@pnp/cli-microsoft365 7.0.0-beta.a9cf617 → 7.0.0-beta.af1793c

package/dist/Auth.js

@@ -1,41 +1,29 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Auth = exports.CertificateType = exports.AuthType = exports.Service = exports.CloudType = void 0;
-const msal_common_1 = require("@azure/msal-common");
-const FileTokenStorage_1 = require("./auth/FileTokenStorage");
-const msalCachePlugin_1 = require("./auth/msalCachePlugin");
-const Cli_1 = require("./cli/Cli");
-const Command_1 = require("./Command");
-const config_1 = require("./config");
-const request_1 = require("./request");
-const settingsNames_1 = require("./settingsNames");
-const browserUtil_1 = require("./utils/browserUtil");
-var CloudType;
+import { AzureCloudInstance } from '@azure/msal-common';
+import { CommandError } from './Command.js';
+import { FileTokenStorage } from './auth/FileTokenStorage.js';
+import { msalCachePlugin } from './auth/msalCachePlugin.js';
+import { Cli } from './cli/Cli.js';
+import config from './config.js';
+import request from './request.js';
+import { settingsNames } from './settingsNames.js';
+import { browserUtil } from './utils/browserUtil.js';
+export var CloudType;
 (function (CloudType) {
     CloudType[CloudType["Public"] = 0] = "Public";
     CloudType[CloudType["USGov"] = 1] = "USGov";
     CloudType[CloudType["USGovHigh"] = 2] = "USGovHigh";
     CloudType[CloudType["USGovDoD"] = 3] = "USGovDoD";
     CloudType[CloudType["China"] = 4] = "China";
-})(CloudType = exports.CloudType || (exports.CloudType = {}));
-class Service {
+})(CloudType || (CloudType = {}));
+export class Service {
     constructor() {
         this.connected = false;
         this.authType = AuthType.DeviceCode;
         this.certificateType = CertificateType.Unknown;
         this.cloudType = CloudType.Public;
         this.accessTokens = {};
-        this.appId = config_1.default.cliAadAppId;
-        this.tenant = config_1.default.tenant;
+        this.appId = config.cliAadAppId;
+        this.tenant = config.tenant;
         this.cloudType = CloudType.Public;
     }
     logout() {
@@ -49,12 +37,11 @@ class Service {
         this.thumbprint = undefined;
         this.spoUrl = undefined;
         this.tenantId = undefined;
-        this.appId = config_1.default.cliAadAppId;
-        this.tenant = config_1.default.tenant;
+        this.appId = config.cliAadAppId;
+        this.tenant = config.tenant;
     }
 }
-exports.Service = Service;
-var AuthType;
+export var AuthType;
 (function (AuthType) {
     AuthType[AuthType["DeviceCode"] = 0] = "DeviceCode";
     AuthType[AuthType["Password"] = 1] = "Password";
@@ -62,14 +49,14 @@ var AuthType;
     AuthType[AuthType["Identity"] = 3] = "Identity";
     AuthType[AuthType["Browser"] = 4] = "Browser";
     AuthType[AuthType["Secret"] = 5] = "Secret";
-})(AuthType = exports.AuthType || (exports.AuthType = {}));
-var CertificateType;
+})(AuthType || (AuthType = {}));
+export var CertificateType;
 (function (CertificateType) {
     CertificateType[CertificateType["Unknown"] = 0] = "Unknown";
     CertificateType[CertificateType["Base64"] = 1] = "Base64";
     CertificateType[CertificateType["Binary"] = 2] = "Binary";
-})(CertificateType = exports.CertificateType || (exports.CertificateType = {}));
-class Auth {
+})(CertificateType || (CertificateType = {}));
+export class Auth {
     get service() {
         return this._service;
     }
@@ -109,130 +96,126 @@ class Auth {
             'https://login.microsoftonline.com': 'https://login.chinacloudapi.cn'
         };
     }
-    restoreAuth() {
-        return __awaiter(this, void 0, void 0, function* () {
-            // check if auth has been restored previously
-            if (this._service.connected) {
-                return Promise.resolve();
-            }
-            try {
-                const service = yield this.getServiceConnectionInfo();
-                this._service = Object.assign(this._service, service);
-            }
-            catch (_a) {
-            }
-        });
+    async restoreAuth() {
+        // check if auth has been restored previously
+        if (this._service.connected) {
+            return Promise.resolve();
+        }
+        try {
+            const service = await this.getServiceConnectionInfo();
+            this._service = Object.assign(this._service, service);
+        }
+        catch {
+        }
     }
-    ensureAccessToken(resource, logger, debug = false, fetchNew = false) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const now = new Date();
-            const accessToken = this.service.accessTokens[resource];
-            const expiresOn = accessToken && accessToken.expiresOn ?
-                // if expiresOn is serialized from the service file, it's set as a string
-                // if it's coming from MSAL, it's a Date
-                typeof accessToken.expiresOn === 'string' ? new Date(accessToken.expiresOn) : accessToken.expiresOn
-                : new Date(0);
-            if (!fetchNew && accessToken && expiresOn > now) {
-                if (debug) {
-                    logger.logToStderr(`Existing access token ${accessToken.accessToken} still valid. Returning...`);
-                }
-                return accessToken.accessToken;
+    async ensureAccessToken(resource, logger, debug = false, fetchNew = false) {
+        const now = new Date();
+        const accessToken = this.service.accessTokens[resource];
+        const expiresOn = accessToken && accessToken.expiresOn ?
