@azure/msal-browser 3.6.0 → 3.7.0

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "3.6.0",
+  "version": "3.7.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",
@@ -101,6 +101,6 @@
     "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@azure/msal-common": "14.5.0"
+    "@azure/msal-common": "14.6.0"
   }
 }

package/src/cache/BrowserCacheManager.ts

@@ -866,10 +866,7 @@ export class BrowserCacheManager extends CacheManager {
         const parsedMetadata = this.validateAndParseJson(value);
         if (
             !parsedMetadata ||
-            !AppMetadataEntity.isAppMetadataEntity(
-                appMetadataKey,
-                parsedMetadata
-            )
+            !CacheHelpers.isAppMetadataEntity(appMetadataKey, parsedMetadata)
         ) {
             this.logger.trace(
                 "BrowserCacheManager.getAppMetadata: called, no cache hit"
@@ -878,7 +875,7 @@ export class BrowserCacheManager extends CacheManager {
         }
 
         this.logger.trace("BrowserCacheManager.getAppMetadata: cache hit");
-        return CacheManager.toObject(new AppMetadataEntity(), parsedMetadata);
+        return parsedMetadata as AppMetadataEntity;
     }
 
     /**
@@ -887,7 +884,7 @@ export class BrowserCacheManager extends CacheManager {
      */
     setAppMetadata(appMetadata: AppMetadataEntity): void {
         this.logger.trace("BrowserCacheManager.setAppMetadata called");
-        const appMetadataKey = appMetadata.generateAppMetadataKey();
+        const appMetadataKey = CacheHelpers.generateAppMetadataKey(appMetadata);
         this.setItem(appMetadataKey, JSON.stringify(appMetadata));
     }
 
@@ -950,18 +947,12 @@ export class BrowserCacheManager extends CacheManager {
         const parsedMetadata = this.validateAndParseJson(value);
         if (
             parsedMetadata &&
-            AuthorityMetadataEntity.isAuthorityMetadataEntity(
-                key,
-                parsedMetadata
-            )
+            CacheHelpers.isAuthorityMetadataEntity(key, parsedMetadata)
         ) {
             this.logger.trace(
                 "BrowserCacheManager.getAuthorityMetadata: cache hit"
             );
-            return CacheManager.toObject(
-                new AuthorityMetadataEntity(),
-                parsedMetadata
-            );
+            return parsedMetadata as AuthorityMetadataEntity;
         }
         return null;
     }
@@ -1119,7 +1110,7 @@ export class BrowserCacheManager extends CacheManager {
         const parsedThrottlingCache = this.validateAndParseJson(value);
         if (
             !parsedThrottlingCache ||
-            !ThrottlingEntity.isThrottlingEntity(
+            !CacheHelpers.isThrottlingEntity(
                 throttlingCacheKey,
                 parsedThrottlingCache
             )
@@ -1131,10 +1122,7 @@ export class BrowserCacheManager extends CacheManager {
         }
 
         this.logger.trace("BrowserCacheManager.getThrottlingCache: cache hit");
-        return CacheManager.toObject(
-            new ThrottlingEntity(),
-            parsedThrottlingCache
-        );
+        return parsedThrottlingCache as ThrottlingEntity;
     }
 
     /**

package/src/cache/TokenCache.ts

@@ -270,9 +270,10 @@ export class TokenCache implements ITokenCache {
                 idTokenClaims,
                 base64Decode,
                 clientInfo,
+                authority.hostnameAndPort,
                 claimsTenantId,
-                undefined,
-                undefined,
+                undefined, // authCodePayload
+                undefined, // nativeAccountId
                 this.logger
             );
 

