plugin-data-source-mssql 2.0.10 → 2.0.12

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/response/ResponseHandler.ts

@@ -0,0 +1,716 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    AccountInfo,
+    buildTenantProfile,
+    updateAccountTenantProfileData,
+} from "../account/AccountInfo.js";
+import {
+    checkMaxAge,
+    extractTokenClaims,
+    isKmsi,
+} from "../account/AuthToken.js";
+import {
+    TokenClaims,
+    getTenantIdFromIdTokenClaims,
+} from "../account/TokenClaims.js";
+import { Authority } from "../authority/Authority.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { AccessTokenEntity } from "../cache/entities/AccessTokenEntity.js";
+import { AccountEntity } from "../cache/entities/AccountEntity.js";
+import { AppMetadataEntity } from "../cache/entities/AppMetadataEntity.js";
+import { CacheRecord } from "../cache/entities/CacheRecord.js";
+import { IdTokenEntity } from "../cache/entities/IdTokenEntity.js";
+import { RefreshTokenEntity } from "../cache/entities/RefreshTokenEntity.js";
+import { ICachePlugin } from "../cache/interface/ICachePlugin.js";
+import { ISerializableTokenCache } from "../cache/interface/ISerializableTokenCache.js";
+import { TokenCacheContext } from "../cache/persistence/TokenCacheContext.js";
+import * as AccountEntityUtils from "../cache/utils/AccountEntityUtils.js";
+import * as CacheHelpers from "../cache/utils/CacheHelpers.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { PopTokenGenerator } from "../crypto/PopTokenGenerator.js";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../error/ClientAuthError.js";
+import {
+    InteractionRequiredAuthError,
+    isInteractionRequiredError,
+} from "../error/InteractionRequiredAuthError.js";
+import { ServerError } from "../error/ServerError.js";
+import { Logger } from "../logger/Logger.js";
+import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import { ScopeSet } from "../request/ScopeSet.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+import * as Constants from "../utils/Constants.js";
+import * as ProtocolUtils from "../utils/ProtocolUtils.js";
+import { RequestStateObject } from "../utils/StateTypes.js";
+import * as TimeUtils from "../utils/TimeUtils.js";
+import { AuthenticationResult } from "./AuthenticationResult.js";
+import { AuthorizationCodePayload } from "./AuthorizationCodePayload.js";
+import { ServerAuthorizationTokenResponse } from "./ServerAuthorizationTokenResponse.js";
+
+/**
+ * Class that handles response parsing.
+ * @internal
+ */
+export class ResponseHandler {
+    private clientId: string;
+    private cacheStorage: CacheManager;
+    private cryptoObj: ICrypto;
+    private logger: Logger;
+    private homeAccountIdentifier: string;
+    private performanceClient: IPerformanceClient;
+    private serializableCache: ISerializableTokenCache | null;
+    private persistencePlugin: ICachePlugin | null;
+
+    constructor(
+        clientId: string,
+        cacheStorage: CacheManager,
+        cryptoObj: ICrypto,
+        logger: Logger,
+        performanceClient: IPerformanceClient,
+        serializableCache: ISerializableTokenCache | null,
+        persistencePlugin: ICachePlugin | null
+    ) {
+        this.clientId = clientId;
+        this.cacheStorage = cacheStorage;
+        this.cryptoObj = cryptoObj;
+        this.logger = logger;
+        this.performanceClient = performanceClient;
+        this.serializableCache = serializableCache;
+        this.persistencePlugin = persistencePlugin;
+    }
+
+    /**
+     * Function which validates server authorization token response.
