@microsoft/teams.apps/dist/middleware/auth/remote-function-validator.js

<p> <a href="https://www.npmjs.com/package/@microsoft/teams.apps" target="_blank"> <img src="https://img.shields.io/npm/v/@microsoft/teams.apps/latest" /> </a> <a href="https://www.npmjs.com/package/@microsoft/teams.apps?activeTab=code

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.RemoteFunctionValidator = void 0;
const jwt_validator_1 = require("./jwt-validator");
/**
 * Remote function validator for /api/functions/* requests
 * Wraps an Entra token validator and provides a simple check() method
 */
class RemoteFunctionValidator {
    entraTokenValidator;
    logger;
    constructor(entraTokenValidator, logger) {
        this.entraTokenValidator = entraTokenValidator;
        this.logger = logger;
    }
    /**
     * Create a remote function validator for Entra tokens
     */
    static create(tenantId, clientId, logger, options) {
        const jwtValidator = new jwt_validator_1.JwtValidator({
            clientId,
            tenantId,
            validateIssuer: {
                allowedTenantIds: options?.allowedTenantIds
            },
            validateScope: options?.requiredScope ? { requiredScope: options.requiredScope } : undefined,
            jwksUriOptions: {
                type: 'tenantId'
            }
        }, logger);
        return new RemoteFunctionValidator(jwtValidator, logger);
    }
    async check(headers) {
        const h = (key) => {
            const v = headers[key];
            return Array.isArray(v) ? v[0] : v;
        };
        const appSessionId = h('x-teams-app-session-id');
        const pageId = h('x-teams-page-id');
        const authorization = h('authorization')?.split(' ');
        const authToken = authorization?.length === 2 && authorization[0].toLowerCase() === 'bearer'
            ? authorization[1]
            : '';
        const tokenPayload = await this.entraTokenValidator.validateAccessToken(authToken);
        if (!pageId ||
            !appSessionId ||
            !authToken ||
            !tokenPayload) {
            this.logger.debug('unauthorized - missing required headers or invalid token');
            return null;
        }
        return {
            appId: tokenPayload?.['appId'],
            appSessionId,
            authToken,
            channelId: h('x-teams-channel-id'),
            chatId: h('x-teams-chat-id'),
            meetingId: h('x-teams-meeting-id'),
            messageId: h('x-teams-message-id'),
            pageId,
            subPageId: h('x-teams-sub-page-id'),
            teamId: h('x-teams-team-id'),
            tenantId: tokenPayload['tid'],
            userId: tokenPayload['oid'],
            userName: tokenPayload['name'],
        };
    }
}
exports.RemoteFunctionValidator = RemoteFunctionValidator;
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlLWZ1bmN0aW9uLXZhbGlkYXRvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9taWRkbGV3YXJlL2F1dGgvcmVtb3RlLWZ1bmN0aW9uLXZhbGlkYXRvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFJQSxtREFBK0M7QUFFL0M7OztHQUdHO0FBQ0gsTUFBYSx1QkFBdUI7SUFDMUIsbUJBQW1CLENBQTRDO0lBQy9ELE1BQU0sQ0FBVTtJQUV4QixZQUFZLG1CQUE4RCxFQUFFLE1BQWU7UUFDekYsSUFBSSxDQUFDLG1CQUFtQixHQUFHLG1CQUFtQixDQUFDO1FBQy9DLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO0lBQ3ZCLENBQUM7SUFFRDs7T0FFRztJQUNILE1BQU0sQ0FBQyxNQUFNLENBQ1gsUUFBZ0IsRUFDaEIsUUFBZ0IsRUFDaEIsTUFBZSxFQUNmLE9BR0M7UUFFRCxNQUFNLFlBQVksR0FBRyxJQUFJLDRCQUFZLENBQUM7WUFDcEMsUUFBUTtZQUNSLFFBQVE7WUFDUixjQUFjLEVBQUU7Z0JBQ2QsZ0JBQWdCLEVBQUUsT0FBTyxFQUFFLGdCQUFnQjthQUM1QztZQUNELGFBQWEsRUFBRSxPQUFPLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLGFBQWEsRUFBRSxPQUFPLENBQUMsYUFBYSxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVM7WUFDNUYsY0FBYyxFQUFFO2dCQUNkLElBQUksRUFBRSxVQUFVO2FBQ2pCO1NBQ0YsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUVYLE9BQU8sSUFBSSx1QkFBdUIsQ0FBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUVELEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBMEM7UUFDcEQsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFXLEVBQUUsRUFBRTtZQUN4QixNQUFNLENBQUMsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDdkIsT0FBTyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNyQyxDQUFDLENBQUM7UUFDRixNQUFNLFlBQVksR0FBRyxDQUFDLENBQUMsd0JBQXdCLENBQUMsQ0FBQztRQUNqRCxNQUFNLE1BQU0sR0FBRyxDQUFDLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNwQyxNQUFNLGFBQWEsR0FBRyxDQUFDLENBQUMsZUFBZSxDQUFDLEVBQUUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3JELE1BQU0sU0FBUyxHQUNiLGFBQWEsRUFBRSxNQUFNLEtBQUssQ0FBQyxJQUFJLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLEVBQUUsS0FBSyxRQUFRO1lBQ3hFLENBQUMsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1lBQ2xCLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFFVCxNQUFNLFlBQVksR0FBRyxNQUFNLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUVuRixJQUNFLENBQUMsTUFBTTtZQUNQLENBQUMsWUFBWTtZQUNiLENBQUMsU0FBUztZQUNWLENBQUMsWUFBWSxFQUNiLENBQUM7WUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1lBQzlFLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUVELE9BQU87WUFDTCxLQUFLLEVBQUUsWUFBWSxFQUFFLENBQUMsT0FBTyxDQUFDO1lBQzlCLFlBQVk7WUFDWixTQUFTO1lBQ1QsU0FBUyxFQUFFLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQztZQUNsQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLGlCQUFpQixDQUFDO1lBQzVCLFNBQVMsRUFBRSxDQUFDLENBQUMsb0JBQW9CLENBQUM7WUFDbEMsU0FBUyxFQUFFLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQztZQUNsQyxNQUFNO1lBQ04sU0FBUyxFQUFFLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQztZQUNuQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLGlCQUFpQixDQUFDO1lBQzVCLFFBQVEsRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDO1lBQzdCLE1BQU0sRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDO1lBQzNCLFFBQVEsRUFBRSxZQUFZLENBQUMsTUFBTSxDQUFDO1NBQy9CLENBQUM7SUFDSixDQUFDO0NBQ0Y7QUE3RUQsMERBNkVDIn0=