add microsoft azure auth provider + add to example app

2020-08-21 15:46:17 +12:00
parent 95596b8129
commit b253c56526
15 changed files with 753 additions and 1 deletions
@@ -122,3 +122,16 @@ auth:
        domain:
          $secret:
            env: AUTH_AUTH0_DOMAIN
+    microsoft:
+      development:
+        appOrigin: "http://localhost:3000/"
+        secure: false
+        clientId:
+          $secret:
+            env: AUTH_AZURE_CLIENT_ID
+        clientSecret:
+          $secret:
+            env: AUTH_AZURE_CLIENT_SECRET
+        tenantId:
+          $secret:
+            env: AUTH_AZURE_TENANT_ID
@@ -30,6 +30,7 @@ import {
  OktaAuth,
  GitlabAuth,
  Auth0Auth,
+  MicrosoftAuth,
  oauthRequestApiRef,
  OAuthRequestManager,
  googleAuthApiRef,
@@ -38,6 +39,7 @@ import {
  oktaAuthApiRef,
  gitlabAuthApiRef,
  auth0AuthApiRef,
+  microsoftAuthApiRef,
  storageApiRef,
  WebStorage,
 } from '@backstage/core';
@@ -74,7 +76,10 @@ import {
  TravisCIApi,
  travisCIApiRef,
 } from '@roadiehq/backstage-plugin-travis-ci';
-import { GithubPullRequestsClient, githubPullRequestsApiRef } from '@roadiehq/backstage-plugin-github-pull-requests';
+import {
+  GithubPullRequestsClient,
+  githubPullRequestsApiRef,
+} from '@roadiehq/backstage-plugin-github-pull-requests';

 export const apis = (config: ConfigApi) => {
  // eslint-disable-next-line no-console
@@ -122,6 +127,15 @@ export const apis = (config: ConfigApi) => {
    }),
  );

+  builder.add(
+    microsoftAuthApiRef,
+    MicrosoftAuth.create({
+      backendUrl,
+      basePath: '/auth/',
+      oauthRequestApi,
+    }),
+  );
+
  const githubAuthApi = builder.add(
    githubAuthApiRef,
    GithubAuth.create({
@@ -19,6 +19,7 @@ import {
  gitlabAuthApiRef,
  oktaAuthApiRef,
  githubAuthApiRef,
+  microsoftAuthApiRef,
 } from '@backstage/core';

 export const providers = [
@@ -28,6 +29,12 @@ export const providers = [
    message: 'Sign In using Google',
    apiRef: googleAuthApiRef,
  },
+  {
+    id: 'microsoft-auth-provider',
+    title: 'Microsoft',
+    message: 'Sign In using Microsoft Azure AD',
+    apiRef: microsoftAuthApiRef,
+  },
  {
    id: 'gitlab-auth-provider',
    title: 'Gitlab',
@@ -277,6 +277,24 @@ export const auth0AuthApiRef = createApiRef<
  description: 'Provides authentication towards Auth0 APIs',
 });

+/**
+ * Provides authentication towards Microsoft APIs and identities.
+ *
+ * For more info and a full list of supported scopes, see:
+ * - https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent
+ * - https://docs.microsoft.com/en-us/graph/permissions-reference
+ */
+export const microsoftAuthApiRef = createApiRef<
+  OAuthApi &
+    OpenIdConnectApi &
+    ProfileInfoApi &
+    BackstageIdentityApi &
+    SessionStateApi
+>({
+  id: 'core.auth.microsoft',
+  description: 'Provides authentication towards Microsoft APIs and identities',
+});
+
 /**
 * Provides authentication for custom identity providers.
 */
@@ -20,3 +20,4 @@ export * from './google';
 export * from './oauth2';
 export * from './okta';
 export * from './auth0';
+export * from './microsoft';
@@ -0,0 +1,172 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import MicrosoftIcon from '@material-ui/icons/AcUnit';
+import { DefaultAuthConnector } from '../../../../lib/AuthConnector';
+import { MicrosoftSession } from './types';
+
+import {
+  OAuthApi,
+  OpenIdConnectApi,
+  ProfileInfoApi,
+  ProfileInfo,
+  SessionStateApi,
+  SessionState,
+  BackstageIdentityApi,
+  AuthRequestOptions,
+  BackstageIdentity,
+} from '../../../definitions/auth';
+
+import { OAuthRequestApi, AuthProvider } from '../../../definitions';
+import { SessionManager } from '../../../../lib/AuthSessionManager/types';
+import { RefreshingAuthSessionManager } from '../../../../lib/AuthSessionManager';
+import { Observable } from '../../../../types';
+
+type CreateOptions = {
+  backendUrl: string;
+  basePath: string;
+
+  oauthRequestApi: OAuthRequestApi;
+
+  environment?: string;
+  provider?: AuthProvider & { id: string };
+};
+
+export type MicrosoftAuthResponse = {
+  providerInfo: {
+    accessToken: string;
+    idToken: string;
+    scope: string;
+    expiresInSeconds: number;
+  };
+  profile: ProfileInfo;
+  backstageIdentity: BackstageIdentity;
+};
+
+const DEFAULT_PROVIDER = {
+  id: 'microsoft',
+  title: 'Microsoft',
+  icon: MicrosoftIcon,
+};
+
+class MicrosoftAuth
+  implements
+    OAuthApi,
+    OpenIdConnectApi,
+    ProfileInfoApi,
+    BackstageIdentityApi,
+    SessionStateApi {
+  static create({
+    backendUrl,
+    basePath,
+    environment = 'development',
+    provider = DEFAULT_PROVIDER,
