Adds application permission check on certain command groups / specific commands

src/m365/base/DelegatedGraphCommand.spec.ts

@@ -0,0 +1,53 @@
+import assert from 'assert';
+import sinon from 'sinon';
+import auth from '../../Auth.js';
+import { telemetry } from '../../telemetry.js';
+import DelegatedGraphCommand from './DelegatedGraphCommand.js';
+import { accessToken } from '../../utils/accessToken.js';
+import { CommandError } from '../../Command.js';
+
+class MockCommand extends DelegatedGraphCommand {
+  public get name(): string {
+    return 'mock';
+  }
+
+  public get description(): string {
+    return 'Mock command';
+  }
+
+  public async commandAction(): Promise<void> {
+  }
+
+  public commandHelp(): void {
+  }
+}
+
+describe('DelegatedGraphCommand', () => {
+  const cmd = new MockCommand();
+
+  before(() => {
+    sinon.stub(telemetry, 'trackEvent').returns();
+    auth.connection.active = true;
+    auth.connection.accessTokens[auth.defaultResource] = {
+      expiresOn: 'abc',
+      accessToken: 'abc'
+    };
+  });
+
+  after(() => {
+    sinon.restore();
+    auth.connection.active = false;
+    auth.connection.accessTokens = {};
+  });
+
+  it(`doesn't throw error when not connected`, () => {
+    auth.connection.active = false;
+    (cmd as any).initAction({ options: {} }, {});
+    auth.connection.active = true;
+  });
+
+  it('throws error when using application-only permissions', () => {
+    sinon.stub(accessToken, 'isAppOnlyAccessToken').returns(true);
+    assert.throws(() => (cmd as any).initAction({ options: {} }, {}), new CommandError('This command does not support application-only permissions.'));
+  });
+});

src/m365/base/DelegatedGraphCommand.ts

@@ -0,0 +1,21 @@
+import auth from '../../Auth.js';
+import { CommandArgs } from '../../Command.js';
+import { Logger } from '../../cli/Logger.js';
+import { accessToken } from '../../utils/accessToken.js';
+import GraphCommand from './GraphCommand.js';
+
+/**
+ * This command class is for delegated-only Graph commands.  
+ */
+export default abstract class DelegatedGraphCommand extends GraphCommand {
+  protected initAction(args: CommandArgs, logger: Logger): void {
+    super.initAction(args, logger);
+
+    if (!auth.connection.active) {
+      // we fail no login in the base command command class
+      return;
+    }
+
+    accessToken.assertDelegatedAccessToken();
+  }
+}

src/m365/base/PowerAppsCommand.spec.ts

@@ -4,6 +4,8 @@ import auth, { CloudType } from '../../Auth.js';
 import { CommandError } from '../../Command.js';
 import { telemetry } from '../../telemetry.js';
 import PowerAppsCommand from './PowerAppsCommand.js';
+import { accessToken } from '../../utils/accessToken.js';
+import { sinonUtil } from '../../utils/sinonUtil.js';
 
 class MockCommand extends PowerAppsCommand {
   public get name(): string {
@@ -27,10 +29,18 @@ describe('PowerAppsCommand', () => {
 
   before(() => {
     sinon.stub(telemetry, 'trackEvent').returns();
+    sinon.stub(accessToken, 'isAppOnlyAccessToken').returns(false);
+    auth.connection.active = true;
+    auth.connection.accessTokens[auth.defaultResource] = {
+      expiresOn: 'abc',
+      accessToken: 'abc'
+    };
   });
 
   after(() => {
     sinon.restore();
+    auth.connection.active = false;
+    auth.connection.accessTokens = {};
   });
 
   it('returns correct resource', () => {
@@ -39,37 +49,44 @@ describe('PowerAppsCommand', () => {
   });
 
   it(`doesn't throw error when not connected`, () => {
-    auth.connection.active = false;
-    (cmd as any).initAction({ options: {} }, {});
+    try {
+      auth.connection.active = false;
+      (cmd as any).initAction({ options: {} }, {});
+    }
+    finally {
+      auth.connection.active = true;
+    }
   });
 
   it('throws error when connected to USGov cloud', () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.USGov;
     assert.throws(() => (cmd as any).initAction({ options: {} }, {}), cloudError);
   });
 
