@azure/msal-browser 2.33.0 → 2.35.0

package/dist/cache/BrowserCacheManager.js

@@ -1,9 +1,9 @@
-/*! @azure/msal-browser v2.33.0 2023-02-06 */
+/*! @azure/msal-browser v2.35.0 2023-04-03 */
 'use strict';
-import { __extends, __spread, __awaiter, __generator } from '../_virtual/_tslib.js';
-import { AccountEntity, CacheManager, IdTokenEntity, AccessTokenEntity, RefreshTokenEntity, AppMetadataEntity, ServerTelemetryEntity, AuthorityMetadataEntity, Constants, PersistentCacheKeys, ClientAuthError, ThrottlingEntity, StringUtils, ProtocolUtils, CcsCredentialType, IdToken, DEFAULT_CRYPTO_IMPLEMENTATION } from '@azure/msal-common';
+import { __extends, __awaiter, __generator, __spread } from '../_virtual/_tslib.js';
+import { CredentialType, RefreshTokenEntity, CacheManager, AccessTokenEntity, IdTokenEntity, AccountEntity, ClientAuthError, AppMetadataEntity, ServerTelemetryEntity, AuthorityMetadataEntity, Constants, PersistentCacheKeys, ThrottlingEntity, StringUtils, ProtocolUtils, CcsCredentialType, IdToken, DEFAULT_CRYPTO_IMPLEMENTATION } from '@azure/msal-common';
 import { BrowserAuthError } from '../error/BrowserAuthError.js';
-import { BrowserCacheLocation, InMemoryCacheKeys, TemporaryCacheKeys } from '../utils/BrowserConstants.js';
+import { BrowserCacheLocation, StaticCacheKeys, InMemoryCacheKeys, TemporaryCacheKeys } from '../utils/BrowserConstants.js';
 import { BrowserStorage } from './BrowserStorage.js';
 import { MemoryStorage } from './MemoryStorage.js';
 import { BrowserProtocolUtils } from '../utils/BrowserProtocolUtils.js';
@@ -20,7 +20,7 @@ import { BrowserProtocolUtils } from '../utils/BrowserProtocolUtils.js';
 var BrowserCacheManager = /** @class */ (function (_super) {
     __extends(BrowserCacheManager, _super);
     function BrowserCacheManager(clientId, cacheConfig, cryptoImpl, logger) {
-        var _this = _super.call(this, clientId, cryptoImpl) || this;
+        var _this = _super.call(this, clientId, cryptoImpl, logger) || this;
         // Cookie life calculation (hours * minutes * seconds * ms)
         _this.COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
         _this.cacheConfig = cacheConfig;
@@ -28,8 +28,11 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         _this.internalStorage = new MemoryStorage();
         _this.browserStorage = _this.setupBrowserStorage(_this.cacheConfig.cacheLocation);
         _this.temporaryCacheStorage = _this.setupTemporaryCacheStorage(_this.cacheConfig.cacheLocation);
-        // Migrate any cache entries from older versions of MSAL.
-        _this.migrateCacheEntries();
+        // Migrate cache entries from older versions of MSAL.
+        if (cacheConfig.cacheMigrationEnabled) {
+            _this.migrateCacheEntries();
+            _this.createKeyMaps();
+        }
         return _this;
     }
     /**
@@ -102,6 +105,91 @@ var BrowserCacheManager = /** @class */ (function (_super) {
             this.setTemporaryCache(newKey, value, true);
         }
     };
+    /**
+     * Searches all cache entries for MSAL accounts and creates the account key map
+     * This is used to migrate users from older versions of MSAL which did not create the map.
