@azure/msal-browser 4.0.0-alpha.0 → 4.0.2

package/src/cache/TokenCache.ts

@@ -86,6 +86,9 @@ export class TokenCache implements ITokenCache {
             );
         }
 
+        const correlationId =
+            request.correlationId || BrowserCrypto.createNewGuid();
+
         const idTokenClaims = response.id_token
             ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
             : undefined;
@@ -115,6 +118,7 @@ export class TokenCache implements ITokenCache {
         const cacheRecordAccount: AccountEntity = await this.loadAccount(
             request,
             options.clientInfo || response.client_info || "",
+            correlationId,
             idTokenClaims,
             authority
         );
@@ -123,7 +127,8 @@ export class TokenCache implements ITokenCache {
             response,
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
-            cacheRecordAccount.realm
+            cacheRecordAccount.realm,
+            correlationId
         );
 
         const accessToken = await this.loadAccessToken(
@@ -132,13 +137,15 @@ export class TokenCache implements ITokenCache {
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
             cacheRecordAccount.realm,
-            options
+            options,
+            correlationId
         );
 
         const refreshToken = await this.loadRefreshToken(
             response,
             cacheRecordAccount.homeAccountId,
-            cacheRecordAccount.environment
+            cacheRecordAccount.environment,
+            correlationId
         );
 
         return this.generateAuthenticationResult(
@@ -166,6 +173,7 @@ export class TokenCache implements ITokenCache {
     private async loadAccount(
         request: SilentRequest,
         clientInfo: string,
+        correlationId: string,
         idTokenClaims?: TokenClaims,
         authority?: Authority
     ): Promise<AccountEntity> {
@@ -175,7 +183,7 @@ export class TokenCache implements ITokenCache {
             const accountEntity = AccountEntity.createFromAccountInfo(
                 request.account
             );
-            await this.storage.setAccount(accountEntity);
+            await this.storage.setAccount(accountEntity, correlationId);
             return accountEntity;
         } else if (!authority || (!clientInfo && !idTokenClaims)) {
             this.logger.error(
@@ -210,7 +218,7 @@ export class TokenCache implements ITokenCache {
             this.logger
         );
 
-        await this.storage.setAccount(cachedAccount);
+        await this.storage.setAccount(cachedAccount, correlationId);
         return cachedAccount;
     }
 
@@ -226,7 +234,8 @@ export class TokenCache implements ITokenCache {
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string,
-        tenantId: string
+        tenantId: string,
+        correlationId: string
     ): Promise<IdTokenEntity | null> {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
@@ -242,7 +251,7 @@ export class TokenCache implements ITokenCache {
             tenantId
         );
 
-        await this.storage.setIdTokenCredential(idTokenEntity);
+        await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
         return idTokenEntity;
     }
 
@@ -261,7 +270,8 @@ export class TokenCache implements ITokenCache {
         homeAccountId: string,
         environment: string,
         tenantId: string,
-        options: LoadTokenOptions
+        options: LoadTokenOptions,
+        correlationId: string
     ): Promise<AccessTokenEntity | null> {
         if (!response.access_token) {
             this.logger.verbose(
@@ -309,7 +319,10 @@ export class TokenCache implements ITokenCache {
             base64Decode
         );
 
-        await this.storage.setAccessTokenCredential(accessTokenEntity);
+        await this.storage.setAccessTokenCredential(
+            accessTokenEntity,
+            correlationId
+        );
         return accessTokenEntity;
     }
 
@@ -324,7 +337,8 @@ export class TokenCache implements ITokenCache {
     private async loadRefreshToken(
         response: ExternalTokenResponse,
         homeAccountId: string,
-        environment: string
+        environment: string,
+        correlationId: string
     ): Promise<RefreshTokenEntity | null> {
         if (!response.refresh_token) {
             this.logger.verbose(
@@ -344,7 +358,10 @@ export class TokenCache implements ITokenCache {
             response.refresh_token_expires_in
         );
 
