Estructura inicial del proyecto

backend/node_modules/@azure/identity/dist/esm/msal/browserFlows/msalBrowserCommon.d.ts

@@ -0,0 +1,19 @@
+import type { MsalBrowserFlowOptions } from "./msalBrowserOptions.js";
+import type { AccessToken } from "@azure/core-auth";
+import type { AuthenticationRecord } from "../types.js";
+import type { CredentialFlowGetTokenOptions } from "../credentials.js";
+/**
+ * Methods that are used by InteractiveBrowserCredential
+ * @internal
+ */
+export interface MsalBrowserClient {
+    getActiveAccount(): Promise<AuthenticationRecord | undefined>;
+    getToken(scopes: string[], options: CredentialFlowGetTokenOptions): Promise<AccessToken>;
+}
+/**
+ * Uses MSAL Browser 2.X for browser authentication,
+ * which uses the [Auth Code Flow](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow).
+ * @internal
+ */
+export declare function createMsalBrowserClient(options: MsalBrowserFlowOptions): MsalBrowserClient;
+//# sourceMappingURL=msalBrowserCommon.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/browserFlows/msalBrowserCommon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalBrowserCommon.d.ts","sourceRoot":"","sources":["../../../../src/msal/browserFlows/msalBrowserCommon.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAYtE,OAAO,KAAK,EAAE,WAAW,EAAmB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,aAAa,CAAC;AAEpE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AA8CvE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,IAAI,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1F;AAKD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CA4P1F"}

backend/node_modules/@azure/identity/dist/esm/msal/browserFlows/msalBrowserCommon.js

@@ -0,0 +1,261 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import { defaultLoggerCallback, ensureValidMsalToken, getAuthority, getKnownAuthorities, getMSALLogLevel, handleMsalError, msalToPublic, publicToMsal, } from "../utils.js";
+import { AuthenticationRequiredError, CredentialUnavailableError } from "../../errors.js";
+import { getLogLevel } from "@azure/logger";
+import { formatSuccess } from "../../util/logging.js";
+import { processMultiTenantRequest, resolveAdditionallyAllowedTenantIds, resolveTenantId, } from "../../util/tenantIdUtils.js";
+import { DefaultTenantId } from "../../constants.js";
+import { createStandardPublicClientApplication } from "@azure/msal-browser";
+// We keep a copy of the redirect hash.
+// Check if self and location object is defined.
+const isLocationDefined = typeof self !== "undefined" && self.location !== undefined;
+/**
+ * Generates a MSAL configuration that generally works for browsers
+ */
+function generateMsalBrowserConfiguration(options) {
+    const tenantId = options.tenantId || DefaultTenantId;
+    const authority = getAuthority(tenantId, options.authorityHost);
+    return {
+        auth: {
+            clientId: options.clientId,
+            authority,
+            knownAuthorities: getKnownAuthorities(tenantId, authority, options.disableInstanceDiscovery),
+            // If the users picked redirect as their login style,
+            // but they didn't provide a redirectUri,
+            // we can try to use the current page we're in as a default value.
+            redirectUri: options.redirectUri || (isLocationDefined ? self.location.origin : undefined),
+        },
+        cache: {
+            cacheLocation: "sessionStorage",
+        },
+        system: {
+            loggerOptions: {
+                loggerCallback: defaultLoggerCallback(options.logger, "Browser"),
+                logLevel: getMSALLogLevel(getLogLevel()),
+                piiLoggingEnabled: options.loggingOptions?.enableUnsafeSupportLogging,
+            },
+        },
+    };
+}
+// We keep a copy of the redirect hash.
+const redirectHash = isLocationDefined ? self.location.hash : undefined;
+/**
+ * Uses MSAL Browser 2.X for browser authentication,
+ * which uses the [Auth Code Flow](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow).
+ * @internal
+ */
+export function createMsalBrowserClient(options) {
+    const loginStyle = options.loginStyle;
+    if (!options.clientId) {
+        throw new CredentialUnavailableError("A client ID is required in browsers");
+    }
+    const clientId = options.clientId;
+    const logger = options.logger;
+    const tenantId = resolveTenantId(logger, options.tenantId, options.clientId);
+    const additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(options?.tokenCredentialOptions?.additionallyAllowedTenants);
+    const authorityHost = options.authorityHost;
+    const msalConfig = generateMsalBrowserConfiguration(options);
+    const disableAutomaticAuthentication = options.disableAutomaticAuthentication;
+    const loginHint = options.loginHint;
+    let account;
+    if (options.authenticationRecord) {
+        account = {
+            ...options.authenticationRecord,
+            tenantId,
+        };
+    }
+    // This variable should only be used through calling `getApp` function
+    let app;
+    /**
+     * Return the MSAL account if not set yet
+     * @returns MSAL application
+     */
+    async function getApp() {
+        if (!app) {
+            // Prepare the MSAL application
+            app = await createStandardPublicClientApplication(msalConfig);
+            // setting the account right after the app is created.
+            if (account) {
+                app.setActiveAccount(publicToMsal(account));
+            }
+        }
+        return app;
+    }
+    /**
+     * Loads the account based on the result of the authentication.
+     * If no result was received, tries to load the account from the cache.
+     * @param result - Result object received from MSAL.
+     */
+    async function handleBrowserResult(result) {
+        try {
+            const msalApp = await getApp();
+            if (result && result.account) {
+                logger.info(`MSAL Browser V2 authentication successful.`);
+                msalApp.setActiveAccount(result.account);
+                return msalToPublic(clientId, result.account);
+            }
+        }
+        catch (e) {
+            logger.info(`Failed to acquire token through MSAL. ${e.message}`);
+        }
+        return;
+    }
+    /**
+     * Handles the MSAL authentication result.
+     * If the result has an account, we update the local account reference.
+     * If the token received is invalid, an error will be thrown depending on what's missing.
+     */
+    function handleResult(scopes, result, getTokenOptions) {
+        if (result?.account) {
+            account = msalToPublic(clientId, result.account);
+        }
+        ensureValidMsalToken(scopes, result, getTokenOptions);
+        logger.getToken.info(formatSuccess(scopes));
+        return {
+            token: result.accessToken,
+            expiresOnTimestamp: result.expiresOn.getTime(),
+            refreshAfterTimestamp: result.refreshOn?.getTime(),
+            tokenType: "Bearer",
+        };
+    }
+    /**
+     * Uses MSAL to handle the redirect.
+     */
+    async function handleRedirect() {
+        const msalApp = await getApp();
+        return handleBrowserResult((await msalApp.handleRedirectPromise(redirectHash ? { hash: redirectHash } : undefined)) ||
+            undefined);
+    }
+    /**
+     * Uses MSAL to retrieve the active account.
+     */
+    async function getActiveAccount() {
+        const msalApp = await getApp();
+        const activeAccount = msalApp.getActiveAccount();
+        if (!activeAccount) {
+            return;
+        }
+        return msalToPublic(clientId, activeAccount);
+    }
+    /**
+     * Uses MSAL to trigger a redirect or a popup login.
+     */
+    async function login(scopes = []) {
+        const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
+        const loginRequest = {
+            scopes: arrayScopes,
+            loginHint: loginHint,
+        };
+        const msalApp = await getApp();
+        switch (loginStyle) {
+            case "redirect": {
+                await app.loginRedirect(loginRequest);
+                return;
+            }
+            case "popup":
+                return handleBrowserResult(await msalApp.loginPopup(loginRequest));
+        }
+    }
+    /**
+     * Tries to retrieve the token silently using MSAL.
+     */
+    async function getTokenSilent(scopes, getTokenOptions) {
+        const activeAccount = await getActiveAccount();
+        if (!activeAccount) {
+            throw new AuthenticationRequiredError({
+                scopes,
+                getTokenOptions,
+                message: "Silent authentication failed. We couldn't retrieve an active account from the cache.",
+            });
+        }
+        const parameters = {
+            authority: getTokenOptions?.authority || msalConfig.auth.authority,
+            correlationId: getTokenOptions?.correlationId,
+            claims: getTokenOptions?.claims,
+            account: publicToMsal(activeAccount),
+            forceRefresh: false,
+            scopes,
+        };
+        try {
+            logger.info("Attempting to acquire token silently");
+            const msalApp = await getApp();
+            const response = await msalApp.acquireTokenSilent(parameters);
+            return handleResult(scopes, response);
+        }
+        catch (err) {
+            throw handleMsalError(scopes, err, options);
+        }
+    }
+    /**
+     * Attempts to retrieve the token in the browser through interactive methods.
+     */
+    async function getTokenInteractive(scopes, getTokenOptions) {
+        const activeAccount = await getActiveAccount();
+        if (!activeAccount) {
+            throw new AuthenticationRequiredError({
+                scopes,
+                getTokenOptions,
+                message: "Silent authentication failed. We couldn't retrieve an active account from the cache.",
+            });
+        }
+        const parameters = {
+            authority: getTokenOptions?.authority || msalConfig.auth.authority,
+            correlationId: getTokenOptions?.correlationId,
+            claims: getTokenOptions?.claims,
+            account: publicToMsal(activeAccount),
+            loginHint: loginHint,
+            scopes,
+        };
+        const msalApp = await getApp();
+        switch (loginStyle) {
+            case "redirect":
+                // This will go out of the page.
+                // Once the InteractiveBrowserCredential is initialized again,
+                // we'll load the MSAL account in the constructor.
+                await msalApp.acquireTokenRedirect(parameters);
+                return { token: "", expiresOnTimestamp: 0, tokenType: "Bearer" };
+            case "popup":
+                return handleResult(scopes, await app.acquireTokenPopup(parameters));
+        }
+    }
+    /**
+     * Attempts to get token through the silent flow.
+     * If failed, get token through interactive method with `doGetToken` method.
+     */
+    async function getToken(scopes, getTokenOptions = {}) {
+        const getTokenTenantId = processMultiTenantRequest(tenantId, getTokenOptions, additionallyAllowedTenantIds) ||
+            tenantId;
+        if (!getTokenOptions.authority) {
+            getTokenOptions.authority = getAuthority(getTokenTenantId, authorityHost);
+        }
+        // We ensure that redirection is handled at this point.
+        await handleRedirect();
+        if (!(await getActiveAccount()) && !disableAutomaticAuthentication) {
+            await login(scopes);
+        }
+        // Attempts to get the token silently; else, falls back to interactive method.
+        try {
+            return await getTokenSilent(scopes, getTokenOptions);
+        }
+        catch (err) {
+            if (err.name !== "AuthenticationRequiredError") {
+                throw err;
+            }
+            if (getTokenOptions?.disableAutomaticAuthentication) {
+                throw new AuthenticationRequiredError({
+                    scopes,
+                    getTokenOptions,
+                    message: "Automatic authentication has been disabled. You may call the authenticate() method.",
+                });
+            }
+            logger.info(`Silent authentication failed, falling back to interactive method ${loginStyle}`);
+            return getTokenInteractive(scopes, getTokenOptions);
+        }
+    }
+    return {
+        getActiveAccount,
+        getToken,
+    };
+}
+//# sourceMappingURL=msalBrowserCommon.js.map

backend/node_modules/@azure/identity/dist/esm/msal/browserFlows/msalBrowserOptions.d.ts

