plugin-data-source-mssql 2.0.6 → 2.0.8

package/dist/tedious/node_modules/@azure/msal-common/src/authority/Authority.ts

@@ -427,7 +427,7 @@ export class Authority {
     }
 
     /**
-     * Returns metadata entity from cache if it exists, otherwiser returns a new metadata entity built
+     * Returns metadata entity from cache if it exists, otherwise returns a new metadata entity built
      * from the configured canonical authority
      * @returns
      */
@@ -547,6 +547,9 @@ export class Authority {
             this.correlationId
         )();
         if (metadata) {
+            // Validate the issuer returned by the OIDC discovery document.
+            this.validateIssuer(metadata.issuer);
+
             // If the user prefers to use an azure region replace the global endpoints with regional information.
             if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
                 metadata = await invokeAsync(
@@ -839,7 +842,7 @@ export class Authority {
         metadataEntity: AuthorityMetadataEntity
     ): Constants.AuthorityMetadataSource | null {
         this.logger.verbose(
-            "Attempting to get cloud discovery metadata  from authority configuration",
+            "Attempting to get cloud discovery metadata from authority configuration",
             this.correlationId
         );
         this.logger.verbosePii(
@@ -1195,6 +1198,190 @@ export class Authority {
         return InstanceDiscoveryMetadataAliases.has(host);
     }
 
