@azure/msal-browser 3.3.0 → 3.5.0

package/dist/interaction_handler/InteractionHandler.mjs

@@ -1,9 +1,8 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
-import { PerformanceEvents, createClientAuthError, ClientAuthErrorCodes, ServerError, invokeAsync, AuthorityFactory } from '@azure/msal-common';
+import { PerformanceEvents, ServerError, invokeAsync, CcsCredentialType } from '@azure/msal-common';
 import { createBrowserAuthError } from '../error/BrowserAuthError.mjs';
-import { TemporaryCacheKeys } from '../utils/BrowserConstants.mjs';
-import { hashEmptyError, userCancelled } from '../error/BrowserAuthErrorCodes.mjs';
+import { userCancelled } from '../error/BrowserAuthErrorCodes.mjs';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -24,21 +23,11 @@ class InteractionHandler {
      * Function to handle response parameters from hash.
      * @param locationHash
      */
-    async handleCodeResponseFromHash(locationHash, state, authority, networkModule) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromHash, this.authCodeRequest.correlationId);
-        // Check that location hash isn't empty.
-        if (!locationHash) {
-            throw createBrowserAuthError(hashEmptyError);
-        }
-        // Handle code response.
-        const stateKey = this.browserStorage.generateStateKey(state);
-        const requestState = this.browserStorage.getTemporaryCache(stateKey);
-        if (!requestState) {
-            throw createClientAuthError(ClientAuthErrorCodes.stateNotFound, "Cached State");
-        }
+    async handleCodeResponse(response, request) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+            authCodeResponse = this.authModule.handleFragmentResponse(response, request.state);
         }
         catch (e) {
             if (e instanceof ServerError &&
@@ -50,7 +39,7 @@ class InteractionHandler {
                 throw e;
             }
         }
-        return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, this.authCodeRequest.correlationId)(authCodeResponse, state, authority, networkModule);
+        return invokeAsync(this.handleCodeResponseFromServer.bind(this), PerformanceEvents.HandleCodeResponseFromServer, this.logger, this.performanceClient, request.correlationId)(authCodeResponse, request);
     }
     /**
      * Process auth code response from AAD
@@ -60,70 +49,50 @@ class InteractionHandler {
      * @param networkModule
      * @returns
      */
-    async handleCodeResponseFromServer(authCodeResponse, state, authority, networkModule, validateNonce = true) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromServer, this.authCodeRequest.correlationId);
+    async handleCodeResponseFromServer(authCodeResponse, request, validateNonce = true) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromServer, request.correlationId);
         this.logger.trace("InteractionHandler.handleCodeResponseFromServer called");
-        // Handle code response.
-        const stateKey = this.browserStorage.generateStateKey(state);
-        const requestState = this.browserStorage.getTemporaryCache(stateKey);
-        if (!requestState) {
-            throw createClientAuthError(ClientAuthErrorCodes.stateNotFound, "Cached State");
-        }
-        // Get cached items
-        const nonceKey = this.browserStorage.generateNonceKey(requestState);
-        const cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
         // Assign code to request
         this.authCodeRequest.code = authCodeResponse.code;
         // Check for new cloud instance
         if (authCodeResponse.cloud_instance_host_name) {
-            await invokeAsync(this.updateTokenEndpointAuthority.bind(this), PerformanceEvents.UpdateTokenEndpointAuthority, this.logger, this.performanceClient, this.authCodeRequest.correlationId)(authCodeResponse.cloud_instance_host_name, authority, networkModule);
+            await invokeAsync(this.authModule.updateAuthority.bind(this.authModule), PerformanceEvents.UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodeResponse.cloud_instance_host_name, request.correlationId);
         }
         // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
         if (validateNonce) {
-            authCodeResponse.nonce = cachedNonce || undefined;
+            // TODO: Assigning "response nonce" to "request nonce" is confusing. Refactor the function doing validation to accept request nonce directly
+            authCodeResponse.nonce = request.nonce || undefined;
         }
-        authCodeResponse.state = requestState;
+        authCodeResponse.state = request.state;
         // Add CCS parameters if available
         if (authCodeResponse.client_info) {
             this.authCodeRequest.clientInfo = authCodeResponse.client_info;
         }
         else {
-            const cachedCcsCred = this.checkCcsCredentials();
-            if (cachedCcsCred) {
-                this.authCodeRequest.ccsCredential = cachedCcsCred;
+            const ccsCred = this.createCcsCredentials(request);
+            if (ccsCred) {
+                this.authCodeRequest.ccsCredential = ccsCred;
             }
         }
         // Acquire token with retrieved code.
-        const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, this.authCodeRequest.correlationId)(this.authCodeRequest, authCodeResponse));
-        this.browserStorage.cleanRequestByState(state);
+        const tokenResponse = (await invokeAsync(this.authModule.acquireToken.bind(this.authModule), PerformanceEvents.AuthClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(this.authCodeRequest, authCodeResponse));
         return tokenResponse;
     }
     /**
-     * Updates authority based on cloudInstanceHostname
-     * @param cloudInstanceHostname
-     * @param authority
-     * @param networkModule
+     * Build ccs creds if available
      */
-    async updateTokenEndpointAuthority(cloudInstanceHostname, authority, networkModule) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.UpdateTokenEndpointAuthority, this.authCodeRequest.correlationId);
-        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${authority.tenant}/`;
-        const cloudInstanceAuthority = await AuthorityFactory.createDiscoveredInstance(cloudInstanceAuthorityUri, networkModule, this.browserStorage, authority.options, this.logger, this.performanceClient, this.authCodeRequest.correlationId);
-        this.authModule.updateAuthority(cloudInstanceAuthority);
-    }
-    /**
-     * Looks up ccs creds in the cache
-     */
-    checkCcsCredentials() {
-        // Look up ccs credential in temp cache
-        const cachedCcsCred = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CCS_CREDENTIAL, true);
-        if (cachedCcsCred) {
-            try {
-                return JSON.parse(cachedCcsCred);
-            }
-            catch (e) {
-                this.authModule.logger.error("Cache credential could not be parsed");
-                this.authModule.logger.errorPii(`Cache credential could not be parsed: ${cachedCcsCred}`);
-            }
+    createCcsCredentials(request) {
+        if (request.account) {
+            return {
+                credential: request.account.homeAccountId,
+                type: CcsCredentialType.HOME_ACCOUNT_ID,
+            };
+        }
+        else if (request.loginHint) {
+            return {
+                credential: request.loginHint,
+                type: CcsCredentialType.UPN,
+            };
         }
         return null;
     }

