@azure/msal-browser 3.5.0 → 3.5.1-beta.0

package/package.json

@@ -1,105 +1,105 @@
 {
-  "name": "@azure/msal-browser",
-  "author": {
-    "name": "Microsoft",
-    "email": "nugetaad@microsoft.com",
-    "url": "https://www.microsoft.com"
-  },
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
-  },
-  "version": "3.5.0",
-  "description": "Microsoft Authentication Library for js",
-  "keywords": [
-    "implicit",
-    "authorization code",
-    "PKCE",
-    "js",
-    "AAD",
-    "msal",
-    "oauth"
-  ],
-  "type": "module",
-  "sideEffects": false,
-  "module": "./dist/index.mjs",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "module": "./dist/index.mjs",
-      "import": "./dist/index.mjs",
-      "require": "./lib/msal-browser.cjs",
-      "default": "./dist/index.mjs"
+    "name": "@azure/msal-browser",
+    "author": {
+        "name": "Microsoft",
+        "email": "nugetaad@microsoft.com",
+        "url": "https://www.microsoft.com"
     },
-    "./package.json": "./package.json"
-  },
-  "engines": {
-    "node": ">=0.8.0"
-  },
-  "beachball": {
-    "disallowedChangeTypes": [
-      "major"
-    ]
-  },
-  "directories": {
-    "test": "test"
-  },
-  "files": [
-    "dist",
-    "lib/msal-browser.js",
-    "lib/msal-browser.js.map",
-    "lib/msal-browser.cjs",
-    "lib/msal-browser.cjs.map",
-    "lib/msal-browser.min.js",
-    "src"
-  ],
-  "scripts": {
-    "clean": "shx rm -rf dist lib",
-    "clean:coverage": "rimraf ../../.nyc_output/*",
-    "lint": "eslint src --ext .ts",
-    "lint:fix": "npm run lint -- --fix",
-    "test": "jest",
-    "test:coverage": "jest --coverage",
-    "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
-    "build:all": "cd ../.. && npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
-    "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
-    "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
-    "build": "npm run clean && npm run build:modules",
-    "prepack": "npm run build:all",
-    "format:check": "npx prettier --ignore-path .gitignore --check src test",
-    "format:fix": "npx prettier --ignore-path .gitignore --write src test"
-  },
-  "devDependencies": {
-    "@azure/storage-blob": "^12.2.1",
-    "@babel/core": "^7.7.2",
-    "@babel/plugin-proposal-class-properties": "^7.7.0",
-    "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
-    "@babel/preset-env": "^7.7.1",
-    "@babel/preset-typescript": "^7.7.2",
-    "@rollup/plugin-node-resolve": "^15.0.1",
-    "@rollup/plugin-terser": "^0.4.0",
-    "@rollup/plugin-typescript": "^11.0.0",
-    "@types/jest": "^29.5.0",
-    "@types/node": "^20.3.1",
-    "@types/sinon": "^7.5.0",
-    "dotenv": "^8.2.0",
-    "eslint-config-msal": "^0.0.0",
-    "fake-indexeddb": "^3.1.3",
-    "jest": "^29.5.0",
-    "jest-environment-jsdom": "^29.5.0",
-    "prettier": "2.8.7",
-    "rimraf": "^3.0.0",
-    "rollup": "^3.14.0",
-    "shx": "^0.3.2",
-    "sinon": "^7.5.0",
-    "ssri": "^8.0.1",
-    "ts-jest": "^29.1.0",
-    "tslib": "^1.10.0",
-    "typescript": "^4.9.5"
-  },
-  "dependencies": {
-    "@azure/msal-common": "14.4.0"
-  }
+    "license": "MIT",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
+    },
+    "version": "3.5.1-beta.0",
+    "description": "Microsoft Authentication Library for js",
+    "keywords": [
+        "implicit",
+        "authorization code",
+        "PKCE",
+        "js",
+        "AAD",
+        "msal",
+        "oauth"
+    ],
+    "type": "module",
+    "sideEffects": false,
+    "module": "./dist/index.mjs",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "module": "./dist/index.mjs",
+            "import": "./dist/index.mjs",
+            "require": "./lib/msal-browser.cjs",
+            "default": "./dist/index.mjs"
+        },
+        "./package.json": "./package.json"
+    },
+    "engines": {
+        "node": ">=0.8.0"
+    },
+    "beachball": {
+        "disallowedChangeTypes": [
+            "major"
+        ]
+    },
+    "directories": {
+        "test": "test"
+    },
+    "files": [
+        "dist",
+        "lib/msal-browser.js",
+        "lib/msal-browser.js.map",
+        "lib/msal-browser.cjs",
+        "lib/msal-browser.cjs.map",
+        "lib/msal-browser.min.js",
+        "src"
+    ],
+    "scripts": {
+        "clean": "shx rm -rf dist lib",
+        "clean:coverage": "rimraf ../../.nyc_output/*",
+        "lint": "eslint src --ext .ts",
+        "lint:fix": "npm run lint -- --fix",
+        "test": "jest",
+        "test:coverage": "jest --coverage",
+        "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
+        "build:all": "cd ../.. && npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
+        "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
+        "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
+        "build": "npm run clean && npm run build:modules",
+        "prepack": "npm run build:all",
+        "format:check": "npx prettier --ignore-path .gitignore --check src test",
+        "format:fix": "npx prettier --ignore-path .gitignore --write src test"
+    },
+    "devDependencies": {
+        "@azure/storage-blob": "^12.2.1",
+        "@babel/core": "^7.7.2",
+        "@babel/plugin-proposal-class-properties": "^7.7.0",
+        "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
+        "@babel/preset-env": "^7.7.1",
+        "@babel/preset-typescript": "^7.7.2",
+        "@rollup/plugin-node-resolve": "^15.0.1",
+        "@rollup/plugin-terser": "^0.4.0",
+        "@rollup/plugin-typescript": "^11.0.0",
+        "@types/jest": "^29.5.0",
+        "@types/node": "^20.3.1",
+        "@types/sinon": "^7.5.0",
+        "dotenv": "^8.2.0",
+        "eslint-config-msal": "^0.0.0",
+        "fake-indexeddb": "^3.1.3",
+        "jest": "^29.5.0",
+        "jest-environment-jsdom": "^29.5.0",
+        "prettier": "2.8.7",
+        "rimraf": "^3.0.0",
+        "rollup": "^3.14.0",
+        "shx": "^0.3.2",
+        "sinon": "^7.5.0",
+        "ssri": "^8.0.1",
+        "ts-jest": "^29.1.0",
+        "tslib": "^1.10.0",
+        "typescript": "^4.9.5"
+    },
+    "dependencies": {
+        "@azure/msal-common": "14.4.1-beta.0"
+    }
 }

