Merge commit 'be3e8236086165e5e45a5a10783823874b3f3ebd' as 'lib/vscode'

lib/vscode/extensions/microsoft-authentication/src/AADHelper.ts

@@ -0,0 +1,671 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as randomBytes from 'randombytes';
+import * as querystring from 'querystring';
+import { Buffer } from 'buffer';
+import * as vscode from 'vscode';
+import { createServer, startServer } from './authServer';
+
+import { v4 as uuid } from 'uuid';
+import { keychain } from './keychain';
+import Logger from './logger';
+import { toBase64UrlEncoding } from './utils';
+import fetch, { Response } from 'node-fetch';
+import { sha256 } from './env/node/sha256';
+import * as nls from 'vscode-nls';
+
+const localize = nls.loadMessageBundle();
+
+const redirectUrl = 'https://vscode-redirect.azurewebsites.net/';
+const loginEndpointUrl = 'https://login.microsoftonline.com/';
+const clientId = 'aebc6443-996d-45c2-90f0-388ff96faa56';
+const tenant = 'organizations';
+
+interface IToken {
+	accessToken?: string; // When unable to refresh due to network problems, the access token becomes undefined
+
+	expiresIn?: number; // How long access token is valid, in seconds
+	expiresAt?: number; // UNIX epoch time at which token will expire
+	refreshToken: string;
+
+	account: {
+		label: string;
+		id: string;
+	};
+	scope: string;
+	sessionId: string; // The account id + the scope
+}
+
+interface ITokenClaims {
+	tid: string;
+	email?: string;
+	unique_name?: string;
+	preferred_username?: string;
+	oid?: string;
+	altsecid?: string;
+	ipd?: string;
+	scp: string;
+}
+
+interface IStoredSession {
+	id: string;
+	refreshToken: string;
+	scope: string; // Scopes are alphabetized and joined with a space
+	account: {
+		label?: string;
+		displayName?: string,
+		id: string
+	}
+}
+
+export interface ITokenResponse {
+	access_token: string;
+	expires_in: number;
+	ext_expires_in: number;
+	refresh_token: string;
+	scope: string;
+	token_type: string;
+	id_token?: string;
+}
+
+function parseQuery(uri: vscode.Uri) {
+	return uri.query.split('&').reduce((prev: any, current) => {
+		const queryString = current.split('=');
+		prev[queryString[0]] = queryString[1];
+		return prev;
+	}, {});
+}
+
+export const onDidChangeSessions = new vscode.EventEmitter<vscode.AuthenticationProviderAuthenticationSessionsChangeEvent>();
+
+export const REFRESH_NETWORK_FAILURE = 'Network failure';
+
+class UriEventHandler extends vscode.EventEmitter<vscode.Uri> implements vscode.UriHandler {
+	public handleUri(uri: vscode.Uri) {
+		this.fire(uri);
+	}
+}
+
+export class AzureActiveDirectoryService {
+	private _tokens: IToken[] = [];
+	private _refreshTimeouts: Map<string, NodeJS.Timeout> = new Map<string, NodeJS.Timeout>();
+	private _uriHandler: UriEventHandler;
+	private _disposables: vscode.Disposable[] = [];
+
+	// Used to keep track of current requests when not using the local server approach.
+	private _pendingStates = new Map<string, string[]>();
+	private _codeExchangePromises = new Map<string, Promise<vscode.AuthenticationSession>>();
+	private _codeVerfifiers = new Map<string, string>();
+
+	constructor() {
+		this._uriHandler = new UriEventHandler();
+		this._disposables.push(vscode.window.registerUriHandler(this._uriHandler));
+	}
+
+	public async initialize(): Promise<void> {
+		const storedData = await keychain.getToken() || await keychain.tryMigrate();
+		if (storedData) {
+			try {
+				const sessions = this.parseStoredData(storedData);
+				const refreshes = sessions.map(async session => {
+					if (!session.refreshToken) {
+						return Promise.resolve();
+					}
+
+					try {
+						await this.refreshToken(session.refreshToken, session.scope, session.id);
+					} catch (e) {
+						if (e.message === REFRESH_NETWORK_FAILURE) {
+							const didSucceedOnRetry = await this.handleRefreshNetworkError(session.id, session.refreshToken, session.scope);
+							if (!didSucceedOnRetry) {
+								this._tokens.push({
+									accessToken: undefined,
+									refreshToken: session.refreshToken,
+									account: {
+										label: session.account.label ?? session.account.displayName!,
+										id: session.account.id
+									},
+									scope: session.scope,
+									sessionId: session.id
+								});
+								this.pollForReconnect(session.id, session.refreshToken, session.scope);
+							}
+						} else {
+							await this.logout(session.id);
+						}
+					}
+				});
+
+				await Promise.all(refreshes);
+			} catch (e) {
+				Logger.info('Failed to initialize stored data');
+				await this.clearSessions();
