@azure/msal-browser 3.2.0 → 3.3.0

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -0,0 +1,252 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { TokenRequest } from "../TokenRequest";
+import { AccountInfo as NaaAccountInfo } from "../AccountInfo";
+import { RedirectRequest } from "../../request/RedirectRequest";
+import { PopupRequest } from "../../request/PopupRequest";
+import { TokenResponse } from "../TokenResponse";
+import {
+    AccountInfo as MsalAccountInfo,
+    AuthError,
+    ClientAuthError,
+    ClientConfigurationError,
+    InteractionRequiredAuthError,
+    ServerError,
+    TimeUtils,
+    ICrypto,
+    Logger,
+    AuthToken,
+    TokenClaims,
+    ClientAuthErrorCodes,
+} from "@azure/msal-common";
+import { isBridgeError } from "../BridgeError";
+import { BridgeStatusCode } from "../BridgeStatusCode";
+import { SilentRequest } from "../../request/SilentRequest";
+import { AuthenticationResult } from "../../response/AuthenticationResult";
+import {} from "../../error/BrowserAuthErrorCodes";
+
+export class NestedAppAuthAdapter {
+    protected crypto: ICrypto;
+    protected logger: Logger;
+    protected clientId: string;
+    protected clientCapabilities: string[];
+
+    constructor(
+        clientId: string,
+        clientCapabilities: string[],
+        crypto: ICrypto,
+        logger: Logger
+    ) {
+        this.clientId = clientId;
+        this.clientCapabilities = clientCapabilities;
+        this.crypto = crypto;
+        this.logger = logger;
+    }
+
+    public toNaaSilentTokenRequest(request: SilentRequest): TokenRequest {
+        let extraParams: Map<string, string>;
+        if (request.extraQueryParameters === undefined) {
+            extraParams = new Map<string, string>();
+        } else {
+            extraParams = new Map<string, string>(
+                Object.entries(request.extraQueryParameters)
+            );
+        }
+        /**
+         * Need to get information about the client to populate request correctly
+         * For example: client id, client capabilities
+         */
+        const tokenRequest: TokenRequest = {
+            userObjectId: request.account?.homeAccountId,
+            clientId: this.clientId,
+            authority: request.authority,
+            scope: request.scopes.join(" "),
+            correlationId:
+                request.correlationId !== undefined
+                    ? request.correlationId
+                    : this.crypto.createNewGuid(),
+            prompt: request.prompt !== undefined ? request.prompt : "",
+            claims: request.claims !== undefined ? request.claims : "",
+            authenticationScheme:
+                request.authenticationScheme !== undefined
+                    ? request.authenticationScheme
+                    : "",
+            clientCapabilities: this.clientCapabilities,
+            extraParameters: extraParams,
+        };
+
+        return tokenRequest;
+    }
+
+    public toNaaTokenRequest(
+        request: PopupRequest | RedirectRequest
+    ): TokenRequest {
+        let extraParams: Map<string, string>;
+        if (request.extraQueryParameters === undefined) {
+            extraParams = new Map<string, string>();
+        } else {
+            extraParams = new Map<string, string>(
+                Object.entries(request.extraQueryParameters)
+            );
+        }
+
+        const tokenRequest: TokenRequest = {
+            userObjectId: request.account?.homeAccountId,
+            clientId: this.clientId,
+            authority: request.authority,
+            scope: request.scopes.join(" "),
+            correlationId:
+                request.correlationId !== undefined
+                    ? request.correlationId
+                    : "",
+            prompt: request.prompt !== undefined ? request.prompt : "",
+            nonce: request.nonce !== undefined ? request.nonce : "",
+            claims: request.claims !== undefined ? request.claims : "",
+            state: request.state !== undefined ? request.state : "",
+            authenticationScheme:
+                request.authenticationScheme !== undefined
+                    ? request.authenticationScheme
+                    : "",
+            clientCapabilities: undefined,
+            extraParameters: extraParams,
+        };
+
+        return tokenRequest;
+    }
+
+    public fromNaaTokenResponse(
+        request: TokenRequest,
+        response: TokenResponse
+    ): AuthenticationResult {
+        const expiresOn = new Date(
+            TimeUtils.nowSeconds() + (response.expires_in || 0) * 1000
+        );
+
