Estructura inicial del proyecto

backend/node_modules/@azure/msal-common/dist/request/AuthenticationHeaderParser.mjs

@@ -0,0 +1,64 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { HeaderNames } from '../utils/Constants.mjs';
+import { invalidAuthenticationHeader, missingNonceAuthenticationHeader } from '../error/ClientConfigurationErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * This is a helper class that parses supported HTTP response authentication headers to extract and return
+ * header challenge values that can be used outside the basic authorization flows.
+ */
+class AuthenticationHeaderParser {
+    constructor(headers) {
+        this.headers = headers;
+    }
+    /**
+     * This method parses the SHR nonce value out of either the Authentication-Info or WWW-Authenticate authentication headers.
+     * @returns
+     */
+    getShrNonce() {
+        // Attempt to parse nonce from Authentiacation-Info
+        const authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+        if (authenticationInfo) {
+            const authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
+            if (authenticationInfoChallenges.nextnonce) {
+                return authenticationInfoChallenges.nextnonce;
+            }
+            throw createClientConfigurationError(invalidAuthenticationHeader);
+        }
+        // Attempt to parse nonce from WWW-Authenticate
+        const wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+        if (wwwAuthenticate) {
+            const wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
+            if (wwwAuthenticateChallenges.nonce) {
+                return wwwAuthenticateChallenges.nonce;
+            }
+            throw createClientConfigurationError(invalidAuthenticationHeader);
+        }
+        // If neither header is present, throw missing headers error
+        throw createClientConfigurationError(missingNonceAuthenticationHeader);
+    }
+    /**
+     * Parses an HTTP header's challenge set into a key/value map.
+     * @param header
+     * @returns
+     */
+    parseChallenges(header) {
+        const schemeSeparator = header.indexOf(" ");
+        const challenges = header.substr(schemeSeparator + 1).split(",");
+        const challengeMap = {};
+        challenges.forEach((challenge) => {
+            const [key, value] = challenge.split("=");
+            // Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
+            challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
+        });
+        return challengeMap;
+    }
+}
+
+export { AuthenticationHeaderParser };
+//# sourceMappingURL=AuthenticationHeaderParser.mjs.map

backend/node_modules/@azure/msal-common/dist/request/AuthenticationHeaderParser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationHeaderParser.mjs","sources":["../../src/request/AuthenticationHeaderParser.ts"],"sourcesContent":[null],"names":["ClientConfigurationErrorCodes.invalidAuthenticationHeader","ClientConfigurationErrorCodes.missingNonceAuthenticationHeader"],"mappings":";;;;;;AAAA;;;AAGG;AAgBH;;;AAGG;MACU,0BAA0B,CAAA;AAGnC,IAAA,WAAA,CAAY,OAA+B,EAAA;AACvC,QAAA,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;KAC1B;AAED;;;AAGG;IACH,WAAW,GAAA;;QAEP,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;AACxE,QAAA,IAAI,kBAAkB,EAAE;YACpB,MAAM,4BAA4B,GAC9B,IAAI,CAAC,eAAe,CAChB,kBAAkB,CACrB,CAAC;YACN,IAAI,4BAA4B,CAAC,SAAS,EAAE;gBACxC,OAAO,4BAA4B,CAAC,SAAS,CAAC;AACjD,aAAA;AACD,YAAA,MAAM,8BAA8B,CAChCA,2BAAyD,CAC5D,CAAC;AACL,SAAA;;QAGD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;AAClE,QAAA,IAAI,eAAe,EAAE;YACjB,MAAM,yBAAyB,GAC3B,IAAI,CAAC,eAAe,CAChB,eAAe,CAClB,CAAC;YACN,IAAI,yBAAyB,CAAC,KAAK,EAAE;gBACjC,OAAO,yBAAyB,CAAC,KAAK,CAAC;AAC1C,aAAA;AACD,YAAA,MAAM,8BAA8B,CAChCA,2BAAyD,CAC5D,CAAC;AACL,SAAA;;AAGD,QAAA,MAAM,8BAA8B,CAChCC,gCAA8D,CACjE,CAAC;KACL;AAED;;;;AAIG;AACK,IAAA,eAAe,CAAI,MAAc,EAAA;QACrC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC5C,QAAA,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,EAAO,CAAC;AAE7B,QAAA,UAAU,CAAC,OAAO,CAAC,CAAC,SAAiB,KAAI;AACrC,YAAA,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;;AAE1C,YAAA,YAAY,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9D,SAAC,CAAC,CAAC;AAEH,QAAA,OAAO,YAAY,CAAC;KACvB;AACJ;;;;"}

backend/node_modules/@azure/msal-common/dist/request/BaseAuthRequest.mjs

@@ -0,0 +1,38 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
+ * If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
+ * This is used for MCP flows.
