@azure/msal-browser 3.1.0 → 3.2.0

package/src/error/NativeAuthError.ts

@@ -3,12 +3,21 @@
  * Licensed under the MIT License.
  */
 
-import { AuthError, InteractionRequiredAuthError } from "@azure/msal-common";
+import {
+    AuthError,
+    InteractionRequiredAuthError,
+    InteractionRequiredAuthErrorCodes,
+    createInteractionRequiredAuthError,
+} from "@azure/msal-common";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "./BrowserAuthError";
 
+import * as NativeAuthErrorCodes from "./NativeAuthErrorCodes";
+import * as NativeStatusCodes from "../broker/nativeBroker/NativeStatusCodes";
+export { NativeAuthErrorCodes };
+
 export type OSError = {
     error?: number;
     protocol_error?: string;
@@ -19,123 +28,86 @@ export type OSError = {
 
 const INVALID_METHOD_ERROR = -2147186943;
 
-export const NativeStatusCode = {
-    USER_INTERACTION_REQUIRED: "USER_INTERACTION_REQUIRED",
-    USER_CANCEL: "USER_CANCEL",
-    NO_NETWORK: "NO_NETWORK",
-    TRANSIENT_ERROR: "TRANSIENT_ERROR",
-    PERSISTENT_ERROR: "PERSISTENT_ERROR",
-    DISABLED: "DISABLED",
-    ACCOUNT_UNAVAILABLE: "ACCOUNT_UNAVAILABLE",
-} as const;
-export type NativeStatusCode =
-    (typeof NativeStatusCode)[keyof typeof NativeStatusCode];
-
-export const NativeAuthErrorMessage = {
-    extensionError: {
-        code: "ContentError",
-    },
-    userSwitch: {
-        code: "user_switch",
-        desc: "User attempted to switch accounts in the native broker, which is not allowed. All new accounts must sign-in through the standard web flow first, please try again.",
-    },
-    tokensNotFoundInCache: {
-        code: "tokens_not_found_in_internal_memory_cache",
-        desc: "Tokens not cached in MSAL JS internal memory, please make the WAM request",
-    },
+export const NativeAuthErrorMessages = {
+    [NativeAuthErrorCodes.userSwitch]:
+        "User attempted to switch accounts in the native broker, which is not allowed. All new accounts must sign-in through the standard web flow first, please try again.",
 };
 
 export class NativeAuthError extends AuthError {
     ext: OSError | undefined;
 
-    constructor(errorCode: string, description: string, ext?: OSError) {
+    constructor(errorCode: string, description?: string, ext?: OSError) {
         super(errorCode, description);
 
         Object.setPrototypeOf(this, NativeAuthError.prototype);
         this.name = "NativeAuthError";
         this.ext = ext;
     }
+}
 
-    /**
-     * These errors should result in a fallback to the 'standard' browser based auth flow.
-     */
-    isFatal(): boolean {
-        if (
-            this.ext &&
-            this.ext.status &&
-            (this.ext.status === NativeStatusCode.PERSISTENT_ERROR ||
-                this.ext.status === NativeStatusCode.DISABLED)
-        ) {
-            return true;
-        }
-
-        if (
-            this.ext &&
-            this.ext.error &&
-            this.ext.error === INVALID_METHOD_ERROR
-        ) {
-            return true;
-        }
-
-        switch (this.errorCode) {
-            case NativeAuthErrorMessage.extensionError.code:
-                return true;
-            default:
-                return false;
-        }
+/**
+ * These errors should result in a fallback to the 'standard' browser based auth flow.
+ */
+export function isFatalNativeAuthError(error: NativeAuthError): boolean {
+    if (
+        error.ext &&
+        error.ext.status &&
+        (error.ext.status === NativeStatusCodes.PERSISTENT_ERROR ||
+            error.ext.status === NativeStatusCodes.DISABLED)
+    ) {
+        return true;
     }
 
