plugin-data-source-mssql 2.0.3 → 2.0.4

package/dist/tedious/node_modules/@azure/msal-browser/src/controllers/NestedAppAuthController.ts

@@ -5,24 +5,23 @@
 
 import {
     CommonAuthorizationUrlRequest,
-    CommonSilentFlowRequest,
     PerformanceCallbackFunction,
     AccountInfo,
     Logger,
     ICrypto,
     IPerformanceClient,
     DEFAULT_CRYPTO_IMPLEMENTATION,
-    PerformanceEvents,
     TimeUtils,
     buildStaticAuthorityOptions,
-    AccountEntity,
-    OIDC_DEFAULT_SCOPES,
+    Constants,
     BaseAuthRequest,
     AccountFilter,
     AuthError,
+    AccountEntityUtils,
     AuthToken,
+    enforceResourceParameter,
 } from "@azure/msal-common/browser";
-import { ITokenCache } from "../cache/ITokenCache.js";
+import * as RootPerformanceEvents from "../telemetry/BrowserRootPerformanceEvents.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import { INavigationClient } from "../navigation/INavigationClient.js";
 import { AuthorizationCodeRequest } from "../request/AuthorizationCodeRequest.js";
@@ -33,11 +32,11 @@ import { RedirectRequest } from "../request/RedirectRequest.js";
 import { SilentRequest } from "../request/SilentRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import {
-    ApiId,
     WrapperSKU,
     InteractionType,
     DEFAULT_REQUEST,
     CacheLookupPolicy,
+    ApiId,
 } from "../utils/BrowserConstants.js";
 import { IController } from "./IController.js";
 import { NestedAppOperatingContext } from "../operatingcontext/NestedAppOperatingContext.js";
@@ -58,6 +57,7 @@ import * as AccountManager from "../cache/AccountManager.js";
 import { AccountContext } from "../naa/BridgeAccountContext.js";
 import { InitializeApplicationRequest } from "../request/InitializeApplicationRequest.js";
 import { createNewGuid } from "../crypto/BrowserCrypto.js";
+import { HandleRedirectPromiseOptions } from "../request/HandleRedirectPromiseOptions.js";
 
 export class NestedAppAuthController implements IController {
     // OperatingContext
@@ -200,21 +200,24 @@ export class NestedAppAuthController implements IController {
         request: PopupRequest | RedirectRequest
     ): Promise<AuthenticationResult> {
         const validRequest = this.ensureValidRequest(request);
+        const correlationId = validRequest.correlationId || createNewGuid();
 
         this.eventHandler.emitEvent(
             EventType.ACQUIRE_TOKEN_START,
+            correlationId,
             InteractionType.Popup,
             validRequest
         );
 
         const atPopupMeasurement = this.performanceClient.startMeasurement(
-            PerformanceEvents.AcquireTokenPopup,
-            validRequest.correlationId
+            RootPerformanceEvents.AcquireTokenPopup,
+            correlationId
         );
 
         atPopupMeasurement.add({ nestedAppAuthRequest: true });
 
         try {
+            enforceResourceParameter(this.config.auth.isMcp, validRequest);
             const naaRequest =
                 this.nestedAppAuthAdapter.toNaaTokenRequest(validRequest);
             const reqTimestamp = TimeUtils.nowSeconds();
@@ -236,7 +239,7 @@ export class NestedAppAuthController implements IController {
             } catch (error) {
                 this.logger.warningPii(
                     `Failed to hydrate cache. Error: ${error}`,
-                    validRequest.correlationId
+                    correlationId
                 );
             }
 
@@ -249,6 +252,7 @@ export class NestedAppAuthController implements IController {
 
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_SUCCESS,
+                correlationId,
                 InteractionType.Popup,
                 result
             );
@@ -275,6 +279,7 @@ export class NestedAppAuthController implements IController {
                     : this.nestedAppAuthAdapter.fromBridgeError(e);
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_FAILURE,
+                correlationId,
                 InteractionType.Popup,
                 null,
                 e as EventError
@@ -301,8 +306,10 @@ export class NestedAppAuthController implements IController {
         request: SilentRequest
     ): Promise<AuthenticationResult> {
         const validRequest = this.ensureValidRequest(request);
+        const correlationId = validRequest.correlationId || createNewGuid();
         this.eventHandler.emitEvent(
             EventType.ACQUIRE_TOKEN_START,
+            correlationId,
             InteractionType.Silent,
             validRequest
         );
@@ -312,6 +319,7 @@ export class NestedAppAuthController implements IController {
         if (result) {
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_SUCCESS,
+                correlationId,
                 InteractionType.Silent,
                 result
             );
@@ -320,8 +328,8 @@ export class NestedAppAuthController implements IController {
 
