plugin-data-source-mssql 2.0.5 → 2.0.7

package/dist/tedious/node_modules/@azure/msal-browser/src/interaction_client/SilentIframeClient.ts

@@ -6,7 +6,7 @@
 import {
     ICrypto,
     Logger,
-    PromptValue,
+    Constants,
     AuthorizationCodeClient,
     AuthError,
     IPerformanceClient,
@@ -15,9 +15,14 @@ import {
     invoke,
     ProtocolMode,
     CommonAuthorizationUrlRequest,
-    HttpMethod,
+    AuthorizeProtocol,
+    PkceCodes,
 } from "@azure/msal-common/browser";
-import { StandardInteractionClient } from "./StandardInteractionClient.js";
+import {
+    initializeAuthorizationRequest,
+    StandardInteractionClient,
+} from "./StandardInteractionClient.js";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
 import { EventHandler } from "../event/EventHandler.js";
@@ -35,7 +40,7 @@ import {
     initiateCodeRequest,
     initiateCodeFlowWithPost,
     initiateEarRequest,
-    monitorIframeForHash,
+    removeHiddenIframe,
 } from "../interaction_handler/SilentHandler.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
@@ -46,6 +51,10 @@ import { generatePkceCodes } from "../crypto/PkceGenerator.js";
 import { isPlatformAuthAllowed } from "../broker/nativeBroker/PlatformAuthProvider.js";
 import { generateEarKey } from "../crypto/BrowserCrypto.js";
 import { IPlatformAuthHandler } from "../broker/nativeBroker/IPlatformAuthHandler.js";
+import {
+    getDiscoveredAuthority,
+    initializeServerTelemetryManager,
+} from "./BaseInteractionClient.js";
 
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
@@ -61,8 +70,8 @@ export class SilentIframeClient extends StandardInteractionClient {
         apiId: ApiId,
         performanceClient: IPerformanceClient,
         nativeStorageImpl: BrowserCacheManager,
-        platformAuthProvider?: IPlatformAuthHandler,
-        correlationId?: string
+        correlationId: string,
+        platformAuthProvider?: IPlatformAuthHandler
     ) {
         super(
             config,
@@ -72,8 +81,8 @@ export class SilentIframeClient extends StandardInteractionClient {
             eventHandler,
             navigationClient,
             performanceClient,
-            platformAuthProvider,
-            correlationId
+            correlationId,
+            platformAuthProvider
         );
         this.apiId = apiId;
         this.nativeStorage = nativeStorageImpl;
@@ -86,10 +95,6 @@ export class SilentIframeClient extends StandardInteractionClient {
     async acquireToken(
         request: SsoSilentRequest
     ): Promise<AuthenticationResult> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.SilentIframeClientAcquireToken,
-            request.correlationId
-        );
         // Check that we have some SSO data
         if (
             !request.loginHint &&
@@ -97,7 +102,8 @@ export class SilentIframeClient extends StandardInteractionClient {
             (!request.account || !request.account.username)
         ) {
             this.logger.warning(
-                "No user hint provided. The authorization server may need more information to complete this request."
+                "No user hint provided. The authorization server may need more information to complete this request.",
+                this.correlationId
             );
         }
 
@@ -105,35 +111,46 @@ export class SilentIframeClient extends StandardInteractionClient {
         const inputRequest = { ...request };
         if (inputRequest.prompt) {
             if (
-                inputRequest.prompt !== PromptValue.NONE &&
-                inputRequest.prompt !== PromptValue.NO_SESSION
+                inputRequest.prompt !== Constants.PromptValue.NONE &&
+                inputRequest.prompt !== Constants.PromptValue.NO_SESSION
             ) {
                 this.logger.warning(
-                    `SilentIframeClient. Replacing invalid prompt ${inputRequest.prompt} with ${PromptValue.NONE}`
+                    `SilentIframeClient. Replacing invalid prompt '${inputRequest.prompt}' with '${Constants.PromptValue.NONE}'`,
+                    this.correlationId
                 );
-                inputRequest.prompt = PromptValue.NONE;
+                inputRequest.prompt = Constants.PromptValue.NONE;
             }
         } else {
-            inputRequest.prompt = PromptValue.NONE;
+            inputRequest.prompt = Constants.PromptValue.NONE;
         }
 
