@azure/msal-browser 3.1.0 → 3.2.0

package/src/controllers/StandardController.ts

@@ -19,7 +19,6 @@ import {
     IPerformanceClient,
     BaseAuthRequest,
     PromptValue,
-    ClientAuthError,
     InProgressPerformanceEvent,
     RequestThumbprint,
     ServerError,
@@ -27,6 +26,9 @@ import {
     ServerResponseType,
     UrlString,
     invokeAsync,
+    createClientAuthError,
+    ClientAuthErrorCodes,
+    AccountFilter,
 } from "@azure/msal-common";
 import {
     BrowserCacheManager,
@@ -50,7 +52,10 @@ import { SsoSilentRequest } from "../request/SsoSilentRequest";
 import { EventCallbackFunction, EventError } from "../event/EventMessage";
 import { EventType } from "../event/EventType";
 import { EndSessionRequest } from "../request/EndSessionRequest";
-import { BrowserConfigurationAuthError } from "../error/BrowserConfigurationAuthError";
+import {
+    BrowserConfigurationAuthErrorCodes,
+    createBrowserConfigurationAuthError,
+} from "../error/BrowserConfigurationAuthError";
 import { EndSessionPopupRequest } from "../request/EndSessionPopupRequest";
 import { INavigationClient } from "../navigation/INavigationClient";
 import { EventHandler } from "../event/EventHandler";
@@ -63,7 +68,10 @@ import { ITokenCache } from "../cache/ITokenCache";
 import { NativeInteractionClient } from "../interaction_client/NativeInteractionClient";
 import { NativeMessageHandler } from "../broker/nativeBroker/NativeMessageHandler";
 import { SilentRequest } from "../request/SilentRequest";
-import { NativeAuthError } from "../error/NativeAuthError";
+import {
+    NativeAuthError,
+    isFatalNativeAuthError,
+} from "../error/NativeAuthError";
 import { SilentCacheClient } from "../interaction_client/SilentCacheClient";
 import { SilentAuthCodeClient } from "../interaction_client/SilentAuthCodeClient";
 import {
@@ -77,6 +85,7 @@ import { BaseOperatingContext } from "../operatingcontext/BaseOperatingContext";
 import { IController } from "./IController";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { ClearCacheRequest } from "../request/ClearCacheRequest";
+import { createNewGuid } from "../crypto/BrowserCrypto";
 
 export class StandardController implements IController {
     // OperatingContext
@@ -281,8 +290,7 @@ export class StandardController implements IController {
                     await NativeMessageHandler.createProvider(
                         this.logger,
                         this.config.system.nativeBrokerHandshakeTimeout,
-                        this.performanceClient,
-                        this.browserCrypto
+                        this.performanceClient
                     );
             } catch (e) {
                 this.logger.verbose(e as string);
@@ -301,7 +309,7 @@ export class StandardController implements IController {
                 PerformanceEvents.ClearTokensAndKeysWithClaims,
                 this.logger,
                 this.performanceClient
-            )();
+            )(this.performanceClient);
         }
 
         this.initialized = true;
@@ -528,7 +536,10 @@ export class StandardController implements IController {
             result = nativeClient
                 .acquireTokenRedirect(request)
                 .catch((e: AuthError) => {
-                    if (e instanceof NativeAuthError && e.isFatal()) {
+                    if (
+                        e instanceof NativeAuthError &&
+                        isFatalNativeAuthError(e)
+                    ) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                         const redirectClient = this.createRedirectClient(
                             request.correlationId
@@ -630,7 +641,10 @@ export class StandardController implements IController {
                     return response;
                 })
                 .catch((e: AuthError) => {
-                    if (e instanceof NativeAuthError && e.isFatal()) {
+                    if (
+                        e instanceof NativeAuthError &&
+                        isFatalNativeAuthError(e)
+                    ) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                         const popupClient = this.createPopupClient(
                             request.correlationId
@@ -781,7 +795,7 @@ export class StandardController implements IController {
                 ApiId.ssoSilent
             ).catch((e: AuthError) => {
                 // If native token acquisition fails for availability reasons fallback to standard flow
-                if (e instanceof NativeAuthError && e.isFatal()) {
+                if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                     const silentIframeClient = this.createSilentIframeClient(
                         validRequest.correlationId
@@ -931,7 +945,10 @@ export class StandardController implements IController {
                         request.nativeAccountId
                     ).catch((e: AuthError) => {
                         // If native token acquisition fails for availability reasons fallback to standard flow
-                        if (e instanceof NativeAuthError && e.isFatal()) {
+                        if (
+                            e instanceof NativeAuthError &&
+                            isFatalNativeAuthError(e)
+                        ) {
                             this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
                         }
                         throw e;
@@ -1038,9 +1055,17 @@ export class StandardController implements IController {
             case CacheLookupPolicy.Default:
             case CacheLookupPolicy.AccessToken:
             case CacheLookupPolicy.AccessTokenAndRefreshToken:
-                return silentCacheClient.acquireToken(commonRequest);
+                return invokeAsync(
+                    silentCacheClient.acquireToken.bind(silentCacheClient),
+                    PerformanceEvents.SilentCacheClientAcquireToken,
+                    this.logger,
+                    this.performanceClient,
+                    commonRequest.correlationId
+                )(commonRequest);
             default:
-                throw ClientAuthError.createRefreshRequiredError();
+                throw createClientAuthError(
+                    ClientAuthErrorCodes.tokenRefreshRequired
+                );
         }
     }
 
