basant307/AI_Governance_Project
048
1/*! @azure/msal-node v5.2.3 2026-06-05 */2'use strict';3'use strict';4 5var node_crypto = require('node:crypto');6var crypto = require('crypto');7var jwt = require('jsonwebtoken');8var http = require('http');9var fs = require('fs');10var path = require('path');11 12/*
13 * Copyright (c) Microsoft Corporation. All rights reserved.
14 * Licensed under the MIT License.
15 */
16/**
17 * This class serializes cache entities to be saved into in-memory object types defined internally
18 * @internal
19 */
20class Serializer {
21 /**
22 * serialize the JSON blob
23 * @param data - JSON blob cache
24 */
25 static serializeJSONBlob(data) {
26 return JSON.stringify(data);
27 }
28 /**
29 * Serialize Accounts
30 * @param accCache - cache of accounts
31 */
32 static serializeAccounts(accCache) {
33 const accounts = {};
34 Object.keys(accCache).map(function (key) {
35 const accountEntity = accCache[key];
36 accounts[key] = {
37 home_account_id: accountEntity.homeAccountId,
38 environment: accountEntity.environment,
39 realm: accountEntity.realm,
40 local_account_id: accountEntity.localAccountId,
41 username: accountEntity.username,
42 authority_type: accountEntity.authorityType,
43 name: accountEntity.name,
44 client_info: accountEntity.clientInfo,
45 last_modification_time: accountEntity.lastModificationTime,
46 last_modification_app: accountEntity.lastModificationApp,
47 tenantProfiles: accountEntity.tenantProfiles?.map((tenantProfile) => {
48 return JSON.stringify(tenantProfile);
49 }),
50 };
51 });
52 return accounts;
53 }
54 /**
55 * Serialize IdTokens
56 * @param idTCache - cache of ID tokens
57 */
58 static serializeIdTokens(idTCache) {
59 const idTokens = {};
60 Object.keys(idTCache).map(function (key) {
61 const idTEntity = idTCache[key];
62 idTokens[key] = {
63 home_account_id: idTEntity.homeAccountId,
64 environment: idTEntity.environment,
65 credential_type: idTEntity.credentialType,
66 client_id: idTEntity.clientId,
67 secret: idTEntity.secret,
68 realm: idTEntity.realm,
69 };
70 });
71 return idTokens;
72 }
73 /**
74 * Serializes AccessTokens
75 * @param atCache - cache of access tokens
76 */
77 static serializeAccessTokens(atCache) {
78 const accessTokens = {};
79 Object.keys(atCache).map(function (key) {
80 const atEntity = atCache[key];
81 accessTokens[key] = {
82 home_account_id: atEntity.homeAccountId,
83 environment: atEntity.environment,
84 credential_type: atEntity.credentialType,
85 client_id: atEntity.clientId,
86 secret: atEntity.secret,
87 realm: atEntity.realm,
88 target: atEntity.target,
89 cached_at: atEntity.cachedAt,
90 expires_on: atEntity.expiresOn,
91 extended_expires_on: atEntity.extendedExpiresOn,
92 refresh_on: atEntity.refreshOn,
93 key_id: atEntity.keyId,
94 token_type: atEntity.tokenType,
95 userAssertionHash: atEntity.userAssertionHash,
96 resource: atEntity.resource,
97 };
98 });
99 return accessTokens;
100 }
101 /**
102 * Serialize refreshTokens
103 * @param rtCache - cache of refresh tokens
104 */
105 static serializeRefreshTokens(rtCache) {
106 const refreshTokens = {};
107 Object.keys(rtCache).map(function (key) {
108 const rtEntity = rtCache[key];
109 refreshTokens[key] = {
110 home_account_id: rtEntity.homeAccountId,
111 environment: rtEntity.environment,
112 credential_type: rtEntity.credentialType,
113 client_id: rtEntity.clientId,
114 secret: rtEntity.secret,
115 family_id: rtEntity.familyId,
116 target: rtEntity.target,
117 realm: rtEntity.realm,
118 };
119 });
120 return refreshTokens;
121 }
122 /**
123 * Serialize amdtCache
124 * @param amdtCache - cache of app metadata
125 */
126 static serializeAppMetadata(amdtCache) {
127 const appMetadata = {};
128 Object.keys(amdtCache).map(function (key) {
129 const amdtEntity = amdtCache[key];
130 appMetadata[key] = {
131 client_id: amdtEntity.clientId,
132 environment: amdtEntity.environment,
133 family_id: amdtEntity.familyId,
134 };
135 });
136 return appMetadata;
137 }
138 /**
139 * Serialize the cache
140 * @param inMemCache - itemised cache read from the JSON
141 */
142 static serializeAllCache(inMemCache) {
143 return {
144 Account: this.serializeAccounts(inMemCache.accounts),
145 IdToken: this.serializeIdTokens(inMemCache.idTokens),
146 AccessToken: this.serializeAccessTokens(inMemCache.accessTokens),
147 RefreshToken: this.serializeRefreshTokens(inMemCache.refreshTokens),
148 AppMetadata: this.serializeAppMetadata(inMemCache.appMetadata),
149 };
150 }
151}152 153/*! @azure/msal-common v16.7.0 2026-06-05 */154/*
155 * Copyright (c) Microsoft Corporation. All rights reserved.
156 * Licensed under the MIT License.