package/dist/interaction_handler/InteractionHandler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"InteractionHandler.mjs","sources":["../../src/interaction_handler/InteractionHandler.ts"],"sourcesContent":[null],"names":["BrowserAuthErrorCodes.hashEmptyError"],"mappings":";;;;;;;AAKA;AAiBA;AAMA;AAEA;AAKA;AACI;AACA;AACA,MAAS,kBAAkB,CAAA;AAC3B,IAAA,WAAU,CAAA,cAAe,EAAA,WAAA,EAAA,eAAA,EAAA,MAAA,EAAA,iBAAA,EAAA;AACzB,QAAA,IAAA,CAAS,UAAC,GAAA,cAAmB,CAAA;AAGzB,QAAA,IAAA,CAAA,cAAA,GAAc,WAAyB,CAAA;AAa3C,QAAA,IAAA,CAAA,eAAA,GAAA,eAAA,CAAA;;;AAGG,KAAA;;AAuDH;;;;;;;AAOG,YAAA,MAAA,sBAAA,CAAAA,cAAA,CAAA,CAAA;SAC+B;AA4ElC;;;;;AAKG,SAAA;AACa,QAAA,IAAA,gBAAA,CAAA;AAuBhB,QAAA,IAAA;;AAEG,SAAA;AACH,QAAA,OAAU,CAAA,EAAA;AAoBb,YAAA,IAAA,CAAA,YAAA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"InteractionHandler.mjs","sources":["../../src/interaction_handler/InteractionHandler.ts"],"sourcesContent":[null],"names":["BrowserAuthErrorCodes.userCancelled"],"mappings":";;;;;;AAKA;AAcA;AAKA;AACA;AAIG;AACH;AACI;AACA,MAAS,kBAAiB,CAAA;AAC1B,IAAA,WAAU,CAAA,cAAiB,EAAA,WAAA,EAAA,eAAA,EAA+B,MAAA,EAAA,iBAAA,EAAA;AAC1D,QAAA,IAAA,CAAS,UAAS,GAAA,cAAO,CAAA;AACzB,QAAA,IAAA,CAAS,cAAC,GAAA,WAAmB,CAAA;AAGzB,QAAA,IAAA,CAAA,eAAA,kBAAuC,CAAA;AAa3C,QAAA,IAAA,CAAA,MAAA,GAAA,MAAA,CAAA;;;AAGG;AACG;AAsCN;;;;;;;AAOG,SAAA;AACG,QAAA,OAAA,CAAA,EAAA;AAwDN,YAAA,IAAA,CAAA,YAAA,WAAA;;AAEG;4CAEU,CAAuBA,aACpB,CAAA,CAAA;AAenB,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/interaction_handler/RedirectHandler.d.ts

