@azure/msal-browser 4.13.2 → 4.15.0

package/src/cache/IWindowStorage.ts

@@ -29,7 +29,12 @@ export interface IWindowStorage<T> {
     /**
      * Setter for sensitive data that may contain PII.
      */
-    setUserData(key: string, value: T, correlationId: string): Promise<void>;
+    setUserData(
+        key: string,
+        value: T,
+        correlationId: string,
+        timestamp: string
+    ): Promise<void>;
 
     /**
      * Removes the item in the window storage object matching the given key.

package/src/cache/LocalStorage.ts

@@ -47,6 +47,7 @@ type EncryptedData = {
     id: string;
     nonce: string;
     data: string;
+    lastUpdatedAt: string;
 };
 
 export class LocalStorage implements IWindowStorage<string> {
@@ -180,7 +181,8 @@ export class LocalStorage implements IWindowStorage<string> {
     async setUserData(
         key: string,
         value: string,
-        correlationId: string
+        correlationId: string,
+        timestamp: string
     ): Promise<void> {
         if (!this.initialized || !this.encryptionCookie) {
             throw createBrowserAuthError(
@@ -199,6 +201,7 @@ export class LocalStorage implements IWindowStorage<string> {
             id: this.encryptionCookie.id,
             nonce: nonce,
             data: data,
+            lastUpdatedAt: timestamp,
         };
 
         this.memoryStorage.setItem(key, value);

package/src/cache/TokenCache.ts

@@ -210,6 +210,7 @@ export class TokenCache implements ITokenCache {
             authority,
             homeAccountId,
             base64Decode,
+            correlationId,
             idTokenClaims,
             clientInfo,
             authority.hostnameAndPort,

package/src/controllers/NestedAppAuthController.ts

@@ -469,11 +469,14 @@ export class NestedAppAuthController implements IController {
         const accountContext =
             this.bridgeProxy.getAccountContext() || this.currentAccountContext;
         let currentAccount: AccountInfo | null = null;
+        const correlationId =
+            request.correlationId || this.browserCrypto.createNewGuid();
         if (accountContext) {
             currentAccount = AccountManager.getAccount(
                 accountContext,
                 this.logger,
-                this.browserStorage
+                this.browserStorage,
+                correlationId
             );
         }
 
@@ -525,10 +528,10 @@ export class NestedAppAuthController implements IController {
 
         const cachedIdToken = this.browserStorage.getIdToken(
             currentAccount,
+            authRequest.correlationId,
             tokenKeys,
             currentAccount.tenantId,
-            this.performanceClient,
-            authRequest.correlationId
+            this.performanceClient
         );
 
         if (!cachedIdToken) {
@@ -672,10 +675,12 @@ export class NestedAppAuthController implements IController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
+        const correlationId = this.browserCrypto.createNewGuid();
         return AccountManager.getAllAccounts(
             this.logger,
             this.browserStorage,
             this.isBrowserEnv(),
+            correlationId,
             accountFilter
         );
     }
@@ -686,10 +691,12 @@ export class NestedAppAuthController implements IController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter: AccountFilter): AccountInfo | null {
+        const correlationId = this.browserCrypto.createNewGuid();
         return AccountManager.getAccount(
             accountFilter,
             this.logger,
-            this.browserStorage
+            this.browserStorage,
+            correlationId
         );
     }
 
@@ -702,10 +709,12 @@ export class NestedAppAuthController implements IController {
      * @returns The account object stored in MSAL
      */
     getAccountByUsername(username: string): AccountInfo | null {
+        const correlationId = this.browserCrypto.createNewGuid();
         return AccountManager.getAccountByUsername(
             username,
             this.logger,
-            this.browserStorage
+            this.browserStorage,
+            correlationId
         );
     }
 
@@ -717,10 +726,12 @@ export class NestedAppAuthController implements IController {
      * @returns The account object stored in MSAL
      */
     getAccountByHomeId(homeAccountId: string): AccountInfo | null {
+        const correlationId = this.browserCrypto.createNewGuid();
         return AccountManager.getAccountByHomeId(
             homeAccountId,
             this.logger,
-            this.browserStorage
+            this.browserStorage,
+            correlationId
         );
     }
 
