@azure/msal-node - npm Package Compare versions

Comparing version 2.12.0 to 2.13.0

dist/cache/distributed/DistributedCachePlugin.d.ts

@@ -0,0 +0,0 @@ import { ICachePlugin, TokenCacheContext } from "@azure/msal-common";

dist/cache/distributed/ICacheClient.d.ts

@@ -0,0 +0,0 @@ export interface ICacheClient {

dist/cache/distributed/IPartitionManager.d.ts

@@ -0,0 +0,0 @@ import { AccountEntity } from "@azure/msal-common";

dist/cache/ITokenCache.d.ts

@@ -0,0 +0,0 @@ import { AccountInfo } from "@azure/msal-common";

dist/cache/NodeStorage.d.ts

@@ -0,0 +0,0 @@ import { TokenKeys, AccountEntity, IdTokenEntity, AccessTokenEntity, RefreshTokenEntity, AppMetadataEntity, ServerTelemetryEntity, ThrottlingEntity, CacheManager, Logger, ValidCacheType, ICrypto, AuthorityMetadataEntity, ValidCredentialType, StaticAuthorityOptions } from "@azure/msal-common";

dist/cache/serializer/Deserializer.d.ts

@@ -0,0 +0,0 @@ import { AccountCache, IdTokenCache, AccessTokenCache, RefreshTokenCache, AppMetadataCache } from "@azure/msal-common";

dist/cache/serializer/Serializer.d.ts

@@ -0,0 +0,0 @@ import { AccountCache, IdTokenCache, AccessTokenCache, RefreshTokenCache, AppMetadataCache } from "@azure/msal-common";

dist/cache/serializer/SerializerTypes.d.ts

@@ -0,0 +0,0 @@ import { AccountCache, IdTokenCache, AccessTokenCache, RefreshTokenCache, AppMetadataCache, ValidCacheType } from "@azure/msal-common";

dist/cache/TokenCache.d.ts

@@ -0,0 +0,0 @@ import { NodeStorage } from "./NodeStorage.js";

dist/client/ClientApplication.d.ts

@@ -0,0 +0,0 @@ import { ClientConfiguration, AuthenticationResult, BaseAuthRequest, Logger, ServerTelemetryManager, AzureRegionConfiguration, AzureCloudOptions, AuthorizationCodePayload, ClientAssertionCallback } from "@azure/msal-common";

dist/client/ClientAssertion.d.ts

@@ -0,0 +0,0 @@ import { CryptoProvider } from "../crypto/CryptoProvider.js";

dist/client/ClientCredentialClient.d.ts

@@ -0,0 +0,0 @@ import { AuthenticationResult, Authority, BaseClient, CacheManager, CacheOutcome, ClientConfiguration, CommonClientCredentialRequest, IAppTokenProvider, ICrypto, ServerTelemetryManager } from "@azure/msal-common";

dist/client/ConfidentialClientApplication.d.ts

@@ -0,0 +0,0 @@ import { ClientApplication } from "./ClientApplication.js";

dist/client/DeviceCodeClient.d.ts

@@ -0,0 +0,0 @@ import { AuthenticationResult, BaseClient, ClientConfiguration, CommonDeviceCodeRequest } from "@azure/msal-common";

dist/client/IConfidentialClientApplication.d.ts

@@ -0,0 +0,0 @@ import { AuthenticationResult, IAppTokenProvider, Logger } from "@azure/msal-common";

dist/client/IPublicClientApplication.d.ts

@@ -0,0 +0,0 @@ import { AccountInfo, AuthenticationResult, Logger } from "@azure/msal-common";

dist/client/ManagedIdentityApplication.d.ts

@@ -0,0 +0,0 @@ import { AuthenticationResult } from "@azure/msal-common";

dist/client/ManagedIdentityClient.d.ts

@@ -0,0 +0,0 @@ import { Authority, INetworkModule, Logger, AuthenticationResult } from "@azure/msal-common";

dist/client/ManagedIdentitySources/AppService.d.ts

@@ -0,0 +0,0 @@ import { INetworkModule, Logger } from "@azure/msal-common";

