@azure/msal-browser 3.0.2 → 3.2.0

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    ICrypto,
+    Logger,
+    CommonAuthorizationCodeRequest,
+    AuthError,
+    Constants,
+    IPerformanceClient,
+    PerformanceEvents,
+    invokeAsync,
+} from "@azure/msal-common";
+import { StandardInteractionClient } from "./StandardInteractionClient";
+import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
+import { BrowserConfiguration } from "../config/Configuration";
+import { BrowserCacheManager } from "../cache/BrowserCacheManager";
+import { EventHandler } from "../event/EventHandler";
+import { INavigationClient } from "../navigation/INavigationClient";
+import {
+    createBrowserAuthError,
+    BrowserAuthErrorCodes,
+} from "../error/BrowserAuthError";
+import { InteractionType, ApiId } from "../utils/BrowserConstants";
+import { SilentHandler } from "../interaction_handler/SilentHandler";
+import { AuthorizationCodeRequest } from "../request/AuthorizationCodeRequest";
+import { HybridSpaAuthorizationCodeClient } from "./HybridSpaAuthorizationCodeClient";
+import { NativeMessageHandler } from "../broker/nativeBroker/NativeMessageHandler";
+import { AuthenticationResult } from "../response/AuthenticationResult";
+
+export class SilentAuthCodeClient extends StandardInteractionClient {
+    private apiId: ApiId;
+
+    constructor(
+        config: BrowserConfiguration,
+        storageImpl: BrowserCacheManager,
+        browserCrypto: ICrypto,
+        logger: Logger,
+        eventHandler: EventHandler,
+        navigationClient: INavigationClient,
+        apiId: ApiId,
+        performanceClient: IPerformanceClient,
+        nativeMessageHandler?: NativeMessageHandler,
+        correlationId?: string
+    ) {
+        super(
+            config,
+            storageImpl,
+            browserCrypto,
+            logger,
+            eventHandler,
+            navigationClient,
+            performanceClient,
+            nativeMessageHandler,
+            correlationId
+        );
+        this.apiId = apiId;
+    }
+
+    /**
+     * Acquires a token silently by redeeming an authorization code against the /token endpoint
+     * @param request
+     */
+    async acquireToken(
+        request: AuthorizationCodeRequest
+    ): Promise<AuthenticationResult> {
+        // Auth code payload is required
+        if (!request.code) {
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.authCodeRequired
+            );
+        }
+
+        // Create silent request
+        const silentRequest: AuthorizationUrlRequest = await invokeAsync(
+            this.initializeAuthorizationRequest.bind(this),
+            PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(request, InteractionType.Silent);
+        this.browserStorage.updateCacheEntries(
+            silentRequest.state,
+            silentRequest.nonce,
+            silentRequest.authority,
+            silentRequest.loginHint || Constants.EMPTY_STRING,
+            silentRequest.account || null
+        );
+
+        const serverTelemetryManager = this.initializeServerTelemetryManager(
+            this.apiId
+        );
+
+        try {
+            // Create auth code request (PKCE not needed)
+            const authCodeRequest: CommonAuthorizationCodeRequest = {
+                ...silentRequest,
+                code: request.code,
+            };
+
+            // Initialize the client
+            const clientConfig = await invokeAsync(
+                this.getClientConfiguration.bind(this),
+                PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(serverTelemetryManager, silentRequest.authority);
+            const authClient: HybridSpaAuthorizationCodeClient =
+                new HybridSpaAuthorizationCodeClient(clientConfig);
+            this.logger.verbose("Auth code client created");
+
+            // Create silent handler
+            const silentHandler = new SilentHandler(
+                authClient,
+                this.browserStorage,
+                authCodeRequest,
+                this.logger,
+                this.config.system,
+                this.performanceClient
+            );
+
+            // Handle auth code parameters from request
+            return invokeAsync(
+                silentHandler.handleCodeResponseFromServer.bind(silentHandler),
