@azure/msal-browser 4.13.2 → 4.14.0

package/src/custom_auth/core/auth_flow/AuthFlowErrorBase.ts

@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    CustomAuthApiError,
+    RedirectError,
+} from "../error/CustomAuthApiError.js";
+import { CustomAuthError } from "../error/CustomAuthError.js";
+import { NoCachedAccountFoundError } from "../error/NoCachedAccountFoundError.js";
+import { InvalidArgumentError } from "../error/InvalidArgumentError.js";
+import * as CustomAuthApiErrorCode from "../network_client/custom_auth_api/types/ApiErrorCodes.js";
+import * as CustomAuthApiSuberror from "../network_client/custom_auth_api/types/ApiSuberrors.js";
+/**
+ * Base class for all auth flow errors.
+ */
+export abstract class AuthFlowErrorBase {
+    constructor(public errorData: CustomAuthError) {}
+
+    protected isUserNotFoundError(): boolean {
+        return this.errorData.error === CustomAuthApiErrorCode.USER_NOT_FOUND;
+    }
+
+    protected isUserInvalidError(): boolean {
+        return (
+            (this.errorData instanceof InvalidArgumentError &&
+                this.errorData.errorDescription?.includes("username")) ||
+            (this.errorData instanceof CustomAuthApiError &&
+                !!this.errorData.errorDescription?.includes(
+                    "username parameter is empty or not valid"
+                ) &&
+                !!this.errorData.errorCodes?.includes(90100))
+        );
+    }
+
+    protected isUnsupportedChallengeTypeError(): boolean {
+        return (
+            (this.errorData.error === CustomAuthApiErrorCode.INVALID_REQUEST &&
+                (this.errorData.errorDescription?.includes(
+                    "The challenge_type list parameter contains an unsupported challenge type"
+                ) ??
+                    false)) ||
+            this.errorData.error ===
+                CustomAuthApiErrorCode.UNSUPPORTED_CHALLENGE_TYPE
+        );
+    }
+
+    protected isPasswordIncorrectError(): boolean {
+        const isIncorrectPassword =
+            this.errorData.error === CustomAuthApiErrorCode.INVALID_GRANT &&
+            this.errorData instanceof CustomAuthApiError &&
+            (this.errorData.errorCodes ?? []).includes(50126);
+
+        const isPasswordEmpty =
+            this.errorData instanceof InvalidArgumentError &&
+            this.errorData.errorDescription?.includes("password") === true;
+
+        return isIncorrectPassword || isPasswordEmpty;
+    }
+
+    protected isInvalidCodeError(): boolean {
+        return (
+            (this.errorData.error === CustomAuthApiErrorCode.INVALID_GRANT &&
+                this.errorData instanceof CustomAuthApiError &&
+                this.errorData.subError ===
+                    CustomAuthApiSuberror.INVALID_OOB_VALUE) ||
+            (this.errorData instanceof InvalidArgumentError &&
+                this.errorData.errorDescription?.includes("code") === true)
+        );
+    }
+
+    protected isRedirectError(): boolean {
+        return this.errorData instanceof RedirectError;
+    }
+
+    protected isInvalidNewPasswordError(): boolean {
+        const invalidPasswordSubErrors = new Set<string>([
+            CustomAuthApiSuberror.PASSWORD_BANNED,
+            CustomAuthApiSuberror.PASSWORD_IS_INVALID,
+            CustomAuthApiSuberror.PASSWORD_RECENTLY_USED,
+            CustomAuthApiSuberror.PASSWORD_TOO_LONG,
+            CustomAuthApiSuberror.PASSWORD_TOO_SHORT,
+            CustomAuthApiSuberror.PASSWORD_TOO_WEAK,
+        ]);
+
+        return (
+            this.errorData instanceof CustomAuthApiError &&
+            this.errorData.error === CustomAuthApiErrorCode.INVALID_GRANT &&
+            invalidPasswordSubErrors.has(this.errorData.subError ?? "")
+        );
+    }
+
+    protected isUserAlreadyExistsError(): boolean {
+        return (
+            this.errorData instanceof CustomAuthApiError &&
+            this.errorData.error === CustomAuthApiErrorCode.USER_ALREADY_EXISTS
+        );
+    }
+
+    protected isAttributeRequiredError(): boolean {
+        return (
+            this.errorData instanceof CustomAuthApiError &&
+            this.errorData.error === CustomAuthApiErrorCode.ATTRIBUTES_REQUIRED
+        );
+    }
+
+    protected isAttributeValidationFailedError(): boolean {
+        return (
+            (this.errorData instanceof CustomAuthApiError &&
+                this.errorData.error === CustomAuthApiErrorCode.INVALID_GRANT &&
+                this.errorData.subError ===
+                    CustomAuthApiSuberror.ATTRIBUTE_VALIATION_FAILED) ||
+            (this.errorData instanceof InvalidArgumentError &&
+                this.errorData.errorDescription?.includes("attributes") ===
+                    true)
+        );
+    }
+
+    protected isNoCachedAccountFoundError(): boolean {
+        return this.errorData instanceof NoCachedAccountFoundError;
+    }
+
+    protected isTokenExpiredError(): boolean {
+        return (
+            this.errorData instanceof CustomAuthApiError &&
+            this.errorData.error === CustomAuthApiErrorCode.EXPIRED_TOKEN
+        );
+    }
+}
+
+export abstract class AuthActionErrorBase extends AuthFlowErrorBase {
+    /**
+     * Checks if the error is due to the expired continuation token.
+     * @returns {boolean} True if the error is due to the expired continuation token, false otherwise.
+     */
+    isTokenExpired(): boolean {
+        return this.isTokenExpiredError();
+    }
+}