dist/client/ManagedIdentitySources/AzureArc.d.ts

@@ -9,6 +9,9 @@ import { INetworkModule, NetworkResponse, NetworkRequestOptions, Logger, ServerAuthorizationTokenResponse } from "@azure/msal-common";
 export declare const ARC_API_VERSION: string;
-export declare const SUPPORTED_AZURE_ARC_PLATFORMS: {
+export declare const DEFAULT_AZURE_ARC_IDENTITY_ENDPOINT: string;
+type FilePathMap = {
     win32: string;
     linux: string;
 };
+export declare const SUPPORTED_AZURE_ARC_PLATFORMS: FilePathMap;
+export declare const AZURE_ARC_FILE_DETECTION: FilePathMap;
 /**
@@ -25,2 +28,3 @@ * Original source of code: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/AzureArcManagedIdentitySource.cs
 }
+export {};
 //# sourceMappingURL=AzureArc.d.ts.map

dist/client/ManagedIdentitySources/BaseManagedIdentitySource.d.ts

@@ -0,0 +0,0 @@ import { Authority, INetworkModule, Logger, NetworkRequestOptions, NetworkResponse, ServerAuthorizationTokenResponse, AuthenticationResult } from "@azure/msal-common";

dist/client/ManagedIdentitySources/CloudShell.d.ts

@@ -0,0 +0,0 @@ import { INetworkModule, Logger } from "@azure/msal-common";

dist/client/ManagedIdentitySources/Imds.d.ts

@@ -0,0 +0,0 @@ import { INetworkModule, Logger } from "@azure/msal-common";

dist/client/ManagedIdentitySources/ServiceFabric.d.ts

@@ -0,0 +0,0 @@ import { INetworkModule, Logger } from "@azure/msal-common";

dist/client/OnBehalfOfClient.d.ts

@@ -0,0 +0,0 @@ import { AuthenticationResult, BaseClient, ClientConfiguration, CommonOnBehalfOfRequest } from "@azure/msal-common";

dist/client/PublicClientApplication.d.ts

@@ -0,0 +0,0 @@ import { AuthenticationResult, AccountInfo } from "@azure/msal-common";

dist/client/UsernamePasswordClient.d.ts

@@ -0,0 +0,0 @@ import { AuthenticationResult, BaseClient, ClientConfiguration, CommonUsernamePasswordRequest } from "@azure/msal-common";

dist/config/Configuration.d.ts

@@ -0,0 +0,0 @@ /// <reference types="node" />

dist/config/ManagedIdentityId.d.ts

@@ -0,0 +0,0 @@ import { ManagedIdentityIdType } from "../utils/Constants";

dist/config/ManagedIdentityRequestParameters.d.ts

@@ -0,0 +0,0 @@ import { HttpMethod } from "../utils/Constants";

dist/crypto/CryptoProvider.d.ts

@@ -0,0 +0,0 @@ import { ICrypto, PkceCodes } from "@azure/msal-common";

dist/crypto/GuidGenerator.d.ts

@@ -0,0 +0,0 @@ import { IGuidGenerator } from "@azure/msal-common";

dist/crypto/HashUtils.d.ts

@@ -0,0 +0,0 @@ /// <reference types="node" />

dist/crypto/PkceGenerator.d.ts

@@ -0,0 +0,0 @@ import { PkceCodes } from "@azure/msal-common";

dist/error/ManagedIdentityError.d.ts

@@ -0,0 +0,0 @@ import { AuthError } from "@azure/msal-common";

dist/error/ManagedIdentityErrorCodes.d.ts

@@ -0,0 +0,0 @@ export declare const invalidFileExtension = "invalid_file_extension";

dist/error/NodeAuthError.d.ts

@@ -0,0 +0,0 @@ import { AuthError } from "@azure/msal-common";

dist/index.d.ts

@@ -0,0 +0,0 @@ /**

dist/internals.d.ts

@@ -0,0 +0,0 @@ /**

dist/network/HttpClient.d.ts

@@ -0,0 +0,0 @@ /// <reference types="node" />

dist/network/HttpClientWithRetries.d.ts

@@ -0,0 +0,0 @@ import { INetworkModule, NetworkRequestOptions, NetworkResponse } from "@azure/msal-common";

