@azure/msal-browser 3.2.0 → 3.3.0

package/src/interaction_client/SilentIframeClient.ts

@@ -29,11 +29,16 @@ import {
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
 import { InteractionType, ApiId } from "../utils/BrowserConstants";
-import { SilentHandler } from "../interaction_handler/SilentHandler";
+import {
+    initiateAuthRequest,
+    monitorIframeForHash,
+} from "../interaction_handler/SilentHandler";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";
 import { NativeMessageHandler } from "../broker/nativeBroker/NativeMessageHandler";
 import { NativeInteractionClient } from "./NativeInteractionClient";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import { InteractionHandler } from "../interaction_handler/InteractionHandler";
+import * as BrowserUtils from "../utils/BrowserUtils";
 
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
@@ -114,6 +119,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             },
             InteractionType.Silent
         );
+        BrowserUtils.preconnect(silentRequest.authority);
         this.browserStorage.updateCacheEntries(
             silentRequest.state,
             silentRequest.nonce,
@@ -179,9 +185,10 @@ export class SilentIframeClient extends StandardInteractionClient {
         authClient: AuthorizationCodeClient,
         silentRequest: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
+        const correlationId = silentRequest.correlationId;
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.SilentIframeClientTokenHelper,
-            silentRequest.correlationId
+            correlationId
         );
 
         // Create auth code request and generate PKCE params
@@ -191,7 +198,7 @@ export class SilentIframeClient extends StandardInteractionClient {
                 PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
                 this.logger,
                 this.performanceClient,
-                silentRequest.correlationId
+                correlationId
             )(silentRequest);
 
         // Create authorize request url
@@ -200,7 +207,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             PerformanceEvents.GetAuthCodeUrl,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
+            correlationId
         )({
             ...silentRequest,
             nativeBroker: NativeMessageHandler.isNativeAvailable(
@@ -212,37 +219,64 @@ export class SilentIframeClient extends StandardInteractionClient {
         });
 
         // Create silent handler
-        const silentHandler = new SilentHandler(
+        const interactionHandler = new InteractionHandler(
             authClient,
             this.browserStorage,
             authCodeRequest,
             this.logger,
-            this.config.system,
             this.performanceClient
         );
         // Get the frame handle for the silent request
         const msalFrame = await invokeAsync(
-            silentHandler.initiateAuthRequest.bind(silentHandler),
+            initiateAuthRequest,
             PerformanceEvents.SilentHandlerInitiateAuthRequest,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
-        )(navigateUrl);
+            correlationId
+        )(
+            navigateUrl,
+            this.performanceClient,
+            this.logger,
+            correlationId,
+            this.config.system.navigateFrameWait
+        );
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const hash = await invokeAsync(
-            silentHandler.monitorIframeForHash.bind(silentHandler),
+            monitorIframeForHash,
             PerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
-        )(msalFrame, this.config.system.iframeHashTimeout);
+            correlationId
+        )(
+            msalFrame,
+            this.config.system.iframeHashTimeout,
+            this.config.system.pollIntervalMilliseconds,
+            this.performanceClient,
+            this.logger,
+            correlationId
+        );
+        if (!hash) {
+            // No hash is present
+            this.logger.error(
+                "The request has returned to the redirectUri but a hash is not present in the iframe. It's likely that the hash has been removed or the page has been redirected by code running on the redirectUri page."
+            );
+            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
+        } else if (!UrlString.hashContainsKnownProperties(hash)) {
+            this.logger.error(
+                "A hash is present in the iframe but it does not contain known properties. It's likely that the hash has been replaced by code running on the redirectUri page."
+            );
+            this.logger.errorPii(`The hash detected in the iframe is: ${hash}`);
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
+            );
+        }
         // Deserialize hash fragment response parameters.
         const serverParams: ServerAuthorizationCodeResponse =
             UrlString.getDeserializedHash(hash);
         const state = this.validateAndExtractStateFromHash(
             serverParams,
             InteractionType.Silent,
-            authCodeRequest.correlationId
+            correlationId
         );
 
