@azure/msal-browser 3.7.0 → 3.7.2-alpha.0

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "3.7.0",
+  "version": "3.7.2-alpha.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",
@@ -85,11 +85,11 @@
     "@types/node": "^20.3.1",
     "@types/sinon": "^7.5.0",
     "dotenv": "^8.2.0",
-    "eslint-config-msal": "^0.0.0",
-    "msal-test-utils": "^0.0.1",
+    "eslint-config-msal": "file:../../shared-configs/eslint-config-msal",
     "fake-indexeddb": "^3.1.3",
     "jest": "^29.5.0",
     "jest-environment-jsdom": "^29.5.0",
+    "msal-test-utils": "file:../../shared-test-utils",
     "prettier": "2.8.7",
     "rimraf": "^3.0.0",
     "rollup": "^3.14.0",
@@ -101,6 +101,6 @@
     "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@azure/msal-common": "14.6.0"
+    "@azure/msal-common": "14.6.2-alpha.0"
   }
 }

package/src/cache/TokenCache.ts

@@ -31,6 +31,7 @@ import {
 } from "../error/BrowserAuthError";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { base64Decode } from "../encode/Base64Decode";
+import * as BrowserCrypto from "../crypto/BrowserCrypto";
 
 export type LoadTokenOptions = {
     clientInfo?: string;
@@ -142,7 +143,8 @@ export class TokenCache implements ITokenCache {
                 this.config.system.networkClient,
                 this.storage,
                 authorityOptions,
-                this.logger
+                this.logger,
+                request.correlationId || BrowserCrypto.createNewGuid()
             );
 
             // "clientInfo" from options takes precedence over "clientInfo" in response

package/src/controllers/StandardController.ts

@@ -1950,7 +1950,10 @@ export class StandardController implements IController {
                     throw error;
                 });
             this.activeSilentTokenRequests.set(silentRequestKey, response);
-            return response;
+            return {
+                ...(await response),
+                state: request.state,
+            };
         } else {
             this.logger.verbose(
                 "acquireTokenSilent has been called previously, returning the result from the first call",
@@ -1958,7 +1961,10 @@ export class StandardController implements IController {
             );
             // Discard measurements for memoized calls, as they are usually only a couple of ms and will artificially deflate metrics
             atsMeasurement.discard();
-            return cachedResponse;
+            return {
+                ...(await cachedResponse),
+                state: request.state,
+            };
         }
     }
 

package/src/crypto/BrowserCrypto.ts

@@ -30,6 +30,10 @@ const S256_HASH_ALG = "SHA-256";
 const MODULUS_LENGTH = 2048;
 // Public Exponent
 const PUBLIC_EXPONENT: Uint8Array = new Uint8Array([0x01, 0x00, 0x01]);
+// UUID hex digits
+const UUID_CHARS = "0123456789abcdef";
+// Array to store UINT32 random value
+const UINT32_ARR = new Uint32Array(1);
 
 const keygenAlgorithmOptions: RsaHashedKeyGenParams = {
     name: PKCS1_V15_KEYGEN_ALG,
@@ -52,7 +56,9 @@ export function validateCryptoAvailable(logger: Logger): void {
 
 /**
  * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
- * @param dataString
+ * @param dataString {string} data string
+ * @param performanceClient {?IPerformanceClient}
+ * @param correlationId {?string} correlation id
  */
 export async function sha256Digest(
     dataString: string,
@@ -80,11 +86,58 @@ export function getRandomValues(dataBuffer: Uint8Array): Uint8Array {
 }
 
