autnam 1.0.0

package/packages/arcgis-rest-request/src/app-tokens.ts

@@ -0,0 +1,132 @@
+/* Copyright (c) 2018-2020 Environmental Systems Research Institute, Inc.
+ * Apache-2.0 */
+
+import { request } from "./request.js";
+import { IRequestOptions } from "./utils/IRequestOptions.js";
+
+/**
+ * Request app-specific token, passing in the token for the current app.
+ *
+ * This call returns a token after performing the same checks made by validateAppAccess.
+ * It returns an app-specific token of the signed-in user only if the user has access
+ * to the app and the encrypted platform cookie is valid.
+ *
+ * A scenario where an app would use this is if it is iframed into another platform app
+ * and receives credentials via postMessage. Those credentials contain a token that is
+ * specific to the host app, so the embedded app would use `exchangeToken` to get one
+ * that is specific to itself.
+ *
+ * Note: This is only usable by Esri applications hosted on *arcgis.com, *esri.com or within
+ * an ArcGIS Enterprise installation. Custom applications can not use this.
+ *
+ * @param token
+ * @param clientId application
+ * @param portal
+ */
+export function exchangeToken(
+  token: string,
+  clientId: string,
+  portal = "https://www.arcgis.com/sharing/rest"
+): Promise<string> {
+  const url = `${portal}/oauth2/exchangeToken`;
+  const ro = {
+    method: "POST",
+    params: {
+      f: "json",
+      client_id: clientId,
+      token
+    }
+  } as IRequestOptions;
+  // make the request and return the token
+  return request(url, ro).then((response) => response.token);
+}
+
+/**
+ * Response from the `platformSelf(...)` function.
+ */
+export interface IPlatformSelfResponse {
+  /**
+   * Username of the user the encrypted cookie was issued for
+   */
+  username: string;
+  /**
+   * Token the consuming application can use, It is tied to the
+   * clientId used in the `platformSelf` call
+   */
+  token: string;
+  /**
+   * Token expiration, in seconds-from-now
+   */
+  expires_in: number;
+}
+
+/**
+ * Request a token for a specific application using the esri_aopc encrypted cookie
+ *
+ * When a client app boots up, it will know its clientId and the redirectUri for use
+ * in the normal /oauth/authorize pop-out oAuth flow.
+ *
+ * If the app sees an `esri_aopc` cookie (only set if the app is hosted on *.arcgis.com),
+ * it can call the /oauth2/platformSelf end-point passing in the clientId and redirectUri
+ * in headers, and it will receive back an app-specific token, assuming the user has
+ * access to the app.
+ *
+ * Since there are scenarios where an app can boot using credentials/token from localstorage
+ * but those credentials are not for the same user as the esri_aopc cookie, it is recommended that
+ * an app check the returned username against any existing identity they may have loaded.
+ *
+ * Note: This is only usable by Esri applications hosted on *arcgis.com, *esri.com or within
+ * an ArcGIS Enterprise installation. Custom applications can not use this.
+ *
+ * ```js
+ * // convert the encrypted platform cookie into a ArcGISIdentityManager
+ * import { platformSelf, ArcGISIdentityManager } from '@esri/arcgis-rest-auth';
+ *
+ * const portal = 'https://www.arcgis.com/sharing/rest';
+ * const clientId = 'YOURAPPCLIENTID';
+ *
+ * // exchange esri_aopc cookie
+ * return platformSelf(clientId, 'https://your-app-redirect-uri', portal)
+ * .then((response) => {
+ *  const currentTimestamp = new Date().getTime();
+ *  const tokenExpiresTimestamp = currentTimestamp + (response.expires_in * 1000);
+ *  // Construct the session and return it
+ *  return new ArcGISIdentityManager({
+ *    portal,
+ *    clientId,
+ *    username: response.username,
+ *    token: response.token,
+ *    tokenExpires: new Date(tokenExpiresTimestamp),
+ *    ssl: true
+ *  });
+ * })
+ *
+ * ```
+ *
+ *
+ * @param clientId
+ * @param redirectUri
+ * @param portal
+ */
+export function platformSelf(
+  clientId: string,
+  redirectUri: string,
+  portal = "https://www.arcgis.com/sharing/rest"
+): Promise<IPlatformSelfResponse> {
+  // TEMPORARY: the f=json should not be needed, but currently is
+  const url = `${portal}/oauth2/platformSelf?f=json`;
+  const ro = {
+    method: "POST",
+    headers: {
+      "X-Esri-Auth-Client-Id": clientId,
+      "X-Esri-Auth-Redirect-Uri": redirectUri
+    },
+    // Note: request has logic to include the cookie
+    // for platformSelf calls w/ the X-Esri-Auth-Client-Id header
+    params: {
+      f: "json"
+    }
+  } as IRequestOptions;
+  // make the request and return the token
+  return request(url, ro);
+}

