@azure/msal-browser 3.9.0 → 3.11.0

package/src/interaction_client/StandardInteractionClient.ts

@@ -32,6 +32,7 @@ import { PopupRequest } from "../request/PopupRequest";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";
 import { generatePkceCodes } from "../crypto/PkceGenerator";
 import { createNewGuid } from "../crypto/BrowserCrypto";
+import { initializeBaseRequest } from "../request/RequestHelpers";
 
 /**
  * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
@@ -315,12 +316,17 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         );
 
         const baseRequest: BaseAuthRequest = await invokeAsync(
-            this.initializeBaseRequest.bind(this),
+            initializeBaseRequest,
             PerformanceEvents.InitializeBaseRequest,
             this.logger,
             this.performanceClient,
             this.correlationId
-        )(request);
+        )(
+            { ...request, correlationId: this.correlationId },
+            this.config,
+            this.performanceClient,
+            this.logger
+        );
 
         const validatedRequest: AuthorizationUrlRequest = {
             ...baseRequest,

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -23,12 +23,15 @@ import {
     RequestParameterBuilder,
     StringUtils,
     createClientAuthError,
+    OIDC_DEFAULT_SCOPES,
 } from "@azure/msal-common";
 import { isBridgeError } from "../BridgeError";
 import { BridgeStatusCode } from "../BridgeStatusCode";
 import { AuthenticationResult } from "../../response/AuthenticationResult";
 import {} from "../../error/BrowserAuthErrorCodes";
 import { AuthResult } from "../AuthResult";
+import { SsoSilentRequest } from "../../request/SsoSilentRequest";
+import { SilentRequest } from "../../request/SilentRequest";
 
 export class NestedAppAuthAdapter {
     protected crypto: ICrypto;
@@ -49,7 +52,11 @@ export class NestedAppAuthAdapter {
     }
 
     public toNaaTokenRequest(
-        request: PopupRequest | RedirectRequest
+        request:
+            | PopupRequest
+            | RedirectRequest
+            | SilentRequest
+            | SsoSilentRequest
     ): TokenRequest {
         let extraParams: Map<string, string>;
         if (request.extraQueryParameters === undefined) {
@@ -65,11 +72,12 @@ export class NestedAppAuthAdapter {
             request.claims,
             this.clientCapabilities
         );
+        const scopes = request.scopes || OIDC_DEFAULT_SCOPES;
         const tokenRequest: TokenRequest = {
             platformBrokerId: request.account?.homeAccountId,
             clientId: this.clientId,
             authority: request.authority,
-            scope: request.scopes.join(" "),
+            scope: scopes.join(" "),
             correlationId:
                 request.correlationId !== undefined
                     ? request.correlationId

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.9.0";
+export const version = "3.11.0";