+    /**
+     * Validates the `issuer` returned by an OIDC discovery document against
+     * this authority, per
+     * https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
+     *
+     * The issuer is accepted when ANY of the following holds:
+     *  1. The issuer scheme + host + port match the authority's (path may
+     *     differ). Applies to all authorities.
+     *  2. The authority is a Microsoft cloud authority (public, sovereign,
+     *     or CIAM), the issuer is HTTPS, and the issuer host is in the known
+     *     Microsoft authority host set.
+     *  3. Same as (2), but the issuer host is a single-label regional variant
+     *     of a known Microsoft host (e.g. `westus.login.microsoftonline.com`).
+     *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
+     *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
+     *     path.
+     *
+     * @param issuer The `issuer` value returned in the OIDC discovery document.
+     * @throws ClientConfigurationError("issuer_validation_failed") on failure.
+     */
+    private validateIssuer(issuer: string): void {
+        if (!issuer) {
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.issuerValidationFailed
+            );
+        }
+
+        // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
+        let issuerUrl: URL;
+        try {
+            issuerUrl = new URL(issuer);
+        } catch {
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.issuerValidationFailed
+            );
+        }
+        const issuerScheme = issuerUrl.protocol;
+        const issuerHost = issuerUrl.host;
+        const authorityScheme = (
+            this.canonicalAuthorityUrlComponents.Protocol || ""
+        ).toLowerCase();
+        const authorityHost = (
+            this.canonicalAuthorityUrlComponents.HostNameAndPort || ""
+        ).toLowerCase();
+
+        // Rule 1: Same scheme and host
+        const matchesAuthorityOrigin = this.matchesAuthorityOrigin(
+            issuerScheme,
+            issuerHost,
+            authorityScheme,
+            authorityHost
+        );
+
+        // Rule 2: The issuer host is a well-known Microsoft authority host (HTTPS only)
+        const matchesKnownMicrosoftHost =
+            issuerScheme === "https:" &&
+            this.isAliasOfKnownMicrosoftAuthority(issuerHost);
+
+        /*
+         * Rule 3: The issuer host is a regional variant ({region}.{host}) of a well-known host
+         * (HTTPS only). E.g. westus2.login.microsoft.com
+         */
+        const matchesRegionalMicrosoftHost =
+            issuerScheme === "https:" &&
+            this.matchesRegionalMicrosoftHost(issuerHost);
+
+        /*
+         * Rule 4: CIAM-specific validation. In a CIAM scenario the issuer is expected to
+         * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
+         */
+        const matchesCiamTenantPattern = this.matchesCiamTenantPattern(
+            issuerUrl,
+            authorityHost,
+            this.canonicalAuthorityUrlComponents.PathSegments
+        );
+
+        // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
+        if (
+            matchesAuthorityOrigin ||
+            matchesKnownMicrosoftHost ||
+            matchesRegionalMicrosoftHost ||
+            matchesCiamTenantPattern
+        ) {
+            return;
+        }
+
+        // issuer validation fails if none of the above rules are satisfied
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.issuerValidationFailed
+        );
+    }
+
+    /**
+     * Rule 1: The issuer scheme + host (and port) match the authority's. Path
+     * may differ. Applies to all authorities.
+     */
+    private matchesAuthorityOrigin(
+        issuerScheme: string,
+        issuerHost: string,
+        authorityScheme: string,
+        authorityHost: string
+    ): boolean {
+        return issuerScheme === authorityScheme && issuerHost === authorityHost;
+    }
+
+    /**
+     * Rule 3: The issuer host is a regional variant
+     * (`{region}.{host}`) of a known Microsoft authority host.
+     * E.g. `westus2.login.microsoft.com`.
+     */
+    private matchesRegionalMicrosoftHost(issuerHost: string): boolean {
+        const firstDot = issuerHost.indexOf(".");
+        if (firstDot > 0 && firstDot < issuerHost.length - 1) {
+            const hostWithoutRegion = issuerHost.substring(firstDot + 1);
+            return this.isAliasOfKnownMicrosoftAuthority(hostWithoutRegion);
+        }
+        return false;
+    }
+
+    /**
+     * Rule 4: The issuer matches one of the well-known CIAM tenant patterns
+     * (`https://{tenant}.ciamlogin.com[/{tenant}[.onmicrosoft.com][/v2.0]]`).
+     *
+     * The bare tenant name is extracted from the authority's first path segment
+     * when available (stripping the `.onmicrosoft.com` suffix that
+     * `transformCIAMAuthority` adds), or otherwise from the leftmost label of
+     * the authority host (to support CIAM custom domain scenarios).
+     *
+     * Both `/{tenant}` and `/{tenant}.onmicrosoft.com` path forms are accepted
+     * because the OIDC issuer may use either form depending on the authority URL
+     * that was used to trigger discovery.
+     */
+    private matchesCiamTenantPattern(
+        issuerUrl: URL,
+        authorityHost: string,
+        authorityPathSegments: string[]
+    ): boolean {
+        /*
+         * authorityPathSegments[0] is the first path segment of the *authority
+         * URL* after transformCIAMAuthority runs (e.g. "contoso.onmicrosoft.com").
+         * Additional CIAM issuer path segments such as "/v2.0" are part of the
+         * issuer string, not the authority URL's PathSegments.
+         */
+        const pathSegment = authorityPathSegments[0];
+
+        /*
+         * Extract the bare tenant name: strip the .onmicrosoft.com suffix when
+         * present (introduced by transformCIAMAuthority), or fall back to the
+         * first label of the authority hostname for non-transformed/custom-domain
+         * CIAM authorities.
+         */
+        const tenantName = pathSegment
+            ? pathSegment.endsWith(Constants.AAD_TENANT_DOMAIN_SUFFIX)
+                ? pathSegment.slice(
+                      0,
+                      -Constants.AAD_TENANT_DOMAIN_SUFFIX.length
+                  )
+                : pathSegment
+            : authorityHost.split(".")[0];
+
+        if (!tenantName) {
+            return false;
+        }
+
+        const ciamBaseURL = `https://${tenantName}${Constants.CIAM_AUTH_URL}`;
+        const validCiamPatterns: string[] = [
+            ciamBaseURL, // https://{tenant}.ciamlogin.com
+            `${ciamBaseURL}/${tenantName}`, // https://{tenant}.ciamlogin.com/{tenant}
+            `${ciamBaseURL}/${tenantName}/v2.0`, // https://{tenant}.ciamlogin.com/{tenant}/v2.0
+            `${ciamBaseURL}/${tenantName}${Constants.AAD_TENANT_DOMAIN_SUFFIX}`, // https://{tenant}.ciamlogin.com/{tenant}.onmicrosoft.com
+            `${ciamBaseURL}/${tenantName}${Constants.AAD_TENANT_DOMAIN_SUFFIX}/v2.0`, // https://{tenant}.ciamlogin.com/{tenant}.onmicrosoft.com/v2.0
+        ];
+
+        /*
+         * Compose the canonical issuer string from URL components and strip any
+         * trailing slashes from the path so it can be compared to the pattern set.
+         */
+        const issuerPath = issuerUrl.pathname.replace(/\/+$/, "");
+        const normalizedIssuer = `${issuerUrl.protocol}//${issuerUrl.host}${issuerPath}`;
+        return validCiamPatterns.some(
+            (pattern) => pattern === normalizedIssuer
+        );
+    }
+
     /**
      * Checks whether the provided host is that of a public cloud authority
      *