@@ -1067,13 +1092,17 @@ export class StandardController implements IController {
                     commonRequest.correlationId
                 );
 
-                this.performanceClient.setPreQueueTime(
+                return invokeAsync(
+                    silentRefreshClient.acquireToken.bind(silentRefreshClient),
                     PerformanceEvents.SilentRefreshClientAcquireToken,
+                    this.logger,
+                    this.performanceClient,
                     commonRequest.correlationId
-                );
-                return silentRefreshClient.acquireToken(commonRequest);
+                )(commonRequest);
             default:
-                throw ClientAuthError.createRefreshRequiredError();
+                throw createClientAuthError(
+                    ClientAuthErrorCodes.tokenRefreshRequired
+                );
         }
     }
 
@@ -1168,18 +1197,45 @@ export class StandardController implements IController {
     // #region Account APIs
 
     /**
-     * Returns all accounts that MSAL currently has data for.
-     * (the account object is created at the time of successful login)
-     * or empty array when no accounts are found
-     * @returns Array of account objects in cache
+     * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
+     * @param accountFilter - (Optional) filter to narrow down the accounts returned
+     * @returns Array of AccountInfo objects in cache
      */
-    getAllAccounts(): AccountInfo[] {
+    getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
         this.logger.verbose("getAllAccounts called");
         return this.isBrowserEnvironment
-            ? this.browserStorage.getAllAccounts()
+            ? this.browserStorage.getAllAccounts(accountFilter)
             : [];
     }
 
+    /**
+     * Returns the first account found in the cache that matches the account filter passed in.
+     * @param accountFilter
+     * @returns The first account found in the cache matching the provided filter or null if no account could be found.
+     */
+    getAccount(accountFilter: AccountFilter): AccountInfo | null {
+        this.logger.trace("getAccount called");
+        if (Object.keys(accountFilter).length === 0) {
+            this.logger.warning("getAccount: No accountFilter provided");
+            return null;
+        }
+
+        const account: AccountInfo | null =
+            this.browserStorage.getAccountInfoFilteredBy(accountFilter);
+
+        if (account) {
+            this.logger.verbose(
+                "getAccount: Account matching provided filter found, returning"
+            );
+            return account;
+        } else {
+            this.logger.verbose(
+                "getAccount: No matching account found, returning null"
+            );
+            return null;
+        }
+    }
+
     /**
      * Returns the signed in account matching username.
      * (the account object is created at the time of successful login)
@@ -1375,7 +1431,9 @@ export class StandardController implements IController {
                 BrowserCacheLocation.MemoryStorage &&
             !this.config.cache.storeAuthStateInCookie
         ) {
-            throw BrowserConfigurationAuthError.createInMemoryRedirectUnavailableError();
+            throw createBrowserConfigurationAuthError(
+                BrowserConfigurationAuthErrorCodes.inMemRedirectUnavailable
+            );
         }
 
         if (
@@ -1768,7 +1826,7 @@ export class StandardController implements IController {
         }
 
         if (this.isBrowserEnvironment) {
-            return this.browserCrypto.createNewGuid();
+            return createNewGuid();
         }
 
         /*
@@ -1862,11 +1920,13 @@ export class StandardController implements IController {
                 correlationId
             );
 