157 */
158const SKU = "msal.js.common";
159// default authority
160const DEFAULT_AUTHORITY = "https://login.microsoftonline.com/common/";
161const DEFAULT_AUTHORITY_HOST = "login.microsoftonline.com";
162const DEFAULT_COMMON_TENANT = "common";
163// ADFS String
164const ADFS = "adfs";
165const DSTS = "dstsv2";
166// Default AAD Instance Discovery Endpoint
167const AAD_INSTANCE_DISCOVERY_ENDPT = `${DEFAULT_AUTHORITY}discovery/instance?api-version=1.1&authorization_endpoint=`;
168// CIAM URL
169const CIAM_AUTH_URL = ".ciamlogin.com";
170const AAD_TENANT_DOMAIN_SUFFIX = ".onmicrosoft.com";
171// Resource delimiter - used for certain cache entries
172const RESOURCE_DELIM = "|";
173// Default scopes
174const OPENID_SCOPE = "openid";
175const PROFILE_SCOPE = "profile";
176const OFFLINE_ACCESS_SCOPE = "offline_access";
177const EMAIL_SCOPE = "email";
178const URL_FORM_CONTENT_TYPE = "application/x-www-form-urlencoded;charset=utf-8";
179const AUTHORIZATION_PENDING = "authorization_pending";
180const NOT_APPLICABLE = "N/A";
181const NOT_AVAILABLE = "Not Available";
182const FORWARD_SLASH = "/";
183const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute/location";
184const IMDS_VERSION = "2020-06-01";
185const IMDS_TIMEOUT = 2000;
186const AZURE_REGION_AUTO_DISCOVER_FLAG = "TryAutoDetect";
187const REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX = "login.microsoft.com";
188const KNOWN_PUBLIC_CLOUDS = [
189 "login.microsoftonline.com",
190 "login.windows.net",
191 "login.microsoft.com",
192 "sts.windows.net",
193];
194const INVALID_INSTANCE = "invalid_instance";
195const HTTP_SUCCESS = 200;
196const HTTP_REDIRECT = 302;
197const HTTP_CLIENT_ERROR_RANGE_START = 400;
198const HTTP_BAD_REQUEST = 400;
199const HTTP_UNAUTHORIZED = 401;
200const HTTP_NOT_FOUND = 404;
201const HTTP_REQUEST_TIMEOUT = 408;
202const HTTP_GONE = 410;
203const HTTP_TOO_MANY_REQUESTS = 429;
204const HTTP_CLIENT_ERROR_RANGE_END = 499;
205const HTTP_SERVER_ERROR = 500;
206const HTTP_SERVER_ERROR_RANGE_START = 500;
207const HTTP_SERVICE_UNAVAILABLE = 503;
208const HTTP_GATEWAY_TIMEOUT = 504;
209const HTTP_SERVER_ERROR_RANGE_END = 599;
210const OIDC_DEFAULT_SCOPES = [
211 OPENID_SCOPE,
212 PROFILE_SCOPE,
213 OFFLINE_ACCESS_SCOPE,
214];
215const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, EMAIL_SCOPE];
216/**
217 * Request header names
218 */
219const HeaderNames = {
220 CONTENT_TYPE: "Content-Type",
221 CONTENT_LENGTH: "Content-Length",
222 RETRY_AFTER: "Retry-After",
223 CCS_HEADER: "X-AnchorMailbox",
224 WWWAuthenticate: "WWW-Authenticate",
225 AuthenticationInfo: "Authentication-Info",
226 X_MS_REQUEST_ID: "x-ms-request-id",
227 X_MS_HTTP_VERSION: "x-ms-httpver",
228};
229/**
230 * String constants related to AAD Authority
231 */
232const AADAuthority = {
233 COMMON: "common",
234 ORGANIZATIONS: "organizations",
235 CONSUMERS: "consumers",
236};
237/**
238 * Claims request keys
239 */
240const ClaimsRequestKeys = {
241 ACCESS_TOKEN: "access_token",
242 XMS_CC: "xms_cc",
243};
244/**
245 * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
246 * prompt values kept changing over past couple of years. There are some undocumented prompt values for some
247 * internal partners too, hence the choice of generic "string" type instead of the "enum"
248 */
249const PromptValue$1 = {
250 LOGIN: "login",
251 SELECT_ACCOUNT: "select_account",
252 CONSENT: "consent",
253 NONE: "none",
254 CREATE: "create",
255 NO_SESSION: "no_session",
256};
257/**
258 * allowed values for codeVerifier
259 */
260const CodeChallengeMethodValues = {
261 S256: "S256",
262};
263/**
264 * Allowed values for response_type
265 */
266const OAuthResponseType = {
267 CODE: "code",
268 IDTOKEN_TOKEN: "id_token token"};
269/**
270 * allowed values for response_mode
271 */
272const ResponseMode$1 = {
273 QUERY: "query",
274 FRAGMENT: "fragment",
275 FORM_POST: "form_post",
276};
277/**
278 * allowed grant_type
279 */
280const GrantType = {
281 AUTHORIZATION_CODE_GRANT: "authorization_code",
282 CLIENT_CREDENTIALS_GRANT: "client_credentials",
283 RESOURCE_OWNER_PASSWORD_GRANT: "password",
284 REFRESH_TOKEN_GRANT: "refresh_token",
285 DEVICE_CODE_GRANT: "device_code",