+			}
+		}
+
+		this._disposables.push(vscode.authentication.onDidChangePassword(() => this.checkForUpdates));
+	}
+
+	private parseStoredData(data: string): IStoredSession[] {
+		return JSON.parse(data);
+	}
+
+	private async storeTokenData(): Promise<void> {
+		const serializedData: IStoredSession[] = this._tokens.map(token => {
+			return {
+				id: token.sessionId,
+				refreshToken: token.refreshToken,
+				scope: token.scope,
+				account: token.account
+			};
+		});
+
+		await keychain.setToken(JSON.stringify(serializedData));
+	}
+
+	private async checkForUpdates(): Promise<void> {
+		const addedIds: string[] = [];
+		let removedIds: string[] = [];
+		const storedData = await keychain.getToken();
+		if (storedData) {
+			try {
+				const sessions = this.parseStoredData(storedData);
+				let promises = sessions.map(async session => {
+					const matchesExisting = this._tokens.some(token => token.scope === session.scope && token.sessionId === session.id);
+					if (!matchesExisting && session.refreshToken) {
+						try {
+							await this.refreshToken(session.refreshToken, session.scope, session.id);
+							addedIds.push(session.id);
+						} catch (e) {
+							if (e.message === REFRESH_NETWORK_FAILURE) {
+								// Ignore, will automatically retry on next poll.
+							} else {
+								await this.logout(session.id);
+							}
+						}
+					}
+				});
+
+				promises = promises.concat(this._tokens.map(async token => {
+					const matchesExisting = sessions.some(session => token.scope === session.scope && token.sessionId === session.id);
+					if (!matchesExisting) {
+						await this.logout(token.sessionId);
+						removedIds.push(token.sessionId);
+					}
+				}));
+
+				await Promise.all(promises);
+			} catch (e) {
+				Logger.error(e.message);
+				// if data is improperly formatted, remove all of it and send change event
+				removedIds = this._tokens.map(token => token.sessionId);
+				this.clearSessions();
+			}
+		} else {
+			if (this._tokens.length) {
+				// Log out all, remove all local data
+				removedIds = this._tokens.map(token => token.sessionId);
+				Logger.info('No stored keychain data, clearing local data');
+
+				this._tokens = [];
+
+				this._refreshTimeouts.forEach(timeout => {
+					clearTimeout(timeout);
+				});
+
+				this._refreshTimeouts.clear();
+			}
+		}
+
+		if (addedIds.length || removedIds.length) {
+			onDidChangeSessions.fire({ added: addedIds, removed: removedIds, changed: [] });
+		}
+	}
+
+	private async convertToSession(token: IToken): Promise<vscode.AuthenticationSession> {
+		const resolvedToken = await this.resolveAccessToken(token);
+		return {
+			id: token.sessionId,
+			accessToken: resolvedToken,
+			account: token.account,
+			scopes: token.scope.split(' ')
+		};
+	}
+
+	private async resolveAccessToken(token: IToken): Promise<string> {
+		if (token.accessToken && (!token.expiresAt || token.expiresAt > Date.now())) {
+			token.expiresAt
+				? Logger.info(`Token available from cache, expires in ${token.expiresAt - Date.now()} milliseconds`)
+				: Logger.info('Token available from cache');
+			return Promise.resolve(token.accessToken);
+		}
+
+		try {
+			Logger.info('Token expired or unavailable, trying refresh');
+			const refreshedToken = await this.refreshToken(token.refreshToken, token.scope, token.sessionId);
+			if (refreshedToken.accessToken) {
+				return refreshedToken.accessToken;
+			} else {
+				throw new Error();
+			}
+		} catch (e) {
+			throw new Error('Unavailable due to network problems');
+		}
+	}
+
+	private getTokenClaims(accessToken: string): ITokenClaims {
+		try {
+			return JSON.parse(Buffer.from(accessToken.split('.')[1], 'base64').toString());
+		} catch (e) {
+			Logger.error(e.message);
+			throw new Error('Unable to read token claims');
+		}
+	}
+
+	get sessions(): Promise<vscode.AuthenticationSession[]> {
+		return Promise.all(this._tokens.map(token => this.convertToSession(token)));
+	}
+
+	public async login(scope: string): Promise<vscode.AuthenticationSession> {
+		Logger.info('Logging in...');
+		if (!scope.includes('offline_access')) {
+			Logger.info('Warning: The \'offline_access\' scope was not included, so the generated token will not be able to be refreshed.');
+		}
+
+		return new Promise(async (resolve, reject) => {
+			if (vscode.env.uiKind === vscode.UIKind.Web) {
+				resolve(this.loginWithoutLocalServer(scope));
+				return;
+			}
+
+			const nonce = randomBytes(16).toString('base64');
+			const { server, redirectPromise, codePromise } = createServer(nonce);
