@azure/msal-browser 3.9.0 → 3.10.0

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "3.9.0",
+  "version": "3.10.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",
@@ -101,6 +101,6 @@
     "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@azure/msal-common": "14.7.0"
+    "@azure/msal-common": "14.7.1"
   }
 }

package/src/interaction_client/NativeInteractionClient.ts

@@ -262,6 +262,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
             const fullAccount = {
                 ...account,
                 idTokenClaims: result?.idTokenClaims as TokenClaims,
+                idToken: result?.idToken,
             };
 
             return {
@@ -416,24 +417,33 @@ export class NativeInteractionClient extends BaseInteractionClient {
             "NativeInteractionClient - handleNativeResponse called."
         );
 
-        if (response.account.id !== request.accountId) {
-            // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
-            throw createNativeAuthError(NativeAuthErrorCodes.userSwitch);
-        }
-
-        // Get the preferred_cache domain for the given authority
-        const authority = await this.getDiscoveredAuthority(request.authority);
-
         // generate identifiers
         const idTokenClaims = AuthToken.extractTokenClaims(
             response.id_token,
             base64Decode
         );
+
         const homeAccountIdentifier = this.createHomeAccountIdentifier(
             response,
             idTokenClaims
         );
 
+        const cachedhomeAccountId =
+            this.browserStorage.getAccountInfoFilteredBy({
+                nativeAccountId: request.accountId,
+            })?.homeAccountId;
+
+        if (
+            homeAccountIdentifier !== cachedhomeAccountId &&
+            response.account.id !== request.accountId
+        ) {
+            // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
+            throw createNativeAuthError(NativeAuthErrorCodes.userSwitch);
+        }
+
+        // Get the preferred_cache domain for the given authority
+        const authority = await this.getDiscoveredAuthority(request.authority);
+
         const baseAccount = buildAccountToCache(
             this.browserStorage,
             authority,
@@ -601,9 +611,18 @@ export class NativeInteractionClient extends BaseInteractionClient {
         const accountInfo: AccountInfo | null = updateAccountTenantProfileData(
             accountEntity.getAccountInfo(),
             undefined, // tenantProfile optional
-            idTokenClaims
+            idTokenClaims,
+            response.id_token
         );
 
+        /**
+         * In pairwise broker flows, this check prevents the broker's native account id
+         * from being returned over the embedded app's account id.
+         */
+        if (accountInfo.nativeAccountId !== response.account.id) {
+            accountInfo.nativeAccountId = response.account.id;
+        }
+
         // generate PoP token as needed
         const responseAccessToken = await this.generatePopAccessToken(
             response,

package/src/interaction_client/SilentIframeClient.ts

@@ -93,15 +93,20 @@ export class SilentIframeClient extends StandardInteractionClient {
             );
         }
 
-        // Check that prompt is set to none or no_session, throw error if it is set to anything else.
-        if (
-            request.prompt &&
-            request.prompt !== PromptValue.NONE &&
-            request.prompt !== PromptValue.NO_SESSION
-        ) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.silentPromptValueError
-            );
+        // Check the prompt value
+        const inputRequest = { ...request };
+        if (inputRequest.prompt) {
+            if (
+                inputRequest.prompt !== PromptValue.NONE &&
+                inputRequest.prompt !== PromptValue.NO_SESSION
+            ) {
+                this.logger.warning(
+                    `SilentIframeClient. Replacing invalid prompt ${inputRequest.prompt} with ${PromptValue.NONE}`
+                );
+                inputRequest.prompt = PromptValue.NONE;
+            }
+        } else {
+            inputRequest.prompt = PromptValue.NONE;
         }
 
         // Create silent request
@@ -111,13 +116,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(
-            {
-                ...request,
-                prompt: request.prompt || PromptValue.NONE,
-            },
-            InteractionType.Silent
-        );
+        )(inputRequest, InteractionType.Silent);
         BrowserUtils.preconnect(silentRequest.authority);
 
         const serverTelemetryManager = this.initializeServerTelemetryManager(

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.9.0";
+export const version = "3.10.0";

package/src/telemetry/BrowserPerformanceClient.ts

@@ -20,6 +20,7 @@ import {
     BROWSER_PERF_ENABLED_KEY,
     BrowserCacheLocation,
 } from "../utils/BrowserConstants";
+import * as BrowserCrypto from "../crypto/BrowserCrypto";
 
 /**
  * Returns browser performance measurement module if session flag is enabled. Returns undefined otherwise.
@@ -88,7 +89,7 @@ export class BrowserPerformanceClient
     }
 
     generateId(): string {
-        return window.crypto.randomUUID();
+        return BrowserCrypto.createNewGuid();
     }
 
     private getPageVisibility(): string | null {

package/src/utils/BrowserUtils.ts

@@ -9,6 +9,7 @@ import {
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
 import { InteractionType, BrowserConstants } from "./BrowserConstants";
+import * as BrowserCrypto from "../crypto/BrowserCrypto";
 
 /**
  * Clears hash from window url.
@@ -162,3 +163,11 @@ export function preconnect(authority: string): void {
         } catch {}
     }, 10000); // 10s Timeout
 }
+
+/**
+ * Wrapper function that creates a UUID v7 from the current timestamp.
+ * @returns {string}
+ */
+export function createGuid(): string {
+    return BrowserCrypto.createNewGuid();
+}