dist/network/ILoopbackClient.d.ts

@@ -0,0 +0,0 @@ import { ServerAuthorizationCodeResponse } from "@azure/msal-common";

dist/network/LoopbackClient.d.ts

@@ -0,0 +0,0 @@ import { ServerAuthorizationCodeResponse } from "@azure/msal-common";

dist/packageMetadata.d.ts

 export declare const name = "@azure/msal-node";
-export declare const version = "2.12.0";
+export declare const version = "2.13.0";
 //# sourceMappingURL=packageMetadata.d.ts.map

dist/request/AuthorizationCodeRequest.d.ts

@@ -0,0 +0,0 @@ import { CommonAuthorizationCodeRequest } from "@azure/msal-common";

dist/request/AuthorizationUrlRequest.d.ts

@@ -0,0 +0,0 @@ import { CommonAuthorizationUrlRequest } from "@azure/msal-common";

dist/request/ClientCredentialRequest.d.ts

@@ -0,0 +0,0 @@ import { ClientAssertionCallback, CommonClientCredentialRequest } from "@azure/msal-common";

dist/request/DeviceCodeRequest.d.ts

@@ -0,0 +0,0 @@ import { CommonDeviceCodeRequest, DeviceCodeResponse } from "@azure/msal-common";

dist/request/InteractiveRequest.d.ts

@@ -0,0 +0,0 @@ /// <reference types="node" />

dist/request/ManagedIdentityRequest.d.ts

@@ -0,0 +0,0 @@ import { CommonClientCredentialRequest } from "@azure/msal-common";

dist/request/ManagedIdentityRequestParams.d.ts

@@ -0,0 +0,0 @@ /**

dist/request/OnBehalfOfRequest.d.ts

@@ -0,0 +0,0 @@ import { CommonOnBehalfOfRequest } from "@azure/msal-common";

dist/request/RefreshTokenRequest.d.ts

@@ -0,0 +0,0 @@ import { CommonRefreshTokenRequest } from "@azure/msal-common";

dist/request/SignOutRequest.d.ts

@@ -0,0 +0,0 @@ import { AccountInfo } from "@azure/msal-common";

dist/request/SilentFlowRequest.d.ts

@@ -0,0 +0,0 @@ import { AccountInfo, CommonSilentFlowRequest } from "@azure/msal-common";

dist/request/UsernamePasswordRequest.d.ts

@@ -0,0 +0,0 @@ import { CommonUsernamePasswordRequest } from "@azure/msal-common";

dist/response/ManagedIdentityTokenResponse.d.ts

@@ -0,0 +0,0 @@ import { AuthenticationScheme } from "@azure/msal-common";

dist/retry/IHttpRetryPolicy.d.ts

@@ -0,0 +0,0 @@ /// <reference types="node" />

dist/retry/LinearRetryPolicy.d.ts

@@ -0,0 +0,0 @@ /// <reference types="node" />

dist/utils/Constants.d.ts

@@ -0,0 +0,0 @@ export declare const AUTHORIZATION_HEADER_NAME: string;

dist/utils/EncodingUtils.d.ts

@@ -0,0 +0,0 @@ /// <reference types="node" />

dist/utils/NetworkUtils.d.ts

@@ -0,0 +0,0 @@ import { NetworkResponse, UrlToHttpRequestOptions } from "@azure/msal-common";

package.json

 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@azure/msal-node",
-  "version": "2.12.0",
+  "version": "2.13.0",
   "author": {
@@ -82,3 +82,3 @@ "name": "Microsoft",
   "dependencies": {
-    "@azure/msal-common": "14.14.0",
+    "@azure/msal-common": "14.14.1",
     "jsonwebtoken": "^9.0.0",
@@ -85,0 +85,0 @@ "uuid": "^8.3.0"

src/client/ConfidentialClientApplication.ts

@@ -224,5 +224,5 @@ /*
         const certificateNotEmpty =
-            (!!this.config.auth.clientCertificate.thumbprint ||
-                !!this.config.auth.clientCertificate.thumbprintSha256) &&
-            !!this.config.auth.clientCertificate.privateKey;
+            (!!this.config.auth.clientCertificate?.thumbprint ||
+                !!this.config.auth.clientCertificate?.thumbprintSha256) &&
+            !!this.config.auth.clientCertificate?.privateKey;
 
