@azure/msal-browser 4.0.0-alpha.0 → 4.0.1

package/src/broker/nativeBroker/NativeMessageHandler.ts

@@ -372,16 +372,16 @@ export class NativeMessageHandler {
      * @param nativeExtensionProvider
      * @param authenticationScheme
      */
-    static isNativeAvailable(
+    static isPlatformBrokerAvailable(
         config: BrowserConfiguration,
         logger: Logger,
         nativeExtensionProvider?: NativeMessageHandler,
         authenticationScheme?: AuthenticationScheme
     ): boolean {
-        logger.trace("isNativeAvailable called");
-        if (!config.system.allowNativeBroker) {
+        logger.trace("isPlatformBrokerAvailable called");
+        if (!config.system.allowPlatformBroker) {
             logger.trace(
-                "isNativeAvailable: allowNativeBroker is not enabled, returning false"
+                "isPlatformBrokerAvailable: allowPlatformBroker is not enabled, returning false"
             );
             // Developer disabled WAM
             return false;
@@ -389,7 +389,7 @@ export class NativeMessageHandler {
 
         if (!nativeExtensionProvider) {
             logger.trace(
-                "isNativeAvailable: WAM extension provider is not initialized, returning false"
+                "isPlatformBrokerAvailable: Platform extension provider is not initialized, returning false"
             );
             // Extension is not available
             return false;
@@ -400,12 +400,12 @@ export class NativeMessageHandler {
                 case AuthenticationScheme.BEARER:
                 case AuthenticationScheme.POP:
                     logger.trace(
-                        "isNativeAvailable: authenticationScheme is supported, returning true"
+                        "isPlatformBrokerAvailable: authenticationScheme is supported, returning true"
                     );
                     return true;
                 default:
                     logger.trace(
-                        "isNativeAvailable: authenticationScheme is not supported, returning false"
+                        "isPlatformBrokerAvailable: authenticationScheme is not supported, returning false"
                     );
                     return false;
             }

package/src/broker/nativeBroker/NativeResponse.ts

@@ -13,7 +13,7 @@ export type NativeAccountInfo = {
 };
 
 /**
- * Token response returned by Native Platform e.g. WAM
+ * Token response returned by Native Platform
  */
 export type NativeResponse = {
     access_token: string;

package/src/cache/BrowserCacheManager.ts

@@ -37,6 +37,7 @@ import {
     CacheHelpers,
     StoreInCache,
     CacheError,
+    invokeAsync,
 } from "@azure/msal-common/browser";
 import { CacheOptions } from "../config/Configuration.js";
 import {
@@ -85,15 +86,15 @@ export class BrowserCacheManager extends CacheManager {
     // Logger instance
     protected logger: Logger;
     // Telemetry perf client
-    protected performanceClient?: IPerformanceClient;
+    protected performanceClient: IPerformanceClient;
 
     constructor(
         clientId: string,
         cacheConfig: Required<CacheOptions>,
         cryptoImpl: ICrypto,
         logger: Logger,
-        staticAuthorityOptions?: StaticAuthorityOptions,
-        performanceClient?: IPerformanceClient
+        performanceClient: IPerformanceClient,
+        staticAuthorityOptions?: StaticAuthorityOptions
     ) {
         super(clientId, cryptoImpl, logger, staticAuthorityOptions);
         this.cacheConfig = cacheConfig;
@@ -110,8 +111,8 @@ export class BrowserCacheManager extends CacheManager {
         this.performanceClient = performanceClient;
     }
 
-    async initialize(): Promise<void> {
-        await this.browserStorage.initialize();
+    async initialize(correlationId: string): Promise<void> {
+        await this.browserStorage.initialize(correlationId);
     }
 
     /**
@@ -124,7 +125,11 @@ export class BrowserCacheManager extends CacheManager {
         try {
             switch (cacheLocation) {
                 case BrowserCacheLocation.LocalStorage:
-                    return new LocalStorage(this.clientId);
+                    return new LocalStorage(
+                        this.clientId,
+                        this.logger,
+                        this.performanceClient
+                    );
                 case BrowserCacheLocation.SessionStorage:
                     return new SessionStorage();
                 case BrowserCacheLocation.MemoryStorage:
@@ -189,10 +194,18 @@ export class BrowserCacheManager extends CacheManager {
      * set account entity in the platform cache
      * @param account
      */
-    async setAccount(account: AccountEntity): Promise<void> {
+    async setAccount(
+        account: AccountEntity,
+        correlationId: string
+    ): Promise<void> {
         this.logger.trace("BrowserCacheManager.setAccount called");
         const key = account.generateAccountKey();
-        await this.browserStorage.setUserData(key, JSON.stringify(account));
+        await invokeAsync(
+            this.browserStorage.setUserData.bind(this.browserStorage),
+            PerformanceEvents.SetUserData,
+            this.logger,
+            this.performanceClient
+        )(key, JSON.stringify(account), correlationId);
         this.addAccountKeyToMap(key);
     }
 
