@azure/msal-browser 3.2.0 → 3.4.0

package/src/controllers/StandardController.ts

@@ -21,7 +21,6 @@ import {
     PromptValue,
     InProgressPerformanceEvent,
     RequestThumbprint,
-    ServerError,
     AccountEntity,
     ServerResponseType,
     UrlString,
@@ -29,6 +28,8 @@ import {
     createClientAuthError,
     ClientAuthErrorCodes,
     AccountFilter,
+    buildStaticAuthorityOptions,
+    InteractionRequiredAuthErrorCodes,
 } from "@azure/msal-common";
 import {
     BrowserCacheManager,
@@ -45,7 +46,7 @@ import {
     DEFAULT_REQUEST,
     BrowserConstants,
 } from "../utils/BrowserConstants";
-import { BrowserUtils } from "../utils/BrowserUtils";
+import * as BrowserUtils from "../utils/BrowserUtils";
 import { RedirectRequest } from "../request/RedirectRequest";
 import { PopupRequest } from "../request/PopupRequest";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";
@@ -207,7 +208,8 @@ export class StandardController implements IController {
                   this.config.auth.clientId,
                   this.config.cache,
                   this.browserCrypto,
-                  this.logger
+                  this.logger,
+                  buildStaticAuthorityOptions(this.config.auth)
               )
             : DEFAULT_BROWSER_CACHE_MANAGER(
                   this.config.auth.clientId,
@@ -1045,13 +1047,13 @@ export class StandardController implements IController {
     protected async acquireTokenFromCache(
         silentCacheClient: SilentCacheClient,
         commonRequest: CommonSilentFlowRequest,
-        silentRequest: SilentRequest
+        cacheLookupPolicy: CacheLookupPolicy
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.AcquireTokenFromCache,
             commonRequest.correlationId
         );
-        switch (silentRequest.cacheLookupPolicy) {
+        switch (cacheLookupPolicy) {
             case CacheLookupPolicy.Default:
             case CacheLookupPolicy.AccessToken:
             case CacheLookupPolicy.AccessTokenAndRefreshToken:
@@ -1072,18 +1074,18 @@ export class StandardController implements IController {
     /**
      * Attempt to acquire an access token via a refresh token
      * @param commonRequest CommonSilentFlowRequest
-     * @param silentRequest SilentRequest
+     * @param cacheLookupPolicy CacheLookupPolicy
      * @returns A promise that, when resolved, returns the access token
      */
     public async acquireTokenByRefreshToken(
         commonRequest: CommonSilentFlowRequest,
-        silentRequest: SilentRequest
+        cacheLookupPolicy: CacheLookupPolicy
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.AcquireTokenByRefreshToken,
             commonRequest.correlationId
         );
-        switch (silentRequest.cacheLookupPolicy) {
+        switch (cacheLookupPolicy) {
             case CacheLookupPolicy.Default:
             case CacheLookupPolicy.AccessTokenAndRefreshToken:
             case CacheLookupPolicy.RefreshToken:
@@ -1559,10 +1561,10 @@ export class StandardController implements IController {
     ): string {
         const account =
             request.account ||
-            this.browserStorage.getAccountInfoByHints(
-                request.loginHint,
-                request.sid
-            ) ||
+            this.browserStorage.getAccountInfoFilteredBy({
+                loginHint: request.loginHint,
+                sid: request.sid,
+            }) ||
             this.getActiveAccount();
 
         return (account && account.nativeAccountId) || "";
@@ -2053,12 +2055,8 @@ export class StandardController implements IController {
                 request.correlationId
             )(request, account);
 