         if (serverParams.accountId) {
@@ -266,7 +300,7 @@ export class SilentIframeClient extends StandardInteractionClient {
                 this.nativeMessageHandler,
                 serverParams.accountId,
                 this.browserStorage,
-                this.correlationId
+                correlationId
             );
             const { userRequestState } = ProtocolUtils.parseRequestState(
                 this.browserCrypto,
@@ -279,7 +313,7 @@ export class SilentIframeClient extends StandardInteractionClient {
                 PerformanceEvents.NativeInteractionClientAcquireToken,
                 this.logger,
                 this.performanceClient,
-                silentRequest.correlationId
+                correlationId
             )({
                 ...silentRequest,
                 state: userRequestState,
@@ -291,11 +325,13 @@ export class SilentIframeClient extends StandardInteractionClient {
 
         // Handle response from hash string
         return invokeAsync(
-            silentHandler.handleCodeResponseFromHash.bind(silentHandler),
+            interactionHandler.handleCodeResponseFromHash.bind(
+                interactionHandler
+            ),
             PerformanceEvents.HandleCodeResponseFromHash,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
+            correlationId
         )(hash, state, authClient.authority, this.networkClient);
     }
 }

package/src/interaction_client/StandardInteractionClient.ts

@@ -37,7 +37,7 @@ import {
     BrowserStateObject,
 } from "../utils/BrowserProtocolUtils";
 import { EndSessionRequest } from "../request/EndSessionRequest";
-import { BrowserUtils } from "../utils/BrowserUtils";
+import * as BrowserUtils from "../utils/BrowserUtils";
 import { RedirectRequest } from "../request/RedirectRequest";
 import { PopupRequest } from "../request/PopupRequest";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";

package/src/interaction_handler/SilentHandler.ts

@@ -4,266 +4,210 @@
  */
 
 import {
-    UrlString,
-    CommonAuthorizationCodeRequest,
-    AuthorizationCodeClient,
-    Constants,
     Logger,
     IPerformanceClient,
     PerformanceEvents,
     invokeAsync,
+    invoke,
 } from "@azure/msal-common";
-import { InteractionHandler } from "./InteractionHandler";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
-import { BrowserCacheManager } from "../cache/BrowserCacheManager";
-import {
-    BrowserSystemOptions,
-    DEFAULT_IFRAME_TIMEOUT_MS,
-} from "../config/Configuration";
-
-export class SilentHandler extends InteractionHandler {
-    private navigateFrameWait: number;
-    private pollIntervalMilliseconds: number;
+import { DEFAULT_IFRAME_TIMEOUT_MS } from "../config/Configuration";
 
-    constructor(
-        authCodeModule: AuthorizationCodeClient,
-        storageImpl: BrowserCacheManager,
-        authCodeRequest: CommonAuthorizationCodeRequest,
-        logger: Logger,
-        systemOptions: Required<
-            Pick<
-                BrowserSystemOptions,
-                "navigateFrameWait" | "pollIntervalMilliseconds"
-            >
-        >,
-        performanceClient: IPerformanceClient
-    ) {
-        super(
-            authCodeModule,
-            storageImpl,
-            authCodeRequest,
+/**
+ * Creates a hidden iframe to given URL using user-requested scopes as an id.
+ * @param urlNavigate
+ * @param userRequestScopes
+ */
+export async function initiateAuthRequest(
+    requestUrl: string,
+    performanceClient: IPerformanceClient,
+    logger: Logger,
+    correlationId: string,
+    navigateFrameWait?: number
+): Promise<HTMLIFrameElement> {
+    performanceClient.addQueueMeasurement(
+        PerformanceEvents.SilentHandlerInitiateAuthRequest,
+        correlationId
+    );
+
+    if (!requestUrl) {
+        // Throw error if request URL is empty.
+        logger.info("Navigate url is empty");
+        throw createBrowserAuthError(BrowserAuthErrorCodes.emptyNavigateUri);
+    }
+    if (navigateFrameWait) {
+        return await invokeAsync(
+            loadFrame,
+            PerformanceEvents.SilentHandlerLoadFrame,
             logger,
-            performanceClient
-        );
-        this.navigateFrameWait = systemOptions.navigateFrameWait;
-        this.pollIntervalMilliseconds = systemOptions.pollIntervalMilliseconds;
+            performanceClient,
+            correlationId
+        )(requestUrl, navigateFrameWait, performanceClient, correlationId);
     }
+    return invoke(
+        loadFrameSync,
+        PerformanceEvents.SilentHandlerLoadFrameSync,
+        logger,
+        performanceClient,
+        correlationId
+    )(requestUrl);
+}
 
