@mindline/sync 1.0.74 → 1.0.76

package/.vs/VSWorkspaceState.json

@@ -2,6 +2,6 @@
   "ExpandedNodes": [
     ""
   ],
-  "SelectedNode": "\\package.json",
+  "SelectedNode": "\\index.ts",
   "PreviewInSolutionExplorer": false
 }

package/.vs/sync/v17/DocumentLayout.json

@@ -2,34 +2,22 @@
   "Version": 1,
   "WorkspaceRootPath": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\",
   "Documents": [
-    {
-      "AbsoluteMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}",
-      "RelativeMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|solutionrelative:index.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}"
-    },
     {
       "AbsoluteMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.d.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}",
       "RelativeMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|solutionrelative:index.d.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}"
     },
     {
-      "AbsoluteMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\package.json||{90A6B3A7-C1A3-4009-A288-E2FF89E96FA0}",
-      "RelativeMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|solutionrelative:package.json||{90A6B3A7-C1A3-4009-A288-E2FF89E96FA0}"
-    },
-    {
-      "AbsoluteMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\resources.json||{90A6B3A7-C1A3-4009-A288-E2FF89E96FA0}",
-      "RelativeMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|solutionrelative:resources.json||{90A6B3A7-C1A3-4009-A288-E2FF89E96FA0}"
-    },
-    {
-      "AbsoluteMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\hybridspa.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}",
-      "RelativeMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|solutionrelative:hybridspa.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}"
+      "AbsoluteMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}",
+      "RelativeMoniker": "D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}|\u003CMiscFiles\u003E|solutionrelative:index.ts||{0F2454B1-A556-402D-A7D0-1FDE7F99DEE0}"
     }
   ],
   "DocumentGroupContainers": [
     {
-      "Orientation": 0,
+      "Orientation": 1,
       "VerticalTabListWidth": 256,
       "DocumentGroups": [
         {
-          "DockedWidth": 179,
+          "DockedHeight": 221,
           "SelectedChildIndex": -1,
           "Children": [
             {
@@ -67,83 +55,39 @@
           ]
         },
         {
-          "DockedWidth": 186,
-          "SelectedChildIndex": 3,
+          "DockedHeight": 299,
+          "SelectedChildIndex": 1,
           "Children": [
             {
               "$type": "Document",
-              "DocumentIndex": 2,
-              "Title": "package.json",
-              "DocumentMoniker": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\package.json",
-              "RelativeDocumentMoniker": "package.json",
-              "ToolTip": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\package.json",
-              "RelativeToolTip": "package.json",
-              "ViewState": "AQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
-              "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.001642|",
-              "WhenOpened": "2024-03-30T18:10:14.136Z",
-              "EditorCaption": ""
-            },
-            {
-              "$type": "Document",
-              "DocumentIndex": 4,
-              "Title": "hybridspa.ts",
-              "DocumentMoniker": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\hybridspa.ts",
-              "RelativeDocumentMoniker": "hybridspa.ts",
-              "ToolTip": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\hybridspa.ts",
-              "RelativeToolTip": "hybridspa.ts",
-              "ViewState": "AQIAAGQBAAAAAAAAAIAmwAcCAAAEAAAA",
-              "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.003213|",
-              "WhenOpened": "2023-11-25T02:18:34.862Z"
-            },
-            {
-              "$type": "Document",
-              "DocumentIndex": 3,
-              "Title": "resources.json",
-              "DocumentMoniker": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\resources.json",
-              "RelativeDocumentMoniker": "resources.json",
-              "ToolTip": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\resources.json",
-              "RelativeToolTip": "resources.json",
-              "ViewState": "AQIAAAgAAAAAAAAAAAAUwDkAAAABAAAA",
-              "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.001642|",
-              "WhenOpened": "2024-03-30T16:56:29.032Z",
-              "EditorCaption": ""
-            },
-            {
-              "$type": "Document",
-              "DocumentIndex": 0,
+              "DocumentIndex": 1,
               "Title": "index.ts",
               "DocumentMoniker": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.ts",
               "RelativeDocumentMoniker": "index.ts",
               "ToolTip": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.ts",
               "RelativeToolTip": "index.ts",
-              "ViewState": "AQIAAOsBAAAAAAAAAAAAANEEAAAuAAAA",
+              "ViewState": "AQIAAMEAAAAAAAAAAAAAAE0FAAAAAAAA",
               "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.003213|",
-              "WhenOpened": "2023-12-05T02:10:16.04Z",
+              "WhenOpened": "2024-05-12T20:20:11.888Z",
               "EditorCaption": ""
-            }
-          ]
-        },
-        {
-          "DockedWidth": 200,
-          "SelectedChildIndex": 0,
-          "Children": [
+            },
             {
               "$type": "Document",
-              "DocumentIndex": 1,
