@redis/entraid/dist/lib/entra-id-credentials-provider-factory.d.ts

Secure token-based authentication for Redis clients using Microsoft Entra ID (formerly Azure Active Directory).

import type { GetTokenOptions, TokenCredential } from '@azure/core-auth';
import { AuthenticationResult, PublicClientApplication } from '@azure/msal-node';
import { RetryPolicy, TokenManagerConfig, ReAuthenticationError, BasicAuth } from '@redis/client/dist/lib/authx';
import { AuthenticationResponse, EntraidCredentialsProvider } from './entraid-credentials-provider';
/**
 * This class is used to create credentials providers for different types of authentication flows.
 */
export declare class EntraIdCredentialsProviderFactory {
    #private;
    /**
     * This method is used to create a ManagedIdentityProvider for both system-assigned and user-assigned managed identities.
     *
     * @param params
     * @param userAssignedClientId For user-assigned managed identities, the developer needs to pass either the client ID,
     * full resource identifier, or the object ID of the managed identity when creating ManagedIdentityApplication.
     *
     */
    static createManagedIdentityProvider(params: CredentialParams, userAssignedClientId?: string): EntraidCredentialsProvider;
    /**
     * This method is used to create a credentials provider for system-assigned managed identities.
     * @param params
     */
    static createForSystemAssignedManagedIdentity(params: CredentialParams): EntraidCredentialsProvider;
    /**
     * This method is used to create a credentials provider for user-assigned managed identities.
     * It will include the client ID as the userAssignedClientId in the ManagedIdentityConfiguration.
     * @param params
     */
    static createForUserAssignedManagedIdentity(params: CredentialParams & {
        userAssignedClientId: string;
    }): EntraidCredentialsProvider;
    /**
     * This method is used to create a credentials provider for service principals using certificate.
     * @param params
     */
    static createForClientCredentialsWithCertificate(params: ClientCredentialsWithCertificateParams): EntraidCredentialsProvider;
    /**
     * This method is used to create a credentials provider for service principals using client secret.
     * @param params
     */
    static createForClientCredentials(params: ClientSecretCredentialsParams): EntraidCredentialsProvider;
    /**
     * This method is used to create a credentials provider using DefaultAzureCredential.
     *
     * The user needs to create a configured instance of DefaultAzureCredential ( or any other class that implements TokenCredential )and pass it to this method.
     *
     * The default credentials mapper for this method is OID_CREDENTIALS_MAPPER which extracts the object ID from JWT
     * encoded token.
     *
     * Depending on the actual flow that DefaultAzureCredential uses, the user may need to provide different
     * credential mapper via the credentialsMapper parameter.
     *
     */
    static createForDefaultAzureCredential({ credential, scopes, options, tokenManagerConfig, onReAuthenticationError, credentialsMapper, onRetryableError }: DefaultAzureCredentialsParams): EntraidCredentialsProvider;
    /**
     * This method is used to create a credentials provider for the Authorization Code Flow with PKCE.
     * @param params
     */
    static createForAuthorizationCodeWithPKCE(params: AuthCodePKCEParams): {
        getPKCECodes: () => Promise<{
            verifier: string;
            challenge: string;
            challengeMethod: string;
        }>;
        getAuthCodeUrl: (pkceCodes: {
            challenge: string;
            challengeMethod: string;
        }) => Promise<string>;
        createCredentialsProvider: (params: PKCEParams) => EntraidCredentialsProvider;
    };
    static getAuthority(config: AuthorityConfig): string;
}
export declare const REDIS_SCOPE_DEFAULT = "https://redis.azure.com/.default";
export declare const REDIS_SCOPE = "https://redis.azure.com";
export type AuthorityConfig = {
    type: 'multi-tenant';
    tenantId: string;
} | {
    type: 'custom';
    authorityUrl: string;
} | {
    type: 'default';
};
export type PKCEParams = {
    code: string;
    verifier: string;
    clientInfo?: string;
};
export type CredentialParams = {
    clientId: string;
    scopes?: string[];
    authorityConfig?: AuthorityConfig;
    tokenManagerConfig: TokenManagerConfig;
    onReAuthenticationError?: (error: ReAuthenticationError) => void;
    credentialsMapper?: (token: AuthenticationResponse) => BasicAuth;
    onRetryableError?: (error: string) => void;
};
export type DefaultAzureCredentialsParams = {
    scopes: string | string[];
    options?: GetTokenOptions;
    credential: TokenCredential;
    tokenManagerConfig: TokenManagerConfig;
    onReAuthenticationError?: (error: ReAuthenticationError) => void;
    credentialsMapper?: (token: AuthenticationResponse) => BasicAuth;
    onRetryableError?: (error: string) => void;
};
export type AuthCodePKCEParams = CredentialParams & {
    redirectUri: string;
};
export type ClientSecretCredentialsParams = CredentialParams & {
    clientSecret: string;
};
export type ClientCredentialsWithCertificateParams = CredentialParams & {
    certificate: {
        thumbprint: string;
        privateKey: string;
        x5c?: string;
    };
};
/**
 * The most important part of the RetryPolicy is the `isRetryable` function. This function is used to determine if a request should be retried based
 * on the error returned from the identity provider. The default for is to retry on network errors only.
 */
export declare const DEFAULT_RETRY_POLICY: RetryPolicy;
export declare const DEFAULT_TOKEN_MANAGER_CONFIG: TokenManagerConfig;
/**
 * This class is used to help with the Authorization Code Flow with PKCE.
 * It provides methods to generate PKCE codes, get the authorization URL, and create the credential provider.
 */
export declare class AuthCodeFlowHelper {
    readonly client: PublicClientApplication;
    readonly scopes: string[];
    readonly redirectUri: string;
    private constructor();
    getAuthCodeUrl(pkceCodes: {
        challenge: string;
        challengeMethod: string;
    }): Promise<string>;
    acquireTokenByCode(params: PKCEParams): Promise<AuthenticationResult>;
    static generatePKCE(): Promise<{
        verifier: string;
        challenge: string;
        challengeMethod: string;
    }>;
    static create(params: {
        clientId: string;
        redirectUri: string;
        scopes?: string[];
        authorityConfig?: AuthorityConfig;
    }): AuthCodeFlowHelper;
}
//# sourceMappingURL=entra-id-credentials-provider-factory.d.ts.map