botframework-connector - npm Package Compare versions

Comparing version 4.1.7 to 4.2.0

lib/auth/channelValidation.js

@@ -67,3 +67,3 @@ "use strict";
         return __awaiter(this, void 0, void 0, function* () {
-            if (!identity.isAuthenticated) {
+            if (!identity || !identity.isAuthenticated) {
                 // The token is in some way invalid. Not Authorized.
@@ -70,0 +70,0 @@ throw new Error('Unauthorized. Is not authenticated');

lib/auth/emulatorValidation.d.ts

@@ -30,5 +30,6 @@ /**
      * @param  {ICredentialProvider} credentials The user defined set of valid credentials, such as the AppId.
+     * @param  {string} channelService The channelService value that distinguishes public Azure from US Government Azure.
      * @returns {Promise<ClaimsIdentity>} A valid ClaimsIdentity.
      */
-    function authenticateEmulatorToken(authHeader: string, credentials: ICredentialProvider, channelId: string): Promise<ClaimsIdentity>;
+    function authenticateEmulatorToken(authHeader: string, credentials: ICredentialProvider, channelService: string, channelId: string): Promise<ClaimsIdentity>;
 }

lib/auth/emulatorValidation.js

@@ -20,3 +20,5 @@ "use strict";
 const constants_1 = require("./constants");
+const governmentConstants_1 = require("./governmentConstants");
 const jwtTokenExtractor_1 = require("./jwtTokenExtractor");
+const jwtTokenValidation_1 = require("./jwtTokenValidation");
 /**
@@ -36,3 +38,5 @@ * Validates and Examines JWT tokens from the Bot Framework Emulator
             'https://login.microsoftonline.com/f8cdef31-a31e-4b4a-93e4-5f571e91255a/v2.0',
-            'https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/' // ???
+            'https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/',
+            'https://sts.windows.net/cab8a31a-1906-4287-a0d8-4eef66b95f6e/',
+            'https://login.microsoftonline.us/cab8a31a-1906-4287-a0d8-4eef66b95f6e/v2.0',
         ],
@@ -94,7 +98,11 @@ audience: undefined,
      * @param  {ICredentialProvider} credentials The user defined set of valid credentials, such as the AppId.
+     * @param  {string} channelService The channelService value that distinguishes public Azure from US Government Azure.
      * @returns {Promise<ClaimsIdentity>} A valid ClaimsIdentity.
      */
-    function authenticateEmulatorToken(authHeader, credentials, channelId) {
+    function authenticateEmulatorToken(authHeader, credentials, channelService, channelId) {
         return __awaiter(this, void 0, void 0, function* () {
-            const tokenExtractor = new jwtTokenExtractor_1.JwtTokenExtractor(EmulatorValidation.ToBotFromEmulatorTokenValidationParameters, constants_1.Constants.ToBotFromEmulatorOpenIdMetadataUrl, constants_1.Constants.AllowedSigningAlgorithms);
+            const openIdMetadataUrl = (channelService !== undefined && jwtTokenValidation_1.JwtTokenValidation.isGovernment(channelService)) ?
+                governmentConstants_1.GovernmentConstants.ToBotFromEmulatorOpenIdMetadataUrl :
+                constants_1.Constants.ToBotFromEmulatorOpenIdMetadataUrl;
+            const tokenExtractor = new jwtTokenExtractor_1.JwtTokenExtractor(EmulatorValidation.ToBotFromEmulatorTokenValidationParameters, openIdMetadataUrl, constants_1.Constants.AllowedSigningAlgorithms);
             const identity = yield tokenExtractor.getIdentityFromAuthHeader(authHeader, channelId);
@@ -101,0 +109,0 @@ if (!identity) {

lib/auth/governmentConstants.d.ts

@@ -29,2 +29,6 @@ /**
     const ToBotFromChannelOpenIdMetadataUrl: string;
+    /**
+     * TO BOT FROM GOV EMULATOR: OpenID metadata document for tokens coming from MSA
+     */
+    const ToBotFromEmulatorOpenIdMetadataUrl: string;
 }