package/dist/tedious/node_modules/@azure/msal-common/src/authority/AuthorityMetadata.ts

@@ -105,6 +105,15 @@ export const rawMetdataJSON: RawMetadata = {
                 preferred_cache: "login.sovcloud-identity.sg",
                 aliases: ["login.sovcloud-identity.sg"],
             },
+            {
+                preferred_network: "login.windows-ppe.net",
+                preferred_cache: "login.windows-ppe.net",
+                aliases: [
+                    "login.windows-ppe.net",
+                    "sts.windows-ppe.net",
+                    "login.microsoft-ppe.com",
+                ],
+            },
         ],
     },
 };

package/dist/tedious/node_modules/@azure/msal-common/src/cache/CacheManager.ts

@@ -3,50 +3,50 @@
  * Licensed under the MIT License.
  */
 
-import {
-    AccountFilter,
-    CredentialFilter,
-    ValidCredentialType,
-    AppMetadataFilter,
-    AppMetadataCache,
-    TokenKeys,
-    TenantProfileFilter,
-} from "./utils/CacheTypes.js";
-import { CacheRecord } from "./entities/CacheRecord.js";
-import * as Constants from "../utils/Constants.js";
-import { CredentialEntity } from "./entities/CredentialEntity.js";
-import { ScopeSet } from "../request/ScopeSet.js";
-import { AccountEntity } from "./entities/AccountEntity.js";
-import { AccessTokenEntity } from "./entities/AccessTokenEntity.js";
-import { IdTokenEntity } from "./entities/IdTokenEntity.js";
-import { RefreshTokenEntity } from "./entities/RefreshTokenEntity.js";
-import { ICacheManager } from "./interface/ICacheManager.js";
-import {
-    createClientAuthError,
-    ClientAuthErrorCodes,
-} from "../error/ClientAuthError.js";
 import {
     AccountInfo,
     TenantProfile,
     updateAccountTenantProfileData,
 } from "../account/AccountInfo.js";
-import { AppMetadataEntity } from "./entities/AppMetadataEntity.js";
-import { ServerTelemetryEntity } from "./entities/ServerTelemetryEntity.js";
-import { ThrottlingEntity } from "./entities/ThrottlingEntity.js";
 import { extractTokenClaims } from "../account/AuthToken.js";
+import { TokenClaims } from "../account/TokenClaims.js";
+import { getAliasesFromStaticSources } from "../authority/AuthorityMetadata.js";
+import { StaticAuthorityOptions } from "../authority/AuthorityOptions.js";
 import { ICrypto } from "../crypto/ICrypto.js";
-import { AuthorityMetadataEntity } from "./entities/AuthorityMetadataEntity.js";
-import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import { AuthError } from "../error/AuthError.js";
+import { createCacheError } from "../error/CacheError.js";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../error/ClientAuthError.js";
 import { Logger } from "../logger/Logger.js";
 import { name, version } from "../packageMetadata.js";
+import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import { ScopeSet } from "../request/ScopeSet.js";
 import { StoreInCache } from "../request/StoreInCache.js";
-import { getAliasesFromStaticSources } from "../authority/AuthorityMetadata.js";
-import { StaticAuthorityOptions } from "../authority/AuthorityOptions.js";
-import { TokenClaims } from "../account/TokenClaims.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
-import { createCacheError } from "../error/CacheError.js";
+import * as Constants from "../utils/Constants.js";
+import { AccessTokenEntity } from "./entities/AccessTokenEntity.js";
+import { AccountEntity } from "./entities/AccountEntity.js";
+import { AppMetadataEntity } from "./entities/AppMetadataEntity.js";
+import { AuthorityMetadataEntity } from "./entities/AuthorityMetadataEntity.js";
+import { CacheRecord } from "./entities/CacheRecord.js";
+import { CredentialEntity } from "./entities/CredentialEntity.js";
+import { IdTokenEntity } from "./entities/IdTokenEntity.js";
+import { RefreshTokenEntity } from "./entities/RefreshTokenEntity.js";
+import { ServerTelemetryEntity } from "./entities/ServerTelemetryEntity.js";
+import { ThrottlingEntity } from "./entities/ThrottlingEntity.js";
+import { ICacheManager } from "./interface/ICacheManager.js";
 import * as AccountEntityUtils from "./utils/AccountEntityUtils.js";
-import { AuthError } from "../error/AuthError.js";
+import {
+    AccountFilter,
+    AppMetadataCache,
+    AppMetadataFilter,
+    CredentialFilter,
+    TenantProfileFilter,
+    TokenKeys,
+    ValidCredentialType,
+} from "./utils/CacheTypes.js";
 