+
+			let token: IToken | undefined;
+			try {
+				const port = await startServer(server);
+				vscode.env.openExternal(vscode.Uri.parse(`http://localhost:${port}/signin?nonce=${encodeURIComponent(nonce)}`));
+
+				const redirectReq = await redirectPromise;
+				if ('err' in redirectReq) {
+					const { err, res } = redirectReq;
+					res.writeHead(302, { Location: `/?error=${encodeURIComponent(err && err.message || 'Unknown error')}` });
+					res.end();
+					throw err;
+				}
+
+				const host = redirectReq.req.headers.host || '';
+				const updatedPortStr = (/^[^:]+:(\d+)$/.exec(Array.isArray(host) ? host[0] : host) || [])[1];
+				const updatedPort = updatedPortStr ? parseInt(updatedPortStr, 10) : port;
+
+				const state = `${updatedPort},${encodeURIComponent(nonce)}`;
+
+				const codeVerifier = toBase64UrlEncoding(randomBytes(32).toString('base64'));
+				const codeChallenge = toBase64UrlEncoding(await sha256(codeVerifier));
+				const loginUrl = `${loginEndpointUrl}${tenant}/oauth2/v2.0/authorize?response_type=code&response_mode=query&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUrl)}&state=${state}&scope=${encodeURIComponent(scope)}&prompt=select_account&code_challenge_method=S256&code_challenge=${codeChallenge}`;
+
+				await redirectReq.res.writeHead(302, { Location: loginUrl });
+				redirectReq.res.end();
+
+				const codeRes = await codePromise;
+				const res = codeRes.res;
+
+				try {
+					if ('err' in codeRes) {
+						throw codeRes.err;
+					}
+					token = await this.exchangeCodeForToken(codeRes.code, codeVerifier, scope);
+					this.setToken(token, scope);
+					Logger.info('Login successful');
+					res.writeHead(302, { Location: '/' });
+					const session = await this.convertToSession(token);
+					resolve(session);
+					res.end();
+				} catch (err) {
+					res.writeHead(302, { Location: `/?error=${encodeURIComponent(err && err.message || 'Unknown error')}` });
+					res.end();
+					reject(err.message);
+				}
+			} catch (e) {
+				Logger.error(e.message);
+
+				// If the error was about starting the server, try directly hitting the login endpoint instead
+				if (e.message === 'Error listening to server' || e.message === 'Closed' || e.message === 'Timeout waiting for port') {
+					await this.loginWithoutLocalServer(scope);
+				}
+
+				reject(e.message);
+			} finally {
+				setTimeout(() => {
+					server.close();
+				}, 5000);
+			}
+		});
+	}
+
+	public dispose(): void {
+		this._disposables.forEach(disposable => disposable.dispose());
+		this._disposables = [];
+	}
+
+	private getCallbackEnvironment(callbackUri: vscode.Uri): string {
+		if (callbackUri.authority.endsWith('.workspaces.github.com') || callbackUri.authority.endsWith('.github.dev')) {
+			return `${callbackUri.authority},`;
+		}
+
+		switch (callbackUri.authority) {
+			case 'online.visualstudio.com':
+				return 'vso,';
+			case 'online-ppe.core.vsengsaas.visualstudio.com':
+				return 'vsoppe,';
+			case 'online.dev.core.vsengsaas.visualstudio.com':
+				return 'vsodev,';
+			default:
+				return `${callbackUri.scheme},`;
+		}
+	}
+
+	private async loginWithoutLocalServer(scope: string): Promise<vscode.AuthenticationSession> {
+		const callbackUri = await vscode.env.asExternalUri(vscode.Uri.parse(`${vscode.env.uriScheme}://vscode.microsoft-authentication`));
+		const nonce = randomBytes(16).toString('base64');
+		const port = (callbackUri.authority.match(/:([0-9]*)$/) || [])[1] || (callbackUri.scheme === 'https' ? 443 : 80);
+		const callbackEnvironment = this.getCallbackEnvironment(callbackUri);
+		const state = `${callbackEnvironment}${port},${encodeURIComponent(nonce)},${encodeURIComponent(callbackUri.query)}`;
+		const signInUrl = `${loginEndpointUrl}${tenant}/oauth2/v2.0/authorize`;
+		let uri = vscode.Uri.parse(signInUrl);
+		const codeVerifier = toBase64UrlEncoding(randomBytes(32).toString('base64'));
+		const codeChallenge = toBase64UrlEncoding(await sha256(codeVerifier));
+		uri = uri.with({
+			query: `response_type=code&client_id=${encodeURIComponent(clientId)}&response_mode=query&redirect_uri=${redirectUrl}&state=${state}&scope=${scope}&prompt=select_account&code_challenge_method=S256&code_challenge=${codeChallenge}`
+		});
+		vscode.env.openExternal(uri);
+
+		const timeoutPromise = new Promise((_: (value: vscode.AuthenticationSession) => void, reject) => {
+			const wait = setTimeout(() => {
+				clearTimeout(wait);
+				reject('Login timed out.');
+			}, 1000 * 60 * 5);
+		});
+
+		const existingStates = this._pendingStates.get(scope) || [];