@@ -1,17 +1,20 @@
-import { AuthorizationCodeClient, CommonAuthorizationCodeRequest, ICrypto, Authority, INetworkModule, Logger, IPerformanceClient } from "@azure/msal-common";
+import { AuthorizationCodeClient, CommonAuthorizationCodeRequest, Logger, IPerformanceClient, CcsCredential, ServerAuthorizationCodeResponse } from "@azure/msal-common";
 import { BrowserCacheManager } from "../cache/BrowserCacheManager";
-import { InteractionHandler, InteractionParams } from "./InteractionHandler";
 import { INavigationClient } from "../navigation/INavigationClient";
 import { AuthenticationResult } from "../response/AuthenticationResult";
-export type RedirectParams = InteractionParams & {
+export type RedirectParams = {
     navigationClient: INavigationClient;
     redirectTimeout: number;
     redirectStartPage: string;
     onRedirectNavigate?: (url: string) => void | boolean;
 };
-export declare class RedirectHandler extends InteractionHandler {
-    private browserCrypto;
-    constructor(authCodeModule: AuthorizationCodeClient, storageImpl: BrowserCacheManager, authCodeRequest: CommonAuthorizationCodeRequest, logger: Logger, browserCrypto: ICrypto, performanceClient: IPerformanceClient);
+export declare class RedirectHandler {
+    authModule: AuthorizationCodeClient;
+    browserStorage: BrowserCacheManager;
+    authCodeRequest: CommonAuthorizationCodeRequest;
+    logger: Logger;
+    performanceClient: IPerformanceClient;
+    constructor(authCodeModule: AuthorizationCodeClient, storageImpl: BrowserCacheManager, authCodeRequest: CommonAuthorizationCodeRequest, logger: Logger, performanceClient: IPerformanceClient);
     /**
      * Redirects window to given URL.
      * @param urlNavigate
@@ -21,6 +24,10 @@ export declare class RedirectHandler extends InteractionHandler {
      * Handle authorization code response in the window.
      * @param hash
      */
-    handleCodeResponseFromHash(locationHash: string, state: string, authority: Authority, networkModule: INetworkModule): Promise<AuthenticationResult>;
+    handleCodeResponse(response: ServerAuthorizationCodeResponse, state: string): Promise<AuthenticationResult>;
+    /**
+     * Looks up ccs creds in the cache
+     */
+    protected checkCcsCredentials(): CcsCredential | null;
 }
 //# sourceMappingURL=RedirectHandler.d.ts.map