package/src/controllers/StandardController.ts

@@ -43,6 +43,7 @@ import {
     CacheLookupPolicy,
     DEFAULT_REQUEST,
     BrowserConstants,
+    iFrameRenewalPolicies,
 } from "../utils/BrowserConstants";
 import * as BrowserUtils from "../utils/BrowserUtils";
 import { RedirectRequest } from "../request/RedirectRequest";
@@ -2078,29 +2079,17 @@ export class StandardController implements IController {
                         silentRequest.correlationId
                     )(silentRequest, cacheLookupPolicy).catch(
                         (refreshTokenError: AuthError) => {
-                            const isSilentlyResolvable =
-                                (!(
-                                    refreshTokenError instanceof
-                                    InteractionRequiredAuthError
-                                ) &&
-                                    (refreshTokenError.errorCode ===
-                                        BrowserConstants.INVALID_GRANT_ERROR ||
-                                        refreshTokenError.errorCode ===
-                                            ClientAuthErrorCodes.tokenRefreshRequired)) ||
-                                refreshTokenError.errorCode ===
-                                    InteractionRequiredAuthErrorCodes.noTokensFound;
-
-                            const tryIframeRenewal =
-                                cacheLookupPolicy ===
-                                    CacheLookupPolicy.Default ||
-                                cacheLookupPolicy === CacheLookupPolicy.Skip ||
-                                cacheLookupPolicy ===
-                                    CacheLookupPolicy.RefreshTokenAndNetwork;
-
-                            if (isSilentlyResolvable && tryIframeRenewal) {
+                            const shouldTryToResolveSilently =
+                                checkIfRefreshTokenErrorCanBeResolvedSilently(
+                                    refreshTokenError,
+                                    silentRequest,
+                                    cacheLookupPolicy
+                                );
+
+                            if (shouldTryToResolveSilently) {
                                 this.logger.verbose(
                                     "Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",
-                                    request.correlationId
+                                    silentRequest.correlationId
                                 );
                                 return invokeAsync(
                                     this.acquireTokenBySilentIframe.bind(this),
@@ -2110,6 +2099,7 @@ export class StandardController implements IController {
                                     silentRequest.correlationId
                                 )(silentRequest);
                             } else {
+                                // Error cannot be silently resolved or iframe renewal is not allowed, interaction required
                                 throw refreshTokenError;
                             }
                         }
@@ -2155,3 +2145,42 @@ export class StandardController implements IController {
             });
     }
 }
+
+/**
+ * Determines whether an error thrown by the refresh token endpoint can be resolved without interaction
+ * @param refreshTokenError
+ * @param silentRequest
+ * @param cacheLookupPolicy
+ * @returns
+ */
+function checkIfRefreshTokenErrorCanBeResolvedSilently(
+    refreshTokenError: AuthError,
+    silentRequest: CommonSilentFlowRequest,
+    cacheLookupPolicy: CacheLookupPolicy
+): boolean {
+    const noInteractionRequired = !(
+        refreshTokenError instanceof InteractionRequiredAuthError &&
+        // For refresh token errors, bad_token does not always require interaction (silently resolvable)
+        refreshTokenError.subError !==
+            InteractionRequiredAuthErrorCodes.badToken
+    );
+
+    // Errors that result when the refresh token needs to be replaced
+    const refreshTokenRefreshRequired =
+        refreshTokenError.errorCode === BrowserConstants.INVALID_GRANT_ERROR ||
+        refreshTokenError.errorCode ===
+            ClientAuthErrorCodes.tokenRefreshRequired;
+
+    // Errors that may be resolved before falling back to interaction (through iframe renewal)
+    const isSilentlyResolvable =
+        (noInteractionRequired && refreshTokenRefreshRequired) ||
+        refreshTokenError.errorCode ===
+            InteractionRequiredAuthErrorCodes.noTokensFound ||
+        refreshTokenError.errorCode ===
+            InteractionRequiredAuthErrorCodes.refreshTokenExpired;
+
+    // Only these policies allow for an iframe renewal attempt
+    const tryIframeRenewal = iFrameRenewalPolicies.includes(cacheLookupPolicy);
+
+    return isSilentlyResolvable && tryIframeRenewal;
+}