+    oauthRequestApi,
+  }: CreateOptions) {
+    const connector = new DefaultAuthConnector({
+      backendUrl,
+      basePath,
+      environment,
+      provider,
+      oauthRequestApi: oauthRequestApi,
+      sessionTransform(res: MicrosoftAuthResponse): MicrosoftSession {
+        return {
+          ...res,
+          providerInfo: {
+            idToken: res.providerInfo.idToken,
+            accessToken: res.providerInfo.accessToken,
+            scopes: MicrosoftAuth.normalizeScopes(res.providerInfo.scope),
+            expiresAt: new Date(
+              Date.now() + res.providerInfo.expiresInSeconds * 1000,
+            ),
+          },
+        };
+      },
+    });
+
+    const sessionManager = new RefreshingAuthSessionManager({
+      connector,
+      defaultScopes: new Set([
+        'openid',
+        'offline_access',
+        'profile',
+        'email',
+        'User.Read',
+      ]),
+      sessionScopes: (session: MicrosoftSession) => session.providerInfo.scopes,
+      sessionShouldRefresh: (session: MicrosoftSession) => {
+        const expiresInSec =
+          (session.providerInfo.expiresAt.getTime() - Date.now()) / 1000;
+        return expiresInSec < 60 * 5;
+      },
+    });
+
+    return new MicrosoftAuth(sessionManager);
+  }
+
+  sessionState$(): Observable<SessionState> {
+    return this.sessionManager.sessionState$();
+  }
+
+  constructor(
+    private readonly sessionManager: SessionManager<MicrosoftSession>,
+  ) {}
+
+  async getAccessToken(
+    scope?: string | string[],
+    options?: AuthRequestOptions,
+  ) {
+    const session = await this.sessionManager.getSession({
+      ...options,
+      scopes: MicrosoftAuth.normalizeScopes(scope),
+    });
+    return session?.providerInfo.accessToken ?? '';
+  }
+
+  async getIdToken(options: AuthRequestOptions = {}) {
+    const session = await this.sessionManager.getSession(options);
+    return session?.providerInfo.idToken ?? '';
+  }
+
+  async logout() {
+    await this.sessionManager.removeSession();
+  }
+
+  async getBackstageIdentity(
+    options: AuthRequestOptions = {},
+  ): Promise<BackstageIdentity | undefined> {
+    const session = await this.sessionManager.getSession(options);
+    return session?.backstageIdentity;
+  }
+
+  async getProfile(options: AuthRequestOptions = {}) {
+    const session = await this.sessionManager.getSession(options);
+    return session?.profile;
+  }
+
+  static normalizeScopes(scopes?: string | string[]): Set<string> {
+    if (!scopes) {
+      return new Set();
+    }
+
+    const scopeList = Array.isArray(scopes)
+      ? scopes
+      : scopes.split(/[\s|,]/).filter(Boolean);
+
+    return new Set(scopeList);
+  }
+}
+export default MicrosoftAuth;
@@ -0,0 +1,18 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export * from './types';
+export { default as MicrosoftAuth } from './MicrosoftAuth';
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { ProfileInfo, BackstageIdentity } from '../../../definitions';
+
+export type MicrosoftSession = {
+  providerInfo: {
+    idToken: string;
+    accessToken: string;
+    scopes: Set<string>;
+    expiresAt: Date;
+  };
+  profile: ProfileInfo;
+  backstageIdentity: BackstageIdentity;
+};
@@ -21,6 +21,7 @@ import {
  identityApiRef,
  oauth2ApiRef,
  oktaAuthApiRef,
+  microsoftAuthApiRef,
  useApi,
  configApiRef,
 } from '@backstage/core-api';
@@ -60,6 +61,13 @@ export function SidebarUserSettings() {
            icon={Star}
          />
        )}
+        {providers.includes('microsoft') && (
+          <OIDCProviderSettings
+            title="Microsoft"
+            apiRef={microsoftAuthApiRef}
+            icon={Star}
+          />
+        )}
        {providers.includes('github') && (
          <OAuthProviderSettings
            title="Github"
@@ -74,6 +74,41 @@ export AUTH_AUTH0_CLIENT_ID=x
 export AUTH_AUTH0_CLIENT_SECRET=x
 ```

+### Microsoft
+
+#### Creating an Azure AD App Registration
+
+An Azure AD App Registration is required to be able to sign in using Azure AD and the Microsoft Graph API.  
+Click [here](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredApps) to create a new one.
+
+- Click on the `New Registration` button.
+- Give the app a name. e.g. `backstage-dev`
+- Select `Accounts in this organizational directory only` under supported account types.
+- Enter the callback URL for your backstage backend instance:
+   - For local development, this is likely `http://localhost:7000/auth/microsoft/handler/frame`
+   - For non-local deployments, this will be `https://{APP_FQDN}:{APP_BACKEND_PORT}/auth/microsoft/handler/frame`
+- Click `Register`.
