@azure/msal-browser 3.2.0 → 3.3.0

package/src/naa/BridgeError.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { BridgeStatusCode } from "./BridgeStatusCode";
+
+export type BridgeError = {
+    status: BridgeStatusCode;
+    code: string; // auth_flow_last_error such as invalid_grant
+    subError: string; // server_suberror_code such as consent_required
+    description: string;
+    properties: object; // additional telemetry info
+};
+
+export function isBridgeError(error: unknown): error is BridgeError {
+    return (error as BridgeError).status !== undefined;
+}

package/src/naa/BridgeProxy.ts

@@ -0,0 +1,230 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AccountInfo } from "./AccountInfo";
+import {
+    AccountByHomeIdRequest,
+    AccountByLocalIdRequest,
+    AccountByUsernameRequest,
+} from "./AccountRequests";
+import { AuthBridge } from "./AuthBridge";
+import { BridgeCapabilities } from "./BridgeCapabilities";
+import { BridgeRequest } from "./BridgeRequest";
+import { BridgeRequestEnvelope, BridgeMethods } from "./BridgeRequestEnvelope";
+import { BridgeResponseEnvelope } from "./BridgeResponseEnvelope";
+import { IBridgeProxy } from "./IBridgeProxy";
+import { InitializeBridgeResponse } from "./InitializeBridgeResponse";
+import { TokenRequest } from "./TokenRequest";
+import { TokenResponse } from "./TokenResponse";
+
+declare global {
+    interface Window {
+        nestedAppAuthBridge: AuthBridge;
+    }
+}
+
+/**
+ * BridgeProxy
+ * Provides a proxy for accessing a bridge to a host app and/or
+ * platform broker
+ */
+export class BridgeProxy implements IBridgeProxy {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    static bridgeRequests: any[] = [];
+    static crypto: Crypto;
+    sdkName: string;
+    sdkVersion: string;
+    capabilities: BridgeCapabilities;
+
+    /**
+     * initializeNestedAppAuthBridge - Initializes the bridge to the host app
+     * @returns a promise that resolves to an InitializeBridgeResponse or rejects with an Error
+     * @remarks This method will be called by the create factory method
+     * @remarks If the bridge is not available, this method will throw an error
+     */
+    protected static async initializeNestedAppAuthBridge(): Promise<InitializeBridgeResponse> {
+        if (window === undefined) {
+            throw new Error("window is undefined");
+        }
+        if (window.nestedAppAuthBridge === undefined) {
+            throw new Error("window.nestedAppAuthBridge is undefined");
+        }
+        if (window.crypto === undefined) {
+            throw new Error("window.crypto is undefined");
+        }
+
+        try {
+            BridgeProxy.crypto = window.crypto;
+
+            window.nestedAppAuthBridge.addEventListener(
+                "message",
+                (response: string) => {
+                    const responseEnvelope: BridgeResponseEnvelope =
+                        JSON.parse(response);
+                    const request = BridgeProxy.bridgeRequests.find(
+                        (element) =>
+                            element.requestId === responseEnvelope.requestId
+                    );
+                    if (request !== undefined) {
+                        BridgeProxy.bridgeRequests.splice(
+                            BridgeProxy.bridgeRequests.indexOf(request),
+                            1
+                        );
+                        if (responseEnvelope.success) {
+                            request.resolve(responseEnvelope.body);
+                        } else {
+                            request.reject(responseEnvelope.body);
+                        }
+                    }
+                }
+            );
+
+            const promise = new Promise<InitializeBridgeResponse>(
+                (resolve, reject) => {
+                    const message: BridgeRequestEnvelope = {
+                        messageType: "NestedAppAuthRequest",
+                        method: "GetInitContext",
+                        requestId: BridgeProxy.getRandomId(),
+                    };
+                    const request: BridgeRequest<InitializeBridgeResponse> = {
+                        requestId: message.requestId,
+                        method: message.method,
+                        resolve: resolve,
+                        reject: reject,
+                    };
+                    BridgeProxy.bridgeRequests.push(request);
