tenantEndpoint();
     let url: URL = new URL(endpoint);
     url.searchParams.append("workspaceId", workspaceId);
     // create tenant headers
@@ -719,7 +719,7 @@ export async function tenantPut(
         return result;
     }
     // create tenant endpoint
-    let endpoint: string = graphConfig.tenantEndpoint();
+    let endpoint: string = mindlineConfig.tenantEndpoint();
     // create tenant headers
     const headers = await defineHeaders(instance, authorizedUser);
     // establish read and write service principals ("notassigned" is default")
@@ -784,7 +784,7 @@ export async function workspacesGet(
         return result;
     }
     // create workspaces endpoint
-    let endpoint: string = graphConfig.workspaceEndpoint();
+    let endpoint: string = mindlineConfig.workspaceEndpoint();
     // create workspace endpoint
     let url: URL = new URL(endpoint);
     // create workspace headers
@@ -843,7 +843,7 @@ export async function readerPost(
         return result;
     }
     // create reader endpoint
-    let readerEndpoint: string = graphConfig.readerStartSyncEndpoint();
+    let readerEndpoint: string = mindlineConfig.readerStartSyncEndpoint();
     let url: URL = new URL(readerEndpoint);
     url.searchParams.append("configurationId", config.id);
     // create headers

package/index.d.ts

@@ -11,7 +11,7 @@ declare module "@mindline/sync" {
         array: Array<Object> | null;
         constructor();
     }  
-    export class graphConfig {
+    export class mindlineConfig {
         static environmentTag: string;
         // config API endpoints
         static adminEndpoint(): string;
@@ -26,14 +26,15 @@ declare module "@mindline/sync" {
         static workspaceEndpoint(): string;
         // SignalR endpoint
         static signalREndpoint(): string;
+    }
+    export class graphConfig {
         // graph API endpoints
-        static graphGroupsEndpoint: string;
-        static graphMailEndpoint: string;
-        static graphMeEndpoint: string;
-        static graphOauth2PermissionGrants: string;
-        static graphServicePrincipalsEndpoint: string;
-        static graphUsersEndpoint: string;
-        // sovereign cloud tenant info endpoints
+        static graphGroupsPredicate: string;
+        static graphMailPredicate: string;
+        static graphMePredicate: string;
+        static graphOauth2PermissionGrantsPredicate: string;
+        static graphServicePrincipalsPredicate: string;
+        static graphUsersPredicate: string;
         static graphTenantByDomainPredicate: string;
         static graphTenantByIdPredicate: string;
         // authority values are based on the well-known OIDC auth endpoints
@@ -267,9 +268,9 @@ declare module "@mindline/sync" {
     // Azure AD Graph API
     //
     export function groupsGet(instance: IPublicClientApplication, user: User | undefined, groupSearchString: string): Promise<{ groups: Group[], error: string }>;
-    export function oauth2PermissionGrantsGet(options: RequestInit, spid: string, oid: string): Promise<{grants: string, error: string}>;
+    export function oauth2PermissionGrantsGet(options: RequestInit, user: User, spid: string, oid: string): Promise<{grants: string, error: string}>;
     export function requestAdminConsent(user: User, scope: string): void;
-    export function servicePrincipalGet(options: RequestInit, appid: string): Promise<{ spid: string, error: string }>;
+    export function servicePrincipalGet(options: RequestInit, user: User, appid: string): Promise<{ spid: string, error: string }>;
     export function signIn(user: User, tasks: TaskArray): boolean;
     export function signInIncrementally(user: User, scope: string): void;
     export function signOut(user: User): boolean;

package/index.ts

@@ -28,58 +28,59 @@ export class APIResult {
     array: Array<Object> | null;
     constructor() { this.result = true; this.status = 200; this.error = ""; this.version = version; this.array = null; }
 }
-export class graphConfig {
+export class mindlineConfig {
     static environmentTag: string = "dev";
     // config API endpoints
     static adminEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/admin`
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/admin`
     };
     static adminIncompleteEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/incomplete-admin`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/incomplete-admin`;
     };
     static adminsEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/admins`;
-    }; 
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/admins`;
+    };
     static configEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configuration`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configuration`;
