@azure/msal-browser 3.13.0 → 3.15.0

package/src/naa/IBridgeProxy.ts

@@ -3,14 +3,14 @@
  * Licensed under the MIT License.
  */
 
-import { AccountInfo } from "./AccountInfo";
 import { AuthResult } from "./AuthResult";
+import { AccountContext } from "./BridgeAccountContext";
 import { BridgeCapabilities } from "./BridgeCapabilities";
 import { TokenRequest } from "./TokenRequest";
 
 export interface IBridgeProxy {
     getTokenInteractive(request: TokenRequest): Promise<AuthResult>;
     getTokenSilent(request: TokenRequest): Promise<AuthResult>;
-    getActiveAccount(): Promise<AccountInfo>;
     getHostCapabilities(): BridgeCapabilities | null;
+    getAccountContext(): AccountContext | null;
 }

package/src/naa/InitContext.ts

@@ -4,9 +4,11 @@
  */
 
 import { BridgeCapabilities } from "./BridgeCapabilities";
+import { AccountContext } from "./BridgeAccountContext";
 
 export interface InitContext {
     capabilities?: BridgeCapabilities;
     sdkName: string;
     sdkVersion: string;
+    accountContext?: AccountContext;
 }

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -24,6 +24,11 @@ import {
     StringUtils,
     createClientAuthError,
     OIDC_DEFAULT_SCOPES,
+    AccountInfo,
+    IdTokenEntity,
+    AccessTokenEntity,
+    TenantProfile,
+    buildTenantProfileFromIdTokenClaims,
 } from "@azure/msal-common";
 import { isBridgeError } from "../BridgeError";
 import { BridgeStatusCode } from "../BridgeStatusCode";
@@ -110,6 +115,7 @@ export class NestedAppAuthAdapter {
         );
         const account = this.fromNaaAccountInfo(
             response.account,
+            response.token.id_token,
             idTokenClaims
         );
         const scopes = response.token.scope || request.scope;
@@ -123,7 +129,7 @@ export class NestedAppAuthAdapter {
             idToken: response.token.id_token,
             idTokenClaims,
             accessToken: response.token.access_token,
-            fromCache: true,
+            fromCache: false,
             expiresOn: expiresOn,
             tokenType:
                 request.authenticationScheme || AuthenticationScheme.BEARER,
@@ -159,6 +165,7 @@ export class NestedAppAuthAdapter {
      */
     public fromNaaAccountInfo(
         fromAccount: NaaAccountInfo,
+        idToken?: string,
         idTokenClaims?: TokenClaims
     ): MsalAccountInfo {
         const effectiveIdTokenClaims =
@@ -183,6 +190,14 @@ export class NestedAppAuthAdapter {
 
         const name = fromAccount.name || effectiveIdTokenClaims?.name;
 
+        const tenantProfiles = new Map<string, TenantProfile>();
+
+        const tenantProfile = buildTenantProfileFromIdTokenClaims(
+            homeAccountId,
+            effectiveIdTokenClaims
+        );
+        tenantProfiles.set(tenantId, tenantProfile);
+
         const account: MsalAccountInfo = {
             homeAccountId,
             environment: fromAccount.environment,
@@ -190,8 +205,9 @@ export class NestedAppAuthAdapter {
             username,
             localAccountId,
             name,
-            idToken: fromAccount.idToken,
+            idToken: idToken,
             idTokenClaims: effectiveIdTokenClaims,
+            tenantProfiles,
         };
 
         return account;
@@ -249,4 +265,54 @@ export class NestedAppAuthAdapter {
             return new AuthError("unknown_error", "An unknown error occurred");
         }
     }
+
+    /**
+     * Returns an AuthenticationResult from the given cache items
+     *
+     * @param account
+     * @param idToken
+     * @param accessToken
+     * @param reqTimestamp
+     * @returns
+     */
+    public toAuthenticationResultFromCache(
+        account: AccountInfo,
+        idToken: IdTokenEntity,
+        accessToken: AccessTokenEntity,
+        request: SilentRequest,
+        correlationId: string
+    ): AuthenticationResult {
+        if (!idToken || !accessToken) {
+            throw createClientAuthError(ClientAuthErrorCodes.nullOrEmptyToken);
+        }
+
+        const idTokenClaims = AuthToken.extractTokenClaims(
+            idToken.secret,
+            this.crypto.base64Decode
+        );
+
+        const scopes = accessToken.target || request.scopes.join(" ");
+
+        const authenticationResult: AuthenticationResult = {
+            authority: accessToken.environment || account.environment,
+            uniqueId: account.localAccountId,
+            tenantId: account.tenantId,
+            scopes: scopes.split(" "),
+            account,
+            idToken: idToken.secret,
+            idTokenClaims: idTokenClaims || {},
+            accessToken: accessToken.secret,
+            fromCache: true,
+            expiresOn: new Date(Number(accessToken.expiresOn) * 1000),
+            tokenType:
+                request.authenticationScheme || AuthenticationScheme.BEARER,
+            correlationId,
+            extExpiresOn: new Date(
+                Number(accessToken.extendedExpiresOn) * 1000
+            ),
+            state: request.state,
+        };
+
+        return authenticationResult;
+    }
 }

package/src/operatingcontext/{TeamsAppOperatingContext.ts → NestedAppOperatingContext.ts}