-    /**
-     * Create the appropriate error object based on the WAM status code.
-     * @param code
-     * @param description
-     * @param ext
-     * @returns
-     */
-    static createError(
-        code: string,
-        description: string,
-        ext?: OSError
-    ): AuthError {
-        if (ext && ext.status) {
-            switch (ext.status) {
-                case NativeStatusCode.ACCOUNT_UNAVAILABLE:
-                    return InteractionRequiredAuthError.createNativeAccountUnavailableError();
-                case NativeStatusCode.USER_INTERACTION_REQUIRED:
-                    return new InteractionRequiredAuthError(code, description);
-                case NativeStatusCode.USER_CANCEL:
-                    return createBrowserAuthError(
-                        BrowserAuthErrorCodes.userCancelled
-                    );
-                case NativeStatusCode.NO_NETWORK:
-                    return createBrowserAuthError(
-                        BrowserAuthErrorCodes.noNetworkConnectivity
-                    );
-            }
-        }
-
-        return new NativeAuthError(code, description, ext);
+    if (
+        error.ext &&
+        error.ext.error &&
+        error.ext.error === INVALID_METHOD_ERROR
+    ) {
+        return true;
     }
 
-    /**
-     * Creates user switch error when the user chooses a different account in the native broker prompt
-     * @returns
-     */
-    static createUserSwitchError(): NativeAuthError {
-        return new NativeAuthError(
-            NativeAuthErrorMessage.userSwitch.code,
-            NativeAuthErrorMessage.userSwitch.desc
-        );
+    switch (error.errorCode) {
+        case NativeAuthErrorCodes.contentError:
+            return true;
+        default:
+            return false;
     }
+}
 
-    /**
-     * Creates a tokens not found error when the internal cache look up fails
-     * @returns NativeAuthError: tokensNotFoundInCache
-     */
-    static createTokensNotFoundInCacheError(): NativeAuthError {
-        return new NativeAuthError(
-            NativeAuthErrorMessage.tokensNotFoundInCache.code,
-            NativeAuthErrorMessage.tokensNotFoundInCache.desc
-        );
+/**
+ * Create the appropriate error object based on the WAM status code.
+ * @param code
+ * @param description
+ * @param ext
+ * @returns
+ */
+export function createNativeAuthError(
+    code: string,
+    description?: string,
+    ext?: OSError
+): AuthError {
+    if (ext && ext.status) {
+        switch (ext.status) {
+            case NativeStatusCodes.ACCOUNT_UNAVAILABLE:
+                return createInteractionRequiredAuthError(
+                    InteractionRequiredAuthErrorCodes.nativeAccountUnavailable
+                );
+            case NativeStatusCodes.USER_INTERACTION_REQUIRED:
+                return new InteractionRequiredAuthError(code, description);
+            case NativeStatusCodes.USER_CANCEL:
+                return createBrowserAuthError(
+                    BrowserAuthErrorCodes.userCancelled
+                );
+            case NativeStatusCodes.NO_NETWORK:
+                return createBrowserAuthError(
+                    BrowserAuthErrorCodes.noNetworkConnectivity
+                );
+        }
     }
+
+    return new NativeAuthError(
+        code,
+        NativeAuthErrorMessages[code] || description,
+        ext
+    );
 }

package/src/error/NativeAuthErrorCodes.ts

@@ -0,0 +1,7 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const contentError = "ContentError";
+export const userSwitch = "user_switch";

package/src/event/EventHandler.ts

@@ -17,6 +17,7 @@ import {
     EventPayload,
 } from "./EventMessage";
 import { EventType } from "./EventType";
+import { createNewGuid } from "../crypto/BrowserCrypto";
 
 export class EventHandler {
     // Callback for subscribing to events
@@ -40,7 +41,7 @@ export class EventHandler {
      */
     addEventCallback(callback: EventCallbackFunction): string | null {
         if (typeof window !== "undefined") {
-            const callbackId = this.browserCrypto.createNewGuid();
+            const callbackId = createNewGuid();
             this.eventCallbacks.set(callbackId, callback);
             this.logger.verbose(
                 `Event callback registered with id: ${callbackId}`

package/src/index.ts

@@ -47,6 +47,7 @@ export {
 } from "./error/BrowserAuthError";
 export {
     BrowserConfigurationAuthError,
+    BrowserConfigurationAuthErrorCodes,
     BrowserConfigurationAuthErrorMessage,
 } from "./error/BrowserConfigurationAuthError";
 