@@ -732,10 +743,12 @@ export class NestedAppAuthController implements IController {
      * @returns The account object stored in MSAL
      */
     getAccountByLocalId(localAccountId: string): AccountInfo | null {
+        const correlationId = this.browserCrypto.createNewGuid();
         return AccountManager.getAccountByLocalId(
             localAccountId,
             this.logger,
-            this.browserStorage
+            this.browserStorage,
+            correlationId
         );
     }
 
@@ -748,14 +761,23 @@ export class NestedAppAuthController implements IController {
          * StandardController uses this to allow the developer to set the active account
          * in the nested app auth scenario the active account is controlled by the app hosting the nested app
          */
-        return AccountManager.setActiveAccount(account, this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return AccountManager.setActiveAccount(
+            account,
+            this.browserStorage,
+            correlationId
+        );
     }
 
     /**
      * Gets the currently active account
      */
     getActiveAccount(): AccountInfo | null {
-        return AccountManager.getActiveAccount(this.browserStorage);
+        const correlationId = this.browserCrypto.createNewGuid();
+        return AccountManager.getActiveAccount(
+            this.browserStorage,
+            correlationId
+        );
     }
 
     // #endregion

package/src/controllers/StandardController.ts

@@ -1439,10 +1439,12 @@ export class StandardController implements IController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
+        const correlationId = this.getRequestCorrelationId();
         return AccountManager.getAllAccounts(
             this.logger,
             this.browserStorage,
             this.isBrowserEnvironment,
+            correlationId,
             accountFilter
         );
     }
@@ -1453,10 +1455,12 @@ export class StandardController implements IController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter: AccountFilter): AccountInfo | null {
+        const correlationId = this.getRequestCorrelationId();
         return AccountManager.getAccount(
             accountFilter,
             this.logger,
-            this.browserStorage
+            this.browserStorage,
+            correlationId
         );
     }
 
@@ -1469,10 +1473,12 @@ export class StandardController implements IController {
      * @returns The account object stored in MSAL
      */
     getAccountByUsername(username: string): AccountInfo | null {
+        const correlationId = this.getRequestCorrelationId();
         return AccountManager.getAccountByUsername(
             username,
             this.logger,
-            this.browserStorage
+            this.browserStorage,
+            correlationId
         );
     }
 
@@ -1484,10 +1490,12 @@ export class StandardController implements IController {
      * @returns The account object stored in MSAL
      */
     getAccountByHomeId(homeAccountId: string): AccountInfo | null {
+        const correlationId = this.getRequestCorrelationId();
         return AccountManager.getAccountByHomeId(
             homeAccountId,
             this.logger,
-            this.browserStorage
+            this.browserStorage,
+            correlationId
         );
     }
 
@@ -1499,10 +1507,12 @@ export class StandardController implements IController {
      * @returns The account object stored in MSAL
      */
     getAccountByLocalId(localAccountId: string): AccountInfo | null {
+        const correlationId = this.getRequestCorrelationId();
         return AccountManager.getAccountByLocalId(
             localAccountId,
             this.logger,
-            this.browserStorage
+            this.browserStorage,
+            correlationId
         );
     }
 
@@ -1511,14 +1521,23 @@ export class StandardController implements IController {
      * @param account
      */
     setActiveAccount(account: AccountInfo | null): void {
-        AccountManager.setActiveAccount(account, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        AccountManager.setActiveAccount(
+            account,
+            this.browserStorage,
+            correlationId
+        );
     }
 
     /**
      * Gets the currently active account
      */
     getActiveAccount(): AccountInfo | null {
-        return AccountManager.getActiveAccount(this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return AccountManager.getActiveAccount(
+            this.browserStorage,
+            correlationId
+        );
     }
 