@@ -0,0 +1,87 @@
+import type { AuthenticationRecord } from "../types.js";
+import type { BrowserLoginStyle } from "../../credentials/interactiveBrowserCredentialOptions.js";
+import type { LogPolicyOptions } from "@azure/core-rest-pipeline";
+import type { MultiTenantTokenCredentialOptions } from "../../credentials/multiTenantTokenCredentialOptions.js";
+import type { CredentialLogger } from "../../util/logging.js";
+/**
+ * Options for the MSAL browser flows.
+ * @internal
+ */
+export interface MsalBrowserFlowOptions {
+    logger: CredentialLogger;
+    /**
+     * The Client ID of the Microsoft Entra application that users will sign into.
+     * This parameter is required on the browser.
+     */
+    clientId?: string;
+    /**
+     * The Microsoft Entra tenant (directory) ID.
+     */
+    tenantId?: string;
+    /**
+     * The authority host to use for authentication requests.
+     * Possible values are available through {@link AzureAuthorityHosts}.
+     * The default is "https://login.microsoftonline.com".
+     */
+    authorityHost?: string;
+    /**
+     * Result of a previous authentication that can be used to retrieve the cached credentials of each individual account.
+     * This is necessary to provide in case the application wants to work with more than one account per
+     * Client ID and Tenant ID pair.
+     *
+     * This record can be retrieved by calling to the credential's `authenticate()` method, as follows:
+     *
+     *     const authenticationRecord = await credential.authenticate();
+     *
+     */
+    authenticationRecord?: AuthenticationRecord;
+    /**
+     * Makes getToken throw if a manual authentication is necessary.
+     * Developers will need to call to `authenticate()` to control when to manually authenticate.
+     */
+    disableAutomaticAuthentication?: boolean;
+    /**
+     * The field determines whether instance discovery is performed when attempting to authenticate.
+     * Setting this to `true` will completely disable both instance discovery and authority validation.
+     * As a result, it's crucial to ensure that the configured authority host is valid and trustworthy.
+     * This functionality is intended for use in scenarios where the metadata endpoint cannot be reached, such as in private clouds or Azure Stack.
+     * The process of instance discovery entails retrieving authority metadata from https://login.microsoft.com/ to validate the authority.
+     */
+    disableInstanceDiscovery?: boolean;
+    /**
+     * Options for multi-tenant applications which allows for additionally allowed tenants.
+     */
+    tokenCredentialOptions: MultiTenantTokenCredentialOptions;
+    /**
+     * Gets the redirect URI of the application. This should be same as the value
+     * in the application registration portal.  Defaults to `window.location.href`.
+     * This field is no longer required for Node.js.
+     */
+    redirectUri?: string;
+    /**
+     * Specifies whether a redirect or a popup window should be used to
+     * initiate the user authentication flow. Possible values are "redirect"
+     * or "popup" (default) for browser and "popup" (default) for node.
+     *
+     */
+    loginStyle: BrowserLoginStyle;
+    /**
+     * loginHint allows a user name to be pre-selected for interactive logins.
+     * Setting this option skips the account selection prompt and immediately attempts to login with the specified account.
+     */
+    loginHint?: string;
+    /**
+     * Allows users to configure settings for logging policy options, allow logging account information and personally identifiable information for customer support.
+     */
+    loggingOptions?: LogPolicyOptions & {
+        /**
+         * Allows logging account information once the authentication flow succeeds.
+         */
+        allowLoggingAccountIdentifiers?: boolean;
+        /**
+         * Allows logging personally identifiable information for customer support.
+         */
+        enableUnsafeSupportLogging?: boolean;
+    };
+}
+//# sourceMappingURL=msalBrowserOptions.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/browserFlows/msalBrowserOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalBrowserOptions.d.ts","sourceRoot":"","sources":["../../../../src/msal/browserFlows/msalBrowserOptions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,wDAAwD,CAAC;AAChH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,gBAAgB,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAE5C;;;OAGG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAEzC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;OAEG;IACH,sBAAsB,EAAE,iCAAiC,CAAC;IAE1D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,UAAU,EAAE,iBAAiB,CAAC;IAE9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,cAAc,CAAC,EAAE,gBAAgB,GAAG;QAClC;;WAEG;QACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;QACzC;;WAEG;QACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;KACtC,CAAC;CACH"}

backend/node_modules/@azure/identity/dist/esm/msal/browserFlows/msalBrowserOptions.js

@@ -0,0 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+export {};
+//# sourceMappingURL=msalBrowserOptions.js.map

backend/node_modules/@azure/identity/dist/esm/msal/browserFlows/msalBrowserOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalBrowserOptions.js","sourceRoot":"","sources":["../../../../src/msal/browserFlows/msalBrowserOptions.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AuthenticationRecord } from \"../types.js\";\nimport type { BrowserLoginStyle } from \"../../credentials/interactiveBrowserCredentialOptions.js\";\nimport type { LogPolicyOptions } from \"@azure/core-rest-pipeline\";\nimport type { MultiTenantTokenCredentialOptions } from \"../../credentials/multiTenantTokenCredentialOptions.js\";\nimport type { CredentialLogger } from \"../../util/logging.js\";\n\n/**\n * Options for the MSAL browser flows.\n * @internal\n */\nexport interface MsalBrowserFlowOptions {\n  logger: CredentialLogger;\n\n  /**\n   * The Client ID of the Microsoft Entra application that users will sign into.\n   * This parameter is required on the browser.\n   */\n  clientId?: string;\n\n  /**\n   * The Microsoft Entra tenant (directory) ID.\n   */\n  tenantId?: string;\n\n  /**\n   * The authority host to use for authentication requests.\n   * Possible values are available through {@link AzureAuthorityHosts}.\n   * The default is \"https://login.microsoftonline.com\".\n   */\n  authorityHost?: string;\n\n  /**\n   * Result of a previous authentication that can be used to retrieve the cached credentials of each individual account.\n   * This is necessary to provide in case the application wants to work with more than one account per\n   * Client ID and Tenant ID pair.\n   *\n   * This record can be retrieved by calling to the credential's `authenticate()` method, as follows:\n   *\n   *     const authenticationRecord = await credential.authenticate();\n   *\n   */\n  authenticationRecord?: AuthenticationRecord;\n\n  /**\n   * Makes getToken throw if a manual authentication is necessary.\n   * Developers will need to call to `authenticate()` to control when to manually authenticate.\n   */\n  disableAutomaticAuthentication?: boolean;\n\n  /**\n   * The field determines whether instance discovery is performed when attempting to authenticate.\n   * Setting this to `true` will completely disable both instance discovery and authority validation.\n   * As a result, it's crucial to ensure that the configured authority host is valid and trustworthy.\n   * This functionality is intended for use in scenarios where the metadata endpoint cannot be reached, such as in private clouds or Azure Stack.\n   * The process of instance discovery entails retrieving authority metadata from https://login.microsoft.com/ to validate the authority.\n   */\n  disableInstanceDiscovery?: boolean;\n\n  /**\n   * Options for multi-tenant applications which allows for additionally allowed tenants.\n   */\n  tokenCredentialOptions: MultiTenantTokenCredentialOptions;\n\n  /**\n   * Gets the redirect URI of the application. This should be same as the value\n   * in the application registration portal.  Defaults to `window.location.href`.\n   * This field is no longer required for Node.js.\n   */\n  redirectUri?: string;\n\n  /**\n   * Specifies whether a redirect or a popup window should be used to\n   * initiate the user authentication flow. Possible values are \"redirect\"\n   * or \"popup\" (default) for browser and \"popup\" (default) for node.\n   *\n   */\n  loginStyle: BrowserLoginStyle;\n\n  /**\n   * loginHint allows a user name to be pre-selected for interactive logins.\n   * Setting this option skips the account selection prompt and immediately attempts to login with the specified account.\n   */\n  loginHint?: string;\n\n  /**\n   * Allows users to configure settings for logging policy options, allow logging account information and personally identifiable information for customer support.\n   */\n  loggingOptions?: LogPolicyOptions & {\n    /**\n     * Allows logging account information once the authentication flow succeeds.\n     */\n    allowLoggingAccountIdentifiers?: boolean;\n    /**\n     * Allows logging personally identifiable information for customer support.\n     */\n    enableUnsafeSupportLogging?: boolean;\n  };\n}\n"]}

backend/node_modules/@azure/identity/dist/esm/msal/credentials.d.ts

@@ -0,0 +1,52 @@
+import type { AccessToken, GetTokenOptions } from "@azure/core-auth";
+import type { AuthenticationRecord } from "./types.js";
+/**
+ * The MSAL clients `getToken` requests can receive a `correlationId` and `disableAutomaticAuthentication`.
+ * (which is used to prevent `getToken` from triggering the manual authentication if `getTokenSilent`  fails).
+ * @internal
+ */
+export interface CredentialFlowGetTokenOptions extends GetTokenOptions {
+    /**
+     * Unique identifier useful to track outgoing requests.
+     */
+    correlationId?: string;
+    /**
+     * Makes getToken throw if a manual authentication is necessary.
+     */
+    disableAutomaticAuthentication?: boolean;
+    /**
+     * Authority, to overwrite the default one, if necessary.
+     */
+    authority?: string;
+    /**
+     * Claims received from challenges.
+     */
+    claims?: string;
+    /**
+     * Indicates to allow Continuous Access Evaluation or not
+     */
+    enableCae?: boolean;
+    /**
+     * Client Assertion
+     */
+    getAssertion?: () => Promise<string>;
+}
+/**
+ * Simplified representation of the internal authentication flow.
+ * @internal
+ */
+export interface CredentialFlow {
+    /**
+     * Clears the MSAL cache.
+     */
+    logout(): Promise<void>;
+    /**
+     * Tries to load the active account, either from memory or from MSAL.
+     */
+    getActiveAccount(): Promise<AuthenticationRecord | undefined>;
+    /**
+     * Calls to the implementation's doGetToken method.
+     */
+    getToken(scopes?: string[], options?: CredentialFlowGetTokenOptions): Promise<AccessToken | null>;
+}
+//# sourceMappingURL=credentials.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/msal/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,6BAA8B,SAAQ,eAAe;IACpE;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;OAEG;IACH,gBAAgB,IAAI,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC9D;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACnG"}

backend/node_modules/@azure/identity/dist/esm/msal/credentials.js

@@ -0,0 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+export {};
+//# sourceMappingURL=credentials.js.map

backend/node_modules/@azure/identity/dist/esm/msal/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/msal/credentials.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport type { AuthenticationRecord } from \"./types.js\";\n\n/**\n * The MSAL clients `getToken` requests can receive a `correlationId` and `disableAutomaticAuthentication`.\n * (which is used to prevent `getToken` from triggering the manual authentication if `getTokenSilent`  fails).\n * @internal\n */\nexport interface CredentialFlowGetTokenOptions extends GetTokenOptions {\n  /**\n   * Unique identifier useful to track outgoing requests.\n   */\n  correlationId?: string;\n  /**\n   * Makes getToken throw if a manual authentication is necessary.\n   */\n  disableAutomaticAuthentication?: boolean;\n  /**\n   * Authority, to overwrite the default one, if necessary.\n   */\n  authority?: string;\n  /**\n   * Claims received from challenges.\n   */\n  claims?: string;\n  /**\n   * Indicates to allow Continuous Access Evaluation or not\n   */\n  enableCae?: boolean;\n  /**\n   * Client Assertion\n   */\n  getAssertion?: () => Promise<string>;\n}\n\n/**\n * Simplified representation of the internal authentication flow.\n * @internal\n */\nexport interface CredentialFlow {\n  /**\n   * Clears the MSAL cache.\n   */\n  logout(): Promise<void>;\n  /**\n   * Tries to load the active account, either from memory or from MSAL.\n   */\n  getActiveAccount(): Promise<AuthenticationRecord | undefined>;\n  /**\n   * Calls to the implementation's doGetToken method.\n   */\n  getToken(scopes?: string[], options?: CredentialFlowGetTokenOptions): Promise<AccessToken | null>;\n}\n"]}

backend/node_modules/@azure/identity/dist/esm/msal/msal.d.ts

@@ -0,0 +1,3 @@
+import * as msalCommon from "@azure/msal-node";
+export { msalCommon };
+//# sourceMappingURL=msal.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/msal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal.d.ts","sourceRoot":"","sources":["../../../src/msal/msal.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,CAAC"}

backend/node_modules/@azure/identity/dist/esm/msal/msal.js

@@ -0,0 +1,5 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import * as msalCommon from "@azure/msal-node";
+export { msalCommon };
+//# sourceMappingURL=msal.js.map

backend/node_modules/@azure/identity/dist/esm/msal/msal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal.js","sourceRoot":"","sources":["../../../src/msal/msal.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,CAAC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport * as msalCommon from \"@azure/msal-node\";\n\nexport { msalCommon };\n"]}

