@azure/identity 4.5.1-alpha.20241111.1 → 4.5.1-alpha.20241113.2

package/dist/esm/msal/browserFlows/msalAuthCode.js

@@ -0,0 +1,203 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import * as msalBrowser from "@azure/msal-browser";
+import { MsalBrowser } from "./msalBrowserCommon.js";
+import { defaultLoggerCallback, getMSALLogLevel, handleMsalError, msalToPublic, publicToMsal, } from "../utils.js";
+import { AuthenticationRequiredError } from "../../errors.js";
+import { getLogLevel } from "@azure/logger";
+// We keep a copy of the redirect hash.
+const redirectHash = self.location.hash;
+/**
+ * Uses MSAL Browser 2.X for browser authentication,
+ * which uses the [Auth Code Flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow).
+ * @internal
+ */
+export class MSALAuthCode extends MsalBrowser {
+    /**
+     * Sets up an MSAL object based on the given parameters.
+     * MSAL with Auth Code allows sending a previously obtained `authenticationRecord` through the optional parameters,
+     * which is set to be the active account.
+     * @param options - Parameters necessary and otherwise used to create the MSAL object.
+     */
+    constructor(options) {
+        var _a;
+        super(options);
+        this.loginHint = options.loginHint;
+        this.msalConfig.cache = {
+            cacheLocation: "sessionStorage",
+            storeAuthStateInCookie: true, // Set to true to improve the experience on IE11 and Edge.
+        };
+        this.msalConfig.system = {
+            loggerOptions: {
+                loggerCallback: defaultLoggerCallback(this.logger, "Browser"),
+                logLevel: getMSALLogLevel(getLogLevel()),
+                piiLoggingEnabled: (_a = options.loggingOptions) === null || _a === void 0 ? void 0 : _a.enableUnsafeSupportLogging,
+            },
+        };
+        if (options.authenticationRecord) {
+            this.account = Object.assign(Object.assign({}, options.authenticationRecord), { tenantId: this.tenantId });
+        }
+    }
+    async getApp() {
+        if (!this.app) {
+            // Prepare the MSAL application
+            this.app = await msalBrowser.PublicClientApplication.createPublicClientApplication(this.msalConfig);
+            // setting the account right after the app is created.
+            if (this.account) {
+                this.app.setActiveAccount(publicToMsal(this.account));
+            }
+        }
+        return this.app;
+    }
+    /**
+     * Loads the account based on the result of the authentication.
+     * If no result was received, tries to load the account from the cache.
+     * @param result - Result object received from MSAL.
+     */
+    async handleBrowserResult(result) {
+        try {
+            const app = await this.getApp();
+            if (result && result.account) {
+                this.logger.info(`MSAL Browser V2 authentication successful.`);
+                app.setActiveAccount(result.account);
+                return msalToPublic(this.clientId, result.account);
+            }
+            // If by this point we happen to have an active account, we should stop trying to parse this.
+            const activeAccount = await this.app.getActiveAccount();
+            if (activeAccount) {
+                return msalToPublic(this.clientId, activeAccount);
+            }
+            // If we don't have an active account, we try to activate it from all the already loaded accounts.
+            const accounts = app.getAllAccounts();
+            if (accounts.length > 1) {
+                // If there's more than one account in memory, we force the user to authenticate again.
+                // At this point we can't identify which account should this credential work with,
+                // since at this point the user won't have provided enough information.
+                // We log a message in case that helps.
+                this.logger.info(`More than one account was found authenticated for this Client ID and Tenant ID.
+However, no "authenticationRecord" has been provided for this credential,
+therefore we're unable to pick between these accounts.
+A new login attempt will be requested, to ensure the correct account is picked.
+To work with multiple accounts for the same Client ID and Tenant ID, please provide an "authenticationRecord" when initializing "InteractiveBrowserCredential".`);
+                // To safely trigger a new login, we're also ensuring the local cache is cleared up for this MSAL object.
+                // However, we want to avoid kicking the user out of their authentication on the Azure side.
+                // We do this by calling to logout while specifying a `onRedirectNavigate` that returns false.
+                await app.logout({
+                    onRedirectNavigate: () => false,
+                });
+                return;
+            }
+            // If there's only one account for this MSAL object, we can safely activate it.
+            if (accounts.length === 1) {
+                const account = accounts[0];
+                app.setActiveAccount(account);
+                return msalToPublic(this.clientId, account);
+            }
+            this.logger.info(`No accounts were found through MSAL.`);
+        }
+        catch (e) {
+            this.logger.info(`Failed to acquire token through MSAL. ${e.message}`);
+        }
+        return;
+    }
+    /**
+     * Uses MSAL to handle the redirect.
+     */
+    async handleRedirect() {
+        const app = await this.getApp();
+        return this.handleBrowserResult((await app.handleRedirectPromise(redirectHash)) || undefined);
+    }
+    /**
+     * Uses MSAL to trigger a redirect or a popup login.
+     */
+    async login(scopes = []) {
+        const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
+        const loginRequest = {
+            scopes: arrayScopes,
+            loginHint: this.loginHint,
+        };
+        const app = await this.getApp();
+        switch (this.loginStyle) {
+            case "redirect": {
+                await app.loginRedirect(loginRequest);
+                return;
+            }
+            case "popup":
+                return this.handleBrowserResult(await app.loginPopup(loginRequest));
+        }
+    }
+    /**
+     * Uses MSAL to retrieve the active account.
+     */
+    async getActiveAccount() {
+        const app = await this.getApp();
+        const account = app.getActiveAccount();
+        if (!account) {
+            return;
+        }
+        return msalToPublic(this.clientId, account);
+    }
+    /**
+     * Attempts to retrieve a token from cache.
+     */
+    async getTokenSilent(scopes, options) {
+        const account = await this.getActiveAccount();
+        if (!account) {
+            throw new AuthenticationRequiredError({
+                scopes,
+                getTokenOptions: options,
+                message: "Silent authentication failed. We couldn't retrieve an active account from the cache.",
+            });
+        }
+        const parameters = {
+            authority: (options === null || options === void 0 ? void 0 : options.authority) || this.msalConfig.auth.authority,
+            correlationId: options === null || options === void 0 ? void 0 : options.correlationId,
+            claims: options === null || options === void 0 ? void 0 : options.claims,
+            account: publicToMsal(account),
+            forceRefresh: false,
+            scopes,
+        };
+        try {
+            this.logger.info("Attempting to acquire token silently");
+            const app = await this.getApp();
+            const response = await app.acquireTokenSilent(parameters);
+            return this.handleResult(scopes, response);
+        }
+        catch (err) {
+            throw handleMsalError(scopes, err, options);
+        }
+    }
+    /**
+     * Attempts to retrieve the token in the browser.
+     */
+    async doGetToken(scopes, options) {
+        const account = await this.getActiveAccount();
+        if (!account) {
+            throw new AuthenticationRequiredError({
+                scopes,
+                getTokenOptions: options,
+                message: "Silent authentication failed. We couldn't retrieve an active account from the cache.",
+            });
+        }
+        const parameters = {
+            authority: (options === null || options === void 0 ? void 0 : options.authority) || this.msalConfig.auth.authority,
+            correlationId: options === null || options === void 0 ? void 0 : options.correlationId,
+            claims: options === null || options === void 0 ? void 0 : options.claims,
+            account: publicToMsal(account),
+            loginHint: this.loginHint,
+            scopes,
+        };
+        const app = await this.getApp();
+        switch (this.loginStyle) {
+            case "redirect":
+                // This will go out of the page.
+                // Once the InteractiveBrowserCredential is initialized again,
+                // we'll load the MSAL account in the constructor.
+                await app.acquireTokenRedirect(parameters);
+                return { token: "", expiresOnTimestamp: 0, tokenType: "Bearer" };
+            case "popup":
+                return this.handleResult(scopes, await app.acquireTokenPopup(parameters));
+        }
+    }
+}
+//# sourceMappingURL=msalAuthCode.js.map

