plugin-data-source-mssql 2.0.11 → 2.0.12

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/cache/utils/AccountEntityUtils.ts

@@ -0,0 +1,292 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import * as Constants from "../../utils/Constants.js";
+import { Authority } from "../../authority/Authority.js";
+import { ICrypto } from "../../crypto/ICrypto.js";
+import { ClientInfo, buildClientInfo } from "../../account/ClientInfo.js";
+import {
+    AccountInfo,
+    TenantProfile,
+    buildTenantProfile,
+    DataBoundary,
+} from "../../account/AccountInfo.js";
+import {
+    createClientAuthError,
+    ClientAuthErrorCodes,
+} from "../../error/ClientAuthError.js";
+import { AuthorityType } from "../../authority/AuthorityType.js";
+import { Logger } from "../../logger/Logger.js";
+import {
+    TokenClaims,
+    getTenantIdFromIdTokenClaims,
+} from "../../account/TokenClaims.js";
+import { ProtocolMode } from "../../authority/ProtocolMode.js";
+import { AccountEntity } from "../entities/AccountEntity.js";
+
+/**
+ * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+ */
+export function generateAccountId(accountEntity: AccountEntity): string {
+    const accountId: Array<string> = [
+        accountEntity.homeAccountId,
+        accountEntity.environment,
+    ];
+    return accountId.join(Constants.CACHE_KEY_SEPARATOR).toLowerCase();
+}
+
+/**
+ * Returns the AccountInfo interface for this account.
+ */
+export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
+    const tenantProfiles = accountEntity.tenantProfiles || [];
+    // Ensure at least the home tenant profile exists
+    if (
+        tenantProfiles.length === 0 &&
+        accountEntity.realm &&
+        accountEntity.localAccountId
+    ) {
+        tenantProfiles.push(
+            buildTenantProfile(
+                accountEntity.homeAccountId,
+                accountEntity.localAccountId,
+                accountEntity.realm
+            )
+        );
+    }
+    return {
+        homeAccountId: accountEntity.homeAccountId,
+        environment: accountEntity.environment,
+        tenantId: accountEntity.realm,
+        username: accountEntity.username,
+        localAccountId: accountEntity.localAccountId,
+        loginHint: accountEntity.loginHint,
+        name: accountEntity.name,
+        nativeAccountId: accountEntity.nativeAccountId,
+        authorityType: accountEntity.authorityType,
+        // Deserialize tenant profiles array into a Map
+        tenantProfiles: new Map(
+            tenantProfiles.map((tenantProfile) => {
+                return [tenantProfile.tenantId, tenantProfile];
+            })
+        ),
+        dataBoundary: accountEntity.dataBoundary,
+    };
+}
+
+/**
+ * Returns true if the account entity is in single tenant format (outdated), false otherwise
+ */
+export function isSingleTenant(accountEntity: AccountEntity): boolean {
+    return !accountEntity.tenantProfiles;
+}
+
+/**
+ * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
+ * @param accountDetails
+ */
+export function createAccountEntity(
+    accountDetails: {
+        homeAccountId: string;
+        idTokenClaims?: TokenClaims;
+        clientInfo?: string;
+        cloudGraphHostName?: string;
+        msGraphHost?: string;
+        environment?: string;
+        nativeAccountId?: string;
+        tenantProfiles?: Array<TenantProfile>;
+    },
+    authority: Authority,
+    base64Decode?: (input: string) => string
+): AccountEntity {
+    let authorityType;
+    if (authority.authorityType === AuthorityType.Adfs) {
+        authorityType = Constants.CACHE_ACCOUNT_TYPE_ADFS;
+    } else if (authority.protocolMode === ProtocolMode.OIDC) {
+        authorityType = Constants.CACHE_ACCOUNT_TYPE_GENERIC;
+    } else {
+        authorityType = Constants.CACHE_ACCOUNT_TYPE_MSSTS;
+    }
+
+    let clientInfo: ClientInfo | undefined;
+    let dataBoundary: DataBoundary | undefined;
+
+    if (accountDetails.clientInfo && base64Decode) {
+        clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+        if (clientInfo.xms_tdbr) {
+            dataBoundary = clientInfo.xms_tdbr === "EU" ? "EU" : "None";
+        }
+    }
+
+    const env =
+        accountDetails.environment ||
+        (authority && authority.getPreferredCache());
+
+    if (!env) {
+        throw createClientAuthError(
+            ClientAuthErrorCodes.invalidCacheEnvironment
+        );
+    }
+
+    /*
+     * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+     * In most cases it will contain a single email. This field should not be relied upon if a custom
+     * policy is configured to return more than 1 email.