+        const account = this.fromNaaAccountInfo(response.account);
+
+        const authenticationResult: AuthenticationResult = {
+            authority: response.account.environment,
+            uniqueId: response.account.homeAccountId,
+            tenantId: response.account.tenantId,
+            scopes: response.scope.split(" "),
+            account: this.fromNaaAccountInfo(response.account),
+            idToken: response.id_token !== undefined ? response.id_token : "",
+            idTokenClaims:
+                account.idTokenClaims !== undefined
+                    ? account.idTokenClaims
+                    : {},
+            accessToken: response.access_token,
+            fromCache: true,
+            expiresOn: expiresOn,
+            tokenType:
+                request.authenticationScheme !== undefined
+                    ? request.authenticationScheme
+                    : "Bearer",
+            correlationId: request.correlationId,
+            requestId: "",
+            extExpiresOn: expiresOn,
+            state: response.state,
+        };
+
+        return authenticationResult;
+    }
+
+    /*
+     *  export type AccountInfo = {
+     *     homeAccountId: string;
+     *     environment: string;
+     *     tenantId: string;
+     *     username: string;
+     *     localAccountId: string;
+     *     name?: string;
+     *     idToken?: string;
+     *     idTokenClaims?: TokenClaims & {
+     *         [key: string]:
+     *             | string
+     *             | number
+     *             | string[]
+     *             | object
+     *             | undefined
+     *             | unknown;
+     *     };
+     *     nativeAccountId?: string;
+     *     authorityType?: string;
+     * };
+     */
+    public fromNaaAccountInfo(fromAccount: NaaAccountInfo): MsalAccountInfo {
+        let tokenClaims: TokenClaims | undefined;
+        if (fromAccount.idToken !== undefined) {
+            tokenClaims = AuthToken.extractTokenClaims(
+                fromAccount.idToken,
+                this.crypto.base64Decode
+            );
+        } else {
+            tokenClaims = undefined;
+        }
+
+        const account: MsalAccountInfo = {
+            homeAccountId: fromAccount.homeAccountId,
+            environment: fromAccount.environment,
+            tenantId: fromAccount.tenantId,
+            username: fromAccount.username,
+            localAccountId: fromAccount.localAccountId,
+            name: fromAccount.name,
+            idToken: fromAccount.idToken,
+            idTokenClaims: tokenClaims,
+        };
+
+        return account;
+    }
+
+    /**
+     *
+     * @param error BridgeError
+     * @returns AuthError, ClientAuthError, ClientConfigurationError, ServerError, InteractionRequiredError
+     */
+    public fromBridgeError(
+        error: unknown
+    ):
+        | AuthError
+        | ClientAuthError
+        | ClientConfigurationError
+        | ServerError
+        | InteractionRequiredAuthError {
+        if (isBridgeError(error)) {
+            switch (error.status) {
+                case BridgeStatusCode.USER_CANCEL:
+                    return new ClientAuthError(
+                        ClientAuthErrorCodes.userCanceled
+                    );
+                case BridgeStatusCode.NO_NETWORK:
+                    return new ClientAuthError(
+                        ClientAuthErrorCodes.noNetworkConnectivity
+                    );
+                case BridgeStatusCode.ACCOUNT_UNAVAILABLE:
+                    return new ClientAuthError(
+                        ClientAuthErrorCodes.noAccountFound
+                    );
+                case BridgeStatusCode.DISABLED:
+                    return new ClientAuthError(
+                        ClientAuthErrorCodes.nestedAppAuthBridgeDisabled
+                    );
+                case BridgeStatusCode.NESTED_APP_AUTH_UNAVAILABLE:
+                    return new ClientAuthError(error.code, error.description);
+                case BridgeStatusCode.TRANSIENT_ERROR:
+                case BridgeStatusCode.PERSISTENT_ERROR:
+                    return new ServerError(error.code, error.description);
+                case BridgeStatusCode.USER_INTERACTION_REQUIRED:
+                    return new InteractionRequiredAuthError(
+                        error.code,
+                        error.description
+                    );
+                default:
+                    return new AuthError(error.code, error.description);
+            }
+        } else {
+            return new AuthError("unknown_error", "An unknown error occurred");
+        }
+    }
+}