package/dist/interaction_handler/RedirectHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RedirectHandler.d.ts","sourceRoot":"","sources":["../../src/interaction_handler/RedirectHandler.ts"],"names":[],"mappings":"AAKA,OAAO,EACH,uBAAuB,EACvB,8BAA8B,EAC9B,OAAO,EACP,SAAS,EACT,cAAc,EACd,MAAM,EAEN,kBAAkB,EAGrB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG;IAC7C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;CACxD,CAAC;AAEF,qBAAa,eAAgB,SAAQ,kBAAkB;IACnD,OAAO,CAAC,aAAa,CAAU;gBAG3B,cAAc,EAAE,uBAAuB,EACvC,WAAW,EAAE,mBAAmB,EAChC,eAAe,EAAE,8BAA8B,EAC/C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,OAAO,EACtB,iBAAiB,EAAE,kBAAkB;IAYzC;;;OAGG;IACG,mBAAmB,CACrB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC;IA6EhB;;;OAGG;IACG,0BAA0B,CAC5B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,cAAc,GAC9B,OAAO,CAAC,oBAAoB,CAAC;CA+EnC"}
+{"version":3,"file":"RedirectHandler.d.ts","sourceRoot":"","sources":["../../src/interaction_handler/RedirectHandler.ts"],"names":[],"mappings":"AAKA,OAAO,EACH,uBAAuB,EACvB,8BAA8B,EAC9B,MAAM,EAEN,kBAAkB,EAGlB,aAAa,EAGb,+BAA+B,EAClC,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,MAAM,MAAM,cAAc,GAAG;IACzB,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;CACxD,CAAC;AAEF,qBAAa,eAAe;IACxB,UAAU,EAAE,uBAAuB,CAAC;IACpC,cAAc,EAAE,mBAAmB,CAAC;IACpC,eAAe,EAAE,8BAA8B,CAAC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,kBAAkB,CAAC;gBAGlC,cAAc,EAAE,uBAAuB,EACvC,WAAW,EAAE,mBAAmB,EAChC,eAAe,EAAE,8BAA8B,EAC/C,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,kBAAkB;IASzC;;;OAGG;IACG,mBAAmB,CACrB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC;IA6EhB;;;OAGG;IACG,kBAAkB,CACpB,QAAQ,EAAE,+BAA+B,EACzC,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC;IAgFhC;;OAEG;IACH,SAAS,CAAC,mBAAmB,IAAI,aAAa,GAAG,IAAI;CAoBxD"}

package/dist/interaction_handler/RedirectHandler.mjs

@@ -1,19 +1,21 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
-import { createClientAuthError, ClientAuthErrorCodes, ServerError } from '@azure/msal-common';
+import { createClientAuthError, ClientAuthErrorCodes, ServerError, invokeAsync, PerformanceEvents } from '@azure/msal-common';
 import { createBrowserAuthError } from '../error/BrowserAuthError.mjs';
 import { TemporaryCacheKeys, ApiId } from '../utils/BrowserConstants.mjs';
-import { InteractionHandler } from './InteractionHandler.mjs';
-import { emptyNavigateUri, hashEmptyError, userCancelled } from '../error/BrowserAuthErrorCodes.mjs';
+import { emptyNavigateUri, userCancelled } from '../error/BrowserAuthErrorCodes.mjs';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-class RedirectHandler extends InteractionHandler {
-    constructor(authCodeModule, storageImpl, authCodeRequest, logger, browserCrypto, performanceClient) {
-        super(authCodeModule, storageImpl, authCodeRequest, logger, performanceClient);
-        this.browserCrypto = browserCrypto;
+class RedirectHandler {
+    constructor(authCodeModule, storageImpl, authCodeRequest, logger, performanceClient) {
+        this.authModule = authCodeModule;
+        this.browserStorage = storageImpl;
+        this.authCodeRequest = authCodeRequest;
+        this.logger = logger;
+        this.performanceClient = performanceClient;
     }
     /**
      * Redirects window to given URL.
@@ -69,12 +71,8 @@ class RedirectHandler extends InteractionHandler {
      * Handle authorization code response in the window.
      * @param hash
      */
-    async handleCodeResponseFromHash(locationHash, state, authority, networkModule) {
+    async handleCodeResponse(response, state) {
         this.logger.verbose("RedirectHandler.handleCodeResponse called");
-        // Check that location hash isn't empty.
-        if (!locationHash) {
-            throw createBrowserAuthError(hashEmptyError);
-        }
         // Interaction is completed - remove interaction status.
         this.browserStorage.setInteractionInProgress(false);
         // Handle code response.
@@ -85,7 +83,7 @@ class RedirectHandler extends InteractionHandler {
         }
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+            authCodeResponse = this.authModule.handleFragmentResponse(response, requestState);
         }
         catch (e) {
             if (e instanceof ServerError &&
@@ -104,7 +102,7 @@ class RedirectHandler extends InteractionHandler {
         this.authCodeRequest.code = authCodeResponse.code;
         // Check for new cloud instance
         if (authCodeResponse.cloud_instance_host_name) {
-            await this.updateTokenEndpointAuthority(authCodeResponse.cloud_instance_host_name, authority, networkModule);
+            await invokeAsync(this.authModule.updateAuthority.bind(this.authModule), PerformanceEvents.UpdateTokenEndpointAuthority, this.logger, this.performanceClient, this.authCodeRequest.correlationId)(authCodeResponse.cloud_instance_host_name, this.authCodeRequest.correlationId);
         }
         authCodeResponse.nonce = cachedNonce || undefined;
         authCodeResponse.state = requestState;
@@ -123,6 +121,23 @@ class RedirectHandler extends InteractionHandler {
         this.browserStorage.cleanRequestByState(state);
         return tokenResponse;
     }
+    /**
+     * Looks up ccs creds in the cache
+     */
+    checkCcsCredentials() {
+        // Look up ccs credential in temp cache
+        const cachedCcsCred = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CCS_CREDENTIAL, true);
+        if (cachedCcsCred) {
+            try {
+                return JSON.parse(cachedCcsCred);
+            }
+            catch (e) {
+                this.authModule.logger.error("Cache credential could not be parsed");
+                this.authModule.logger.errorPii(`Cache credential could not be parsed: ${cachedCcsCred}`);
+            }
+        }
+        return null;
+    }
 }
 
