@azure/msal-browser 2.19.0 → 2.20.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.19.0 2021-11-02 */
+/*! @azure/msal-browser v2.20.0 2021-12-07 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -107,7 +107,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -194,7 +194,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -331,6 +331,7 @@
         AADServerParamKeys["ON_BEHALF_OF"] = "on_behalf_of";
         AADServerParamKeys["FOCI"] = "foci";
         AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
+        AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
     })(AADServerParamKeys || (AADServerParamKeys = {}));
     /**
      * Claims request keys
@@ -555,7 +556,7 @@
         CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
     })(CacheOutcome || (CacheOutcome = {}));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -599,7 +600,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -665,7 +666,7 @@
         }
     };
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1127,7 +1128,7 @@
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1252,7 +1253,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1432,12 +1433,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "5.1.0";
+    var version$1 = "5.2.0";
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1581,7 +1582,7 @@
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1826,7 +1827,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2010,7 +2011,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2048,7 +2049,7 @@
         };
     }
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2062,7 +2063,7 @@
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2296,7 +2297,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2334,7 +2335,7 @@
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3166,7 +3167,7 @@
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3248,7 +3249,7 @@
         return __assign({ clientCapabilities: [] }, authOptions);
     }
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3268,7 +3269,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3364,7 +3365,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3413,7 +3414,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3424,7 +3425,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3513,7 +3514,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3599,7 +3600,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3939,7 +3940,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4004,7 +4005,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4054,7 +4055,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4161,7 +4162,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4228,7 +4229,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4292,7 +4293,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4308,7 +4309,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4379,7 +4380,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4580,7 +4581,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4655,7 +4656,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4725,7 +4726,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4761,7 +4762,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4881,7 +4882,7 @@
                             _a.sent();
                             _a.label = 7;
                         case 7: return [7 /*endfinally*/];
-                        case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                        case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
                     }
                 });
             });
@@ -4967,7 +4968,7 @@
          * @param fromTokenCache
          * @param stateString
          */
-        ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState) {
+        ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
             var _a, _b, _c;
             return __awaiter(this, void 0, void 0, function () {
                 var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
@@ -5016,7 +5017,8 @@
                                     tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
                                     state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                     cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
-                                    msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING
+                                    msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
+                                    code: code
                                 }];
                     }
                 });
@@ -5025,7 +5027,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5037,7 +5039,10 @@
     var AuthorizationCodeClient = /** @class */ (function (_super) {
         __extends(AuthorizationCodeClient, _super);
         function AuthorizationCodeClient(configuration) {
-            return _super.call(this, configuration) || this;
+            var _this = _super.call(this, configuration) || this;
+            // Flag to indicate if client is for hybrid spa auth code redemption
+            _this.includeRedirectUri = true;
+            return _this;
         }
         /**
          * Creates the URL of the authorization request letting the user input credentials and consent to the
@@ -5186,13 +5191,24 @@
         AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
             return __awaiter(this, void 0, void 0, function () {
                 var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var _a;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             parameterBuilder = new RequestParameterBuilder();
                             parameterBuilder.addClientId(this.config.authOptions.clientId);
-                            // validate the redirectUri (to be a non null value)
-                            parameterBuilder.addRedirectUri(request.redirectUri);
+                            /*
+                             * For hybrid spa flow, there will be a code but no verifier
+                             * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
+                             */
+                            if (!this.includeRedirectUri) {
+                                // Just validate
+                                RequestValidator.validateRedirectUri(request.redirectUri);
+                            }
+                            else {
+                                // Validate and include redirect uri
+                                parameterBuilder.addRedirectUri(request.redirectUri);
+                            }
                             // Add scope array, parameter builder will add default scopes and dedupe
                             parameterBuilder.addScopes(request.scopes);
                             // add code: user set, not validated
@@ -5221,7 +5237,7 @@
                             popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                             return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                         case 1:
-                            cnfString = _a.sent();
+                            cnfString = _b.sent();
                             parameterBuilder.addPopToken(cnfString);
                             return [3 /*break*/, 3];