+            // if expiresOn is serialized from the service file, it's set as a string
+            // if it's coming from MSAL, it's a Date
+            typeof accessToken.expiresOn === 'string' ? new Date(accessToken.expiresOn) : accessToken.expiresOn
+            : new Date(0);
+        if (!fetchNew && accessToken && expiresOn > now) {
+            if (debug) {
+                await logger.logToStderr(`Existing access token ${accessToken.accessToken} still valid. Returning...`);
             }
-            else {
-                if (debug) {
-                    if (!accessToken) {
-                        logger.logToStderr(`No token found for resource ${resource}`);
-                    }
-                    else {
-                        logger.logToStderr(`Access token expired. Token: ${accessToken.accessToken}, ExpiresAt: ${accessToken.expiresOn}`);
-                    }
+            return accessToken.accessToken;
+        }
+        else {
+            if (debug) {
+                if (!accessToken) {
+                    await logger.logToStderr(`No token found for resource ${resource}`);
                 }
-            }
-            let getTokenPromise;
-            // when using cert, you can't retrieve token silently, because there is
-            // no account. Also cert auth instantiates clientApplication itself
-            // after inspecting the specified cert and calculating thumbprint if one
-            // wasn't specified
-            if (this.service.authType !== AuthType.Certificate) {
-                this.clientApplication = this.getClientApplication(logger, debug);
-                if (this.clientApplication) {
-                    const accounts = yield this.clientApplication.getTokenCache().getAllAccounts();
-                    if (accounts.length > 0) {
-                        getTokenPromise = this.ensureAccessTokenSilent.bind(this);
-                    }
+                else {
+                    await logger.logToStderr(`Access token expired. Token: ${accessToken.accessToken}, ExpiresAt: ${accessToken.expiresOn}`);
                 }
             }
-            if (!getTokenPromise) {
-                switch (this.service.authType) {
-                    case AuthType.DeviceCode:
-                        getTokenPromise = this.ensureAccessTokenWithDeviceCode.bind(this);
-                        break;
-                    case AuthType.Password:
-                        getTokenPromise = this.ensureAccessTokenWithPassword.bind(this);
-                        break;
-                    case AuthType.Certificate:
-                        getTokenPromise = this.ensureAccessTokenWithCertificate.bind(this);
-                        break;
-                    case AuthType.Identity:
-                        getTokenPromise = this.ensureAccessTokenWithIdentity.bind(this);
-                        break;
-                    case AuthType.Browser:
-                        getTokenPromise = this.ensureAccessTokenWithBrowser.bind(this);
-                        break;
-                    case AuthType.Secret:
-                        getTokenPromise = this.ensureAccessTokenWithSecret.bind(this);
-                        break;
+        }
+        let getTokenPromise;
+        // when using cert, you can't retrieve token silently, because there is
+        // no account. Also cert auth instantiates clientApplication itself
+        // after inspecting the specified cert and calculating thumbprint if one
+        // wasn't specified
+        if (this.service.authType !== AuthType.Certificate) {
+            this.clientApplication = await this.getClientApplication(logger, debug);
+            if (this.clientApplication) {
+                const accounts = await this.clientApplication.getTokenCache().getAllAccounts();
+                if (accounts.length > 0) {
+                    getTokenPromise = this.ensureAccessTokenSilent.bind(this);
                 }
             }
-            const response = yield getTokenPromise(resource, logger, debug, fetchNew);
-            if (!response) {
-                if (debug) {
-                    logger.logToStderr(`getTokenPromise authentication result is null`);
-                }
-                throw `Failed to retrieve an access token. Please try again`;
+        }
+        if (!getTokenPromise) {
+            switch (this.service.authType) {
+                case AuthType.DeviceCode:
+                    getTokenPromise = this.ensureAccessTokenWithDeviceCode.bind(this);
+                    break;
+                case AuthType.Password:
+                    getTokenPromise = this.ensureAccessTokenWithPassword.bind(this);
+                    break;
+                case AuthType.Certificate:
+                    getTokenPromise = this.ensureAccessTokenWithCertificate.bind(this);
+                    break;
+                case AuthType.Identity:
+                    getTokenPromise = this.ensureAccessTokenWithIdentity.bind(this);
+                    break;
+                case AuthType.Browser:
+                    getTokenPromise = this.ensureAccessTokenWithBrowser.bind(this);
+                    break;
+                case AuthType.Secret:
+                    getTokenPromise = this.ensureAccessTokenWithSecret.bind(this);
+                    break;
             }
-            else {
-                if (debug) {
-                    logger.logToStderr('Response');
-                    logger.logToStderr(response);
-                    logger.logToStderr('');
-                }
+        }
+        const response = await getTokenPromise(resource, logger, debug, fetchNew);
+        if (!response) {
+            if (debug) {
+                await logger.logToStderr(`getTokenPromise authentication result is null`);
             }
-            this.service.accessTokens[resource] = {
-                expiresOn: response.expiresOn,
-                accessToken: response.accessToken
-            };
-            this.service.connected = true;
-            try {
-                yield this.storeConnectionInfo();
+            throw `Failed to retrieve an access token. Please try again`;
+        }
+        else {
+            if (debug) {
+                await logger.logToStderr('Response');
+                await logger.logToStderr(response);
