@pnp/cli-microsoft365 10.0.0-beta.48e9f7d → 10.0.0-beta.558f289

package/dist/m365/viva/commands/engage/engage-community-user-list.js

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+import { globalOptionsZod } from '../../../../Command.js';
+import { zod } from '../../../../utils/zod.js';
+import GraphCommand from '../../../base/GraphCommand.js';
+import commands from '../../commands.js';
+import { validation } from '../../../../utils/validation.js';
+import { vivaEngage } from '../../../../utils/vivaEngage.js';
+import { odata } from '../../../../utils/odata.js';
+const options = globalOptionsZod
+    .extend({
+    communityId: z.string().optional(),
+    communityDisplayName: zod.alias('n', z.string().optional()),
+    entraGroupId: z.string()
+        .refine(name => validation.isValidGuid(name), name => ({
+        message: `'${name}' is not a valid GUID.`
+    })).optional(),
+    role: zod.alias('r', z.enum(['Admin', 'Member']).optional())
+})
+    .strict();
+class VivaEngageCommunityUserListCommand extends GraphCommand {
+    get name() {
+        return commands.ENGAGE_COMMUNITY_USER_LIST;
+    }
+    get description() {
+        return 'Lists all users within a specified Microsoft 365 Viva Engage community';
+    }
+    get schema() {
+        return options;
+    }
+    getRefinedSchema(schema) {
+        return schema
+            .refine(options => [options.communityId, options.communityDisplayName, options.entraGroupId].filter(x => x !== undefined).length === 1, {
+            message: 'Specify either communityId, communityDisplayName, or entraGroupId, but not multiple.'
+        })
+            .refine(options => options.communityId || options.communityDisplayName || options.entraGroupId, {
+            message: 'Specify at least one of communityId, communityDisplayName, or entraGroupId.'
+        });
+    }
+    defaultProperties() {
+        return ['id', 'displayName', 'userPrincipalName', 'roles'];
+    }
+    async commandAction(logger, args) {
+        try {
+            if (this.verbose) {
+                await logger.logToStderr('Getting list of users in community...');
+            }
+            let entraGroupId = args.options.entraGroupId;
+            if (args.options.communityDisplayName) {
+                const community = await vivaEngage.getCommunityByDisplayName(args.options.communityDisplayName, ['groupId']);
+                entraGroupId = community.groupId;
+            }
+            if (args.options.communityId) {
+                const community = await vivaEngage.getCommunityById(args.options.communityId, ['groupId']);
+                entraGroupId = community.groupId;
+            }
+            const requestOptions = {
+                url: `${this.resource}/v1.0/groups/${entraGroupId}/members`,
+                headers: {
+                    accept: 'application/json;odata.metadata=none'
+                },
+                responseType: 'json'
+            };
+            const members = await odata.getAllItems(requestOptions);
+            requestOptions.url = `${this.resource}/v1.0/groups/${entraGroupId}/owners`;
+            const owners = await odata.getAllItems(requestOptions);
+            const extendedMembers = members.map(m => {
+                return {
+                    ...m,
+                    roles: ['Member']
+                };
+            });
+            const extendedOwners = owners.map(o => {
+                return {
+                    ...o,
+                    roles: ['Admin']
+                };
+            });
+            let users = [];
+            if (args.options.role) {
+                if (args.options.role === 'Member') {
+                    users = users.concat(extendedMembers);
+                }
+                if (args.options.role === 'Admin') {
+                    users = users.concat(extendedOwners);
+                }
+            }
+            else {
+                users = extendedOwners.concat(extendedMembers);
+            }
+            await logger.log(users);
+        }
+        catch (err) {
+            this.handleRejectedODataJsonPromise(err);
+        }
+    }
+}
+export default new VivaEngageCommunityUserListCommand();
+//# sourceMappingURL=engage-community-user-list.js.map