lib/auth/governmentConstants.js

@@ -32,3 +32,7 @@ "use strict";
     GovernmentConstants.ToBotFromChannelOpenIdMetadataUrl = 'https://login.botframework.azure.us/v1/.well-known/openidconfiguration';
+    /**
+     * TO BOT FROM GOV EMULATOR: OpenID metadata document for tokens coming from MSA
+     */
+    GovernmentConstants.ToBotFromEmulatorOpenIdMetadataUrl = 'https://login.microsoftonline.us/cab8a31a-1906-4287-a0d8-4eef66b95f6e/v2.0/.well-known/openid-configuration';
 })(GovernmentConstants = exports.GovernmentConstants || (exports.GovernmentConstants = {}));
 //# sourceMappingURL=governmentConstants.js.map

lib/auth/jwtTokenValidation.js

@@ -49,3 +49,3 @@ "use strict";
             if (usingEmulator) {
-                return yield emulatorValidation_1.EmulatorValidation.authenticateEmulatorToken(authHeader, credentials, channelId);
+                return yield emulatorValidation_1.EmulatorValidation.authenticateEmulatorToken(authHeader, credentials, channelService, channelId);
             }
@@ -52,0 +52,0 @@ if (isPublicAzure(channelService)) {

lib/auth/microsoftAppCredentials.js

@@ -19,3 +19,2 @@ "use strict";
 const msrest = require("ms-rest-js");
-const request = require("request");
 const url = require("url");
@@ -92,3 +91,3 @@ const constants_1 = require("./constants");
                     // we have the token. Is it valid?
-                    if (oAuthToken.expiration_time > new Date(Date.now())) {
+                    if (oAuthToken.expiration_time > Date.now()) {
                         return oAuthToken.access_token;
@@ -102,45 +101,50 @@ }
             // 3. We don't have it in the cache.
-            const newOAuthToken = yield this.refreshToken();
-            MicrosoftAppCredentials.cache.set(this.tokenCacheKey, newOAuthToken);
-            return newOAuthToken.access_token;
+            const res = yield this.refreshToken();
+            this.refreshingToken = null;
+            let oauthResponse;
+            if (res.ok) {
+                // `res` is equalivent to the results from the cached promise `this.refreshingToken`.
+                // Because the promise has been cached, we need to see if the body has been read.
+                // If the body has not been read yet, we can call res.json() to get the access_token.
+                // If the body has been read, the OAuthResponse for that call should have been cached already,
+                // in which case we can return the cache from there. If a cached OAuthResponse does not exist,
+                // call getToken() again to retry the authentication process.
+                if (!res.bodyUsed) {
+                    oauthResponse = yield res.json();
+                    // Subtract 5 minutes from expires_in so they'll we'll get a
+                    // new token before it expires.
+                    oauthResponse.expiration_time = Date.now() + (oauthResponse.expires_in * 1000) - 300000;
+                    MicrosoftAppCredentials.cache.set(this.tokenCacheKey, oauthResponse);
+                    return oauthResponse.access_token;
+                }
+                else {
+                    const oAuthToken = MicrosoftAppCredentials.cache.get(this.tokenCacheKey);
+                    if (oAuthToken) {
+                        return oAuthToken.access_token;
+                    }
+                    else {
+                        return yield this.getToken();
+                    }
+                }
+            }
+            else {
+                throw new Error(res.statusText);
+            }
         });
     }
     refreshToken() {
-        if (!this.refreshingToken) {
-            this.refreshingToken = new Promise((resolve, reject) => {
-                // Refresh access token
-                const opt = {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.refreshingToken) {
+                const params = new FormData();
+                params.append('grant_type', 'client_credentials');
+                params.append('client_id', this.appId);
+                params.append('client_secret', this.appPassword);
+                params.append('scope', this.oAuthScope);
+                this.refreshingToken = fetch(this.oAuthEndpoint, {
                     method: 'POST',
-                    url: this.oAuthEndpoint,
-                    form: {
-                        grant_type: 'client_credentials',
-                        client_id: this.appId,
-                        client_secret: this.appPassword,
-                        scope: this.oAuthScope
-                    }
-                };
-                request(opt, (err, response, body) => {
-                    this.refreshingToken = null;
-                    if (!err) {
-                        if (body && response.statusCode && response.statusCode < 300) {
-                            // Subtract 5 minutes from expires_in so they'll we'll get a
-                            // new token before it expires.
-                            const oauthResponse = JSON.parse(body);
-                            oauthResponse.expiration_time = new Date(Date.now() + (oauthResponse.expires_in * 1000) - 300000);
-                            resolve(oauthResponse);
-                        }
-                        else {
-                            reject(new Error(`Refresh access token failed with status code: ${response.statusCode}`));
-                        }
-                    }
-                    else {
-                        reject(err);
-                    }
+                    body: params
                 });
-            }).catch((err) => {
-                this.refreshingToken = null;
-                throw err;
-            });
-        }
-        return this.refreshingToken;
+            }
+            return this.refreshingToken;
+        });
     }
@@ -147,0 +151,0 @@ shouldSetToken(webResource) {