 /**
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
@@ -315,8 +315,10 @@ export abstract class CacheManager implements ICacheManager {
         const allAccounts = this.getAllAccounts(accountFilter, correlationId);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
-            const sortedAccounts = allAccounts.sort((account) => {
-                return account.idTokenClaims ? -1 : 1;
+            const sortedAccounts = allAccounts.sort((a, b) => {
+                const aHasClaims = a.idTokenClaims ? 1 : 0;
+                const bHasClaims = b.idTokenClaims ? 1 : 0;
+                return bHasClaims - aHasClaims;
             });
             return sortedAccounts[0];
         } else if (allAccounts.length === 1) {

package/dist/tedious/node_modules/@azure/msal-common/src/error/ClientConfigurationErrorCodes.ts

@@ -26,3 +26,4 @@ export const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 export const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 export const authorityMismatch = "authority_mismatch";
 export const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+export const issuerValidationFailed = "issuer_validation_failed";

package/dist/tedious/node_modules/@azure/msal-common/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.5.1";
+export const version = "16.6.1";

package/dist/tedious/node_modules/@azure/msal-common/types/authority/Authority.d.ts

@@ -0,0 +1,301 @@
+import { AuthorityType } from "./AuthorityType.js";
+import { OpenIdConfigResponse } from "./OpenIdConfigResponse.js";
+import { IUri } from "../url/IUri.js";
+import { INetworkModule } from "../network/INetworkModule.js";
+import { ProtocolMode } from "./ProtocolMode.js";
+import { ICacheManager } from "../cache/interface/ICacheManager.js";
+import { AuthorityOptions, StaticAuthorityOptions } from "./AuthorityOptions.js";
+import { CloudDiscoveryMetadata } from "./CloudDiscoveryMetadata.js";
+import { RegionDiscoveryMetadata } from "./RegionDiscoveryMetadata.js";
+import type { AzureCloudOptions } from "../config/ClientConfiguration.js";
+import { Logger } from "../logger/Logger.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+/**
+ * The authority class validates the authority URIs used by the user, and retrieves the OpenID Configuration Data from the
+ * endpoint. It will store the pertinent config data in this object for use during token calls.
+ * @internal
+ */
+export declare class Authority {
+    private _canonicalAuthority;
+    private _canonicalAuthorityUrlComponents;
+    protected networkInterface: INetworkModule;
+    protected cacheManager: ICacheManager;
+    private authorityOptions;
+    private metadata;
+    private regionDiscovery;
+    regionDiscoveryMetadata: RegionDiscoveryMetadata;
+    private logger;
+    protected performanceClient: IPerformanceClient;
+    protected correlationId: string;
+    private managedIdentity;
+    private static reservedTenantDomains;
+    constructor(authority: string, networkInterface: INetworkModule, cacheManager: ICacheManager, authorityOptions: AuthorityOptions, logger: Logger, correlationId: string, performanceClient: IPerformanceClient, managedIdentity?: boolean);
+    /**
+     * Get {@link AuthorityType}
+     * @param authorityUri {@link IUri}
+     * @private
+     */
+    private getAuthorityType;
+    get authorityType(): AuthorityType;
+    /**
+     * ProtocolMode enum representing the way endpoints are constructed.
+     */
+    get protocolMode(): ProtocolMode;
+    /**
+     * Returns authorityOptions which can be used to reinstantiate a new authority instance
+     */
+    get options(): AuthorityOptions;
+    /**
+     * A URL that is the authority set by the developer
+     */
+    get canonicalAuthority(): string;
+    /**
+     * Sets canonical authority.
+     */
+    set canonicalAuthority(url: string);
+    /**
+     * Get authority components.
+     */
+    get canonicalAuthorityUrlComponents(): IUri;
+    /**
+     * Get hostname and port i.e. login.microsoftonline.com
+     */
+    get hostnameAndPort(): string;
+    /**
+     * Get tenant for authority.
+     */
+    get tenant(): string;
+    /**
+     * OAuth /authorize endpoint for requests
+     */
+    get authorizationEndpoint(): string;
+    /**
+     * OAuth /token endpoint for requests
+     */
+    get tokenEndpoint(): string;
+    get deviceCodeEndpoint(): string;
+    /**
+     * OAuth logout endpoint for requests
