@azure/msal-browser 4.11.1 → 4.13.0

package/src/broker/nativeBroker/PlatformAuthProvider.ts

@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    LoggerOptions,
+    IPerformanceClient,
+    Logger,
+    AuthenticationScheme,
+    StubPerformanceClient,
+} from "@azure/msal-common/browser";
+import { name, version } from "../../packageMetadata.js";
+import {
+    BrowserConfiguration,
+    DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
+} from "../../config/Configuration.js";
+import { PlatformAuthExtensionHandler } from "./PlatformAuthExtensionHandler.js";
+import { IPlatformAuthHandler } from "./IPlatformAuthHandler.js";
+import { PlatformAuthDOMHandler } from "./PlatformAuthDOMHandler.js";
+import { createNewGuid } from "../../crypto/BrowserCrypto.js";
+import {
+    BrowserCacheLocation,
+    PLATFORM_AUTH_DOM_SUPPORT,
+} from "../../utils/BrowserConstants.js";
+
+/**
+ * Checks if the platform broker is available in the current environment.
+ * @param loggerOptions
+ * @param perfClient
+ * @returns
+ */
+export async function isPlatformBrokerAvailable(
+    loggerOptions?: LoggerOptions,
+    perfClient?: IPerformanceClient,
+    correlationId?: string
+): Promise<boolean> {
+    const logger = new Logger(loggerOptions || {}, name, version);
+
+    logger.trace("isPlatformBrokerAvailable called");
+
+    const performanceClient = perfClient || new StubPerformanceClient();
+
+    if (typeof window === "undefined") {
+        logger.trace("Non-browser environment detected, returning false");
+        return false;
+    }
+
+    return !!(await getPlatformAuthProvider(
+        logger,
+        performanceClient,
+        correlationId || createNewGuid()
+    ));
+}
+
+export async function getPlatformAuthProvider(
+    logger: Logger,
+    performanceClient: IPerformanceClient,
+    correlationId: string,
+    nativeBrokerHandshakeTimeout?: number
+): Promise<IPlatformAuthHandler | undefined> {
+    logger.trace("getPlatformAuthProvider called", correlationId);
+
+    const enablePlatformBrokerDOMSupport = isDomEnabledForPlatformAuth();
+
+    logger.trace(
+        "Has client allowed platform auth via DOM API: " +
+            enablePlatformBrokerDOMSupport
+    );
+    let platformAuthProvider: IPlatformAuthHandler | undefined;
+    try {
+        if (enablePlatformBrokerDOMSupport) {
+            // Check if DOM platform API is supported first
+            platformAuthProvider = await PlatformAuthDOMHandler.createProvider(
+                logger,
+                performanceClient,
+                correlationId
+            );
+        }
+        if (!platformAuthProvider) {
+            logger.trace(
+                "Platform auth via DOM API not available, checking for extension"
+            );
+            /*
+             * If DOM APIs are not available, check if browser extension is available.
+             * Platform authentication via DOM APIs is preferred over extension APIs.
+             */
+            platformAuthProvider =
+                await PlatformAuthExtensionHandler.createProvider(
+                    logger,
+                    nativeBrokerHandshakeTimeout ||
+                        DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
+                    performanceClient
+                );
+        }
+    } catch (e) {
+        logger.trace("Platform auth not available", e as string);
+    }
+    return platformAuthProvider;
+}
+
+/**
+ * Returns true if the DOM API support for platform auth is enabled in session storage
+ * @returns boolean
+ * @deprecated
+ */
+export function isDomEnabledForPlatformAuth(): boolean {
+    let sessionStorage: Storage | undefined;
+    try {
+        sessionStorage = window[BrowserCacheLocation.SessionStorage];
+        // Mute errors if it's a non-browser environment or cookies are blocked.
+        return sessionStorage?.getItem(PLATFORM_AUTH_DOM_SUPPORT) === "true";
+    } catch (e) {
+        return false;
+    }
+}
+
+/**
+ * Returns boolean indicating whether or not the request should attempt to use native broker
+ * @param logger
+ * @param config
+ * @param platformAuthProvider
+ * @param authenticationScheme
+ */
+export function isPlatformAuthAllowed(
+    config: BrowserConfiguration,
+    logger: Logger,
+    platformAuthProvider?: IPlatformAuthHandler,
+    authenticationScheme?: AuthenticationScheme
+): boolean {
+    logger.trace("isBrokerAvailable called");
+    if (!config.system.allowPlatformBroker) {
+        logger.trace(
+            "isBrokerAvailable: allowPlatformBroker is not enabled, returning false"
+        );
+        // Developer disabled WAM
+        return false;
+    }
+
+    if (!platformAuthProvider) {
+        logger.trace(
+            "isBrokerAvailable: Platform auth provider is not initialized, returning false"
+        );
+        // Platform broker auth providers are not available
+        return false;
+    }
+
+    if (authenticationScheme) {
+        switch (authenticationScheme) {
+            case AuthenticationScheme.BEARER:
+            case AuthenticationScheme.POP:
+                logger.trace(
+                    "isBrokerAvailable: authenticationScheme is supported, returning true"
+                );
+                return true;
+            default:
+                logger.trace(
+                    "isBrokerAvailable: authenticationScheme is not supported, returning false"
+                );
+                return false;
+        }
+    }
+    return true;
+}

