@azure/msal-node - npm Package Compare versions

Comparing version 1.13.0 to 1.14.0

dist/client/ClientApplication.d.ts

@@ -95,2 +95,12 @@ import { ClientConfiguration, AuthenticationResult, BaseAuthRequest, Logger, ServerTelemetryManager, AzureRegionConfiguration, AzureCloudOptions, AuthorizationCodePayload } from "@azure/msal-common";
     /**
+     * Validates OIDC state by comparing the user cached state with the state received from the server.
+     *
+     * This API is provided for scenarios where you would use OAuth2.0 state parameter to mitigate against
+     * CSRF attacks.
+     * For more information about state, visit https://datatracker.ietf.org/doc/html/rfc6819#section-3.6.
+     * @param state
+     * @param cachedState
+     */
+    protected validateState(state: string, cachedState: string): void;
+    /**
      * Returns the logger instance
@@ -97,0 +107,0 @@ */

dist/error/NodeAuthError.d.ts

@@ -30,2 +30,6 @@ import { AuthError } from "@azure/msal-common";
     };
+    stateNotFoundError: {
+        code: string;
+        desc: string;
+    };
 };
@@ -58,3 +62,7 @@ export declare class NodeAuthError extends AuthError {
     static createLoopbackServerTimeoutError(): NodeAuthError;
+    /**
+     * Creates an error thrown when the state is not present.
+     */
+    static createStateNotFoundError(): NodeAuthError;
 }
 //# sourceMappingURL=NodeAuthError.d.ts.map

