Merge from vscode 79a1f5a5ca0c6c53db617aa1fa5a2396d2caebe2

extensions/microsoft-authentication/src/AADHelper.ts

@@ -0,0 +1,618 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as crypto from 'crypto';
+import * as https from 'https';
+import * as querystring from 'querystring';
+import * as vscode from 'vscode';
+import * as uuid from 'uuid';
+import { createServer, startServer } from './authServer';
+import { keychain } from './keychain';
+import Logger from './logger';
+import { toBase64UrlEncoding } from './utils';
+
+const redirectUrl = 'https://vscode-redirect.azurewebsites.net/';
+const loginEndpointUrl = 'https://login.microsoftonline.com/';
+const clientId = 'aebc6443-996d-45c2-90f0-388ff96faa56';
+const tenant = 'organizations';
+
+interface IToken {
+	accessToken?: string; // When unable to refresh due to network problems, the access token becomes undefined
+
+	expiresIn?: string; // How long access token is valid, in seconds
+	expiresAt?: number; // UNIX epoch time at which token will expire
+	refreshToken: string;
+
+	account: {
+		displayName: string;
+		id: string;
+	};
+	scope: string;
+	sessionId: string; // The account id + the scope
+}
+
+interface ITokenClaims {
+	tid: string;
+	email?: string;
+	unique_name?: string;
+	oid?: string;
+	altsecid?: string;
+	ipd?: string;
+	scp: string;
+}
+
+interface IStoredSession {
+	id: string;
+	refreshToken: string;
+	scope: string; // Scopes are alphabetized and joined with a space
+	account: {
+		displayName: string,
+		id: string
+	}
+}
+
+function parseQuery(uri: vscode.Uri) {
+	return uri.query.split('&').reduce((prev: any, current) => {
+		const queryString = current.split('=');
+		prev[queryString[0]] = queryString[1];
+		return prev;
+	}, {});
+}
+
+export const onDidChangeSessions = new vscode.EventEmitter<vscode.AuthenticationSessionsChangeEvent>();
+
+export const REFRESH_NETWORK_FAILURE = 'Network failure';
+
+class UriEventHandler extends vscode.EventEmitter<vscode.Uri> implements vscode.UriHandler {
+	public handleUri(uri: vscode.Uri) {
+		this.fire(uri);
+	}
+}
+
+export class AzureActiveDirectoryService {
+	private _tokens: IToken[] = [];
+	private _refreshTimeouts: Map<string, NodeJS.Timeout> = new Map<string, NodeJS.Timeout>();
+	private _uriHandler: UriEventHandler;
+
+	constructor() {
+		this._uriHandler = new UriEventHandler();
+		vscode.window.registerUriHandler(this._uriHandler);
+	}
+
+	public async initialize(): Promise<void> {
+		const storedData = await keychain.getToken();
+		if (storedData) {
+			try {
+				const sessions = this.parseStoredData(storedData);
+				const refreshes = sessions.map(async session => {
+					try {
+						await this.refreshToken(session.refreshToken, session.scope, session.id);
+					} catch (e) {
+						if (e.message === REFRESH_NETWORK_FAILURE) {
+							const didSucceedOnRetry = await this.handleRefreshNetworkError(session.id, session.refreshToken, session.scope);
+							if (!didSucceedOnRetry) {
+								this._tokens.push({
+									accessToken: undefined,
+									refreshToken: session.refreshToken,
+									account: {
+										displayName: session.account.displayName,
+										id: session.account.id
+									},
+									scope: session.scope,
+									sessionId: session.id
+								});
+								this.pollForReconnect(session.id, session.refreshToken, session.scope);
+							}
+						} else {
+							await this.logout(session.id);
+						}
+					}
+				});
+
+				await Promise.all(refreshes);
+			} catch (e) {
+				Logger.info('Failed to initialize stored data');
+				await this.clearSessions();
+			}
+		}
+
+		this.pollForChange();
+	}
+
+	private parseStoredData(data: string): IStoredSession[] {
+		return JSON.parse(data);
+	}
+
+	private async storeTokenData(): Promise<void> {
+		const serializedData: IStoredSession[] = this._tokens.map(token => {
+			return {
+				id: token.sessionId,
+				refreshToken: token.refreshToken,
+				scope: token.scope,
+				account: token.account
+			};
+		});
+
+		await keychain.setToken(JSON.stringify(serializedData));
+	}
+
+	private pollForChange() {
+		setTimeout(async () => {
+			const addedIds: string[] = [];
+			let removedIds: string[] = [];
+			const storedData = await keychain.getToken();
+			if (storedData) {
+				try {
+					const sessions = this.parseStoredData(storedData);
+					let promises = sessions.map(async session => {
+						const matchesExisting = this._tokens.some(token => token.scope === session.scope && token.sessionId === session.id);
+						if (!matchesExisting) {
+							try {
+								await this.refreshToken(session.refreshToken, session.scope, session.id);
+								addedIds.push(session.id);
+							} catch (e) {
+								if (e.message === REFRESH_NETWORK_FAILURE) {
+									// Ignore, will automatically retry on next poll.