package/packages/arcgis-rest-request/src/authenticated-request-options.ts

@@ -0,0 +1,23 @@
+/* Copyright (c) 2018 Environmental Systems Research Institute, Inc.
+ * Apache-2.0 */
+
+import { ApplicationCredentialsManager } from "./ApplicationCredentialsManager.js";
+import { ArcGISIdentityManager } from "./ArcGISIdentityManager.js";
+import { IRequestOptions } from "./utils/IRequestOptions.js";
+
+/**
+ * Used internally by packages for requests that require user authentication.
+ */
+export interface IAuthenticatedRequestOptions extends IRequestOptions {
+  authentication: ArcGISIdentityManager | ApplicationCredentialsManager;
+}
+
+/**
+ * Used internally by packages for requests that require authentication.
+ */
+export interface IUserRequestOptions extends IRequestOptions {
+  /**
+   * A session representing a logged in user.
+   */
+  authentication: ArcGISIdentityManager;
+}

package/packages/arcgis-rest-request/src/federation-utils.ts

@@ -0,0 +1,88 @@
+import { cleanUrl } from "./utils/clean-url.js";
+
+/**
+ * Used to test if a URL is an ArcGIS Online URL
+ */
+const arcgisOnlineUrlRegex = /^https?:\/\/(\S+)\.arcgis\.com.+/;
+
+/**
+ * Used to test if a URL is production ArcGIS Online Portal
+ */
+const arcgisOnlinePortalRegex =
+  /^https?:\/\/(dev|devext|qa|qaext|www)\.arcgis\.com\/sharing\/rest+/;
+
+/**
+ * Used to test if a URL is an ArcGIS Online Organization Portal
+ */
+const arcgisOnlineOrgPortalRegex =
+  /^https?:\/\/(?:[a-z0-9-]+\.maps(dev|devext|qa|qaext)?)?.arcgis\.com\/sharing\/rest/;
+
+export function isOnline(url: string): boolean {
+  return arcgisOnlineUrlRegex.test(url);
+}
+
+export function normalizeOnlinePortalUrl(portalUrl: string): string {
+  if (!arcgisOnlineUrlRegex.test(portalUrl)) {
+    return portalUrl;
+  }
+
+  switch (getOnlineEnvironment(portalUrl)) {
+    case "dev":
+      return "https://devext.arcgis.com/sharing/rest";
+    case "qa":
+      return "https://qaext.arcgis.com/sharing/rest";
+    default:
+      return "https://www.arcgis.com/sharing/rest";
+  }
+}
+
+export function getOnlineEnvironment(url: string): string {
+  if (!arcgisOnlineUrlRegex.test(url)) {
+    return null;
+  }
+
+  const match = url.match(arcgisOnlineUrlRegex);
+  const subdomain = match[1].split(".").pop();
+
+  if (subdomain.includes("dev")) {
+    return "dev";
+  }
+
+  if (subdomain.includes("qa")) {
+    return "qa";
+  }
+
+  return "production";
+}
+
+export function isFederated(
+  owningSystemUrl: string,
+  portalUrl: string
+): boolean {
+  const normalizedPortalUrl = cleanUrl(
+    normalizeOnlinePortalUrl(portalUrl)
+  ).replace(/https?:\/\//, "");
+
+  const normalizedOwningSystemUrl = cleanUrl(owningSystemUrl).replace(
+    /https?:\/\//,
+    ""
+  );
+
+  return new RegExp(normalizedOwningSystemUrl, "i").test(normalizedPortalUrl);
+}
+
+export function canUseOnlineToken(
+  portalUrl: string,
+  requestUrl: string
+): boolean {
+  const portalIsOnline = isOnline(portalUrl);
+  const requestIsOnline = isOnline(requestUrl);
+  const portalEnv = getOnlineEnvironment(portalUrl);
+  const requestEnv = getOnlineEnvironment(requestUrl);
+
+  if (portalIsOnline && requestIsOnline && portalEnv === requestEnv) {
+    return true;
+  }
+
+  return false;
+}