+                PerformanceEvents.HandleCodeResponseFromServer,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(
+                {
+                    code: request.code,
+                    msgraph_host: request.msGraphHost,
+                    cloud_graph_host_name: request.cloudGraphHostName,
+                    cloud_instance_host_name: request.cloudInstanceHostName,
+                },
+                silentRequest.state,
+                authClient.authority,
+                this.networkClient,
+                false
+            );
+        } catch (e) {
+            if (e instanceof AuthError) {
+                (e as AuthError).setCorrelationId(this.correlationId);
+                serverTelemetryManager.cacheFailedRequest(e);
+            }
+            this.browserStorage.cleanRequestByState(silentRequest.state);
+            throw e;
+        }
+    }
+
+    /**
+     * Currently Unsupported
+     */
+    logout(): Promise<void> {
+        // Synchronous so we must reject
+        return Promise.reject(
+            createBrowserAuthError(
+                BrowserAuthErrorCodes.silentLogoutUnsupported
+            )
+        );
+    }
+}

package/src/interaction_client/SilentCacheClient.ts

@@ -0,0 +1,125 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { StandardInteractionClient } from "./StandardInteractionClient";
+import {
+    CommonSilentFlowRequest,
+    SilentFlowClient,
+    ServerTelemetryManager,
+    AccountInfo,
+    AzureCloudOptions,
+    PerformanceEvents,
+    invokeAsync,
+} from "@azure/msal-common";
+import { SilentRequest } from "../request/SilentRequest";
+import { ApiId } from "../utils/BrowserConstants";
+import {
+    BrowserAuthError,
+    BrowserAuthErrorCodes,
+} from "../error/BrowserAuthError";
+import { AuthenticationResult } from "../response/AuthenticationResult";
+import { ClearCacheRequest } from "../request/ClearCacheRequest";
+
+export class SilentCacheClient extends StandardInteractionClient {
+    /**
+     * Returns unexpired tokens from the cache, if available
+     * @param silentRequest
+     */
+    async acquireToken(
+        silentRequest: CommonSilentFlowRequest
+    ): Promise<AuthenticationResult> {
+        // Telemetry manager only used to increment cacheHits here
+        const serverTelemetryManager = this.initializeServerTelemetryManager(
+            ApiId.acquireTokenSilent_silentFlow
+        );
+
+        const silentAuthClient = await this.createSilentFlowClient(
+            serverTelemetryManager,
+            silentRequest.authority,
+            silentRequest.azureCloudOptions
+        );
+        this.logger.verbose("Silent auth client created");
+
+        try {
+            const response = await silentAuthClient.acquireCachedToken(
+                silentRequest
+            );
+            const authResponse = response[0] as AuthenticationResult;
+
+            this.performanceClient.addFields(
+                {
+                    fromCache: true,
+                },
+                silentRequest.correlationId
+            );
+            return authResponse;
+        } catch (error) {
+            if (
+                error instanceof BrowserAuthError &&
+                error.errorCode === BrowserAuthErrorCodes.cryptoKeyNotFound
+            ) {
+                this.logger.verbose(
+                    "Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair."
+                );
+            }
+            throw error;
+        }
+    }
+
+    /**
+     * API to silenty clear the browser cache.
+     * @param logoutRequest
+     */
+    logout(logoutRequest?: ClearCacheRequest): Promise<void> {
+        this.logger.verbose("logoutRedirect called");
+        const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
+        return this.clearCacheOnLogout(validLogoutRequest?.account);
+    }
+
+    /**
+     * Creates an Silent Flow Client with the given authority, or the default authority.
+     * @param serverTelemetryManager
+     * @param authorityUrl
+     */
+    protected async createSilentFlowClient(
+        serverTelemetryManager: ServerTelemetryManager,
+        authorityUrl?: string,
+        azureCloudOptions?: AzureCloudOptions
+    ): Promise<SilentFlowClient> {
+        // Create auth module.