+		this._pendingStates.set(scope, [...existingStates, state]);
+
+		// Register a single listener for the URI callback, in case the user starts the login process multiple times
+		// before completing it.
+		let existingPromise = this._codeExchangePromises.get(scope);
+		if (!existingPromise) {
+			existingPromise = this.handleCodeResponse(scope);
+			this._codeExchangePromises.set(scope, existingPromise);
+		}
+
+		this._codeVerfifiers.set(state, codeVerifier);
+
+		return Promise.race([existingPromise, timeoutPromise])
+			.finally(() => {
+				this._pendingStates.delete(scope);
+				this._codeExchangePromises.delete(scope);
+				this._codeVerfifiers.delete(state);
+			});
+	}
+
+	private async handleCodeResponse(scope: string): Promise<vscode.AuthenticationSession> {
+		let uriEventListener: vscode.Disposable;
+		return new Promise((resolve: (value: vscode.AuthenticationSession) => void, reject) => {
+			uriEventListener = this._uriHandler.event(async (uri: vscode.Uri) => {
+				try {
+					const query = parseQuery(uri);
+					const code = query.code;
+
+					const acceptedStates = this._pendingStates.get(scope) || [];
+					// Workaround double encoding issues of state in web
+					if (!acceptedStates.includes(query.state) && !acceptedStates.includes(decodeURIComponent(query.state))) {
+						throw new Error('State does not match.');
+					}
+
+					const verifier = this._codeVerfifiers.get(query.state) ?? this._codeVerfifiers.get(decodeURIComponent(query.state));
+					if (!verifier) {
+						throw new Error('No available code verifier');
+					}
+
+					const token = await this.exchangeCodeForToken(code, verifier, scope);
+					this.setToken(token, scope);
+
+					const session = await this.convertToSession(token);
+					resolve(session);
+				} catch (err) {
+					reject(err);
+				}
+			});
+		}).then(result => {
+			uriEventListener.dispose();
+			return result;
+		}).catch(err => {
+			uriEventListener.dispose();
+			throw err;
+		});
+	}
+
+	private async setToken(token: IToken, scope: string): Promise<void> {
+		const existingTokenIndex = this._tokens.findIndex(t => t.sessionId === token.sessionId);
+		if (existingTokenIndex > -1) {
+			this._tokens.splice(existingTokenIndex, 1, token);
+		} else {
+			this._tokens.push(token);
+		}
+
+		this.clearSessionTimeout(token.sessionId);
+
+		if (token.expiresIn) {
+			this._refreshTimeouts.set(token.sessionId, setTimeout(async () => {
+				try {
+					await this.refreshToken(token.refreshToken, scope, token.sessionId);
+					onDidChangeSessions.fire({ added: [], removed: [], changed: [token.sessionId] });
+				} catch (e) {
+					if (e.message === REFRESH_NETWORK_FAILURE) {
+						const didSucceedOnRetry = await this.handleRefreshNetworkError(token.sessionId, token.refreshToken, scope);
+						if (!didSucceedOnRetry) {
+							this.pollForReconnect(token.sessionId, token.refreshToken, token.scope);
+						}
+					} else {
+						await this.logout(token.sessionId);
+						onDidChangeSessions.fire({ added: [], removed: [token.sessionId], changed: [] });
+					}
+				}
+			}, 1000 * (token.expiresIn - 30)));
+		}
+
+		this.storeTokenData();
+	}
+
+	private getTokenFromResponse(json: ITokenResponse, scope: string, existingId?: string): IToken {
+		let claims = undefined;
+
+		try {
+			claims = this.getTokenClaims(json.access_token);
+		} catch (e) {
+			if (json.id_token) {
+				Logger.info('Failed to fetch token claims from access_token. Attempting to parse id_token instead');
+				claims = this.getTokenClaims(json.id_token);
+			} else {
+				throw e;
+			}
+		}
+
+		return {
+			expiresIn: json.expires_in,
+			expiresAt: json.expires_in ? Date.now() + json.expires_in * 1000 : undefined,
+			accessToken: json.access_token,
+			refreshToken: json.refresh_token,
+			scope,
+			sessionId: existingId || `${claims.tid}/${(claims.oid || (claims.altsecid || '' + claims.ipd || ''))}/${uuid()}`,
+			account: {
+				label: claims.email || claims.unique_name || claims.preferred_username || 'user@example.com',
+				id: `${claims.tid}/${(claims.oid || (claims.altsecid || '' + claims.ipd || ''))}`
+			}
+		};
+	}
+
+	private async exchangeCodeForToken(code: string, codeVerifier: string, scope: string): Promise<IToken> {
+		Logger.info('Exchanging login code for token');
+		try {
+			const postData = querystring.stringify({
+				grant_type: 'authorization_code',
+				code: code,
+				client_id: clientId,
+				scope: scope,
+				code_verifier: codeVerifier,
+				redirect_uri: redirectUrl
+			});
+