         // proceed with acquiring tokens via the host
         const ssoSilentMeasurement = this.performanceClient.startMeasurement(
-            PerformanceEvents.SsoSilent,
-            validRequest.correlationId
+            RootPerformanceEvents.SsoSilent,
+            correlationId
         );
 
         ssoSilentMeasurement.increment({
@@ -332,6 +340,7 @@ export class NestedAppAuthController implements IController {
         });
 
         try {
+            enforceResourceParameter(this.config.auth.isMcp, validRequest);
             const naaRequest =
                 this.nestedAppAuthAdapter.toNaaTokenRequest(validRequest);
             naaRequest.forceRefresh = validRequest.forceRefresh;
@@ -352,7 +361,7 @@ export class NestedAppAuthController implements IController {
             } catch (error) {
                 this.logger.warningPii(
                     `Failed to hydrate cache. Error: ${error}`,
-                    validRequest.correlationId
+                    correlationId
                 );
             }
 
@@ -365,6 +374,7 @@ export class NestedAppAuthController implements IController {
 
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_SUCCESS,
+                correlationId,
                 InteractionType.Silent,
                 result
             );
@@ -388,6 +398,7 @@ export class NestedAppAuthController implements IController {
                     : this.nestedAppAuthAdapter.fromBridgeError(e);
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_FAILURE,
+                correlationId,
                 InteractionType.Silent,
                 null,
                 e as EventError
@@ -411,9 +422,10 @@ export class NestedAppAuthController implements IController {
     private async acquireTokenFromCache(
         request: SilentRequest
     ): Promise<AuthenticationResult | null> {
+        const correlationId = request.correlationId || createNewGuid();
         const atsMeasurement = this.performanceClient.startMeasurement(
-            PerformanceEvents.AcquireTokenSilent,
-            request.correlationId
+            RootPerformanceEvents.AcquireTokenSilent,
+            correlationId
         );
 
         atsMeasurement?.add({
@@ -423,7 +435,8 @@ export class NestedAppAuthController implements IController {
         // if the request has claims, we cannot look up in the cache
         if (request.claims) {
             this.logger.verbose(
-                "Claims are present in the request, skipping cache lookup"
+                "Claims are present in the request, skipping cache lookup",
+                correlationId
             );
             return null;
         }
@@ -431,7 +444,8 @@ export class NestedAppAuthController implements IController {
         // if the request has forceRefresh, we cannot look up in the cache
         if (request.forceRefresh) {
             this.logger.verbose(
-                "forceRefresh is set to true, skipping cache lookup"
+                "forceRefresh is set to true, skipping cache lookup",
+                correlationId
             );
             return null;
         }
@@ -455,6 +469,7 @@ export class NestedAppAuthController implements IController {
         if (result) {
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_SUCCESS,
+                correlationId,
                 InteractionType.Silent,
                 result
             );
@@ -473,11 +488,13 @@ export class NestedAppAuthController implements IController {
         }
 
         this.logger.warning(
-            "Cached tokens are not found for the account, proceeding with silent token request."
+            "Cached tokens are not found for the account, proceeding with silent token request.",
+            correlationId
         );
 
         this.eventHandler.emitEvent(
             EventType.ACQUIRE_TOKEN_FAILURE,
+            correlationId,
             InteractionType.Silent,
             null
         );
@@ -503,9 +520,8 @@ export class NestedAppAuthController implements IController {
         // always prioritize the account context from the bridge
         const accountContext =
             this.bridgeProxy.getAccountContext() || this.currentAccountContext;
+        const correlationId = request.correlationId || createNewGuid();
         let currentAccount: AccountInfo | null = null;
-        const correlationId =
-            request.correlationId || this.browserCrypto.createNewGuid();
         if (accountContext) {
             currentAccount = AccountManager.getAccount(
                 accountContext,
@@ -518,23 +534,24 @@ export class NestedAppAuthController implements IController {
         // fall back to brokering if no cached account is found
         if (!currentAccount) {
             this.logger.verbose(
-                "No active account found, falling back to the host"
+                "No active account found, falling back to the host",
+                correlationId
             );
             return Promise.resolve(null);
         }
 
         this.logger.verbose(
-            "active account found, attempting to acquire token silently"
+            "active account found, attempting to acquire token silently",
+            correlationId
         );
 
         const authRequest: BaseAuthRequest = {
             ...request,
-            correlationId:
-                request.correlationId || this.browserCrypto.createNewGuid(),
+            correlationId: correlationId,
             authority: request.authority || currentAccount.environment,
             scopes: request.scopes?.length
                 ? request.scopes
-                : [...OIDC_DEFAULT_SCOPES],
+                : [...Constants.OIDC_DEFAULT_SCOPES],
         };
 