-    /**
-     * Creates a hidden iframe to given URL using user-requested scopes as an id.
-     * @param urlNavigate
-     * @param userRequestScopes
-     */
-    async initiateAuthRequest(requestUrl: string): Promise<HTMLIFrameElement> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.SilentHandlerInitiateAuthRequest,
-            this.authCodeRequest.correlationId
-        );
-
-        if (!requestUrl) {
-            // Throw error if request URL is empty.
-            this.logger.info("Navigate url is empty");
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.emptyNavigateUri
+/**
+ * Monitors an iframe content window until it loads a url with a known hash, or hits a specified timeout.
+ * @param iframe
+ * @param timeout
+ */
+export async function monitorIframeForHash(
+    iframe: HTMLIFrameElement,
+    timeout: number,
+    pollIntervalMilliseconds: number,
+    performanceClient: IPerformanceClient,
+    logger: Logger,
+    correlationId: string
+): Promise<string> {
+    performanceClient.addQueueMeasurement(
+        PerformanceEvents.SilentHandlerMonitorIframeForHash,
+        correlationId
+    );
+
+    return new Promise<string>((resolve, reject) => {
+        if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
+            logger.warning(
+                `system.loadFrameTimeout or system.iframeHashTimeout set to lower (${timeout}ms) than the default (${DEFAULT_IFRAME_TIMEOUT_MS}ms). This may result in timeouts.`
             );
         }
 
