@azure/msal-angular 4.0.12 → 4.0.13

package/src/msal.interceptor.ts

@@ -0,0 +1,388 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { Injectable, Inject } from "@angular/core";
+import { Location, DOCUMENT } from "@angular/common";
+import {
+  HttpRequest,
+  HttpHandler,
+  HttpEvent,
+  HttpInterceptor,
+} from "@angular/common/http"; // eslint-disable-line import/no-unresolved
+import {
+  AccountInfo,
+  AuthenticationResult,
+  BrowserConfigurationAuthError,
+  InteractionStatus,
+  InteractionType,
+  StringUtils,
+} from "@azure/msal-browser";
+import { Observable, EMPTY, of } from "rxjs";
+import { switchMap, catchError, take, filter } from "rxjs/operators";
+import { MsalService } from "./msal.service";
+import {
+  MsalInterceptorAuthRequest,
+  MsalInterceptorConfiguration,
+  ProtectedResourceScopes,
+} from "./msal.interceptor.config";
+import { MsalBroadcastService } from "./msal.broadcast.service";
+import { MSAL_INTERCEPTOR_CONFIG } from "./constants";
+
+@Injectable()
+export class MsalInterceptor implements HttpInterceptor {
+  private _document?: Document;
+
+  constructor(
+    @Inject(MSAL_INTERCEPTOR_CONFIG)
+    private msalInterceptorConfig: MsalInterceptorConfiguration,
+    private authService: MsalService,
+    private location: Location,
+    private msalBroadcastService: MsalBroadcastService,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/explicit-module-boundary-types
+    @Inject(DOCUMENT) document?: any
+  ) {
+    this._document = document as Document;
+  }
+
+  intercept(
+    req: HttpRequest<any>, // eslint-disable-line @typescript-eslint/no-explicit-any
+    next: HttpHandler
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ): Observable<HttpEvent<any>> {
+    if (
+      this.msalInterceptorConfig.interactionType !== InteractionType.Popup &&
+      this.msalInterceptorConfig.interactionType !== InteractionType.Redirect
+    ) {
+      throw new BrowserConfigurationAuthError(
+        "invalid_interaction_type",
+        "Invalid interaction type provided to MSAL Interceptor. InteractionType.Popup, InteractionType.Redirect must be provided in the msalInterceptorConfiguration"
+      );
+    }
+
+    this.authService.getLogger().verbose("MSAL Interceptor activated");
+    const scopes = this.getScopesForEndpoint(req.url, req.method);
+
+    // If no scopes for endpoint, does not acquire token
+    if (!scopes || scopes.length === 0) {
+      this.authService
+        .getLogger()
+        .verbose("Interceptor - no scopes for endpoint");
+      return next.handle(req);
+    }
+
+    // Sets account as active account or first account
+    let account: AccountInfo;
+    if (!!this.authService.instance.getActiveAccount()) {
+      this.authService
+        .getLogger()
+        .verbose("Interceptor - active account selected");
+      account = this.authService.instance.getActiveAccount();
+    } else {
+      this.authService
+        .getLogger()
+        .verbose("Interceptor - no active account, fallback to first account");
+      account = this.authService.instance.getAllAccounts()[0];
+    }
+
+    const authRequest =
+      typeof this.msalInterceptorConfig.authRequest === "function"
+        ? this.msalInterceptorConfig.authRequest(this.authService, req, {
+            account: account,
+          })
+        : { ...this.msalInterceptorConfig.authRequest, account };
+
+    this.authService
+      .getLogger()
+      .info(`Interceptor - ${scopes.length} scopes found for endpoint`);
+    this.authService
+      .getLogger()
+      .infoPii(`Interceptor - [${scopes}] scopes found for ${req.url}`);
+
+    return this.acquireToken(authRequest, scopes, account).pipe(
+      switchMap((result: AuthenticationResult) => {
+        this.authService
+          .getLogger()
+          .verbose("Interceptor - setting authorization headers");
+        const headers = req.headers.set(
+          "Authorization",
+          `Bearer ${result.accessToken}`
+        );
+
+        const requestClone = req.clone({ headers });
+        return next.handle(requestClone);
+      })
+    );
+  }
+
+  /**
+   * Try to acquire token silently. Invoke interaction if acquireTokenSilent rejected with error or resolved with null access token
+   * @param authRequest Request