+ * @param isMcp - Flag indicating if application is an MCP app, from configuration
+ * @param request - Auth request
+ */
+function enforceResourceParameter(isMcp, request) {
+    if (!isMcp) {
+        return;
+    }
+    if (request.resource &&
+        (containsResourceParam(request.extraParameters) ||
+            containsResourceParam(request.extraQueryParameters))) {
+        throw createClientAuthError(misplacedResourceParam);
+    }
+    if (!request.resource) {
+        throw createClientAuthError(resourceParameterRequired);
+    }
+}
+function containsResourceParam(params) {
+    if (!params) {
+        return false;
+    }
+    return Object.prototype.hasOwnProperty.call(params, "resource");
+}
+
+export { enforceResourceParameter };
+//# sourceMappingURL=BaseAuthRequest.mjs.map

backend/node_modules/@azure/msal-common/dist/request/BaseAuthRequest.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseAuthRequest.mjs","sources":["../../src/request/BaseAuthRequest.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.misplacedResourceParam","ClientAuthErrorCodes.resourceParameterRequired"],"mappings":";;;;;AAAA;;;AAGG;AA4GH;;;;;;AAMG;AACa,SAAA,wBAAwB,CACpC,KAAc,EACd,OAAiC,EAAA;IAEjC,IAAI,CAAC,KAAK,EAAE;QACR,OAAO;AACV,KAAA;IAED,IACI,OAAO,CAAC,QAAQ;AAChB,SAAC,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;AAC3C,YAAA,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,EAC1D;AACE,QAAA,MAAM,qBAAqB,CACvBA,sBAA2C,CAC9C,CAAC;AACL,KAAA;AAED,IAAA,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;AACnB,QAAA,MAAM,qBAAqB,CACvBC,yBAA8C,CACjD,CAAC;AACL,KAAA;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAmB,EAAA;IAC9C,IAAI,CAAC,MAAM,EAAE;AACT,QAAA,OAAO,KAAK,CAAC;AAChB,KAAA;AAED,IAAA,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACpE;;;;"}

backend/node_modules/@azure/msal-common/dist/request/RequestParameterBuilder.mjs

@@ -0,0 +1,433 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { OIDC_DEFAULT_SCOPES, ResponseMode, HeaderNames, CLIENT_INFO, ClaimsRequestKeys, PasswordGrantConstants, AuthenticationScheme, X_MS_LIB_CAPABILITY_VALUE } from '../utils/Constants.mjs';
+import { CLIENT_ID, BROKER_CLIENT_ID, REDIRECT_URI, RESPONSE_TYPE, RESPONSE_MODE, NATIVE_BROKER, SCOPE, POST_LOGOUT_URI, ID_TOKEN_HINT, DOMAIN_HINT, LOGIN_HINT, SID, CLAIMS, CLIENT_REQUEST_ID, X_CLIENT_SKU, X_CLIENT_VER, X_CLIENT_OS, X_CLIENT_CPU, X_APP_NAME, X_APP_VER, PROMPT, STATE, NONCE, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE, DEVICE_CODE, REFRESH_TOKEN, CODE_VERIFIER, CLIENT_SECRET, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, OBO_ASSERTION, REQUESTED_TOKEN_USE, GRANT_TYPE, CLI_DATA, INSTANCE_AWARE, TOKEN_TYPE, REQ_CNF, X_CLIENT_CURR_TELEM, X_CLIENT_LAST_TELEM, X_MS_LIB_CAPABILITY, LOGOUT_HINT, BROKER_REDIRECT_URI, EAR_JWK, EAR_JWE_CRYPTO, RESOURCE } from '../constants/AADServerParamKeys.mjs';
+import { ScopeSet } from './ScopeSet.mjs';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { StringUtils } from '../utils/StringUtils.mjs';
+import { invalidClaims, pkceParamsMissing } from '../error/ClientConfigurationErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function instrumentBrokerParams(parameters, correlationId, performanceClient) {
+    if (!correlationId) {
+        return;
+    }
+    const clientId = parameters.get(CLIENT_ID);
+    if (clientId && parameters.has(BROKER_CLIENT_ID)) {
+        performanceClient?.addFields({
+            embeddedClientId: clientId,
+            embeddedRedirectUri: parameters.get(REDIRECT_URI),
+        }, correlationId);
+    }
+}
+/**
+ * Add the given response_type
+ * @param parameters
+ * @param responseType
+ */
+function addResponseType(parameters, responseType) {
+    parameters.set(RESPONSE_TYPE, responseType);
+}
+/**
+ * add response_mode. defaults to query.