         // fetch access token and check for expiry
@@ -548,7 +565,7 @@ export class NestedAppAuthController implements IController {
 
         // If there is no access token, log it and return null
         if (!cachedAccessToken) {
-            this.logger.verbose("No cached access token found");
+            this.logger.verbose("No cached access token found", correlationId);
             return Promise.resolve(null);
         } else if (
             TimeUtils.wasClockTurnedBack(cachedAccessToken.cachedAt) ||
@@ -557,20 +574,33 @@ export class NestedAppAuthController implements IController {
                 this.config.system.tokenRenewalOffsetSeconds
             )
         ) {
-            this.logger.verbose("Cached access token has expired");
+            this.logger.verbose(
+                "Cached access token has expired",
+                correlationId
+            );
             return Promise.resolve(null);
+        } else if (authRequest.resource) {
+            const requestedResource = authRequest.resource;
+            const cachedResource = cachedAccessToken.resource;
+
+            if (!cachedResource || cachedResource !== requestedResource) {
+                this.logger.verbose(
+                    "Cached access token resource does not match requested resource for MCP flow",
+                    correlationId
+                );
+                return Promise.resolve(null);
+            }
         }
 
         const cachedIdToken = this.browserStorage.getIdToken(
             currentAccount,
             authRequest.correlationId,
             tokenKeys,
-            currentAccount.tenantId,
-            this.performanceClient
+            currentAccount.tenantId
         );
 
         if (!cachedIdToken) {
-            this.logger.verbose("No cached id token found");
+            this.logger.verbose("No cached id token found", correlationId);
             return Promise.resolve(null);
         }
 
@@ -625,45 +655,6 @@ export class NestedAppAuthController implements IController {
         throw NestedAppAuthError.createUnsupportedError();
     }
 
-    /**
-     * acquireTokenNative flow is not currently supported in nested app auth
-     * @param request
-     * @param apiId
-     * @param accountId
-     */
-    acquireTokenNative(
-        request: // eslint-disable-line @typescript-eslint/no-unused-vars
-        | SilentRequest
-            | Partial<
-                  Omit<
-                      CommonAuthorizationUrlRequest,
-                      | "requestedClaimsHash"
-                      | "responseMode"
-                      | "earJwk"
-                      | "codeChallenge"
-                      | "codeChallengeMethod"
-                      | "platformBroker"
-                  >
-              >
-            | PopupRequest,
-        apiId: ApiId, // eslint-disable-line @typescript-eslint/no-unused-vars
-        accountId?: string | undefined // eslint-disable-line @typescript-eslint/no-unused-vars
-    ): Promise<AuthenticationResult> {
-        throw NestedAppAuthError.createUnsupportedError();
-    }
-
-    /**
-     * acquireTokenByRefreshToken flow is not currently supported in nested app auth
-     * @param commonRequest
-     * @param silentRequest
-     */
-    acquireTokenByRefreshToken(
-        commonRequest: CommonSilentFlowRequest, // eslint-disable-line @typescript-eslint/no-unused-vars
-        silentRequest: SilentRequest // eslint-disable-line @typescript-eslint/no-unused-vars
-    ): Promise<AuthenticationResult> {
-        throw NestedAppAuthError.createUnsupportedError();
-    }
-
     /**
      * Adds event callbacks to array
      * @param callback
@@ -694,14 +685,6 @@ export class NestedAppAuthController implements IController {
         throw NestedAppAuthError.createUnsupportedError();
     }
 
-    enableAccountStorageEvents(): void {
-        throw NestedAppAuthError.createUnsupportedError();
-    }
-
-    disableAccountStorageEvents(): void {
-        throw NestedAppAuthError.createUnsupportedError();
-    }
-
     // #region Account APIs
 