 /**
- * Creates a new random GUID
- * @returns
+ * Returns random Uint32 value.
+ * @returns {number}
+ */
+function getRandomUint32(): number {
+    window.crypto.getRandomValues(UINT32_ARR);
+    return UINT32_ARR[0];
+}
+
+/**
+ * Creates a UUID v7 from the current timestamp.
+ * Implementation relies on the system clock to guarantee increasing order of generated identifiers.
+ * @returns {number}
  */
 export function createNewGuid(): string {
-    return window.crypto.randomUUID();
+    const currentTimestamp = Date.now();
+    const baseRand = getRandomUint32() * 0x400 + (getRandomUint32() & 0x3ff);
+
+    // Result byte array
+    const bytes = new Uint8Array(16);
+    // A 12-bit `rand_a` field value
+    const randA = Math.trunc(baseRand / 2 ** 30);
+    // The higher 30 bits of 62-bit `rand_b` field value
+    const randBHi = baseRand & (2 ** 30 - 1);
+    // The lower 32 bits of 62-bit `rand_b` field value
+    const randBLo = getRandomUint32();
+
+    bytes[0] = currentTimestamp / 2 ** 40;
+    bytes[1] = currentTimestamp / 2 ** 32;
+    bytes[2] = currentTimestamp / 2 ** 24;
+    bytes[3] = currentTimestamp / 2 ** 16;
+    bytes[4] = currentTimestamp / 2 ** 8;
+    bytes[5] = currentTimestamp;
+    bytes[6] = 0x70 | (randA >>> 8);
+    bytes[7] = randA;
+    bytes[8] = 0x80 | (randBHi >>> 24);
+    bytes[9] = randBHi >>> 16;
+    bytes[10] = randBHi >>> 8;
+    bytes[11] = randBHi;
+    bytes[12] = randBLo >>> 24;
+    bytes[13] = randBLo >>> 16;
+    bytes[14] = randBLo >>> 8;
+    bytes[15] = randBLo;
+
+    let text = "";
+    for (let i = 0; i < bytes.length; i++) {
+        text += UUID_CHARS.charAt(bytes[i] >>> 4);
+        text += UUID_CHARS.charAt(bytes[i] & 0xf);
+        if (i === 3 || i === 5 || i === 7 || i === 9) {
+            text += "-";
+        }
+    }
+    return text;
 }
 
 /**

package/src/interaction_client/BaseInteractionClient.ts

@@ -22,6 +22,8 @@ import {
     IPerformanceClient,
     PerformanceEvents,
     StringUtils,
+    AzureCloudOptions,
+    invokeAsync,
 } from "@azure/msal-common";
 import { BrowserConfiguration } from "../config/Configuration";
 import { BrowserCacheManager } from "../cache/BrowserCacheManager";
@@ -136,8 +138,7 @@ export abstract class BaseInteractionClient {
      * @param request
      */
     protected async initializeBaseRequest(
-        request: Partial<BaseAuthRequest>,
-        account?: AccountInfo
+        request: Partial<BaseAuthRequest>
     ): Promise<BaseAuthRequest> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.InitializeBaseRequest,
@@ -145,10 +146,6 @@ export abstract class BaseInteractionClient {
         );
         const authority = request.authority || this.config.auth.authority;
 
-        if (account) {
-            await this.validateRequestAuthority(authority, account);
-        }
-
         const scopes = [...((request && request.scopes) || [])];
 
         const validatedRequest: BaseAuthRequest = {
@@ -218,25 +215,6 @@ export abstract class BaseInteractionClient {
         );
     }
 
-    /*
-     * If authority provided in the request does not match environment/authority specified
-     * in the account or MSAL config, we throw an error.
-     */
-    async validateRequestAuthority(
-        authority: string,
-        account: AccountInfo
-    ): Promise<void> {
-        const discoveredAuthority = await this.getDiscoveredAuthority(
-            authority
-        );
-
-        if (!discoveredAuthority.isAlias(account.environment)) {
-            throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.authorityMismatch
-            );
-        }
-    }
-
     /**
      *
      * @param apiId
@@ -266,41 +244,60 @@ export abstract class BaseInteractionClient {
     /**
      * Used to get a discovered version of the default authority.
      * @param requestAuthority
+     * @param requestAzureCloudOptions
+     * @param account
      */
     protected async getDiscoveredAuthority(
-        requestAuthority?: string
+        requestAuthority?: string,
+        requestAzureCloudOptions?: AzureCloudOptions,
+        account?: AccountInfo
     ): Promise<Authority> {
-        this.logger.verbose("getDiscoveredAuthority called");
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+            this.correlationId
+        );
         const authorityOptions: AuthorityOptions = {
             protocolMode: this.config.auth.protocolMode,
             OIDCOptions: this.config.auth.OIDCOptions,
             knownAuthorities: this.config.auth.knownAuthorities,
             cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
             authorityMetadata: this.config.auth.authorityMetadata,
+            skipAuthorityMetadataCache:
+                this.config.auth.skipAuthorityMetadataCache,
         };
 
