@azure/msal-browser 3.1.0 → 3.3.0

package/src/controllers/UnknownOperatingContextController.ts

@@ -0,0 +1,383 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    CommonAuthorizationUrlRequest,
+    CommonSilentFlowRequest,
+    PerformanceCallbackFunction,
+    AccountInfo,
+    Logger,
+    ICrypto,
+    IPerformanceClient,
+    DEFAULT_CRYPTO_IMPLEMENTATION,
+    AccountFilter,
+} from "@azure/msal-common";
+import { ITokenCache } from "../cache/ITokenCache";
+import { BrowserConfiguration } from "../config/Configuration";
+import {
+    BrowserCacheManager,
+    DEFAULT_BROWSER_CACHE_MANAGER,
+} from "../cache/BrowserCacheManager";
+import { INavigationClient } from "../navigation/INavigationClient";
+import { AuthorizationCodeRequest } from "../request/AuthorizationCodeRequest";
+import { EndSessionPopupRequest } from "../request/EndSessionPopupRequest";
+import { EndSessionRequest } from "../request/EndSessionRequest";
+import { PopupRequest } from "../request/PopupRequest";
+import { RedirectRequest } from "../request/RedirectRequest";
+import { SilentRequest } from "../request/SilentRequest";
+import { SsoSilentRequest } from "../request/SsoSilentRequest";
+import { AuthenticationResult } from "../response/AuthenticationResult";
+import { ApiId, WrapperSKU, InteractionType } from "../utils/BrowserConstants";
+import { IController } from "./IController";
+import { UnknownOperatingContext } from "../operatingcontext/UnknownOperatingContext";
+import { CryptoOps } from "../crypto/CryptoOps";
+import {
+    blockAPICallsBeforeInitialize,
+    blockNonBrowserEnvironment,
+} from "../utils/BrowserUtils";
+import { EventHandler } from "../event/EventHandler";
+import { EventCallbackFunction } from "../event/EventMessage";
+import { ClearCacheRequest } from "../request/ClearCacheRequest";
+
+/**
+ * UnknownOperatingContextController class
+ *
+ * - Until initialize method is called, this controller is the default
+ * - AFter initialize method is called, this controller will be swapped out for the appropriate controller
+ * if the operating context can be determined; otherwise this controller will continued be used
+ *
+ * - Why do we have this?  We don't want to dynamically import (download) all of the code in StandardController if we don't need to.
+ *
+ * - Only includes implementation for getAccounts and handleRedirectPromise
+ *   - All other methods are will throw initialization error (because either initialize method or the factory method were not used)
+ *   - This controller is necessary for React Native wrapper, server side rendering and any other scenario where we don't have a DOM
+ *
+ */
+export class UnknownOperatingContextController implements IController {
+    // OperatingContext
+    protected readonly operatingContext: UnknownOperatingContext;
+
+    // Logger
+    protected logger: Logger;
+
+    // Storage interface implementation
+    protected readonly browserStorage: BrowserCacheManager;
+
+    // Input configuration by developer/user
+    protected readonly config: BrowserConfiguration;
+
+    // Performance telemetry client
+    protected readonly performanceClient: IPerformanceClient;
+
+    // Crypto interface implementation
+    protected readonly browserCrypto: ICrypto;
+
+    // Flag to indicate if in browser environment
+    protected isBrowserEnvironment: boolean;
+
+    // Flag representing whether or not the initialize API has been called and completed
+    protected initialized: boolean = false;
+
+    protected readonly eventHandler: EventHandler;
+
+    constructor(operatingContext: UnknownOperatingContext) {
+        this.operatingContext = operatingContext;
+
+        this.isBrowserEnvironment =
+            this.operatingContext.isBrowserEnvironment();
+
+        this.config = operatingContext.getConfig();
+
+        this.logger = operatingContext.getLogger();
+
+        // Initialize performance client
+        this.performanceClient = this.config.telemetry.client;
+
+        // Initialize the crypto class.
+        this.browserCrypto = this.isBrowserEnvironment
+            ? new CryptoOps(this.logger, this.performanceClient)
+            : DEFAULT_CRYPTO_IMPLEMENTATION;
+
+        // Initialize the browser storage class.
+        this.browserStorage = this.isBrowserEnvironment
+            ? new BrowserCacheManager(
+                  this.config.auth.clientId,
+                  this.config.cache,
+                  this.browserCrypto,
+                  this.logger
+              )
+            : DEFAULT_BROWSER_CACHE_MANAGER(
+                  this.config.auth.clientId,
+                  this.logger
+              );
+
+        this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
+    }
+    getBrowserStorage(): BrowserCacheManager {
+        return this.browserStorage;
+    }
+
+    getEventHandler(): EventHandler {
+        return this.eventHandler;
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    getAccount(accountFilter: AccountFilter): AccountInfo | null {
+        return null;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    getAccountByHomeId(homeAccountId: string): AccountInfo | null {
+        return null;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    getAccountByLocalId(localAccountId: string): AccountInfo | null {
+        return null;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    getAccountByUsername(username: string): AccountInfo | null {
+        return null;
+    }
+    getAllAccounts(): AccountInfo[] {
+        return [];
+    }
+    initialize(): Promise<void> {
+        this.initialized = true;
+        return Promise.resolve();
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    acquireTokenPopup(request: PopupRequest): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    acquireTokenRedirect(request: RedirectRequest): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return Promise.resolve();