lib/auth/openIdMetadata.js

 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : new P(function (resolve) { resolve(result.value); }).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -10,3 +18,2 @@ /**
  */
-const request = require("request");
 // tslint:disable-next-line:no-var-requires no-require-imports
@@ -22,16 +29,16 @@ const getPem = require('rsa-pem-from-mod-exp');
     getKey(keyId) {
-        return new Promise((resolve, reject) => {
+        return __awaiter(this, void 0, void 0, function* () {
             // If keys are more than 5 days old, refresh them
-            const now = new Date().getTime();
-            if (this.lastUpdated < (now - 1000 * 60 * 60 * 24 * 5)) {
-                this.refreshCache((err) => {
-                    if (err) {
-                        //logger.error('Error retrieving OpenId metadata at ' + this.url + ', error: ' + err.toString());
-                        // fall through and return cached key on error
-                        reject(err);
-                    }
+            if (this.lastUpdated < (Date.now() - 1000 * 60 * 60 * 24 * 5)) {
+                try {
+                    yield this.refreshCache();
                     // Search the cache even if we failed to refresh
                     const key = this.findKey(keyId);
-                    resolve(key);
-                });
+                    return key;
+                }
+                catch (err) {
+                    //logger.error('Error retrieving OpenId metadata at ' + this.url + ', error: ' + err.toString());
+                    // fall through and return cached key on error
+                    throw err;
+                }
             }
@@ -41,36 +48,22 @@ else {
                 const key = this.findKey(keyId);
-                resolve(key);
+                return key;
             }
         });
     }
-    refreshCache(cb) {
-        const options = {
-            method: 'GET',
-            url: this.url,
-            json: true
-        };
-        request(options, (err, response, body) => {
-            if (!err && (response.statusCode && response.statusCode >= 400 || !body)) {
-                err = new Error(`Failed to load openID config: ${response.statusCode}`);
+    refreshCache() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = yield fetch(this.url);
+            if (res.ok) {
+                const openIdConfig = yield res.json();
+                const getKeyResponse = yield fetch(openIdConfig.jwks_uri);
+                if (getKeyResponse.ok) {
+                    this.lastUpdated = new Date().getTime();
+                    this.keys = (yield getKeyResponse.json()).keys;
+                }
+                else {
+                    throw new Error(`Failed to load Keys: ${getKeyResponse.status}`);
+                }
             }
-            if (err) {
-                cb(err);
-            }
             else {
-                const openIdConfig = body;
-                const get_key_options = {
-                    method: 'GET',
-                    url: openIdConfig.jwks_uri,
-                    json: true
-                };
-                request(get_key_options, (get_key_error, get_key_response, get_key_body) => {
-                    if (!get_key_error && (get_key_response.statusCode && get_key_response.statusCode >= 400 || !get_key_body)) {
-                        get_key_error = new Error(`Failed to load Keys: ${get_key_response.statusCode}`);
-                    }
-                    if (!get_key_error) {
-                        this.lastUpdated = new Date().getTime();
-                        this.keys = get_key_body.keys;
-                    }
-                    cb(get_key_error);
-                });
+                throw new Error(`Failed to load openID config: ${res.status}`);
             }
@@ -77,0 +70,0 @@ });

lib/emulatorApiClient.d.ts

@@ -0,1 +1,8 @@
+/**
+ * @module botbuilder
+ */
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
 import { MicrosoftAppCredentials } from "./auth/microsoftAppCredentials";
@@ -2,0 +9,0 @@ export declare class EmulatorApiClient {