     /**
@@ -710,12 +693,11 @@ export class NestedAppAuthController implements IController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
-        const correlationId = this.browserCrypto.createNewGuid();
         return AccountManager.getAllAccounts(
             this.logger,
             this.browserStorage,
             this.isBrowserEnv(),
-            correlationId,
+            createNewGuid(),
             accountFilter
         );
     }
@@ -726,64 +708,11 @@ export class NestedAppAuthController implements IController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter: AccountFilter): AccountInfo | null {
-        const correlationId = this.browserCrypto.createNewGuid();
         return AccountManager.getAccount(
             accountFilter,
             this.logger,
             this.browserStorage,
-            correlationId
-        );
-    }
-
-    /**
-     * Returns the signed in account matching username.
-     * (the account object is created at the time of successful login)
-     * or null when no matching account is found.
-     * This API is provided for convenience but getAccountById should be used for best reliability
-     * @param username
-     * @returns The account object stored in MSAL
-     */
-    getAccountByUsername(username: string): AccountInfo | null {
-        const correlationId = this.browserCrypto.createNewGuid();
-        return AccountManager.getAccountByUsername(
-            username,
-            this.logger,
-            this.browserStorage,
-            correlationId
-        );
-    }
-
-    /**
-     * Returns the signed in account matching homeAccountId.
-     * (the account object is created at the time of successful login)
-     * or null when no matching account is found
-     * @param homeAccountId
-     * @returns The account object stored in MSAL
-     */
-    getAccountByHomeId(homeAccountId: string): AccountInfo | null {
-        const correlationId = this.browserCrypto.createNewGuid();
-        return AccountManager.getAccountByHomeId(
-            homeAccountId,
-            this.logger,
-            this.browserStorage,
-            correlationId
-        );
-    }
-
-    /**
-     * Returns the signed in account matching localAccountId.
-     * (the account object is created at the time of successful login)
-     * or null when no matching account is found
-     * @param localAccountId
-     * @returns The account object stored in MSAL
-     */
-    getAccountByLocalId(localAccountId: string): AccountInfo | null {
-        const correlationId = this.browserCrypto.createNewGuid();
-        return AccountManager.getAccountByLocalId(
-            localAccountId,
-            this.logger,
-            this.browserStorage,
-            correlationId
+            createNewGuid()
         );
     }
 
@@ -796,11 +725,10 @@ export class NestedAppAuthController implements IController {
          * StandardController uses this to allow the developer to set the active account
          * in the nested app auth scenario the active account is controlled by the app hosting the nested app
          */
-        const correlationId = this.browserCrypto.createNewGuid();
         return AccountManager.setActiveAccount(
             account,
             this.browserStorage,
-            correlationId
+            createNewGuid()
         );
     }
 
@@ -808,17 +736,16 @@ export class NestedAppAuthController implements IController {
      * Gets the currently active account
      */
     getActiveAccount(): AccountInfo | null {
-        const correlationId = this.browserCrypto.createNewGuid();
         return AccountManager.getActiveAccount(
             this.browserStorage,
-            correlationId
+            createNewGuid()
         );
     }
 
     // #endregion
 
     handleRedirectPromise(
-        hash?: string | undefined // eslint-disable-line @typescript-eslint/no-unused-vars
+        options?: HandleRedirectPromiseOptions // eslint-disable-line @typescript-eslint/no-unused-vars
     ): Promise<AuthenticationResult | null> {
         return Promise.resolve(null);
     }
@@ -831,10 +758,6 @@ export class NestedAppAuthController implements IController {
     loginRedirect(request?: RedirectRequest | undefined): Promise<void> {
         throw NestedAppAuthError.createUnsupportedError();
     }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    logout(logoutRequest?: EndSessionRequest | undefined): Promise<void> {
-        throw NestedAppAuthError.createUnsupportedError();
-    }
     logoutRedirect(
         logoutRequest?: EndSessionRequest | undefined // eslint-disable-line @typescript-eslint/no-unused-vars
     ): Promise<void> {
@@ -850,7 +773,6 @@ export class NestedAppAuthController implements IController {
         request: Partial<
             Omit<
                 CommonAuthorizationUrlRequest,
-                | "requestedClaimsHash"
                 | "responseMode"
                 | "earJwk"
                 | "codeChallenge"
@@ -861,9 +783,6 @@ export class NestedAppAuthController implements IController {
     ): Promise<AuthenticationResult> {
         return this.acquireTokenSilentInternal(request as SilentRequest);
     }
-    getTokenCache(): ITokenCache {
-        throw NestedAppAuthError.createUnsupportedError();
-    }
 
     /**
      * Returns the logger instance
@@ -892,7 +811,8 @@ export class NestedAppAuthController implements IController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setNavigationClient(navigationClient: INavigationClient): void {
         this.logger.warning(
-            "setNavigationClient is not supported in nested app auth"
+            "setNavigationClient is not supported in nested app auth",
+            ""
         );
     }
 
@@ -929,13 +849,14 @@ export class NestedAppAuthController implements IController {
             | RedirectRequest
             | PopupRequest
     ): Promise<void> {
-        this.logger.verbose("hydrateCache called");
+        this.logger.verbose("hydrateCache called", result.correlationId);
 
-        const accountEntity = AccountEntity.createFromAccountInfo(
-            result.account,
-            result.cloudGraphHostName,
-            result.msGraphHost
-        );
+        const accountEntity =
+            AccountEntityUtils.createAccountEntityFromAccountInfo(
+                result.account,
+                result.cloudGraphHostName,
+                result.msGraphHost
+            );
         await this.browserStorage.setAccount(
             accountEntity,
             result.correlationId,