+    }
+    acquireTokenSilent(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        silentRequest: SilentRequest
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    acquireTokenByCode(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request: AuthorizationCodeRequest
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    acquireTokenNative(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request:
+            | PopupRequest
+            | SilentRequest
+            | Partial<
+                  Omit<
+                      CommonAuthorizationUrlRequest,
+                      | "responseMode"
+                      | "codeChallenge"
+                      | "codeChallengeMethod"
+                      | "requestedClaimsHash"
+                      | "nativeBroker"
+                  >
+              >,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        apiId: ApiId,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        accountId?: string | undefined
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    acquireTokenByRefreshToken(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        commonRequest: CommonSilentFlowRequest,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        silentRequest: SilentRequest
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    addEventCallback(callback: EventCallbackFunction): string | null {
+        return this.eventHandler.addEventCallback(callback);
+    }
+    removeEventCallback(callbackId: string): void {
+        this.eventHandler.removeEventCallback(callbackId);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    addPerformanceCallback(callback: PerformanceCallbackFunction): string {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return "";
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    removePerformanceCallback(callbackId: string): boolean {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return true;
+    }
+    enableAccountStorageEvents(): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+    disableAccountStorageEvents(): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+
+    handleRedirectPromise(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        hash?: string | undefined
+    ): Promise<AuthenticationResult | null> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        return Promise.resolve(null);
+    }
+    loginPopup(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request?: PopupRequest | undefined
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    loginRedirect(request?: RedirectRequest | undefined): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<void>;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    logout(logoutRequest?: EndSessionRequest | undefined): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<void>;
+    }
+    logoutRedirect(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        logoutRequest?: EndSessionRequest | undefined
+    ): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<void>;
+    }
+    logoutPopup(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        logoutRequest?: EndSessionPopupRequest | undefined
+    ): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<void>;
+    }
+    ssoSilent(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request: Partial<
+            Omit<
+                CommonAuthorizationUrlRequest,
+                | "responseMode"
+                | "codeChallenge"
+                | "codeChallengeMethod"
+                | "requestedClaimsHash"
+                | "nativeBroker"
+            >
+        >
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    getTokenCache(): ITokenCache {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as ITokenCache;
+    }
+    getLogger(): Logger {
+        return this.logger;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    setLogger(logger: Logger): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    setActiveAccount(account: AccountInfo | null): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+    getActiveAccount(): AccountInfo | null {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return null;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    initializeWrapperLibrary(sku: WrapperSKU, version: string): void {
+        this.browserStorage.setWrapperMetadata(sku, version);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    setNavigationClient(navigationClient: INavigationClient): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+    getConfiguration(): BrowserConfiguration {
+        return this.config;
+    }
+    isBrowserEnv(): boolean {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return true;
+    }
+    getBrowserCrypto(): ICrypto {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as ICrypto;
+    }
+    getPerformanceClient(): IPerformanceClient {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as IPerformanceClient;
+    }
+    getRedirectResponse(): Map<string, Promise<AuthenticationResult | null>> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Map<string, Promise<AuthenticationResult | null>>;
+    }
+    preflightBrowserEnvironmentCheck(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        interactionType: InteractionType,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        isAppEmbedded?: boolean | undefined
+    ): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    async clearCache(logoutRequest?: ClearCacheRequest): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    async hydrateCache(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        result: AuthenticationResult,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request:
+            | SilentRequest
+            | SsoSilentRequest
+            | RedirectRequest
+            | PopupRequest
+    ): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+}