+     */
+    get endSessionEndpoint(): string;
+    /**
+     * OAuth issuer for requests
+     */
+    get selfSignedJwtAudience(): string;
+    /**
+     * Jwks_uri for token signing keys
+     */
+    get jwksUri(): string;
+    /**
+     * Returns a flag indicating that tenant name can be replaced in authority {@link IUri}
+     * @param authorityUri {@link IUri}
+     * @private
+     */
+    private canReplaceTenant;
+    /**
+     * Replaces tenant in url path with current tenant. Defaults to common.
+     * @param urlString
+     */
+    private replaceTenant;
+    /**
+     * Replaces path such as tenant or policy with the current tenant or policy.
+     * @param urlString
+     */
+    private replacePath;
+    /**
+     * The default open id configuration endpoint for any canonical authority.
+     */
+    protected get defaultOpenIdConfigurationEndpoint(): string;
+    /**
+     * Boolean that returns whether or not tenant discovery has been completed.
+     */
+    discoveryComplete(): boolean;
+    /**
+     * Perform endpoint discovery to discover aliases, preferred_cache, preferred_network
+     * and the /authorize, /token and logout endpoints.
+     */
+    resolveEndpointsAsync(): Promise<void>;
+    /**
+     * Returns metadata entity from cache if it exists, otherwise returns a new metadata entity built
+     * from the configured canonical authority
+     * @returns
+     */
+    private getCurrentMetadataEntity;
+    /**
+     * Updates cached metadata based on metadata source and sets the instance's metadata
+     * property to the same value
+     * @param metadataEntity
+     * @param cloudDiscoverySource
+     * @param endpointMetadataResult
+     */
+    private updateCachedMetadata;
+    /**
+     * Update AuthorityMetadataEntity with new endpoints and return where the information came from
+     * @param metadataEntity
+     */
+    private updateEndpointMetadata;
+    /**
+     * Updates endpoint metadata from local sources and returns where the information was retrieved from and the metadata config
+     * response if the source is hardcoded metadata
+     * @param metadataEntity
+     * @returns
+     */
+    private updateEndpointMetadataFromLocalSources;
+    /**
+     * Compares the number of url components after the domain to determine if the cached
+     * authority metadata can be used for the requested authority. Protects against same domain different
+     * authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
+     * @param metadataEntity
+     */
+    private isAuthoritySameType;
+    /**
+     * Parse authorityMetadata config option
+     */
+    private getEndpointMetadataFromConfig;
+    /**
+     * Gets OAuth endpoints from the given OpenID configuration endpoint.
+     *
+     * @param hasHardcodedMetadata boolean
+     */
+    private getEndpointMetadataFromNetwork;
+    /**
+     * Get OAuth endpoints for common authorities.
+     */
+    private getEndpointMetadataFromHardcodedValues;
+    /**
+     * Update the retrieved metadata with regional information.
+     * User selected Azure region will be used if configured.
+     */
+    private updateMetadataWithRegionalInformation;
+    /**
+     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
+     * and returns where the information was retrieved from
+     * @param metadataEntity
+     * @returns AuthorityMetadataSource
+     */
+    private updateCloudDiscoveryMetadata;
+    private updateCloudDiscoveryMetadataFromLocalSources;
+    /**
+     * Parse cloudDiscoveryMetadata config or check knownAuthorities
+     */
+    private getCloudDiscoveryMetadataFromConfig;
+    /**
+     * Called to get metadata from network if CloudDiscoveryMetadata was not populated by config
+     *
+     * @param hasHardcodedMetadata boolean
+     */
+    private getCloudDiscoveryMetadataFromNetwork;
+    /**
+     * Helper function to determine if this host is included in the knownAuthorities config option
+     */
+    private isInKnownAuthorities;
+    /**
+     * helper function to populate the authority based on azureCloudOptions
+     * @param authorityString
+     * @param azureCloudOptions
+     */
+    static generateAuthority(authorityString: string, azureCloudOptions?: AzureCloudOptions): string;
+    /**
+     * Creates cloud discovery metadata object from a given host
+     * @param host
+     */
+    static createCloudDiscoveryMetadataFromHost(host: string): CloudDiscoveryMetadata;