@@ -457,14 +470,19 @@ export class BrowserCacheManager extends CacheManager {
      * set IdToken credential to the platform cache
      * @param idToken
      */
-    async setIdTokenCredential(idToken: IdTokenEntity): Promise<void> {
+    async setIdTokenCredential(
+        idToken: IdTokenEntity,
+        correlationId: string
+    ): Promise<void> {
         this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
         const idTokenKey = CacheHelpers.generateCredentialKey(idToken);
 
-        await this.browserStorage.setUserData(
-            idTokenKey,
-            JSON.stringify(idToken)
-        );
+        await invokeAsync(
+            this.browserStorage.setUserData.bind(this.browserStorage),
+            PerformanceEvents.SetUserData,
+            this.logger,
+            this.performanceClient
+        )(idTokenKey, JSON.stringify(idToken), correlationId);
 
         this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
     }
@@ -505,16 +523,19 @@ export class BrowserCacheManager extends CacheManager {
      * @param accessToken
      */
     async setAccessTokenCredential(
-        accessToken: AccessTokenEntity
+        accessToken: AccessTokenEntity,
+        correlationId: string
     ): Promise<void> {
         this.logger.trace(
             "BrowserCacheManager.setAccessTokenCredential called"
         );
         const accessTokenKey = CacheHelpers.generateCredentialKey(accessToken);
-        await this.browserStorage.setUserData(
-            accessTokenKey,
-            JSON.stringify(accessToken)
-        );
+        await invokeAsync(
+            this.browserStorage.setUserData.bind(this.browserStorage),
+            PerformanceEvents.SetUserData,
+            this.logger,
+            this.performanceClient
+        )(accessTokenKey, JSON.stringify(accessToken), correlationId);
 
         this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
     }
@@ -557,17 +578,20 @@ export class BrowserCacheManager extends CacheManager {
      * @param refreshToken
      */
     async setRefreshTokenCredential(
-        refreshToken: RefreshTokenEntity
+        refreshToken: RefreshTokenEntity,
+        correlationId: string
     ): Promise<void> {
         this.logger.trace(
             "BrowserCacheManager.setRefreshTokenCredential called"
         );
         const refreshTokenKey =
             CacheHelpers.generateCredentialKey(refreshToken);
-        await this.browserStorage.setUserData(
-            refreshTokenKey,
-            JSON.stringify(refreshToken)
-        );
+        await invokeAsync(
+            this.browserStorage.setUserData.bind(this.browserStorage),
+            PerformanceEvents.SetUserData,
+            this.logger,
+            this.performanceClient
+        )(refreshTokenKey, JSON.stringify(refreshToken), correlationId);
 
         this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
     }
@@ -1404,7 +1428,7 @@ export class BrowserCacheManager extends CacheManager {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
         };
-        return this.saveCacheRecord(cacheRecord);
+        return this.saveCacheRecord(cacheRecord, result.correlationId);
     }
 
     /**
@@ -1415,14 +1439,14 @@ export class BrowserCacheManager extends CacheManager {
      */
     async saveCacheRecord(
         cacheRecord: CacheRecord,
-        storeInCache?: StoreInCache,
-        correlationId?: string
+        correlationId: string,
+        storeInCache?: StoreInCache
     ): Promise<void> {
         try {
             await super.saveCacheRecord(
                 cacheRecord,
-                storeInCache,
-                correlationId
+                correlationId,
+                storeInCache
             );
         } catch (e) {
             if (
@@ -1451,7 +1475,8 @@ export class BrowserCacheManager extends CacheManager {
 
 export const DEFAULT_BROWSER_CACHE_MANAGER = (
     clientId: string,
-    logger: Logger
+    logger: Logger,
+    performanceClient: IPerformanceClient
 ): BrowserCacheManager => {
     const cacheOptions: Required<CacheOptions> = {
         cacheLocation: BrowserCacheLocation.MemoryStorage,
@@ -1465,6 +1490,7 @@ export const DEFAULT_BROWSER_CACHE_MANAGER = (
         clientId,
         cacheOptions,
         DEFAULT_CRYPTO_IMPLEMENTATION,
-        logger
+        logger,
+        performanceClient
     );
 };

package/src/cache/IWindowStorage.ts

@@ -7,7 +7,7 @@ export interface IWindowStorage<T> {
     /**
      * Async initializer
      */
-    initialize(): Promise<void>;
+    initialize(correlationId: string): Promise<void>;
     /**
      * Get the item from the window storage object matching the given key.
      * @param key
@@ -29,7 +29,7 @@ export interface IWindowStorage<T> {
     /**
      * Setter for sensitive data that may contain PII.
      */
-    setUserData(key: string, value: T): Promise<void>;
+    setUserData(key: string, value: T, correlationId: string): Promise<void>;
 
