@azure/msal-browser 2.19.0 → 2.20.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.19.0 2021-11-02 */
+/*! @azure/msal-browser v2.20.0 2021-12-07 */
 'use strict';
 'use strict';
 
@@ -105,7 +105,7 @@ function __spread() {
     return ar;
 }
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /*! *****************************************************************************
 Copyright (c) Microsoft Corporation.
 
@@ -192,7 +192,7 @@ function __spreadArrays() {
     return r;
 }
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -329,6 +329,7 @@ var AADServerParamKeys;
     AADServerParamKeys["ON_BEHALF_OF"] = "on_behalf_of";
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
+    AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
  * Claims request keys
@@ -553,7 +554,7 @@ var CacheOutcome;
     CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
 })(CacheOutcome || (CacheOutcome = {}));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -597,7 +598,7 @@ var AuthError = /** @class */ (function (_super) {
     return AuthError;
 }(Error));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -663,7 +664,7 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
     }
 };
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1125,7 +1126,7 @@ var ClientAuthError = /** @class */ (function (_super) {
     return ClientAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1250,7 +1251,7 @@ var StringUtils = /** @class */ (function () {
     return StringUtils;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1430,12 +1431,12 @@ var Logger = /** @class */ (function () {
     return Logger;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /* eslint-disable header/header */
 var name$1 = "@azure/msal-common";
-var version$1 = "5.1.0";
+var version$1 = "5.2.0";
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1579,7 +1580,7 @@ var CredentialEntity = /** @class */ (function () {
     return CredentialEntity;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1824,7 +1825,7 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     return ClientConfigurationError;
 }(ClientAuthError));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2008,7 +2009,7 @@ var ScopeSet = /** @class */ (function () {
     return ScopeSet;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2046,7 +2047,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2060,7 +2061,7 @@ var AuthorityType;
     AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
 })(AuthorityType || (AuthorityType = {}));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2294,7 +2295,7 @@ var AccountEntity = /** @class */ (function () {
     return AccountEntity;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2332,7 +2333,7 @@ var AuthToken = /** @class */ (function () {
     return AuthToken;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3164,7 +3165,7 @@ var DefaultStorageClass = /** @class */ (function (_super) {
     return DefaultStorageClass;
 }(CacheManager));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3246,7 +3247,7 @@ function buildAuthOptions(authOptions) {
     return __assign({ clientCapabilities: [] }, authOptions);
 }
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3266,7 +3267,7 @@ var ServerError = /** @class */ (function (_super) {
     return ServerError;
 }(AuthError));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3362,7 +3363,7 @@ var ThrottlingUtils = /** @class */ (function () {
     return ThrottlingUtils;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3411,7 +3412,7 @@ var NetworkManager = /** @class */ (function () {
     return NetworkManager;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3422,7 +3423,7 @@ var CcsCredentialType;
     CcsCredentialType["UPN"] = "UPN";
 })(CcsCredentialType || (CcsCredentialType = {}));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3511,7 +3512,7 @@ var BaseClient = /** @class */ (function () {
     return BaseClient;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3597,7 +3598,7 @@ var RequestValidator = /** @class */ (function () {
     return RequestValidator;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3937,7 +3938,7 @@ var RequestParameterBuilder = /** @class */ (function () {
     return RequestParameterBuilder;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4002,7 +4003,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
     return IdTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4052,7 +4053,7 @@ var TimeUtils = /** @class */ (function () {
     return TimeUtils;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4159,7 +4160,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
     return AccessTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4226,7 +4227,7 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
     return RefreshTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4290,7 +4291,7 @@ var InteractionRequiredAuthError = /** @class */ (function (_super) {
     return InteractionRequiredAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4306,7 +4307,7 @@ var CacheRecord = /** @class */ (function () {
     return CacheRecord;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4377,7 +4378,7 @@ var ProtocolUtils = /** @class */ (function () {
     return ProtocolUtils;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4578,7 +4579,7 @@ var UrlString = /** @class */ (function () {
     return UrlString;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4653,7 +4654,7 @@ var PopTokenGenerator = /** @class */ (function () {
     return PopTokenGenerator;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4723,7 +4724,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return AppMetadataEntity;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4759,7 +4760,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return TokenCacheContext;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4879,7 +4880,7 @@ var ResponseHandler = /** @class */ (function () {
                         _a.sent();
                         _a.label = 7;
                     case 7: return [7 /*endfinally*/];
-                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
                 }
             });
         });
@@ -4965,7 +4966,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param fromTokenCache
      * @param stateString
      */
-    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState) {
+    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
             var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
@@ -5014,7 +5015,8 @@ var ResponseHandler = /** @class */ (function () {