+              "DocumentIndex": 0,
               "Title": "index.d.ts",
               "DocumentMoniker": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.d.ts",
               "RelativeDocumentMoniker": "index.d.ts",
               "ToolTip": "C:\\Users\\ArvindSuthar\\source\\repos\\front\\sync\\index.d.ts",
               "RelativeToolTip": "index.d.ts",
-              "ViewState": "AQIAAPsAAAAAAAAAAAAAABcBAAAIAAAA",
+              "ViewState": "AQIAAK8AAAAAAAAAAAAAACUBAAAQAAAA",
               "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.003213|",
-              "WhenOpened": "2024-01-01T16:19:43.325Z",
+              "WhenOpened": "2024-03-31T03:51:46.193Z",
               "EditorCaption": ""
             }
           ]
         },
         {
-          "DockedWidth": 221,
+          "DockedHeight": 200,
           "SelectedChildIndex": -1,
           "Children": [
             {
@@ -153,7 +97,7 @@
           ]
         },
         {
-          "DockedWidth": 294,
+          "DockedHeight": 200,
           "SelectedChildIndex": -1,
           "Children": [
             {

package/actors.json

@@ -0,0 +1,20 @@
+[
+  {
+    "type": "user",
+    "actor": "arvind@mindline.site",
+    "resource": "kv-syncproject",
+    "role": "Key Vault Certificate Officer",
+    "updatedby": "arvind@mindline.site",
+    "updatedon": "2023-09-06T15:36:45.7760714Z",
+    "resources": []
+  },
+  {
+    "type": "app",
+    "actor": "mindline1-sync-512169f5-38d1-4b57-be8b-967f2d0ae4c6",
+    "resource": "dev-subscription",
+    "role": "Contributor",
+    "updatedby": "arvind@mindline.site",
+    "updatedon": "2023-09-06T15:36:45.7760714Z",
+    "resources": []
+  }
+]

package/hybridspa.ts

@@ -7,6 +7,9 @@ import {
     TenantConfigInfo,
     User
 } from "./index";
+import {
+    AccountInfo
+} from "@azure/msal-common";
 import {
     IPublicClientApplication,
     AuthenticationResult,
@@ -15,7 +18,7 @@ import { deserializeArray } from "class-transformer";
 
 // helper functions
 // TODO: this is where you want to trigger a re-authentication if token expires
-export async function defineHeaders(
+async function mindlineDefineHeaders(
     instance: IPublicClientApplication,
     user: User
 ): Promise<Headers> {
@@ -23,42 +26,68 @@ export async function defineHeaders(
     headers.append("Content-Type", "application/json");
     headers.append("accept", "*/*");
     // authorization header - if needed, retrieve and cache access token
-    if (user.accessToken == null || user.accessToken === "") {
+    if (user.mindlineAccessToken == null || user.mindlineAccessToken === "") {
         try {
-            let response: AuthenticationResult = await instance.acquireTokenByCode({
-                code: user.spacode,
+            let accounts: AccountInfo[] = instance.getAllAccounts();
+            let homeAccountId = user.oid + "." + user.tid;
+            let account: AccountInfo = null;
+            for (let i: number = 0; i < accounts.length; i++) {
+                if (accounts[i].homeAccountId == homeAccountId) {
+                    account = accounts[i];
+                }
+            }
+            let response: AuthenticationResult = await instance.acquireTokenSilent({
+                scopes: ["api://8d95d21c-c378-4bb0-9f52-88c30d271e7a/Config.Write"],
+                account: account
             });
-            user.accessToken = response.accessToken; // cache access token
-            console.log("Front end token acquired: " + user.accessToken.slice(0, 20));
+            user.mindlineAccessToken = response.accessToken; // cache access token
+            console.log("Front end token acquired silently: " + user.mindlineAccessToken.slice(0, 20));
         }
         catch (error: any) {
-            console.log("Front end token failure: " + error);
+            try {
+                console.log("Front end token silent acquisition failure: " + error);
+                // fallback to redirect if silent acquisition fails
+                let accounts: AccountInfo[] = instance.getAllAccounts();
+                let homeAccountId = user.oid + "." + user.tid;
+                let account: AccountInfo = null;
+                for (let i: number = 0; i < accounts.length; i++) {
+                    if (accounts[i].homeAccountId == homeAccountId) {
+                        account = accounts[i];
+                    }
+                }
+                instance.acquireTokenRedirect({
+                    scopes: ["api://8d95d21c-c378-4bb0-9f52-88c30d271e7a/Config.Write"],
+                    account: account
+                });
+            }
+            catch (error: any) {
+                console.log("Front end token popup acquisition failure: " + error);
+            }
         }
     }
-    headers.append("Authorization", `Bearer ${user.accessToken}`);
+    headers.append("Authorization", `Bearer ${user.mindlineAccessToken}`);
     return headers;
 }
-async function processErrors(response: Response): Promise<string> {
+export async function processErrors(response: Response): Promise<string> {
     let errorString: string = "";
     if (response.status === 401) {
         errorString = response.statusText;
-    }
-    else {
-        let data = await response.json();
-        if (data.error !== undefined) {
-            errorString = `Error: ${data.error} Message: ${data.message}`;
-        } else if (data.errors !== undefined) {
-            let errorArray = Object.keys(data.errors);
-            let errorlist: string = "";
-            errorString = errorArray.reduce(
-                (acc, curr) => acc + curr + ": " + data.errors[curr] + " ",
