plugin-data-source-mssql 2.0.11 → 2.0.12

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/crypto/ICrypto.ts

@@ -0,0 +1,128 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../error/ClientAuthError.js";
+import type { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import type { ShrOptions, SignedHttpRequest } from "./SignedHttpRequest.js";
+
+/**
+ * The PkceCodes type describes the structure
+ * of objects that contain PKCE code
+ * challenge and verifier pairs
+ */
+export type PkceCodes = {
+    verifier: string;
+    challenge: string;
+};
+
+export type SignedHttpRequestParameters = Pick<
+    BaseAuthRequest,
+    | "resourceRequestMethod"
+    | "resourceRequestUri"
+    | "shrClaims"
+    | "shrNonce"
+    | "shrOptions"
+> & {
+    correlationId: string;
+};
+
+/**
+ * Interface for crypto functions used by library
+ */
+export interface ICrypto {
+    /**
+     * Creates a guid randomly.
+     */
+    createNewGuid(): string;
+    /**
+     * base64 Encode string
+     * @param input
+     */
+    base64Encode(input: string): string;
+    /**
+     * base64 decode string
+     * @param input
+     */
+    base64Decode(input: string): string;
+    /**
+     * base64 URL safe encoded string
+     */
+    base64UrlEncode(input: string): string;
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid: string): string;
+    /**
+     * Generates an JWK RSA S256 Thumbprint
+     * @param request
+     */
+    getPublicKeyThumbprint(
+        request: SignedHttpRequestParameters
+    ): Promise<string>;
+    /**
+     * Removes cryptographic keypair from key store matching the keyId passed in
+     * @param kid
+     * @param correlationId
+     */
+    removeTokenBindingKey(kid: string, correlationId: string): Promise<void>;
+    /**
+     * Removes all cryptographic keys from IndexedDB storage
+     * @param correlationId
+     */
+    clearKeystore(correlationId: string): Promise<boolean>;
+    /**
+     * Returns a signed proof-of-possession token with a given acces token that contains a cnf claim with the required kid.
+     * @param accessToken
+     */
+    signJwt(
+        payload: SignedHttpRequest,
+        kid: string,
+        shrOptions?: ShrOptions,
+        correlationId?: string
+    ): Promise<string>;
+    /**
+     * Returns the SHA-256 hash of an input string
+     * @param plainText
+     */
+    hashString(plainText: string): Promise<string>;
+}
+
+export const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {
+    createNewGuid: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    base64Decode: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    base64Encode: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    base64UrlEncode: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    encodeKid: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    async getPublicKeyThumbprint(): Promise<string> {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    async removeTokenBindingKey(): Promise<void> {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    async clearKeystore(): Promise<boolean> {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    async signJwt(): Promise<string> {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    async hashString(): Promise<string> {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+};

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/crypto/IGuidGenerator.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export interface IGuidGenerator {
+    generateGuid(): string;
+    isGuid(guid: string): boolean;
+}

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/crypto/JoseHeader.ts

@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    JoseHeaderErrorCodes,
+    createJoseHeaderError,
+} from "../error/JoseHeaderError.js";
+import { JsonWebTokenTypes } from "../utils/Constants.js";
+
+export type JoseHeaderOptions = {
+    typ?: JsonWebTokenTypes;
+    alg?: string;
+    kid?: string;
+};
+
+/** @internal */
+export class JoseHeader {
+    public typ?: JsonWebTokenTypes;
+    public alg?: string;
+    public kid?: string;
+
+    constructor(options: JoseHeaderOptions) {
+        this.typ = options.typ;
+        this.alg = options.alg;
+        this.kid = options.kid;
+    }
+
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object and returns
+     * the stringified header object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @returns
+     */
+    static getShrHeaderString(shrHeaderOptions: JoseHeaderOptions): string {
+        // KeyID is required on the SHR header
+        if (!shrHeaderOptions.kid) {
+            throw createJoseHeaderError(JoseHeaderErrorCodes.missingKidError);
+        }
+
+        // Alg is required on the SHR header
+        if (!shrHeaderOptions.alg) {
+            throw createJoseHeaderError(JoseHeaderErrorCodes.missingAlgError);
+        }
+
+        const shrHeader = new JoseHeader({
+            // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
+            typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
+            kid: shrHeaderOptions.kid,
+            alg: shrHeaderOptions.alg,
+        });
+
+        return JSON.stringify(shrHeader);
+    }
+}

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/crypto/PopTokenGenerator.ts