dist/msal-node.cjs.production.min.js

@@ -1,2 +0,2 @@
-"use strict";function e(e){return e&&"object"==typeof e&&"default"in e?e.default:e}Object.defineProperty(exports,"__esModule",{value:!0});var t,r,n=require("@azure/msal-common"),i=require("http"),o=e(i),s=e(require("https")),a=require("uuid"),c=e(require("crypto")),l=require("jsonwebtoken");!function(e){e.GET="get",e.POST="post"}(t||(t={})),function(e){e[e.OK=200]="OK",e[e.REDIRECT=302]="REDIRECT"}(r||(r={}));const h="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";var u;!function(e){e[e.acquireTokenSilent=62]="acquireTokenSilent",e[e.acquireTokenByUsernamePassword=371]="acquireTokenByUsernamePassword",e[e.acquireTokenByDeviceCode=671]="acquireTokenByDeviceCode",e[e.acquireTokenByClientCredential=771]="acquireTokenByClientCredential",e[e.acquireTokenByCode=871]="acquireTokenByCode",e[e.acquireTokenByRefreshToken=872]="acquireTokenByRefreshToken"}(u||(u={}));class d{async sendGetRequestAsync(e,r){return null!=r&&r.proxyUrl?g(e,t.GET,r):p(e,t.GET,r)}async sendPostRequestAsync(e,r,n){return null!=r&&r.proxyUrl?g(e,t.POST,r,n):p(e,t.POST,r,n)}}const g=(e,r,n,i)=>{const s=(null==n?void 0:n.headers)||{},a=new URL((null==n?void 0:n.proxyUrl)||""),c=new URL(e),l={host:a.hostname,port:a.port,method:"CONNECT",path:c.hostname,headers:s};i&&(l.timeout=i);let h="";if(r===t.POST){const e=(null==n?void 0:n.body)||"";h=`Content-Type: application/x-www-form-urlencoded\r\nContent-Length: ${e.length}\r\n\r\n`+e}const u=`${r.toUpperCase()} ${c.href} HTTP/1.1\r\nHost: ${c.host}\r\nConnection: close\r\n`+h+"\r\n";return new Promise((e,t)=>{const r=o.request(l);l.timeout&&r.on("timeout",()=>{r.destroy(),t(new Error("Request time out"))}),r.end(),r.on("connect",(n,i)=>{const o=(null==n?void 0:n.statusCode)||500;(o<200||o>299)&&(r.destroy(),i.destroy(),t(new Error("HTTP status code "+o))),l.timeout&&(i.setTimeout(l.timeout),i.on("timeout",()=>{r.destroy(),i.destroy(),t(new Error("Request time out"))})),i.write(u);const s=[];i.on("data",e=>{s.push(e)}),i.on("end",()=>{const n=Buffer.concat([...s]).toString().split("\r\n"),o=parseInt(n[0].split(" ")[1]),a=n[n.length-1],c=n.slice(1,n.length-2),l=new Map;c.forEach(e=>{const t=e.split(new RegExp(/:\s(.*)/s)),r=t[0];let n=t[1];try{const e=JSON.parse(n);e&&"object"==typeof e&&(n=e)}catch(e){}l.set(r,n)});const h={headers:Object.fromEntries(l),body:JSON.parse(a),status:o};(o<200||o>299)&&"authorization_pending"!==h.body.error&&(r.destroy(),i.destroy(),t(new Error("HTTP status code "+o))),e(h)}),i.on("error",e=>{r.destroy(),i.destroy(),t(new Error(e.toString()))})}),r.on("error",e=>{r.destroy(),t(new Error(e.toString()))})})},p=(e,r,n,i)=>{const o=r===t.POST,a=(null==n?void 0:n.body)||"",c={method:r,headers:(null==n?void 0:n.headers)||{}};return i&&(c.timeout=i),o&&(c.headers={...c.headers,"Content-Length":a.length}),new Promise((t,r)=>{const n=s.request(e,c);i&&n.on("timeout",()=>{n.destroy(),r(new Error("Request time out"))}),o&&n.write(a),n.end(),n.on("response",e=>{const i=e.headers,o=e.statusCode,s=[];e.on("data",e=>{s.push(e)}),e.on("end",()=>{const e=Buffer.concat([...s]).toString(),a={headers:i,body:JSON.parse(e),status:o};(o<200||o>299)&&"authorization_pending"!==a.body.error&&(n.destroy(),r(new Error("HTTP status code "+o))),t(a)})}),n.on("error",e=>{n.destroy(),r(new Error(e.toString()))})})},y={clientId:n.Constants.EMPTY_STRING,authority:n.Constants.DEFAULT_AUTHORITY,clientSecret:n.Constants.EMPTY_STRING,clientAssertion:n.Constants.EMPTY_STRING,clientCertificate:{thumbprint:n.Constants.EMPTY_STRING,privateKey:n.Constants.EMPTY_STRING,x5c:n.Constants.EMPTY_STRING},knownAuthorities:[],cloudDiscoveryMetadata:n.Constants.EMPTY_STRING,authorityMetadata:n.Constants.EMPTY_STRING,clientCapabilities:[],protocolMode:n.ProtocolMode.AAD,azureCloudOptions:{azureCloudInstance:n.AzureCloudInstance.None,tenant:n.Constants.EMPTY_STRING},skipAuthorityMetadataCache:!1},m={},f={loggerOptions:{loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:n.LogLevel.Info},networkClient:class{static getNetworkClient(){return new d}}.getNetworkClient(),proxyUrl:n.Constants.EMPTY_STRING},C={application:{appName:n.Constants.EMPTY_STRING,appVersion:n.Constants.EMPTY_STRING}};function T({auth:e,cache:t,system:r,telemetry:n}){return{auth:{...y,...e},cache:{...m,...t},system:{...f,...r},telemetry:{...C,...n}}}class A{generateGuid(){return a.v4()}isGuid(e){return/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}}class k{static base64Encode(e,t){return Buffer.from(e,t).toString("base64")}static base64EncodeUrl(e,t){return k.base64Encode(e,t).replace(/=/g,n.Constants.EMPTY_STRING).replace(/\+/g,"-").replace(/\//g,"_")}static base64Decode(e){return Buffer.from(e,"base64").toString("utf8")}static base64DecodeUrl(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");for(;t.length%4;)t+="=";return k.base64Decode(t)}}class I{sha256(e){return c.createHash("sha256").update(e).digest()}}class E{constructor(){this.hashUtils=new I}async generatePkceCodes(){const e=this.generateCodeVerifier();return{verifier:e,challenge:this.generateCodeChallengeFromVerifier(e)}}generateCodeVerifier(){const e=[],t=256-256%h.length;for(;e.length<=32;){const r=c.randomBytes(1)[0];r>=t||e.push(h[r%h.length])}const r=e.join(n.Constants.EMPTY_STRING);return k.base64EncodeUrl(r)}generateCodeChallengeFromVerifier(e){return k.base64EncodeUrl(this.hashUtils.sha256(e).toString("base64"),"base64")}}class v{constructor(){this.pkceGenerator=new E,this.guidGenerator=new A,this.hashUtils=new I}createNewGuid(){return this.guidGenerator.generateGuid()}base64Encode(e){return k.base64Encode(e)}base64Decode(e){return k.base64Decode(e)}generatePkceCodes(){return this.pkceGenerator.generatePkceCodes()}getPublicKeyThumbprint(){throw new Error("Method not implemented.")}removeTokenBindingKey(){throw new Error("Method not implemented.")}clearKeystore(){throw new Error("Method not implemented.")}signJwt(){throw new Error("Method not implemented.")}async hashString(e){return k.base64EncodeUrl(this.hashUtils.sha256(e).toString("base64"),"base64")}}class w{static deserializeJSONBlob(e){return n.StringUtils.isEmpty(e)?{}:JSON.parse(e)}static deserializeAccounts(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={homeAccountId:i.home_account_id,environment:i.environment,realm:i.realm,localAccountId:i.local_account_id,username:i.username,authorityType:i.authority_type,name:i.name,clientInfo:i.client_info,lastModificationTime:i.last_modification_time,lastModificationApp:i.last_modification_app},s=new n.AccountEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeIdTokens(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={homeAccountId:i.home_account_id,environment:i.environment,credentialType:i.credential_type,clientId:i.client_id,secret:i.secret,realm:i.realm},s=new n.IdTokenEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeAccessTokens(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={homeAccountId:i.home_account_id,environment:i.environment,credentialType:i.credential_type,clientId:i.client_id,secret:i.secret,realm:i.realm,target:i.target,cachedAt:i.cached_at,expiresOn:i.expires_on,extendedExpiresOn:i.extended_expires_on,refreshOn:i.refresh_on,keyId:i.key_id,tokenType:i.token_type,requestedClaims:i.requestedClaims,requestedClaimsHash:i.requestedClaimsHash},s=new n.AccessTokenEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeRefreshTokens(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={homeAccountId:i.home_account_id,environment:i.environment,credentialType:i.credential_type,clientId:i.client_id,secret:i.secret,familyId:i.family_id,target:i.target,realm:i.realm},s=new n.RefreshTokenEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeAppMetadata(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={clientId:i.client_id,environment:i.environment,familyId:i.family_id},s=new n.AppMetadataEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeAllCache(e){return{accounts:e.Account?this.deserializeAccounts(e.Account):{},idTokens:e.IdToken?this.deserializeIdTokens(e.IdToken):{},accessTokens:e.AccessToken?this.deserializeAccessTokens(e.AccessToken):{},refreshTokens:e.RefreshToken?this.deserializeRefreshTokens(e.RefreshToken):{},appMetadata:e.AppMetadata?this.deserializeAppMetadata(e.AppMetadata):{}}}}class b{static serializeJSONBlob(e){return JSON.stringify(e)}static serializeAccounts(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={home_account_id:n.homeAccountId,environment:n.environment,realm:n.realm,local_account_id:n.localAccountId,username:n.username,authority_type:n.authorityType,name:n.name,client_info:n.clientInfo,last_modification_time:n.lastModificationTime,last_modification_app:n.lastModificationApp}})),t}static serializeIdTokens(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={home_account_id:n.homeAccountId,environment:n.environment,credential_type:n.credentialType,client_id:n.clientId,secret:n.secret,realm:n.realm}})),t}static serializeAccessTokens(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={home_account_id:n.homeAccountId,environment:n.environment,credential_type:n.credentialType,client_id:n.clientId,secret:n.secret,realm:n.realm,target:n.target,cached_at:n.cachedAt,expires_on:n.expiresOn,extended_expires_on:n.extendedExpiresOn,refresh_on:n.refreshOn,key_id:n.keyId,token_type:n.tokenType,requestedClaims:n.requestedClaims,requestedClaimsHash:n.requestedClaimsHash}})),t}static serializeRefreshTokens(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={home_account_id:n.homeAccountId,environment:n.environment,credential_type:n.credentialType,client_id:n.clientId,secret:n.secret,family_id:n.familyId,target:n.target,realm:n.realm}})),t}static serializeAppMetadata(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={client_id:n.clientId,environment:n.environment,family_id:n.familyId}})),t}static serializeAllCache(e){return{Account:this.serializeAccounts(e.accounts),IdToken:this.serializeIdTokens(e.idTokens),AccessToken:this.serializeAccessTokens(e.accessTokens),RefreshToken:this.serializeRefreshTokens(e.refreshTokens),AppMetadata:this.serializeAppMetadata(e.appMetadata)}}}class S extends n.CacheManager{constructor(e,t,r){super(t,r),this.cache={},this.changeEmitters=[],this.logger=e}registerChangeEmitter(e){this.changeEmitters.push(e)}emitChange(){this.changeEmitters.forEach(e=>e.call(null))}cacheToInMemoryCache(e){const t={accounts:{},idTokens:{},accessTokens:{},refreshTokens:{},appMetadata:{}};for(const r in e)if(e[r]instanceof n.AccountEntity)t.accounts[r]=e[r];else if(e[r]instanceof n.IdTokenEntity)t.idTokens[r]=e[r];else if(e[r]instanceof n.AccessTokenEntity)t.accessTokens[r]=e[r];else if(e[r]instanceof n.RefreshTokenEntity)t.refreshTokens[r]=e[r];else{if(!