@azure/msal-browser 3.27.0 → 4.0.0-alpha.0

package/src/controllers/NestedAppAuthController.ts

@@ -157,8 +157,8 @@ export class NestedAppAuthController implements IController {
      * Specific implementation of initialize function for NestedAppAuthController
      * @returns
      */
-    initialize(): Promise<void> {
-        // do nothing not required by this controller
+    async initialize(): Promise<void> {
+        await this.browserStorage.initialize();
         return Promise.resolve();
     }
 
@@ -842,7 +842,7 @@ export class NestedAppAuthController implements IController {
             result.cloudGraphHostName,
             result.msGraphHost
         );
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(accountEntity);
         return this.browserStorage.hydrateCache(result, request);
     }
 }

package/src/controllers/StandardController.ts

@@ -331,6 +331,8 @@ export class StandardController implements IController {
             return;
         }
 
+        await this.browserStorage.initialize();
+
         const initCorrelationId =
             request?.correlationId || this.getRequestCorrelationId();
         const allowNativeBroker = this.config.system.allowNativeBroker;
@@ -1472,7 +1474,7 @@ export class StandardController implements IController {
             result.cloudGraphHostName,
             result.msGraphHost
         );
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(accountEntity);
 
         if (result.fromNativeBroker) {
             this.logger.verbose(

package/src/crypto/BrowserCrypto.ts

@@ -13,6 +13,7 @@ import {
 } from "@azure/msal-common/browser";
 import { KEY_FORMAT_JWK } from "../utils/BrowserConstants.js";
 import { urlEncodeArr } from "../encode/Base64Encode.js";
+import { base64DecToArr } from "../encode/Base64Decode.js";
 
 /**
  * This file defines functions used by the browser library to perform cryptography operations such as
@@ -22,8 +23,10 @@ import { urlEncodeArr } from "../encode/Base64Encode.js";
 /**
  * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
  */
-// RSA KeyGen Algorithm
+// Algorithms
 const PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+const AES_GCM = "AES-GCM";
+const HKDF = "HKDF";
 // SHA-256 hashing algorithm
 const S256_HASH_ALG = "SHA-256";
 // MOD length for PoP tokens
@@ -35,6 +38,14 @@ const UUID_CHARS = "0123456789abcdef";
 // Array to store UINT32 random value
 const UINT32_ARR = new Uint32Array(1);
 
+// Key Format
+const RAW = "raw";
+// Key Usages
+const ENCRYPT = "encrypt";
+const DECRYPT = "decrypt";
+const DERIVE_KEY = "deriveKey";
+
+// Suberror
 const SUBTLE_SUBERROR = "crypto_subtle_undefined";
 
 const keygenAlgorithmOptions: RsaHashedKeyGenParams = {
@@ -213,6 +224,114 @@ export async function sign(
     ) as Promise<ArrayBuffer>;
 }
 