         // Create silent request
         const silentRequest: CommonAuthorizationUrlRequest = await invokeAsync(
-            this.initializeAuthorizationRequest.bind(this),
-            PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
+            initializeAuthorizationRequest,
+            BrowserPerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
             this.logger,
             this.performanceClient,
-            request.correlationId
-        )(inputRequest, InteractionType.Silent);
+            this.correlationId
+        )(
+            inputRequest,
+            InteractionType.Silent,
+            this.config,
+            this.browserCrypto,
+            this.browserStorage,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        );
         silentRequest.platformBroker = isPlatformAuthAllowed(
             this.config,
             this.logger,
+            this.correlationId,
             this.platformAuthProvider,
             silentRequest.authenticationScheme
         );
         BrowserUtils.preconnect(silentRequest.authority);
 
-        if (this.config.auth.protocolMode === ProtocolMode.EAR) {
+        if (this.config.system.protocolMode === ProtocolMode.EAR) {
             return this.executeEarFlow(silentRequest);
         } else {
             return this.executeCodeFlow(silentRequest);
@@ -149,15 +166,19 @@ export class SilentIframeClient extends StandardInteractionClient {
         request: CommonAuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
         let authClient: AuthorizationCodeClient | undefined;
-        const serverTelemetryManager = this.initializeServerTelemetryManager(
-            this.apiId
+        const serverTelemetryManager = initializeServerTelemetryManager(
+            this.apiId,
+            this.config.auth.clientId,
+            this.correlationId,
+            this.browserStorage,
+            this.logger
         );
 
         try {
             // Initialize the client
             authClient = await invokeAsync(
                 this.createAuthCodeClient.bind(this),
-                PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                BrowserPerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
                 this.logger,
                 this.performanceClient,
                 request.correlationId
@@ -171,7 +192,7 @@ export class SilentIframeClient extends StandardInteractionClient {
 
             return await invokeAsync(
                 this.silentTokenHelper.bind(this),
-                PerformanceEvents.SilentIframeClientTokenHelper,
+                BrowserPerformanceEvents.SilentIframeClientTokenHelper,
                 this.logger,
                 this.performanceClient,
                 request.correlationId
@@ -199,7 +220,7 @@ export class SilentIframeClient extends StandardInteractionClient {
 
             return await invokeAsync(
                 this.silentTokenHelper.bind(this),
-                PerformanceEvents.SilentIframeClientTokenHelper,
+                BrowserPerformanceEvents.SilentIframeClientTokenHelper,
                 this.logger,
                 this.performanceClient,
                 this.correlationId
@@ -214,30 +235,41 @@ export class SilentIframeClient extends StandardInteractionClient {
     async executeEarFlow(
         request: CommonAuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
-        const correlationId = request.correlationId;
+        const {
+            correlationId,
+            authority,
+            azureCloudOptions,
+            extraQueryParameters,
+            account,
+        } = request;
         const discoveredAuthority = await invokeAsync(
-            this.getDiscoveredAuthority.bind(this),
-            PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+            getDiscoveredAuthority,
+            BrowserPerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
             this.logger,
             this.performanceClient,
             correlationId
-        )({
-            requestAuthority: request.authority,
-            requestAzureCloudOptions: request.azureCloudOptions,
-            requestExtraQueryParameters: request.extraQueryParameters,
-            account: request.account,
-        });
+        )(
+            this.config,
+            this.correlationId,
+            this.performanceClient,
+            this.browserStorage,
+            this.logger,
+            authority,
+            azureCloudOptions,
+            extraQueryParameters,
+            account
+        );
 
         const earJwk = await invokeAsync(
             generateEarKey,
-            PerformanceEvents.GenerateEarKey,
+            BrowserPerformanceEvents.GenerateEarKey,
             this.logger,
             this.performanceClient,
             correlationId
         )();
         const pkceCodes = await invokeAsync(
             generatePkceCodes,
-            PerformanceEvents.GeneratePkceCodes,
+            BrowserPerformanceEvents.GeneratePkceCodes,
             this.logger,
             this.performanceClient,
             correlationId
@@ -247,9 +279,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        const msalFrame = await invokeAsync(
+        const iframe = await invokeAsync(
             initiateEarRequest,
-            PerformanceEvents.SilentHandlerInitiateAuthRequest,
+            BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
             this.logger,
             this.performanceClient,
             correlationId
@@ -261,43 +293,56 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.performanceClient
         );
 
-        const responseType = this.config.auth.OIDCOptions.serverResponseType;
-        // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(
-            monitorIframeForHash,
-            PerformanceEvents.SilentHandlerMonitorIframeForHash,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            msalFrame,
-            this.config.system.iframeHashTimeout,
-            this.config.system.pollIntervalMilliseconds,
-            this.performanceClient,
-            this.logger,
-            correlationId,
-            responseType
-        );
+        const responseType = this.config.auth.OIDCOptions.responseMode;
+        let responseString: string;
+        try {
+            responseString = await invokeAsync(
+                BrowserUtils.waitForBridgeResponse,
+                BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                this.config.system.iframeBridgeTimeout,
+                this.logger,
+                this.browserCrypto,
+                request,
+                this.performanceClient,
+                this.config.experimental
+            );
+        } finally {
+            invoke(
+                removeHiddenIframe,
+                BrowserPerformanceEvents.RemoveHiddenIframe,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(iframe);
+        }
 
