{"version":3,"sources":["../../src/clients/token-provider-factory.ts"],"names":[],"mappings":";;;;;;AA0BO,SAAS,0BAAA,CACd,aAAA,EACA,sBAAA,EACA,KAAA,GAA0B,MAAA,EACnB;AACP,EAAA,OAAO,MAAM;AACX,IAAA,OAAO,yBAAA,CAA0B,WAAA,CAAY,sBAAsB,CAAA,EAAG,YAAY;AAGhF,MAAA,IAAI,CAAC,sBAAA,EAAwB;AAC3B,QAAA,OAAQ,MAAM,aAAA,CAAc,WAAA,CAAY,KAAA,CAAM,QAAQ,CAAA,IAAM,KAAA,CAAA;AAAA,MAC9D;AAEA,MAAA,IAAI,2BAAA,CAA4B,sBAAsB,CAAA,EAAG;AACvD,QAAA,IAAI,CAAC,cAAc,mBAAA,EAAqB;AACtC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR;AAAA,WAGF;AAAA,QACF;AAEA,QAAA,OACG,MAAM,aAAA,CAAc,mBAAA;AAAA,UACnB,KAAA,CAAM,uBAAA;AAAA,UACN,mBAAA,CAAoB,wBAAwB,aAAa,CAAA;AAAA,UACzD,sBAAA,CAAuB,aAAA;AAAA,UACvB,sBAAA,CAAuB;AAAA,SACzB,IAAM,KAAA,CAAA;AAAA,MAEV;AAEA,MAAA,IAAI,CAAC,cAAc,kBAAA,EAAoB;AACrC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAGF;AAAA,MACF;AAEA,MAAA,OACG,MAAM,aAAA,CAAc,kBAAA;AAAA,QACnB,KAAA,CAAM,uBAAA;AAAA,QACN,mBAAA,CAAoB,wBAAwB,YAAY,CAAA;AAAA,QACxD,sBAAA,CAAuB;AAAA,OACzB,IAAM,KAAA,CAAA;AAAA,IAEV,CAAC,CAAA;AAAA,EACH,CAAA;AACF;AAEA,SAAS,YAAY,eAAA,EAAwD;AAC3E,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,UAAA,CAAW,OAAA;AAAA,EACpB;AAEA,EAAA,OAAO,2BAAA,CAA4B,eAAe,CAAA,GAC9C,UAAA,CAAW,cACX,UAAA,CAAW,UAAA;AACjB;AAEA,SAAS,mBAAA,CAAoB,iBAAkC,cAAA,EAAgC;AAC7F,EAAA,IAAI,CAAC,gBAAgB,YAAA,EAAc;AACjC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gCAAgC,cAAc,CAAA,kCAAA;AAAA,KAChD;AAAA,EACF;AAEA,EAAA,OAAO,eAAA,CAAgB,YAAA;AACzB;AAEA,eAAe,yBAAA,CAA6B,UAAoB,YAAA,EAA4C;AAC1G,EAAA,OAAO,mBAAkB,CAAE,eAAA;AAAA,IACzB,cAAA,CAAe,YAAA;AAAA,IACf,EAAE,IAAA,EAAM,QAAA,CAAS,MAAA,EAAQ,UAAA,EAAY,EAAE,CAAC,mBAAA,CAAoB,QAAQ,GAAG,QAAA,EAAS,EAAE;AAAA,IAClF,OAAO,IAAA,KAAS;AACd,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,YAAA,EAAa;AAAA,MAC5B,SAAS,KAAA,EAAO;AACd,QAAA,uBAAA,CAAwB,MAAM,KAAK,CAAA;AACnC,QAAA,MAAM,KAAA;AAAA,MACR,CAAA,SAAE;AACA,QAAA,IAAA,CAAK,GAAA,EAAI;AAAA,MACX;AAAA,IACF;AAAA,GACF;AACF","file":"token-provider-factory.mjs","sourcesContent":["import { SpanKind } from '@opentelemetry/api';\n\nimport type { Token } from '@microsoft/teams.common';\n\nimport { PUBLIC } from '../auth/cloud-environment';\nimport type { CloudEnvironment } from '../auth/cloud-environment';\nimport type { ITokenProvider } from '../auth/credentials';\nimport {\n  API_ATTRIBUTE_NAMES,\n  API_SPAN_NAMES,\n  AUTH_FLOWS,\n  type AuthFlow\n} from '../diagnostics/constants';\nimport {\n  getTeamsApiTracer,\n  recordTeamsApiException\n} from '../diagnostics/helpers';\nimport { isUserBackedAgenticIdentity, type AgenticIdentity } from '../models';\n\n\n/**\n * @internal\n * Creates a common HTTP token callback backed by an {@link ITokenProvider}.\n * Resolves the token and emits `microsoft.teams.auth.outbound`; the common HTTP\n * client owns Authorization header injection.