@@ -6,11 +6,11 @@
 import { BaseOperatingContext } from "./BaseOperatingContext";
 import { IBridgeProxy } from "../naa/IBridgeProxy";
 import { BridgeProxy } from "../naa/BridgeProxy";
-import { AccountInfo } from "../naa/AccountInfo";
+import { AccountContext } from "../naa/BridgeAccountContext";
 
-export class TeamsAppOperatingContext extends BaseOperatingContext {
+export class NestedAppOperatingContext extends BaseOperatingContext {
     protected bridgeProxy: IBridgeProxy | undefined = undefined;
-    protected activeAccount: AccountInfo | undefined = undefined;
+    protected accountContext: AccountContext | null = null;
 
     /*
      * TODO: Once we have determine the bundling code return here to specify the name of the bundle
@@ -21,7 +21,7 @@ export class TeamsAppOperatingContext extends BaseOperatingContext {
     /**
      * Unique identifier for the operating context
      */
-    static readonly ID: string = "TeamsAppOperatingContext";
+    static readonly ID: string = "NestedAppOperatingContext";
 
     /**
      * Return the module name.  Intended for use with import() to enable dynamic import
@@ -29,28 +29,25 @@ export class TeamsAppOperatingContext extends BaseOperatingContext {
      * @returns
      */
     getModuleName(): string {
-        return TeamsAppOperatingContext.MODULE_NAME;
+        return NestedAppOperatingContext.MODULE_NAME;
     }
+
     /**
      * Returns the unique identifier for this operating context
      * @returns string
      */
     getId(): string {
-        return TeamsAppOperatingContext.ID;
+        return NestedAppOperatingContext.ID;
     }
 
+    /**
+     * Returns the current BridgeProxy
+     * @returns IBridgeProxy | undefined
+     */
     getBridgeProxy(): IBridgeProxy | undefined {
         return this.bridgeProxy;
     }
 
-    getActiveAccount(): AccountInfo | undefined {
-        return this.activeAccount;
-    }
-
-    setActiveAccount(account: AccountInfo): void {
-        this.activeAccount = account;
-    }
-
     /**
      * Checks whether the operating context is available.
      * Confirms that the code is running a browser rather.  This is required.
@@ -61,31 +58,26 @@ export class TeamsAppOperatingContext extends BaseOperatingContext {
          * TODO: Add implementation to check for presence of inject Nested App Auth Bridge JavaScript interface
          *
          */
+
         try {
             if (typeof window !== "undefined") {
                 const bridgeProxy: IBridgeProxy = await BridgeProxy.create();
                 /*
-                 * Because we want single sign on we need to attempt to
-                 * grab the active account as part of initialization
-                 * this.activeAccount = await bridgeProxy.getActiveAccount();
+                 * Because we want single sign on we expect the host app to provide the account context
+                 * with a min set of params that can be used to identify the account
+                 * this.account = nestedApp.getAccountByFilter(bridgeProxy.getAccountContext());
                  */
-                try {
-                    if (bridgeProxy.getHostCapabilities()?.queryAccount) {
-                        this.activeAccount =
-                            await bridgeProxy.getActiveAccount();
-                    }
-                } catch (e) {
-                    this.activeAccount = undefined;
-                }
+                this.accountContext = bridgeProxy.getAccountContext();
                 this.bridgeProxy = bridgeProxy;
                 this.available = bridgeProxy !== undefined;
-            } else {
-                this.available = false;
             }
-        } catch (e) {
-            this.available = false;
-        } finally {
-            return this.available;
+        } catch (ex) {
+            this.logger.infoPii(
+                `Could not initialize Nested App Auth bridge (${ex})`
+            );
         }
+
+        this.logger.info(`Nested App Auth Bridge available: ${this.available}`);
+        return this.available;
     }
 }

package/src/operatingcontext/StandardOperatingContext.ts

@@ -25,6 +25,7 @@ export class StandardOperatingContext extends BaseOperatingContext {
     getModuleName(): string {
         return StandardOperatingContext.MODULE_NAME;
     }
+
     /**
      * Returns the unique identifier for this operating context
      * @returns string

package/src/operatingcontext/UnknownOperatingContext.ts

@@ -17,6 +17,14 @@ export class UnknownOperatingContext extends BaseOperatingContext {
      */
     static readonly ID: string = "UnknownOperatingContext";
 