                                 tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
                                 state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
-                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING
+                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
+                                code: code
                             }];
                 }
             });
@@ -5023,7 +5025,7 @@ var ResponseHandler = /** @class */ (function () {
     return ResponseHandler;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5035,7 +5037,10 @@ var ResponseHandler = /** @class */ (function () {
 var AuthorizationCodeClient = /** @class */ (function (_super) {
     __extends(AuthorizationCodeClient, _super);
     function AuthorizationCodeClient(configuration) {
-        return _super.call(this, configuration) || this;
+        var _this = _super.call(this, configuration) || this;
+        // Flag to indicate if client is for hybrid spa auth code redemption
+        _this.includeRedirectUri = true;
+        return _this;
     }
     /**
      * Creates the URL of the authorization request letting the user input credentials and consent to the
@@ -5184,13 +5189,24 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
-                        // validate the redirectUri (to be a non null value)
-                        parameterBuilder.addRedirectUri(request.redirectUri);
+                        /*
+                         * For hybrid spa flow, there will be a code but no verifier
+                         * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
+                         */
+                        if (!this.includeRedirectUri) {
+                            // Just validate
+                            RequestValidator.validateRedirectUri(request.redirectUri);
+                        }
+                        else {
+                            // Validate and include redirect uri
+                            parameterBuilder.addRedirectUri(request.redirectUri);
+                        }
                         // Add scope array, parameter builder will add default scopes and dedupe
                         parameterBuilder.addScopes(request.scopes);
                         // add code: user set, not validated
@@ -5219,7 +5235,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _a.sent();
+                        cnfString = _b.sent();
                         parameterBuilder.addPopToken(cnfString);
                         return [3 /*break*/, 3];
                     case 2:
@@ -5231,7 +5247,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                                 throw ClientConfigurationError.createMissingSshJwkError();
                             }
                         }
-                        _a.label = 3;
+                        _b.label = 3;
                     case 3:
                         correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
                         parameterBuilder.addCorrelationId(correlationId);
@@ -5271,6 +5287,15 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                                     break;
                             }
                         }
+                        if (request.tokenBodyParameters) {
+                            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+                        }
+                        // Add hybrid spa parameters if not already provided
+                        if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[AADServerParamKeys.RETURN_SPA_CODE])) {
+                            parameterBuilder.addExtraQueryParameters((_a = {},
+                                _a[AADServerParamKeys.RETURN_SPA_CODE] = "1",
+                                _a));
+                        }
                         return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
             });
@@ -5408,7 +5433,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     return AuthorizationCodeClient;
 }(BaseClient));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5619,7 +5644,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
     return RefreshTokenClient;
 }(BaseClient));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5742,7 +5767,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     return SilentFlowClient;
 }(BaseClient));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5753,7 +5778,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("issuer"));
 }
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5767,7 +5792,7 @@ exports.ProtocolMode = void 0;
     ProtocolMode["OIDC"] = "OIDC";
 })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5842,7 +5867,7 @@ var AuthorityMetadataEntity = /** @class */ (function () {
     return AuthorityMetadataEntity;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5852,7 +5877,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5966,7 +5991,7 @@ var RegionDiscovery = /** @class */ (function () {
     return RegionDiscovery;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6532,7 +6557,7 @@ var Authority = /** @class */ (function () {
     return Authority;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6593,7 +6618,7 @@ var AuthorityFactory = /** @class */ (function () {
     return AuthorityFactory;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6624,7 +6649,7 @@ var ServerTelemetryEntity = /** @class */ (function () {
     return ServerTelemetryEntity;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6652,7 +6677,7 @@ var ThrottlingEntity = /** @class */ (function () {
     return ThrottlingEntity;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6669,7 +6694,7 @@ var StubbedNetworkModule = {
     }
 };
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6728,7 +6753,7 @@ var AuthenticationHeaderParser = /** @class */ (function () {
     return AuthenticationHeaderParser;
 }());
 
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6981,6 +7006,7 @@ exports.ApiId = void 0;
     ApiId[ApiId["ssoSilent"] = 863] = "ssoSilent";
     ApiId[ApiId["acquireTokenSilent_authCode"] = 864] = "acquireTokenSilent_authCode";
     ApiId[ApiId["handleRedirectPromise"] = 865] = "handleRedirectPromise";
+    ApiId[ApiId["acquireTokenByCode"] = 866] = "acquireTokenByCode";
     ApiId[ApiId["acquireTokenSilent_silentFlow"] = 61] = "acquireTokenSilent_silentFlow";
     ApiId[ApiId["logout"] = 961] = "logout";
     ApiId[ApiId["logoutPopup"] = 962] = "logoutPopup";
@@ -7571,6 +7597,10 @@ var BrowserAuthErrorMessage = {
         code: "crypto_key_not_found",
         desc: "Cryptographic Key or Keypair not found in browser storage."