@@ -112,12 +113,16 @@ export {
     IdTokenClaims,
     // Error
     AuthError,
+    AuthErrorCodes,
     AuthErrorMessage,
     ClientAuthError,
+    ClientAuthErrorCodes,
     ClientAuthErrorMessage,
     ClientConfigurationError,
+    ClientConfigurationErrorCodes,
     ClientConfigurationErrorMessage,
     InteractionRequiredAuthError,
+    InteractionRequiredAuthErrorCodes,
     InteractionRequiredAuthErrorMessage,
     ServerError,
     // Network

package/src/interaction_client/BaseInteractionClient.ts

@@ -14,7 +14,8 @@ import {
     UrlString,
     ServerTelemetryManager,
     ServerTelemetryRequest,
-    ClientConfigurationError,
+    createClientConfigurationError,
+    ClientConfigurationErrorCodes,
     Authority,
     AuthorityOptions,
     AuthorityFactory,
@@ -36,6 +37,7 @@ import { INavigationClient } from "../navigation/INavigationClient";
 import { NativeMessageHandler } from "../broker/nativeBroker/NativeMessageHandler";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { ClearCacheRequest } from "../request/ClearCacheRequest";
+import { createNewGuid } from "../crypto/BrowserCrypto";
 
 export abstract class BaseInteractionClient {
     protected config: BrowserConfiguration;
@@ -67,8 +69,7 @@ export abstract class BaseInteractionClient {
         this.eventHandler = eventHandler;
         this.navigationClient = navigationClient;
         this.nativeMessageHandler = nativeMessageHandler;
-        this.correlationId =
-            correlationId || this.browserCrypto.createNewGuid();
+        this.correlationId = correlationId || createNewGuid();
         this.logger = logger.clone(
             BrowserConstants.MSAL_SKU,
             version,
@@ -142,7 +143,6 @@ export abstract class BaseInteractionClient {
             PerformanceEvents.InitializeBaseRequest,
             request.correlationId
         );
-        this.logger.verbose("Initializing BaseAuthRequest");
         const authority = request.authority || this.config.auth.authority;
 
         if (account) {
@@ -170,10 +170,14 @@ export abstract class BaseInteractionClient {
                 AuthenticationScheme.SSH
             ) {
                 if (!request.sshJwk) {
-                    throw ClientConfigurationError.createMissingSshJwkError();
+                    throw createClientConfigurationError(
+                        ClientConfigurationErrorCodes.missingSshJwk
+                    );
                 }
                 if (!request.sshKid) {
-                    throw ClientConfigurationError.createMissingSshKidError();
+                    throw createClientConfigurationError(
+                        ClientConfigurationErrorCodes.missingSshKid
+                    );
                 }
             }
             this.logger.verbose(
@@ -227,7 +231,9 @@ export abstract class BaseInteractionClient {
         );
 
         if (!discoveredAuthority.isAlias(account.environment)) {
-            throw ClientConfigurationError.createAuthorityMismatchError();
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.authorityMismatch
+            );
         }
     }
 

package/src/interaction_client/NativeInteractionClient.ts

@@ -22,13 +22,17 @@ import {
     PerformanceEvents,
     IdTokenEntity,
     AccessTokenEntity,
-    ClientAuthError,
     AuthError,
     CommonSilentFlowRequest,
     AccountInfo,
     CacheRecord,
     AADServerParamKeys,
     TokenClaims,
+    createClientAuthError,
+    ClientAuthErrorCodes,
+    invokeAsync,
+    createAuthError,
+    AuthErrorCodes,
 } from "@azure/msal-common";
 import { BaseInteractionClient } from "./BaseInteractionClient";
 import { BrowserConfiguration } from "../config/Configuration";
@@ -49,7 +53,12 @@ import {
     NativeTokenRequest,
 } from "../broker/nativeBroker/NativeRequest";
 import { MATS, NativeResponse } from "../broker/nativeBroker/NativeResponse";
-import { NativeAuthError } from "../error/NativeAuthError";
+import {
+    NativeAuthError,
+    NativeAuthErrorCodes,
+    createNativeAuthError,
+    isFatalNativeAuthError,
+} from "../error/NativeAuthError";
 import { RedirectRequest } from "../request/RedirectRequest";
 import { NavigationOptions } from "../navigation/NavigationOptions";
 import { INavigationClient } from "../navigation/INavigationClient";
@@ -122,6 +131,10 @@ export class NativeInteractionClient extends BaseInteractionClient {
     async acquireToken(
         request: PopupRequest | SilentRequest | SsoSilentRequest
     ): Promise<AuthenticationResult> {
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.NativeInteractionClientAcquireToken,
+            request.correlationId
+        );
         this.logger.trace("NativeInteractionClient - acquireToken called.");
 