@@ -0,0 +1,150 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { ICrypto, SignedHttpRequestParameters } from "./ICrypto.js";
+import * as TimeUtils from "../utils/TimeUtils.js";
+import { UrlString } from "../url/UrlString.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
+import { invokeAsync } from "../utils/FunctionWrappers.js";
+import { Logger } from "../logger/Logger.js";
+
+/**
+ * See eSTS docs for more info.
+ * - A kid element, with the value containing an RFC 7638-compliant JWK thumbprint that is base64 encoded.
+ * -  xms_ksl element, representing the storage location of the key's secret component on the client device. One of two values:
+ *      - sw: software storage
+ *      - uhw: hardware storage
+ */
+type ReqCnf = {
+    kid: string;
+    xms_ksl: KeyLocation;
+};
+
+export type ReqCnfData = {
+    kid: string;
+    reqCnfString: string;
+};
+
+const KeyLocation = {
+    SW: "sw",
+    UHW: "uhw",
+} as const;
+export type KeyLocation = (typeof KeyLocation)[keyof typeof KeyLocation];
+
+/** @internal */
+export class PopTokenGenerator {
+    private cryptoUtils: ICrypto;
+    private performanceClient: IPerformanceClient;
+
+    constructor(cryptoUtils: ICrypto, performanceClient: IPerformanceClient) {
+        this.cryptoUtils = cryptoUtils;
+        this.performanceClient = performanceClient;
+    }
+
+    /**
+     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
+     * @param request
+     * @returns
+     */
+    async generateCnf(
+        request: SignedHttpRequestParameters,
+        logger: Logger
+    ): Promise<ReqCnfData> {
+        const reqCnf = await invokeAsync(
+            this.generateKid.bind(this),
+            PerformanceEvents.PopTokenGenerateCnf,
+            logger,
+            this.performanceClient,
+            request.correlationId
+        )(request);
+        const reqCnfString: string = this.cryptoUtils.base64UrlEncode(
+            JSON.stringify(reqCnf)
+        );
+
+        return {
+            kid: reqCnf.kid,
+            reqCnfString,
+        };
+    }
+
+    /**
+     * Generates key_id for a SHR token request
+     * @param request
+     * @returns
+     */
+    async generateKid(request: SignedHttpRequestParameters): Promise<ReqCnf> {
+        const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(
+            request
+        );
+
+        return {
+            kid: kidThumbprint,
+            xms_ksl: KeyLocation.SW,
+        };
+    }
+
+    /**
+     * Signs the POP access_token with the local generated key-pair
+     * @param accessToken
+     * @param request
+     * @returns
+     */
+    async signPopToken(
+        accessToken: string,
+        keyId: string,
+        request: SignedHttpRequestParameters
+    ): Promise<string> {
+        return this.signPayload(accessToken, keyId, request);
+    }
+
+    /**
+     * Utility function to generate the signed JWT for an access_token
+     * @param payload
+     * @param kid
+     * @param request
+     * @param claims
+     * @returns
+     */
+    async signPayload(
+        payload: string,
+        keyId: string,
+        request: SignedHttpRequestParameters,
+        claims?: object
+    ): Promise<string> {
+        // Deconstruct request to extract SHR parameters
+        const {
+            resourceRequestMethod,
+            resourceRequestUri,
+            shrClaims,
+            shrNonce,
+            shrOptions,
+        } = request;
+
+        const resourceUrlString = resourceRequestUri
+            ? new UrlString(resourceRequestUri)
+            : undefined;
+        const resourceUrlComponents = resourceUrlString?.getUrlComponents();
+        return this.cryptoUtils.signJwt(
+            {
+                at: payload,
+                ts: TimeUtils.nowSeconds(),
+                m: resourceRequestMethod?.toUpperCase(),
+                u: resourceUrlComponents?.HostNameAndPort,
+                nonce: shrNonce || this.cryptoUtils.createNewGuid(),
+                p: resourceUrlComponents?.AbsolutePath,
+                q: resourceUrlComponents?.QueryString
+                    ? [[], resourceUrlComponents.QueryString]
+                    : undefined,
+                client_claims: shrClaims || undefined,
+                ...claims,
+            },
+            keyId,
+            shrOptions,
+            request.correlationId
+        );
+    }
+}

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/crypto/SignedHttpRequest.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { JoseHeaderOptions } from "./JoseHeader.js";
+
+export type SignedHttpRequest = {
+    at?: string;
+    cnf?: object;
+    m?: string;
+    u?: string;
+    p?: string;
+    q?: [Array<string>, string];
+    ts?: number;
+    nonce?: string;
+    client_claims?: string;
+};
+
+export type ShrOptions = {
+    header: JoseHeaderOptions;
+};