     /**
      * Removes the item in the window storage object matching the given key.

package/src/cache/LocalStorage.ts

@@ -3,7 +3,15 @@
  * Licensed under the MIT License.
  */
 
-import { Constants, TokenKeys } from "@azure/msal-common/browser";
+import {
+    Constants,
+    TokenKeys,
+    IPerformanceClient,
+    invokeAsync,
+    PerformanceEvents,
+    Logger,
+    invoke,
+} from "@azure/msal-common/browser";
 import {
     createNewGuid,
     decrypt,
@@ -25,6 +33,7 @@ import { CookieStorage } from "./CookieStorage.js";
 import { IWindowStorage } from "./IWindowStorage.js";
 import { MemoryStorage } from "./MemoryStorage.js";
 import { getAccountKeys, getTokenKeys } from "./CacheHelpers.js";
+import { StaticCacheKeys } from "../utils/BrowserConstants.js";
 
 const ENCRYPTION_KEY = "msal.cache.encryption";
 
@@ -43,9 +52,15 @@ export class LocalStorage implements IWindowStorage<string> {
     private clientId: string;
     private initialized: boolean;
     private memoryStorage: MemoryStorage<string>;
+    private performanceClient: IPerformanceClient;
+    private logger: Logger;
     private encryptionCookie?: EncryptionCookie;
 
-    constructor(clientId: string) {
+    constructor(
+        clientId: string,
+        logger: Logger,
+        performanceClient: IPerformanceClient
+    ) {
         if (!window.localStorage) {
             throw createBrowserConfigurationAuthError(
                 BrowserConfigurationAuthErrorCodes.storageNotSupported
@@ -54,9 +69,11 @@ export class LocalStorage implements IWindowStorage<string> {
         this.memoryStorage = new MemoryStorage<string>();
         this.initialized = false;
         this.clientId = clientId;
+        this.logger = logger;
+        this.performanceClient = performanceClient;
     }
 
-    async initialize(): Promise<void> {
+    async initialize(correlationId: string): Promise<void> {
         this.initialized = true;
 
         const cookies = new CookieStorage();
@@ -65,26 +82,61 @@ export class LocalStorage implements IWindowStorage<string> {
         if (cookieString) {
             try {
                 parsedCookie = JSON.parse(cookieString);
-            } catch (e) {
-                // TODO: Log telemetry but don't throw
-            }
+            } catch (e) {}
         }
         if (parsedCookie.key && parsedCookie.id) {
             // Encryption key already exists, import
+            const baseKey = invoke(
+                base64DecToArr,
+                PerformanceEvents.Base64Decode,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(parsedCookie.key);
             this.encryptionCookie = {
                 id: parsedCookie.id,
-                key: await generateHKDF(base64DecToArr(parsedCookie.key)),
+                key: await invokeAsync(
+                    generateHKDF,
+                    PerformanceEvents.GenerateHKDF,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(baseKey),
             };
-            await this.importExistingCache();
+            await invokeAsync(
+                this.importExistingCache.bind(this),
+                PerformanceEvents.ImportExistingCache,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(correlationId);
         } else {
             // Encryption key doesn't exist or is invalid, generate a new one and clear existing cache
             this.clear();
             const id = createNewGuid();
-            const baseKey = await generateBaseKey();
-            const keyStr = urlEncodeArr(new Uint8Array(baseKey));
+            const baseKey = await invokeAsync(
+                generateBaseKey,
+                PerformanceEvents.GenerateBaseKey,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )();
+            const keyStr = invoke(
+                urlEncodeArr,
+                PerformanceEvents.UrlEncodeArr,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(new Uint8Array(baseKey));
             this.encryptionCookie = {
                 id: id,
-                key: await generateHKDF(baseKey),
+                key: await invokeAsync(
+                    generateHKDF,
+                    PerformanceEvents.GenerateHKDF,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(baseKey),
             };
 
             const cookieData = {
@@ -112,18 +164,24 @@ export class LocalStorage implements IWindowStorage<string> {
         window.localStorage.setItem(key, value);
     }
 