 export { RedirectHandler };

package/dist/interaction_handler/RedirectHandler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"RedirectHandler.mjs","sources":["../../src/interaction_handler/RedirectHandler.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;AAKA;AAiBA;AACA;AACA;AAOqB,MAAA,wBAAS,kBAAA,CAAA;IAC1B,WAAkB,CAAA,cAAO,aAAa,EAAA,eAAe,EAAA,MAAA,EAAA,aAAA,EAAA,iBAAA,EAAA;QACvD,KAAA,CAAA,cAAA,EAAA,WAAA,EAAA,eAAA,EAAA,MAAA,EAAA,iBAAA,CAAA,CAAA;AAEF,QAAa,IAAA,CAAA,aAAA,GAAA;KACF;;AAoBP;;;AAGG,IAAA,MAAA,mBAAA,CAAA,UAAA,EAAA,MAAA,EAAA;AACG,QAAA,IAAA,CAAA,MAAA,CAAA,OACF,CAAA,4CAED,CAAA,CAAA;AA6EH;;;AAGG,YAAA,IAAA,MAAA,CAAA,iBAAA,EAAA;gBAC6B,IAAA,CAAA,MAAA,CAAA,wFAIb,CAAA,CAAA;AAgFtB,gBAAA,IAAA,CAAA,cAAA,CAAA,iBAAA,CAAA,kBAAA,CAAA,UAAA,EAAA,MAAA,CAAA,iBAAA,EAAA,IAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"RedirectHandler.mjs","sources":["../../src/interaction_handler/RedirectHandler.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;AAKA;AAkBA;AACA;AAEA;AAKqB,MAAA,gBAAQ;IACzB,WAAkB,CAAA,cAAO,aAAa,EAAA,eAAe,EAAA,MAAA,EAAA,iBAAA,EAAA;QACvD,IAAA,CAAA,UAAA,GAAA,cAAA,CAAA;AAEF,QAAA,IAAA,CAAA,cAA4B,GAAA,WAAA,CAAA;QACd,IAAA,CAAA,iCAA0B,CAAA;QACtB,IAAA,CAAA,MAAA;QACC,IAAA,CAAA,sCAAgC;KACzC;;AAIF;AAaJ;;;AAGG,QAAA,IAAA,CAAA,MAAA,CAAA,OAAA,CAAA,4CAAA,CAAA,CAAA;AACG;AAgFN,QAAA,IAAA,UAAA,EAAA;;;AAGG,gBAAA,IAAA,CAAA,MAAA,CAAA,OAAA,CAAA,gFAAA,CAAA,CAAA;AACG,gBAAA,IAAA,CAAA,cACQ,CAAA,iBAAA,CAAA,kBACH,CAAA,UACR,EAAA,MAAQ,CAAA,iBAAA,EAAqB,IAAA,CAAA,CAAA;AAgFhC,aAAA;;AAEG,YAAA,IAAA,CAAA,cAAA,CAAA,iBAAA,CAAA,kBAAA,CAAA,cAAA,EAAA,IAAA,CAAA,eAAA,CAAA,aAAA,EAAA,IAAA,CAAA,CAAA;AACH,YAAA,IAAU,CAAA,cAAA,CAAA,gBAAuB,CAAA,IAAgB,CAAI,eAAA,CAAA,CAAA;AAoBxD,YAAA,IAAA,CAAA,MAAA,CAAA,OAAA,CAAA,CAAA,kDAAA,EAAA,UAAA,CAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/interaction_handler/SilentHandler.d.ts