package/dist/m365/viva/commands.js

@@ -3,6 +3,8 @@ export default {
     CONNECTIONS_APP_CREATE: `${prefix} connections app create`,
     ENGAGE_COMMUNITY_ADD: `${prefix} engage community add`,
     ENGAGE_COMMUNITY_GET: `${prefix} engage community get`,
+    ENGAGE_COMMUNITY_LIST: `${prefix} engage community list`,
+    ENGAGE_COMMUNITY_USER_LIST: `${prefix} engage community user list`,
     ENGAGE_GROUP_LIST: `${prefix} engage group list`,
     ENGAGE_GROUP_USER_ADD: `${prefix} engage group user add`,
     ENGAGE_GROUP_USER_REMOVE: `${prefix} engage group user remove`,

package/dist/request.js

@@ -4,6 +4,7 @@ import auth, { Auth } from './Auth.js';
 import { app } from './utils/app.js';
 import { formatting } from './utils/formatting.js';
 import { timings } from './cli/timings.js';
+import { timersUtil } from './utils/timersUtil.js';
 class Request {
     set debug(debug) {
         // if the value to set is the same as current value return early to avoid
@@ -125,76 +126,60 @@ class Request {
         options.method = 'HEAD';
         return this.execute(options);
     }
-    execute(options, resolve, reject) {
+    async execute(options) {
         const start = process.hrtime.bigint();
         if (!this._logger) {
-            return Promise.reject('Logger not set on the request object');
+            throw 'Logger not set on the request object';
         }
         this.updateRequestForCloudType(options, auth.connection.cloudType);
-        return new Promise((_resolve, _reject) => {
-            (() => {
-                if (options.headers && options.headers['x-anonymous']) {
-                    return Promise.resolve('');
-                }
-                else {
-                    const url = options.headers && options.headers['x-resource'] ? options.headers['x-resource'] : options.url;
-                    const resource = Auth.getResourceFromUrl(url);
-                    return auth.ensureAccessToken(resource, this._logger, this._debug);
-                }
-            })()
-                .then((accessToken) => {
-                if (options.headers) {
-                    if (options.headers['x-anonymous']) {
-                        delete options.headers['x-anonymous'];
-                    }
-                    if (options.headers['x-resource']) {
-                        delete options.headers['x-resource'];
-                    }
-                    if (accessToken !== '') {
-                        options.headers.authorization = `Bearer ${accessToken}`;
-                    }
-                }
-                const proxyUrl = process.env.HTTP_PROXY || process.env.HTTPS_PROXY;
-                if (proxyUrl) {
-                    options.proxy = this.createProxyConfigFromUrl(proxyUrl);
+        try {
+            let accessToken = '';
+            if (options.headers && options.headers['x-anonymous']) {
+                accessToken = '';
+            }
+            else {
+                const url = options.headers && options.headers['x-resource'] ? options.headers['x-resource'] : options.url;
+                const resource = Auth.getResourceFromUrl(url);
+                accessToken = await auth.ensureAccessToken(resource, this._logger, this._debug);
+            }
+            if (options.headers) {
+                if (options.headers['x-anonymous']) {
+                    delete options.headers['x-anonymous'];
                 }
-                return this.req(options);
-            })
-                .then((res) => {
-                if (resolve) {
-                    resolve((options.responseType === 'stream' || options.fullResponse) ? res : res.data);
+                if (options.headers['x-resource']) {
+                    delete options.headers['x-resource'];
                 }
-                else {
-                    const end = process.hrtime.bigint();
-                    timings.api.push(Number(end - start));
-                    _resolve((options.responseType === 'stream' || options.fullResponse) ? res : res.data);
+                if (accessToken !== '') {
+                    options.headers.authorization = `Bearer ${accessToken}`;
                 }
-            }, async (error) => {
-                if (error && error.response &&
-                    (error.response.status === 429 ||
-                        error.response.status === 503)) {
-                    let retryAfter = parseInt(error.response.headers['retry-after'] || '10');
-                    if (isNaN(retryAfter)) {
-                        retryAfter = 10;
-                    }
-                    if (this._debug) {
-                        await this._logger.log(`Request throttled. Waiting ${retryAfter}sec before retrying...`);
-                    }
-                    // eslint-disable-next-line @typescript-eslint/no-floating-promises
-                    setTimeout(async () => { this.execute(options, resolve || _resolve, reject || _reject); }, retryAfter * 1000);
+            }
+            const proxyUrl = process.env.HTTP_PROXY || process.env.HTTPS_PROXY;
+            if (proxyUrl) {
+                options.proxy = this.createProxyConfigFromUrl(proxyUrl);
+            }
+            const res = await this.req(options);
+            const end = process.hrtime.bigint();
+            timings.api.push(Number(end - start));
+            return options.responseType === 'stream' || options.fullResponse ?
+                res :
+                res.data;
+        }
+        catch (error) {
+            const end = process.hrtime.bigint();
+            timings.api.push(Number(end - start));
+            if (error && error.response && (error.response.status === 429 || error.response.status === 503)) {
+                let retryAfter = parseInt(error.response.headers['retry-after'] || '10');
+                if (isNaN(retryAfter)) {
+                    retryAfter = 10;
                 }
-                else {
-                    if (reject) {
-                        reject(error);
-                    }
-                    else {
-                        const end = process.hrtime.bigint();
-                        timings.api.push(Number(end - start));
-                        _reject(error);
-                    }
+                if (this._debug) {
+                    await this._logger.log(`Request throttled. Waiting ${retryAfter} sec before retrying...`);
                 }
-            });
-        });
+                await timersUtil.setTimeout(retryAfter * 1000);
+                return this.execute(options);
+            }
+            throw error;
+        }
     }
     updateRequestForCloudType(options, cloudType) {
         const url = new URL(options.url);