+                await logger.logToStderr('');
             }
-            catch (ex) {
-                // error could happen due to an issue with persisting the access
-                // token which shouldn't fail the overall token retrieval process
-                if (debug) {
-                    logger.logToStderr(new Command_1.CommandError(ex));
-                }
+        }
+        this.service.accessTokens[resource] = {
+            expiresOn: response.expiresOn,
+            accessToken: response.accessToken
+        };
+        this.service.connected = true;
+        try {
+            await this.storeConnectionInfo();
+        }
+        catch (ex) {
+            // error could happen due to an issue with persisting the access
+            // token which shouldn't fail the overall token retrieval process
+            if (debug) {
+                await logger.logToStderr(new CommandError(ex));
             }
-            return response.accessToken;
-        });
+        }
+        return response.accessToken;
     }
-    getClientApplication(logger, debug) {
+    async getClientApplication(logger, debug) {
         switch (this.service.authType) {
             case AuthType.DeviceCode:
             case AuthType.Password:
             case AuthType.Browser:
-                return this.getPublicClient(logger, debug);
+                return await this.getPublicClient(logger, debug);
             case AuthType.Certificate:
-                return this.getConfidentialClient(logger, debug, this.service.thumbprint, this.service.password, undefined);
+                return await this.getConfidentialClient(logger, debug, this.service.thumbprint, this.service.password, undefined);
             case AuthType.Identity:
                 // msal-node doesn't support managed identity so we need to do it manually
                 return undefined;
             case AuthType.Secret:
-                return this.getConfidentialClient(logger, debug, undefined, undefined, this.service.secret);
+                return await this.getConfidentialClient(logger, debug, undefined, undefined, this.service.secret);
         }
     }
-    getAuthClientConfiguration(logger, debug, certificateThumbprint, certificatePrivateKey, clientSecret) {
-        const msal = require('@azure/msal-node');
+    async getAuthClientConfiguration(logger, debug, certificateThumbprint, certificatePrivateKey, clientSecret) {
+        const msal = await import('@azure/msal-node');
         const { LogLevel } = msal;
         const cert = !certificateThumbprint ? undefined : {
             thumbprint: certificateThumbprint,
@@ -241,15 +224,15 @@ class Auth {
         let azureCloudInstance = 0;
         switch (this.service.cloudType) {
             case CloudType.Public:
-                azureCloudInstance = msal_common_1.AzureCloudInstance.AzurePublic;
+                azureCloudInstance = AzureCloudInstance.AzurePublic;
                 break;
             case CloudType.China:
-                azureCloudInstance = msal_common_1.AzureCloudInstance.AzureChina;
+                azureCloudInstance = AzureCloudInstance.AzureChina;
                 break;
             case CloudType.USGov:
             case CloudType.USGovHigh:
             case CloudType.USGovDoD:
-                azureCloudInstance = msal_common_1.AzureCloudInstance.AzureUsGovernment;
+                azureCloudInstance = AzureCloudInstance.AzureUsGovernment;
                 break;
         }
         const config = {
@@ -261,19 +244,20 @@ class Auth {
             }
         };
         const authConfig = cert
-            ? Object.assign(Object.assign({}, config), { clientCertificate: cert }) : Object.assign(Object.assign({}, config), { clientSecret });
+            ? { ...config, clientCertificate: cert }
+            : { ...config, clientSecret };
         return {
             auth: authConfig,
             cache: {
-                cachePlugin: msalCachePlugin_1.msalCachePlugin
+                cachePlugin: msalCachePlugin
             },
             system: {
                 loggerOptions: {
                     // loggerCallback is called by MSAL which we're not testing
                     /* c8 ignore next 4 */
-                    loggerCallback: (level, message) => {
+                    loggerCallback: async (level, message) => {
                         if (level === LogLevel.Error || debug) {
-                            logger.logToStderr(message);
+                            await logger.logToStderr(message);
                         }
                     },
                     piiLoggingEnabled: false,
@@ -282,8 +266,8 @@ class Auth {
             }
         };
     }
-    getPublicClient(logger, debug) {
-        const msal = require('@azure/msal-node');
+    async getPublicClient(logger, debug) {
+        const msal = await import('@azure/msal-node');
         const { PublicClientApplication } = msal;
         if (this.service.authType === AuthType.Password &&
             this.service.tenant === 'common') {
@@ -291,291 +275,277 @@ class Auth {
             // organizations
             this.service.tenant = 'organizations';
         }
-        return new PublicClientApplication(this.getAuthClientConfiguration(logger, debug));
+        return new PublicClientApplication(await this.getAuthClientConfiguration(logger, debug));
     }
-    getConfidentialClient(logger, debug, certificateThumbprint, certificatePrivateKey, clientSecret) {
-        const msal = require('@azure/msal-node');
+    async getConfidentialClient(logger, debug, certificateThumbprint, certificatePrivateKey, clientSecret) {
+        const msal = await import('@azure/msal-node');
         const { ConfidentialClientApplication } = msal;
-        return new ConfidentialClientApplication(this.getAuthClientConfiguration(logger, debug, certificateThumbprint, certificatePrivateKey, clientSecret));
+        return new ConfidentialClientApplication(await this.getAuthClientConfiguration(logger, debug, certificateThumbprint, certificatePrivateKey, clientSecret));
     }
     retrieveAuthCodeWithBrowser(resource, logger, debug) {
-        return new Promise((resolve, reject) => {
+        return new Promise(async (resolve, reject) => {