+     * @returns
+     */
+    BrowserCacheManager.prototype.createKeyMaps = function () {
+        var _this = this;
+        this.logger.trace("BrowserCacheManager - createKeyMaps called.");
+        var accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+        var tokenKeys = this.getItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId);
+        if (accountKeys && tokenKeys) {
+            this.logger.verbose("BrowserCacheManager:createKeyMaps - account and token key maps already exist, skipping migration.");
+            // Key maps already exist, no need to iterate through cache
+            return;
+        }
+        var allKeys = this.browserStorage.getKeys();
+        allKeys.forEach(function (key) {
+            if (_this.isCredentialKey(key)) {
+                // Get item, parse, validate and write key to map
+                var value = _this.getItem(key);
+                if (value) {
+                    var credObj = _this.validateAndParseJson(value);
+                    if (credObj && credObj.hasOwnProperty("credentialType")) {
+                        switch (credObj["credentialType"]) {
+                            case CredentialType.ID_TOKEN:
+                                if (IdTokenEntity.isIdTokenEntity(credObj)) {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - idToken found, saving key to token key map");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - idToken with key: " + key + " found, saving key to token key map");
+                                    var idTokenEntity = CacheManager.toObject(new IdTokenEntity(), credObj);
+                                    var newKey = _this.updateCredentialCacheKey(key, idTokenEntity);
+                                    _this.addTokenKey(newKey, CredentialType.ID_TOKEN);
+                                    return;
+                                }
+                                else {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching idToken schema with value containing idToken credentialType field but value failed IdTokenEntity validation, skipping.");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - failed idToken validation on key: " + key);
+                                }
+                                break;
+                            case CredentialType.ACCESS_TOKEN:
+                            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
+                                if (AccessTokenEntity.isAccessTokenEntity(credObj)) {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - accessToken found, saving key to token key map");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - accessToken with key: " + key + " found, saving key to token key map");
+                                    var accessTokenEntity = CacheManager.toObject(new AccessTokenEntity(), credObj);
+                                    var newKey = _this.updateCredentialCacheKey(key, accessTokenEntity);
+                                    _this.addTokenKey(newKey, CredentialType.ACCESS_TOKEN);
+                                    return;
+                                }
+                                else {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching accessToken schema with value containing accessToken credentialType field but value failed AccessTokenEntity validation, skipping.");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - failed accessToken validation on key: " + key);
+                                }
+                                break;
+                            case CredentialType.REFRESH_TOKEN:
+                                if (RefreshTokenEntity.isRefreshTokenEntity(credObj)) {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - refreshToken found, saving key to token key map");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - refreshToken with key: " + key + " found, saving key to token key map");
+                                    var refreshTokenEntity = CacheManager.toObject(new RefreshTokenEntity(), credObj);
+                                    var newKey = _this.updateCredentialCacheKey(key, refreshTokenEntity);
+                                    _this.addTokenKey(newKey, CredentialType.REFRESH_TOKEN);
+                                    return;
+                                }
+                                else {
+                                    _this.logger.trace("BrowserCacheManager:createKeyMaps - key found matching refreshToken schema with value containing refreshToken credentialType field but value failed RefreshTokenEntity validation, skipping.");
+                                    _this.logger.tracePii("BrowserCacheManager:createKeyMaps - failed refreshToken validation on key: " + key);
+                                }
+                                break;
+                            // If credentialType isn't one of our predefined ones, it may not be an MSAL cache value. Ignore.
+                        }
+                    }
+                }
+            }
+            if (_this.isAccountKey(key)) {
+                var value = _this.getItem(key);
+                if (value) {
+                    var accountObj = _this.validateAndParseJson(value);
+                    if (accountObj && AccountEntity.isAccountEntity(accountObj)) {
+                        _this.logger.trace("BrowserCacheManager:createKeyMaps - account found, saving key to account key map");
+                        _this.logger.tracePii("BrowserCacheManager:createKeyMaps - account with key: " + key + " found, saving key to account key map");
+                        _this.addAccountKeyToMap(key);
+                    }
+                }
+            }
+        });
+    };
     /**
      * Parses passed value as JSON object, JSON.parse() will throw an error.
