@pnp/cli-microsoft365 6.0.0-beta.ff232be → 6.1.0-beta.11542c0

package/dist/m365/aad/commands/app/app-add.js

@@ -8,74 +8,67 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _AadAppAddCommand_instances, _AadAppAddCommand_initTelemetry, _AadAppAddCommand_initOptions, _AadAppAddCommand_initValidators, _AadAppAddCommand_initOptionSets;
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = require("fs");
 const uuid_1 = require("uuid");
 const Auth_1 = require("../../../../Auth");
 const request_1 = require("../../../../request");
-const utils_1 = require("../../../../utils");
+const accessToken_1 = require("../../../../utils/accessToken");
+const odata_1 = require("../../../../utils/odata");
 const GraphCommand_1 = require("../../../base/GraphCommand");
 const commands_1 = require("../../commands");
 class AadAppAddCommand extends GraphCommand_1.default {
-    constructor() {
-        super(...arguments);
-        this.appName = '';
-    }
     get name() {
         return commands_1.default.APP_ADD;
     }
     get description() {
         return 'Creates new Azure AD app registration';
     }
-    getTelemetryProperties(args) {
-        const telemetryProps = super.getTelemetryProperties(args);
-        telemetryProps.apis = typeof args.options.apisDelegated !== 'undefined';
-        telemetryProps.implicitFlow = args.options.implicitFlow;
-        telemetryProps.multitenant = args.options.multitenant;
-        telemetryProps.platform = args.options.platform;
-        telemetryProps.redirectUris = typeof args.options.redirectUris !== 'undefined';
-        telemetryProps.scopeAdminConsentDescription = typeof args.options.scopeAdminConsentDescription !== 'undefined';
-        telemetryProps.scopeAdminConsentDisplayName = typeof args.options.scopeAdminConsentDisplayName !== 'undefined';
-        telemetryProps.scopeName = args.options.scopeConsentBy;
-        telemetryProps.scopeName = typeof args.options.scopeName !== 'undefined';
-        telemetryProps.uri = typeof args.options.uri !== 'undefined';
-        telemetryProps.withSecret = args.options.withSecret;
-        telemetryProps.certificateFile = typeof args.options.certificateFile !== 'undefined';
-        telemetryProps.certificateBase64Encoded = typeof args.options.certificateBase64Encoded !== 'undefined';
-        telemetryProps.certificateDisplayName = typeof args.options.certificateDisplayName !== 'undefined';
-        return telemetryProps;
+    constructor() {
+        super();
+        _AadAppAddCommand_instances.add(this);
+        this.appName = '';
+        this.appPermissions = [];
+        __classPrivateFieldGet(this, _AadAppAddCommand_instances, "m", _AadAppAddCommand_initTelemetry).call(this);
+        __classPrivateFieldGet(this, _AadAppAddCommand_instances, "m", _AadAppAddCommand_initOptions).call(this);
+        __classPrivateFieldGet(this, _AadAppAddCommand_instances, "m", _AadAppAddCommand_initValidators).call(this);
+        __classPrivateFieldGet(this, _AadAppAddCommand_instances, "m", _AadAppAddCommand_initOptionSets).call(this);
     }
-    commandAction(logger, args, cb) {
-        this
-            .resolveApis(args, logger)
-            .then(apis => this.createAppRegistration(args, apis, logger))
-            .then(appInfo => {
-            // based on the assumption that we're adding AAD app to the current
-            // directory. If we in the future extend the command with allowing
-            // users to create AAD app in a different directory, we'll need to
-            // adjust this
-            appInfo.tenantId = utils_1.accessToken.getTenantIdFromAccessToken(Auth_1.default.service.accessTokens[Auth_1.default.defaultResource].accessToken);
-            return Promise.resolve(appInfo);
-        })
-            .then(appInfo => this.updateAppFromManifest(args, appInfo))
-            .then(appInfo => this.configureUri(args, appInfo, logger))
-            .then(appInfo => this.configureSecret(args, appInfo, logger))
-            .then(appInfo => this.saveAppInfo(args, appInfo, logger))
-            .then((_appInfo) => {
-            const appInfo = {
-                appId: _appInfo.appId,
-                objectId: _appInfo.id,
-                tenantId: _appInfo.tenantId
-            };
-            if (_appInfo.secret) {