@@ -1,4 +1,4 @@
-import { Logger, IPerformanceClient } from "@azure/msal-common";
+import { Logger, IPerformanceClient, ServerResponseType } from "@azure/msal-common";
 /**
  * Creates a hidden iframe to given URL using user-requested scopes as an id.
  * @param urlNavigate
@@ -10,5 +10,5 @@ export declare function initiateAuthRequest(requestUrl: string, performanceClien
  * @param iframe
  * @param timeout
  */
-export declare function monitorIframeForHash(iframe: HTMLIFrameElement, timeout: number, pollIntervalMilliseconds: number, performanceClient: IPerformanceClient, logger: Logger, correlationId: string): Promise<string>;
+export declare function monitorIframeForHash(iframe: HTMLIFrameElement, timeout: number, pollIntervalMilliseconds: number, performanceClient: IPerformanceClient, logger: Logger, correlationId: string, responseType: ServerResponseType): Promise<string>;
 //# sourceMappingURL=SilentHandler.d.ts.map

package/dist/interaction_handler/SilentHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SilentHandler.d.ts","sourceRoot":"","sources":["../../src/interaction_handler/SilentHandler.ts"],"names":[],"mappings":"AAKA,OAAO,EACH,MAAM,EACN,kBAAkB,EAIrB,MAAM,oBAAoB,CAAC;AAO5B;;;;GAIG;AACH,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,kBAAkB,EACrC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,iBAAiB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA2B5B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACtC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,MAAM,EACf,wBAAwB,EAAE,MAAM,EAChC,iBAAiB,EAAE,kBAAkB,EACrC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CA0DjB"}
+{"version":3,"file":"SilentHandler.d.ts","sourceRoot":"","sources":["../../src/interaction_handler/SilentHandler.ts"],"names":[],"mappings":"AAKA,OAAO,EACH,MAAM,EACN,kBAAkB,EAIlB,kBAAkB,EACrB,MAAM,oBAAoB,CAAC;AAO5B;;;;GAIG;AACH,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,kBAAkB,EACrC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,iBAAiB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA2B5B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACtC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,MAAM,EACf,wBAAwB,EAAE,MAAM,EAChC,iBAAiB,EAAE,kBAAkB,EACrC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,kBAAkB,GACjC,OAAO,CAAC,MAAM,CAAC,CA+DjB"}

package/dist/interaction_handler/SilentHandler.mjs

@@ -1,6 +1,6 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
-import { PerformanceEvents, invokeAsync, invoke } from '@azure/msal-common';
+import { PerformanceEvents, invokeAsync, invoke, ServerResponseType } from '@azure/msal-common';
 import { createBrowserAuthError } from '../error/BrowserAuthError.mjs';
 import { DEFAULT_IFRAME_TIMEOUT_MS } from '../config/Configuration.mjs';
 import { emptyNavigateUri, monitorWindowTimeout } from '../error/BrowserAuthErrorCodes.mjs';
@@ -31,7 +31,7 @@ async function initiateAuthRequest(requestUrl, performanceClient, logger, correl
  * @param iframe
  * @param timeout
  */
-async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId) {
+async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId, responseType) {
     performanceClient.addQueueMeasurement(PerformanceEvents.SilentHandlerMonitorIframeForHash, correlationId);
     return new Promise((resolve, reject) => {
         if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
@@ -60,12 +60,18 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             if (!href || href === "about:blank") {
                 return;
             }
-            const contentHash = contentWindow
-                ? contentWindow.location.hash
-                : "";
+            let responseString = "";
+            if (contentWindow) {
+                if (responseType === ServerResponseType.QUERY) {
+                    responseString = contentWindow.location.search;
+                }
+                else {
+                    responseString = contentWindow.location.hash;
+                }
+            }
             window.clearTimeout(timeoutId);
             window.clearInterval(intervalId);
-            resolve(contentHash);
+            resolve(responseString);
         }, pollIntervalMilliseconds);
     }).finally(() => {
         invoke(removeHiddenIframe, PerformanceEvents.RemoveHiddenIframe, logger, performanceClient, correlationId)(iframe);