     // #endregion

package/src/custom_auth/CustomAuthActionInputs.ts

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { UserAccountAttributes } from "./UserAccountAttributes.js";
+
+export type CustomAuthActionInputs = {
+    correlationId?: string;
+};
+
+export type AccountRetrievalInputs = CustomAuthActionInputs;
+
+export type SignInInputs = CustomAuthActionInputs & {
+    username: string;
+    password?: string;
+    scopes?: Array<string>;
+};
+
+export type SignUpInputs = CustomAuthActionInputs & {
+    username: string;
+    password?: string;
+    attributes?: UserAccountAttributes;
+};
+
+export type ResetPasswordInputs = CustomAuthActionInputs & {
+    username: string;
+};
+
+export type AccessTokenRetrievalInputs = {
+    forceRefresh: boolean;
+    scopes?: Array<string>;
+};
+
+export type SignInWithContinuationTokenInputs = {
+    scopes?: Array<string>;
+};

package/src/custom_auth/CustomAuthConstants.ts

@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { Constants } from "@azure/msal-common/browser";
+import { version } from "../packageMetadata.js";
+
+export const GrantType = {
+    PASSWORD: "password",
+    OOB: "oob",
+    CONTINUATION_TOKEN: "continuation_token",
+    REDIRECT: "redirect",
+    ATTRIBUTES: "attributes",
+} as const;
+
+export const ChallengeType = {
+    PASSWORD: "password",
+    OOB: "oob",
+    REDIRECT: "redirect",
+} as const;
+
+export const DefaultScopes = [
+    Constants.OPENID_SCOPE,
+    Constants.PROFILE_SCOPE,
+    Constants.OFFLINE_ACCESS_SCOPE,
+] as const;
+
+export const HttpHeaderKeys = {
+    CONTENT_TYPE: "Content-Type",
+    X_MS_REQUEST_ID: "x-ms-request-id",
+} as const;
+
+export const DefaultPackageInfo = {
+    SKU: "msal.browser",
+    VERSION: version,
+    OS: "",
+    CPU: "",
+} as const;
+
+export const ResetPasswordPollStatus = {
+    IN_PROGRESS: "in_progress",
+    SUCCEEDED: "succeeded",
+    FAILED: "failed",
+    NOT_STARTED: "not_started",
+} as const;
+
+export const DefaultCustomAuthApiCodeLength = -1; // Default value indicating that the code length is not specified
+export const DefaultCustomAuthApiCodeResendIntervalInSec = 300; // seconds
+export const PasswordResetPollingTimeoutInMs = 300000; // milliseconds