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/brokerOptions.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Parameters that enable WAM broker authentication in the InteractiveBrowserCredential.
+ */
+export type BrokerOptions = BrokerEnabledOptions | BrokerDisabledOptions;
+/**
+ * Parameters when WAM broker authentication is disabled.
+ */
+export interface BrokerDisabledOptions {
+    /**
+     * If set to true, broker will be enabled for WAM support on Windows.
+     */
+    enabled: false;
+    /**
+     * If set to true, MSA account will be passed through, required for WAM authentication.
+     */
+    legacyEnableMsaPassthrough?: undefined;
+    /**
+     * Window handle for parent window, required for WAM authentication.
+     */
+    parentWindowHandle: undefined;
+}
+/**
+ * Parameters when WAM broker authentication is enabled.
+ */
+export interface BrokerEnabledOptions {
+    /**
+     * If set to true, broker will be enabled for WAM support on Windows.
+     */
+    enabled: true;
+    /**
+     * If set to true, MSA account will be passed through, required for WAM authentication.
+     */
+    legacyEnableMsaPassthrough?: boolean;
+    /**
+     * Window handle for parent window, required for WAM authentication.
+     */
+    parentWindowHandle: Uint8Array;
+    /**
+     * If set to true, the credential will attempt to use the default broker account for authentication before falling back to interactive authentication.
+     * Default is set to false.
+     */
+    useDefaultBrokerAccount?: boolean;
+}
+//# sourceMappingURL=brokerOptions.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/brokerOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brokerOptions.d.ts","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/brokerOptions.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,KAAK,CAAC;IAEf;;OAEG;IACH,0BAA0B,CAAC,EAAE,SAAS,CAAC;IACvC;;OAEG;IACH,kBAAkB,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,IAAI,CAAC;IACd;;OAEG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;OAEG;IACH,kBAAkB,EAAE,UAAU,CAAC;IAE/B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC"}

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/brokerOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=brokerOptions.js.map

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/brokerOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brokerOptions.js","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/brokerOptions.ts"],"names":[],"mappings":"","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n/**\n * Parameters that enable WAM broker authentication in the InteractiveBrowserCredential.\n */\nexport type BrokerOptions = BrokerEnabledOptions | BrokerDisabledOptions;\n\n/**\n * Parameters when WAM broker authentication is disabled.\n */\nexport interface BrokerDisabledOptions {\n  /**\n   * If set to true, broker will be enabled for WAM support on Windows.\n   */\n  enabled: false;\n\n  /**\n   * If set to true, MSA account will be passed through, required for WAM authentication.\n   */\n  legacyEnableMsaPassthrough?: undefined;\n  /**\n   * Window handle for parent window, required for WAM authentication.\n   */\n  parentWindowHandle: undefined;\n}\n\n/**\n * Parameters when WAM broker authentication is enabled.\n */\nexport interface BrokerEnabledOptions {\n  /**\n   * If set to true, broker will be enabled for WAM support on Windows.\n   */\n  enabled: true;\n  /**\n   * If set to true, MSA account will be passed through, required for WAM authentication.\n   */\n  legacyEnableMsaPassthrough?: boolean;\n  /**\n   * Window handle for parent window, required for WAM authentication.\n   */\n  parentWindowHandle: Uint8Array;\n\n  /**\n   * If set to true, the credential will attempt to use the default broker account for authentication before falling back to interactive authentication.\n   * Default is set to false.\n   */\n  useDefaultBrokerAccount?: boolean;\n}\n"]}

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/msalClient.d.ts

@@ -0,0 +1,199 @@
+import * as msal from "@azure/msal-node";
+import type { AccessToken, GetTokenOptions } from "@azure/core-auth";
+import type { AuthenticationRecord, CertificateParts } from "../types.js";
+import type { CredentialLogger } from "../../util/logging.js";
+import type { BrokerOptions } from "./brokerOptions.js";
+import type { DeviceCodePromptCallback } from "../../credentials/deviceCodeCredentialOptions.js";
+import { IdentityClient } from "../../client/identityClient.js";
+import type { InteractiveBrowserCredentialNodeOptions } from "../../credentials/interactiveBrowserCredentialOptions.js";
+import type { TokenCachePersistenceOptions } from "./tokenCachePersistenceOptions.js";
+/**
+ * Represents the options for acquiring a token using flows that support silent authentication.
+ */
+export interface GetTokenWithSilentAuthOptions extends GetTokenOptions {
+    /**
+     * Disables automatic authentication. If set to true, the method will throw an error if the user needs to authenticate.
+     *
+     * @remarks
+     *
+     * This option will be set to `false` when the user calls `authenticate` directly on a credential that supports it.
+     */
+    disableAutomaticAuthentication?: boolean;
+}
+/**
+ * Represents the options for acquiring a token interactively.
+ */
+export interface GetTokenInteractiveOptions extends GetTokenWithSilentAuthOptions {
+    /**
+     * Window handle for parent window, required for WAM authentication.
+     */
+    parentWindowHandle?: Buffer;
+    /**
+     * Shared configuration options for browser customization
+     */
+    browserCustomizationOptions?: InteractiveBrowserCredentialNodeOptions["browserCustomizationOptions"];
+    /**
+     * loginHint allows a user name to be pre-selected for interactive logins.
+     * Setting this option skips the account selection prompt and immediately attempts to login with the specified account.
+     */
+    loginHint?: string;
+}
+/**
+ * Represents a client for interacting with the Microsoft Authentication Library (MSAL).
+ */
+export interface MsalClient {
+    /**
+     *
+     * Retrieves an access token by using the on-behalf-of flow and a client assertion callback of the calling service.
+     *
+     * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.
+     * @param userAssertionToken - The access token that was sent to the middle-tier API. This token must have an audience of the app making this OBO request.
+     * @param clientCredentials - The client secret OR client certificate OR client `getAssertion` callback.
+     * @param options - Additional options that may be provided to the method.
+     * @returns An access token.
+     */
+    getTokenOnBehalfOf(scopes: string[], userAssertionToken: string, clientCredentials: string | CertificateParts | (() => Promise<string>), options?: GetTokenOptions): Promise<AccessToken>;
+    /**
+     * Retrieves an access token by using an interactive prompt (InteractiveBrowserCredential).
+     * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.
+     * @param options - Additional options that may be provided to the method.
+     * @returns An access token.
+     */
+    getTokenByInteractiveRequest(scopes: string[], options: GetTokenInteractiveOptions): Promise<AccessToken>;
+    /**
+     * Retrieves an access token by using a user's username and password.
+     *
+     * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.
+     * @param username - The username provided by the developer.
+     * @param password - The user's password provided by the developer.
+     * @param options - Additional options that may be provided to the method.
+     * @returns An access token.
+     */
+    getTokenByUsernamePassword(scopes: string[], username: string, password: string, options?: GetTokenOptions): Promise<AccessToken>;
+    /**
+     * Retrieves an access token by prompting the user to authenticate using a device code.
+     *
+     * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.
+     * @param userPromptCallback - The callback function that allows developers to customize the prompt message.
+     * @param options - Additional options that may be provided to the method.
+     * @returns An access token.
+     */
+    getTokenByDeviceCode(scopes: string[], userPromptCallback: DeviceCodePromptCallback, options?: GetTokenWithSilentAuthOptions): Promise<AccessToken>;
+    /**
+     * Retrieves an access token by using a client certificate.
+     *
+     * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.
+     * @param certificate - The client certificate used for authentication.
+     * @param options - Additional options that may be provided to the method.
+     * @returns An access token.
+     */
+    getTokenByClientCertificate(scopes: string[], certificate: CertificateParts, options?: GetTokenOptions): Promise<AccessToken>;
+    /**
+     * Retrieves an access token by using a client assertion.
+     *
+     * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.
+     * @param clientAssertion - The client `getAssertion` callback used for authentication.
+     * @param options - Additional options that may be provided to the method.
+     * @returns An access token.
+     */
+    getTokenByClientAssertion(scopes: string[], clientAssertion: () => Promise<string>, options?: GetTokenOptions): Promise<AccessToken>;
+    /**
+     * Retrieves an access token by using a client secret.
+     *
+     * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.
+     * @param clientSecret - The client secret of the application. This is a credential that the application can use to authenticate itself.
+     * @param options - Additional options that may be provided to the method.
+     * @returns An access token.
+     */
+    getTokenByClientSecret(scopes: string[], clientSecret: string, options?: GetTokenOptions): Promise<AccessToken>;
+    /**
+     * Retrieves an access token by using an authorization code flow.
+     *
+     * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.
+     * @param authorizationCode - An authorization code that was received from following the
+                                authorization code flow.  This authorization code must not
+                                have already been used to obtain an access token.
+     * @param redirectUri - The redirect URI that was used to request the authorization code.
+                          Must be the same URI that is configured for the App Registration.
+     * @param clientSecret - An optional client secret that was generated for the App Registration.
+     * @param options - Additional options that may be provided to the method.
+     */
+    getTokenByAuthorizationCode(scopes: string[], redirectUri: string, authorizationCode: string, clientSecret?: string, options?: GetTokenWithSilentAuthOptions): Promise<AccessToken>;
+    /**
+     * Retrieves the last authenticated account. This method expects an authentication record to have been previously loaded.
+     *
+     * An authentication record could be loaded by calling the `getToken` method, or by providing an `authenticationRecord` when creating a credential.
+     */
+    getActiveAccount(): AuthenticationRecord | undefined;
+    /**
+     * Retrieves an access token using brokered authentication.
+     *
+     * @param scopes - The scopes for which the access token is requested. These represent the resources that the application wants to access.
+     * @param useDefaultBrokerAccount - Whether to use the default broker account for authentication.
+     * @param options - Additional options that may be provided to the method.
+     * @returns An access token.
+     */
+    getBrokeredToken(scopes: string[], useDefaultBrokerAccount: boolean, options?: GetTokenInteractiveOptions): Promise<AccessToken>;
+}
+/**
+ * Represents the options for configuring the MsalClient.
+ */
+export interface MsalClientOptions {
+    /**
+     * Parameters that enable WAM broker authentication in the InteractiveBrowserCredential.
+     */
+    brokerOptions?: BrokerOptions;
+    /**
+     * Parameters that enable token cache persistence in the Identity credentials.
+     */
+    tokenCachePersistenceOptions?: TokenCachePersistenceOptions;
+    /**
+     * Indicates if this is being used by VSCode credential.
+     */
+    isVSCodeCredential?: boolean;
+    /**
+     * A custom authority host.
+     */
+    authorityHost?: IdentityClient["tokenCredentialOptions"]["authorityHost"];
+    /**
+     * Allows users to configure settings for logging policy options, allow logging account information and personally identifiable information for customer support.
+     */
+    loggingOptions?: IdentityClient["tokenCredentialOptions"]["loggingOptions"];
+    /**
+     * The token credential options for the MsalClient.
+     */
+    tokenCredentialOptions?: IdentityClient["tokenCredentialOptions"];
+    /**
+     * Determines whether instance discovery is disabled.
+     */
+    disableInstanceDiscovery?: boolean;
+    /**
+     * The logger for the MsalClient.
+     */
+    logger?: CredentialLogger;
+    /**
+     * The authentication record for the MsalClient.
+     */
+    authenticationRecord?: AuthenticationRecord;
+}
+/**
+ * Generates the configuration for MSAL (Microsoft Authentication Library).
+ *
+ * @param clientId - The client ID of the application.
+ * @param  tenantId - The tenant ID of the Azure Active Directory.
+ * @param  msalClientOptions - Optional. Additional options for creating the MSAL client.
+ * @returns  The MSAL configuration object.
+ */
+export declare function generateMsalConfiguration(clientId: string, tenantId: string, msalClientOptions?: MsalClientOptions): msal.Configuration;
+/**
+ * Creates an instance of the MSAL (Microsoft Authentication Library) client.
+ *
+ * @param clientId - The client ID of the application.
+ * @param tenantId - The tenant ID of the Azure Active Directory.
+ * @param createMsalClientOptions - Optional. Additional options for creating the MSAL client.
+ * @returns An instance of the MSAL client.
+ *
+ * @public
+ */
+export declare function createMsalClient(clientId: string, tenantId: string, createMsalClientOptions?: MsalClientOptions): MsalClient;
+//# sourceMappingURL=msalClient.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/msalClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalClient.d.ts","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/msalClient.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AAEzC,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAiB9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,0DAA0D,CAAC;AACxH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAUtF;;GAEG;AACH,MAAM,WAAW,6BAA8B,SAAQ,eAAe;IACpE;;;;;;OAMG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,0BAA2B,SAAQ,6BAA6B;IAC/E;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,2BAA2B,CAAC,EAAE,uCAAuC,CAAC,6BAA6B,CAAC,CAAC;IACrG;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;OASG;IACH,kBAAkB,CAChB,MAAM,EAAE,MAAM,EAAE,EAChB,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,EAAE,MAAM,GAAG,gBAAgB,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,EACtE,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;;;OAKG;IACH,4BAA4B,CAC1B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB;;;;;;;;OAQG;IACH,0BAA0B,CACxB,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB;;;;;;;OAOG;IACH,oBAAoB,CAClB,MAAM,EAAE,MAAM,EAAE,EAChB,kBAAkB,EAAE,wBAAwB,EAC5C,OAAO,CAAC,EAAE,6BAA6B,GACtC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB;;;;;;;OAOG;IACH,2BAA2B,CACzB,MAAM,EAAE,MAAM,EAAE,EAChB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;;;;;OAOG;IACH,yBAAyB,CACvB,MAAM,EAAE,MAAM,EAAE,EAChB,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;;;;;OAOG;IACH,sBAAsB,CACpB,MAAM,EAAE,MAAM,EAAE,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;;;;;;;;;OAWG;IACH,2BAA2B,CACzB,MAAM,EAAE,MAAM,EAAE,EAChB,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,6BAA6B,GACtC,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;;OAIG;IACH,gBAAgB,IAAI,oBAAoB,GAAG,SAAS,CAAC;IAErD;;;;;;;OAOG;IACH,gBAAgB,CACd,MAAM,EAAE,MAAM,EAAE,EAChB,uBAAuB,EAAE,OAAO,EAChC,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,WAAW,CAAC,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;OAEG;IACH,4BAA4B,CAAC,EAAE,4BAA4B,CAAC;IAE5D;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC,wBAAwB,CAAC,CAAC,eAAe,CAAC,CAAC;IAE1E;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC,wBAAwB,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAE5E;;OAEG;IACH,sBAAsB,CAAC,EAAE,cAAc,CAAC,wBAAwB,CAAC,CAAC;IAElE;;OAEG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;OAEG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAE1B;;OAEG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,iBAAiB,GAAE,iBAAsB,GACxC,IAAI,CAAC,aAAa,CAoCpB;AAuBD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,uBAAuB,GAAE,iBAAsB,GAC9C,UAAU,CA0jBZ"}