         // start the perf measurement
@@ -222,14 +235,14 @@ export class NativeInteractionClient extends BaseInteractionClient {
             this.logger.warning(
                 "NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided"
             );
-            throw ClientAuthError.createNoAccountFoundError();
+            throw createClientAuthError(ClientAuthErrorCodes.noAccountFound);
         }
         // fetch the account from browser cache
         const account = this.browserStorage.getAccountInfoFilteredBy({
             nativeAccountId,
         });
         if (!account) {
-            throw ClientAuthError.createNoAccountFoundError();
+            throw createClientAuthError(ClientAuthErrorCodes.noAccountFound);
         }
 
         // leverage silent flow for cached tokens retrieval
@@ -271,7 +284,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
             this.validateNativeResponse(response);
         } catch (e) {
             // Only throw fatal errors here to allow application to fallback to regular redirect. Otherwise proceed and the error will be thrown in handleRedirectPromise
-            if (e instanceof NativeAuthError && e.isFatal()) {
+            if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                 throw e;
             }
         }
@@ -384,7 +397,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
 
         if (response.account.id !== request.accountId) {
             // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
-            throw NativeAuthError.createUserSwitchError();
+            throw createNativeAuthError(NativeAuthErrorCodes.userSwitch);
         }
 
         // Get the preferred_cache domain for the given authority
@@ -510,7 +523,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
              * PopTokenGenerator to query the full key for signing
              */
             if (!request.keyId) {
-                throw ClientAuthError.createKeyIdMissingError();
+                throw createClientAuthError(ClientAuthErrorCodes.keyIdMissing);
             }
             return await popTokenGenerator.signPopToken(
                 response.access_token,
@@ -719,7 +732,8 @@ export class NativeInteractionClient extends BaseInteractionClient {
         ) {
             return response as NativeResponse;
         } else {
-            throw NativeAuthError.createUnexpectedError(
+            throw createAuthError(
+                AuthErrorCodes.unexpectedError,
                 "Response missing expected properties."
             );
         }
@@ -859,9 +873,13 @@ export class NativeInteractionClient extends BaseInteractionClient {
             };
 
             const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-            const reqCnfData = await popTokenGenerator.generateCnf(
-                shrParameters
-            );
+            const reqCnfData = await invokeAsync(
+                popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                PerformanceEvents.PopTokenGenerateCnf,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(shrParameters, this.logger);
 
             // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
             validatedRequest.reqCnf = reqCnfData.reqCnfHash;

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -11,6 +11,7 @@ import {
     Constants,
     IPerformanceClient,
     PerformanceEvents,
+    invokeAsync,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
@@ -65,8 +66,6 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
     async acquireToken(
         request: AuthorizationCodeRequest
     ): Promise<AuthenticationResult> {
-        this.logger.trace("SilentAuthCodeClient.acquireToken called");
-
         // Auth code payload is required
         if (!request.code) {
             throw createBrowserAuthError(
@@ -75,15 +74,13 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
         }
 
         // Create silent request
-        this.performanceClient.setPreQueueTime(
+        const silentRequest: AuthorizationUrlRequest = await invokeAsync(
+            this.initializeAuthorizationRequest.bind(this),
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
+            this.logger,
+            this.performanceClient,
             request.correlationId
-        );
-        const silentRequest: AuthorizationUrlRequest =
-            await this.initializeAuthorizationRequest(
-                request,
-                InteractionType.Silent
-            );
+        )(request, InteractionType.Silent);
         this.browserStorage.updateCacheEntries(
             silentRequest.state,
             silentRequest.nonce,
@@ -104,14 +101,13 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             };
 
             // Initialize the client
-            this.performanceClient.setPreQueueTime(
+            const clientConfig = await invokeAsync(
+                this.getClientConfiguration.bind(this),
                 PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+                this.logger,
+                this.performanceClient,
                 request.correlationId
-            );
-            const clientConfig = await this.getClientConfiguration(
-                serverTelemetryManager,
-                silentRequest.authority
-            );
+            )(serverTelemetryManager, silentRequest.authority);
             const authClient: HybridSpaAuthorizationCodeClient =
                 new HybridSpaAuthorizationCodeClient(clientConfig);
             this.logger.verbose("Auth code client created");
@@ -127,7 +123,13 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             );
 
