plugin-data-source-mssql 2.0.10 → 2.0.12

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/cache/utils/CacheTypes.ts

@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AccountEntity } from "../entities/AccountEntity.js";
+import { IdTokenEntity } from "../entities/IdTokenEntity.js";
+import { AccessTokenEntity } from "../entities/AccessTokenEntity.js";
+import { RefreshTokenEntity } from "../entities/RefreshTokenEntity.js";
+import { AppMetadataEntity } from "../entities/AppMetadataEntity.js";
+import { ServerTelemetryEntity } from "../entities/ServerTelemetryEntity.js";
+import { ThrottlingEntity } from "../entities/ThrottlingEntity.js";
+import { AuthorityMetadataEntity } from "../entities/AuthorityMetadataEntity.js";
+import { AuthenticationScheme } from "../../utils/Constants.js";
+import { ScopeSet } from "../../request/ScopeSet.js";
+import { AccountInfo } from "../../account/AccountInfo.js";
+
+/** @internal */
+export type AccountCache = Record<string, AccountEntity>;
+/** @internal */
+export type IdTokenCache = Record<string, IdTokenEntity>;
+/** @internal */
+export type AccessTokenCache = Record<string, AccessTokenEntity>;
+/** @internal */
+export type RefreshTokenCache = Record<string, RefreshTokenEntity>;
+/** @internal */
+export type AppMetadataCache = Record<string, AppMetadataEntity>;
+
+/**
+ * Object type of all accepted cache types
+ * @internal
+ */
+export type ValidCacheType =
+    | AccountEntity
+    | IdTokenEntity
+    | AccessTokenEntity
+    | RefreshTokenEntity
+    | AppMetadataEntity
+    | AuthorityMetadataEntity
+    | ServerTelemetryEntity
+    | ThrottlingEntity
+    | string;
+
+/**
+ * Object type of all credential types
+ * @internal
+ */
+export type ValidCredentialType =
+    | IdTokenEntity
+    | AccessTokenEntity
+    | RefreshTokenEntity;
+
+/**
+ * Account:	<home_account_id>-<environment>-<realm*>
+ */
+export type AccountFilter = Omit<
+    Partial<AccountInfo>,
+    "idToken" | "idTokenClaims"
+> & {
+    realm?: string;
+    loginHint?: string;
+    sid?: string;
+    isHomeTenant?: boolean;
+};
+
+export type TenantProfileFilter = Pick<
+    AccountFilter,
+    | "localAccountId"
+    | "loginHint"
+    | "name"
+    | "sid"
+    | "isHomeTenant"
+    | "username"
+    | "upn"
+>;
+
+/**
+ * Credential: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme*>
+ */
+export type CredentialFilter = {
+    homeAccountId?: string;
+    environment?: string;
+    credentialType?: string;
+    clientId?: string;
+    familyId?: string;
+    realm?: string;
+    target?: ScopeSet;
+    userAssertionHash?: string;
+    tokenType?: AuthenticationScheme;
+    keyId?: string;
+};
+
+/**
+ * AppMetadata: appmetadata-<environment>-<client_id>
+ */
+export type AppMetadataFilter = {
+    environment?: string;
+    clientId?: string;
+};
+
+export type TokenKeys = {
+    idToken: string[];
+    accessToken: string[];
+    refreshToken: string[];
+};

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/client/AuthorizationCodeClient.ts

@@ -0,0 +1,606 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CommonAuthorizationCodeRequest } from "../request/CommonAuthorizationCodeRequest.js";
+import { Authority } from "../authority/Authority.js";
+import * as RequestParameterBuilder from "../request/RequestParameterBuilder.js";
+import * as UrlUtils from "../utils/UrlUtils.js";
+import * as Constants from "../utils/Constants.js";
+import * as AADServerParamKeys from "../constants/AADServerParamKeys.js";
+import {
+    buildClientConfiguration,
+    ClientConfiguration,
+    CommonClientConfiguration,
+    isOidcProtocolMode,
+} from "../config/ClientConfiguration.js";
+import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
+import { ResponseHandler } from "../response/ResponseHandler.js";
+import { AuthenticationResult } from "../response/AuthenticationResult.js";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../error/ClientAuthError.js";
+import { UrlString } from "../url/UrlString.js";
+import { CommonEndSessionRequest } from "../request/CommonEndSessionRequest.js";
+import { PopTokenGenerator } from "../crypto/PopTokenGenerator.js";