(e[r]instanceof n.AppMetadataEntity))continue;t.appMetadata[r]=e[r]}return t}inMemoryCacheToCache(e){let t=this.getCache();return t={...t,...e.accounts,...e.idTokens,...e.accessTokens,...e.refreshTokens,...e.appMetadata},t}getInMemoryCache(){return this.logger.trace("Getting in-memory cache"),this.cacheToInMemoryCache(this.getCache())}setInMemoryCache(e){this.logger.trace("Setting in-memory cache");const t=this.inMemoryCacheToCache(e);this.setCache(t),this.emitChange()}getCache(){return this.logger.trace("Getting cache key-value store"),this.cache}setCache(e){this.logger.trace("Setting cache key value store"),this.cache=e,this.emitChange()}getItem(e){return this.logger.tracePii("Item key: "+e),this.getCache()[e]}setItem(e,t){this.logger.tracePii("Item key: "+e);const r=this.getCache();r[e]=t,this.setCache(r)}getAccount(e){const t=this.getItem(e);return n.AccountEntity.isAccountEntity(t)?t:null}setAccount(e){const t=e.generateAccountKey();this.setItem(t,e)}getIdTokenCredential(e){const t=this.getItem(e);return n.IdTokenEntity.isIdTokenEntity(t)?t:null}setIdTokenCredential(e){const t=e.generateCredentialKey();this.setItem(t,e)}getAccessTokenCredential(e){const t=this.getItem(e);return n.AccessTokenEntity.isAccessTokenEntity(t)?t:null}setAccessTokenCredential(e){const t=e.generateCredentialKey();this.setItem(t,e)}getRefreshTokenCredential(e){const t=this.getItem(e);return n.RefreshTokenEntity.isRefreshTokenEntity(t)?t:null}setRefreshTokenCredential(e){const t=e.generateCredentialKey();this.setItem(t,e)}getAppMetadata(e){const t=this.getItem(e);return n.AppMetadataEntity.isAppMetadataEntity(e,t)?t:null}setAppMetadata(e){const t=e.generateAppMetadataKey();this.setItem(t,e)}getServerTelemetry(e){const t=this.getItem(e);return t&&n.ServerTelemetryEntity.isServerTelemetryEntity(e,t)?t:null}setServerTelemetry(e,t){this.setItem(e,t)}getAuthorityMetadata(e){const t=this.getItem(e);return t&&n.AuthorityMetadataEntity.isAuthorityMetadataEntity(e,t)?t:null}getAuthorityMetadataKeys(){return this.getKeys().filter(e=>this.isAuthorityMetadata(e))}setAuthorityMetadata(e,t){this.setItem(e,t)}getThrottlingCache(e){const t=this.getItem(e);return t&&n.ThrottlingEntity.isThrottlingEntity(e,t)?t:null}setThrottlingCache(e,t){this.setItem(e,t)}removeItem(e){this.logger.tracePii("Item key: "+e);let t=!1;const r=this.getCache();return r[e]&&(delete r[e],t=!0),t&&(this.setCache(r),this.emitChange()),t}containsKey(e){return this.getKeys().includes(e)}getKeys(){this.logger.trace("Retrieving all cache keys");const e=this.getCache();return[...Object.keys(e)]}async clear(){this.logger.trace("Clearing cache entries created by MSAL"),this.getKeys().forEach(e=>{this.removeItem(e)}),this.emitChange()}static generateInMemoryCache(e){return w.deserializeAllCache(w.deserializeJSONBlob(e))}static generateJsonCache(e){return b.serializeAllCache(e)}updateCredentialCacheKey(e,t){const r=t.generateCredentialKey();if(e!==r){const n=this.getItem(e);if(n)return this.removeItem(e),this.setItem(r,n),this.logger.verbose(`Updated an outdated ${t.credentialType} cache key`),r;this.logger.error(`Attempted to update an outdated ${t.credentialType} cache key but no item matching the outdated key was found in storage`)}return e}}const R={},M={},_={},O={},P={};class q{constructor(e,t,r){this.cacheHasChanged=!1,this.storage=e,this.storage.registerChangeEmitter(this.handleChangeEvent.bind(this)),r&&(this.persistence=r),this.logger=t}hasChanged(){return this.cacheHasChanged}serialize(){this.logger.trace("Serializing in-memory cache");let e=b.serializeAllCache(this.storage.getInMemoryCache());return n.StringUtils.isEmpty(this.cacheSnapshot)?this.logger.trace("No cache snapshot to merge"):(this.logger.trace("Reading cache snapshot from disk"),e=this.mergeState(JSON.parse(this.cacheSnapshot),e)),this.cacheHasChanged=!1,JSON.stringify(e)}deserialize(e){if(this.logger.trace("Deserializing JSON to in-memory cache"),this.cacheSnapshot=e,n.StringUtils.isEmpty(this.cacheSnapshot))this.logger.trace("No cache snapshot to deserialize");else{this.logger.trace("Reading cache snapshot from disk");const e=w.deserializeAllCache(this.overlayDefaults(JSON.parse(this.cacheSnapshot)));this.storage.setInMemoryCache(e)}}getKVStore(){return this.storage.getCache()}async getAllAccounts(){let e;this.logger.trace("getAllAccounts called");try{return this.persistence&&(e=new n.TokenCacheContext(this,!1),await this.persistence.beforeCacheAccess(e)),this.storage.getAllAccounts()}finally{this.persistence&&e&&await this.persistence.afterCacheAccess(e)}}async getAccountByHomeId(e){const t=await this.getAllAccounts();return!n.StringUtils.isEmpty(e)&&t&&t.length&&t.filter(t=>t.homeAccountId===e)[0]||null}async getAccountByLocalId(e){const t=await this.getAllAccounts();return!n.StringUtils.isEmpty(e)&&t&&t.length&&t.filter(t=>t.localAccountId===e)[0]||null}async removeAccount(e){let t;this.logger.trace("removeAccount called");try{this.persistence&&(t=new n.TokenCacheContext(this,!0),await this.persistence.beforeCacheAccess(t)),await this.storage.removeAccount(n.AccountEntity.generateAccountCacheKey(e))}finally{this.persistence&&t&&await this.persistence.afterCacheAccess(t)}}handleChangeEvent(){this.cacheHasChanged=!0}mergeState(e,t){this.logger.trace("Merging in-memory cache with cache snapshot");const r=this.mergeRemovals(e,t);return this.mergeUpdates(r,t)}mergeUpdates(e,t){return Object.keys(t).forEach(r=>{const n=t[r];if(e.hasOwnProperty(r)){const t=null!==n,i="object"==typeof n,o=!Array.isArray(n),s=null!=e[r];t&&i&&o&&s?this.mergeUpdates(e[r],n):e[r]=n}else null!==n&&(e[r]=n)}),e}mergeRemovals(e,t){this.logger.trace("Remove updated entries in cache");const r=e.Account?this.mergeRemovalsDict(e.Account,t.Account):e.Account,n=e.AccessToken?this.mergeRemovalsDict(e.AccessToken,t.AccessToken):e.AccessToken,i=e.RefreshToken?this.mergeRemovalsDict(e.RefreshToken,t.RefreshToken):e.RefreshToken,o=e.IdToken?this.mergeRemovalsDict(e.IdToken,t.IdToken):e.IdToken,s=e.AppMetadata?this.mergeRemovalsDict(e.AppMetadata,t.AppMetadata):e.AppMetadata;return{...e,Account:r,AccessToken:n,RefreshToken:i,IdToken:o,AppMetadata:s}}mergeRemovalsDict(e,t){const r={...e};return Object.keys(e).forEach(e=>{t&&t.hasOwnProperty(e)||delete r[e]}),r}overlayDefaults(e){return this.logger.trace("Overlaying input cache with the default cache"),{Account:{...R,...e.Account},IdToken:{...M,...e.IdToken},AccessToken:{..._,...e.AccessToken},RefreshToken:{...O,...e.RefreshToken},AppMetadata:{...P,...e.AppMetadata}}}}class x{constructor(e){this.config=T(e),this.cryptoProvider=new v,this.logger=new n.Logger(this.config.system.loggerOptions,"@azure/msal-node","1.13.0"),this.storage=new S(this.logger,this.config.auth.clientId,this.cryptoProvider),this.tokenCache=new q(this.storage,this.logger,this.config.cache.cachePlugin)}async getAuthCodeUrl(e){this.logger.info("getAuthCodeUrl called",e.correlationId);const t={...e,...await this.initializeBaseRequest(e),responseMode:e.responseMode||n.ResponseMode.QUERY,authenticationScheme:n.AuthenticationScheme.BEARER},r=await this.buildOauthClientConfiguration(t.authority,t.correlationId,void 0,void 0,e.azureCloudOptions),i=new n.AuthorizationCodeClient(r);return this.logger.verbose("Auth code client created",t.correlationId),i.getAuthCodeUrl(t)}async acquireTokenByCode(e,t){this.logger.info("acquireTokenByCode called",e.correlationId);const r={...e,...await this.initializeBaseRequest(e),authenticationScheme:n.AuthenticationScheme.BEARER},i=this.initializeServerTelemetryManager(u.acquireTokenByCode,r.correlationId);try{const o=await this.buildOauthClientConfiguration(r.authority,r.correlationId,i,void 0,e.azureCloudOptions),s=new n.AuthorizationCodeClient(o);return this.logger.verbose("Auth code client created",r.correlationId),s.acquireToken(r,t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(r.correlationId),i.cacheFailedRequest(e),e}}async acquireTokenByRefreshToken(e){this.logger.info("acquireTokenByRefreshToken called",e.correlationId);const t={...e,...await this.initializeBaseRequest(e),authenticationScheme:n.AuthenticationScheme.BEARER},r=this.initializeServerTelemetryManager(u.acquireTokenByRefreshToken,t.correlationId);try{const i=await this.buildOauthClientConfiguration(t.authority,t.correlationId,r,void 0,e.azureCloudOptions),o=new n.RefreshTokenClient(i);return this.logger.verbose("Refresh token client created",t.correlationId),o.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),r.cacheFailedRequest(e),e}}async acquireTokenSilent(e){const t={...e,...await this.initializeBaseRequest(e),forceRefresh:e.forceRefresh||!1},r=this.initializeServerTelemetryManager(u.acquireTokenSilent,t.correlationId,t.forceRefresh);try{const i=await this.buildOauthClientConfiguration(t.authority,t.correlationId,r,void 0,e.azureCloudOptions),o=new n.SilentFlowClient(i);return this.logger.verbose("Silent flow client created",t.correlationId),o.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),r.cacheFailedRequest(e),e}}async acquireTokenByUsernamePassword(e){this.logger.info("acquireTokenByUsernamePassword called",e.correlationId);const t={...e,...await this.initializeBaseRequest(e)},r=this.initializeServerTelemetryManager(u.acquireTokenByUsernamePassword,t.correlationId);try{const i=await this.buildOauthClientConfiguration(t.authority,t.correlationId,r,void 0,e.azureCloudOptions),o=new n.UsernamePasswordClient(i);return this.logger.verbose("Username password client created",t.correlationId),o.