-        if (this.navigateFrameWait) {
-            return await invokeAsync(
-                this.loadFrame.bind(this),
-                PerformanceEvents.SilentHandlerLoadFrame,
-                this.logger,
-                this.performanceClient,
-                this.authCodeRequest.correlationId
-            )(requestUrl);
-        }
-        return this.loadFrameSync(requestUrl);
-    }
-
-    /**
-     * Monitors an iframe content window until it loads a url with a known hash, or hits a specified timeout.
-     * @param iframe
-     * @param timeout
-     */
-    monitorIframeForHash(
-        iframe: HTMLIFrameElement,
-        timeout: number
-    ): Promise<string> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.SilentHandlerMonitorIframeForHash,
-            this.authCodeRequest.correlationId
-        );
-
-        return new Promise((resolve, reject) => {
-            if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
-                this.logger.warning(
-                    `system.loadFrameTimeout or system.iframeHashTimeout set to lower (${timeout}ms) than the default (${DEFAULT_IFRAME_TIMEOUT_MS}ms). This may result in timeouts.`
-                );
-            }
-
-            /*
-             * Polling for iframes can be purely timing based,
-             * since we don't need to account for interaction.
-             */
-            const nowMark = window.performance.now();
-            const timeoutMark = nowMark + timeout;
-
-            const intervalId = setInterval(() => {
-                if (window.performance.now() > timeoutMark) {
-                    this.removeHiddenIframe(iframe);
-                    clearInterval(intervalId);
-                    reject(
-                        createBrowserAuthError(
-                            BrowserAuthErrorCodes.monitorWindowTimeout
-                        )
-                    );
-                    return;
-                }
-
-                let href: string = Constants.EMPTY_STRING;
-                const contentWindow = iframe.contentWindow;
-                try {
-                    /*
-                     * Will throw if cross origin,
-                     * which should be caught and ignored
-                     * since we need the interval to keep running while on STS UI.
-                     */
-                    href = contentWindow
-                        ? contentWindow.location.href
-                        : Constants.EMPTY_STRING;
-                } catch (e) {}
-
-                if (!href || href === "about:blank") {
-                    return;
-                }
-
-                const contentHash = contentWindow
-                    ? contentWindow.location.hash
-                    : Constants.EMPTY_STRING;
-                if (contentHash) {
-                    if (UrlString.hashContainsKnownProperties(contentHash)) {
-                        // Success case
-                        this.removeHiddenIframe(iframe);
-                        clearInterval(intervalId);
-                        resolve(contentHash);
-                        return;
-                    } else {
-                        // Hash is present but incorrect
-                        this.logger.error(
-                            "SilentHandler:monitorIFrameForHash - a hash is present in the iframe but it does not contain known properties. It's likely that the hash has been replaced by code running on the redirectUri page."
-                        );
-                        this.logger.errorPii(
-                            `SilentHandler:monitorIFrameForHash - the url detected in the iframe is: ${href}`
-                        );
-                        this.removeHiddenIframe(iframe);
-                        clearInterval(intervalId);
-                        reject(
-                            createBrowserAuthError(
-                                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
-                            )
-                        );
-                        return;
-                    }
-                } else {
-                    // No hash is present
-                    this.logger.error(
-                        "SilentHandler:monitorIFrameForHash - the request has returned to the redirectUri but a hash is not present in the iframe. It's likely that the hash has been removed or the page has been redirected by code running on the redirectUri page."
-                    );
-                    this.logger.errorPii(
-                        `SilentHandler:monitorIFrameForHash - the url detected in the iframe is: ${href}`
-                    );
-                    this.removeHiddenIframe(iframe);
-                    clearInterval(intervalId);
-                    reject(
-                        createBrowserAuthError(
-                            BrowserAuthErrorCodes.hashEmptyError
-                        )
-                    );
-                    return;
-                }
-            }, this.pollIntervalMilliseconds);
-        });
-    }
-
-    /**
-     * @hidden
-     * Loads iframe with authorization endpoint URL
-     * @ignore
-     */
-    private loadFrame(urlNavigate: string): Promise<HTMLIFrameElement> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.SilentHandlerLoadFrame,
-            this.authCodeRequest.correlationId
-        );
-
         /*
-         * This trick overcomes iframe navigation in IE
-         * IE does not load the page consistently in iframe
+         * Polling for iframes can be purely timing based,
+         * since we don't need to account for interaction.
          */
+        const timeoutId = window.setTimeout(() => {
+            window.clearInterval(intervalId);
+            reject(
+                createBrowserAuthError(
+                    BrowserAuthErrorCodes.monitorWindowTimeout
+                )
+            );
+        }, timeout);
+
+        const intervalId = window.setInterval(() => {
+            let href: string = "";
+            const contentWindow = iframe.contentWindow;
+            try {
+                /*
+                 * Will throw if cross origin,
+                 * which should be caught and ignored
+                 * since we need the interval to keep running while on STS UI.
+                 */
+                href = contentWindow ? contentWindow.location.href : "";
+            } catch (e) {}
+
+            if (!href || href === "about:blank") {
+                return;
+            }
 
-        return new Promise((resolve, reject) => {
-            const frameHandle = this.createHiddenIframe();
-
-            setTimeout(() => {
-                if (!frameHandle) {
-                    reject("Unable to load iframe");
-                    return;
-                }
+            const contentHash = contentWindow
+                ? contentWindow.location.hash
+                : "";
+            window.clearTimeout(timeoutId);
+            window.clearInterval(intervalId);
+            resolve(contentHash);
+        }, pollIntervalMilliseconds);
+    }).finally(() => {
+        invoke(
+            removeHiddenIframe,
+            PerformanceEvents.RemoveHiddenIframe,
+            logger,
+            performanceClient,
+            correlationId
+        )(iframe);
+    });
+}
 
-                frameHandle.src = urlNavigate;
+/**
+ * @hidden
+ * Loads iframe with authorization endpoint URL
+ * @ignore
+ * @deprecated
+ */
+function loadFrame(
+    urlNavigate: string,
+    navigateFrameWait: number,
+    performanceClient: IPerformanceClient,
+    correlationId: string
+): Promise<HTMLIFrameElement> {
+    performanceClient.addQueueMeasurement(
+        PerformanceEvents.SilentHandlerLoadFrame,
+        correlationId
+    );
+
+    /*
+     * This trick overcomes iframe navigation in IE
+     * IE does not load the page consistently in iframe
+     */
 
