@azure/msal-browser 3.13.0 → 3.15.0

package/src/controllers/StandardController.ts

@@ -33,6 +33,7 @@ import {
     BrowserCacheManager,
     DEFAULT_BROWSER_CACHE_MANAGER,
 } from "../cache/BrowserCacheManager";
+import * as AccountManager from "../cache/AccountManager";
 import { BrowserConfiguration, CacheOptions } from "../config/Configuration";
 import {
     InteractionType,
@@ -84,6 +85,34 @@ import { ClearCacheRequest } from "../request/ClearCacheRequest";
 import { createNewGuid } from "../crypto/BrowserCrypto";
 import { initializeSilentRequest } from "../request/RequestHelpers";
 
+function getAccountType(
+    account?: AccountInfo
+): "AAD" | "MSA" | "B2C" | undefined {
+    const idTokenClaims = account?.idTokenClaims;
+    if (idTokenClaims?.tfp || idTokenClaims?.acr) {
+        return "B2C";
+    }
+
+    if (!idTokenClaims?.tid) {
+        return undefined;
+    } else if (idTokenClaims?.tid === "9188040d-6c67-4c5b-b112-36a304b66dad") {
+        return "MSA";
+    }
+    return "AAD";
+}
+
+function preflightCheck(
+    initialized: boolean,
+    performanceEvent: InProgressPerformanceEvent
+) {
+    try {
+        BrowserUtils.preflightCheck(initialized);
+    } catch (e) {
+        performanceEvent.end({ success: false }, e);
+        throw e;
+    }
+}
+
 export class StandardController implements IController {
     // OperatingContext
     protected readonly operatingContext: StandardOperatingContext;
@@ -142,7 +171,7 @@ export class StandardController implements IController {
     >;
 
     // Active Iframe request
-    private activeIframeRequest: [Promise<void>, string] | undefined;
+    private activeIframeRequest: [Promise<boolean>, string] | undefined;
 
     private ssoSilentMeasurement?: InProgressPerformanceEvent;
     private acquireTokenByCodeAsyncMeasurement?: InProgressPerformanceEvent;
@@ -439,11 +468,7 @@ export class StandardController implements IController {
                 this.logger,
                 this.performanceClient,
                 rootMeasurement.event.correlationId
-            )(
-                hash,
-                this.performanceClient,
-                rootMeasurement.event.correlationId
-            );
+            )(hash, rootMeasurement);
         }
 
         return redirectResponse
@@ -472,13 +497,26 @@ export class StandardController implements IController {
                             "handleRedirectResponse returned result, acquire token success"
                         );
                     }
-                    rootMeasurement.end({ success: true });
+                    rootMeasurement.end({
+                        success: true,
+                        accountType: getAccountType(result.account),
+                    });
+                } else {
+                    /*
+                     * Instrument an event only if an error code is set. Otherwise, discard it when the redirect response
+                     * is empty and the error code is missing.
+                     */
+                    if (rootMeasurement.event.errorCode) {
+                        rootMeasurement.end({ success: false });
+                    } else {
+                        rootMeasurement.discard();
+                    }
                 }
+
                 this.eventHandler.emitEvent(
                     EventType.HANDLE_REDIRECT_END,
                     InteractionType.Redirect
                 );
-                rootMeasurement.end({ success: false });
 
                 return result;
             })
@@ -631,9 +669,14 @@ export class StandardController implements IController {
             correlationId
         );
 
+        atPopupMeasurement.add({
+            scenarioId: request.scenarioId,
+            accountType: getAccountType(request.account),
+        });
+
         try {
             this.logger.verbose("acquireTokenPopup called", correlationId);
-            BrowserUtils.preflightCheck(this.initialized);
+            preflightCheck(this.initialized, atPopupMeasurement);
             this.browserStorage.setInteractionInProgress(true);
         } catch (e) {
             // Since this function is syncronous we need to reject
@@ -672,6 +715,7 @@ export class StandardController implements IController {
                         success: true,
                         isNativeBroker: true,
                         requestId: response.requestId,
+                        accountType: getAccountType(response.account),
                     });
                     return response;
                 })
@@ -721,13 +765,12 @@ export class StandardController implements IController {
                     );
                 }
 