+                    window.nestedAppAuthBridge.postMessage(
+                        JSON.stringify(message)
+                    );
+                }
+            );
+
+            return promise;
+        } catch (error) {
+            window.console.log(error);
+            throw error;
+        }
+    }
+
+    public static getRandomId(): string {
+        return BridgeProxy.crypto.randomUUID();
+    }
+
+    /**
+     * getTokenInteractive - Attempts to get a token interactively from the bridge
+     * @param request A token request
+     * @returns a promise that resolves to a token response or rejects with a BridgeError
+     */
+    public getTokenInteractive(request: TokenRequest): Promise<TokenResponse> {
+        return this.sendRequest<TokenResponse>("GetTokenPopup", request);
+    }
+
+    /**
+     * getTokenSilent Attempts to get a token silently from the bridge
+     * @param request A token request
+     * @returns a promise that resolves to a token response or rejects with a BridgeError
+     */
+    public getTokenSilent(request: TokenRequest): Promise<TokenResponse> {
+        return this.sendRequest<TokenResponse>("GetToken", request);
+    }
+
+    /**
+     * getAccountInfo - Gets account information from the bridge
+     *
+     * @param request A request for account information
+     */
+    public getAccountInfo(
+        request:
+            | AccountByHomeIdRequest
+            | AccountByLocalIdRequest
+            | AccountByUsernameRequest
+    ): Promise<AccountInfo> {
+        let method: BridgeMethods = "GetAccountByHomeId";
+
+        if ((request as AccountByHomeIdRequest).homeAccountId !== undefined) {
+            method = "GetAccountByHomeId";
+        }
+
+        if ((request as AccountByLocalIdRequest).localAccountId !== undefined) {
+            method = "GetAccountByLocalId";
+        }
+
+        if ((request as AccountByUsernameRequest).username !== undefined) {
+            method = "GetAccountByUsername";
+        }
+
+        return this.sendRequest<AccountInfo>(method, request);
+    }
+
+    public getActiveAccount(): Promise<AccountInfo> {
+        return this.sendRequest<AccountInfo>("GetActiveAccount", undefined);
+    }
+
+    /**
+     * A method used to send a request to the bridge
+     * @param request A token request
+     * @returns a promise that resolves to a response of provided type or rejects with a BridgeError
+     */
+    private sendRequest<TResponse>(
+        method: BridgeMethods,
+        request:
+            | TokenRequest
+            | AccountByHomeIdRequest
+            | AccountByLocalIdRequest
+            | AccountByUsernameRequest
+            | undefined
+    ): Promise<TResponse> {
+        const message: BridgeRequestEnvelope = {
+            messageType: "NestedAppAuthRequest",
+            method: method,
+            requestId: BridgeProxy.getRandomId(),
+            body: request,
+        };
+
+        const promise = new Promise<TResponse>((resolve, reject) => {
+            const request: BridgeRequest<TResponse> = {
+                requestId: message.requestId,
+                method: message.method,
+                resolve: resolve,
+                reject: reject,
+            };
+            BridgeProxy.bridgeRequests.push(request);
+            window.nestedAppAuthBridge.postMessage(JSON.stringify(message));
+        });
+
+        return promise;
+    }
+
+    /**
+     * Private constructor for BridgeProxy
+     * @param sdkName The name of the SDK being used to make requests on behalf of the app
+     * @param sdkVersion The version of the SDK being used to make requests on behalf of the app
+     * @param capabilities The capabilities of the bridge / SDK / platform broker
+     */
+    private constructor(
+        sdkName: string,
+        sdkVersion: string,
+        capabilities: BridgeCapabilities
+    ) {
+        this.sdkName = sdkName;
+        this.sdkVersion = sdkVersion;
+        this.capabilities = capabilities;
+    }
+
+    /**
+     * Factory method for creating an implementation of IBridgeProxy
+     * @returns A promise that resolves to a BridgeProxy implementation
+     */
+    public static async create(): Promise<IBridgeProxy> {
+        const response = await BridgeProxy.initializeNestedAppAuthBridge();
+        return new BridgeProxy(
+            response.sdkName,
+            response.sdkVersion,
+            response.capabilities
+        );
+    }
+}
+
+export default BridgeProxy;