-        await this.storage.setRefreshTokenCredential(refreshTokenEntity);
+        await this.storage.setRefreshTokenCredential(
+            refreshTokenEntity,
+            correlationId
+        );
         return refreshTokenEntity;
     }
 

package/src/config/Configuration.ts

@@ -192,9 +192,9 @@ export type BrowserSystemOptions = SystemOptions & {
      */
     allowRedirectInIframe?: boolean;
     /**
-     * Flag to enable native broker support (e.g. acquiring tokens from WAM on Windows)
+     * Flag to enable native broker support (e.g. acquiring tokens from WAM on Windows, MacBroker on Mac)
      */
-    allowNativeBroker?: boolean;
+    allowPlatformBroker?: boolean;
     /**
      * Sets the timeout for waiting for the native broker handshake to resolve
      */
@@ -340,7 +340,7 @@ export function buildConfiguration(
         redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS,
         asyncPopups: false,
         allowRedirectInIframe: false,
-        allowNativeBroker: false,
+        allowPlatformBroker: false,
         nativeBrokerHandshakeTimeout:
             userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
@@ -376,14 +376,14 @@ export function buildConfiguration(
         );
     }
 
-    // Throw an error if user has set allowNativeBroker to true without being in AAD protocol mode
+    // Throw an error if user has set allowPlatformBroker to true without being in AAD protocol mode
     if (
         userInputAuth?.protocolMode &&
         userInputAuth.protocolMode !== ProtocolMode.AAD &&
-        providedSystemOptions?.allowNativeBroker
+        providedSystemOptions?.allowPlatformBroker
     ) {
         throw createClientConfigurationError(
-            ClientConfigurationErrorCodes.cannotAllowNativeBroker
+            ClientConfigurationErrorCodes.cannotAllowPlatformBroker
         );
     }
 

package/src/controllers/NestedAppAuthController.ts

@@ -53,6 +53,9 @@ import {
 } from "../cache/BrowserCacheManager.js";
 import { ClearCacheRequest } from "../request/ClearCacheRequest.js";
 import * as AccountManager from "../cache/AccountManager.js";
+import { AccountContext } from "../naa/BridgeAccountContext.js";
+import { InitializeApplicationRequest } from "../request/InitializeApplicationRequest.js";
+import { createNewGuid } from "../crypto/BrowserCrypto.js";
 
 export class NestedAppAuthController implements IController {
     // OperatingContext
@@ -82,6 +85,9 @@ export class NestedAppAuthController implements IController {
     // NestedAppAuthAdapter
     protected readonly nestedAppAuthAdapter: NestedAppAuthAdapter;
 
+    // currentAccount for NAA apps
+    protected currentAccountContext: AccountContext | null;
+
     constructor(operatingContext: NestedAppOperatingContext) {
         this.operatingContext = operatingContext;
         const proxy = this.operatingContext.getBridgeProxy();
@@ -102,7 +108,7 @@ export class NestedAppAuthController implements IController {
 
         // Initialize the crypto class.
         this.browserCrypto = operatingContext.isBrowserEnvironment()
-            ? new CryptoOps(this.logger, this.performanceClient)
+            ? new CryptoOps(this.logger, this.performanceClient, true)
             : DEFAULT_CRYPTO_IMPLEMENTATION;
 
         // Initialize the browser storage class.
@@ -112,11 +118,13 @@ export class NestedAppAuthController implements IController {
                   this.config.cache,
                   this.browserCrypto,
                   this.logger,
+                  this.performanceClient,
                   buildStaticAuthorityOptions(this.config.auth)
               )
             : DEFAULT_BROWSER_CACHE_MANAGER(
                   this.config.auth.clientId,
-                  this.logger
+                  this.logger,
+                  this.performanceClient
               );
 
         this.eventHandler = new EventHandler(this.logger);
@@ -130,15 +138,7 @@ export class NestedAppAuthController implements IController {
 
         // Set the active account if available
         const accountContext = this.bridgeProxy.getAccountContext();
-        if (accountContext) {
-            const cachedAccount = AccountManager.getAccount(
-                accountContext,
-                this.logger,
-                this.browserStorage
-            );
-
-            AccountManager.setActiveAccount(cachedAccount, this.browserStorage);
-        }
+        this.currentAccountContext = accountContext ? accountContext : null;
     }
 
     /**
@@ -157,8 +157,9 @@ export class NestedAppAuthController implements IController {
      * Specific implementation of initialize function for NestedAppAuthController
      * @returns
      */
-    async initialize(): Promise<void> {
-        await this.browserStorage.initialize();
+    async initialize(request?: InitializeApplicationRequest): Promise<void> {
+        const initCorrelationId = request?.correlationId || createNewGuid();
+        await this.browserStorage.initialize(initCorrelationId);
         return Promise.resolve();
     }
 