-                atPopupMeasurement.add({
-                    accessTokenSize: result.accessToken.length,
-                    idTokenSize: result.idToken.length,
-                });
                 atPopupMeasurement.end({
                     success: true,
                     requestId: result.requestId,
+                    accessTokenSize: result.accessToken.length,
+                    idTokenSize: result.idToken.length,
+                    accountType: getAccountType(result.account),
                 });
                 return result;
             })
@@ -803,14 +846,19 @@ export class StandardController implements IController {
             prompt: request.prompt,
             correlationId: correlationId,
         };
-        BrowserUtils.preflightCheck(this.initialized);
         this.ssoSilentMeasurement = this.performanceClient.startMeasurement(
             PerformanceEvents.SsoSilent,
             correlationId
         );
+        this.ssoSilentMeasurement?.add({
+            scenarioId: request.scenarioId,
+            accountType: getAccountType(request.account),
+        });
+        preflightCheck(this.initialized, this.ssoSilentMeasurement);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
         });
+
         document.addEventListener(
             "visibilitychange",
             this.trackPageVisibilityWithMeasurement
@@ -853,14 +901,13 @@ export class StandardController implements IController {
                     InteractionType.Silent,
                     response
                 );
-                this.ssoSilentMeasurement?.add({
-                    accessTokenSize: response.accessToken.length,
-                    idTokenSize: response.idToken.length,
-                });
                 this.ssoSilentMeasurement?.end({
                     success: true,
                     isNativeBroker: response.fromNativeBroker,
                     requestId: response.requestId,
+                    accessTokenSize: response.accessToken.length,
+                    idTokenSize: response.idToken.length,
+                    accountType: getAccountType(response.account),
                 });
                 return response;
             })
@@ -902,16 +949,17 @@ export class StandardController implements IController {
     ): Promise<AuthenticationResult> {
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.trace("acquireTokenByCode called", correlationId);
-        BrowserUtils.preflightCheck(this.initialized);
+        const atbcMeasurement = this.performanceClient.startMeasurement(
+            PerformanceEvents.AcquireTokenByCode,
+            correlationId
+        );
+        preflightCheck(this.initialized, atbcMeasurement);
         this.eventHandler.emitEvent(
             EventType.ACQUIRE_TOKEN_BY_CODE_START,
             InteractionType.Silent,
             request
         );
-        const atbcMeasurement = this.performanceClient.startMeasurement(
-            PerformanceEvents.AcquireTokenByCode,
-            correlationId
-        );
+        atbcMeasurement.add({ scenarioId: request.scenarioId });
 
         try {
             if (request.code && request.nativeAccountId) {
@@ -938,14 +986,13 @@ export class StandardController implements IController {
                                 result
                             );
                             this.hybridAuthCodeResponses.delete(hybridAuthCode);
-                            atbcMeasurement.add({
-                                accessTokenSize: result.accessToken.length,
-                                idTokenSize: result.idToken.length,
-                            });
                             atbcMeasurement.end({
                                 success: true,
                                 isNativeBroker: result.fromNativeBroker,
                                 requestId: result.requestId,
+                                accessTokenSize: result.accessToken.length,
+                                idTokenSize: result.idToken.length,
+                                accountType: getAccountType(result.account),
                             });
                             return result;
                         })
@@ -976,7 +1023,7 @@ export class StandardController implements IController {
                 return await response;
             } else if (request.nativeAccountId) {
                 if (this.canUseNative(request, request.nativeAccountId)) {
-                    return await this.acquireTokenNative(
+                    const result = await this.acquireTokenNative(
                         {
                             ...request,
                             correlationId,
@@ -993,6 +1040,11 @@ export class StandardController implements IController {
                         }
                         throw e;
                     });
+                    atbcMeasurement.end({
+                        accountType: getAccountType(result.account),
+                        success: true,
+                    });
+                    return result;
                 } else {
                     throw createBrowserAuthError(
                         BrowserAuthErrorCodes.unableToAcquireTokenFromNativePlatform
@@ -1248,10 +1300,12 @@ export class StandardController implements IController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
-        this.logger.verbose("getAllAccounts called");
-        return this.isBrowserEnvironment
-            ? this.browserStorage.getAllAccounts(accountFilter)
-            : [];
+        return AccountManager.getAllAccounts(
+            this.logger,
+            this.browserStorage,
+            this.isBrowserEnvironment,
+            accountFilter
+        );
     }
 
