@azure/msal-browser 3.1.0 → 3.3.0

package/src/crypto/CryptoOps.ts

@@ -9,15 +9,12 @@ import {
     JoseHeader,
     Logger,
     PerformanceEvents,
-    PkceCodes,
     SignedHttpRequest,
     SignedHttpRequestParameters,
 } from "@azure/msal-common";
 import { base64Encode, urlEncode, urlEncodeArr } from "../encode/Base64Encode";
 import { base64Decode } from "../encode/Base64Decode";
-import { PkceGenerator } from "./PkceGenerator";
-import { BrowserCrypto } from "./BrowserCrypto";
-import { BrowserStringUtils } from "../utils/BrowserStringUtils";
+import * as BrowserCrypto from "./BrowserCrypto";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -36,8 +33,6 @@ export type CachedKeyPair = {
  * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
  */
 export class CryptoOps implements ICrypto {
-    private browserCrypto: BrowserCrypto;
-    private pkceGenerator: PkceGenerator;
     private logger: Logger;
 
     /**
@@ -53,8 +48,7 @@ export class CryptoOps implements ICrypto {
     constructor(logger: Logger, performanceClient?: IPerformanceClient) {
         this.logger = logger;
         // Browser crypto needs to be validated first before any other classes can be set.
-        this.browserCrypto = new BrowserCrypto(this.logger);
-        this.pkceGenerator = new PkceGenerator(this.browserCrypto);
+        BrowserCrypto.validateCryptoAvailable(logger);
         this.cache = new CryptoKeyStore(this.logger);
         this.performanceClient = performanceClient;
     }
@@ -64,7 +58,7 @@ export class CryptoOps implements ICrypto {
      * @returns string (GUID)
      */
     createNewGuid(): string {
-        return window.crypto.randomUUID();
+        return BrowserCrypto.createNewGuid();
     }
 
     /**
@@ -83,13 +77,6 @@ export class CryptoOps implements ICrypto {
         return base64Decode(input);
     }
 
-    /**
-     * Generates PKCE codes used in Authorization Code Flow.
-     */
-    async generatePkceCodes(): Promise<PkceCodes> {
-        return this.pkceGenerator.generateCodes();
-    }
-
     /**
      * Generates a keypair, stores it and returns a thumbprint
      * @param request
@@ -104,13 +91,13 @@ export class CryptoOps implements ICrypto {
             );
 
         // Generate Keypair
-        const keyPair: CryptoKeyPair = await this.browserCrypto.generateKeyPair(
+        const keyPair: CryptoKeyPair = await BrowserCrypto.generateKeyPair(
             CryptoOps.EXTRACTABLE,
             CryptoOps.POP_KEY_USAGES
         );
 
         // Generate Thumbprint for Public Key
-        const publicKeyJwk: JsonWebKey = await this.browserCrypto.exportJwk(
+        const publicKeyJwk: JsonWebKey = await BrowserCrypto.exportJwk(
             keyPair.publicKey
         );
 
@@ -121,16 +108,16 @@ export class CryptoOps implements ICrypto {
         };
 
         const publicJwkString: string =
-            BrowserStringUtils.getSortedObjectString(pubKeyThumprintObj);
+            getSortedObjectString(pubKeyThumprintObj);
         const publicJwkHash = await this.hashString(publicJwkString);
 
         // Generate Thumbprint for Private Key
-        const privateKeyJwk: JsonWebKey = await this.browserCrypto.exportJwk(
+        const privateKeyJwk: JsonWebKey = await BrowserCrypto.exportJwk(
             keyPair.privateKey
         );
         // Re-import private key to make it unextractable
         const unextractablePrivateKey: CryptoKey =
-            await this.browserCrypto.importJwk(privateKeyJwk, false, ["sign"]);
+            await BrowserCrypto.importJwk(privateKeyJwk, false, ["sign"]);
 
         // Store Keypair data in keystore
         await this.cache.asymmetricKeys.setItem(publicJwkHash, {
@@ -189,11 +176,10 @@ export class CryptoOps implements ICrypto {
         }
 