@@ -229,0 +229,0 @@ /*

src/client/ManagedIdentitySources/AzureArc.ts

@@ -36,3 +36,8 @@ /*
 import { NodeStorage } from "../../cache/NodeStorage";
-import { readFileSync, statSync } from "fs";
+import {
+    accessSync,
+    constants as fsConstants,
+    readFileSync,
+    statSync,
+} from "fs";
 import { ManagedIdentityTokenResponse } from "../../response/ManagedIdentityTokenResponse";
@@ -43,4 +48,12 @@ import { ManagedIdentityId } from "../../config/ManagedIdentityId";
 export const ARC_API_VERSION: string = "2019-11-01";
+export const DEFAULT_AZURE_ARC_IDENTITY_ENDPOINT: string =
+    "http://127.0.0.1:40342/metadata/identity/oauth2/token";
+const HIMDS_EXECUTABLE_HELPER_STRING = "N/A: himds executable exists";
 
-export const SUPPORTED_AZURE_ARC_PLATFORMS = {
+type FilePathMap = {
+    win32: string;
+    linux: string;
+};
+
+export const SUPPORTED_AZURE_ARC_PLATFORMS: FilePathMap = {
     win32: `${process.env["ProgramData"]}\\AzureConnectedMachineAgent\\Tokens\\`,
@@ -50,2 +63,7 @@ linux: "/var/opt/azcmagent/tokens/",
 
+export const AZURE_ARC_FILE_DETECTION: FilePathMap = {
+    win32: `${process.env["ProgramFiles"]}\\AzureConnectedMachineAgent\\himds.exe`,
+    linux: "/opt/azcmagent/bin/himds",
+};
+
 /**
@@ -70,9 +88,34 @@ * Original source of code: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/src/AzureArcManagedIdentitySource.cs
     public static getEnvironmentVariables(): Array<string | undefined> {
-        const identityEndpoint: string | undefined =
+        let identityEndpoint: string | undefined =
             process.env[
                 ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT
             ];
-        const imdsEndpoint: string | undefined =
+        let imdsEndpoint: string | undefined =
             process.env[ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT];
 
+        // if either of the identity or imds endpoints are undefined, check if the himds executable exists
+        if (!identityEndpoint || !imdsEndpoint) {
+            // get the expected Windows or Linux file path of the himds executable
+            const fileDetectionPath: string =
+                AZURE_ARC_FILE_DETECTION[process.platform as keyof FilePathMap];
+            try {
+                /*
+                 * check if the himds executable exists and its permissions allow it to be read
+                 * returns undefined if true, throws an error otherwise
+                 */
+                accessSync(
+                    fileDetectionPath,
+                    fsConstants.F_OK | fsConstants.R_OK
+                );
+
+                identityEndpoint = DEFAULT_AZURE_ARC_IDENTITY_ENDPOINT;
+                imdsEndpoint = HIMDS_EXECUTABLE_HELPER_STRING;
+            } catch (err) {
+                /*
+                 * do nothing
+                 * accessSync returns undefined on success, and throws an error on failure
+                 */
+            }
+        }
+
         return [identityEndpoint, imdsEndpoint];
@@ -91,33 +134,43 @@ }
 
-        // if either of the identity or imds endpoints are undefined, this MSI provider is unavailable.
+        // if either of the identity or imds endpoints are undefined (even after himds file detection)
         if (!identityEndpoint || !imdsEndpoint) {
             logger.info(
-                `[Managed Identity] ${ManagedIdentitySourceNames.AZURE_ARC} managed identity is unavailable because one or both of the '${ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT}' and '${ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT}' environment variables are not defined.`
+                `[Managed Identity] ${ManagedIdentitySourceNames.AZURE_ARC} managed identity is unavailable through environment variables because one or both of '${ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT}' and '${ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT}' are not defined. ${ManagedIdentitySourceNames.AZURE_ARC} managed identity is also unavailable through file detection.`
             );
+
             return null;
         }
 
