@azure/msal-browser 3.5.1-beta.1 → 3.7.0

package/src/interaction_client/BaseInteractionClient.ts

@@ -283,7 +283,7 @@ export abstract class BaseInteractionClient {
             this.logger.verbose(
                 "Creating discovered authority with request authority"
             );
-            return await AuthorityFactory.createDiscoveredInstance(
+            return AuthorityFactory.createDiscoveredInstance(
                 requestAuthority,
                 this.config.system.networkClient,
                 this.browserStorage,
@@ -295,7 +295,7 @@ export abstract class BaseInteractionClient {
         this.logger.verbose(
             "Creating discovered authority with configured authority"
         );
-        return await AuthorityFactory.createDiscoveredInstance(
+        return AuthorityFactory.createDiscoveredInstance(
             this.config.auth.authority,
             this.config.system.networkClient,
             this.browserStorage,

package/src/interaction_client/NativeInteractionClient.ts

@@ -33,7 +33,9 @@ import {
     invokeAsync,
     createAuthError,
     AuthErrorCodes,
+    updateAccountTenantProfileData,
     CacheHelpers,
+    buildAccountToCache,
 } from "@azure/msal-common";
 import { BaseInteractionClient } from "./BaseInteractionClient";
 import { BrowserConfiguration } from "../config/Configuration";
@@ -372,7 +374,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
                 reqTimestamp
             );
             this.browserStorage.setInteractionInProgress(false);
-            return result;
+            return await result;
         } catch (e) {
             this.browserStorage.setInteractionInProgress(false);
             throw e;
@@ -420,14 +422,19 @@ export class NativeInteractionClient extends BaseInteractionClient {
             response,
             idTokenClaims
         );
-        const accountEntity = AccountEntity.createAccount(
-            {
-                homeAccountId: homeAccountIdentifier,
-                idTokenClaims: idTokenClaims,
-                clientInfo: response.client_info,
-                nativeAccountId: response.account.id,
-            },
-            authority
+
+        const baseAccount = buildAccountToCache(
+            this.browserStorage,
+            authority,
+            homeAccountIdentifier,
+            idTokenClaims,
+            base64Decode,
+            response.client_info,
+            undefined, // environment
+            idTokenClaims.tid,
+            undefined, // auth code payload
+            response.account.id,
+            this.logger
         );
 
         // generate authenticationResult
@@ -435,13 +442,13 @@ export class NativeInteractionClient extends BaseInteractionClient {
             response,
             request,
             idTokenClaims,
-            accountEntity,
+            baseAccount,
             authority.canonicalAuthority,
             reqTimestamp
         );
 
         // cache accounts and tokens in the appropriate storage
-        this.cacheAccount(accountEntity);
+        this.cacheAccount(baseAccount);
         this.cacheNativeTokens(
             response,
             request,
@@ -533,7 +540,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
             if (!request.keyId) {
                 throw createClientAuthError(ClientAuthErrorCodes.keyIdMissing);
             }
-            return await popTokenGenerator.signPopToken(
+            return popTokenGenerator.signPopToken(
                 response.access_token,
                 request.keyId,
                 shrParameters
@@ -580,14 +587,11 @@ export class NativeInteractionClient extends BaseInteractionClient {
             idTokenClaims.tid ||
             Constants.EMPTY_STRING;
 
-        const fullAccountEntity: AccountEntity = idTokenClaims
-            ? Object.assign(new AccountEntity(), {
-                  ...accountEntity,
-                  idTokenClaims: idTokenClaims,
-              })
-            : accountEntity;
-
-        const accountInfo = fullAccountEntity.getAccountInfo();
+        const accountInfo: AccountInfo | null = updateAccountTenantProfileData(
+            accountEntity.getAccountInfo(),
+            undefined, // tenantProfile optional
+            idTokenClaims
+        );
 