     /**
@@ -1260,26 +1314,11 @@ export class StandardController implements IController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter: AccountFilter): AccountInfo | null {
-        this.logger.trace("getAccount called");
-        if (Object.keys(accountFilter).length === 0) {
-            this.logger.warning("getAccount: No accountFilter provided");
-            return null;
-        }
-
-        const account: AccountInfo | null =
-            this.browserStorage.getAccountInfoFilteredBy(accountFilter);
-
-        if (account) {
-            this.logger.verbose(
-                "getAccount: Account matching provided filter found, returning"
-            );
-            return account;
-        } else {
-            this.logger.verbose(
-                "getAccount: No matching account found, returning null"
-            );
-            return null;
-        }
+        return AccountManager.getAccount(
+            accountFilter,
+            this.logger,
+            this.browserStorage
+        );
     }
 
     /**
@@ -1291,29 +1330,11 @@ export class StandardController implements IController {
      * @returns The account object stored in MSAL
      */
     getAccountByUsername(username: string): AccountInfo | null {
-        this.logger.trace("getAccountByUsername called");
-        if (!username) {
-            this.logger.warning("getAccountByUsername: No username provided");
-            return null;
-        }
-
-        const account = this.browserStorage.getAccountInfoFilteredBy({
+        return AccountManager.getAccountByUsername(
             username,
-        });
-        if (account) {
-            this.logger.verbose(
-                "getAccountByUsername: Account matching username found, returning"
-            );
-            this.logger.verbosePii(
-                `getAccountByUsername: Returning signed-in accounts matching username: ${username}`
-            );
-            return account;
-        } else {
-            this.logger.verbose(
-                "getAccountByUsername: No matching account found, returning null"
-            );
-            return null;
-        }
+            this.logger,
+            this.browserStorage
+        );
     }
 
     /**
@@ -1324,31 +1345,11 @@ export class StandardController implements IController {
      * @returns The account object stored in MSAL
      */
     getAccountByHomeId(homeAccountId: string): AccountInfo | null {
-        this.logger.trace("getAccountByHomeId called");
-        if (!homeAccountId) {
-            this.logger.warning(
-                "getAccountByHomeId: No homeAccountId provided"
-            );
-            return null;
-        }
-
-        const account = this.browserStorage.getAccountInfoFilteredBy({
+        return AccountManager.getAccountByHomeId(
             homeAccountId,
-        });
-        if (account) {
-            this.logger.verbose(
-                "getAccountByHomeId: Account matching homeAccountId found, returning"
-            );
-            this.logger.verbosePii(
-                `getAccountByHomeId: Returning signed-in accounts matching homeAccountId: ${homeAccountId}`
-            );
-            return account;
-        } else {
-            this.logger.verbose(
-                "getAccountByHomeId: No matching account found, returning null"
-            );
-            return null;
-        }
+            this.logger,
+            this.browserStorage
+        );
     }
 
