@azure/msal-browser 3.5.1-beta.1 → 3.7.0

package/package.json

@@ -1,105 +1,106 @@
 {
-    "name": "@azure/msal-browser",
-    "author": {
-        "name": "Microsoft",
-        "email": "nugetaad@microsoft.com",
-        "url": "https://www.microsoft.com"
+  "name": "@azure/msal-browser",
+  "author": {
+    "name": "Microsoft",
+    "email": "nugetaad@microsoft.com",
+    "url": "https://www.microsoft.com"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
+  },
+  "version": "3.7.0",
+  "description": "Microsoft Authentication Library for js",
+  "keywords": [
+    "implicit",
+    "authorization code",
+    "PKCE",
+    "js",
+    "AAD",
+    "msal",
+    "oauth"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "module": "./dist/index.mjs",
+      "import": "./dist/index.mjs",
+      "require": "./lib/msal-browser.cjs",
+      "default": "./dist/index.mjs"
     },
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
-    },
-    "version": "3.5.1-beta.1",
-    "description": "Microsoft Authentication Library for js",
-    "keywords": [
-        "implicit",
-        "authorization code",
-        "PKCE",
-        "js",
-        "AAD",
-        "msal",
-        "oauth"
-    ],
-    "type": "module",
-    "sideEffects": false,
-    "module": "./dist/index.mjs",
-    "types": "./dist/index.d.ts",
-    "exports": {
-        ".": {
-            "types": "./dist/index.d.ts",
-            "module": "./dist/index.mjs",
-            "import": "./dist/index.mjs",
-            "require": "./lib/msal-browser.cjs",
-            "default": "./dist/index.mjs"
-        },
-        "./package.json": "./package.json"
-    },
-    "engines": {
-        "node": ">=0.8.0"
-    },
-    "beachball": {
-        "disallowedChangeTypes": [
-            "major"
-        ]
-    },
-    "directories": {
-        "test": "test"
-    },
-    "files": [
-        "dist",
-        "lib/msal-browser.js",
-        "lib/msal-browser.js.map",
-        "lib/msal-browser.cjs",
-        "lib/msal-browser.cjs.map",
-        "lib/msal-browser.min.js",
-        "src"
-    ],
-    "scripts": {
-        "clean": "shx rm -rf dist lib",
-        "clean:coverage": "rimraf ../../.nyc_output/*",
-        "lint": "eslint src --ext .ts",
-        "lint:fix": "npm run lint -- --fix",
-        "test": "jest",
-        "test:coverage": "jest --coverage",
-        "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
-        "build:all": "cd ../.. && npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
-        "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
-        "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
-        "build": "npm run clean && npm run build:modules",
-        "prepack": "npm run build:all",
-        "format:check": "npx prettier --ignore-path .gitignore --check src test",
-        "format:fix": "npx prettier --ignore-path .gitignore --write src test"
-    },
-    "devDependencies": {
-        "@azure/storage-blob": "^12.2.1",
-        "@babel/core": "^7.7.2",
-        "@babel/plugin-proposal-class-properties": "^7.7.0",