package/src/broker/nativeBroker/{NativeRequest.ts → PlatformAuthRequest.ts}

@@ -9,7 +9,7 @@ import { StoreInCache, StringDict } from "@azure/msal-common/browser";
 /**
  * Token request which native broker will use to acquire tokens
  */
-export type NativeTokenRequest = {
+export type PlatformAuthRequest = {
     accountId: string; // WAM specific account id used for identification of WAM account. This can be any broker-id eventually
     clientId: string;
     authority: string;
@@ -40,7 +40,7 @@ export type NativeTokenRequest = {
  */
 export type NativeExtensionRequestBody = {
     method: NativeExtensionMethod;
-    request?: NativeTokenRequest;
+    request?: PlatformAuthRequest;
 };
 
 /**
@@ -52,3 +52,42 @@ export type NativeExtensionRequest = {
     extensionId?: string;
     body: NativeExtensionRequestBody;
 };
+
+export type PlatformDOMTokenRequest = {
+    brokerId: string;
+    accountId?: string;
+    clientId: string;
+    authority: string;
+    scope: string;
+    redirectUri: string;
+    correlationId: string;
+    isSecurityTokenService: boolean;
+    state?: string;
+    /*
+     * Known optional parameters will go into extraQueryParameters.
+     * List of known parameters is:
+     * "prompt", "nonce", "claims", "loginHint", "instanceAware", "windowTitleSubstring", "extendedExpiryToken", "storeInCache",
+     * ProofOfPossessionParams: "reqCnf", "keyId", "tokenType", "shrClaims", "shrNonce", "resourceRequestMethod", "resourceRequestUri", "signPopToken"
+     */
+    extraParameters?: DOMExtraParameters;
+    embeddedClientId?: string;
+    storeInCache?: StoreInCache; // Object of booleans indicating whether to store tokens in the cache or not (default is true)
+};
+
+export type DOMExtraParameters = StringDict & {
+    prompt?: string;
+    nonce?: string;
+    claims?: string;
+    loginHint?: string;
+    instanceAware?: string;
+    windowTitleSubstring?: string;
+    extendedExpiryToken?: string;
+    reqCnf?: string;
+    keyId?: string;
+    tokenType?: string;
+    shrClaims?: string;
+    shrNonce?: string;
+    resourceRequestMethod?: string;
+    resourceRequestUri?: string;
+    signPopToken?: string; // Set to true only if token request deos not contain a PoP keyId
+};

package/src/broker/nativeBroker/{NativeResponse.ts → PlatformAuthResponse.ts}

@@ -15,7 +15,7 @@ export type NativeAccountInfo = {
 /**
  * Token response returned by Native Platform
  */
-export type NativeResponse = {
+export type PlatformAuthResponse = {
     access_token: string;
     account: NativeAccountInfo;
     client_info: string;
@@ -54,3 +54,27 @@ export type MATS = {
     http_status?: number;
     http_event_count?: number;
 };
+
+export type PlatformDOMTokenResponse = {
+    isSuccess: boolean;
+    state?: string;
+    accessToken: string;
+    expiresIn: number;
+    account: NativeAccountInfo;
+    clientInfo: string;
+    idToken: string;
+    scopes: string;
+    proofOfPossessionPayload?: string;
+    extendedLifetimeToken?: boolean;
+    error: ErrorResult;
+    properties?: Record<string, string>;
+};
+
+export type ErrorResult = {
+    code: string;
+    description?: string;
+    errorCode: string;
+    protocolError?: string;
+    status: string;
+    properties?: object;
+};