286 JWT_BEARER: "urn:ietf:params:oauth:grant-type:jwt-bearer",
287};
288/**
289 * Account types in Cache
290 */
291const CACHE_ACCOUNT_TYPE_MSSTS = "MSSTS";
292const CACHE_ACCOUNT_TYPE_ADFS = "ADFS";
293const CACHE_ACCOUNT_TYPE_GENERIC = "Generic";
294/**
295 * Separators used in cache
296 */
297const CACHE_KEY_SEPARATOR = "-";
298const CLIENT_INFO_SEPARATOR = ".";
299/**
300 * Credential Type stored in the cache
301 */
302const CredentialType = {
303 ID_TOKEN: "IdToken",
304 ACCESS_TOKEN: "AccessToken",
305 ACCESS_TOKEN_WITH_AUTH_SCHEME: "AccessToken_With_AuthScheme",
306 REFRESH_TOKEN: "RefreshToken",
307};
308/**
309 * More Cache related constants
310 */
311const APP_METADATA = "appmetadata";
312const CLIENT_INFO = "client_info";
313const THE_FAMILY_ID = "1";
314const AUTHORITY_METADATA_CACHE_KEY = "authority-metadata";
315const AUTHORITY_METADATA_REFRESH_TIME_SECONDS = 3600 * 24; // 24 Hours
316const AuthorityMetadataSource = {
317 CONFIG: "config",
318 CACHE: "cache",
319 NETWORK: "network",
320 HARDCODED_VALUES: "hardcoded_values",
321};
322const SERVER_TELEM_SCHEMA_VERSION = 5;
323const SERVER_TELEM_MAX_LAST_HEADER_BYTES = 330; // ESTS limit is 350B, set to 330 to provide a 20B buffer,
324const SERVER_TELEM_MAX_CACHED_ERRORS = 50; // Limit the number of errors that can be stored to prevent uncontrolled size gains
325const SERVER_TELEM_CACHE_KEY = "server-telemetry";
326const SERVER_TELEM_CATEGORY_SEPARATOR = "|";
327const SERVER_TELEM_VALUE_SEPARATOR = ",";
328const SERVER_TELEM_OVERFLOW_TRUE = "1";
329const SERVER_TELEM_OVERFLOW_FALSE = "0";
330const SERVER_TELEM_UNKNOWN_ERROR = "unknown_error";
331/**
332 * Type of the authentication request
333 */
334const AuthenticationScheme = {
335 BEARER: "Bearer",
336 POP: "pop",
337 SSH: "ssh-cert",
338};
339/**
340 * Constants related to throttling
341 */
342const DEFAULT_THROTTLE_TIME_SECONDS = 60;
343// Default maximum time to throttle in seconds, overrides what the server sends back
344const DEFAULT_MAX_THROTTLE_TIME_SECONDS = 3600;
345// Prefix for storing throttling entries
346const THROTTLING_PREFIX = "throttling";
347// Value assigned to the x-ms-lib-capability header to indicate to the server the library supports throttling
348const X_MS_LIB_CAPABILITY_VALUE = "retry-after, h429";
349/**
350 * Errors
351 */
352const INVALID_GRANT_ERROR = "invalid_grant";
353const CLIENT_MISMATCH_ERROR = "client_mismatch";
354/**
355 * Password grant parameters
356 */
357const PasswordGrantConstants = {
358 username: "username",
359 password: "password",
360};
361/**
362 * Region Discovery Sources
363 */
364const RegionDiscoverySources = {
365 FAILED_AUTO_DETECTION: "1",
366 INTERNAL_CACHE: "2",
367 ENVIRONMENT_VARIABLE: "3",
368 IMDS: "4",
369};
370/**
371 * Region Discovery Outcomes
372 */
373const RegionDiscoveryOutcomes = {
374 CONFIGURED_NO_AUTO_DETECTION: "2",
375 AUTO_DETECTION_REQUESTED_SUCCESSFUL: "4",
376 AUTO_DETECTION_REQUESTED_FAILED: "5",
377};
378/**
379 * Specifies the reason for fetching the access token from the identity provider
380 */
381const CacheOutcome = {
382 // When a token is found in the cache or the cache is not supposed to be hit when making the request
383 NOT_APPLICABLE: "0",
384 // When the token request goes to the identity provider because force_refresh was set to true. Also occurs if claims were requested
385 FORCE_REFRESH_OR_CLAIMS: "1",
386 // When the token request goes to the identity provider because no cached access token exists
387 NO_CACHED_ACCESS_TOKEN: "2",
388 // When the token request goes to the identity provider because cached access token expired
389 CACHED_ACCESS_TOKEN_EXPIRED: "3",
390 // When the token request goes to the identity provider because refresh_in was used and the existing token needs to be refreshed
391 PROACTIVELY_REFRESHED: "4",
392};
393// Token renewal offset default in seconds
394const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
395const EncodingTypes = {
396 BASE64: "base64",
397 HEX: "hex",
398 UTF8: "utf-8",
399};400 401/*! @azure/msal-common v16.7.0 2026-06-05 */402/*
403 * Copyright (c) Microsoft Corporation. All rights reserved.
404 * Licensed under the MIT License.