-        "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
-        "@babel/preset-env": "^7.7.1",
-        "@babel/preset-typescript": "^7.7.2",
-        "@rollup/plugin-node-resolve": "^15.0.1",
-        "@rollup/plugin-terser": "^0.4.0",
-        "@rollup/plugin-typescript": "^11.0.0",
-        "@types/jest": "^29.5.0",
-        "@types/node": "^20.3.1",
-        "@types/sinon": "^7.5.0",
-        "dotenv": "^8.2.0",
-        "eslint-config-msal": "^0.0.0",
-        "fake-indexeddb": "^3.1.3",
-        "jest": "^29.5.0",
-        "jest-environment-jsdom": "^29.5.0",
-        "prettier": "2.8.7",
-        "rimraf": "^3.0.0",
-        "rollup": "^3.14.0",
-        "shx": "^0.3.2",
-        "sinon": "^7.5.0",
-        "ssri": "^8.0.1",
-        "ts-jest": "^29.1.0",
-        "tslib": "^1.10.0",
-        "typescript": "^4.9.5"
-    },
-    "dependencies": {
-        "@azure/msal-common": "14.4.1-beta.1"
-    }
+    "./package.json": "./package.json"
+  },
+  "engines": {
+    "node": ">=0.8.0"
+  },
+  "beachball": {
+    "disallowedChangeTypes": [
+      "major"
+    ]
+  },
+  "directories": {
+    "test": "test"
+  },
+  "files": [
+    "dist",
+    "lib/msal-browser.js",
+    "lib/msal-browser.js.map",
+    "lib/msal-browser.cjs",
+    "lib/msal-browser.cjs.map",
+    "lib/msal-browser.min.js",
+    "src"
+  ],
+  "scripts": {
+    "clean": "shx rm -rf dist lib",
+    "clean:coverage": "rimraf ../../.nyc_output/*",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "npm run lint -- --fix",
+    "test": "jest",
+    "test:coverage": "jest --coverage",
+    "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
+    "build:all": "cd ../.. && npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
+    "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
+    "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
+    "build": "npm run clean && npm run build:modules",
+    "prepack": "npm run build:all",
+    "format:check": "npx prettier --ignore-path .gitignore --check src test",
+    "format:fix": "npx prettier --ignore-path .gitignore --write src test"
+  },
+  "devDependencies": {
+    "@azure/storage-blob": "^12.2.1",
+    "@babel/core": "^7.7.2",
+    "@babel/plugin-proposal-class-properties": "^7.7.0",
+    "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
+    "@babel/preset-env": "^7.7.1",
+    "@babel/preset-typescript": "^7.7.2",
+    "@rollup/plugin-node-resolve": "^15.0.1",
+    "@rollup/plugin-terser": "^0.4.0",
+    "@rollup/plugin-typescript": "^11.0.0",
+    "@types/jest": "^29.5.0",
+    "@types/node": "^20.3.1",
+    "@types/sinon": "^7.5.0",
+    "dotenv": "^8.2.0",
+    "eslint-config-msal": "^0.0.0",
+    "msal-test-utils": "^0.0.1",
+    "fake-indexeddb": "^3.1.3",
+    "jest": "^29.5.0",
+    "jest-environment-jsdom": "^29.5.0",
+    "prettier": "2.8.7",
+    "rimraf": "^3.0.0",
+    "rollup": "^3.14.0",
+    "shx": "^0.3.2",
+    "sinon": "^7.5.0",
+    "ssri": "^8.0.1",
+    "ts-jest": "^29.1.0",
+    "tslib": "^1.10.0",
+    "typescript": "^4.9.5"
+  },
+  "dependencies": {
+    "@azure/msal-common": "14.6.0"
+  }
 }