+    /**
+     * Returns the unique identifier for this operating context
+     * @returns string
+     */
+    getId(): string {
+        return UnknownOperatingContext.ID;
+    }
+
     /**
      * Return the module name.  Intended for use with import() to enable dynamic import
      * of the implementation associated with this operating context
@@ -25,13 +33,6 @@ export class UnknownOperatingContext extends BaseOperatingContext {
     getModuleName(): string {
         return UnknownOperatingContext.MODULE_NAME;
     }
-    /**
-     * Returns the unique identifier for this operating context
-     * @returns string
-     */
-    getId(): string {
-        return UnknownOperatingContext.ID;
-    }
 
     /**
      * Checks whether the operating context is available.

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.13.0";
+export const version = "3.15.0";

package/src/utils/BrowserUtils.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { UrlString } from "@azure/msal-common";
+import { UrlString, invoke, invokeAsync } from "@azure/msal-common";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -206,3 +206,6 @@ export function preconnect(authority: string): void {
 export function createGuid(): string {
     return BrowserCrypto.createNewGuid();
 }
+
+export { invoke };
+export { invokeAsync };

package/dist/operatingcontext/TeamsAppOperatingContext.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"TeamsAppOperatingContext.d.ts","sourceRoot":"","sources":["../../src/operatingcontext/TeamsAppOperatingContext.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,qBAAa,wBAAyB,SAAQ,oBAAoB;IAC9D,SAAS,CAAC,WAAW,EAAE,YAAY,GAAG,SAAS,CAAa;IAC5D,SAAS,CAAC,aAAa,EAAE,WAAW,GAAG,SAAS,CAAa;IAM7D,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAM;IAEzC;;OAEG;IACH,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAA8B;IAExD;;;;OAIG;IACH,aAAa,IAAI,MAAM;IAGvB;;;OAGG;IACH,KAAK,IAAI,MAAM;IAIf,cAAc,IAAI,YAAY,GAAG,SAAS;IAI1C,gBAAgB,IAAI,WAAW,GAAG,SAAS;IAI3C,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAI5C;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;CAgCvC"}

package/dist/operatingcontext/TeamsAppOperatingContext.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"TeamsAppOperatingContext.mjs","sources":["../../src/operatingcontext/TeamsAppOperatingContext.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;AAAA;;;AAGG;AAOG,MAAO,wBAAyB,SAAQ,oBAAoB,CAAA;AAAlE,IAAA,WAAA,GAAA;;QACc,IAAW,CAAA,WAAA,GAA6B,SAAS,CAAC;QAClD,IAAa,CAAA,aAAA,GAA4B,SAAS,CAAC;KA8EhE;AAjEG;;;;AAIG;IACH,aAAa,GAAA;QACT,OAAO,wBAAwB,CAAC,WAAW,CAAC;KAC/C;AACD;;;AAGG;IACH,KAAK,GAAA;QACD,OAAO,wBAAwB,CAAC,EAAE,CAAC;KACtC;IAED,cAAc,GAAA;QACV,OAAO,IAAI,CAAC,WAAW,CAAC;KAC3B;IAED,gBAAgB,GAAA;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC;KAC7B;AAED,IAAA,gBAAgB,CAAC,OAAoB,EAAA;AACjC,QAAA,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;KAChC;AAED;;;;AAIG;AACH,IAAA,MAAM,UAAU,GAAA;AACZ;;;AAGG;QACH,IAAI;AACA,YAAA,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;AAC/B,gBAAA,MAAM,WAAW,GAAiB,MAAM,WAAW,CAAC,MAAM,EAAE,CAAC;AAC7D;;;;AAIG;gBACH,IAAI;AACA,oBAAA,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE;AACjD,wBAAA,IAAI,CAAC,aAAa;AACd,4BAAA,MAAM,WAAW,CAAC,gBAAgB,EAAE,CAAC;AAC5C,qBAAA;AACJ,iBAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;AACR,oBAAA,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;AAClC,iBAAA;AACD,gBAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AAC/B,gBAAA,IAAI,CAAC,SAAS,GAAG,WAAW,KAAK,SAAS,CAAC;AAC9C,aAAA;AAAM,iBAAA;AACH,gBAAA,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;AAC1B,aAAA;AACJ,SAAA;AAAC,QAAA,OAAO,CAAC,EAAE;AACR,YAAA,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;AAC1B,SAAA;AAAS,gBAAA;YACN,OAAO,IAAI,CAAC,SAAS,CAAC;AACzB,SAAA;KACJ;;AA3ED;;;AAGG;AACa,wBAAW,CAAA,WAAA,GAAW,EAAE,CAAC;AAEzC;;AAEG;AACa,wBAAE,CAAA,EAAA,GAAW,0BAA0B;;;;"}