+     * @param serverResponse
+     * @param correlationId
+     * @param refreshAccessToken
+     */
+    validateTokenResponse(
+        serverResponse: ServerAuthorizationTokenResponse,
+        correlationId: string,
+        refreshAccessToken?: boolean
+    ): void {
+        // Check for error
+        if (
+            serverResponse.error ||
+            serverResponse.error_description ||
+            serverResponse.suberror
+        ) {
+            const errString = `Error(s): ${
+                serverResponse.error_codes || Constants.NOT_AVAILABLE
+            } - Timestamp: ${
+                serverResponse.timestamp || Constants.NOT_AVAILABLE
+            } - Description: ${
+                serverResponse.error_description || Constants.NOT_AVAILABLE
+            } - Correlation ID: ${
+                serverResponse.correlation_id || Constants.NOT_AVAILABLE
+            } - Trace ID: ${
+                serverResponse.trace_id || Constants.NOT_AVAILABLE
+            }`;
+            const serverErrorNo = serverResponse.error_codes?.length
+                ? serverResponse.error_codes[0]
+                : undefined;
+            const serverError = new ServerError(
+                serverResponse.error,
+                errString,
+                serverResponse.suberror,
+                serverErrorNo,
+                serverResponse.status
+            );
+
+            // check if 500 error
+            if (
+                refreshAccessToken &&
+                serverResponse.status &&
+                serverResponse.status >=
+                    Constants.HTTP_SERVER_ERROR_RANGE_START &&
+                serverResponse.status <= Constants.HTTP_SERVER_ERROR_RANGE_END
+            ) {
+                this.logger.warning(
+                    `executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed.\n${serverError}`,
+                    correlationId
+                );
+
+                // don't throw an exception, but alert the user via a log that the token was unable to be refreshed
+                return;
+                // check if 400 error
+            } else if (
+                refreshAccessToken &&
+                serverResponse.status &&
+                serverResponse.status >=
+                    Constants.HTTP_CLIENT_ERROR_RANGE_START &&
+                serverResponse.status <= Constants.HTTP_CLIENT_ERROR_RANGE_END
+            ) {
+                this.logger.warning(
+                    `executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token.\n${serverError}`,
+                    correlationId
+                );
+
+                // don't throw an exception, but alert the user via a log that the token was unable to be refreshed
+                return;
+            }
+
+            if (
+                isInteractionRequiredError(
+                    serverResponse.error,
+                    serverResponse.error_description,
+                    serverResponse.suberror
+                )
+            ) {
+                throw new InteractionRequiredAuthError(
+                    serverResponse.error,
+                    serverResponse.error_description,
+                    serverResponse.suberror,
+                    serverResponse.timestamp || "",
+                    serverResponse.trace_id || "",
+                    serverResponse.correlation_id || "",
+                    serverResponse.claims || "",
+                    serverErrorNo
+                );
+            }
+
+            throw serverError;
+        }
+    }
+
+    /**
+     * Returns a constructed token response based on given string. Also manages the cache updates and cleanups.
+     * @param serverTokenResponse
+     * @param authority
+     */
+    async handleServerTokenResponse(
+        serverTokenResponse: ServerAuthorizationTokenResponse,
+        authority: Authority,
+        reqTimestamp: number,
+        request: BaseAuthRequest,
+        apiId: number,
+        authCodePayload?: AuthorizationCodePayload,
+        userAssertionHash?: string,
+        handlingRefreshTokenResponse?: boolean,
+        forceCacheRefreshTokenResponse?: boolean,
+        serverRequestId?: string
+    ): Promise<AuthenticationResult> {
+        // create an idToken object (not entity)
+        let idTokenClaims: TokenClaims | undefined;
+        if (serverTokenResponse.id_token) {
+            idTokenClaims = extractTokenClaims(
+                serverTokenResponse.id_token || "",
+                this.cryptoObj.base64Decode
+            );
+
+            // token nonce check (TODO: Add a warning if no nonce is given?)