+								} else {
+									await this.logout(session.id);
+								}
+							}
+						}
+					});
+
+					promises = promises.concat(this._tokens.map(async token => {
+						const matchesExisting = sessions.some(session => token.scope === session.scope && token.sessionId === session.id);
+						if (!matchesExisting) {
+							await this.logout(token.sessionId);
+							removedIds.push(token.sessionId);
+						}
+					}));
+
+					await Promise.all(promises);
+				} catch (e) {
+					Logger.error(e.message);
+					// if data is improperly formatted, remove all of it and send change event
+					removedIds = this._tokens.map(token => token.sessionId);
+					this.clearSessions();
+				}
+			} else {
+				if (this._tokens.length) {
+					// Log out all, remove all local data
+					removedIds = this._tokens.map(token => token.sessionId);
+					Logger.info('No stored keychain data, clearing local data');
+
+					this._tokens = [];
+
+					this._refreshTimeouts.forEach(timeout => {
+						clearTimeout(timeout);
+					});
+
+					this._refreshTimeouts.clear();
+				}
+			}
+
+			if (addedIds.length || removedIds.length) {
+				onDidChangeSessions.fire({ added: addedIds, removed: removedIds, changed: [] });
+			}
+
+			this.pollForChange();
+		}, 1000 * 30);
+	}
+
+	private async convertToSession(token: IToken): Promise<vscode.AuthenticationSession2> {
+		const resolvedToken = await this.resolveAccessToken(token);
+		return new vscode.AuthenticationSession2(token.sessionId, resolvedToken, token.account, token.scope.split(' '));
+	}
+
+	private async resolveAccessToken(token: IToken): Promise<string> {
+		if (token.accessToken && (!token.expiresAt || token.expiresAt > Date.now())) {
+			token.expiresAt
+				? Logger.info(`Token available from cache, expires in ${token.expiresAt - Date.now()} milliseconds`)
+				: Logger.info('Token available from cache');
+			return Promise.resolve(token.accessToken);
+		}
+
+		try {
+			Logger.info('Token expired or unavailable, trying refresh');
+			const refreshedToken = await this.refreshToken(token.refreshToken, token.scope, token.sessionId);
+			if (refreshedToken.accessToken) {
+				return refreshedToken.accessToken;
+			} else {
+				throw new Error();
+			}
+		} catch (e) {
+			throw new Error('Unavailable due to network problems');
+		}
+	}
+
+	private getTokenClaims(accessToken: string): ITokenClaims {
+		try {
+			return JSON.parse(Buffer.from(accessToken.split('.')[1], 'base64').toString());
+		} catch (e) {
+			Logger.error(e.message);
+			throw new Error('Unable to read token claims');
+		}
+	}
+
+	get sessions(): Promise<vscode.AuthenticationSession2[]> {
+		return Promise.all(this._tokens.map(token => this.convertToSession(token)));
+	}
+
+	public async login(scope: string): Promise<vscode.AuthenticationSession2> {
+		Logger.info('Logging in...');
+		return new Promise(async (resolve, reject) => {
+			if (vscode.env.uiKind === vscode.UIKind.Web) {
+				resolve(this.loginWithoutLocalServer(scope));
+				return;
+			}
+
+			const nonce = crypto.randomBytes(16).toString('base64');
+			const { server, redirectPromise, codePromise } = createServer(nonce);
+
+			let token: IToken | undefined;
+			try {
+				const port = await startServer(server);
+				vscode.env.openExternal(vscode.Uri.parse(`http://localhost:${port}/signin?nonce=${encodeURIComponent(nonce)}`));
+
+				const redirectReq = await redirectPromise;
+				if ('err' in redirectReq) {
+					const { err, res } = redirectReq;
+					res.writeHead(302, { Location: `/?error=${encodeURIComponent(err && err.message || 'Unknown error')}` });
+					res.end();
+					throw err;
+				}
+
+				const host = redirectReq.req.headers.host || '';
+				const updatedPortStr = (/^[^:]+:(\d+)$/.exec(Array.isArray(host) ? host[0] : host) || [])[1];
+				const updatedPort = updatedPortStr ? parseInt(updatedPortStr, 10) : port;
+
+				const state = `${updatedPort},${encodeURIComponent(nonce)}`;
+
+				const codeVerifier = toBase64UrlEncoding(crypto.randomBytes(32).toString('base64'));
+				const codeChallenge = toBase64UrlEncoding(crypto.createHash('sha256').update(codeVerifier).digest('base64'));