         // generate PoP token as needed
         const responseAccessToken = await this.generatePopAccessToken(

package/src/interaction_client/PopupClient.ts

@@ -339,7 +339,7 @@ export class PopupClient extends StandardInteractionClient {
                     this.browserCrypto,
                     validRequest.state
                 );
-                return nativeInteractionClient.acquireToken({
+                return await nativeInteractionClient.acquireToken({
                     ...validRequest,
                     state: userRequestState,
                     prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently

package/src/interaction_client/RedirectClient.ts

@@ -254,7 +254,7 @@ export class RedirectClient extends StandardInteractionClient {
                 this.logger.verbose(
                     "NavigateToLoginRequestUrl set to false, handling response"
                 );
-                return this.handleResponse(
+                return await this.handleResponse(
                     serverParams,
                     serverTelemetryManager
                 );
@@ -313,7 +313,7 @@ export class RedirectClient extends StandardInteractionClient {
 
                 // If navigateInternal implementation returns false, handle the hash now
                 if (!processHashOnRedirect) {
-                    return this.handleResponse(
+                    return await this.handleResponse(
                         serverParams,
                         serverTelemetryManager
                     );
@@ -483,7 +483,7 @@ export class RedirectClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient
         );
-        return await interactionHandler.handleCodeResponse(serverParams, state);
+        return interactionHandler.handleCodeResponse(serverParams, state);
     }
 
     /**

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -114,7 +114,7 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             );
 
             // Handle auth code parameters from request
-            return invokeAsync(
+            return await invokeAsync(
                 interactionHandler.handleCodeResponseFromServer.bind(
                     interactionHandler
                 ),

package/src/interaction_client/SilentRefreshClient.ts

@@ -44,6 +44,14 @@ export class SilentRefreshClient extends StandardInteractionClient {
             ...request,
             ...baseRequest,
         };
+
+        if (request.redirectUri) {
+            // Make sure any passed redirectUri is converted to an absolute URL - redirectUri is not a required parameter for refresh token redemption so only include if explicitly provided
+            silentRequest.redirectUri = this.getRedirectUri(
+                request.redirectUri
+            );
+        }
+
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             ApiId.acquireTokenSilent_silentFlow
         );

package/src/interaction_client/StandardInteractionClient.ts

@@ -319,7 +319,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             userAuthority,
             requestAzureCloudOptions || this.config.auth.azureCloudOptions
         );
-        return await invokeAsync(
+        return invokeAsync(
             AuthorityFactory.createDiscoveredInstance.bind(AuthorityFactory),
             PerformanceEvents.AuthorityFactoryCreateDiscoveredInstance,
             this.logger,

package/src/interaction_handler/SilentHandler.ts

@@ -40,7 +40,7 @@ export async function initiateAuthRequest(
         throw createBrowserAuthError(BrowserAuthErrorCodes.emptyNavigateUri);
     }
     if (navigateFrameWait) {
-        return await invokeAsync(
+        return invokeAsync(
             loadFrame,
             PerformanceEvents.SilentHandlerLoadFrame,
             logger,
@@ -203,7 +203,7 @@ function createHiddenIframe(): HTMLIFrameElement {
         "sandbox",
         "allow-scripts allow-same-origin allow-forms"
     );
-    document.getElementsByTagName("body")[0].appendChild(authFrame);
+    document.body.appendChild(authFrame);
 
     return authFrame;
 }

package/src/naa/AuthBridge.ts

@@ -3,14 +3,15 @@
  * Licensed under the MIT License.
  */
 
+export type AuthBridgeResponse = string | { data: string };
 export interface AuthBridge {
     addEventListener: (
         eventName: string,
-        callback: (response: string) => void
+        callback: (response: AuthBridgeResponse) => void
     ) => void;
     postMessage: (message: string) => void;
     removeEventListener: (
         eventName: string,
-        callback: (response: string) => void
+        callback: (response: AuthBridgeResponse) => void
     ) => void;
 }