             // _authServer is never set before hitting this line, but this check
             // is implemented so that we can support lazy loading
             // but also stub it for testing
             /* c8 ignore next 3 */
             if (!this._authServer) {
-                this._authServer = require('./AuthServer').default;
+                this._authServer = (await import('./AuthServer')).default;
             }
             this._authServer.initializeServer(this.service, resource, resolve, reject, logger, debug);
         });
     }
-    ensureAccessTokenWithBrowser(resource, logger, debug) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (debug) {
-                logger.logToStderr(`Retrieving new access token using interactive browser session...`);
-            }
-            const response = yield this.retrieveAuthCodeWithBrowser(resource, logger, debug);
-            if (debug) {
-                logger.logToStderr(`The service returned the code '${response.code}'`);
-            }
-            return this.clientApplication.acquireTokenByCode({
-                code: response.code,
-                redirectUri: response.redirectUri,
-                scopes: [`${resource}/.default`]
-            });
+    async ensureAccessTokenWithBrowser(resource, logger, debug) {
+        if (debug) {
+            await logger.logToStderr(`Retrieving new access token using interactive browser session...`);
+        }
+        const response = await this.retrieveAuthCodeWithBrowser(resource, logger, debug);
+        if (debug) {
+            await logger.logToStderr(`The service returned the code '${response.code}'`);
+        }
+        return this.clientApplication.acquireTokenByCode({
+            code: response.code,
+            redirectUri: response.redirectUri,
+            scopes: [`${resource}/.default`]
         });
     }
-    ensureAccessTokenSilent(resource, logger, debug, fetchNew) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (debug) {
-                logger.logToStderr(`Retrieving new access token silently`);
-            }
-            const accounts = yield this.clientApplication
-                .getTokenCache().getAllAccounts();
-            return this.clientApplication.acquireTokenSilent({
-                account: accounts[0],
-                scopes: [`${resource}/.default`],
-                forceRefresh: fetchNew
-            });
+    async ensureAccessTokenSilent(resource, logger, debug, fetchNew) {
+        if (debug) {
+            await logger.logToStderr(`Retrieving new access token silently`);
+        }
+        const accounts = await this.clientApplication
+            .getTokenCache().getAllAccounts();
+        return this.clientApplication.acquireTokenSilent({
+            account: accounts[0],
+            scopes: [`${resource}/.default`],
+            forceRefresh: fetchNew
         });
     }
-    ensureAccessTokenWithDeviceCode(resource, logger, debug) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (debug) {
-                logger.logToStderr(`Starting Auth.ensureAccessTokenWithDeviceCode. resource: ${resource}, debug: ${debug}`);
-            }
-            this.deviceCodeRequest = {
-                // deviceCodeCallback is called by MSAL which we're not testing
-                /* c8 ignore next 1 */
-                deviceCodeCallback: response => this.processDeviceCodeCallback(response, logger, debug),
-                scopes: [`${resource}/.default`]
-            };
-            return this.clientApplication.acquireTokenByDeviceCode(this.deviceCodeRequest);
-        });
+    async ensureAccessTokenWithDeviceCode(resource, logger, debug) {
+        if (debug) {
+            await logger.logToStderr(`Starting Auth.ensureAccessTokenWithDeviceCode. resource: ${resource}, debug: ${debug}`);
+        }
+        this.deviceCodeRequest = {
+            // deviceCodeCallback is called by MSAL which we're not testing
+            /* c8 ignore next 1 */
+            deviceCodeCallback: response => this.processDeviceCodeCallback(response, logger, debug),
+            scopes: [`${resource}/.default`]
+        };
+        return this.clientApplication.acquireTokenByDeviceCode(this.deviceCodeRequest);
     }
-    processDeviceCodeCallback(response, logger, debug) {
+    async processDeviceCodeCallback(response, logger, debug) {
         if (debug) {
-            logger.logToStderr('Response:');
-            logger.logToStderr(response);
-            logger.logToStderr('');
+            await logger.logToStderr('Response:');
+            await logger.logToStderr(response);
+            await logger.logToStderr('');
         }
-        logger.log(response.message);
-        if (Cli_1.Cli.getInstance().getSettingWithDefaultValue(settingsNames_1.settingsNames.autoOpenLinksInBrowser, false)) {
-            browserUtil_1.browserUtil.open(response.verificationUri);
+        await logger.log(response.message);
+        if (Cli.getInstance().getSettingWithDefaultValue(settingsNames.autoOpenLinksInBrowser, false)) {
+            browserUtil.open(response.verificationUri);
         }
-        if (Cli_1.Cli.getInstance().getSettingWithDefaultValue(settingsNames_1.settingsNames.copyDeviceCodeToClipboard, false)) {
+        if (Cli.getInstance().getSettingWithDefaultValue(settingsNames.copyDeviceCodeToClipboard, false)) {
             // _clipboardy is never set before hitting this line, but this check
             // is implemented so that we can support lazy loading
             // but also stub it for testing
             /* c8 ignore next 3 */
             if (!this._clipboardy) {
-                this._clipboardy = require('clipboardy');
+                this._clipboardy = (await import('clipboardy')).default;
             }
             this._clipboardy.writeSync(response.userCode);
         }
     }
-    ensureAccessTokenWithPassword(resource, logger, debug) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (debug) {
-                logger.logToStderr(`Retrieving new access token using credentials...`);
-            }
-            return this.clientApplication.acquireTokenByUsernamePassword({
-                username: this.service.userName,
-                password: this.service.password,
-                scopes: [`${resource}/.default`]
-            });
+    async ensureAccessTokenWithPassword(resource, logger, debug) {