+   * @param scopes Array of scopes for the request
+   * @param account Account
+   * @returns Authentication result
+   */
+  private acquireToken(
+    authRequest: MsalInterceptorAuthRequest,
+    scopes: string[],
+    account: AccountInfo
+  ): Observable<AuthenticationResult> {
+    // Note: For MSA accounts, include openid scope when calling acquireTokenSilent to return idToken
+    return this.authService
+      .acquireTokenSilent({ ...authRequest, scopes, account })
+      .pipe(
+        catchError(() => {
+          this.authService
+            .getLogger()
+            .error(
+              "Interceptor - acquireTokenSilent rejected with error. Invoking interaction to resolve."
+            );
+          return this.msalBroadcastService.inProgress$.pipe(
+            take(1),
+            switchMap((status: InteractionStatus) => {
+              if (status === InteractionStatus.None) {
+                return this.acquireTokenInteractively(authRequest, scopes);
+              }
+
+              return this.msalBroadcastService.inProgress$.pipe(
+                filter(
+                  (status: InteractionStatus) =>
+                    status === InteractionStatus.None
+                ),
+                take(1),
+                switchMap(() => this.acquireToken(authRequest, scopes, account))
+              );
+            })
+          );
+        }),
+        switchMap((result: AuthenticationResult) => {
+          if (!result.accessToken) {
+            this.authService
+              .getLogger()
+              .error(
+                "Interceptor - acquireTokenSilent resolved with null access token. Known issue with B2C tenants, invoking interaction to resolve."
+              );
+            return this.msalBroadcastService.inProgress$.pipe(
+              filter(
+                (status: InteractionStatus) => status === InteractionStatus.None
+              ),
+              take(1),
+              switchMap(() =>
+                this.acquireTokenInteractively(authRequest, scopes)
+              )
+            );
+          }
+          return of(result);
+        })
+      );
+  }
+
+  /**
+   * Invoke interaction for the given set of scopes
+   * @param authRequest Request
+   * @param scopes Array of scopes for the request
+   * @returns Result from the interactive request
+   */
+  private acquireTokenInteractively(
+    authRequest: MsalInterceptorAuthRequest,
+    scopes: string[]
+  ): Observable<AuthenticationResult> {
+    if (this.msalInterceptorConfig.interactionType === InteractionType.Popup) {
+      this.authService
+        .getLogger()
+        .verbose(
+          "Interceptor - error acquiring token silently, acquiring by popup"
+        );
+      return this.authService.acquireTokenPopup({ ...authRequest, scopes });
+    }
+    this.authService
+      .getLogger()
+      .verbose(
+        "Interceptor - error acquiring token silently, acquiring by redirect"
+      );
+    const redirectStartPage = window.location.href;
+    this.authService.acquireTokenRedirect({
+      ...authRequest,
+      scopes,
+      redirectStartPage,
+    });
+    return EMPTY;
+  }
+
+  /**
+   * Looks up the scopes for the given endpoint from the protectedResourceMap
+   * @param endpoint Url of the request
+   * @param httpMethod Http method of the request
+   * @returns Array of scopes, or null if not found
+   *
+   */
+  private getScopesForEndpoint(
+    endpoint: string,
+    httpMethod: string
+  ): Array<string> | null {
+    this.authService
+      .getLogger()
+      .verbose("Interceptor - getting scopes for endpoint");
+
+    // Ensures endpoints and protected resources compared are normalized
+    const normalizedEndpoint = this.location.normalize(endpoint);
+
+    const protectedResourcesArray = Array.from(
+      this.msalInterceptorConfig.protectedResourceMap.keys()
+    );
+
+    const matchingProtectedResources = this.matchResourcesToEndpoint(
+      protectedResourcesArray,
+      normalizedEndpoint
+    );
+
+    if (matchingProtectedResources.length > 0) {
+      return this.matchScopesToEndpoint(
+        this.msalInterceptorConfig.protectedResourceMap,
+        matchingProtectedResources,
+        httpMethod
+      );
+    }
+
+    return null;
+  }
+
+  /**