package/src/operatingcontext/TeamsAppOperatingContext.ts

@@ -4,8 +4,14 @@
  */
 
 import { BaseOperatingContext } from "./BaseOperatingContext";
+import { IBridgeProxy } from "../naa/IBridgeProxy";
+import { BridgeProxy } from "../naa/BridgeProxy";
+import { AccountInfo } from "../naa/AccountInfo";
 
 export class TeamsAppOperatingContext extends BaseOperatingContext {
+    protected bridgeProxy: IBridgeProxy | undefined = undefined;
+    protected activeAccount: AccountInfo | undefined = undefined;
+
     /*
      * TODO: Once we have determine the bundling code return here to specify the name of the bundle
      * containing the implementation for this operating context
@@ -33,6 +39,18 @@ export class TeamsAppOperatingContext extends BaseOperatingContext {
         return TeamsAppOperatingContext.ID;
     }
 
+    getBridgeProxy(): IBridgeProxy | undefined {
+        return this.bridgeProxy;
+    }
+
+    getActiveAccount(): AccountInfo | undefined {
+        return this.activeAccount;
+    }
+
+    setActiveAccount(account: AccountInfo): void {
+        this.activeAccount = account;
+    }
+
     /**
      * Checks whether the operating context is available.
      * Confirms that the code is running a browser rather.  This is required.
@@ -40,9 +58,31 @@ export class TeamsAppOperatingContext extends BaseOperatingContext {
      */
     async initialize(): Promise<boolean> {
         /*
-         * TODO: Add implementation to check for presence of inject MetaOSHub JavaScript interface
-         * TODO: Make pre-flight token request to ensure that App is eligible to use Nested App Auth
+         * TODO: Add implementation to check for presence of inject Nested App Auth Bridge JavaScript interface
+         *
          */
-        return false;
+        try {
+            if (typeof window !== "undefined") {
+                const bridgeProxy: IBridgeProxy = await BridgeProxy.create();
+                /*
+                 * Because we want single sign on we need to attempt to
+                 * grab the active account as part of initialization
+                 * this.activeAccount = await bridgeProxy.getActiveAccount();
+                 */
+                try {
+                    this.activeAccount = await bridgeProxy.getActiveAccount();
+                } catch (e) {
+                    this.activeAccount = undefined;
+                }
+                this.bridgeProxy = bridgeProxy;
+                this.available = bridgeProxy !== undefined;
+            } else {
+                this.available = false;
+            }
+        } catch (e) {
+            this.available = false;
+        } finally {
+            return this.available;
+        }
     }
 }

package/src/operatingcontext/UnknownOperatingContext.ts

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { BaseOperatingContext } from "./BaseOperatingContext";
+
+export class UnknownOperatingContext extends BaseOperatingContext {
+    /*
+     * TODO: Once we have determine the bundling code return here to specify the name of the bundle
+     * containing the implementation for this operating context
+     */
+    static readonly MODULE_NAME: string = "";
+
+    /**
+     * Unique identifier for the operating context
+     */
+    static readonly ID: string = "UnknownOperatingContext";
+
+    /**
+     * Return the module name.  Intended for use with import() to enable dynamic import
+     * of the implementation associated with this operating context
+     * @returns
+     */
+    getModuleName(): string {
+        return UnknownOperatingContext.MODULE_NAME;
+    }
+    /**
+     * Returns the unique identifier for this operating context
+     * @returns string
+     */
+    getId(): string {
+        return UnknownOperatingContext.ID;
+    }
+
+    /**
+     * Checks whether the operating context is available.
+     * Confirms that the code is running a browser rather.  This is required.
+     * @returns Promise<boolean> indicating whether this operating context is currently available.
+     */
+    async initialize(): Promise<boolean> {
+        /**
+         * This operating context is in use when we have not checked for what the operating context is.
+         * The context is unknown until we check it.
+         */
+        return true;
+    }
+}

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.2.0";
+export const version = "3.3.0";

package/src/utils/BrowserUtils.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { Constants, UrlString } from "@azure/msal-common";
+import { UrlString } from "@azure/msal-common";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -11,146 +11,154 @@ import {
 import { InteractionType, BrowserConstants } from "./BrowserConstants";
 