package/src/naa/AuthResult.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AccountInfo } from "./AccountInfo";
+import { TokenResponse } from "./TokenResponse";
+
+export type AuthResult = {
+    token: TokenResponse;
+    account: AccountInfo;
+};

package/src/naa/BridgeProxy.ts

@@ -4,20 +4,17 @@
  */
 
 import { AccountInfo } from "./AccountInfo";
-import {
-    AccountByHomeIdRequest,
-    AccountByLocalIdRequest,
-    AccountByUsernameRequest,
-} from "./AccountRequests";
-import { AuthBridge } from "./AuthBridge";
+import { AuthBridge, AuthBridgeResponse } from "./AuthBridge";
+import { AuthResult } from "./AuthResult";
 import { BridgeCapabilities } from "./BridgeCapabilities";
+import { BridgeError } from "./BridgeError";
 import { BridgeRequest } from "./BridgeRequest";
 import { BridgeRequestEnvelope, BridgeMethods } from "./BridgeRequestEnvelope";
 import { BridgeResponseEnvelope } from "./BridgeResponseEnvelope";
+import { BridgeStatusCode } from "./BridgeStatusCode";
 import { IBridgeProxy } from "./IBridgeProxy";
-import { InitializeBridgeResponse } from "./InitializeBridgeResponse";
+import { InitContext } from "./InitContext";
 import { TokenRequest } from "./TokenRequest";
-import { TokenResponse } from "./TokenResponse";
 
 declare global {
     interface Window {
@@ -31,8 +28,7 @@ declare global {
  * platform broker
  */
 export class BridgeProxy implements IBridgeProxy {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    static bridgeRequests: any[] = [];
+    static bridgeRequests: BridgeRequest[] = [];
     static crypto: Crypto;
     sdkName: string;
     sdkVersion: string;
@@ -44,7 +40,7 @@ export class BridgeProxy implements IBridgeProxy {
      * @remarks This method will be called by the create factory method
      * @remarks If the bridge is not available, this method will throw an error
      */
-    protected static async initializeNestedAppAuthBridge(): Promise<InitializeBridgeResponse> {
+    protected static async initializeNestedAppAuthBridge(): Promise<InitContext> {
         if (window === undefined) {
             throw new Error("window is undefined");
         }
@@ -60,9 +56,11 @@ export class BridgeProxy implements IBridgeProxy {
 
             window.nestedAppAuthBridge.addEventListener(
                 "message",
-                (response: string) => {
+                (response: AuthBridgeResponse) => {
+                    const responsePayload =
+                        typeof response === "string" ? response : response.data;
                     const responseEnvelope: BridgeResponseEnvelope =
-                        JSON.parse(response);
+                        JSON.parse(responsePayload);
                     const request = BridgeProxy.bridgeRequests.find(
                         (element) =>
                             element.requestId === responseEnvelope.requestId
@@ -73,22 +71,22 @@ export class BridgeProxy implements IBridgeProxy {
                             1
                         );
                         if (responseEnvelope.success) {
-                            request.resolve(responseEnvelope.body);
+                            request.resolve(responseEnvelope);
                         } else {
-                            request.reject(responseEnvelope.body);
+                            request.reject(responseEnvelope.error);
                         }
                     }
                 }
             );
 
-            const promise = new Promise<InitializeBridgeResponse>(
+            const bridgeResponse = await new Promise<BridgeResponseEnvelope>(
                 (resolve, reject) => {
                     const message: BridgeRequestEnvelope = {
                         messageType: "NestedAppAuthRequest",
                         method: "GetInitContext",
                         requestId: BridgeProxy.getRandomId(),
                     };
-                    const request: BridgeRequest<InitializeBridgeResponse> = {
+                    const request: BridgeRequest = {
                         requestId: message.requestId,
                         method: message.method,
                         resolve: resolve,
@@ -101,7 +99,9 @@ export class BridgeProxy implements IBridgeProxy {
                 }
             );
 
