@azure/msal-browser 3.0.2 → 3.2.0

package/src/interaction_handler/InteractionHandler.ts

@@ -0,0 +1,251 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    AuthorizationCodePayload,
+    CommonAuthorizationCodeRequest,
+    AuthorizationCodeClient,
+    AuthorityFactory,
+    Authority,
+    INetworkModule,
+    CcsCredential,
+    Logger,
+    ServerError,
+    IPerformanceClient,
+    PerformanceEvents,
+    invokeAsync,
+    createClientAuthError,
+    ClientAuthErrorCodes,
+} from "@azure/msal-common";
+
+import { BrowserCacheManager } from "../cache/BrowserCacheManager";
+import {
+    createBrowserAuthError,
+    BrowserAuthErrorCodes,
+} from "../error/BrowserAuthError";
+import { TemporaryCacheKeys } from "../utils/BrowserConstants";
+import { AuthenticationResult } from "../response/AuthenticationResult";
+
+export type InteractionParams = {};
+
+/**
+ * Abstract class which defines operations for a browser interaction handling class.
+ */
+export class InteractionHandler {
+    protected authModule: AuthorizationCodeClient;
+    protected browserStorage: BrowserCacheManager;
+    protected authCodeRequest: CommonAuthorizationCodeRequest;
+    protected logger: Logger;
+    protected performanceClient: IPerformanceClient;
+
+    constructor(
+        authCodeModule: AuthorizationCodeClient,
+        storageImpl: BrowserCacheManager,
+        authCodeRequest: CommonAuthorizationCodeRequest,
+        logger: Logger,
+        performanceClient: IPerformanceClient
+    ) {
+        this.authModule = authCodeModule;
+        this.browserStorage = storageImpl;
+        this.authCodeRequest = authCodeRequest;
+        this.logger = logger;
+        this.performanceClient = performanceClient;
+    }
+
+    /**
+     * Function to handle response parameters from hash.
+     * @param locationHash
+     */
+    async handleCodeResponseFromHash(
+        locationHash: string,
+        state: string,
+        authority: Authority,
+        networkModule: INetworkModule
+    ): Promise<AuthenticationResult> {
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.HandleCodeResponseFromHash,
+            this.authCodeRequest.correlationId
+        );
+        // Check that location hash isn't empty.
+        if (!locationHash) {
+            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
+        }
+
+        // Handle code response.
+        const stateKey = this.browserStorage.generateStateKey(state);
+        const requestState = this.browserStorage.getTemporaryCache(stateKey);
+        if (!requestState) {
+            throw createClientAuthError(
+                ClientAuthErrorCodes.stateNotFound,
+                "Cached State"
+            );
+        }
+
+        let authCodeResponse;
+        try {
+            authCodeResponse = this.authModule.handleFragmentResponse(
+                locationHash,
+                requestState
+            );
+        } catch (e) {
+            if (
+                e instanceof ServerError &&
+                e.subError === BrowserAuthErrorCodes.userCancelled
+            ) {
+                // Translate server error caused by user closing native prompt to corresponding first class MSAL error
+                throw createBrowserAuthError(
+                    BrowserAuthErrorCodes.userCancelled
+                );
+            } else {
+                throw e;
+            }
+        }
+
+        return invokeAsync(
+            this.handleCodeResponseFromServer.bind(this),
+            PerformanceEvents.HandleCodeResponseFromServer,
+            this.logger,
+            this.performanceClient,
+            this.authCodeRequest.correlationId
+        )(authCodeResponse, state, authority, networkModule);
+    }
+
+    /**
+     * Process auth code response from AAD
+     * @param authCodeResponse
+     * @param state
+     * @param authority
+     * @param networkModule
+     * @returns
+     */
+    async handleCodeResponseFromServer(
+        authCodeResponse: AuthorizationCodePayload,
+        state: string,
+        authority: Authority,
+        networkModule: INetworkModule,
+        validateNonce: boolean = true
+    ): Promise<AuthenticationResult> {
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.HandleCodeResponseFromServer,
+            this.authCodeRequest.correlationId
+        );
+        this.logger.trace(
+            "InteractionHandler.handleCodeResponseFromServer called"
+        );
+
+        // Handle code response.
+        const stateKey = this.browserStorage.generateStateKey(state);
+        const requestState = this.browserStorage.getTemporaryCache(stateKey);
+        if (!requestState) {
+            throw createClientAuthError(
+                ClientAuthErrorCodes.stateNotFound,
+                "Cached State"
+            );
+        }
+
+        // Get cached items
+        const nonceKey = this.browserStorage.generateNonceKey(requestState);
+        const cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
+
+        // Assign code to request
+        this.authCodeRequest.code = authCodeResponse.code;
+
+        // Check for new cloud instance
+        if (authCodeResponse.cloud_instance_host_name) {
+            await invokeAsync(
+                this.updateTokenEndpointAuthority.bind(this),
+                PerformanceEvents.UpdateTokenEndpointAuthority,
+                this.logger,
+                this.performanceClient,
+                this.authCodeRequest.correlationId
+            )(
+                authCodeResponse.cloud_instance_host_name,
+                authority,
+                networkModule
+            );
+        }
+
+        // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
+        if (validateNonce) {
+            authCodeResponse.nonce = cachedNonce || undefined;
+        }
+
+        authCodeResponse.state = requestState;
+
+        // Add CCS parameters if available
+        if (authCodeResponse.client_info) {
+            this.authCodeRequest.clientInfo = authCodeResponse.client_info;
+        } else {
+            const cachedCcsCred = this.checkCcsCredentials();
+            if (cachedCcsCred) {
+                this.authCodeRequest.ccsCredential = cachedCcsCred;
+            }
+        }
+
+        // Acquire token with retrieved code.