-        const validatedIdentityEndpoint: string =
+        // check if the imds endpoint is set to the default for file detection
+        if (imdsEndpoint === HIMDS_EXECUTABLE_HELPER_STRING) {
+            logger.info(
+                `[Managed Identity] ${ManagedIdentitySourceNames.AZURE_ARC} managed identity is available through file detection. Defaulting to known ${ManagedIdentitySourceNames.AZURE_ARC} endpoint: ${DEFAULT_AZURE_ARC_IDENTITY_ENDPOINT}. Creating ${ManagedIdentitySourceNames.AZURE_ARC} managed identity.`
+            );
+        } else {
+            // otherwise, both the identity and imds endpoints are defined without file detection; validate them
+
+            const validatedIdentityEndpoint: string =
+                AzureArc.getValidatedEnvVariableUrlString(
+                    ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT,
+                    identityEndpoint,
+                    ManagedIdentitySourceNames.AZURE_ARC,
+                    logger
+                );
+            // remove trailing slash
+            validatedIdentityEndpoint.endsWith("/")
+                ? validatedIdentityEndpoint.slice(0, -1)
+                : validatedIdentityEndpoint;
+
             AzureArc.getValidatedEnvVariableUrlString(
-                ManagedIdentityEnvironmentVariableNames.IDENTITY_ENDPOINT,
-                identityEndpoint,
+                ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT,
+                imdsEndpoint,
                 ManagedIdentitySourceNames.AZURE_ARC,
                 logger
             );
-        // remove trailing slash
-        validatedIdentityEndpoint.endsWith("/")
-            ? validatedIdentityEndpoint.slice(0, -1)
-            : validatedIdentityEndpoint;
 
-        AzureArc.getValidatedEnvVariableUrlString(
-            ManagedIdentityEnvironmentVariableNames.IMDS_ENDPOINT,
-            imdsEndpoint,
-            ManagedIdentitySourceNames.AZURE_ARC,
-            logger
-        );
+            logger.info(
+                `[Managed Identity] Environment variables validation passed for ${ManagedIdentitySourceNames.AZURE_ARC} managed identity. Endpoint URI: ${validatedIdentityEndpoint}. Creating ${ManagedIdentitySourceNames.AZURE_ARC} managed identity.`
+            );
+        }
 
-        logger.info(
-            `[Managed Identity] Environment variables validation passed for ${ManagedIdentitySourceNames.AZURE_ARC} managed identity. Endpoint URI: ${validatedIdentityEndpoint}. Creating ${ManagedIdentitySourceNames.AZURE_ARC} managed identity.`
-        );
-
         if (
@@ -194,5 +247,7 @@ managedIdentityId.idType !== ManagedIdentityIdType.SYSTEM_ASSIGNED
 
-            // get the expected Windows or Linux file path)
+            // get the expected Windows or Linux file path
             const expectedSecretFilePath: string =
-                SUPPORTED_AZURE_ARC_PLATFORMS[process.platform as string];
+                SUPPORTED_AZURE_ARC_PLATFORMS[
+                    process.platform as keyof FilePathMap
+                ];
 
@@ -199,0 +254,0 @@ // throw an error if the file in the file path is not a .key file

src/network/LoopbackClient.ts

@@ -68,2 +68,8 @@ /*
                         }
+                        if (authCodeResponse.error) {
+                            res.end(
+                                errorTemplate ||
+                                    `Error occurred: ${authCodeResponse.error}`
+                            );
+                        }
                         resolve(authCodeResponse);
@@ -70,0 +76,0 @@ }

src/packageMetadata.ts

 /* eslint-disable header/header */
 export const name = "@azure/msal-node";
-export const version = "2.12.0";
+export const version = "2.13.0";

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1199998

increased by2.04%

Lines of code

19435

increased by0.95%

Worsened metrics

Number of low supply chain risk alerts

30

increased by7.14%

Dependency changes

• + Added@azure/msal-common@14.14.1(transitive)

• - Removed@azure/msal-common@14.14.0(transitive)

• Updated@azure/msal-common@14.14.1