+            if (authCodePayload && authCodePayload.nonce) {
+                if (idTokenClaims.nonce !== authCodePayload.nonce) {
+                    throw createClientAuthError(
+                        ClientAuthErrorCodes.nonceMismatch
+                    );
+                }
+            }
+
+            // token max_age check
+            if (request.maxAge || request.maxAge === 0) {
+                const authTime = idTokenClaims.auth_time;
+                if (!authTime) {
+                    throw createClientAuthError(
+                        ClientAuthErrorCodes.authTimeNotFound
+                    );
+                }
+
+                checkMaxAge(authTime, request.maxAge);
+            }
+        }
+
+        // generate homeAccountId
+        this.homeAccountIdentifier = AccountEntityUtils.generateHomeAccountId(
+            serverTokenResponse.client_info || "",
+            authority.authorityType,
+            this.logger,
+            this.cryptoObj,
+            request.correlationId,
+            idTokenClaims
+        );
+
+        // save the response tokens
+        let requestStateObj: RequestStateObject | undefined;
+        if (!!authCodePayload && !!authCodePayload.state) {
+            requestStateObj = ProtocolUtils.parseRequestState(
+                this.cryptoObj.base64Decode,
+                authCodePayload.state
+            );
+        }
+
+        // Add keyId from request to serverTokenResponse if defined
+        serverTokenResponse.key_id =
+            serverTokenResponse.key_id || request.sshKid || undefined;
+
+        const cacheRecord = this.generateCacheRecord(
+            serverTokenResponse,
+            authority,
+            reqTimestamp,
+            request,
+            idTokenClaims,
+            userAssertionHash,
+            authCodePayload
+        );
+        let cacheContext;
+        try {
+            if (this.persistencePlugin && this.serializableCache) {
+                this.logger.verbose(
+                    "Persistence enabled, calling beforeCacheAccess",
+                    request.correlationId
+                );
+                cacheContext = new TokenCacheContext(
+                    this.serializableCache,
+                    true
+                );
+                await this.persistencePlugin.beforeCacheAccess(cacheContext);
+            }
+            /*
+             * When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.
+             * If not present, we should return null, as it's the case that another application called removeAccount in between
+             * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal, unless explicitly flagged by
+             * the developer, as in the case of refresh token flow used in ADAL Node to MSAL Node migration.
+             */
+            if (
+                handlingRefreshTokenResponse &&
+                !forceCacheRefreshTokenResponse &&
+                cacheRecord.account
+            ) {
+                const cachedAccounts = this.cacheStorage.getAllAccounts(
+                    {
+                        homeAccountId: cacheRecord.account.homeAccountId,
+                        environment: cacheRecord.account.environment,
+                    },
+                    request.correlationId
+                );
+
+                if (cachedAccounts.length < 1) {
+                    this.logger.warning(
+                        "Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache",
+                        request.correlationId
+                    );
+                    this.performanceClient?.addFields(
+                        {
+                            acntLoggedOut: true,
+                        },
+                        request.correlationId
+                    );
+                    return await ResponseHandler.generateAuthenticationResult(
+                        this.cryptoObj,
+                        authority,
+                        cacheRecord,
+                        false,
+                        request,
+                        this.performanceClient,
+                        idTokenClaims,
+                        requestStateObj,
+                        undefined,
+                        serverRequestId
+                    );
+                }
+            }
+            await this.cacheStorage.saveCacheRecord(
+                cacheRecord,
+                request.correlationId,
+                isKmsi(idTokenClaims || {}),
+                apiId,
+                request.storeInCache
+            );
+        } finally {
+            if (
+                this.persistencePlugin &&
+                this.serializableCache &&
+                cacheContext
+            ) {
+                this.logger.verbose(
+                    "Persistence enabled, calling afterCacheAccess",
+                    request.correlationId
+                );
+                await this.persistencePlugin.afterCacheAccess(cacheContext);
+            }
+        }
+
+        return ResponseHandler.generateAuthenticationResult(
+            this.cryptoObj,
+            authority,
+            cacheRecord,
+            false,
+            request,
+            this.performanceClient,
+            idTokenClaims,
+            requestStateObj,
+            serverTokenResponse,
+            serverRequestId
+        );
+    }
+
+    /**
+     * Generates CacheRecord
+     * @param serverTokenResponse
+     * @param idTokenObj
+     * @param authority
+     */
+    private generateCacheRecord(
+        serverTokenResponse: ServerAuthorizationTokenResponse,
+        authority: Authority,
+        reqTimestamp: number,
+        request: BaseAuthRequest,
+        idTokenClaims?: TokenClaims,
+        userAssertionHash?: string,
+        authCodePayload?: AuthorizationCodePayload
+    ): CacheRecord {
+        const env = authority.getPreferredCache();