-    async setUserData(key: string, value: string): Promise<void> {
+    async setUserData(
+        key: string,
+        value: string,
+        correlationId: string
+    ): Promise<void> {
         if (!this.initialized || !this.encryptionCookie) {
             throw createBrowserAuthError(
                 BrowserAuthErrorCodes.uninitializedPublicClientApplication
             );
         }
 
-        const { data, nonce } = await encrypt(
-            this.encryptionCookie.key,
-            value,
-            this.getContext(key)
-        );
+        const { data, nonce } = await invokeAsync(
+            encrypt,
+            PerformanceEvents.Encrypt,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(this.encryptionCookie.key, value, this.getContext(key));
         const encryptedData: EncryptedData = {
             id: this.encryptionCookie.id,
             nonce: nonce,
@@ -176,20 +234,34 @@ export class LocalStorage implements IWindowStorage<string> {
      * Helper to decrypt all known MSAL keys in localStorage and save them to inMemory storage
      * @returns
      */
-    private async importExistingCache(): Promise<void> {
+    private async importExistingCache(correlationId: string): Promise<void> {
         if (!this.encryptionCookie) {
             return;
         }
 
-        const accountKeys = getAccountKeys(this);
-        await this.importArray(accountKeys);
+        let accountKeys = getAccountKeys(this);
+        accountKeys = await this.importArray(accountKeys, correlationId);
+        // Write valid account keys back to map
+        this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
 
         const tokenKeys: TokenKeys = getTokenKeys(this.clientId, this);
-        await Promise.all([
-            this.importArray(tokenKeys.idToken),
-            this.importArray(tokenKeys.accessToken),
-            this.importArray(tokenKeys.refreshToken),
-        ]);
+        tokenKeys.idToken = await this.importArray(
+            tokenKeys.idToken,
+            correlationId
+        );
+        tokenKeys.accessToken = await this.importArray(
+            tokenKeys.accessToken,
+            correlationId
+        );
+        tokenKeys.refreshToken = await this.importArray(
+            tokenKeys.refreshToken,
+            correlationId
+        );
+        // Write valid token keys back to map
+        this.setItem(
+            `${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`,
+            JSON.stringify(tokenKeys)
+        );
     }
 
     /**
@@ -198,7 +270,8 @@ export class LocalStorage implements IWindowStorage<string> {
      * @returns
      */
     private async getItemFromEncryptedCache(
-        key: string
+        key: string,
+        correlationId: string
     ): Promise<string | null> {
         if (!this.encryptionCookie) {
             return null;
@@ -212,21 +285,36 @@ export class LocalStorage implements IWindowStorage<string> {
         let encObj: EncryptedData;
         try {
             encObj = JSON.parse(rawCache);
-            if (!encObj.id || !encObj.nonce || !encObj.data) {
-                throw "Not encrypted!"; // TODO: Typed error
-            }
-
-            if (encObj.id !== this.encryptionCookie.id) {
-                throw "Old item!"; // TODO: Typed error
-            }
         } catch (e) {
             // Not a valid encrypted object, remove
-            this.removeItem(key);
-            // TODO: Log to telemetry
             return null;
         }
 
-        return decrypt(
+        if (!encObj.id || !encObj.nonce || !encObj.data) {
+            // Data is not encrypted, likely from old version of MSAL. It must be removed because we don't know how old it is.
+            this.performanceClient.incrementFields(
+                { unencryptedCacheCount: 1 },
+                correlationId
+            );
+            return null;
+        }
+
+        if (encObj.id !== this.encryptionCookie.id) {
+            // Data was encrypted with a different key. It must be removed because it is from a previous session.
+            this.performanceClient.incrementFields(
+                { encryptedCacheExpiredCount: 1 },
+                correlationId
+            );
+            return null;
+        }
+
+        return invokeAsync(
+            decrypt,
+            PerformanceEvents.Decrypt,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
             this.encryptionCookie.key,
             encObj.nonce,
             this.getContext(key),
@@ -237,21 +325,32 @@ export class LocalStorage implements IWindowStorage<string> {
     /**
      * Helper to decrypt and save an array of cache keys
      * @param arr
+     * @returns Array of keys successfully imported
      */
-    private async importArray(arr: Array<string>): Promise<void> {
+    private async importArray(
+        arr: Array<string>,
+        correlationId: string
+    ): Promise<Array<string>> {
+        const importedArr: Array<string> = [];
         const promiseArr: Array<Promise<void>> = [];
         arr.forEach((key) => {
-            const promise = this.getItemFromEncryptedCache(key).then(
-                (value) => {
-                    if (value) {
-                        this.memoryStorage.setItem(key, value);
-                    }
+            const promise = this.getItemFromEncryptedCache(
+                key,
+                correlationId
+            ).then((value) => {
+                if (value) {
+                    this.memoryStorage.setItem(key, value);
+                    importedArr.push(key);
+                } else {
+                    // If value is empty, unencrypted or expired remove
+                    this.removeItem(key);
                 }
-            );
+            });
             promiseArr.push(promise);
         });
 
         await Promise.all(promiseArr);
+        return importedArr;
     }
 
     /**

package/src/cache/TokenCache.ts

@@ -86,6 +86,9 @@ export class TokenCache implements ITokenCache {
             );
         }
 