+				const loginUrl = `${loginEndpointUrl}${tenant}/oauth2/v2.0/authorize?response_type=code&response_mode=query&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUrl)}&state=${state}&scope=${encodeURIComponent(scope)}&prompt=select_account&code_challenge_method=S256&code_challenge=${codeChallenge}`;
+
+				await redirectReq.res.writeHead(302, { Location: loginUrl });
+				redirectReq.res.end();
+
+				const codeRes = await codePromise;
+				const res = codeRes.res;
+
+				try {
+					if ('err' in codeRes) {
+						throw codeRes.err;
+					}
+					token = await this.exchangeCodeForToken(codeRes.code, codeVerifier, scope);
+					this.setToken(token, scope);
+					Logger.info('Login successful');
+					res.writeHead(302, { Location: '/' });
+					const session = await this.convertToSession(token);
+					resolve(session);
+					res.end();
+				} catch (err) {
+					res.writeHead(302, { Location: `/?error=${encodeURIComponent(err && err.message || 'Unknown error')}` });
+					res.end();
+					reject(err.message);
+				}
+			} catch (e) {
+				Logger.error(e.message);
+
+				// If the error was about starting the server, try directly hitting the login endpoint instead
+				if (e.message === 'Error listening to server' || e.message === 'Closed' || e.message === 'Timeout waiting for port') {
+					await this.loginWithoutLocalServer(scope);
+				}
+
+				reject(e.message);
+			} finally {
+				setTimeout(() => {
+					server.close();
+				}, 5000);
+			}
+		});
+	}
+
+	private getCallbackEnvironment(callbackUri: vscode.Uri): string {
+		if (callbackUri.authority.endsWith('.workspaces.github.com')) {
+			return `${callbackUri.authority},`;
+		}
+
+		switch (callbackUri.authority) {
+			case 'online.visualstudio.com':
+				return 'vso,';
+			case 'online-ppe.core.vsengsaas.visualstudio.com':
+				return 'vsoppe,';
+			case 'online.dev.core.vsengsaas.visualstudio.com':
+				return 'vsodev,';
+			default:
+				return '';
+		}
+	}
+
+	private async loginWithoutLocalServer(scope: string): Promise<vscode.AuthenticationSession2> {
+		const callbackUri = await vscode.env.asExternalUri(vscode.Uri.parse(`${vscode.env.uriScheme}://vscode.microsoft-authentication`));
+		const nonce = crypto.randomBytes(16).toString('base64');
+		const port = (callbackUri.authority.match(/:([0-9]*)$/) || [])[1] || (callbackUri.scheme === 'https' ? 443 : 80);
+		const callbackEnvironment = this.getCallbackEnvironment(callbackUri);
+		const state = `${callbackEnvironment}${port},${encodeURIComponent(nonce)},${encodeURIComponent(callbackUri.query)}`;
+		const signInUrl = `${loginEndpointUrl}${tenant}/oauth2/v2.0/authorize`;
+		let uri = vscode.Uri.parse(signInUrl);
+		const codeVerifier = toBase64UrlEncoding(crypto.randomBytes(32).toString('base64'));
+		const codeChallenge = toBase64UrlEncoding(crypto.createHash('sha256').update(codeVerifier).digest('base64'));
+		uri = uri.with({
+			query: `response_type=code&client_id=${encodeURIComponent(clientId)}&response_mode=query&redirect_uri=${redirectUrl}&state=${state}&scope=${scope}&prompt=select_account&code_challenge_method=S256&code_challenge=${codeChallenge}`
+		});
+		vscode.env.openExternal(uri);
+
+		const timeoutPromise = new Promise((_: (value: vscode.AuthenticationSession2) => void, reject) => {
+			const wait = setTimeout(() => {
+				clearTimeout(wait);
+				reject('Login timed out.');
+			}, 1000 * 60 * 5);
+		});
+
+		return Promise.race([this.handleCodeResponse(state, codeVerifier, scope), timeoutPromise]);
+	}
+
+	private async handleCodeResponse(state: string, codeVerifier: string, scope: string): Promise<vscode.AuthenticationSession2> {
+		let uriEventListener: vscode.Disposable;
+		return new Promise((resolve: (value: vscode.AuthenticationSession2) => void, reject) => {
+			uriEventListener = this._uriHandler.event(async (uri: vscode.Uri) => {
+				try {
+					const query = parseQuery(uri);
+					const code = query.code;
+
+					// Workaround double encoding issues of state in web
+					if (query.state !== state && decodeURIComponent(query.state) !== state) {