                         case 2:
@@ -5233,7 +5249,7 @@
                                     throw ClientConfigurationError.createMissingSshJwkError();
                                 }
                             }
-                            _a.label = 3;
+                            _b.label = 3;
                         case 3:
                             correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
                             parameterBuilder.addCorrelationId(correlationId);
@@ -5273,6 +5289,15 @@
                                         break;
                                 }
                             }
+                            if (request.tokenBodyParameters) {
+                                parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+                            }
+                            // Add hybrid spa parameters if not already provided
+                            if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[AADServerParamKeys.RETURN_SPA_CODE])) {
+                                parameterBuilder.addExtraQueryParameters((_a = {},
+                                    _a[AADServerParamKeys.RETURN_SPA_CODE] = "1",
+                                    _a));
+                            }
                             return [2 /*return*/, parameterBuilder.createQueryString()];
                     }
                 });
@@ -5410,7 +5435,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5621,7 +5646,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5744,7 +5769,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5755,7 +5780,7 @@
             response.hasOwnProperty("issuer"));
     }
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5769,7 +5794,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5844,7 +5869,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5854,7 +5879,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5968,7 +5993,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6534,7 +6559,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6595,7 +6620,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6626,7 +6651,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6654,7 +6679,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6671,7 +6696,7 @@
         }
     };
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6730,7 +6755,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v5.1.0 2021-11-02 */
+    /*! @azure/msal-common v5.2.0 2021-12-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6983,6 +7008,7 @@
         ApiId[ApiId["ssoSilent"] = 863] = "ssoSilent";
         ApiId[ApiId["acquireTokenSilent_authCode"] = 864] = "acquireTokenSilent_authCode";
         ApiId[ApiId["handleRedirectPromise"] = 865] = "handleRedirectPromise";
+        ApiId[ApiId["acquireTokenByCode"] = 866] = "acquireTokenByCode";
         ApiId[ApiId["acquireTokenSilent_silentFlow"] = 61] = "acquireTokenSilent_silentFlow";
         ApiId[ApiId["logout"] = 961] = "logout";
         ApiId[ApiId["logoutPopup"] = 962] = "logoutPopup";
@@ -7573,6 +7599,10 @@
             code: "crypto_key_not_found",
             desc: "Cryptographic Key or Keypair not found in browser storage."
         },
+        authCodeRequired: {
+            code: "auth_code_required",
+            desc: "An authorization code must be provided (as the `code` property on the request) to this flow."
+        },
         databaseUnavailable: {
             code: "database_unavailable",
             desc: "IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts."
@@ -7809,6 +7839,12 @@
         BrowserAuthError.createSigningKeyNotFoundInStorageError = function (keyId) {
             return new BrowserAuthError(BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code, BrowserAuthErrorMessage.signingKeyNotFoundInStorage.desc + " | No match found for KeyId: " + keyId);
         };
+        /**
+         * Create an error when an authorization code is required but not provided
+         */
+        BrowserAuthError.createAuthCodeRequiredError = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.authCodeRequired.code, BrowserAuthErrorMessage.authCodeRequired.desc);
+        };
         /**
          * Create an error when IndexedDB is unavailable
          */
@@ -10297,7 +10333,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.19.0";
+    var version = "2.20.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10317,6 +10353,9 @@
         EventType["SSO_SILENT_START"] = "msal:ssoSilentStart";
         EventType["SSO_SILENT_SUCCESS"] = "msal:ssoSilentSuccess";
         EventType["SSO_SILENT_FAILURE"] = "msal:ssoSilentFailure";
+        EventType["ACQUIRE_TOKEN_BY_CODE_START"] = "msal:acquireTokenByCodeStart";
+        EventType["ACQUIRE_TOKEN_BY_CODE_SUCCESS"] = "msal:acquireTokenByCodeSuccess";
+        EventType["ACQUIRE_TOKEN_BY_CODE_FAILURE"] = "msal:acquireTokenByCodeFailure";
         EventType["HANDLE_REDIRECT_START"] = "msal:handleRedirectStart";
         EventType["HANDLE_REDIRECT_END"] = "msal:handleRedirectEnd";
         EventType["POPUP_OPENED"] = "msal:popupOpened";
@@ -10998,23 +11037,46 @@
          * Function to handle response parameters from hash.
          * @param locationHash
          */
-        InteractionHandler.prototype.handleCodeResponse = function (locationHash, state, authority, networkModule) {
+        InteractionHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var stateKey, requestState, authCodeResponse, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
+                var stateKey, requestState, authCodeResponse;
+                return __generator$1(this, function (_a) {
+                    this.browserRequestLogger.verbose("InteractionHandler.handleCodeResponse called");
+                    // Check that location hash isn't empty.
+                    if (StringUtils.isEmpty(locationHash)) {
+                        throw BrowserAuthError.createEmptyHashError(locationHash);
+                    }
+                    stateKey = this.browserStorage.generateStateKey(state);
+                    requestState = this.browserStorage.getTemporaryCache(stateKey);
+                    if (!requestState) {
+                        throw ClientAuthError.createStateNotFoundError("Cached State");
+                    }
+                    authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                    return [2 /*return*/, this.handleCodeResponseFromServer(authCodeResponse, state, authority, networkModule)];
+                });
+            });
+        };
+        /**
+         * Process auth code response from AAD
+         * @param authCodeResponse
+         * @param state
+         * @param authority
+         * @param networkModule
+         * @returns
+         */
+        InteractionHandler.prototype.handleCodeResponseFromServer = function (authCodeResponse, state, authority, networkModule, validateNonce) {
+            if (validateNonce === void 0) { validateNonce = true; }
+            return __awaiter$1(this, void 0, void 0, function () {
+                var stateKey, requestState, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            this.browserRequestLogger.verbose("InteractionHandler.handleCodeResponse called");
-                            // Check that location hash isn't empty.