+    /**
+     * helper function to generate environment from authority object
+     */
+    getPreferredCache(): string;
+    /**
+     * Returns whether or not the provided host is an alias of this authority instance
+     * @param host
+     */
+    isAlias(host: string): boolean;
+    /**
+     * Returns whether or not the provided host is an alias of a known Microsoft authority for purposes of endpoint discovery
+     * @param host
+     */
+    isAliasOfKnownMicrosoftAuthority(host: string): boolean;
+    /**
+     * Validates the `issuer` returned by an OIDC discovery document against
+     * this authority, per
+     * https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
+     *
+     * The issuer is accepted when ANY of the following holds:
+     *  1. The issuer scheme + host + port match the authority's (path may
+     *     differ). Applies to all authorities.
+     *  2. The authority is a Microsoft cloud authority (public, sovereign,
+     *     or CIAM), the issuer is HTTPS, and the issuer host is in the known
+     *     Microsoft authority host set.
+     *  3. Same as (2), but the issuer host is a single-label regional variant
+     *     of a known Microsoft host (e.g. `westus.login.microsoftonline.com`).
+     *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
+     *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
+     *     path.
+     *
+     * @param issuer The `issuer` value returned in the OIDC discovery document.
+     * @throws ClientConfigurationError("issuer_validation_failed") on failure.
+     */
+    private validateIssuer;
+    /**
+     * Rule 1: The issuer scheme + host (and port) match the authority's. Path
+     * may differ. Applies to all authorities.
+     */
+    private matchesAuthorityOrigin;
+    /**
+     * Rule 3: The issuer host is a regional variant
+     * (`{region}.{host}`) of a known Microsoft authority host.
+     * E.g. `westus2.login.microsoft.com`.
+     */
+    private matchesRegionalMicrosoftHost;
+    /**
+     * Rule 4: The issuer matches one of the well-known CIAM tenant patterns
+     * (`https://{tenant}.ciamlogin.com[/{tenant}[.onmicrosoft.com][/v2.0]]`).
+     *
+     * The bare tenant name is extracted from the authority's first path segment
+     * when available (stripping the `.onmicrosoft.com` suffix that
+     * `transformCIAMAuthority` adds), or otherwise from the leftmost label of
+     * the authority host (to support CIAM custom domain scenarios).
+     *
+     * Both `/{tenant}` and `/{tenant}.onmicrosoft.com` path forms are accepted
+     * because the OIDC issuer may use either form depending on the authority URL
+     * that was used to trigger discovery.
+     */
+    private matchesCiamTenantPattern;
+    /**
+     * Checks whether the provided host is that of a public cloud authority
+     *
+     * @param authority string
+     * @returns bool
+     */
+    static isPublicCloudAuthority(host: string): boolean;
+    /**
+     * Rebuild the authority string with the region
+     *
+     * @param host string
+     * @param region string
+     */
+    static buildRegionalAuthorityString(host: string, region: string, queryString?: string): string;
+    /**
+     * Replace the endpoints in the metadata object with their regional equivalents.
+     *
+     * @param metadata OpenIdConfigResponse
+     * @param azureRegion string
+     */
+    static replaceWithRegionalInformation(metadata: OpenIdConfigResponse, azureRegion: string): OpenIdConfigResponse;
+    /**
+     * Transform CIAM_AUTHORIY as per the below rules:
+     * If no path segments found and it is a CIAM authority (hostname ends with .ciamlogin.com), then transform it
+     *
+     * NOTE: The transformation path should go away once STS supports CIAM with the format: `tenantIdorDomain.ciamlogin.com`
+     * `ciamlogin.com` can also change in the future and we should accommodate the same
+     *
+     * @param authority
+     */
+    static transformCIAMAuthority(authority: string): string;
+}
+/**
+ * Extract tenantId from authority
+ */
+export declare function getTenantFromAuthorityString(authority: string): string | undefined;
+export declare function formatAuthorityUri(authorityUri: string): string;
+export declare function buildStaticAuthorityOptions(authOptions: Partial<AuthorityOptions>): StaticAuthorityOptions;
+//# sourceMappingURL=Authority.d.ts.map