   it('throws error when connected to USGovHigh cloud', () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.USGovHigh;
     assert.throws(() => (cmd as any).initAction({ options: {} }, {}), cloudError);
   });
 
   it('throws error when connected to USGovDoD cloud', () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.USGovDoD;
     assert.throws(() => (cmd as any).initAction({ options: {} }, {}), cloudError);
   });
 
   it('throws error when connected to China cloud', () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.China;
     assert.throws(() => (cmd as any).initAction({ options: {} }, {}), cloudError);
   });
 
   it(`doesn't throw error when connected to public cloud`, () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.Public;
     assert.doesNotThrow(() => (cmd as any).initAction({ options: {} }, {}));
   });
+
+  it('throws error when using application-only permissions', () => {
+    sinonUtil.restore(accessToken.isAppOnlyAccessToken);
+    sinon.stub(accessToken, 'isAppOnlyAccessToken').returns(true);
+    auth.connection.cloudType = CloudType.Public;
+    assert.throws(() => (cmd as any).initAction({ options: {} }, {}), new CommandError('This command does not support application-only permissions.'));
+  });
 });

src/m365/base/PowerAppsCommand.ts

@@ -1,6 +1,7 @@
 import auth, { CloudType } from '../../Auth.js';
 import { Logger } from '../../cli/Logger.js';
 import Command, { CommandArgs, CommandError } from '../../Command.js';
+import { accessToken } from '../../utils/accessToken.js';
 
 export default abstract class PowerAppsCommand extends Command {
   protected get resource(): string {
@@ -18,5 +19,7 @@ export default abstract class PowerAppsCommand extends Command {
     if (auth.connection.cloudType !== CloudType.Public) {
       throw new CommandError(`Power Apps commands only support the public cloud at the moment. We'll add support for other clouds in the future. Sorry for the inconvenience.`);
     }
+
+    accessToken.assertDelegatedAccessToken();
   }
 }

src/m365/base/PowerAutomateCommand.spec.ts

@@ -4,6 +4,8 @@ import auth, { CloudType } from '../../Auth.js';
 import { CommandError } from '../../Command.js';
 import { telemetry } from '../../telemetry.js';
 import PowerAutomateCommand from './PowerAutomateCommand.js';
+import { accessToken } from '../../utils/accessToken.js';
+import { sinonUtil } from '../../utils/sinonUtil.js';
 
 class MockCommand extends PowerAutomateCommand {
   public get name(): string {
@@ -27,10 +29,18 @@ describe('PowerAutomateCommand', () => {
 
   before(() => {
     sinon.stub(telemetry, 'trackEvent').returns();
+    sinon.stub(accessToken, 'isAppOnlyAccessToken').returns(false);
+    auth.connection.active = true;
+    auth.connection.accessTokens[auth.defaultResource] = {
+      expiresOn: 'abc',
+      accessToken: 'abc'
+    };
   });
 
   after(() => {
     sinon.restore();
+    auth.connection.active = false;
+    auth.connection.accessTokens = {};
   });
 
   it('returns correct resource', () => {
@@ -39,37 +49,44 @@ describe('PowerAutomateCommand', () => {
   });
 
   it(`doesn't throw error when not connected`, () => {
-    auth.connection.active = false;
-    (cmd as any).initAction({ options: {} }, {});
+    try {
+      auth.connection.active = false;
+      (cmd as any).initAction({ options: {} }, {});
+    }
+    finally {
+      auth.connection.active = true;
+    }
   });
 
   it('throws error when connected to USGov cloud', () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.USGov;
     assert.throws(() => (cmd as any).initAction({ options: {} }, {}), cloudError);
   });
 
   it('throws error when connected to USGovHigh cloud', () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.USGovHigh;
     assert.throws(() => (cmd as any).initAction({ options: {} }, {}), cloudError);
   });
 
   it('throws error when connected to USGovDoD cloud', () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.USGovDoD;
     assert.throws(() => (cmd as any).initAction({ options: {} }, {}), cloudError);
   });
 
   it('throws error when connected to China cloud', () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.China;
     assert.throws(() => (cmd as any).initAction({ options: {} }, {}), cloudError);
   });
 