package/dist/interaction_handler/SilentHandler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"SilentHandler.mjs","sources":["../../src/interaction_handler/SilentHandler.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;AAKA;AAaA;;;AAwCA;;;;AAIG;AACH,eAAA,mBAA0C,CAAA,UAChC,EAAmB,iBAAA,EAClB,MAAA,EAAE,aACe,EAAA,iBAAA,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"SilentHandler.mjs","sources":["../../src/interaction_handler/SilentHandler.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;AAKA;AAcA;;;AAwCA;;;;AAIG;AACH,eAAA,mBAA0C,CAAA,UAChC,mBACN,EAAA,MAAO,EAAE,aACe,EAAA,iBAAA,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/naa/BridgeError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/naa/BridgeProxy.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/naa/BridgeStatusCode.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/naa/mapping/NestedAppAuthAdapter.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 import { TimeUtils, AuthToken, AuthError, InteractionRequiredAuthError, ServerError, ClientAuthError, ClientAuthErrorCodes } from '@azure/msal-common';
 import { isBridgeError } from '../BridgeError.mjs';

package/dist/navigation/NavigationClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/network/FetchClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 import { Constants } from '@azure/msal-common';
 import { createBrowserAuthError } from '../error/BrowserAuthError.mjs';

package/dist/operatingcontext/BaseOperatingContext.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 import { Logger } from '@azure/msal-common';
 import { buildConfiguration } from '../config/Configuration.mjs';

package/dist/operatingcontext/StandardOperatingContext.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 import { BaseOperatingContext } from './BaseOperatingContext.mjs';
 

package/dist/operatingcontext/TeamsAppOperatingContext.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 import { BaseOperatingContext } from './BaseOperatingContext.mjs';
 import { BridgeProxy } from '../naa/BridgeProxy.mjs';

package/dist/operatingcontext/UnknownOperatingContext.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 import { BaseOperatingContext } from './BaseOperatingContext.mjs';
 

package/dist/packageMetadata.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "@azure/msal-browser";
-export declare const version = "3.3.0";
+export declare const version = "3.5.0";
 //# sourceMappingURL=packageMetadata.d.ts.map

package/dist/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.3.0";
+const version = "3.5.0";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist/response/ResponseHandler.d.ts

@@ -0,0 +1,8 @@
+import { ICrypto, Logger, ServerAuthorizationCodeResponse } from "@azure/msal-common";
+import { InteractionType } from "../utils/BrowserConstants";
+export declare function deserializeResponse(responseString: string, responseLocation: string, logger: Logger): ServerAuthorizationCodeResponse;
+/**
+ * Returns the interaction type that the response object belongs to
+ */
+export declare function validateInteractionType(response: ServerAuthorizationCodeResponse, browserCrypto: ICrypto, interactionType: InteractionType): void;
+//# sourceMappingURL=ResponseHandler.d.ts.map

package/dist/response/ResponseHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResponseHandler.d.ts","sourceRoot":"","sources":["../../src/response/ResponseHandler.ts"],"names":[],"mappings":"AAKA,OAAO,EACH,OAAO,EACP,MAAM,EACN,+BAA+B,EAElC,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,wBAAgB,mBAAmB,CAC/B,cAAc,EAAE,MAAM,EACtB,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,MAAM,GACf,+BAA+B,CAuBjC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACnC,QAAQ,EAAE,+BAA+B,EACzC,aAAa,EAAE,OAAO,EACtB,eAAe,EAAE,eAAe,GACjC,IAAI,CAkBN"}

