fix: get microsoftAppPassword from profile appPasswordHint

Composer/packages/client/src/components/CreationFlow/CreateOptions.tsx

@@ -258,19 +258,20 @@ export function CreateOptions(props: CreateOptionsProps) {
       const decoded = decodeURIComponent(props.location.search);
       const { source, payload } = querystring.parse(decoded);
       if (typeof source === 'string' && typeof payload === 'string') {
-        const alias = getAliasFromPayload(source, payload);
-        // check to see if Composer currently has a bot project corresponding to the alias
-        axios
-          .get<any>(`/api/projects/alias/${alias}`)
-          .then((aliasRes) => {
-            if (aliasRes.status === 200) {
-              navigate(`/bot/${aliasRes.data.id}`);
-              return;
-            }
-          })
-          .catch((e) => {
-            setIsOpen(true);
-          });
+        getAliasFromPayload(source, payload).then((alias) => {
+          // check to see if Composer currently has a bot project corresponding to the alias
+          axios
+            .get<any>(`/api/projects/alias/${alias}`)
+            .then((aliasRes) => {
+              if (aliasRes.status === 200) {
+                navigate(`/bot/${aliasRes.data.id}`);
+                return;
+              }
+            })
+            .catch((e) => {
+              setIsOpen(true);
+            });
+        });
         return;
       }
     }

Composer/packages/client/src/components/CreationFlow/DefineConversation.tsx

@@ -208,7 +208,7 @@ const DefineConversation: React.FC<DefineConversationProps> = (props) => {
   }, [focusedStorageFolder]);
 
   const handleSubmit = useCallback(
-    (e) => {
+    async (e) => {
       e.preventDefault();
       if (hasErrors) {
         return;
@@ -246,7 +246,7 @@ const DefineConversation: React.FC<DefineConversationProps> = (props) => {
         if (payload && typeof payload === 'string' && typeof source === 'string') {
           dataToSubmit.profile = JSON.parse(payload);
           dataToSubmit.source = source;
-          dataToSubmit.alias = getAliasFromPayload(source, payload);
+          dataToSubmit.alias = await getAliasFromPayload(source, payload);
         }
       }
 

Composer/packages/client/src/constants.ts

@@ -381,6 +381,10 @@ export const graphScopes = {
   scopes: ['https://graph.microsoft.com/Application.ReadWrite.All'],
   targetResource: 'https://graph.microsoft.com/',
 };
+export const vaultScopes = {
+  scopes: ['https://vault.azure.net/user_impersonation'],
+  targetResource: 'https://vault.azure.net/',
+};
 
 export const authUrl = `https://login.microsoftonline.com/${authConfig.tenantId}/oauth2/v2.0/authorize`;
 

Composer/packages/client/src/pages/publish/Publish.tsx

@@ -21,6 +21,7 @@ import {
   setTenantId,
   getTenantIdFromCache,
 } from '../../utils/auth';
+import { vaultScopes } from '../../constants';
 import { AuthClient } from '../../utils/authClient';
 import TelemetryClient from '../../telemetry/TelemetryClient';
 import { ApiStatus, PublishStatusPollingUpdater, pollingUpdaterList } from '../../utils/publishStatusPollingUpdater';
@@ -254,6 +255,9 @@ const Publish: React.FC<RouteComponentProps<{ projectId: string; targetName?: st
         token = await AuthClient.getARMTokenForTenant(tenant);
       }
     }
+    // get keyvault token
+    const result = await AuthClient.getAccessToken(vaultScopes);
+    console.log('kv -----------', result);
 
     setPublishDialogVisiblity(false);
     // notifications

Composer/packages/client/src/recoilModel/dispatchers/project.ts

@@ -324,7 +324,7 @@ export const projectDispatcher = () => {
       if (profile) {
         // ABS Create Flow, update publishProfile after create project
         const dispatcher = await snapshot.getPromise(dispatcherState);
-        const newProfile = getPublishProfileFromPayload(profile, source);
+        const newProfile = await getPublishProfileFromPayload(profile, source);
 
         newProfile && dispatcher.setPublishTargets([newProfile], projectId);
       }

Composer/packages/client/src/utils/electronUtil.ts

@@ -2,6 +2,10 @@
 // Licensed under the MIT License.
 import { PublishTarget } from '@bfc/shared';
 