+        if (debug) {
+            await logger.logToStderr(`Retrieving new access token using credentials...`);
+        }
+        return this.clientApplication.acquireTokenByUsernamePassword({
+            username: this.service.userName,
+            password: this.service.password,
+            scopes: [`${resource}/.default`]
         });
     }
-    ensureAccessTokenWithCertificate(resource, logger, debug) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const nodeForge = require('node-forge');
-            const { pem, pki, asn1, pkcs12 } = nodeForge;
-            if (debug) {
-                logger.logToStderr(`Retrieving new access token using certificate...`);
-            }
-            let cert = '';
-            const buf = Buffer.from(this.service.certificate, 'base64');
-            if (this.service.certificateType === CertificateType.Unknown || this.service.certificateType === CertificateType.Base64) {
-                // First time this method is called, we don't know if certificate is PEM or PFX (type is Unknown)
-                // We assume it is PEM but when parsing of PEM fails, we assume it could be PFX
-                // Type is persisted on service so subsequent calls only run through the correct parsing flow
-                try {
-                    cert = buf.toString('utf8');
-                    const pemObjs = pem.decode(cert);
-                    if (this.service.thumbprint === undefined) {
-                        const pemCertObj = pemObjs.find(pem => pem.type === "CERTIFICATE");
-                        const pemCertStr = pem.encode(pemCertObj);
-                        const pemCert = pki.certificateFromPem(pemCertStr);
-                        this.service.thumbprint = this.calculateThumbprint(pemCert);
-                    }
-                }
-                catch (e) {
-                    this.service.certificateType = CertificateType.Binary;
-                }
-            }
-            if (this.service.certificateType === CertificateType.Binary) {
-                const p12Asn1 = asn1.fromDer(buf.toString('binary'), false);
-                const p12Parsed = pkcs12.pkcs12FromAsn1(p12Asn1, false, this.service.password);
-                let keyBags = p12Parsed.getBags({ bagType: pki.oids.pkcs8ShroudedKeyBag });
-                const pkcs8ShroudedKeyBag = keyBags[pki.oids.pkcs8ShroudedKeyBag][0];
-                if (debug) {
-                    // check if there is something in the keyBag as well as
-                    // the pkcs8ShroudedKeyBag. This will give us more information
-                    // whether there is a cert that can potentially store keys in the keyBag.
-                    // I could not find a way to add something to the keyBag with all 
-                    // my attempts, but lets keep it here for troubleshooting purposes.
-                    logger.logToStderr(`pkcs8ShroudedKeyBagkeyBags length is ${[pki.oids.pkcs8ShroudedKeyBag].length}`);
-                    keyBags = p12Parsed.getBags({ bagType: pki.oids.keyBag });
-                    logger.logToStderr(`keyBag length is ${keyBags[pki.oids.keyBag].length}`);
-                }
-                // convert a Forge private key to an ASN.1 RSAPrivateKey
-                const rsaPrivateKey = pki.privateKeyToAsn1(pkcs8ShroudedKeyBag.key);
-                // wrap an RSAPrivateKey ASN.1 object in a PKCS#8 ASN.1 PrivateKeyInfo
-                const privateKeyInfo = pki.wrapRsaPrivateKey(rsaPrivateKey);
-                // convert a PKCS#8 ASN.1 PrivateKeyInfo to PEM
-                cert = pki.privateKeyInfoToPem(privateKeyInfo);
+    async ensureAccessTokenWithCertificate(resource, logger, debug) {
+        const nodeForge = (await import('node-forge')).default;
+        const { pem, pki, asn1, pkcs12 } = nodeForge;
+        if (debug) {
+            await logger.logToStderr(`Retrieving new access token using certificate...`);
+        }
+        let cert = '';
+        const buf = Buffer.from(this.service.certificate, 'base64');
+        if (this.service.certificateType === CertificateType.Unknown || this.service.certificateType === CertificateType.Base64) {
+            // First time this method is called, we don't know if certificate is PEM or PFX (type is Unknown)
+            // We assume it is PEM but when parsing of PEM fails, we assume it could be PFX
+            // Type is persisted on service so subsequent calls only run through the correct parsing flow
+            try {
+                cert = buf.toString('utf8');
+                const pemObjs = pem.decode(cert);
                 if (this.service.thumbprint === undefined) {
-                    const certBags = p12Parsed.getBags({ bagType: pki.oids.certBag });
-                    const certBag = certBags[pki.oids.certBag][0];
-                    this.service.thumbprint = this.calculateThumbprint(certBag.cert);
+                    const pemCertObj = pemObjs.find(pem => pem.type === "CERTIFICATE");
+                    const pemCertStr = pem.encode(pemCertObj);
+                    const pemCert = pki.certificateFromPem(pemCertStr);
+                    this.service.thumbprint = await this.calculateThumbprint(pemCert);
                 }
             }
-            this.clientApplication = this.getConfidentialClient(logger, debug, this.service.thumbprint, cert);
-            return this.clientApplication.acquireTokenByClientCredential({
-                scopes: [`${resource}/.default`]
-            });
+            catch (e) {
+                this.service.certificateType = CertificateType.Binary;
+            }
+        }
+        if (this.service.certificateType === CertificateType.Binary) {
+            const p12Asn1 = asn1.fromDer(buf.toString('binary'), false);
+            const p12Parsed = pkcs12.pkcs12FromAsn1(p12Asn1, false, this.service.password);
+            let keyBags = p12Parsed.getBags({ bagType: pki.oids.pkcs8ShroudedKeyBag });
+            const pkcs8ShroudedKeyBag = keyBags[pki.oids.pkcs8ShroudedKeyBag][0];
+            if (debug) {
+                // check if there is something in the keyBag as well as
+                // the pkcs8ShroudedKeyBag. This will give us more information
+                // whether there is a cert that can potentially store keys in the keyBag.