+			const proxyEndpoints: { [providerId: string]: string } | undefined = await vscode.commands.executeCommand('workbench.getCodeExchangeProxyEndpoints');
+			const endpoint = proxyEndpoints && proxyEndpoints['microsoft'] || `${loginEndpointUrl}${tenant}/oauth2/v2.0/token`;
+
+			const result = await fetch(endpoint, {
+				method: 'POST',
+				headers: {
+					'Content-Type': 'application/x-www-form-urlencoded',
+					'Content-Length': postData.length.toString()
+				},
+				body: postData
+			});
+
+			if (result.ok) {
+				Logger.info('Exchanging login code for token success');
+				const json = await result.json();
+				return this.getTokenFromResponse(json, scope);
+			} else {
+				Logger.error('Exchanging login code for token failed');
+				throw new Error('Unable to login.');
+			}
+		} catch (e) {
+			Logger.error(e.message);
+			throw e;
+		}
+	}
+
+	private async refreshToken(refreshToken: string, scope: string, sessionId: string): Promise<IToken> {
+		Logger.info('Refreshing token...');
+		const postData = querystring.stringify({
+			refresh_token: refreshToken,
+			client_id: clientId,
+			grant_type: 'refresh_token',
+			scope: scope
+		});
+
+		let result: Response;
+		try {
+			result = await fetch(`https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`, {
+				method: 'POST',
+				headers: {
+					'Content-Type': 'application/x-www-form-urlencoded',
+					'Content-Length': postData.length.toString()
+				},
+				body: postData
+			});
+		} catch (e) {
+			Logger.error('Refreshing token failed');
+			throw new Error(REFRESH_NETWORK_FAILURE);
+		}
+
+		try {
+			if (result.ok) {
+				const json = await result.json();
+				const token = this.getTokenFromResponse(json, scope, sessionId);
+				this.setToken(token, scope);
+				Logger.info('Token refresh success');
+				return token;
+			} else {
+				throw new Error('Bad request.');
+			}
+		} catch (e) {
+			vscode.window.showErrorMessage(localize('signOut', "You have been signed out because reading stored authentication information failed."));
+			Logger.error(`Refreshing token failed: ${result.statusText}`);
+			throw new Error('Refreshing token failed');
+		}
+	}
+
+	private clearSessionTimeout(sessionId: string): void {
+		const timeout = this._refreshTimeouts.get(sessionId);
+		if (timeout) {
+			clearTimeout(timeout);
+			this._refreshTimeouts.delete(sessionId);
+		}
+	}
+
+	private removeInMemorySessionData(sessionId: string) {
+		const tokenIndex = this._tokens.findIndex(token => token.sessionId === sessionId);
+		if (tokenIndex > -1) {
+			this._tokens.splice(tokenIndex, 1);
+		}
+
+		this.clearSessionTimeout(sessionId);
+	}
+
+	private pollForReconnect(sessionId: string, refreshToken: string, scope: string): void {
+		this.clearSessionTimeout(sessionId);
+
+		this._refreshTimeouts.set(sessionId, setTimeout(async () => {
+			try {
+				await this.refreshToken(refreshToken, scope, sessionId);
+			} catch (e) {
+				this.pollForReconnect(sessionId, refreshToken, scope);
+			}
+		}, 1000 * 60 * 30));
+	}
+
+	private handleRefreshNetworkError(sessionId: string, refreshToken: string, scope: string, attempts: number = 1): Promise<boolean> {
+		return new Promise((resolve, _) => {
+			if (attempts === 3) {
+				Logger.error('Token refresh failed after 3 attempts');
+				return resolve(false);
+			}
+
+			if (attempts === 1) {
+				const token = this._tokens.find(token => token.sessionId === sessionId);
+				if (token) {
+					token.accessToken = undefined;
+					onDidChangeSessions.fire({ added: [], removed: [], changed: [token.sessionId] });
+				}
+			}
+
+			const delayBeforeRetry = 5 * attempts * attempts;
+
+			this.clearSessionTimeout(sessionId);
+
+			this._refreshTimeouts.set(sessionId, setTimeout(async () => {
+				try {
+					await this.refreshToken(refreshToken, scope, sessionId);
+					return resolve(true);
+				} catch (e) {
+					return resolve(await this.handleRefreshNetworkError(sessionId, refreshToken, scope, attempts + 1));
+				}
+			}, 1000 * delayBeforeRetry));
+		});
+	}
+
+	public async logout(sessionId: string) {
+		Logger.info(`Logging out of session '${sessionId}'`);
+		this.removeInMemorySessionData(sessionId);
+
+		if (this._tokens.length === 0) {
+			await keychain.deleteToken();
+		} else {
+			this.storeTokenData();
+		}
+	}
+
+	public async clearSessions() {
+		Logger.info('Logging out of all sessions');
+		this._tokens = [];
+		await keychain.deleteToken();
+
+		this._refreshTimeouts.forEach(timeout => {
+			clearTimeout(timeout);
+		});
+
+		this._refreshTimeouts.clear();
+	}
+}