         // Get public key as JWK
-        const publicKeyJwk = await this.browserCrypto.exportJwk(
+        const publicKeyJwk = await BrowserCrypto.exportJwk(
             cachedKeyPair.publicKey
         );
-        const publicKeyJwkString =
-            BrowserStringUtils.getSortedObjectString(publicKeyJwk);
+        const publicKeyJwkString = getSortedObjectString(publicKeyJwk);
 
         // Base64URL encode public key thumbprint with keyId only: BASE64URL({ kid: "FULL_PUBLIC_KEY_HASH" })
         const encodedKeyIdThumbprint = urlEncode(JSON.stringify({ kid: kid }));
@@ -215,8 +201,9 @@ export class CryptoOps implements ICrypto {
         const tokenString = `${encodedShrHeader}.${encodedPayload}`;
 
         // Sign token
-        const tokenBuffer = BrowserStringUtils.stringToUtf8Arr(tokenString);
-        const signatureBuffer = await this.browserCrypto.sign(
+        const encoder = new TextEncoder();
+        const tokenBuffer = encoder.encode(tokenString);
+        const signatureBuffer = await BrowserCrypto.sign(
             cachedKeyPair.privateKey,
             tokenBuffer
         );
@@ -238,10 +225,14 @@ export class CryptoOps implements ICrypto {
      * @param plainText
      */
     async hashString(plainText: string): Promise<string> {
-        const hashBuffer: ArrayBuffer = await this.browserCrypto.sha256Digest(
+        const hashBuffer: ArrayBuffer = await BrowserCrypto.sha256Digest(
             plainText
         );
         const hashBytes = new Uint8Array(hashBuffer);
         return urlEncodeArr(hashBytes);
     }
 }
+
+function getSortedObjectString(obj: object): string {
+    return JSON.stringify(obj, Object.keys(obj).sort());
+}

package/src/crypto/PkceGenerator.ts

@@ -3,74 +3,113 @@
  * Licensed under the MIT License.
  */
 
-import { PkceCodes } from "@azure/msal-common";
+import {
+    IPerformanceClient,
+    Logger,
+    PerformanceEvents,
+    PkceCodes,
+    invoke,
+    invokeAsync,
+} from "@azure/msal-common";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
 import { urlEncodeArr } from "../encode/Base64Encode";
-import { BrowserCrypto } from "./BrowserCrypto";
+import { getRandomValues, sha256Digest } from "./BrowserCrypto";
 
 // Constant byte array length
 const RANDOM_BYTE_ARR_LENGTH = 32;
 
 /**
- * Class which exposes APIs to generate PKCE codes and code verifiers.
+ * This file defines APIs to generate PKCE codes and code verifiers.
  */
-export class PkceGenerator {
-    private cryptoObj: BrowserCrypto;
-
-    constructor(cryptoObj: BrowserCrypto) {
-        this.cryptoObj = cryptoObj;
-    }
 
-    /**
-     * Generates PKCE Codes. See the RFC for more information: https://tools.ietf.org/html/rfc7636
-     */
-    async generateCodes(): Promise<PkceCodes> {
-        const codeVerifier = this.generateCodeVerifier();
-        const codeChallenge = await this.generateCodeChallengeFromVerifier(
-            codeVerifier
-        );
-        return {
-            verifier: codeVerifier,
-            challenge: codeChallenge,
-        };
-    }
+/**
+ * Generates PKCE Codes. See the RFC for more information: https://tools.ietf.org/html/rfc7636
+ */
+export async function generatePkceCodes(
+    performanceClient: IPerformanceClient,
+    logger: Logger,
+    correlationId: string
+): Promise<PkceCodes> {
+    performanceClient.addQueueMeasurement(
+        PerformanceEvents.GeneratePkceCodes,
+        correlationId
+    );
+    const codeVerifier = invoke(
+        generateCodeVerifier,
+        PerformanceEvents.GenerateCodeVerifier,
+        logger,
+        performanceClient,
+        correlationId
+    )(performanceClient, logger, correlationId);
+    const codeChallenge = await invokeAsync(
+        generateCodeChallengeFromVerifier,
+        PerformanceEvents.GenerateCodeChallengeFromVerifier,
+        logger,
+        performanceClient,
+        correlationId
+    )(codeVerifier, performanceClient, logger, correlationId);
+    return {
+        verifier: codeVerifier,
+        challenge: codeChallenge,
+    };
+}
 
