@azure/msal-browser 3.28.0 → 4.0.0-alpha.0

package/src/crypto/BrowserCrypto.ts

@@ -13,6 +13,7 @@ import {
 } from "@azure/msal-common/browser";
 import { KEY_FORMAT_JWK } from "../utils/BrowserConstants.js";
 import { urlEncodeArr } from "../encode/Base64Encode.js";
+import { base64DecToArr } from "../encode/Base64Decode.js";
 
 /**
  * This file defines functions used by the browser library to perform cryptography operations such as
@@ -22,8 +23,10 @@ import { urlEncodeArr } from "../encode/Base64Encode.js";
 /**
  * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
  */
-// RSA KeyGen Algorithm
+// Algorithms
 const PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+const AES_GCM = "AES-GCM";
+const HKDF = "HKDF";
 // SHA-256 hashing algorithm
 const S256_HASH_ALG = "SHA-256";
 // MOD length for PoP tokens
@@ -35,6 +38,14 @@ const UUID_CHARS = "0123456789abcdef";
 // Array to store UINT32 random value
 const UINT32_ARR = new Uint32Array(1);
 
+// Key Format
+const RAW = "raw";
+// Key Usages
+const ENCRYPT = "encrypt";
+const DECRYPT = "decrypt";
+const DERIVE_KEY = "deriveKey";
+
+// Suberror
 const SUBTLE_SUBERROR = "crypto_subtle_undefined";
 
 const keygenAlgorithmOptions: RsaHashedKeyGenParams = {
@@ -213,6 +224,114 @@ export async function sign(
     ) as Promise<ArrayBuffer>;
 }
 
+/**
+ * Generates symmetric base encryption key. This may be stored as all encryption/decryption keys will be derived from this one.
+ */
+export async function generateBaseKey(): Promise<ArrayBuffer> {
+    const key = await window.crypto.subtle.generateKey(
+        {
+            name: AES_GCM,
+            length: 256,
+        },
+        true,
+        [ENCRYPT, DECRYPT]
+    );
+    return window.crypto.subtle.exportKey(RAW, key);
+}
+
+/**
+ * Returns the raw key to be passed into the key derivation function
+ * @param baseKey
+ * @returns
+ */
+export async function generateHKDF(baseKey: ArrayBuffer): Promise<CryptoKey> {
+    return window.crypto.subtle.importKey(RAW, baseKey, HKDF, false, [
+        DERIVE_KEY,
+    ]);
+}
+
+/**
+ * Given a base key and a nonce generates a derived key to be used in encryption and decryption.
+ * Note: every time we encrypt a new key is derived
+ * @param baseKey
+ * @param nonce
+ * @returns
+ */
+async function deriveKey(
+    baseKey: CryptoKey,
+    nonce: ArrayBuffer,
+    context: string
+): Promise<CryptoKey> {
+    return window.crypto.subtle.deriveKey(
+        {
+            name: HKDF,
+            salt: nonce,
+            hash: S256_HASH_ALG,
+            info: new TextEncoder().encode(context),
+        },
+        baseKey,
+        { name: AES_GCM, length: 256 },
+        false,
+        [ENCRYPT, DECRYPT]
+    );
+}
+
+/**
+ * Encrypt the given data given a base key. Returns encrypted data and a nonce that must be provided during decryption
+ * @param key
+ * @param rawData
+ */
+export async function encrypt(
+    baseKey: CryptoKey,
+    rawData: string,
+    context: string
+): Promise<{ data: string; nonce: string }> {
+    const encodedData = new TextEncoder().encode(rawData);
+    // The nonce must never be reused with a given key.
+    const nonce = window.crypto.getRandomValues(new Uint8Array(16));
+    const derivedKey = await deriveKey(baseKey, nonce, context);
+    const encryptedData = await window.crypto.subtle.encrypt(
+        {
+            name: AES_GCM,
+            iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+        },
+        derivedKey,
+        encodedData
+    );
+
+    return {
+        data: urlEncodeArr(new Uint8Array(encryptedData)),
+        nonce: urlEncodeArr(nonce),
+    };
+}
+
+/**
+ * Decrypt data with the given key and nonce
+ * @param key
+ * @param nonce
+ * @param encryptedData
+ * @returns
+ */
+export async function decrypt(
+    baseKey: CryptoKey,
+    nonce: string,
+    context: string,
+    encryptedData: string
+): Promise<string> {
+    const encodedData = base64DecToArr(encryptedData);
+    const derivedKey = await deriveKey(baseKey, base64DecToArr(nonce), context);
+    const decryptedData = await window.crypto.subtle.decrypt(
+        {
+            name: AES_GCM,
+            iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+        },
+        derivedKey,
+        encodedData
+    );
+
+    return new TextDecoder().decode(decryptedData);
+}
+
 /**
  * Returns the SHA-256 hash of an input string
  * @param plainText

package/src/encode/Base64Decode.ts

@@ -25,7 +25,7 @@ export function base64Decode(input: string): string {
  * Decodes base64 into Uint8Array
  * @param base64String
  */
-function base64DecToArr(base64String: string): Uint8Array {
+export function base64DecToArr(base64String: string): Uint8Array {
     let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
     switch (encodedString.length % 4) {
         case 0:

package/src/index.ts

@@ -74,7 +74,6 @@ export { ITokenCache } from "./cache/ITokenCache.js";
 