-                resolve(frameHandle);
-            }, this.navigateFrameWait);
-        });
-    }
+    return new Promise((resolve, reject) => {
+        const frameHandle = createHiddenIframe();
 
-    /**
-     * @hidden
-     * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
-     * @param urlNavigate
-     * @param frameName
-     * @param logger
-     */
-    private loadFrameSync(urlNavigate: string): HTMLIFrameElement {
-        const frameHandle = this.createHiddenIframe();
+        window.setTimeout(() => {
+            if (!frameHandle) {
+                reject("Unable to load iframe");
+                return;
+            }
 
-        frameHandle.src = urlNavigate;
+            frameHandle.src = urlNavigate;
 
-        return frameHandle;
-    }
+            resolve(frameHandle);
+        }, navigateFrameWait);
+    });
+}
+/**
+ * @hidden
+ * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
+ * @param urlNavigate
+ * @param frameName
+ * @param logger
+ */
+function loadFrameSync(urlNavigate: string): HTMLIFrameElement {
+    const frameHandle = createHiddenIframe();
 
-    /**
-     * @hidden
-     * Creates a new hidden iframe or gets an existing one for silent token renewal.
-     * @ignore
-     */
-    private createHiddenIframe(): HTMLIFrameElement {
-        const authFrame = document.createElement("iframe");
+    frameHandle.src = urlNavigate;
 
-        authFrame.style.visibility = "hidden";
-        authFrame.style.position = "absolute";
-        authFrame.style.width = authFrame.style.height = "0";
-        authFrame.style.border = "0";
-        authFrame.setAttribute(
-            "sandbox",
-            "allow-scripts allow-same-origin allow-forms"
-        );
-        document.getElementsByTagName("body")[0].appendChild(authFrame);
+    return frameHandle;
+}
 
-        return authFrame;
-    }
+/**
+ * @hidden
+ * Creates a new hidden iframe or gets an existing one for silent token renewal.
+ * @ignore
+ */
+function createHiddenIframe(): HTMLIFrameElement {
+    const authFrame = document.createElement("iframe");
+
+    authFrame.style.visibility = "hidden";
+    authFrame.style.position = "absolute";
+    authFrame.style.width = authFrame.style.height = "0";
+    authFrame.style.border = "0";
+    authFrame.setAttribute(
+        "sandbox",
+        "allow-scripts allow-same-origin allow-forms"
+    );
+    document.getElementsByTagName("body")[0].appendChild(authFrame);
+
+    return authFrame;
+}
 
-    /**
-     * @hidden
-     * Removes a hidden iframe from the page.
-     * @ignore
-     */
-    private removeHiddenIframe(iframe: HTMLIFrameElement): void {
-        if (document.body === iframe.parentNode) {
-            document.body.removeChild(iframe);
-        }
+/**
+ * @hidden
+ * Removes a hidden iframe from the page.
+ * @ignore
+ */
+function removeHiddenIframe(iframe: HTMLIFrameElement): void {
+    if (document.body === iframe.parentNode) {
+        document.body.removeChild(iframe);
     }
 }

package/src/naa/AccountInfo.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type AccountInfo = {
+    homeAccountId: string;
+    environment: string;
+    tenantId: string;
+    username: string;
+    localAccountId: string;
+    name?: string;
+    idToken?: string; // idTokenClaims can be parsed from idToken in MSAL.js
+    platformBrokerId?: string; // Used by WAM previous called nativeAccountId
+    idTokenClaims?: object;
+    client_info?: string;
+};

package/src/naa/AccountRequests.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type AccountByHomeIdRequest = {
+    homeAccountId: string;
+};
+
+export type AccountByLocalIdRequest = {
+    localAccountId: string;
+};
+
+export type AccountByUsernameRequest = {
+    username: string;
+};

package/src/naa/AuthBridge.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export interface AuthBridge {
+    addEventListener: (
+        eventName: string,
+        callback: (response: string) => void
+    ) => void;
+    postMessage: (message: string) => void;
+    removeEventListener: (
+        eventName: string,
+        callback: (response: string) => void
+    ) => void;
+}

package/src/naa/BridgeCapabilities.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export interface BridgeCapabilities {
+    queryAccount: boolean;
+}