+import { AuthorizationCodePayload } from "../response/AuthorizationCodePayload.js";
+import * as TimeUtils from "../utils/TimeUtils.js";
+import {
+    buildClientInfoFromHomeAccountId,
+    buildClientInfo,
+} from "../account/ClientInfo.js";
+import { CcsCredentialType, CcsCredential } from "../account/CcsCredential.js";
+import {
+    createClientConfigurationError,
+    ClientConfigurationErrorCodes,
+} from "../error/ClientConfigurationError.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
+import { invokeAsync } from "../utils/FunctionWrappers.js";
+import { ClientAssertion } from "../account/ClientCredentials.js";
+import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
+import { getRequestThumbprint } from "../network/RequestThumbprint.js";
+import {
+    createTokenQueryParameters,
+    createTokenRequestHeaders,
+    executePostToTokenEndpoint,
+} from "../protocol/Token.js";
+import { createDiscoveredInstance } from "../authority/AuthorityFactory.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { Logger } from "../logger/Logger.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { INetworkModule } from "../network/INetworkModule.js";
+import { version, name } from "../packageMetadata.js";
+
+/**
+ * Oauth2.0 Authorization Code client
+ * @internal
+ */
+export class AuthorizationCodeClient {
+    // Flag to indicate if client is for hybrid spa auth code redemption
+    protected includeRedirectUri: boolean = true;
+    private oidcDefaultScopes;
+
+    // Logger object
+    public logger: Logger;
+
+    // Application config
+    protected config: CommonClientConfiguration;
+
+    // Crypto Interface
+    protected cryptoUtils: ICrypto;
+
+    // Storage Interface
+    protected cacheManager: CacheManager;
+
+    // Network Interface
+    protected networkClient: INetworkModule;
+
+    // Server Telemetry Manager
+    protected serverTelemetryManager: ServerTelemetryManager | null;
+
+    // Default authority object
+    public authority: Authority;
+
+    // Performance telemetry client
+    protected performanceClient: IPerformanceClient;
+
+    constructor(
+        configuration: ClientConfiguration,
+        performanceClient: IPerformanceClient
+    ) {
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
+        this.oidcDefaultScopes =
+            this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
+    }
+
+    /**
+     * API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
+     * authorization_code_grant
+     * @param request
+     */
+    async acquireToken(
+        request: CommonAuthorizationCodeRequest,
+        apiId: number,
+        authCodePayload?: AuthorizationCodePayload
+    ): Promise<AuthenticationResult> {
+        if (!request.code) {
+            throw createClientAuthError(
+                ClientAuthErrorCodes.requestCannotBeMade
+            );
+        }
+
+        // Check for new cloud instance
+        if (authCodePayload && authCodePayload.cloud_instance_host_name) {
+            await invokeAsync(
+                this.updateTokenEndpointAuthority.bind(this),
+                PerformanceEvents.UpdateTokenEndpointAuthority,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(authCodePayload.cloud_instance_host_name, request.correlationId);
+        }
+
+        const reqTimestamp = TimeUtils.nowSeconds();
+        const response = await invokeAsync(
+            this.executeTokenRequest.bind(this),
+            PerformanceEvents.AuthClientExecuteTokenRequest,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(this.authority, request, this.serverTelemetryManager);
+
+        // Retrieve requestId from response headers
+        const requestId =
+            response.headers?.[Constants.HeaderNames.X_MS_REQUEST_ID];
+
+        const responseHandler = new ResponseHandler(
+            this.config.authOptions.clientId,
+            this.cacheManager,
+            this.cryptoUtils,
+            this.logger,
+            this.performanceClient,
+            this.config.serializableCache,
+            this.config.persistencePlugin
+        );
+
+        // Validate response. This function throws a server error if an error is returned by the server.