+ * @param responseMode
+ */
+function addResponseMode(parameters, responseMode) {
+    parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode.QUERY);
+}
+/**
+ * Add flag to indicate STS should attempt to use WAM if available
+ */
+function addNativeBroker(parameters) {
+    parameters.set(NATIVE_BROKER, "1");
+}
+/**
+ * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
+ * @param scopeSet
+ * @param addOidcScopes
+ */
+function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+    // Always add openid to the scopes when adding OIDC scopes
+    if (addOidcScopes &&
+        !defaultScopes.includes("openid") &&
+        !scopes.includes("openid")) {
+        defaultScopes.push("openid");
+    }
+    const requestScopes = addOidcScopes
+        ? [...(scopes || []), ...defaultScopes]
+        : scopes || [];
+    const scopeSet = new ScopeSet(requestScopes);
+    parameters.set(SCOPE, scopeSet.printScopes());
+}
+/**
+ * add clientId
+ * @param clientId
+ */
+function addClientId(parameters, clientId) {
+    parameters.set(CLIENT_ID, clientId);
+}
+/**
+ * add redirect_uri
+ * @param redirectUri
+ */
+function addRedirectUri(parameters, redirectUri) {
+    parameters.set(REDIRECT_URI, redirectUri);
+}
+/**
+ * add post logout redirectUri
+ * @param redirectUri
+ */
+function addPostLogoutRedirectUri(parameters, redirectUri) {
+    parameters.set(POST_LOGOUT_URI, redirectUri);
+}
+/**
+ * add id_token_hint to logout request
+ * @param idTokenHint
+ */
+function addIdTokenHint(parameters, idTokenHint) {
+    parameters.set(ID_TOKEN_HINT, idTokenHint);
+}
+/**
+ * add domain_hint
+ * @param domainHint
+ */
+function addDomainHint(parameters, domainHint) {
+    parameters.set(DOMAIN_HINT, domainHint);
+}
+/**
+ * add login_hint
+ * @param loginHint
+ */
+function addLoginHint(parameters, loginHint) {
+    parameters.set(LOGIN_HINT, loginHint);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for login_hint
+ * @param loginHint
+ */
+function addCcsUpn(parameters, loginHint) {
+    parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
+}
+/**
+ * Adds the CCS (Cache Credential Service) query parameter for account object
+ * @param loginHint
+ */
+function addCcsOid(parameters, clientInfo) {
+    parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
+}
+/**
+ * add sid
+ * @param sid
+ */
+function addSid(parameters, sid) {
+    parameters.set(SID, sid);
+}
+/**
+ * Adds claims to request parameters, conditionally excluding clientCapabilities
+ * when skipBrokerClaims is true and a brokered flow is in effect.