     };
     static configsEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configurations`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configurations`;
     };
     static initEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configuration/init`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/configuration/init`;
     };
     static readerStartSyncEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/startSync`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/startSync`;
     };
     static tenantEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/tenant`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/tenant`;
     };
     static tenantsEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/tenants`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/tenants`;
     };
     static workspaceEndpoint(): string {
-        return `https://${graphConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/workspaces`;
+        return `https://${mindlineConfig.environmentTag}-configurationapi-westus.azurewebsites.net/api/v1/workspaces`;
     };
     // SignalR endpoint
     static signalREndpoint(): string {
-        return `https://${graphConfig.environmentTag}-signalrdispatcher-westus.azurewebsites.net/statsHub`;
+        return `https://${mindlineConfig.environmentTag}-signalrdispatcher-westus.azurewebsites.net/statsHub`;
     };
-    // graph API endpoints
-    static graphGroupsEndpoint: string = "https://graph.microsoft.com/v1.0/groups";
-    static graphMailEndpoint: string = "https://graph.microsoft.com/v1.0/me/messages";
-    static graphMeEndpoint: string = "https://graph.microsoft.com/v1.0/me";
-    static graphOauth2PermissionGrants: string = "https://graph.microsoft.com/v1.0/oauth2PermissionGrants";
-    static graphServicePrincipalsEndpoint: string = "https://graph.microsoft.com/v1.0/servicePrincipals";
-    static graphUsersEndpoint: string = "https://graph.microsoft.com/v1.0/users";
-    // sovereign cloud tenant info endpoints
+}
+export class graphConfig {
+    // graph API predicates
+    static graphGroupsPredicate: string = "v1.0/groups";
+    static graphMailPredicate: string = "v1.0/me/messages";
+    static graphMePredicate: string = "v1.0/me";
+    static graphOauth2PermissionGrantsPredicate: string = "v1.0/oauth2PermissionGrants";
+    static graphServicePrincipalsPredicate: string = "v1.0/servicePrincipals";
+    static graphUsersPredicate: string = "v1.0/users";
     static graphTenantByDomainPredicate: string = "beta/tenantRelationships/findTenantInformationByDomainName";
     static graphTenantByIdPredicate: string = "beta/tenantRelationships/findTenantInformationByTenantId";
     // authority values are based on the well-known OIDC auth endpoints
     static authorityWW: string = "https://login.microsoftonline.com/";
-    static authorityWWRegex: RegExp = /^(https:\/\/login\.microsoftonline\.(?:us|com)\/)([\dA-Fa-f]{8}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{12})\/oauth2\/authorize$/;
+    static authorityWWRegex: RegExp = /^(https:\/\/login\.microsoftonline\.com\/)([\dA-Fa-f]{8}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{12})\/oauth2\/authorize$/;
     static authorityUS: string = "https://login.microsoftonline.us/";
-    static authorityUSRegex: RegExp = /^(https:\/\/login\.microsoftonline\.(?:us|com)\/)([\dA-Fa-f]{8}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{12})\/oauth2\/authorize$/;
+    static authorityUSRegex: RegExp = /^(https:\/\/login\.microsoftonline\.us\/)([\dA-Fa-f]{8}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{12})\/oauth2\/authorize$/;
     static authorityCN: string = "https://login.partner.microsoftonline.cn/";
     static authorityCNRegex: RegExp = /^(https:\/\/login\.partner\.microsoftonline\.cn\/)([\dA-Fa-f]{8}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{4}-[\dA-Fa-f]{12})\/oauth2\/authorize$/;
 };
@@ -172,6 +173,14 @@ export class Tenant {
         this.graphSP = "";
     }
 }
+function getAppId(authority: string): string {
+    switch (authority) {
+        case graphConfig.authorityWW: return "63100afe-506e-4bb2-8ff7-d8d5ab373129";
+        case graphConfig.authorityUS: return "762d313c-dcfd-4582-8cc5-53cc9844f62e";
+        case graphConfig.authorityCN: return "814e0ebd-ada6-42b4-b8ae-e26f3861a0aa";
+        default: debugger; return "";
+    }
+}
 function getGraphEndpoint(authority: string): string {
     switch (authority) {
         case graphConfig.authorityWW: return "https://graph.microsoft.com/";
@@ -180,6 +189,14 @@ function getGraphEndpoint(authority: string): string {
         default: debugger; return "";
     }
 }
+function getLoginEndpoint(authority: string): string {