405 */
406const CLIENT_ID = "client_id";
407const REDIRECT_URI = "redirect_uri";
408const RESPONSE_TYPE = "response_type";
409const RESPONSE_MODE = "response_mode";
410const GRANT_TYPE = "grant_type";
411const CLAIMS = "claims";
412const SCOPE = "scope";
413const REFRESH_TOKEN = "refresh_token";
414const STATE = "state";
415const NONCE = "nonce";
416const PROMPT = "prompt";
417const CODE = "code";
418const CODE_CHALLENGE = "code_challenge";
419const CODE_CHALLENGE_METHOD = "code_challenge_method";
420const CODE_VERIFIER = "code_verifier";
421const CLIENT_REQUEST_ID = "client-request-id";
422const X_CLIENT_SKU = "x-client-SKU";
423const X_CLIENT_VER = "x-client-VER";
424const X_CLIENT_OS = "x-client-OS";
425const X_CLIENT_CPU = "x-client-CPU";
426const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
427const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
428const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
429const X_APP_NAME = "x-app-name";
430const X_APP_VER = "x-app-ver";
431const POST_LOGOUT_URI = "post_logout_redirect_uri";
432const ID_TOKEN_HINT = "id_token_hint";
433const DEVICE_CODE = "device_code";
434const CLIENT_SECRET = "client_secret";
435const CLIENT_ASSERTION = "client_assertion";
436const CLIENT_ASSERTION_TYPE = "client_assertion_type";
437const TOKEN_TYPE = "token_type";
438const REQ_CNF = "req_cnf";
439const OBO_ASSERTION = "assertion";
440const REQUESTED_TOKEN_USE = "requested_token_use";
441const ON_BEHALF_OF = "on_behalf_of";
442const RETURN_SPA_CODE = "return_spa_code";
443const LOGOUT_HINT = "logout_hint";
444const SID = "sid";
445const LOGIN_HINT = "login_hint";
446const DOMAIN_HINT = "domain_hint";
447const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
448const BROKER_CLIENT_ID = "brk_client_id";
449const BROKER_REDIRECT_URI = "brk_redirect_uri";
450const INSTANCE_AWARE = "instance_aware";
451const RESOURCE = "resource";
452const CLI_DATA = "clidata";453 454/*! @azure/msal-common v16.7.0 2026-06-05 */455/*
456 * Copyright (c) Microsoft Corporation. All rights reserved.
457 * Licensed under the MIT License.
458 */
459function getDefaultErrorMessage(code) {
460 return `See https://aka.ms/msal.js.errors#${code} for details`;
461}
462/**
463 * General error class thrown by the MSAL.js library.
464 */
465class AuthError extends Error {
466 constructor(errorCode, errorMessage, suberror) {
467 const message = errorMessage ||
468 (errorCode ? getDefaultErrorMessage(errorCode) : "");
469 const errorString = message ? `${errorCode}: ${message}` : errorCode;
470 super(errorString);
471 Object.setPrototypeOf(this, AuthError.prototype);
472 this.errorCode = errorCode || "";
473 this.errorMessage = message || "";
474 this.subError = suberror || "";
475 this.name = "AuthError";
476 }
477 setCorrelationId(correlationId) {
478 this.correlationId = correlationId;
479 }
480}
481function createAuthError(code, additionalMessage) {
482 return new AuthError(code, additionalMessage || getDefaultErrorMessage(code));
483}484 485/*! @azure/msal-common v16.7.0 2026-06-05 */486 487/*
488 * Copyright (c) Microsoft Corporation. All rights reserved.
489 * Licensed under the MIT License.
490 */
491/**
492 * Error thrown when there is an error in configuration of the MSAL.js library.
493 */
494class ClientConfigurationError extends AuthError {
495 constructor(errorCode) {
496 super(errorCode);
497 this.name = "ClientConfigurationError";
498 Object.setPrototypeOf(this, ClientConfigurationError.prototype);
499 }
500}
501function createClientConfigurationError(errorCode) {
502 return new ClientConfigurationError(errorCode);
503}504 505/*! @azure/msal-common v16.7.0 2026-06-05 */506/*
507 * Copyright (c) Microsoft Corporation. All rights reserved.
508 * Licensed under the MIT License.
509 */
510/**
511 * @hidden
512 */
513class StringUtils {
514 /**
515 * Check if stringified object is empty
516 * @param strObj
517 */
518 static isEmptyObj(strObj) {
519 if (strObj) {
520 try {
521 const obj = JSON.parse(strObj);
522 return Object.keys(obj).length === 0;
523 }
524 catch (e) { }
525 }
526 return true;
527 }
528 static startsWith(str, search) {
529 return str.indexOf(search) === 0;
530 }
531 static endsWith(str, search) {
532 return (str.length >= search.length &&
533 str.lastIndexOf(search) === str.length - search.length);
534 }
535 /**
536 * Parses string into an object.
537 *
538 * @param query
539 */
540 static queryStringToObject(query) {
541 const obj = {};
542 const params = query.split("&");
543 const decode = (s) => decodeURIComponent(s.replace(/\+/g, " "));
544 params.forEach((pair) => {
545 if (pair.trim()) {
546 const [key, value] = pair.split(/=(.+)/g, 2); // Split on the first occurence of the '=' character
547 if (key && value) {
548 obj[decode(key)] = decode(value);
549 }
550 }
551 });
552 return obj;
553 }
554 /**
555 * Trims entries in an array.
556 *
557 * @param arr
558 */
559 static trimArrayEntries(arr) {
560 return arr.map((entry) => entry.trim());
561 }
562 /**
563 * Removes empty strings from array
564 * @param arr
565 */
566 static removeEmptyStringsFromArray(arr) {
567 return arr.filter((entry) => {
568 return !!entry;
569 });
570 }
571 /**
572 * Attempts to parse a string into JSON
573 * @param str
574 */
575 static jsonParseHelper(str) {
576 try {
577 return JSON.parse(str);
578 }
579 catch (e) {
580 return null;
581 }
582 }
583}584 585/*! @azure/msal-common v16.7.0 2026-06-05 */586 587/*
588 * Copyright (c) Microsoft Corporation. All rights reserved.
589 * Licensed under the MIT License.
590 */
591/**
592 * ClientAuthErrorMessage class containing string constants used by error codes and messages.