package/dist/esm/msal/browserFlows/msalAuthCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalAuthCode.js","sourceRoot":"","sources":["../../../../src/msal/browserFlows/msalAuthCode.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAElC,OAAO,KAAK,WAAW,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,YAAY,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,uCAAuC;AACvC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;AAExC;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,WAAW;IAI3C;;;;;OAKG;IACH,YAAY,OAA+B;;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAEnC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG;YACtB,aAAa,EAAE,gBAAgB;YAC/B,sBAAsB,EAAE,IAAI,EAAE,0DAA0D;SACzF,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG;YACvB,aAAa,EAAE;gBACb,cAAc,EAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;gBAC7D,QAAQ,EAAE,eAAe,CAAC,WAAW,EAAE,CAAC;gBACxC,iBAAiB,EAAE,MAAA,OAAO,CAAC,cAAc,0CAAE,0BAA0B;aACtE;SACF,CAAC;QACF,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,mCACP,OAAO,CAAC,oBAAoB,KAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ,GACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,+BAA+B;YAC/B,IAAI,CAAC,GAAG,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,6BAA6B,CAChF,IAAI,CAAC,UAAuC,CAC7C,CAAC;YAEF,sDAAsD;YACtD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAyC;QAEzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBAC/D,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACrC,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,CAAC;YAED,6FAA6F;YAC7F,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,GAAI,CAAC,gBAAgB,EAAE,CAAC;YACzD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACpD,CAAC;YAED,kGAAkG;YAClG,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,uFAAuF;gBACvF,kFAAkF;gBAClF,uEAAuE;gBACvE,uCAAuC;gBACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;;;;gKAIsJ,CACvJ,CAAC;gBACF,yGAAyG;gBACzG,4FAA4F;gBAC5F,8FAA8F;gBAC9F,MAAM,GAAG,CAAC,MAAM,CAAC;oBACf,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK;iBAChC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,+EAA+E;YAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC5B,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO;IACT,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IAChG,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,KAAK,CAAC,SAA4B,EAAE;QAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAgC;YAChD,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,gBAAgB;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CACzB,MAAgB,EAChB,OAAuC;QAEvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAA2B,CAAC;gBACpC,MAAM;gBACN,eAAe,EAAE,OAAO;gBACxB,OAAO,EACL,sFAAsF;aACzF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAA8B;YAC5C,SAAS,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,KAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAU;YAChE,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;YACrC,MAAM,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM;YACvB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;YAC9B,YAAY,EAAE,KAAK;YACnB,MAAM;SACP,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,UAAU,CACxB,MAAgB,EAChB,OAAuC;QAEvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAA2B,CAAC;gBACpC,MAAM;gBACN,eAAe,EAAE,OAAO;gBACxB,OAAO,EACL,sFAAsF;aACzF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAgC;YAC9C,SAAS,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,KAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAU;YAChE,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;YACrC,MAAM,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM;YACvB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;YAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM;SACP,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,KAAK,UAAU;gBACb,gCAAgC;gBAChC,8DAA8D;gBAC9D,kDAAkD;gBAElD,MAAM,GAAG,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;gBAC3C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;YACnE,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;CACF","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport * as msalBrowser from \"@azure/msal-browser\";\n\nimport type { MsalBrowserFlowOptions } from \"./msalBrowserCommon.js\";\nimport { MsalBrowser } from \"./msalBrowserCommon.js\";\nimport {\n  defaultLoggerCallback,\n  getMSALLogLevel,\n  handleMsalError,\n  msalToPublic,\n  publicToMsal,\n} from \"../utils.js\";\n\nimport type { AccessToken } from \"@azure/core-auth\";\nimport type { AuthenticationRecord } from \"../types.js\";\nimport { AuthenticationRequiredError } from \"../../errors.js\";\nimport type { CredentialFlowGetTokenOptions } from \"../credentials.js\";\nimport { getLogLevel } from \"@azure/logger\";\n\n// We keep a copy of the redirect hash.\nconst redirectHash = self.location.hash;\n\n/**\n * Uses MSAL Browser 2.X for browser authentication,\n * which uses the [Auth Code Flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow).\n * @internal\n */\nexport class MSALAuthCode extends MsalBrowser {\n  protected app?: msalBrowser.IPublicClientApplication;\n  private loginHint?: string;\n\n  /**\n   * Sets up an MSAL object based on the given parameters.\n   * MSAL with Auth Code allows sending a previously obtained `authenticationRecord` through the optional parameters,\n   * which is set to be the active account.\n   * @param options - Parameters necessary and otherwise used to create the MSAL object.\n   */\n  constructor(options: MsalBrowserFlowOptions) {\n    super(options);\n    this.loginHint = options.loginHint;\n\n    this.msalConfig.cache = {\n      cacheLocation: \"sessionStorage\",\n      storeAuthStateInCookie: true, // Set to true to improve the experience on IE11 and Edge.\n    };\n    this.msalConfig.system = {\n      loggerOptions: {\n        loggerCallback: defaultLoggerCallback(this.logger, \"Browser\"),\n        logLevel: getMSALLogLevel(getLogLevel()),\n        piiLoggingEnabled: options.loggingOptions?.enableUnsafeSupportLogging,\n      },\n    };\n    if (options.authenticationRecord) {\n      this.account = {\n        ...options.authenticationRecord,\n        tenantId: this.tenantId,\n      };\n    }\n  }\n\n  private async getApp(): Promise<msalBrowser.IPublicClientApplication> {\n    if (!this.app) {\n      // Prepare the MSAL application\n      this.app = await msalBrowser.PublicClientApplication.createPublicClientApplication(\n        this.msalConfig as msalBrowser.Configuration,\n      );\n\n      // setting the account right after the app is created.