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/msalClient.js

@@ -0,0 +1,499 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import * as msal from "@azure/msal-node";
+import { credentialLogger, formatSuccess } from "../../util/logging.js";
+import { msalPlugins } from "./msalPlugins.js";
+import { defaultLoggerCallback, ensureValidMsalToken, getAuthority, getAuthorityHost, getKnownAuthorities, getMSALLogLevel, handleMsalError, msalToPublic, publicToMsal, } from "../utils.js";
+import { AuthenticationRequiredError } from "../../errors.js";
+import { IdentityClient } from "../../client/identityClient.js";
+import { calculateRegionalAuthority } from "../../regionalAuthority.js";
+import { getLogLevel } from "@azure/logger";
+import { resolveTenantId } from "../../util/tenantIdUtils.js";
+/**
+ * The default logger used if no logger was passed in by the credential.
+ */
+const msalLogger = credentialLogger("MsalClient");
+/**
+ * Generates the configuration for MSAL (Microsoft Authentication Library).
+ *
+ * @param clientId - The client ID of the application.
+ * @param  tenantId - The tenant ID of the Azure Active Directory.
+ * @param  msalClientOptions - Optional. Additional options for creating the MSAL client.
+ * @returns  The MSAL configuration object.
+ */
+export function generateMsalConfiguration(clientId, tenantId, msalClientOptions = {}) {
+    const resolvedTenant = resolveTenantId(msalClientOptions.logger ?? msalLogger, tenantId, clientId);
+    // TODO: move and reuse getIdentityClientAuthorityHost
+    const authority = getAuthority(resolvedTenant, getAuthorityHost(msalClientOptions));
+    const httpClient = new IdentityClient({
+        ...msalClientOptions.tokenCredentialOptions,
+        authorityHost: authority,
+        loggingOptions: msalClientOptions.loggingOptions,
+    });
+    const msalConfig = {
+        auth: {
+            clientId,
+            authority,
+            knownAuthorities: getKnownAuthorities(resolvedTenant, authority, msalClientOptions.disableInstanceDiscovery),
+        },
+        system: {
+            networkClient: httpClient,
+            loggerOptions: {
+                loggerCallback: defaultLoggerCallback(msalClientOptions.logger ?? msalLogger),
+                logLevel: getMSALLogLevel(getLogLevel()),
+                piiLoggingEnabled: msalClientOptions.loggingOptions?.enableUnsafeSupportLogging,
+            },
+        },
+    };
+    return msalConfig;
+}
+/**
+ * Creates an instance of the MSAL (Microsoft Authentication Library) client.
+ *
+ * @param clientId - The client ID of the application.
+ * @param tenantId - The tenant ID of the Azure Active Directory.
+ * @param createMsalClientOptions - Optional. Additional options for creating the MSAL client.
+ * @returns An instance of the MSAL client.
+ *
+ * @public
+ */
+export function createMsalClient(clientId, tenantId, createMsalClientOptions = {}) {
+    const state = {
+        msalConfig: generateMsalConfiguration(clientId, tenantId, createMsalClientOptions),
+        cachedAccount: createMsalClientOptions.authenticationRecord
+            ? publicToMsal(createMsalClientOptions.authenticationRecord)
+            : null,
+        pluginConfiguration: msalPlugins.generatePluginConfiguration(createMsalClientOptions),
+        logger: createMsalClientOptions.logger ?? msalLogger,
+    };
+    const publicApps = new Map();
+    async function getPublicApp(options = {}) {
+        const appKey = options.enableCae ? "CAE" : "default";
+        let publicClientApp = publicApps.get(appKey);
+        if (publicClientApp) {
+            state.logger.getToken.info("Existing PublicClientApplication found in cache, returning it.");
+            return publicClientApp;
+        }
+        // Initialize a new app and cache it
+        state.logger.getToken.info(`Creating new PublicClientApplication with CAE ${options.enableCae ? "enabled" : "disabled"}.`);
+        const cachePlugin = options.enableCae
+            ? state.pluginConfiguration.cache.cachePluginCae
+            : state.pluginConfiguration.cache.cachePlugin;
+        state.msalConfig.auth.clientCapabilities = options.enableCae ? ["cp1"] : undefined;
+        publicClientApp = new msal.PublicClientApplication({
+            ...state.msalConfig,
+            broker: { nativeBrokerPlugin: state.pluginConfiguration.broker.nativeBrokerPlugin },
+            cache: { cachePlugin: await cachePlugin },
+        });
+        publicApps.set(appKey, publicClientApp);
+        return publicClientApp;
+    }
+    const confidentialApps = new Map();
+    async function getConfidentialApp(options = {}) {
+        const appKey = options.enableCae ? "CAE" : "default";
+        let confidentialClientApp = confidentialApps.get(appKey);
+        if (confidentialClientApp) {
+            state.logger.getToken.info("Existing ConfidentialClientApplication found in cache, returning it.");
+            return confidentialClientApp;
+        }
+        // Initialize a new app and cache it
+        state.logger.getToken.info(`Creating new ConfidentialClientApplication with CAE ${options.enableCae ? "enabled" : "disabled"}.`);
+        const cachePlugin = options.enableCae
+            ? state.pluginConfiguration.cache.cachePluginCae
+            : state.pluginConfiguration.cache.cachePlugin;
+        state.msalConfig.auth.clientCapabilities = options.enableCae ? ["cp1"] : undefined;
+        confidentialClientApp = new msal.ConfidentialClientApplication({
+            ...state.msalConfig,
+            broker: { nativeBrokerPlugin: state.pluginConfiguration.broker.nativeBrokerPlugin },
+            cache: { cachePlugin: await cachePlugin },
+        });
+        confidentialApps.set(appKey, confidentialClientApp);
+        return confidentialClientApp;
+    }
+    async function getTokenSilent(app, scopes, options = {}) {
+        if (state.cachedAccount === null) {
+            state.logger.getToken.info("No cached account found in local state.");
+            throw new AuthenticationRequiredError({ scopes });
+        }
+        // Keep track and reuse the claims we received across challenges
+        if (options.claims) {
+            state.cachedClaims = options.claims;
+        }
+        const silentRequest = {
+            account: state.cachedAccount,
+            scopes,
+            claims: state.cachedClaims,
+        };
+        if (state.pluginConfiguration.broker.isEnabled) {
+            silentRequest.extraQueryParameters ||= {};
+            if (state.pluginConfiguration.broker.enableMsaPassthrough) {
+                silentRequest.extraQueryParameters["msal_request_type"] = "consumer_passthrough";
+            }
+        }
+        if (options.proofOfPossessionOptions) {
+            silentRequest.shrNonce = options.proofOfPossessionOptions.nonce;
+            silentRequest.authenticationScheme = "pop";
+            silentRequest.resourceRequestMethod = options.proofOfPossessionOptions.resourceRequestMethod;
+            silentRequest.resourceRequestUri = options.proofOfPossessionOptions.resourceRequestUrl;
+        }
+        state.logger.getToken.info("Attempting to acquire token silently");
+        try {
+            return await app.acquireTokenSilent(silentRequest);
+        }
+        catch (err) {
+            throw handleMsalError(scopes, err, options);
+        }
+    }
+    /**
+     * Builds an authority URL for the given request. The authority may be different than the one used when creating the MSAL client
+     * if the user is creating cross-tenant requests
+     */
+    function calculateRequestAuthority(options) {
+        if (options?.tenantId) {
+            return getAuthority(options.tenantId, getAuthorityHost(createMsalClientOptions));
+        }
+        return state.msalConfig.auth.authority;
+    }
+    /**
+     * Performs silent authentication using MSAL to acquire an access token.
+     * If silent authentication fails, falls back to interactive authentication.
+     *
+     * @param msalApp - The MSAL application instance.
+     * @param scopes - The scopes for which to acquire the access token.
+     * @param options - The options for acquiring the access token.
+     * @param onAuthenticationRequired - A callback function to handle interactive authentication when silent authentication fails.
+     * @returns A promise that resolves to an AccessToken object containing the access token and its expiration timestamp.
+     */
+    async function withSilentAuthentication(msalApp, scopes, options, onAuthenticationRequired) {
+        let response = null;
+        try {
+            response = await getTokenSilent(msalApp, scopes, options);
+        }
+        catch (e) {
+            if (e.name !== "AuthenticationRequiredError") {
+                throw e;
+            }
+            if (options.disableAutomaticAuthentication) {
+                throw new AuthenticationRequiredError({
+                    scopes,
+                    getTokenOptions: options,
+                    message: "Automatic authentication has been disabled. You may call the authentication() method.",
+                });
+            }
+        }
+        // Silent authentication failed
+        if (response === null) {
+            try {
+                response = await onAuthenticationRequired();
+            }
+            catch (err) {
+                throw handleMsalError(scopes, err, options);
+            }
+        }
+        // At this point we should have a token, process it
+        ensureValidMsalToken(scopes, response, options);
+        state.cachedAccount = response?.account ?? null;
+        state.logger.getToken.info(formatSuccess(scopes));
+        return {
+            token: response.accessToken,
+            expiresOnTimestamp: response.expiresOn.getTime(),
+            refreshAfterTimestamp: response.refreshOn?.getTime(),
+            tokenType: response.tokenType,
+        };
+    }
+    async function getTokenByClientSecret(scopes, clientSecret, options = {}) {
+        state.logger.getToken.info(`Attempting to acquire token using client secret`);
+        state.msalConfig.auth.clientSecret = clientSecret;
+        const msalApp = await getConfidentialApp(options);
+        try {
+            const response = await msalApp.acquireTokenByClientCredential({
+                scopes,
+                authority: calculateRequestAuthority(options),
+                azureRegion: calculateRegionalAuthority(),
+                claims: options?.claims,
+            });
+            ensureValidMsalToken(scopes, response, options);
+            state.logger.getToken.info(formatSuccess(scopes));
+            return {
+                token: response.accessToken,
+                expiresOnTimestamp: response.expiresOn.getTime(),
+                refreshAfterTimestamp: response.refreshOn?.getTime(),
+                tokenType: response.tokenType,
+            };
+        }
+        catch (err) {
+            throw handleMsalError(scopes, err, options);
+        }
+    }
+    async function getTokenByClientAssertion(scopes, clientAssertion, options = {}) {
+        state.logger.getToken.info(`Attempting to acquire token using client assertion`);
+        state.msalConfig.auth.clientAssertion = clientAssertion;
+        const msalApp = await getConfidentialApp(options);
+        try {
+            const response = await msalApp.acquireTokenByClientCredential({
+                scopes,
+                authority: calculateRequestAuthority(options),
+                azureRegion: calculateRegionalAuthority(),
+                claims: options?.claims,
+                clientAssertion,
+            });
+            ensureValidMsalToken(scopes, response, options);
+            state.logger.getToken.info(formatSuccess(scopes));
+            return {
+                token: response.accessToken,
+                expiresOnTimestamp: response.expiresOn.getTime(),
+                refreshAfterTimestamp: response.refreshOn?.getTime(),