package/src/app/PublicClientApplication.ts

@@ -27,6 +27,7 @@ import { StandardOperatingContext } from "../operatingcontext/StandardOperatingC
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { EventCallbackFunction } from "../event/EventMessage";
 import { ClearCacheRequest } from "../request/ClearCacheRequest";
+import { EndSessionPopupRequest } from "../request/EndSessionPopupRequest";
 
 /**
  * The PublicClientApplication class is the object exposed by the library to perform authentication and authorization functions in Single Page Applications
@@ -306,7 +307,7 @@ export class PublicClientApplication implements IPublicClientApplication {
      * Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
      * @param logoutRequest
      */
-    logoutPopup(logoutRequest?: EndSessionRequest): Promise<void> {
+    logoutPopup(logoutRequest?: EndSessionPopupRequest): Promise<void> {
         return this.controller.logoutPopup(logoutRequest);
     }
 

package/src/cache/BrowserCacheManager.ts

@@ -394,15 +394,31 @@ export class BrowserCacheManager extends CacheManager {
      * fetch the account entity from the platform cache
      * @param accountKey
      */
-    getAccount(accountKey: string): AccountEntity | null {
+    getAccount(accountKey: string, logger?: Logger): AccountEntity | null {
         this.logger.trace("BrowserCacheManager.getAccount called");
-        const account = this.getItem(accountKey);
-        if (!account) {
+        const accountEntity = this.getCachedAccountEntity(accountKey);
+
+        return this.updateOutdatedCachedAccount(
+            accountKey,
+            accountEntity,
+            logger
+        );
+    }
+
+    /**
+     * Reads account from cache, deserializes it into an account entity and returns it.
+     * If account is not found from the key, returns null and removes key from map.
+     * @param accountKey
+     * @returns
+     */
+    getCachedAccountEntity(accountKey: string): AccountEntity | null {
+        const serializedAccount = this.getItem(accountKey);
+        if (!serializedAccount) {
             this.removeAccountKeyFromMap(accountKey);
             return null;
         }
 
-        const parsedAccount = this.validateAndParseJson(account);
+        const parsedAccount = this.validateAndParseJson(serializedAccount);
         if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
             this.removeAccountKeyFromMap(accountKey);
             return null;
@@ -505,6 +521,15 @@ export class BrowserCacheManager extends CacheManager {
         this.removeAccountKeyFromMap(key);
     }
 
+    /**
+     * Remove account entity from the platform cache if it's outdated
+     * @param accountKey
+     */
+    removeOutdatedAccount(accountKey: string): void {
+        this.removeItem(accountKey);
+        this.removeAccountKeyFromMap(accountKey);
+    }
+
     /**
      * Removes given idToken from the cache and from the key map
      * @param key
@@ -841,10 +866,7 @@ export class BrowserCacheManager extends CacheManager {
         const parsedMetadata = this.validateAndParseJson(value);
         if (
             !parsedMetadata ||
-            !AppMetadataEntity.isAppMetadataEntity(
-                appMetadataKey,
-                parsedMetadata
-            )
+            !CacheHelpers.isAppMetadataEntity(appMetadataKey, parsedMetadata)
         ) {
             this.logger.trace(
                 "BrowserCacheManager.getAppMetadata: called, no cache hit"
@@ -853,7 +875,7 @@ export class BrowserCacheManager extends CacheManager {
         }
 
         this.logger.trace("BrowserCacheManager.getAppMetadata: cache hit");
-        return CacheManager.toObject(new AppMetadataEntity(), parsedMetadata);
+        return parsedMetadata as AppMetadataEntity;
     }
 
     /**
@@ -862,7 +884,7 @@ export class BrowserCacheManager extends CacheManager {
      */
     setAppMetadata(appMetadata: AppMetadataEntity): void {
         this.logger.trace("BrowserCacheManager.setAppMetadata called");
-        const appMetadataKey = appMetadata.generateAppMetadataKey();
+        const appMetadataKey = CacheHelpers.generateAppMetadataKey(appMetadata);
         this.setItem(appMetadataKey, JSON.stringify(appMetadata));
     }
 