+        const clientConfig = await invokeAsync(
+            this.getClientConfiguration.bind(this),
+            PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(serverTelemetryManager, authorityUrl, azureCloudOptions);
+        return new SilentFlowClient(clientConfig, this.performanceClient);
+    }
+
+    async initializeSilentRequest(
+        request: SilentRequest,
+        account: AccountInfo
+    ): Promise<CommonSilentFlowRequest> {
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.InitializeSilentRequest,
+            this.correlationId
+        );
+
+        const baseRequest = await invokeAsync(
+            this.initializeBaseRequest.bind(this),
+            PerformanceEvents.InitializeBaseRequest,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(request, account);
+        return {
+            ...request,
+            ...baseRequest,
+            account: account,
+            forceRefresh: request.forceRefresh || false,
+        };
+    }
+}

package/src/interaction_client/SilentIframeClient.ts

@@ -0,0 +1,301 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    ICrypto,
+    Logger,
+    PromptValue,
+    CommonAuthorizationCodeRequest,
+    AuthorizationCodeClient,
+    AuthError,
+    Constants,
+    UrlString,
+    ServerAuthorizationCodeResponse,
+    ProtocolUtils,
+    IPerformanceClient,
+    PerformanceEvents,
+    invokeAsync,
+} from "@azure/msal-common";
+import { StandardInteractionClient } from "./StandardInteractionClient";
+import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
+import { BrowserConfiguration } from "../config/Configuration";
+import { BrowserCacheManager } from "../cache/BrowserCacheManager";
+import { EventHandler } from "../event/EventHandler";
+import { INavigationClient } from "../navigation/INavigationClient";
+import {
+    createBrowserAuthError,
+    BrowserAuthErrorCodes,
+} from "../error/BrowserAuthError";
+import { InteractionType, ApiId } from "../utils/BrowserConstants";
+import { SilentHandler } from "../interaction_handler/SilentHandler";
+import { SsoSilentRequest } from "../request/SsoSilentRequest";
+import { NativeMessageHandler } from "../broker/nativeBroker/NativeMessageHandler";
+import { NativeInteractionClient } from "./NativeInteractionClient";
+import { AuthenticationResult } from "../response/AuthenticationResult";
+
+export class SilentIframeClient extends StandardInteractionClient {
+    protected apiId: ApiId;
+    protected nativeStorage: BrowserCacheManager;
+
+    constructor(
+        config: BrowserConfiguration,
+        storageImpl: BrowserCacheManager,
+        browserCrypto: ICrypto,
+        logger: Logger,
+        eventHandler: EventHandler,
+        navigationClient: INavigationClient,
+        apiId: ApiId,
+        performanceClient: IPerformanceClient,
+        nativeStorageImpl: BrowserCacheManager,
+        nativeMessageHandler?: NativeMessageHandler,
+        correlationId?: string
+    ) {
+        super(
+            config,
+            storageImpl,
+            browserCrypto,
+            logger,
+            eventHandler,
+            navigationClient,
+            performanceClient,
+            nativeMessageHandler,
+            correlationId
+        );
+        this.apiId = apiId;
+        this.nativeStorage = nativeStorageImpl;
+    }
+
+    /**
+     * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none or prompt=no_session
+     * @param request
+     */
+    async acquireToken(
+        request: SsoSilentRequest
+    ): Promise<AuthenticationResult> {
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.SilentIframeClientAcquireToken,
+            request.correlationId
+        );
+        // Check that we have some SSO data
+        if (
+            !request.loginHint &&
+            !request.sid &&
+            (!request.account || !request.account.username)
+        ) {
+            this.logger.warning(
+                "No user hint provided. The authorization server may need more information to complete this request."
+            );
+        }
+
+        // Check that prompt is set to none or no_session, throw error if it is set to anything else.
+        if (
+            request.prompt &&
+            request.prompt !== PromptValue.NONE &&
+            request.prompt !== PromptValue.NO_SESSION
+        ) {
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.silentPromptValueError
+            );
+        }
+
+        // Create silent request
+        const silentRequest: AuthorizationUrlRequest = await invokeAsync(
+            this.initializeAuthorizationRequest.bind(this),
+            PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(
+            {
+                ...request,
+                prompt: request.prompt || PromptValue.NONE,
+            },
+            InteractionType.Silent
+        );
+        this.browserStorage.updateCacheEntries(
+            silentRequest.state,
+            silentRequest.nonce,
+            silentRequest.authority,
+            silentRequest.loginHint || Constants.EMPTY_STRING,
+            silentRequest.account || null
+        );
+
+        const serverTelemetryManager = this.initializeServerTelemetryManager(
+            this.apiId
+        );
+
+        try {
+            // Initialize the client
+            const authClient: AuthorizationCodeClient = await invokeAsync(
+                this.createAuthCodeClient.bind(this),
+                PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(
+                serverTelemetryManager,
+                silentRequest.authority,
+                silentRequest.azureCloudOptions
+            );
+
+            return await invokeAsync(
+                this.silentTokenHelper.bind(this),
+                PerformanceEvents.SilentIframeClientTokenHelper,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(authClient, silentRequest);
+        } catch (e) {
+            if (e instanceof AuthError) {
+                (e as AuthError).setCorrelationId(this.correlationId);
+                serverTelemetryManager.cacheFailedRequest(e);
+            }
+            this.browserStorage.cleanRequestByState(silentRequest.state);
+            throw e;
+        }
+    }
+
+    /**
+     * Currently Unsupported
+     */
+    logout(): Promise<void> {
+        // Synchronous so we must reject
+        return Promise.reject(
+            createBrowserAuthError(
+                BrowserAuthErrorCodes.silentLogoutUnsupported
+            )
+        );
+    }
+
+    /**
+     * Helper which acquires an authorization code silently using a hidden iframe from given url
+     * using the scopes requested as part of the id, and exchanges the code for a set of OAuth tokens.