+        responseHandler.validateTokenResponse(
+            response.body,
+            request.correlationId
+        );
+
+        return invokeAsync(
+            responseHandler.handleServerTokenResponse.bind(responseHandler),
+            PerformanceEvents.HandleServerTokenResponse,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(
+            response.body,
+            this.authority,
+            reqTimestamp,
+            request,
+            apiId,
+            authCodePayload,
+            undefined,
+            undefined,
+            undefined,
+            requestId
+        );
+    }
+
+    /**
+     * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
+     * Default behaviour is to redirect the user to `window.location.href`.
+     * @param authorityUri
+     */
+    getLogoutUri(logoutRequest: CommonEndSessionRequest): string {
+        // Throw error if logoutRequest is null/undefined
+        if (!logoutRequest) {
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.logoutRequestEmpty
+            );
+        }
+        const queryString = this.createLogoutUrlQueryString(logoutRequest);
+
+        // Construct logout URI
+        return UrlString.appendQueryString(
+            this.authority.endSessionEndpoint,
+            queryString
+        );
+    }
+
+    /**
+     * Executes POST request to token endpoint
+     * @param authority
+     * @param request
+     */
+    private async executeTokenRequest(
+        authority: Authority,
+        request: CommonAuthorizationCodeRequest,
+        serverTelemetryManager: ServerTelemetryManager | null
+    ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
+        const queryParametersString = createTokenQueryParameters(
+            request,
+            this.config.authOptions.clientId,
+            this.config.authOptions.redirectUri,
+            this.performanceClient
+        );
+        const endpoint = UrlString.appendQueryString(
+            authority.tokenEndpoint,
+            queryParametersString
+        );
+
+        const requestBody = await invokeAsync(
+            this.createTokenRequestBody.bind(this),
+            PerformanceEvents.AuthClientCreateTokenRequestBody,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(request);
+
+        let ccsCredential: CcsCredential | undefined = undefined;
+        if (request.clientInfo) {
+            try {
+                const clientInfo = buildClientInfo(
+                    request.clientInfo,
+                    this.cryptoUtils.base64Decode
+                );
+                ccsCredential = {
+                    credential: `${clientInfo.uid}${Constants.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
+                    type: CcsCredentialType.HOME_ACCOUNT_ID,
+                };
+            } catch (e) {
+                this.logger.verbose(
+                    `Could not parse client info for CCS Header: '${e}'`,
+                    request.correlationId
+                );
+            }
+        }
+        const headers: Record<string, string> = createTokenRequestHeaders(
+            this.logger,
+            this.config.systemOptions.preventCorsPreflight,
+            ccsCredential || request.ccsCredential
+        );
+
+        const thumbprint = getRequestThumbprint(
+            this.config.authOptions.clientId,
+            request
+        );
+
+        return invokeAsync(
+            executePostToTokenEndpoint,
+            PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(
+            endpoint,
+            requestBody,
+            headers,
+            thumbprint,
+            request.correlationId,
+            this.cacheManager,
+            this.networkClient,
+            this.logger,
+            this.performanceClient,
+            serverTelemetryManager
+        );
+    }
+
+    /**
+     * Generates a map for all the params to be sent to the service
+     * @param request
+     */
+    private async createTokenRequestBody(
+        request: CommonAuthorizationCodeRequest
+    ): Promise<string> {
+        const parameters = new Map<string, string>();
+
+        RequestParameterBuilder.addClientId(
+            parameters,
+            request.embeddedClientId ||
+                request.extraParameters?.[AADServerParamKeys.CLIENT_ID] ||
+                this.config.authOptions.clientId
+        );
+
+        /*
+         * For hybrid spa flow, there will be a code but no verifier
+         * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
+         */
+        if (!this.includeRedirectUri) {
+            // Just validate
+            if (!request.redirectUri) {