package/src/interaction_client/NativeInteractionClient.ts

@@ -430,8 +430,9 @@ export class NativeInteractionClient extends BaseInteractionClient {
             idTokenClaims,
             base64Decode,
             response.client_info,
+            undefined, // environment
             idTokenClaims.tid,
-            undefined,
+            undefined, // auth code payload
             response.account.id,
             this.logger
         );

package/src/interaction_client/SilentRefreshClient.ts

@@ -44,6 +44,14 @@ export class SilentRefreshClient extends StandardInteractionClient {
             ...request,
             ...baseRequest,
         };
+
+        if (request.redirectUri) {
+            // Make sure any passed redirectUri is converted to an absolute URL - redirectUri is not a required parameter for refresh token redemption so only include if explicitly provided
+            silentRequest.redirectUri = this.getRedirectUri(
+                request.redirectUri
+            );
+        }
+
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             ApiId.acquireTokenSilent_silentFlow
         );

package/src/naa/AuthResult.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AccountInfo } from "./AccountInfo";
+import { TokenResponse } from "./TokenResponse";
+
+export type AuthResult = {
+    token: TokenResponse;
+    account: AccountInfo;
+};

package/src/naa/BridgeProxy.ts

@@ -4,20 +4,17 @@
  */
 
 import { AccountInfo } from "./AccountInfo";
-import {
-    AccountByHomeIdRequest,
-    AccountByLocalIdRequest,
-    AccountByUsernameRequest,
-} from "./AccountRequests";
 import { AuthBridge, AuthBridgeResponse } from "./AuthBridge";
+import { AuthResult } from "./AuthResult";
 import { BridgeCapabilities } from "./BridgeCapabilities";
+import { BridgeError } from "./BridgeError";
 import { BridgeRequest } from "./BridgeRequest";
 import { BridgeRequestEnvelope, BridgeMethods } from "./BridgeRequestEnvelope";
 import { BridgeResponseEnvelope } from "./BridgeResponseEnvelope";
+import { BridgeStatusCode } from "./BridgeStatusCode";
 import { IBridgeProxy } from "./IBridgeProxy";
-import { InitializeBridgeResponse } from "./InitializeBridgeResponse";
+import { InitContext } from "./InitContext";
 import { TokenRequest } from "./TokenRequest";
-import { TokenResponse } from "./TokenResponse";
 
 declare global {
     interface Window {
@@ -31,8 +28,7 @@ declare global {
  * platform broker
  */
 export class BridgeProxy implements IBridgeProxy {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    static bridgeRequests: any[] = [];
+    static bridgeRequests: BridgeRequest[] = [];
     static crypto: Crypto;
     sdkName: string;
     sdkVersion: string;
@@ -44,7 +40,7 @@ export class BridgeProxy implements IBridgeProxy {
      * @remarks This method will be called by the create factory method
      * @remarks If the bridge is not available, this method will throw an error
      */
-    protected static async initializeNestedAppAuthBridge(): Promise<InitializeBridgeResponse> {
+    protected static async initializeNestedAppAuthBridge(): Promise<InitContext> {
         if (window === undefined) {
             throw new Error("window is undefined");
         }
@@ -75,22 +71,22 @@ export class BridgeProxy implements IBridgeProxy {
                             1
                         );
                         if (responseEnvelope.success) {
-                            request.resolve(responseEnvelope.body);
+                            request.resolve(responseEnvelope);
                         } else {
-                            request.reject(responseEnvelope.body);
+                            request.reject(responseEnvelope.error);
                         }
                     }
                 }
             );
 
-            const promise = new Promise<InitializeBridgeResponse>(
+            const bridgeResponse = await new Promise<BridgeResponseEnvelope>(
                 (resolve, reject) => {
                     const message: BridgeRequestEnvelope = {
                         messageType: "NestedAppAuthRequest",
                         method: "GetInitContext",
                         requestId: BridgeProxy.getRandomId(),
                     };
-                    const request: BridgeRequest<InitializeBridgeResponse> = {
+                    const request: BridgeRequest = {
                         requestId: message.requestId,
                         method: message.method,
                         resolve: resolve,
@@ -103,7 +99,9 @@ export class BridgeProxy implements IBridgeProxy {
                 }
             );
 