 // Storage
 export { MemoryStorage } from "./cache/MemoryStorage.js";
-export { BrowserStorage } from "./cache/BrowserStorage.js";
 export { LocalStorage } from "./cache/LocalStorage.js";
 export { SessionStorage } from "./cache/SessionStorage.js";
 export { IWindowStorage } from "./cache/IWindowStorage.js";

package/src/interaction_client/NativeInteractionClient.ts

@@ -529,7 +529,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
         );
 
         // cache accounts and tokens in the appropriate storage
-        this.cacheAccount(baseAccount);
+        await this.cacheAccount(baseAccount);
         this.cacheNativeTokens(
             response,
             request,
@@ -722,9 +722,9 @@ export class NativeInteractionClient extends BaseInteractionClient {
      * cache the account entity in browser storage
      * @param accountEntity
      */
-    cacheAccount(accountEntity: AccountEntity): void {
+    async cacheAccount(accountEntity: AccountEntity): Promise<void> {
         // Store the account info and hence `nativeAccountId` in browser cache
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(accountEntity);
 
         // Remove any existing cached tokens for this account in browser storage
         this.browserStorage.removeAccountContext(accountEntity).catch((e) => {

package/src/interaction_client/StandardInteractionClient.ts

@@ -381,14 +381,6 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             validatedRequest.account = account;
         }
 
-        // Check for ADAL/MSAL v1 SSO
-        if (!validatedRequest.loginHint && !account) {
-            const legacyLoginHint = this.browserStorage.getLegacyLoginHint();
-            if (legacyLoginHint) {
-                validatedRequest.loginHint = legacyLoginHint;
-            }
-        }
-
         return validatedRequest;
     }
 }

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.28.0";
+export const version = "4.0.0-alpha.0";

package/dist/cache/BrowserStorage.d.ts

@@ -1,14 +0,0 @@
-import { IWindowStorage } from "./IWindowStorage.js";
-/**
- * @deprecated This class will be removed in a future major version
- */
-export declare class BrowserStorage implements IWindowStorage<string> {
-    private windowStorage;
-    constructor(cacheLocation: string);
-    getItem(key: string): string | null;
-    setItem(key: string, value: string): void;
-    removeItem(key: string): void;
-    getKeys(): string[];
-    containsKey(key: string): boolean;
-}
-//# sourceMappingURL=BrowserStorage.d.ts.map

package/dist/cache/BrowserStorage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"BrowserStorage.d.ts","sourceRoot":"","sources":["../../src/cache/BrowserStorage.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD;;GAEG;AACH,qBAAa,cAAe,YAAW,cAAc,CAAC,MAAM,CAAC;IACzD,OAAO,CAAC,aAAa,CAAyB;gBAElC,aAAa,EAAE,MAAM;IAYjC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,OAAO,IAAI,MAAM,EAAE;IAInB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAGpC"}

package/dist/cache/BrowserStorage.mjs

@@ -1,46 +0,0 @@
-/*! @azure/msal-browser v3.28.0 2024-12-12 */
-'use strict';
-import { createBrowserConfigurationAuthError } from '../error/BrowserConfigurationAuthError.mjs';
-import { BrowserCacheLocation } from '../utils/BrowserConstants.mjs';
-import { LocalStorage } from './LocalStorage.mjs';
-import { SessionStorage } from './SessionStorage.mjs';
-import { storageNotSupported } from '../error/BrowserConfigurationAuthErrorCodes.mjs';
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * @deprecated This class will be removed in a future major version
- */
-class BrowserStorage {
-    constructor(cacheLocation) {
-        if (cacheLocation === BrowserCacheLocation.LocalStorage) {
-            this.windowStorage = new LocalStorage();
-        }
-        else if (cacheLocation === BrowserCacheLocation.SessionStorage) {
-            this.windowStorage = new SessionStorage();
-        }
-        else {
-            throw createBrowserConfigurationAuthError(storageNotSupported);
-        }
-    }
-    getItem(key) {
-        return this.windowStorage.getItem(key);
-    }
-    setItem(key, value) {
-        this.windowStorage.setItem(key, value);
-    }
-    removeItem(key) {
-        this.windowStorage.removeItem(key);
-    }
-    getKeys() {
-        return Object.keys(this.windowStorage);
-    }
-    containsKey(key) {
-        return this.windowStorage.hasOwnProperty(key);
-    }
-}
-
-export { BrowserStorage };
-//# sourceMappingURL=BrowserStorage.mjs.map