+
+We also need to generate a client secret so Backstage can authenticate as this app.
+
+- Click on the `Certificates & secrets` menu item.
+- Under `Client secrets`, click on `New client secret`.
+- Add a description for the new secret. e.g. `auth-backend-plugin`
+- Select an expiry time; `1 Year`, `2 Years` or `Never`.
+- Click `Add`.
+
+The secret value will then be displayed on the screen. **You will not be able to retrieve it again after leaving the page**.
+
+#### Starting the Auth Backend
+
+```bash
+cd packages/backend
+export AUTH_AZURE_CLIENT_ID=x
+export AUTH_AZURE_CLIENT_SECRET=x
+export AUTH_AZURE_TENANT_ID=x
+yarn start
+```
+
 ### SAML

 To try out SAML, you can use the mock identity provider:
@@ -30,6 +30,7 @@
    "express": "^4.17.1",
    "express-promise-router": "^3.0.3",
    "fs-extra": "^9.0.0",
+    "got": "^11.5.2",
    "helmet": "^4.0.0",
    "jose": "^1.27.1",
    "jwt-decode": "2.2.0",
@@ -40,6 +41,7 @@
    "passport-github2": "^0.1.12",
    "passport-gitlab2": "^5.0.0",
    "passport-google-oauth20": "^2.0.0",
+    "passport-microsoft": "^0.1.0",
    "passport-oauth2": "^1.5.0",
    "passport-okta-oauth": "^0.0.1",
    "passport-saml": "^1.3.3",
@@ -55,6 +57,7 @@
    "@types/passport": "^1.0.3",
    "@types/passport-github2": "^1.2.4",
    "@types/passport-google-oauth20": "^2.0.3",
+    "@types/passport-microsoft": "^0.0.0",
    "@types/passport-saml": "^1.1.2",
    "jest-fetch-mock": "^3.0.3"
  },
@@ -24,6 +24,7 @@ import { createOAuth2Provider } from './oauth2';
 import { createOktaProvider } from './okta';
 import { createSamlProvider } from './saml';
 import { createAuth0Provider } from './auth0';
+import { createMicrosoftProvider } from './microsoft';
 import {
  AuthProviderConfig,
  AuthProviderFactory,
@@ -42,6 +43,7 @@ const factories: { [providerId: string]: AuthProviderFactory } = {
  saml: createSamlProvider,
  okta: createOktaProvider,
  auth0: createAuth0Provider,
+  microsoft: createMicrosoftProvider,
  oauth2: createOAuth2Provider,
 };

@@ -0,0 +1,17 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { createMicrosoftProvider } from './provider';
@@ -0,0 +1,257 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import express from 'express';
+import passport from 'passport';
+import { Strategy as MicrosoftStrategy } from 'passport-microsoft';
+
+import {
+  executeFrameHandlerStrategy,
+  executeRedirectStrategy,
+  executeRefreshTokenStrategy,
+  makeProfileInfo,
+  executeFetchUserProfileStrategy,
+} from '../../lib/PassportStrategyHelper';
+
+import {
+  OAuthProviderHandlers,
+  RedirectInfo,
+  AuthProviderConfig,
+  OAuthProviderOptions,
+  OAuthResponse,
+  PassportDoneCallback,
+} from '../types';
+
+import { OAuthProvider } from '../../lib/OAuthProvider';
+import { Logger } from 'winston';
+import { TokenIssuer } from '../../identity';
+import { Config } from '@backstage/config';
+
+import got from 'got';
+
+type PrivateInfo = {
+  refreshToken: string;
+};
+
+export type MicrosoftAuthProviderOptions = OAuthProviderOptions & {
+  authorizationUrl?: string;
+  tokenUrl?: string;
+};
+
+export class MicrosoftAuthProvider implements OAuthProviderHandlers {
+  private readonly _strategy: MicrosoftStrategy;
+
+  static transformAuthResponse(
+    accessToken: string,
+    params: any,
+    rawProfile: any,
+    photoURL?: any,
+  ): OAuthResponse {
+    let passportProfile: passport.Profile = rawProfile;
+    if (photoURL) {
+      passportProfile = {
+        ...passportProfile,
+        photos: [{ value: photoURL }],
+      };
+    }
+
+    const profile = makeProfileInfo(passportProfile, params.id_token);
+    const providerInfo = {
+      idToken: params.id_token,
+      accessToken,
+      scope: params.scope,
+      expiresInSeconds: params.expires_in,
+    };
+
+    return {
+      providerInfo,
+      profile,
+    };
+  }
+
+  constructor(options: MicrosoftAuthProviderOptions) {