+/**
+ * Generates symmetric base encryption key. This may be stored as all encryption/decryption keys will be derived from this one.
+ */
+export async function generateBaseKey(): Promise<ArrayBuffer> {
+    const key = await window.crypto.subtle.generateKey(
+        {
+            name: AES_GCM,
+            length: 256,
+        },
+        true,
+        [ENCRYPT, DECRYPT]
+    );
+    return window.crypto.subtle.exportKey(RAW, key);
+}
+
+/**
+ * Returns the raw key to be passed into the key derivation function
+ * @param baseKey
+ * @returns
+ */
+export async function generateHKDF(baseKey: ArrayBuffer): Promise<CryptoKey> {
+    return window.crypto.subtle.importKey(RAW, baseKey, HKDF, false, [
+        DERIVE_KEY,
+    ]);
+}
+
+/**
+ * Given a base key and a nonce generates a derived key to be used in encryption and decryption.
+ * Note: every time we encrypt a new key is derived
+ * @param baseKey
+ * @param nonce
+ * @returns
+ */
+async function deriveKey(
+    baseKey: CryptoKey,
+    nonce: ArrayBuffer,
+    context: string
+): Promise<CryptoKey> {
+    return window.crypto.subtle.deriveKey(
+        {
+            name: HKDF,
+            salt: nonce,
+            hash: S256_HASH_ALG,
+            info: new TextEncoder().encode(context),
+        },
+        baseKey,
+        { name: AES_GCM, length: 256 },
+        false,
+        [ENCRYPT, DECRYPT]
+    );
+}
+
+/**
+ * Encrypt the given data given a base key. Returns encrypted data and a nonce that must be provided during decryption
+ * @param key
+ * @param rawData
+ */
+export async function encrypt(
+    baseKey: CryptoKey,
+    rawData: string,
+    context: string
+): Promise<{ data: string; nonce: string }> {
+    const encodedData = new TextEncoder().encode(rawData);
+    // The nonce must never be reused with a given key.
+    const nonce = window.crypto.getRandomValues(new Uint8Array(16));
+    const derivedKey = await deriveKey(baseKey, nonce, context);
+    const encryptedData = await window.crypto.subtle.encrypt(
+        {
+            name: AES_GCM,
+            iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+        },
+        derivedKey,
+        encodedData
+    );
+
+    return {
+        data: urlEncodeArr(new Uint8Array(encryptedData)),
+        nonce: urlEncodeArr(nonce),
+    };
+}
+
+/**
+ * Decrypt data with the given key and nonce
+ * @param key
+ * @param nonce
+ * @param encryptedData
+ * @returns
+ */
+export async function decrypt(
+    baseKey: CryptoKey,
+    nonce: string,
+    context: string,
+    encryptedData: string
+): Promise<string> {
+    const encodedData = base64DecToArr(encryptedData);
+    const derivedKey = await deriveKey(baseKey, base64DecToArr(nonce), context);
+    const decryptedData = await window.crypto.subtle.decrypt(
+        {
+            name: AES_GCM,
+            iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+        },
+        derivedKey,
+        encodedData
+    );
+
+    return new TextDecoder().decode(decryptedData);
+}
+
 /**
  * Returns the SHA-256 hash of an input string
  * @param plainText

package/src/encode/Base64Decode.ts

@@ -25,7 +25,7 @@ export function base64Decode(input: string): string {
  * Decodes base64 into Uint8Array
  * @param base64String
  */
-function base64DecToArr(base64String: string): Uint8Array {
+export function base64DecToArr(base64String: string): Uint8Array {
     let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
     switch (encodedString.length % 4) {
         case 0:

package/src/index.ts

@@ -74,7 +74,9 @@ export { ITokenCache } from "./cache/ITokenCache.js";
 
 // Storage
 export { MemoryStorage } from "./cache/MemoryStorage.js";
-export { BrowserStorage } from "./cache/BrowserStorage.js";
+export { LocalStorage } from "./cache/LocalStorage.js";
+export { SessionStorage } from "./cache/SessionStorage.js";
+export { IWindowStorage } from "./cache/IWindowStorage.js";
 
 // Events
 export {

package/src/interaction_client/NativeInteractionClient.ts

@@ -529,7 +529,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
         );
 
         // cache accounts and tokens in the appropriate storage
-        this.cacheAccount(baseAccount);
+        await this.cacheAccount(baseAccount);
         this.cacheNativeTokens(
             response,
             request,
@@ -722,9 +722,9 @@ export class NativeInteractionClient extends BaseInteractionClient {
      * cache the account entity in browser storage
      * @param accountEntity
      */
-    cacheAccount(accountEntity: AccountEntity): void {
+    async cacheAccount(accountEntity: AccountEntity): Promise<void> {
         // Store the account info and hence `nativeAccountId` in browser cache
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(accountEntity);
 