+   * Finds resource endpoints that match request endpoint
+   * @param protectedResourcesEndpoints
+   * @param endpoint
+   * @returns
+   */
+  private matchResourcesToEndpoint(
+    protectedResourcesEndpoints: string[],
+    endpoint: string
+  ): Array<string> {
+    const matchingResources: Array<string> = [];
+
+    protectedResourcesEndpoints.forEach((key) => {
+      const normalizedKey = this.location.normalize(key);
+
+      // Get url components
+      const absoluteKey = this.getAbsoluteUrl(normalizedKey);
+      const keyComponents = new URL(absoluteKey);
+      const absoluteEndpoint = this.getAbsoluteUrl(endpoint);
+      const endpointComponents = new URL(absoluteEndpoint);
+
+      if (this.checkUrlComponents(keyComponents, endpointComponents)) {
+        matchingResources.push(key);
+      }
+    });
+
+    return matchingResources;
+  }
+
+  /**
+   * Compares URL segments between key and endpoint
+   * @param key
+   * @param endpoint
+   * @returns
+   */
+  private checkUrlComponents(
+    keyComponents: URL,
+    endpointComponents: URL
+  ): boolean {
+    // URL properties from https://developer.mozilla.org/en-US/docs/Web/API/URL
+    const urlProperties = ["protocol", "host", "pathname", "search", "hash"];
+
+    for (const property of urlProperties) {
+      if (keyComponents[property]) {
+        const decodedInput = decodeURIComponent(keyComponents[property]);
+        if (
+          !StringUtils.matchPattern(decodedInput, endpointComponents[property])
+        ) {
+          return false;
+        }
+      }
+    }
+
+    return true;
+  }
+
+  /**
+   * Transforms relative urls to absolute urls
+   * @param url
+   * @returns
+   */
+  private getAbsoluteUrl(url: string): string {
+    const link = this._document.createElement("a");
+    link.href = url;
+    return link.href;
+  }
+
+  /**
+   * Finds scopes from first matching endpoint with HTTP method that matches request
+   * @param protectedResourceMap Protected resource map
+   * @param endpointArray Array of resources that match request endpoint
+   * @param httpMethod Http method of the request
+   * @returns
+   */
+  private matchScopesToEndpoint(
+    protectedResourceMap: Map<
+      string,
+      Array<string | ProtectedResourceScopes> | null
+    >,
+    endpointArray: string[],
+    httpMethod: string
+  ): Array<string> | null {
+    const allMatchedScopes = [];
+
+    // Check each matched endpoint for matching HttpMethod and scopes
+    endpointArray.forEach((matchedEndpoint) => {
+      const scopesForEndpoint = [];
+      const methodAndScopesArray = protectedResourceMap.get(matchedEndpoint);
+
+      // Return if resource is unprotected
+      if (methodAndScopesArray === null) {
+        allMatchedScopes.push(null);
+        return;
+      }
+
+      methodAndScopesArray.forEach((entry) => {
+        // Entry is either array of scopes or ProtectedResourceScopes object
+        if (typeof entry === "string") {
+          scopesForEndpoint.push(entry);
+        } else {
+          // Ensure methods being compared are normalized
+          const normalizedRequestMethod = httpMethod.toLowerCase();
+          const normalizedResourceMethod = entry.httpMethod.toLowerCase();
+          // Method in protectedResourceMap matches request http method
+          if (normalizedResourceMethod === normalizedRequestMethod) {
+            // Validate if scopes comes null to unprotect the resource in a certain http method
+            if (entry.scopes === null) {
+              allMatchedScopes.push(null);
+            } else {
+              entry.scopes.forEach((scope) => {
+                scopesForEndpoint.push(scope);
+              });
+            }
+          }
+        }
+      });
+
+      // Only add to all scopes if scopes for endpoint and method is found
+      if (scopesForEndpoint.length > 0) {
+        allMatchedScopes.push(scopesForEndpoint);
+      }
+    });
+
+    if (allMatchedScopes.length > 0) {
+      if (allMatchedScopes.length > 1) {
+        this.authService
+          .getLogger()
+          .warning(
+            "Interceptor - More than 1 matching scopes for endpoint found."
+          );
+      }
+      // Returns scopes for first matching endpoint
+      return allMatchedScopes[0];
+    }
+
+    return null;
+  }
+}