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/error/AuthError.ts

@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import * as AuthErrorCodes from "./AuthErrorCodes.js";
+import type { PlatformBrokerError } from "./PlatformBrokerError.js";
+export { AuthErrorCodes };
+
+export function getDefaultErrorMessage(code: string): string {
+    return `See https://aka.ms/msal.js.errors#${code} for details`;
+}
+
+/**
+ * General error class thrown by the MSAL.js library.
+ */
+export class AuthError extends Error {
+    /**
+     * Short string denoting error
+     */
+    errorCode: string;
+
+    /**
+     * Detailed description of error
+     */
+    errorMessage: string;
+
+    /**
+     * Describes the subclass of an error
+     */
+    subError: string;
+
+    /**
+     * CorrelationId associated with the error
+     */
+    correlationId: string;
+
+    /**
+     * Default PlatformBrokerError from MsalNodeRuntime when broker is enabled
+     */
+    platformBrokerError?: PlatformBrokerError;
+
+    constructor(errorCode?: string, errorMessage?: string, suberror?: string) {
+        const message =
+            errorMessage ||
+            (errorCode ? getDefaultErrorMessage(errorCode) : "");
+        const errorString = message ? `${errorCode}: ${message}` : errorCode;
+        super(errorString);
+        Object.setPrototypeOf(this, AuthError.prototype);
+
+        this.errorCode = errorCode || "";
+        this.errorMessage = message || "";
+        this.subError = suberror || "";
+        this.name = "AuthError";
+    }
+
+    setCorrelationId(correlationId: string): void {
+        this.correlationId = correlationId;
+    }
+}
+
+export function createAuthError(
+    code: string,
+    additionalMessage?: string
+): AuthError {
+    return new AuthError(
+        code,
+        additionalMessage || getDefaultErrorMessage(code)
+    );
+}

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/error/AuthErrorCodes.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * AuthErrorMessage class containing string constants used by error codes and messages.
+ */
+export const unexpectedError = "unexpected_error";
+export const postRequestFailed = "post_request_failed";

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/error/CacheError.ts

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import * as CacheErrorCodes from "./CacheErrorCodes.js";
+import { getDefaultErrorMessage } from "./AuthError.js";
+export { CacheErrorCodes };
+
+/**
+ * Error thrown when there is an error with the cache
+ */
+export class CacheError extends Error {
+    /**
+     * Short string denoting error
+     */
+    errorCode: string;
+
+    /**
+     * Detailed description of error
+     */
+    errorMessage: string;
+
+    constructor(errorCode: string, errorMessage?: string) {
+        const message = errorMessage || getDefaultErrorMessage(errorCode);
+        super(message);
+        Object.setPrototypeOf(this, CacheError.prototype);
+
+        this.name = "CacheError";
+        this.errorCode = errorCode;
+        this.errorMessage = message;
+    }
+}
+
+/**
+ * Helper function to wrap browser errors in a CacheError object
+ * @param e
+ * @returns
+ */
+export function createCacheError(e: unknown): CacheError {
+    if (!(e instanceof Error)) {
+        return new CacheError(CacheErrorCodes.cacheErrorUnknown);
+    }
+
+    if (
+        e.name === "QuotaExceededError" ||
+        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+        e.message.includes("exceeded the quota")
+    ) {
+        return new CacheError(CacheErrorCodes.cacheQuotaExceeded);
+    } else {
+        return new CacheError(e.name, e.message);
+    }
+}

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/error/CacheErrorCodes.ts

@@ -0,0 +1,7 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const cacheQuotaExceeded = "cache_quota_exceeded";
+export const cacheErrorUnknown = "cache_error_unknown";

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/error/ClientAuthError.ts

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "./AuthError.js";
+import * as ClientAuthErrorCodes from "./ClientAuthErrorCodes.js";
+export { ClientAuthErrorCodes }; // Allow importing as "ClientAuthErrorCodes";
+
+/**
+ * ClientAuthErrorMessage class containing string constants used by error codes and messages.
+ */
+
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+export class ClientAuthError extends AuthError {
+    constructor(errorCode: string, additionalMessage?: string) {
+        super(errorCode, additionalMessage);
+        this.name = "ClientAuthError";
+
+        Object.setPrototypeOf(this, ClientAuthError.prototype);
+    }
+}
+
+export function createClientAuthError(
+    errorCode: string,
+    additionalMessage?: string
+): ClientAuthError {
+    return new ClientAuthError(errorCode, additionalMessage);
+}

