Migrate MicrosoftAPIRefreshAccessTokenService to @azure/msal-node
#16954
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,67 +1,61 @@ | ||
| import { Injectable } from '@nestjs/common'; | ||
|
|
||
| import { ConfidentialClientApplication } from '@azure/msal-node'; | ||
|
|
||
| import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service'; | ||
| import { | ||
| ConnectedAccountRefreshAccessTokenException, | ||
| ConnectedAccountRefreshAccessTokenExceptionCode, | ||
| } from 'src/modules/connected-account/refresh-tokens-manager/exceptions/connected-account-refresh-tokens.exception'; | ||
| import type { ConnectedAccountTokens } from 'src/modules/connected-account/refresh-tokens-manager/services/connected-account-refresh-tokens.service'; | ||
| import { parseMsalError } from 'src/modules/connected-account/refresh-tokens-manager/drivers/microsoft/utils/parse-msal-error.util'; | ||
|
|
||
| @Injectable() | ||
| export class MicrosoftAPIRefreshAccessTokenService { | ||
| constructor(private readonly config: TwentyConfigService) {} | ||
|
|
||
| async refreshTokens(refreshToken: string): Promise<ConnectedAccountTokens> { | ||
| const msalClient = new ConfidentialClientApplication({ | ||
| auth: { | ||
| clientId: this.config.get('AUTH_MICROSOFT_CLIENT_ID'), | ||
| clientSecret: this.config.get('AUTH_MICROSOFT_CLIENT_SECRET'), | ||
| authority: 'https://login.microsoftonline.com/common', | ||
| }, | ||
| }); | ||
|
|
||
| try { | ||
| const response = await msalClient.acquireTokenByRefreshToken({ | ||
| refreshToken, | ||
| scopes: ['https://graph.microsoft.com/.default'], | ||
| forceCache: true, | ||
|
Member
Author
There was a problem hiding this comment. During my testing it didn't store the token in
Member
There was a problem hiding this comment. @neo773 Why do we need it? |
||
| }); | ||
|
|
||
| if (!response) { | ||
| throw new ConnectedAccountRefreshAccessTokenException( | ||
| 'No response received from Microsoft token endpoint', | ||
| ConnectedAccountRefreshAccessTokenExceptionCode.INVALID_REFRESH_TOKEN, | ||
| ); | ||
| } | ||
|
|
||
| return { | ||
| accessToken: response.accessToken, | ||
| refreshToken: this.extractRefreshTokenFromCache(msalClient), | ||
| }; | ||
neo773 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } catch (error) { | ||
| if (error instanceof ConnectedAccountRefreshAccessTokenException) { | ||
| throw error; | ||
| } | ||
|
|
||
| throw parseMsalError(error); | ||
| } | ||
| } | ||
|
|
||
| private extractRefreshTokenFromCache( | ||
| msalClient: ConfidentialClientApplication, | ||
| ): string { | ||
| const tokenCache = JSON.parse(msalClient.getTokenCache().serialize()); | ||
| const refreshTokenKey = Object.keys(tokenCache.RefreshToken)[0]; | ||
neo773 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| return tokenCache.RefreshToken[refreshTokenKey].secret; | ||
neo773 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| import { | ||
| AuthError, | ||
| InteractionRequiredAuthError, | ||
| ServerError, | ||
| } from '@azure/msal-node'; | ||
|
|
||
| import { | ||
| ConnectedAccountRefreshAccessTokenException, | ||
| ConnectedAccountRefreshAccessTokenExceptionCode, | ||
| } from 'src/modules/connected-account/refresh-tokens-manager/exceptions/connected-account-refresh-tokens.exception'; | ||
|
|
||
| /** | ||
| * @see https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes | ||
| */ | ||
| const PERMANENT_AUTH_ERROR_CODES = new Set([ | ||
| 'invalid_grant', | ||
| 'invalid_client', | ||
| 'unauthorized_client', | ||
| 'invalid_request', | ||
| ]); | ||
|
|
||
| /** | ||
| * @see https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-common/src/error/ClientAuthErrorCodes.ts | ||
| */ | ||
| const TRANSIENT_AUTH_ERROR_CODES = new Set([ | ||
| 'network_error', | ||
| 'no_network_connectivity', | ||
| 'endpoints_resolution_error', | ||
| 'openid_config_error', | ||
| 'request_cannot_be_made', | ||
| ]); | ||
|
|
||
| export const parseMsalError = ( | ||
| error: unknown, | ||
| ): ConnectedAccountRefreshAccessTokenException => { | ||
| if (error instanceof InteractionRequiredAuthError) { | ||
| return new ConnectedAccountRefreshAccessTokenException( | ||
| `Microsoft token refresh requires re-authentication: ${error.errorCode}`, | ||
| ConnectedAccountRefreshAccessTokenExceptionCode.INVALID_REFRESH_TOKEN, | ||
| ); | ||
| } | ||
|
|
||
| if (error instanceof ServerError) { | ||
| const status = error.status; | ||
|
|
||
| if (status === 429) { | ||
| return new ConnectedAccountRefreshAccessTokenException( | ||
| 'Microsoft rate limit exceeded', | ||
| ConnectedAccountRefreshAccessTokenExceptionCode.TEMPORARY_NETWORK_ERROR, | ||
| ); | ||
| } | ||
|
|
||
| if (status && status >= 500 && status < 600) { | ||
| return new ConnectedAccountRefreshAccessTokenException( | ||
| `Microsoft server error (${status}): ${error.errorMessage}`, | ||
| ConnectedAccountRefreshAccessTokenExceptionCode.TEMPORARY_NETWORK_ERROR, | ||
| ); | ||
| } | ||
| } | ||
|
|
||
| if (error instanceof AuthError) { | ||
| if (TRANSIENT_AUTH_ERROR_CODES.has(error.errorCode)) { | ||
| return new ConnectedAccountRefreshAccessTokenException( | ||
| `Microsoft network error: ${error.errorCode} - ${error.errorMessage}`, | ||
| ConnectedAccountRefreshAccessTokenExceptionCode.TEMPORARY_NETWORK_ERROR, | ||
| ); | ||
| } | ||
|
|
||
| if (PERMANENT_AUTH_ERROR_CODES.has(error.errorCode)) { | ||
| return new ConnectedAccountRefreshAccessTokenException( | ||
| `Microsoft auth error: ${error.errorCode} - ${error.errorMessage}`, | ||
| ConnectedAccountRefreshAccessTokenExceptionCode.INVALID_REFRESH_TOKEN, | ||
| ); | ||
| } | ||
| } | ||
|
|
||
| const message = error instanceof Error ? error.message : String(error); | ||
|
|
||
| return new ConnectedAccountRefreshAccessTokenException( | ||
| `Microsoft token refresh failed: ${message}`, | ||
| ConnectedAccountRefreshAccessTokenExceptionCode.INVALID_REFRESH_TOKEN, | ||
| ); | ||
| }; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this is risky maybe give a bit more details in your PR description, thanks!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I did add the info here
#16954 (comment)
TLDR;
Microsoft wants you to offload the token lifecycle to their new SDK with a cache storage layer for persisting data.
This data is a proprietary JSON blob and not compatible with our existing schema as it involves heavy changes.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm sorry, I don't understand the rational behind this PR, what are we migrating? why? could you add more details?