     /**
@@ -1359,31 +1360,11 @@ export class StandardController implements IController {
      * @returns The account object stored in MSAL
      */
     getAccountByLocalId(localAccountId: string): AccountInfo | null {
-        this.logger.trace("getAccountByLocalId called");
-        if (!localAccountId) {
-            this.logger.warning(
-                "getAccountByLocalId: No localAccountId provided"
-            );
-            return null;
-        }
-
-        const account = this.browserStorage.getAccountInfoFilteredBy({
+        return AccountManager.getAccountByLocalId(
             localAccountId,
-        });
-        if (account) {
-            this.logger.verbose(
-                "getAccountByLocalId: Account matching localAccountId found, returning"
-            );
-            this.logger.verbosePii(
-                `getAccountByLocalId: Returning signed-in accounts matching localAccountId: ${localAccountId}`
-            );
-            return account;
-        } else {
-            this.logger.verbose(
-                "getAccountByLocalId: No matching account found, returning null"
-            );
-            return null;
-        }
+            this.logger,
+            this.browserStorage
+        );
     }
 
     /**
@@ -1391,14 +1372,14 @@ export class StandardController implements IController {
      * @param account
      */
     setActiveAccount(account: AccountInfo | null): void {
-        this.browserStorage.setActiveAccount(account);
+        AccountManager.setActiveAccount(account, this.browserStorage);
     }
 
     /**
      * Gets the currently active account
      */
     getActiveAccount(): AccountInfo | null {
-        return this.browserStorage.getActiveAccount();
+        return AccountManager.getActiveAccount(this.browserStorage);
     }
 
     // #endregion
@@ -1856,15 +1837,17 @@ export class StandardController implements IController {
         );
         atsMeasurement.add({
             cacheLookupPolicy: request.cacheLookupPolicy,
+            scenarioId: request.scenarioId,
         });
 
-        BrowserUtils.preflightCheck(this.initialized);
+        preflightCheck(this.initialized, atsMeasurement);
         this.logger.verbose("acquireTokenSilent called", correlationId);
 
         const account = request.account || this.getActiveAccount();
         if (!account) {
             throw createBrowserAuthError(BrowserAuthErrorCodes.noAccountError);
         }
+        atsMeasurement.add({ accountType: getAccountType(account) });
 
         const thumbprint: RequestThumbprint = {
             clientId: this.config.auth.clientId,
@@ -1904,16 +1887,14 @@ export class StandardController implements IController {
             )
                 .then((result) => {
                     this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.add({
-                        accessTokenSize: result.accessToken.length,
-                        idTokenSize: result.idToken.length,
-                    });
                     atsMeasurement.end({
                         success: true,
                         fromCache: result.fromCache,
                         isNativeBroker: result.fromNativeBroker,
                         cacheLookupPolicy: request.cacheLookupPolicy,
                         requestId: result.requestId,
+                        accessTokenSize: result.accessToken.length,
+                        idTokenSize: result.idToken.length,
                     });
                     return result;
                 })
@@ -2000,13 +1981,11 @@ export class StandardController implements IController {
 
             if (shouldTryToResolveSilently) {
                 if (!this.activeIframeRequest) {
-                    let _resolve: () => void,
-                        _reject: (reason?: AuthError | Error) => void;
+                    let _resolve: (result: boolean) => void;
                     // Always set the active request tracker immediately after checking it to prevent races
                     this.activeIframeRequest = [
-                        new Promise((resolve, reject) => {
+                        new Promise((resolve) => {
                             _resolve = resolve;
-                            _reject = reject;
                         }),
                         silentRequest.correlationId,
                     ];
@@ -2022,11 +2001,11 @@ export class StandardController implements IController {
                         silentRequest.correlationId
                     )(silentRequest)
                         .then((iframeResult) => {
-                            _resolve();
+                            _resolve(true);
                             return iframeResult;
                         })
                         .catch((e) => {
-                            _reject(e);
+                            _resolve(false);
                             throw e;
                         })
                         .finally(() => {
@@ -2048,20 +2027,11 @@ export class StandardController implements IController {
                         awaitIframeCorrelationId: activeCorrelationId,
                     });
 