+ * @param parameters - The request parameters map
+ * @param claims - The claims string from the request
+ * @param clientCapabilities - The client capabilities from configuration
+ * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+ */
+function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+    // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
+    const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
+        ? undefined
+        : clientCapabilities;
+    if (!StringUtils.isEmptyObj(claims) ||
+        (configClaims && configClaims.length > 0)) {
+        const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
+        try {
+            JSON.parse(mergedClaims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+        parameters.set(CLAIMS, mergedClaims);
+    }
+}
+/**
+ * add correlationId
+ * @param correlationId
+ */
+function addCorrelationId(parameters, correlationId) {
+    parameters.set(CLIENT_REQUEST_ID, correlationId);
+}
+/**
+ * add library info query params
+ * @param libraryInfo
+ */
+function addLibraryInfo(parameters, libraryInfo) {
+    // Telemetry Info
+    parameters.set(X_CLIENT_SKU, libraryInfo.sku);
+    parameters.set(X_CLIENT_VER, libraryInfo.version);
+    if (libraryInfo.os) {
+        parameters.set(X_CLIENT_OS, libraryInfo.os);
+    }
+    if (libraryInfo.cpu) {
+        parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
+    }
+}
+/**
+ * Add client telemetry parameters
+ * @param appTelemetry
+ */
+function addApplicationTelemetry(parameters, appTelemetry) {
+    if (appTelemetry?.appName) {
+        parameters.set(X_APP_NAME, appTelemetry.appName);
+    }
+    if (appTelemetry?.appVersion) {
+        parameters.set(X_APP_VER, appTelemetry.appVersion);
+    }
+}
+/**
+ * add prompt
+ * @param prompt
+ */
+function addPrompt(parameters, prompt) {
+    parameters.set(PROMPT, prompt);
+}
+/**
+ * add state
+ * @param state
+ */
+function addState(parameters, state) {
+    if (state) {
+        parameters.set(STATE, state);
+    }
+}
+/**
+ * add nonce
+ * @param nonce
+ */
+function addNonce(parameters, nonce) {
+    parameters.set(NONCE, nonce);
+}
+/**
+ * add code_challenge and code_challenge_method
+ * - throw if either of them are not passed
+ * @param codeChallenge
+ * @param codeChallengeMethod
+ */
+function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
+    if (codeChallenge && codeChallengeMethod) {
+        parameters.set(CODE_CHALLENGE, codeChallenge);
+        parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
+    }
+    else {
+        throw createClientConfigurationError(pkceParamsMissing);
+    }
+}
+/**
+ * add the `authorization_code` passed by the user to exchange for a token
+ * @param code
+ */
+function addAuthorizationCode(parameters, code) {
+    parameters.set(CODE, code);
+}
+/**
+ * add the `authorization_code` passed by the user to exchange for a token
+ * @param code
+ */
+function addDeviceCode(parameters, code) {
+    parameters.set(DEVICE_CODE, code);
+}
+/**
+ * add the `refreshToken` passed by the user
+ * @param refreshToken
+ */
+function addRefreshToken(parameters, refreshToken) {
+    parameters.set(REFRESH_TOKEN, refreshToken);
+}
+/**
+ * add the `code_verifier` passed by the user to exchange for a token
+ * @param codeVerifier
+ */
+function addCodeVerifier(parameters, codeVerifier) {
+    parameters.set(CODE_VERIFIER, codeVerifier);
+}
+/**
+ * add client_secret
+ * @param clientSecret
+ */
+function addClientSecret(parameters, clientSecret) {
+    parameters.set(CLIENT_SECRET, clientSecret);
+}
+/**
+ * add clientAssertion for confidential client flows
+ * @param clientAssertion
+ */
+function addClientAssertion(parameters, clientAssertion) {
+    if (clientAssertion) {
+        parameters.set(CLIENT_ASSERTION, clientAssertion);
+    }
+}
+/**
+ * add clientAssertionType for confidential client flows
+ * @param clientAssertionType
+ */
+function addClientAssertionType(parameters, clientAssertionType) {
+    if (clientAssertionType) {
+        parameters.set(CLIENT_ASSERTION_TYPE, clientAssertionType);
+    }
+}
+/**
+ * add OBO assertion for confidential client flows
+ * @param clientAssertion
+ */
+function addOboAssertion(parameters, oboAssertion) {
+    parameters.set(OBO_ASSERTION, oboAssertion);
+}
+/**
+ * add grant type
+ * @param grantType
+ */
+function addRequestTokenUse(parameters, tokenUse) {
+    parameters.set(REQUESTED_TOKEN_USE, tokenUse);
+}
+/**
+ * add grant type
+ * @param grantType
+ */
+function addGrantType(parameters, grantType) {
+    parameters.set(GRANT_TYPE, grantType);
+}
+/**
+ * add client info
+ *
+ */
+function addClientInfo(parameters) {
+    parameters.set(CLIENT_INFO, "1");
+}
+/**
+ * add clidata=1 to request to indicate client data support
+ */
+function addCliData(parameters) {
+    parameters.set(CLI_DATA, "1");
+}
+function addInstanceAware(parameters) {
+    if (!parameters.has(INSTANCE_AWARE)) {
+        parameters.set(INSTANCE_AWARE, "true");
+    }
+}
+/**
+ * Add extraParameters
+ * @param extraParams - String dictionary containing extra parameters to be added.