package/src/controllers/NestedAppAuthController.ts

@@ -14,6 +14,7 @@ import {
     DEFAULT_CRYPTO_IMPLEMENTATION,
     PerformanceEvents,
     AccountFilter,
+    TimeUtils,
 } from "@azure/msal-common";
 import { ITokenCache } from "../cache/ITokenCache";
 import { BrowserConfiguration } from "../config/Configuration";
@@ -134,13 +135,15 @@ export class NestedAppAuthController implements IController {
         try {
             const naaRequest =
                 this.nestedAppAuthAdapter.toNaaTokenRequest(request);
+            const reqTimestamp = TimeUtils.nowSeconds();
             const response = await this.bridgeProxy.getTokenInteractive(
                 naaRequest
             );
             const result: AuthenticationResult =
                 this.nestedAppAuthAdapter.fromNaaTokenResponse(
                     naaRequest,
-                    response
+                    response,
+                    reqTimestamp
                 );
 
             this.operatingContext.setActiveAccount(result.account);
@@ -204,13 +207,15 @@ export class NestedAppAuthController implements IController {
 
         try {
             const naaRequest =
-                this.nestedAppAuthAdapter.toNaaSilentTokenRequest(request);
+                this.nestedAppAuthAdapter.toNaaTokenRequest(request);
+            const reqTimestamp = TimeUtils.nowSeconds();
             const response = await this.bridgeProxy.getTokenSilent(naaRequest);
 
             const result: AuthenticationResult =
                 this.nestedAppAuthAdapter.fromNaaTokenResponse(
                     naaRequest,
-                    response
+                    response,
+                    reqTimestamp
                 );
 
             this.operatingContext.setActiveAccount(result.account);

package/src/controllers/StandardController.ts

@@ -2088,7 +2088,9 @@ export class StandardController implements IController {
                                         refreshTokenError.errorCode ===
                                             ClientAuthErrorCodes.tokenRefreshRequired)) ||
                                 refreshTokenError.errorCode ===
-                                    InteractionRequiredAuthErrorCodes.noTokensFound;
+                                    InteractionRequiredAuthErrorCodes.noTokensFound ||
+                                refreshTokenError.errorCode ===
+                                    InteractionRequiredAuthErrorCodes.refreshTokenExpired;
 