-                    // Await for errors first so we can distinguish errors thrown by activePromise versus errors thrown by .then below
-                    await activePromise.catch(() => {
-                        awaitConcurrentIframeMeasure.end({
-                            success: false,
-                        });
-                        this.logger.info(
-                            `Iframe request with correlationId: ${activeCorrelationId} failed. Interaction is required.`
-                        );
-                        // If previous iframe request failed, it's unlikely to succeed this time. Throw original error.
-                        throw refreshTokenError;
+                    const activePromiseResult = await activePromise;
+                    awaitConcurrentIframeMeasure.end({
+                        success: activePromiseResult,
                     });
-
-                    return activePromise.then(() => {
-                        awaitConcurrentIframeMeasure.end({ success: true });
+                    if (activePromiseResult) {
                         this.logger.verbose(
                             `Parallel iframe request with correlationId: ${activeCorrelationId} succeeded. Retrying cache and/or RT redemption`,
                             silentRequest.correlationId
@@ -2071,7 +2041,13 @@ export class StandardController implements IController {
                             silentRequest,
                             cacheLookupPolicy
                         );
-                    });
+                    } else {
+                        this.logger.info(
+                            `Iframe request with correlationId: ${activeCorrelationId} failed. Interaction is required.`
+                        );
+                        // If previous iframe request failed, it's unlikely to succeed this time. Throw original error.
+                        throw refreshTokenError;
+                    }
                 } else {
                     // Cache policy set to skip and another iframe request is already in progress
                     this.logger.warning(

package/src/index.ts

@@ -11,7 +11,11 @@
 import * as BrowserUtils from "./utils/BrowserUtils";
 export { BrowserUtils };
 
-export { PublicClientApplication } from "./app/PublicClientApplication";
+export {
+    PublicClientApplication,
+    createNestablePublicClientApplication,
+    createStandardPublicClientApplication,
+} from "./app/PublicClientApplication";
 export { PublicClientNext } from "./app/PublicClientNext";
 export { IController } from "./controllers/IController";
 export {

package/src/interaction_client/RedirectClient.ts

@@ -21,6 +21,7 @@ import {
     invokeAsync,
     ServerResponseType,
     UrlUtils,
+    InProgressPerformanceEvent,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import {
@@ -190,14 +191,12 @@ export class RedirectClient extends StandardInteractionClient {
      * Checks if navigateToLoginRequestUrl is set, and:
      * - if true, performs logic to cache and navigate
      * - if false, handles hash string and parses response
-     * @param hash {string?} url hash
-     * @param performanceClient {IPerformanceClient?}
-     * @param correlationId {string?} correlation identifier
+     * @param hash {string} url hash
+     * @param parentMeasurement {InProgressPerformanceEvent} parent measurement
      */
     async handleRedirectPromise(
-        hash?: string,
-        performanceClient?: IPerformanceClient,
-        correlationId?: string
+        hash: string = "",
+        parentMeasurement: InProgressPerformanceEvent
     ): Promise<AuthenticationResult | null> {
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             ApiId.handleRedirectPromise
@@ -220,12 +219,7 @@ export class RedirectClient extends StandardInteractionClient {
                 this.browserStorage.cleanRequestByInteractionType(
                     InteractionType.Redirect
                 );
-                if (performanceClient && correlationId) {
-                    performanceClient?.addFields(
-                        { errorCode: "no_server_response" },
-                        correlationId
-                    );
-                }
+                parentMeasurement.event.errorCode = "no_server_response";
                 return null;
             }
 

package/src/naa/BridgeAccountContext.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * AccountContext is used to pass account information when the bridge is initialized
+ *
+ * NAA (MetaOS) apps are created and destroyed for the same session multiple times.
+ * `AccountContext` helps in booting up the cached account when the bridge
+ * is recreated for a new NAA instance in the same auth session.
+ */
+export interface AccountContext {
+    homeAccountId: string;
+    environment: string;
+    tenantId: string;
+}