+ */
+function addExtraParameters(parameters, extraParams) {
+    Object.entries(extraParams).forEach(([key, value]) => {
+        if (!parameters.has(key) && value) {
+            parameters.set(key, value);
+        }
+    });
+}
+function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+    let mergedClaims;
+    // Parse provided claims into JSON object or initialize empty object
+    if (!claims) {
+        mergedClaims = {};
+    }
+    else {
+        try {
+            mergedClaims = JSON.parse(claims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+    }
+    if (clientCapabilities && clientCapabilities.length > 0) {
+        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+            // Add access_token key to claims object
+            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
+        }
+        // Add xms_cc claim with provided clientCapabilities to access_token key
+        mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] = {
+            values: clientCapabilities,
+        };
+    }
+    return JSON.stringify(mergedClaims);
+}
+/**
+ * adds `username` for Password Grant flow
+ * @param username
+ */
+function addUsername(parameters, username) {
+    parameters.set(PasswordGrantConstants.username, username);
+}
+/**
+ * adds `password` for Password Grant flow
+ * @param password
+ */
+function addPassword(parameters, password) {
+    parameters.set(PasswordGrantConstants.password, password);
+}
+/**
+ * add pop_jwk to query params
+ * @param cnfString
+ */
+function addPopToken(parameters, cnfString) {
+    if (cnfString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
+        parameters.set(REQ_CNF, cnfString);
+    }
+}
+/**
+ * add SSH JWK and key ID to query params
+ */
+function addSshJwk(parameters, sshJwkString) {
+    if (sshJwkString) {
+        parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
+        parameters.set(REQ_CNF, sshJwkString);
+    }
+}
+/**
+ * add server telemetry fields
+ * @param serverTelemetryManager
+ */
+function addServerTelemetry(parameters, serverTelemetryManager) {
+    parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+    parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+}
+/**
+ * Adds parameter that indicates to the server that throttling is supported
+ */
+function addThrottling(parameters) {
+    parameters.set(X_MS_LIB_CAPABILITY, X_MS_LIB_CAPABILITY_VALUE);
+}
+/**
+ * Adds logout_hint parameter for "silent" logout which prevent server account picker
+ */
+function addLogoutHint(parameters, logoutHint) {
+    parameters.set(LOGOUT_HINT, logoutHint);
+}
+function addBrokerParameters(parameters, brokerClientId, brokerRedirectUri) {
+    if (!parameters.has(BROKER_CLIENT_ID)) {
+        parameters.set(BROKER_CLIENT_ID, brokerClientId);
+    }
+    if (!parameters.has(BROKER_REDIRECT_URI)) {
+        parameters.set(BROKER_REDIRECT_URI, brokerRedirectUri);
+    }
+}
+/**
+ * Add EAR (Encrypted Authorize Response) request parameters
+ * @param parameters
+ * @param jwk
+ */
+function addEARParameters(parameters, jwk) {
+    parameters.set(EAR_JWK, encodeURIComponent(jwk));
+    // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
+    const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
+    parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+function addResource(parameters, resource) {
+    if (resource) {
+        parameters.set(RESOURCE, resource);
+    }
+}
+
+export { addApplicationTelemetry, addAuthorizationCode, addBrokerParameters, addCcsOid, addCcsUpn, addClaims, addCliData, addClientAssertion, addClientAssertionType, addClientCapabilitiesToClaims, addClientId, addClientInfo, addClientSecret, addCodeChallengeParams, addCodeVerifier, addCorrelationId, addDeviceCode, addDomainHint, addEARParameters, addExtraParameters, addGrantType, addIdTokenHint, addInstanceAware, addLibraryInfo, addLoginHint, addLogoutHint, addNativeBroker, addNonce, addOboAssertion, addPassword, addPopToken, addPostLogoutRedirectUri, addPrompt, addRedirectUri, addRefreshToken, addRequestTokenUse, addResource, addResponseMode, addResponseType, addScopes, addServerTelemetry, addSid, addSshJwk, addState, addThrottling, addUsername, instrumentBrokerParams };
+//# sourceMappingURL=RequestParameterBuilder.mjs.map

backend/node_modules/@azure/msal-common/dist/request/ScopeSet.mjs

@@ -0,0 +1,204 @@
+/*! @azure/msal-common v16.6.2 2026-05-19 */
+'use strict';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { StringUtils } from '../utils/StringUtils.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { OIDC_DEFAULT_SCOPES, OFFLINE_ACCESS_SCOPE, OIDC_SCOPES } from '../utils/Constants.mjs';
+import { emptyInputScopesError } from '../error/ClientConfigurationErrorCodes.mjs';
+import { cannotAppendScopeSet, cannotRemoveEmptyScope, emptyInputScopeSet } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
+ * the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions
+ * to ensure uniqueness of strings.