\n      if (this.account) {\n        this.app.setActiveAccount(publicToMsal(this.account));\n      }\n    }\n\n    return this.app;\n  }\n\n  /**\n   * Loads the account based on the result of the authentication.\n   * If no result was received, tries to load the account from the cache.\n   * @param result - Result object received from MSAL.\n   */\n  private async handleBrowserResult(\n    result?: msalBrowser.AuthenticationResult,\n  ): Promise<AuthenticationRecord | undefined> {\n    try {\n      const app = await this.getApp();\n      if (result && result.account) {\n        this.logger.info(`MSAL Browser V2 authentication successful.`);\n        app.setActiveAccount(result.account);\n        return msalToPublic(this.clientId, result.account);\n      }\n\n      // If by this point we happen to have an active account, we should stop trying to parse this.\n      const activeAccount = await this.app!.getActiveAccount();\n      if (activeAccount) {\n        return msalToPublic(this.clientId, activeAccount);\n      }\n\n      // If we don't have an active account, we try to activate it from all the already loaded accounts.\n      const accounts = app.getAllAccounts();\n      if (accounts.length > 1) {\n        // If there's more than one account in memory, we force the user to authenticate again.\n        // At this point we can't identify which account should this credential work with,\n        // since at this point the user won't have provided enough information.\n        // We log a message in case that helps.\n        this.logger.info(\n          `More than one account was found authenticated for this Client ID and Tenant ID.\nHowever, no \"authenticationRecord\" has been provided for this credential,\ntherefore we're unable to pick between these accounts.\nA new login attempt will be requested, to ensure the correct account is picked.\nTo work with multiple accounts for the same Client ID and Tenant ID, please provide an \"authenticationRecord\" when initializing \"InteractiveBrowserCredential\".`,\n        );\n        // To safely trigger a new login, we're also ensuring the local cache is cleared up for this MSAL object.\n        // However, we want to avoid kicking the user out of their authentication on the Azure side.\n        // We do this by calling to logout while specifying a `onRedirectNavigate` that returns false.\n        await app.logout({\n          onRedirectNavigate: () => false,\n        });\n        return;\n      }\n\n      // If there's only one account for this MSAL object, we can safely activate it.\n      if (accounts.length === 1) {\n        const account = accounts[0];\n        app.setActiveAccount(account);\n        return msalToPublic(this.clientId, account);\n      }\n\n      this.logger.info(`No accounts were found through MSAL.`);\n    } catch (e: any) {\n      this.logger.info(`Failed to acquire token through MSAL. ${e.message}`);\n    }\n    return;\n  }\n\n  /**\n   * Uses MSAL to handle the redirect.\n   */\n  public async handleRedirect(): Promise<AuthenticationRecord | undefined> {\n    const app = await this.getApp();\n    return this.handleBrowserResult((await app.handleRedirectPromise(redirectHash)) || undefined);\n  }\n\n  /**\n   * Uses MSAL to trigger a redirect or a popup login.\n   */\n  public async login(scopes: string | string[] = []): Promise<AuthenticationRecord | undefined> {\n    const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];\n    const loginRequest: msalBrowser.RedirectRequest = {\n      scopes: arrayScopes,\n      loginHint: this.loginHint,\n    };\n    const app = await this.getApp();\n    switch (this.loginStyle) {\n      case \"redirect\": {\n        await app.loginRedirect(loginRequest);\n        return;\n      }\n      case \"popup\":\n        return this.handleBrowserResult(await app.loginPopup(loginRequest));\n    }\n  }\n\n  /**\n   * Uses MSAL to retrieve the active account.\n   */\n  public async getActiveAccount(): Promise<AuthenticationRecord | undefined> {\n    const app = await this.getApp();\n    const account = app.getActiveAccount();\n    if (!account) {\n      return;\n    }\n    return msalToPublic(this.clientId, account);\n  }\n\n  /**\n   * Attempts to retrieve a token from cache.\n   */\n  public async getTokenSilent(\n    scopes: string[],\n    options?: CredentialFlowGetTokenOptions,\n  ): Promise<AccessToken> {\n    const account = await this.getActiveAccount();\n    if (!account) {\n      throw new AuthenticationRequiredError({\n        scopes,\n        getTokenOptions: options,\n        message:\n          \"Silent authentication failed. We couldn't retrieve an active account from the cache.\",\n      });\n    }\n\n    const parameters: msalBrowser.SilentRequest = {\n      authority: options?.authority || this.msalConfig.auth.authority!,\n      correlationId: options?.correlationId,\n      claims: options?.claims,\n      account: publicToMsal(account),\n      forceRefresh: false,\n      scopes,\n    };\n\n    try {\n      this.logger.info(\"Attempting to acquire token silently\");\n      const app = await this.getApp();\n      const response = await app.acquireTokenSilent(parameters);\n      return this.handleResult(scopes, response);\n    } catch (err: any) {\n      throw handleMsalError(scopes, err, options);\n    }\n  }\n\n  /**\n   * Attempts to retrieve the token in the browser.\n   */\n  protected async doGetToken(\n    scopes: string[],\n    options?: CredentialFlowGetTokenOptions,\n  ): Promise<AccessToken> {\n    const account = await this.getActiveAccount();\n    if (!account) {\n      throw new AuthenticationRequiredError({\n        scopes,\n        getTokenOptions: options,\n        message:\n          \"Silent authentication failed. We couldn't retrieve an active account from the cache.\",\n      });\n    }\n\n    const parameters: msalBrowser.RedirectRequest = {\n      authority: options?.authority || this.msalConfig.auth.authority!,\n      correlationId: options?.correlationId,\n      claims: options?.claims,\n      account: publicToMsal(account),\n      loginHint: this.loginHint,\n      scopes,\n    };\n    const app = await this.getApp();\n    switch (this.loginStyle) {\n      case \"redirect\":\n        // This will go out of the page.\n        // Once the InteractiveBrowserCredential is initialized again,\n        // we'll load the MSAL account in the constructor.\n\n        await app.acquireTokenRedirect(parameters);\n        return { token: \"\", expiresOnTimestamp: 0, tokenType: \"Bearer\" };\n      case \"popup\":\n        return this.handleResult(scopes, await app.acquireTokenPopup(parameters));\n    }\n  }\n}\n"]}