lib/emulatorApiClient.js

@@ -11,3 +11,2 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const request = require("request");
 class EmulatorApiClient {
@@ -17,20 +16,15 @@ static emulateOAuthCards(credentials, emulatorUrl, emulate) {
             let token = yield credentials.getToken();
-            return new Promise((resolve, reject) => {
-                let requestUrl = emulatorUrl + (emulatorUrl.endsWith('/') ? '' : '/') + `api/usertoken/emulateOAuthCards?emulate=${(!!emulate).toString()}`;
-                const opt = {
-                    method: 'POST',
-                    url: requestUrl,
-                    auth: {
-                        bearer: token
-                    }
-                };
-                request(opt, (err, response, body) => {
-                    if (response.statusCode && response.statusCode < 300) {
-                        resolve(true);
-                    }
-                    else {
-                        reject(new Error(`EmulateOAuthCards failed with status code: ${response.statusCode}`));
-                    }
-                });
+            let requestUrl = emulatorUrl + (emulatorUrl.endsWith('/') ? '' : '/') + `api/usertoken/emulateOAuthCards?emulate=${(!!emulate).toString()}`;
+            const res = yield fetch(requestUrl, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${token}`
+                }
             });
+            if (res.ok) {
+                return true;
+            }
+            else {
+                throw new Error(`EmulateOAuthCards failed with status code: ${res.status}`);
+            }
         });
@@ -37,0 +31,0 @@ }

lib/index.js

@@ -6,2 +6,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+(new Function('require', 'const env = (global || window); if (!env.hasOwnProperty("FormData")) { env.FormData = require("form-data"); }; if (!env.hasOwnProperty("fetch")) { env.fetch = require("node-fetch"); }'))(require);
 /**
@@ -8,0 +9,0 @@ * @module botbuilder

package.json

@@ -5,3 +5,3 @@ {
   "description": "Bot Connector is autorest generated connector client.",
-  "version": "4.1.7",
+  "version": "4.2.0",
   "license": "MIT",
@@ -25,9 +25,10 @@ "keywords": [
     "@types/node": "^9.3.0",
-    "@types/request": "^2.47.0",
     "base64url": "^3.0.0",
-    "botframework-schema": "^4.1.7",
+    "botframework-schema": "^4.2.0",
+    "form-data": "^2.3.3",
     "jsonwebtoken": "8.0.1",
     "ms-rest-azure-js": "1.0.176",
     "ms-rest-js": "1.0.455",
-    "request": "^2.87.0",
+    "nock": "^10.0.3",
+    "node-fetch": "^2.2.1",
     "rsa-pem-from-mod-exp": "^0.8.4"
@@ -34,0 +35,0 @@ },

src/auth/channelValidation.ts

@@ -87,3 +87,3 @@ /**
     ): Promise<ClaimsIdentity> {
-        if (!identity.isAuthenticated) {
+        if (!identity || !identity.isAuthenticated) {
             // The token is in some way invalid. Not Authorized.
@@ -90,0 +90,0 @@ throw new Error('Unauthorized. Is not authenticated');

src/auth/emulatorValidation.ts

@@ -11,4 +11,6 @@ /**
 import { Constants } from './constants';
+import { GovernmentConstants } from './governmentConstants';
 import { ICredentialProvider } from './credentialProvider';
 import { JwtTokenExtractor } from './jwtTokenExtractor';
+import { JwtTokenValidation } from './jwtTokenValidation';
 
@@ -29,3 +31,5 @@ /**
             'https://login.microsoftonline.com/f8cdef31-a31e-4b4a-93e4-5f571e91255a/v2.0',      // Auth v3.2, 2.0 token
-            'https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/'                     // ???
+            'https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/',                    // ???
+            'https://sts.windows.net/cab8a31a-1906-4287-a0d8-4eef66b95f6e/',                    // US Gov Auth, 1.0 token
+            'https://login.microsoftonline.us/cab8a31a-1906-4287-a0d8-4eef66b95f6e/v2.0',       // US Gov Auth, 2.0 token
         ],
@@ -95,2 +99,3 @@ audience: undefined, // Audience validation takes place manually in code.
      * @param  {ICredentialProvider} credentials The user defined set of valid credentials, such as the AppId.
+     * @param  {string} channelService The channelService value that distinguishes public Azure from US Government Azure.
      * @returns {Promise<ClaimsIdentity>} A valid ClaimsIdentity.
@@ -101,8 +106,12 @@ */
         credentials: ICredentialProvider,
+        channelService: string,
         channelId: string
     ): Promise<ClaimsIdentity> {
+        const openIdMetadataUrl = (channelService !== undefined && JwtTokenValidation.isGovernment(channelService)) ?
+            GovernmentConstants.ToBotFromEmulatorOpenIdMetadataUrl :
+            Constants.ToBotFromEmulatorOpenIdMetadataUrl;
 