@@ -925,18 +947,12 @@ export class BrowserCacheManager extends CacheManager {
         const parsedMetadata = this.validateAndParseJson(value);
         if (
             parsedMetadata &&
-            AuthorityMetadataEntity.isAuthorityMetadataEntity(
-                key,
-                parsedMetadata
-            )
+            CacheHelpers.isAuthorityMetadataEntity(key, parsedMetadata)
         ) {
             this.logger.trace(
                 "BrowserCacheManager.getAuthorityMetadata: cache hit"
             );
-            return CacheManager.toObject(
-                new AuthorityMetadataEntity(),
-                parsedMetadata
-            );
+            return parsedMetadata as AuthorityMetadataEntity;
         }
         return null;
     }
@@ -1034,6 +1050,7 @@ export class BrowserCacheManager extends CacheManager {
             return this.getAccountInfoFilteredBy({
                 homeAccountId: activeAccountValueObj.homeAccountId,
                 localAccountId: activeAccountValueObj.localAccountId,
+                tenantId: activeAccountValueObj.tenantId,
             });
         }
         this.logger.trace(
@@ -1058,6 +1075,7 @@ export class BrowserCacheManager extends CacheManager {
             const activeAccountValue: ActiveAccountFilters = {
                 homeAccountId: account.homeAccountId,
                 localAccountId: account.localAccountId,
+                tenantId: account.tenantId,
             };
             this.browserStorage.setItem(
                 activeAccountKey,
@@ -1092,7 +1110,7 @@ export class BrowserCacheManager extends CacheManager {
         const parsedThrottlingCache = this.validateAndParseJson(value);
         if (
             !parsedThrottlingCache ||
-            !ThrottlingEntity.isThrottlingEntity(
+            !CacheHelpers.isThrottlingEntity(
                 throttlingCacheKey,
                 parsedThrottlingCache
             )
@@ -1104,10 +1122,7 @@ export class BrowserCacheManager extends CacheManager {
         }
 
         this.logger.trace("BrowserCacheManager.getThrottlingCache: cache hit");
-        return CacheManager.toObject(
-            new ThrottlingEntity(),
-            parsedThrottlingCache
-        );
+        return parsedThrottlingCache as ThrottlingEntity;
     }
 
     /**

package/src/cache/DatabaseStorage.ts

@@ -85,7 +85,7 @@ export class DatabaseStorage<T> implements IAsyncStorage<T> {
      */
     private async validateDbIsOpen(): Promise<void> {
         if (!this.dbOpen) {
-            return await this.open();
+            return this.open();
         }
     }
 

package/src/cache/TokenCache.ts

@@ -19,6 +19,7 @@ import {
     CacheRecord,
     TokenClaims,
     CacheHelpers,
+    buildAccountToCache,
 } from "@azure/msal-common";
 import { BrowserConfiguration } from "../config/Configuration";
 import { SilentRequest } from "../request/SilentRequest";
@@ -240,40 +241,44 @@ export class TokenCache implements ITokenCache {
         clientInfo?: string,
         requestHomeAccountId?: string
     ): AccountEntity {
-        let homeAccountId;
-        if (requestHomeAccountId) {
-            homeAccountId = requestHomeAccountId;
-        } else if (authority.authorityType !== undefined && clientInfo) {
-            homeAccountId = AccountEntity.generateHomeAccountId(
-                clientInfo,
-                authority.authorityType,
-                this.logger,
-                this.cryptoObj,
-                idTokenClaims
-            );
-        }
+        if (this.isBrowserEnvironment) {
+            this.logger.verbose("TokenCache - loading account");
+            let homeAccountId;
+            if (requestHomeAccountId) {
+                homeAccountId = requestHomeAccountId;
+            } else if (authority.authorityType !== undefined && clientInfo) {
+                homeAccountId = AccountEntity.generateHomeAccountId(
+                    clientInfo,
+                    authority.authorityType,
+                    this.logger,
+                    this.cryptoObj,
+                    idTokenClaims
+                );
+            }
 
-        if (!homeAccountId) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToLoadToken
-            );
-        }
+            if (!homeAccountId) {
+                throw createBrowserAuthError(
+                    BrowserAuthErrorCodes.unableToLoadToken
+                );
+            }
+            const claimsTenantId = idTokenClaims.tid;
 
-        const accountEntity = AccountEntity.createAccount(
-            {
+            const cachedAccount = buildAccountToCache(
+                this.storage,
+                authority,
                 homeAccountId,
-                idTokenClaims: idTokenClaims,
+                idTokenClaims,
+                base64Decode,
                 clientInfo,
-                environment: authority.hostnameAndPort,
-            },
-            authority
-        );
-
-        if (this.isBrowserEnvironment) {
-            this.logger.verbose("TokenCache - loading account");
+                authority.hostnameAndPort,
+                claimsTenantId,
+                undefined, // authCodePayload
+                undefined, // nativeAccountId
+                this.logger
+            );
 