package/src/crypto/BrowserCrypto.ts

@@ -3,14 +3,22 @@
  * Licensed under the MIT License.
  */
 
-import { BrowserStringUtils } from "../utils/BrowserStringUtils";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
-import { ISubtleCrypto } from "./ISubtleCrypto";
-import { ModernBrowserCrypto } from "./ModernBrowserCrypto";
-import { Logger } from "@azure/msal-common";
+import {
+    IPerformanceClient,
+    Logger,
+    PerformanceEvents,
+} from "@azure/msal-common";
+import { KEY_FORMAT_JWK } from "../utils/BrowserConstants";
+
+/**
+ * This file defines functions used by the browser library to perform cryptography operations such as
+ * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
+ */
+
 /**
  * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
  */
@@ -23,113 +31,121 @@ const MODULUS_LENGTH = 2048;
 // Public Exponent
 const PUBLIC_EXPONENT: Uint8Array = new Uint8Array([0x01, 0x00, 0x01]);
 
+const keygenAlgorithmOptions: RsaHashedKeyGenParams = {
+    name: PKCS1_V15_KEYGEN_ALG,
+    hash: S256_HASH_ALG,
+    modulusLength: MODULUS_LENGTH,
+    publicExponent: PUBLIC_EXPONENT,
+};
+
 /**
- * This class implements functions used by the browser library to perform cryptography operations such as
- * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
+ * Check whether browser crypto is available.
  */
-export class BrowserCrypto {
-    private keygenAlgorithmOptions: RsaHashedKeyGenParams;
-    private subtleCrypto: ISubtleCrypto;
-    private logger: Logger;
-
-    constructor(logger: Logger) {
-        this.logger = logger;
-
-        if (this.hasBrowserCrypto()) {
-            // Use standard modern web crypto if available
-            this.logger.verbose(
-                "BrowserCrypto: modern crypto interface available"
-            );
-            this.subtleCrypto = new ModernBrowserCrypto();
-        } else {
-            this.logger.error("BrowserCrypto: crypto interface is unavailable");
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.cryptoNonExistent
-            );
-        }
-
-        this.keygenAlgorithmOptions = {
-            name: PKCS1_V15_KEYGEN_ALG,
-            hash: S256_HASH_ALG,
-            modulusLength: MODULUS_LENGTH,
-            publicExponent: PUBLIC_EXPONENT,
-        };
+export function validateCryptoAvailable(logger: Logger): void {
+    if ("crypto" in window) {
+        logger.verbose("BrowserCrypto: modern crypto interface available");
+    } else {
+        logger.error("BrowserCrypto: crypto interface is unavailable");
+        throw createBrowserAuthError(BrowserAuthErrorCodes.cryptoNonExistent);
     }
+}
 
-    /**
-     * Check whether browser crypto is available.
-     */
-    private hasBrowserCrypto(): boolean {
-        return "crypto" in window;
-    }
+/**
+ * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
+ * @param dataString
+ */
+export async function sha256Digest(
+    dataString: string,
+    performanceClient?: IPerformanceClient,
+    correlationId?: string
+): Promise<ArrayBuffer> {
+    performanceClient?.addQueueMeasurement(
+        PerformanceEvents.Sha256Digest,
+        correlationId
+    );
+    const encoder = new TextEncoder();
+    const data = encoder.encode(dataString);
+    return window.crypto.subtle.digest(
+        S256_HASH_ALG,
+        data
+    ) as Promise<ArrayBuffer>;
+}
 