+        if (!env) {
+            throw createClientAuthError(
+                ClientAuthErrorCodes.invalidCacheEnvironment
+            );
+        }
+
+        const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
+
+        // IdToken: non AAD scenarios can have empty realm
+        let cachedIdToken: IdTokenEntity | undefined;
+        let cachedAccount: AccountEntity | undefined;
+        if (serverTokenResponse.id_token && !!idTokenClaims) {
+            cachedIdToken = CacheHelpers.createIdTokenEntity(
+                this.homeAccountIdentifier,
+                env,
+                serverTokenResponse.id_token,
+                this.clientId,
+                claimsTenantId || ""
+            );
+
+            cachedAccount = buildAccountToCache(
+                this.cacheStorage,
+                authority,
+                this.homeAccountIdentifier,
+                this.cryptoObj.base64Decode,
+                request.correlationId,
+                idTokenClaims,
+                serverTokenResponse.client_info,
+                env,
+                claimsTenantId,
+                authCodePayload,
+                undefined, // nativeAccountId
+                this.logger,
+                this.performanceClient
+            );
+        }
+
+        // AccessToken
+        let cachedAccessToken: AccessTokenEntity | null = null;
+        if (serverTokenResponse.access_token) {
+            // If scopes not returned in server response, use request scopes
+            const responseScopes = serverTokenResponse.scope
+                ? ScopeSet.fromString(serverTokenResponse.scope)
+                : new ScopeSet(request.scopes || []);
+
+            /*
+             * Use timestamp calculated before request
+             * Server may return timestamps as strings, parse to numbers if so.
+             */
+            const expiresIn: number =
+                (typeof serverTokenResponse.expires_in === "string"
+                    ? parseInt(serverTokenResponse.expires_in, 10)
+                    : serverTokenResponse.expires_in) || 0;
+            const extExpiresIn: number =
+                (typeof serverTokenResponse.ext_expires_in === "string"
+                    ? parseInt(serverTokenResponse.ext_expires_in, 10)
+                    : serverTokenResponse.ext_expires_in) || 0;
+            const refreshIn: number | undefined =
+                (typeof serverTokenResponse.refresh_in === "string"
+                    ? parseInt(serverTokenResponse.refresh_in, 10)
+                    : serverTokenResponse.refresh_in) || undefined;
+            const tokenExpirationSeconds = reqTimestamp + expiresIn;
+            const extendedTokenExpirationSeconds =
+                tokenExpirationSeconds + extExpiresIn;
+            const refreshOnSeconds =
+                refreshIn && refreshIn > 0
+                    ? reqTimestamp + refreshIn
+                    : undefined;
+
+            // non AAD scenarios can have empty realm
+            cachedAccessToken = CacheHelpers.createAccessTokenEntity(
+                this.homeAccountIdentifier,
+                env,
+                serverTokenResponse.access_token,
+                this.clientId,
+                claimsTenantId || authority.tenant || "",
+                responseScopes.printScopes(),
+                tokenExpirationSeconds,
+                extendedTokenExpirationSeconds,
+                this.cryptoObj.base64Decode,
+                refreshOnSeconds,
+                serverTokenResponse.token_type,
+                userAssertionHash,
+                serverTokenResponse.key_id
+            );
+            // Set resource (to be used for MCP scenarios)
+            const resource = request.resource || null;
+            if (resource) {
+                cachedAccessToken.resource = resource;
+            }
+        }
+
+        // refreshToken
+        let cachedRefreshToken: RefreshTokenEntity | null = null;
+        if (serverTokenResponse.refresh_token) {
+            let rtExpiresOn: number | undefined;
+            if (serverTokenResponse.refresh_token_expires_in) {
+                const rtExpiresIn: number =
+                    typeof serverTokenResponse.refresh_token_expires_in ===
+                    "string"
+                        ? parseInt(
+                              serverTokenResponse.refresh_token_expires_in,
+                              10
+                          )
+                        : serverTokenResponse.refresh_token_expires_in;
+                rtExpiresOn = reqTimestamp + rtExpiresIn;
+
+                this.performanceClient?.addFields(
+                    { ntwkRtExpiresOnSeconds: rtExpiresOn },
+                    request.correlationId
+                );
+            }
+            cachedRefreshToken = CacheHelpers.createRefreshTokenEntity(
+                this.homeAccountIdentifier,
+                env,
+                serverTokenResponse.refresh_token,
+                this.clientId,
+                serverTokenResponse.foci,
+                userAssertionHash,
+                rtExpiresOn
+            );
+        }
+
+        // appMetadata
+        let cachedAppMetadata: AppMetadataEntity | null = null;
+        if (serverTokenResponse.foci) {
+            cachedAppMetadata = {
+                clientId: this.clientId,
+                environment: env,
+                familyId: serverTokenResponse.foci,
+            };
+        }
+
+        return {
+            account: cachedAccount,
+            idToken: cachedIdToken,
+            accessToken: cachedAccessToken,
+            refreshToken: cachedRefreshToken,
+            appMetadata: cachedAppMetadata,
+        };
+    }
+
+    /**
+     * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
+     *
+     * Optionally takes a state string that is set as-is in the response.