+    this._strategy = new MicrosoftStrategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        authorizationURL: options.authorizationUrl,
+        tokenURL: options.tokenUrl,
+        passReqToCallback: false as true,
+      },
+      (
+        accessToken: any,
+        refreshToken: any,
+        params: any,
+        rawProfile: passport.Profile,
+        done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
+      ) => {
+        got
+          .get('https://graph.microsoft.com/v1.0/me/photos/48x48/$value', {
+            encoding: 'binary',
+            responseType: 'buffer',
+            headers: {
+              Authorization: `Bearer ${accessToken}`,
+            },
+          })
+          .then(photoData => {
+            const photoURL = `data:image/jpeg;base64,${Buffer.from(
+              photoData.body,
+            ).toString('base64')}`;
+            const authResponse = MicrosoftAuthProvider.transformAuthResponse(
+              accessToken,
+              params,
+              rawProfile,
+              photoURL,
+            );
+            done(undefined, authResponse, { refreshToken });
+          })
+          .catch(error => {
+            console.log(
+              `Error retrieving user photo from Microsoft Graph API: ${error}`,
+            );
+            const authResponse = MicrosoftAuthProvider.transformAuthResponse(
+              accessToken,
+              params,
+              rawProfile,
+            );
+            done(undefined, authResponse, { refreshToken });
+          });
+      },
+    );
+  }
+
+  async start(
+    req: express.Request,
+    options: Record<string, string>,
+  ): Promise<RedirectInfo> {
+    return await executeRedirectStrategy(req, this._strategy, options);
+  }
+
+  async handler(
+    req: express.Request,
+  ): Promise<{ response: OAuthResponse; refreshToken: string }> {
+    const { response, privateInfo } = await executeFrameHandlerStrategy<
+      OAuthResponse,
+      PrivateInfo
+    >(req, this._strategy);
+
+    return {
+      response: await this.populateIdentity(response),
+      refreshToken: privateInfo.refreshToken,
+    };
+  }
+
+  async refresh(refreshToken: string, scope: string): Promise<OAuthResponse> {
+    const { accessToken, params } = await executeRefreshTokenStrategy(
+      this._strategy,
+      refreshToken,
+      scope,
+    );
+
+    const profile = await executeFetchUserProfileStrategy(
+      this._strategy,
+      accessToken,
+      params.id_token,
+    );
+    const photo = await this.getUserPhoto(accessToken);
+    if (photo) {
+      profile.picture = photo;
+    }
+
+    return this.populateIdentity({
+      providerInfo: {
+        accessToken,
+        idToken: params.id_token,
+        expiresInSeconds: params.expires_in,
+        scope: params.scope,
+      },
+      profile,
+    });
+  }
+
+  private getUserPhoto(accessToken: string): Promise<string> {
+    return new Promise(resolve => {
+      got
+        .get('https://graph.microsoft.com/v1.0/me/photos/48x48/$value', {
+          encoding: 'binary',
+          responseType: 'buffer',
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+          },
+        })
+        .then(photoData => {
+          const photoURL = `data:image/jpeg;base64,${Buffer.from(
+            photoData.body,
+          ).toString('base64')}`;
+          resolve(photoURL);
+        })
+        .catch(error => {
+          console.log(
+            `Error retrieving user photo from Microsoft Graph API: ${error}`,
+          );
+          resolve();
+        });
+    });
+  }
+
+  private async populateIdentity(
+    response: OAuthResponse,
+  ): Promise<OAuthResponse> {
+    const { profile } = response;
+
+    if (!profile.email) {
+      throw new Error('Microsoft profile contained no email');
+    }
+
+    // Like Google implementation, setting this to local part of email for now