-            return await promise;
+            return BridgeProxy.validateBridgeResultOrThrow(
+                bridgeResponse.initContext
+            );
         } catch (error) {
             window.console.log(error);
             throw error;
@@ -117,51 +115,37 @@ export class BridgeProxy implements IBridgeProxy {
     /**
      * getTokenInteractive - Attempts to get a token interactively from the bridge
      * @param request A token request
-     * @returns a promise that resolves to a token response or rejects with a BridgeError
+     * @returns a promise that resolves to an auth result or rejects with a BridgeError
      */
-    public getTokenInteractive(request: TokenRequest): Promise<TokenResponse> {
-        return this.sendRequest<TokenResponse>("GetTokenPopup", request);
+    public getTokenInteractive(request: TokenRequest): Promise<AuthResult> {
+        return this.getToken("GetTokenPopup", request);
     }
 
     /**
      * getTokenSilent Attempts to get a token silently from the bridge
      * @param request A token request
-     * @returns a promise that resolves to a token response or rejects with a BridgeError
+     * @returns a promise that resolves to an auth result or rejects with a BridgeError
      */
-    public getTokenSilent(request: TokenRequest): Promise<TokenResponse> {
-        return this.sendRequest<TokenResponse>("GetToken", request);
+    public getTokenSilent(request: TokenRequest): Promise<AuthResult> {
+        return this.getToken("GetToken", request);
     }
 
-    /**
-     * getAccountInfo - Gets account information from the bridge
-     *
-     * @param request A request for account information
-     */
-    public getAccountInfo(
-        request:
-            | AccountByHomeIdRequest
-            | AccountByLocalIdRequest
-            | AccountByUsernameRequest
-    ): Promise<AccountInfo> {
-        let method: BridgeMethods = "GetAccountByHomeId";
-
-        if ((request as AccountByHomeIdRequest).homeAccountId !== undefined) {
-            method = "GetAccountByHomeId";
-        }
-
-        if ((request as AccountByLocalIdRequest).localAccountId !== undefined) {
-            method = "GetAccountByLocalId";
-        }
-
-        if ((request as AccountByUsernameRequest).username !== undefined) {
-            method = "GetAccountByUsername";
-        }
-
-        return this.sendRequest<AccountInfo>(method, request);
+    private async getToken(
+        requestType: BridgeMethods,
+        request: TokenRequest
+    ): Promise<AuthResult> {
+        const result = await this.sendRequest(requestType, {
+            tokenParams: request,
+        });
+        return {
+            token: BridgeProxy.validateBridgeResultOrThrow(result.token),
+            account: BridgeProxy.validateBridgeResultOrThrow(result.account),
+        };
     }
 
-    public getActiveAccount(): Promise<AccountInfo> {
-        return this.sendRequest<AccountInfo>("GetActiveAccount", undefined);
+    public async getActiveAccount(): Promise<AccountInfo> {
+        const result = await this.sendRequest("GetActiveAccount");
+        return BridgeProxy.validateBridgeResultOrThrow(result.account);
     }
 
     public getHostCapabilities(): BridgeCapabilities | null {
@@ -173,36 +157,43 @@ export class BridgeProxy implements IBridgeProxy {
      * @param request A token request
      * @returns a promise that resolves to a response of provided type or rejects with a BridgeError
      */
-    private sendRequest<TResponse>(
+    private sendRequest(
         method: BridgeMethods,
-        request:
-            | TokenRequest
-            | AccountByHomeIdRequest
-            | AccountByLocalIdRequest
-            | AccountByUsernameRequest
-            | undefined
-    ): Promise<TResponse> {
+        requestParams?: Partial<BridgeRequestEnvelope>
+    ): Promise<BridgeResponseEnvelope> {
         const message: BridgeRequestEnvelope = {
             messageType: "NestedAppAuthRequest",
             method: method,
             requestId: BridgeProxy.getRandomId(),
-            body: request,
+            ...requestParams,
         };
 