+        const tokenResponse = (await invokeAsync(
+            this.authModule.acquireToken.bind(this.authModule),
+            PerformanceEvents.AuthClientAcquireToken,
+            this.logger,
+            this.performanceClient,
+            this.authCodeRequest.correlationId
+        )(this.authCodeRequest, authCodeResponse)) as AuthenticationResult;
+        this.browserStorage.cleanRequestByState(state);
+        return tokenResponse;
+    }
+
+    /**
+     * Updates authority based on cloudInstanceHostname
+     * @param cloudInstanceHostname
+     * @param authority
+     * @param networkModule
+     */
+    protected async updateTokenEndpointAuthority(
+        cloudInstanceHostname: string,
+        authority: Authority,
+        networkModule: INetworkModule
+    ): Promise<void> {
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.UpdateTokenEndpointAuthority,
+            this.authCodeRequest.correlationId
+        );
+        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${authority.tenant}/`;
+        const cloudInstanceAuthority =
+            await AuthorityFactory.createDiscoveredInstance(
+                cloudInstanceAuthorityUri,
+                networkModule,
+                this.browserStorage,
+                authority.options,
+                this.logger,
+                this.performanceClient,
+                this.authCodeRequest.correlationId
+            );
+        this.authModule.updateAuthority(cloudInstanceAuthority);
+    }
+
+    /**
+     * Looks up ccs creds in the cache
+     */
+    protected checkCcsCredentials(): CcsCredential | null {
+        // Look up ccs credential in temp cache
+        const cachedCcsCred = this.browserStorage.getTemporaryCache(
+            TemporaryCacheKeys.CCS_CREDENTIAL,
+            true
+        );
+        if (cachedCcsCred) {
+            try {
+                return JSON.parse(cachedCcsCred) as CcsCredential;
+            } catch (e) {
+                this.authModule.logger.error(
+                    "Cache credential could not be parsed"
+                );
+                this.authModule.logger.errorPii(
+                    `Cache credential could not be parsed: ${cachedCcsCred}`
+                );
+            }
+        }
+        return null;
+    }
+}

package/src/interaction_handler/RedirectHandler.ts

@@ -0,0 +1,229 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    AuthorizationCodeClient,
+    CommonAuthorizationCodeRequest,
+    ICrypto,
+    Authority,
+    INetworkModule,
+    Logger,
+    ServerError,
+    IPerformanceClient,
+    createClientAuthError,
+    ClientAuthErrorCodes,
+} from "@azure/msal-common";
+import {
+    createBrowserAuthError,
+    BrowserAuthErrorCodes,
+} from "../error/BrowserAuthError";
+import { ApiId, TemporaryCacheKeys } from "../utils/BrowserConstants";
+import { BrowserCacheManager } from "../cache/BrowserCacheManager";
+import { InteractionHandler, InteractionParams } from "./InteractionHandler";
+import { INavigationClient } from "../navigation/INavigationClient";
+import { NavigationOptions } from "../navigation/NavigationOptions";
+import { AuthenticationResult } from "../response/AuthenticationResult";
+
+export type RedirectParams = InteractionParams & {
+    navigationClient: INavigationClient;
+    redirectTimeout: number;
+    redirectStartPage: string;
+    onRedirectNavigate?: (url: string) => void | boolean;
+};
+
+export class RedirectHandler extends InteractionHandler {
+    private browserCrypto: ICrypto;
+
+    constructor(
+        authCodeModule: AuthorizationCodeClient,
+        storageImpl: BrowserCacheManager,
+        authCodeRequest: CommonAuthorizationCodeRequest,
+        logger: Logger,
+        browserCrypto: ICrypto,
+        performanceClient: IPerformanceClient
+    ) {
+        super(
+            authCodeModule,
+            storageImpl,
+            authCodeRequest,
+            logger,
+            performanceClient
+        );
+        this.browserCrypto = browserCrypto;
+    }
+
+    /**
+     * Redirects window to given URL.