+						throw new Error('State does not match.');
+					}
+
+					const token = await this.exchangeCodeForToken(code, codeVerifier, scope);
+					this.setToken(token, scope);
+
+					const session = await this.convertToSession(token);
+					resolve(session);
+				} catch (err) {
+					reject(err);
+				}
+			});
+		}).then(result => {
+			uriEventListener.dispose();
+			return result;
+		}).catch(err => {
+			uriEventListener.dispose();
+			throw err;
+		});
+	}
+
+	private async setToken(token: IToken, scope: string): Promise<void> {
+		const existingTokenIndex = this._tokens.findIndex(t => t.sessionId === token.sessionId);
+		if (existingTokenIndex > -1) {
+			this._tokens.splice(existingTokenIndex, 1, token);
+		} else {
+			this._tokens.push(token);
+		}
+
+		this.clearSessionTimeout(token.sessionId);
+
+		if (token.expiresIn) {
+			this._refreshTimeouts.set(token.sessionId, setTimeout(async () => {
+				try {
+					await this.refreshToken(token.refreshToken, scope, token.sessionId);
+					onDidChangeSessions.fire({ added: [], removed: [], changed: [token.sessionId] });
+				} catch (e) {
+					if (e.message === REFRESH_NETWORK_FAILURE) {
+						const didSucceedOnRetry = await this.handleRefreshNetworkError(token.sessionId, token.refreshToken, scope);
+						if (!didSucceedOnRetry) {
+							this.pollForReconnect(token.sessionId, token.refreshToken, token.scope);
+						}
+					} else {
+						await this.logout(token.sessionId);
+						onDidChangeSessions.fire({ added: [], removed: [token.sessionId], changed: [] });
+					}
+				}
+			}, 1000 * (parseInt(token.expiresIn) - 30)));
+		}
+
+		this.storeTokenData();
+	}
+
+	private getTokenFromResponse(buffer: Buffer[], scope: string, existingId?: string): IToken {
+		const json = JSON.parse(Buffer.concat(buffer).toString());
+		const claims = this.getTokenClaims(json.access_token);
+		return {
+			expiresIn: json.expires_in,
+			expiresAt: json.expires_in ? Date.now() + json.expires_in * 1000 : undefined,
+			accessToken: json.access_token,
+			refreshToken: json.refresh_token,
+			scope,
+			sessionId: existingId || `${claims.tid}/${(claims.oid || (claims.altsecid || '' + claims.ipd || ''))}/${uuid()}`,
+			account: {
+				displayName: claims.email || claims.unique_name || 'user@example.com',
+				id: `${claims.tid}/${(claims.oid || (claims.altsecid || '' + claims.ipd || ''))}`
+			}
+		};
+	}
+
+	private async exchangeCodeForToken(code: string, codeVerifier: string, scope: string): Promise<IToken> {
+		return new Promise((resolve: (value: IToken) => void, reject) => {
+			Logger.info('Exchanging login code for token');
+			try {
+				const postData = querystring.stringify({
+					grant_type: 'authorization_code',
+					code: code,
+					client_id: clientId,
+					scope: scope,
+					code_verifier: codeVerifier,
+					redirect_uri: redirectUrl
+				});
+
+				const tokenUrl = vscode.Uri.parse(`${loginEndpointUrl}${tenant}/oauth2/v2.0/token`);
+
+				const post = https.request({
+					host: tokenUrl.authority,
+					path: tokenUrl.path,
+					method: 'POST',
+					headers: {
+						'Content-Type': 'application/x-www-form-urlencoded',
+						'Content-Length': postData.length
+					}
+				}, result => {
+					const buffer: Buffer[] = [];
+					result.on('data', (chunk: Buffer) => {
+						buffer.push(chunk);
+					});
+					result.on('end', () => {
+						if (result.statusCode === 200) {
+							Logger.info('Exchanging login code for token success');
+							resolve(this.getTokenFromResponse(buffer, scope));
+						} else {
+							Logger.error('Exchanging login code for token failed');
+							reject(new Error('Unable to login.'));
+						}
+					});
+				});
+
+				post.write(postData);
+
+				post.end();
+				post.on('error', err => {
+					reject(err);
+				});
+
+			} catch (e) {
+				Logger.error(e.message);
+				reject(e);
+			}
+		});
+	}
+
+	private async refreshToken(refreshToken: string, scope: string, sessionId: string): Promise<IToken> {
+		return new Promise((resolve: (value: IToken) => void, reject) => {
+			Logger.info('Refreshing token...');