         const tokenExtractor: JwtTokenExtractor = new JwtTokenExtractor(
             ToBotFromEmulatorTokenValidationParameters,
-            Constants.ToBotFromEmulatorOpenIdMetadataUrl,
+            openIdMetadataUrl,
             Constants.AllowedSigningAlgorithms);
@@ -109,0 +118,0 @@

src/auth/governmentConstants.ts

@@ -33,2 +33,8 @@ /**
     export const ToBotFromChannelOpenIdMetadataUrl: string = 'https://login.botframework.azure.us/v1/.well-known/openidconfiguration';
+    
+    /**
+     * TO BOT FROM GOV EMULATOR: OpenID metadata document for tokens coming from MSA
+     */
+    export const ToBotFromEmulatorOpenIdMetadataUrl: string =
+        'https://login.microsoftonline.us/cab8a31a-1906-4287-a0d8-4eef66b95f6e/v2.0/.well-known/openid-configuration';
 }

src/auth/jwtTokenValidation.ts

@@ -63,3 +63,3 @@ /**
         if (usingEmulator) {
-            return await EmulatorValidation.authenticateEmulatorToken(authHeader, credentials, channelId);
+            return await EmulatorValidation.authenticateEmulatorToken(authHeader, credentials, channelService, channelId);
         }
@@ -66,0 +66,0 @@

src/auth/microsoftAppCredentials.ts

@@ -9,3 +9,2 @@ /**
 import * as msrest from 'ms-rest-js';
-import * as request from 'request';
 import * as url from 'url';
@@ -36,3 +35,3 @@ import { Constants } from './constants';
     public readonly tokenCacheKey: string;
-    private refreshingToken: Promise<OAuthResponse> | null = null;
+    private refreshingToken: Promise<Response> | null = null;
 
@@ -107,3 +106,3 @@ constructor(appId: string, appPassword: string) {
                 // we have the token. Is it valid?
-                if (oAuthToken.expiration_time > new Date(Date.now())) {
+                if (oAuthToken.expiration_time > Date.now()) {
                     return oAuthToken.access_token;
@@ -118,45 +117,47 @@ }
         // 3. We don't have it in the cache.
-        const newOAuthToken: OAuthResponse = await this.refreshToken();
-        MicrosoftAppCredentials.cache.set(this.tokenCacheKey, newOAuthToken);
+        const res: Response = await this.refreshToken();
+        this.refreshingToken = null;
 
-        return newOAuthToken.access_token;
+        let oauthResponse: OAuthResponse;
+        if (res.ok) {          
+            // `res` is equalivent to the results from the cached promise `this.refreshingToken`.
+            // Because the promise has been cached, we need to see if the body has been read.
+            // If the body has not been read yet, we can call res.json() to get the access_token.
+            // If the body has been read, the OAuthResponse for that call should have been cached already,
+            // in which case we can return the cache from there. If a cached OAuthResponse does not exist,
+            // call getToken() again to retry the authentication process.
+            if (!res.bodyUsed){
+                oauthResponse = await res.json();
+                // Subtract 5 minutes from expires_in so they'll we'll get a
+                // new token before it expires.
+                oauthResponse.expiration_time = Date.now() + (oauthResponse.expires_in * 1000) - 300000;
+                MicrosoftAppCredentials.cache.set(this.tokenCacheKey, oauthResponse);
+                return oauthResponse.access_token;
+            } else {
+                const oAuthToken: OAuthResponse = MicrosoftAppCredentials.cache.get(this.tokenCacheKey);
+                if (oAuthToken) {
+                    return oAuthToken.access_token;
+                } else {
+                    return await this.getToken();
+                }
+            }
+        } else {
+            throw new Error(res.statusText);
+        }
+
     }
 