-            this.storage.setAccount(accountEntity);
-            return accountEntity;
+            this.storage.setAccount(cachedAccount);
+            return cachedAccount;
         } else {
             throw createBrowserAuthError(
                 BrowserAuthErrorCodes.unableToLoadToken

package/src/config/Configuration.ts

@@ -33,7 +33,7 @@ import { FetchClient } from "../network/FetchClient";
 
 // Default timeout for popup windows and iframes in milliseconds
 export const DEFAULT_POPUP_TIMEOUT_MS = 60000;
-export const DEFAULT_IFRAME_TIMEOUT_MS = 6000;
+export const DEFAULT_IFRAME_TIMEOUT_MS = 10000;
 export const DEFAULT_REDIRECT_TIMEOUT_MS = 30000;
 export const DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS = 2000;
 

package/src/controllers/ControllerFactory.ts

@@ -16,7 +16,7 @@ export async function createV3Controller(
     await standard.initialize();
 
     const controller = await import("./StandardController");
-    return await controller.StandardController.createController(standard);
+    return controller.StandardController.createController(standard);
 }
 
 export async function createController(
@@ -34,12 +34,10 @@ export async function createController(
         teamsApp.getConfig().auth.supportsNestedAppAuth
     ) {
         const controller = await import("./NestedAppAuthController");
-        return await controller.NestedAppAuthController.createController(
-            teamsApp
-        );
+        return controller.NestedAppAuthController.createController(teamsApp);
     } else if (standard.isAvailable()) {
         const controller = await import("./StandardController");
-        return await controller.StandardController.createController(standard);
+        return controller.StandardController.createController(standard);
     } else {
         // Since neither of the actual operating contexts are available keep the UnknownOperatingContextController
         return null;