package/dist/esm/msal/browserFlows/msalBrowserCommon.d.ts

@@ -0,0 +1,106 @@
+import type * as msalBrowser from "@azure/msal-browser";
+import type { AccessToken, GetTokenOptions } from "@azure/core-auth";
+import type { AuthenticationRecord, MsalResult } from "../types.js";
+import type { CredentialLogger } from "../../util/logging.js";
+import type { MsalFlow, MsalFlowOptions } from "./flows.js";
+import type { BrowserLoginStyle } from "../../credentials/interactiveBrowserCredentialOptions.js";
+import type { CredentialFlowGetTokenOptions } from "../credentials.js";
+import type { LogPolicyOptions } from "@azure/core-rest-pipeline";
+import type { MultiTenantTokenCredentialOptions } from "../../credentials/multiTenantTokenCredentialOptions.js";
+/**
+ * Union of the constructor parameters that all MSAL flow types take.
+ * Some properties might not be used by some flow types.
+ */
+export interface MsalBrowserFlowOptions extends MsalFlowOptions {
+    tokenCredentialOptions: MultiTenantTokenCredentialOptions;
+    redirectUri?: string;
+    loginStyle: BrowserLoginStyle;
+    loginHint?: string;
+    /**
+     * Allows users to configure settings for logging policy options, allow logging account information and personally identifiable information for customer support.
+     */
+    loggingOptions?: LogPolicyOptions & {
+        /**
+         * Allows logging account information once the authentication flow succeeds.
+         */
+        allowLoggingAccountIdentifiers?: boolean;
+        /**
+         * Allows logging personally identifiable information for customer support.
+         */
+        enableUnsafeSupportLogging?: boolean;
+    };
+}
+/**
+ * The common methods we use to work with the MSAL browser flows.
+ * @internal
+ */
+export interface MsalBrowserFlow extends MsalFlow {
+    login(scopes?: string[]): Promise<AuthenticationRecord | undefined>;
+    handleRedirect(): Promise<AuthenticationRecord | undefined>;
+}
+/**
+ * Generates a MSAL configuration that generally works for browsers
+ * @internal
+ */
+export declare function defaultBrowserMsalConfig(options: MsalBrowserFlowOptions): msalBrowser.Configuration;
+/**
+ * MSAL partial base client for the browsers.
+ *
+ * It completes the input configuration with some default values.
+ * It also provides with utility protected methods that can be used from any of the clients,
+ * which includes handlers for successful responses and errors.
+ *
+ * @internal
+ */
+export declare abstract class MsalBrowser implements MsalBrowserFlow {
+    protected loginStyle: BrowserLoginStyle;
+    protected clientId: string;
+    protected tenantId: string;
+    protected additionallyAllowedTenantIds: string[];
+    protected authorityHost?: string;
+    protected account: AuthenticationRecord | undefined;
+    protected msalConfig: msalBrowser.Configuration;
+    protected disableAutomaticAuthentication?: boolean;
+    protected app?: msalBrowser.IPublicClientApplication;
+    protected logger: CredentialLogger;
+    constructor(options: MsalBrowserFlowOptions);
+    /**
+     * In the browsers we don't need to init()
+     */
+    init(): Promise<void>;
+    /**
+     * Attempts to handle a redirection request the least amount of times possible.
+     */
+    abstract handleRedirect(): Promise<AuthenticationRecord | undefined>;
+    /**
+     * Clears MSAL's cache.
+     */
+    logout(): Promise<void>;
+    /**
+     * Uses MSAL to retrieve the active account.
+     */
+    abstract getActiveAccount(): Promise<AuthenticationRecord | undefined>;
+    /**
+     * Uses MSAL to trigger a redirect or a popup login.
+     */
+    abstract login(scopes?: string | string[]): Promise<AuthenticationRecord | undefined>;
+    /**
+     * Attempts to retrieve a token from cache.
+     */
+    abstract getTokenSilent(scopes: string[]): Promise<AccessToken>;
+    /**
+     * Attempts to retrieve the token in the browser.
+     */
+    protected abstract doGetToken(scopes: string[]): Promise<AccessToken>;
+    /**
+     * Attempts to retrieve an authenticated token from MSAL.
+     */
+    getToken(scopes: string[], options?: CredentialFlowGetTokenOptions): Promise<AccessToken>;
+    /**
+     * Handles the MSAL authentication result.
+     * If the result has an account, we update the local account reference.
+     * If the token received is invalid, an error will be thrown depending on what's missing.
+     */
+    protected handleResult(scopes: string | string[], result?: MsalResult, getTokenOptions?: GetTokenOptions): AccessToken;
+}
+//# sourceMappingURL=msalBrowserCommon.d.ts.map