-            return promise;
+            return BridgeProxy.validateBridgeResultOrThrow(
+                bridgeResponse.initContext
+            );
         } catch (error) {
             window.console.log(error);
             throw error;
@@ -115,51 +115,37 @@ export class BridgeProxy implements IBridgeProxy {
     /**
      * getTokenInteractive - Attempts to get a token interactively from the bridge
      * @param request A token request
-     * @returns a promise that resolves to a token response or rejects with a BridgeError
+     * @returns a promise that resolves to an auth result or rejects with a BridgeError
      */
-    public getTokenInteractive(request: TokenRequest): Promise<TokenResponse> {
-        return this.sendRequest<TokenResponse>("GetTokenPopup", request);
+    public getTokenInteractive(request: TokenRequest): Promise<AuthResult> {
+        return this.getToken("GetTokenPopup", request);
     }
 
     /**
      * getTokenSilent Attempts to get a token silently from the bridge
      * @param request A token request
-     * @returns a promise that resolves to a token response or rejects with a BridgeError
+     * @returns a promise that resolves to an auth result or rejects with a BridgeError
      */
-    public getTokenSilent(request: TokenRequest): Promise<TokenResponse> {
-        return this.sendRequest<TokenResponse>("GetToken", request);
+    public getTokenSilent(request: TokenRequest): Promise<AuthResult> {
+        return this.getToken("GetToken", request);
     }
 
-    /**
-     * getAccountInfo - Gets account information from the bridge
-     *
-     * @param request A request for account information
-     */
-    public getAccountInfo(
-        request:
-            | AccountByHomeIdRequest
-            | AccountByLocalIdRequest
-            | AccountByUsernameRequest
-    ): Promise<AccountInfo> {
-        let method: BridgeMethods = "GetAccountByHomeId";
-
-        if ((request as AccountByHomeIdRequest).homeAccountId !== undefined) {
-            method = "GetAccountByHomeId";
-        }
-
-        if ((request as AccountByLocalIdRequest).localAccountId !== undefined) {
-            method = "GetAccountByLocalId";
-        }
-
-        if ((request as AccountByUsernameRequest).username !== undefined) {
-            method = "GetAccountByUsername";
-        }
-
-        return this.sendRequest<AccountInfo>(method, request);
+    private async getToken(
+        requestType: BridgeMethods,
+        request: TokenRequest
+    ): Promise<AuthResult> {
+        const result = await this.sendRequest(requestType, {
+            tokenParams: request,
+        });
+        return {
+            token: BridgeProxy.validateBridgeResultOrThrow(result.token),
+            account: BridgeProxy.validateBridgeResultOrThrow(result.account),
+        };
     }
 
-    public getActiveAccount(): Promise<AccountInfo> {
-        return this.sendRequest<AccountInfo>("GetActiveAccount", undefined);
+    public async getActiveAccount(): Promise<AccountInfo> {
+        const result = await this.sendRequest("GetActiveAccount");
+        return BridgeProxy.validateBridgeResultOrThrow(result.account);
     }
 
     public getHostCapabilities(): BridgeCapabilities | null {
@@ -171,36 +157,43 @@ export class BridgeProxy implements IBridgeProxy {
      * @param request A token request
      * @returns a promise that resolves to a response of provided type or rejects with a BridgeError
      */
-    private sendRequest<TResponse>(
+    private sendRequest(
         method: BridgeMethods,
-        request:
-            | TokenRequest
-            | AccountByHomeIdRequest
-            | AccountByLocalIdRequest
-            | AccountByUsernameRequest
-            | undefined
-    ): Promise<TResponse> {
+        requestParams?: Partial<BridgeRequestEnvelope>
+    ): Promise<BridgeResponseEnvelope> {
         const message: BridgeRequestEnvelope = {
             messageType: "NestedAppAuthRequest",
             method: method,
             requestId: BridgeProxy.getRandomId(),
-            body: request,
+            ...requestParams,
         };
 