 /**
- * Utility class for browser specific functions
+ * Clears hash from window url.
  */
-export class BrowserUtils {
-    // #region Window Navigation and URL management
-
-    /**
-     * Clears hash from window url.
-     */
-    static clearHash(contentWindow: Window): void {
-        // Office.js sets history.replaceState to null
-        contentWindow.location.hash = Constants.EMPTY_STRING;
-        if (typeof contentWindow.history.replaceState === "function") {
-            // Full removes "#" from url
-            contentWindow.history.replaceState(
-                null,
-                Constants.EMPTY_STRING,
-                `${contentWindow.location.origin}${contentWindow.location.pathname}${contentWindow.location.search}`
-            );
-        }
+export function clearHash(contentWindow: Window): void {
+    // Office.js sets history.replaceState to null
+    contentWindow.location.hash = "";
+    if (typeof contentWindow.history.replaceState === "function") {
+        // Full removes "#" from url
+        contentWindow.history.replaceState(
+            null,
+            "",
+            `${contentWindow.location.origin}${contentWindow.location.pathname}${contentWindow.location.search}`
+        );
     }
+}
 
-    /**
-     * Replaces current hash with hash from provided url
-     */
-    static replaceHash(url: string): void {
-        const urlParts = url.split("#");
-        urlParts.shift(); // Remove part before the hash
-        window.location.hash =
-            urlParts.length > 0 ? urlParts.join("#") : Constants.EMPTY_STRING;
-    }
+/**
+ * Replaces current hash with hash from provided url
+ */
+export function replaceHash(url: string): void {
+    const urlParts = url.split("#");
+    urlParts.shift(); // Remove part before the hash
+    window.location.hash = urlParts.length > 0 ? urlParts.join("#") : "";
+}
 
-    /**
-     * Returns boolean of whether the current window is in an iframe or not.
-     */
-    static isInIframe(): boolean {
-        return window.parent !== window;
-    }
+/**
+ * Returns boolean of whether the current window is in an iframe or not.
+ */
+export function isInIframe(): boolean {
+    return window.parent !== window;
+}
 
-    /**
-     * Returns boolean of whether or not the current window is a popup opened by msal
-     */
-    static isInPopup(): boolean {
-        return (
-            typeof window !== "undefined" &&
-            !!window.opener &&
-            window.opener !== window &&
-            typeof window.name === "string" &&
-            window.name.indexOf(`${BrowserConstants.POPUP_NAME_PREFIX}.`) === 0
-        );
-    }
+/**
+ * Returns boolean of whether or not the current window is a popup opened by msal
+ */
+export function isInPopup(): boolean {
+    return (
+        typeof window !== "undefined" &&
+        !!window.opener &&
+        window.opener !== window &&
+        typeof window.name === "string" &&
+        window.name.indexOf(`${BrowserConstants.POPUP_NAME_PREFIX}.`) === 0
+    );
+}
 
-    // #endregion
+// #endregion
 
-    /**
-     * Returns current window URL as redirect uri
-     */
-    static getCurrentUri(): string {
-        return window.location.href.split("?")[0].split("#")[0];
-    }
+/**
+ * Returns current window URL as redirect uri
+ */
+export function getCurrentUri(): string {
+    return window.location.href.split("?")[0].split("#")[0];
+}
 
-    /**
-     * Gets the homepage url for the current window location.
-     */
-    static getHomepage(): string {
-        const currentUrl = new UrlString(window.location.href);
-        const urlComponents = currentUrl.getUrlComponents();
-        return `${urlComponents.Protocol}//${urlComponents.HostNameAndPort}/`;
-    }
+/**
+ * Gets the homepage url for the current window location.
+ */
+export function getHomepage(): string {
+    const currentUrl = new UrlString(window.location.href);
+    const urlComponents = currentUrl.getUrlComponents();
+    return `${urlComponents.Protocol}//${urlComponents.HostNameAndPort}/`;
+}
 
-    /**
-     * Throws error if we have completed an auth and are
-     * attempting another auth request inside an iframe.
-     */
-    static blockReloadInHiddenIframes(): void {
-        const isResponseHash = UrlString.hashContainsKnownProperties(
-            window.location.hash
-        );
-        // return an error if called from the hidden iframe created by the msal js silent calls
-        if (isResponseHash && BrowserUtils.isInIframe()) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.blockIframeReload
-            );
-        }
+/**
+ * Throws error if we have completed an auth and are
+ * attempting another auth request inside an iframe.
+ */
+export function blockReloadInHiddenIframes(): void {
+    const isResponseHash = UrlString.hashContainsKnownProperties(
+        window.location.hash
+    );
+    // return an error if called from the hidden iframe created by the msal js silent calls
+    if (isResponseHash && isInIframe()) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.blockIframeReload);
     }
+}
 