+                tokenType: response.tokenType,
+            };
+        }
+        catch (err) {
+            throw handleMsalError(scopes, err, options);
+        }
+    }
+    async function getTokenByClientCertificate(scopes, certificate, options = {}) {
+        state.logger.getToken.info(`Attempting to acquire token using client certificate`);
+        state.msalConfig.auth.clientCertificate = certificate;
+        const msalApp = await getConfidentialApp(options);
+        try {
+            const response = await msalApp.acquireTokenByClientCredential({
+                scopes,
+                authority: calculateRequestAuthority(options),
+                azureRegion: calculateRegionalAuthority(),
+                claims: options?.claims,
+            });
+            ensureValidMsalToken(scopes, response, options);
+            state.logger.getToken.info(formatSuccess(scopes));
+            return {
+                token: response.accessToken,
+                expiresOnTimestamp: response.expiresOn.getTime(),
+                refreshAfterTimestamp: response.refreshOn?.getTime(),
+                tokenType: response.tokenType,
+            };
+        }
+        catch (err) {
+            throw handleMsalError(scopes, err, options);
+        }
+    }
+    async function getTokenByDeviceCode(scopes, deviceCodeCallback, options = {}) {
+        state.logger.getToken.info(`Attempting to acquire token using device code`);
+        const msalApp = await getPublicApp(options);
+        return withSilentAuthentication(msalApp, scopes, options, () => {
+            const requestOptions = {
+                scopes,
+                cancel: options?.abortSignal?.aborted ?? false,
+                deviceCodeCallback,
+                authority: calculateRequestAuthority(options),
+                claims: options?.claims,
+            };
+            const deviceCodeRequest = msalApp.acquireTokenByDeviceCode(requestOptions);
+            if (options.abortSignal) {
+                options.abortSignal.addEventListener("abort", () => {
+                    requestOptions.cancel = true;
+                });
+            }
+            return deviceCodeRequest;
+        });
+    }
+    async function getTokenByUsernamePassword(scopes, username, password, options = {}) {
+        state.logger.getToken.info(`Attempting to acquire token using username and password`);
+        const msalApp = await getPublicApp(options);
+        return withSilentAuthentication(msalApp, scopes, options, () => {
+            const requestOptions = {
+                scopes,
+                username,
+                password,
+                authority: calculateRequestAuthority(options),
+                claims: options?.claims,
+            };
+            return msalApp.acquireTokenByUsernamePassword(requestOptions);
+        });
+    }
+    function getActiveAccount() {
+        if (!state.cachedAccount) {
+            return undefined;
+        }
+        return msalToPublic(clientId, state.cachedAccount);
+    }
+    async function getTokenByAuthorizationCode(scopes, redirectUri, authorizationCode, clientSecret, options = {}) {
+        state.logger.getToken.info(`Attempting to acquire token using authorization code`);
+        let msalApp;
+        if (clientSecret) {
+            // If a client secret is provided, we need to use a confidential client application
+            // See https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-access-token-with-a-client_secret
+            state.msalConfig.auth.clientSecret = clientSecret;
+            msalApp = await getConfidentialApp(options);
+        }
+        else {
+            msalApp = await getPublicApp(options);
+        }
+        return withSilentAuthentication(msalApp, scopes, options, () => {
+            return msalApp.acquireTokenByCode({
+                scopes,
+                redirectUri,
+                code: authorizationCode,
+                authority: calculateRequestAuthority(options),
+                claims: options?.claims,
+            });
+        });
+    }
+    async function getTokenOnBehalfOf(scopes, userAssertionToken, clientCredentials, options = {}) {
+        msalLogger.getToken.info(`Attempting to acquire token on behalf of another user`);
+        if (typeof clientCredentials === "string") {
+            // Client secret
+            msalLogger.getToken.info(`Using client secret for on behalf of flow`);
+            state.msalConfig.auth.clientSecret = clientCredentials;
+        }
+        else if (typeof clientCredentials === "function") {
+            // Client Assertion
+            msalLogger.getToken.info(`Using client assertion callback for on behalf of flow`);
+            state.msalConfig.auth.clientAssertion = clientCredentials;
+        }
+        else {
+            // Client certificate
+            msalLogger.getToken.info(`Using client certificate for on behalf of flow`);
+            state.msalConfig.auth.clientCertificate = clientCredentials;
+        }
+        const msalApp = await getConfidentialApp(options);
+        try {
+            const response = await msalApp.acquireTokenOnBehalfOf({
+                scopes,
+                authority: calculateRequestAuthority(options),
+                claims: options.claims,
+                oboAssertion: userAssertionToken,
+            });
+            ensureValidMsalToken(scopes, response, options);
+            msalLogger.getToken.info(formatSuccess(scopes));
+            return {
+                token: response.accessToken,
+                expiresOnTimestamp: response.expiresOn.getTime(),
+                refreshAfterTimestamp: response.refreshOn?.getTime(),
+                tokenType: response.tokenType,
+            };
+        }
+        catch (err) {
+            throw handleMsalError(scopes, err, options);
+        }
+    }
+    /**
+     * Creates a base interactive request configuration for MSAL interactive authentication.
+     * This is shared between interactive and brokered authentication flows.
+     */
+    function createBaseInteractiveRequest(scopes, options) {
+        return {
+            openBrowser: async (url) => {
+                const open = await import("open");
+                await open.default(url, { newInstance: true });
+            },
+            scopes,
+            authority: calculateRequestAuthority(options),
+            claims: options?.claims,
+            loginHint: options?.loginHint,
+            errorTemplate: options?.browserCustomizationOptions?.errorMessage,
+            successTemplate: options?.browserCustomizationOptions?.successMessage,
+            prompt: options?.loginHint ? "login" : "select_account",
+        };
+    }
+    /**
+     * @internal
+     */
+    async function getBrokeredTokenInternal(scopes, useDefaultBrokerAccount, options = {}) {
+        msalLogger.verbose("Authentication will resume through the broker");
+        const app = await getPublicApp(options);
+        const interactiveRequest = createBaseInteractiveRequest(scopes, options);
+        if (state.pluginConfiguration.broker.parentWindowHandle) {
+            interactiveRequest.windowHandle = Buffer.from(state.pluginConfiguration.broker.parentWindowHandle);
+        }
+        else {
+            // this is a bug, as the pluginConfiguration handler should validate this case.
+            msalLogger.warning("Parent window handle is not specified for the broker. This may cause unexpected behavior. Please provide the parentWindowHandle.");
+        }
+        if (state.pluginConfiguration.broker.enableMsaPassthrough) {
+            (interactiveRequest.extraQueryParameters ??= {})["msal_request_type"] =
+                "consumer_passthrough";
+        }
+        if (useDefaultBrokerAccount) {
+            interactiveRequest.prompt = "none";
+            msalLogger.verbose("Attempting broker authentication using the default broker account");
+        }
+        else {
+            msalLogger.verbose("Attempting broker authentication without the default broker account");
+        }
+        if (options.proofOfPossessionOptions) {
+            interactiveRequest.shrNonce = options.proofOfPossessionOptions.nonce;
+            interactiveRequest.authenticationScheme = "pop";
+            interactiveRequest.resourceRequestMethod =
+                options.proofOfPossessionOptions.resourceRequestMethod;
+            interactiveRequest.resourceRequestUri = options.proofOfPossessionOptions.resourceRequestUrl;
+        }
+        try {
+            return await app.acquireTokenInteractive(interactiveRequest);
+        }
+        catch (e) {
+            msalLogger.verbose(`Failed to authenticate through the broker: ${e.message}`);
+            if (options.disableAutomaticAuthentication) {
+                throw new AuthenticationRequiredError({
+                    scopes,
+                    getTokenOptions: options,
+                    message: "Cannot silently authenticate with default broker account.",
+                });
+            }
+            // If we tried to use the default broker account and failed, fall back to interactive authentication
+            if (useDefaultBrokerAccount) {
+                return getBrokeredTokenInternal(scopes, false, options);
+            }
+            else {
+                throw e;
+            }
+        }
+    }
+    /**
+     * A helper function that supports brokered authentication through the MSAL's public application.
+     *
+     * When useDefaultBrokerAccount is true, the method will attempt to authenticate using the default broker account.
+     * If the default broker account is not available, the method will fall back to interactive authentication.
+     */
+    async function getBrokeredToken(scopes, useDefaultBrokerAccount, options = {}) {
+        msalLogger.getToken.info(`Attempting to acquire token using brokered authentication with useDefaultBrokerAccount: ${useDefaultBrokerAccount}`);
+        const response = await getBrokeredTokenInternal(scopes, useDefaultBrokerAccount, options);
+        ensureValidMsalToken(scopes, response, options);
+        state.cachedAccount = response?.account ?? null;
+        state.logger.getToken.info(formatSuccess(scopes));
+        return {
+            token: response.accessToken,
+            expiresOnTimestamp: response.expiresOn.getTime(),
+            refreshAfterTimestamp: response.refreshOn?.getTime(),
+            tokenType: response.tokenType,
+        };
+    }
+    async function getTokenByInteractiveRequest(scopes, options = {}) {
+        msalLogger.getToken.info(`Attempting to acquire token interactively`);
+        const app = await getPublicApp(options);
+        return withSilentAuthentication(app, scopes, options, async () => {
+            const interactiveRequest = createBaseInteractiveRequest(scopes, options);
+            if (state.pluginConfiguration.broker.isEnabled) {
+                return getBrokeredTokenInternal(scopes, state.pluginConfiguration.broker.useDefaultBrokerAccount ?? false, options);
+            }
+            if (options.proofOfPossessionOptions) {
+                interactiveRequest.shrNonce = options.proofOfPossessionOptions.nonce;
+                interactiveRequest.authenticationScheme = "pop";
+                interactiveRequest.resourceRequestMethod =
+                    options.proofOfPossessionOptions.resourceRequestMethod;
+                interactiveRequest.resourceRequestUri = options.proofOfPossessionOptions.resourceRequestUrl;
+            }
+            return app.acquireTokenInteractive(interactiveRequest);
+        });
+    }
+    return {
+        getActiveAccount,
+        getBrokeredToken,
+        getTokenByClientSecret,
+        getTokenByClientAssertion,
+        getTokenByClientCertificate,
+        getTokenByDeviceCode,
+        getTokenByUsernamePassword,
+        getTokenByAuthorizationCode,
+        getTokenOnBehalfOf,
+        getTokenByInteractiveRequest,
+    };
+}
+//# sourceMappingURL=msalClient.js.map