package/dist/esm/msal/browserFlows/msalBrowserCommon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalBrowserCommon.d.ts","sourceRoot":"","sources":["../../../../src/msal/browserFlows/msalBrowserCommon.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,WAAW,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAQ5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,wDAAwD,CAAC;AAEhH;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,sBAAsB,EAAE,iCAAiC,CAAC;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,cAAc,CAAC,EAAE,gBAAgB,GAAG;QAClC;;WAEG;QACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;QACzC;;WAEG;QACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;KACtC,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,QAAQ;IAC/C,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IACpE,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;CAC7D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,sBAAsB,GAC9B,WAAW,CAAC,aAAa,CAc3B;AAED;;;;;;;;GAQG;AACH,8BAAsB,WAAY,YAAW,eAAe;IAC1D,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACxC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IACjD,SAAS,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IACjC,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACpD,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,aAAa,CAAC;IAChD,SAAS,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACnD,SAAS,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,wBAAwB,CAAC;IACrD,SAAS,CAAC,MAAM,EAAE,gBAAgB,CAAC;gBAEvB,OAAO,EAAE,sBAAsB;IAuB3C;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B;;OAEG;aACa,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAE3E;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B;;OAEG;aACa,gBAAgB,IAAI,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAE7E;;OAEG;aACa,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAE5F;;OAEG;aACa,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAEtE;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAErE;;OAEG;IACU,QAAQ,CACnB,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,WAAW,CAAC;IAkCvB;;;;OAIG;IACH,SAAS,CAAC,YAAY,CACpB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,MAAM,CAAC,EAAE,UAAU,EACnB,eAAe,CAAC,EAAE,eAAe,GAChC,WAAW;CAaf"}

package/dist/esm/msal/browserFlows/msalBrowserCommon.js

@@ -0,0 +1,116 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import { AuthenticationRequiredError, CredentialUnavailableError } from "../../errors.js";
+import { formatSuccess } from "../../util/logging.js";
+import { ensureValidMsalToken, getAuthority, getKnownAuthorities, msalToPublic } from "../utils.js";
+import { processMultiTenantRequest, resolveAdditionallyAllowedTenantIds, resolveTenantId, } from "../../util/tenantIdUtils.js";
+import { DefaultTenantId } from "../../constants.js";
+/**
+ * Generates a MSAL configuration that generally works for browsers
+ * @internal
+ */
+export function defaultBrowserMsalConfig(options) {
+    const tenantId = options.tenantId || DefaultTenantId;
+    const authority = getAuthority(tenantId, options.authorityHost);
+    return {
+        auth: {
+            clientId: options.clientId,
+            authority,
+            knownAuthorities: getKnownAuthorities(tenantId, authority, options.disableInstanceDiscovery),
+            // If the users picked redirect as their login style,
+            // but they didn't provide a redirectUri,
+            // we can try to use the current page we're in as a default value.
+            redirectUri: options.redirectUri || self.location.origin,
+        },
+    };
+}
+/**
+ * MSAL partial base client for the browsers.
+ *
+ * It completes the input configuration with some default values.
+ * It also provides with utility protected methods that can be used from any of the clients,
+ * which includes handlers for successful responses and errors.
+ *
+ * @internal
+ */
+export class MsalBrowser {
+    constructor(options) {
+        var _a;
+        this.logger = options.logger;
+        this.loginStyle = options.loginStyle;
+        if (!options.clientId) {
+            throw new CredentialUnavailableError("A client ID is required in browsers");
+        }
+        this.clientId = options.clientId;
+        this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds((_a = options === null || options === void 0 ? void 0 : options.tokenCredentialOptions) === null || _a === void 0 ? void 0 : _a.additionallyAllowedTenants);
+        this.tenantId = resolveTenantId(this.logger, options.tenantId, options.clientId);
+        this.authorityHost = options.authorityHost;
+        this.msalConfig = defaultBrowserMsalConfig(options);
+        this.disableAutomaticAuthentication = options.disableAutomaticAuthentication;
+        if (options.authenticationRecord) {
+            this.account = Object.assign(Object.assign({}, options.authenticationRecord), { tenantId: this.tenantId });
+        }
+    }
+    /**
+     * In the browsers we don't need to init()
+     */
+    async init() {
+        // Nothing to do here.
+    }
+    /**
+     * Clears MSAL's cache.
+     */
+    async logout() {
+        var _a;
+        (_a = this.app) === null || _a === void 0 ? void 0 : _a.logout();
+    }
+    /**
+     * Attempts to retrieve an authenticated token from MSAL.
+     */
+    async getToken(scopes, options = {}) {
+        const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds) ||
+            this.tenantId;
+        if (!options.authority) {
+            options.authority = getAuthority(tenantId, this.authorityHost);
+        }
+        // We ensure that redirection is handled at this point.
+        await this.handleRedirect();
+        if (!(await this.getActiveAccount()) && !this.disableAutomaticAuthentication) {
+            await this.login(scopes);
+        }
+        return this.getTokenSilent(scopes).catch((err) => {
+            if (err.name !== "AuthenticationRequiredError") {
+                throw err;
+            }
+            if (options === null || options === void 0 ? void 0 : options.disableAutomaticAuthentication) {
+                throw new AuthenticationRequiredError({
+                    scopes,
+                    getTokenOptions: options,
+                    message: "Automatic authentication has been disabled. You may call the authentication() method.",
+                });
+            }
+            this.logger.info(`Silent authentication failed, falling back to interactive method ${this.loginStyle}`);
+            return this.doGetToken(scopes);
+        });
+    }
+    /**
+     * Handles the MSAL authentication result.
+     * If the result has an account, we update the local account reference.
+     * If the token received is invalid, an error will be thrown depending on what's missing.
+     */
+    handleResult(scopes, result, getTokenOptions) {
+        var _a;
+        if (result === null || result === void 0 ? void 0 : result.account) {
+            this.account = msalToPublic(this.clientId, result.account);
+        }
+        ensureValidMsalToken(scopes, result, getTokenOptions);
+        this.logger.getToken.info(formatSuccess(scopes));
+        return {
+            token: result.accessToken,
+            expiresOnTimestamp: result.expiresOn.getTime(),
+            refreshAfterTimestamp: (_a = result.refreshOn) === null || _a === void 0 ? void 0 : _a.getTime(),
+            tokenType: "Bearer",
+        };
+    }
+}
+//# sourceMappingURL=msalBrowserCommon.js.map

