@azure/msal-browser 4.15.0 → 4.18.0

package/src/custom_auth/core/network_client/custom_auth_api/SignInApiClient.ts

@@ -90,6 +90,7 @@ export class SignInApiClient extends BaseApiClient {
                 grant_type: GrantType.PASSWORD,
                 scope: params.scope,
                 password: params.password,
+                ...(params.claims && { claims: params.claims }),
             },
             params.telemetryManager,
             params.correlationId
@@ -105,6 +106,7 @@ export class SignInApiClient extends BaseApiClient {
                 scope: params.scope,
                 oob: params.oob,
                 grant_type: GrantType.OOB,
+                ...(params.claims && { claims: params.claims }),
             },
             params.telemetryManager,
             params.correlationId
@@ -121,6 +123,7 @@ export class SignInApiClient extends BaseApiClient {
                 scope: params.scope,
                 grant_type: GrantType.CONTINUATION_TOKEN,
                 client_info: true,
+                ...(params.claims && { claims: params.claims }),
             },
             params.telemetryManager,
             params.correlationId

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiRequestTypes.ts

@@ -19,6 +19,7 @@ export interface SignInChallengeRequest extends ApiRequestBase {
 interface SignInTokenRequestBase extends ApiRequestBase {
     continuation_token: string;
     scope: string;
+    claims?: string;
 }
 
 export interface SignInPasswordTokenRequest extends SignInTokenRequestBase {

package/src/custom_auth/core/utils/ArgumentValidator.ts

@@ -24,3 +24,25 @@ export function ensureArgumentIsNotEmptyString(
         throw new InvalidArgumentError(argName, correlationId);
     }
 }
+
+export function ensureArgumentIsJSONString(
+    argName: string,
+    argValue: string,
+    correlationId?: string
+): void {
+    try {
+        const parsed = JSON.parse(argValue);
+        if (
+            typeof parsed !== "object" ||
+            parsed === null ||
+            Array.isArray(parsed)
+        ) {
+            throw new InvalidArgumentError(argName, correlationId);
+        }
+    } catch (e) {
+        if (e instanceof SyntaxError) {
+            throw new InvalidArgumentError(argName, correlationId);
+        }
+        throw e; // Rethrow unexpected errors
+    }
+}

package/src/custom_auth/get_account/auth_flow/CustomAuthAccountData.ts

@@ -18,10 +18,7 @@ import {
     TokenClaims,
 } from "@azure/msal-common/browser";
 import { SilentRequest } from "../../../request/SilentRequest.js";
-import {
-    ensureArgumentIsNotEmptyString,
-    ensureArgumentIsNotNullOrUndefined,
-} from "../../core/utils/ArgumentValidator.js";
+import * as ArgumentValidator from "../../core/utils/ArgumentValidator.js";
 
 /*
  * Account information.
@@ -34,8 +31,15 @@ export class CustomAuthAccountData {
         private readonly logger: Logger,
         private readonly correlationId: string
     ) {
-        ensureArgumentIsNotEmptyString("correlationId", correlationId);
-        ensureArgumentIsNotNullOrUndefined("account", account, correlationId);
+        ArgumentValidator.ensureArgumentIsNotEmptyString(
+            "correlationId",
+            correlationId
+        );
+        ArgumentValidator.ensureArgumentIsNotNullOrUndefined(
+            "account",
+            account,
+            correlationId
+        );
     }
 
     /**
@@ -107,12 +111,20 @@ export class CustomAuthAccountData {
         accessTokenRetrievalInputs: AccessTokenRetrievalInputs
     ): Promise<GetAccessTokenResult> {
         try {
-            ensureArgumentIsNotNullOrUndefined(
+            ArgumentValidator.ensureArgumentIsNotNullOrUndefined(
                 "accessTokenRetrievalInputs",
                 accessTokenRetrievalInputs,
                 this.correlationId
             );
 