+			const postData = querystring.stringify({
+				refresh_token: refreshToken,
+				client_id: clientId,
+				grant_type: 'refresh_token',
+				scope: scope
+			});
+
+			const post = https.request({
+				host: 'login.microsoftonline.com',
+				path: `/${tenant}/oauth2/v2.0/token`,
+				method: 'POST',
+				headers: {
+					'Content-Type': 'application/x-www-form-urlencoded',
+					'Content-Length': postData.length
+				}
+			}, result => {
+				const buffer: Buffer[] = [];
+				result.on('data', (chunk: Buffer) => {
+					buffer.push(chunk);
+				});
+				result.on('end', async () => {
+					if (result.statusCode === 200) {
+						const token = this.getTokenFromResponse(buffer, scope, sessionId);
+						this.setToken(token, scope);
+						Logger.info('Token refresh success');
+						resolve(token);
+					} else {
+						Logger.error('Refreshing token failed');
+						reject(new Error('Refreshing token failed.'));
+					}
+				});
+			});
+
+			post.write(postData);
+
+			post.end();
+			post.on('error', err => {
+				Logger.error(err.message);
+				reject(new Error(REFRESH_NETWORK_FAILURE));
+			});
+		});
+	}
+
+	private clearSessionTimeout(sessionId: string): void {
+		const timeout = this._refreshTimeouts.get(sessionId);
+		if (timeout) {
+			clearTimeout(timeout);
+			this._refreshTimeouts.delete(sessionId);
+		}
+	}
+
+	private removeInMemorySessionData(sessionId: string) {
+		const tokenIndex = this._tokens.findIndex(token => token.sessionId === sessionId);
+		if (tokenIndex > -1) {
+			this._tokens.splice(tokenIndex, 1);
+		}
+
+		this.clearSessionTimeout(sessionId);
+	}
+
+	private pollForReconnect(sessionId: string, refreshToken: string, scope: string): void {
+		this.clearSessionTimeout(sessionId);
+
+		this._refreshTimeouts.set(sessionId, setTimeout(async () => {
+			try {
+				await this.refreshToken(refreshToken, scope, sessionId);
+			} catch (e) {
+				this.pollForReconnect(sessionId, refreshToken, scope);
+			}
+		}, 1000 * 60 * 30));
+	}
+
+	private handleRefreshNetworkError(sessionId: string, refreshToken: string, scope: string, attempts: number = 1): Promise<boolean> {
+		return new Promise((resolve, _) => {
+			if (attempts === 3) {
+				Logger.error('Token refresh failed after 3 attempts');
+				return resolve(false);
+			}
+
+			if (attempts === 1) {
+				const token = this._tokens.find(token => token.sessionId === sessionId);
+				if (token) {
+					token.accessToken = undefined;
+					onDidChangeSessions.fire({ added: [], removed: [], changed: [token.sessionId] });
+				}
+			}
+
+			const delayBeforeRetry = 5 * attempts * attempts;
+
+			this.clearSessionTimeout(sessionId);
+
+			this._refreshTimeouts.set(sessionId, setTimeout(async () => {
+				try {
+					await this.refreshToken(refreshToken, scope, sessionId);
+					return resolve(true);
+				} catch (e) {
+					return resolve(await this.handleRefreshNetworkError(sessionId, refreshToken, scope, attempts + 1));
+				}
+			}, 1000 * delayBeforeRetry));
+		});
+	}
+
+	public async logout(sessionId: string) {
+		Logger.info(`Logging out of session '${sessionId}'`);
+		this.removeInMemorySessionData(sessionId);
+
+		if (this._tokens.length === 0) {
+			await keychain.deleteToken();
+		} else {
+			this.storeTokenData();
+		}
+	}
+
+	public async clearSessions() {
+		Logger.info('Logging out of all sessions');
+		this._tokens = [];
+		await keychain.deleteToken();
+
+		this._refreshTimeouts.forEach(timeout => {
+			clearTimeout(timeout);
+		});
+
+		this._refreshTimeouts.clear();
+	}
+}

extensions/microsoft-authentication/src/authServer.ts

@@ -0,0 +1,197 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as http from 'http';
+import * as url from 'url';
+import * as fs from 'fs';
+import * as net from 'net';
+import * as path from 'path';
+
+interface Deferred<T> {
+	resolve: (result: T | Promise<T>) => void;
+	reject: (reason: any) => void;
+}
+
+const _typeof = {
+	number: 'number',
+	string: 'string',
+	undefined: 'undefined',
+	object: 'object',
+	function: 'function'
+};
+
+/**
+ * @returns whether the provided parameter is undefined.