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/msalPlugins.d.ts

@@ -0,0 +1,109 @@
+import type * as msalNode from "@azure/msal-node";
+import type { MsalClientOptions } from "./msalClient.js";
+import type { NativeBrokerPluginControl, VisualStudioCodeCredentialControl } from "../../plugins/provider.js";
+import type { TokenCachePersistenceOptions } from "./tokenCachePersistenceOptions.js";
+/**
+ * Configuration for the plugins used by the MSAL node client.
+ */
+export interface PluginConfiguration {
+    /**
+     * Configuration for the cache plugin.
+     */
+    cache: {
+        /**
+         * The non-CAE cache plugin handler.
+         */
+        cachePlugin?: Promise<msalNode.ICachePlugin>;
+        /**
+         * The CAE cache plugin handler - persisted to a different file.
+         */
+        cachePluginCae?: Promise<msalNode.ICachePlugin>;
+    };
+    /**
+     * Configuration for the broker plugin.
+     */
+    broker: {
+        /**
+         * True if the broker plugin is enabled and available. False otherwise.
+         *
+         * It is a bug if this is true and the broker plugin is not available.
+         */
+        isEnabled: boolean;
+        /**
+         * If true, MSA account will be passed through, required for WAM authentication.
+         */
+        enableMsaPassthrough: boolean;
+        /**
+         * The parent window handle for the broker.
+         */
+        parentWindowHandle?: Uint8Array;
+        /**
+         * The native broker plugin handler.
+         */
+        nativeBrokerPlugin?: msalNode.INativeBrokerPlugin;
+        /**
+         * If set to true, the credential will attempt to use the default broker account for authentication before falling back to interactive authentication. Default is set to false.
+         */
+        useDefaultBrokerAccount?: boolean;
+    };
+}
+/**
+ * The current persistence provider, undefined by default.
+ * @internal
+ */
+export declare let persistenceProvider: ((options?: TokenCachePersistenceOptions) => Promise<msalNode.ICachePlugin>) | undefined;
+/**
+ * An object that allows setting the persistence provider.
+ * @internal
+ */
+export declare const msalNodeFlowCacheControl: {
+    setPersistence(pluginProvider: Exclude<typeof persistenceProvider, undefined>): void;
+};
+/**
+ * The current native broker provider, undefined by default.
+ * @internal
+ */
+export declare let nativeBrokerInfo: {
+    broker: msalNode.INativeBrokerPlugin;
+} | undefined;
+/**
+ * The current VSCode auth record path, undefined by default.
+ * @internal
+ */
+export declare let vsCodeAuthRecordPath: string | undefined;
+/**
+ * The current VSCode broker, undefined by default.
+ * @internal
+ */
+export declare let vsCodeBrokerInfo: {
+    broker: msalNode.INativeBrokerPlugin;
+} | undefined;
+export declare function hasNativeBroker(): boolean;
+export declare function hasVSCodePlugin(): boolean;
+/**
+ * An object that allows setting the native broker provider.
+ * @internal
+ */
+export declare const msalNodeFlowNativeBrokerControl: NativeBrokerPluginControl;
+/**
+ * An object that allows setting the VSCode credential auth record path and broker.
+ * @internal
+ */
+export declare const msalNodeFlowVSCodeCredentialControl: VisualStudioCodeCredentialControl;
+/**
+ * Configures plugins, validating that required plugins are available and enabled.
+ *
+ * Does not create the plugins themselves, but rather returns the configuration that will be used to create them.
+ *
+ * @param options - options for creating the MSAL client
+ * @returns plugin configuration
+ */
+declare function generatePluginConfiguration(options: MsalClientOptions): PluginConfiguration;
+/**
+ * Wraps generatePluginConfiguration as a writeable property for test stubbing purposes.
+ */
+export declare const msalPlugins: {
+    generatePluginConfiguration: typeof generatePluginConfiguration;
+};
+export {};
+//# sourceMappingURL=msalPlugins.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/msalPlugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalPlugins.d.ts","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/msalPlugins.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQlD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EACV,yBAAyB,EACzB,iCAAiC,EAClC,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEtF;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,KAAK,EAAE;QACL;;WAEG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7C;;WAEG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;KACjD,CAAC;IACF;;OAEG;IACH,MAAM,EAAE;QACN;;;;WAIG;QACH,SAAS,EAAE,OAAO,CAAC;QACnB;;WAEG;QACH,oBAAoB,EAAE,OAAO,CAAC;QAC9B;;WAEG;QACH,kBAAkB,CAAC,EAAE,UAAU,CAAC;QAChC;;WAEG;QACH,kBAAkB,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAClD;;WAEG;QACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC,CAAC;CACH;AAED;;;GAGG;AACH,eAAO,IAAI,mBAAmB,EAC1B,CAAC,CAAC,OAAO,CAAC,EAAE,4BAA4B,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,GAC5E,SAAqB,CAAC;AAE1B;;;GAGG;AACH,eAAO,MAAM,wBAAwB;mCACJ,OAAO,CAAC,OAAO,mBAAmB,EAAE,SAAS,CAAC,GAAG,IAAI;CAGrF,CAAC;AAEF;;;GAGG;AACH,eAAO,IAAI,gBAAgB,EACvB;IACE,MAAM,EAAE,QAAQ,CAAC,mBAAmB,CAAC;CACtC,GACD,SAAqB,CAAC;AAE1B;;;GAGG;AACH,eAAO,IAAI,oBAAoB,EAAE,MAAM,GAAG,SAAqB,CAAC;AAEhE;;;GAGG;AACH,eAAO,IAAI,gBAAgB,EACvB;IACE,MAAM,EAAE,QAAQ,CAAC,mBAAmB,CAAC;CACtC,GACD,SAAqB,CAAC;AAE1B,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,yBAM7C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAE,iCASjD,CAAC;AAEF;;;;;;;GAOG;AACH,iBAAS,2BAA2B,CAAC,OAAO,EAAE,iBAAiB,GAAG,mBAAmB,CAqCpF;AAyDD;;GAEG;AACH,eAAO,MAAM,WAAW;;CAEvB,CAAC"}

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/msalPlugins.js

@@ -0,0 +1,160 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import { CACHE_CAE_SUFFIX, CACHE_NON_CAE_SUFFIX, DEFAULT_TOKEN_CACHE_NAME, } from "../../constants.js";
+/**
+ * The current persistence provider, undefined by default.
+ * @internal
+ */
+export let persistenceProvider = undefined;
+/**
+ * An object that allows setting the persistence provider.
+ * @internal
+ */
+export const msalNodeFlowCacheControl = {
+    setPersistence(pluginProvider) {
+        persistenceProvider = pluginProvider;
+    },
+};
+/**
+ * The current native broker provider, undefined by default.
+ * @internal
+ */
+export let nativeBrokerInfo = undefined;
+/**
+ * The current VSCode auth record path, undefined by default.
+ * @internal
+ */
+export let vsCodeAuthRecordPath = undefined;
+/**
+ * The current VSCode broker, undefined by default.
+ * @internal
+ */
+export let vsCodeBrokerInfo = undefined;
+export function hasNativeBroker() {
+    return nativeBrokerInfo !== undefined;
+}
+export function hasVSCodePlugin() {
+    return vsCodeAuthRecordPath !== undefined && vsCodeBrokerInfo !== undefined;
+}
+/**
+ * An object that allows setting the native broker provider.
+ * @internal
+ */
+export const msalNodeFlowNativeBrokerControl = {
+    setNativeBroker(broker) {
+        nativeBrokerInfo = {
+            broker,
+        };
+    },
+};
+/**
+ * An object that allows setting the VSCode credential auth record path and broker.
+ * @internal
+ */
+export const msalNodeFlowVSCodeCredentialControl = {
+    setVSCodeAuthRecordPath(path) {
+        vsCodeAuthRecordPath = path;
+    },
+    setVSCodeBroker(broker) {
+        vsCodeBrokerInfo = {
+            broker,
+        };
+    },
+};
+/**
+ * Configures plugins, validating that required plugins are available and enabled.
+ *
+ * Does not create the plugins themselves, but rather returns the configuration that will be used to create them.
+ *
+ * @param options - options for creating the MSAL client
+ * @returns plugin configuration
+ */
+function generatePluginConfiguration(options) {
+    const config = {
+        cache: {},
+        broker: {
+            ...options.brokerOptions,
+            isEnabled: options.brokerOptions?.enabled ?? false,
+            enableMsaPassthrough: options.brokerOptions?.legacyEnableMsaPassthrough ?? false,
+        },
+    };
+    if (options.tokenCachePersistenceOptions?.enabled) {
+        if (persistenceProvider === undefined) {
+            throw new Error([
+                "Persistent token caching was requested, but no persistence provider was configured.",
+                "You must install the identity-cache-persistence plugin package (`npm install --save @azure/identity-cache-persistence`)",
+                "and enable it by importing `useIdentityPlugin` from `@azure/identity` and calling",
+                "`useIdentityPlugin(cachePersistencePlugin)` before using `tokenCachePersistenceOptions`.",
+            ].join(" "));
+        }
+        const cacheBaseName = options.tokenCachePersistenceOptions.name || DEFAULT_TOKEN_CACHE_NAME;
+        config.cache.cachePlugin = persistenceProvider({
+            name: `${cacheBaseName}.${CACHE_NON_CAE_SUFFIX}`,
+            ...options.tokenCachePersistenceOptions,
+        });
+        config.cache.cachePluginCae = persistenceProvider({
+            name: `${cacheBaseName}.${CACHE_CAE_SUFFIX}`,
+            ...options.tokenCachePersistenceOptions,
+        });
+    }
+    if (options.brokerOptions?.enabled) {
+        config.broker.nativeBrokerPlugin = getBrokerPlugin(options.isVSCodeCredential || false);
+    }
+    return config;
+}
+// Broker error message templates with variables for credential and package names
+const brokerErrorTemplates = {
+    missing: (credentialName, packageName, pluginVar) => [
+        `${credentialName} was requested, but no plugin was configured or no authentication record was found.`,
+        `You must install the ${packageName} plugin package (npm install --save ${packageName})`,
+        "and enable it by importing `useIdentityPlugin` from `@azure/identity` and calling",
+        `useIdentityPlugin(${pluginVar}) before using enableBroker.`,
+    ].join(" "),
+    unavailable: (credentialName, packageName) => [
+        `${credentialName} was requested, and the plugin is configured, but the broker is unavailable.`,
+        `Ensure the ${credentialName} plugin is properly installed and configured.`,
+        "Check for missing native dependencies and ensure the package is properly installed.",
+        `See the README for prerequisites on installing and using ${packageName}.`,
+    ].join(" "),
+};
+// Values for VSCode and native broker configurations for error message
+const brokerConfig = {
+    vsCode: {
+        credentialName: "Visual Studio Code Credential",
+        packageName: "@azure/identity-vscode",
+        pluginVar: "vsCodePlugin",
+        get brokerInfo() {
+            return vsCodeBrokerInfo;
+        },
+    },
+    native: {
+        credentialName: "Broker for WAM",
+        packageName: "@azure/identity-broker",
+        pluginVar: "nativeBrokerPlugin",
+        get brokerInfo() {
+            return nativeBrokerInfo;
+        },
+    },
+};
+/**
+ * Set appropriate broker plugin based on whether VSCode or native broker is requested.
+ * @param isVSCodePlugin - true for VSCode broker, false for native broker
+ * @returns the broker plugin if available
+ */
+function getBrokerPlugin(isVSCodePlugin) {
+    const { credentialName, packageName, pluginVar, brokerInfo } = brokerConfig[isVSCodePlugin ? "vsCode" : "native"];
+    if (brokerInfo === undefined) {
+        throw new Error(brokerErrorTemplates.missing(credentialName, packageName, pluginVar));
+    }
+    if (brokerInfo.broker.isBrokerAvailable === false) {
+        throw new Error(brokerErrorTemplates.unavailable(credentialName, packageName));
+    }
+    return brokerInfo.broker;
+}
+/**
+ * Wraps generatePluginConfiguration as a writeable property for test stubbing purposes.
+ */
+export const msalPlugins = {
+    generatePluginConfiguration,
+};
+//# sourceMappingURL=msalPlugins.js.map