-            const requestWithCLP = {
-                ...request,
-                // set the request's CacheLookupPolicy to Default if it was not optionally passed in
-                cacheLookupPolicy:
-                    request.cacheLookupPolicy || CacheLookupPolicy.Default,
-            };
+            const cacheLookupPolicy =
+                request.cacheLookupPolicy || CacheLookupPolicy.Default;
 
             result = invokeAsync(
                 this.acquireTokenFromCache.bind(this),
@@ -2066,10 +2064,10 @@ export class StandardController implements IController {
                 this.logger,
                 this.performanceClient,
                 silentRequest.correlationId
-            )(silentCacheClient, silentRequest, requestWithCLP).catch(
+            )(silentCacheClient, silentRequest, cacheLookupPolicy).catch(
                 (cacheError: AuthError) => {
                     if (
-                        requestWithCLP.cacheLookupPolicy ===
+                        request.cacheLookupPolicy ===
                         CacheLookupPolicy.AccessToken
                     ) {
                         throw cacheError;
@@ -2089,42 +2087,42 @@ export class StandardController implements IController {
                         this.logger,
                         this.performanceClient,
                         silentRequest.correlationId
-                    )(silentRequest, requestWithCLP).catch(
+                    )(silentRequest, cacheLookupPolicy).catch(
                         (refreshTokenError: AuthError) => {
-                            const isServerError =
-                                refreshTokenError instanceof ServerError;
-                            const isInteractionRequiredError =
-                                refreshTokenError instanceof
-                                InteractionRequiredAuthError;
-                            const isInvalidGrantError =
+                            const isSilentlyResolvable =
+                                (!(
+                                    refreshTokenError instanceof
+                                    InteractionRequiredAuthError
+                                ) &&
+                                    (refreshTokenError.errorCode ===
+                                        BrowserConstants.INVALID_GRANT_ERROR ||
+                                        refreshTokenError.errorCode ===
+                                            ClientAuthErrorCodes.tokenRefreshRequired)) ||
                                 refreshTokenError.errorCode ===
-                                BrowserConstants.INVALID_GRANT_ERROR;
-
-                            if (
-                                (!isServerError ||
-                                    !isInvalidGrantError ||
-                                    isInteractionRequiredError ||
-                                    requestWithCLP.cacheLookupPolicy ===
-                                        CacheLookupPolicy.AccessTokenAndRefreshToken ||
-                                    requestWithCLP.cacheLookupPolicy ===
-                                        CacheLookupPolicy.RefreshToken) &&
-                                requestWithCLP.cacheLookupPolicy !==
-                                    CacheLookupPolicy.Skip
-                            ) {
+                                    InteractionRequiredAuthErrorCodes.noTokensFound;
+
+                            const tryIframeRenewal =
+                                cacheLookupPolicy ===
+                                    CacheLookupPolicy.Default ||
+                                cacheLookupPolicy === CacheLookupPolicy.Skip ||
+                                cacheLookupPolicy ===
+                                    CacheLookupPolicy.RefreshTokenAndNetwork;
+
+                            if (isSilentlyResolvable && tryIframeRenewal) {
+                                this.logger.verbose(
+                                    "Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",
+                                    request.correlationId
+                                );
+                                return invokeAsync(
+                                    this.acquireTokenBySilentIframe.bind(this),
+                                    PerformanceEvents.AcquireTokenBySilentIframe,
+                                    this.logger,
+                                    this.performanceClient,
+                                    silentRequest.correlationId
+                                )(silentRequest);
+                            } else {
                                 throw refreshTokenError;
                             }
-
-                            this.logger.verbose(
-                                "Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",
-                                request.correlationId
-                            );
-                            return invokeAsync(
-                                this.acquireTokenBySilentIframe.bind(this),
-                                PerformanceEvents.AcquireTokenBySilentIframe,
-                                this.logger,
-                                this.performanceClient,
-                                silentRequest.correlationId
-                            )(silentRequest);
                         }
                     );
                 }