\n */\nexport function createTokenProviderFactory(\n  tokenProvider: ITokenProvider,\n  defaultAgenticIdentity?: AgenticIdentity,\n  cloud: CloudEnvironment = PUBLIC\n): Token {\n  return () => {\n    return traceAuthTokenAcquisition(getAuthFlow(defaultAgenticIdentity), async () => {\n      // Coerce null to undefined: the TokenFactory contract allows only\n      // string | StringLike | undefined.\n      if (!defaultAgenticIdentity) {\n        return (await tokenProvider.getAppToken(cloud.botScope)) ?? undefined;\n      }\n\n      if (isUserBackedAgenticIdentity(defaultAgenticIdentity)) {\n        if (!tokenProvider.getAgenticUserToken) {\n          throw new Error(\n            'This client is scoped to a user-backed AgenticIdentity, but the configured token provider does not ' +\n            'implement `getAgenticUserToken`. Falling back to an app-only token would authenticate ' +\n            'under the wrong identity.'\n          );\n        }\n\n        return (\n          (await tokenProvider.getAgenticUserToken(\n            cloud.agenticIdentityBotScope,\n            requireAgenticAppId(defaultAgenticIdentity, 'user-backed'),\n            defaultAgenticIdentity.agenticUserId,\n            defaultAgenticIdentity.tenantId\n          )) ?? undefined\n        );\n      }\n\n      if (!tokenProvider.getAgenticAppToken) {\n        throw new Error(\n          'This client is scoped to an app-backed AgenticIdentity, but the configured token provider does not ' +\n          'implement `getAgenticAppToken`. Falling back to an app-only token would authenticate ' +\n          'under the wrong identity.'\n        );\n      }\n\n      return (\n        (await tokenProvider.getAgenticAppToken(\n          cloud.agenticIdentityBotScope,\n          requireAgenticAppId(defaultAgenticIdentity, 'app-backed'),\n          defaultAgenticIdentity.tenantId\n        )) ?? undefined\n      );\n    });\n  };\n}\n\nfunction getAuthFlow(agenticIdentity: AgenticIdentity | undefined): AuthFlow {\n  if (!agenticIdentity) {\n    return AUTH_FLOWS.appOnly;\n  }\n\n  return isUserBackedAgenticIdentity(agenticIdentity)\n    ? AUTH_FLOWS.agenticUser\n    : AUTH_FLOWS.agenticApp;\n}\n\nfunction requireAgenticAppId(agenticIdentity: AgenticIdentity, identityFlavor: string): string {\n  if (!agenticIdentity.agenticAppId) {\n    throw new Error(\n      `agenticAppId is required for ${identityFlavor} AgenticIdentity token acquisition`\n    );\n  }\n\n  return agenticIdentity.agenticAppId;\n}\n\nasync function traceAuthTokenAcquisition<T>(authFlow: AuthFlow, acquireToken: () => Promise<T>): Promise<T> {\n  return getTeamsApiTracer().startActiveSpan(\n    API_SPAN_NAMES.authOutbound,\n    { kind: SpanKind.CLIENT, attributes: { [API_ATTRIBUTE_NAMES.authFlow]: authFlow } },\n    async (span) => {\n      try {\n        return await acquireToken();\n      } catch (error) {\n        recordTeamsApiException(span, error);\n        throw error;\n      } finally {\n        span.end();\n      }\n    }\n  );\n}\n"]}