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),r.cacheFailedRequest(e),e}}getTokenCache(){return this.logger.info("getTokenCache called"),this.tokenCache}getLogger(){return this.logger}setLogger(e){this.logger=e}async buildOauthClientConfiguration(e,t,r,i,o){this.logger.verbose("buildOauthClientConfiguration called",t);const s=o||this.config.auth.azureCloudOptions;this.logger.verbose("building oauth client configuration with the authority: "+e,t);const a=await this.createAuthority(e,i,t,s);return null==r||r.updateRegionDiscoveryMetadata(a.regionDiscoveryMetadata),{authOptions:{clientId:this.config.auth.clientId,authority:a,clientCapabilities:this.config.auth.clientCapabilities},systemOptions:{proxyUrl:this.config.system.proxyUrl},loggerOptions:{logLevel:this.config.system.loggerOptions.logLevel,loggerCallback:this.config.system.loggerOptions.loggerCallback,piiLoggingEnabled:this.config.system.loggerOptions.piiLoggingEnabled,correlationId:t},cryptoInterface:this.cryptoProvider,networkInterface:this.config.system.networkClient,storageInterface:this.storage,serverTelemetryManager:r,clientCredentials:{clientSecret:this.clientSecret,clientAssertion:this.clientAssertion?this.getClientAssertion(a):void 0},libraryInfo:{sku:"msal.js.node",version:"1.13.0",cpu:process.arch||n.Constants.EMPTY_STRING,os:process.platform||n.Constants.EMPTY_STRING},telemetry:this.config.telemetry,persistencePlugin:this.config.cache.cachePlugin,serializableCache:this.tokenCache}}getClientAssertion(e){return{assertion:this.clientAssertion.getJwt(this.cryptoProvider,this.config.auth.clientId,e.tokenEndpoint),assertionType:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}async initializeBaseRequest(e){return this.logger.verbose("initializeRequestScopes called",e.correlationId),e.authenticationScheme&&e.authenticationScheme===n.AuthenticationScheme.POP&&this.logger.verbose("Authentication Scheme 'pop' is not supported yet, setting Authentication Scheme to 'Bearer' for request",e.correlationId),e.authenticationScheme=n.AuthenticationScheme.BEARER,e.claims&&!n.StringUtils.isEmpty(e.claims)&&(e.requestedClaimsHash=await this.cryptoProvider.hashString(e.claims)),{...e,scopes:[...e&&e.scopes||[],...n.OIDC_DEFAULT_SCOPES],correlationId:e&&e.correlationId||this.cryptoProvider.createNewGuid(),authority:e.authority||this.config.auth.authority}}initializeServerTelemetryManager(e,t,r){return new n.ServerTelemetryManager({clientId:this.config.auth.clientId,correlationId:t,apiId:e,forceRefresh:r||!1},this.storage)}async createAuthority(e,t,r,i){this.logger.verbose("createAuthority called",r);const o=n.Authority.generateAuthority(e,i),s={protocolMode:this.config.auth.protocolMode,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,azureRegionConfiguration:t,skipAuthorityMetadataCache:this.config.auth.skipAuthorityMetadataCache};return await n.AuthorityFactory.createDiscoveredInstance(o,this.config.system.networkClient,this.storage,s,this.config.system.proxyUrl)}clearCache(){this.storage.clear()}}class z extends n.AuthError{constructor(e,t){super(e,t),this.name="NodeAuthError"}static createInvalidLoopbackAddressTypeError(){return new z("invalid_loopback_server_address_type","Loopback server address is not type string. This is unexpected.")}static createUnableToLoadRedirectUrlError(){return new z("unable_to_load_redirectUrl","Loopback server callback was invoked without a url. This is unexpected.")}static createNoAuthCodeInResponseError(){return new z("no_auth_code_in_response","No auth code found in the server response. Please check your network trace to determine what happened.")}static createNoLoopbackServerExistsError(){return new z("no_loopback_server_exists","No loopback server exists yet.")}static createLoopbackServerAlreadyExistsError(){return new z("loopback_server_already_exists","Loopback server already exists. Cannot create another.")}static createLoopbackServerTimeoutError(){return new z("loopback_server_timeout","Timed out waiting for auth code listener to be registered.")}}class U{async listenForAuthCode(e,t){if(this.server)throw z.createLoopbackServerAlreadyExistsError();const o=new Promise((o,s)=>{this.server=i.createServer(async(i,a)=>{const c=i.url;if(!c)return a.end(t||"Error occurred loading redirectUrl"),void s(z.createUnableToLoadRedirectUrlError());if(c===n.Constants.FORWARD_SLASH)return void a.end(e||"Auth code was successfully acquired. You can close this window now.");const l=n.UrlString.getDeserializedQueryString(c);if(l.code){const e=await this.getRedirectUri();a.writeHead(r.REDIRECT,{location:e}),a.end()}o(l)}),this.server.listen(0)});return await new Promise(e=>{let t=0;const r=setInterval(()=>{if(50<t)throw z.createLoopbackServerTimeoutError();this.server.listening&&(clearInterval(r),e()),t++},100)}),o}getRedirectUri(){if(!this.server)throw z.createNoLoopbackServerExistsError();const e=this.server.address();if(!e||"string"==typeof e||!e.port)throw this.closeServer(),z.createInvalidLoopbackAddressTypeError();return"http://localhost:"+(e&&e.port)}closeServer(){this.server&&this.server.close()}}class j{static fromAssertion(e){const t=new j;return t.jwt=e,t}static fromCertificate(e,t,r){const n=new j;return n.privateKey=t,n.thumbprint=e,r&&(n.publicCertificate=this.parseCertificate(r)),n}getJwt(e,t,r){if(this.privateKey&&this.thumbprint)return this.jwt&&!this.isExpired()&&t===this.issuer&&r===this.jwtAudience?this.jwt:this.createJwt(e,t,r);if(this.jwt)return this.jwt;throw n.ClientAuthError.createInvalidAssertionError()}createJwt(e,t,r){this.issuer=t,this.jwtAudience=r;const i=n.TimeUtils.nowSeconds();this.expirationTime=i+600;const o={alg:"RS256",x5t:k.base64EncodeUrl(this.thumbprint,"hex")};this.publicCertificate&&Object.assign(o,{x5c:this.publicCertificate});const s={aud:this.jwtAudience,exp:this.expirationTime,iss:this.issuer,sub:this.issuer,nbf:i,jti:e.createNewGuid()};return this.jwt=l.sign(s,this.privateKey,{header:o}),this.jwt}isExpired(){return this.expirationTime<n.TimeUtils.nowSeconds()}static parseCertificate(e){const t=/-----BEGIN CERTIFICATE-----\r*\n(.+?)\r*\n-----END CERTIFICATE-----/gs,r=[];let i;for(;null!==(i=t.exec(e));)r.push(i[1].replace(/\r*\n/g,n.Constants.EMPTY_STRING));return r}}Object.defineProperty(exports,"AuthError",{enumerable:!0,get:function(){return n.AuthError}}),Object.defineProperty(exports,"AuthErrorMessage",{enumerable:!0,get:function(){return n.AuthErrorMessage}}),Object.defineProperty(exports,"AzureCloudInstance",{enumerable:!0,get:function(){return n.AzureCloudInstance}}),Object.defineProperty(exports,"ClientAuthError",{enumerable:!0,get:function(){return n.ClientAuthError}}),Object.defineProperty(exports,"ClientAuthErrorMessage",{enumerable:!0,get:function(){return n.ClientAuthErrorMessage}}),Object.defineProperty(exports,"ClientConfigurationError",{enumerable:!0,get:function(){return n.ClientConfigurationError}}),Object.defineProperty(exports,"ClientConfigurationErrorMessage",{enumerable:!0,get:function(){return n.ClientConfigurationErrorMessage}}),Object.defineProperty(exports,"InteractionRequiredAuthError",{enumerable:!0,get:function(){return n.InteractionRequiredAuthError}}),Object.defineProperty(exports,"InteractionRequiredAuthErrorMessage",{enumerable:!0,get:function(){return n.InteractionRequiredAuthErrorMessage}}),Object.defineProperty(exports,"LogLevel",{enumerable:!0,get:function(){return n.LogLevel}}),Object.defineProperty(exports,"Logger",{enumerable:!0,get:function(){return n.Logger}}),Object.defineProperty(exports,"PromptValue",{enumerable:!0,get:function(){return n.PromptValue}}),Object.defineProperty(exports,"ProtocolMode",{enumerable:!0,get:function(){return n.ProtocolMode}}),Object.defineProperty(exports,"ResponseMode",{enumerable:!0,get:function(){return n.ResponseMode}}),Object.defineProperty(exports,"ServerError",{enumerable:!0,get:function(){return n.ServerError}}),Object.defineProperty(exports,"TokenCacheContext",{enumerable:!0,get:function(){return n.TokenCacheContext}}),exports.ClientApplication=x,exports.ClientAssertion=j,exports.ConfidentialClientApplication=class extends x{constructor(e){super(e),this.setClientCredential(this.config),this.appTokenProvider=void 0}SetAppTokenProvider(e){this.appTokenProvider=e}async acquireTokenByClientCredential(e){let t;this.logger.info("acquireTokenByClientCredential called",e.correlationId),e.clientAssertion&&(t={assertion:e.clientAssertion,assertionType:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"});const r={...e,...await this.initializeBaseRequest(e),clientAssertion:t},i={azureRegion:r.azureRegion,environmentRegion:process.env.REGION_NAME},o=this.initializeServerTelemetryManager(u.acquireTokenByClientCredential,r.correlationId,r.skipCache);try{const t=await this.buildOauthClientConfiguration(r.authority,r.correlationId,o,i,e.azureCloudOptions),s=new n.ClientCredentialClient(t,this.appTokenProvider);return this.logger.verbose("Client credential client created",r.correlationId),s.acquireToken(r)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(r.correlationId),o.cacheFailedRequest(e),e}}async acquireTokenOnBehalfOf(e){this.logger.info("acquireTokenOnBehalfOf called",e.correlationId);const t={...e,...await this.initializeBaseRequest(e)};try{const r=await this.buildOauthClientConfiguration(t.authority,t.correlationId,void 0,void 0,e.azureCloudOptions),i=new n.OnBehalfOfClient(r);return this.logger.verbose("On behalf of client created",t.correlationId),i.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),e}}setClientCredential(e){const t=!n.StringUtils.isEmpty(e.auth.clientSecret),r=!n.StringUtils.isEmpty(e.auth.clientAssertion),i=e.auth.clientCertificate||{thumbprint:n.Constants.EMPTY_STRING,privateKey:n.Constants.EMPTY_STRING},o=!n.StringUtils.isEmpty(i.thumbprint)||!n.StringUtils.isEmpty(i.privateKey);if(!this.appTokenProvider){if(t&&r||r&&o||t&&o)throw n.ClientAuthError.createInvalidCredentialError();if(e.auth.clientSecret)this.clientSecret=e.auth.clientSecret;else if(e.auth.clientAssertion)this.clientAssertion=j.fromAssertion(e.auth.clientAssertion);else{if(!o)throw n.ClientAuthError.createInvalidCredentialError();var s;this.clientAssertion=j.fromCertificate(i.thumbprint,i.privateKey,null==(s=e.auth.clientCertificate)?void 0:s.x5c)}}}},exports.CryptoProvider=v,exports.DistributedCachePlugin=class{constructor(e,t){this.client=e,this.partitionManager=t}async beforeCacheAccess(e){const t=await this.partitionManager.getKey(),r=await this.client.get(t);e.tokenCache.deserialize(r)}async afterCacheAccess(e){if(e.cacheHasChanged){const t=e.tokenCache.getKVStore(),r=Object.values(t).filter(e=>n.AccountEntity.isAccountEntity(e));if(r.length>0){const t=r[0],n=await this.partitionManager.extractKey(t);await this.client.set(n,e.tokenCache.serialize())}}}},exports.NodeStorage=S,exports.PublicClientApplication=class extends x{constructor(e){super(e)}async acquireTokenByDeviceCode(e){this.logger.info("acquireTokenByDeviceCode called",e.correlationId);const t=Object.assign(e,await this.initializeBaseRequest(e)),r=this.initializeServerTelemetryManager(u.acquireTokenByDeviceCode,t.correlationId);try{const i=await this.buildOauthClientConfiguration(t.authority,t.correlationId,r,void 0,e.azureCloudOptions),o=new n.DeviceCodeClient(i);return this.logger.verbose("Device code client created",t.correlationId),o.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),r.cacheFailedRequest(e),e}}async acquireTokenInteractive(e){const{verifier:t,challenge:r}=await this.cryptoProvider.generatePkceCodes(),{openBrowser:i,successTemplate:o,errorTemplate:s,...a}=e,c=new U,l=c.listenForAuthCode(o,s),h=c.getRedirectUri(),u={...a,scopes:e.scopes||[],redirectUri:h,responseMode:n.ResponseMode.QUERY,codeChallenge:r,codeChallengeMethod:n.CodeChallengeMethodValues.S256},d=await this.getAuthCodeUrl(u);await i(d);const g=await l.finally(()=>{c.closeServer()});if(g.error)throw new n.ServerError(g.error,g.error_description,g.suberror);if(!g.code)throw z.createNoAuthCodeInResponseError();return this.acquireTokenByCode({code:g.code,scopes:n.OIDC_DEFAULT_SCOPES,redirectUri:u.redirectUri,codeVerifier:t,clientInfo:g.client_info||n.Constants.EMPTY_STRING})}},exports.TokenCache=q,exports.buildAppConfiguration=T,exports.version="1.13.0";