package/src/naa/BridgeCapabilities.ts

@@ -3,6 +3,7 @@
  * Licensed under the MIT License.
  */
 
+// Capabilities are intended to future proof the bridge against any feature support
 export interface BridgeCapabilities {
-    queryAccount: boolean;
+    queryAccount?: boolean;
 }

package/src/naa/BridgeProxy.ts

@@ -3,10 +3,10 @@
  * Licensed under the MIT License.
  */
 
-import { AccountInfo } from "./AccountInfo";
 import { AuthBridge, AuthBridgeResponse } from "./AuthBridge";
 import { AuthResult } from "./AuthResult";
 import { BridgeCapabilities } from "./BridgeCapabilities";
+import { AccountContext } from "./BridgeAccountContext";
 import { BridgeError } from "./BridgeError";
 import { BridgeRequest } from "./BridgeRequest";
 import { BridgeRequestEnvelope, BridgeMethods } from "./BridgeRequestEnvelope";
@@ -33,6 +33,7 @@ export class BridgeProxy implements IBridgeProxy {
     sdkName: string;
     sdkVersion: string;
     capabilities?: BridgeCapabilities;
+    accountContext?: AccountContext;
 
     /**
      * initializeNestedAppAuthBridge - Initializes the bridge to the host app
@@ -80,6 +81,7 @@ export class BridgeProxy implements IBridgeProxy {
                         messageType: "NestedAppAuthRequest",
                         method: "GetInitContext",
                         requestId: BrowserCrypto.createNewGuid(),
+                        sendTime: Date.now(),
                     };
                     const request: BridgeRequest = {
                         requestId: message.requestId,
@@ -134,15 +136,14 @@ export class BridgeProxy implements IBridgeProxy {
         };
     }
 
-    public async getActiveAccount(): Promise<AccountInfo> {
-        const result = await this.sendRequest("GetActiveAccount");
-        return BridgeProxy.validateBridgeResultOrThrow(result.account);
-    }
-
     public getHostCapabilities(): BridgeCapabilities | null {
         return this.capabilities ?? null;
     }
 
+    public getAccountContext(): AccountContext | null {
+        return this.accountContext ? this.accountContext : null;
+    }
+
     /**
      * A method used to send a request to the bridge
      * @param request A token request
@@ -156,6 +157,7 @@ export class BridgeProxy implements IBridgeProxy {
             messageType: "NestedAppAuthRequest",
             method: method,
             requestId: BrowserCrypto.createNewGuid(),
+            sendTime: Date.now(),
             ...requestParams,
         };
 
@@ -194,10 +196,12 @@ export class BridgeProxy implements IBridgeProxy {
     private constructor(
         sdkName: string,
         sdkVersion: string,
+        accountContext?: AccountContext,
         capabilities?: BridgeCapabilities
     ) {
         this.sdkName = sdkName;
         this.sdkVersion = sdkVersion;
+        this.accountContext = accountContext;
         this.capabilities = capabilities;
     }
 
@@ -210,6 +214,7 @@ export class BridgeProxy implements IBridgeProxy {
         return new BridgeProxy(
             response.sdkName,
             response.sdkVersion,
+            response.accountContext,
             response.capabilities
         );
     }

package/src/naa/BridgeRequestEnvelope.ts

@@ -5,12 +5,7 @@
 
 import { TokenRequest } from "./TokenRequest";
 
-export type BridgeMethods =
-    | "GetToken"
-    | "GetActiveAccount"
-    | "GetAllAccounts"
-    | "GetInitContext"
-    | "GetTokenPopup";
+export type BridgeMethods = "GetToken" | "GetInitContext" | "GetTokenPopup";
 
 export type BridgeRequestEnvelope = {
     messageType: "NestedAppAuthRequest";