package/dist/settingsNames.js

@@ -1,6 +1,11 @@
 const settingsNames = {
     authType: 'authType',
     autoOpenLinksInBrowser: 'autoOpenLinksInBrowser',
+    clientId: 'clientId',
+    clientSecret: 'clientSecret',
+    clientCertificateFile: 'clientCertificateFile',
+    clientCertificateBase64Encoded: 'clientCertificateBase64Encoded',
+    clientCertificatePassword: 'clientCertificatePassword',
     copyDeviceCodeToClipboard: 'copyDeviceCodeToClipboard',
     csvEscape: 'csvEscape',
     csvHeader: 'csvHeader',
@@ -16,7 +21,7 @@ const settingsNames = {
     prompt: 'prompt',
     promptListPageSize: 'promptListPageSize',
     showHelpOnFailure: 'showHelpOnFailure',
-    showSpinner: 'showSpinner'
+    tenantId: 'tenantId'
 };
 export { settingsNames };
 //# sourceMappingURL=settingsNames.js.map

package/dist/telemetryRunner.js

@@ -8,7 +8,7 @@ try {
     const data = JSON.parse(input);
     const { commandName, properties, exception, shell, session } = data;
     appInsights.commonProperties.shell = shell;
-    appInsights.context.tags['ai.session.id'] = session;
+    appInsights.context.tags[appInsights.context.keys.sessionId] = session;
     if (exception) {
         appInsights.trackException({
             exception
@@ -20,7 +20,7 @@ try {
             properties
         });
     }
-    appInsights.flush();
+    await appInsights.flush();
 }
 catch { }
 //# sourceMappingURL=telemetryRunner.js.map