package/dist/esm/msal/browserFlows/msalBrowserCommon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msalBrowserCommon.js","sourceRoot":"","sources":["../../../../src/msal/browserFlows/msalBrowserCommon.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAMlC,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE1F,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,eAAe,GAChB,MAAM,6BAA6B,CAAC;AAIrC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAqCrD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA+B;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IACrD,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE;YACJ,QAAQ,EAAE,OAAO,CAAC,QAAS;YAC3B,SAAS;YACT,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,wBAAwB,CAAC;YAC5F,qDAAqD;YACrD,yCAAyC;YACzC,kEAAkE;YAClE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM;SACzD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAgB,WAAW;IAY/B,YAAY,OAA+B;;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC,qCAAqC,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,4BAA4B,GAAG,mCAAmC,CACrE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,sBAAsB,0CAAE,0BAA0B,CAC5D,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC;QAE7E,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,mCACP,OAAO,CAAC,oBAAoB,KAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ,GACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,sBAAsB;IACxB,CAAC;IAOD;;OAEG;IACH,KAAK,CAAC,MAAM;;QACV,MAAA,IAAI,CAAC,GAAG,0CAAE,MAAM,EAAE,CAAC;IACrB,CAAC;IAsBD;;OAEG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAgB,EAChB,UAAyC,EAAE;QAE3C,MAAM,QAAQ,GACZ,yBAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,4BAA4B,CAAC;YACpF,IAAI,CAAC,QAAQ,CAAC;QAEhB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,CAAC;QAED,uDAAuD;QACvD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;gBAC/C,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,8BAA8B,EAAE,CAAC;gBAC5C,MAAM,IAAI,2BAA2B,CAAC;oBACpC,MAAM;oBACN,eAAe,EAAE,OAAO;oBACxB,OAAO,EACL,uFAAuF;iBAC1F,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oEAAoE,IAAI,CAAC,UAAU,EAAE,CACtF,CAAC;YACF,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACO,YAAY,CACpB,MAAyB,EACzB,MAAmB,EACnB,eAAiC;;QAEjC,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;YAC9C,qBAAqB,EAAE,MAAA,MAAM,CAAC,SAAS,0CAAE,OAAO,EAAE;YAClD,SAAS,EAAE,QAAQ;SACL,CAAC;IACnB,CAAC;CACF","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type * as msalBrowser from \"@azure/msal-browser\";\n\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport type { AuthenticationRecord, MsalResult } from \"../types.js\";\nimport { AuthenticationRequiredError, CredentialUnavailableError } from \"../../errors.js\";\nimport type { CredentialLogger } from \"../../util/logging.js\";\nimport { formatSuccess } from \"../../util/logging.js\";\nimport type { MsalFlow, MsalFlowOptions } from \"./flows.js\";\nimport { ensureValidMsalToken, getAuthority, getKnownAuthorities, msalToPublic } from \"../utils.js\";\nimport {\n  processMultiTenantRequest,\n  resolveAdditionallyAllowedTenantIds,\n  resolveTenantId,\n} from \"../../util/tenantIdUtils.js\";\n\nimport type { BrowserLoginStyle } from \"../../credentials/interactiveBrowserCredentialOptions.js\";\nimport type { CredentialFlowGetTokenOptions } from \"../credentials.js\";\nimport { DefaultTenantId } from \"../../constants.js\";\nimport type { LogPolicyOptions } from \"@azure/core-rest-pipeline\";\nimport type { MultiTenantTokenCredentialOptions } from \"../../credentials/multiTenantTokenCredentialOptions.js\";\n\n/**\n * Union of the constructor parameters that all MSAL flow types take.\n * Some properties might not be used by some flow types.\n */\nexport interface MsalBrowserFlowOptions extends MsalFlowOptions {\n  tokenCredentialOptions: MultiTenantTokenCredentialOptions;\n  redirectUri?: string;\n  loginStyle: BrowserLoginStyle;\n  loginHint?: string;\n  /**\n   * Allows users to configure settings for logging policy options, allow logging account information and personally identifiable information for customer support.\n   */\n  loggingOptions?: LogPolicyOptions & {\n    /**\n     * Allows logging account information once the authentication flow succeeds.\n     */\n    allowLoggingAccountIdentifiers?: boolean;\n    /**\n     * Allows logging personally identifiable information for customer support.\n     */\n    enableUnsafeSupportLogging?: boolean;\n  };\n}\n\n/**\n * The common methods we use to work with the MSAL browser flows.\n * @internal\n */\nexport interface MsalBrowserFlow extends MsalFlow {\n  login(scopes?: string[]): Promise<AuthenticationRecord | undefined>;\n  handleRedirect(): Promise<AuthenticationRecord | undefined>;\n}\n\n/**\n * Generates a MSAL configuration that generally works for browsers\n * @internal\n */\nexport function defaultBrowserMsalConfig(\n  options: MsalBrowserFlowOptions,\n): msalBrowser.Configuration {\n  const tenantId = options.tenantId || DefaultTenantId;\n  const authority = getAuthority(tenantId, options.authorityHost);\n  return {\n    auth: {\n      clientId: options.clientId!,\n      authority,\n      knownAuthorities: getKnownAuthorities(tenantId, authority, options.disableInstanceDiscovery),\n      // If the users picked redirect as their login style,\n      // but they didn't provide a redirectUri,\n      // we can try to use the current page we're in as a default value.\n      redirectUri: options.redirectUri || self.location.origin,\n    },\n  };\n}\n\n/**\n * MSAL partial base client for the browsers.\n *\n * It completes the input configuration with some default values.\n * It also provides with utility protected methods that can be used from any of the clients,\n * which includes handlers for successful responses and errors.\n *\n * @internal\n */\nexport abstract class MsalBrowser implements MsalBrowserFlow {\n  protected loginStyle: BrowserLoginStyle;\n  protected clientId: string;\n  protected tenantId: string;\n  protected additionallyAllowedTenantIds: string[];\n  protected authorityHost?: string;\n  protected account: AuthenticationRecord | undefined;\n  protected msalConfig: msalBrowser.Configuration;\n  protected disableAutomaticAuthentication?: boolean;\n  protected app?: msalBrowser.IPublicClientApplication;\n  protected logger: CredentialLogger;\n\n  constructor(options: MsalBrowserFlowOptions) {\n    this.logger = options.logger;\n    this.loginStyle = options.loginStyle;\n    if (!options.clientId) {\n      throw new CredentialUnavailableError(\"A client ID is required in browsers\");\n    }\n    this.clientId = options.clientId;\n    this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(\n      options?.tokenCredentialOptions?.additionallyAllowedTenants,\n    );\n    this.tenantId = resolveTenantId(this.logger, options.tenantId, options.clientId);\n    this.authorityHost = options.authorityHost;\n    this.msalConfig = defaultBrowserMsalConfig(options);\n    this.disableAutomaticAuthentication = options.disableAutomaticAuthentication;\n\n    if (options.authenticationRecord) {\n      this.account = {\n        ...options.authenticationRecord,\n        tenantId: this.tenantId,\n      };\n    }\n  }\n\n  /**\n   * In the browsers we don't need to init()\n   */\n  async init(): Promise<void> {\n    // Nothing to do here.\n  }\n\n  /**\n   * Attempts to handle a redirection request the least amount of times possible.\n   */\n  public abstract handleRedirect(): Promise<AuthenticationRecord | undefined>;\n\n  /**\n   * Clears MSAL's cache.\n   */\n  async logout(): Promise<void> {\n    this.app?.logout();\n  }\n\n  /**\n   * Uses MSAL to retrieve the active account.\n   */\n  public abstract getActiveAccount(): Promise<AuthenticationRecord | undefined>;\n\n  /**\n   * Uses MSAL to trigger a redirect or a popup login.\n   */\n  public abstract login(scopes?: string | string[]): Promise<AuthenticationRecord | undefined>;\n\n  /**\n   * Attempts to retrieve a token from cache.\n   */\n  public abstract getTokenSilent(scopes: string[]): Promise<AccessToken>;\n\n  /**\n   * Attempts to retrieve the token in the browser.\n   */\n  protected abstract doGetToken(scopes: string[]): Promise<AccessToken>;\n\n  /**\n   * Attempts to retrieve an authenticated token from MSAL.\n   */\n  public async getToken(\n    scopes: string[],\n    options: CredentialFlowGetTokenOptions = {},\n  ): Promise<AccessToken> {\n    const tenantId =\n      processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds) ||\n      this.tenantId;\n\n    if (!options.authority) {\n      options.authority = getAuthority(tenantId, this.authorityHost);\n    }\n\n    // We ensure that redirection is handled at this point.\n    await this.handleRedirect();\n\n    if (!(await this.getActiveAccount()) && !this.disableAutomaticAuthentication) {\n      await this.login(scopes);\n    }\n    return this.getTokenSilent(scopes).catch((err) => {\n      if (err.name !== \"AuthenticationRequiredError\") {\n        throw err;\n      }\n      if (options?.disableAutomaticAuthentication) {\n        throw new AuthenticationRequiredError({\n          scopes,\n          getTokenOptions: options,\n          message:\n            \"Automatic authentication has been disabled. You may call the authentication() method.\",\n        });\n      }\n      this.logger.info(\n        `Silent authentication failed, falling back to interactive method ${this.loginStyle}`,\n      );\n      return this.doGetToken(scopes);\n    });\n  }\n\n  /**\n   * Handles the MSAL authentication result.\n   * If the result has an account, we update the local account reference.\n   * If the token received is invalid, an error will be thrown depending on what's missing.\n   */\n  protected handleResult(\n    scopes: string | string[],\n    result?: MsalResult,\n    getTokenOptions?: GetTokenOptions,\n  ): AccessToken {\n    if (result?.account) {\n      this.account = msalToPublic(this.clientId, result.account);\n    }\n    ensureValidMsalToken(scopes, result, getTokenOptions);\n    this.logger.getToken.info(formatSuccess(scopes));\n    return {\n      token: result.accessToken,\n      expiresOnTimestamp: result.expiresOn.getTime(),\n      refreshAfterTimestamp: result.refreshOn?.getTime(),\n      tokenType: \"Bearer\",\n    } as AccessToken;\n  }\n}\n"]}