-    private refreshToken(): Promise<OAuthResponse> {
+    private async refreshToken(): Promise<Response> {
         if (!this.refreshingToken) {
-            this.refreshingToken = new Promise<OAuthResponse>((resolve: any, reject: any): void => {
-                // Refresh access token
-                const opt: request.Options = {
-                    method: 'POST',
-                    url: this.oAuthEndpoint,
-                    form: {
-                        grant_type: 'client_credentials',
-                        client_id: this.appId,
-                        client_secret: this.appPassword,
-                        scope: this.oAuthScope
-                    }
-                };
+            const params = new FormData();
+            params.append('grant_type', 'client_credentials');
+            params.append('client_id', this.appId);
+            params.append('client_secret', this.appPassword);
+            params.append('scope', this.oAuthScope);
 
-                request(opt, (err: any, response: any, body: any) => {
-                    this.refreshingToken = null;
-                    if (!err) {
-                        if (body && response.statusCode && response.statusCode < 300) {
-                            // Subtract 5 minutes from expires_in so they'll we'll get a
-                            // new token before it expires.
-                            const oauthResponse: OAuthResponse = <OAuthResponse>JSON.parse(body);
-                            oauthResponse.expiration_time = new Date(Date.now() + (oauthResponse.expires_in * 1000) - 300000);
-                            resolve(oauthResponse);
-                        } else {
-                            reject(new Error(`Refresh access token failed with status code: ${ response.statusCode }`));
-                        }
-                    } else {
-                        reject(err);
-                    }
-                });
-            }).catch((err: Error) => {
-                this.refreshingToken = null;
-                throw err;
+            this.refreshingToken = fetch(this.oAuthEndpoint, {
+                method: 'POST',
+                body: params
             });
         }
-
         return this.refreshingToken;
@@ -177,3 +178,3 @@ }
     access_token: string;
-    expiration_time: Date;
+    expiration_time: number;
 }

src/auth/openIdMetadata.ts

@@ -8,3 +8,2 @@ /**
  */
-import * as request from 'request';
 // tslint:disable-next-line:no-var-requires no-require-imports
@@ -24,63 +23,40 @@ const getPem: any = require('rsa-pem-from-mod-exp');
 
-    public getKey(keyId: string): Promise<IOpenIdMetadataKey | null> {
-        return new Promise((resolve: any, reject: any): void => {
-            // If keys are more than 5 days old, refresh them
-            const now: number = new Date().getTime();
-            if (this.lastUpdated < (now - 1000 * 60 * 60 * 24 * 5)) {
-                this.refreshCache((err: any): void => {
-                    if (err) {
-                        //logger.error('Error retrieving OpenId metadata at ' + this.url + ', error: ' + err.toString());
-                        // fall through and return cached key on error
-                        reject(err);
-                    }
-
-                    // Search the cache even if we failed to refresh
-                    const key: IOpenIdMetadataKey = this.findKey(keyId);
-                    resolve(key);
-                });
-            } else {
-                // Otherwise read from cache
+    public async getKey(keyId: string): Promise<IOpenIdMetadataKey | null> {
+        // If keys are more than 5 days old, refresh them
+        if (this.lastUpdated < (Date.now() - 1000 * 60 * 60 * 24 * 5)) {
+            try {
+                await this.refreshCache();
+                
+                // Search the cache even if we failed to refresh
                 const key: IOpenIdMetadataKey = this.findKey(keyId);
-                resolve(key);
+                return key;
+            } catch (err) {
+                //logger.error('Error retrieving OpenId metadata at ' + this.url + ', error: ' + err.toString());
+                // fall through and return cached key on error
+                throw err;
             }
-        });
+        } else {
+            // Otherwise read from cache
+            const key: IOpenIdMetadataKey = this.findKey(keyId);
+            return key
+        }
     }
 
-    private refreshCache(cb: (err: Error) => void): void {
-        const options: request.Options = {
-            method: 'GET',
-            url: this.url,
-            json: true
-        };
+    private async refreshCache(): Promise<void> {
+        const res = await fetch(this.url);
 
-        request(options, (err: any, response: any, body: any) => {
-            if (!err && (response.statusCode && response.statusCode >= 400 || !body)) {
-                err = new Error(`Failed to load openID config: ${ response.statusCode }`);
-            }
+        if (res.ok) {
+            const openIdConfig = await res.json() as IOpenIdConfig;
 