-        const promise = new Promise<TResponse>((resolve, reject) => {
-            const request: BridgeRequest<TResponse> = {
-                requestId: message.requestId,
-                method: message.method,
-                resolve: resolve,
-                reject: reject,
-            };
-            BridgeProxy.bridgeRequests.push(request);
-            window.nestedAppAuthBridge.postMessage(JSON.stringify(message));
-        });
+        const promise = new Promise<BridgeResponseEnvelope>(
+            (resolve, reject) => {
+                const request: BridgeRequest = {
+                    requestId: message.requestId,
+                    method: message.method,
+                    resolve: resolve,
+                    reject: reject,
+                };
+                BridgeProxy.bridgeRequests.push(request);
+                window.nestedAppAuthBridge.postMessage(JSON.stringify(message));
+            }
+        );
 
         return promise;
     }
 
+    private static validateBridgeResultOrThrow<T>(input: T | undefined): T {
+        if (input === undefined) {
+            const bridgeError: BridgeError = {
+                status: BridgeStatusCode.NestedAppAuthUnavailable,
+            };
+            throw bridgeError;
+        }
+        return input;
+    }
+
     /**
      * Private constructor for BridgeProxy
      * @param sdkName The name of the SDK being used to make requests on behalf of the app

package/src/naa/BridgeRequest.ts

@@ -3,10 +3,14 @@
  * Licensed under the MIT License.
  */
 
-export type BridgeRequest<TResponse> = {
+import { BridgeResponseEnvelope } from "./BridgeResponseEnvelope";
+
+export type BridgeRequest = {
     requestId: string;
     method: string;
-    resolve: (value: TResponse | PromiseLike<TResponse>) => void;
+    resolve: (
+        value: BridgeResponseEnvelope | PromiseLike<BridgeResponseEnvelope>
+    ) => void;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     reject: (reason?: any) => void;
 };

package/src/naa/BridgeRequestEnvelope.ts

@@ -4,19 +4,11 @@
  */
 
 import { TokenRequest } from "./TokenRequest";
-import {
-    AccountByHomeIdRequest,
-    AccountByLocalIdRequest,
-    AccountByUsernameRequest,
-} from "./AccountRequests";
 
 export type BridgeMethods =
     | "GetToken"
     | "GetActiveAccount"
     | "GetAllAccounts"
-    | "GetAccountByHomeId"
-    | "GetAccountByLocalId"
-    | "GetAccountByUsername"
     | "GetInitContext"
     | "GetTokenPopup";
 
@@ -27,11 +19,7 @@ export type BridgeRequestEnvelope = {
     clientLibrary?: string;
     clientLibraryVersion?: string;
     requestId: string;
-    body?:
-        | TokenRequest
-        | AccountByHomeIdRequest
-        | AccountByLocalIdRequest
-        | AccountByUsernameRequest;
+    tokenParams?: TokenRequest;
 };
 
 export function isBridgeRequestEnvelope(

package/src/naa/BridgeResponseEnvelope.ts

@@ -6,16 +6,14 @@
 import { BridgeError } from "./BridgeError";
 import { TokenResponse } from "./TokenResponse";
 import { AccountInfo } from "./AccountInfo";
-import { InitializeBridgeResponse } from "./InitializeBridgeResponse";
+import { InitContext } from "./InitContext";
 
 export type BridgeResponseEnvelope = {
     messageType: "NestedAppAuthResponse";
     requestId: string;
     success: boolean; // false if body is error
-    body:
-        | TokenResponse
-        | BridgeError
-        | AccountInfo
-        | AccountInfo[]
-        | InitializeBridgeResponse;
+    token?: TokenResponse;
+    error?: BridgeError;
+    account?: AccountInfo;
+    initContext?: InitContext;
 };