package/src/naa/BridgeRequest.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type BridgeRequest<TResponse> = {
+    requestId: string;
+    method: string;
+    resolve: (value: TResponse | PromiseLike<TResponse>) => void;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    reject: (reason?: any) => void;
+};

package/src/naa/BridgeRequestEnvelope.ts

@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { TokenRequest } from "./TokenRequest";
+import {
+    AccountByHomeIdRequest,
+    AccountByLocalIdRequest,
+    AccountByUsernameRequest,
+} from "./AccountRequests";
+
+export type BridgeMethods =
+    | "GetToken"
+    | "GetActiveAccount"
+    | "GetAllAccounts"
+    | "GetAccountByHomeId"
+    | "GetAccountByLocalId"
+    | "GetAccountByUsername"
+    | "GetInitContext"
+    | "GetTokenPopup";
+
+export type BridgeRequestEnvelope = {
+    messageType: "NestedAppAuthRequest";
+    method: BridgeMethods;
+    sendTime?: number; // Assume this is epoch
+    clientLibrary?: string;
+    clientLibraryVersion?: string;
+    requestId: string;
+    body?:
+        | TokenRequest
+        | AccountByHomeIdRequest
+        | AccountByLocalIdRequest
+        | AccountByUsernameRequest;
+};
+
+export function isBridgeRequestEnvelope(
+    obj: unknown
+): obj is BridgeRequestEnvelope {
+    return (
+        (obj as BridgeRequestEnvelope).messageType !== undefined &&
+        (obj as BridgeRequestEnvelope).messageType === "NestedAppAuthRequest" &&
+        (obj as BridgeRequestEnvelope).method !== undefined &&
+        (obj as BridgeRequestEnvelope).requestId !== undefined
+    );
+}

package/src/naa/BridgeResponseEnvelope.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { BridgeError } from "./BridgeError";
+import { TokenResponse } from "./TokenResponse";
+import { AccountInfo } from "./AccountInfo";
+import { InitializeBridgeResponse } from "./InitializeBridgeResponse";
+
+export type BridgeResponseEnvelope = {
+    messageType: "NestedAppAuthResponse";
+    requestId: string;
+    success: boolean; // false if body is error
+    body:
+        | TokenResponse
+        | BridgeError
+        | AccountInfo
+        | AccountInfo[]
+        | InitializeBridgeResponse;
+};

package/src/naa/BridgeStatusCode.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export enum BridgeStatusCode {
+    USER_INTERACTION_REQUIRED = "USER_INTERACTION_REQUIRED",
+    USER_CANCEL = "USER_CANCEL",
+    NO_NETWORK = "NO_NETWORK",
+    TRANSIENT_ERROR = "TRANSIENT_ERROR",
+    PERSISTENT_ERROR = "PERSISTENT_ERROR",
+    DISABLED = "DISABLED",
+    ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE",
+    NESTED_APP_AUTH_UNAVAILABLE = "NESTED_APP_AUTH_UNAVAILABLE", // NAA is unavailable in the current context, can retry with standard browser based auth
+}

package/src/naa/IBridgeProxy.ts

@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AccountInfo } from "./AccountInfo";
+import {
+    AccountByHomeIdRequest,
+    AccountByLocalIdRequest,
+    AccountByUsernameRequest,
+} from "./AccountRequests";
+import { TokenRequest } from "./TokenRequest";
+import { TokenResponse } from "./TokenResponse";
+
+export interface IBridgeProxy {
+    getTokenInteractive(request: TokenRequest): Promise<TokenResponse>;
+    getTokenSilent(request: TokenRequest): Promise<TokenResponse>;
+    getAccountInfo(
+        request:
+            | AccountByHomeIdRequest
+            | AccountByLocalIdRequest
+            | AccountByUsernameRequest
+    ): Promise<AccountInfo>;
+    getActiveAccount(): Promise<AccountInfo>;
+}