+     */
+    const preferredUsername =
+        accountDetails.idTokenClaims?.preferred_username ||
+        accountDetails.idTokenClaims?.upn;
+    const email = accountDetails.idTokenClaims?.emails
+        ? accountDetails.idTokenClaims.emails[0]
+        : null;
+
+    const username = preferredUsername || email || "";
+
+    const loginHint = accountDetails.idTokenClaims?.login_hint;
+
+    const realm =
+        clientInfo?.utid ||
+        getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+        ""; // non-AAD scenarios can have empty realm
+    // How do you account for MSA CID here?
+    const localAccountId =
+        clientInfo?.uid ||
+        accountDetails.idTokenClaims?.oid ||
+        accountDetails.idTokenClaims?.sub ||
+        "";
+    let tenantProfiles;
+    if (accountDetails.tenantProfiles) {
+        tenantProfiles = accountDetails.tenantProfiles;
+    } else {
+        const tenantProfile = buildTenantProfile(
+            accountDetails.homeAccountId,
+            localAccountId,
+            realm,
+            accountDetails.idTokenClaims
+        );
+        tenantProfiles = [tenantProfile];
+    }
+
+    return {
+        homeAccountId: accountDetails.homeAccountId,
+        environment: env,
+        realm: realm,
+        localAccountId: localAccountId,
+        username: username,
+        authorityType: authorityType,
+        loginHint: loginHint,
+        clientInfo: accountDetails.clientInfo,
+        name: accountDetails.idTokenClaims?.name || "",
+        lastModificationTime: undefined,
+        lastModificationApp: undefined,
+        cloudGraphHostName: accountDetails.cloudGraphHostName,
+        msGraphHost: accountDetails.msGraphHost,
+        nativeAccountId: accountDetails.nativeAccountId,
+        tenantProfiles: tenantProfiles,
+        dataBoundary,
+    } as AccountEntity;
+}
+
+/**
+ * Creates an AccountEntity object from AccountInfo
+ * @param accountInfo
+ * @param cloudGraphHostName
+ * @param msGraphHost
+ * @returns
+ */
+export function createAccountEntityFromAccountInfo(
+    accountInfo: AccountInfo,
+    cloudGraphHostName?: string,
+    msGraphHost?: string
+): AccountEntity {
+    // Serialize tenant profiles map into an array
+    const tenantProfiles = Array.from(
+        accountInfo.tenantProfiles?.values() || []
+    );
+    // Ensure at least the home tenant profile exists
+    if (
+        tenantProfiles.length === 0 &&
+        accountInfo.tenantId &&
+        accountInfo.localAccountId
+    ) {
+        tenantProfiles.push(
+            buildTenantProfile(
+                accountInfo.homeAccountId,
+                accountInfo.localAccountId,
+                accountInfo.tenantId,
+                accountInfo.idTokenClaims
+            )
+        );
+    }
+    return {
+        authorityType:
+            accountInfo.authorityType || Constants.CACHE_ACCOUNT_TYPE_GENERIC,
+        homeAccountId: accountInfo.homeAccountId,
+        localAccountId: accountInfo.localAccountId,
+        nativeAccountId: accountInfo.nativeAccountId,
+        realm: accountInfo.tenantId,
+        environment: accountInfo.environment,
+        username: accountInfo.username,
+        loginHint: accountInfo.loginHint,
+        name: accountInfo.name,
+        cloudGraphHostName: cloudGraphHostName,
+        msGraphHost: msGraphHost,
+        tenantProfiles: tenantProfiles,
+        dataBoundary: accountInfo.dataBoundary,
+    } as AccountEntity;
+}
+
+/**
+ * Generate HomeAccountId from server response
+ * @param serverClientInfo
+ * @param authType
+ */
+export function generateHomeAccountId(
+    serverClientInfo: string,
+    authType: AuthorityType,
+    logger: Logger,
+    cryptoObj: ICrypto,
+    correlationId: string,
+    idTokenClaims?: TokenClaims
+): string {
+    // since ADFS/DSTS do not have tid and does not set client_info