+ */
+export function isUndefined(obj: any): obj is undefined {
+	return typeof (obj) === _typeof.undefined;
+}
+
+/**
+ * @returns whether the provided parameter is undefined or null.
+ */
+export function isUndefinedOrNull(obj: any): obj is undefined | null {
+	return isUndefined(obj) || obj === null;
+}
+
+/**
+ * Asserts that the argument passed in is neither undefined nor null.
+ */
+export function assertIsDefined<T>(arg: T | null | undefined): T {
+	if (isUndefinedOrNull(arg)) {
+		throw new Error('Assertion Failed: argument is undefined or null');
+	}
+
+	return arg;
+}
+
+export function createTerminateServer(server: http.Server) {
+	const sockets: Record<number, net.Socket> = {};
+	let socketCount = 0;
+	server.on('connection', socket => {
+		const id = socketCount++;
+		sockets[id] = socket;
+		socket.on('close', () => {
+			delete sockets[id];
+		});
+	});
+	return async () => {
+		const result = new Promise<Error | undefined>(resolve => server.close(resolve));
+		for (const id in sockets) {
+			sockets[id].destroy();
+		}
+		return result;
+	};
+}
+
+export async function startServer(server: http.Server): Promise<string> {
+	let portTimer: NodeJS.Timer;
+
+	function cancelPortTimer() {
+		clearTimeout(portTimer);
+	}
+
+	const port = new Promise<string>((resolve, reject) => {
+		portTimer = setTimeout(() => {
+			reject(new Error('Timeout waiting for port'));
+		}, 5000);
+
+		server.on('listening', () => {
+			const address = server.address();
+			if (typeof address === 'string') {
+				resolve(address);
+			} else {
+				resolve(assertIsDefined(address).port.toString());
+			}
+		});
+
+		server.on('error', _ => {
+			reject(new Error('Error listening to server'));
+		});
+
+		server.on('close', () => {
+			reject(new Error('Closed'));
+		});
+
+		server.listen(0);
+	});
+
+	port.then(cancelPortTimer, cancelPortTimer);
+	return port;
+}
+
+function sendFile(res: http.ServerResponse, filepath: string, contentType: string) {
+	fs.readFile(filepath, (err, body) => {
+		if (err) {
+			console.error(err);
+			res.writeHead(404);
+			res.end();
+		} else {
+			res.writeHead(200, {
+				'Content-Length': body.length,
+				'Content-Type': contentType
+			});
+			res.end(body);
+		}
+	});
+}
+
+async function callback(nonce: string, reqUrl: url.Url): Promise<string> {
+	const query = reqUrl.query;
+	if (!query || typeof query === 'string') {
+		throw new Error('No query received.');
+	}
+
+	let error = query.error_description || query.error;
+
+	if (!error) {
+		const state = (query.state as string) || '';
+		const receivedNonce = (state.split(',')[1] || '').replace(/ /g, '+');
+		if (receivedNonce !== nonce) {
+			error = 'Nonce does not match.';
+		}
+	}
+
+	const code = query.code as string;
+	if (!error && code) {
+		return code;
+	}
+
+	throw new Error((error as string) || 'No code received.');
+}
+
+export function createServer(nonce: string) {
+	type RedirectResult = { req: http.IncomingMessage; res: http.ServerResponse; } | { err: any; res: http.ServerResponse; };
+	let deferredRedirect: Deferred<RedirectResult>;
+	const redirectPromise = new Promise<RedirectResult>((resolve, reject) => deferredRedirect = { resolve, reject });
+
+	type CodeResult = { code: string; res: http.ServerResponse; } | { err: any; res: http.ServerResponse; };
+	let deferredCode: Deferred<CodeResult>;
+	const codePromise = new Promise<CodeResult>((resolve, reject) => deferredCode = { resolve, reject });
+
+	const codeTimer = setTimeout(() => {
+		deferredCode.reject(new Error('Timeout waiting for code'));
+	}, 5 * 60 * 1000);
+
+	function cancelCodeTimer() {
+		clearTimeout(codeTimer);
+	}
+
+	const server = http.createServer(function (req, res) {
+		const reqUrl = url.parse(req.url!, /* parseQueryString */ true);
+		switch (reqUrl.pathname) {
+			case '/signin':
+				const receivedNonce = ((reqUrl.query.nonce as string) || '').replace(/ /g, '+');
+				if (receivedNonce === nonce) {
+					deferredRedirect.resolve({ req, res });
+				} else {