+"use strict";function e(e){return e&&"object"==typeof e&&"default"in e?e.default:e}Object.defineProperty(exports,"__esModule",{value:!0});var t,r,n=require("@azure/msal-common"),i=require("http"),o=e(i),s=e(require("https")),a=require("uuid"),c=e(require("crypto")),l=require("jsonwebtoken");!function(e){e.GET="get",e.POST="post"}(t||(t={})),function(e){e[e.OK=200]="OK",e[e.REDIRECT=302]="REDIRECT"}(r||(r={}));const h="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";var u;!function(e){e[e.acquireTokenSilent=62]="acquireTokenSilent",e[e.acquireTokenByUsernamePassword=371]="acquireTokenByUsernamePassword",e[e.acquireTokenByDeviceCode=671]="acquireTokenByDeviceCode",e[e.acquireTokenByClientCredential=771]="acquireTokenByClientCredential",e[e.acquireTokenByCode=871]="acquireTokenByCode",e[e.acquireTokenByRefreshToken=872]="acquireTokenByRefreshToken"}(u||(u={}));class d{async sendGetRequestAsync(e,r){return null!=r&&r.proxyUrl?g(e,t.GET,r):p(e,t.GET,r)}async sendPostRequestAsync(e,r,n){return null!=r&&r.proxyUrl?g(e,t.POST,r,n):p(e,t.POST,r,n)}}const g=(e,r,n,i)=>{const s=(null==n?void 0:n.headers)||{},a=new URL((null==n?void 0:n.proxyUrl)||""),c=new URL(e),l={host:a.hostname,port:a.port,method:"CONNECT",path:c.hostname,headers:s};i&&(l.timeout=i);let h="";if(r===t.POST){const e=(null==n?void 0:n.body)||"";h=`Content-Type: application/x-www-form-urlencoded\r\nContent-Length: ${e.length}\r\n\r\n`+e}const u=`${r.toUpperCase()} ${c.href} HTTP/1.1\r\nHost: ${c.host}\r\nConnection: close\r\n`+h+"\r\n";return new Promise((e,t)=>{const r=o.request(l);l.timeout&&r.on("timeout",()=>{r.destroy(),t(new Error("Request time out"))}),r.end(),r.on("connect",(n,i)=>{const o=(null==n?void 0:n.statusCode)||500;(o<200||o>299)&&(r.destroy(),i.destroy(),t(new Error("HTTP status code "+o))),l.timeout&&(i.setTimeout(l.timeout),i.on("timeout",()=>{r.destroy(),i.destroy(),t(new Error("Request time out"))})),i.write(u);const s=[];i.on("data",e=>{s.push(e)}),i.on("end",()=>{const n=Buffer.concat([...s]).toString().split("\r\n"),o=parseInt(n[0].split(" ")[1]),a=n[n.length-1],c=n.slice(1,n.length-2),l=new Map;c.forEach(e=>{const t=e.split(new RegExp(/:\s(.*)/s)),r=t[0];let n=t[1];try{const e=JSON.parse(n);e&&"object"==typeof e&&(n=e)}catch(e){}l.set(r,n)});const h={headers:Object.fromEntries(l),body:JSON.parse(a),status:o};(o<200||o>299)&&"authorization_pending"!==h.body.error&&(r.destroy(),i.destroy(),t(new Error("HTTP status code "+o))),e(h)}),i.on("error",e=>{r.destroy(),i.destroy(),t(new Error(e.toString()))})}),r.on("error",e=>{r.destroy(),t(new Error(e.toString()))})})},p=(e,r,n,i)=>{const o=r===t.POST,a=(null==n?void 0:n.body)||"",c={method:r,headers:(null==n?void 0:n.headers)||{}};return i&&(c.timeout=i),o&&(c.headers={...c.headers,"Content-Length":a.length}),new Promise((t,r)=>{const n=s.request(e,c);i&&n.on("timeout",()=>{n.destroy(),r(new Error("Request time out"))}),o&&n.write(a),n.end(),n.on("response",e=>{const i=e.headers,o=e.statusCode,s=[];e.on("data",e=>{s.push(e)}),e.on("end",()=>{const e=Buffer.concat([...s]).toString(),a={headers:i,body:JSON.parse(e),status:o};(o<200||o>299)&&"authorization_pending"!==a.body.error&&(n.destroy(),r(new Error("HTTP status code "+o))),t(a)})}),n.on("error",e=>{n.destroy(),r(new Error(e.toString()))})})},y={clientId:n.Constants.EMPTY_STRING,authority:n.Constants.DEFAULT_AUTHORITY,clientSecret:n.Constants.EMPTY_STRING,clientAssertion:n.Constants.EMPTY_STRING,clientCertificate:{thumbprint:n.Constants.EMPTY_STRING,privateKey:n.Constants.EMPTY_STRING,x5c:n.Constants.EMPTY_STRING},knownAuthorities:[],cloudDiscoveryMetadata:n.Constants.EMPTY_STRING,authorityMetadata:n.Constants.EMPTY_STRING,clientCapabilities:[],protocolMode:n.ProtocolMode.AAD,azureCloudOptions:{azureCloudInstance:n.AzureCloudInstance.None,tenant:n.Constants.EMPTY_STRING},skipAuthorityMetadataCache:!1},m={},f={loggerOptions:{loggerCallback:()=>{},piiLoggingEnabled:!1,logLevel:n.LogLevel.Info},networkClient:class{static getNetworkClient(){return new d}}.getNetworkClient(),proxyUrl:n.Constants.EMPTY_STRING},C={application:{appName:n.Constants.EMPTY_STRING,appVersion:n.Constants.EMPTY_STRING}};function T({auth:e,cache:t,system:r,telemetry:n}){return{auth:{...y,...e},cache:{...m,...t},system:{...f,...r},telemetry:{...C,...n}}}class A{generateGuid(){return a.v4()}isGuid(e){return/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(e)}}class k{static base64Encode(e,t){return Buffer.from(e,t).toString("base64")}static base64EncodeUrl(e,t){return k.base64Encode(e,t).replace(/=/g,n.Constants.EMPTY_STRING).replace(/\+/g,"-").replace(/\//g,"_")}static base64Decode(e){return Buffer.from(e,"base64").toString("utf8")}static base64DecodeUrl(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");for(;t.length%4;)t+="=";return k.base64Decode(t)}}class I{sha256(e){return c.createHash("sha256").update(e).digest()}}class E{constructor(){this.hashUtils=new I}async generatePkceCodes(){const e=this.generateCodeVerifier();return{verifier:e,challenge:this.generateCodeChallengeFromVerifier(e)}}generateCodeVerifier(){const e=[],t=256-256%h.length;for(;e.length<=32;){const r=c.randomBytes(1)[0];r>=t||e.push(h[r%h.length])}const r=e.join(n.Constants.EMPTY_STRING);return k.base64EncodeUrl(r)}generateCodeChallengeFromVerifier(e){return k.base64EncodeUrl(this.hashUtils.sha256(e).toString("base64"),"base64")}}class v{constructor(){this.pkceGenerator=new E,this.guidGenerator=new A,this.hashUtils=new I}createNewGuid(){return this.guidGenerator.generateGuid()}base64Encode(e){return k.base64Encode(e)}base64Decode(e){return k.base64Decode(e)}generatePkceCodes(){return this.pkceGenerator.generatePkceCodes()}getPublicKeyThumbprint(){throw new Error("Method not implemented.")}removeTokenBindingKey(){throw new Error("Method not implemented.")}clearKeystore(){throw new Error("Method not implemented.")}signJwt(){throw new Error("Method not implemented.")}async hashString(e){return k.base64EncodeUrl(this.hashUtils.sha256(e).toString("base64"),"base64")}}class w{static deserializeJSONBlob(e){return n.StringUtils.isEmpty(e)?{}:JSON.parse(e)}static deserializeAccounts(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={homeAccountId:i.home_account_id,environment:i.environment,realm:i.realm,localAccountId:i.local_account_id,username:i.username,authorityType:i.authority_type,name:i.name,clientInfo:i.client_info,lastModificationTime:i.last_modification_time,lastModificationApp:i.last_modification_app},s=new n.AccountEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeIdTokens(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={homeAccountId:i.home_account_id,environment:i.environment,credentialType:i.credential_type,clientId:i.client_id,secret:i.secret,realm:i.realm},s=new n.IdTokenEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeAccessTokens(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={homeAccountId:i.home_account_id,environment:i.environment,credentialType:i.credential_type,clientId:i.client_id,secret:i.secret,realm:i.realm,target:i.target,cachedAt:i.cached_at,expiresOn:i.expires_on,extendedExpiresOn:i.extended_expires_on,refreshOn:i.refresh_on,keyId:i.key_id,tokenType:i.token_type,requestedClaims:i.requestedClaims,requestedClaimsHash:i.requestedClaimsHash},s=new n.AccessTokenEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeRefreshTokens(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={homeAccountId:i.home_account_id,environment:i.environment,credentialType:i.credential_type,clientId:i.client_id,secret:i.secret,familyId:i.family_id,target:i.target,realm:i.realm},s=new n.RefreshTokenEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeAppMetadata(e){const t={};return e&&Object.keys(e).map((function(r){const i=e[r],o={clientId:i.client_id,environment:i.environment,familyId:i.family_id},s=new n.AppMetadataEntity;n.CacheManager.toObject(s,o),t[r]=s})),t}static deserializeAllCache(e){return{accounts:e.Account?this.deserializeAccounts(e.Account):{},idTokens:e.IdToken?this.deserializeIdTokens(e.IdToken):{},accessTokens:e.AccessToken?this.deserializeAccessTokens(e.AccessToken):{},refreshTokens:e.RefreshToken?this.deserializeRefreshTokens(e.RefreshToken):{},appMetadata:e.AppMetadata?this.deserializeAppMetadata(e.AppMetadata):{}}}}class b{static serializeJSONBlob(e){return JSON.stringify(e)}static serializeAccounts(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={home_account_id:n.homeAccountId,environment:n.environment,realm:n.realm,local_account_id:n.localAccountId,username:n.username,authority_type:n.authorityType,name:n.name,client_info:n.clientInfo,last_modification_time:n.lastModificationTime,last_modification_app:n.lastModificationApp}})),t}static serializeIdTokens(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={home_account_id:n.homeAccountId,environment:n.environment,credential_type:n.credentialType,client_id:n.clientId,secret:n.secret,realm:n.realm}})),t}static serializeAccessTokens(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={home_account_id:n.homeAccountId,environment:n.environment,credential_type:n.credentialType,client_id:n.clientId,secret:n.secret,realm:n.realm,target:n.target,cached_at:n.cachedAt,expires_on:n.expiresOn,extended_expires_on:n.extendedExpiresOn,refresh_on:n.refreshOn,key_id:n.keyId,token_type:n.tokenType,requestedClaims:n.requestedClaims,requestedClaimsHash:n.requestedClaimsHash}})),t}static serializeRefreshTokens(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={home_account_id:n.homeAccountId,environment:n.environment,credential_type:n.credentialType,client_id:n.clientId,secret:n.secret,family_id:n.familyId,target:n.target,realm:n.realm}})),t}static serializeAppMetadata(e){const t={};return Object.keys(e).map((function(r){const n=e[r];t[r]={client_id:n.clientId,environment:n.environment,family_id:n.familyId}})),t}static serializeAllCache(e){return{Account:this.serializeAccounts(e.accounts),IdToken:this.serializeIdTokens(e.idTokens),AccessToken:this.serializeAccessTokens(e.accessTokens),RefreshToken:this.serializeRefreshTokens(e.refreshTokens),AppMetadata:this.serializeAppMetadata(e.appMetadata)}}}class S extends n.CacheManager{constructor(e,t,r){super(t,r),this.cache={},this.changeEmitters=[],this.logger=e}registerChangeEmitter(e){this.changeEmitters.push(e)}emitChange(){this.changeEmitters.forEach(e=>e.call(null))}cacheToInMemoryCache(e){const t={accounts:{},idTokens:{},accessTokens:{},refreshTokens:{},appMetadata:{}};for(const r in e)if(e[r]instanceof n.AccountEntity)t.accounts[r]=e[r];else if(e[r]instanceof n.IdTokenEntity)t.idTokens[r]=e[r];else if(e[r]instanceof n.AccessTokenEntity)t.accessTokens[r]=e[r];else if(e[r]instanceof n.RefreshTokenEntity)t.refreshTokens[r]=e[r];else{if(!