+    if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
+        // for cases where there is clientInfo
+        if (serverClientInfo) {
+            try {
+                const clientInfo = buildClientInfo(
+                    serverClientInfo,
+                    cryptoObj.base64Decode
+                );
+                if (clientInfo.uid && clientInfo.utid) {
+                    return `${clientInfo.uid}.${clientInfo.utid}`;
+                }
+            } catch (e) {}
+        }
+        logger.warning("No client info in response", correlationId);
+    }
+
+    // default to "sub" claim
+    return idTokenClaims?.sub || "";
+}
+
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isAccountEntity(entity: object): entity is AccountEntity {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        entity.hasOwnProperty("homeAccountId") &&
+        entity.hasOwnProperty("environment") &&
+        entity.hasOwnProperty("realm") &&
+        entity.hasOwnProperty("localAccountId") &&
+        entity.hasOwnProperty("username") &&
+        entity.hasOwnProperty("authorityType")
+    );
+}

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/cache/utils/CacheHelpers.ts

@@ -0,0 +1,377 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { extractTokenClaims } from "../../account/AuthToken.js";
+import { TokenClaims } from "../../account/TokenClaims.js";
+import { CloudDiscoveryMetadata } from "../../authority/CloudDiscoveryMetadata.js";
+import { OpenIdConfigResponse } from "../../authority/OpenIdConfigResponse.js";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../../error/ClientAuthError.js";
+import * as Constants from "../../utils/Constants.js";
+import * as TimeUtils from "../../utils/TimeUtils.js";
+import { AccessTokenEntity } from "../entities/AccessTokenEntity.js";
+import { AppMetadataEntity } from "../entities/AppMetadataEntity.js";
+import { AuthorityMetadataEntity } from "../entities/AuthorityMetadataEntity.js";
+import { CredentialEntity } from "../entities/CredentialEntity.js";
+import { IdTokenEntity } from "../entities/IdTokenEntity.js";
+import { RefreshTokenEntity } from "../entities/RefreshTokenEntity.js";
+
+/**
+ * Create IdTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
+ */
+export function createIdTokenEntity(
+    homeAccountId: string,
+    environment: string,
+    idToken: string,
+    clientId: string,
+    tenantId: string
+): IdTokenEntity {
+    const idTokenEntity: IdTokenEntity = {
+        credentialType: Constants.CredentialType.ID_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: idToken,
+        realm: tenantId,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+    };
+
+    return idTokenEntity;
+}
+
+/**
+ * Create AccessTokenEntity
+ * @param homeAccountId
+ * @param environment
+ * @param accessToken
+ * @param clientId
+ * @param tenantId
+ * @param scopes
+ * @param expiresOn
+ * @param extExpiresOn
+ */
+export function createAccessTokenEntity(
+    homeAccountId: string,
+    environment: string,
+    accessToken: string,
+    clientId: string,
+    tenantId: string,
+    scopes: string,
+    expiresOn: number,
+    extExpiresOn: number,
+    base64Decode: (input: string) => string,
+    refreshOn?: number,
+    tokenType?: Constants.AuthenticationScheme,
+    userAssertionHash?: string,
+    keyId?: string
+): AccessTokenEntity {
+    const atEntity: AccessTokenEntity = {
+        homeAccountId: homeAccountId,
+        credentialType: Constants.CredentialType.ACCESS_TOKEN,
+        secret: accessToken,
+        cachedAt: TimeUtils.nowSeconds().toString(),
+        expiresOn: expiresOn.toString(),
+        extendedExpiresOn: extExpiresOn.toString(),
+        environment: environment,
+        clientId: clientId,
+        realm: tenantId,
+        target: scopes,