+import { armScopes } from '../constants';
+
+import httpClient from './httpUtil';
+import { AuthClient } from './authClient';
 /**
  * Returns true if the client is embedded in the Composer Electron environment.
  */
@@ -23,44 +27,25 @@ export type Profile = ABSProfile; // can include PVAProfile or other type of pro
  *
  * @param profile payload from bf's create protocol
  */
-export function getPublishProfileFromPayload(profile: Profile, source: string): PublishTarget | undefined {
-  switch (source) {
-    case 'abs': {
-      const appId = profile.appId;
-      // parse subscriptionId ... from profile
-      const temp = { ...profile };
-      const subs = profile.resourceId.match(/subscriptions\/([\w-]*)\//);
-      const groups = profile.resourceId.match(/resourceGroups\/([^/]*)/);
-      const names = profile.resourceId.match(/botServices\/([^/]*)/);
-      temp.subscriptionId = (subs && subs.length > 0 && subs[1]) || '';
-      temp.resourceGroup = (groups && groups.length > 0 && groups[1]) || '';
-      temp.botName = (names && names.length > 0 && names[1]) || '';
-      delete temp.appId;
-
-      console.log(temp);
-      return {
-        name: `${source}-${profile.botName}`,
-        type: 'azurePublish',
-        configuration: JSON.stringify({
-          hostname: '',
-          runtimeIdentifier: 'win-x64',
-          settings: {
-            MicrosoftAppId: appId,
-          },
-          ...temp,
-        }),
-      };
-    }
+export async function getPublishProfileFromPayload(
+  profile: Profile,
+  source: string
+): Promise<PublishTarget | undefined> {
+  try {
+    const resutl = await httpClient.post(`/import/${source}/generateProfile`, profile);
+    console.log(resutl);
+    return resutl.data;
+  } catch (error) {
+    console.log(error);
   }
 }
 
-export function getAliasFromPayload(source: string, payload: string): string | undefined {
-  switch (source) {
-    case 'abs':
-      if (payload) {
-        const profile: ABSProfile = JSON.parse(payload);
-        const alias = `${source}-${profile.botName}-${profile.appId}`;
-        return alias;
-      }
+export async function getAliasFromPayload(source: string, payload: string): Promise<string | undefined> {
+  try {
+    const resutl = await httpClient.post(`/import/${source}/getAlias`, JSON.parse(payload));
+    console.log(resutl);
+    return resutl.data.alias;
+  } catch (error) {
+    console.log(error);
   }
 }

Composer/packages/server/src/controllers/import.ts

@@ -78,7 +78,43 @@ async function startImport(req: ImportRequest, res: Response) {
   }
 }
 
+async function generateProfile(req: ImportRequest, res: Response) {
+  const { source } = req.params;
+  const payload = req.body;
+
+  const contentProvider = contentProviderFactory.getProvider({ kind: source, metadata: payload });
+  if (contentProvider?.generateProfile) {
+    try {
+      const profile = await contentProvider.generateProfile();
+      res.status(200).json(profile);
+    } catch (err) {
+      res.status(500).json({ message: err.stack });
+    }
+  } else {
+    res.status(400).json({ message: 'No content provider found for source: ' + source });
+  }
+}
+
+async function getAlias(req: ImportRequest, res: Response) {
+  const { source } = req.params;
+  const payload = req.body;
+
+  const contentProvider = contentProviderFactory.getProvider({ kind: source, metadata: payload });
+  if (contentProvider?.getAlias) {
+    try {
+      const alias = await contentProvider.getAlias();
+      res.status(200).json({ alias });
+    } catch (error) {
+      res.status(500).json({ message: error.stack });
+    }
+  } else {
+    res.status(400).json({ message: 'No content provider found for source: ' + source });
+  }
+}
+
 export const ImportController = {
   authenticate,
   startImport,
+  generateProfile,
+  getAlias,
 };