(e[r]instanceof n.AppMetadataEntity))continue;t.appMetadata[r]=e[r]}return t}inMemoryCacheToCache(e){let t=this.getCache();return t={...t,...e.accounts,...e.idTokens,...e.accessTokens,...e.refreshTokens,...e.appMetadata},t}getInMemoryCache(){return this.logger.trace("Getting in-memory cache"),this.cacheToInMemoryCache(this.getCache())}setInMemoryCache(e){this.logger.trace("Setting in-memory cache");const t=this.inMemoryCacheToCache(e);this.setCache(t),this.emitChange()}getCache(){return this.logger.trace("Getting cache key-value store"),this.cache}setCache(e){this.logger.trace("Setting cache key value store"),this.cache=e,this.emitChange()}getItem(e){return this.logger.tracePii("Item key: "+e),this.getCache()[e]}setItem(e,t){this.logger.tracePii("Item key: "+e);const r=this.getCache();r[e]=t,this.setCache(r)}getAccount(e){const t=this.getItem(e);return n.AccountEntity.isAccountEntity(t)?t:null}setAccount(e){const t=e.generateAccountKey();this.setItem(t,e)}getIdTokenCredential(e){const t=this.getItem(e);return n.IdTokenEntity.isIdTokenEntity(t)?t:null}setIdTokenCredential(e){const t=e.generateCredentialKey();this.setItem(t,e)}getAccessTokenCredential(e){const t=this.getItem(e);return n.AccessTokenEntity.isAccessTokenEntity(t)?t:null}setAccessTokenCredential(e){const t=e.generateCredentialKey();this.setItem(t,e)}getRefreshTokenCredential(e){const t=this.getItem(e);return n.RefreshTokenEntity.isRefreshTokenEntity(t)?t:null}setRefreshTokenCredential(e){const t=e.generateCredentialKey();this.setItem(t,e)}getAppMetadata(e){const t=this.getItem(e);return n.AppMetadataEntity.isAppMetadataEntity(e,t)?t:null}setAppMetadata(e){const t=e.generateAppMetadataKey();this.setItem(t,e)}getServerTelemetry(e){const t=this.getItem(e);return t&&n.ServerTelemetryEntity.isServerTelemetryEntity(e,t)?t:null}setServerTelemetry(e,t){this.setItem(e,t)}getAuthorityMetadata(e){const t=this.getItem(e);return t&&n.AuthorityMetadataEntity.isAuthorityMetadataEntity(e,t)?t:null}getAuthorityMetadataKeys(){return this.getKeys().filter(e=>this.isAuthorityMetadata(e))}setAuthorityMetadata(e,t){this.setItem(e,t)}getThrottlingCache(e){const t=this.getItem(e);return t&&n.ThrottlingEntity.isThrottlingEntity(e,t)?t:null}setThrottlingCache(e,t){this.setItem(e,t)}removeItem(e){this.logger.tracePii("Item key: "+e);let t=!1;const r=this.getCache();return r[e]&&(delete r[e],t=!0),t&&(this.setCache(r),this.emitChange()),t}containsKey(e){return this.getKeys().includes(e)}getKeys(){this.logger.trace("Retrieving all cache keys");const e=this.getCache();return[...Object.keys(e)]}async clear(){this.logger.trace("Clearing cache entries created by MSAL"),this.getKeys().forEach(e=>{this.removeItem(e)}),this.emitChange()}static generateInMemoryCache(e){return w.deserializeAllCache(w.deserializeJSONBlob(e))}static generateJsonCache(e){return b.serializeAllCache(e)}updateCredentialCacheKey(e,t){const r=t.generateCredentialKey();if(e!==r){const n=this.getItem(e);if(n)return this.removeItem(e),this.setItem(r,n),this.logger.verbose(`Updated an outdated ${t.credentialType} cache key`),r;this.logger.error(`Attempted to update an outdated ${t.credentialType} cache key but no item matching the outdated key was found in storage`)}return e}}const R={},M={},_={},O={},P={};class q{constructor(e,t,r){this.cacheHasChanged=!1,this.storage=e,this.storage.registerChangeEmitter(this.handleChangeEvent.bind(this)),r&&(this.persistence=r),this.logger=t}hasChanged(){return this.cacheHasChanged}serialize(){this.logger.trace("Serializing in-memory cache");let e=b.serializeAllCache(this.storage.getInMemoryCache());return n.StringUtils.isEmpty(this.cacheSnapshot)?this.logger.trace("No cache snapshot to merge"):(this.logger.trace("Reading cache snapshot from disk"),e=this.mergeState(JSON.parse(this.cacheSnapshot),e)),this.cacheHasChanged=!1,JSON.stringify(e)}deserialize(e){if(this.logger.trace("Deserializing JSON to in-memory cache"),this.cacheSnapshot=e,n.StringUtils.isEmpty(this.cacheSnapshot))this.logger.trace("No cache snapshot to deserialize");else{this.logger.trace("Reading cache snapshot from disk");const e=w.deserializeAllCache(this.overlayDefaults(JSON.parse(this.cacheSnapshot)));this.storage.setInMemoryCache(e)}}getKVStore(){return this.storage.getCache()}async getAllAccounts(){let e;this.logger.trace("getAllAccounts called");try{return this.persistence&&(e=new n.TokenCacheContext(this,!1),await this.persistence.beforeCacheAccess(e)),this.storage.getAllAccounts()}finally{this.persistence&&e&&await this.persistence.afterCacheAccess(e)}}async getAccountByHomeId(e){const t=await this.getAllAccounts();return!n.StringUtils.isEmpty(e)&&t&&t.length&&t.filter(t=>t.homeAccountId===e)[0]||null}async getAccountByLocalId(e){const t=await this.getAllAccounts();return!n.StringUtils.isEmpty(e)&&t&&t.length&&t.filter(t=>t.localAccountId===e)[0]||null}async removeAccount(e){let t;this.logger.trace("removeAccount called");try{this.persistence&&(t=new n.TokenCacheContext(this,!0),await this.persistence.beforeCacheAccess(t)),await this.storage.removeAccount(n.AccountEntity.generateAccountCacheKey(e))}finally{this.persistence&&t&&await this.persistence.afterCacheAccess(t)}}handleChangeEvent(){this.cacheHasChanged=!0}mergeState(e,t){this.logger.trace("Merging in-memory cache with cache snapshot");const r=this.mergeRemovals(e,t);return this.mergeUpdates(r,t)}mergeUpdates(e,t){return Object.keys(t).forEach(r=>{const n=t[r];if(e.hasOwnProperty(r)){const t=null!==n,i="object"==typeof n,o=!Array.isArray(n),s=null!=e[r];t&&i&&o&&s?this.mergeUpdates(e[r],n):e[r]=n}else null!==n&&(e[r]=n)}),e}mergeRemovals(e,t){this.logger.trace("Remove updated entries in cache");const r=e.Account?this.mergeRemovalsDict(e.Account,t.Account):e.Account,n=e.AccessToken?this.mergeRemovalsDict(e.AccessToken,t.AccessToken):e.AccessToken,i=e.RefreshToken?this.mergeRemovalsDict(e.RefreshToken,t.RefreshToken):e.RefreshToken,o=e.IdToken?this.mergeRemovalsDict(e.IdToken,t.IdToken):e.IdToken,s=e.AppMetadata?this.mergeRemovalsDict(e.AppMetadata,t.AppMetadata):e.AppMetadata;return{...e,Account:r,AccessToken:n,RefreshToken:i,IdToken:o,AppMetadata:s}}mergeRemovalsDict(e,t){const r={...e};return Object.keys(e).forEach(e=>{t&&t.hasOwnProperty(e)||delete r[e]}),r}overlayDefaults(e){return this.logger.trace("Overlaying input cache with the default cache"),{Account:{...R,...e.Account},IdToken:{...M,...e.IdToken},AccessToken:{..._,...e.AccessToken},RefreshToken:{...O,...e.RefreshToken},AppMetadata:{...P,...e.AppMetadata}}}}class x extends n.AuthError{constructor(e,t){super(e,t),this.name="NodeAuthError"}static createInvalidLoopbackAddressTypeError(){return new x("invalid_loopback_server_address_type","Loopback server address is not type string. This is unexpected.")}static createUnableToLoadRedirectUrlError(){return new x("unable_to_load_redirectUrl","Loopback server callback was invoked without a url. This is unexpected.")}static createNoAuthCodeInResponseError(){return new x("no_auth_code_in_response","No auth code found in the server response. Please check your network trace to determine what happened.")}static createNoLoopbackServerExistsError(){return new x("no_loopback_server_exists","No loopback server exists yet.")}static createLoopbackServerAlreadyExistsError(){return new x("loopback_server_already_exists","Loopback server already exists. Cannot create another.")}static createLoopbackServerTimeoutError(){return new x("loopback_server_timeout","Timed out waiting for auth code listener to be registered.")}static createStateNotFoundError(){return new x("state_not_found","State not found. Please verify that the request originated from msal.")}}class z{constructor(e){this.config=T(e),this.cryptoProvider=new v,this.logger=new n.Logger(this.config.system.loggerOptions,"@azure/msal-node","1.14.0"),this.storage=new S(this.logger,this.config.auth.clientId,this.cryptoProvider),this.tokenCache=new q(this.storage,this.logger,this.config.cache.cachePlugin)}async getAuthCodeUrl(e){this.logger.info("getAuthCodeUrl called",e.correlationId);const t={...e,...await this.initializeBaseRequest(e),responseMode:e.responseMode||n.ResponseMode.QUERY,authenticationScheme:n.AuthenticationScheme.BEARER},r=await this.buildOauthClientConfiguration(t.authority,t.correlationId,void 0,void 0,e.azureCloudOptions),i=new n.AuthorizationCodeClient(r);return this.logger.verbose("Auth code client created",t.correlationId),i.getAuthCodeUrl(t)}async acquireTokenByCode(e,t){this.logger.info("acquireTokenByCode called"),e.state&&t&&(this.logger.info("acquireTokenByCode - validating state"),this.validateState(e.state,t.state||""),t={...t,state:""});const r={...e,...await this.initializeBaseRequest(e),authenticationScheme:n.AuthenticationScheme.BEARER},i=this.initializeServerTelemetryManager(u.acquireTokenByCode,r.correlationId);try{const o=await this.buildOauthClientConfiguration(r.authority,r.correlationId,i,void 0,e.azureCloudOptions),s=new n.AuthorizationCodeClient(o);return this.logger.verbose("Auth code client created",r.correlationId),s.acquireToken(r,t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(r.correlationId),i.cacheFailedRequest(e),e}}async acquireTokenByRefreshToken(e){this.logger.info("acquireTokenByRefreshToken called",e.correlationId);const t={...e,...await this.initializeBaseRequest(e),authenticationScheme:n.AuthenticationScheme.BEARER},r=this.initializeServerTelemetryManager(u.acquireTokenByRefreshToken,t.correlationId);try{const i=await this.buildOauthClientConfiguration(t.authority,t.correlationId,r,void 0,e.azureCloudOptions),o=new n.RefreshTokenClient(i);return this.logger.verbose("Refresh token client created",t.correlationId),o.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),r.cacheFailedRequest(e),e}}async acquireTokenSilent(e){const t={...e,...await this.initializeBaseRequest(e),forceRefresh:e.forceRefresh||!1},r=this.initializeServerTelemetryManager(u.acquireTokenSilent,t.correlationId,t.forceRefresh);try{const i=await this.buildOauthClientConfiguration(t.authority,t.correlationId,r,void 0,e.azureCloudOptions),o=new n.SilentFlowClient(i);return this.logger.verbose("Silent flow client created",t.correlationId),o.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),r.cacheFailedRequest(e),e}}async acquireTokenByUsernamePassword(e){this.logger.info("acquireTokenByUsernamePassword called",e.correlationId);const t={...e,...await this.initializeBaseRequest(e)},r=this.initializeServerTelemetryManager(u.acquireTokenByUsernamePassword,t.correlationId);try{const i=await this.buildOauthClientConfiguration(t.authority,t.correlationId,r,void 0,e.azureCloudOptions),o=new n.UsernamePasswordClient(i);return this.logger.verbose("Username password client created",t.correlationId),o.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),r.cacheFailedRequest(e),e}}getTokenCache(){return this.logger.info("getTokenCache called"),this.tokenCache}validateState(e,t){if(!e)throw x.createStateNotFoundError();if(e!