-        const promise = new Promise<TResponse>((resolve, reject) => {
-            const request: BridgeRequest<TResponse> = {
-                requestId: message.requestId,
-                method: message.method,
-                resolve: resolve,
-                reject: reject,
-            };
-            BridgeProxy.bridgeRequests.push(request);
-            window.nestedAppAuthBridge.postMessage(JSON.stringify(message));
-        });
+        const promise = new Promise<BridgeResponseEnvelope>(
+            (resolve, reject) => {
+                const request: BridgeRequest = {
+                    requestId: message.requestId,
+                    method: message.method,
+                    resolve: resolve,
+                    reject: reject,
+                };
+                BridgeProxy.bridgeRequests.push(request);
+                window.nestedAppAuthBridge.postMessage(JSON.stringify(message));
+            }
+        );
 
         return promise;
     }
 
+    private static validateBridgeResultOrThrow<T>(input: T | undefined): T {
+        if (input === undefined) {
+            const bridgeError: BridgeError = {
+                status: BridgeStatusCode.NestedAppAuthUnavailable,
+            };
+            throw bridgeError;
+        }
+        return input;
+    }
+
     /**
      * Private constructor for BridgeProxy
      * @param sdkName The name of the SDK being used to make requests on behalf of the app

package/src/naa/BridgeRequest.ts

@@ -3,10 +3,14 @@
  * Licensed under the MIT License.
  */
 
-export type BridgeRequest<TResponse> = {
+import { BridgeResponseEnvelope } from "./BridgeResponseEnvelope";
+
+export type BridgeRequest = {
     requestId: string;
     method: string;
-    resolve: (value: TResponse | PromiseLike<TResponse>) => void;
+    resolve: (
+        value: BridgeResponseEnvelope | PromiseLike<BridgeResponseEnvelope>
+    ) => void;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     reject: (reason?: any) => void;
 };

package/src/naa/BridgeRequestEnvelope.ts

@@ -4,19 +4,11 @@
  */
 
 import { TokenRequest } from "./TokenRequest";
-import {
-    AccountByHomeIdRequest,
-    AccountByLocalIdRequest,
-    AccountByUsernameRequest,
-} from "./AccountRequests";
 
 export type BridgeMethods =
     | "GetToken"
     | "GetActiveAccount"
     | "GetAllAccounts"
-    | "GetAccountByHomeId"
-    | "GetAccountByLocalId"
-    | "GetAccountByUsername"
     | "GetInitContext"
     | "GetTokenPopup";
 
@@ -27,11 +19,7 @@ export type BridgeRequestEnvelope = {
     clientLibrary?: string;
     clientLibraryVersion?: string;
     requestId: string;
-    body?:
-        | TokenRequest
-        | AccountByHomeIdRequest
-        | AccountByLocalIdRequest
-        | AccountByUsernameRequest;
+    tokenParams?: TokenRequest;
 };
 
 export function isBridgeRequestEnvelope(

package/src/naa/BridgeResponseEnvelope.ts

@@ -6,16 +6,14 @@
 import { BridgeError } from "./BridgeError";
 import { TokenResponse } from "./TokenResponse";
 import { AccountInfo } from "./AccountInfo";
-import { InitializeBridgeResponse } from "./InitializeBridgeResponse";
+import { InitContext } from "./InitContext";
 
 export type BridgeResponseEnvelope = {
     messageType: "NestedAppAuthResponse";
     requestId: string;
     success: boolean; // false if body is error
-    body:
-        | TokenResponse
-        | BridgeError
-        | AccountInfo
-        | AccountInfo[]
-        | InitializeBridgeResponse;
+    token?: TokenResponse;
+    error?: BridgeError;
+    account?: AccountInfo;
+    initContext?: InitContext;
 };