package/src/request/RequestHelpers.ts

@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    AccountInfo,
+    AuthenticationScheme,
+    BaseAuthRequest,
+    ClientConfigurationErrorCodes,
+    CommonSilentFlowRequest,
+    IPerformanceClient,
+    Logger,
+    PerformanceEvents,
+    StringUtils,
+    createClientConfigurationError,
+    invokeAsync,
+} from "@azure/msal-common";
+import { BrowserConfiguration } from "../config/Configuration";
+import { SilentRequest } from "./SilentRequest";
+import { hashString } from "../crypto/BrowserCrypto";
+
+/**
+ * Initializer function for all request APIs
+ * @param request
+ */
+export async function initializeBaseRequest(
+    request: Partial<BaseAuthRequest> & { correlationId: string },
+    config: BrowserConfiguration,
+    performanceClient: IPerformanceClient,
+    logger: Logger
+): Promise<BaseAuthRequest> {
+    performanceClient.addQueueMeasurement(
+        PerformanceEvents.InitializeBaseRequest,
+        request.correlationId
+    );
+    const authority = request.authority || config.auth.authority;
+
+    const scopes = [...((request && request.scopes) || [])];
+
+    const validatedRequest: BaseAuthRequest = {
+        ...request,
+        correlationId: request.correlationId,
+        authority,
+        scopes,
+    };
+
+    // Set authenticationScheme to BEARER if not explicitly set in the request
+    if (!validatedRequest.authenticationScheme) {
+        validatedRequest.authenticationScheme = AuthenticationScheme.BEARER;
+        logger.verbose(
+            'Authentication Scheme wasn\'t explicitly set in request, defaulting to "Bearer" request'
+        );
+    } else {
+        if (
+            validatedRequest.authenticationScheme === AuthenticationScheme.SSH
+        ) {
+            if (!request.sshJwk) {
+                throw createClientConfigurationError(
+                    ClientConfigurationErrorCodes.missingSshJwk
+                );
+            }
+            if (!request.sshKid) {
+                throw createClientConfigurationError(
+                    ClientConfigurationErrorCodes.missingSshKid
+                );
+            }
+        }
+        logger.verbose(
+            `Authentication Scheme set to "${validatedRequest.authenticationScheme}" as configured in Auth request`
+        );
+    }
+
+    // Set requested claims hash if claims-based caching is enabled and claims were requested
+    if (
+        config.cache.claimsBasedCachingEnabled &&
+        request.claims &&
+        // Checks for empty stringified object "{}" which doesn't qualify as requested claims
+        !StringUtils.isEmptyObj(request.claims)
+    ) {
+        validatedRequest.requestedClaimsHash = await hashString(request.claims);
+    }
+
+    return validatedRequest;
+}
+
+export async function initializeSilentRequest(
+    request: SilentRequest & { correlationId: string },
+    account: AccountInfo,
+    config: BrowserConfiguration,
+    performanceClient: IPerformanceClient,
+    logger: Logger
+): Promise<CommonSilentFlowRequest> {
+    performanceClient.addQueueMeasurement(
+        PerformanceEvents.InitializeSilentRequest,
+        request.correlationId
+    );
+
+    const baseRequest = await invokeAsync(
+        initializeBaseRequest,
+        PerformanceEvents.InitializeBaseRequest,
+        logger,
+        performanceClient,
+        request.correlationId
+    )(request, config, performanceClient, logger);
+    return {
+        ...request,
+        ...baseRequest,
+        account: account,
+        forceRefresh: request.forceRefresh || false,
+    };
+}

package/src/telemetry/BrowserPerformanceClient.ts

@@ -20,6 +20,7 @@ import {
     BROWSER_PERF_ENABLED_KEY,
     BrowserCacheLocation,
 } from "../utils/BrowserConstants";
+import * as BrowserCrypto from "../crypto/BrowserCrypto";
 
 /**
  * Returns browser performance measurement module if session flag is enabled. Returns undefined otherwise.
@@ -68,7 +69,11 @@ export class BrowserPerformanceClient
     extends PerformanceClient
     implements IPerformanceClient
 {
-    constructor(configuration: Configuration, intFields?: Set<string>) {
+    constructor(
+        configuration: Configuration,
+        intFields?: Set<string>,
+        abbreviations?: Map<string, string>
+    ) {
         super(
             configuration.auth.clientId,
             configuration.auth.authority || `${Constants.DEFAULT_AUTHORITY}`,
@@ -83,12 +88,13 @@ export class BrowserPerformanceClient
                 appName: "",
                 appVersion: "",
             },
-            intFields
+            intFields,
+            abbreviations
         );
     }
 
     generateId(): string {
-        return window.crypto.randomUUID();
+        return BrowserCrypto.createNewGuid();
     }
 
