@azure/msal-browser 3.13.0 → 3.14.0

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "3.13.0",
+  "version": "3.14.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",
@@ -101,6 +101,6 @@
     "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@azure/msal-common": "14.9.0"
+    "@azure/msal-common": "14.10.0"
   }
 }

package/src/app/IPublicClientApplication.ts

@@ -4,6 +4,7 @@
  */
 
 import {
+    AccountFilter,
     AccountInfo,
     Logger,
     PerformanceCallbackFunction,
@@ -43,6 +44,7 @@ export interface IPublicClientApplication {
     removePerformanceCallback(callbackId: string): boolean;
     enableAccountStorageEvents(): void;
     disableAccountStorageEvents(): void;
+    getAccount(accountFilter: AccountFilter): AccountInfo | null;
     getAccountByHomeId(homeAccountId: string): AccountInfo | null;
     getAccountByLocalId(localId: string): AccountInfo | null;
     getAccountByUsername(userName: string): AccountInfo | null;
@@ -113,6 +115,9 @@ export const stubbedPublicClientApplication: IPublicClientApplication = {
     getAllAccounts: () => {
         return [];
     },
+    getAccount: () => {
+        return null;
+    },
     getAccountByHomeId: () => {
         return null;
     },

package/src/controllers/ControllerFactory.ts

@@ -29,10 +29,7 @@ export async function createController(
 
     await Promise.all(operatingContexts);
 
-    if (
-        teamsApp.isAvailable() &&
-        teamsApp.getConfig().auth.supportsNestedAppAuth
-    ) {
+    if (teamsApp.isAvailable()) {
         const controller = await import("./NestedAppAuthController");
         return controller.NestedAppAuthController.createController(teamsApp);
     } else if (standard.isAvailable()) {

package/src/controllers/StandardController.ts

@@ -84,6 +84,22 @@ import { ClearCacheRequest } from "../request/ClearCacheRequest";
 import { createNewGuid } from "../crypto/BrowserCrypto";
 import { initializeSilentRequest } from "../request/RequestHelpers";
 
+function getAccountType(
+    account?: AccountInfo
+): "AAD" | "MSA" | "B2C" | undefined {
+    const idTokenClaims = account?.idTokenClaims;
+    if (idTokenClaims?.tfp || idTokenClaims?.acr) {
+        return "B2C";
+    }
+
+    if (!idTokenClaims?.tid) {
+        return undefined;
+    } else if (idTokenClaims?.tid === "9188040d-6c67-4c5b-b112-36a304b66dad") {
+        return "MSA";
+    }
+    return "AAD";
+}
+
 export class StandardController implements IController {
     // OperatingContext
     protected readonly operatingContext: StandardOperatingContext;
@@ -142,7 +158,7 @@ export class StandardController implements IController {
     >;
 
     // Active Iframe request
-    private activeIframeRequest: [Promise<void>, string] | undefined;
+    private activeIframeRequest: [Promise<boolean>, string] | undefined;
 
     private ssoSilentMeasurement?: InProgressPerformanceEvent;
     private acquireTokenByCodeAsyncMeasurement?: InProgressPerformanceEvent;
@@ -439,11 +455,7 @@ export class StandardController implements IController {
                 this.logger,
                 this.performanceClient,
                 rootMeasurement.event.correlationId
-            )(
-                hash,
-                this.performanceClient,
-                rootMeasurement.event.correlationId
-            );
+            )(hash, rootMeasurement);
         }
 
         return redirectResponse
@@ -472,13 +484,26 @@ export class StandardController implements IController {
                             "handleRedirectResponse returned result, acquire token success"
                         );
                     }
-                    rootMeasurement.end({ success: true });
+                    rootMeasurement.end({
+                        success: true,
+                        accountType: getAccountType(result.account),
+                    });
+                } else {
+                    /*
+                     * Instrument an event only if an error code is set. Otherwise, discard it when the redirect response
+                     * is empty and the error code is missing.
+                     */
+                    if (rootMeasurement.event.errorCode) {
+                        rootMeasurement.end({ success: false });
+                    } else {
+                        rootMeasurement.discard();
+                    }
                 }
+
                 this.eventHandler.emitEvent(
                     EventType.HANDLE_REDIRECT_END,
                     InteractionType.Redirect
                 );
-                rootMeasurement.end({ success: false });
 
                 return result;
             })
@@ -631,6 +656,11 @@ export class StandardController implements IController {
             correlationId
         );
 
+        atPopupMeasurement.add({
+            scenarioId: request.scenarioId,
+            accountType: getAccountType(request.account),
+        });
+
         try {
             this.logger.verbose("acquireTokenPopup called", correlationId);
             BrowserUtils.preflightCheck(this.initialized);
@@ -672,6 +702,7 @@ export class StandardController implements IController {
                         success: true,
                         isNativeBroker: true,
                         requestId: response.requestId,
+                        accountType: getAccountType(response.account),
                     });
                     return response;
                 })
@@ -721,13 +752,12 @@ export class StandardController implements IController {
                     );
                 }
 