package/dist/esm/msal/credentials.d.ts

@@ -0,0 +1,52 @@
+import type { AccessToken, GetTokenOptions } from "@azure/core-auth";
+import type { AuthenticationRecord } from "./types.js";
+/**
+ * The MSAL clients `getToken` requests can receive a `correlationId` and `disableAutomaticAuthentication`.
+ * (which is used to prevent `getToken` from triggering the manual authentication if `getTokenSilent`  fails).
+ * @internal
+ */
+export interface CredentialFlowGetTokenOptions extends GetTokenOptions {
+    /**
+     * Unique identifier useful to track outgoing requests.
+     */
+    correlationId?: string;
+    /**
+     * Makes getToken throw if a manual authentication is necessary.
+     */
+    disableAutomaticAuthentication?: boolean;
+    /**
+     * Authority, to overwrite the default one, if necessary.
+     */
+    authority?: string;
+    /**
+     * Claims received from challenges.
+     */
+    claims?: string;
+    /**
+     * Indicates to allow Continuous Access Evaluation or not
+     */
+    enableCae?: boolean;
+    /**
+     * Client Assertion
+     */
+    getAssertion?: () => Promise<string>;
+}
+/**
+ * Simplified representation of the internal authentication flow.
+ * @internal
+ */
+export interface CredentialFlow {
+    /**
+     * Clears the MSAL cache.
+     */
+    logout(): Promise<void>;
+    /**
+     * Tries to load the active account, either from memory or from MSAL.
+     */
+    getActiveAccount(): Promise<AuthenticationRecord | undefined>;
+    /**
+     * Calls to the implementation's doGetToken method.
+     */
+    getToken(scopes?: string[], options?: CredentialFlowGetTokenOptions): Promise<AccessToken | null>;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/esm/msal/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/msal/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,6BAA8B,SAAQ,eAAe;IACpE;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;OAEG;IACH,gBAAgB,IAAI,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC9D;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACnG"}