                             const tryIframeRenewal =
                                 cacheLookupPolicy ===

package/src/naa/AccountInfo.ts

@@ -4,14 +4,13 @@
  */
 
 export type AccountInfo = {
-    homeAccountId: string;
+    homeAccountId?: string;
     environment: string;
-    tenantId: string;
+    tenantId?: string;
     username: string;
-    localAccountId: string;
+    localAccountId?: string;
     name?: string;
     idToken?: string; // idTokenClaims can be parsed from idToken in MSAL.js
     platformBrokerId?: string; // Used by WAM previous called nativeAccountId
     idTokenClaims?: object;
-    client_info?: string;
 };

package/src/naa/BridgeError.ts

@@ -7,10 +7,10 @@ import { BridgeStatusCode } from "./BridgeStatusCode";
 
 export type BridgeError = {
     status: BridgeStatusCode;
-    code: string; // auth_flow_last_error such as invalid_grant
-    subError: string; // server_suberror_code such as consent_required
-    description: string;
-    properties: object; // additional telemetry info
+    code?: string; // auth_flow_last_error such as invalid_grant
+    subError?: string; // server_suberror_code such as consent_required
+    description?: string;
+    properties?: object; // additional telemetry info
 };
 
 export function isBridgeError(error: unknown): error is BridgeError {

package/src/naa/BridgeProxy.ts

@@ -36,7 +36,7 @@ export class BridgeProxy implements IBridgeProxy {
     static crypto: Crypto;
     sdkName: string;
     sdkVersion: string;
-    capabilities: BridgeCapabilities;
+    capabilities?: BridgeCapabilities;
 
     /**
      * initializeNestedAppAuthBridge - Initializes the bridge to the host app
@@ -162,6 +162,10 @@ export class BridgeProxy implements IBridgeProxy {
         return this.sendRequest<AccountInfo>("GetActiveAccount", undefined);
     }
 
+    public getHostCapabilities(): BridgeCapabilities | null {
+        return this.capabilities ?? null;
+    }
+
     /**
      * A method used to send a request to the bridge
      * @param request A token request
@@ -206,7 +210,7 @@ export class BridgeProxy implements IBridgeProxy {
     private constructor(
         sdkName: string,
         sdkVersion: string,
-        capabilities: BridgeCapabilities
+        capabilities?: BridgeCapabilities
     ) {
         this.sdkName = sdkName;
         this.sdkVersion = sdkVersion;

package/src/naa/IBridgeProxy.ts

@@ -9,6 +9,7 @@ import {
     AccountByLocalIdRequest,
     AccountByUsernameRequest,
 } from "./AccountRequests";
+import { BridgeCapabilities } from "./BridgeCapabilities";
 import { TokenRequest } from "./TokenRequest";
 import { TokenResponse } from "./TokenResponse";
 
@@ -22,4 +23,5 @@ export interface IBridgeProxy {
             | AccountByUsernameRequest
     ): Promise<AccountInfo>;
     getActiveAccount(): Promise<AccountInfo>;
+    getHostCapabilities(): BridgeCapabilities | null;
 }

package/src/naa/InitializeBridgeResponse.ts

@@ -6,7 +6,7 @@
 import { BridgeCapabilities } from "./BridgeCapabilities";
 
 export interface InitializeBridgeResponse {
-    capabilities: BridgeCapabilities;
+    capabilities?: BridgeCapabilities;
     sdkName: string;
     sdkVersion: string;
 }

package/src/naa/TokenRequest.ts

@@ -9,7 +9,6 @@ export type TokenRequest = {
     authority?: string;
     scope: string;
     correlationId: string;
-    prompt?: string; // Prompt used to identify interactive request
     nonce?: string;
     claims?: string;
     state?: string;
@@ -18,7 +17,6 @@ export type TokenRequest = {
     authenticationScheme?: string;
     shrClaims?: string;
     shrNonce?: string;
-    clientCapabilities?: string[]; // CP1 for CAE support
     resourceRequestMethod?: string;
     resourceRequestUri?: string;
     extendedExpiryToken?: boolean;

package/src/naa/TokenResponse.ts

@@ -8,14 +8,13 @@ import { AccountInfo } from "./AccountInfo";
 export type TokenResponse = {
     access_token: string;
     account: AccountInfo;
-    client_info: string;
     expires_in: number;
     id_token: string;
     properties: TokenResponseProperties | null;
     scope: string;
-    state: string;
     shr?: string; // token binding enabled at native layer it is the access token, not the signing keys
     extendedLifetimeToken?: boolean;
+    authority?: string;
 };
 