     private getPageVisibility(): string | null {
@@ -158,14 +164,18 @@ export class BrowserPerformanceClient
         return {
             ...inProgressEvent,
             end: (
-                event?: Partial<PerformanceEvent>
+                event?: Partial<PerformanceEvent>,
+                error?: unknown
             ): PerformanceEvent | null => {
-                const res = inProgressEvent.end({
-                    ...event,
-                    startPageVisibility,
-                    endPageVisibility: this.getPageVisibility(),
-                    durationMs: getPerfDurationMs(startTime),
-                });
+                const res = inProgressEvent.end(
+                    {
+                        ...event,
+                        startPageVisibility,
+                        endPageVisibility: this.getPageVisibility(),
+                        durationMs: getPerfDurationMs(startTime),
+                    },
+                    error
+                );
                 void browserMeasurement?.then((measurement) =>
                     measurement.endMeasurement()
                 );

package/src/utils/BrowserUtils.ts

@@ -8,7 +8,13 @@ import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
-import { InteractionType, BrowserConstants } from "./BrowserConstants";
+import { BrowserConstants, BrowserCacheLocation } from "./BrowserConstants";
+import * as BrowserCrypto from "../crypto/BrowserCrypto";
+import {
+    BrowserConfigurationAuthErrorCodes,
+    createBrowserConfigurationAuthError,
+} from "../error/BrowserConfigurationAuthError";
+import { BrowserConfiguration } from "../config/Configuration";
 
 /**
  * Clears hash from window url.
@@ -92,16 +98,8 @@ export function blockReloadInHiddenIframes(): void {
  * @param interactionType Interaction type for the request
  * @param allowRedirectInIframe Config value to allow redirects when app is inside an iframe
  */
-export function blockRedirectInIframe(
-    interactionType: InteractionType,
-    allowRedirectInIframe: boolean
-): void {
-    const isIframedApp = isInIframe();
-    if (
-        interactionType === InteractionType.Redirect &&
-        isIframedApp &&
-        !allowRedirectInIframe
-    ) {
+export function blockRedirectInIframe(allowRedirectInIframe: boolean): void {
+    if (isInIframe() && !allowRedirectInIframe) {
         // If we are not in top frame, we shouldn't redirect. This is also handled by the service.
         throw createBrowserAuthError(BrowserAuthErrorCodes.redirectInIframe);
     }
@@ -121,10 +119,8 @@ export function blockAcquireTokenInPopups(): void {
  * Throws error if token requests are made in non-browser environment
  * @param isBrowserEnvironment Flag indicating if environment is a browser.
  */
-export function blockNonBrowserEnvironment(
-    isBrowserEnvironment: boolean
-): void {
-    if (!isBrowserEnvironment) {
+export function blockNonBrowserEnvironment(): void {
+    if (typeof window === "undefined") {
         throw createBrowserAuthError(
             BrowserAuthErrorCodes.nonBrowserEnvironment
         );
@@ -143,6 +139,46 @@ export function blockAPICallsBeforeInitialize(initialized: boolean): void {
     }
 }
 
+/**
+ * Helper to validate app environment before making an auth request
+ * @param initialized
+ */
+export function preflightCheck(initialized: boolean): void {
+    // Block request if not in browser environment
+    blockNonBrowserEnvironment();
+
+    // Block auth requests inside a hidden iframe
+    blockReloadInHiddenIframes();
+
+    // Block redirectUri opened in a popup from calling MSAL APIs
+    blockAcquireTokenInPopups();
+
+    // Block token acquisition before initialize has been called
+    blockAPICallsBeforeInitialize(initialized);
+}
+
+/**
+ * Helper to validate app enviornment before making redirect request
+ * @param initialized
+ * @param config
+ */
+export function redirectPreflightCheck(
+    initialized: boolean,
+    config: BrowserConfiguration
+): void {
+    preflightCheck(initialized);
+    blockRedirectInIframe(config.system.allowRedirectInIframe);
+    // Block redirects if memory storage is enabled but storeAuthStateInCookie is not
+    if (
+        config.cache.cacheLocation === BrowserCacheLocation.MemoryStorage &&
+        !config.cache.storeAuthStateInCookie
+    ) {
+        throw createBrowserConfigurationAuthError(
+            BrowserConfigurationAuthErrorCodes.inMemRedirectUnavailable
+        );
+    }
+}
+
 /**
  * Adds a preconnect link element to the header which begins DNS resolution and SSL connection in anticipation of the /token request
  * @param loginDomain Authority domain, including https protocol e.g. https://login.microsoftonline.com
@@ -162,3 +198,11 @@ export function preconnect(authority: string): void {
         } catch {}
     }, 10000); // 10s Timeout
 }
+
+/**
+ * Wrapper function that creates a UUID v7 from the current timestamp.
+ * @returns {string}
+ */
+export function createGuid(): string {
+    return BrowserCrypto.createNewGuid();
+}