         // Remove any existing cached tokens for this account in browser storage
         this.browserStorage.removeAccountContext(accountEntity).catch((e) => {

package/src/interaction_client/StandardInteractionClient.ts

@@ -362,6 +362,11 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 .serverResponseType as ResponseMode,
         };
 
+        // Skip active account lookup if either login hint or session id is set
+        if (request.loginHint || request.sid) {
+            return validatedRequest;
+        }
+
         const account =
             request.account || this.browserStorage.getActiveAccount();
         if (account) {
@@ -376,14 +381,6 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             validatedRequest.account = account;
         }
 
-        // Check for ADAL/MSAL v1 SSO
-        if (!validatedRequest.loginHint && !account) {
-            const legacyLoginHint = this.browserStorage.getLegacyLoginHint();
-            if (legacyLoginHint) {
-                validatedRequest.loginHint = legacyLoginHint;
-            }
-        }
-
         return validatedRequest;
     }
 }

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.27.0";
+export const version = "4.0.0-alpha.0";

package/dist/cache/BrowserStorage.d.ts

@@ -1,12 +0,0 @@
-import { IWindowStorage } from "./IWindowStorage.js";
-export declare class BrowserStorage implements IWindowStorage<string> {
-    private windowStorage;
-    constructor(cacheLocation: string);
-    private validateWindowStorage;
-    getItem(key: string): string | null;
-    setItem(key: string, value: string): void;
-    removeItem(key: string): void;
-    getKeys(): string[];
-    containsKey(key: string): boolean;
-}
-//# sourceMappingURL=BrowserStorage.d.ts.map

package/dist/cache/BrowserStorage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"BrowserStorage.d.ts","sourceRoot":"","sources":["../../src/cache/BrowserStorage.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,qBAAa,cAAe,YAAW,cAAc,CAAC,MAAM,CAAC;IACzD,OAAO,CAAC,aAAa,CAAU;gBAEnB,aAAa,EAAE,MAAM;IAKjC,OAAO,CAAC,qBAAqB;IAY7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,OAAO,IAAI,MAAM,EAAE;IAInB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAGpC"}

package/dist/cache/BrowserStorage.mjs

@@ -1,41 +0,0 @@
-/*! @azure/msal-browser v3.27.0 2024-11-05 */
-'use strict';
-import { createBrowserConfigurationAuthError } from '../error/BrowserConfigurationAuthError.mjs';
-import { BrowserCacheLocation } from '../utils/BrowserConstants.mjs';
-import { storageNotSupported } from '../error/BrowserConfigurationAuthErrorCodes.mjs';
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class BrowserStorage {
-    constructor(cacheLocation) {
-        this.validateWindowStorage(cacheLocation);
-        this.windowStorage = window[cacheLocation];
-    }
-    validateWindowStorage(cacheLocation) {
-        if ((cacheLocation !== BrowserCacheLocation.LocalStorage &&
-            cacheLocation !== BrowserCacheLocation.SessionStorage) ||
-            !window[cacheLocation]) {
-            throw createBrowserConfigurationAuthError(storageNotSupported);
-        }
-    }
-    getItem(key) {
-        return this.windowStorage.getItem(key);
-    }
-    setItem(key, value) {
-        this.windowStorage.setItem(key, value);
-    }
-    removeItem(key) {
-        this.windowStorage.removeItem(key);
-    }
-    getKeys() {
-        return Object.keys(this.windowStorage);
-    }
-    containsKey(key) {
-        return this.windowStorage.hasOwnProperty(key);
-    }
-}
-
-export { BrowserStorage };
-//# sourceMappingURL=BrowserStorage.mjs.map