-        if (requestAuthority) {
-            this.logger.verbose(
-                "Creating discovered authority with request authority"
-            );
-            return AuthorityFactory.createDiscoveredInstance(
-                requestAuthority,
-                this.config.system.networkClient,
-                this.browserStorage,
-                authorityOptions,
-                this.logger
-            );
-        }
+        // build authority string based on auth params, precedence - azureCloudInstance + tenant >> authority
+        const userAuthority = requestAuthority
+            ? requestAuthority
+            : this.config.auth.authority;
 
-        this.logger.verbose(
-            "Creating discovered authority with configured authority"
+        // fall back to the authority from config
+        const builtAuthority = Authority.generateAuthority(
+            userAuthority,
+            requestAzureCloudOptions || this.config.auth.azureCloudOptions
         );
-        return AuthorityFactory.createDiscoveredInstance(
-            this.config.auth.authority,
+        const discoveredAuthority = await invokeAsync(
+            AuthorityFactory.createDiscoveredInstance,
+            PerformanceEvents.AuthorityFactoryCreateDiscoveredInstance,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(
+            builtAuthority,
             this.config.system.networkClient,
             this.browserStorage,
             authorityOptions,
-            this.logger
+            this.logger,
+            this.correlationId,
+            this.performanceClient
         );
+
+        if (account && !discoveredAuthority.isAlias(account.environment)) {
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.authorityMismatch
+            );
+        }
+
+        return discoveredAuthority;
     }
 }

package/src/interaction_client/NativeInteractionClient.ts

@@ -809,7 +809,12 @@ export class NativeInteractionClient extends BaseInteractionClient {
         const authority = request.authority || this.config.auth.authority;
 
         if (request.account) {
-            await this.validateRequestAuthority(authority, request.account);
+            // validate authority
+            await this.getDiscoveredAuthority(
+                authority,
+                request.azureCloudOptions,
+                request.account
+            );
         }
 
         const canonicalAuthority = new UrlString(authority);

package/src/interaction_client/PopupClient.ts

@@ -232,7 +232,8 @@ export class PopupClient extends StandardInteractionClient {
             )(
                 serverTelemetryManager,
                 validRequest.authority,
-                validRequest.azureCloudOptions
+                validRequest.azureCloudOptions,
+                validRequest.account
             );
 
             const isNativeBroker = NativeMessageHandler.isNativeAvailable(
@@ -406,7 +407,12 @@ export class PopupClient extends StandardInteractionClient {
                 this.logger,
                 this.performanceClient,
                 this.correlationId
-            )(serverTelemetryManager, requestAuthority);
+            )(
+                serverTelemetryManager,
+                requestAuthority,
+                undefined, // AzureCloudOptions
+                validRequest.account || undefined
+            );
 
             try {
                 authClient.authority.endSessionEndpoint;

package/src/interaction_client/RedirectClient.ts

@@ -136,7 +136,8 @@ export class RedirectClient extends StandardInteractionClient {
             )(
                 serverTelemetryManager,
                 validRequest.authority,
-                validRequest.azureCloudOptions
+                validRequest.azureCloudOptions,
+                validRequest.account
             );
 
             // Create redirect interaction handler.
@@ -520,7 +521,12 @@ export class RedirectClient extends StandardInteractionClient {
                 this.logger,
                 this.performanceClient,
                 this.correlationId
-            )(serverTelemetryManager, logoutRequest && logoutRequest.authority);
+            )(
+                serverTelemetryManager,
+                logoutRequest && logoutRequest.authority,
+                undefined, // AzureCloudOptions
+                (logoutRequest && logoutRequest.account) || undefined
+            );
 
             if (authClient.authority.protocolMode === ProtocolMode.OIDC) {
                 try {