package/dist/cache/CryptoKeyStore.d.ts

@@ -1,19 +0,0 @@
-import { Logger } from "@azure/msal-common";
-import { CachedKeyPair } from "../crypto/CryptoOps";
-import { AsyncMemoryStorage } from "./AsyncMemoryStorage";
-export declare const CryptoKeyStoreNames: {
-    readonly asymmetricKeys: "asymmetricKeys";
-    readonly symmetricKeys: "symmetricKeys";
-};
-export type CryptoKeyStoreNames = (typeof CryptoKeyStoreNames)[keyof typeof CryptoKeyStoreNames];
-/**
- * MSAL CryptoKeyStore DB Version 2
- */
-export declare class CryptoKeyStore {
-    asymmetricKeys: AsyncMemoryStorage<CachedKeyPair>;
-    symmetricKeys: AsyncMemoryStorage<CryptoKey>;
-    logger: Logger;
-    constructor(logger: Logger);
-    clear(): Promise<boolean>;
-}
-//# sourceMappingURL=CryptoKeyStore.d.ts.map

package/dist/cache/CryptoKeyStore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CryptoKeyStore.d.ts","sourceRoot":"","sources":["../../src/cache/CryptoKeyStore.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAC3B,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEnE;;GAEG;AACH,qBAAa,cAAc;IAChB,cAAc,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClD,aAAa,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,MAAM;IAYpB,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;CA0BlC"}

package/dist/cache/CryptoKeyStore.mjs

@@ -1,47 +0,0 @@
-/*! @azure/msal-browser v3.9.0 2024-02-07 */
-'use strict';
-import { AsyncMemoryStorage } from './AsyncMemoryStorage.mjs';
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CryptoKeyStoreNames = {
-    asymmetricKeys: "asymmetricKeys",
-    symmetricKeys: "symmetricKeys",
-};
-/**
- * MSAL CryptoKeyStore DB Version 2
- */
-class CryptoKeyStore {
-    constructor(logger) {
-        this.logger = logger;
-        this.asymmetricKeys = new AsyncMemoryStorage(this.logger, CryptoKeyStoreNames.asymmetricKeys);
-        this.symmetricKeys = new AsyncMemoryStorage(this.logger, CryptoKeyStoreNames.symmetricKeys);
-    }
-    async clear() {
-        // Delete in-memory keystores
-        this.asymmetricKeys.clearInMemory();
-        this.symmetricKeys.clearInMemory();
-        /**
-         * There is only one database, so calling clearPersistent on asymmetric keystore takes care of
-         * every persistent keystore
-         */
-        try {
-            await this.asymmetricKeys.clearPersistent();
-            return true;
-        }
-        catch (e) {
-            if (e instanceof Error) {
-                this.logger.error(`Clearing keystore failed with error: ${e.message}`);
-            }
-            else {
-                this.logger.error("Clearing keystore failed with unknown error");
-            }
-            return false;
-        }
-    }
-}
-
-export { CryptoKeyStore, CryptoKeyStoreNames };
-//# sourceMappingURL=CryptoKeyStore.mjs.map