+ */
+class ScopeSet {
+    constructor(inputScopes) {
+        // Filter empty string and null/undefined array items
+        const scopeArr = inputScopes
+            ? StringUtils.trimArrayEntries([...inputScopes])
+            : [];
+        const filteredInput = scopeArr
+            ? StringUtils.removeEmptyStringsFromArray(scopeArr)
+            : [];
+        // Check if scopes array has at least one member
+        if (!filteredInput || !filteredInput.length) {
+            throw createClientConfigurationError(emptyInputScopesError);
+        }
+        this.scopes = new Set(); // Iterator in constructor not supported by IE11
+        filteredInput.forEach((scope) => this.scopes.add(scope));
+    }
+    /**
+     * Factory method to create ScopeSet from space-delimited string
+     * @param inputScopeString
+     * @param appClientId
+     * @param scopesRequired
+     */
+    static fromString(inputScopeString) {
+        const scopeString = inputScopeString || "";
+        const inputScopes = scopeString.split(" ");
+        return new ScopeSet(inputScopes);
+    }
+    /**
+     * Creates the set of scopes to search for in cache lookups
+     * @param inputScopeString
+     * @returns
+     */
+    static createSearchScopes(inputScopeString) {
+        // Handle empty scopes by using default OIDC scopes for cache lookup
+        const scopesToUse = inputScopeString && inputScopeString.length > 0
+            ? inputScopeString
+            : [...OIDC_DEFAULT_SCOPES];
+        const scopeSet = new ScopeSet(scopesToUse);
+        if (!scopeSet.containsOnlyOIDCScopes()) {
+            scopeSet.removeOIDCScopes();
+        }
+        else {
+            scopeSet.removeScope(OFFLINE_ACCESS_SCOPE);
+        }
+        return scopeSet;
+    }
+    /**
+     * Check if a given scope is present in this set of scopes.
+     * @param scope
+     */
+    containsScope(scope) {
+        const lowerCaseScopes = this.printScopesLowerCase().split(" ");
+        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
+        // compare lowercase scopes
+        return scope
+            ? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
+            : false;
+    }
+    /**
+     * Check if a set of scopes is present in this set of scopes.
+     * @param scopeSet
+     */
+    containsScopeSet(scopeSet) {
+        if (!scopeSet || scopeSet.scopes.size <= 0) {
+            return false;
+        }
+        return (this.scopes.size >= scopeSet.scopes.size &&
+            scopeSet.asArray().every((scope) => this.containsScope(scope)));
+    }
+    /**
+     * Check if set of scopes contains only the defaults
+     */
+    containsOnlyOIDCScopes() {
+        let defaultScopeCount = 0;
+        OIDC_SCOPES.forEach((defaultScope) => {
+            if (this.containsScope(defaultScope)) {
+                defaultScopeCount += 1;
+            }
+        });
+        return this.scopes.size === defaultScopeCount;
+    }
+    /**
+     * Appends single scope if passed
+     * @param newScope
+     */
+    appendScope(newScope) {
+        if (newScope) {
+            this.scopes.add(newScope.trim());
+        }
+    }
+    /**
+     * Appends multiple scopes if passed
+     * @param newScopes
+     */
+    appendScopes(newScopes) {
+        try {
+            newScopes.forEach((newScope) => this.appendScope(newScope));
+        }
+        catch (e) {
+            throw createClientAuthError(cannotAppendScopeSet);
+        }
+    }
+    /**
+     * Removes element from set of scopes.