-    /**
-     * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
-     * @param dataString
-     */
-    async sha256Digest(dataString: string): Promise<ArrayBuffer> {
-        const data = BrowserStringUtils.stringToUtf8Arr(dataString);
-        // MSR Crypto wants object with name property, instead of string
-        return this.subtleCrypto.digest({ name: S256_HASH_ALG }, data);
-    }
+/**
+ * Populates buffer with cryptographically random values.
+ * @param dataBuffer
+ */
+export function getRandomValues(dataBuffer: Uint8Array): Uint8Array {
+    return window.crypto.getRandomValues(dataBuffer);
+}
 
-    /**
-     * Populates buffer with cryptographically random values.
-     * @param dataBuffer
-     */
-    getRandomValues(dataBuffer: Uint8Array): Uint8Array {
-        return this.subtleCrypto.getRandomValues(dataBuffer);
-    }
+/**
+ * Creates a new random GUID
+ * @returns
+ */
+export function createNewGuid(): string {
+    return window.crypto.randomUUID();
+}
 
-    /**
-     * Generates a keypair based on current keygen algorithm config.
-     * @param extractable
-     * @param usages
-     */
-    async generateKeyPair(
-        extractable: boolean,
-        usages: Array<KeyUsage>
-    ): Promise<CryptoKeyPair> {
-        return this.subtleCrypto.generateKey(
-            this.keygenAlgorithmOptions,
-            extractable,
-            usages
-        );
-    }
+/**
+ * Generates a keypair based on current keygen algorithm config.
+ * @param extractable
+ * @param usages
+ */
+export async function generateKeyPair(
+    extractable: boolean,
+    usages: Array<KeyUsage>
+): Promise<CryptoKeyPair> {
+    return window.crypto.subtle.generateKey(
+        keygenAlgorithmOptions,
+        extractable,
+        usages
+    ) as Promise<CryptoKeyPair>;
+}
 
-    /**
-     * Export key as Json Web Key (JWK)
-     * @param key
-     */
-    async exportJwk(key: CryptoKey): Promise<JsonWebKey> {
-        return this.subtleCrypto.exportKey(key);
-    }
+/**
+ * Export key as Json Web Key (JWK)
+ * @param key
+ */
+export async function exportJwk(key: CryptoKey): Promise<JsonWebKey> {
+    return window.crypto.subtle.exportKey(
+        KEY_FORMAT_JWK,
+        key
+    ) as Promise<JsonWebKey>;
+}
 
-    /**
-     * Imports key as Json Web Key (JWK), can set extractable and usages.
-     * @param key
-     * @param extractable
-     * @param usages
-     */
-    async importJwk(
-        key: JsonWebKey,
-        extractable: boolean,
-        usages: Array<KeyUsage>
-    ): Promise<CryptoKey> {
-        return this.subtleCrypto.importKey(
-            key,
-            this.keygenAlgorithmOptions,
-            extractable,
-            usages
-        );
-    }
+/**
+ * Imports key as Json Web Key (JWK), can set extractable and usages.
+ * @param key
+ * @param extractable
+ * @param usages
+ */
+export async function importJwk(
+    key: JsonWebKey,
+    extractable: boolean,
+    usages: Array<KeyUsage>
+): Promise<CryptoKey> {
+    return window.crypto.subtle.importKey(
+        KEY_FORMAT_JWK,
+        key,
+        keygenAlgorithmOptions,
+        extractable,
+        usages
+    ) as Promise<CryptoKey>;
+}
 
-    /**
-     * Signs given data with given key
-     * @param key
-     * @param data
-     */
-    async sign(key: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer> {
-        return this.subtleCrypto.sign(this.keygenAlgorithmOptions, key, data);
-    }
+/**
+ * Signs given data with given key
+ * @param key
+ * @param data
+ */
+export async function sign(
+    key: CryptoKey,
+    data: ArrayBuffer
+): Promise<ArrayBuffer> {
+    return window.crypto.subtle.sign(
+        keygenAlgorithmOptions,
+        key,
+        data
+    ) as Promise<ArrayBuffer>;
 }