package/src/custom_auth/CustomAuthPublicClientApplication.ts

@@ -0,0 +1,158 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { GetAccountResult } from "./get_account/auth_flow/result/GetAccountResult.js";
+import { SignInResult } from "./sign_in/auth_flow/result/SignInResult.js";
+import { SignUpResult } from "./sign_up/auth_flow/result/SignUpResult.js";
+import { ICustomAuthStandardController } from "./controller/ICustomAuthStandardController.js";
+import { CustomAuthStandardController } from "./controller/CustomAuthStandardController.js";
+import { ICustomAuthPublicClientApplication } from "./ICustomAuthPublicClientApplication.js";
+import {
+    AccountRetrievalInputs,
+    SignInInputs,
+    SignUpInputs,
+    ResetPasswordInputs,
+} from "./CustomAuthActionInputs.js";
+import { CustomAuthConfiguration } from "./configuration/CustomAuthConfiguration.js";
+import { CustomAuthOperatingContext } from "./operating_context/CustomAuthOperatingContext.js";
+import { ResetPasswordStartResult } from "./reset_password/auth_flow/result/ResetPasswordStartResult.js";
+import { InvalidConfigurationError } from "./core/error/InvalidConfigurationError.js";
+import { ChallengeType } from "./CustomAuthConstants.js";
+import { PublicClientApplication } from "../app/PublicClientApplication.js";
+import {
+    InvalidAuthority,
+    InvalidChallengeType,
+    MissingConfiguration,
+} from "./core/error/InvalidConfigurationErrorCodes.js";
+
+export class CustomAuthPublicClientApplication
+    extends PublicClientApplication
+    implements ICustomAuthPublicClientApplication
+{
+    private readonly customAuthController: ICustomAuthStandardController;
+
+    /**
+     * Creates a new instance of a PublicClientApplication with the given configuration and controller to start Native authentication flows
+     * @param {CustomAuthConfiguration} config - A configuration object for the PublicClientApplication instance
+     * @returns {Promise<ICustomAuthPublicClientApplication>} - A promise that resolves to a CustomAuthPublicClientApplication instance
+     */
+    static async create(
+        config: CustomAuthConfiguration
+    ): Promise<ICustomAuthPublicClientApplication> {
+        CustomAuthPublicClientApplication.validateConfig(config);
+
+        const customAuthController = new CustomAuthStandardController(
+            new CustomAuthOperatingContext(config)
+        );
+
+        await customAuthController.initialize();
+
+        const app = new CustomAuthPublicClientApplication(
+            config,
+            customAuthController
+        );
+
+        return app;
+    }
+
+    private constructor(
+        config: CustomAuthConfiguration,
+        controller: ICustomAuthStandardController
+    ) {
+        super(config, controller);
+
+        this.customAuthController = controller;
+    }
+
+    /**
+     * Gets the current account from the browser cache.
+     * @param {AccountRetrievalInputs} accountRetrievalInputs?:AccountRetrievalInputs
+     * @returns {GetAccountResult} - The result of the get account operation
+     */
+    getCurrentAccount(
+        accountRetrievalInputs?: AccountRetrievalInputs
+    ): GetAccountResult {
+        return this.customAuthController.getCurrentAccount(
+            accountRetrievalInputs
+        );
+    }
+
+    /**
+     * Initiates the sign-in flow.
+     * This method results in sign-in completion, or extra actions (password, code, etc.) required to complete the sign-in.
+     * Create result with error details if any exception thrown.
+     * @param {SignInInputs} signInInputs - Inputs for the sign-in flow
+     * @returns {Promise<SignInResult>} - A promise that resolves to SignInResult
+     */
+    signIn(signInInputs: SignInInputs): Promise<SignInResult> {
+        return this.customAuthController.signIn(signInInputs);
+    }
+
+    /**
+     * Initiates the sign-up flow.
+     * This method results in sign-up completion, or extra actions (password, code, etc.) required to complete the sign-up.
+     * Create result with error details if any exception thrown.
+     * @param {SignUpInputs} signUpInputs
+     * @returns {Promise<SignUpResult>} - A promise that resolves to SignUpResult
+     */
+    signUp(signUpInputs: SignUpInputs): Promise<SignUpResult> {
+        return this.customAuthController.signUp(signUpInputs);
+    }
+
+    /**
+     * Initiates the reset password flow.
+     * This method results in triggering extra action (submit code) to complete the reset password.
+     * Create result with error details if any exception thrown.
+     * @param {ResetPasswordInputs} resetPasswordInputs - Inputs for the reset password flow
+     * @returns {Promise<ResetPasswordStartResult>} - A promise that resolves to ResetPasswordStartResult
+     */
+    resetPassword(
+        resetPasswordInputs: ResetPasswordInputs
+    ): Promise<ResetPasswordStartResult> {
+        return this.customAuthController.resetPassword(resetPasswordInputs);
+    }
+
+    /**
+     * Validates the configuration to ensure it is a valid CustomAuthConfiguration object.
+     * @param {CustomAuthConfiguration} config - The configuration object for the PublicClientApplication.
+     * @returns {void}
+     */
+    private static validateConfig(config: CustomAuthConfiguration): void {
+        // Ensure the configuration object has a valid CIAM authority URL.
+        if (!config) {
+            throw new InvalidConfigurationError(
+                MissingConfiguration,
+                "The configuration is missing."
+            );
+        }
+
+        if (!config.auth?.authority) {
+            throw new InvalidConfigurationError(
+                InvalidAuthority,
+                `The authority URL '${config.auth?.authority}' is not set.`
+            );
+        }
+
+        const challengeTypes = config.customAuth.challengeTypes;
+
+        if (!!challengeTypes && challengeTypes.length > 0) {
+            challengeTypes.forEach((challengeType) => {
+                const lowerCaseChallengeType = challengeType.toLowerCase();
+                if (
+                    lowerCaseChallengeType !== ChallengeType.PASSWORD &&
+                    lowerCaseChallengeType !== ChallengeType.OOB &&
+                    lowerCaseChallengeType !== ChallengeType.REDIRECT
+                ) {
+                    throw new InvalidConfigurationError(
+                        InvalidChallengeType,
+                        `Challenge type ${challengeType} in the configuration are not valid. Supported challenge types are ${Object.values(
+                            ChallengeType
+                        )}`
+                    );
+                }
+            });
+        }
+    }
+}