   it(`doesn't throw error when connected to public cloud`, () => {
-    auth.connection.active = true;
     auth.connection.cloudType = CloudType.Public;
     assert.doesNotThrow(() => (cmd as any).initAction({ options: {} }, {}));
   });
+
+  it('throws error when using application-only permissions', () => {
+    sinonUtil.restore(accessToken.isAppOnlyAccessToken);
+    sinon.stub(accessToken, 'isAppOnlyAccessToken').returns(true);
+    auth.connection.cloudType = CloudType.Public;
+    assert.throws(() => (cmd as any).initAction({ options: {} }, {}), new CommandError('This command does not support application-only permissions.'));
+  });
 });

src/m365/base/PowerAutomateCommand.ts

@@ -1,6 +1,7 @@
 import auth, { CloudType } from '../../Auth.js';
 import { Logger } from '../../cli/Logger.js';
 import Command, { CommandArgs, CommandError } from '../../Command.js';
+import { accessToken } from '../../utils/accessToken.js';
 
 export default abstract class PowerAutomateCommand extends Command {
   protected get resource(): string {
@@ -18,5 +19,7 @@ export default abstract class PowerAutomateCommand extends Command {
     if (auth.connection.cloudType !== CloudType.Public) {
       throw new CommandError(`Power Automate commands only support the public cloud at the moment. We'll add support for other clouds in the future. Sorry for the inconvenience.`);
     }
+
+    accessToken.assertDelegatedAccessToken();
   }
 }

src/m365/base/PowerBICommand.spec.ts

@@ -8,6 +8,7 @@ import { pid } from '../../utils/pid.js';
 import { session } from '../../utils/session.js';
 import { sinonUtil } from '../../utils/sinonUtil.js';
 import PowerBICommand from './PowerBICommand.js';
+import { accessToken } from '../../utils/accessToken.js';
 
 class MockCommand extends PowerBICommand {
   public get name(): string {
@@ -27,9 +28,14 @@ class MockCommand extends PowerBICommand {
 
 describe('PowerBICommand', () => {
   before(() => {
-    sinon.stub(telemetry, 'trackEvent').callsFake(() => { });
-    sinon.stub(pid, 'getProcessName').callsFake(() => '');
-    sinon.stub(session, 'getId').callsFake(() => '');
+    sinon.stub(telemetry, 'trackEvent').returns();
+    sinon.stub(pid, 'getProcessName').returns('');
+    sinon.stub(session, 'getId').returns('');
+    sinon.stub(accessToken, 'isAppOnlyAccessToken').returns(false);
+    auth.connection.accessTokens[auth.defaultResource] = {
+      expiresOn: 'abc',
+      accessToken: 'abc'
+    };
   });
 
   afterEach(() => {
@@ -38,6 +44,8 @@ describe('PowerBICommand', () => {
 
   after(() => {
     sinon.restore();
+    auth.connection.active = false;
+    auth.connection.accessTokens = {};
   });
 
   it('correctly reports an error while restoring auth info', async () => {
@@ -96,4 +104,12 @@ describe('PowerBICommand', () => {
     const command = new MockCommand();
     assert.strictEqual((command as any).resource, 'https://api.powerbi.com');
   });
+
+  it('throws error when using application-only permissions', () => {
+    const cmd = new MockCommand();
+    sinonUtil.restore(accessToken.isAppOnlyAccessToken);
+    sinon.stub(accessToken, 'isAppOnlyAccessToken').returns(true);
+    auth.connection.active = true;
+    assert.throws(() => (cmd as any).initAction({ options: {} }, {}), new CommandError('This command does not support application-only permissions.'));
+  });
 });

src/m365/base/PowerBICommand.ts

@@ -1,7 +1,22 @@
-import Command from '../../Command.js';
+import Command, { CommandArgs } from '../../Command.js';
+import auth from '../../Auth.js';
+import { accessToken } from '../../utils/accessToken.js';
+import { Logger } from '../../cli/Logger.js';
 
 export default abstract class PowerBICommand extends Command {
   protected get resource(): string {
     return 'https://api.powerbi.com';
   }
+
+  protected initAction(args: CommandArgs, logger: Logger): void {
+    super.initAction(args, logger);
+
+    if (!auth.connection.active) {
+      // we fail no login in the base command command class
+      return;
+    }
+
+    accessToken.assertDelegatedAccessToken();
+  }
+
 }