-    /**
-     * Generates a random 32 byte buffer and returns the base64
-     * encoded string to be used as a PKCE Code Verifier
-     */
-    private generateCodeVerifier(): string {
-        try {
-            // Generate random values as utf-8
-            const buffer: Uint8Array = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
-            this.cryptoObj.getRandomValues(buffer);
-            // encode verifier as base64
-            const pkceCodeVerifierB64: string = urlEncodeArr(buffer);
-            return pkceCodeVerifierB64;
-        } catch (e) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.pkceNotCreated);
-        }
+/**
+ * Generates a random 32 byte buffer and returns the base64
+ * encoded string to be used as a PKCE Code Verifier
+ */
+function generateCodeVerifier(
+    performanceClient: IPerformanceClient,
+    logger: Logger,
+    correlationId: string
+): string {
+    try {
+        // Generate random values as utf-8
+        const buffer: Uint8Array = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
+        invoke(
+            getRandomValues,
+            PerformanceEvents.GetRandomValues,
+            logger,
+            performanceClient,
+            correlationId
+        )(buffer);
+        // encode verifier as base64
+        const pkceCodeVerifierB64: string = urlEncodeArr(buffer);
+        return pkceCodeVerifierB64;
+    } catch (e) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.pkceNotCreated);
     }
+}
 
-    /**
-     * Creates a base64 encoded PKCE Code Challenge string from the
-     * hash created from the PKCE Code Verifier supplied
-     */
-    private async generateCodeChallengeFromVerifier(
-        pkceCodeVerifier: string
-    ): Promise<string> {
-        try {
-            // hashed verifier
-            const pkceHashedCodeVerifier = await this.cryptoObj.sha256Digest(
-                pkceCodeVerifier
-            );
-            // encode hash as base64
-            return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
-        } catch (e) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.pkceNotCreated);
-        }
+/**
+ * Creates a base64 encoded PKCE Code Challenge string from the
+ * hash created from the PKCE Code Verifier supplied
+ */
+async function generateCodeChallengeFromVerifier(
+    pkceCodeVerifier: string,
+    performanceClient: IPerformanceClient,
+    logger: Logger,
+    correlationId: string
+): Promise<string> {
+    performanceClient.addQueueMeasurement(
+        PerformanceEvents.GenerateCodeChallengeFromVerifier,
+        correlationId
+    );
+    try {
+        // hashed verifier
+        const pkceHashedCodeVerifier = await invokeAsync(
+            sha256Digest,
+            PerformanceEvents.Sha256Digest,
+            logger,
+            performanceClient,
+            correlationId
+        )(pkceCodeVerifier, performanceClient, correlationId);
+        // encode hash as base64
+        return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
+    } catch (e) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.pkceNotCreated);
     }
 }

package/src/encode/Base64Decode.ts

@@ -3,6 +3,11 @@
  * Licensed under the MIT License.
  */
 
+import {
+    BrowserAuthErrorCodes,
+    createBrowserAuthError,
+} from "../error/BrowserAuthError";
+
 /**
  * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
  * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
@@ -21,6 +26,21 @@ export function base64Decode(input: string): string {
  * @param base64String
  */
 function base64DecToArr(base64String: string): Uint8Array {
-    const binString = atob(base64String);
+    let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
+    switch (encodedString.length % 4) {
+        case 0:
+            break;
+        case 2:
+            encodedString += "==";
+            break;
+        case 3:
+            encodedString += "=";
+            break;
+        default:
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.invalidBase64String
+            );
+    }
+    const binString = atob(encodedString);
     return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
 }

package/src/error/BrowserAuthError.ts

@@ -88,11 +88,17 @@ export const BrowserAuthErrorMessages = {
     [BrowserAuthErrorCodes.uninitializedPublicClientApplication]: `You must call and await the initialize function before attempting to call any other MSAL API.  ${ErrorLink}`,
     [BrowserAuthErrorCodes.nativePromptNotSupported]:
         "The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",
+    [BrowserAuthErrorCodes.invalidBase64String]:
+        "Invalid base64 encoded string.",
 };
 