+    const id = profile.email.split('@')[0];
+
+    return { ...response, backstageIdentity: { id } };
+  }
+}
+
+export function createMicrosoftProvider(
+  config: AuthProviderConfig,
+  _: string,
+  envConfig: Config,
+  _logger: Logger,
+  tokenIssuer: TokenIssuer,
+) {
+  const providerId = 'microsoft';
+
+  const clientId = envConfig.getString('clientId');
+  const clientSecret = envConfig.getString('clientSecret');
+  const tenantID = envConfig.getString('tenantId');
+
+  const callbackUrl = `${config.baseUrl}/${providerId}/handler/frame`;
+  const authorizationUrl = `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/authorize`;
+  const tokenUrl = `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/token`;
+
+  const provider = new MicrosoftAuthProvider({
+    clientId,
+    clientSecret,
+    callbackUrl,
+    authorizationUrl,
+    tokenUrl,
+  });
+
+  return OAuthProvider.fromConfig(config, provider, {
+    disableRefresh: false,
+    providerId,
+    tokenIssuer,
+  });
+}
@@ -3419,6 +3419,11 @@
  resolved "https://registry.npmjs.org/@sindresorhus/is/-/is-0.7.0.tgz#9a06f4f137ee84d7df0460c1fdb1135ffa6c50fd"
  integrity sha512-ONhaKPIufzzrlNbqtWFFd+jlnemX6lJAgq9ZeiZtS7I1PIf/la7CW4m83rTXRnVnsMbW2k56pGYu7AUFJD9Pow==

+"@sindresorhus/is@^3.0.0":
+  version "3.1.1"
+  resolved "https://registry.npmjs.org/@sindresorhus/is/-/is-3.1.1.tgz#6e39e4222add8b362da35720c9dd5d53345d5851"
+  integrity sha512-tLnujxFtfH7F+i5ghUfgGlJsvyCKvUnSMFMlWybFdX9/DdX8svb4Zwx1gV0gkkVCHXtmPSetoAR3QlKfOld6Tw==
+
 "@sinonjs/commons@^1.7.0":
  version "1.7.1"
  resolved "https://registry.npmjs.org/@sinonjs/commons/-/commons-1.7.1.tgz#da5fd19a5f71177a53778073978873964f49acf1"
@@ -4302,6 +4307,13 @@
  dependencies:
    defer-to-connect "^1.0.1"

+"@szmarczak/http-timer@^4.0.5":
+  version "4.0.5"
+  resolved "https://registry.npmjs.org/@szmarczak/http-timer/-/http-timer-4.0.5.tgz#bfbd50211e9dfa51ba07da58a14cdfd333205152"
+  integrity sha512-PyRA9sm1Yayuj5OIoJ1hGt2YISX45w9WcFbh6ddT0Z/0yaFxOtGLInr4jUfU1EAFVs0Yfyfev4RNwBlUaHdlDQ==
+  dependencies:
+    defer-to-connect "^2.0.0"
+
 "@testing-library/cypress@^6.0.0":
  version "6.0.0"
  resolved "https://registry.npmjs.org/@testing-library/cypress/-/cypress-6.0.0.tgz#935f7716e0e495f02fd753a42621e4d350097dce"
@@ -4467,6 +4479,16 @@
    "@types/connect" "*"
    "@types/node" "*"

+"@types/cacheable-request@^6.0.1":
+  version "6.0.1"
+  resolved "https://registry.npmjs.org/@types/cacheable-request/-/cacheable-request-6.0.1.tgz#5d22f3dded1fd3a84c0bbeb5039a7419c2c91976"
+  integrity sha512-ykFq2zmBGOCbpIXtoVbz4SKY5QriWPh3AjyU4G74RYbtt5yOc5OfaY75ftjg7mikMOla1CTGpX3lLbuJh8DTrQ==
+  dependencies:
+    "@types/http-cache-semantics" "*"
+    "@types/keyv" "*"
+    "@types/node" "*"
+    "@types/responselike" "*"
+
 "@types/cheerio@^0.22.8":
  version "0.22.21"
  resolved "https://registry.npmjs.org/@types/cheerio/-/cheerio-0.22.21.tgz#5e37887de309ba11b2e19a6e14cad7874b31a8a3"
@@ -4739,6 +4761,11 @@
  resolved "https://registry.npmjs.org/@types/http-assert/-/http-assert-1.5.1.tgz#d775e93630c2469c2f980fc27e3143240335db3b"
  integrity sha512-PGAK759pxyfXE78NbKxyfRcWYA/KwW17X290cNev/qAsn9eQIxkH4shoNBafH37wewhDG/0p1cHPbK6+SzZjWQ==

+"@types/http-cache-semantics@*":
+  version "4.0.0"
+  resolved "https://registry.npmjs.org/@types/http-cache-semantics/-/http-cache-semantics-4.0.0.tgz#9140779736aa2655635ee756e2467d787cfe8a2a"
+  integrity sha512-c3Xy026kOF7QOTn00hbIllV1dLR9hG9NkSrLQgCVs8NF6sBU+VGWjD3wLPhmh1TYAc7ugCFsvHYMN4VcBN1U1A==
+
 "@types/http-errors@^1.6.3":
  version "1.8.0"
  resolved "https://registry.npmjs.org/@types/http-errors/-/http-errors-1.8.0.tgz#682477dbbbd07cd032731cb3b0e7eaee3d026b69"
@@ -4833,6 +4860,13 @@
  resolved "https://registry.npmjs.org/@types/keygrip/-/keygrip-1.0.2.tgz#513abfd256d7ad0bf1ee1873606317b33b1b2a72"