package/src/naa/BridgeStatusCode.ts

@@ -3,13 +3,15 @@
  * Licensed under the MIT License.
  */
 
-export enum BridgeStatusCode {
-    USER_INTERACTION_REQUIRED = "USER_INTERACTION_REQUIRED",
-    USER_CANCEL = "USER_CANCEL",
-    NO_NETWORK = "NO_NETWORK",
-    TRANSIENT_ERROR = "TRANSIENT_ERROR",
-    PERSISTENT_ERROR = "PERSISTENT_ERROR",
-    DISABLED = "DISABLED",
-    ACCOUNT_UNAVAILABLE = "ACCOUNT_UNAVAILABLE",
-    NESTED_APP_AUTH_UNAVAILABLE = "NESTED_APP_AUTH_UNAVAILABLE", // NAA is unavailable in the current context, can retry with standard browser based auth
-}
+export const BridgeStatusCode = {
+    UserInteractionRequired: "USER_INTERACTION_REQUIRED",
+    UserCancel: "USER_CANCEL",
+    NoNetwork: "NO_NETWORK",
+    TransientError: "TRANSIENT_ERROR",
+    PersistentError: "PERSISTENT_ERROR",
+    Disabled: "DISABLED",
+    AccountUnavailable: "ACCOUNT_UNAVAILABLE",
+    NestedAppAuthUnavailable: "NESTED_APP_AUTH_UNAVAILABLE", // NAA is unavailable in the current context, can retry with standard browser based auth
+} as const;
+export type BridgeStatusCode =
+    (typeof BridgeStatusCode)[keyof typeof BridgeStatusCode];

package/src/naa/IBridgeProxy.ts

@@ -4,24 +4,13 @@
  */
 
 import { AccountInfo } from "./AccountInfo";
-import {
-    AccountByHomeIdRequest,
-    AccountByLocalIdRequest,
-    AccountByUsernameRequest,
-} from "./AccountRequests";
+import { AuthResult } from "./AuthResult";
 import { BridgeCapabilities } from "./BridgeCapabilities";
 import { TokenRequest } from "./TokenRequest";
-import { TokenResponse } from "./TokenResponse";
 
 export interface IBridgeProxy {
-    getTokenInteractive(request: TokenRequest): Promise<TokenResponse>;
-    getTokenSilent(request: TokenRequest): Promise<TokenResponse>;
-    getAccountInfo(
-        request:
-            | AccountByHomeIdRequest
-            | AccountByLocalIdRequest
-            | AccountByUsernameRequest
-    ): Promise<AccountInfo>;
+    getTokenInteractive(request: TokenRequest): Promise<AuthResult>;
+    getTokenSilent(request: TokenRequest): Promise<AuthResult>;
     getActiveAccount(): Promise<AccountInfo>;
     getHostCapabilities(): BridgeCapabilities | null;
 }

package/src/naa/{InitializeBridgeResponse.ts → InitContext.ts}

@@ -5,7 +5,7 @@
 
 import { BridgeCapabilities } from "./BridgeCapabilities";
 
-export interface InitializeBridgeResponse {
+export interface InitContext {
     capabilities?: BridgeCapabilities;
     sdkName: string;
     sdkVersion: string;

package/src/naa/TokenRequest.ts

@@ -4,12 +4,11 @@
  */
 
 export type TokenRequest = {
-    userObjectId?: string; // Account identifier used by OneAuth
+    platformBrokerId?: string; // Account identifier used by OneAuth
     clientId: string;
     authority?: string;
     scope: string;
     correlationId: string;
-    nonce?: string;
     claims?: string;
     state?: string;
     reqCnf?: string; // Having OneAuth own the keypair is better for hardware token binding support

package/src/naa/TokenResponse.ts

@@ -3,15 +3,12 @@
  * Licensed under the MIT License.
  */
 
-import { AccountInfo } from "./AccountInfo";
-
 export type TokenResponse = {
     access_token: string;
-    account: AccountInfo;
     expires_in: number;
     id_token: string;
     properties: TokenResponseProperties | null;
-    scope: string;
+    scope?: string;
     shr?: string; // token binding enabled at native layer it is the access token, not the signing keys
     extendedLifetimeToken?: boolean;
     authority?: string;