+     *
+     * @param cacheRecord
+     * @param idTokenObj
+     * @param fromTokenCache
+     * @param stateString
+     */
+    static async generateAuthenticationResult(
+        cryptoObj: ICrypto,
+        authority: Authority,
+        cacheRecord: CacheRecord,
+        fromTokenCache: boolean,
+        request: BaseAuthRequest,
+        performanceClient: IPerformanceClient,
+        idTokenClaims?: TokenClaims,
+        requestState?: RequestStateObject,
+        serverTokenResponse?: ServerAuthorizationTokenResponse,
+        requestId?: string
+    ): Promise<AuthenticationResult> {
+        let accessToken: string = "";
+        let responseScopes: Array<string> = [];
+        let expiresOn: Date | null = null;
+        let extExpiresOn: Date | undefined;
+        let refreshOn: Date | undefined;
+        let familyId: string = "";
+
+        if (cacheRecord.accessToken) {
+            /*
+             * if the request object has `popKid` property, `signPopToken` will be set to false and
+             * the token will be returned unsigned
+             */
+            if (
+                cacheRecord.accessToken.tokenType ===
+                    Constants.AuthenticationScheme.POP &&
+                !request.popKid
+            ) {
+                const popTokenGenerator: PopTokenGenerator =
+                    new PopTokenGenerator(cryptoObj, performanceClient);
+                const { secret, keyId } = cacheRecord.accessToken;
+
+                if (!keyId) {
+                    throw createClientAuthError(
+                        ClientAuthErrorCodes.keyIdMissing
+                    );
+                }
+
+                accessToken = await popTokenGenerator.signPopToken(
+                    secret,
+                    keyId,
+                    request
+                );
+            } else {
+                accessToken = cacheRecord.accessToken.secret;
+            }
+            responseScopes = ScopeSet.fromString(
+                cacheRecord.accessToken.target
+            ).asArray();
+            // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
+            expiresOn = TimeUtils.toDateFromSeconds(
+                cacheRecord.accessToken.expiresOn
+            );
+            extExpiresOn = TimeUtils.toDateFromSeconds(
+                cacheRecord.accessToken.extendedExpiresOn
+            );
+            if (cacheRecord.accessToken.refreshOn) {
+                refreshOn = TimeUtils.toDateFromSeconds(
+                    cacheRecord.accessToken.refreshOn
+                );
+            }
+        }
+
+        if (cacheRecord.appMetadata) {
+            familyId =
+                cacheRecord.appMetadata.familyId === Constants.THE_FAMILY_ID
+                    ? Constants.THE_FAMILY_ID
+                    : "";
+        }
+        const uid = idTokenClaims?.oid || idTokenClaims?.sub || "";
+        const tid = idTokenClaims?.tid || "";
+
+        // for hybrid + native bridge enablement, send back the native account Id
+        if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
+            cacheRecord.account.nativeAccountId =
+                serverTokenResponse?.spa_accountid;
+        }
+
+        const accountInfo: AccountInfo | null = cacheRecord.account
+            ? updateAccountTenantProfileData(
+                  AccountEntityUtils.getAccountInfo(cacheRecord.account),
+                  undefined, // tenantProfile optional
+                  idTokenClaims,
+                  cacheRecord.idToken?.secret
+              )
+            : null;
+
+        return {
+            authority: authority.canonicalAuthority,
+            uniqueId: uid,
+            tenantId: tid,