+     * @param scope
+     */
+    removeScope(scope) {
+        if (!scope) {
+            throw createClientAuthError(cannotRemoveEmptyScope);
+        }
+        this.scopes.delete(scope.trim());
+    }
+    /**
+     * Removes default scopes from set of scopes
+     * Primarily used to prevent cache misses if the default scopes are not returned from the server
+     */
+    removeOIDCScopes() {
+        OIDC_SCOPES.forEach((defaultScope) => {
+            this.scopes.delete(defaultScope);
+        });
+    }
+    /**
+     * Combines an array of scopes with the current set of scopes.
+     * @param otherScopes
+     */
+    unionScopeSets(otherScopes) {
+        if (!otherScopes) {
+            throw createClientAuthError(emptyInputScopeSet);
+        }
+        const unionScopes = new Set(); // Iterator in constructor not supported in IE11
+        otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
+        this.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
+        return unionScopes;
+    }
+    /**
+     * Check if scopes intersect between this set and another.
+     * @param otherScopes
+     */
+    intersectingScopeSets(otherScopes) {
+        if (!otherScopes) {
+            throw createClientAuthError(emptyInputScopeSet);
+        }
+        // Do not allow OIDC scopes to be the only intersecting scopes
+        if (!otherScopes.containsOnlyOIDCScopes()) {
+            otherScopes.removeOIDCScopes();
+        }
+        const unionScopes = this.unionScopeSets(otherScopes);
+        const sizeOtherScopes = otherScopes.getScopeCount();
+        const sizeThisScopes = this.getScopeCount();
+        const sizeUnionScopes = unionScopes.size;
+        return sizeUnionScopes < sizeThisScopes + sizeOtherScopes;
+    }
+    /**
+     * Returns size of set of scopes.
+     */
+    getScopeCount() {
+        return this.scopes.size;
+    }
+    /**
+     * Returns the scopes as an array of string values
+     */
+    asArray() {
+        const array = [];
+        this.scopes.forEach((val) => array.push(val));
+        return array;
+    }
+    /**
+     * Prints scopes into a space-delimited string
+     */
+    printScopes() {
+        if (this.scopes) {
+            const scopeArr = this.asArray();
+            return scopeArr.join(" ");
+        }
+        return "";
+    }
+    /**
+     * Prints scopes into a space-delimited lower-case string (used for caching)
+     */
+    printScopesLowerCase() {
+        return this.printScopes().toLowerCase();
+    }
+}
+
+export { ScopeSet };
+//# sourceMappingURL=ScopeSet.mjs.map

backend/node_modules/@azure/msal-common/dist/request/ScopeSet.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopeSet.mjs","sources":["../../src/request/ScopeSet.ts"],"sourcesContent":[null],"names":["ClientConfigurationErrorCodes.emptyInputScopesError","ClientAuthErrorCodes.cannotAppendScopeSet","ClientAuthErrorCodes.cannotRemoveEmptyScope","ClientAuthErrorCodes.emptyInputScopeSet"],"mappings":";;;;;;;;;AAAA;;;AAGG;AAiBH;;;;AAIG;MACU,QAAQ,CAAA;AAIjB,IAAA,WAAA,CAAY,WAA0B,EAAA;;QAElC,MAAM,QAAQ,GAAG,WAAW;cACtB,WAAW,CAAC,gBAAgB,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;cAC9C,EAAE,CAAC;QACT,MAAM,aAAa,GAAG,QAAQ;AAC1B,cAAE,WAAW,CAAC,2BAA2B,CAAC,QAAQ,CAAC;cACjD,EAAE,CAAC;;AAGT,QAAA,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;AACzC,YAAA,MAAM,8BAA8B,CAChCA,qBAAmD,CACtD,CAAC;AACL,SAAA;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;AAChC,QAAA,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;KAC5D;AAED;;;;;AAKG;IACH,OAAO,UAAU,CAAC,gBAAwB,EAAA;AACtC,QAAA,MAAM,WAAW,GAAG,gBAAgB,IAAI,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAkB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1D,QAAA,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;KACpC;AAED;;;;AAIG;IACH,OAAO,kBAAkB,CAAC,gBAA+B,EAAA;;QAErD,MAAM,WAAW,GACb,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;AAC3C,cAAE,gBAAgB;AAClB,cAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC;AAEnC,QAAA,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3C,QAAA,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE;YACpC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;AAC/B,SAAA;AAAM,aAAA;AACH,YAAA,QAAQ,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAC9C,SAAA;AAED,QAAA,OAAO,QAAQ,CAAC;KACnB;AAED;;;AAGG;AACH,IAAA,aAAa,CAAC,KAAa,EAAA;QACvB,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC/D,QAAA,MAAM,kBAAkB,GAAG,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;;AAEzD,QAAA,OAAO,KAAK;cACN,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;cAClD,KAAK,CAAC;KACf;AAED;;;AAGG;AACH,IAAA,gBAAgB,CAAC,QAAkB,EAAA;QAC/B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE;AACxC,YAAA,OAAO,KAAK,CAAC;AAChB,SAAA;QAED,QACI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI;AACxC,YAAA,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAChE;KACL;AAED;;AAEG;IACH,sBAAsB,GAAA;QAClB,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAC1B,QAAA,WAAW,CAAC,OAAO,CAAC,CAAC,YAAoB,KAAI;AACzC,YAAA,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE;gBAClC,iBAAiB,IAAI,CAAC,CAAC;AAC1B,aAAA;AACL,SAAC,CAAC,CAAC;AAEH,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,CAAC;KACjD;AAED;;;AAGG;AACH,IAAA,WAAW,CAAC,QAAgB,EAAA;AACxB,QAAA,IAAI,QAAQ,EAAE;YACV,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AACpC,SAAA;KACJ;AAED;;;AAGG;AACH,IAAA,YAAY,CAAC,SAAwB,EAAA;QACjC,IAAI;AACA,YAAA,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,SAAA;AAAC,QAAA,OAAO,CAAC,EAAE;AACR,YAAA,MAAM,qBAAqB,CACvBC,oBAAyC,CAC5C,CAAC;AACL,SAAA;KACJ;AAED;;;AAGG;AACH,IAAA,WAAW,CAAC,KAAa,EAAA;QACrB,IAAI,CAAC,KAAK,EAAE;AACR,YAAA,MAAM,qBAAqB,CACvBC,sBAA2C,CAC9C,CAAC;AACL,SAAA;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;KACpC;AAED;;;AAGG;IACH,gBAAgB,GAAA;AACZ,QAAA,WAAW,CAAC,OAAO,CAAC,CAAC,YAAoB,KAAI;AACzC,YAAA,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACrC,SAAC,CAAC,CAAC;KACN;AAED;;;AAGG;AACH,IAAA,cAAc,CAAC,WAAqB,EAAA;QAChC,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,MAAM,qBAAqB,CACvBC,kBAAuC,CAC1C,CAAC;AACL,SAAA;AACD,QAAA,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,KAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACrE,QAAA,OAAO,WAAW,CAAC;KACtB;AAED;;;AAGG;AACH,IAAA,qBAAqB,CAAC,WAAqB,EAAA;QACvC,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,MAAM,qBAAqB,CACvBA,kBAAuC,CAC1C,CAAC;AACL,SAAA;;AAGD,QAAA,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,EAAE;YACvC,WAAW,CAAC,gBAAgB,EAAE,CAAC;AAClC,SAAA;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;AACrD,QAAA,MAAM,eAAe,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;AACpD,QAAA,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;AAC5C,QAAA,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC;AACzC,QAAA,OAAO,eAAe,GAAG,cAAc,GAAG,eAAe,CAAC;KAC7D;AAED;;AAEG;IACH,aAAa,GAAA;AACT,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;KAC3B;AAED;;AAEG;IACH,OAAO,GAAA;QACH,MAAM,KAAK,GAAkB,EAAE,CAAC;AAChC,QAAA,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9C,QAAA,OAAO,KAAK,CAAC;KAChB;AAED;;AAEG;IACH,WAAW,GAAA;QACP,IAAI,IAAI,CAAC,MAAM,EAAE;AACb,YAAA,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;AAChC,YAAA,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,SAAA;AACD,QAAA,OAAO,EAAE,CAAC;KACb;AAED;;AAEG;IACH,oBAAoB,GAAA;AAChB,QAAA,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;KAC3C;AACJ;;;;"}