     },
+    authCodeRequired: {
+        code: "auth_code_required",
+        desc: "An authorization code must be provided (as the `code` property on the request) to this flow."
+    },
     databaseUnavailable: {
         code: "database_unavailable",
         desc: "IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts."
@@ -7807,6 +7837,12 @@ var BrowserAuthError = /** @class */ (function (_super) {
     BrowserAuthError.createSigningKeyNotFoundInStorageError = function (keyId) {
         return new BrowserAuthError(BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code, BrowserAuthErrorMessage.signingKeyNotFoundInStorage.desc + " | No match found for KeyId: " + keyId);
     };
+    /**
+     * Create an error when an authorization code is required but not provided
+     */
+    BrowserAuthError.createAuthCodeRequiredError = function () {
+        return new BrowserAuthError(BrowserAuthErrorMessage.authCodeRequired.code, BrowserAuthErrorMessage.authCodeRequired.desc);
+    };
     /**
      * Create an error when IndexedDB is unavailable
      */
@@ -10295,7 +10331,7 @@ function buildConfiguration(_a, isBrowserEnvironment) {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-browser";
-var version = "2.19.0";
+var version = "2.20.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10315,6 +10351,9 @@ exports.EventType = void 0;
     EventType["SSO_SILENT_START"] = "msal:ssoSilentStart";
     EventType["SSO_SILENT_SUCCESS"] = "msal:ssoSilentSuccess";
     EventType["SSO_SILENT_FAILURE"] = "msal:ssoSilentFailure";
+    EventType["ACQUIRE_TOKEN_BY_CODE_START"] = "msal:acquireTokenByCodeStart";
+    EventType["ACQUIRE_TOKEN_BY_CODE_SUCCESS"] = "msal:acquireTokenByCodeSuccess";
+    EventType["ACQUIRE_TOKEN_BY_CODE_FAILURE"] = "msal:acquireTokenByCodeFailure";
     EventType["HANDLE_REDIRECT_START"] = "msal:handleRedirectStart";
     EventType["HANDLE_REDIRECT_END"] = "msal:handleRedirectEnd";
     EventType["POPUP_OPENED"] = "msal:popupOpened";
@@ -10996,23 +11035,46 @@ var InteractionHandler = /** @class */ (function () {
      * Function to handle response parameters from hash.
      * @param locationHash
      */
-    InteractionHandler.prototype.handleCodeResponse = function (locationHash, state, authority, networkModule) {
+    InteractionHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var stateKey, requestState, authCodeResponse, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
+            var stateKey, requestState, authCodeResponse;
+            return __generator$1(this, function (_a) {
+                this.browserRequestLogger.verbose("InteractionHandler.handleCodeResponse called");
+                // Check that location hash isn't empty.
+                if (StringUtils.isEmpty(locationHash)) {
+                    throw BrowserAuthError.createEmptyHashError(locationHash);
+                }
+                stateKey = this.browserStorage.generateStateKey(state);
+                requestState = this.browserStorage.getTemporaryCache(stateKey);
+                if (!requestState) {
+                    throw ClientAuthError.createStateNotFoundError("Cached State");
+                }
+                authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                return [2 /*return*/, this.handleCodeResponseFromServer(authCodeResponse, state, authority, networkModule)];
+            });
+        });
+    };
+    /**
+     * Process auth code response from AAD
+     * @param authCodeResponse
+     * @param state
+     * @param authority
+     * @param networkModule
+     * @returns
+     */
+    InteractionHandler.prototype.handleCodeResponseFromServer = function (authCodeResponse, state, authority, networkModule, validateNonce) {
+        if (validateNonce === void 0) { validateNonce = true; }
+        return __awaiter$1(this, void 0, void 0, function () {
+            var stateKey, requestState, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        this.browserRequestLogger.verbose("InteractionHandler.handleCodeResponse called");
-                        // Check that location hash isn't empty.