package/dist/response/ResponseHandler.mjs

@@ -0,0 +1,46 @@
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
+'use strict';
+import { UrlUtils } from '@azure/msal-common';
+import { createBrowserAuthError } from '../error/BrowserAuthError.mjs';
+import { extractBrowserRequestState } from '../utils/BrowserProtocolUtils.mjs';
+import { hashEmptyError, hashDoesNotContainKnownProperties, noStateInHash, unableToParseState, stateInteractionTypeMismatch } from '../error/BrowserAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function deserializeResponse(responseString, responseLocation, logger) {
+    // Deserialize hash fragment response parameters.
+    const serverParams = UrlUtils.getDeserializedResponse(responseString);
+    if (!serverParams) {
+        if (!UrlUtils.stripLeadingHashOrQuery(responseString)) {
+            // Hash or Query string is empty
+            logger.error(`The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`);
+            throw createBrowserAuthError(hashEmptyError);
+        }
+        else {
+            logger.error(`A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`);
+            logger.errorPii(`The ${responseLocation} detected is: ${responseString}`);
+            throw createBrowserAuthError(hashDoesNotContainKnownProperties);
+        }
+    }
+    return serverParams;
+}
+/**
+ * Returns the interaction type that the response object belongs to
+ */
+function validateInteractionType(response, browserCrypto, interactionType) {
+    if (!response.state) {
+        throw createBrowserAuthError(noStateInHash);
+    }
+    const platformStateObj = extractBrowserRequestState(browserCrypto, response.state);
+    if (!platformStateObj) {
+        throw createBrowserAuthError(unableToParseState);
+    }
+    if (platformStateObj.interactionType !== interactionType) {
+        throw createBrowserAuthError(stateInteractionTypeMismatch);
+    }
+}
+
+export { deserializeResponse, validateInteractionType };
+//# sourceMappingURL=ResponseHandler.mjs.map

package/dist/response/ResponseHandler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResponseHandler.mjs","sources":["../../src/response/ResponseHandler.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;AAKA;AAWA;AAEA;AA6BA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/telemetry/BrowserPerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 import { PerformanceClient, Constants, Logger } from '@azure/msal-common';
 import { BrowserPerformanceMeasurement } from './BrowserPerformanceMeasurement.mjs';

package/dist/telemetry/BrowserPerformanceMeasurement.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/BrowserConstants.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.3.0 2023-10-20 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 import { OIDC_DEFAULT_SCOPES } from '@azure/msal-common';
 

package/dist/utils/BrowserProtocolUtils.d.ts

@@ -1,19 +1,12 @@
 import { InteractionType } from "./BrowserConstants";
-import { ICrypto, ServerAuthorizationCodeResponse } from "@azure/msal-common";
+import { ICrypto } from "@azure/msal-common";
 export type BrowserStateObject = {
     interactionType: InteractionType;
 };
-export declare class BrowserProtocolUtils {
-    /**
-     * Extracts the BrowserStateObject from the state string.
-     * @param browserCrypto
-     * @param state
-     */
-    static extractBrowserRequestState(browserCrypto: ICrypto, state: string): BrowserStateObject | null;
-    /**
-     * Parses properties of server response from url hash
-     * @param locationHash Hash from url
-     */
-    static parseServerResponseFromHash(locationHash: string): ServerAuthorizationCodeResponse;
-}
+/**
+ * Extracts the BrowserStateObject from the state string.
+ * @param browserCrypto
+ * @param state
+ */
+export declare function extractBrowserRequestState(browserCrypto: ICrypto, state: string): BrowserStateObject | null;
 //# sourceMappingURL=BrowserProtocolUtils.d.ts.map

package/dist/utils/BrowserProtocolUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BrowserProtocolUtils.d.ts","sourceRoot":"","sources":["../../src/utils/BrowserProtocolUtils.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACH,OAAO,EAGP,+BAA+B,EAIlC,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,kBAAkB,GAAG;IAC7B,eAAe,EAAE,eAAe,CAAC;CACpC,CAAC;AAEF,qBAAa,oBAAoB;IAC7B;;;;OAIG;IACH,MAAM,CAAC,0BAA0B,CAC7B,aAAa,EAAE,OAAO,EACtB,KAAK,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI;IAc5B;;;OAGG;IACH,MAAM,CAAC,2BAA2B,CAC9B,YAAY,EAAE,MAAM,GACrB,+BAA+B;CAQrC"}
+{"version":3,"file":"BrowserProtocolUtils.d.ts","sourceRoot":"","sources":["../../src/utils/BrowserProtocolUtils.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACH,OAAO,EAKV,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,kBAAkB,GAAG;IAC7B,eAAe,EAAE,eAAe,CAAC;CACpC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,0BAA0B,CACtC,aAAa,EAAE,OAAO,EACtB,KAAK,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAY3B"}