Composer/packages/server/src/externalContentProvider/azureBotServiceProvider.ts

@@ -0,0 +1,158 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import { PublishTarget } from '@bfc/shared';
+import * as axios from 'axios';
+import jwtDecode from 'jwt-decode';
+
+import { authService } from '../services/auth/auth';
+
+import { IContentProviderMetadata, ExternalContentProvider, BotContentInfo } from './externalContentProvider';
+
+export type AzureBotServiceMetadata = IContentProviderMetadata & {
+  resourceId: string;
+  botName: string;
+  appId?: string;
+  appPasswordHint?: string;
+  subscriptionId?: string;
+  resourceGroup?: string;
+  armEndpoint?: string;
+  tenantId: string;
+};
+
+export class AzureBotServiceProvider extends ExternalContentProvider<AzureBotServiceMetadata> {
+  constructor(metadata: AzureBotServiceMetadata) {
+    super(metadata);
+  }
+  public async downloadBotContent(): Promise<BotContentInfo> {
+    throw new Error('ABS Not support');
+  }
+  public async cleanUp(): Promise<void> {
+    throw new Error('Method not implemented.');
+  }
+  public async getAlias(): Promise<string> {
+    const alias = `abs-${this.metadata.botName}-${this.metadata.appId}`;
+    return alias;
+  }
+
+  public async authenticate(): Promise<string> {
+    return this.getVaultAccessToken();
+  }
+
+  public async generateProfile(): Promise<PublishTarget> {
+    const appId = this.metadata.appId;
+    // parse subscriptionId ... from this.metadata
+    const temp = { ...this.metadata };
+    const subs = this.metadata.resourceId.match(/subscriptions\/([\w-]*)\//);
+    const groups = this.metadata.resourceId.match(/resourceGroups\/([^/]*)/);
+    const names = this.metadata.resourceId.match(/botServices\/([^/]*)/);
+    temp.subscriptionId = (subs && subs.length > 0 && subs[1]) || '';
+    temp.resourceGroup = (groups && groups.length > 0 && groups[1]) || '';
+    temp.botName = (names && names.length > 0 && names[1]) || '';
+    delete temp.appId;
+
+    // transform key vault token hint to microsoft app password
+    const hint = this.metadata.appPasswordHint || '';
+    delete temp.appPasswordHint;
+    const vaultNames = hint.match(/vaults\/([^/]*)/);
+    const secretNames = hint.match(/secrets\/([^/]*)/);
+    const resourceGroupNames = hint.match(/resourceGroups\/([^/]*)/);
+    const vaultName = (vaultNames && vaultNames.length > 0 && vaultNames[1]) || '';
+    const secretName = (secretNames && secretNames.length > 0 && secretNames[1]) || '';
+    const resourceGroupName = (resourceGroupNames && resourceGroupNames.length > 0 && resourceGroupNames[1]) || '';
+    const tenantId = this.metadata.tenantId;
+
+    // get token
+    const armToken = await this.getArmAccessToken(tenantId);
+    const vaultToken = await this.getVaultAccessToken();
+    const decoded = jwtDecode<{ oid: string }>(armToken);
+
+    // set key vault policy
+    await this.keyVaultUpdatePolicy(armToken, temp.subscriptionId, resourceGroupName, vaultName, tenantId, decoded.oid);
+    const appPwd = await this.keyVaultGetSecretValue(vaultToken, vaultName, secretName);
+    return {
+      name: `abs-${this.metadata.botName}`,
+      type: 'azurePublish',
+      configuration: JSON.stringify({
+        hostname: '',
+        runtimeIdentifier: 'win-x64',
+        settings: {
+          MicrosoftAppId: appId,
+          MicrosoftAppPassword: appPwd,
+        },
+        ...temp,
+      }),
+    };
+  }
+
+  private async keyVaultUpdatePolicy(
+    token: string,
+    subscriptionId: string,
+    resourceGroupName: string,
+    vaultName: string,
+    tenantId: string,
+    objectId: string
+  ) {
+    const operationKind = 'add';
+    const url = `https://management.azure.com/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.KeyVault/vaults/${vaultName}/accessPolicies/${operationKind}?api-version=2019-09-01`;
+    const result = await axios.default.put(
+      url,
+      {
+        properties: {
+          accessPolicies: [
+            {
+              tenantId: tenantId,
+              objectId: objectId,
+              permissions: {
+                secrets: ['get', 'list'],
+              },
+            },
+          ],
+        },
+      },
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          'Content-Type': 'application/json',
+        },
+      }
+    );
+    return result;
+  }
+
+  private async keyVaultGetSecretValue(token: string, vaultName: string, secretName: string) {
+    const vaultUri = `https://${vaultName}.vault.azure.net/secrets/${secretName}?api-version=7.1`;
+    const result = await axios.default.get(vaultUri, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    return result.data.value;
+  }
+
+  private async getVaultAccessToken(): Promise<string> {
+    try {
+      // get an kv token
+      const authCredentials = {
+        scopes: ['https://vault.azure.net/user_impersonation'],
+        targetResource: 'https://vault.azure.net',
+      };
+      const accessToken = await authService.getAccessToken(authCredentials);
+      if (accessToken === '') {
+        throw 'User cancelled login flow.';
+      }
+      return accessToken;
+    } catch (e) {
+      throw `Error while trying to get a key vault token: ${e.toString()}`;
+    }
+  }
+
+  private async getArmAccessToken(tenantId: string): Promise<string> {
+    try {
+      const accessToken = await authService.getArmAccessToken(tenantId);
+      if (accessToken === '') {
+        throw 'User cancelled login flow.';
+      }
+      return accessToken;
+    } catch (e) {
+      throw `Error while trying to get a key vault token: ${e.toString()}`;
+    }
+  }
+}