-                errorlist
-            );
-        } else if (data.title !== undefined) {
-            errorString = data.title;
-        } else {
-            debugger;
-        }
+        if (errorString != "") return errorString;
+    }
+    let data = await response.json();
+    if (data.error !== undefined) {
+        errorString = `Error: ${data.error.code} Message: ${data.error.message}`;
+    } else if (data.errors !== undefined) {
+        let errorArray = Object.keys(data.errors);
+        let errorlist: string = "";
+        errorString = errorArray.reduce(
+            (acc, curr) => acc + curr + ": " + data.errors[curr] + " ",
+            errorlist
+        );
+    } else if (data.title !== undefined) {
+        errorString = data.title;
+    } else {
+        debugger;
     }
     return errorString;
 }
@@ -83,7 +112,7 @@ export async function adminDelete(
     url.searchParams.append("workspaceId", workspaceId);
     url.searchParams.append("email", user.mail);
     // create headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     // make endpoint call
     let options = { method: "DELETE", headers: headers };
     try {
@@ -129,7 +158,7 @@ export async function adminsGet(
     let url: URL = new URL(endpoint);
     url.searchParams.append("workspaceId", workspaceID);
     // create headers
-    const headers = await defineHeaders(instance, user);
+    const headers = await mindlineDefineHeaders(instance, user);
     // make endpoint call
     let options = { method: "GET", headers: headers };
     try {
@@ -186,7 +215,7 @@ export async function adminPost(
     // create admin endpoint
     let endpoint: string = mindlineConfig.adminEndpoint();
     // create headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     // create admin body
     let adminBody: string = `
     {"email": "${user.mail}", 
@@ -225,7 +254,7 @@ export async function configConsentReadPut(instance: IPublicClientApplication, a
     let url: URL = new URL(endpoint);
     url.searchParams.append("configurationId", configId);
     // create headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     // create body
     let configConsentReadBody: string = `
     {
@@ -266,7 +295,7 @@ export async function configConsentWritePut(instance: IPublicClientApplication,
     let url: URL = new URL(endpoint);
     url.searchParams.append("configurationId", configId);
     // create headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     // create body
     let configConsentWriteBody: string = `
     {
@@ -318,7 +347,7 @@ export async function configDelete(
     url = new URL(mindlineConfig.configEndpoint());
     url.searchParams.append("configurationId", config.id);
     // create headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     // make endpoint call
     let options = { method: "DELETE", headers: headers };
     try {
@@ -363,7 +392,7 @@ export async function configPost(
     // create no parameter config endpoint
     let endpoint: string = mindlineConfig.configEndpoint();
     // create config headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     // create config body
     let configBody: string = `
     {
@@ -441,7 +470,7 @@ export async function configPut(
     let url: URL = new URL(endpoint);
     url.searchParams.append("configurationId", config.id);
     // create config headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     // create config body
     let configBody: string = `
     {
@@ -517,7 +546,7 @@ export async function configsGet(
     let url: URL = new URL(endpoint);
     url.searchParams.append("workspaceId", workspaceID);
     // create headers
-    const headers = await defineHeaders(instance, user);
+    const headers = await mindlineDefineHeaders(instance, user);
     // make endpoint call
     let options = { method: "GET", headers: headers };
     try {
@@ -574,7 +603,7 @@ export async function initPost(
     // create init endpoint
     let endpoint: string = mindlineConfig.initEndpoint();
     // create init headers
-    const headers = await defineHeaders(instance, user);
+    const headers = await mindlineDefineHeaders(instance, user);
     // create init body
     let initBody: string = `
   {
@@ -634,7 +663,7 @@ export async function tenantDelete(
     url.searchParams.append("tenantId", tenant.tid);
     url.searchParams.append("workspaceId", workspaceId);
     // create headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     // make tenant endpoint call
     let options = { method: "DELETE", headers: headers };
     try {
@@ -682,7 +711,7 @@ export async function tenantsGet(
     let url: URL = new URL(endpoint);
     url.searchParams.append("workspaceId", workspaceID);
     // create headers
-    const headers = await defineHeaders(instance, user);
+    const headers = await mindlineDefineHeaders(instance, user);
     // make endpoint call
     let options = { method: "GET", headers: headers };
     try {
@@ -742,7 +771,7 @@ export async function tenantPost(
     let url: URL = new URL(endpoint);
     url.searchParams.append("workspaceId", workspaceId);
     // create tenant headers
-    const headers = await defineHeaders(instance, addingUser);
+    const headers = await mindlineDefineHeaders(instance, addingUser);
     // create tenant body
     let tenantBody: string = `
     {"tenantId": "${tenant.tid}", 
@@ -792,7 +821,7 @@ export async function workspacePut(instance: IPublicClientApplication, authorize
     url.searchParams.append("workspaceId", workspaceId);
     url.searchParams.append("workspaceName", workspaceName);