593 */
594/**
595 * Error thrown when there is an error in the client code running on the browser.
596 */
597class ClientAuthError extends AuthError {
598 constructor(errorCode, additionalMessage) {
599 super(errorCode, additionalMessage);
600 this.name = "ClientAuthError";
601 Object.setPrototypeOf(this, ClientAuthError.prototype);
602 }
603}
604function createClientAuthError(errorCode, additionalMessage) {
605 return new ClientAuthError(errorCode, additionalMessage);
606}607 608/*! @azure/msal-common v16.7.0 2026-06-05 */609/*
610 * Copyright (c) Microsoft Corporation. All rights reserved.
611 * Licensed under the MIT License.
612 */
613const redirectUriEmpty = "redirect_uri_empty";
614const claimsRequestParsingError = "claims_request_parsing_error";
615const authorityUriInsecure = "authority_uri_insecure";
616const urlParseError = "url_parse_error";
617const urlEmptyError = "empty_url_error";
618const emptyInputScopesError = "empty_input_scopes_error";
619const invalidClaims = "invalid_claims";
620const tokenRequestEmpty = "token_request_empty";
621const logoutRequestEmpty = "logout_request_empty";
622const invalidCodeChallengeMethod = "invalid_code_challenge_method";
623const pkceParamsMissing = "pkce_params_missing";
624const invalidCloudDiscoveryMetadata = "invalid_cloud_discovery_metadata";
625const invalidAuthorityMetadata = "invalid_authority_metadata";
626const untrustedAuthority = "untrusted_authority";
627const missingSshJwk = "missing_ssh_jwk";
628const missingSshKid = "missing_ssh_kid";
629const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
630const invalidAuthenticationHeader = "invalid_authentication_header";
631const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
632const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
633const authorityMismatch = "authority_mismatch";
634const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
635const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
636const issuerValidationFailed = "issuer_validation_failed";637 638var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({639 __proto__: null,640 authorityMismatch: authorityMismatch,641 authorityUriInsecure: authorityUriInsecure,642 cannotAllowPlatformBroker: cannotAllowPlatformBroker,643 cannotSetOIDCOptions: cannotSetOIDCOptions,644 claimsRequestParsingError: claimsRequestParsingError,645 emptyInputScopesError: emptyInputScopesError,646 invalidAuthenticationHeader: invalidAuthenticationHeader,647 invalidAuthorityMetadata: invalidAuthorityMetadata,648 invalidClaims: invalidClaims,649 invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,650 invalidCodeChallengeMethod: invalidCodeChallengeMethod,651 invalidPlatformBrokerConfiguration: invalidPlatformBrokerConfiguration,652 invalidRequestMethodForEAR: invalidRequestMethodForEAR,653 issuerValidationFailed: issuerValidationFailed,654 logoutRequestEmpty: logoutRequestEmpty,655 missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,656 missingSshJwk: missingSshJwk,657 missingSshKid: missingSshKid,658 pkceParamsMissing: pkceParamsMissing,659 redirectUriEmpty: redirectUriEmpty,660 tokenRequestEmpty: tokenRequestEmpty,661 untrustedAuthority: untrustedAuthority,662 urlEmptyError: urlEmptyError,663 urlParseError: urlParseError664});665 666/*! @azure/msal-common v16.7.0 2026-06-05 */667/*
668 * Copyright (c) Microsoft Corporation. All rights reserved.
669 * Licensed under the MIT License.
670 */
671const clientInfoDecodingError = "client_info_decoding_error";
672const clientInfoEmptyError = "client_info_empty_error";
673const tokenParsingError = "token_parsing_error";
674const nullOrEmptyToken = "null_or_empty_token";
675const endpointResolutionError = "endpoints_resolution_error";
676const networkError = "network_error";
677const openIdConfigError = "openid_config_error";
678const hashNotDeserialized = "hash_not_deserialized";
679const invalidState = "invalid_state";
680const stateMismatch = "state_mismatch";
681const stateNotFound = "state_not_found";
682const nonceMismatch = "nonce_mismatch";
683const authTimeNotFound = "auth_time_not_found";
684const maxAgeTranspired = "max_age_transpired";
685const multipleMatchingTokens = "multiple_matching_tokens";
686const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
687const requestCannotBeMade = "request_cannot_be_made";
688const cannotRemoveEmptyScope = "cannot_remove_empty_scope";
689const cannotAppendScopeSet = "cannot_append_scopeset";
690const emptyInputScopeSet = "empty_input_scopeset";
691const noAccountInSilentRequest = "no_account_in_silent_request";
692const invalidCacheRecord = "invalid_cache_record";
693const invalidCacheEnvironment = "invalid_cache_environment";
694const noAccountFound = "no_account_found";
695const noCryptoObject = "no_crypto_object";
696const unexpectedCredentialType = "unexpected_credential_type";
697const tokenRefreshRequired = "token_refresh_required";
698const tokenClaimsCnfRequiredForSignedJwt = "token_claims_cnf_required_for_signedjwt";
699const authorizationCodeMissingFromServerResponse = "authorization_code_missing_from_server_response";
700const bindingKeyNotRemoved = "binding_key_not_removed";
701const endSessionEndpointNotSupported = "end_session_endpoint_not_supported";
702const keyIdMissing = "key_id_missing";
703const noNetworkConnectivity = "no_network_connectivity";
704const userCanceled = "user_canceled";
705const methodNotImplemented = "method_not_implemented";
706const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
707const platformBrokerError = "platform_broker_error";