package/src/custom_auth/core/auth_flow/AuthFlowResultBase.ts

@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "@azure/msal-common/browser";
+import { CustomAuthError } from "../error/CustomAuthError.js";
+import { MsalCustomAuthError } from "../error/MsalCustomAuthError.js";
+import { UnexpectedError } from "../error/UnexpectedError.js";
+import { AuthFlowErrorBase } from "./AuthFlowErrorBase.js";
+import { AuthFlowStateBase } from "./AuthFlowState.js";
+
+/*
+ * Base class for a result of an authentication operation.
+ * @typeParam TState - The type of the auth flow state.
+ * @typeParam TError - The type of error.
+ * @typeParam TData - The type of the result data.
+ */
+export abstract class AuthFlowResultBase<
+    TState extends AuthFlowStateBase,
+    TError extends AuthFlowErrorBase,
+    TData = void
+> {
+    /*
+     *constructor for ResultBase
+     * @param state - The state.
+     * @param data - The result data.
+     */
+    constructor(public state: TState, public data?: TData) {}
+
+    /*
+     * The error that occurred during the authentication operation.
+     */
+    error?: TError;
+
+    /*
+     * Creates a CustomAuthError with an error.
+     * @param error - The error that occurred.
+     * @returns The auth error.
+     */
+    protected static createErrorData(error: unknown): CustomAuthError {
+        if (error instanceof CustomAuthError) {
+            return error;
+        } else if (error instanceof AuthError) {
+            return new MsalCustomAuthError(
+                error.errorCode,
+                error.errorMessage,
+                error.subError,
+                error.correlationId
+            );
+        } else {
+            return new UnexpectedError(error);
+        }
+    }
+}

