h&!      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGH Safe-Inferred"8;?Z Safe-Inferred"8;? I ms-graph-api3Possible exception states of authentication requestJ ms-graph-apidecoded claims from the JWT token, valid (at least) for the Google OpenID implementation as of February 2021K ms-graph-api/intended audience of the token (== API key ID ) ms-graph-apisub fieldL ms-graph-api#NB Validation is not a monad thoughM ms-graph-apiDecode and validate the aud, N and nbf fields of the JWTO ms-graph-api Validate the aud, N and nbf fieldsP ms-graph-api Fails if the Niry field is not at least nsecs seconds in the futureQ ms-graph-api(Fails if the current time is before the nbf time (= token is not yet valid)R ms-graph-api Fails if the aud4ience field is not equal to the supplied ApiAudienceM ms-graph-apiintended token audience (its meaning depends on the OAuth identity provider ) ms-graph-apibuffer period to allow for API roundtrip delays (defaults to 0 if Nothing) ms-graph-api;JWT-encoded string, e.g. the contents of the id_token fieldO ms-graph-apiintended token audience (its meaning depends on the OAuth identity provider )P ms-graph-apidefaults to 0 if NothingR ms-graph-api/intended audience of the token (== API key ID ) ms-graph-apidecoded from the JWT0ISTUVWXJYZ[\]^_K`abcdefghijklLMOPQRmnopqrstuvwx Safe-Inferred"%&18;?   ms-graph-api https://learn.microsoft.com/en-us/azure/active-directory/develop/userinfo ms-graph-apiapplication name ms-graph-apiapp client ID : see $https://stackoverflow.com/a/70670961 ms-graph-apiapp client secret " ms-graph-apiOAuth2 and OIDC scopes  ms-graph-apiOAuth2 state (a random string,  4https://www.rfc-editor.org/rfc/rfc6749#section-10.12 )  ms-graph-apiOAuth2 redirect URI  ms-graph-apiNB : OIDC scopes openid and offline_access are ALWAYS requested since the library assumes we have access to refresh tokens and ID tokensy ms-graph-api https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration  ms-graph-apiOAuth configuration     Safe-Inferred"168;?D  ms-graph-apitransactional token storez ms-graph-api The JWT identity token from the X-MS-TOKEN-AAD-ID-TOKEN header injected by App Service can be decoded for its claims e.g. sub0 (which is unique for each user for a given app) https://bogdan.bynapse.com/azure/the-app-service-token-store-was-added-to-app-service-authentication-authorization-and-it-is-a-repository-of-oauth-tokens-associated-with-your-app-users-when-a-user-logs-into-your-app-via-an-iden/ https://stackoverflow.com/questions/46757665/authentication-for-azure-functions/ ms-graph-api'Decode the App Service ID token header X-MS-TOKEN-AAD-ID-TOKEN:, look its user up in the local token store, supply token t to continuation. If the user sub cannot be found in the token store the browser is redirected to the login URI.Special case of z ms-graph-apiLogin endpointsee  { ms-graph-apilogin endpoint handler ms-graph-api2The identity provider redirects the client to the reply& endpoint as part of the OAuth flow : https://learn.microsoft.com/en-us/graph/auth-v2-user?view=graph-rest-1.0&tabs=http#authorization-responsesee  | ms-graph-api1) the ExchangeToken arrives with the redirect once the user has approved the scopes in the browser https://learn.microsoft.com/en-us/graph/auth-v2-user?view=graph-rest-1.0&tabs=http#authorization-response} ms-graph-apiDecode and validate ID token https://learn.microsoft.com/en-us/azure/active-directory/develop/userinfo#consider-using-an-id-token-instead~ ms-graph-apiLift ExceptT to ActionM which is basically the handler Monad in Scotty. z ms-graph-api-look up the UserSub's token, do stuff with it ms-graph-api login URI ms-graph-apicall MSGraph APIs with token t, etc. ms-graph-apie.g. "/login" ms-graph-apie.g. "/oauth/reply"| ms-graph-api also called code. Expires in 10 minutes ms-graph-apiuser id ms-graph-api new token ms-graph-apitoken expires in ms-graph-apiuser identifier e.g. sub ms-graph-apiuser identifier e.g. sub} ms-graph-api-appears in the OAuth2Token if scopes include openid ms-graph-api(sub)   Safe-Inferred"18;?} ms-graph-apia collection of items with key value! ms-graph-api )POST https://graph.microsoft.com/v1.0/..." ms-graph-api (GET https://graph.microsoft.com/v1.0/...