package/dist/cache/BrowserStorage.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"BrowserStorage.mjs","sources":["../../src/cache/BrowserStorage.ts"],"sourcesContent":[null],"names":["BrowserConfigurationAuthErrorCodes.storageNotSupported"],"mappings":";;;;;;AAAA;;;AAGG;MASU,cAAc,CAAA;AAGvB,IAAA,WAAA,CAAY,aAAqB,EAAA;AAC7B,QAAA,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;AAC1C,QAAA,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;KAC9C;AAEO,IAAA,qBAAqB,CAAC,aAAqB,EAAA;AAC/C,QAAA,IACI,CAAC,aAAa,KAAK,oBAAoB,CAAC,YAAY;AAChD,YAAA,aAAa,KAAK,oBAAoB,CAAC,cAAc;AACzD,YAAA,CAAC,MAAM,CAAC,aAAa,CAAC,EACxB;AACE,YAAA,MAAM,mCAAmC,CACrCA,mBAAsD,CACzD,CAAC;AACL,SAAA;KACJ;AAED,IAAA,OAAO,CAAC,GAAW,EAAA;QACf,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;KAC1C;IAED,OAAO,CAAC,GAAW,EAAE,KAAa,EAAA;QAC9B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;KAC1C;AAED,IAAA,UAAU,CAAC,GAAW,EAAA;AAClB,QAAA,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;KACtC;IAED,OAAO,GAAA;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;KAC1C;AAED,IAAA,WAAW,CAAC,GAAW,EAAA;QACnB,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;KACjD;AACJ;;;;"}

package/lib/types/cache/BrowserStorage.d.ts

@@ -1,12 +0,0 @@
-import { IWindowStorage } from "./IWindowStorage.js";
-export declare class BrowserStorage implements IWindowStorage<string> {
-    private windowStorage;
-    constructor(cacheLocation: string);
-    private validateWindowStorage;
-    getItem(key: string): string | null;
-    setItem(key: string, value: string): void;
-    removeItem(key: string): void;
-    getKeys(): string[];
-    containsKey(key: string): boolean;
-}
-//# sourceMappingURL=BrowserStorage.d.ts.map

package/lib/types/cache/BrowserStorage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"BrowserStorage.d.ts","sourceRoot":"","sources":["../../../src/cache/BrowserStorage.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,qBAAa,cAAe,YAAW,cAAc,CAAC,MAAM,CAAC;IACzD,OAAO,CAAC,aAAa,CAAU;gBAEnB,aAAa,EAAE,MAAM;IAKjC,OAAO,CAAC,qBAAqB;IAY7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,OAAO,IAAI,MAAM,EAAE;IAInB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAGpC"}

package/src/cache/BrowserStorage.ts

@@ -1,52 +0,0 @@
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-
-import {
-    BrowserConfigurationAuthErrorCodes,
-    createBrowserConfigurationAuthError,
-} from "../error/BrowserConfigurationAuthError.js";
-import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
-import { IWindowStorage } from "./IWindowStorage.js";
-
-export class BrowserStorage implements IWindowStorage<string> {
-    private windowStorage: Storage;
-
-    constructor(cacheLocation: string) {
-        this.validateWindowStorage(cacheLocation);
-        this.windowStorage = window[cacheLocation];
-    }
-
-    private validateWindowStorage(cacheLocation: string): void {
-        if (
-            (cacheLocation !== BrowserCacheLocation.LocalStorage &&
-                cacheLocation !== BrowserCacheLocation.SessionStorage) ||
-            !window[cacheLocation]
-        ) {
-            throw createBrowserConfigurationAuthError(
-                BrowserConfigurationAuthErrorCodes.storageNotSupported
-            );
-        }
-    }
-
-    getItem(key: string): string | null {
-        return this.windowStorage.getItem(key);
-    }
-
-    setItem(key: string, value: string): void {
-        this.windowStorage.setItem(key, value);
-    }
-
-    removeItem(key: string): void {
-        this.windowStorage.removeItem(key);
-    }
-
-    getKeys(): string[] {
-        return Object.keys(this.windowStorage);
-    }
-
-    containsKey(key: string): boolean {
-        return this.windowStorage.hasOwnProperty(key);
-    }
-}