  integrity sha512-GJhpTepz2udxGexqos8wgaBx4I/zWIDPh/KOGEwAqtuGDkOUJu5eFvwmdBX4AmB8Odsr+9pHCQqiAqDL/yKMKw==

+"@types/keyv@*":
+  version "3.1.1"
+  resolved "https://registry.npmjs.org/@types/keyv/-/keyv-3.1.1.tgz#e45a45324fca9dab716ab1230ee249c9fb52cfa7"
+  integrity sha512-MPtoySlAZQ37VoLaPcTHCu1RWJ4llDkULYZIzOYxlhxBqYPB0RsRlmMU0R6tahtFe27mIdkHV+551ZWV4PLmVw==
+  dependencies:
+    "@types/node" "*"
+
 "@types/koa-compose@*":
  version "3.2.5"
  resolved "https://registry.npmjs.org/@types/koa-compose/-/koa-compose-3.2.5.tgz#85eb2e80ac50be95f37ccf8c407c09bbe3468e9d"
@@ -4976,6 +5010,13 @@
    "@types/passport" "*"
    "@types/passport-oauth2" "*"

+"@types/passport-microsoft@^0.0.0":
+  version "0.0.0"
+  resolved "https://registry.npmjs.org/@types/passport-microsoft/-/passport-microsoft-0.0.0.tgz#ba71bccdd793711239d6b02e8d5953c21abc1c8d"
+  integrity sha512-jfkltRosn+P/+RoFMTl+mCyBTgPTFhjDEF832j7fmlYpuf+5yuzPLz7Rm5XMKN/Gqpro6myCyGPTuCc4yBQ2jQ==
+  dependencies:
+    "@types/passport-oauth2" "*"
+
 "@types/passport-oauth2@*":
  version "1.4.9"
  resolved "https://registry.npmjs.org/@types/passport-oauth2/-/passport-oauth2-1.4.9.tgz#134007c4b505a82548c9cb19094c5baeb2205c92"
@@ -5150,6 +5191,13 @@
  dependencies:
    "@types/node" "*"

+"@types/responselike@*", "@types/responselike@^1.0.0":
+  version "1.0.0"
+  resolved "https://registry.npmjs.org/@types/responselike/-/responselike-1.0.0.tgz#251f4fe7d154d2bad125abe1b429b23afd262e29"
+  integrity sha512-85Y2BjiufFzaMIlvJDvTTB8Fxl2xfLo4HgmHzVBz08w4wDePCTjYw66PdrolO0kzli3yam/YCgRufyo1DdQVTA==
+  dependencies:
+    "@types/node" "*"
+
 "@types/rollup-plugin-peer-deps-external@^2.2.0":
  version "2.2.0"
  resolved "https://registry.npmjs.org/@types/rollup-plugin-peer-deps-external/-/rollup-plugin-peer-deps-external-2.2.0.tgz#eae7d8b9d27fa037f5bcaded24e389f85b81973c"
@@ -7389,6 +7437,11 @@ cache-base@^1.0.1:
    union-value "^1.0.0"
    unset-value "^1.0.0"

+cacheable-lookup@^5.0.3:
+  version "5.0.3"
+  resolved "https://registry.npmjs.org/cacheable-lookup/-/cacheable-lookup-5.0.3.tgz#049fdc59dffdd4fc285e8f4f82936591bd59fec3"
+  integrity sha512-W+JBqF9SWe18A72XFzN/V/CULFzPm7sBXzzR6ekkE+3tLG72wFZrBiBZhrZuDoYexop4PHJVdFAKb/Nj9+tm9w==
+
 cacheable-request@^2.1.1:
  version "2.1.4"
  resolved "https://registry.npmjs.org/cacheable-request/-/cacheable-request-2.1.4.tgz#0d808801b6342ad33c91df9d0b44dc09b91e5c3d"
@@ -7415,6 +7468,19 @@ cacheable-request@^6.0.0:
    normalize-url "^4.1.0"
    responselike "^1.0.2"

+cacheable-request@^7.0.1:
+  version "7.0.1"
+  resolved "https://registry.npmjs.org/cacheable-request/-/cacheable-request-7.0.1.tgz#062031c2856232782ed694a257fa35da93942a58"
+  integrity sha512-lt0mJ6YAnsrBErpTMWeu5kl/tg9xMAWjavYTN6VQXM1A/teBITuNcccXsCxF0tDQQJf9DfAaX5O4e0zp0KlfZw==
+  dependencies:
+    clone-response "^1.0.2"
+    get-stream "^5.1.0"
+    http-cache-semantics "^4.0.0"
+    keyv "^4.0.0"
+    lowercase-keys "^2.0.0"
+    normalize-url "^4.1.0"
+    responselike "^2.0.0"
+
 cachedir@^2.3.0:
  version "2.3.0"
  resolved "https://registry.npmjs.org/cachedir/-/cachedir-2.3.0.tgz#0c75892a052198f0b21c7c1804d8331edfcae0e8"
@@ -9100,6 +9166,13 @@ decompress-response@^4.2.0:
  dependencies:
    mimic-response "^2.0.0"

+decompress-response@^6.0.0:
+  version "6.0.0"
+  resolved "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz#ca387612ddb7e104bd16d85aab00d5ecf09c66fc"
+  integrity sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==
+  dependencies:
+    mimic-response "^3.1.0"
+
 decompress-tar@^4.0.0, decompress-tar@^4.1.0, decompress-tar@^4.1.1:
  version "4.1.1"
  resolved "https://registry.npmjs.org/decompress-tar/-/decompress-tar-4.1.1.tgz#718cbd3fcb16209716e70a26b84e7ba4592e5af1"
@@ -9215,6 +9288,11 @@ defer-to-connect@^1.0.1:
  resolved "https://registry.npmjs.org/defer-to-connect/-/defer-to-connect-1.1.3.tgz#331ae050c08dcf789f8c83a7b81f0ed94f4ac591"