-                appInfo.secret = _appInfo.secret;
+    commandAction(logger, args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const apis = yield this.resolveApis(args, logger);
+                let appInfo = yield this.createAppRegistration(args, apis, logger);
+                // based on the assumption that we're adding AAD app to the current
+                // directory. If we in the future extend the command with allowing
+                // users to create AAD app in a different directory, we'll need to
+                // adjust this
+                appInfo.tenantId = accessToken_1.accessToken.getTenantIdFromAccessToken(Auth_1.default.service.accessTokens[Auth_1.default.defaultResource].accessToken);
+                appInfo = yield this.updateAppFromManifest(args, appInfo);
+                appInfo = yield this.grantAdminConsent(appInfo, args.options.grantAdminConsent, logger);
+                appInfo = yield this.configureUri(args, appInfo, logger);
+                appInfo = yield this.configureSecret(args, appInfo, logger);
+                const _appInfo = yield this.saveAppInfo(args, appInfo, logger);
+                appInfo = {
+                    appId: _appInfo.appId,
+                    objectId: _appInfo.id,
+                    tenantId: _appInfo.tenantId
+                };
+                if (_appInfo.secrets) {
+                    appInfo.secrets = _appInfo.secrets;
+                }
+                logger.log(appInfo);
             }
-            if (_appInfo.secrets) {
-                appInfo.secrets = _appInfo.secrets;
+            catch (err) {
+                this.handleRejectedODataJsonPromise(err);
             }
-            logger.log(appInfo);
-            cb();
-        }, (rawRes) => this.handleRejectedODataJsonPromise(rawRes, logger, cb));
+        });
     }
     createAppRegistration(args, apis, logger) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -128,6 +121,81 @@ class AadAppAddCommand extends GraphCommand_1.default {
             return request_1.default.post(createApplicationRequestOptions);
         });
     }
+    grantAdminConsent(appInfo, adminConsent, logger) {
+        if (!adminConsent || this.appPermissions.length === 0) {
+            return Promise.resolve(appInfo);
+        }
+        return this.createServicePrincipal(appInfo.appId)
+            .then((sp) => {
+            if (this.debug) {
+                logger.logToStderr("Service principal created, returned object id: " + sp.id);
+            }
+            const tasks = [];
+            this.appPermissions.forEach(permission => {
+                if (permission.scope.length > 0) {
+                    tasks.push(this.grantOAuth2Permission(sp.id, permission.resourceId, permission.scope.join(' ')));
+                    if (this.debug) {
+                        logger.logToStderr(`Admin consent granted for following resource ${permission.resourceId}, with delegated permissions: ${permission.scope.join(',')}`);
+                    }
+                }
+                permission.resourceAccess.filter(access => access.type === "Role").forEach((access) => {
+                    tasks.push(this.addRoleToServicePrincipal(sp.id, permission.resourceId, access.id));
+                    if (this.debug) {
+                        logger.logToStderr(`Admin consent granted for following resource ${permission.resourceId}, with application permission: ${access.id}`);
+                    }
+                });
+            });
+            return Promise.all(tasks)
+                .then(_ => {
+                return appInfo;
+            });
+        });
+    }
+    addRoleToServicePrincipal(objectId, resourceId, appRoleId) {
+        const requestOptions = {
+            url: `${this.resource}/v1.0/myorganization/servicePrincipals/${objectId}/appRoleAssignments`,
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            responseType: 'json',
+            data: {
+                appRoleId: appRoleId,
+                principalId: objectId,
+                resourceId: resourceId
+            }
+        };
+        return request_1.default.post(requestOptions);
+    }
+    grantOAuth2Permission(appId, resourceId, scopeName) {
+        const grantAdminConsentApplicationRequestOptions = {