      * @param input
@@ -141,12 +229,15 @@ var BrowserCacheManager = /** @class */ (function (_super) {
      * @param accountKey
      */
     BrowserCacheManager.prototype.getAccount = function (accountKey) {
+        this.logger.trace("BrowserCacheManager.getAccount called");
         var account = this.getItem(accountKey);
         if (!account) {
+            this.removeAccountKeyFromMap(accountKey);
             return null;
         }
         var parsedAccount = this.validateAndParseJson(account);
         if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
+            this.removeAccountKeyFromMap(accountKey);
             return null;
         }
         return CacheManager.toObject(new AccountEntity(), parsedAccount);
@@ -160,6 +251,207 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         this.logger.trace("BrowserCacheManager.setAccount called");
         var key = account.generateAccountKey();
         this.setItem(key, JSON.stringify(account));
+        this.addAccountKeyToMap(key);
+    };
+    /**
+     * Returns the array of account keys currently cached
+     * @returns
+     */
+    BrowserCacheManager.prototype.getAccountKeys = function () {
+        this.logger.trace("BrowserCacheManager.getAccountKeys called");
+        var accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+        if (accountKeys) {
+            return JSON.parse(accountKeys);
+        }
+        this.logger.verbose("BrowserCacheManager.getAccountKeys - No account keys found");
+        return [];
+    };
+    /**
+     * Add a new account to the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.addAccountKeyToMap = function (key) {
+        this.logger.trace("BrowserCacheManager.addAccountKeyToMap called");
+        this.logger.tracePii("BrowserCacheManager.addAccountKeyToMap called with key: " + key);
+        var accountKeys = this.getAccountKeys();
+        if (accountKeys.indexOf(key) === -1) {
+            // Only add key if it does not already exist in the map
+            accountKeys.push(key);
+            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
+        }
+        else {
+            this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key already exists in map");
+        }
+    };
+    /**
+     * Remove an account from the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeAccountKeyFromMap = function (key) {
+        this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called");
+        this.logger.tracePii("BrowserCacheManager.removeAccountKeyFromMap called with key: " + key);
+        var accountKeys = this.getAccountKeys();
+        var removalIndex = accountKeys.indexOf(key);
+        if (removalIndex > -1) {
+            accountKeys.splice(removalIndex, 1);
+            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
+        }
+        else {
+            this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap key not found in existing map");
+        }
+    };
+    /**
+     * Extends inherited removeAccount function to include removal of the account key from the map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeAccount = function (key) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                _super.prototype.removeAccount.call(this, key);
+                this.removeAccountKeyFromMap(key);
+                return [2 /*return*/];
+            });
+        });
+    };
+    /**
+     * Removes given idToken from the cache and from the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeIdToken = function (key) {
+        _super.prototype.removeIdToken.call(this, key);
+        this.removeTokenKey(key, CredentialType.ID_TOKEN);
+    };
+    /**
+     * Removes given accessToken from the cache and from the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeAccessToken = function (key) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                _super.prototype.removeAccessToken.call(this, key);
+                this.removeTokenKey(key, CredentialType.ACCESS_TOKEN);
+                return [2 /*return*/];
+            });
+        });
+    };
+    /**
+     * Removes given refreshToken from the cache and from the key map
+     * @param key
+     */
+    BrowserCacheManager.prototype.removeRefreshToken = function (key) {
+        _super.prototype.removeRefreshToken.call(this, key);
+        this.removeTokenKey(key, CredentialType.REFRESH_TOKEN);
+    };
+    /**
+     * Gets the keys for the cached tokens associated with this clientId
+     * @returns
+     */
+    BrowserCacheManager.prototype.getTokenKeys = function () {
+        this.logger.trace("BrowserCacheManager.getTokenKeys called");
+        var item = this.getItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId);
+        if (item) {
+            var tokenKeys = this.validateAndParseJson(item);
+            if (tokenKeys &&
+                tokenKeys.hasOwnProperty("idToken") &&
+                tokenKeys.hasOwnProperty("accessToken") &&
+                tokenKeys.hasOwnProperty("refreshToken")) {
+                return tokenKeys;
+            }
+            else {
+                this.logger.error("BrowserCacheManager.getTokenKeys - Token keys found but in an unknown format. Returning empty key map.");
+            }
+        }
+        else {
+            this.logger.verbose("BrowserCacheManager.getTokenKeys - No token keys found");
+        }
+        return {
+            idToken: [],
+            accessToken: [],
+            refreshToken: []
+        };
+    };
+    /**
+     * Adds the given key to the token key map
+     * @param key
+     * @param type
+     */
+    BrowserCacheManager.prototype.addTokenKey = function (key, type) {
+        this.logger.trace("BrowserCacheManager addTokenKey called");
+        var tokenKeys = this.getTokenKeys();
+        switch (type) {
+            case CredentialType.ID_TOKEN:
+                if (tokenKeys.idToken.indexOf(key) === -1) {
+                    this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
+                    tokenKeys.idToken.push(key);
+                }
+                break;
+            case CredentialType.ACCESS_TOKEN:
+                if (tokenKeys.accessToken.indexOf(key) === -1) {
+                    this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map");
+                    tokenKeys.accessToken.push(key);
+                }
+                break;
+            case CredentialType.REFRESH_TOKEN:
+                if (tokenKeys.refreshToken.indexOf(key) === -1) {
+                    this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