package/src/controllers/StandardController.ts

@@ -43,6 +43,7 @@ import {
     CacheLookupPolicy,
     DEFAULT_REQUEST,
     BrowserConstants,
+    iFrameRenewalPolicies,
 } from "../utils/BrowserConstants";
 import * as BrowserUtils from "../utils/BrowserUtils";
 import { RedirectRequest } from "../request/RedirectRequest";
@@ -923,10 +924,10 @@ export class StandardController implements IController {
                     );
                     atbcMeasurement.discard();
                 }
-                return response;
+                return await response;
             } else if (request.nativeAccountId) {
                 if (this.canUseNative(request, request.nativeAccountId)) {
-                    return this.acquireTokenNative(
+                    return await this.acquireTokenNative(
                         {
                             ...request,
                             correlationId,
@@ -1549,7 +1550,7 @@ export class StandardController implements IController {
     ): string {
         const account =
             request.account ||
-            this.browserStorage.getAccountInfoFilteredBy({
+            this.getAccount({
                 loginHint: request.loginHint,
                 sid: request.sid,
             }) ||
@@ -2078,31 +2079,17 @@ export class StandardController implements IController {
                         silentRequest.correlationId
                     )(silentRequest, cacheLookupPolicy).catch(
                         (refreshTokenError: AuthError) => {
-                            const isSilentlyResolvable =
-                                (!(
-                                    refreshTokenError instanceof
-                                    InteractionRequiredAuthError
-                                ) &&
-                                    (refreshTokenError.errorCode ===
-                                        BrowserConstants.INVALID_GRANT_ERROR ||
-                                        refreshTokenError.errorCode ===
-                                            ClientAuthErrorCodes.tokenRefreshRequired)) ||
-                                refreshTokenError.errorCode ===
-                                    InteractionRequiredAuthErrorCodes.noTokensFound ||
-                                refreshTokenError.errorCode ===
-                                    InteractionRequiredAuthErrorCodes.refreshTokenExpired;
-
-                            const tryIframeRenewal =
-                                cacheLookupPolicy ===
-                                    CacheLookupPolicy.Default ||
-                                cacheLookupPolicy === CacheLookupPolicy.Skip ||
-                                cacheLookupPolicy ===
-                                    CacheLookupPolicy.RefreshTokenAndNetwork;
-
-                            if (isSilentlyResolvable && tryIframeRenewal) {
+                            const shouldTryToResolveSilently =
+                                checkIfRefreshTokenErrorCanBeResolvedSilently(
+                                    refreshTokenError,
+                                    silentRequest,
+                                    cacheLookupPolicy
+                                );
+
+                            if (shouldTryToResolveSilently) {
                                 this.logger.verbose(
                                     "Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",
-                                    request.correlationId
+                                    silentRequest.correlationId
                                 );
                                 return invokeAsync(
                                     this.acquireTokenBySilentIframe.bind(this),
@@ -2112,6 +2099,7 @@ export class StandardController implements IController {
                                     silentRequest.correlationId
                                 )(silentRequest);
                             } else {
+                                // Error cannot be silently resolved or iframe renewal is not allowed, interaction required
                                 throw refreshTokenError;
                             }
                         }
@@ -2157,3 +2145,42 @@ export class StandardController implements IController {
             });
     }
 }
+
+/**
+ * Determines whether an error thrown by the refresh token endpoint can be resolved without interaction
+ * @param refreshTokenError
+ * @param silentRequest
+ * @param cacheLookupPolicy
+ * @returns
+ */
+function checkIfRefreshTokenErrorCanBeResolvedSilently(
+    refreshTokenError: AuthError,
+    silentRequest: CommonSilentFlowRequest,
+    cacheLookupPolicy: CacheLookupPolicy
+): boolean {
+    const noInteractionRequired = !(
+        refreshTokenError instanceof InteractionRequiredAuthError &&
+        // For refresh token errors, bad_token does not always require interaction (silently resolvable)
+        refreshTokenError.subError !==
+            InteractionRequiredAuthErrorCodes.badToken
+    );
+
+    // Errors that result when the refresh token needs to be replaced
+    const refreshTokenRefreshRequired =
+        refreshTokenError.errorCode === BrowserConstants.INVALID_GRANT_ERROR ||
+        refreshTokenError.errorCode ===
+            ClientAuthErrorCodes.tokenRefreshRequired;
+
+    // Errors that may be resolved before falling back to interaction (through iframe renewal)
+    const isSilentlyResolvable =
+        (noInteractionRequired && refreshTokenRefreshRequired) ||
+        refreshTokenError.errorCode ===
+            InteractionRequiredAuthErrorCodes.noTokensFound ||
+        refreshTokenError.errorCode ===
+            InteractionRequiredAuthErrorCodes.refreshTokenExpired;
+
+    // Only these policies allow for an iframe renewal attempt
+    const tryIframeRenewal = iFrameRenewalPolicies.includes(cacheLookupPolicy);
+
+    return isSilentlyResolvable && tryIframeRenewal;
+}

package/src/crypto/CryptoOps.ts

@@ -151,7 +151,7 @@ export class CryptoOps implements ICrypto {
      * Removes all cryptographic keys from IndexedDB storage
      */
     async clearKeystore(): Promise<boolean> {
-        return await this.cache.clear();
+        return this.cache.clear();
     }
 
     /**

package/src/crypto/SignedHttpRequest.ts

@@ -71,6 +71,6 @@ export class SignedHttpRequest {
      * @returns If keys are properly deleted
      */
     async removeKeys(publicKeyThumbprint: string): Promise<boolean> {
-        return await this.cryptoOps.removeTokenBindingKey(publicKeyThumbprint);
+        return this.cryptoOps.removeTokenBindingKey(publicKeyThumbprint);
     }
 }

package/src/index.ts

@@ -146,6 +146,7 @@ export {
     PerformanceEvents,
     // Telemetry
     InProgressPerformanceEvent,
+    TenantProfile,
 } from "@azure/msal-common";
 
 export { version } from "./packageMetadata";