-    /**
-     * Block redirect operations in iframes unless explicitly allowed
-     * @param interactionType Interaction type for the request
-     * @param allowRedirectInIframe Config value to allow redirects when app is inside an iframe
-     */
-    static blockRedirectInIframe(
-        interactionType: InteractionType,
-        allowRedirectInIframe: boolean
-    ): void {
-        const isIframedApp = BrowserUtils.isInIframe();
-        if (
-            interactionType === InteractionType.Redirect &&
-            isIframedApp &&
-            !allowRedirectInIframe
-        ) {
-            // If we are not in top frame, we shouldn't redirect. This is also handled by the service.
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.redirectInIframe
-            );
-        }
+/**
+ * Block redirect operations in iframes unless explicitly allowed
+ * @param interactionType Interaction type for the request
+ * @param allowRedirectInIframe Config value to allow redirects when app is inside an iframe
+ */
+export function blockRedirectInIframe(
+    interactionType: InteractionType,
+    allowRedirectInIframe: boolean
+): void {
+    const isIframedApp = isInIframe();
+    if (
+        interactionType === InteractionType.Redirect &&
+        isIframedApp &&
+        !allowRedirectInIframe
+    ) {
+        // If we are not in top frame, we shouldn't redirect. This is also handled by the service.
+        throw createBrowserAuthError(BrowserAuthErrorCodes.redirectInIframe);
     }
+}
 
-    /**
-     * Block redirectUri loaded in popup from calling AcquireToken APIs
-     */
-    static blockAcquireTokenInPopups(): void {
-        // Popups opened by msal popup APIs are given a name that starts with "msal."
-        if (BrowserUtils.isInPopup()) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.blockNestedPopups
-            );
-        }
+/**
+ * Block redirectUri loaded in popup from calling AcquireToken APIs
+ */
+export function blockAcquireTokenInPopups(): void {
+    // Popups opened by msal popup APIs are given a name that starts with "msal."
+    if (isInPopup()) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.blockNestedPopups);
     }
+}
 
-    /**
-     * Throws error if token requests are made in non-browser environment
-     * @param isBrowserEnvironment Flag indicating if environment is a browser.
-     */
-    static blockNonBrowserEnvironment(isBrowserEnvironment: boolean): void {
-        if (!isBrowserEnvironment) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.nonBrowserEnvironment
-            );
-        }
+/**
+ * Throws error if token requests are made in non-browser environment
+ * @param isBrowserEnvironment Flag indicating if environment is a browser.
+ */
+export function blockNonBrowserEnvironment(
+    isBrowserEnvironment: boolean
+): void {
+    if (!isBrowserEnvironment) {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.nonBrowserEnvironment
+        );
     }
+}
 
-    /**
-     * Throws error if initialize hasn't been called
-     * @param initialized
-     */
-    static blockAPICallsBeforeInitialize(initialized: boolean): void {
-        if (!initialized) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.uninitializedPublicClientApplication
-            );
-        }
+/**
+ * Throws error if initialize hasn't been called
+ * @param initialized
+ */
+export function blockAPICallsBeforeInitialize(initialized: boolean): void {
+    if (!initialized) {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.uninitializedPublicClientApplication
+        );
     }
 }
+
+/**
+ * Adds a preconnect link element to the header which begins DNS resolution and SSL connection in anticipation of the /token request
+ * @param loginDomain Authority domain, including https protocol e.g. https://login.microsoftonline.com
+ * @returns
+ */
+export function preconnect(authority: string): void {
+    const link = document.createElement("link");
+    link.rel = "preconnect";
+    link.href = new URL(authority).origin;
+    link.crossOrigin = "anonymous";
+    document.head.appendChild(link);
+
+    // The browser will close connection if not used within a few seconds, remove element from the header after 10s
+    window.setTimeout(() => {
+        try {
+            document.head.removeChild(link);
+        } catch {}
+    }, 10000); // 10s Timeout
+}