@@ -224,7 +225,13 @@ export class NestedAppAuthController implements IController {
             // cache the tokens in the response
             await this.hydrateCache(result, request);
 
-            this.browserStorage.setActiveAccount(result.account);
+            // cache the account context in memory after successful token fetch
+            this.currentAccountContext = {
+                homeAccountId: result.account.homeAccountId,
+                environment: result.account.environment,
+                tenantId: result.account.tenantId,
+            };
+
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_SUCCESS,
                 InteractionType.Popup,
@@ -318,7 +325,13 @@ export class NestedAppAuthController implements IController {
             // cache the tokens in the response
             await this.hydrateCache(result, request);
 
-            this.browserStorage.setActiveAccount(result.account);
+            // cache the account context in memory after successful token fetch
+            this.currentAccountContext = {
+                homeAccountId: result.account.homeAccountId,
+                environment: result.account.environment,
+                tenantId: result.account.tenantId,
+            };
+
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_SUCCESS,
                 InteractionType.Silent,
@@ -376,8 +389,20 @@ export class NestedAppAuthController implements IController {
             return null;
         }
 
+        // if the request has forceRefresh, we cannot look up in the cache
+        if (request.forceRefresh) {
+            this.logger.verbose(
+                "forceRefresh is set to true, skipping cache lookup"
+            );
+            return null;
+        }
+
         // respect cache lookup policy
         let result: AuthenticationResult | null = null;
+        if (!request.cacheLookupPolicy) {
+            request.cacheLookupPolicy = CacheLookupPolicy.Default;
+        }
+
         switch (request.cacheLookupPolicy) {
             case CacheLookupPolicy.Default:
             case CacheLookupPolicy.AccessToken:
@@ -428,16 +453,16 @@ export class NestedAppAuthController implements IController {
     private async acquireTokenFromCacheInternal(
         request: SilentRequest
     ): Promise<AuthenticationResult | null> {
-        const accountContext = this.bridgeProxy.getAccountContext();
-        let currentAccount = null;
+        // always prioritize the account context from the bridge
+        const accountContext =
+            this.bridgeProxy.getAccountContext() || this.currentAccountContext;
+        let currentAccount: AccountInfo | null = null;
         if (accountContext) {
-            const hubAccount = AccountManager.getAccount(
+            currentAccount = AccountManager.getAccount(
                 accountContext,
                 this.logger,
                 this.browserStorage
             );
-            // always prioritize for hub account context, the reqirement of `request.account` will be removed soon
-            currentAccount = hubAccount || request.account;
         }
 
         // fall back to brokering if no cached account is found
@@ -568,7 +593,7 @@ export class NestedAppAuthController implements IController {
                       | "responseMode"
                       | "codeChallenge"
                       | "codeChallengeMethod"
-                      | "nativeBroker"
+                      | "platformBroker"
                   >
               >
             | PopupRequest,
@@ -761,7 +786,7 @@ export class NestedAppAuthController implements IController {
                 | "responseMode"
                 | "codeChallenge"
                 | "codeChallengeMethod"
-                | "nativeBroker"
+                | "platformBroker"
             >
         >
     ): Promise<AuthenticationResult> {
@@ -842,7 +867,10 @@ export class NestedAppAuthController implements IController {
             result.cloudGraphHostName,
             result.msGraphHost
         );
-        await this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(
+            accountEntity,
+            result.correlationId
+        );
         return this.browserStorage.hydrateCache(result, request);
     }
 }

package/src/controllers/StandardController.ts

@@ -242,12 +242,13 @@ export class StandardController implements IController {
                   this.config.cache,
                   this.browserCrypto,
                   this.logger,
-                  buildStaticAuthorityOptions(this.config.auth),
-                  this.performanceClient
+                  this.performanceClient,
+                  buildStaticAuthorityOptions(this.config.auth)
               )
             : DEFAULT_BROWSER_CACHE_MANAGER(
                   this.config.auth.clientId,
-                  this.logger
+                  this.logger,
+                  this.performanceClient
               );
 
         // initialize in memory storage for native flows
@@ -264,7 +265,6 @@ export class StandardController implements IController {
             nativeCacheOptions,
             this.browserCrypto,
             this.logger,
-            undefined,
             this.performanceClient
         );
 
@@ -331,18 +331,24 @@ export class StandardController implements IController {
             return;
         }
 