package/dist/utils/entraApp.js

@@ -0,0 +1,283 @@
+import fs from 'fs';
+import request from '../request.js';
+import { odata } from './odata.js';
+async function getCertificateBase64Encoded({ options, logger, debug }) {
+    if (options.certificateBase64Encoded) {
+        return options.certificateBase64Encoded;
+    }
+    if (debug) {
+        await logger.logToStderr(`Reading existing ${options.certificateFile}...`);
+    }
+    try {
+        return fs.readFileSync(options.certificateFile, { encoding: 'base64' });
+    }
+    catch (e) {
+        throw new Error(`Error reading certificate file: ${e}. Please add the certificate using base64 option '--certificateBase64Encoded'.`);
+    }
+}
+async function createServicePrincipal(appId) {
+    const requestOptions = {
+        url: `https://graph.microsoft.com/v1.0/myorganization/servicePrincipals`,
+        headers: {
+            'content-type': 'application/json'
+        },
+        data: {
+            appId: appId
+        },
+        responseType: 'json'
+    };
+    return request.post(requestOptions);
+}
+async function grantOAuth2Permission({ appId, resourceId, scopeName }) {
+    const grantAdminConsentApplicationRequestOptions = {
+        url: `https://graph.microsoft.com/v1.0/myorganization/oauth2PermissionGrants`,
+        headers: {
+            accept: 'application/json;odata.metadata=none'
+        },
+        responseType: 'json',
+        data: {
+            clientId: appId,
+            consentType: "AllPrincipals",
+            principalId: null,
+            resourceId: resourceId,
+            scope: scopeName
+        }
+    };
+    return request.post(grantAdminConsentApplicationRequestOptions);
+}
+async function addRoleToServicePrincipal({ objectId, resourceId, appRoleId }) {
+    const requestOptions = {
+        url: `https://graph.microsoft.com/v1.0/myorganization/servicePrincipals/${objectId}/appRoleAssignments`,
+        headers: {
+            'Content-Type': 'application/json'
+        },
+        responseType: 'json',
+        data: {
+            appRoleId: appRoleId,
+            principalId: objectId,
+            resourceId: resourceId
+        }
+    };
+    return request.post(requestOptions);
+}
+async function getRequiredResourceAccessForApis({ servicePrincipals, apis, scopeType, logger, debug }) {
+    if (!apis) {
+        return [];
+    }
+    const resolvedApis = [];
+    const requestedApis = apis.split(',').map(a => a.trim());
+    for (const api of requestedApis) {
+        const pos = api.lastIndexOf('/');
+        const permissionName = api.substring(pos + 1);
+        const servicePrincipalName = api.substring(0, pos);
+        if (debug) {
+            await logger.logToStderr(`Resolving ${api}...`);
+            await logger.logToStderr(`Permission name: ${permissionName}`);
+            await logger.logToStderr(`Service principal name: ${servicePrincipalName}`);
+        }
+        const servicePrincipal = servicePrincipals.find(sp => (sp.servicePrincipalNames.indexOf(servicePrincipalName) > -1 ||
+            sp.servicePrincipalNames.indexOf(`${servicePrincipalName}/`) > -1));
+        if (!servicePrincipal) {
+            throw `Service principal ${servicePrincipalName} not found`;
+        }
+        const scopesOfType = scopeType === 'Scope' ? servicePrincipal.oauth2PermissionScopes : servicePrincipal.appRoles;
+        const permission = scopesOfType.find(scope => scope.value === permissionName);
+        if (!permission) {
+            throw `Permission ${permissionName} for service principal ${servicePrincipalName} not found`;
+        }
+        let resolvedApi = resolvedApis.find(a => a.resourceAppId === servicePrincipal.appId);
+        if (!resolvedApi) {
+            resolvedApi = {
+                resourceAppId: servicePrincipal.appId,
+                resourceAccess: []
+            };
+            resolvedApis.push(resolvedApi);
+        }
+        const resourceAccessPermission = {
+            id: permission.id,
+            type: scopeType
+        };
+        resolvedApi.resourceAccess.push(resourceAccessPermission);
+        updateAppPermissions({
+            spId: servicePrincipal.id,
+            resourceAccessPermission,