-                atPopupMeasurement.add({
-                    accessTokenSize: result.accessToken.length,
-                    idTokenSize: result.idToken.length,
-                });
                 atPopupMeasurement.end({
                     success: true,
                     requestId: result.requestId,
+                    accessTokenSize: result.accessToken.length,
+                    idTokenSize: result.idToken.length,
+                    accountType: getAccountType(result.account),
                 });
                 return result;
             })
@@ -811,6 +841,11 @@ export class StandardController implements IController {
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
         });
+        this.ssoSilentMeasurement?.add({
+            scenarioId: request.scenarioId,
+            accountType: getAccountType(request.account),
+        });
+
         document.addEventListener(
             "visibilitychange",
             this.trackPageVisibilityWithMeasurement
@@ -853,14 +888,13 @@ export class StandardController implements IController {
                     InteractionType.Silent,
                     response
                 );
-                this.ssoSilentMeasurement?.add({
-                    accessTokenSize: response.accessToken.length,
-                    idTokenSize: response.idToken.length,
-                });
                 this.ssoSilentMeasurement?.end({
                     success: true,
                     isNativeBroker: response.fromNativeBroker,
                     requestId: response.requestId,
+                    accessTokenSize: response.accessToken.length,
+                    idTokenSize: response.idToken.length,
+                    accountType: getAccountType(response.account),
                 });
                 return response;
             })
@@ -912,6 +946,7 @@ export class StandardController implements IController {
             PerformanceEvents.AcquireTokenByCode,
             correlationId
         );
+        atbcMeasurement.add({ scenarioId: request.scenarioId });
 
         try {
             if (request.code && request.nativeAccountId) {
@@ -938,14 +973,13 @@ export class StandardController implements IController {
                                 result
                             );
                             this.hybridAuthCodeResponses.delete(hybridAuthCode);
-                            atbcMeasurement.add({
-                                accessTokenSize: result.accessToken.length,
-                                idTokenSize: result.idToken.length,
-                            });
                             atbcMeasurement.end({
                                 success: true,
                                 isNativeBroker: result.fromNativeBroker,
                                 requestId: result.requestId,
+                                accessTokenSize: result.accessToken.length,
+                                idTokenSize: result.idToken.length,
+                                accountType: getAccountType(result.account),
                             });
                             return result;
                         })
@@ -976,7 +1010,7 @@ export class StandardController implements IController {
                 return await response;
             } else if (request.nativeAccountId) {
                 if (this.canUseNative(request, request.nativeAccountId)) {
-                    return await this.acquireTokenNative(
+                    const result = await this.acquireTokenNative(
                         {
                             ...request,
                             correlationId,
@@ -993,6 +1027,11 @@ export class StandardController implements IController {
                         }
                         throw e;
                     });
+                    atbcMeasurement.end({
+                        accountType: getAccountType(result.account),
+                        success: true,
+                    });
+                    return result;
                 } else {
                     throw createBrowserAuthError(
                         BrowserAuthErrorCodes.unableToAcquireTokenFromNativePlatform
@@ -1856,6 +1895,7 @@ export class StandardController implements IController {
         );
         atsMeasurement.add({
             cacheLookupPolicy: request.cacheLookupPolicy,
+            scenarioId: request.scenarioId,
         });
 
         BrowserUtils.preflightCheck(this.initialized);
@@ -1865,6 +1905,7 @@ export class StandardController implements IController {
         if (!account) {
             throw createBrowserAuthError(BrowserAuthErrorCodes.noAccountError);
         }
+        atsMeasurement.add({ accountType: getAccountType(account) });
 
         const thumbprint: RequestThumbprint = {
             clientId: this.config.auth.clientId,
@@ -1904,16 +1945,14 @@ export class StandardController implements IController {
             )
                 .then((result) => {
                     this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.add({
-                        accessTokenSize: result.accessToken.length,
-                        idTokenSize: result.idToken.length,
-                    });
                     atsMeasurement.end({
                         success: true,
                         fromCache: result.fromCache,
                         isNativeBroker: result.fromNativeBroker,
                         cacheLookupPolicy: request.cacheLookupPolicy,
                         requestId: result.requestId,
+                        accessTokenSize: result.accessToken.length,
+                        idTokenSize: result.idToken.length,
                     });
                     return result;
                 })
@@ -2000,13 +2039,11 @@ export class StandardController implements IController {
 
             if (shouldTryToResolveSilently) {
                 if (!this.activeIframeRequest) {
-                    let _resolve: () => void,
-                        _reject: (reason?: AuthError | Error) => void;
+                    let _resolve: (result: boolean) => void;
                     // Always set the active request tracker immediately after checking it to prevent races
                     this.activeIframeRequest = [
-                        new Promise((resolve, reject) => {
+                        new Promise((resolve) => {
                             _resolve = resolve;
-                            _reject = reject;
                         }),
                         silentRequest.correlationId,
                     ];
@@ -2022,11 +2059,11 @@ export class StandardController implements IController {
                         silentRequest.correlationId
                     )(silentRequest)
                         .then((iframeResult) => {
-                            _resolve();
+                            _resolve(true);
                             return iframeResult;
                         })
                         .catch((e) => {
-                            _reject(e);
+                            _resolve(false);
                             throw e;
                         })
                         .finally(() => {
@@ -2048,20 +2085,11 @@ export class StandardController implements IController {
                         awaitIframeCorrelationId: activeCorrelationId,
                     });
 