-        await this.browserStorage.initialize();
-
         const initCorrelationId =
             request?.correlationId || this.getRequestCorrelationId();
-        const allowNativeBroker = this.config.system.allowNativeBroker;
+        const allowPlatformBroker = this.config.system.allowPlatformBroker;
         const initMeasurement = this.performanceClient.startMeasurement(
             PerformanceEvents.InitializeClientApplication,
             initCorrelationId
         );
         this.eventHandler.emitEvent(EventType.INITIALIZE_START);
 
-        if (allowNativeBroker) {
+        await invokeAsync(
+            this.browserStorage.initialize.bind(this.browserStorage),
+            PerformanceEvents.InitializeCache,
+            this.logger,
+            this.performanceClient,
+            initCorrelationId
+        )(initCorrelationId);
+
+        if (allowPlatformBroker) {
             try {
                 this.nativeExtensionProvider =
                     await NativeMessageHandler.createProvider(
@@ -373,7 +379,10 @@ export class StandardController implements IController {
 
         this.initialized = true;
         this.eventHandler.emitEvent(EventType.INITIALIZE_END);
-        initMeasurement.end({ allowNativeBroker, success: true });
+        initMeasurement.end({
+            allowPlatformBroker: allowPlatformBroker,
+            success: true,
+        });
     }
 
     // #region Redirect Flow
@@ -433,7 +442,7 @@ export class StandardController implements IController {
             this.browserStorage.getCachedNativeRequest();
         const useNative =
             request &&
-            NativeMessageHandler.isNativeAvailable(
+            NativeMessageHandler.isPlatformBrokerAvailable(
                 this.config,
                 this.logger,
                 this.nativeExtensionProvider
@@ -656,7 +665,10 @@ export class StandardController implements IController {
 
             let result: Promise<void>;
 
-            if (this.nativeExtensionProvider && this.canUseNative(request)) {
+            if (
+                this.nativeExtensionProvider &&
+                this.canUsePlatformBroker(request)
+            ) {
                 const nativeClient = new NativeInteractionClient(
                     this.config,
                     this.browserStorage,
@@ -770,7 +782,7 @@ export class StandardController implements IController {
 
         let result: Promise<AuthenticationResult>;
 
-        if (this.canUseNative(request)) {
+        if (this.canUsePlatformBroker(request)) {
             result = this.acquireTokenNative(
                 {
                     ...request,
@@ -939,7 +951,7 @@ export class StandardController implements IController {
 
         let result: Promise<AuthenticationResult>;
 
-        if (this.canUseNative(validRequest)) {
+        if (this.canUsePlatformBroker(validRequest)) {
             result = this.acquireTokenNative(
                 validRequest,
                 ApiId.ssoSilent
@@ -1087,7 +1099,9 @@ export class StandardController implements IController {
                 }
                 return await response;
             } else if (request.nativeAccountId) {
-                if (this.canUseNative(request, request.nativeAccountId)) {
+                if (
+                    this.canUsePlatformBroker(request, request.nativeAccountId)
+                ) {
                     const result = await this.acquireTokenNative(
                         {
                             ...request,
@@ -1474,7 +1488,10 @@ export class StandardController implements IController {
             result.cloudGraphHostName,
             result.msGraphHost
         );
-        await this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(
+            accountEntity,
+            result.correlationId
+        );
 
         if (result.fromNativeBroker) {
             this.logger.verbose(
@@ -1524,16 +1541,16 @@ export class StandardController implements IController {
     }
 
     /**
-     * Returns boolean indicating if this request can use the native broker
+     * Returns boolean indicating if this request can use the platform broker
      * @param request
      */
-    public canUseNative(
+    public canUsePlatformBroker(
         request: RedirectRequest | PopupRequest | SsoSilentRequest,
         accountId?: string
     ): boolean {
-        this.logger.trace("canUseNative called");
+        this.logger.trace("canUsePlatformBroker called");
         if (
-            !NativeMessageHandler.isNativeAvailable(
+            !NativeMessageHandler.isPlatformBrokerAvailable(
                 this.config,
                 this.logger,
                 this.nativeExtensionProvider,
@@ -1541,7 +1558,7 @@ export class StandardController implements IController {
             )
         ) {
             this.logger.trace(
-                "canUseNative: isNativeAvailable returned false, returning false"
+                "canUsePlatformBroker: isPlatformBrokerAvailable returned false, returning false"
             );
             return false;
         }
@@ -1552,12 +1569,12 @@ export class StandardController implements IController {
                 case PromptValue.CONSENT:
                 case PromptValue.LOGIN:
                     this.logger.trace(
-                        "canUseNative: prompt is compatible with native flow"
+                        "canUsePlatformBroker: prompt is compatible with platform broker flow"
                     );
                     break;
                 default:
                     this.logger.trace(
-                        `canUseNative: prompt = ${request.prompt} is not compatible with native flow, returning false`
+                        `canUsePlatformBroker: prompt = ${request.prompt} is not compatible with platform broker flow, returning false`
                     );
                     return false;
             }
@@ -1565,7 +1582,7 @@ export class StandardController implements IController {
 