package/src/custom_auth/core/auth_flow/AuthFlowState.ts

@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { InvalidArgumentError } from "../error/InvalidArgumentError.js";
+import { CustomAuthBrowserConfiguration } from "../../configuration/CustomAuthConfiguration.js";
+import { Logger } from "@azure/msal-common/browser";
+import { ensureArgumentIsNotEmptyString } from "../utils/ArgumentValidator.js";
+import { DefaultCustomAuthApiCodeLength } from "../../CustomAuthConstants.js";
+
+export interface AuthFlowActionRequiredStateParameters {
+    correlationId: string;
+    logger: Logger;
+    config: CustomAuthBrowserConfiguration;
+    continuationToken?: string;
+}
+
+/**
+ * Base class for the state of an authentication flow.
+ */
+export abstract class AuthFlowStateBase {}
+
+/**
+ * Base class for the action requried state in an authentication flow.
+ */
+export abstract class AuthFlowActionRequiredStateBase<
+    TParameter extends AuthFlowActionRequiredStateParameters
+> extends AuthFlowStateBase {
+    /**
+     * Creates a new instance of AuthFlowActionRequiredStateBase.
+     * @param stateParameters The parameters for the auth state.
+     */
+    protected constructor(protected readonly stateParameters: TParameter) {
+        ensureArgumentIsNotEmptyString(
+            "correlationId",
+            stateParameters.correlationId
+        );
+
+        super();
+    }
+
+    protected ensureCodeIsValid(code: string, codeLength: number): void {
+        if (
+            codeLength !== DefaultCustomAuthApiCodeLength &&
+            (!code || code.length !== codeLength)
+        ) {
+            this.stateParameters.logger.error(
+                "Code parameter is not provided or invalid for authentication flow.",
+                this.stateParameters.correlationId
+            );
+
+            throw new InvalidArgumentError(
+                "code",
+                this.stateParameters.correlationId
+            );
+        }
+    }
+
+    protected ensurePasswordIsNotEmpty(password: string): void {
+        if (!password) {
+            this.stateParameters.logger.error(
+                "Password parameter is not provided for authentication flow.",
+                this.stateParameters.correlationId
+            );
+
+            throw new InvalidArgumentError(
+                "password",
+                this.stateParameters.correlationId
+            );
+        }
+    }
+}

package/src/custom_auth/core/error/CustomAuthApiError.ts

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { UserAttribute } from "../network_client/custom_auth_api/types/ApiErrorResponseTypes.js";
+import { CustomAuthError } from "./CustomAuthError.js";
+
+/**
+ * Error when no required authentication method by Microsoft Entra is supported
+ */
+export class RedirectError extends CustomAuthError {
+    constructor(correlationId?: string) {
+        super(
+            "redirect",
+            "No required authentication method by Microsoft Entra is supported, a fallback to the web-based authentication flow is needed.",
+            correlationId
+        );
+        Object.setPrototypeOf(this, RedirectError.prototype);
+    }
+}
+
+/**
+ * Custom Auth API error.
+ */
+export class CustomAuthApiError extends CustomAuthError {
+    constructor(
+        error: string,
+        errorDescription: string,
+        correlationId?: string,
+        errorCodes?: Array<number>,
+        subError?: string,
+        public attributes?: Array<UserAttribute>,
+        public continuationToken?: string,
+        public traceId?: string,
+        public timestamp?: string
+    ) {
+        super(error, errorDescription, correlationId, errorCodes, subError);
+        Object.setPrototypeOf(this, CustomAuthApiError.prototype);
+    }
+}

package/src/custom_auth/core/error/CustomAuthError.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export class CustomAuthError extends Error {
+    constructor(
+        public error: string,
+        public errorDescription?: string,
+        public correlationId?: string,
+        public errorCodes?: Array<number>,
+        public subError?: string
+    ) {
+        super(`${error}: ${errorDescription ?? ""}`);
+        Object.setPrototypeOf(this, CustomAuthError.prototype);
+
+        this.errorCodes = errorCodes ?? [];
+        this.subError = subError ?? "";
+    }
+}

package/src/custom_auth/core/error/HttpError.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class HttpError extends CustomAuthError {
+    constructor(error: string, message: string, correlationId?: string) {
+        super(error, message, correlationId);
+        Object.setPrototypeOf(this, HttpError.prototype);
+    }
+}

package/src/custom_auth/core/error/HttpErrorCodes.ts

@@ -0,0 +1,7 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const NoNetworkConnectivity = "no_network_connectivity";
+export const FailedSendRequest = "failed_send_request";