package/src/naa/InitializeBridgeResponse.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { BridgeCapabilities } from "./BridgeCapabilities";
+
+export interface InitializeBridgeResponse {
+    capabilities: BridgeCapabilities;
+    sdkName: string;
+    sdkVersion: string;
+}

package/src/naa/TokenRequest.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type TokenRequest = {
+    userObjectId?: string; // Account identifier used by OneAuth
+    clientId: string;
+    authority?: string;
+    scope: string;
+    correlationId: string;
+    prompt?: string; // Prompt used to identify interactive request
+    nonce?: string;
+    claims?: string;
+    state?: string;
+    reqCnf?: string; // Having OneAuth own the keypair is better for hardware token binding support
+    keyId?: string; // Having OneAuth own the keypair is better for hardware token binding support
+    authenticationScheme?: string;
+    shrClaims?: string;
+    shrNonce?: string;
+    clientCapabilities?: string[]; // CP1 for CAE support
+    resourceRequestMethod?: string;
+    resourceRequestUri?: string;
+    extendedExpiryToken?: boolean;
+    extraParameters?: Map<string, string>;
+};

package/src/naa/TokenResponse.ts

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AccountInfo } from "./AccountInfo";
+
+export type TokenResponse = {
+    access_token: string;
+    account: AccountInfo;
+    client_info: string;
+    expires_in: number;
+    id_token: string;
+    properties: TokenResponseProperties | null;
+    scope: string;
+    state: string;
+    shr?: string; // token binding enabled at native layer it is the access token, not the signing keys
+    extendedLifetimeToken?: boolean;
+};
+
+export type TokenResponseProperties = {
+    MATS?: string;
+};
+
+/*
+ * Sample response below
+ * {
+ * "body":{
+ *   "access_token":"<token>",
+ *      "account":{"environment":"login.microsoftonline.com",
+ *        "homeAccountId":"2995ae49-d9dd-409d-8d62-ba969ce58a81.51178b70-16cc-41b5-bef1-ae1808139065",
+ *        "idTokenClaims":{
+ *          "aud":"a076930c-cfc9-4ebd-9607-7963bccbf666",
+ *          "exp":"1680557128",
+ *          "graph_url":"https://graph.microsoft.com",
+ *          "iat":"1680553228",
+ *          "iss":"https://login.microsoftonline.com/51178b70-16cc-41b5-bef1-ae1808139065/v2.0",
+ *          "name":"Adele Vance",
+ *          "nbf":"1680553228",
+ *          "oid":"2995ae49-d9dd-409d-8d62-ba969ce58a81",
+ *          "preferred_username":"AdeleV@vc6w6.onmicrosoft.com",
+ *          "rh":"0.AX0AcIsXUcwWtUG-8a4YCBOQZQyTdqDJz71Olgd5Y7zL9maaAHs.",
+ *          "sovereignty2":"Global",
+ *          "sub":"wtxUI1WD2C--Bl8vN1p-P-VgadGud8QSqXD4Vp5i9sc",
+ *          "tid":"51178b70-16cc-41b5-bef1-ae1808139065",
+ *          "uti":"39pEKQyYDU6SXjD_phaCAA",
+ *          "ver":"2.0"},
+ *        "localAccountId":"2995ae49-d9dd-409d-8d62-ba969ce58a81",
+ *        "name":"Adele Vance",
+ *        "tenantId":"51178b70-16cc-41b5-bef1-ae1808139065",
+ *        "username":"AdeleV@vc6w6.onmicrosoft.com"
+ *   },
+ *   "client_info":"",
+ *   "expires_in":4290,
+ *   "id_token":"",
+ *   "properties":null,
+ *   "scope":"User.Read",
+ *   "state":""},
+ * "requestId":"8863d6e8-a539-43e3-84b6-ca1bf64943f3",
+ * "success":true}
+ */