package/dist/tedious/node_modules/@azure/msal-common/types/authority/Authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authority.d.ts","sourceRoot":"","sources":["../../src/authority/Authority.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAEH,oBAAoB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAKtC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAY9D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EACH,gBAAgB,EAEhB,sBAAsB,EACzB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAKpF;;;;GAIG;AACH,qBAAa,SAAS;IAElB,OAAO,CAAC,mBAAmB,CAAY;IAEvC,OAAO,CAAC,gCAAgC,CAAc;IAEtD,SAAS,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAE3C,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC;IAEtC,OAAO,CAAC,gBAAgB,CAAmB;IAE3C,OAAO,CAAC,QAAQ,CAA0B;IAE1C,OAAO,CAAC,eAAe,CAAkB;IAElC,uBAAuB,EAAE,uBAAuB,CAAC;IAExD,OAAO,CAAC,MAAM,CAAS;IAEvB,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAEhD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAEhC,OAAO,CAAC,eAAe,CAAU;IAEjC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAMjC;gBAGC,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAChC,YAAY,EAAE,aAAa,EAC3B,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,kBAAkB,EACrC,eAAe,CAAC,EAAE,OAAO;IAwB7B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAqBxB,IAAW,aAAa,IAAI,aAAa,CAExC;IAED;;OAEG;IACH,IAAW,YAAY,IAAI,YAAY,CAEtC;IAED;;OAEG;IACH,IAAW,OAAO,IAAI,gBAAgB,CAErC;IAED;;OAEG;IACH,IAAW,kBAAkB,IAAI,MAAM,CAEtC;IAED;;OAEG;IACH,IAAW,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAIxC;IAED;;OAEG;IACH,IAAW,+BAA+B,IAAI,IAAI,CAOjD;IAED;;OAEG;IACH,IAAW,eAAe,IAAI,MAAM,CAEnC;IAED;;OAEG;IACH,IAAW,MAAM,IAAI,MAAM,CAE1B;IAED;;OAEG;IACH,IAAW,qBAAqB,IAAI,MAAM,CAQzC;IAED;;OAEG;IACH,IAAW,aAAa,IAAI,MAAM,CAQjC;IAED,IAAW,kBAAkB,IAAI,MAAM,CAUtC;IAED;;OAEG;IACH,IAAW,kBAAkB,IAAI,MAAM,CActC;IAED;;OAEG;IACH,IAAW,qBAAqB,IAAI,MAAM,CAQzC;IAED;;OAEG;IACH,IAAW,OAAO,IAAI,MAAM,CAQ3B;IAED;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAIrB;;;OAGG;IACH,OAAO,CAAC,WAAW;IA4CnB;;OAEG;IACH,SAAS,KAAK,kCAAkC,IAAI,MAAM,CAWzD;IAED;;OAEG;IACH,iBAAiB,IAAI,OAAO;IAI5B;;;OAGG;IACU,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiCnD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IA+B5B;;;OAGG;YACW,sBAAsB;IA6EpC;;;;;OAKG;IACH,OAAO,CAAC,sCAAsC;IAmE9C;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAgBrC;;;;OAIG;YACW,8BAA8B;IAwC5C;;OAEG;IACH,OAAO,CAAC,sCAAsC;IAQ9C;;;OAGG;YACW,qCAAqC;IAmDnD;;;;;OAKG;YACW,4BAA4B;IAiC1C,OAAO,CAAC,4CAA4C;IAwFpD;;OAEG;IACH,OAAO,CAAC,mCAAmC;IAoE3C;;;;OAIG;YACW,oCAAoC;IA6GlD;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAa5B;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CACpB,eAAe,EAAE,MAAM,EACvB,iBAAiB,CAAC,EAAE,iBAAiB,GACtC,MAAM;IAkBT;;;OAGG;IACH,MAAM,CAAC,oCAAoC,CACvC,IAAI,EAAE,MAAM,GACb,sBAAsB;IAQzB;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAY3B;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B;;;OAGG;IACH,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIvD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,cAAc;IAwEtB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;;OAIG;IACH,OAAO,CAAC,4BAA4B;IASpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,wBAAwB;IAoDhC;;;;;OAKG;IACH,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;OAKG;IACH,MAAM,CAAC,4BAA4B,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GACrB,MAAM;IAyBT;;;;;OAKG;IACH,MAAM,CAAC,8BAA8B,CACjC,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,MAAM,GACpB,oBAAoB;IAyBvB;;;;;;;;OAQG;IACH,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAmB3D;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CACxC,SAAS,EAAE,MAAM,GAClB,MAAM,GAAG,SAAS,CAsBpB;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAI/D;AAED,wBAAgB,2BAA2B,CACvC,WAAW,EAAE,OAAO,CAAC,gBAAgB,CAAC,GACvC,sBAAsB,CAoBxB"}