+                // I could not find a way to add something to the keyBag with all 
+                // my attempts, but lets keep it here for troubleshooting purposes.
+                await logger.logToStderr(`pkcs8ShroudedKeyBagkeyBags length is ${[pki.oids.pkcs8ShroudedKeyBag].length}`);
+                keyBags = p12Parsed.getBags({ bagType: pki.oids.keyBag });
+                await logger.logToStderr(`keyBag length is ${keyBags[pki.oids.keyBag].length}`);
+            }
+            // convert a Forge private key to an ASN.1 RSAPrivateKey
+            const rsaPrivateKey = pki.privateKeyToAsn1(pkcs8ShroudedKeyBag.key);
+            // wrap an RSAPrivateKey ASN.1 object in a PKCS#8 ASN.1 PrivateKeyInfo
+            const privateKeyInfo = pki.wrapRsaPrivateKey(rsaPrivateKey);
+            // convert a PKCS#8 ASN.1 PrivateKeyInfo to PEM
+            cert = pki.privateKeyInfoToPem(privateKeyInfo);
+            if (this.service.thumbprint === undefined) {
+                const certBags = p12Parsed.getBags({ bagType: pki.oids.certBag });
+                const certBag = (certBags[pki.oids.certBag])[0];
+                this.service.thumbprint = await this.calculateThumbprint(certBag.cert);
+            }
+        }
+        this.clientApplication = await this.getConfidentialClient(logger, debug, this.service.thumbprint, cert);
+        return this.clientApplication.acquireTokenByClientCredential({
+            scopes: [`${resource}/.default`]
         });
     }
-    ensureAccessTokenWithIdentity(resource, logger, debug) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const userName = this.service.userName;
+    async ensureAccessTokenWithIdentity(resource, logger, debug) {
+        const userName = this.service.userName;
+        if (debug) {
+            await logger.logToStderr('Will try to retrieve access token using identity...');
+        }
+        const requestOptions = {
+            url: '',
+            headers: {
+                accept: 'application/json',
+                Metadata: true,
+                'x-anonymous': true
+            },
+            responseType: 'json'
+        };
+        if (process.env.IDENTITY_ENDPOINT && process.env.IDENTITY_HEADER) {
             if (debug) {
-                logger.logToStderr('Will try to retrieve access token using identity...');
+                await logger.logToStderr('IDENTITY_ENDPOINT and IDENTITY_HEADER env variables found it is Azure Function, WebApp...');
             }
-            const requestOptions = {
-                url: '',
-                headers: {
-                    accept: 'application/json',
-                    Metadata: true,
-                    'x-anonymous': true
-                },
-                responseType: 'json'
-            };
-            if (process.env.IDENTITY_ENDPOINT && process.env.IDENTITY_HEADER) {
-                if (debug) {
-                    logger.logToStderr('IDENTITY_ENDPOINT and IDENTITY_HEADER env variables found it is Azure Function, WebApp...');
-                }
-                requestOptions.url = `${process.env.IDENTITY_ENDPOINT}?resource=${encodeURIComponent(resource)}&api-version=2019-08-01`;
-                requestOptions.headers['X-IDENTITY-HEADER'] = process.env.IDENTITY_HEADER;
+            requestOptions.url = `${process.env.IDENTITY_ENDPOINT}?resource=${encodeURIComponent(resource)}&api-version=2019-08-01`;
+            requestOptions.headers['X-IDENTITY-HEADER'] = process.env.IDENTITY_HEADER;
+        }
+        else if (process.env.MSI_ENDPOINT && process.env.MSI_SECRET) {
+            if (debug) {
+                await logger.logToStderr('MSI_ENDPOINT and MSI_SECRET env variables found it is Azure Function or WebApp, but using the old names of the env variables...');
             }
-            else if (process.env.MSI_ENDPOINT && process.env.MSI_SECRET) {
-                if (debug) {
-                    logger.logToStderr('MSI_ENDPOINT and MSI_SECRET env variables found it is Azure Function or WebApp, but using the old names of the env variables...');
-                }
-                requestOptions.url = `${process.env.MSI_ENDPOINT}?resource=${encodeURIComponent(resource)}&api-version=2019-08-01`;
-                requestOptions.headers['X-IDENTITY-HEADER'] = process.env.MSI_SECRET;
+            requestOptions.url = `${process.env.MSI_ENDPOINT}?resource=${encodeURIComponent(resource)}&api-version=2019-08-01`;
+            requestOptions.headers['X-IDENTITY-HEADER'] = process.env.MSI_SECRET;
+        }
+        else if (process.env.IDENTITY_ENDPOINT) {
+            if (debug) {
+                await logger.logToStderr('IDENTITY_ENDPOINT env variable found it is Azure Could Shell...');
             }
-            else if (process.env.IDENTITY_ENDPOINT) {
-                if (debug) {
-                    logger.logToStderr('IDENTITY_ENDPOINT env variable found it is Azure Could Shell...');
-                }
-                if (userName && process.env.ACC_CLOUD) {
-                    // reject for now since the Azure Cloud Shell does not support user-managed identity 
-                    return Promise.reject('Azure Cloud Shell does not support user-managed identity. You can execute the command without the --userName option to login with user identity');
-                }
-                requestOptions.url = `${process.env.IDENTITY_ENDPOINT}?resource=${encodeURIComponent(resource)}`;
+            if (userName && process.env.ACC_CLOUD) {
+                // reject for now since the Azure Cloud Shell does not support user-managed identity 
+                return Promise.reject('Azure Cloud Shell does not support user-managed identity. You can execute the command without the --userName option to login with user identity');
             }
-            else if (process.env.MSI_ENDPOINT) {
-                if (debug) {
-                    logger.logToStderr('MSI_ENDPOINT env variable found it is Azure Could Shell, but using the old names of the env variables...');
-                }
-                if (userName && process.env.ACC_CLOUD) {
-                    // reject for now since the Azure Cloud Shell does not support user-managed identity 