+					const err = new Error('Nonce does not match.');
+					deferredRedirect.resolve({ err, res });
+				}
+				break;
+			case '/':
+				sendFile(res, path.join(__dirname, '../media/auth.html'), 'text/html; charset=utf-8');
+				break;
+			case '/auth.css':
+				sendFile(res, path.join(__dirname, '../media/auth.css'), 'text/css; charset=utf-8');
+				break;
+			case '/callback':
+				deferredCode.resolve(callback(nonce, reqUrl)
+					.then(code => ({ code, res }), err => ({ err, res })));
+				break;
+			default:
+				res.writeHead(404);
+				res.end();
+				break;
+		}
+	});
+
+	codePromise.then(cancelCodeTimer, cancelCodeTimer);
+	return {
+		server,
+		redirectPromise,
+		codePromise
+	};
+}

extensions/microsoft-authentication/src/extension.ts

@@ -0,0 +1,52 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as vscode from 'vscode';
+import { AzureActiveDirectoryService, onDidChangeSessions } from './AADHelper';
+import TelemetryReporter from 'vscode-extension-telemetry';
+
+export const DEFAULT_SCOPES = 'https://management.core.windows.net/.default offline_access';
+
+export async function activate(context: vscode.ExtensionContext) {
+	const { name, version, aiKey } = require('../package.json') as { name: string, version: string, aiKey: string };
+	const telemetryReporter = new TelemetryReporter(name, version, aiKey);
+
+	const loginService = new AzureActiveDirectoryService();
+
+	await loginService.initialize();
+
+	context.subscriptions.push(vscode.authentication.registerAuthenticationProvider({
+		id: 'microsoft',
+		displayName: 'Microsoft',
+		supportsMultipleAccounts: true,
+		onDidChangeSessions: onDidChangeSessions.event,
+		getSessions: () => Promise.resolve(loginService.sessions),
+		login: async (scopes: string[]) => {
+			try {
+				telemetryReporter.sendTelemetryEvent('login');
+				const session = await loginService.login(scopes.sort().join(' '));
+				onDidChangeSessions.fire({ added: [session.id], removed: [], changed: [] });
+				return session;
+			} catch (e) {
+				telemetryReporter.sendTelemetryEvent('loginFailed');
+				throw e;
+			}
+		},
+		logout: async (id: string) => {
+			try {
+				telemetryReporter.sendTelemetryEvent('logout');
+				await loginService.logout(id);
+				onDidChangeSessions.fire({ added: [], removed: [id], changed: [] });
+			} catch (e) {
+				telemetryReporter.sendTelemetryEvent('logoutFailed');
+			}
+		}
+	}));
+
+	return;
+}
+
+// this method is called when your extension is deactivated
+export function deactivate() { }

extensions/microsoft-authentication/src/keychain.ts

@@ -0,0 +1,90 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+// keytar depends on a native module shipped in vscode, so this is
+// how we load it
+import * as keytarType from 'keytar';
+import * as vscode from 'vscode';
+import Logger from './logger';
+import * as nls from 'vscode-nls';
+
+const localize = nls.loadMessageBundle();
+
+function getKeytar(): Keytar | undefined {
+	try {
+		return require('keytar');
+	} catch (err) {
+		console.log(err);
+	}
+
+	return undefined;
+}
+
+export type Keytar = {
+	getPassword: typeof keytarType['getPassword'];
+	setPassword: typeof keytarType['setPassword'];
+	deletePassword: typeof keytarType['deletePassword'];
+};
+
+const SERVICE_ID = `${vscode.env.uriScheme}-microsoft.login`;
+const ACCOUNT_ID = 'account';
+
+export class Keychain {
+	private keytar: Keytar;
+
+	constructor() {
+		const keytar = getKeytar();
+		if (!keytar) {
+			throw new Error('System keychain unavailable');
+		}
+
+		this.keytar = keytar;
+	}
+
+
+	async setToken(token: string): Promise<void> {
+		try {
+			return await this.keytar.setPassword(SERVICE_ID, ACCOUNT_ID, token);
+		} catch (e) {
+			Logger.error(`Setting token failed: ${e}`);
+
+			// Temporary fix for #94005
+			// This happens when processes write simulatenously to the keychain, most
+			// likely when trying to refresh the token. Ignore the error since additional
+			// writes after the first one do not matter. Should actually be fixed upstream.