Composer/packages/server/src/externalContentProvider/contentProviderFactory.ts

@@ -5,20 +5,24 @@ import { ExternalContentProviderType } from '@botframework-composer/types';
 
 import { ExternalContentProvider, IContentProviderMetadata } from './externalContentProvider';
 import { PowerVirtualAgentsProvider, PowerVirtualAgentsMetadata } from './powerVirtualAgentsProvider';
+import { AzureBotServiceMetadata, AzureBotServiceProvider } from './azureBotServiceProvider';
 
-type ProviderInfo = PowerVirtualAgentsProviderInfo; // union with additional provider info types (ex. PowerVirtualAgentsProviderInfo | ABSProviderInfo | etc.)
+type ProviderInfo = PowerVirtualAgentsProviderInfo | AzureBotServiceProviderInfo; // union with additional provider info types (ex. PowerVirtualAgentsProviderInfo | ABSProviderInfo | etc.)
 
 type ProviderInfoBase<T extends IContentProviderMetadata> = {
   kind: ExternalContentProviderType;
   metadata: T;
 };
 
 type PowerVirtualAgentsProviderInfo = ProviderInfoBase<PowerVirtualAgentsMetadata> & { kind: 'pva' };
+type AzureBotServiceProviderInfo = ProviderInfoBase<AzureBotServiceMetadata> & { kind: 'abs' };
 
 function getProvider(info: ProviderInfo): ExternalContentProvider<IContentProviderMetadata> | undefined {
   switch (info.kind) {
     case 'pva':
       return new PowerVirtualAgentsProvider(info.metadata);
+    case 'abs':
+      return new AzureBotServiceProvider(info.metadata);
     default:
       return undefined;
   }