-                            if (StringUtils.isEmpty(locationHash)) {
-                                throw BrowserAuthError.createEmptyHashError(locationHash);
-                            }
+                            this.browserRequestLogger.trace("InteractionHandler.handleCodeResponseFromServer called");
                             stateKey = this.browserStorage.generateStateKey(state);
                             requestState = this.browserStorage.getTemporaryCache(stateKey);
                             if (!requestState) {
                                 throw ClientAuthError.createStateNotFoundError("Cached State");
                             }
-                            authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
                             nonceKey = this.browserStorage.generateNonceKey(requestState);
                             cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
                             // Assign code to request
@@ -11025,7 +11087,10 @@
                             _a.sent();
                             _a.label = 2;
                         case 2:
-                            authCodeResponse.nonce = cachedNonce || undefined;
+                            // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
+                            if (validateNonce) {
+                                authCodeResponse.nonce = cachedNonce || undefined;
+                            }
                             authCodeResponse.state = requestState;
                             // Add CCS parameters if available
                             if (authCodeResponse.client_info) {
@@ -11257,7 +11322,7 @@
                             state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Popup, validRequest.correlationId);
                             // Remove throttle if it exists
                             ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
-                            return [4 /*yield*/, interactionHandler.handleCodeResponse(hash, state, authClient.authority, this.networkClient)];
+                            return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                         case 6:
                             result = _a.sent();
                             return [2 /*return*/, result];
@@ -11441,7 +11506,7 @@
          * Handle authorization code response in the window.
          * @param hash
          */
-        RedirectHandler.prototype.handleCodeResponse = function (locationHash, state, authority, networkModule, clientId) {
+        RedirectHandler.prototype.handleCodeResponseFromHash = function (locationHash, state, authority, networkModule, clientId) {
             return __awaiter$1(this, void 0, void 0, function () {
                 var stateKey, requestState, authCodeResponse, nonceKey, cachedNonce, cachedCcsCred, tokenResponse;
                 return __generator$1(this, function (_a) {
@@ -11702,7 +11767,7 @@
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
                             interactionHandler = new RedirectHandler(authClient, this.browserStorage, cachedRequest, this.logger, this.browserCrypto);
-                            return [4 /*yield*/, interactionHandler.handleCodeResponse(hash, state, authClient.authority, this.networkClient, this.config.auth.clientId)];
+                            return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient, this.config.auth.clientId)];
                         case 2: return [2 /*return*/, _a.sent()];
                     }
                 });
@@ -12026,7 +12091,7 @@
                             hash = _a.sent();
                             state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Silent, authCodeRequest.correlationId);
                             // Handle response from hash string
-                            return [2 /*return*/, silentHandler.handleCodeResponse(hash, state, authClient.authority, this.networkClient)];
+                            return [2 /*return*/, silentHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
                     }
                 });
             });
@@ -12217,6 +12282,88 @@
         return TokenCache;
     }());
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var HybridSpaAuthorizationCodeClient = /** @class */ (function (_super) {
+        __extends$1(HybridSpaAuthorizationCodeClient, _super);
+        function HybridSpaAuthorizationCodeClient(config) {
+            var _this = _super.call(this, config) || this;
+            _this.includeRedirectUri = false;
+            return _this;
+        }
+        return HybridSpaAuthorizationCodeClient;
+    }(AuthorizationCodeClient));
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var SilentAuthCodeClient = /** @class */ (function (_super) {
+        __extends$1(SilentAuthCodeClient, _super);
+        function SilentAuthCodeClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, apiId, correlationId) {
+            var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, correlationId) || this;
+            _this.apiId = apiId;
+            return _this;
+        }
+        /**
+         * Acquires a token silently by redeeming an authorization code against the /token endpoint
+         * @param request
+         */
+        SilentAuthCodeClient.prototype.acquireToken = function (request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var silentRequest, serverTelemetryManager, authCodeRequest, clientConfig, authClient, silentHandler, e_1;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.logger.trace("SilentAuthCodeClient.acquireToken called");
+                            // Auth code payload is required
+                            if (!request.code) {
+                                throw BrowserAuthError.createAuthCodeRequiredError();
+                            }
+                            silentRequest = this.initializeAuthorizationRequest(request, exports.InteractionType.Silent);
+                            serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            authCodeRequest = __assign$1(__assign$1({}, silentRequest), { code: request.code });
+                            return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, silentRequest.authority)];
+                        case 2:
+                            clientConfig = _a.sent();
+                            authClient = new HybridSpaAuthorizationCodeClient(clientConfig);
+                            this.logger.verbose("Auth code client created");