+        const correlationId =
+            request.correlationId || BrowserCrypto.createNewGuid();
+
         const idTokenClaims = response.id_token
             ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
             : undefined;
@@ -115,6 +118,7 @@ export class TokenCache implements ITokenCache {
         const cacheRecordAccount: AccountEntity = await this.loadAccount(
             request,
             options.clientInfo || response.client_info || "",
+            correlationId,
             idTokenClaims,
             authority
         );
@@ -123,7 +127,8 @@ export class TokenCache implements ITokenCache {
             response,
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
-            cacheRecordAccount.realm
+            cacheRecordAccount.realm,
+            correlationId
         );
 
         const accessToken = await this.loadAccessToken(
@@ -132,13 +137,15 @@ export class TokenCache implements ITokenCache {
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
             cacheRecordAccount.realm,
-            options
+            options,
+            correlationId
         );
 
         const refreshToken = await this.loadRefreshToken(
             response,
             cacheRecordAccount.homeAccountId,
-            cacheRecordAccount.environment
+            cacheRecordAccount.environment,
+            correlationId
         );
 
         return this.generateAuthenticationResult(
@@ -166,6 +173,7 @@ export class TokenCache implements ITokenCache {
     private async loadAccount(
         request: SilentRequest,
         clientInfo: string,
+        correlationId: string,
         idTokenClaims?: TokenClaims,
         authority?: Authority
     ): Promise<AccountEntity> {
@@ -175,7 +183,7 @@ export class TokenCache implements ITokenCache {
             const accountEntity = AccountEntity.createFromAccountInfo(
                 request.account
             );
-            await this.storage.setAccount(accountEntity);
+            await this.storage.setAccount(accountEntity, correlationId);
             return accountEntity;
         } else if (!authority || (!clientInfo && !idTokenClaims)) {
             this.logger.error(
@@ -210,7 +218,7 @@ export class TokenCache implements ITokenCache {
             this.logger
         );
 
-        await this.storage.setAccount(cachedAccount);
+        await this.storage.setAccount(cachedAccount, correlationId);
         return cachedAccount;
     }
 
@@ -226,7 +234,8 @@ export class TokenCache implements ITokenCache {
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string,
-        tenantId: string
+        tenantId: string,
+        correlationId: string
     ): Promise<IdTokenEntity | null> {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
@@ -242,7 +251,7 @@ export class TokenCache implements ITokenCache {
             tenantId
         );
 
-        await this.storage.setIdTokenCredential(idTokenEntity);
+        await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
         return idTokenEntity;
     }
 
@@ -261,7 +270,8 @@ export class TokenCache implements ITokenCache {
         homeAccountId: string,
         environment: string,
         tenantId: string,
-        options: LoadTokenOptions
+        options: LoadTokenOptions,
+        correlationId: string
     ): Promise<AccessTokenEntity | null> {
         if (!response.access_token) {
             this.logger.verbose(
@@ -309,7 +319,10 @@ export class TokenCache implements ITokenCache {
             base64Decode
         );
 
-        await this.storage.setAccessTokenCredential(accessTokenEntity);
+        await this.storage.setAccessTokenCredential(
+            accessTokenEntity,
+            correlationId
+        );
         return accessTokenEntity;
     }
 
@@ -324,7 +337,8 @@ export class TokenCache implements ITokenCache {
     private async loadRefreshToken(
         response: ExternalTokenResponse,
         homeAccountId: string,
-        environment: string
+        environment: string,
+        correlationId: string
     ): Promise<RefreshTokenEntity | null> {
         if (!response.refresh_token) {
             this.logger.verbose(
@@ -344,7 +358,10 @@ export class TokenCache implements ITokenCache {
             response.refresh_token_expires_in
         );
 
-        await this.storage.setRefreshTokenCredential(refreshTokenEntity);
+        await this.storage.setRefreshTokenCredential(
+            refreshTokenEntity,
+            correlationId
+        );
         return refreshTokenEntity;
     }