package/src/custom_auth/core/error/InvalidArgumentError.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class InvalidArgumentError extends CustomAuthError {
+    constructor(argName: string, correlationId?: string) {
+        const errorDescription = `The argument '${argName}' is invalid.`;
+
+        super("invalid_argument", errorDescription, correlationId);
+        Object.setPrototypeOf(this, InvalidArgumentError.prototype);
+    }
+}

package/src/custom_auth/core/error/InvalidConfigurationError.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class InvalidConfigurationError extends CustomAuthError {
+    constructor(error: string, message: string, correlationId?: string) {
+        super(error, message, correlationId);
+        Object.setPrototypeOf(this, InvalidConfigurationError.prototype);
+    }
+}

package/src/custom_auth/core/error/InvalidConfigurationErrorCodes.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const MissingConfiguration = "missing_configuration";
+export const InvalidAuthority = "invalid_authority";
+export const InvalidChallengeType = "invalid_challenge_type";

package/src/custom_auth/core/error/MethodNotImplementedError.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class MethodNotImplementedError extends CustomAuthError {
+    constructor(method: string, correlationId?: string) {
+        const errorDescription = `The method '${method}' is not implemented, please do not use.`;
+
+        super("method_not_implemented", errorDescription, correlationId);
+        Object.setPrototypeOf(this, MethodNotImplementedError.prototype);
+    }
+}

package/src/custom_auth/core/error/MsalCustomAuthError.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class MsalCustomAuthError extends CustomAuthError {
+    subError: string | undefined;
+
+    constructor(
+        error: string,
+        errorDescription?: string,
+        subError?: string,
+        correlationId?: string
+    ) {
+        super(error, errorDescription, correlationId);
+        Object.setPrototypeOf(this, MsalCustomAuthError.prototype);
+
+        this.subError = subError || "";
+    }
+}

package/src/custom_auth/core/error/NoCachedAccountFoundError.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class NoCachedAccountFoundError extends CustomAuthError {
+    constructor(correlationId?: string) {
+        super(
+            "no_cached_account_found",
+            "No account found in the cache",
+            correlationId
+        );
+        Object.setPrototypeOf(this, NoCachedAccountFoundError.prototype);
+    }
+}

package/src/custom_auth/core/error/ParsedUrlError.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class ParsedUrlError extends CustomAuthError {
+    constructor(error: string, message: string, correlationId?: string) {
+        super(error, message, correlationId);
+        Object.setPrototypeOf(this, ParsedUrlError.prototype);
+    }
+}

package/src/custom_auth/core/error/ParsedUrlErrorCodes.ts

@@ -0,0 +1,6 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const InvalidUrl = "invalid_url";

package/src/custom_auth/core/error/UnexpectedError.ts

@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class UnexpectedError extends CustomAuthError {
+    constructor(errorData: unknown, correlationId?: string) {
+        let errorDescription: string;
+
+        if (errorData instanceof Error) {
+            errorDescription = errorData.message;
+        } else if (typeof errorData === "string") {
+            errorDescription = errorData;
+        } else if (typeof errorData === "object" && errorData !== null) {
+            errorDescription = JSON.stringify(errorData);
+        } else {
+            errorDescription = "An unexpected error occurred.";
+        }
+
+        super("unexpected_error", errorDescription, correlationId);
+        Object.setPrototypeOf(this, UnexpectedError.prototype);
+    }
+}

package/src/custom_auth/core/error/UnsupportedEnvironmentError.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class UnsupportedEnvironmentError extends CustomAuthError {
+    constructor(correlationId?: string) {
+        super(
+            "unsupported_env",
+            "The current environment is not browser",
+            correlationId
+        );
+        Object.setPrototypeOf(this, UnsupportedEnvironmentError.prototype);
+    }
+}

package/src/custom_auth/core/error/UserAccountAttributeError.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class UserAccountAttributeError extends CustomAuthError {
+    constructor(error: string, attributeName: string, attributeValue: string) {
+        const errorDescription = `Failed to set attribute '${attributeName}' with value '${attributeValue}'`;
+
+        super(error, errorDescription);
+        Object.setPrototypeOf(this, UserAccountAttributeError.prototype);
+    }
+}