# ms-graph-api (GET https://graph.microsoft.com/v1.0/...Returns the response body as a bytestring, e.g. for endpoints that download files or general bytestring payloads$ ms-graph-api-drop the prefix and lowercase first charactere.g. userDisplayName ->  displayName ms-graph-api-drop the prefix and lowercase first character ms-graph-apiDrops the given prefix from a list. It returns the original sequence if the sequence doesn't start with the given prefix. dropPrefix "Mr. " "Mr. Men" == "Men" dropPrefix "Mr. " "Dr. Men" == "Dr. Men"! ms-graph-apiURI path segments ms-graph-api request body" ms-graph-apiURI path segments# ms-graph-apiURI path segments$ ms-graph-api record prefix ms-graph-apirecord name prefix ms-graph-apiJSON field name !"#$"#! $ Safe-Inferred"8;?. ms-graph-apiGet user information GET /users/{user-id} https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http#request/ ms-graph-api!Get information on signed-in userCalling the /me endpoint requires a signed-in user and therefore a delegated permission. Application permissions are not supported when using the /me endpoint. GET /me https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http#request-1. ms-graph-apiuser id)-,+*././)-,+* Safe-Inferred"8;?5 ms-graph-api.download a complete file from user's directory %GET /me/drive/items/{item-id}/content https://learn.microsoft.com/en-us/graph/api/driveitem-get-content?view=graph-rest-1.0&tabs=http#request6 ms-graph-apidownload a file from a drive .GET /drives/{drive-id}/items/{item-id}/content https://learn.microsoft.com/en-us/graph/api/driveitem-get-content?view=graph-rest-1.0&tabs=http#request5 ms-graph-apiitem ID6 ms-graph-apidrive ID ms-graph-apifile ID5656 Safe-Inferred"8;?s> ms-graph-apiGet drive of current user? ms-graph-api5List children in the root of the current user's drive https://learn.microsoft.com/en-us/graph/api/driveitem-list-children?view=graph-rest-1.0&tabs=http#list-children-in-the-root-of-the-current-users-drive@ ms-graph-api5List children in the root of the current user's drive /GET /drives/{drive-id}/items/{item-id}/children https://learn.microsoft.com/en-us/graph/api/driveitem-list-children?view=graph-rest-1.0&tabs=http#list-children-in-the-root-of-the-current-users-drive@ ms-graph-apidrive ID ms-graph-apiitem ID 7:98;=<>?@ >?@;=<7:98    !"#$%&'(()*+,-./0122345+6789:;<=>>?@AABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdeOfPghgi jklmnopqrstuvwxyz{|}~+ms-graph-api-0.3.0.0-J8fAZ9YhmoPK6rVlP5rmuGMSGraphAPI.Internal.CommonNetwork.OAuth2.SessionNetwork.OAuth2.Provider.AzureADMSGraphAPI.UserMSGraphAPI.Files.DriveItemsMSGraphAPI.DriveMSGraphAPI.AuthNetwork.OAuth2.JWT req-3.13.0-Z6GuU1Shmz9y57HLYa14xNetwork.HTTP.ReqrunReqUserSub AzureADUserOAuthCfg$sel:oacAppName:OAuthCfg$sel:oacClientId:OAuthCfg$sel:oacClientSecret:OAuthCfg$sel:oacScopes:OAuthCfg$sel:oacAuthState:OAuthCfg$sel:oacRedirectURI:OAuthCfgAzureAD azureADApp$fFromJSONAzureADUser$fEqAzureADUser$fOrdAzureADUser$fShowAzureADUser $fEqAzureAD $fShowAzureADTokensScottyAction withAADUser loginEndpoint replyEndpoint expireUser lookupUser$fShowOAuthSessionError$fExceptionOAuthSessionError$fEqOAuthSessionError CollectioncValuepostgetgetLbs aesonOptions$fFromJSONCollection$fEqCollection$fShowCollection$fGenericCollectionUseruIduUserPrincipalName uDisplayNamegetMe$fFromJSONUser$fEqUser $fOrdUser $fShowUser $fGenericUserdownloadFileMe downloadFile DriveItemdiNamediSizeDrivedId getDriveMegetDriveItemsMegetDriveItemChildren$fFromJSONDrive$fFromJSONDriveItem $fEqDriveItem$fShowDriveItem$fGenericDriveItem $fEqDrive $fShowDrive$fGenericDrive JWTException JWTClaims ApiAudiencebindValidationdecodeValidateJWTbase GHC.Floatexp validateJWT validateExp validateNbf validateAud JENoTokenJEClaimNotFoundJEMalformedJWTJEAudienceNotFound JENotYetValidJEExpiredTokenjcEmailjcSubjcNbfjcIatjcExpjcAud apiAudience UserEmail userEmailuserSub jwtClaims decValidSub decValidExp decValidNbf decValidEmail decValidAud decodeJWTdecAuddecExpdecIatdecNbfdecSubdecEmail claimNotFoundfromAudfromNumericDatefromStringOrUriepochdefaultAzureADIdpaadHeaderIdTokenloginHfetchUpdateTokendecValidIdTokenexcepttToActionM updateToken recordName dropPrefix