 export type TokenResponseProperties = {

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -15,16 +15,18 @@ import {
     ClientConfigurationError,
     InteractionRequiredAuthError,
     ServerError,
-    TimeUtils,
     ICrypto,
     Logger,
     AuthToken,
     TokenClaims,
     ClientAuthErrorCodes,
+    AuthenticationScheme,
+    RequestParameterBuilder,
+    StringUtils,
+    createClientAuthError,
 } from "@azure/msal-common";
 import { isBridgeError } from "../BridgeError";
 import { BridgeStatusCode } from "../BridgeStatusCode";
-import { SilentRequest } from "../../request/SilentRequest";
 import { AuthenticationResult } from "../../response/AuthenticationResult";
 import {} from "../../error/BrowserAuthErrorCodes";
 
@@ -46,41 +48,6 @@ export class NestedAppAuthAdapter {
         this.logger = logger;
     }
 
-    public toNaaSilentTokenRequest(request: SilentRequest): TokenRequest {
-        let extraParams: Map<string, string>;
-        if (request.extraQueryParameters === undefined) {
-            extraParams = new Map<string, string>();
-        } else {
-            extraParams = new Map<string, string>(
-                Object.entries(request.extraQueryParameters)
-            );
-        }
-        /**
-         * Need to get information about the client to populate request correctly
-         * For example: client id, client capabilities
-         */
-        const tokenRequest: TokenRequest = {
-            userObjectId: request.account?.homeAccountId,
-            clientId: this.clientId,
-            authority: request.authority,
-            scope: request.scopes.join(" "),
-            correlationId:
-                request.correlationId !== undefined
-                    ? request.correlationId
-                    : this.crypto.createNewGuid(),
-            prompt: request.prompt !== undefined ? request.prompt : "",
-            claims: request.claims !== undefined ? request.claims : "",
-            authenticationScheme:
-                request.authenticationScheme !== undefined
-                    ? request.authenticationScheme
-                    : "",
-            clientCapabilities: this.clientCapabilities,
-            extraParameters: extraParams,
-        };
-
-        return tokenRequest;
-    }
-
     public toNaaTokenRequest(
         request: PopupRequest | RedirectRequest
     ): TokenRequest {
@@ -93,6 +60,11 @@ export class NestedAppAuthAdapter {
             );
         }
 
+        const requestBuilder = new RequestParameterBuilder();
+        const claims = requestBuilder.addClientCapabilitiesToClaims(
+            request.claims,
+            this.clientCapabilities
+        );
         const tokenRequest: TokenRequest = {
             userObjectId: request.account?.homeAccountId,
             clientId: this.clientId,
@@ -101,16 +73,12 @@ export class NestedAppAuthAdapter {
             correlationId:
                 request.correlationId !== undefined
                     ? request.correlationId
-                    : "",
-            prompt: request.prompt !== undefined ? request.prompt : "",
-            nonce: request.nonce !== undefined ? request.nonce : "",
-            claims: request.claims !== undefined ? request.claims : "",
-            state: request.state !== undefined ? request.state : "",
+                    : this.crypto.createNewGuid(),
+            nonce: request.nonce,
+            claims: !StringUtils.isEmptyObj(claims) ? claims : undefined,
+            state: request.state,
             authenticationScheme:
-                request.authenticationScheme !== undefined
-                    ? request.authenticationScheme
-                    : "",
-            clientCapabilities: undefined,
+                request.authenticationScheme || AuthenticationScheme.BEARER,
             extraParameters: extraParams,
         };
 
@@ -119,36 +87,41 @@ export class NestedAppAuthAdapter {
 
     public fromNaaTokenResponse(
         request: TokenRequest,
-        response: TokenResponse
+        response: TokenResponse,
+        reqTimestamp: number
     ): AuthenticationResult {
+        if (!response.id_token || !response.access_token) {
+            throw createClientAuthError(ClientAuthErrorCodes.nullOrEmptyToken);
+        }
+
         const expiresOn = new Date(
-            TimeUtils.nowSeconds() + (response.expires_in || 0) * 1000
+            (reqTimestamp + (response.expires_in || 0)) * 1000
+        );
+        const idTokenClaims = AuthToken.extractTokenClaims(
+            response.id_token,
+            this.crypto.base64Decode
+        );
+        const account = this.fromNaaAccountInfo(
+            response.account,
+            idTokenClaims
         );
-
-        const account = this.fromNaaAccountInfo(response.account);
 