             // Handle auth code parameters from request
-            return silentHandler.handleCodeResponseFromServer(
+            return invokeAsync(
+                silentHandler.handleCodeResponseFromServer.bind(silentHandler),
+                PerformanceEvents.HandleCodeResponseFromServer,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(
                 {
                     code: request.code,
                     msgraph_host: request.msGraphHost,

package/src/interaction_client/SilentCacheClient.ts

@@ -11,7 +11,7 @@ import {
     AccountInfo,
     AzureCloudOptions,
     PerformanceEvents,
-    AuthError,
+    invokeAsync,
 } from "@azure/msal-common";
 import { SilentRequest } from "../request/SilentRequest";
 import { ApiId } from "../utils/BrowserConstants";
@@ -30,10 +30,6 @@ export class SilentCacheClient extends StandardInteractionClient {
     async acquireToken(
         silentRequest: CommonSilentFlowRequest
     ): Promise<AuthenticationResult> {
-        const acquireTokenMeasurement = this.performanceClient.startMeasurement(
-            PerformanceEvents.SilentCacheClientAcquireToken,
-            silentRequest.correlationId
-        );
         // Telemetry manager only used to increment cacheHits here
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             ApiId.acquireTokenSilent_silentFlow
@@ -47,15 +43,18 @@ export class SilentCacheClient extends StandardInteractionClient {
         this.logger.verbose("Silent auth client created");
 
         try {
-            const cachedToken = (await silentAuthClient.acquireCachedToken(
+            const response = await silentAuthClient.acquireCachedToken(
                 silentRequest
-            )) as AuthenticationResult;
+            );
+            const authResponse = response[0] as AuthenticationResult;
 
-            acquireTokenMeasurement.end({
-                success: true,
-                fromCache: true,
-            });
-            return cachedToken;
+            this.performanceClient.addFields(
+                {
+                    fromCache: true,
+                },
+                silentRequest.correlationId
+            );
+            return authResponse;
         } catch (error) {
             if (
                 error instanceof BrowserAuthError &&
@@ -65,14 +64,6 @@ export class SilentCacheClient extends StandardInteractionClient {
                     "Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair."
                 );
             }
-            acquireTokenMeasurement.end({
-                errorCode:
-                    (error instanceof AuthError && error.errorCode) ||
-                    undefined,
-                subErrorCode:
-                    (error instanceof AuthError && error.subError) || undefined,
-                success: false,
-            });
             throw error;
         }
     }
@@ -98,15 +89,13 @@ export class SilentCacheClient extends StandardInteractionClient {
         azureCloudOptions?: AzureCloudOptions
     ): Promise<SilentFlowClient> {
         // Create auth module.
-        this.performanceClient.setPreQueueTime(
+        const clientConfig = await invokeAsync(
+            this.getClientConfiguration.bind(this),
             PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+            this.logger,
+            this.performanceClient,
             this.correlationId
-        );
-        const clientConfig = await this.getClientConfiguration(
-            serverTelemetryManager,
-            authorityUrl,
-            azureCloudOptions
-        );
+        )(serverTelemetryManager, authorityUrl, azureCloudOptions);
         return new SilentFlowClient(clientConfig, this.performanceClient);
     }
 
@@ -119,13 +108,16 @@ export class SilentCacheClient extends StandardInteractionClient {
             this.correlationId
         );
 
-        this.performanceClient.setPreQueueTime(
+        const baseRequest = await invokeAsync(
+            this.initializeBaseRequest.bind(this),
             PerformanceEvents.InitializeBaseRequest,
+            this.logger,
+            this.performanceClient,
             this.correlationId
-        );
+        )(request, account);
         return {
             ...request,
-            ...(await this.initializeBaseRequest(request, account)),
+            ...baseRequest,
             account: account,
             forceRefresh: request.forceRefresh || false,
         };

package/src/interaction_client/SilentIframeClient.ts

@@ -231,7 +231,7 @@ export class SilentIframeClient extends StandardInteractionClient {
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const hash = await invokeAsync(
             silentHandler.monitorIframeForHash.bind(silentHandler),
-            PerformanceEvents.SilentHandlerInitiateAuthRequest,
+            PerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
             silentRequest.correlationId