     // create workspace headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     let options = { method: "PUT", headers: headers };
     // make config endpoint call
     try {
@@ -838,7 +867,7 @@ export async function workspacesGet(
     // create workspace endpoint
     let url: URL = new URL(endpoint);
     // create workspace headers
-    const headers = await defineHeaders(instance, user);
+    const headers = await mindlineDefineHeaders(instance, user);
     // make workspace endpoint call
     let options = { method: "GET", headers: headers };
     try {
@@ -897,7 +926,7 @@ export async function readerPost(
     let url: URL = new URL(readerEndpoint);
     url.searchParams.append("configurationId", config.id);
     // create headers
-    const headers = await defineHeaders(instance, authorizedUser);
+    const headers = await mindlineDefineHeaders(instance, authorizedUser);
     // make reader endpoint call
     let options = { method: "POST", headers: headers };
     try {

package/index.d.ts

@@ -10,7 +10,12 @@ declare module "@mindline/sync" {
         version: string;
         array: Array<Object> | null;
         constructor();
-    }  
+    }
+    export class azureConfig {
+        // azure graph REST API endpoints
+        static azureElevateAccess: string;
+        static azureListRootAssignments: string";
+    };
     export class mindlineConfig {
         static environmentTag: string;
         // config API endpoints
@@ -72,7 +77,8 @@ declare module "@mindline/sync" {
         workspaceIDs: string;
         session: string;
         spacode: string;
-        accessToken: string;
+        graphAccessToken: string;
+        mindlineAccessToken: string;
         loginHint: string;
         scopes: string[];
         authTS: Date;
@@ -279,9 +285,23 @@ declare module "@mindline/sync" {
         resources: ResourceNode[];
         constructor(type: string, resource: string, cost: number);
     }
-    //
-    // Azure AD Graph API
-    //
+    export class ActorArray {
+        actorNodes: ActorNode[];
+        constructor(bClearLocalStorage: boolean);
+        // get initial data from localStorage or file
+        init(bClearLocalStorage: boolean): void;
+    }
+    export class ActorNode {
+        type: string;
+        actor: string;
+        resource: string;
+        role: string;
+        updatedby: string;
+        updatedon: string;
+        actors: ActorNode[];
+        constructor(type: string, actor: string, resource: string, role: string, updatedby: string, updatedon: string);
+    }
+    // ======================= Azure AD Graph API ===============================
     export function groupsGet(instance: IPublicClientApplication, user: User | undefined, groupSearchString: string): Promise<{ groups: Group[], error: string }>;
     export function oauth2PermissionGrantsGet(options: RequestInit, user: User, spid: string, oid: string): Promise<{grants: string, error: string}>;
     export function requestAdminConsent(admin: User, tct: TenantConfigType): void;
@@ -295,9 +315,7 @@ declare module "@mindline/sync" {
     export function userDelegatedScopesGet(instance: IPublicClientApplication, loggedInUser: User, tenant: Tenant): { scopes: string, id: string, error: string };
     export function userDelegatedScopesRemove(instance: IPublicClientApplication, loggedInUser: User, tenant: Tenant, scope: string): boolean;
     export function usersGet(instance: IPublicClientApplication, user: User | undefined): { users: string[], error: string };
-    //
-    // Mindline Config API
-    //
+    // ======================= Mindline Config API ===============================
     export function configConsentForRead(instance: IPublicClientApplication, authorizedUser: User, configId: string, tid: string, consent: boolean): Promise<APIResult>;
     export function configConsentForWrite(instance: IPublicClientApplication, authorizedUser: User, configId: string, tid: string, consent: boolean): Promise<APIResult>;
     export function configEdit(
@@ -317,4 +335,7 @@ declare module "@mindline/sync" {
     export function userAdd(instance: IPublicClientApplication, authorizedUser: User, user: User, workspaceId: string): APIResult;
     export function userRemove(instance: IPublicClientApplication, authorizedUser: User, user: User, workspaceId: string): APIResult;
     export function workspaceEdit(instance: IPublicClientApplication, authorizedUser: User, workspaceId: string, workspaceName: string): Promise<APIResult>;
+    // ======================= Azure REST API ===============================
+    export function canListRootAssignments(instance: IPublicClientApplication, user: User): Promise<boolean>;
+    export function elevateGlobalAdminToUserAccessAdmin(instance: IPublicClientApplication, user: User): Promise<boolean>;
 }

package/index.ts

@@ -1,8 +1,9 @@
 //index.ts - published interface - AAD implementations, facade to Mindline Config API
 import * as signalR from "@microsoft/signalr"
+import { AccountInfo } from "@azure/msal-common";
 import { IPublicClientApplication, AuthenticationResult } from "@azure/msal-browser"
 import { deserializeArray } from 'class-transformer';
-import { defineHeaders, adminDelete, adminPost, adminsGet, configConsentReadPut, configConsentWritePut, configDelete, configsGet, configPost, configPut, initPost, readerPost, tenantPost, tenantDelete, tenantsGet, workspacePut, workspacesGet } from './hybridspa';
+import { processErrors, adminDelete, adminPost, adminsGet, configConsentReadPut, configConsentWritePut, configDelete, configsGet, configPost, configPut, initPost, readerPost, tenantPost, tenantDelete, tenantsGet, workspacePut, workspacesGet } from './hybridspa';