-            this.performanceClient.setPreQueueTime(
+            const response = invokeAsync(
+                this.acquireTokenSilentAsync.bind(this),
                 PerformanceEvents.AcquireTokenSilentAsync,
+                this.logger,
+                this.performanceClient,
                 correlationId
-            );
-            const response = this.acquireTokenSilentAsync(
+            )(
                 {
                     ...request,
                     correlationId,
@@ -1960,7 +2020,7 @@ export class StandardController implements IController {
                 ApiId.acquireTokenSilent_silentFlow
             ).catch(async (e: AuthError) => {
                 // If native token acquisition fails for availability reasons fallback to web flow
-                if (e instanceof NativeAuthError && e.isFatal()) {
+                if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.logger.verbose(
                         "acquireTokenSilent - native platform unavailable, falling back to web flow"
                     );
@@ -1983,15 +2043,15 @@ export class StandardController implements IController {
                 request.correlationId
             );
 
-            this.performanceClient.setPreQueueTime(
+            const silentRequest = await invokeAsync(
+                silentCacheClient.initializeSilentRequest.bind(
+                    silentCacheClient
+                ),
                 PerformanceEvents.InitializeSilentRequest,
+                this.logger,
+                this.performanceClient,
                 request.correlationId
-            );
-            const silentRequest =
-                await silentCacheClient.initializeSilentRequest(
-                    request,
-                    account
-                );
+            )(request, account);
 
             const requestWithCLP = {
                 ...request,
@@ -2000,72 +2060,75 @@ export class StandardController implements IController {
                     request.cacheLookupPolicy || CacheLookupPolicy.Default,
             };
 
-            this.performanceClient.setPreQueueTime(
+            result = invokeAsync(
+                this.acquireTokenFromCache.bind(this),
                 PerformanceEvents.AcquireTokenFromCache,
+                this.logger,
+                this.performanceClient,
                 silentRequest.correlationId
-            );
-            result = this.acquireTokenFromCache(
-                silentCacheClient,
-                silentRequest,
-                requestWithCLP
-            ).catch((cacheError: AuthError) => {
-                if (
-                    requestWithCLP.cacheLookupPolicy ===
-                    CacheLookupPolicy.AccessToken
-                ) {
-                    throw cacheError;
-                }
-
-                // block the reload if it occurred inside a hidden iframe
-                BrowserUtils.blockReloadInHiddenIframes();
-                this.eventHandler.emitEvent(
-                    EventType.ACQUIRE_TOKEN_NETWORK_START,
-                    InteractionType.Silent,
-                    silentRequest
-                );
-
-                this.performanceClient.setPreQueueTime(
-                    PerformanceEvents.AcquireTokenByRefreshToken,
-                    silentRequest.correlationId
-                );
-                return this.acquireTokenByRefreshToken(
-                    silentRequest,
-                    requestWithCLP
-                ).catch((refreshTokenError: AuthError) => {
-                    const isServerError =
-                        refreshTokenError instanceof ServerError;
-                    const isInteractionRequiredError =
-                        refreshTokenError instanceof
-                        InteractionRequiredAuthError;
-                    const isInvalidGrantError =
-                        refreshTokenError.errorCode ===
-                        BrowserConstants.INVALID_GRANT_ERROR;
-
+            )(silentCacheClient, silentRequest, requestWithCLP).catch(
+                (cacheError: AuthError) => {
                     if (
-                        (!isServerError ||
-                            !isInvalidGrantError ||
-                            isInteractionRequiredError ||
-                            requestWithCLP.cacheLookupPolicy ===
-                                CacheLookupPolicy.AccessTokenAndRefreshToken ||
-                            requestWithCLP.cacheLookupPolicy ===
-                                CacheLookupPolicy.RefreshToken) &&
-                        requestWithCLP.cacheLookupPolicy !==
-                            CacheLookupPolicy.Skip
+                        requestWithCLP.cacheLookupPolicy ===
+                        CacheLookupPolicy.AccessToken
                     ) {
-                        throw refreshTokenError;
+                        throw cacheError;
                     }
 