+    switch (authority) {
+        case graphConfig.authorityWW: return "https://login.microsoft.com/";
+        case graphConfig.authorityUS: return "https://login.microsoft.us/";
+        case graphConfig.authorityCN: return "https://login.partner.microsoftonline.cn/";
+        default: debugger; return "";
+    }
+}
 export enum TenantConfigType {
     source = 1,
     target = 2,
@@ -1112,7 +1129,7 @@ export class BatchArray {
         }
         // start SignalR connection based on each batchId
         batchIdArray.map((batchPair: Object) => {
-            const endpoint: string = graphConfig.signalREndpoint();
+            const endpoint: string = mindlineConfig.signalREndpoint();
             let endpointUrl: URL = new URL(endpoint);
             endpointUrl.searchParams.append("statsId", batchPair.BatchId);
             console.log(`Creating SignalR Hub for TID: ${batchPair.SourceId} ${endpointUrl.href}`);
@@ -1195,9 +1212,7 @@ export class TenantNode {
         }
     }
 }
-//
-// Azure AD Graph API
-//
+// ======================= Azure AD Graph API ===============================
 export async function groupsGet(instance: IPublicClientApplication, user: User | undefined, groupSearchString: string): Promise<{ groups: Group[], error: string }> {
     // need a logged in user to get graph users
     if (user == null || user.spacode == "") {
@@ -1208,7 +1223,8 @@ export async function groupsGet(instance: IPublicClientApplication, user: User |
     let options = { method: "GET", headers: headers };
     // make /groups endpoint call
     try {
-        let groupsEndpoint = `${graphConfig.graphGroupsEndpoint}/?$filter=startsWith(displayName, '${groupSearchString}')`;
+        let groupsEndpoint: string = getGraphEndpoint(user.authority) + graphConfig.graphGroupsPredicate;
+        groupsEndpoint += `/?$filter=startsWith(displayName, '${groupSearchString}')`;
         let response = await fetch(groupsEndpoint, options);
         let data = await response.json();
         if (typeof data.error !== "undefined") {
@@ -1221,10 +1237,10 @@ export async function groupsGet(instance: IPublicClientApplication, user: User |
         return { groups: [], error: `Exception: ${error}` };
     }
 }
-export async function oauth2PermissionGrantsGet(options: RequestInit, spid: string, oid: string): Promise<{ grants: string, id: string, error: string }> {
+export async function oauth2PermissionGrantsGet(options: RequestInit, user: User, spid: string, oid: string): Promise<{ grants: string, id: string, error: string }> {
     try {
         // make /oauth2PermissionGrants endpoint call
-        let spurl: string = graphConfig.graphOauth2PermissionGrants;
+        let spurl: string = getGraphEndpoint(user.authority) + graphConfig.graphOauth2PermissionGrantsPredicate;
         let url: URL = new URL(spurl);
         url.searchParams.append("$filter", `resourceId eq '${spid}' and consentType eq 'Principal' and principalId eq '${oid}'`);
         let response = await fetch(url.href, options);
@@ -1251,7 +1267,8 @@ export async function oauth2PermissionGrantsSet(instance: IPublicClientApplicati
     }
     // make /oauth2PermissionGrants endpoint call
     try {
-        let grantsurl: string = graphConfig.graphOauth2PermissionGrants + `/${id}`;
+        let grantsurl: string = getGraphEndpoint(loggedInUser.authority);
+        grantsurl += graphConfig.graphOauth2PermissionGrantsPredicate + `/${id}`;
         let scopesBody: string = `{ "scope": "${scopes}" }`;
         const headers = await defineHeaders(instance, loggedInUser);
         let options: RequestInit = { method: "PATCH", headers: headers, body: scopesBody };
@@ -1288,19 +1305,21 @@ export function requestAdminConsent(user: User, scope: string): void {
     // https://learn.microsoft.com/EN-US/azure/active-directory/develop/scopes-oidc#client-credentials-grant-flow-and-default
     // https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow#request-the-permissions-from-a-directory-admin
     //
-    let adminConsentURL: string = "https://login.microsoftonline.com/";
+    let adminConsentURL: string = getLoginEndpoint(user.authority);
     adminConsentURL += user.tid;
     adminConsentURL += "/adminconsent";
     let url: URL = new URL(adminConsentURL);
-    url.searchParams.append("client_id", "63100afe-506e-4bb2-8ff7-d8d5ab373129");
+    let clientId: string = getAppId(user.authority);
+    url.searchParams.append("client_id", clientId);
     url.searchParams.append("redirect_uri", window.location.origin);
     url.searchParams.append("domain_hint", user.companyDomain);
     window.location.assign(url.href);
 }
-export async function servicePrincipalGet(options: RequestInit, appid: string): Promise<{ spid: string, error: string }> {