package/src/controllers/UnknownOperatingContextController.ts

@@ -0,0 +1,383 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    CommonAuthorizationUrlRequest,
+    CommonSilentFlowRequest,
+    PerformanceCallbackFunction,
+    AccountInfo,
+    Logger,
+    ICrypto,
+    IPerformanceClient,
+    DEFAULT_CRYPTO_IMPLEMENTATION,
+    AccountFilter,
+} from "@azure/msal-common";
+import { ITokenCache } from "../cache/ITokenCache";
+import { BrowserConfiguration } from "../config/Configuration";
+import {
+    BrowserCacheManager,
+    DEFAULT_BROWSER_CACHE_MANAGER,
+} from "../cache/BrowserCacheManager";
+import { INavigationClient } from "../navigation/INavigationClient";
+import { AuthorizationCodeRequest } from "../request/AuthorizationCodeRequest";
+import { EndSessionPopupRequest } from "../request/EndSessionPopupRequest";
+import { EndSessionRequest } from "../request/EndSessionRequest";
+import { PopupRequest } from "../request/PopupRequest";
+import { RedirectRequest } from "../request/RedirectRequest";
+import { SilentRequest } from "../request/SilentRequest";
+import { SsoSilentRequest } from "../request/SsoSilentRequest";
+import { AuthenticationResult } from "../response/AuthenticationResult";
+import { ApiId, WrapperSKU, InteractionType } from "../utils/BrowserConstants";
+import { IController } from "./IController";
+import { UnknownOperatingContext } from "../operatingcontext/UnknownOperatingContext";
+import { CryptoOps } from "../crypto/CryptoOps";
+import {
+    blockAPICallsBeforeInitialize,
+    blockNonBrowserEnvironment,
+} from "../utils/BrowserUtils";
+import { EventHandler } from "../event/EventHandler";
+import { EventCallbackFunction } from "../event/EventMessage";
+import { ClearCacheRequest } from "../request/ClearCacheRequest";
+
+/**
+ * UnknownOperatingContextController class
+ *
+ * - Until initialize method is called, this controller is the default
+ * - AFter initialize method is called, this controller will be swapped out for the appropriate controller
+ * if the operating context can be determined; otherwise this controller will continued be used
+ *
+ * - Why do we have this?  We don't want to dynamically import (download) all of the code in StandardController if we don't need to.
+ *
+ * - Only includes implementation for getAccounts and handleRedirectPromise
+ *   - All other methods are will throw initialization error (because either initialize method or the factory method were not used)
+ *   - This controller is necessary for React Native wrapper, server side rendering and any other scenario where we don't have a DOM
+ *
+ */
+export class UnknownOperatingContextController implements IController {
+    // OperatingContext
+    protected readonly operatingContext: UnknownOperatingContext;
+
+    // Logger
+    protected logger: Logger;
+
+    // Storage interface implementation
+    protected readonly browserStorage: BrowserCacheManager;
+
+    // Input configuration by developer/user
+    protected readonly config: BrowserConfiguration;
+
+    // Performance telemetry client
+    protected readonly performanceClient: IPerformanceClient;
+
+    // Crypto interface implementation
+    protected readonly browserCrypto: ICrypto;
+
+    // Flag to indicate if in browser environment
+    protected isBrowserEnvironment: boolean;
+
+    // Flag representing whether or not the initialize API has been called and completed
+    protected initialized: boolean = false;
+
+    protected readonly eventHandler: EventHandler;
+
+    constructor(operatingContext: UnknownOperatingContext) {
+        this.operatingContext = operatingContext;
+
+        this.isBrowserEnvironment =
+            this.operatingContext.isBrowserEnvironment();
+
+        this.config = operatingContext.getConfig();
+
+        this.logger = operatingContext.getLogger();
+
+        // Initialize performance client
+        this.performanceClient = this.config.telemetry.client;
+
+        // Initialize the crypto class.
+        this.browserCrypto = this.isBrowserEnvironment
+            ? new CryptoOps(this.logger, this.performanceClient)
+            : DEFAULT_CRYPTO_IMPLEMENTATION;
+
+        // Initialize the browser storage class.
+        this.browserStorage = this.isBrowserEnvironment
+            ? new BrowserCacheManager(
+                  this.config.auth.clientId,
+                  this.config.cache,
+                  this.browserCrypto,
+                  this.logger
+              )
+            : DEFAULT_BROWSER_CACHE_MANAGER(
+                  this.config.auth.clientId,
+                  this.logger
+              );
+
+        this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
+    }
+    getBrowserStorage(): BrowserCacheManager {
+        return this.browserStorage;
+    }
+
+    getEventHandler(): EventHandler {
+        return this.eventHandler;
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    getAccount(accountFilter: AccountFilter): AccountInfo | null {
+        return null;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    getAccountByHomeId(homeAccountId: string): AccountInfo | null {
+        return null;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    getAccountByLocalId(localAccountId: string): AccountInfo | null {
+        return null;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    getAccountByUsername(username: string): AccountInfo | null {
+        return null;
+    }
+    getAllAccounts(): AccountInfo[] {
+        return [];
+    }
+    initialize(): Promise<void> {
+        this.initialized = true;
+        return Promise.resolve();
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    acquireTokenPopup(request: PopupRequest): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    acquireTokenRedirect(request: RedirectRequest): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return Promise.resolve();
+    }
+    acquireTokenSilent(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        silentRequest: SilentRequest