708const resourceParameterRequired = "resource_parameter_required";
709const misplacedResourceParam = "misplaced_resource_parameter";710 711var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({712 __proto__: null,713 authTimeNotFound: authTimeNotFound,714 authorizationCodeMissingFromServerResponse: authorizationCodeMissingFromServerResponse,715 bindingKeyNotRemoved: bindingKeyNotRemoved,716 cannotAppendScopeSet: cannotAppendScopeSet,717 cannotRemoveEmptyScope: cannotRemoveEmptyScope,718 clientInfoDecodingError: clientInfoDecodingError,719 clientInfoEmptyError: clientInfoEmptyError,720 emptyInputScopeSet: emptyInputScopeSet,721 endSessionEndpointNotSupported: endSessionEndpointNotSupported,722 endpointResolutionError: endpointResolutionError,723 hashNotDeserialized: hashNotDeserialized,724 invalidCacheEnvironment: invalidCacheEnvironment,725 invalidCacheRecord: invalidCacheRecord,726 invalidState: invalidState,727 keyIdMissing: keyIdMissing,728 maxAgeTranspired: maxAgeTranspired,729 methodNotImplemented: methodNotImplemented,730 misplacedResourceParam: misplacedResourceParam,731 multipleMatchingAppMetadata: multipleMatchingAppMetadata,732 multipleMatchingTokens: multipleMatchingTokens,733 nestedAppAuthBridgeDisabled: nestedAppAuthBridgeDisabled,734 networkError: networkError,735 noAccountFound: noAccountFound,736 noAccountInSilentRequest: noAccountInSilentRequest,737 noCryptoObject: noCryptoObject,738 noNetworkConnectivity: noNetworkConnectivity,739 nonceMismatch: nonceMismatch,740 nullOrEmptyToken: nullOrEmptyToken,741 openIdConfigError: openIdConfigError,742 platformBrokerError: platformBrokerError,743 requestCannotBeMade: requestCannotBeMade,744 resourceParameterRequired: resourceParameterRequired,745 stateMismatch: stateMismatch,746 stateNotFound: stateNotFound,747 tokenClaimsCnfRequiredForSignedJwt: tokenClaimsCnfRequiredForSignedJwt,748 tokenParsingError: tokenParsingError,749 tokenRefreshRequired: tokenRefreshRequired,750 unexpectedCredentialType: unexpectedCredentialType,751 userCanceled: userCanceled752});753 754/*! @azure/msal-common v16.7.0 2026-06-05 */755 756/*
757 * Copyright (c) Microsoft Corporation. All rights reserved.
758 * Licensed under the MIT License.
759 */
760/**
761 * The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
762 * the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions
763 * to ensure uniqueness of strings.
764 */
765class ScopeSet {
766 constructor(inputScopes) {
767 // Filter empty string and null/undefined array items
768 const scopeArr = inputScopes
769 ? StringUtils.trimArrayEntries([...inputScopes])
770 : [];
771 const filteredInput = scopeArr
772 ? StringUtils.removeEmptyStringsFromArray(scopeArr)
773 : [];
774 // Check if scopes array has at least one member
775 if (!filteredInput || !filteredInput.length) {
776 throw createClientConfigurationError(emptyInputScopesError);
777 }
778 this.scopes = new Set(); // Iterator in constructor not supported by IE11
779 filteredInput.forEach((scope) => this.scopes.add(scope));
780 }
781 /**
782 * Factory method to create ScopeSet from space-delimited string
783 * @param inputScopeString
784 * @param appClientId
785 * @param scopesRequired
786 */
787 static fromString(inputScopeString) {
788 const scopeString = inputScopeString || "";
789 const inputScopes = scopeString.split(" ");
790 return new ScopeSet(inputScopes);
791 }
792 /**
793 * Creates the set of scopes to search for in cache lookups
794 * @param inputScopeString
795 * @returns
796 */
797 static createSearchScopes(inputScopeString) {
798 // Handle empty scopes by using default OIDC scopes for cache lookup
799 const scopesToUse = inputScopeString && inputScopeString.length > 0
800 ? inputScopeString
801 : [...OIDC_DEFAULT_SCOPES];
802 const scopeSet = new ScopeSet(scopesToUse);
803 if (!scopeSet.containsOnlyOIDCScopes()) {
804 scopeSet.removeOIDCScopes();
805 }
806 else {
807 scopeSet.removeScope(OFFLINE_ACCESS_SCOPE);
808 }
809 return scopeSet;
810 }
811 /**
812 * Check if a given scope is present in this set of scopes.
813 * @param scope
814 */
815 containsScope(scope) {
816 const lowerCaseScopes = this.printScopesLowerCase().split(" ");
817 const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
818 // compare lowercase scopes
819 return scope
820 ? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
821 : false;
822 }
823 /**
824 * Check if a set of scopes is present in this set of scopes.
825 * @param scopeSet
826 */
827 containsScopeSet(scopeSet) {
828 if (!scopeSet || scopeSet.scopes.size <= 0) {
829 return false;
830 }
831 return (this.scopes.size >= scopeSet.scopes.size &&
832 scopeSet.asArray().every((scope) => this.containsScope(scope)));
833 }
834 /**
835 * Check if set of scopes contains only the defaults
836 */
837 containsOnlyOIDCScopes() {
838 let defaultScopeCount = 0;
839 OIDC_SCOPES.forEach((defaultScope) => {
840 if (this.containsScope(defaultScope)) {
841 defaultScopeCount += 1;
842 }
843 });
844 return this.scopes.size === defaultScopeCount;
845 }
846 /**
847 * Appends single scope if passed
848 * @param newScope
849 */
850 appendScope(newScope) {
851 if (newScope) {
852 this.scopes.add(newScope.trim());
853 }
854 }
855 /**
856 * Appends multiple scopes if passed
857 * @param newScopes
858 */
859 appendScopes(newScopes) {
860 try {
861 newScopes.forEach((newScope) => this.appendScope(newScope));
862 }
863 catch (e) {
864 throw createClientAuthError(cannotAppendScopeSet);
865 }
866 }
867 /**
868 * Removes element from set of scopes.