-                    return Promise.reject('Azure Cloud Shell does not support user-managed identity. You can execute the command without the --userName option to login with user identity');
-                }
-                requestOptions.url = `${process.env.MSI_ENDPOINT}?resource=${encodeURIComponent(resource)}`;
+            requestOptions.url = `${process.env.IDENTITY_ENDPOINT}?resource=${encodeURIComponent(resource)}`;
+        }
+        else if (process.env.MSI_ENDPOINT) {
+            if (debug) {
+                await logger.logToStderr('MSI_ENDPOINT env variable found it is Azure Could Shell, but using the old names of the env variables...');
             }
-            else {
-                if (debug) {
-                    logger.logToStderr('IDENTITY_ENDPOINT and MSI_ENDPOINT env variables not found. Attempt to get Managed Identity token by using the Azure Virtual Machine API...');
-                }
-                requestOptions.url = `http://169.254.169.254/metadata/identity/oauth2/token?resource=${encodeURIComponent(resource)}&api-version=2018-02-01`;
+            if (userName && process.env.ACC_CLOUD) {
+                // reject for now since the Azure Cloud Shell does not support user-managed identity 
+                return Promise.reject('Azure Cloud Shell does not support user-managed identity. You can execute the command without the --userName option to login with user identity');
             }
-            if (userName) {
-                // if name present then the identity is user-assigned managed identity
-                // the name option in this case is either client_id or principal_id (object_id) 
-                // of the managed identity service principal
-                requestOptions.url += `&client_id=${encodeURIComponent(userName)}`;
-                if (debug) {
-                    logger.logToStderr('Wil try to get token using client_id param...');
-                }
+            requestOptions.url = `${process.env.MSI_ENDPOINT}?resource=${encodeURIComponent(resource)}`;
+        }
+        else {
+            if (debug) {
+                await logger.logToStderr('IDENTITY_ENDPOINT and MSI_ENDPOINT env variables not found. Attempt to get Managed Identity token by using the Azure Virtual Machine API...');
+            }
+            requestOptions.url = `http://169.254.169.254/metadata/identity/oauth2/token?resource=${encodeURIComponent(resource)}&api-version=2018-02-01`;
+        }
+        if (userName) {
+            // if name present then the identity is user-assigned managed identity
+            // the name option in this case is either client_id or principal_id (object_id) 
+            // of the managed identity service principal
+            requestOptions.url += `&client_id=${encodeURIComponent(userName)}`;
+            if (debug) {
+                await logger.logToStderr('Wil try to get token using client_id param...');
+            }
+        }
+        try {
+            const accessTokenResponse = await request.get(requestOptions);
+            return {
+                accessToken: accessTokenResponse.access_token,
+                expiresOn: new Date(parseInt(accessTokenResponse.expires_on) * 1000)
+            };
+        }
+        catch (e) {
+            if (!userName) {
+                throw e;
+            }
+            // since the userName option can be either client_id or principal_id (object_id) 
+            // and the first attempt was using client_id
+            // now lets see if the api returned 'not found' response and
+            // try to get token using principal_id (object_id)
+            let isNotFoundResponse = false;
+            if (e.error && e.error.Message) {
+                // check if it is Azure Function api 'not found' response
+                isNotFoundResponse = (e.error.Message.indexOf("No Managed Identity found") !== -1);
+            }
+            else if (e.error && e.error.error_description) {
+                // check if it is Azure VM api 'not found' response
+                isNotFoundResponse = (e.error.error_description === "Identity not found");
+            }
+            if (!isNotFoundResponse) {
+                // it is not a 'not found' response then exit with error
+                throw e;
             }
+            if (debug) {
+                await logger.logToStderr('Wil try to get token using principal_id (also known as object_id) param ...');
+            }
+            requestOptions.url = requestOptions.url.replace('&client_id=', '&principal_id=');
+            requestOptions.headers['x-anonymous'] = true;
             try {
-                const accessTokenResponse = yield request_1.default.get(requestOptions);
+                const accessTokenResponse = await request.get(requestOptions);
                 return {
                     accessToken: accessTokenResponse.access_token,
                     expiresOn: new Date(parseInt(accessTokenResponse.expires_on) * 1000)
                 };
             }
-            catch (e) {
-                if (!userName) {
-                    throw e;
-                }
-                // since the userName option can be either client_id or principal_id (object_id) 
-                // and the first attempt was using client_id
-                // now lets see if the api returned 'not found' response and
-                // try to get token using principal_id (object_id)
-                let isNotFoundResponse = false;
-                if (e.error && e.error.Message) {
-                    // check if it is Azure Function api 'not found' response
-                    isNotFoundResponse = (e.error.Message.indexOf("No Managed Identity found") !== -1);
-                }
-                else if (e.error && e.error.error_description) {
-                    // check if it is Azure VM api 'not found' response
-                    isNotFoundResponse = (e.error.error_description === "Identity not found");
-                }
-                if (!isNotFoundResponse) {
-                    // it is not a 'not found' response then exit with error