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    acquireTokenByCode(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request: AuthorizationCodeRequest
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    acquireTokenNative(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request:
+            | PopupRequest
+            | SilentRequest
+            | Partial<
+                  Omit<
+                      CommonAuthorizationUrlRequest,
+                      | "responseMode"
+                      | "codeChallenge"
+                      | "codeChallengeMethod"
+                      | "requestedClaimsHash"
+                      | "nativeBroker"
+                  >
+              >,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        apiId: ApiId,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        accountId?: string | undefined
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    acquireTokenByRefreshToken(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        commonRequest: CommonSilentFlowRequest,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        silentRequest: SilentRequest
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    addEventCallback(callback: EventCallbackFunction): string | null {
+        return this.eventHandler.addEventCallback(callback);
+    }
+    removeEventCallback(callbackId: string): void {
+        this.eventHandler.removeEventCallback(callbackId);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    addPerformanceCallback(callback: PerformanceCallbackFunction): string {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return "";
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    removePerformanceCallback(callbackId: string): boolean {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return true;
+    }
+    enableAccountStorageEvents(): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+    disableAccountStorageEvents(): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+
+    handleRedirectPromise(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        hash?: string | undefined
+    ): Promise<AuthenticationResult | null> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        return Promise.resolve(null);
+    }
+    loginPopup(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request?: PopupRequest | undefined
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    loginRedirect(request?: RedirectRequest | undefined): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<void>;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    logout(logoutRequest?: EndSessionRequest | undefined): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<void>;
+    }
+    logoutRedirect(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        logoutRequest?: EndSessionRequest | undefined
+    ): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<void>;
+    }
+    logoutPopup(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        logoutRequest?: EndSessionPopupRequest | undefined
+    ): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<void>;
+    }
+    ssoSilent(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request: Partial<
+            Omit<
+                CommonAuthorizationUrlRequest,
+                | "responseMode"
+                | "codeChallenge"
+                | "codeChallengeMethod"
+                | "requestedClaimsHash"
+                | "nativeBroker"
+            >
+        >
+    ): Promise<AuthenticationResult> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Promise<AuthenticationResult>;
+    }
+    getTokenCache(): ITokenCache {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as ITokenCache;
+    }
+    getLogger(): Logger {
+        return this.logger;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    setLogger(logger: Logger): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    setActiveAccount(account: AccountInfo | null): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+    getActiveAccount(): AccountInfo | null {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return null;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    initializeWrapperLibrary(sku: WrapperSKU, version: string): void {
+        this.browserStorage.setWrapperMetadata(sku, version);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    setNavigationClient(navigationClient: INavigationClient): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+    getConfiguration(): BrowserConfiguration {
+        return this.config;
+    }
+    isBrowserEnv(): boolean {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return true;
+    }
+    getBrowserCrypto(): ICrypto {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as ICrypto;
+    }
+    getPerformanceClient(): IPerformanceClient {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as IPerformanceClient;
+    }
+    getRedirectResponse(): Map<string, Promise<AuthenticationResult | null>> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        return {} as Map<string, Promise<AuthenticationResult | null>>;
+    }
+    preflightBrowserEnvironmentCheck(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        interactionType: InteractionType,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        isAppEmbedded?: boolean | undefined
+    ): void {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    async clearCache(logoutRequest?: ClearCacheRequest): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    async hydrateCache(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        result: AuthenticationResult,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request:
+            | SilentRequest
+            | SsoSilentRequest
+            | RedirectRequest
+            | PopupRequest
+    ): Promise<void> {
+        blockAPICallsBeforeInitialize(this.initialized);
+        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+    }
+}