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -99,7 +99,12 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
                 this.logger,
                 this.performanceClient,
                 request.correlationId
-            )(serverTelemetryManager, silentRequest.authority);
+            )(
+                serverTelemetryManager,
+                silentRequest.authority,
+                silentRequest.azureCloudOptions,
+                silentRequest.account
+            );
             const authClient: HybridSpaAuthorizationCodeClient =
                 new HybridSpaAuthorizationCodeClient(clientConfig);
             this.logger.verbose("Auth code client created");

package/src/interaction_client/SilentCacheClient.ts

@@ -42,7 +42,8 @@ export class SilentCacheClient extends StandardInteractionClient {
         const silentAuthClient = await this.createSilentFlowClient(
             serverTelemetryManager,
             silentRequest.authority,
-            silentRequest.azureCloudOptions
+            silentRequest.azureCloudOptions,
+            silentRequest.account
         );
         this.logger.verbose("Silent auth client created");
 
@@ -94,7 +95,8 @@ export class SilentCacheClient extends StandardInteractionClient {
     protected async createSilentFlowClient(
         serverTelemetryManager: ServerTelemetryManager,
         authorityUrl?: string,
-        azureCloudOptions?: AzureCloudOptions
+        azureCloudOptions?: AzureCloudOptions,
+        account?: AccountInfo
     ): Promise<SilentFlowClient> {
         // Create auth module.
         const clientConfig = await invokeAsync(
@@ -103,7 +105,7 @@ export class SilentCacheClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient,
             this.correlationId
-        )(serverTelemetryManager, authorityUrl, azureCloudOptions);
+        )(serverTelemetryManager, authorityUrl, azureCloudOptions, account);
         return new SilentFlowClient(clientConfig, this.performanceClient);
     }
 
@@ -122,7 +124,7 @@ export class SilentCacheClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient,
             this.correlationId
-        )(request, account);
+        )(request);
         return {
             ...request,
             ...baseRequest,

package/src/interaction_client/SilentIframeClient.ts

@@ -135,7 +135,8 @@ export class SilentIframeClient extends StandardInteractionClient {
             )(
                 serverTelemetryManager,
                 silentRequest.authority,
-                silentRequest.azureCloudOptions
+                silentRequest.azureCloudOptions,
+                silentRequest.account
             );
 
             return await invokeAsync(

package/src/interaction_client/SilentRefreshClient.ts

@@ -12,6 +12,7 @@ import {
     AzureCloudOptions,
     PerformanceEvents,
     invokeAsync,
+    AccountInfo,
 } from "@azure/msal-common";
 import { ApiId } from "../utils/BrowserConstants";
 import {
@@ -39,7 +40,7 @@ export class SilentRefreshClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(request, request.account);
+        )(request);
         const silentRequest: CommonSilentFlowRequest = {
             ...request,
             ...baseRequest,
@@ -59,7 +60,8 @@ export class SilentRefreshClient extends StandardInteractionClient {
         const refreshTokenClient = await this.createRefreshTokenClient(
             serverTelemetryManager,
             silentRequest.authority,
-            silentRequest.azureCloudOptions
+            silentRequest.azureCloudOptions,
+            silentRequest.account
         );
         // Send request to renew token. Auth module will throw errors if token cannot be renewed.
         return invokeAsync(
@@ -97,7 +99,8 @@ export class SilentRefreshClient extends StandardInteractionClient {
     protected async createRefreshTokenClient(
         serverTelemetryManager: ServerTelemetryManager,
         authorityUrl?: string,
-        azureCloudOptions?: AzureCloudOptions
+        azureCloudOptions?: AzureCloudOptions,
+        account?: AccountInfo
     ): Promise<RefreshTokenClient> {
         // Create auth module.
         const clientConfig = await invokeAsync(
@@ -106,7 +109,7 @@ export class SilentRefreshClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient,
             this.correlationId
-        )(serverTelemetryManager, authorityUrl, azureCloudOptions);
+        )(serverTelemetryManager, authorityUrl, azureCloudOptions, account);
         return new RefreshTokenClient(clientConfig, this.performanceClient);
     }
 }