package/src/msal.module.ts

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { ModuleWithProviders, NgModule } from "@angular/core";
+import { CommonModule } from "@angular/common";
+import { IPublicClientApplication } from "@azure/msal-browser";
+import { MsalBroadcastService } from "./msal.broadcast.service";
+import { MsalGuard } from "./msal.guard";
+import { MsalGuardConfiguration } from "./msal.guard.config";
+import { MsalInterceptorConfiguration } from "./msal.interceptor.config";
+import { MsalRedirectComponent } from "./msal.redirect.component";
+import { MsalService } from "./msal.service";
+import {
+  MSAL_INSTANCE,
+  MSAL_GUARD_CONFIG,
+  MSAL_INTERCEPTOR_CONFIG,
+} from "./constants";
+
+@NgModule({
+  declarations: [MsalRedirectComponent],
+  imports: [CommonModule],
+  providers: [MsalGuard, MsalBroadcastService],
+})
+export class MsalModule {
+  static forRoot(
+    msalInstance: IPublicClientApplication,
+    guardConfig: MsalGuardConfiguration,
+    interceptorConfig: MsalInterceptorConfiguration
+  ): ModuleWithProviders<MsalModule> {
+    return {
+      ngModule: MsalModule,
+      providers: [
+        {
+          provide: MSAL_INSTANCE,
+          useValue: msalInstance,
+        },
+        {
+          provide: MSAL_GUARD_CONFIG,
+          useValue: guardConfig,
+        },
+        {
+          provide: MSAL_INTERCEPTOR_CONFIG,
+          useValue: interceptorConfig,
+        },
+        MsalService,
+      ],
+    };
+  }
+}

package/src/msal.navigation.client.spec.ts

@@ -0,0 +1,96 @@
+import { TestBed } from "@angular/core/testing";
+import { Location } from "@angular/common";
+import { Router } from "@angular/router";
+import {
+  InteractionType,
+  NavigationClient,
+  NavigationOptions,
+  PublicClientApplication,
+} from "@azure/msal-browser";
+import { MsalBroadcastService } from "./msal.broadcast.service";
+import { MsalGuard } from "./msal.guard";
+import { MsalCustomNavigationClient } from "./msal.navigation.client";
+import { MsalModule, MsalService } from "./public-api";
+
+let authService: MsalService;
+let navigationClient: MsalCustomNavigationClient;
+let routerMock = {
+  navigateByUrl: jasmine.createSpy("navigateByUrl").and.resolveTo(),
+};
+
+const msalInstance = new PublicClientApplication({
+  auth: {
+    clientId: "b5c2e510-4a17-4feb-b219-e55aa5b74144",
+    redirectUri: "http://localhost:4200",
+  },
+});
+
+describe("MsalCustomNaviationClient", () => {
+  beforeEach(() => {
+    TestBed.resetTestingModule();
+
+    TestBed.configureTestingModule({
+      imports: [
+        MsalModule.forRoot(msalInstance, null, {
+          interactionType: InteractionType.Popup,
+          protectedResourceMap: new Map(),
+        }),
+      ],
+      providers: [
+        MsalBroadcastService,
+        { provide: Router, useValue: routerMock },
+        Location,
+        MsalCustomNavigationClient,
+        MsalService,
+        MsalGuard,
+      ],
+      teardown: { destroyAfterEach: false },
+    });
+    authService = TestBed.inject(MsalService);
+    navigationClient = TestBed.inject(MsalCustomNavigationClient);
+  });
+
+  describe("NavigateInternal Unit tests", () => {
+    it("is created", () => {
+      expect(navigationClient).toBeTruthy();
+    });
+
+    it("NavigateInternal (noHistory false)", (done) => {
+      const url = "http://localhost:4200/profile";
+      const normalizedAbsoluteUrl = "/profile";
+
+      const options = {
+        noHistory: false,
+      } as NavigationOptions;
+
+      const navigateByUrlOptions = {
+        replaceUrl: false,
+      };
+
+      navigationClient.navigateInternal(url, options).then(() => {
+        expect(routerMock.navigateByUrl).toHaveBeenCalledWith(
+          normalizedAbsoluteUrl,
+          navigateByUrlOptions
+        );
+        done();
+      });
+    });
+
+    it("NavigateInternal (noHistory true)", (done) => {
+      const url = "http://localhost:4200/profile";
+
+      const options = {
+        noHistory: true,
+      } as NavigationOptions;
+
+      const windowLocationReplaceSpy = spyOn(
+        NavigationClient.prototype,
+        "navigateInternal"
+      );
+      navigationClient.navigateInternal(url, options).then(() => {
+        expect(windowLocationReplaceSpy).toHaveBeenCalledWith(url, options);
+        done();
+      });
+    });
+  });
+});