package/dist/cache/CryptoKeyStore.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"CryptoKeyStore.mjs","sources":["../../src/cache/CryptoKeyStore.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;AAMU,MAAA,mBAAmB,GAAG;AAC/B,IAAA,cAAc,EAAE,gBAAgB;AAChC,IAAA,aAAa,EAAE,eAAe;EACvB;AAIX;;AAEG;MACU,cAAc,CAAA;AAKvB,IAAA,WAAA,CAAY,MAAc,EAAA;AACtB,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACrB,QAAA,IAAI,CAAC,cAAc,GAAG,IAAI,kBAAkB,CACxC,IAAI,CAAC,MAAM,EACX,mBAAmB,CAAC,cAAc,CACrC,CAAC;AACF,QAAA,IAAI,CAAC,aAAa,GAAG,IAAI,kBAAkB,CACvC,IAAI,CAAC,MAAM,EACX,mBAAmB,CAAC,aAAa,CACpC,CAAC;KACL;AAED,IAAA,MAAM,KAAK,GAAA;;AAEP,QAAA,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;AACpC,QAAA,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;AAEnC;;;AAGG;QACH,IAAI;AACA,YAAA,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;AAC5C,YAAA,OAAO,IAAI,CAAC;AACf,SAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,IAAI,CAAC,YAAY,KAAK,EAAE;gBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,CAAwC,qCAAA,EAAA,CAAC,CAAC,OAAO,CAAE,CAAA,CACtD,CAAC;AACL,aAAA;AAAM,iBAAA;AACH,gBAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,6CAA6C,CAChD,CAAC;AACL,aAAA;AAED,YAAA,OAAO,KAAK,CAAC;AAChB,SAAA;KACJ;AACJ;;;;"}

package/dist/cache/IAsyncMemoryStorage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"IAsyncMemoryStorage.d.ts","sourceRoot":"","sources":["../../src/cache/IAsyncMemoryStorage.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa,CAAC,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C;;;OAGG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvC;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7B;;;OAGG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9C"}

package/src/cache/CryptoKeyStore.ts

@@ -1,63 +0,0 @@
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-
-import { Logger } from "@azure/msal-common";
-import { CachedKeyPair } from "../crypto/CryptoOps";
-import { AsyncMemoryStorage } from "./AsyncMemoryStorage";
-
-export const CryptoKeyStoreNames = {
-    asymmetricKeys: "asymmetricKeys",
-    symmetricKeys: "symmetricKeys",
-} as const;
-export type CryptoKeyStoreNames =
-    (typeof CryptoKeyStoreNames)[keyof typeof CryptoKeyStoreNames];
-
-/**
- * MSAL CryptoKeyStore DB Version 2
- */
-export class CryptoKeyStore {
-    public asymmetricKeys: AsyncMemoryStorage<CachedKeyPair>;
-    public symmetricKeys: AsyncMemoryStorage<CryptoKey>;
-    public logger: Logger;
-
-    constructor(logger: Logger) {
-        this.logger = logger;
-        this.asymmetricKeys = new AsyncMemoryStorage<CachedKeyPair>(
-            this.logger,
-            CryptoKeyStoreNames.asymmetricKeys
-        );
-        this.symmetricKeys = new AsyncMemoryStorage<CryptoKey>(
-            this.logger,
-            CryptoKeyStoreNames.symmetricKeys
-        );
-    }
-
-    async clear(): Promise<boolean> {
-        // Delete in-memory keystores
-        this.asymmetricKeys.clearInMemory();
-        this.symmetricKeys.clearInMemory();
-
-        /**
-         * There is only one database, so calling clearPersistent on asymmetric keystore takes care of
-         * every persistent keystore
-         */
-        try {
-            await this.asymmetricKeys.clearPersistent();
-            return true;
-        } catch (e) {
-            if (e instanceof Error) {
-                this.logger.error(
-                    `Clearing keystore failed with error: ${e.message}`
-                );
-            } else {
-                this.logger.error(
-                    "Clearing keystore failed with unknown error"
-                );
-            }
-
-            return false;
-        }
-    }
-}