lib/vscode/extensions/microsoft-authentication/src/authServer.ts

@@ -0,0 +1,155 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as http from 'http';
+import * as url from 'url';
+import * as fs from 'fs';
+import * as path from 'path';
+
+interface Deferred<T> {
+	resolve: (result: T | Promise<T>) => void;
+	reject: (reason: any) => void;
+}
+
+/**
+ * Asserts that the argument passed in is neither undefined nor null.
+ */
+function assertIsDefined<T>(arg: T | null | undefined): T {
+	if (typeof (arg) === 'undefined' || arg === null) {
+		throw new Error('Assertion Failed: argument is undefined or null');
+	}
+
+	return arg;
+}
+
+export async function startServer(server: http.Server): Promise<string> {
+	let portTimer: NodeJS.Timer;
+
+	function cancelPortTimer() {
+		clearTimeout(portTimer);
+	}
+
+	const port = new Promise<string>((resolve, reject) => {
+		portTimer = setTimeout(() => {
+			reject(new Error('Timeout waiting for port'));
+		}, 5000);
+
+		server.on('listening', () => {
+			const address = server.address();
+			if (typeof address === 'string') {
+				resolve(address);
+			} else {
+				resolve(assertIsDefined(address).port.toString());
+			}
+		});
+
+		server.on('error', _ => {
+			reject(new Error('Error listening to server'));
+		});
+
+		server.on('close', () => {
+			reject(new Error('Closed'));
+		});
+
+		server.listen(0);
+	});
+
+	port.then(cancelPortTimer, cancelPortTimer);
+	return port;
+}
+
+function sendFile(res: http.ServerResponse, filepath: string, contentType: string) {
+	fs.readFile(filepath, (err, body) => {
+		if (err) {
+			console.error(err);
+			res.writeHead(404);
+			res.end();
+		} else {
+			res.writeHead(200, {
+				'Content-Length': body.length,
+				'Content-Type': contentType
+			});
+			res.end(body);
+		}
+	});
+}
+
+async function callback(nonce: string, reqUrl: url.Url): Promise<string> {
+	const query = reqUrl.query;
+	if (!query || typeof query === 'string') {
+		throw new Error('No query received.');
+	}
+
+	let error = query.error_description || query.error;
+
+	if (!error) {
+		const state = (query.state as string) || '';
+		const receivedNonce = (state.split(',')[1] || '').replace(/ /g, '+');
+		if (receivedNonce !== nonce) {
+			error = 'Nonce does not match.';
+		}
+	}
+
+	const code = query.code as string;
+	if (!error && code) {
+		return code;
+	}
+
+	throw new Error((error as string) || 'No code received.');
+}
+
+export function createServer(nonce: string) {
+	type RedirectResult = { req: http.IncomingMessage; res: http.ServerResponse; } | { err: any; res: http.ServerResponse; };
+	let deferredRedirect: Deferred<RedirectResult>;
+	const redirectPromise = new Promise<RedirectResult>((resolve, reject) => deferredRedirect = { resolve, reject });
+
+	type CodeResult = { code: string; res: http.ServerResponse; } | { err: any; res: http.ServerResponse; };
+	let deferredCode: Deferred<CodeResult>;
+	const codePromise = new Promise<CodeResult>((resolve, reject) => deferredCode = { resolve, reject });
+
+	const codeTimer = setTimeout(() => {
+		deferredCode.reject(new Error('Timeout waiting for code'));
+	}, 5 * 60 * 1000);
+
+	function cancelCodeTimer() {
+		clearTimeout(codeTimer);
+	}
+
+	const server = http.createServer(function (req, res) {
+		const reqUrl = url.parse(req.url!, /* parseQueryString */ true);
+		switch (reqUrl.pathname) {
+			case '/signin':
+				const receivedNonce = ((reqUrl.query.nonce as string) || '').replace(/ /g, '+');
+				if (receivedNonce === nonce) {
+					deferredRedirect.resolve({ req, res });
+				} else {
+					const err = new Error('Nonce does not match.');
+					deferredRedirect.resolve({ err, res });
+				}
+				break;
+			case '/':
+				sendFile(res, path.join(__dirname, '../media/auth.html'), 'text/html; charset=utf-8');
+				break;
+			case '/auth.css':
+				sendFile(res, path.join(__dirname, '../media/auth.css'), 'text/css; charset=utf-8');
+				break;
+			case '/callback':
+				deferredCode.resolve(callback(nonce, reqUrl)
+					.then(code => ({ code, res }), err => ({ err, res })));
+				break;
+			default:
+				res.writeHead(404);
+				res.end();
+				break;
+		}
+	});
+
+	codePromise.then(cancelCodeTimer, cancelCodeTimer);
+	return {
+		server,
+		redirectPromise,
+		codePromise
+	};
+}