package/src/msal.navigation.client.ts

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { Injectable } from "@angular/core";
+import { Location } from "@angular/common";
+import { Router } from "@angular/router";
+import {
+  NavigationClient,
+  NavigationOptions,
+  UrlString,
+} from "@azure/msal-browser";
+import { MsalService } from "./msal.service";
+
+/**
+ * Custom navigation used for Angular client-side navigation.
+ * See performance doc for details:
+ * https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/lib/msal-angular/docs/performance.md
+ */
+@Injectable()
+export class MsalCustomNavigationClient extends NavigationClient {
+  constructor(
+    private authService: MsalService,
+    private router: Router,
+    private location: Location
+  ) {
+    super();
+  }
+
+  async navigateInternal(
+    url: string,
+    options: NavigationOptions
+  ): Promise<boolean> {
+    this.authService.getLogger().trace("MsalCustomNavigationClient called");
+
+    this.authService
+      .getLogger()
+      .verbose("MsalCustomNavigationClient - navigating");
+    this.authService
+      .getLogger()
+      .verbosePii(`MsalCustomNavigationClient - navigating to url: ${url}`);
+
+    // Prevent hash clearing from causing an issue with Client-side navigation after redirect is handled
+    if (options.noHistory) {
+      return super.navigateInternal(url, options);
+    } else {
+      // Normalizing newUrl if no query string
+      const urlComponents = new UrlString(url).getUrlComponents();
+      const newUrl = urlComponents.QueryString
+        ? `${urlComponents.AbsolutePath}?${urlComponents.QueryString}`
+        : this.location.normalize(urlComponents.AbsolutePath);
+      await this.router.navigateByUrl(newUrl, {
+        replaceUrl: options.noHistory,
+      });
+    }
+    return Promise.resolve(options.noHistory);
+  }
+}

package/src/msal.redirect.component.spec.ts

@@ -0,0 +1,64 @@
+import { TestBed } from "@angular/core/testing";
+import {
+  IPublicClientApplication,
+  PublicClientApplication,
+} from "@azure/msal-browser";
+import { MsalBroadcastService } from "./msal.broadcast.service";
+import { MsalModule } from "./msal.module";
+import { MsalRedirectComponent } from "./msal.redirect.component";
+import { MsalService } from "./msal.service";
+
+let authService: MsalService;
+let broadcastService: MsalBroadcastService;
+
+function MSALInstanceFactory(): IPublicClientApplication {
+  return new PublicClientApplication({
+    auth: {
+      clientId: "b5c2e510-4a17-4feb-b219-e55aa5b74144",
+      redirectUri: "http://localhost:4200",
+    },
+  });
+}
+
+function initializeMsal() {
+  TestBed.resetTestingModule();
+
+  TestBed.configureTestingModule({
+    declarations: [MsalRedirectComponent],
+    imports: [MsalModule.forRoot(MSALInstanceFactory(), null, null)],
+    providers: [],
+    teardown: { destroyAfterEach: false },
+  });
+
+  authService = TestBed.inject(MsalService);
+  broadcastService = TestBed.inject(MsalBroadcastService);
+}
+
+describe("MsalRedirectComponent", () => {
+  beforeEach(initializeMsal);
+
+  it("calls handleRedirectObservable on ngInit", (done) => {
+    const sampleAccessToken = {
+      accessToken: "123abc",
+    };
+
+    spyOn(
+      PublicClientApplication.prototype,
+      "handleRedirectPromise"
+    ).and.callFake(() => {
+      return new Promise((resolve) => {
+        console.log("Spy called");
+        //@ts-ignore
+        resolve(sampleAccessToken);
+
+        expect(
+          PublicClientApplication.prototype.handleRedirectPromise
+        ).toHaveBeenCalled();
+        done();
+      });
+    });
+
+    const component = new MsalRedirectComponent(authService);
+    component.ngOnInit();
+  });
+});

package/src/msal.redirect.component.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * This is a dedicated redirect component to be added to Angular apps to
+ * handle redirects when using @azure/msal-angular.
+ * Import this component to use redirects in your app.
+ */
+
+import { Component, OnInit } from "@angular/core";
+import { MsalService } from "./msal.service";
+
+@Component({
+  selector: "app-redirect",
+  template: "",
+})
+export class MsalRedirectComponent implements OnInit {
+  constructor(private authService: MsalService) {}
+
+  ngOnInit(): void {
+    this.authService.getLogger().verbose("MsalRedirectComponent activated");
+    this.authService.handleRedirectObservable().subscribe();
+  }
+}