 import { version } from './package.json';
 import users from "./users.json";
 import tenants from "./tenants.json";
@@ -11,6 +12,7 @@ import workspaces from "./workspaces.json";
 import tasksData from "./tasks";
 import syncmilestones from './syncmilestones';
 import resources from './resources';
+import actors from './actors';
 import { log } from "console";
 const FILTER_FIELD = "workspaceIDs";
 // called by unit tests
@@ -29,6 +31,11 @@ export class APIResult {
     array: Array<Object> | null;
     constructor() { this.result = true; this.status = 200; this.error = ""; this.version = version; this.array = null; }
 }
+export class azureConfig {
+    // azure graph REST API endpoints
+    static azureElevateAccess: string = "https://management.azure.com/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01";
+    static azureListRootAssignments: string = "https://management.azure.com/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&$filter=principalId+eq+";
+};
 export class mindlineConfig {
     static environmentTag: string = "dev";
     // config API endpoints
@@ -120,7 +127,9 @@ export class User {
     workspaceIDs: string;
     session: string;  // button text
     spacode: string;  // to get front end access token
-    accessToken: string; // front end access token
+    graphAccessToken: string; // front end graph access token
+    mindlineAccessToken: string; // front end mindline access token
+    azureAccessToken: string; // front end azure access token
     loginHint: string; // to help sign out without prompt
     scopes: string[]; // to detect if incremental consent has happened
     authTS: Date; // timestamp user was authenticated
@@ -137,7 +146,9 @@ export class User {
         this.workspaceIDs = "";
         this.session = "Sign In";
         this.spacode = "";
-        this.accessToken = "";
+        this.graphAccessToken = "";
+        this.mindlineAccessToken = "";
+        this.azureAccessToken = "";
         this.loginHint = "";
         this.scopes = new Array();
         this.authTS = new Date(0);
@@ -425,7 +436,7 @@ export class InitInfo {
                 newuser.workspaceIDs = user.workspaceIDs;
                 newuser.session = user.session;
                 newuser.spacode = user.spacode;
-                newuser.accessToken = user.accessToken;
+                newuser.graphAccessToken = user.graphAccessToken;
                 newuser.loginHint = user.loginHint;
                 newuser.scopes = user.scopes;
                 newuser.authTS = new Date(user.authTS);
@@ -1231,36 +1242,53 @@ export class TenantNode {
 }
 export class ResourceArray {
     resourceNodes: ResourceNode[];
-    constructor(bClearLocalStorage: boolean) {
+    constructor(bInitialize: boolean, bClearLocalStorage: boolean) {
         this.resourceNodes = new Array<ResourceNode>();
-        this.init(bClearLocalStorage);
+        if (bInitialize) {
+            this.init(bClearLocalStorage);
+        }
     }
-    // get initial data from localStorage or file
+    // get resource data from localStorage or file
     init(bClearLocalStorage: boolean): void {
         console.log(`Calling ResourceArray::init(bClearLocalStorage: ${bClearLocalStorage ? "true" : "false"})`);
         // if we have a non-empty string value stored, read it from localStorage
         if (storageAvailable("localStorage")) {
-            let result = localStorage.getItem("RBAC");
+            let result = localStorage.getItem("ResourceArray");
             if (result != null && typeof result === "string" && result !== "") {
                 if (bClearLocalStorage) {
-                    localStorage.removeItem("RBAC");
+                    localStorage.removeItem("ResourceArray");
                 }
                 else {
-                    let resourceArrayString: string = result;
-                    let raFromLocalStorage: ResourceArray = JSON.parse(resourceArrayString);
-                    this.resourceNodes = raFromLocalStorage.resourceNodes;
+                    // read entire object from localstorage
+                    let raString: string = result;
+                    let resourceArray: ResourceArray = JSON.parse(raString);
+                    this.resourceNodes = resourceArray.resourceNodes;
                     return;
                 }
             }
         }
-        // if storage unavailable or we were just asked to clear, read defaults to enable usable UI
-        var resourcesString = JSON.stringify(resources);
+        // if storage unavailable or we were just asked to clear, read resources from file
+        var resourceNodesString = JSON.stringify(resources);
         try {
-            this.resourceNodes = deserializeArray(ResourceNode, resourcesString);
+            this.resourceNodes = deserializeArray(ResourceNode, resourceNodesString);
         } catch (e) {
             debugger;
         }
     }
+    // read
+    async read(instance: IPublicClientApplication, user: User): Promise<ResourceArray> {
+        let resources: ResourceArray = new ResourceArray(false, false);
+        resources.resourceNodes = await readResources(instance, user);
+        return resources;
+    }
+    // save resource data to localstorage
+    save(): void {
+        // if we have localStorage, save resources
+        if (storageAvailable("localStorage")) {
+            let raString: string = JSON.stringify(this);
+            localStorage.setItem("ResourceArray", raString);
+        }
+    }
 }
 export class ResourceNode {
     type: string;
@@ -1276,14 +1304,89 @@ export class ResourceNode {
         this.resources = new Array<ResourceNode>();
     }
 }