869 * @param scope
870 */
871 removeScope(scope) {
872 if (!scope) {
873 throw createClientAuthError(cannotRemoveEmptyScope);
874 }
875 this.scopes.delete(scope.trim());
876 }
877 /**
878 * Removes default scopes from set of scopes
879 * Primarily used to prevent cache misses if the default scopes are not returned from the server
880 */
881 removeOIDCScopes() {
882 OIDC_SCOPES.forEach((defaultScope) => {
883 this.scopes.delete(defaultScope);
884 });
885 }
886 /**
887 * Combines an array of scopes with the current set of scopes.
888 * @param otherScopes
889 */
890 unionScopeSets(otherScopes) {
891 if (!otherScopes) {
892 throw createClientAuthError(emptyInputScopeSet);
893 }
894 const unionScopes = new Set(); // Iterator in constructor not supported in IE11
895 otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
896 this.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
897 return unionScopes;
898 }
899 /**
900 * Check if scopes intersect between this set and another.
901 * @param otherScopes
902 */
903 intersectingScopeSets(otherScopes) {
904 if (!otherScopes) {
905 throw createClientAuthError(emptyInputScopeSet);
906 }
907 // Do not allow OIDC scopes to be the only intersecting scopes
908 if (!otherScopes.containsOnlyOIDCScopes()) {
909 otherScopes.removeOIDCScopes();
910 }
911 const unionScopes = this.unionScopeSets(otherScopes);
912 const sizeOtherScopes = otherScopes.getScopeCount();
913 const sizeThisScopes = this.getScopeCount();
914 const sizeUnionScopes = unionScopes.size;
915 return sizeUnionScopes < sizeThisScopes + sizeOtherScopes;
916 }
917 /**
918 * Returns size of set of scopes.
919 */
920 getScopeCount() {
921 return this.scopes.size;
922 }
923 /**
924 * Returns the scopes as an array of string values
925 */
926 asArray() {
927 const array = [];
928 this.scopes.forEach((val) => array.push(val));
929 return array;
930 }
931 /**
932 * Prints scopes into a space-delimited string
933 */
934 printScopes() {
935 if (this.scopes) {
936 const scopeArr = this.asArray();
937 return scopeArr.join(" ");
938 }
939 return "";
940 }
941 /**
942 * Prints scopes into a space-delimited lower-case string (used for caching)
943 */
944 printScopesLowerCase() {
945 return this.printScopes().toLowerCase();
946 }
947}948 949/*! @azure/msal-common v16.7.0 2026-06-05 */950 951/*
952 * Copyright (c) Microsoft Corporation. All rights reserved.
953 * Licensed under the MIT License.
954 */
955function instrumentBrokerParams(parameters, correlationId, performanceClient) {
956 if (!correlationId) {
957 return;
958 }
959 const clientId = parameters.get(CLIENT_ID);
960 if (clientId && parameters.has(BROKER_CLIENT_ID)) {
961 performanceClient?.addFields({
962 embeddedClientId: clientId,
963 embeddedRedirectUri: parameters.get(REDIRECT_URI),
964 }, correlationId);
965 }
966}
967/**
968 * Add the given response_type
969 * @param parameters
970 * @param responseType
971 */
972function addResponseType(parameters, responseType) {
973 parameters.set(RESPONSE_TYPE, responseType);
974}
975/**
976 * add response_mode. defaults to query.
977 * @param responseMode
978 */
979function addResponseMode(parameters, responseMode) {
980 parameters.set(RESPONSE_MODE, responseMode ? responseMode : ResponseMode$1.QUERY);
981}
982/**
983 * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
984 * @param scopeSet
985 * @param addOidcScopes
986 */
987function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
988 // Always add openid to the scopes when adding OIDC scopes
989 if (addOidcScopes &&
990 !defaultScopes.includes("openid") &&
991 !scopes.includes("openid")) {
992 defaultScopes.push("openid");
993 }
994 const requestScopes = addOidcScopes
995 ? [...(scopes || []), ...defaultScopes]
996 : scopes || [];
997 const scopeSet = new ScopeSet(requestScopes);
998 parameters.set(SCOPE, scopeSet.printScopes());
999}
1000/**
1001 * add clientId
1002 * @param clientId
1003 */
1004function addClientId(parameters, clientId) {
1005 parameters.set(CLIENT_ID, clientId);
1006}
1007/**
1008 * add redirect_uri
1009 * @param redirectUri
1010 */
1011function addRedirectUri(parameters, redirectUri) {
1012 parameters.set(REDIRECT_URI, redirectUri);
1013}
1014/**
1015 * add post logout redirectUri
1016 * @param redirectUri
1017 */
1018function addPostLogoutRedirectUri(parameters, redirectUri) {
1019 parameters.set(POST_LOGOUT_URI, redirectUri);
1020}
1021/**
1022 * add id_token_hint to logout request
1023 * @param idTokenHint
1024 */
1025function addIdTokenHint(parameters, idTokenHint) {
1026 parameters.set(ID_TOKEN_HINT, idTokenHint);
1027}
1028/**
1029 * add domain_hint
1030 * @param domainHint
1031 */
1032function addDomainHint(parameters, domainHint) {
1033 parameters.set(DOMAIN_HINT, domainHint);
1034}
1035/**
1036 * add login_hint
1037 * @param loginHint
1038 */
1039function addLoginHint(parameters, loginHint) {
1040 parameters.set(LOGIN_HINT, loginHint);
1041}
1042/**
1043 * Adds the CCS (Cache Credential Service) query parameter for login_hint
1044 * @param loginHint
1045 */
1046function addCcsUpn(parameters, loginHint) {
1047 parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
1048}
1049/**
1050 * Adds the CCS (Cache Credential Service) query parameter for account object
1051 * @param loginHint
1052 */
1053function addCcsOid(parameters, clientInfo) {
1054 parameters.set(HeaderNames.CCS_HEADER, `Oid:${clientInfo.uid}@${clientInfo.utid}`);
1055}
1056/**
1057 * add sid
1058 * @param sid
1059 */
1060function addSid(parameters, sid) {
1061 parameters.set(SID, sid);
1062}
1063/**
1064 * Adds claims to request parameters, conditionally excluding clientCapabilities
1065 * when skipBrokerClaims is true and a brokered flow is in effect.