-                        if (StringUtils.isEmpty(locationHash)) {
-                            throw BrowserAuthError.createEmptyHashError(locationHash);
-                        }
+                        this.browserRequestLogger.trace("InteractionHandler.handleCodeResponseFromServer called");
                         stateKey = this.browserStorage.generateStateKey(state);
                         requestState = this.browserStorage.getTemporaryCache(stateKey);
                         if (!requestState) {
                             throw ClientAuthError.createStateNotFoundError("Cached State");
                         }
-                        authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
                         nonceKey = this.browserStorage.generateNonceKey(requestState);
                         cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
                         // Assign code to request
@@ -11023,7 +11085,10 @@ var InteractionHandler = /** @class */ (function () {
                         _a.sent();
                         _a.label = 2;
                     case 2:
-                        authCodeResponse.nonce = cachedNonce || undefined;
+                        // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
+                        if (validateNonce) {
+                            authCodeResponse.nonce = cachedNonce || undefined;
+                        }
                         authCodeResponse.state = requestState;
                         // Add CCS parameters if available
                         if (authCodeResponse.client_info) {
@@ -11255,7 +11320,7 @@ var PopupClient = /** @class */ (function (_super) {
                         state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Popup, validRequest.correlationId);
                         // Remove throttle if it exists
                         ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
-                        return [4 /*yield*/, interactionHandler.handleCodeResponse(hash, state, authClient.authority, this.networkClient)];
+                        return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                     case 6:
                         result = _a.sent();
                         return [2 /*return*/, result];
@@ -11439,7 +11504,7 @@ var RedirectHandler = /** @class */ (function (_super) {
      * Handle authorization code response in the window.
      * @param hash
      */
-    RedirectHandler.prototype.handleCodeResponse = function (locationHash, state, authority, networkModule, clientId) {
+    RedirectHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule, clientId) {
         return __awaiter$1(this, void 0, void 0, function () {
             var stateKey, requestState, authCodeResponse, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
             return __generator$1(this, function (_a) {
@@ -11700,7 +11765,7 @@ var RedirectClient = /** @class */ (function (_super) {
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
                         interactionHandler = new RedirectHandler(authClient, this.browserStorage, cachedRequest, this.logger, this.browserCrypto);
-                        return [4 /*yield*/, interactionHandler.handleCodeResponse(hash, state, authClient.authority, this.networkClient, this.config.auth.clientId)];
+                        return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient, this.config.auth.clientId)];
                     case 2: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -12024,7 +12089,7 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         hash = _a.sent();
                         state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Silent, authCodeRequest.correlationId);
                         // Handle response from hash string
-                        return [2 /*return*/, silentHandler.handleCodeResponse(hash, state, authClient.authority, this.networkClient)];
+                        return [2 /*return*/, silentHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                 }
             });
         });
@@ -12215,6 +12280,88 @@ var TokenCache = /** @class */ (function () {
     return TokenCache;
 }());
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var HybridSpaAuthorizationCodeClient = /** @class */ (function (_super) {
+    __extends$1(HybridSpaAuthorizationCodeClient, _super);
+    function HybridSpaAuthorizationCodeClient(config) {
+        var _this = _super.call(this, config) || this;
+        _this.includeRedirectUri = false;
+        return _this;
+    }
+    return HybridSpaAuthorizationCodeClient;
+}(AuthorizationCodeClient));
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var SilentAuthCodeClient = /** @class */ (function (_super) {
+    __extends$1(SilentAuthCodeClient, _super);
+    function SilentAuthCodeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, correlationId) {
+        var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, correlationId) || this;
+        _this.apiId = apiId;
+        return _this;
+    }
+    /**
+     * Acquires a token silently by redeeming an authorization code against the /token endpoint
+     * @param request
+     */
+    SilentAuthCodeClient.prototype.acquireToken = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var silentRequest, serverTelemetryManager, authCodeRequest, clientConfig, authClient, silentHandler, e_1;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.trace("SilentAuthCodeClient.acquireToken called");
+                        // Auth code payload is required
+                        if (!request.code) {
+                            throw BrowserAuthError.createAuthCodeRequiredError();
+                        }
+                        silentRequest = this.initializeAuthorizationRequest(request, exports.InteractionType.Silent);
+                        serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        authCodeRequest = __assign$1(__assign$1({}, silentRequest), { code: request.code });
+                        return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, silentRequest.authority)];
+                    case 2:
+                        clientConfig = _a.sent();