+        tokenType: tokenType || Constants.AuthenticationScheme.BEARER,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
+    };
+
+    if (userAssertionHash) {
+        atEntity.userAssertionHash = userAssertionHash;
+    }
+
+    if (refreshOn) {
+        atEntity.refreshOn = refreshOn.toString();
+    }
+
+    /*
+     * Create Access Token With Auth Scheme instead of regular access token
+     * Cast to lower to handle "bearer" from ADFS
+     */
+    if (
+        atEntity.tokenType?.toLowerCase() !==
+        Constants.AuthenticationScheme.BEARER.toLowerCase()
+    ) {
+        atEntity.credentialType =
+            Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+        switch (atEntity.tokenType) {
+            case Constants.AuthenticationScheme.POP:
+                // Make sure keyId is present and add it to credential
+                const tokenClaims: TokenClaims | null = extractTokenClaims(
+                    accessToken,
+                    base64Decode
+                );
+                if (!tokenClaims?.cnf?.kid) {
+                    throw createClientAuthError(
+                        ClientAuthErrorCodes.tokenClaimsCnfRequiredForSignedJwt
+                    );
+                }
+                atEntity.keyId = tokenClaims.cnf.kid;
+                break;
+            case Constants.AuthenticationScheme.SSH:
+                atEntity.keyId = keyId;
+        }
+    }
+
+    return atEntity;
+}
+
+/**
+ * Create RefreshTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
+ */
+export function createRefreshTokenEntity(
+    homeAccountId: string,
+    environment: string,
+    refreshToken: string,
+    clientId: string,
+    familyId?: string,
+    userAssertionHash?: string,
+    expiresOn?: number
+): RefreshTokenEntity {
+    const rtEntity: RefreshTokenEntity = {
+        credentialType: Constants.CredentialType.REFRESH_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: refreshToken,
+        lastUpdatedAt: Date.now().toString(),
+    };
+
+    if (userAssertionHash) {
+        rtEntity.userAssertionHash = userAssertionHash;
+    }
+
+    if (familyId) {
+        rtEntity.familyId = familyId;
+    }
+
+    if (expiresOn) {
+        rtEntity.expiresOn = expiresOn.toString();
+    }
+
+    return rtEntity;
+}
+
+export function isCredentialEntity(entity: object): entity is CredentialEntity {
+    return (
+        entity.hasOwnProperty("homeAccountId") &&
+        entity.hasOwnProperty("environment") &&
+        entity.hasOwnProperty("credentialType") &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("secret")
+    );
+}
+
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isAccessTokenEntity(
+    entity: object
+): entity is AccessTokenEntity {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity.hasOwnProperty("target") &&
+        (entity["credentialType"] === Constants.CredentialType.ACCESS_TOKEN ||
+            entity["credentialType"] ===
+                Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME)
+    );
+}
+
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isIdTokenEntity(entity: object): entity is IdTokenEntity {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity["credentialType"] === Constants.CredentialType.ID_TOKEN
+    );
+}
+
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isRefreshTokenEntity(
+    entity: object
+): entity is RefreshTokenEntity {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        isCredentialEntity(entity) &&
+        entity["credentialType"] === Constants.CredentialType.REFRESH_TOKEN
+    );
+}
+
+/**
+ * validates if a given cache entry is "Telemetry", parses <key,value>
+ * @param key
+ * @param entity
+ */
+export function isServerTelemetryEntity(key: string, entity?: object): boolean {
+    const validateKey: boolean =
+        key.indexOf(Constants.SERVER_TELEM_CACHE_KEY) === 0;
+    let validateEntity: boolean = true;