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/tokenCachePersistenceOptions.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Parameters that enable token cache persistence in the Identity credentials.
+ */
+export interface TokenCachePersistenceOptions {
+    /**
+     * If set to true, persistent token caching will be enabled for this credential instance.
+     */
+    enabled: boolean;
+    /**
+     * Unique identifier for the persistent token cache.
+     *
+     * Based on this identifier, the persistence file will be located in any of the following places:
+     * - Darwin: '/Users/user/.IdentityService/<name>'
+     * - Windows 8+: 'C:\\Users\\user\\AppData\\Local\\.IdentityService\\<name>'
+     * - Linux: '/home/user/.IdentityService/<name>'
+     */
+    name?: string;
+    /**
+     * If set to true, the cache will be stored without encryption if no OS level user encryption is available.
+     * When set to false, the PersistentTokenCache will throw an error if no OS level user encryption is available.
+     */
+    unsafeAllowUnencryptedStorage?: boolean;
+}
+//# sourceMappingURL=tokenCachePersistenceOptions.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/tokenCachePersistenceOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenCachePersistenceOptions.d.ts","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/tokenCachePersistenceOptions.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;CACzC"}

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/tokenCachePersistenceOptions.js

@@ -0,0 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+export {};
+//# sourceMappingURL=tokenCachePersistenceOptions.js.map

backend/node_modules/@azure/identity/dist/esm/msal/nodeFlows/tokenCachePersistenceOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenCachePersistenceOptions.js","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/tokenCachePersistenceOptions.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\n/**\n * Parameters that enable token cache persistence in the Identity credentials.\n */\nexport interface TokenCachePersistenceOptions {\n  /**\n   * If set to true, persistent token caching will be enabled for this credential instance.\n   */\n  enabled: boolean;\n  /**\n   * Unique identifier for the persistent token cache.\n   *\n   * Based on this identifier, the persistence file will be located in any of the following places:\n   * - Darwin: '/Users/user/.IdentityService/<name>'\n   * - Windows 8+: 'C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\.IdentityService\\\\<name>'\n   * - Linux: '/home/user/.IdentityService/<name>'\n   */\n  name?: string;\n  /**\n   * If set to true, the cache will be stored without encryption if no OS level user encryption is available.\n   * When set to false, the PersistentTokenCache will throw an error if no OS level user encryption is available.\n   */\n  unsafeAllowUnencryptedStorage?: boolean;\n}\n"]}

backend/node_modules/@azure/identity/dist/esm/msal/types.d.ts

@@ -0,0 +1,93 @@
+/**
+ * @internal
+ */
+export type AppType = "public" | "confidential" | "publicFirst" | "confidentialFirst";
+/**
+ * The shape we use return the token (and the expiration date).
+ * @internal
+ */
+export interface MsalToken {
+    accessToken?: string;
+    expiresOn: Date | null;
+}
+/**
+ * Represents a valid (i.e. complete) MSAL token.
+ */
+export type ValidMsalToken = {
+    [P in keyof MsalToken]-?: NonNullable<MsalToken[P]>;
+};
+/**
+ * Internal representation of MSAL's Account information.
+ * Helps us to disambiguate the MSAL classes accross environments.
+ * @internal
+ */
+export interface MsalAccountInfo {
+    homeAccountId: string;
+    environment?: string;
+    tenantId: string;
+    username: string;
+    localAccountId: string;
+    name?: string;
+    idTokenClaims?: object;
+}
+/**
+ * Represents the common properties of any of the MSAL responses.
+ * @internal
+ */
+export interface MsalResult {
+    authority?: string;
+    account: MsalAccountInfo | null;
+    accessToken: string;
+    expiresOn: Date | null;
+    refreshOn?: Date | null;
+}
+/**
+ * The record to use to find the cached tokens in the cache.
+ */
+export interface AuthenticationRecord {
+    /**
+     * Entity which issued the token represented by the domain of the issuer (e.g. login.microsoftonline.com)
+     */
+    authority: string;
+    /**
+     * The home account Id.
+     */
+    homeAccountId: string;
+    /**
+     * The associated client ID.
+     */
+    clientId: string;
+    /**
+     * The associated tenant ID.
+     */
+    tenantId: string;
+    /**
+     * The username of the logged in account.
+     */
+    username: string;
+}
+/**
+ * Represents a parsed certificate
+ * @internal
+ */
+export interface CertificateParts {
+    /**
+     * Hex encoded X.509 SHA-256 thumbprint of the certificate.
+     */
+    thumbprintSha256: string;
+    /**
+     * Hex encoded X.509 SHA-1 thumbprint of the certificate.
+     * @deprecated Use thumbprintSha256 property instead. Thumbprint needs to be computed with SHA-256 algorithm.
+     * SHA-1 is only needed for backwards compatibility with older versions of ADFS.
+     */
+    thumbprint: string;
+    /**
+     * The PEM encoded private key.
+     */
+    privateKey: string;
+    /**
+     * x5c header.
+     */
+    x5c?: string;
+}
+//# sourceMappingURL=types.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/msal/types.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,GAAG,aAAa,GAAG,mBAAmB,CAAC;AAEtF;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;KAAG,CAAC,IAAI,MAAM,SAAS,CAAC,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAErF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}

backend/node_modules/@azure/identity/dist/esm/msal/types.js

@@ -0,0 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+export {};
+//# sourceMappingURL=types.js.map

backend/node_modules/@azure/identity/dist/esm/msal/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/msal/types.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\n/**\n * @internal\n */\nexport type AppType = \"public\" | \"confidential\" | \"publicFirst\" | \"confidentialFirst\";\n\n/**\n * The shape we use return the token (and the expiration date).\n * @internal\n */\nexport interface MsalToken {\n  accessToken?: string;\n  expiresOn: Date | null;\n}\n\n/**\n * Represents a valid (i.e. complete) MSAL token.\n */\nexport type ValidMsalToken = { [P in keyof MsalToken]-?: NonNullable<MsalToken[P]> };\n\n/**\n * Internal representation of MSAL's Account information.\n * Helps us to disambiguate the MSAL classes accross environments.\n * @internal\n */\nexport interface MsalAccountInfo {\n  homeAccountId: string;\n  environment?: string;\n  tenantId: string;\n  username: string;\n  localAccountId: string;\n  name?: string;\n  // Leaving idTokenClaims as object since that's how MSAL has this assigned.\n  idTokenClaims?: object;\n}\n\n/**\n * Represents the common properties of any of the MSAL responses.\n * @internal\n */\nexport interface MsalResult {\n  authority?: string;\n  account: MsalAccountInfo | null;\n  accessToken: string;\n  expiresOn: Date | null;\n  refreshOn?: Date | null;\n}\n\n/**\n * The record to use to find the cached tokens in the cache.\n */\nexport interface AuthenticationRecord {\n  /**\n   * Entity which issued the token represented by the domain of the issuer (e.g. login.microsoftonline.com)\n   */\n  authority: string;\n  /**\n   * The home account Id.\n   */\n  homeAccountId: string;\n  /**\n   * The associated client ID.\n   */\n  clientId: string;\n  /**\n   * The associated tenant ID.\n   */\n  tenantId: string;\n  /**\n   * The username of the logged in account.\n   */\n  username: string;\n}\n\n/**\n * Represents a parsed certificate\n * @internal\n */\nexport interface CertificateParts {\n  /**\n   * Hex encoded X.509 SHA-256 thumbprint of the certificate.\n   */\n  thumbprintSha256: string;\n  /**\n   * Hex encoded X.509 SHA-1 thumbprint of the certificate.\n   * @deprecated Use thumbprintSha256 property instead. Thumbprint needs to be computed with SHA-256 algorithm.\n   * SHA-1 is only needed for backwards compatibility with older versions of ADFS.\n   */\n  thumbprint: string;\n  /**\n   * The PEM encoded private key.\n   */\n  privateKey: string;\n  /**\n   * x5c header.\n   */\n  x5c?: string;\n}\n"]}