package/src/crypto/BrowserCrypto.ts

@@ -3,7 +3,6 @@
  * Licensed under the MIT License.
  */
 
-import { BrowserStringUtils } from "../utils/BrowserStringUtils";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -64,7 +63,8 @@ export async function sha256Digest(
         PerformanceEvents.Sha256Digest,
         correlationId
     );
-    const data = BrowserStringUtils.stringToUtf8Arr(dataString);
+    const encoder = new TextEncoder();
+    const data = encoder.encode(dataString);
     return window.crypto.subtle.digest(
         S256_HASH_ALG,
         data

package/src/crypto/CryptoOps.ts

@@ -15,7 +15,6 @@ import {
 import { base64Encode, urlEncode, urlEncodeArr } from "../encode/Base64Encode";
 import { base64Decode } from "../encode/Base64Decode";
 import * as BrowserCrypto from "./BrowserCrypto";
-import { BrowserStringUtils } from "../utils/BrowserStringUtils";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -109,7 +108,7 @@ export class CryptoOps implements ICrypto {
         };
 
         const publicJwkString: string =
-            BrowserStringUtils.getSortedObjectString(pubKeyThumprintObj);
+            getSortedObjectString(pubKeyThumprintObj);
         const publicJwkHash = await this.hashString(publicJwkString);
 
         // Generate Thumbprint for Private Key
@@ -180,8 +179,7 @@ export class CryptoOps implements ICrypto {
         const publicKeyJwk = await BrowserCrypto.exportJwk(
             cachedKeyPair.publicKey
         );
-        const publicKeyJwkString =
-            BrowserStringUtils.getSortedObjectString(publicKeyJwk);
+        const publicKeyJwkString = getSortedObjectString(publicKeyJwk);
 
         // Base64URL encode public key thumbprint with keyId only: BASE64URL({ kid: "FULL_PUBLIC_KEY_HASH" })
         const encodedKeyIdThumbprint = urlEncode(JSON.stringify({ kid: kid }));
@@ -203,7 +201,8 @@ export class CryptoOps implements ICrypto {
         const tokenString = `${encodedShrHeader}.${encodedPayload}`;
 
         // Sign token
-        const tokenBuffer = BrowserStringUtils.stringToUtf8Arr(tokenString);
+        const encoder = new TextEncoder();
+        const tokenBuffer = encoder.encode(tokenString);
         const signatureBuffer = await BrowserCrypto.sign(
             cachedKeyPair.privateKey,
             tokenBuffer
@@ -233,3 +232,7 @@ export class CryptoOps implements ICrypto {
         return urlEncodeArr(hashBytes);
     }
 }
+
+function getSortedObjectString(obj: object): string {
+    return JSON.stringify(obj, Object.keys(obj).sort());
+}

package/src/error/NestedAppAuthError.ts

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "@azure/msal-common";
+
+/**
+ * NestedAppAuthErrorMessage class containing string constants used by error codes and messages.
+ */
+export const NestedAppAuthErrorMessage = {
+    unsupportedMethod: {
+        code: "unsupported_method",
+        desc: "The PKCE code challenge and verifier could not be generated.",
+    },
+};
+
+export class NestedAppAuthError extends AuthError {
+    constructor(errorCode: string, errorMessage?: string) {
+        super(errorCode, errorMessage);
+
+        Object.setPrototypeOf(this, NestedAppAuthError.prototype);
+        this.name = "NestedAppAuthError";
+    }
+
+    public static createUnsupportedError(): NestedAppAuthError {
+        return new NestedAppAuthError(
+            NestedAppAuthErrorMessage.unsupportedMethod.code,
+            NestedAppAuthErrorMessage.unsupportedMethod.desc
+        );
+    }
+}