         const authenticationResult: AuthenticationResult = {
-            authority: response.account.environment,
-            uniqueId: response.account.homeAccountId,
-            tenantId: response.account.tenantId,
+            authority: response.authority || account.environment,
+            uniqueId: account.localAccountId,
+            tenantId: account.tenantId,
             scopes: response.scope.split(" "),
-            account: this.fromNaaAccountInfo(response.account),
+            account,
             idToken: response.id_token !== undefined ? response.id_token : "",
-            idTokenClaims:
-                account.idTokenClaims !== undefined
-                    ? account.idTokenClaims
-                    : {},
+            idTokenClaims,
             accessToken: response.access_token,
             fromCache: true,
             expiresOn: expiresOn,
             tokenType:
-                request.authenticationScheme !== undefined
-                    ? request.authenticationScheme
-                    : "Bearer",
+                request.authenticationScheme || AuthenticationScheme.BEARER,
             correlationId: request.correlationId,
-            requestId: "",
             extExpiresOn: expiresOn,
-            state: response.state,
+            state: request.state,
         };
 
         return authenticationResult;
@@ -176,26 +149,41 @@ export class NestedAppAuthAdapter {
      *     authorityType?: string;
      * };
      */
-    public fromNaaAccountInfo(fromAccount: NaaAccountInfo): MsalAccountInfo {
-        let tokenClaims: TokenClaims | undefined;
-        if (fromAccount.idToken !== undefined) {
-            tokenClaims = AuthToken.extractTokenClaims(
-                fromAccount.idToken,
-                this.crypto.base64Decode
-            );
-        } else {
-            tokenClaims = undefined;
-        }
+    public fromNaaAccountInfo(
+        fromAccount: NaaAccountInfo,
+        idTokenClaims?: TokenClaims
+    ): MsalAccountInfo {
+        const effectiveIdTokenClaims =
+            idTokenClaims || (fromAccount.idTokenClaims as TokenClaims);
+
+        const localAccountId =
+            fromAccount.localAccountId ||
+            effectiveIdTokenClaims?.oid ||
+            effectiveIdTokenClaims?.sub ||
+            "";
+
+        const tenantId =
+            fromAccount.tenantId || effectiveIdTokenClaims?.tid || "";
+
+        const homeAccountId =
+            fromAccount.homeAccountId || `${localAccountId}.${tenantId}`;
+
+        const username =
+            fromAccount.username ||
+            effectiveIdTokenClaims?.preferred_username ||
+            "";
+
+        const name = fromAccount.name || effectiveIdTokenClaims?.name;
 
         const account: MsalAccountInfo = {
-            homeAccountId: fromAccount.homeAccountId,
+            homeAccountId,
             environment: fromAccount.environment,
-            tenantId: fromAccount.tenantId,
-            username: fromAccount.username,
-            localAccountId: fromAccount.localAccountId,
-            name: fromAccount.name,
+            tenantId,
+            username,
+            localAccountId,
+            name,
             idToken: fromAccount.idToken,
-            idTokenClaims: tokenClaims,
+            idTokenClaims: effectiveIdTokenClaims,
         };
 
         return account;
@@ -233,7 +221,11 @@ export class NestedAppAuthAdapter {
                         ClientAuthErrorCodes.nestedAppAuthBridgeDisabled
                     );
                 case BridgeStatusCode.NESTED_APP_AUTH_UNAVAILABLE:
-                    return new ClientAuthError(error.code, error.description);
+                    return new ClientAuthError(
+                        error.code ||
+                            ClientAuthErrorCodes.nestedAppAuthBridgeDisabled,
+                        error.description
+                    );
                 case BridgeStatusCode.TRANSIENT_ERROR:
                 case BridgeStatusCode.PERSISTENT_ERROR:
                     return new ServerError(error.code, error.description);

package/src/operatingcontext/TeamsAppOperatingContext.ts

@@ -70,7 +70,10 @@ export class TeamsAppOperatingContext extends BaseOperatingContext {
                  * this.activeAccount = await bridgeProxy.getActiveAccount();
                  */
                 try {
-                    this.activeAccount = await bridgeProxy.getActiveAccount();
+                    if (bridgeProxy.getHostCapabilities()?.queryAccount) {
+                        this.activeAccount =
+                            await bridgeProxy.getActiveAccount();
+                    }
                 } catch (e) {
                     this.activeAccount = undefined;
                 }