+export async function servicePrincipalGet(options: RequestInit, user: User, appid: string): Promise<{ spid: string, error: string }> {
     try {
         // make /servicePrincipals endpoint call to get the Service Principal ID
-        let spurl: string = graphConfig.graphServicePrincipalsEndpoint;
+        let spurl: string = getGraphEndpoint(user.authority);
+        spurl += graphConfig.graphServicePrincipalsPredicate;
         spurl += `(appId='${appid}')`;
         let url: URL = new URL(spurl);
         url.searchParams.append("$select", "id,appId,displayName");
@@ -1335,63 +1354,52 @@ export async function signIn(user: User, tasks: TaskArray): Promise<boolean> {
             return false;
         }
     }
+    // SignIn by an admin consents the app, Challenge adds incremental permissions dynamically, but requires a consented app - TEST THIS
+    let signinURL: string = window.location.href;
     switch (user.authority) {
         case graphConfig.authorityWW:
-            // SignIn by an admin consents the app, Challenge adds incremental permissions dynamically, but requires a consented app
-            let tenantURL: string = window.location.href;
-            tenantURL += "MicrosoftIdentity/Account/SignIn";
-            let url: URL = new URL(tenantURL);
-            url.searchParams.append("redirectUri", window.location.origin);
-            url.searchParams.append("domainHint", "organizations");
-            if (user.oid !== "1") { // "1" means no mail has been set by admin initially in the app, oid and mail should be same if user has set and not yet signed in
-                url.searchParams.append("loginHint", user.mail);
-            }
-            tasks.setTaskStart("initialization", new Date());
-            tasks.setTaskStart("authenticate user", new Date());
-            window.location.assign(url.href);
-            return true;
+            signinURL += "MicrosoftIdentity/Account/SignIn";
+            break;
         case graphConfig.authorityUS:
-            // retrieve controller protected by USGov authorization
-            let usURL: string = window.location.href;
-            usURL += "USGov";
-            let urlUS: URL = new URL(usURL);
-            urlUS.searchParams.append("redirectUri", window.location.origin);
-            urlUS.searchParams.append("domainHint", user.companyDomain);
-            if (user.oid !== "1") {
-                urlUS.searchParams.append("loginHint", user.mail);
-            }
-            tasks.setTaskStart("initialization", new Date());
-            tasks.setTaskStart("authenticate user", new Date());
-            window.location.assign(urlUS.href);
-            return true;
+            signinURL += "USGov/SignIn";
+            break;
         case graphConfig.authorityCN:
-            // retrieve controller protected by USGov authorization
-            let chinaURL: string = window.location.href;
-            chinaURL += "China";
-            let urlChina: URL = new URL(chinaURL);
-            urlChina.searchParams.append("redirectUri", window.location.origin);
-            urlChina.searchParams.append("domainHint", user.companyDomain);
-            if (user.oid !== "1") {
-                urlChina.searchParams.append("loginHint", user.mail);
-            }
-            tasks.setTaskStart("initialization", new Date());
-            tasks.setTaskStart("authenticate user", new Date());
-            window.location.assign(urlChina.href);
-            return true;
+            signinURL += "China/SignIn";
+            break;
         default:
             // unknown authority
-            debugger;
+            return false;
+    }
+    let url: URL = new URL(signinURL);
+    url.searchParams.append("redirectUri", window.location.origin);
+    url.searchParams.append("domainHint", "organizations");
+    if (user.oid !== "1") { // "1" means no mail has been set by admin initially in the app, oid and mail should be same if user has set and not yet signed in
+        url.searchParams.append("loginHint", user.mail);
     }
-    return false;
+    tasks.setTaskStart("initialization", new Date());
+    tasks.setTaskStart("authenticate user", new Date());
+    window.location.assign(url.href);
+    return true;
 }
 export function signInIncrementally(user: User, scope: string): void {
     if (user.oid == "1") return;
-    //
-    // for delegated permissions, we can use the Microsoft Identity Web Account Controller Challenge method
-    //
-    let tenantURL: string = window.location.href;
-    tenantURL += "MicrosoftIdentity/Account/Challenge";
-    let url: URL = new URL(tenantURL);