+            scopes: responseScopes,
+            account: accountInfo,
+            idToken: cacheRecord?.idToken?.secret || "",
+            idTokenClaims: idTokenClaims || {},
+            accessToken: accessToken,
+            fromCache: fromTokenCache,
+            expiresOn: expiresOn,
+            extExpiresOn: extExpiresOn,
+            refreshOn: refreshOn,
+            correlationId: request.correlationId,
+            requestId: requestId || "",
+            familyId: familyId,
+            tokenType: cacheRecord.accessToken?.tokenType || "",
+            state: requestState ? requestState.userRequestState : "",
+            cloudGraphHostName: cacheRecord.account?.cloudGraphHostName || "",
+            msGraphHost: cacheRecord.account?.msGraphHost || "",
+            code: serverTokenResponse?.spa_code,
+            fromPlatformBroker: false,
+        };
+    }
+}
+
+export function buildAccountToCache(
+    cacheStorage: CacheManager,
+    authority: Authority,
+    homeAccountId: string,
+    base64Decode: (input: string) => string,
+    correlationId: string,
+    idTokenClaims?: TokenClaims,
+    clientInfo?: string,
+    environment?: string,
+    claimsTenantId?: string | null,
+    authCodePayload?: AuthorizationCodePayload,
+    nativeAccountId?: string,
+    logger?: Logger,
+    performanceClient?: IPerformanceClient
+): AccountEntity {
+    logger?.verbose("setCachedAccount called", correlationId);
+
+    /*
+     * Check if base account is already cached. Filter by homeAccountId (identifies
+     * the user's home identity) and environment (identifies the cloud) — the two
+     * tenant-agnostic properties that uniquely locate a base AccountEntity.
+     */
+    const accountEnvironment = environment || authority.getPreferredCache();
+    const matchedAccounts = cacheStorage.getAccountsFilteredBy(
+        { homeAccountId, environment: accountEnvironment },
+        correlationId
+    );
+    performanceClient?.addFields(
+        { cacheMatchedAccounts: matchedAccounts.length },
+        correlationId
+    );
+
+    if (matchedAccounts.length > 1) {
+        /*
+         * Base accounts are expected to be unique for a given homeAccountId in normal cache usage.
+         * If multiple matches exist, ignore the cache hit rather than arbitrarily choosing one.
+         */
+        logger?.warning(
+            "Multiple base accounts matched homeAccountId. Ignoring cached account and creating a new base account.",
+            correlationId
+        );
+    }
+
+    const cachedAccount =
+        matchedAccounts.length === 1 ? matchedAccounts[0] : null;
+
+    const baseAccount =
+        cachedAccount ||
+        AccountEntityUtils.createAccountEntity(
+            {
+                homeAccountId,
+                idTokenClaims,
+                clientInfo,
+                environment,
+                cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
+                msGraphHost: authCodePayload?.msgraph_host,
+                nativeAccountId: nativeAccountId,
+            },
+            authority,
+            base64Decode
+        );
+
+    const tenantProfiles = baseAccount.tenantProfiles || [];
+    const tenantId = claimsTenantId || baseAccount.realm;
+    if (
+        tenantId &&
+        !tenantProfiles.find((tenantProfile) => {
+            return tenantProfile.tenantId === tenantId;
+        })
+    ) {
+        const newTenantProfile = buildTenantProfile(
+            homeAccountId,
+            baseAccount.localAccountId,
+            tenantId,
+            idTokenClaims
+        );
+        tenantProfiles.push(newTenantProfile);
+    }
+    baseAccount.tenantProfiles = tenantProfiles;
+
+    return baseAccount;
+}