+                throw createClientConfigurationError(
+                    ClientConfigurationErrorCodes.redirectUriEmpty
+                );
+            }
+        } else {
+            // Validate and include redirect uri
+            RequestParameterBuilder.addRedirectUri(
+                parameters,
+                request.redirectUri
+            );
+        }
+
+        // Add scope array, parameter builder will add default scopes and dedupe
+        RequestParameterBuilder.addScopes(
+            parameters,
+            request.scopes,
+            true,
+            this.oidcDefaultScopes
+        );
+
+        RequestParameterBuilder.addResource(parameters, request.resource);
+
+        // add code: user set, not validated
+        RequestParameterBuilder.addAuthorizationCode(parameters, request.code);
+
+        // Add library metadata
+        RequestParameterBuilder.addLibraryInfo(
+            parameters,
+            this.config.libraryInfo
+        );
+        RequestParameterBuilder.addApplicationTelemetry(
+            parameters,
+            this.config.telemetry.application
+        );
+        RequestParameterBuilder.addThrottling(parameters);
+
+        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
+            RequestParameterBuilder.addServerTelemetry(
+                parameters,
+                this.serverTelemetryManager
+            );
+        }
+
+        // add code_verifier if passed
+        if (request.codeVerifier) {
+            RequestParameterBuilder.addCodeVerifier(
+                parameters,
+                request.codeVerifier
+            );
+        }
+
+        if (this.config.clientCredentials.clientSecret) {
+            RequestParameterBuilder.addClientSecret(
+                parameters,
+                this.config.clientCredentials.clientSecret
+            );
+        }
+
+        if (this.config.clientCredentials.clientAssertion) {
+            const clientAssertion: ClientAssertion =
+                this.config.clientCredentials.clientAssertion;
+
+            RequestParameterBuilder.addClientAssertion(
+                parameters,
+                await getClientAssertion(
+                    clientAssertion.assertion,
+                    this.config.authOptions.clientId,
+                    request.resourceRequestUri
+                )
+            );
+            RequestParameterBuilder.addClientAssertionType(
+                parameters,
+                clientAssertion.assertionType
+            );
+        }
+
+        RequestParameterBuilder.addGrantType(
+            parameters,
+            Constants.GrantType.AUTHORIZATION_CODE_GRANT
+        );
+        RequestParameterBuilder.addClientInfo(parameters);
+
+        if (
+            request.authenticationScheme === Constants.AuthenticationScheme.POP
+        ) {
+            const popTokenGenerator = new PopTokenGenerator(
+                this.cryptoUtils,
+                this.performanceClient
+            );
+
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            } else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+
+            // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+            RequestParameterBuilder.addPopToken(parameters, reqCnfData);
+        } else if (
+            request.authenticationScheme === Constants.AuthenticationScheme.SSH
+        ) {
+            if (request.sshJwk) {
+                RequestParameterBuilder.addSshJwk(parameters, request.sshJwk);
+            } else {
+                throw createClientConfigurationError(
+                    ClientConfigurationErrorCodes.missingSshJwk
+                );
+            }
+        }
+
+        let ccsCred: CcsCredential | undefined = undefined;
+        if (request.clientInfo) {
+            try {
+                const clientInfo = buildClientInfo(
+                    request.clientInfo,
+                    this.cryptoUtils.base64Decode
+                );
+                ccsCred = {
+                    credential: `${clientInfo.uid}${Constants.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
+                    type: CcsCredentialType.HOME_ACCOUNT_ID,
+                };
+            } catch (e) {
+                this.logger.verbose(
+                    `Could not parse client info for CCS Header: '${e}'`,
+                    request.correlationId
+                );
+            }
+        } else {
+            ccsCred = request.ccsCredential;
+        }
+
+        // Adds these as parameters in the request instead of headers to prevent CORS preflight request
+        if (this.config.systemOptions.preventCorsPreflight && ccsCred) {
+            switch (ccsCred.type) {