+            url: `${this.resource}/v1.0/myorganization/oauth2PermissionGrants`,
+            headers: {
+                accept: 'application/json;odata.metadata=none'
+            },
+            responseType: 'json',
+            data: {
+                clientId: appId,
+                consentType: "AllPrincipals",
+                principalId: null,
+                resourceId: resourceId,
+                scope: scopeName
+            }
+        };
+        return request_1.default.post(grantAdminConsentApplicationRequestOptions);
+    }
+    createServicePrincipal(appId) {
+        const requestOptions = {
+            url: `${this.resource}/v1.0/myorganization/servicePrincipals`,
+            headers: {
+                'content-type': 'application/json'
+            },
+            data: {
+                appId: appId
+            },
+            responseType: 'json'
+        };
+        return request_1.default.post(requestOptions);
+    }
     updateAppFromManifest(args, appInfo) {
         if (!args.options.manifest) {
             return Promise.resolve(appInfo);
@@ -139,10 +207,40 @@ class AadAppAddCommand extends GraphCommand_1.default {
         delete v2Manifest.appId;
         delete v2Manifest.publisherDomain;
         // extract secrets from the manifest. Store them in a separate variable
-        // and remove them from the manifest because we need to create them
-        // separately
         const secrets = this.getSecretsFromManifest(v2Manifest);
         // Azure Portal returns v2 manifest whereas the Graph API expects a v1.6
+        if (args.options.apisApplication || args.options.apisDelegated) {
+            // take submitted delegated / application permissions as options
+            // otherwise, they will be skipped in the app update
+            v2Manifest.requiredResourceAccess = appInfo.requiredResourceAccess;
+        }
+        if (args.options.redirectUris) {
+            // take submitted redirectUris/platform as options
+            // otherwise, they will be removed from the app
+            v2Manifest.replyUrlsWithType = args.options.redirectUris.split(',').map(u => {
+                return {
+                    url: u.trim(),
+                    type: this.translatePlatformToType(args.options.platform)
+                };
+            });
+        }
+        if (args.options.multitenant) {
+            // override manifest setting when using multitenant flag
+            v2Manifest.signInAudience = 'AzureADMultipleOrgs';
+        }
+        if (args.options.implicitFlow) {
+            // remove manifest settings when using implicitFlow flag
+            delete v2Manifest.oauth2AllowIdTokenImplicitFlow;
+            delete v2Manifest.oauth2AllowImplicitFlow;
+        }
+        if (args.options.scopeName) {
+            // override manifest setting when using options.
+            delete v2Manifest.oauth2Permissions;
+        }
+        if (args.options.certificateFile || args.options.certificateBase64Encoded) {
+            // override manifest setting when using options.
+            delete v2Manifest.keyCredentials;
+        }
         const graphManifest = this.transformManifest(v2Manifest);
         const updateAppRequestOptions = {
             url: `${this.resource}/v1.0/myorganization/applications/${appInfo.id}`,
@@ -342,36 +440,61 @@ class AadAppAddCommand extends GraphCommand_1.default {
             .then(_ => appInfo);
     }
     resolveApis(args, logger) {
-        if (!args.options.apisDelegated && !args.options.apisApplication) {
+        var _a;
+        if (!args.options.apisDelegated && !args.options.apisApplication
+            && (typeof ((_a = this.manifest) === null || _a === void 0 ? void 0 : _a.requiredResourceAccess) === 'undefined' || this.manifest.requiredResourceAccess.length === 0)) {
             return Promise.resolve([]);
         }
         if (this.verbose) {
             logger.logToStderr('Resolving requested APIs...');
         }
-        return utils_1.odata
-            .getAllItems(`${this.resource}/v1.0/myorganization/servicePrincipals?$select=servicePrincipalNames,appId,oauth2PermissionScopes,appRoles`)
+        return odata_1.odata
+            .getAllItems(`${this.resource}/v1.0/myorganization/servicePrincipals?$select=appId,appRoles,id,oauth2PermissionScopes,servicePrincipalNames`)