+                            silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system.navigateFrameWait);
+                            // Handle auth code parameters from request
+                            return [2 /*return*/, silentHandler.handleCodeResponseFromServer({
+                                    code: request.code,
+                                    msgraph_host: request.msGraphHost,
+                                    cloud_graph_host_name: request.cloudGraphHostName,
+                                    cloud_instance_host_name: request.cloudInstanceHostName
+                                }, silentRequest.state, authClient.authority, this.networkClient, false)];
+                        case 3:
+                            e_1 = _a.sent();
+                            if (e_1 instanceof AuthError) {
+                                e_1.setCorrelationId(this.correlationId);
+                            }
+                            serverTelemetryManager.cacheFailedRequest(e_1);
+                            this.browserStorage.cleanRequestByState(silentRequest.state);
+                            throw e_1;
+                        case 4: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Currently Unsupported
+         */
+        SilentAuthCodeClient.prototype.logout = function () {
+            // Synchronous so we must reject
+            return Promise.reject(BrowserAuthError.createSilentLogoutUnsupportedError());
+        };
+        return SilentAuthCodeClient;
+    }(StandardInteractionClient));
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -12260,6 +12407,8 @@
             this.navigationClient = this.config.system.navigationClient;
             // Initialize redirectResponse Map
             this.redirectResponse = new Map();
+            // Initial hybrid spa map
+            this.hybridAuthCodeResponses = new Map();
             // Initialize the crypto class.
             this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger) : DEFAULT_CRYPTO_IMPLEMENTATION;
             this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
@@ -12464,6 +12613,77 @@
                 });
             });
         };
+        /**
+         * This function redeems an authorization code (passed as code) from the eSTS token endpoint.
+         * This authorization code should be acquired server-side using a confidential client to acquire a spa_code.
+         * This API is not indended for normal authorization code acquisition and redemption.
+         *
+         * Redemption of this authorization code will not require PKCE, as it was acquired by a confidential client.
+         *
+         * @param request {@link AuthorizationCodeRequest}
+         * @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
+         */
+        ClientApplication.prototype.acquireTokenByCode = function (request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var response;
+                var _this = this;
+                return __generator$1(this, function (_a) {
+                    this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
+                    this.logger.trace("acquireTokenByCode called", request.correlationId);
+                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_START, exports.InteractionType.Silent, request);
+                    try {
+                        if (!request.code) {
+                            throw BrowserAuthError.createAuthCodeRequiredError();
+                        }
+                        response = this.hybridAuthCodeResponses.get(request.code);
+                        if (!response) {
+                            this.logger.verbose("Initiating new acquireTokenByCode request", request.correlationId);
+                            response = this.acquireTokenByCodeAsync(request)
+                                .then(function (result) {
+                                _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_SUCCESS, exports.InteractionType.Silent, result);
+                                _this.hybridAuthCodeResponses.delete(request.code);
+                                return result;
+                            })
+                                .catch(function (error) {
+                                _this.hybridAuthCodeResponses.delete(request.code);
+                                throw error;
+                            });
+                            this.hybridAuthCodeResponses.set(request.code, response);
+                        }
+                        else {
+                            this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
+                        }
+                        return [2 /*return*/, response];
+                    }
+                    catch (e) {
+                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_BY_CODE_FAILURE, exports.InteractionType.Silent, null, e);
+                        throw e;
+                    }
+                    return [2 /*return*/];
+                });
+            });
+        };
+        /**
+         * Creates a SilentAuthCodeClient to redeem an authorization code.
+         * @param request
+         * @returns Result of the operation to redeem the authorization code
+         */
+        ClientApplication.prototype.acquireTokenByCodeAsync = function (request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var silentAuthCodeClient, silentTokenResult;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.logger.trace("acquireTokenByCodeAsync called", request.correlationId);
+                            silentAuthCodeClient = new SilentAuthCodeClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, exports.ApiId.acquireTokenByCode, request.correlationId);
+                            return [4 /*yield*/, silentAuthCodeClient.acquireToken(request)];
+                        case 1:
+                            silentTokenResult = _a.sent();
+                            return [2 /*return*/, silentTokenResult];
+                    }
+                });
+            });
+        };
         /**
          * Use this function to obtain a token before every call to the API / resource provider
          *
@@ -12962,6 +13182,9 @@
         acquireTokenSilent: function () {
             return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
         },
+        acquireTokenByCode: function () {
+            return Promise.reject(BrowserConfigurationAuthError.createStubPcaInstanceCalledError());
+        },
         getAllAccounts: function () {
             return [];
         },