+			if (e.message === 'The specified item already exists in the keychain.') {
+				return;
+			}
+
+			const troubleshooting = localize('troubleshooting', "Troubleshooting Guide");
+			const result = await vscode.window.showErrorMessage(localize('keychainWriteError', "Writing login information to the keychain failed with error '{0}'.", e.message), troubleshooting);
+			if (result === troubleshooting) {
+				vscode.env.openExternal(vscode.Uri.parse('https://code.visualstudio.com/docs/editor/settings-sync#_troubleshooting-keychain-issues'));
+			}
+		}
+	}
+
+	async getToken(): Promise<string | null | undefined> {
+		try {
+			return await this.keytar.getPassword(SERVICE_ID, ACCOUNT_ID);
+		} catch (e) {
+			// Ignore
+			Logger.error(`Getting token failed: ${e}`);
+			return Promise.resolve(undefined);
+		}
+	}
+
+	async deleteToken(): Promise<boolean | undefined> {
+		try {
+			return await this.keytar.deletePassword(SERVICE_ID, ACCOUNT_ID);
+		} catch (e) {
+			// Ignore
+			Logger.error(`Deleting token failed: ${e}`);
+			return Promise.resolve(undefined);
+		}
+	}
+}
+
+export const keychain = new Keychain();

extensions/microsoft-authentication/src/logger.ts

@@ -0,0 +1,55 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as vscode from 'vscode';
+
+type LogLevel = 'Info' | 'Error';
+
+class Log {
+	private output: vscode.OutputChannel;
+
+	constructor() {
+		this.output = vscode.window.createOutputChannel('Microsoft Authentication');
+	}
+
+	private data2String(data: any): string {
+		if (data instanceof Error) {
+			return data.stack || data.message;
+		}
+		if (data.success === false && data.message) {
+			return data.message;
+		}
+		return data.toString();
+	}
+
+	public info(message: string, data?: any): void {
+		this.logLevel('Info', message, data);
+	}
+
+	public error(message: string, data?: any): void {
+		this.logLevel('Error', message, data);
+	}
+
+	public logLevel(level: LogLevel, message: string, data?: any): void {
+		this.output.appendLine(`[${level}  - ${this.now()}] ${message}`);
+		if (data) {
+			this.output.appendLine(this.data2String(data));
+		}
+	}
+
+	private now(): string {
+		const now = new Date();
+		return padLeft(now.getUTCHours() + '', 2, '0')
+			+ ':' + padLeft(now.getMinutes() + '', 2, '0')
+			+ ':' + padLeft(now.getUTCSeconds() + '', 2, '0') + '.' + now.getMilliseconds();
+	}
+}
+
+function padLeft(s: string, n: number, pad = ' ') {
+	return pad.repeat(Math.max(0, n - s.length)) + s;
+}
+
+const Logger = new Log();
+export default Logger;

extensions/microsoft-authentication/src/typings/refs.d.ts

@@ -0,0 +1,7 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+/// <reference path='../../../../src/vs/vscode.d.ts'/>
+/// <reference path='../../../../src/vs/vscode.proposed.d.ts'/>

extensions/microsoft-authentication/src/utils.ts

@@ -0,0 +1,8 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the Source EULA. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+export function toBase64UrlEncoding(base64string: string) {
+	return base64string.replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_'); // Need to use base64url encoding
+}