+    // for dynamic delegated permissions, we can use the Microsoft Identity Web Account Controller Challenge method
+    let challengeURL: string = window.location.href;
+    switch (user.authority) {
+        case graphConfig.authorityWW:
+            challengeURL += "MicrosoftIdentity/Account/Challenge";
+            break;
+        case graphConfig.authorityUS:
+            challengeURL += "USGov/Challenge";
+            break;
+        case graphConfig.authorityCN:
+            challengeURL += "China/Challenge";
+            break;
+        default:
+            // unknown authority
+            return;
+    }
+    let url: URL = new URL(challengeURL);
     url.searchParams.append("redirectUri", window.location.origin);
     url.searchParams.append("scope", scope);
     url.searchParams.append("domainHint", "organizations");
@@ -1421,8 +1429,23 @@ export async function signOut(user: User): Promise<boolean>{
     //      OnRedirectToIdentityProviderForSignOut - this is where we set the logout_hint for user we are trying to logout
     //      OnSignedOutCallbackRedirect - called when the call sucessfully completes
     let signoutURL: string = window.location.href;
-    signoutURL += "MicrosoftIdentity/Account/SignOut";
-    window.location.assign(signoutURL);
+    switch (user.authority) {
+        case graphConfig.authorityWW:
+            signoutURL += "MicrosoftIdentity/Account/SignOut";
+            break;
+        case graphConfig.authorityUS:
+            signoutURL += "USGov/SignOut";
+            break;
+        case graphConfig.authorityCN:
+            signoutURL += "China/SignOut";
+            break;
+        default:
+            // unknown authority
+            return false;
+    }
+    url = new URL(signoutURL);
+    url.searchParams.append("redirectUri", window.location.origin);
+    window.location.assign(url.href);
     return true;
 }
 //tenantRelationshipsGetByDomain - query AAD for associated company name and id
@@ -1615,7 +1638,7 @@ export async function userDelegatedScopesGet(instance: IPublicClientApplication,
     try {
         // first, cache Graph resource ID (service principal) for this tenant if we don't have it already
         if (tenant.graphSP == "") {
-            let { spid, error } = await servicePrincipalGet(options, "00000003-0000-0000-c000-000000000000");
+            let { spid, error } = await servicePrincipalGet(options, loggedInUser, "00000003-0000-0000-c000-000000000000");
             if (error != "") {
                 debugger;
                 return { scopes: null, id: null, error: `${error}` };
@@ -1623,7 +1646,7 @@ export async function userDelegatedScopesGet(instance: IPublicClientApplication,
             tenant.graphSP = spid;
         }
         // then, retrieve the delegated Graph permissions assigned to this user
-        let { grants, id, error } = await oauth2PermissionGrantsGet(options, tenant.graphSP, loggedInUser.oid);
+        let { grants, id, error } = await oauth2PermissionGrantsGet(options, loggedInUser, tenant.graphSP, loggedInUser.oid);
         if (error != "") {
             debugger;
             return { scopes: null, id: null, error: `${error}` };
@@ -1673,7 +1696,9 @@ export async function usersGet(instance: IPublicClientApplication, user: User |
         // create headers
         const headers = await defineHeaders(instance, user);
         let options = { method: "GET", headers: headers };
-        let response = await fetch(graphConfig.graphUsersEndpoint, options);
+        let usersEndpoint = getGraphEndpoint(user.authority);
+        usersEndpoint += graphConfig.graphUsersPredicate;
+        let response = await fetch(usersEndpoint, options);
         let data = await response.json();
         if (typeof data.error !== "undefined") {
             return { users: [], error: `${data.error.code}: ${data.error.message}` };
@@ -1812,9 +1837,7 @@ export async function userAdd(instance: IPublicClientApplication, authorizedUser
 export async function userRemove(instance: IPublicClientApplication, authorizedUser: User, user: User, workspaceId: string): Promise<APIResult> {
     return adminDelete(instance, authorizedUser, user, workspaceId);
 }
-//
 // Mindline Config API internal helper functions
-//
 function processReturnedAdmins(workspace: Workspace, ii: InitInfo, returnedAdmins: Array<Object>) {
     returnedAdmins.map((item) => {
         // are we already tracking this user?

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mindline/sync",
   "type": "module",
-  "version": "1.0.64",
+  "version": "1.0.66",
   "types": "index.d.ts",
   "exports": "./index.ts",
   "description": "sync is a node.js package encapsulating javscript classes required for configuring Mindline sync service.",