+            oAuth2PermissionValue: permission.value
+        });
+    }
+    return resolvedApis;
+}
+function updateAppPermissions({ spId, resourceAccessPermission, oAuth2PermissionValue }) {
+    // During API resolution, we store globally both app role assignments and oauth2permissions
+    // So that we'll be able to parse them during the admin consent process
+    let existingPermission = entraApp.appPermissions.find(oauth => oauth.resourceId === spId);
+    if (!existingPermission) {
+        existingPermission = {
+            resourceId: spId,
+            resourceAccess: [],
+            scope: []
+        };
+        entraApp.appPermissions.push(existingPermission);
+    }
+    if (resourceAccessPermission.type === 'Scope' && oAuth2PermissionValue && !existingPermission.scope.find(scp => scp === oAuth2PermissionValue)) {
+        existingPermission.scope.push(oAuth2PermissionValue);
+    }
+    if (!existingPermission.resourceAccess.find(res => res.id === resourceAccessPermission.id)) {
+        existingPermission.resourceAccess.push(resourceAccessPermission);
+    }
+}
+export const entraApp = {
+    appPermissions: [],
+    createAppRegistration: async ({ options, apis, logger, verbose, debug }) => {
+        const applicationInfo = {
+            displayName: options.name,
+            signInAudience: options.multitenant ? 'AzureADMultipleOrgs' : 'AzureADMyOrg'
+        };
+        if (apis.length > 0) {
+            applicationInfo.requiredResourceAccess = apis;
+        }
+        if (options.redirectUris) {
+            applicationInfo[options.platform] = {
+                redirectUris: options.redirectUris.split(',').map(u => u.trim())
+            };
+        }
+        if (options.implicitFlow) {
+            if (!applicationInfo.web) {
+                applicationInfo.web = {};
+            }
+            applicationInfo.web.implicitGrantSettings = {
+                enableAccessTokenIssuance: true,
+                enableIdTokenIssuance: true
+            };
+        }
+        if (options.certificateFile || options.certificateBase64Encoded) {
+            const certificateBase64Encoded = await getCertificateBase64Encoded({ options, logger, debug });
+            const newKeyCredential = {
+                type: 'AsymmetricX509Cert',
+                usage: 'Verify',
+                displayName: options.certificateDisplayName,
+                key: certificateBase64Encoded
+            };
+            applicationInfo.keyCredentials = [newKeyCredential];
+        }
+        if (options.allowPublicClientFlows) {
+            applicationInfo.isFallbackPublicClient = true;
+        }
+        if (verbose) {
+            await logger.logToStderr(`Creating Microsoft Entra app registration...`);
+        }
+        const createApplicationRequestOptions = {
+            url: `https://graph.microsoft.com/v1.0/myorganization/applications`,
+            headers: {
+                accept: 'application/json;odata.metadata=none'
+            },
+            responseType: 'json',
+            data: applicationInfo
+        };
+        return request.post(createApplicationRequestOptions);
+    },
+    grantAdminConsent: async ({ appInfo, appPermissions, adminConsent, logger, debug }) => {
+        if (!adminConsent || appPermissions.length === 0) {
+            return appInfo;
+        }
+        const sp = await createServicePrincipal(appInfo.appId);
+        if (debug) {
+            await logger.logToStderr("Service principal created, returned object id: " + sp.id);
+        }
+        const tasks = [];
+        appPermissions.forEach(async (permission) => {
+            if (permission.scope.length > 0) {
+                tasks.push(grantOAuth2Permission({
+                    appId: sp.id,
+                    resourceId: permission.resourceId,
+                    scopeName: permission.scope.join(' ')
+                }));
+                if (debug) {
+                    await logger.logToStderr(`Admin consent granted for following resource ${permission.resourceId}, with delegated permissions: ${permission.scope.join(',')}`);
+                }
+            }
+            permission.resourceAccess.filter(access => access.type === "Role").forEach(async (access) => {