package/src/custom_auth/ICustomAuthPublicClientApplication.ts

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { GetAccountResult } from "./get_account/auth_flow/result/GetAccountResult.js";
+import { SignInResult } from "./sign_in/auth_flow/result/SignInResult.js";
+import { SignUpResult } from "./sign_up/auth_flow/result/SignUpResult.js";
+import {
+    AccountRetrievalInputs,
+    ResetPasswordInputs,
+    SignInInputs,
+    SignUpInputs,
+} from "./CustomAuthActionInputs.js";
+import { ResetPasswordStartResult } from "./reset_password/auth_flow/result/ResetPasswordStartResult.js";
+import { IPublicClientApplication } from "../app/IPublicClientApplication.js";
+
+export interface ICustomAuthPublicClientApplication
+    extends IPublicClientApplication {
+    /**
+     * Gets the current account from the cache.
+     * @param {AccountRetrievalInputs} accountRetrievalInputs - Inputs for getting the current cached account
+     * @returns {GetAccountResult} The result of the operation
+     */
+    getCurrentAccount(
+        accountRetrievalInputs?: AccountRetrievalInputs
+    ): GetAccountResult;
+
+    /**
+     * Initiates the sign-in flow.
+     * @param {SignInInputs} signInInputs - Inputs for the sign-in flow
+     * @returns {Promise<SignInResult>} A promise that resolves to SignInResult
+     */
+    signIn(signInInputs: SignInInputs): Promise<SignInResult>;
+
+    /**
+     * Initiates the sign-up flow.
+     * @param {SignUpInputs} signUpInputs - Inputs for the sign-up flow
+     * @returns {Promise<SignUpResult>} A promise that resolves to SignUpResult
+     */
+    signUp(signUpInputs: SignUpInputs): Promise<SignUpResult>;
+
+    /**
+     * Initiates the reset password flow.
+     * @param {ResetPasswordInputs} resetPasswordInputs - Inputs for the reset password flow
+     * @returns {Promise<ResetPasswordStartResult>} A promise that resolves to ResetPasswordStartResult
+     */
+    resetPassword(
+        resetPasswordInputs: ResetPasswordInputs
+    ): Promise<ResetPasswordStartResult>;
+}

package/src/custom_auth/UserAccountAttributes.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type UserAccountAttributes = Record<string, string> & {
+    city?: string;
+    country?: string;
+    displayName?: string;
+    givenName?: string;
+    jobTitle?: string;
+    postalCode?: string;
+    state?: string;
+    streetAddress?: string;
+    surname?: string;
+};

package/src/custom_auth/configuration/CustomAuthConfiguration.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    BrowserConfiguration,
+    Configuration,
+} from "../../config/Configuration.js";
+
+export type CustomAuthOptions = {
+    challengeTypes?: Array<string>;
+    authApiProxyUrl: string;
+};
+
+export type CustomAuthConfiguration = Configuration & {
+    customAuth: CustomAuthOptions;
+};
+
+export type CustomAuthBrowserConfiguration = BrowserConfiguration & {
+    customAuth: CustomAuthOptions;
+};