package/src/naa/BridgeStatusCode.ts

@@ -3,13 +3,15 @@
  * Licensed under the MIT License.
  */
 
-export enum BridgeStatusCode {
-    USER_INTERACTION_REQUIRED = "USER_INTERACTION_REQUIRED",
-    USER_CANCEL = "USER_CANCEL",
-    NO_NETWORK = "NO_NETWORK",
-    TRANSIENT_ERROR = "TRANSIENT_ERROR",
-    PERSISTENT_ERROR = "PERSISTENT_ERROR",
-    DISABLED = "DISABLED",
-    ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE",
-    NESTED_APP_AUTH_UNAVAILABLE = "NESTED_APP_AUTH_UNAVAILABLE", // NAA is unavailable in the current context, can retry with standard browser based auth
-}
+export const BridgeStatusCode = {
+    UserInteractionRequired: "USER_INTERACTION_REQUIRED",
+    UserCancel: "USER_CANCEL",
+    NoNetwork: "NO_NETWORK",
+    TransientError: "TRANSIENT_ERROR",
+    PersistentError: "PERSISTENT_ERROR",
+    Disabled: "DISABLED",
+    AccountUnavailable: "ACCOUNT_UNAVAILABLE",
+    NestedAppAuthUnavailable: "NESTED_APP_AUTH_UNAVAILABLE", // NAA is unavailable in the current context, can retry with standard browser based auth
+} as const;
+export type BridgeStatusCode =
+    (typeof BridgeStatusCode)[keyof typeof BridgeStatusCode];

package/src/naa/IBridgeProxy.ts

@@ -4,24 +4,13 @@
  */
 
 import { AccountInfo } from "./AccountInfo";
-import {
-    AccountByHomeIdRequest,
-    AccountByLocalIdRequest,
-    AccountByUsernameRequest,
-} from "./AccountRequests";
+import { AuthResult } from "./AuthResult";
 import { BridgeCapabilities } from "./BridgeCapabilities";
 import { TokenRequest } from "./TokenRequest";
-import { TokenResponse } from "./TokenResponse";
 
 export interface IBridgeProxy {
-    getTokenInteractive(request: TokenRequest): Promise<TokenResponse>;
-    getTokenSilent(request: TokenRequest): Promise<TokenResponse>;
-    getAccountInfo(
-        request:
-            | AccountByHomeIdRequest
-            | AccountByLocalIdRequest
-            | AccountByUsernameRequest
-    ): Promise<AccountInfo>;
+    getTokenInteractive(request: TokenRequest): Promise<AuthResult>;
+    getTokenSilent(request: TokenRequest): Promise<AuthResult>;
     getActiveAccount(): Promise<AccountInfo>;
     getHostCapabilities(): BridgeCapabilities | null;
 }

package/src/naa/{InitializeBridgeResponse.ts → InitContext.ts}

@@ -5,7 +5,7 @@
 
 import { BridgeCapabilities } from "./BridgeCapabilities";
 
-export interface InitializeBridgeResponse {
+export interface InitContext {
     capabilities?: BridgeCapabilities;
     sdkName: string;
     sdkVersion: string;

package/src/naa/TokenRequest.ts

@@ -4,12 +4,11 @@
  */
 
 export type TokenRequest = {
-    userObjectId?: string; // Account identifier used by OneAuth
+    platformBrokerId?: string; // Account identifier used by OneAuth
     clientId: string;
     authority?: string;
     scope: string;
     correlationId: string;
-    nonce?: string;
     claims?: string;
     state?: string;
     reqCnf?: string; // Having OneAuth own the keypair is better for hardware token binding support

package/src/naa/TokenResponse.ts

@@ -3,15 +3,12 @@
  * Licensed under the MIT License.
  */
 
-import { AccountInfo } from "./AccountInfo";
-
 export type TokenResponse = {
     access_token: string;
-    account: AccountInfo;
     expires_in: number;
     id_token: string;
     properties: TokenResponseProperties | null;
-    scope: string;
+    scope?: string;
     shr?: string; // token binding enabled at native layer it is the access token, not the signing keys
     extendedLifetimeToken?: boolean;
     authority?: string;