package/src/cache/BrowserCacheManager.ts

@@ -53,7 +53,7 @@ import { LocalStorage } from "./LocalStorage.js";
 import { SessionStorage } from "./SessionStorage.js";
 import { MemoryStorage } from "./MemoryStorage.js";
 import { IWindowStorage } from "./IWindowStorage.js";
-import { NativeTokenRequest } from "../broker/nativeBroker/NativeRequest.js";
+import { PlatformAuthRequest } from "../broker/nativeBroker/PlatformAuthRequest.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { SilentRequest } from "../request/SilentRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
@@ -65,6 +65,8 @@ import { CookieStorage } from "./CookieStorage.js";
 import { getAccountKeys, getTokenKeys } from "./CacheHelpers.js";
 import { EventType } from "../event/EventType.js";
 import { EventHandler } from "../event/EventHandler.js";
+import { clearHash } from "../utils/BrowserUtils.js";
+import { version } from "../packageMetadata.js";
 
 /**
  * This class implements the cache storage interface for MSAL through browser local or session storage.
@@ -122,6 +124,29 @@ export class BrowserCacheManager extends CacheManager {
 
     async initialize(correlationId: string): Promise<void> {
         await this.browserStorage.initialize(correlationId);
+        this.trackVersionChanges(correlationId);
+    }
+
+    /**
+     * Tracks upgrades and downgrades for telemetry and debugging purposes
+     */
+    private trackVersionChanges(correlationId: string): void {
+        const previousVersion = this.browserStorage.getItem(
+            StaticCacheKeys.VERSION
+        );
+        if (previousVersion) {
+            this.logger.info(
+                `MSAL.js was last initialized by version: ${previousVersion}`
+            );
+            this.performanceClient.addFields(
+                { previousLibraryVersion: previousVersion },
+                correlationId
+            );
+        }
+
+        if (previousVersion !== version) {
+            this.browserStorage.setItem(StaticCacheKeys.VERSION, version);
+        }
     }
 
     /**
@@ -1161,7 +1186,7 @@ export class BrowserCacheManager extends CacheManager {
     /**
      * Gets cached native request for redirect flows
      */
-    getCachedNativeRequest(): NativeTokenRequest | null {
+    getCachedNativeRequest(): PlatformAuthRequest | null {
         this.logger.trace("BrowserCacheManager.getCachedNativeRequest called");
         const cachedRequest = this.getTemporaryCache(
             TemporaryCacheKeys.NATIVE_REQUEST,
@@ -1176,7 +1201,7 @@ export class BrowserCacheManager extends CacheManager {
 
         const parsedRequest = this.validateAndParseJson(
             cachedRequest
-        ) as NativeTokenRequest;
+        ) as PlatformAuthRequest;
         if (!parsedRequest) {
             this.logger.error(
                 "BrowserCacheManager.getCachedNativeRequest: Unable to parse native request"
@@ -1203,7 +1228,18 @@ export class BrowserCacheManager extends CacheManager {
     } | null {
         const key = `${Constants.CACHE_PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}`;
         const value = this.getTemporaryCache(key, false);
-        return value ? JSON.parse(value) : null;
+        try {
+            return value ? JSON.parse(value) : null;
+        } catch (e) {
+            // Remove interaction and other temp keys if interaction status can't be parsed
+            this.logger.error(
+                `Cannot parse interaction status. Removing temporary cache items and clearing url hash. Retrying interaction should fix the error`
+            );
+            this.removeTemporaryItem(key);
+            this.resetRequestCache();
+            clearHash(window);
+            return null;
+        }
     }
 
     setInteractionInProgress(

package/src/controllers/IController.ts

@@ -29,7 +29,10 @@ import { EventType } from "../event/EventType.js";
 
 export interface IController {
     // TODO: Make request mandatory in the next major version?
-    initialize(request?: InitializeApplicationRequest): Promise<void>;
+    initialize(
+        request?: InitializeApplicationRequest,
+        isBroker?: boolean
+    ): Promise<void>;
 
     acquireTokenPopup(request: PopupRequest): Promise<AuthenticationResult>;
 

package/src/controllers/NestedAppAuthController.ts

@@ -159,7 +159,11 @@ export class NestedAppAuthController implements IController {
      * Specific implementation of initialize function for NestedAppAuthController
      * @returns
      */
-    async initialize(request?: InitializeApplicationRequest): Promise<void> {
+    async initialize(
+        request?: InitializeApplicationRequest,
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        isBroker?: boolean
+    ): Promise<void> {
         const initCorrelationId = request?.correlationId || createNewGuid();
         await this.browserStorage.initialize(initCorrelationId);
         return Promise.resolve();