 /**
  * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
- * @deprecated Use BrowserAuthBrowserAuthErrorCodes instead
+ * @deprecated Use exported BrowserAuthErrorCodes instead.
+ * In your app you can do :
+ * ```
+ * import { BrowserAuthErrorCodes } from "@azure/msal-browser";
+ * ```
  */
 export const BrowserAuthErrorMessage = {
     pkceNotGenerated: {
@@ -321,6 +327,12 @@ export const BrowserAuthErrorMessage = {
             BrowserAuthErrorCodes.nativePromptNotSupported
         ],
     },
+    invalidBase64StringError: {
+        code: BrowserAuthErrorCodes.invalidBase64String,
+        desc: BrowserAuthErrorMessages[
+            BrowserAuthErrorCodes.invalidBase64String
+        ],
+    },
 };
 
 /**

package/src/error/BrowserAuthErrorCodes.ts

@@ -54,3 +54,4 @@ export const nativeConnectionNotEstablished =
 export const uninitializedPublicClientApplication =
     "uninitialized_public_client_application";
 export const nativePromptNotSupported = "native_prompt_not_supported";
+export const invalidBase64String = "invalid_base64_string";

package/src/error/BrowserConfigurationAuthError.ts

@@ -4,46 +4,41 @@
  */
 
 import { AuthError } from "@azure/msal-common";
+import * as BrowserConfigurationAuthErrorCodes from "./BrowserConfigurationAuthErrorCodes";
+export { BrowserConfigurationAuthErrorCodes };
+
+export const BrowserConfigurationAuthErrorMessages = {
+    [BrowserConfigurationAuthErrorCodes.storageNotSupported]:
+        "Given storage configuration option was not supported.",
+    [BrowserConfigurationAuthErrorCodes.stubbedPublicClientApplicationCalled]:
+        "Stub instance of Public Client Application was called. If using msal-react, please ensure context is not used without a provider. For more visit: aka.ms/msaljs/browser-errors",
+    [BrowserConfigurationAuthErrorCodes.inMemRedirectUnavailable]:
+        "Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true.",
+};
 
 /**
  * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
+ * @deprecated Use BrowserAuthErrorCodes instead
  */
 export const BrowserConfigurationAuthErrorMessage = {
-    redirectUriNotSet: {
-        code: "redirect_uri_empty",
-        desc: "A redirect URI is required for all calls, and none has been set.",
-    },
-    postLogoutUriNotSet: {
-        code: "post_logout_uri_empty",
-        desc: "A post logout redirect has not been set.",
-    },
     storageNotSupportedError: {
-        code: "storage_not_supported",
-        desc: "Given storage configuration option was not supported.",
-    },
-    noRedirectCallbacksSet: {
-        code: "no_redirect_callbacks",
-        desc:
-            "No redirect callbacks have been set. Please call setRedirectCallbacks() with the appropriate function arguments before continuing. " +
-            "More information is available here: https://github.com/AzureAD/microsoft-authentication-library-for-js/wiki/MSAL-basics.",
-    },
-    invalidCallbackObject: {
-        code: "invalid_callback_object",
-        desc:
-            "The object passed for the callback was invalid. " +
-            "More information is available here: https://github.com/AzureAD/microsoft-authentication-library-for-js/wiki/MSAL-basics.",
+        code: BrowserConfigurationAuthErrorCodes.storageNotSupported,
+        desc: BrowserConfigurationAuthErrorMessages[
+            BrowserConfigurationAuthErrorCodes.storageNotSupported
+        ],
     },
     stubPcaInstanceCalled: {
-        code: "stubbed_public_client_application_called",
-        desc: "Stub instance of Public Client Application was called. If using msal-react, please ensure context is not used without a provider. For more visit: aka.ms/msaljs/browser-errors",
+        code: BrowserConfigurationAuthErrorCodes.stubbedPublicClientApplicationCalled,
+        desc: BrowserConfigurationAuthErrorMessages[
+            BrowserConfigurationAuthErrorCodes
+                .stubbedPublicClientApplicationCalled
+        ],
     },
     inMemRedirectUnavailable: {
-        code: "in_mem_redirect_unavailable",
-        desc: "Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true.",
-    },
-    entropyNotProvided: {
-        code: "entropy_not_provided",
-        desc: "The available browser crypto interface requires entropy set via system.cryptoOptions.entropy configuration option.",
+        code: BrowserConfigurationAuthErrorCodes.inMemRedirectUnavailable,
+        desc: BrowserConfigurationAuthErrorMessages[
+            BrowserConfigurationAuthErrorCodes.inMemRedirectUnavailable
+        ],
     },
 };
 