+export class ActorArray {
+    actorNodes: ActorNode[];
+    constructor(bClearLocalStorage: boolean) {
+        this.actorNodes = new Array<ActorNode>();
+        this.init(bClearLocalStorage);
+    }
+    // get initial data from localStorage or file
+    init(bClearLocalStorage: boolean): void {
+        console.log(`Calling ResourceArray::init(bClearLocalStorage: ${bClearLocalStorage ? "true" : "false"})`);
+        // if we have a non-empty string value stored, read it from localStorage
+        if (storageAvailable("localStorage")) {
+            let result = localStorage.getItem("RBACActors");
+            if (result != null && typeof result === "string" && result !== "") {
+                if (bClearLocalStorage) {
+                    localStorage.removeItem("RBACActors");
+                }
+                else {
+                    let actorArrayString: string = result;
+                    let aaFromLocalStorage: ActorArray = JSON.parse(actorArrayString);
+                    this.actorNodes = aaFromLocalStorage.actorNodes;
+                    return;
+                }
+            }
+        }
+        // if storage unavailable or we were just asked to clear, read defaults to enable usable UI
+        var actorsString = JSON.stringify(actors);
+        try {
+            this.actorNodes = deserializeArray(ActorNode, actorsString);
+        } catch (e) {
+            debugger;
+        }
+    }
+}
+export class ActorNode {
+    type: string;
+    actor: string;
+    resource: string;
+    role: string;
+    updatedby: string;
+    updatedon: string;
+    actors: ActorNode[];
+    constructor(type: string, actor: string, resource: string, role: string, updatedby: string, updatedon: string) {
+        this.type = type;
+        this.actor = resource;
+        this.resource = resource;
+        this.role = role;
+        this.updatedby = updatedby;
+        this.updatedon = updatedon;
+        this.actors = new Array<ActorNode>();
+    }
+}
 // ======================= Azure AD Graph API ===============================
+// TODO: this is where you want to trigger a re-authentication if token expires
+async function graphDefineHeaders(
+    instance: IPublicClientApplication,
+    user: User
+): Promise<Headers> {
+    const headers = new Headers();
+    headers.append("Content-Type", "application/json");
+    headers.append("accept", "*/*");
+    // authorization header - if needed, retrieve and cache access token
+    if (user.graphAccessToken == null || user.graphAccessToken === "") {
+        try {
+            let response: AuthenticationResult = await instance.acquireTokenByCode({
+                code: user.spacode,
+            });
+            user.graphAccessToken = response.accessToken; // cache access token
+            console.log("Front end token acquired: " + user.graphAccessToken.slice(0, 20));
+        }
+        catch (error: any) {
+            console.log("Front end token failure: " + error);
+        }
+    }
+    headers.append("Authorization", `Bearer ${user.graphAccessToken}`);
+    return headers;
+}
 export async function groupsGet(instance: IPublicClientApplication, user: User | undefined, groupSearchString: string): Promise<{ groups: Group[], error: string }> {
     // need a logged in user to get graph users
     if (user == null || user.spacode == "") {
         return { groups: [], error: `500: invalid user passed to groupsGet` };
     }
     // create headers
-    const headers = await defineHeaders(instance, user);
+    const headers = await graphDefineHeaders(instance, user);
     let options = { method: "GET", headers: headers };
     // make /groups endpoint call
     try {
@@ -1334,7 +1437,7 @@ export async function oauth2PermissionGrantsSet(instance: IPublicClientApplicati
         let grantsurl: string = getGraphEndpoint(loggedInUser.authority);
         grantsurl += graphConfig.graphOauth2PermissionGrantsPredicate + `/${id}`;
         let scopesBody: string = `{ "scope": "${scopes}" }`;
-        const headers = await defineHeaders(instance, loggedInUser);
+        const headers = await graphDefineHeaders(instance, loggedInUser);
         let options: RequestInit = { method: "PATCH", headers: headers, body: scopesBody };
         let response = await fetch(grantsurl, options);
         if (response.status == 204 && response.statusText == "No Content") {
@@ -1520,12 +1623,12 @@ export async function tenantRelationshipsGetByDomain(loggedInUser: User, tenant:
     // do we already have a valid tenant name? if so, nothing to add
     if (tenant.name != null && tenant.name !== "") return false;
     // if needed, retrieve and cache access token
-    if (loggedInUser.accessToken != null && loggedInUser.accessToken === "") {
+    if (loggedInUser.graphAccessToken != null && loggedInUser.graphAccessToken === "") {
         console.log(`tenantRelationshipsGetByDomain called with invalid logged in user: ${loggedInUser.name}`);
         try {
-            let response: AuthenticationResult = await instance.acquireTokenByCode({ code: loggedInUser.spacode });
-            loggedInUser.accessToken = response.accessToken; // cache access token on the user
-            console.log("tenantRelationshipsGetByDomain: Front end token acquired: " + loggedInUser.accessToken.slice(0, 20));
+            let response: AuthenticationResult = await instance.acquireTokenByCode({ code: loggedInUser.spacode, scopes: ["user.read", "contacts.read", "CrossTenantInformation.ReadBasic.All"] });
+            loggedInUser.graphAccessToken = response.accessToken; // cache access token on the user