==t)throw n.ClientAuthError.createStateMismatchError()}getLogger(){return this.logger}setLogger(e){this.logger=e}async buildOauthClientConfiguration(e,t,r,i,o){this.logger.verbose("buildOauthClientConfiguration called",t);const s=o||this.config.auth.azureCloudOptions;this.logger.verbose("building oauth client configuration with the authority: "+e,t);const a=await this.createAuthority(e,i,t,s);return null==r||r.updateRegionDiscoveryMetadata(a.regionDiscoveryMetadata),{authOptions:{clientId:this.config.auth.clientId,authority:a,clientCapabilities:this.config.auth.clientCapabilities},systemOptions:{proxyUrl:this.config.system.proxyUrl},loggerOptions:{logLevel:this.config.system.loggerOptions.logLevel,loggerCallback:this.config.system.loggerOptions.loggerCallback,piiLoggingEnabled:this.config.system.loggerOptions.piiLoggingEnabled,correlationId:t},cryptoInterface:this.cryptoProvider,networkInterface:this.config.system.networkClient,storageInterface:this.storage,serverTelemetryManager:r,clientCredentials:{clientSecret:this.clientSecret,clientAssertion:this.clientAssertion?this.getClientAssertion(a):void 0},libraryInfo:{sku:"msal.js.node",version:"1.14.0",cpu:process.arch||n.Constants.EMPTY_STRING,os:process.platform||n.Constants.EMPTY_STRING},telemetry:this.config.telemetry,persistencePlugin:this.config.cache.cachePlugin,serializableCache:this.tokenCache}}getClientAssertion(e){return{assertion:this.clientAssertion.getJwt(this.cryptoProvider,this.config.auth.clientId,e.tokenEndpoint),assertionType:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}}async initializeBaseRequest(e){return this.logger.verbose("initializeRequestScopes called",e.correlationId),e.authenticationScheme&&e.authenticationScheme===n.AuthenticationScheme.POP&&this.logger.verbose("Authentication Scheme 'pop' is not supported yet, setting Authentication Scheme to 'Bearer' for request",e.correlationId),e.authenticationScheme=n.AuthenticationScheme.BEARER,e.claims&&!n.StringUtils.isEmpty(e.claims)&&(e.requestedClaimsHash=await this.cryptoProvider.hashString(e.claims)),{...e,scopes:[...e&&e.scopes||[],...n.OIDC_DEFAULT_SCOPES],correlationId:e&&e.correlationId||this.cryptoProvider.createNewGuid(),authority:e.authority||this.config.auth.authority}}initializeServerTelemetryManager(e,t,r){return new n.ServerTelemetryManager({clientId:this.config.auth.clientId,correlationId:t,apiId:e,forceRefresh:r||!1},this.storage)}async createAuthority(e,t,r,i){this.logger.verbose("createAuthority called",r);const o=n.Authority.generateAuthority(e,i),s={protocolMode:this.config.auth.protocolMode,knownAuthorities:this.config.auth.knownAuthorities,cloudDiscoveryMetadata:this.config.auth.cloudDiscoveryMetadata,authorityMetadata:this.config.auth.authorityMetadata,azureRegionConfiguration:t,skipAuthorityMetadataCache:this.config.auth.skipAuthorityMetadataCache};return await n.AuthorityFactory.createDiscoveredInstance(o,this.config.system.networkClient,this.storage,s,this.config.system.proxyUrl)}clearCache(){this.storage.clear()}}class U{async listenForAuthCode(e,t){if(this.server)throw x.createLoopbackServerAlreadyExistsError();const o=new Promise((o,s)=>{this.server=i.createServer(async(i,a)=>{const c=i.url;if(!c)return a.end(t||"Error occurred loading redirectUrl"),void s(x.createUnableToLoadRedirectUrlError());if(c===n.Constants.FORWARD_SLASH)return void a.end(e||"Auth code was successfully acquired. You can close this window now.");const l=n.UrlString.getDeserializedQueryString(c);if(l.code){const e=await this.getRedirectUri();a.writeHead(r.REDIRECT,{location:e}),a.end()}o(l)}),this.server.listen(0)});return await new Promise(e=>{let t=0;const r=setInterval(()=>{if(50<t)throw x.createLoopbackServerTimeoutError();this.server.listening&&(clearInterval(r),e()),t++},100)}),o}getRedirectUri(){if(!this.server)throw x.createNoLoopbackServerExistsError();const e=this.server.address();if(!e||"string"==typeof e||!e.port)throw this.closeServer(),x.createInvalidLoopbackAddressTypeError();return"http://localhost:"+(e&&e.port)}closeServer(){this.server&&this.server.close()}}class j{static fromAssertion(e){const t=new j;return t.jwt=e,t}static fromCertificate(e,t,r){const n=new j;return n.privateKey=t,n.thumbprint=e,r&&(n.publicCertificate=this.parseCertificate(r)),n}getJwt(e,t,r){if(this.privateKey&&this.thumbprint)return this.jwt&&!this.isExpired()&&t===this.issuer&&r===this.jwtAudience?this.jwt:this.createJwt(e,t,r);if(this.jwt)return this.jwt;throw n.ClientAuthError.createInvalidAssertionError()}createJwt(e,t,r){this.issuer=t,this.jwtAudience=r;const i=n.TimeUtils.nowSeconds();this.expirationTime=i+600;const o={alg:"RS256",x5t:k.base64EncodeUrl(this.thumbprint,"hex")};this.publicCertificate&&Object.assign(o,{x5c:this.publicCertificate});const s={aud:this.jwtAudience,exp:this.expirationTime,iss:this.issuer,sub:this.issuer,nbf:i,jti:e.createNewGuid()};return this.jwt=l.sign(s,this.privateKey,{header:o}),this.jwt}isExpired(){return this.expirationTime<n.TimeUtils.nowSeconds()}static parseCertificate(e){const t=/-----BEGIN CERTIFICATE-----\r*\n(.+?)\r*\n-----END CERTIFICATE-----/gs,r=[];let i;for(;null!==(i=t.exec(e));)r.push(i[1].replace(/\r*\n/g,n.Constants.EMPTY_STRING));return r}}Object.defineProperty(exports,"AuthError",{enumerable:!0,get:function(){return n.AuthError}}),Object.defineProperty(exports,"AuthErrorMessage",{enumerable:!0,get:function(){return n.AuthErrorMessage}}),Object.defineProperty(exports,"AzureCloudInstance",{enumerable:!0,get:function(){return n.AzureCloudInstance}}),Object.defineProperty(exports,"ClientAuthError",{enumerable:!0,get:function(){return n.ClientAuthError}}),Object.defineProperty(exports,"ClientAuthErrorMessage",{enumerable:!0,get:function(){return n.ClientAuthErrorMessage}}),Object.defineProperty(exports,"ClientConfigurationError",{enumerable:!0,get:function(){return n.ClientConfigurationError}}),Object.defineProperty(exports,"ClientConfigurationErrorMessage",{enumerable:!0,get:function(){return n.ClientConfigurationErrorMessage}}),Object.defineProperty(exports,"InteractionRequiredAuthError",{enumerable:!0,get:function(){return n.InteractionRequiredAuthError}}),Object.defineProperty(exports,"InteractionRequiredAuthErrorMessage",{enumerable:!0,get:function(){return n.InteractionRequiredAuthErrorMessage}}),Object.defineProperty(exports,"LogLevel",{enumerable:!0,get:function(){return n.LogLevel}}),Object.defineProperty(exports,"Logger",{enumerable:!0,get:function(){return n.Logger}}),Object.defineProperty(exports,"PromptValue",{enumerable:!0,get:function(){return n.PromptValue}}),Object.defineProperty(exports,"ProtocolMode",{enumerable:!0,get:function(){return n.ProtocolMode}}),Object.defineProperty(exports,"ResponseMode",{enumerable:!0,get:function(){return n.ResponseMode}}),Object.defineProperty(exports,"ServerError",{enumerable:!0,get:function(){return n.ServerError}}),Object.defineProperty(exports,"TokenCacheContext",{enumerable:!0,get:function(){return n.TokenCacheContext}}),exports.ClientApplication=z,exports.ClientAssertion=j,exports.ConfidentialClientApplication=class extends z{constructor(e){super(e),this.setClientCredential(this.config),this.appTokenProvider=void 0}SetAppTokenProvider(e){this.appTokenProvider=e}async acquireTokenByClientCredential(e){let t;this.logger.info("acquireTokenByClientCredential called",e.correlationId),e.clientAssertion&&(t={assertion:e.clientAssertion,assertionType:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"});const r={...e,...await this.initializeBaseRequest(e),clientAssertion:t},i={azureRegion:r.azureRegion,environmentRegion:process.env.REGION_NAME},o=this.initializeServerTelemetryManager(u.acquireTokenByClientCredential,r.correlationId,r.skipCache);try{const t=await this.buildOauthClientConfiguration(r.authority,r.correlationId,o,i,e.azureCloudOptions),s=new n.ClientCredentialClient(t,this.appTokenProvider);return this.logger.verbose("Client credential client created",r.correlationId),s.acquireToken(r)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(r.correlationId),o.cacheFailedRequest(e),e}}async acquireTokenOnBehalfOf(e){this.logger.info("acquireTokenOnBehalfOf called",e.correlationId);const t={...e,...await this.initializeBaseRequest(e)};try{const r=await this.buildOauthClientConfiguration(t.authority,t.correlationId,void 0,void 0,e.azureCloudOptions),i=new n.OnBehalfOfClient(r);return this.logger.verbose("On behalf of client created",t.correlationId),i.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),e}}setClientCredential(e){const t=!n.StringUtils.isEmpty(e.auth.clientSecret),r=!n.StringUtils.isEmpty(e.auth.clientAssertion),i=e.auth.clientCertificate||{thumbprint:n.Constants.EMPTY_STRING,privateKey:n.Constants.EMPTY_STRING},o=!n.StringUtils.isEmpty(i.thumbprint)||!n.StringUtils.isEmpty(i.privateKey);if(!this.appTokenProvider){if(t&&r||r&&o||t&&o)throw n.ClientAuthError.createInvalidCredentialError();if(e.auth.clientSecret)this.clientSecret=e.auth.clientSecret;else if(e.auth.clientAssertion)this.clientAssertion=j.fromAssertion(e.auth.clientAssertion);else{if(!o)throw n.ClientAuthError.createInvalidCredentialError();var s;this.clientAssertion=j.fromCertificate(i.thumbprint,i.privateKey,null==(s=e.auth.clientCertificate)?void 0:s.x5c)}}}},exports.CryptoProvider=v,exports.DistributedCachePlugin=class{constructor(e,t){this.client=e,this.partitionManager=t}async beforeCacheAccess(e){const t=await this.partitionManager.getKey(),r=await this.client.get(t);e.tokenCache.deserialize(r)}async afterCacheAccess(e){if(e.cacheHasChanged){const t=e.tokenCache.getKVStore(),r=Object.values(t).filter(e=>n.AccountEntity.isAccountEntity(e));if(r.length>0){const t=r[0],n=await this.partitionManager.extractKey(t);await this.client.set(n,e.tokenCache.serialize())}}}},exports.NodeStorage=S,exports.PublicClientApplication=class extends z{constructor(e){super(e)}async acquireTokenByDeviceCode(e){this.logger.info("acquireTokenByDeviceCode called",e.correlationId);const t=Object.assign(e,await this.initializeBaseRequest(e)),r=this.initializeServerTelemetryManager(u.acquireTokenByDeviceCode,t.correlationId);try{const i=await this.buildOauthClientConfiguration(t.authority,t.correlationId,r,void 0,e.azureCloudOptions),o=new n.DeviceCodeClient(i);return this.logger.verbose("Device code client created",t.correlationId),o.acquireToken(t)}catch(e){throw e instanceof n.AuthError&&e.setCorrelationId(t.correlationId),r.cacheFailedRequest(e),e}}async acquireTokenInteractive(e){const{verifier:t,challenge:r}=await this.cryptoProvider.generatePkceCodes(),{openBrowser:i,successTemplate:o,errorTemplate:s,...a}=e,c=new U,l=c.listenForAuthCode(o,s),h=c.getRedirectUri(),u={...a,scopes:e.scopes||[],redirectUri:h,responseMode:n.ResponseMode.QUERY,codeChallenge:r,codeChallengeMethod:n.CodeChallengeMethodValues.S256},d=await this.getAuthCodeUrl(u);await i(d);const g=await l.finally(()=>{c.closeServer()});if(g.error)throw new n.ServerError(g.error,g.error_description,g.suberror);if(!g.code)throw x.createNoAuthCodeInResponseError();return this.acquireTokenByCode({code:g.code,scopes:n.OIDC_DEFAULT_SCOPES,redirectUri:u.redirectUri,codeVerifier:t,clientInfo:g.client_info||n.Constants.EMPTY_STRING})}},exports.TokenCache=q,exports.buildAppConfiguration=T,exports.version="1.14.0";
 //# sourceMappingURL=msal-node.cjs.production.min.js.map