lib/vscode/extensions/microsoft-authentication/src/env/browser/authServer.ts

@@ -0,0 +1,12 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+export function startServer(_: any): any {
+	throw new Error('Not implemented');
+}
+
+export function createServer(_: any): any {
+	throw new Error('Not implemented');
+}

lib/vscode/extensions/microsoft-authentication/src/env/browser/sha256.ts

@@ -0,0 +1,11 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+export async function sha256(s: string | Uint8Array): Promise<string> {
+	const createHash = require('sha.js');
+	return createHash('sha256').update(s).digest('base64');
+}

lib/vscode/extensions/microsoft-authentication/src/env/node/sha256.ts

@@ -0,0 +1,10 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+'use strict';
+
+export async function sha256(s: string | Uint8Array): Promise<string> {
+	return (require('crypto')).createHash('sha256').update(s).digest('base64');
+}

lib/vscode/extensions/microsoft-authentication/src/extension.ts

@@ -0,0 +1,68 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as vscode from 'vscode';
+import { AzureActiveDirectoryService, onDidChangeSessions } from './AADHelper';
+import TelemetryReporter from 'vscode-extension-telemetry';
+
+export const DEFAULT_SCOPES = 'https://management.core.windows.net/.default offline_access';
+
+export async function activate(context: vscode.ExtensionContext) {
+	const { name, version, aiKey } = require('../package.json') as { name: string, version: string, aiKey: string };
+	const telemetryReporter = new TelemetryReporter(name, version, aiKey);
+
+	const loginService = new AzureActiveDirectoryService();
+	context.subscriptions.push(loginService);
+
+	await loginService.initialize();
+
+	context.subscriptions.push(vscode.authentication.registerAuthenticationProvider({
+		id: 'microsoft',
+		label: 'Microsoft',
+		supportsMultipleAccounts: true,
+		onDidChangeSessions: onDidChangeSessions.event,
+		getSessions: () => Promise.resolve(loginService.sessions),
+		login: async (scopes: string[]) => {
+			try {
+				/* __GDPR__
+					"login" : { }
+				*/
+				telemetryReporter.sendTelemetryEvent('login');
+
+				const session = await loginService.login(scopes.sort().join(' '));
+				onDidChangeSessions.fire({ added: [session.id], removed: [], changed: [] });
+				return session;
+			} catch (e) {
+				/* __GDPR__
+					"loginFailed" : { }
+				*/
+				telemetryReporter.sendTelemetryEvent('loginFailed');
+
+				throw e;
+			}
+		},
+		logout: async (id: string) => {
+			try {
+				/* __GDPR__
+					"logout" : { }
+				*/
+				telemetryReporter.sendTelemetryEvent('logout');
+
+				await loginService.logout(id);
+				onDidChangeSessions.fire({ added: [], removed: [id], changed: [] });
+			} catch (e) {
+				/* __GDPR__
+					"logoutFailed" : { }
+				*/
+				telemetryReporter.sendTelemetryEvent('logoutFailed');
+			}
+		}
+	}));
+
+	return;
+}
+
+// this method is called when your extension is deactivated
+export function deactivate() { }