+            console.log("tenantRelationshipsGetByDomain: Front end token acquired: " + loggedInUser.graphAccessToken.slice(0, 20));
         }
         catch (error: any) {
             console.log("tenantRelationshipsGetByDomain: Front end token failure: " + error);
@@ -1534,7 +1637,7 @@ export async function tenantRelationshipsGetByDomain(loggedInUser: User, tenant:
     }
     // prepare Authorization headers as part of options
     const headers = new Headers();
-    const bearer = `Bearer ${loggedInUser.accessToken}`;
+    const bearer = `Bearer ${loggedInUser.graphAccessToken}`;
     headers.append("Authorization", bearer);
     let options = { method: "GET", headers: headers };
     // make tenant endpoint call
@@ -1578,11 +1681,11 @@ export async function tenantRelationshipsGetById(loggedInUser: User, tenant: Ten
     console.log("**** tenantRelationshipsGetById");
     if (debug) debugger;
     // if needed, retrieve and cache access token
-    if (loggedInUser.accessToken === "") {
+    if (loggedInUser.graphAccessToken === "") {
         try {
-            let response: AuthenticationResult = await instance.acquireTokenByCode({ code: loggedInUser.spacode });
-            loggedInUser.accessToken = response.accessToken; // cache access token
-            console.log("tenantRelationshipsGetById: Front end token acquired: " + loggedInUser.accessToken.slice(0, 20));
+            let response: AuthenticationResult = await instance.acquireTokenByCode({ code: loggedInUser.spacode, scopes: ["user.read", "contacts.read", "CrossTenantInformation.ReadBasic.All"] });
+            loggedInUser.graphAccessToken = response.accessToken; // cache access token
+            console.log("tenantRelationshipsGetById: Front end token acquired: " + loggedInUser.graphAccessToken.slice(0, 20));
         }
         catch (error: any) {
             console.log("tenantRelationshipsGetById: Front end token failure: " + error);
@@ -1591,7 +1694,7 @@ export async function tenantRelationshipsGetById(loggedInUser: User, tenant: Ten
     }
     // prepare Authorization headers as part of options
     const headers = new Headers();
-    const bearer = `Bearer ${loggedInUser.accessToken}`;
+    const bearer = `Bearer ${loggedInUser.graphAccessToken}`;
     headers.append("Authorization", bearer);
     let options = { method: "GET", headers: headers };
     // make tenant endpoint call
@@ -1648,7 +1751,7 @@ export async function tenantUnauthenticatedLookup(tenant: Tenant, debug: boolean
             openidEndpoint += "/.well-known/openid-configuration";
             console.log("Attempting GET from openid well-known endpoint: ", openidEndpoint);
             response = await fetch(openidEndpoint);
-            if (response.status == 200 && response.statusText == "OK") {
+            if (response.status == 200) {
                 let data = await response.json();
                 if (data) {
                     // store tenant ID and authority
@@ -1688,7 +1791,7 @@ export async function userDelegatedScopesGet(instance: IPublicClientApplication,
         return { scopes: null, id: null, error: `500: invalid parameter(s) passed to getUserDelegatedScopes` };
     }
     // create headers
-    const headers = await defineHeaders(instance, loggedInUser);
+    const headers = await graphDefineHeaders(instance, loggedInUser);
     let options: RequestInit = { method: "GET", headers: headers };
     try {
         // first, cache Graph resource ID (service principal) for this tenant if we don't have it already
@@ -1744,12 +1847,12 @@ export async function userDelegatedScopesRemove(instance: IPublicClientApplicati
 export async function usersGet(instance: IPublicClientApplication, user: User | undefined): Promise<{ users: string[], error: string }> {
     // need a logged in user to get graph users
     if (user == null || user.spacode == "") {
-        return { users: [], error: `500: invalid user passed to groupsGet` };
+        return { users: [], error: `500: invalid user passed to usersGet` };
     }
     // make /users endpoint call
     try {
         // create headers
-        const headers = await defineHeaders(instance, user);
+        const headers = await graphDefineHeaders(instance, user);
         let options = { method: "GET", headers: headers };
         let usersEndpoint = getGraphEndpoint(user.authority);
         usersEndpoint += graphConfig.graphUsersPredicate;
@@ -1844,7 +1947,8 @@ export async function configsRefresh(instance: IPublicClientApplication, authori
 export async function initGet(instance: IPublicClientApplication, user: User, ii: InitInfo, tasks: TaskArray, debug: boolean): Promise<APIResult> {
     console.log(`>>>>>> initGet`);
     let result: APIResult = new APIResult();
-    if (debug) debugger;
+    if (debug)
+        debugger;
     // lookup authority for this user (the lookup call does it based on domain, but TID works as well to find authority)
     let tenant: Tenant = new Tenant();
     tenant.tid = user.tid;
@@ -2135,4 +2239,146 @@ async function workspaceInfoGet(instance: IPublicClientApplication, user: User,
     result.result = false;
     result.status = 500;
     return result;
+}
+// ======================= Azure REST API ===============================
+// TODO: this is where you want to trigger a re-authentication if token expires
+async function azureDefineHeaders(
+    instance: IPublicClientApplication,
+    user: User
+): Promise<Headers> {
+    const headers = new Headers();
+    headers.append("Content-Type", "application/json");
+    headers.append("accept", "*/*");
+    // authorization header - if needed, retrieve and cache access token