dist/packageMetadata.d.ts

 export declare const name = "@azure/msal-node";
-export declare const version = "1.13.0";
+export declare const version = "1.14.0";
 //# sourceMappingURL=packageMetadata.d.ts.map

dist/request/AuthorizationCodeRequest.d.ts

@@ -13,2 +13,3 @@ import { CommonAuthorizationCodeRequest } from "@azure/msal-common";
  * - codeVerifier            - The same code_verifier that was used to obtain the authorization_code. Required if PKCE was used in the authorization code grant request.For more information, see the PKCE RFC: https://tools.ietf.org/html/rfc7636
+ * - state                   - Unique GUID generated by the user that is cached by the user and sent to the server during the first leg of the flow. This string is sent back by the server with the authorization code. The user cached state is then compared with the state received from the server to mitigate the risk of CSRF attacks. See https://datatracker.ietf.org/doc/html/rfc6819#section-3.6.
  * @public
@@ -20,3 +21,4 @@ */
     code: string;
+    state?: string;
 };
 //# sourceMappingURL=AuthorizationCodeRequest.d.ts.map

package.json

 {
   "name": "@azure/msal-node",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "author": {
@@ -61,3 +61,3 @@ "name": "Microsoft",
   "dependencies": {
-    "@azure/msal-common": "^7.4.0",
+    "@azure/msal-common": "^7.4.1",
     "jsonwebtoken": "^8.5.1",
@@ -64,0 +64,0 @@ "uuid": "^8.3.0"

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

852381

increased by1.26%

Lines of code

6376

increased by1.45%

Dependency changes

• Updated@azure/msal-common@^7.4.1