  integrity sha512-0ISdNousHvZT2EiFlZeZAHBUvSxmKswVCEf8hW7KWgG4a8MVEu/3Vb6uWYozkjylyCxe0JBIiRB1jV45S70WVQ==

+defer-to-connect@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.npmjs.org/defer-to-connect/-/defer-to-connect-2.0.0.tgz#83d6b199db041593ac84d781b5222308ccf4c2c1"
+  integrity sha512-bYL2d05vOSf1JEZNx5vSAtPuBMkX8K9EUutg7zlKvTqKXHt7RhWJFbmd7qakVuf13i+IkGmp6FwSsONOf6VYIg==
+
 define-properties@^1.1.2, define-properties@^1.1.3:
  version "1.1.3"
  resolved "https://registry.npmjs.org/define-properties/-/define-properties-1.1.3.tgz#cf88da6cbee26fe6db7094f61d870cbd84cee9f1"
@@ -11853,6 +11931,23 @@ good-listener@^1.2.2:
  dependencies:
    delegate "^3.1.2"

+got@^11.5.2:
+  version "11.5.2"
+  resolved "https://registry.npmjs.org/got/-/got-11.5.2.tgz#772e3f3a06d9c7589c7c94dc3c83cdb31ddbf742"
+  integrity sha512-yUhpEDLeuGiGJjRSzEq3kvt4zJtAcjKmhIiwNp/eUs75tRlXfWcHo5tcBaMQtnjHWC7nQYT5HkY/l0QOQTkVww==
+  dependencies:
+    "@sindresorhus/is" "^3.0.0"
+    "@szmarczak/http-timer" "^4.0.5"
+    "@types/cacheable-request" "^6.0.1"
+    "@types/responselike" "^1.0.0"
+    cacheable-lookup "^5.0.3"
+    cacheable-request "^7.0.1"
+    decompress-response "^6.0.0"
+    http2-wrapper "^1.0.0-beta.5.0"
+    lowercase-keys "^2.0.0"
+    p-cancelable "^2.0.0"
+    responselike "^2.0.0"
+
 got@^7.0.0:
  version "7.1.0"
  resolved "https://registry.npmjs.org/got/-/got-7.1.0.tgz#05450fd84094e6bbea56f451a43a9c289166385a"
@@ -12554,6 +12649,14 @@ http-signature@~1.2.0:
    jsprim "^1.2.2"
    sshpk "^1.7.0"

+http2-wrapper@^1.0.0-beta.5.0:
+  version "1.0.0-beta.5.2"
+  resolved "https://registry.npmjs.org/http2-wrapper/-/http2-wrapper-1.0.0-beta.5.2.tgz#8b923deb90144aea65cf834b016a340fc98556f3"
+  integrity sha512-xYz9goEyBnC8XwXDTuC/MZ6t+MrKVQZOk4s7+PaDkwIsQd8IwqvM+0M6bA/2lvG8GHXcPdf+MejTUeO2LCPCeQ==
+  dependencies:
+    quick-lru "^5.1.1"
+    resolve-alpn "^1.0.0"
+
 https-browserify@^1.0.0:
  version "1.0.0"
  resolved "https://registry.npmjs.org/https-browserify/-/https-browserify-1.0.0.tgz#ec06c10e0a34c0f2faf199f7fd7fc78fffd03c73"
@@ -14292,6 +14395,11 @@ json-buffer@3.0.0:
  resolved "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.0.tgz#5b1f397afc75d677bde8bcfc0e47e1f9a3d9a898"
  integrity sha1-Wx85evx11ne96Lz8Dkfh+aPZqJg=

+json-buffer@3.0.1:
+  version "3.0.1"
+  resolved "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz#9338802a30d3b6605fbe0613e094008ca8c05a13"
+  integrity sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==
+
 json-parse-better-errors@^1.0.0, json-parse-better-errors@^1.0.1, json-parse-better-errors@^1.0.2:
  version "1.0.2"
  resolved "https://registry.npmjs.org/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz#bb867cfb3450e69107c131d1c514bab3dc8bcaa9"
@@ -14547,6 +14655,13 @@ keyv@^3.0.0:
  dependencies:
    json-buffer "3.0.0"

+keyv@^4.0.0:
+  version "4.0.1"
+  resolved "https://registry.npmjs.org/keyv/-/keyv-4.0.1.tgz#9fe703cb4a94d6d11729d320af033307efd02ee6"
+  integrity sha512-xz6Jv6oNkbhrFCvCP7HQa8AaII8y8LRpoSm661NOKLr4uHuBwhX4epXrPQgF3+xdJnN4Esm5X0xwY4bOlALOtw==
+  dependencies:
+    json-buffer "3.0.1"
+
 killable@^1.0.1:
  version "1.0.1"
  resolved "https://registry.npmjs.org/killable/-/killable-1.0.1.tgz#4c8ce441187a061c7474fb87ca08e2a638194892"
@@ -15738,6 +15853,11 @@ mimic-response@^2.0.0:
  resolved "https://registry.npmjs.org/mimic-response/-/mimic-response-2.1.0.tgz#d13763d35f613d09ec37ebb30bac0469c0ee8f43"
  integrity sha512-wXqjST+SLt7R009ySCglWBCFpjUygmCIfD790/kVbiGmUgfYGuB14PiTd5DwVxSV4NcYHjzMkoj5LjQZwTQLEA==

+mimic-response@^3.1.0:
+  version "3.1.0"
+  resolved "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz#2d1d59af9c1b129815accc2c46a022a5ce1fa3c9"
+  integrity sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==
+
 min-document@^2.19.0:
  version "2.19.0"
  resolved "https://registry.npmjs.org/min-document/-/min-document-2.19.0.tgz#7bd282e3f5842ed295bb748cdd9f1ffa2c824685"