+                case CcsCredentialType.HOME_ACCOUNT_ID:
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(
+                            ccsCred.credential
+                        );
+                        RequestParameterBuilder.addCcsOid(
+                            parameters,
+                            clientInfo
+                        );
+                    } catch (e) {
+                        this.logger.verbose(
+                            `Could not parse home account ID for CCS Header: '${e}'`,
+                            request.correlationId
+                        );
+                    }
+                    break;
+                case CcsCredentialType.UPN:
+                    RequestParameterBuilder.addCcsUpn(
+                        parameters,
+                        ccsCred.credential
+                    );
+                    break;
+            }
+        }
+
+        if (request.embeddedClientId) {
+            RequestParameterBuilder.addBrokerParameters(
+                parameters,
+                this.config.authOptions.clientId,
+                this.config.authOptions.redirectUri
+            );
+        }
+
+        if (request.extraParameters) {
+            RequestParameterBuilder.addExtraParameters(
+                parameters,
+                request.extraParameters
+            );
+        }
+
+        // Add hybrid spa parameters if not already provided
+        if (
+            request.enableSpaAuthorizationCode &&
+            (!request.extraParameters ||
+                !request.extraParameters[AADServerParamKeys.RETURN_SPA_CODE])
+        ) {
+            RequestParameterBuilder.addExtraParameters(parameters, {
+                [AADServerParamKeys.RETURN_SPA_CODE]: "1",
+            });
+        }
+
+        RequestParameterBuilder.instrumentBrokerParams(
+            parameters,
+            request.correlationId,
+            this.performanceClient
+        );
+
+        RequestParameterBuilder.addClaims(
+            parameters,
+            request.claims,
+            this.config.authOptions.clientCapabilities,
+            request.skipBrokerClaims
+        );
+
+        return UrlUtils.mapToQueryString(parameters);
+    }
+
+    /**
+     * This API validates the `EndSessionRequest` and creates a URL
+     * @param request
+     */
+    private createLogoutUrlQueryString(
+        request: CommonEndSessionRequest
+    ): string {
+        const parameters = new Map<string, string>();
+
+        if (request.postLogoutRedirectUri) {
+            RequestParameterBuilder.addPostLogoutRedirectUri(
+                parameters,
+                request.postLogoutRedirectUri
+            );
+        }
+
+        if (request.correlationId) {
+            RequestParameterBuilder.addCorrelationId(
+                parameters,
+                request.correlationId
+            );
+        }
+
+        if (request.idTokenHint) {
+            RequestParameterBuilder.addIdTokenHint(
+                parameters,
+                request.idTokenHint
+            );
+        }
+
+        if (request.state) {
+            RequestParameterBuilder.addState(parameters, request.state);
+        }
+
+        if (request.logoutHint) {
+            RequestParameterBuilder.addLogoutHint(
+                parameters,
+                request.logoutHint
+            );
+        }
+
+        if (request.extraQueryParameters) {
+            RequestParameterBuilder.addExtraParameters(
+                parameters,
+                request.extraQueryParameters
+            );
+        }
+
+        if (this.config.authOptions.instanceAware) {
+            RequestParameterBuilder.addInstanceAware(parameters);
+        }
+
+        return UrlUtils.mapToQueryString(parameters);
+    }
+
+    /**
+     * Updates the authority to the cloud instance provided in the authorization response
+     * @param cloudInstanceHostName - cloud instance host name from authorization code payload
+     * @param correlationId - request correlation id
+     */
+    private async updateTokenEndpointAuthority(
+        cloudInstanceHostName: string,
+        correlationId: string
+    ): Promise<void> {
+        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostName}/${this.authority.tenant}/`;
+        const cloudInstanceAuthority = await createDiscoveredInstance(
+            cloudInstanceAuthorityUri,
+            this.networkClient,
+            this.cacheManager,
+            this.authority.options,
+            this.logger,
+            correlationId,
+            this.performanceClient
+        );
+        this.authority = cloudInstanceAuthority;
+    }
+}