lib/vscode/extensions/microsoft-authentication/src/keychain.ts

@@ -0,0 +1,106 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+// keytar depends on a native module shipped in vscode, so this is
+// how we load it
+import * as keytarType from 'keytar';
+import * as vscode from 'vscode';
+import Logger from './logger';
+import * as nls from 'vscode-nls';
+
+const localize = nls.loadMessageBundle();
+
+function getKeytar(): Keytar | undefined {
+	try {
+		return require('keytar');
+	} catch (err) {
+		console.log(err);
+	}
+
+	return undefined;
+}
+
+export type Keytar = {
+	getPassword: typeof keytarType['getPassword'];
+	setPassword: typeof keytarType['setPassword'];
+	deletePassword: typeof keytarType['deletePassword'];
+};
+
+const OLD_SERVICE_ID = `${vscode.env.uriScheme}-microsoft.login`;
+const SERVICE_ID = `microsoft.login`;
+const ACCOUNT_ID = 'account';
+
+export class Keychain {
+	private keytar: Keytar;
+
+	constructor() {
+		const keytar = getKeytar();
+		if (!keytar) {
+			throw new Error('System keychain unavailable');
+		}
+
+		this.keytar = keytar;
+	}
+
+
+	async setToken(token: string): Promise<void> {
+		try {
+			return await vscode.authentication.setPassword(SERVICE_ID, token);
+		} catch (e) {
+			Logger.error(`Setting token failed: ${e}`);
+
+			// Temporary fix for #94005
+			// This happens when processes write simulatenously to the keychain, most
+			// likely when trying to refresh the token. Ignore the error since additional
+			// writes after the first one do not matter. Should actually be fixed upstream.
+			if (e.message === 'The specified item already exists in the keychain.') {
+				return;
+			}
+
+			const troubleshooting = localize('troubleshooting', "Troubleshooting Guide");
+			const result = await vscode.window.showErrorMessage(localize('keychainWriteError', "Writing login information to the keychain failed with error '{0}'.", e.message), troubleshooting);
+			if (result === troubleshooting) {
+				vscode.env.openExternal(vscode.Uri.parse('https://code.visualstudio.com/docs/editor/settings-sync#_troubleshooting-keychain-issues'));
+			}
+		}
+	}
+
+	async getToken(): Promise<string | null | undefined> {
+		try {
+			return await vscode.authentication.getPassword(SERVICE_ID);
+		} catch (e) {
+			// Ignore
+			Logger.error(`Getting token failed: ${e}`);
+			return Promise.resolve(undefined);
+		}
+	}
+
+	async deleteToken(): Promise<void> {
+		try {
+			return await vscode.authentication.deletePassword(SERVICE_ID);
+		} catch (e) {
+			// Ignore
+			Logger.error(`Deleting token failed: ${e}`);
+			return Promise.resolve(undefined);
+		}
+	}
+
+	async tryMigrate(): Promise<string | null> {
+		try {
+			const oldValue = await this.keytar.getPassword(OLD_SERVICE_ID, ACCOUNT_ID);
+			if (oldValue) {
+				await this.setToken(oldValue);
+				await this.keytar.deletePassword(OLD_SERVICE_ID, ACCOUNT_ID);
+			}
+
+			return oldValue;
+		} catch (_) {
+			// Ignore
+			return Promise.resolve(null);
+		}
+	}
+}
+
+export const keychain = new Keychain();

lib/vscode/extensions/microsoft-authentication/src/logger.ts

@@ -0,0 +1,55 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as vscode from 'vscode';
+
+type LogLevel = 'Info' | 'Error';
+
+class Log {
+	private output: vscode.OutputChannel;
+
+	constructor() {
+		this.output = vscode.window.createOutputChannel('Microsoft Authentication');
+	}
+
+	private data2String(data: any): string {
+		if (data instanceof Error) {
+			return data.stack || data.message;
+		}
+		if (data.success === false && data.message) {
+			return data.message;
+		}
+		return data.toString();
+	}
+
+	public info(message: string, data?: any): void {
+		this.logLevel('Info', message, data);
+	}
+
+	public error(message: string, data?: any): void {
+		this.logLevel('Error', message, data);
+	}
+
+	public logLevel(level: LogLevel, message: string, data?: any): void {
+		this.output.appendLine(`[${level}  - ${this.now()}] ${message}`);
+		if (data) {
+			this.output.appendLine(this.data2String(data));
+		}
+	}
+
+	private now(): string {
+		const now = new Date();
+		return padLeft(now.getUTCHours() + '', 2, '0')
+			+ ':' + padLeft(now.getMinutes() + '', 2, '0')
+			+ ':' + padLeft(now.getUTCSeconds() + '', 2, '0') + '.' + now.getMilliseconds();
+	}
+}
+
+function padLeft(s: string, n: number, pad = ' ') {
+	return pad.repeat(Math.max(0, n - s.length)) + s;
+}
+
+const Logger = new Log();
+export default Logger;

lib/vscode/extensions/microsoft-authentication/src/typings/refs.d.ts

@@ -0,0 +1,7 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+/// <reference path='../../../../src/vs/vscode.d.ts'/>
+/// <reference path='../../../../src/vs/vscode.proposed.d.ts'/>

lib/vscode/extensions/microsoft-authentication/src/utils.ts

@@ -0,0 +1,8 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+export function toBase64UrlEncoding(base64string: string) {
+	return base64string.replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_'); // Need to use base64url encoding
+}