-            if (err) {
-                cb(err);
+            const getKeyResponse = await fetch(openIdConfig.jwks_uri);
+            if (getKeyResponse.ok) {
+                this.lastUpdated = new Date().getTime();
+                this.keys = (await getKeyResponse.json()).keys as IKey[];
             } else {
-                const openIdConfig: IOpenIdConfig = <IOpenIdConfig>body;
+                throw new Error(`Failed to load Keys: ${ getKeyResponse.status }`);
+            }
 
-                const get_key_options: request.Options = {
-                    method: 'GET',
-                    url: openIdConfig.jwks_uri,
-                    json: true
-                };
-
-                request(get_key_options, (get_key_error: Error, get_key_response: any, get_key_body: any) => {
-                    if (!get_key_error && (get_key_response.statusCode && get_key_response.statusCode >= 400 || !get_key_body)) {
-                        get_key_error = new Error(`Failed to load Keys: ${ get_key_response.statusCode }`);
-                    }
-
-                    if (!get_key_error) {
-                        this.lastUpdated = new Date().getTime();
-                        this.keys = <IKey[]>get_key_body.keys;
-                    }
-
-                    cb(get_key_error);
-                });
-            }
-        });
+        } else {
+            throw new Error(`Failed to load openID config: ${ res.status }`);
+        }
     }
@@ -87,0 +63,0 @@

src/emulatorApiClient.ts

@@ -0,3 +1,9 @@
+/**
+ * @module botbuilder
+ */
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
 import { MicrosoftAppCredentials } from "./auth/microsoftAppCredentials";
-import * as request from 'request';
 
@@ -7,23 +13,18 @@ export class EmulatorApiClient {
         let token = await credentials.getToken();
-        return new Promise<boolean>((resolve: any, reject: any): void => {
-            let requestUrl: string = emulatorUrl + (emulatorUrl.endsWith('/') ? '' : '/') + `api/usertoken/emulateOAuthCards?emulate=${(!!emulate).toString()}`;
+        let requestUrl: string = emulatorUrl + (emulatorUrl.endsWith('/') ? '' : '/') + `api/usertoken/emulateOAuthCards?emulate=${(!!emulate).toString()}`;
 
-            const opt: request.Options = {
-                method: 'POST',
-                url: requestUrl,
-                auth: {
-                    bearer: token
-                }
-            };
+        const res = await fetch(requestUrl, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
 
-            request(opt, (err: any, response: any, body: any) => {
-               if (response.statusCode && response.statusCode < 300) {
-                    resolve(true);
-                } else {
-                    reject(new Error(`EmulateOAuthCards failed with status code: ${ response.statusCode }`));
-                }
-            });
-        });
+        if (res.ok) {
+            return true;
+        } else {
+            throw new Error(`EmulateOAuthCards failed with status code: ${ res.status }`)
+        }
     }
 }
 

src/index.ts

@@ -0,1 +1,3 @@
+(new Function('require', 'const env = (global || window); if (!env.hasOwnProperty("FormData")) { env.FormData = require("form-data"); }; if (!env.hasOwnProperty("fetch")) { env.fetch = require("node-fetch"); }'))(require);
+
 import { TokenResponse } from './connectorApi/models/mappers';
@@ -2,0 +4,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

493466

increased by0.29%

Lines of code

12351

increased by0.1%

Worsened metrics

Dependency count

11

increased by10%

Number of medium supply chain risk alerts

5

increased byInfinity%

Dependency changes

• + Addedform-data@^2.3.3

• + Addednock@^10.0.3

• + Addednode-fetch@^2.2.1

• + Addedassertion-error@1.1.0(transitive)

• + Addedcall-bind@1.0.7(transitive)

• + Addedchai@4.5.0(transitive)

• + Addedcheck-error@1.0.3(transitive)

• + Addeddebug@4.3.7(transitive)

• + Addeddeep-eql@4.1.4(transitive)

• + Addeddeep-equal@1.1.2(transitive)

• + Addeddefine-data-property@1.1.4(transitive)

• + Addeddefine-properties@1.2.1(transitive)

• + Addedes-define-property@1.0.0(transitive)