@@ -16870,6 +16990,11 @@ p-cancelable@^1.0.0:
  resolved "https://registry.npmjs.org/p-cancelable/-/p-cancelable-1.1.0.tgz#d078d15a3af409220c886f1d9a0ca2e441ab26cc"
  integrity sha512-s73XxOZ4zpt1edZYZzvhqFa6uvQc1vwUa0K0BdtIZgQMAJj9IbebH+JkgKZc9h+B05PKHLOTl4ajG1BmNrVZlw==

+p-cancelable@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.npmjs.org/p-cancelable/-/p-cancelable-2.0.0.tgz#4a3740f5bdaf5ed5d7c3e34882c6fb5d6b266a6e"
+  integrity sha512-wvPXDmbMmu2ksjkB4Z3nZWTSkJEb9lqVdMaCKpZUGJG9TMiNp9XcbG3fn9fPKjem04fJMJnXoyFPk2FmgiaiNg==
+
 p-each-series@^2.1.0:
  version "2.1.0"
  resolved "https://registry.npmjs.org/p-each-series/-/p-each-series-2.1.0.tgz#961c8dd3f195ea96c747e636b262b800a6b1af48"
@@ -17253,6 +17378,14 @@ passport-google-oauth20@^2.0.0:
  dependencies:
    passport-oauth2 "1.x.x"

+passport-microsoft@^0.1.0:
+  version "0.1.0"
+  resolved "https://registry.npmjs.org/passport-microsoft/-/passport-microsoft-0.1.0.tgz#dc72c1a38b294d74f4dc55fe93f52e25cb9aa5b4"
+  integrity sha512-0giBDgE1fnR5X84zJZkQ11hnKVrzEgViwRO6RGsormK9zTxFQmN/UHMTDbIpvhk989VqALewB6Pk1R5vNr3GHw==
+  dependencies:
+    passport-oauth2 "1.2.0"
+    pkginfo "0.2.x"
+
 passport-oauth1@1.x.x:
  version "1.1.0"
  resolved "https://registry.npmjs.org/passport-oauth1/-/passport-oauth1-1.1.0.tgz#a7de988a211f9cf4687377130ea74df32730c918"
@@ -17262,6 +17395,15 @@ passport-oauth1@1.x.x:
    passport-strategy "1.x.x"
    utils-merge "1.x.x"

+passport-oauth2@1.2.0:
+  version "1.2.0"
+  resolved "https://registry.npmjs.org/passport-oauth2/-/passport-oauth2-1.2.0.tgz#49613a3eca85c7a1e65bf1019e2b6b80a10c8ac2"
+  integrity sha1-SWE6PsqFx6HmW/EBnitrgKEMisI=
+  dependencies:
+    oauth "0.9.x"
+    passport-strategy "1.x.x"
+    uid2 "0.0.x"
+
 passport-oauth2@1.x.x, passport-oauth2@^1.4.0, passport-oauth2@^1.5.0:
  version "1.5.0"
  resolved "https://registry.npmjs.org/passport-oauth2/-/passport-oauth2-1.5.0.tgz#64babbb54ac46a4dcab35e7f266ed5294e3c4108"
@@ -18539,6 +18681,11 @@ quick-lru@^4.0.1:
  resolved "https://registry.npmjs.org/quick-lru/-/quick-lru-4.0.1.tgz#5b8878f113a58217848c6482026c73e1ba57727f"
  integrity sha512-ARhCpm70fzdcvNQfPoy49IaanKkTlRWF2JMzqhcJbhSFRZv7nPTvZJdcY7301IPmvW+/p0RgIWnQDLJxifsQ7g==

+quick-lru@^5.1.1:
+  version "5.1.1"
+  resolved "https://registry.npmjs.org/quick-lru/-/quick-lru-5.1.1.tgz#366493e6b3e42a3a6885e2e99d18f80fb7a8c932"
+  integrity sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==
+
 raf-schd@^4.0.2:
  version "4.0.2"
  resolved "https://registry.npmjs.org/raf-schd/-/raf-schd-4.0.2.tgz#bd44c708188f2e84c810bf55fcea9231bcaed8a0"
@@ -19682,6 +19829,11 @@ resize-observer-polyfill@^1.5.1:
  resolved "https://registry.npmjs.org/resize-observer-polyfill/-/resize-observer-polyfill-1.5.1.tgz#0e9020dd3d21024458d4ebd27e23e40269810464"
  integrity sha512-LwZrotdHOo12nQuZlHEmtuXdqGoOD0OhaxopaNFxWzInpEgaLWoVuAMbTzixuosCx2nEG58ngzW3vxdWoxIgdg==

+resolve-alpn@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.npmjs.org/resolve-alpn/-/resolve-alpn-1.0.0.tgz#745ad60b3d6aff4b4a48e01b8c0bdc70959e0e8c"
+  integrity sha512-rTuiIEqFmGxne4IovivKSDzld2lWW9QCjqv80SYjPgf+gS35eaCAjaP54CCwGAwBtnCsvNLYtqxe1Nw+i6JEmA==
+
 resolve-cwd@^2.0.0:
  version "2.0.0"
  resolved "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-2.0.0.tgz#00a9f7387556e27038eae232caa372a6a59b665a"
@@ -19745,6 +19897,13 @@ responselike@1.0.2, responselike@^1.0.2:
  dependencies:
    lowercase-keys "^1.0.0"

+responselike@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.npmjs.org/responselike/-/responselike-2.0.0.tgz#26391bcc3174f750f9a79eacc40a12a5c42d7723"
+  integrity sha512-xH48u3FTB9VsZw7R+vvgaKeLKzT6jOogbQhEe/jewwnZgzPcnyWui2Av6JpoYZF/91uueC+lqhWqeURw5/qhCw==
+  dependencies:
+    lowercase-keys "^2.0.0"
+
 restore-cursor@^1.0.1:
  version "1.0.1"
  resolved "https://registry.npmjs.org/restore-cursor/-/restore-cursor-1.0.1.tgz#34661f46886327fed2991479152252df92daa541"