             .then(servicePrincipals => {
+            let resolvedApis = [];
             try {
-                const resolvedApis = this.getRequiredResourceAccessForApis(servicePrincipals, args.options.apisDelegated, 'Scope', logger);
-                if (this.debug) {
-                    logger.logToStderr(`Resolved delegated permissions: ${JSON.stringify(resolvedApis, null, 2)}`);
-                }
-                const resolvedApplicationApis = this.getRequiredResourceAccessForApis(servicePrincipals, args.options.apisApplication, 'Role', logger);
-                if (this.debug) {
-                    logger.logToStderr(`Resolved application permissions: ${JSON.stringify(resolvedApplicationApis, null, 2)}`);
-                }
-                // merge resolved application APIs onto resolved delegated APIs
-                resolvedApplicationApis.forEach(resolvedRequiredResource => {
-                    const requiredResource = resolvedApis.find(api => api.resourceAppId === resolvedRequiredResource.resourceAppId);
-                    if (requiredResource) {
-                        requiredResource.resourceAccess.push(...resolvedRequiredResource.resourceAccess);
+                if (args.options.apisDelegated || args.options.apisApplication) {
+                    resolvedApis = this.getRequiredResourceAccessForApis(servicePrincipals, args.options.apisDelegated, 'Scope', logger);
+                    if (this.verbose) {
+                        logger.logToStderr(`Resolved delegated permissions: ${JSON.stringify(resolvedApis, null, 2)}`);
                     }
-                    else {
-                        resolvedApis.push(resolvedRequiredResource);
+                    const resolvedApplicationApis = this.getRequiredResourceAccessForApis(servicePrincipals, args.options.apisApplication, 'Role', logger);
+                    if (this.verbose) {
+                        logger.logToStderr(`Resolved application permissions: ${JSON.stringify(resolvedApplicationApis, null, 2)}`);
                     }
-                });
-                if (this.debug) {
+                    // merge resolved application APIs onto resolved delegated APIs
+                    resolvedApplicationApis.forEach(resolvedRequiredResource => {
+                        const requiredResource = resolvedApis.find(api => api.resourceAppId === resolvedRequiredResource.resourceAppId);
+                        if (requiredResource) {
+                            requiredResource.resourceAccess.push(...resolvedRequiredResource.resourceAccess);
+                        }
+                        else {
+                            resolvedApis.push(resolvedRequiredResource);
+                        }
+                    });
+                }
+                else {
+                    const manifestApis = this.manifest.requiredResourceAccess;
+                    manifestApis.forEach(manifestApi => {
+                        resolvedApis.push(manifestApi);
+                        const app = servicePrincipals.find(servicePrincipals => servicePrincipals.appId === manifestApi.resourceAppId);
+                        if (app) {
+                            manifestApi.resourceAccess.forEach((res => {
+                                var _a;
+                                const resourceAccessPermission = {
+                                    id: res.id,
+                                    type: res.type
+                                };
+                                const oAuthValue = (_a = app.oauth2PermissionScopes.find(scp => scp.id === res.id)) === null || _a === void 0 ? void 0 : _a.value;
+                                this.updateAppPermissions(app.id, resourceAccessPermission, oAuthValue);
+                            }));
+                        }
+                    });
+                }
+                if (this.verbose) {
                     logger.logToStderr(`Merged delegated and application permissions: ${JSON.stringify(resolvedApis, null, 2)}`);
+                    logger.logToStderr(`App role assignments: ${JSON.stringify(this.appPermissions.flatMap(permission => permission.resourceAccess.filter(access => access.type === "Role")), null, 2)}`);