+     * @param urlNavigate
+     */
+    async initiateAuthRequest(
+        requestUrl: string,
+        params: RedirectParams
+    ): Promise<void> {
+        this.logger.verbose("RedirectHandler.initiateAuthRequest called");
+        // Navigate if valid URL
+        if (requestUrl) {
+            // Cache start page, returns to this page after redirectUri if navigateToLoginRequestUrl is true
+            if (params.redirectStartPage) {
+                this.logger.verbose(
+                    "RedirectHandler.initiateAuthRequest: redirectStartPage set, caching start page"
+                );
+                this.browserStorage.setTemporaryCache(
+                    TemporaryCacheKeys.ORIGIN_URI,
+                    params.redirectStartPage,
+                    true
+                );
+            }
+
+            // Set interaction status in the library.
+            this.browserStorage.setTemporaryCache(
+                TemporaryCacheKeys.CORRELATION_ID,
+                this.authCodeRequest.correlationId,
+                true
+            );
+            this.browserStorage.cacheCodeRequest(this.authCodeRequest);
+            this.logger.infoPii(
+                `RedirectHandler.initiateAuthRequest: Navigate to: ${requestUrl}`
+            );
+            const navigationOptions: NavigationOptions = {
+                apiId: ApiId.acquireTokenRedirect,
+                timeout: params.redirectTimeout,
+                noHistory: false,
+            };
+
+            // If onRedirectNavigate is implemented, invoke it and provide requestUrl
+            if (typeof params.onRedirectNavigate === "function") {
+                this.logger.verbose(
+                    "RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback"
+                );
+                const navigate = params.onRedirectNavigate(requestUrl);
+
+                // Returning false from onRedirectNavigate will stop navigation
+                if (navigate !== false) {
+                    this.logger.verbose(
+                        "RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating"
+                    );
+                    await params.navigationClient.navigateExternal(
+                        requestUrl,
+                        navigationOptions
+                    );
+                    return;
+                } else {
+                    this.logger.verbose(
+                        "RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation"
+                    );
+                    return;
+                }
+            } else {
+                // Navigate window to request URL
+                this.logger.verbose(
+                    "RedirectHandler.initiateAuthRequest: Navigating window to navigate url"
+                );
+                await params.navigationClient.navigateExternal(
+                    requestUrl,
+                    navigationOptions
+                );
+                return;
+            }
+        } else {
+            // Throw error if request URL is empty.
+            this.logger.info(
+                "RedirectHandler.initiateAuthRequest: Navigate url is empty"
+            );
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.emptyNavigateUri
+            );
+        }
+    }
+
+    /**
+     * Handle authorization code response in the window.
+     * @param hash
+     */
+    async handleCodeResponseFromHash(
+        locationHash: string,
+        state: string,
+        authority: Authority,
+        networkModule: INetworkModule
+    ): Promise<AuthenticationResult> {
+        this.logger.verbose("RedirectHandler.handleCodeResponse called");
+
+        // Check that location hash isn't empty.
+        if (!locationHash) {
+            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
+        }
+
+        // Interaction is completed - remove interaction status.
+        this.browserStorage.setInteractionInProgress(false);
+
+        // Handle code response.
+        const stateKey = this.browserStorage.generateStateKey(state);
+        const requestState = this.browserStorage.getTemporaryCache(stateKey);
+        if (!requestState) {
+            throw createClientAuthError(
+                ClientAuthErrorCodes.stateNotFound,
+                "Cached State"
+            );
+        }
+
+        let authCodeResponse;
+        try {
+            authCodeResponse = this.authModule.handleFragmentResponse(
+                locationHash,
+                requestState
+            );
+        } catch (e) {
+            if (
+                e instanceof ServerError &&
+                e.subError === BrowserAuthErrorCodes.userCancelled
+            ) {
+                // Translate server error caused by user closing native prompt to corresponding first class MSAL error
+                throw createBrowserAuthError(
+                    BrowserAuthErrorCodes.userCancelled
+                );
+            } else {
+                throw e;
+            }
+        }
+
+        // Get cached items
+        const nonceKey = this.browserStorage.generateNonceKey(requestState);
+        const cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
+
+        // Assign code to request
+        this.authCodeRequest.code = authCodeResponse.code;
+
+        // Check for new cloud instance
+        if (authCodeResponse.cloud_instance_host_name) {
+            await this.updateTokenEndpointAuthority(
+                authCodeResponse.cloud_instance_host_name,
+                authority,
+                networkModule
+            );
+        }
+
+        authCodeResponse.nonce = cachedNonce || undefined;
+        authCodeResponse.state = requestState;
+
+        // Add CCS parameters if available
+        if (authCodeResponse.client_info) {
+            this.authCodeRequest.clientInfo = authCodeResponse.client_info;
+        } else {
+            const cachedCcsCred = this.checkCcsCredentials();
+            if (cachedCcsCred) {
+                this.authCodeRequest.ccsCredential = cachedCcsCred;
+            }
+        }
+
+        // Acquire token with retrieved code.
+        const tokenResponse = (await this.authModule.acquireToken(
+            this.authCodeRequest,
+            authCodeResponse
+        )) as AuthenticationResult;
+
+        this.browserStorage.cleanRequestByState(state);
+        return tokenResponse;
+    }
+}