-                    this.logger.verbose(
-                        "Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",
-                        request.correlationId
+                    // block the reload if it occurred inside a hidden iframe
+                    BrowserUtils.blockReloadInHiddenIframes();
+                    this.eventHandler.emitEvent(
+                        EventType.ACQUIRE_TOKEN_NETWORK_START,
+                        InteractionType.Silent,
+                        silentRequest
                     );
-                    this.performanceClient.setPreQueueTime(
-                        PerformanceEvents.AcquireTokenBySilentIframe,
+
+                    return invokeAsync(
+                        this.acquireTokenByRefreshToken.bind(this),
+                        PerformanceEvents.AcquireTokenByRefreshToken,
+                        this.logger,
+                        this.performanceClient,
                         silentRequest.correlationId
+                    )(silentRequest, requestWithCLP).catch(
+                        (refreshTokenError: AuthError) => {
+                            const isServerError =
+                                refreshTokenError instanceof ServerError;
+                            const isInteractionRequiredError =
+                                refreshTokenError instanceof
+                                InteractionRequiredAuthError;
+                            const isInvalidGrantError =
+                                refreshTokenError.errorCode ===
+                                BrowserConstants.INVALID_GRANT_ERROR;
+
+                            if (
+                                (!isServerError ||
+                                    !isInvalidGrantError ||
+                                    isInteractionRequiredError ||
+                                    requestWithCLP.cacheLookupPolicy ===
+                                        CacheLookupPolicy.AccessTokenAndRefreshToken ||
+                                    requestWithCLP.cacheLookupPolicy ===
+                                        CacheLookupPolicy.RefreshToken) &&
+                                requestWithCLP.cacheLookupPolicy !==
+                                    CacheLookupPolicy.Skip
+                            ) {
+                                throw refreshTokenError;
+                            }
+
+                            this.logger.verbose(
+                                "Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",
+                                request.correlationId
+                            );
+                            return invokeAsync(
+                                this.acquireTokenBySilentIframe.bind(this),
+                                PerformanceEvents.AcquireTokenBySilentIframe,
+                                this.logger,
+                                this.performanceClient,
+                                silentRequest.correlationId
+                            )(silentRequest);
+                        }
                     );
-                    return this.acquireTokenBySilentIframe(silentRequest);
-                });
-            });
+                }
+            );
         }
 
         return result

package/src/crypto/BrowserCrypto.ts

@@ -8,9 +8,18 @@ import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
-import { ISubtleCrypto } from "./ISubtleCrypto";
-import { ModernBrowserCrypto } from "./ModernBrowserCrypto";
-import { Logger } from "@azure/msal-common";
+import {
+    IPerformanceClient,
+    Logger,
+    PerformanceEvents,
+} from "@azure/msal-common";
+import { KEY_FORMAT_JWK } from "../utils/BrowserConstants";
+
+/**
+ * This file defines functions used by the browser library to perform cryptography operations such as
+ * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
+ */
+
 /**
  * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
  */
@@ -23,113 +32,120 @@ const MODULUS_LENGTH = 2048;
 // Public Exponent
 const PUBLIC_EXPONENT: Uint8Array = new Uint8Array([0x01, 0x00, 0x01]);
 
+const keygenAlgorithmOptions: RsaHashedKeyGenParams = {
+    name: PKCS1_V15_KEYGEN_ALG,
+    hash: S256_HASH_ALG,
+    modulusLength: MODULUS_LENGTH,
+    publicExponent: PUBLIC_EXPONENT,
+};
+
 /**
- * This class implements functions used by the browser library to perform cryptography operations such as
- * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
+ * Check whether browser crypto is available.
  */
-export class BrowserCrypto {
-    private keygenAlgorithmOptions: RsaHashedKeyGenParams;
-    private subtleCrypto: ISubtleCrypto;
-    private logger: Logger;
-
-    constructor(logger: Logger) {
-        this.logger = logger;
-
-        if (this.hasBrowserCrypto()) {
-            // Use standard modern web crypto if available
-            this.logger.verbose(
-                "BrowserCrypto: modern crypto interface available"
-            );
-            this.subtleCrypto = new ModernBrowserCrypto();
-        } else {
-            this.logger.error("BrowserCrypto: crypto interface is unavailable");
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.cryptoNonExistent
-            );
-        }
-
-        this.keygenAlgorithmOptions = {
-            name: PKCS1_V15_KEYGEN_ALG,
-            hash: S256_HASH_ALG,
-            modulusLength: MODULUS_LENGTH,
-            publicExponent: PUBLIC_EXPONENT,
-        };
+export function validateCryptoAvailable(logger: Logger): void {
+    if ("crypto" in window) {
+        logger.verbose("BrowserCrypto: modern crypto interface available");
+    } else {
+        logger.error("BrowserCrypto: crypto interface is unavailable");
+        throw createBrowserAuthError(BrowserAuthErrorCodes.cryptoNonExistent);
     }
+}
 