• + Addedes-errors@1.3.0(transitive)

• + Addedfunction-bind@1.1.2(transitive)

• + Addedfunctions-have-names@1.2.3(transitive)

• + Addedget-func-name@2.0.2(transitive)

• + Addedget-intrinsic@1.2.4(transitive)

• + Addedgopd@1.0.1(transitive)

• + Addedhas-property-descriptors@1.0.2(transitive)

• + Addedhas-proto@1.0.3(transitive)

• + Addedhas-symbols@1.0.3(transitive)

• + Addedhas-tostringtag@1.0.2(transitive)

• + Addedhasown@2.0.2(transitive)

• + Addedis-arguments@1.1.1(transitive)

• + Addedis-date-object@1.0.5(transitive)

• + Addedis-regex@1.1.4(transitive)

• + Addedlodash@4.17.21(transitive)

• + Addedloupe@2.3.7(transitive)

• + Addedminimist@1.2.8(transitive)

• + Addedmkdirp@0.5.6(transitive)

• + Addednock@10.0.6(transitive)

• + Addednode-fetch@2.7.0(transitive)

• + Addedobject-inspect@1.13.2(transitive)

• + Addedobject-is@1.1.6(transitive)

• + Addedobject-keys@1.1.1(transitive)

• + Addedpathval@1.1.1(transitive)

• + Addedpropagate@1.0.0(transitive)

• + Addedqs@6.13.0(transitive)

• + Addedregexp.prototype.flags@1.5.2(transitive)

• + Addedsemver@5.7.2(transitive)

• + Addedset-function-length@1.2.2(transitive)

• + Addedset-function-name@2.0.2(transitive)

• + Addedside-channel@1.0.6(transitive)

• + Addedtr46@0.0.3(transitive)

• + Addedtype-detect@4.1.0(transitive)

• + Addedwebidl-conversions@3.0.1(transitive)

• + Addedwhatwg-url@5.0.0(transitive)

• - Removed@types/request@^2.47.0

• - Removedrequest@^2.87.0

• - Removed@types/caseless@0.12.5(transitive)

• - Removed@types/request@2.48.12(transitive)

• - Removed@types/tough-cookie@4.0.5(transitive)

• - Removedajv@6.12.6(transitive)

• - Removedasn1@0.2.6(transitive)

• - Removedassert-plus@1.0.0(transitive)

• - Removedaws-sign2@0.7.0(transitive)

• - Removedaws4@1.13.2(transitive)

• - Removedbcrypt-pbkdf@1.0.2(transitive)

• - Removedcaseless@0.12.0(transitive)

• - Removedcore-util-is@1.0.2(transitive)

• - Removeddashdash@1.14.1(transitive)

• - Removedecc-jsbn@0.1.2(transitive)

• - Removedextend@3.0.2(transitive)

• - Removedextsprintf@1.3.0(transitive)

• - Removedfast-deep-equal@3.1.3(transitive)

• - Removedfast-json-stable-stringify@2.1.0(transitive)

• - Removedforever-agent@0.6.1(transitive)

• - Removedform-data@2.3.3(transitive)

• - Removedgetpass@0.1.7(transitive)

• - Removedhar-schema@2.0.0(transitive)

• - Removedhar-validator@5.1.5(transitive)

• - Removedhttp-signature@1.2.0(transitive)

• - Removedis-typedarray@1.0.0(transitive)

• - Removedisstream@0.1.2(transitive)

• - Removedjsbn@0.1.1(transitive)

• - Removedjson-schema@0.4.0(transitive)

• - Removedjson-schema-traverse@0.4.1(transitive)

• - Removedjsprim@1.4.2(transitive)

• - Removedoauth-sign@0.9.0(transitive)

• - Removedperformance-now@2.1.0(transitive)

• - Removedqs@6.5.3(transitive)

• - Removedrequest@2.88.2(transitive)

• - Removedsafer-buffer@2.1.2(transitive)

• - Removedsshpk@1.18.0(transitive)

• - Removedtunnel-agent@0.6.0(transitive)

• - Removedtweetnacl@0.14.5(transitive)

• - Removeduri-js@4.4.1(transitive)

• - Removedverror@1.10.0(transitive)

• Updatedbotframework-schema@^4.2.0