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,
-            PerformanceEvents.DeserializeResponse,
+            BrowserPerformanceEvents.DeserializeResponse,
             this.logger,
             this.performanceClient,
             correlationId
-        )(responseString, responseType, this.logger);
+        )(responseString, responseType, this.logger, this.correlationId);
 
         if (!serverParams.ear_jwe && serverParams.code) {
             // If server doesn't support EAR, they may fallback to auth code flow instead
             const authClient = await invokeAsync(
                 this.createAuthCodeClient.bind(this),
-                PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                BrowserPerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
                 this.logger,
                 this.performanceClient,
                 correlationId
             )({
-                serverTelemetryManager: this.initializeServerTelemetryManager(
-                    this.apiId
+                serverTelemetryManager: initializeServerTelemetryManager(
+                    this.apiId,
+                    this.config.auth.clientId,
+                    correlationId,
+                    this.browserStorage,
+                    this.logger
                 ),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
@@ -308,7 +353,7 @@ export class SilentIframeClient extends StandardInteractionClient {
 
             return invokeAsync(
                 Authorize.handleResponseCode,
-                PerformanceEvents.HandleResponseCode,
+                BrowserPerformanceEvents.HandleResponseCode,
                 this.logger,
                 this.performanceClient,
                 correlationId
@@ -329,7 +374,7 @@ export class SilentIframeClient extends StandardInteractionClient {
         } else {
             return invokeAsync(
                 Authorize.handleResponseEAR,
-                PerformanceEvents.HandleResponseEar,
+                BrowserPerformanceEvents.HandleResponseEar,
                 this.logger,
                 this.performanceClient,
                 correlationId
@@ -349,6 +394,85 @@ export class SilentIframeClient extends StandardInteractionClient {
         }
     }
 
+    /**
+     * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+     * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+     * @param request - The SSO silent request
+     * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+     */
+    async verifySso(request: SsoSilentRequest): Promise<boolean> {
+        const inputRequest = { ...request };
+        if (!inputRequest.prompt) {
+            inputRequest.prompt = Constants.PromptValue.NONE;
+        }
+
+        // Create silent request
+        const silentRequest: CommonAuthorizationUrlRequest = await invokeAsync(
+            initializeAuthorizationRequest,
+            BrowserPerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(
+            inputRequest,
+            InteractionType.Silent,
+            this.config,
+            this.browserCrypto,
+            this.browserStorage,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        );
+
+        const authClient: AuthorizationCodeClient = await invokeAsync(
+            this.createAuthCodeClient.bind(this),
+            BrowserPerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )({
+            serverTelemetryManager: initializeServerTelemetryManager(
+                this.apiId,
+                this.config.auth.clientId,
+                this.correlationId,
+                this.browserStorage,
+                this.logger
+            ),
+            requestAuthority: silentRequest.authority,
+            requestAzureCloudOptions: silentRequest.azureCloudOptions,
+            requestExtraQueryParameters: silentRequest.extraQueryParameters,
+            account: silentRequest.account,
+        });
+
+        const { serverParams } = await this.silentAuthorizeHelper(
+            authClient,
+            silentRequest
+        );
+
+        const correlationId = silentRequest.correlationId;
+
+        // Validate the response - this checks for errors and validates state
+        AuthorizeProtocol.validateAuthorizationResponse(
+            serverParams,
+            silentRequest.state
+        );
+
+        // Verify a valid authorization code is present
+        if (!serverParams.code) {
+            this.logger.warning(
+                "SSO verification response did not contain an authorization code",
+                correlationId
+            );
+            return false;
+        }
+
+        this.logger.verbose(
+            "SSO verification completed successfully with valid authorization code - skipped token exchange",
+            correlationId
+        );
+        return true;
+    }
+
     /**
      * Currently Unsupported
      */
@@ -371,14 +495,51 @@ export class SilentIframeClient extends StandardInteractionClient {
         authClient: AuthorizationCodeClient,
         request: CommonAuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
-        const correlationId = request.correlationId;
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.SilentIframeClientTokenHelper,
-            correlationId
+        const { serverParams, pkceCodes } = await this.silentAuthorizeHelper(
+            authClient,
+            request
         );
+
+        return invokeAsync(
+            Authorize.handleResponseCode,
+            BrowserPerformanceEvents.HandleResponseCode,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(
+            request,
+            serverParams,
+            pkceCodes.verifier,
+            this.apiId,
+            this.config,
+            authClient,
+            this.browserStorage,
+            this.nativeStorage,
+            this.eventHandler,
+            this.logger,
+            this.performanceClient,
+            this.platformAuthProvider
+        );
+    }
+
+    /**
+     * Shared helper that generates PKCE codes, builds the /authorize URL,
+     * loads it in a hidden iframe, waits for the redirect-bridge response,
+     * and returns the deserialized server parameters along with the PKCE codes
+     * and the request that was sent.
+     */
+    private async silentAuthorizeHelper(
+        authClient: AuthorizationCodeClient,
+        request: CommonAuthorizationUrlRequest
+    ): Promise<{
+        serverParams: ReturnType<typeof ResponseHandler.deserializeResponse>;
+        pkceCodes: PkceCodes;
+        silentRequest: CommonAuthorizationUrlRequest;
+    }> {
+        const correlationId = request.correlationId;
         const pkceCodes = await invokeAsync(
             generatePkceCodes,
-            PerformanceEvents.GeneratePkceCodes,
+            BrowserPerformanceEvents.GeneratePkceCodes,
             this.logger,
             this.performanceClient,
             correlationId
@@ -389,12 +550,11 @@ export class SilentIframeClient extends StandardInteractionClient {
             codeChallenge: pkceCodes.challenge,
         };
 