1066 * @param parameters - The request parameters map
1067 * @param claims - The claims string from the request
1068 * @param clientCapabilities - The client capabilities from configuration
1069 * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
1070 */
1071function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
1072 // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
1073 const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
1074 ? undefined
1075 : clientCapabilities;
1076 if (!StringUtils.isEmptyObj(claims) ||
1077 (configClaims && configClaims.length > 0)) {
1078 const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
1079 try {
1080 JSON.parse(mergedClaims);
1081 }
1082 catch (e) {
1083 throw createClientConfigurationError(invalidClaims);
1084 }
1085 parameters.set(CLAIMS, mergedClaims);
1086 }
1087}
1088/**
1089 * add correlationId
1090 * @param correlationId
1091 */
1092function addCorrelationId(parameters, correlationId) {
1093 parameters.set(CLIENT_REQUEST_ID, correlationId);
1094}
1095/**
1096 * add library info query params
1097 * @param libraryInfo
1098 */
1099function addLibraryInfo(parameters, libraryInfo) {
1100 // Telemetry Info
1101 parameters.set(X_CLIENT_SKU, libraryInfo.sku);
1102 parameters.set(X_CLIENT_VER, libraryInfo.version);
1103 if (libraryInfo.os) {
1104 parameters.set(X_CLIENT_OS, libraryInfo.os);
1105 }
1106 if (libraryInfo.cpu) {
1107 parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
1108 }
1109}
1110/**
1111 * Add client telemetry parameters
1112 * @param appTelemetry
1113 */
1114function addApplicationTelemetry(parameters, appTelemetry) {
1115 if (appTelemetry?.appName) {
1116 parameters.set(X_APP_NAME, appTelemetry.appName);
1117 }
1118 if (appTelemetry?.appVersion) {
1119 parameters.set(X_APP_VER, appTelemetry.appVersion);
1120 }
1121}
1122/**
1123 * add prompt
1124 * @param prompt
1125 */
1126function addPrompt(parameters, prompt) {
1127 parameters.set(PROMPT, prompt);
1128}
1129/**
1130 * add state
1131 * @param state
1132 */
1133function addState(parameters, state) {
1134 if (state) {
1135 parameters.set(STATE, state);
1136 }
1137}
1138/**
1139 * add nonce
1140 * @param nonce
1141 */
1142function addNonce(parameters, nonce) {
1143 parameters.set(NONCE, nonce);
1144}
1145/**
1146 * add code_challenge and code_challenge_method
1147 * - throw if either of them are not passed
1148 * @param codeChallenge
1149 * @param codeChallengeMethod
1150 */
1151function addCodeChallengeParams(parameters, codeChallenge, codeChallengeMethod) {
1152 if (codeChallenge && codeChallengeMethod) {
1153 parameters.set(CODE_CHALLENGE, codeChallenge);
1154 parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
1155 }
1156 else {
1157 throw createClientConfigurationError(pkceParamsMissing);
1158 }
1159}
1160/**
1161 * add the `authorization_code` passed by the user to exchange for a token
1162 * @param code
1163 */
1164function addAuthorizationCode(parameters, code) {
1165 parameters.set(CODE, code);
1166}
1167/**
1168 * add the `authorization_code` passed by the user to exchange for a token
1169 * @param code
1170 */
1171function addDeviceCode(parameters, code) {
1172 parameters.set(DEVICE_CODE, code);
1173}
1174/**
1175 * add the `refreshToken` passed by the user
1176 * @param refreshToken
1177 */
1178function addRefreshToken(parameters, refreshToken) {
1179 parameters.set(REFRESH_TOKEN, refreshToken);
1180}
1181/**
1182 * add the `code_verifier` passed by the user to exchange for a token
1183 * @param codeVerifier
1184 */
1185function addCodeVerifier(parameters, codeVerifier) {
1186 parameters.set(CODE_VERIFIER, codeVerifier);
1187}
1188/**
1189 * add client_secret
1190 * @param clientSecret
1191 */
1192function addClientSecret(parameters, clientSecret) {
1193 parameters.set(CLIENT_SECRET, clientSecret);
1194}
1195/**
1196 * add clientAssertion for confidential client flows
1197 * @param clientAssertion
1198 */
1199function addClientAssertion(parameters, clientAssertion) {
1200 if (clientAssertion) {