package/dist/tedious/node_modules/@azure/msal-common/types/authority/AuthorityMetadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorityMetadata.d.ts","sourceRoot":"","sources":["../../src/authority/AuthorityMetadata.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,KAAK,WAAW,GAAG;IACf,gBAAgB,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAA;KAAE,CAAC;IAC1D,yBAAyB,EAAE,8BAA8B,CAAC;CAC7D,CAAC;AAkCF,eAAO,MAAM,cAAc,EAAE,WAoE5B,CAAC;AAEF,eAAO,MAAM,gBAAgB;;CAAkC,CAAC;AAChE,eAAO,MAAM,yBAAyB,gCACM,CAAC;AAE7C,eAAO,MAAM,gCAAgC,EAAE,GAAG,CAAC,MAAM,CAAa,CAAC;AASvE;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACvC,sBAAsB,EAAE,sBAAsB,EAC9C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACtB,MAAM,EAAE,CA0BV;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAClC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,aAAa,CAAC,EAAE,MAAM,EACtB,sBAAsB,CAAC,EAAE,sBAAsB,EAAE,EACjD,MAAM,CAAC,EAAE,uBAAuB,GACjC,MAAM,EAAE,GAAG,IAAI,CA0BjB;AAED;;GAEG;AACH,wBAAgB,4CAA4C,CACxD,aAAa,EAAE,MAAM,GACtB,sBAAsB,GAAG,IAAI,CAM/B;AAED;;;;GAIG;AACH,wBAAgB,4CAA4C,CACxD,QAAQ,EAAE,sBAAsB,EAAE,EAClC,aAAa,EAAE,MAAM,GACtB,sBAAsB,GAAG,IAAI,CAS/B"}