-        let msalFrame: HTMLIFrameElement;
-
-        if (request.httpMethod === HttpMethod.POST) {
-            msalFrame = await invokeAsync(
+        let iframe: HTMLIFrameElement;
+        if (request.httpMethod === Constants.HttpMethod.POST) {
+            iframe = await invokeAsync(
                 initiateCodeFlowWithPost,
-                PerformanceEvents.SilentHandlerInitiateAuthRequest,
+                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
                 this.logger,
                 this.performanceClient,
                 correlationId
@@ -422,65 +582,51 @@ export class SilentIframeClient extends StandardInteractionClient {
             );
 
             // Get the frame handle for the silent request
-            msalFrame = await invokeAsync(
+            iframe = await invokeAsync(
                 initiateCodeRequest,
-                PerformanceEvents.SilentHandlerInitiateAuthRequest,
+                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
                 this.logger,
                 this.performanceClient,
                 correlationId
-            )(
-                navigateUrl,
+            )(navigateUrl, this.performanceClient, this.logger, correlationId);
+        }
+
+        const responseType = this.config.auth.OIDCOptions.responseMode;
+        // Wait for response from the redirect bridge.
+        let responseString: string;
+        try {
+            responseString = await invokeAsync(
+                BrowserUtils.waitForBridgeResponse,
+                BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
+                this.logger,
                 this.performanceClient,
+                correlationId
+            )(
+                this.config.system.iframeBridgeTimeout,
                 this.logger,
-                correlationId,
-                this.config.system.navigateFrameWait
+                this.browserCrypto,
+                request,
+                this.performanceClient,
+                this.config.experimental
             );
+        } finally {
+            invoke(
+                removeHiddenIframe,
+                BrowserPerformanceEvents.RemoveHiddenIframe,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(iframe);
         }
 
-        const responseType = this.config.auth.OIDCOptions.serverResponseType;
-        // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const responseString = await invokeAsync(
-            monitorIframeForHash,
-            PerformanceEvents.SilentHandlerMonitorIframeForHash,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            msalFrame,
-            this.config.system.iframeHashTimeout,
-            this.config.system.pollIntervalMilliseconds,
-            this.performanceClient,
-            this.logger,
-            correlationId,
-            responseType
-        );
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,
-            PerformanceEvents.DeserializeResponse,
+            BrowserPerformanceEvents.DeserializeResponse,
             this.logger,
             this.performanceClient,
             correlationId
-        )(responseString, responseType, this.logger);
+        )(responseString, responseType, this.logger, this.correlationId);
 
-        return invokeAsync(
-            Authorize.handleResponseCode,
-            PerformanceEvents.HandleResponseCode,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            request,
-            serverParams,
-            pkceCodes.verifier,
-            this.apiId,
-            this.config,
-            authClient,
-            this.browserStorage,
-            this.nativeStorage,
-            this.eventHandler,
-            this.logger,
-            this.performanceClient,
-            this.platformAuthProvider
-        );
+        return { serverParams, pkceCodes, silentRequest };
     }
 }