@azure/identity/dist/commonjs/credentials/interactiveBrowserCredential.js

Provides credential implementations for Azure SDK libraries that can authenticate with Microsoft Entra ID

var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
var interactiveBrowserCredential_exports = {};
__export(interactiveBrowserCredential_exports, {
  InteractiveBrowserCredential: () => InteractiveBrowserCredential
});
module.exports = __toCommonJS(interactiveBrowserCredential_exports);
var import_tenantIdUtils = require("../util/tenantIdUtils.js");
var import_logging = require("../util/logging.js");
var import_scopeUtils = require("../util/scopeUtils.js");
var import_tracing = require("../util/tracing.js");
var import_msalClient = require("../msal/nodeFlows/msalClient.js");
var import_constants = require("../constants.js");
const logger = (0, import_logging.credentialLogger)("InteractiveBrowserCredential");
class InteractiveBrowserCredential {
  tenantId;
  additionallyAllowedTenantIds;
  msalClient;
  disableAutomaticAuthentication;
  browserCustomizationOptions;
  loginHint;
  /**
   * Creates an instance of InteractiveBrowserCredential with the details needed.
   *
   * This credential uses the [Authorization Code Flow](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow).
   * On Node.js, it will open a browser window while it listens for a redirect response from the authentication service.
   * On browsers, it authenticates via popups. The `loginStyle` optional parameter can be set to `redirect` to authenticate by redirecting the user to an Azure secure login page, which then will redirect the user back to the web application where the authentication started.
   *
   * For Node.js, if a `clientId` is provided, the Microsoft Entra application will need to be configured to have a "Mobile and desktop applications" redirect endpoint.
   * Follow our guide on [setting up Redirect URIs for Desktop apps that calls to web APIs](https://learn.microsoft.com/entra/identity-platform/scenario-desktop-app-registration#redirect-uris).
   *
   * @param options - Options for configuring the client which makes the authentication requests.
   */
  constructor(options) {
    this.tenantId = (0, import_tenantIdUtils.resolveTenantId)(logger, options.tenantId, options.clientId);
    this.additionallyAllowedTenantIds = (0, import_tenantIdUtils.resolveAdditionallyAllowedTenantIds)(
      options?.additionallyAllowedTenants
    );
    const msalClientOptions = {
      ...options,
      tokenCredentialOptions: options,
      logger
    };
    const ibcNodeOptions = options;
    this.browserCustomizationOptions = ibcNodeOptions.browserCustomizationOptions;
    this.loginHint = ibcNodeOptions.loginHint;
    if (ibcNodeOptions?.brokerOptions?.enabled) {
      if (!ibcNodeOptions?.brokerOptions?.parentWindowHandle) {
        throw new Error(
          "In order to do WAM authentication, `parentWindowHandle` under `brokerOptions` is a required parameter"
        );
      } else {
        msalClientOptions.brokerOptions = {
          enabled: true,
          parentWindowHandle: ibcNodeOptions.brokerOptions.parentWindowHandle,
          legacyEnableMsaPassthrough: ibcNodeOptions.brokerOptions?.legacyEnableMsaPassthrough,
          useDefaultBrokerAccount: ibcNodeOptions.brokerOptions?.useDefaultBrokerAccount
        };
      }
    }
    this.msalClient = (0, import_msalClient.createMsalClient)(
      options.clientId ?? import_constants.DeveloperSignOnClientId,
      this.tenantId,
      msalClientOptions
    );
    this.disableAutomaticAuthentication = options?.disableAutomaticAuthentication;
  }
  /**
   * Authenticates with Microsoft Entra ID and returns an access token if successful.
   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
   *
   * If the user provided the option `disableAutomaticAuthentication`,
   * once the token can't be retrieved silently,
   * this method won't attempt to request user interaction to retrieve the token.
   *
   * @param scopes - The list of scopes for which the token will have access.
   * @param options - The options used to configure any requests this
   *                TokenCredential implementation might make.
   */
  async getToken(scopes, options = {}) {
    return import_tracing.tracingClient.withSpan(
      `${this.constructor.name}.getToken`,
      options,
      async (newOptions) => {
        newOptions.tenantId = (0, import_tenantIdUtils.processMultiTenantRequest)(
          this.tenantId,
          newOptions,
          this.additionallyAllowedTenantIds,
          logger
        );
        const arrayScopes = (0, import_scopeUtils.ensureScopes)(scopes);
        return this.msalClient.getTokenByInteractiveRequest(arrayScopes, {
          ...newOptions,
          disableAutomaticAuthentication: this.disableAutomaticAuthentication,
          browserCustomizationOptions: this.browserCustomizationOptions,
          loginHint: this.loginHint
        });
      }
    );
  }
  /**
   * Authenticates with Microsoft Entra ID and returns an access token if successful.
   * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
   *
   * If the token can't be retrieved silently, this method will always generate a challenge for the user.
   *
   * On Node.js, this credential has [Proof Key for Code Exchange (PKCE)](https://datatracker.ietf.org/doc/html/rfc7636) enabled by default.
   * PKCE is a security feature that mitigates authentication code interception attacks.
   *
   * @param scopes - The list of scopes for which the token will have access.
   * @param options - The options used to configure any requests this
   *                  TokenCredential implementation might make.
   */
  async authenticate(scopes, options = {}) {
    return import_tracing.tracingClient.withSpan(
      `${this.constructor.name}.authenticate`,
      options,
      async (newOptions) => {
        const arrayScopes = (0, import_scopeUtils.ensureScopes)(scopes);
        await this.msalClient.getTokenByInteractiveRequest(arrayScopes, {
          ...newOptions,
          disableAutomaticAuthentication: false,
          // this method should always allow user interaction
          browserCustomizationOptions: this.browserCustomizationOptions,
          loginHint: this.loginHint
        });
        return this.msalClient.getActiveAccount();
      }
    );
  }
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  InteractiveBrowserCredential
});
//# sourceMappingURL=interactiveBrowserCredential.js.map