+                    logger.logToStderr(`OAuth2 permissions: ${JSON.stringify(this.appPermissions.flatMap(permission => permission.scope), null, 2)}`);
                 }
                 return Promise.resolve(resolvedApis);
             }
@@ -413,15 +536,36 @@ class AadAppAddCommand extends GraphCommand_1.default {
                 };
                 resolvedApis.push(resolvedApi);
             }
-            resolvedApi.resourceAccess.push({
+            const resourceAccessPermission = {
                 id: permission.id,
                 type: scopeType
-            });
+            };
+            resolvedApi.resourceAccess.push(resourceAccessPermission);
+            this.updateAppPermissions(servicePrincipal.id, resourceAccessPermission, permission.value);
         });
         return resolvedApis;
     }
+    updateAppPermissions(spId, resourceAccessPermission, oAuth2PermissionValue) {
+        // During API resolution, we store globally both app role assignments and oauth2permissions
+        // So that we'll be able to parse them during the admin consent process
+        let existingPermission = this.appPermissions.find(oauth => oauth.resourceId === spId);
+        if (!existingPermission) {
+            existingPermission = {
+                resourceId: spId,
+                resourceAccess: [],
+                scope: []
+            };
+            this.appPermissions.push(existingPermission);
+        }
+        if (resourceAccessPermission.type === 'Scope' && oAuth2PermissionValue && !existingPermission.scope.find(scp => scp === oAuth2PermissionValue)) {
+            existingPermission.scope.push(oAuth2PermissionValue);
+        }
+        if (!existingPermission.resourceAccess.find(res => res.id === resourceAccessPermission.id)) {
+            existingPermission.resourceAccess.push(resourceAccessPermission);
+        }
+    }
     configureSecret(args, appInfo, logger) {
-        if (!args.options.withSecret) {
+        if (!args.options.withSecret || (appInfo.secrets && appInfo.secrets.length > 0)) {
             return Promise.resolve(appInfo);
         }
         if (this.verbose) {
@@ -430,7 +574,10 @@ class AadAppAddCommand extends GraphCommand_1.default {
         return this
             .createSecret({ appObjectId: appInfo.id })
             .then(secret => {
-            appInfo.secret = secret.value;
+            if (!appInfo.secrets) {
+                appInfo.secrets = [];
+            }
+            appInfo.secrets.push(secret);
             return Promise.resolve(appInfo);
         });
     }
@@ -514,72 +661,77 @@ class AadAppAddCommand extends GraphCommand_1.default {
         }
         return Promise.resolve(appInfo);
     }
-    options() {
-        const options = [
-            {
-                option: '-n, --name [name]'
-            },
-            {
-                option: '--multitenant'
-            },
-            {
-                option: '-r, --redirectUris [redirectUris]'
-            },
-            {
-                option: '-p, --platform [platform]',
-                autocomplete: AadAppAddCommand.aadApplicationPlatform
-            },
-            {
-                option: '--implicitFlow'
-            },
-            {
-                option: '-s, --withSecret'
-            },
-            {
-                option: '--apisDelegated [apisDelegated]'
-            },
-            {
-                option: '--apisApplication [apisApplication]'
-            },
-            {
-                option: '-u, --uri [uri]'
-            },
-            {
-                option: '--scopeName [scopeName]'
-            },
-            {
-                option: '--scopeConsentBy [scopeConsentBy]',
-                autocomplete: AadAppAddCommand.aadAppScopeConsentBy
-            },
-            {
-                option: '--scopeAdminConsentDisplayName [scopeAdminConsentDisplayName]'
-            },
-            {
-                option: '--scopeAdminConsentDescription [scopeAdminConsentDescription]'
-            },
-            {
-                option: '--certificateFile [certificateFile]'
-            },
-            {
-                option: '--certificateBase64Encoded [certificateBase64Encoded]'
-            },
-            {
-                option: '--certificateDisplayName [certificateDisplayName]'
-            },