-                    // Await for errors first so we can distinguish errors thrown by activePromise versus errors thrown by .then below
-                    await activePromise.catch(() => {
-                        awaitConcurrentIframeMeasure.end({
-                            success: false,
-                        });
-                        this.logger.info(
-                            `Iframe request with correlationId: ${activeCorrelationId} failed. Interaction is required.`
-                        );
-                        // If previous iframe request failed, it's unlikely to succeed this time. Throw original error.
-                        throw refreshTokenError;
+                    const activePromiseResult = await activePromise;
+                    awaitConcurrentIframeMeasure.end({
+                        success: activePromiseResult,
                     });
-
-                    return activePromise.then(() => {
-                        awaitConcurrentIframeMeasure.end({ success: true });
+                    if (activePromiseResult) {
                         this.logger.verbose(
                             `Parallel iframe request with correlationId: ${activeCorrelationId} succeeded. Retrying cache and/or RT redemption`,
                             silentRequest.correlationId
@@ -2071,7 +2099,13 @@ export class StandardController implements IController {
                             silentRequest,
                             cacheLookupPolicy
                         );
-                    });
+                    } else {
+                        this.logger.info(
+                            `Iframe request with correlationId: ${activeCorrelationId} failed. Interaction is required.`
+                        );
+                        // If previous iframe request failed, it's unlikely to succeed this time. Throw original error.
+                        throw refreshTokenError;
+                    }
                 } else {
                     // Cache policy set to skip and another iframe request is already in progress
                     this.logger.warning(

package/src/interaction_client/RedirectClient.ts

@@ -21,6 +21,7 @@ import {
     invokeAsync,
     ServerResponseType,
     UrlUtils,
+    InProgressPerformanceEvent,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import {
@@ -190,14 +191,12 @@ export class RedirectClient extends StandardInteractionClient {
      * Checks if navigateToLoginRequestUrl is set, and:
      * - if true, performs logic to cache and navigate
      * - if false, handles hash string and parses response
-     * @param hash {string?} url hash
-     * @param performanceClient {IPerformanceClient?}
-     * @param correlationId {string?} correlation identifier
+     * @param hash {string} url hash
+     * @param parentMeasurement {InProgressPerformanceEvent} parent measurement
      */
     async handleRedirectPromise(
-        hash?: string,
-        performanceClient?: IPerformanceClient,
-        correlationId?: string
+        hash: string = "",
+        parentMeasurement: InProgressPerformanceEvent
     ): Promise<AuthenticationResult | null> {
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             ApiId.handleRedirectPromise
@@ -220,12 +219,7 @@ export class RedirectClient extends StandardInteractionClient {
                 this.browserStorage.cleanRequestByInteractionType(
                     InteractionType.Redirect
                 );
-                if (performanceClient && correlationId) {
-                    performanceClient?.addFields(
-                        { errorCode: "no_server_response" },
-                        correlationId
-                    );
-                }
+                parentMeasurement.event.errorCode = "no_server_response";
                 return null;
             }
 

package/src/operatingcontext/TeamsAppOperatingContext.ts

@@ -61,6 +61,11 @@ export class TeamsAppOperatingContext extends BaseOperatingContext {
          * TODO: Add implementation to check for presence of inject Nested App Auth Bridge JavaScript interface
          *
          */
+
+        if (!this.getConfig().auth.supportsNestedAppAuth) {
+            return false;
+        }
+
         try {
             if (typeof window !== "undefined") {
                 const bridgeProxy: IBridgeProxy = await BridgeProxy.create();
@@ -74,18 +79,19 @@ export class TeamsAppOperatingContext extends BaseOperatingContext {
                         this.activeAccount =
                             await bridgeProxy.getActiveAccount();
                     }
-                } catch (e) {
-                    this.activeAccount = undefined;
+                } catch {
+                    // Ignore errors
                 }
                 this.bridgeProxy = bridgeProxy;
                 this.available = bridgeProxy !== undefined;
-            } else {
-                this.available = false;
             }
-        } catch (e) {
-            this.available = false;
-        } finally {
-            return this.available;
+        } catch (ex) {
+            this.logger.infoPii(
+                `Could not initialize Nested App Auth bridge (${ex})`
+            );
         }
+
+        this.logger.info(`Nested App Auth Bridge available: ${this.available}`);
+        return this.available;
     }
 }

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.13.0";
+export const version = "3.14.0";

package/src/utils/BrowserUtils.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { UrlString } from "@azure/msal-common";
+import { UrlString, invoke, invokeAsync } from "@azure/msal-common";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -206,3 +206,6 @@ export function preconnect(authority: string): void {
 export function createGuid(): string {
     return BrowserCrypto.createNewGuid();
 }
+
+export { invoke };
+export { invokeAsync };