+                    tokenKeys.refreshToken.push(key);
+                }
+                break;
+            default:
+                this.logger.error("BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: " + type);
+                ClientAuthError.createUnexpectedCredentialTypeError();
+        }
+        this.setItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId, JSON.stringify(tokenKeys));
+    };
+    /**
+     * Removes the given key from the token key map
+     * @param key
+     * @param type
+     */
+    BrowserCacheManager.prototype.removeTokenKey = function (key, type) {
+        this.logger.trace("BrowserCacheManager removeTokenKey called");
+        var tokenKeys = this.getTokenKeys();
+        switch (type) {
+            case CredentialType.ID_TOKEN:
+                this.logger.infoPii("BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: " + key + " from map");
+                var idRemoval = tokenKeys.idToken.indexOf(key);
+                if (idRemoval > -1) {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - idToken removed from map");
+                    tokenKeys.idToken.splice(idRemoval, 1);
+                }
+                else {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - idToken does not exist in map. Either it was previously removed or it was never added.");
+                }
+                break;
+            case CredentialType.ACCESS_TOKEN:
+                this.logger.infoPii("BrowserCacheManager: removeTokenKey - attempting to remove accessToken with key: " + key + " from map");
+                var accessRemoval = tokenKeys.accessToken.indexOf(key);
+                if (accessRemoval > -1) {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - accessToken removed from map");
+                    tokenKeys.idToken.splice(accessRemoval, 1);
+                }
+                else {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - accessToken does not exist in map. Either it was previously removed or it was never added.");
+                }
+                break;
+            case CredentialType.REFRESH_TOKEN:
+                this.logger.infoPii("BrowserCacheManager: removeTokenKey - attempting to remove refreshToken with key: " + key + " from map");
+                var refreshRemoval = tokenKeys.refreshToken.indexOf(key);
+                if (refreshRemoval > -1) {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken removed from map");
+                    tokenKeys.idToken.splice(refreshRemoval, 1);
+                }
+                else {
+                    this.logger.info("BrowserCacheManager: removeTokenKey - refreshToken does not exist in map. Either it was previously removed or it was never added.");
+                }
+                break;
+            default:
+                this.logger.error("BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: " + type);
+                ClientAuthError.createUnexpectedCredentialTypeError();
+        }
+        this.setItem(StaticCacheKeys.TOKEN_KEYS + "." + this.clientId, JSON.stringify(tokenKeys));
     };
     /**
      * generates idToken entity from a string
@@ -169,11 +461,13 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         var value = this.getItem(idTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
+            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
             return null;
         }
         var parsedIdToken = this.validateAndParseJson(value);
         if (!parsedIdToken || !IdTokenEntity.isIdTokenEntity(parsedIdToken)) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
+            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit");
@@ -187,6 +481,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
         var idTokenKey = idToken.generateCredentialKey();
         this.setItem(idTokenKey, JSON.stringify(idToken));
+        this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
     };
     /**
      * generates accessToken entity from a string
@@ -196,11 +491,13 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         var value = this.getItem(accessTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
+            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
             return null;
         }
         var parsedAccessToken = this.validateAndParseJson(value);
         if (!parsedAccessToken || !AccessTokenEntity.isAccessTokenEntity(parsedAccessToken)) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
+            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit");
@@ -214,6 +511,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
         var accessTokenKey = accessToken.generateCredentialKey();
         this.setItem(accessTokenKey, JSON.stringify(accessToken));
+        this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
     };
     /**
      * generates refreshToken entity from a string
@@ -223,11 +521,13 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         var value = this.getItem(refreshTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
+            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
             return null;
         }
         var parsedRefreshToken = this.validateAndParseJson(value);
         if (!parsedRefreshToken || !RefreshTokenEntity.isRefreshTokenEntity(parsedRefreshToken)) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
+            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit");
@@ -241,6 +541,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
         var refreshTokenKey = refreshToken.generateCredentialKey();
         this.setItem(refreshTokenKey, JSON.stringify(refreshToken));
+        this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
     };
     /**
      * fetch appMetadata entity from the platform cache
@@ -538,7 +839,6 @@ var BrowserCacheManager = /** @class */ (function (_super) {
             this.logger.trace("BrowserCacheManager.removeItem: storeAuthStateInCookie is true, clearing item cookie");
             this.clearItemCookie(key);
         }
-        return true;
     };
     /**
      * Checks whether key is in cache.
@@ -966,7 +1266,8 @@ var DEFAULT_BROWSER_CACHE_MANAGER = function (clientId, logger) {
     var cacheOptions = {
         cacheLocation: BrowserCacheLocation.MemoryStorage,
         storeAuthStateInCookie: false,
-        secureCookies: false
+        secureCookies: false,
+        cacheMigrationEnabled: false
     };
     return new BrowserCacheManager(clientId, cacheOptions, DEFAULT_CRYPTO_IMPLEMENTATION, logger);
 };