         if (!accountId && !this.getNativeAccountId(request)) {
             this.logger.trace(
-                "canUseNative: nativeAccountId is not available, returning false"
+                "canUsePlatformBroker: nativeAccountId is not available, returning false"
             );
             return false;
         }
@@ -2254,7 +2271,7 @@ export class StandardController implements IController {
         cacheLookupPolicy: CacheLookupPolicy
     ): Promise<AuthenticationResult> {
         if (
-            NativeMessageHandler.isNativeAvailable(
+            NativeMessageHandler.isPlatformBrokerAvailable(
                 this.config,
                 this.logger,
                 this.nativeExtensionProvider,

package/src/controllers/UnknownOperatingContextController.ts

@@ -105,12 +105,13 @@ export class UnknownOperatingContextController implements IController {
                   this.config.cache,
                   this.browserCrypto,
                   this.logger,
-                  undefined,
-                  this.performanceClient
+                  this.performanceClient,
+                  undefined
               )
             : DEFAULT_BROWSER_CACHE_MANAGER(
                   this.config.auth.clientId,
-                  this.logger
+                  this.logger,
+                  this.performanceClient
               );
     }
     getBrowserStorage(): BrowserCacheManager {
@@ -180,7 +181,7 @@ export class UnknownOperatingContextController implements IController {
                       | "codeChallenge"
                       | "codeChallengeMethod"
                       | "requestedClaimsHash"
-                      | "nativeBroker"
+                      | "platformBroker"
                   >
               >,
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -287,7 +288,7 @@ export class UnknownOperatingContextController implements IController {
                 | "codeChallenge"
                 | "codeChallengeMethod"
                 | "requestedClaimsHash"
-                | "nativeBroker"
+                | "platformBroker"
             >
         >
     ): Promise<AuthenticationResult> {

package/src/crypto/BrowserCrypto.ts

@@ -58,7 +58,9 @@ const keygenAlgorithmOptions: RsaHashedKeyGenParams = {
 /**
  * Check whether browser crypto is available.
  */
-export function validateCryptoAvailable(): void {
+export function validateCryptoAvailable(
+    skipValidateSubtleCrypto: boolean
+): void {
     if (!window) {
         throw createBrowserAuthError(
             BrowserAuthErrorCodes.nonBrowserEnvironment
@@ -67,7 +69,7 @@ export function validateCryptoAvailable(): void {
     if (!window.crypto) {
         throw createBrowserAuthError(BrowserAuthErrorCodes.cryptoNonExistent);
     }
-    if (!window.crypto.subtle) {
+    if (!skipValidateSubtleCrypto && !window.crypto.subtle) {
         throw createBrowserAuthError(
             BrowserAuthErrorCodes.cryptoNonExistent,
             SUBTLE_SUBERROR

package/src/crypto/CryptoOps.ts

@@ -50,10 +50,16 @@ export class CryptoOps implements ICrypto {
     private static EXTRACTABLE: boolean = true;
     private cache: AsyncMemoryStorage<CachedKeyPair>;
 
-    constructor(logger: Logger, performanceClient?: IPerformanceClient) {
+    constructor(
+        logger: Logger,
+        performanceClient?: IPerformanceClient,
+        skipValidateSubtleCrypto?: boolean
+    ) {
         this.logger = logger;
         // Browser crypto needs to be validated first before any other classes can be set.
-        BrowserCrypto.validateCryptoAvailable();
+        BrowserCrypto.validateCryptoAvailable(
+            skipValidateSubtleCrypto ?? false
+        );
         this.cache = new AsyncMemoryStorage<CachedKeyPair>(this.logger);
         this.performanceClient = performanceClient;
     }