+    if (user.azureAccessToken == null || user.azureAccessToken === "") {
+        try {
+            let accounts: AccountInfo[] = instance.getAllAccounts();
+            let homeAccountId = user.oid + "." + user.tid;
+            let account: AccountInfo = null;
+            for (let i: number = 0; i < accounts.length; i++) {
+                if (accounts[i].homeAccountId == homeAccountId) {
+                    account = accounts[i];
+                }
+            }
+            debugger;
+            let response: AuthenticationResult = await instance.acquireTokenSilent({
+                scopes: ["https://management.azure.com/user_impersonation"],
+                account: account
+            });
+            user.azureAccessToken = response.accessToken; // cache access token
+            console.log("Front end token acquired silently: " + user.azureAccessToken.slice(0, 20));
+        }
+        catch (error: any) {
+            try {
+                console.log("Front end token silent acquisition failure: " + error);
+                // fallback to redirect if silent acquisition fails
+                let accounts: AccountInfo[] = instance.getAllAccounts();
+                let homeAccountId = user.oid + "." + user.tid;
+                let account: AccountInfo = null;
+                for (let i: number = 0; i < accounts.length; i++) {
+                    if (accounts[i].homeAccountId == homeAccountId) {
+                        account = accounts[i];
+                    }
+                }
+                instance.acquireTokenRedirect({
+                    scopes: ["https://management.azure.com/user_impersonation"],
+                    account: account
+                });
+            }
+            catch (error: any) {
+                console.log("Front end token popup acquisition failure: " + error);
+            }
+        }
+    }
+    headers.append("Authorization", `Bearer ${user.azureAccessToken}`);
+    return headers;
+}
+export async function canListRootAssignments(instance: IPublicClientApplication, user: User): Promise<boolean> {
+    // need a logged in user to call Azure REST API
+    if (user == null || user.spacode == "") {
+        return false;
+    }
+    // make Azure REST API call
+    try {
+        // create headers
+        const headers = await azureDefineHeaders(instance, user);
+        let options = { method: "GET", headers: headers };
+        let listrootassignmentsEndpoint: string = azureConfig.azureListRootAssignments;
+        listrootassignmentsEndpoint += "'";
+        listrootassignmentsEndpoint += user.oid;
+        listrootassignmentsEndpoint += "'";
+        let response = await fetch(listrootassignmentsEndpoint, options);
+        if (response.status == 200) {
+            let data = await response.json();
+            debugger;
+            console.log("Successful call to Azure Resource Graph list root assignments");
+        }
+        else {
+            console.log(await processErrors(response));
+            return false;
+        }
+    }
+    catch (error: any) {
+        console.log(error);
+        return false;
+    }
+    return true;
+}
+export async function elevateGlobalAdminToUserAccessAdmin(instance: IPublicClientApplication, user: User): Promise<boolean> {
+    // need a logged in user to call Azure REST API
+    if (user == null || user.spacode == "") {
+        return false;
+    }
+    // make Azure REST API call
+    try {
+        // create headers
+        const headers = await azureDefineHeaders(instance, user);
+        let options = { method: "POST", headers: headers };
+        let elevateaccessEndpoint: string = azureConfig.azureElevateAccess;
+        let response = await fetch(elevateaccessEndpoint, options);
+        if (response.status == 200) {
+            console.log("Successful call to Azure Resource Graph list root assignments");
+        }
+        else {
+            console.log(await processErrors(response));
+            return false;
+        }
+    }
+    catch (error: any) {
+        console.log(error);
+        return false;
+    }
+    return true; 
+}
+async function readResources(instance: IPublicClientApplication, user: User): Promise<ResourceNode[]> {
+    // need a logged in user to call Azure REST API
+    let resources: ResourceNode[] = new Array<ResourceNode>();
+    if (user == null || user.spacode == "") {
+        return resources;
+    }
+    // make Azure REST API call
+    try {
+        // create headers
+        const headers = await azureDefineHeaders(instance, user);
+        let options = { method: "GET", headers: headers };
+        let listrootassignmentsEndpoint: string = azureConfig.azureListRootAssignments;
+        listrootassignmentsEndpoint += "'";
+        listrootassignmentsEndpoint += user.oid;
+        listrootassignmentsEndpoint += "'";
+        let response = await fetch(listrootassignmentsEndpoint, options);
+        if (response.status == 200) {
+            let data = await response.json();
+            debugger;
+            console.log("Successful call to Azure Resource Graph list root assignments");
+        }
+        else {
+            console.log(await processErrors(response));
+            return false;
+        }
+    }
+    catch (error: any) {
+        console.log(error);
+        return false;
+    }
+    return true;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mindline/sync",
   "type": "module",
-  "version": "1.0.74",
+  "version": "1.0.76",
   "types": "index.d.ts",
   "exports": "./index.ts",
   "description": "sync is a node.js package encapsulating javscript classes required for configuring Mindline sync service.",