+                tasks.push(addRoleToServicePrincipal({
+                    objectId: sp.id,
+                    resourceId: permission.resourceId,
+                    appRoleId: access.id
+                }));
+                if (debug) {
+                    await logger.logToStderr(`Admin consent granted for following resource ${permission.resourceId}, with application permission: ${access.id}`);
+                }
+            });
+        });
+        await Promise.all(tasks);
+        return appInfo;
+    },
+    resolveApis: async ({ options, manifest, logger, verbose, debug }) => {
+        if (!options.apisDelegated && !options.apisApplication
+            && (typeof manifest?.requiredResourceAccess === 'undefined' || manifest.requiredResourceAccess.length === 0)) {
+            return [];
+        }
+        if (verbose) {
+            await logger.logToStderr('Resolving requested APIs...');
+        }
+        const servicePrincipals = await odata.getAllItems(`https://graph.microsoft.com/v1.0/myorganization/servicePrincipals?$select=appId,appRoles,id,oauth2PermissionScopes,servicePrincipalNames`);
+        let resolvedApis = [];
+        if (options.apisDelegated || options.apisApplication) {
+            resolvedApis = await getRequiredResourceAccessForApis({
+                servicePrincipals,
+                apis: options.apisDelegated,
+                scopeType: 'Scope',
+                logger,
+                debug
+            });
+            if (verbose) {
+                await logger.logToStderr(`Resolved delegated permissions: ${JSON.stringify(resolvedApis, null, 2)}`);
+            }
+            const resolvedApplicationApis = await getRequiredResourceAccessForApis({
+                servicePrincipals,
+                apis: options.apisApplication,
+                scopeType: 'Role',
+                logger,
+                debug
+            });
+            if (verbose) {
+                await logger.logToStderr(`Resolved application permissions: ${JSON.stringify(resolvedApplicationApis, null, 2)}`);
+            }
+            // merge resolved application APIs onto resolved delegated APIs
+            resolvedApplicationApis.forEach(resolvedRequiredResource => {
+                const requiredResource = resolvedApis.find(api => api.resourceAppId === resolvedRequiredResource.resourceAppId);
+                if (requiredResource) {
+                    requiredResource.resourceAccess.push(...resolvedRequiredResource.resourceAccess);
+                }
+                else {
+                    resolvedApis.push(resolvedRequiredResource);
+                }
+            });
+        }
+        else {
+            const manifestApis = manifest.requiredResourceAccess;
+            manifestApis.forEach(manifestApi => {
+                resolvedApis.push(manifestApi);
+                const app = servicePrincipals.find(servicePrincipals => servicePrincipals.appId === manifestApi.resourceAppId);
+                if (app) {
+                    manifestApi.resourceAccess.forEach((res => {
+                        const resourceAccessPermission = {
+                            id: res.id,
+                            type: res.type
+                        };
+                        const oAuthValue = app.oauth2PermissionScopes.find(scp => scp.id === res.id)?.value;
+                        updateAppPermissions({
+                            spId: app.id,
+                            resourceAccessPermission,
+                            oAuth2PermissionValue: oAuthValue
+                        });
+                    }));
+                }
+            });
+        }
+        if (verbose) {
+            await logger.logToStderr(`Merged delegated and application permissions: ${JSON.stringify(resolvedApis, null, 2)}`);
+            await logger.logToStderr(`App role assignments: ${JSON.stringify(entraApp.appPermissions.flatMap(permission => permission.resourceAccess.filter(access => access.type === "Role")), null, 2)}`);
+            await logger.logToStderr(`OAuth2 permissions: ${JSON.stringify(entraApp.appPermissions.flatMap(permission => permission.scope), null, 2)}`);
+        }
+        return resolvedApis;
+    }
+};
+//# sourceMappingURL=entraApp.js.map