+
+    if (entity) {
+        validateEntity =
+            entity.hasOwnProperty("failedRequests") &&
+            entity.hasOwnProperty("errors") &&
+            entity.hasOwnProperty("cacheHits");
+    }
+
+    return validateKey && validateEntity;
+}
+
+/**
+ * validates if a given cache entry is "Throttling", parses <key,value>
+ * @param key
+ * @param entity
+ */
+export function isThrottlingEntity(key: string, entity?: object): boolean {
+    let validateKey: boolean = false;
+    if (key) {
+        validateKey = key.indexOf(Constants.THROTTLING_PREFIX) === 0;
+    }
+
+    let validateEntity: boolean = true;
+    if (entity) {
+        validateEntity = entity.hasOwnProperty("throttleTime");
+    }
+
+    return validateKey && validateEntity;
+}
+
+/**
+ * Generate AppMetadata Cache Key as per the schema: appmetadata-<environment>-<client_id>
+ */
+export function generateAppMetadataKey({
+    environment,
+    clientId,
+}: AppMetadataEntity): string {
+    const appMetaDataKeyArray: Array<string> = [
+        Constants.APP_METADATA,
+        environment,
+        clientId,
+    ];
+    return appMetaDataKeyArray
+        .join(Constants.CACHE_KEY_SEPARATOR)
+        .toLowerCase();
+}
+
+/*
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isAppMetadataEntity(key: string, entity: object): boolean {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        key.indexOf(Constants.APP_METADATA) === 0 &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("environment")
+    );
+}
+
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isAuthorityMetadataEntity(
+    key: string,
+    entity: object
+): boolean {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        key.indexOf(Constants.AUTHORITY_METADATA_CACHE_KEY) === 0 &&
+        entity.hasOwnProperty("aliases") &&
+        entity.hasOwnProperty("preferred_cache") &&
+        entity.hasOwnProperty("preferred_network") &&
+        entity.hasOwnProperty("canonical_authority") &&
+        entity.hasOwnProperty("authorization_endpoint") &&
+        entity.hasOwnProperty("token_endpoint") &&
+        entity.hasOwnProperty("issuer") &&
+        entity.hasOwnProperty("aliasesFromNetwork") &&
+        entity.hasOwnProperty("endpointsFromNetwork") &&
+        entity.hasOwnProperty("expiresAt") &&
+        entity.hasOwnProperty("jwks_uri")
+    );
+}
+
+/**
+ * Reset the exiresAt value
+ */
+export function generateAuthorityMetadataExpiresAt(): number {
+    return (
+        TimeUtils.nowSeconds() +
+        Constants.AUTHORITY_METADATA_REFRESH_TIME_SECONDS
+    );
+}
+
+export function updateAuthorityEndpointMetadata(
+    authorityMetadata: AuthorityMetadataEntity,
+    updatedValues: OpenIdConfigResponse,
+    fromNetwork: boolean
+): void {
+    authorityMetadata.authorization_endpoint =
+        updatedValues.authorization_endpoint;
+    authorityMetadata.token_endpoint = updatedValues.token_endpoint;
+    authorityMetadata.end_session_endpoint = updatedValues.end_session_endpoint;
+    authorityMetadata.issuer = updatedValues.issuer;
+    authorityMetadata.endpointsFromNetwork = fromNetwork;
+    authorityMetadata.jwks_uri = updatedValues.jwks_uri;
+}
+
+export function updateCloudDiscoveryMetadata(
+    authorityMetadata: AuthorityMetadataEntity,
+    updatedValues: CloudDiscoveryMetadata,
+    fromNetwork: boolean
+): void {
+    authorityMetadata.aliases = updatedValues.aliases;
+    authorityMetadata.preferred_cache = updatedValues.preferred_cache;
+    authorityMetadata.preferred_network = updatedValues.preferred_network;
+    authorityMetadata.aliasesFromNetwork = fromNetwork;
+}
+
+/**
+ * Returns whether or not the data needs to be refreshed
+ */
+export function isAuthorityMetadataExpired(
+    metadata: AuthorityMetadataEntity
+): boolean {
+    return metadata.expiresAt <= TimeUtils.nowSeconds();
+}