package/src/interaction_client/StandardInteractionClient.ts

@@ -9,9 +9,6 @@ import {
     Constants,
     AuthorizationCodeClient,
     ClientConfiguration,
-    AuthorityOptions,
-    Authority,
-    AuthorityFactory,
     UrlString,
     CommonEndSessionRequest,
     ProtocolUtils,
@@ -207,7 +204,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
     protected async createAuthCodeClient(
         serverTelemetryManager: ServerTelemetryManager,
         authorityUrl?: string,
-        requestAzureCloudOptions?: AzureCloudOptions
+        requestAzureCloudOptions?: AzureCloudOptions,
+        account?: AccountInfo
     ): Promise<AuthorizationCodeClient> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
@@ -220,7 +218,12 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             this.logger,
             this.performanceClient,
             this.correlationId
-        )(serverTelemetryManager, authorityUrl, requestAzureCloudOptions);
+        )(
+            serverTelemetryManager,
+            authorityUrl,
+            requestAzureCloudOptions,
+            account
+        );
         return new AuthorizationCodeClient(
             clientConfig,
             this.performanceClient
@@ -236,7 +239,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
     protected async getClientConfiguration(
         serverTelemetryManager: ServerTelemetryManager,
         requestAuthority?: string,
-        requestAzureCloudOptions?: AzureCloudOptions
+        requestAzureCloudOptions?: AzureCloudOptions,
+        account?: AccountInfo
     ): Promise<ClientConfiguration> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.StandardInteractionClientGetClientConfiguration,
@@ -248,7 +252,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             this.logger,
             this.performanceClient,
             this.correlationId
-        )(requestAuthority, requestAzureCloudOptions);
+        )(requestAuthority, requestAzureCloudOptions, account);
         const logger = this.config.system.loggerOptions;
 
         return {
@@ -286,56 +290,6 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         };
     }
 
-    /**
-     * Used to get a discovered version of the default authority.
-     * @param requestAuthority
-     * @param requestCorrelationId
-     */
-    protected async getDiscoveredAuthority(
-        requestAuthority?: string,
-        requestAzureCloudOptions?: AzureCloudOptions
-    ): Promise<Authority> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
-            this.correlationId
-        );
-        const authorityOptions: AuthorityOptions = {
-            protocolMode: this.config.auth.protocolMode,
-            OIDCOptions: this.config.auth.OIDCOptions,
-            knownAuthorities: this.config.auth.knownAuthorities,
-            cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-            authorityMetadata: this.config.auth.authorityMetadata,
-            skipAuthorityMetadataCache:
-                this.config.auth.skipAuthorityMetadataCache,
-        };
-
-        // build authority string based on auth params, precedence - azureCloudInstance + tenant >> authority
-        const userAuthority = requestAuthority
-            ? requestAuthority
-            : this.config.auth.authority;
-
-        // fall back to the authority from config
-        const builtAuthority = Authority.generateAuthority(
-            userAuthority,
-            requestAzureCloudOptions || this.config.auth.azureCloudOptions
-        );
-        return invokeAsync(
-            AuthorityFactory.createDiscoveredInstance.bind(AuthorityFactory),
-            PerformanceEvents.AuthorityFactoryCreateDiscoveredInstance,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        )(
-            builtAuthority,
-            this.config.system.networkClient,
-            this.browserStorage,
-            authorityOptions,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        );
-    }
-
     /**
      * Helper to initialize required request parameters for interactive APIs and ssoSilent()
      * @param request

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.7.0";
+export const version = "3.7.2-alpha.0";

package/src/request/SilentRequest.ts

@@ -45,5 +45,6 @@ export type SilentRequest = Omit<
     forceRefresh?: boolean;
     cacheLookupPolicy?: CacheLookupPolicy;
     prompt?: string;
+    state?: string;
     tokenBodyParameters?: StringDict;
 };