package/dist/esm/msal/credentials.js

@@ -0,0 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+export {};
+//# sourceMappingURL=credentials.js.map

package/dist/esm/msal/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/msal/credentials.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { AccessToken, GetTokenOptions } from \"@azure/core-auth\";\nimport type { AuthenticationRecord } from \"./types.js\";\n\n/**\n * The MSAL clients `getToken` requests can receive a `correlationId` and `disableAutomaticAuthentication`.\n * (which is used to prevent `getToken` from triggering the manual authentication if `getTokenSilent`  fails).\n * @internal\n */\nexport interface CredentialFlowGetTokenOptions extends GetTokenOptions {\n  /**\n   * Unique identifier useful to track outgoing requests.\n   */\n  correlationId?: string;\n  /**\n   * Makes getToken throw if a manual authentication is necessary.\n   */\n  disableAutomaticAuthentication?: boolean;\n  /**\n   * Authority, to overwrite the default one, if necessary.\n   */\n  authority?: string;\n  /**\n   * Claims received from challenges.\n   */\n  claims?: string;\n  /**\n   * Indicates to allow Continuous Access Evaluation or not\n   */\n  enableCae?: boolean;\n  /**\n   * Client Assertion\n   */\n  getAssertion?: () => Promise<string>;\n}\n\n/**\n * Simplified representation of the internal authentication flow.\n * @internal\n */\nexport interface CredentialFlow {\n  /**\n   * Clears the MSAL cache.\n   */\n  logout(): Promise<void>;\n  /**\n   * Tries to load the active account, either from memory or from MSAL.\n   */\n  getActiveAccount(): Promise<AuthenticationRecord | undefined>;\n  /**\n   * Calls to the implementation's doGetToken method.\n   */\n  getToken(scopes?: string[], options?: CredentialFlowGetTokenOptions): Promise<AccessToken | null>;\n}\n"]}

package/dist/esm/msal/msal.d.ts

@@ -0,0 +1,3 @@
+import * as msalCommon from "@azure/msal-node";
+export { msalCommon };
+//# sourceMappingURL=msal.d.ts.map

package/dist/esm/msal/msal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msal.d.ts","sourceRoot":"","sources":["../../../src/msal/msal.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/esm/msal/nodeFlows/brokerOptions.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Parameters that enable WAM broker authentication in the InteractiveBrowserCredential.
+ */
+export type BrokerOptions = BrokerEnabledOptions | BrokerDisabledOptions;
+/**
+ * Parameters when WAM broker authentication is disabled.
+ */
+export interface BrokerDisabledOptions {
+    /**
+     * If set to true, broker will be enabled for WAM support on Windows.
+     */
+    enabled: false;
+    /**
+     * If set to true, MSA account will be passed through, required for WAM authentication.
+     */
+    legacyEnableMsaPassthrough?: undefined;
+    /**
+     * Window handle for parent window, required for WAM authentication.
+     */
+    parentWindowHandle: undefined;
+}
+/**
+ * Parameters when WAM broker authentication is enabled.
+ */
+export interface BrokerEnabledOptions {
+    /**
+     * If set to true, broker will be enabled for WAM support on Windows.
+     */
+    enabled: true;
+    /**
+     * If set to true, MSA account will be passed through, required for WAM authentication.
+     */
+    legacyEnableMsaPassthrough?: boolean;
+    /**
+     * Window handle for parent window, required for WAM authentication.
+     */
+    parentWindowHandle: Uint8Array;
+    /**
+     * If set to true, the credential will attempt to use the default broker account for authentication before falling back to interactive authentication.
+     * Default is set to false.
+     */
+    useDefaultBrokerAccount?: boolean;
+}
+//# sourceMappingURL=brokerOptions.d.ts.map

package/dist/esm/msal/nodeFlows/brokerOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brokerOptions.d.ts","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/brokerOptions.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,KAAK,CAAC;IAEf;;OAEG;IACH,0BAA0B,CAAC,EAAE,SAAS,CAAC;IACvC;;OAEG;IACH,kBAAkB,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,IAAI,CAAC;IACd;;OAEG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;OAEG;IACH,kBAAkB,EAAE,UAAU,CAAC;IAE/B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC"}

package/dist/esm/msal/nodeFlows/brokerOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=brokerOptions.js.map

package/dist/esm/msal/nodeFlows/brokerOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brokerOptions.js","sourceRoot":"","sources":["../../../../src/msal/nodeFlows/brokerOptions.ts"],"names":[],"mappings":"","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n/**\n * Parameters that enable WAM broker authentication in the InteractiveBrowserCredential.\n */\nexport type BrokerOptions = BrokerEnabledOptions | BrokerDisabledOptions;\n\n/**\n * Parameters when WAM broker authentication is disabled.\n */\nexport interface BrokerDisabledOptions {\n  /**\n   * If set to true, broker will be enabled for WAM support on Windows.\n   */\n  enabled: false;\n\n  /**\n   * If set to true, MSA account will be passed through, required for WAM authentication.\n   */\n  legacyEnableMsaPassthrough?: undefined;\n  /**\n   * Window handle for parent window, required for WAM authentication.\n   */\n  parentWindowHandle: undefined;\n}\n\n/**\n * Parameters when WAM broker authentication is enabled.\n */\nexport interface BrokerEnabledOptions {\n  /**\n   * If set to true, broker will be enabled for WAM support on Windows.\n   */\n  enabled: true;\n  /**\n   * If set to true, MSA account will be passed through, required for WAM authentication.\n   */\n  legacyEnableMsaPassthrough?: boolean;\n  /**\n   * Window handle for parent window, required for WAM authentication.\n   */\n  parentWindowHandle: Uint8Array;\n\n  /**\n   * If set to true, the credential will attempt to use the default broker account for authentication before falling back to interactive authentication.\n   * Default is set to false.\n   */\n  useDefaultBrokerAccount?: boolean;\n}\n"]}