@@ -57,77 +52,13 @@ export class BrowserConfigurationAuthError extends AuthError {
 
         Object.setPrototypeOf(this, BrowserConfigurationAuthError.prototype);
     }
+}
 
-    /**
-     * Creates an error thrown when the redirect uri is empty (not set by caller)
-     */
-    static createRedirectUriEmptyError(): BrowserConfigurationAuthError {
-        return new BrowserConfigurationAuthError(
-            BrowserConfigurationAuthErrorMessage.redirectUriNotSet.code,
-            BrowserConfigurationAuthErrorMessage.redirectUriNotSet.desc
-        );
-    }
-
-    /**
-     * Creates an error thrown when the post-logout redirect uri is empty (not set by caller)
-     */
-    static createPostLogoutRedirectUriEmptyError(): BrowserConfigurationAuthError {
-        return new BrowserConfigurationAuthError(
-            BrowserConfigurationAuthErrorMessage.postLogoutUriNotSet.code,
-            BrowserConfigurationAuthErrorMessage.postLogoutUriNotSet.desc
-        );
-    }
-
-    /**
-     * Creates error thrown when given storage location is not supported.
-     * @param givenStorageLocation
-     */
-    static createStorageNotSupportedError(
-        givenStorageLocation: string
-    ): BrowserConfigurationAuthError {
-        return new BrowserConfigurationAuthError(
-            BrowserConfigurationAuthErrorMessage.storageNotSupportedError.code,
-            `${BrowserConfigurationAuthErrorMessage.storageNotSupportedError.desc} Given Location: ${givenStorageLocation}`
-        );
-    }
-
-    /**
-     * Creates error thrown when redirect callbacks are not set before calling loginRedirect() or acquireTokenRedirect().
-     */
-    static createRedirectCallbacksNotSetError(): BrowserConfigurationAuthError {
-        return new BrowserConfigurationAuthError(
-            BrowserConfigurationAuthErrorMessage.noRedirectCallbacksSet.code,
-            BrowserConfigurationAuthErrorMessage.noRedirectCallbacksSet.desc
-        );
-    }
-
-    /**
-     * Creates error thrown when the stub instance of PublicClientApplication is called.
-     */
-    static createStubPcaInstanceCalledError(): BrowserConfigurationAuthError {
-        return new BrowserConfigurationAuthError(
-            BrowserConfigurationAuthErrorMessage.stubPcaInstanceCalled.code,
-            BrowserConfigurationAuthErrorMessage.stubPcaInstanceCalled.desc
-        );
-    }
-
-    /*
-     * Create an error thrown when in-memory storage is used and storeAuthStateInCookie=false.
-     */
-    static createInMemoryRedirectUnavailableError(): BrowserConfigurationAuthError {
-        return new BrowserConfigurationAuthError(
-            BrowserConfigurationAuthErrorMessage.inMemRedirectUnavailable.code,
-            BrowserConfigurationAuthErrorMessage.inMemRedirectUnavailable.desc
-        );
-    }
-
-    /**
-     * Creates an error thrown when a crypto interface that requires entropy is initialized without entropy
-     */
-    static createEntropyNotProvided(): BrowserConfigurationAuthError {
-        return new BrowserConfigurationAuthError(
-            BrowserConfigurationAuthErrorMessage.entropyNotProvided.code,
-            BrowserConfigurationAuthErrorMessage.entropyNotProvided.desc
-        );
-    }
+export function createBrowserConfigurationAuthError(
+    errorCode: string
+): BrowserConfigurationAuthError {
+    return new BrowserConfigurationAuthError(
+        errorCode,
+        BrowserConfigurationAuthErrorMessages[errorCode]
+    );
 }

package/src/error/BrowserConfigurationAuthErrorCodes.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const storageNotSupported = "storage_not_supported";
+export const stubbedPublicClientApplicationCalled =
+    "stubbed_public_client_application_called";
+export const inMemRedirectUnavailable = "in_mem_redirect_unavailable";