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/error/ClientAuthErrorCodes.ts

@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const clientInfoDecodingError = "client_info_decoding_error";
+export const clientInfoEmptyError = "client_info_empty_error";
+export const tokenParsingError = "token_parsing_error";
+export const nullOrEmptyToken = "null_or_empty_token";
+export const endpointResolutionError = "endpoints_resolution_error";
+export const networkError = "network_error";
+export const openIdConfigError = "openid_config_error";
+export const hashNotDeserialized = "hash_not_deserialized";
+export const invalidState = "invalid_state";
+export const stateMismatch = "state_mismatch";
+export const stateNotFound = "state_not_found";
+export const nonceMismatch = "nonce_mismatch";
+export const authTimeNotFound = "auth_time_not_found";
+export const maxAgeTranspired = "max_age_transpired";
+export const multipleMatchingTokens = "multiple_matching_tokens";
+export const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
+export const requestCannotBeMade = "request_cannot_be_made";
+export const cannotRemoveEmptyScope = "cannot_remove_empty_scope";
+export const cannotAppendScopeSet = "cannot_append_scopeset";
+export const emptyInputScopeSet = "empty_input_scopeset";
+export const noAccountInSilentRequest = "no_account_in_silent_request";
+export const invalidCacheRecord = "invalid_cache_record";
+export const invalidCacheEnvironment = "invalid_cache_environment";
+export const noAccountFound = "no_account_found";
+export const noCryptoObject = "no_crypto_object";
+export const unexpectedCredentialType = "unexpected_credential_type";
+export const tokenRefreshRequired = "token_refresh_required";
+export const tokenClaimsCnfRequiredForSignedJwt =
+    "token_claims_cnf_required_for_signedjwt";
+export const authorizationCodeMissingFromServerResponse =
+    "authorization_code_missing_from_server_response";
+export const bindingKeyNotRemoved = "binding_key_not_removed";
+export const endSessionEndpointNotSupported =
+    "end_session_endpoint_not_supported";
+export const keyIdMissing = "key_id_missing";
+export const noNetworkConnectivity = "no_network_connectivity";
+export const userCanceled = "user_canceled";
+export const methodNotImplemented = "method_not_implemented";
+export const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
+export const platformBrokerError = "platform_broker_error";
+export const resourceParameterRequired = "resource_parameter_required";
+export const misplacedResourceParam = "misplaced_resource_parameter";

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/error/ClientConfigurationError.ts

@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "./AuthError.js";
+import * as ClientConfigurationErrorCodes from "./ClientConfigurationErrorCodes.js";
+export { ClientConfigurationErrorCodes };
+
+/**
+ * Error thrown when there is an error in configuration of the MSAL.js library.
+ */
+export class ClientConfigurationError extends AuthError {
+    constructor(errorCode: string) {
+        super(errorCode);
+        this.name = "ClientConfigurationError";
+        Object.setPrototypeOf(this, ClientConfigurationError.prototype);
+    }
+}
+
+export function createClientConfigurationError(
+    errorCode: string
+): ClientConfigurationError {
+    return new ClientConfigurationError(errorCode);
+}

package/dist/tedious/node_modules/@azure/msal-browser/node_modules/@azure/msal-common/src/error/ClientConfigurationErrorCodes.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const redirectUriEmpty = "redirect_uri_empty";
+export const claimsRequestParsingError = "claims_request_parsing_error";
+export const authorityUriInsecure = "authority_uri_insecure";
+export const urlParseError = "url_parse_error";
+export const urlEmptyError = "empty_url_error";
+export const emptyInputScopesError = "empty_input_scopes_error";
+export const invalidClaims = "invalid_claims";
+export const tokenRequestEmpty = "token_request_empty";
+export const logoutRequestEmpty = "logout_request_empty";
+export const invalidCodeChallengeMethod = "invalid_code_challenge_method";
+export const pkceParamsMissing = "pkce_params_missing";
+export const invalidCloudDiscoveryMetadata = "invalid_cloud_discovery_metadata";
+export const invalidAuthorityMetadata = "invalid_authority_metadata";
+export const untrustedAuthority = "untrusted_authority";
+export const missingSshJwk = "missing_ssh_jwk";
+export const missingSshKid = "missing_ssh_kid";
+export const missingNonceAuthenticationHeader =
+    "missing_nonce_authentication_header";
+export const invalidAuthenticationHeader = "invalid_authentication_header";
+export const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
+export const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
+export const authorityMismatch = "authority_mismatch";
+export const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+export const issuerValidationFailed = "issuer_validation_failed";