package/packages/arcgis-rest-request/src/fetch-token.ts

@@ -0,0 +1,48 @@
+/* Copyright (c) 2017 Environmental Systems Research Institute, Inc.
+ * Apache-2.0 */
+
+import { request } from "./request.js";
+import { IRequestOptions } from "./utils/IRequestOptions.js";
+import { ITokenRequestOptions } from "./utils/ITokenRequestOptions.js";
+
+interface IFetchTokenRawResponse {
+  access_token: string;
+  expires_in: number;
+  username: string;
+  ssl?: boolean;
+  refresh_token?: string;
+}
+
+export interface IFetchTokenResponse {
+  token: string;
+  expires: Date;
+  username: string;
+  ssl: boolean;
+  refreshToken?: string;
+}
+
+export function fetchToken(
+  url: string,
+  requestOptions: ITokenRequestOptions
+): Promise<IFetchTokenResponse> {
+  const options: IRequestOptions = requestOptions;
+  // we generate a response, so we can't return the raw response
+  options.rawResponse = false;
+
+  return request(url, options).then((response: IFetchTokenRawResponse) => {
+    const r: IFetchTokenResponse = {
+      token: response.access_token,
+      username: response.username,
+      expires: new Date(
+        // convert seconds in response to milliseconds and add the value to the current time to calculate a static expiration timestamp
+        Date.now() + (response.expires_in * 1000 - 1000)
+      ),
+      ssl: response.ssl === true
+    };
+    if (response.refresh_token) {
+      r.refreshToken = response.refresh_token;
+    }
+
+    return r;
+  });
+}

package/packages/arcgis-rest-request/src/generate-token.ts

@@ -0,0 +1,32 @@
+/* Copyright (c) 2017-2018 Environmental Systems Research Institute, Inc.
+ * Apache-2.0 */
+
+import { ITokenRequestOptions } from "./utils/ITokenRequestOptions.js";
+import { request, NODEJS_DEFAULT_REFERER_HEADER } from "./request.js";
+import { IRequestOptions } from "./utils/IRequestOptions.js";
+
+export interface IGenerateTokenResponse {
+  token: string;
+  expires: number;
+  ssl: boolean;
+}
+
+export function generateToken(
+  url: string,
+  requestOptions: ITokenRequestOptions
+): Promise<IGenerateTokenResponse> {
+  const options: IRequestOptions = requestOptions;
+
+  /* istanbul ignore else */
+  if (
+    typeof window !== "undefined" &&
+    window.location &&
+    window.location.host
+  ) {
+    options.params.referer = window.location.host;
+  } else {
+    options.params.referer = NODEJS_DEFAULT_REFERER_HEADER;
+  }
+
+  return request(url, options);
+}

package/packages/arcgis-rest-request/src/index.ts

@@ -0,0 +1,46 @@
+/* Copyright (c) 2018-2019 Environmental Systems Research Institute, Inc.
+ * Apache-2.0 */
+
+/** TODO: Temporary trivial change to force sem-rel to compute a release */
+export * from "./request.js";
+export * from "./utils/append-custom-params.js";
+export * from "./utils/ArcGISRequestError.js";
+export * from "./utils/clean-url.js";
+export * from "./utils/encode-form-data.js";
+export * from "./utils/encode-query-string.js";
+export * from "./utils/decode-query-string.js";
+export * from "./utils/ErrorTypes.js";
+export * from "./utils/GrantTypes.js";
+export * from "./utils/HTTPMethods.js";
+export * from "./utils/IAuthenticationManager.js";
+export * from "./utils/IFetchTokenParams.js";
+export * from "./utils/IGenerateTokenParams.js";
+export * from "./utils/IParams.js";
+export * from "./utils/IParamBuilder.js";
+export * from "./utils/IParamsBuilder.js";
+export * from "./utils/IRequestOptions.js";
+export * from "./utils/ITokenRequestOptions.js";
+export * from "./utils/process-params.js";
+export * from "./utils/ResponseFormats.js";
+export * from "./utils/retryAuthError.js";
+export * from "./utils/warn.js";
+export * from "./ApplicationCredentialsManager.js";
+export * from "./ApiKeyManager.js";
+export * from "./ArcGISIdentityManager.js";
+export * from "./fetch-token.js";
+export * from "./generate-token.js";
+export * from "./authenticated-request-options.js";
+export * from "./app-tokens.js";
+export * from "./validate-app-access.js";
+export * from "./federation-utils.js";
+export * from "./revoke-token.js";
+
+export * from "./types/feature.js";
+export * from "./types/geometry.js";
+export * from "./types/symbol.js";
+export * from "./types/service.js";
+export * from "./types/group.js";
+export * from "./types/user.js";
+
+export * from "@esri/arcgis-rest-fetch";
+export * from "@esri/arcgis-rest-form-data";