+                        authClient = new HybridSpaAuthorizationCodeClient(clientConfig);
+                        this.logger.verbose("Auth code client created");
+                        silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system.navigateFrameWait);
+                        // Handle auth code parameters from request
+                        return [2 /*return*/, silentHandler.handleCodeResponseFromServer({
+                                code: request.code,
+                                msgraph_host: request.msGraphHost,
+                                cloud_graph_host_name: request.cloudGraphHostName,
+                                cloud_instance_host_name: request.cloudInstanceHostName
+                            }, silentRequest.state, authClient.authority, this.networkClient, false)];
+                    case 3:
+                        e_1 = _a.sent();
+                        if (e_1 instanceof AuthError) {
+                            e_1.setCorrelationId(this.correlationId);
+                        }
+                        serverTelemetryManager.cacheFailedRequest(e_1);
+                        this.browserStorage.cleanRequestByState(silentRequest.state);
+                        throw e_1;
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Currently Unsupported
+     */
+    SilentAuthCodeClient.prototype.logout = function () {
+        // Synchronous so we must reject
+        return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
+    };
+    return SilentAuthCodeClient;
+}(StandardInteractionClient));
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -12258,6 +12405,8 @@ var ClientApplication = /** @class */ (function () {
         this.navigationClient = this.config.system.navigationClient;
         // Initialize redirectResponse Map
         this.redirectResponse = new Map();
+        // Initial hybrid spa map
+        this.hybridAuthCodeResponses = new Map();
         // Initialize the crypto class.
         this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger) : DEFAULT_CRYPTO_IMPLEMENTATION;
         this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
@@ -12462,6 +12611,77 @@ var ClientApplication = /** @class */ (function () {
             });
         });
     };
+    /**
+     * This function redeems an authorization code (passed as code) from the eSTS token endpoint.
+     * This authorization code should be acquired server-side using a confidential client to acquire a spa_code.
+     * This API is not indended for normal authorization code acquisition and redemption.
+     *
+     * Redemption of this authorization code will not require PKCE, as it was acquired by a confidential client.
+     *
+     * @param request {@link AuthorizationCodeRequest}
+     * @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
+     */
+    ClientApplication.prototype.acquireTokenByCode = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var response;
+            var _this = this;
+            return __generator$1(this, function (_a) {
+                this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
+                this.logger.trace("acquireTokenByCode called", request.correlationId);
+                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_START, exports.InteractionType.Silent, request);
+                try {
+                    if (!request.code) {
+                        throw BrowserAuthError.createAuthCodeRequiredError();
+                    }
+                    response = this.hybridAuthCodeResponses.get(request.code);
+                    if (!response) {
+                        this.logger.verbose("Initiating new acquireTokenByCode request", request.correlationId);
+                        response = this.acquireTokenByCodeAsync(request)
+                            .then(function (result) {
+                            _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
+                            _this.hybridAuthCodeResponses.delete(request.code);
+                            return result;
+                        })
+                            .catch(function (error) {
+                            _this.hybridAuthCodeResponses.delete(request.code);
+                            throw error;
+                        });
+                        this.hybridAuthCodeResponses.set(request.code, response);
+                    }
+                    else {
+                        this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
+                    }
+                    return [2 /*return*/, response];
+                }
+                catch (e) {
+                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
+                    throw e;
+                }
+                return [2 /*return*/];
+            });
+        });
+    };
+    /**
+     * Creates a SilentAuthCodeClient to redeem an authorization code.
+     * @param request
+     * @returns Result of the operation to redeem the authorization code
+     */
+    ClientApplication.prototype.acquireTokenByCodeAsync = function (request) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var silentAuthCodeClient, silentTokenResult;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.trace("acquireTokenByCodeAsync called", request.correlationId);
+                        silentAuthCodeClient = new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenByCode, request.correlationId);
+                        return [4 /*yield*/, silentAuthCodeClient.acquireToken(request)];
+                    case 1:
+                        silentTokenResult = _a.sent();
+                        return [2 /*return*/, silentTokenResult];
+                }
+            });
+        });
+    };
     /**
      * Use this function to obtain a token before every call to the API / resource provider
      *
@@ -12960,6 +13180,9 @@ var stubbedPublicClientApplication = {
     acquireTokenSilent: function () {
         return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
     },
+    acquireTokenByCode: function () {
+        return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
+    },
     getAllAccounts: function () {
         return [];
     },