backend/node_modules/@azure/identity/dist/esm/msal/utils.d.ts

@@ -0,0 +1,95 @@
+import type { AuthenticationRecord, MsalAccountInfo, MsalToken, ValidMsalToken } from "./types.js";
+import type { CredentialLogger } from "../util/logging.js";
+import type { AzureLogLevel } from "@azure/logger";
+import type { GetTokenOptions } from "@azure/core-auth";
+import { msalCommon } from "./msal.js";
+export interface ILoggerCallback {
+    (level: msalCommon.LogLevel, message: string, containsPii: boolean): void;
+}
+/**
+ * Ensures the validity of the MSAL token
+ * @internal
+ */
+export declare function ensureValidMsalToken(scopes: string | string[], msalToken?: MsalToken | null, getTokenOptions?: GetTokenOptions): asserts msalToken is ValidMsalToken;
+/**
+ * Returns the authority host from either the options bag or the AZURE_AUTHORITY_HOST environment variable.
+ *
+ * Defaults to {@link DefaultAuthorityHost}.
+ * @internal
+ */
+export declare function getAuthorityHost(options?: {
+    authorityHost?: string;
+}): string;
+/**
+ * Generates a valid authority by combining a host with a tenantId.
+ * @internal
+ */
+export declare function getAuthority(tenantId: string, host?: string): string;
+/**
+ * Generates the known authorities.
+ * If the Tenant Id is `adfs`, the authority can't be validated since the format won't match the expected one.
+ * For that reason, we have to force MSAL to disable validating the authority
+ * by sending it within the known authorities in the MSAL configuration.
+ * @internal
+ */
+export declare function getKnownAuthorities(tenantId: string, authorityHost: string, disableInstanceDiscovery?: boolean): string[];
+/**
+ * Generates a logger that can be passed to the MSAL clients.
+ * @param credLogger - The logger of the credential.
+ * @internal
+ */
+export declare const defaultLoggerCallback: (logger: CredentialLogger, platform?: "Node" | "Browser") => ILoggerCallback;
+/**
+ * @internal
+ */
+export declare function getMSALLogLevel(logLevel: AzureLogLevel | undefined): msalCommon.LogLevel;
+/**
+ * Wraps core-util's randomUUID in order to allow for mocking in tests.
+ * This prepares the library for the upcoming core-util update to ESM.
+ *
+ * @internal
+ * @returns A string containing a random UUID
+ */
+export declare function randomUUID(): string;
+/**
+ * Handles MSAL errors.
+ */
+export declare function handleMsalError(scopes: string[], error: Error, getTokenOptions?: GetTokenOptions): Error;
+export declare function publicToMsal(account: AuthenticationRecord): msalCommon.AccountInfo;
+export declare function msalToPublic(clientId: string, account: MsalAccountInfo): AuthenticationRecord;
+/**
+ * Serializes an `AuthenticationRecord` into a string.
+ *
+ * The output of a serialized authentication record will contain the following properties:
+ *
+ * - "authority"
+ * - "homeAccountId"
+ * - "clientId"
+ * - "tenantId"
+ * - "username"
+ * - "version"
+ *
+ * To later convert this string to a serialized `AuthenticationRecord`, please use the exported function `deserializeAuthenticationRecord()`.
+ */
+export declare function serializeAuthenticationRecord(record: AuthenticationRecord): string;
+/**
+ * Deserializes a previously serialized authentication record from a string into an object.
+ *
+ * The input string must contain the following properties:
+ *
+ * - "authority"
+ * - "homeAccountId"
+ * - "clientId"
+ * - "tenantId"
+ * - "username"
+ * - "version"
+ *
+ * If the version we receive is unsupported, an error will be thrown.
+ *
+ * At the moment, the only available version is: "1.0", which is always set when the authentication record is serialized.
+ *
+ * @param serializedRecord - Authentication record previously serialized into string.
+ * @returns AuthenticationRecord.
+ */
+export declare function deserializeAuthenticationRecord(serializedRecord: string): AuthenticationRecord;
+//# sourceMappingURL=utils.d.ts.map

backend/node_modules/@azure/identity/dist/esm/msal/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/msal/utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEnG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAM3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,WAAW,eAAe;IAC9B,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3E;AASD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,EAC5B,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,SAAS,IAAI,cAAc,CAkBrC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQ7E;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAYpE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,wBAAwB,CAAC,EAAE,OAAO,GACjC,MAAM,EAAE,CAKV;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,CAClC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,KAC1B,eAoBF,CAAC;AAEJ;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,SAAS,GAAG,UAAU,CAAC,QAAQ,CAcxF;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,KAAK,EACZ,eAAe,CAAC,EAAE,eAAe,GAChC,KAAK,CA6CP;AAGD,wBAAgB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,UAAU,CAAC,WAAW,CAQlF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,oBAAoB,CAU7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAElF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,+BAA+B,CAAC,gBAAgB,EAAE,MAAM,GAAG,oBAAoB,CAQ9F"}

backend/node_modules/@azure/identity/dist/esm/msal/utils.js

@@ -0,0 +1,233 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import { AuthenticationRequiredError, CredentialUnavailableError } from "../errors.js";
+import { credentialLogger, formatError } from "../util/logging.js";
+import { DefaultAuthority, DefaultAuthorityHost, DefaultTenantId } from "../constants.js";
+import { randomUUID as coreRandomUUID, isNode, isNodeLike } from "@azure/core-util";
+import { AbortError } from "@azure/abort-controller";
+import { msalCommon } from "./msal.js";
+const logger = credentialLogger("IdentityUtils");
+/**
+ * Latest AuthenticationRecord version
+ */
+const LatestAuthenticationRecordVersion = "1.0";
+/**
+ * Ensures the validity of the MSAL token
+ * @internal
+ */
+export function ensureValidMsalToken(scopes, msalToken, getTokenOptions) {
+    const error = (message) => {
+        logger.getToken.info(message);
+        return new AuthenticationRequiredError({
+            scopes: Array.isArray(scopes) ? scopes : [scopes],
+            getTokenOptions,
+            message,
+        });
+    };
+    if (!msalToken) {
+        throw error("No response");
+    }
+    if (!msalToken.expiresOn) {
+        throw error(`Response had no "expiresOn" property.`);
+    }
+    if (!msalToken.accessToken) {
+        throw error(`Response had no "accessToken" property.`);
+    }
+}
+/**
+ * Returns the authority host from either the options bag or the AZURE_AUTHORITY_HOST environment variable.
+ *
+ * Defaults to {@link DefaultAuthorityHost}.
+ * @internal
+ */
+export function getAuthorityHost(options) {
+    let authorityHost = options?.authorityHost;
+    if (!authorityHost && isNodeLike) {
+        authorityHost = process.env.AZURE_AUTHORITY_HOST;
+    }
+    return authorityHost ?? DefaultAuthorityHost;
+}
+/**
+ * Generates a valid authority by combining a host with a tenantId.
+ * @internal
+ */
+export function getAuthority(tenantId, host) {
+    if (!host) {
+        host = DefaultAuthorityHost;
+    }
+    if (new RegExp(`${tenantId}/?$`).test(host)) {
+        return host;
+    }
+    if (host.endsWith("/")) {
+        return host + tenantId;
+    }
+    else {
+        return `${host}/${tenantId}`;
+    }
+}
+/**
+ * Generates the known authorities.
+ * If the Tenant Id is `adfs`, the authority can't be validated since the format won't match the expected one.
+ * For that reason, we have to force MSAL to disable validating the authority
+ * by sending it within the known authorities in the MSAL configuration.
+ * @internal
+ */
+export function getKnownAuthorities(tenantId, authorityHost, disableInstanceDiscovery) {
+    if ((tenantId === "adfs" && authorityHost) || disableInstanceDiscovery) {
+        return [authorityHost];
+    }
+    return [];
+}
+/**
+ * Generates a logger that can be passed to the MSAL clients.
+ * @param credLogger - The logger of the credential.
+ * @internal
+ */
+export const defaultLoggerCallback = (credLogger, platform = isNode ? "Node" : "Browser") => (level, message, containsPii) => {
+    if (containsPii) {
+        return;
+    }
+    switch (level) {
+        case msalCommon.LogLevel.Error:
+            credLogger.info(`MSAL ${platform} V2 error: ${message}`);
+            return;
+        case msalCommon.LogLevel.Info:
+            credLogger.info(`MSAL ${platform} V2 info message: ${message}`);
+            return;
+        case msalCommon.LogLevel.Verbose:
+            credLogger.info(`MSAL ${platform} V2 verbose message: ${message}`);
+            return;
+        case msalCommon.LogLevel.Warning:
+            credLogger.info(`MSAL ${platform} V2 warning: ${message}`);
+            return;
+    }
+};
+/**
+ * @internal
+ */
+export function getMSALLogLevel(logLevel) {
+    switch (logLevel) {
+        case "error":
+            return msalCommon.LogLevel.Error;
+        case "info":
+            return msalCommon.LogLevel.Info;
+        case "verbose":
+            return msalCommon.LogLevel.Verbose;
+        case "warning":
+            return msalCommon.LogLevel.Warning;
+        default:
+            // default msal logging level should be Info
+            return msalCommon.LogLevel.Info;
+    }
+}
+/**
+ * Wraps core-util's randomUUID in order to allow for mocking in tests.
+ * This prepares the library for the upcoming core-util update to ESM.
+ *
+ * @internal
+ * @returns A string containing a random UUID
+ */
+export function randomUUID() {
+    return coreRandomUUID();
+}
+/**
+ * Handles MSAL errors.
+ */
+export function handleMsalError(scopes, error, getTokenOptions) {
+    if (error.name === "AuthError" ||
+        error.name === "ClientAuthError" ||
+        error.name === "BrowserAuthError") {
+        const msalError = error;
+        switch (msalError.errorCode) {
+            case "endpoints_resolution_error":
+                logger.info(formatError(scopes, error.message));
+                return new CredentialUnavailableError(error.message);
+            case "device_code_polling_cancelled":
+                return new AbortError("The authentication has been aborted by the caller.");
+            case "consent_required":
+            case "interaction_required":
+            case "login_required":
+                logger.info(formatError(scopes, `Authentication returned errorCode ${msalError.errorCode}`));
+                break;
+            default:
+                logger.info(formatError(scopes, `Failed to acquire token: ${error.message}`));
+                break;
+        }
+    }
+    if (error.name === "ClientConfigurationError" ||
+        error.name === "BrowserConfigurationAuthError" ||
+        error.name === "AbortError" ||
+        error.name === "AuthenticationError") {
+        return error;
+    }
+    if (error.name === "NativeAuthError") {
+        logger.info(formatError(scopes, `Error from the native broker: ${error.message} with status code: ${error.statusCode}`));
+        return error;
+    }
+    return new AuthenticationRequiredError({ scopes, getTokenOptions, message: error.message });
+}
+// transformations
+export function publicToMsal(account) {
+    return {
+        localAccountId: account.homeAccountId,
+        environment: account.authority,
+        username: account.username,
+        homeAccountId: account.homeAccountId,
+        tenantId: account.tenantId,
+    };
+}
+export function msalToPublic(clientId, account) {
+    const record = {
+        authority: account.environment ?? DefaultAuthority,
+        homeAccountId: account.homeAccountId,
+        tenantId: account.tenantId || DefaultTenantId,
+        username: account.username,
+        clientId,
+        version: LatestAuthenticationRecordVersion,
+    };
+    return record;
+}
+/**
+ * Serializes an `AuthenticationRecord` into a string.
+ *
+ * The output of a serialized authentication record will contain the following properties:
+ *
+ * - "authority"
+ * - "homeAccountId"
+ * - "clientId"
+ * - "tenantId"
+ * - "username"
+ * - "version"
+ *
+ * To later convert this string to a serialized `AuthenticationRecord`, please use the exported function `deserializeAuthenticationRecord()`.
+ */
+export function serializeAuthenticationRecord(record) {
+    return JSON.stringify(record);
+}
+/**
+ * Deserializes a previously serialized authentication record from a string into an object.
+ *
+ * The input string must contain the following properties:
+ *
+ * - "authority"
+ * - "homeAccountId"
+ * - "clientId"
+ * - "tenantId"
+ * - "username"
+ * - "version"
+ *
+ * If the version we receive is unsupported, an error will be thrown.
+ *
+ * At the moment, the only available version is: "1.0", which is always set when the authentication record is serialized.
+ *
+ * @param serializedRecord - Authentication record previously serialized into string.
+ * @returns AuthenticationRecord.
+ */
+export function deserializeAuthenticationRecord(serializedRecord) {
+    const parsed = JSON.parse(serializedRecord);
+    if (parsed.version && parsed.version !== LatestAuthenticationRecordVersion) {
+        throw Error("Unsupported AuthenticationRecord version");
+    }
+    return parsed;
+}
+//# sourceMappingURL=utils.js.map