package/src/custom_auth/core/error/UserAccountAttributeErrorCodes.ts

@@ -0,0 +1,6 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const InvalidAttributeErrorCode = "invalid_attribute";

package/src/custom_auth/core/error/UserAlreadySignedInError.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthError } from "./CustomAuthError.js";
+
+export class UserAlreadySignedInError extends CustomAuthError {
+    constructor(correlationId?: string) {
+        super(
+            "user_already_signed_in",
+            "The user has already signed in.",
+            correlationId
+        );
+        Object.setPrototypeOf(this, UserAlreadySignedInError.prototype);
+    }
+}

package/src/custom_auth/core/interaction_client/CustomAuthInteractionClientBase.ts

@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { ICustomAuthApiClient } from "../network_client/custom_auth_api/ICustomAuthApiClient.js";
+import { MethodNotImplementedError } from "../error/MethodNotImplementedError.js";
+import { CustomAuthAuthority } from "../CustomAuthAuthority.js";
+import { ChallengeType } from "../../CustomAuthConstants.js";
+import { StandardInteractionClient } from "../../../interaction_client/StandardInteractionClient.js";
+import { BrowserConfiguration } from "../../../config/Configuration.js";
+import { BrowserCacheManager } from "../../../cache/BrowserCacheManager.js";
+import {
+    Constants,
+    ICrypto,
+    IPerformanceClient,
+    Logger,
+} from "@azure/msal-common/browser";
+import { EventHandler } from "../../../event/EventHandler.js";
+import { INavigationClient } from "../../../navigation/INavigationClient.js";
+import { RedirectRequest } from "../../../request/RedirectRequest.js";
+import { PopupRequest } from "../../../request/PopupRequest.js";
+import { SsoSilentRequest } from "../../../request/SsoSilentRequest.js";
+import { EndSessionRequest } from "../../../request/EndSessionRequest.js";
+import { ClearCacheRequest } from "../../../request/ClearCacheRequest.js";
+import { AuthenticationResult } from "../../../response/AuthenticationResult.js";
+
+export abstract class CustomAuthInteractionClientBase extends StandardInteractionClient {
+    constructor(
+        config: BrowserConfiguration,
+        storageImpl: BrowserCacheManager,
+        browserCrypto: ICrypto,
+        logger: Logger,
+        eventHandler: EventHandler,
+        navigationClient: INavigationClient,
+        performanceClient: IPerformanceClient,
+        protected customAuthApiClient: ICustomAuthApiClient,
+        protected customAuthAuthority: CustomAuthAuthority
+    ) {
+        super(
+            config,
+            storageImpl,
+            browserCrypto,
+            logger,
+            eventHandler,
+            navigationClient,
+            performanceClient
+        );
+    }
+
+    protected getChallengeTypes(
+        configuredChallengeTypes: string[] | undefined
+    ): string {
+        const challengeType = configuredChallengeTypes ?? [];
+        if (
+            !challengeType.some(
+                (type) => type.toLowerCase() === ChallengeType.REDIRECT
+            )
+        ) {
+            challengeType.push(ChallengeType.REDIRECT);
+        }
+        return challengeType.join(" ");
+    }
+
+    protected getScopes(scopes: string[] | undefined): string[] {
+        if (!!scopes && scopes.length > 0) {
+            scopes;
+        }
+
+        return [
+            Constants.OPENID_SCOPE,
+            Constants.PROFILE_SCOPE,
+            Constants.OFFLINE_ACCESS_SCOPE,
+        ];
+    }
+
+    // It is not necessary to implement this method from base class.
+    acquireToken(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request: RedirectRequest | PopupRequest | SsoSilentRequest
+    ): Promise<AuthenticationResult | void> {
+        throw new MethodNotImplementedError("SignInClient.acquireToken");
+    }
+
+    // It is not necessary to implement this method from base class.
+    logout(
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        request: EndSessionRequest | ClearCacheRequest | undefined
+    ): Promise<void> {
+        throw new MethodNotImplementedError("SignInClient.logout");
+    }
+}