+     * @param navigateUrl
+     * @param userRequestScopes
+     */
+    protected async silentTokenHelper(
+        authClient: AuthorizationCodeClient,
+        silentRequest: AuthorizationUrlRequest
+    ): Promise<AuthenticationResult> {
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.SilentIframeClientTokenHelper,
+            silentRequest.correlationId
+        );
+
+        // Create auth code request and generate PKCE params
+        const authCodeRequest: CommonAuthorizationCodeRequest =
+            await invokeAsync(
+                this.initializeAuthorizationCodeRequest.bind(this),
+                PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
+                this.logger,
+                this.performanceClient,
+                silentRequest.correlationId
+            )(silentRequest);
+
+        // Create authorize request url
+        const navigateUrl = await invokeAsync(
+            authClient.getAuthCodeUrl.bind(authClient),
+            PerformanceEvents.GetAuthCodeUrl,
+            this.logger,
+            this.performanceClient,
+            silentRequest.correlationId
+        )({
+            ...silentRequest,
+            nativeBroker: NativeMessageHandler.isNativeAvailable(
+                this.config,
+                this.logger,
+                this.nativeMessageHandler,
+                silentRequest.authenticationScheme
+            ),
+        });
+
+        // Create silent handler
+        const silentHandler = new SilentHandler(
+            authClient,
+            this.browserStorage,
+            authCodeRequest,
+            this.logger,
+            this.config.system,
+            this.performanceClient
+        );
+        // Get the frame handle for the silent request
+        const msalFrame = await invokeAsync(
+            silentHandler.initiateAuthRequest.bind(silentHandler),
+            PerformanceEvents.SilentHandlerInitiateAuthRequest,
+            this.logger,
+            this.performanceClient,
+            silentRequest.correlationId
+        )(navigateUrl);
+        // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+        const hash = await invokeAsync(
+            silentHandler.monitorIframeForHash.bind(silentHandler),
+            PerformanceEvents.SilentHandlerMonitorIframeForHash,
+            this.logger,
+            this.performanceClient,
+            silentRequest.correlationId
+        )(msalFrame, this.config.system.iframeHashTimeout);
+        // Deserialize hash fragment response parameters.
+        const serverParams: ServerAuthorizationCodeResponse =
+            UrlString.getDeserializedHash(hash);
+        const state = this.validateAndExtractStateFromHash(
+            serverParams,
+            InteractionType.Silent,
+            authCodeRequest.correlationId
+        );
+
+        if (serverParams.accountId) {
+            this.logger.verbose(
+                "Account id found in hash, calling WAM for token"
+            );
+            if (!this.nativeMessageHandler) {
+                throw createBrowserAuthError(
+                    BrowserAuthErrorCodes.nativeConnectionNotEstablished
+                );
+            }
+            const nativeInteractionClient = new NativeInteractionClient(
+                this.config,
+                this.browserStorage,
+                this.browserCrypto,
+                this.logger,
+                this.eventHandler,
+                this.navigationClient,
+                this.apiId,
+                this.performanceClient,
+                this.nativeMessageHandler,
+                serverParams.accountId,
+                this.browserStorage,
+                this.correlationId
+            );
+            const { userRequestState } = ProtocolUtils.parseRequestState(
+                this.browserCrypto,
+                state
+            );
+            return invokeAsync(
+                nativeInteractionClient.acquireToken.bind(
+                    nativeInteractionClient
+                ),
+                PerformanceEvents.NativeInteractionClientAcquireToken,
+                this.logger,
+                this.performanceClient,
+                silentRequest.correlationId
+            )({
+                ...silentRequest,
+                state: userRequestState,
+                prompt: silentRequest.prompt || PromptValue.NONE,
+            }).finally(() => {
+                this.browserStorage.cleanRequestByState(state);
+            });
+        }
+
+        // Handle response from hash string
+        return invokeAsync(
+            silentHandler.handleCodeResponseFromHash.bind(silentHandler),
+            PerformanceEvents.HandleCodeResponseFromHash,
+            this.logger,
+            this.performanceClient,
+            silentRequest.correlationId
+        )(hash, state, authClient.authority, this.networkClient);
+    }
+}