-                    throw e;
-                }
-                if (debug) {
-                    logger.logToStderr('Wil try to get token using principal_id (also known as object_id) param ...');
+            catch (err) {
+                // will give up and not try any further with the 'msi_res_id' (resource id) query string param
+                // since it does not work with the Azure Functions api, but just with the Azure VM api
+                if (err.error.code === 'EACCES') {
+                    // the CLI does not know if managed identity is actually assigned when EACCES code thrown
+                    // so show meaningful message since the raw error response could be misleading 
+                    return Promise.reject('Error while logging with Managed Identity. Please check if a Managed Identity is assigned to the current Azure resource.');
                 }
-                requestOptions.url = requestOptions.url.replace('&client_id=', '&principal_id=');
-                requestOptions.headers['x-anonymous'] = true;
-                try {
-                    const accessTokenResponse = yield request_1.default.get(requestOptions);
-                    return {
-                        accessToken: accessTokenResponse.access_token,
-                        expiresOn: new Date(parseInt(accessTokenResponse.expires_on) * 1000)
-                    };
-                }
-                catch (err) {
-                    // will give up and not try any further with the 'msi_res_id' (resource id) query string param
-                    // since it does not work with the Azure Functions api, but just with the Azure VM api
-                    if (err.error.code === 'EACCES') {
-                        // the CLI does not know if managed identity is actually assigned when EACCES code thrown
-                        // so show meaningful message since the raw error response could be misleading 
-                        return Promise.reject('Error while logging with Managed Identity. Please check if a Managed Identity is assigned to the current Azure resource.');
-                    }
-                    else {
-                        throw err;
-                    }
+                else {
+                    throw err;
                 }
             }
-        });
+        }
     }
-    ensureAccessTokenWithSecret(resource, logger, debug) {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.clientApplication = this.getConfidentialClient(logger, debug, undefined, undefined, this.service.secret);
-            return this.clientApplication.acquireTokenByClientCredential({
-                scopes: [`${resource}/.default`]
-            });
+    async ensureAccessTokenWithSecret(resource, logger, debug) {
+        this.clientApplication = await this.getConfidentialClient(logger, debug, undefined, undefined, this.service.secret);
+        return this.clientApplication.acquireTokenByClientCredential({
+            scopes: [`${resource}/.default`]
         });
     }
-    calculateThumbprint(certificate) {
-        const nodeForge = require('node-forge');
+    async calculateThumbprint(certificate) {
+        const nodeForge = (await import('node-forge')).default;
         const { md, asn1, pki } = nodeForge;
         const messageDigest = md.sha1.create();
         messageDigest.update(asn1.toDer(pki.certificateToAsn1(certificate)).getBytes());
@@ -588,7 +558,8 @@ class Auth {
             resource = resource.substr(0, pos);
         }
         if (resource === 'https://api.bap.microsoft.com' ||
-            resource === 'https://api.powerapps.com') {
+            resource === 'https://api.powerapps.com' ||
+            resource.endsWith('.api.bap.microsoft.com')) {
             resource = 'https://service.powerapps.com/';
         }
         if (resource === 'https://api.powerbi.com') {
@@ -598,32 +569,28 @@ class Auth {
         }
         return resource;
     }
-    getServiceConnectionInfo() {
-        return __awaiter(this, void 0, void 0, function* () {
-            const tokenStorage = this.getTokenStorage();
-            const json = yield tokenStorage.get();
-            return JSON.parse(json);
-        });
+    async getServiceConnectionInfo() {
+        const tokenStorage = this.getTokenStorage();
+        const json = await tokenStorage.get();
+        return JSON.parse(json);
     }
     storeConnectionInfo() {
         const tokenStorage = this.getTokenStorage();
         return tokenStorage.set(JSON.stringify(this.service));
     }
-    clearConnectionInfo() {
-        return __awaiter(this, void 0, void 0, function* () {
-            const tokenStorage = this.getTokenStorage();
-            yield tokenStorage.remove();
-            // we need to manually clear MSAL cache, because MSAL doesn't have support
-            // for logging out when using cert-based auth
-            const msalCache = this.getMsalCacheStorage();
-            yield msalCache.remove();
-        });
+    async clearConnectionInfo() {
+        const tokenStorage = this.getTokenStorage();
+        await tokenStorage.remove();
+        // we need to manually clear MSAL cache, because MSAL doesn't have support
+        // for logging out when using cert-based auth
+        const msalCache = this.getMsalCacheStorage();
+        await msalCache.remove();
     }
     getTokenStorage() {
-        return new FileTokenStorage_1.FileTokenStorage(FileTokenStorage_1.FileTokenStorage.connectionInfoFilePath());
+        return new FileTokenStorage(FileTokenStorage.connectionInfoFilePath());
     }
     getMsalCacheStorage() {
-        return new FileTokenStorage_1.FileTokenStorage(FileTokenStorage_1.FileTokenStorage.msalCacheFilePath());
+        return new FileTokenStorage(FileTokenStorage.msalCacheFilePath());
     }
     static getEndpointForResource(resource, cloudType) {
         if (Auth.cloudEndpoints[cloudType] &&
@@ -635,8 +602,7 @@ class Auth {
         }
     }
 }
-exports.Auth = Auth;
 Auth.cloudEndpoints = [];
 Auth.initialize();
-exports.default = new Auth();
+export default new Auth();
 //# sourceMappingURL=Auth.js.map