-            {
-                option: '--manifest [manifest]'
-            },
-            {
-                option: '--save'
-            }
-        ];
-        const parentOptions = super.options();
-        return options.concat(parentOptions);
-    }
-    validate(args) {
-        if (!args.options.manifest && !args.options.name) {
-            return 'Specify either the name of the app to create or the manifest';
+    translatePlatformToType(platform) {
+        if (platform === 'publicClient') {
+            return 'InstalledClient';
         }
+        return platform.charAt(0).toUpperCase() + platform.substring(1);
+    }
+}
+_AadAppAddCommand_instances = new WeakSet(), _AadAppAddCommand_initTelemetry = function _AadAppAddCommand_initTelemetry() {
+    this.telemetry.push((args) => {
+        Object.assign(this.telemetryProperties, {
+            apis: typeof args.options.apisDelegated !== 'undefined',
+            implicitFlow: args.options.implicitFlow,
+            multitenant: args.options.multitenant,
+            platform: args.options.platform,
+            redirectUris: typeof args.options.redirectUris !== 'undefined',
+            scopeAdminConsentDescription: typeof args.options.scopeAdminConsentDescription !== 'undefined',
+            scopeAdminConsentDisplayName: typeof args.options.scopeAdminConsentDisplayName !== 'undefined',
+            scopeConsentBy: args.options.scopeConsentBy,
+            scopeName: typeof args.options.scopeName !== 'undefined',
+            uri: typeof args.options.uri !== 'undefined',
+            withSecret: args.options.withSecret,
+            certificateFile: typeof args.options.certificateFile !== 'undefined',
+            certificateBase64Encoded: typeof args.options.certificateBase64Encoded !== 'undefined',
+            certificateDisplayName: typeof args.options.certificateDisplayName !== 'undefined',
+            grantAdminConsent: typeof args.options.grantAdminConsent !== 'undefined'
+        });
+    });
+}, _AadAppAddCommand_initOptions = function _AadAppAddCommand_initOptions() {
+    this.options.unshift({
+        option: '-n, --name [name]'
+    }, {
+        option: '--multitenant'
+    }, {
+        option: '-r, --redirectUris [redirectUris]'
+    }, {
+        option: '-p, --platform [platform]',
+        autocomplete: AadAppAddCommand.aadApplicationPlatform
+    }, {
+        option: '--implicitFlow'
+    }, {
+        option: '-s, --withSecret'
+    }, {
+        option: '--apisDelegated [apisDelegated]'
+    }, {
+        option: '--apisApplication [apisApplication]'
+    }, {
+        option: '-u, --uri [uri]'
+    }, {
+        option: '--scopeName [scopeName]'
+    }, {
+        option: '--scopeConsentBy [scopeConsentBy]',
+        autocomplete: AadAppAddCommand.aadAppScopeConsentBy
+    }, {
+        option: '--scopeAdminConsentDisplayName [scopeAdminConsentDisplayName]'
+    }, {
+        option: '--scopeAdminConsentDescription [scopeAdminConsentDescription]'
+    }, {
+        option: '--certificateFile [certificateFile]'
+    }, {
+        option: '--certificateBase64Encoded [certificateBase64Encoded]'
+    }, {
+        option: '--certificateDisplayName [certificateDisplayName]'
+    }, {
+        option: '--manifest [manifest]'
+    }, {
+        option: '--save'
+    }, {
+        option: '--grantAdminConsent'
+    });
+}, _AadAppAddCommand_initValidators = function _AadAppAddCommand_initValidators() {
+    this.validators.push((args) => __awaiter(this, void 0, void 0, function* () {
         if (args.options.platform &&
             AadAppAddCommand.aadApplicationPlatform.indexOf(args.options.platform) < 0) {
             return `${args.options.platform} is not a valid value for platform. Allowed values are ${AadAppAddCommand.aadApplicationPlatform.join(', ')}`;
@@ -623,8 +775,10 @@ class AadAppAddCommand extends GraphCommand_1.default {
             }
         }
         return true;
-    }
-}
+    }));
+}, _AadAppAddCommand_initOptionSets = function _AadAppAddCommand_initOptionSets() {
+    this.optionSets.push({ options: ['name', 'manifest'] });
+};
 AadAppAddCommand.aadApplicationPlatform = ['spa', 'web', 'publicClient'];
 AadAppAddCommand.aadAppScopeConsentBy = ['admins', 'adminsAndUsers'];
 module.exports = new AadAppAddCommand();