-    /**
-     * Check whether browser crypto is available.
-     */
-    private hasBrowserCrypto(): boolean {
-        return "crypto" in window;
-    }
+/**
+ * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
+ * @param dataString
+ */
+export async function sha256Digest(
+    dataString: string,
+    performanceClient?: IPerformanceClient,
+    correlationId?: string
+): Promise<ArrayBuffer> {
+    performanceClient?.addQueueMeasurement(
+        PerformanceEvents.Sha256Digest,
+        correlationId
+    );
+    const data = BrowserStringUtils.stringToUtf8Arr(dataString);
+    return window.crypto.subtle.digest(
+        S256_HASH_ALG,
+        data
+    ) as Promise<ArrayBuffer>;
+}
 
-    /**
-     * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
-     * @param dataString
-     */
-    async sha256Digest(dataString: string): Promise<ArrayBuffer> {
-        const data = BrowserStringUtils.stringToUtf8Arr(dataString);
-        // MSR Crypto wants object with name property, instead of string
-        return this.subtleCrypto.digest({ name: S256_HASH_ALG }, data);
-    }
+/**
+ * Populates buffer with cryptographically random values.
+ * @param dataBuffer
+ */
+export function getRandomValues(dataBuffer: Uint8Array): Uint8Array {
+    return window.crypto.getRandomValues(dataBuffer);
+}
 
-    /**
-     * Populates buffer with cryptographically random values.
-     * @param dataBuffer
-     */
-    getRandomValues(dataBuffer: Uint8Array): Uint8Array {
-        return this.subtleCrypto.getRandomValues(dataBuffer);
-    }
+/**
+ * Creates a new random GUID
+ * @returns
+ */
+export function createNewGuid(): string {
+    return window.crypto.randomUUID();
+}
 
-    /**
-     * Generates a keypair based on current keygen algorithm config.
-     * @param extractable
-     * @param usages
-     */
-    async generateKeyPair(
-        extractable: boolean,
-        usages: Array<KeyUsage>
-    ): Promise<CryptoKeyPair> {
-        return this.subtleCrypto.generateKey(
-            this.keygenAlgorithmOptions,
-            extractable,
-            usages
-        );
-    }
+/**
+ * Generates a keypair based on current keygen algorithm config.
+ * @param extractable
+ * @param usages
+ */
+export async function generateKeyPair(
+    extractable: boolean,
+    usages: Array<KeyUsage>
+): Promise<CryptoKeyPair> {
+    return window.crypto.subtle.generateKey(
+        keygenAlgorithmOptions,
+        extractable,
+        usages
+    ) as Promise<CryptoKeyPair>;
+}
 
-    /**
-     * Export key as Json Web Key (JWK)
-     * @param key
-     */
-    async exportJwk(key: CryptoKey): Promise<JsonWebKey> {
-        return this.subtleCrypto.exportKey(key);
-    }
+/**
+ * Export key as Json Web Key (JWK)
+ * @param key
+ */
+export async function exportJwk(key: CryptoKey): Promise<JsonWebKey> {
+    return window.crypto.subtle.exportKey(
+        KEY_FORMAT_JWK,
+        key
+    ) as Promise<JsonWebKey>;
+}
 
-    /**
-     * Imports key as Json Web Key (JWK), can set extractable and usages.
-     * @param key
-     * @param extractable
-     * @param usages
-     */
-    async importJwk(
-        key: JsonWebKey,
-        extractable: boolean,
-        usages: Array<KeyUsage>
-    ): Promise<CryptoKey> {
-        return this.subtleCrypto.importKey(
-            key,
-            this.keygenAlgorithmOptions,
-            extractable,
-            usages
-        );
-    }
+/**
+ * Imports key as Json Web Key (JWK), can set extractable and usages.
+ * @param key
+ * @param extractable
+ * @param usages
+ */
+export async function importJwk(
+    key: JsonWebKey,
+    extractable: boolean,
+    usages: Array<KeyUsage>
+): Promise<CryptoKey> {
+    return window.crypto.subtle.importKey(
+        KEY_FORMAT_JWK,
+        key,
+        keygenAlgorithmOptions,
+        extractable,
+        usages
+    ) as Promise<CryptoKey>;
+}
 
-    /**
-     * Signs given data with given key
-     * @param key
-     * @param data
-     */
-    async sign(key: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer> {
-        return this.subtleCrypto.sign(this.keygenAlgorithmOptions, key, data);
-    }
+/**
+ * Signs given data with given key
+ * @param key
+ * @param data
+ */
+export async function sign(
+    key: CryptoKey,
+    data: ArrayBuffer
+): Promise<ArrayBuffer> {
+    return window.crypto.subtle.sign(
+        keygenAlgorithmOptions,
+        key,
+        data
+    ) as Promise<ArrayBuffer>;
 }