package/dist/cache/BrowserStorage.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"BrowserStorage.mjs","sources":["../../src/cache/BrowserStorage.ts"],"sourcesContent":[null],"names":["BrowserConfigurationAuthErrorCodes.storageNotSupported"],"mappings":";;;;;;;;AAAA;;;AAGG;AAWH;;AAEG;MACU,cAAc,CAAA;AAGvB,IAAA,WAAA,CAAY,aAAqB,EAAA;AAC7B,QAAA,IAAI,aAAa,KAAK,oBAAoB,CAAC,YAAY,EAAE;AACrD,YAAA,IAAI,CAAC,aAAa,GAAG,IAAI,YAAY,EAAE,CAAC;AAC3C,SAAA;AAAM,aAAA,IAAI,aAAa,KAAK,oBAAoB,CAAC,cAAc,EAAE;AAC9D,YAAA,IAAI,CAAC,aAAa,GAAG,IAAI,cAAc,EAAE,CAAC;AAC7C,SAAA;AAAM,aAAA;AACH,YAAA,MAAM,mCAAmC,CACrCA,mBAAsD,CACzD,CAAC;AACL,SAAA;KACJ;AAED,IAAA,OAAO,CAAC,GAAW,EAAA;QACf,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;KAC1C;IAED,OAAO,CAAC,GAAW,EAAE,KAAa,EAAA;QAC9B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;KAC1C;AAED,IAAA,UAAU,CAAC,GAAW,EAAA;AAClB,QAAA,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;KACtC;IAED,OAAO,GAAA;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;KAC1C;AAED,IAAA,WAAW,CAAC,GAAW,EAAA;QACnB,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;KACjD;AACJ;;;;"}

package/lib/types/cache/BrowserStorage.d.ts

@@ -1,14 +0,0 @@
-import { IWindowStorage } from "./IWindowStorage.js";
-/**
- * @deprecated This class will be removed in a future major version
- */
-export declare class BrowserStorage implements IWindowStorage<string> {
-    private windowStorage;
-    constructor(cacheLocation: string);
-    getItem(key: string): string | null;
-    setItem(key: string, value: string): void;
-    removeItem(key: string): void;
-    getKeys(): string[];
-    containsKey(key: string): boolean;
-}
-//# sourceMappingURL=BrowserStorage.d.ts.map

package/lib/types/cache/BrowserStorage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"BrowserStorage.d.ts","sourceRoot":"","sources":["../../../src/cache/BrowserStorage.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD;;GAEG;AACH,qBAAa,cAAe,YAAW,cAAc,CAAC,MAAM,CAAC;IACzD,OAAO,CAAC,aAAa,CAAyB;gBAElC,aAAa,EAAE,MAAM;IAYjC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,OAAO,IAAI,MAAM,EAAE;IAInB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAGpC"}

package/src/cache/BrowserStorage.ts

@@ -1,52 +0,0 @@
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-
-import {
-    BrowserConfigurationAuthErrorCodes,
-    createBrowserConfigurationAuthError,
-} from "../error/BrowserConfigurationAuthError.js";
-import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
-import { IWindowStorage } from "./IWindowStorage.js";
-import { LocalStorage } from "./LocalStorage.js";
-import { SessionStorage } from "./SessionStorage.js";
-
-/**
- * @deprecated This class will be removed in a future major version
- */
-export class BrowserStorage implements IWindowStorage<string> {
-    private windowStorage: IWindowStorage<string>;
-
-    constructor(cacheLocation: string) {
-        if (cacheLocation === BrowserCacheLocation.LocalStorage) {
-            this.windowStorage = new LocalStorage();
-        } else if (cacheLocation === BrowserCacheLocation.SessionStorage) {
-            this.windowStorage = new SessionStorage();
-        } else {
-            throw createBrowserConfigurationAuthError(
-                BrowserConfigurationAuthErrorCodes.storageNotSupported
-            );
-        }
-    }
-
-    getItem(key: string): string | null {
-        return this.windowStorage.getItem(key);
-    }
-
-    setItem(key: string, value: string): void {
-        this.windowStorage.setItem(key, value);
-    }
-
-    removeItem(key: string): void {
-        this.windowStorage.removeItem(key);
-    }
-
-    getKeys(): string[] {
-        return Object.keys(this.windowStorage);
-    }
-
-    containsKey(key: string): boolean {
-        return this.windowStorage.hasOwnProperty(key);
-    }
-}