+            if (accessTokenRetrievalInputs.claims) {
+                ArgumentValidator.ensureArgumentIsJSONString(
+                    "accessTokenRetrievalInputs.claims",
+                    accessTokenRetrievalInputs.claims,
+                    this.correlationId
+                );
+            }
+
             this.logger.verbose("Getting current account.", this.correlationId);
 
             const currentAccount = this.cacheClient.getCurrentAccount(
@@ -133,7 +145,8 @@ export class CustomAuthAccountData {
             const commonSilentFlowRequest = this.createCommonSilentFlowRequest(
                 currentAccount,
                 accessTokenRetrievalInputs.forceRefresh,
-                newScopes
+                newScopes,
+                accessTokenRetrievalInputs.claims
             );
             const result = await this.cacheClient.acquireToken(
                 commonSilentFlowRequest
@@ -158,7 +171,8 @@ export class CustomAuthAccountData {
     private createCommonSilentFlowRequest(
         accountInfo: AccountInfo,
         forceRefresh: boolean = false,
-        requestScopes: Array<string>
+        requestScopes: Array<string>,
+        claims?: string
     ): CommonSilentFlowRequest {
         const silentRequest: SilentRequest = {
             authority: this.config.auth.authority,
@@ -171,6 +185,7 @@ export class CustomAuthAccountData {
                 accessToken: true,
                 refreshToken: true,
             },
+            ...(claims && { claims: claims }),
         };
 
         return {

package/src/custom_auth/sign_in/auth_flow/error_type/SignInError.ts

@@ -31,6 +31,14 @@ export class SignInError extends AuthActionErrorBase {
         return this.isPasswordIncorrectError();
     }
 
+    /**
+     * Checks if the error is due to password reset being required.
+     * @returns true if the error is due to password reset being required, false otherwise.
+     */
+    isPasswordResetRequired(): boolean {
+        return this.isPasswordResetRequiredError();
+    }
+
     /**
      * Checks if the error is due to the provided challenge type is not supported.
      * @returns {boolean} True if the error is due to the provided challenge type is not supported, false otherwise.

package/src/custom_auth/sign_in/auth_flow/state/SignInCodeRequiredState.ts

@@ -37,6 +37,7 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                 continuationToken: this.stateParameters.continuationToken ?? "",
                 code: code,
                 username: this.stateParameters.username,
+                claims: this.stateParameters.claims,
             };
 
             this.stateParameters.logger.verbose(

package/src/custom_auth/sign_in/auth_flow/state/SignInContinuationState.ts

@@ -10,6 +10,7 @@ import { SignInWithContinuationTokenInputs } from "../../../CustomAuthActionInpu
 import { SignInContinuationStateParameters } from "./SignInStateParameters.js";
 import { SignInState } from "./SignInState.js";
 import { SignInCompletedState } from "./SignInCompletedState.js";
+import * as ArgumentValidator from "../../../core/utils/ArgumentValidator.js";
 
 /*
  * Sign-in continuation state.
@@ -24,6 +25,14 @@ export class SignInContinuationState extends SignInState<SignInContinuationState
         signInWithContinuationTokenInputs?: SignInWithContinuationTokenInputs
     ): Promise<SignInResult> {
         try {
+            if (signInWithContinuationTokenInputs?.claims) {
+                ArgumentValidator.ensureArgumentIsJSONString(
+                    "signInWithContinuationTokenInputs.claims",
+                    signInWithContinuationTokenInputs.claims,
+                    this.stateParameters.correlationId
+                );
+            }
+
             const continuationTokenParams: SignInContinuationTokenParams = {
                 clientId: this.stateParameters.config.auth.clientId,
                 correlationId: this.stateParameters.correlationId,
@@ -33,6 +42,7 @@ export class SignInContinuationState extends SignInState<SignInContinuationState
                 continuationToken: this.stateParameters.continuationToken ?? "",
                 username: this.stateParameters.username,
                 signInScenario: this.stateParameters.signInScenario,
+                claims: signInWithContinuationTokenInputs?.claims,
             };
 
             this.stateParameters.logger.verbose(

package/src/custom_auth/sign_in/auth_flow/state/SignInPasswordRequiredState.ts

@@ -34,6 +34,7 @@ export class SignInPasswordRequiredState extends SignInState<SignInPasswordRequi
                 continuationToken: this.stateParameters.continuationToken ?? "",
                 password: password,
                 username: this.stateParameters.username,
+                claims: this.stateParameters.claims,
             };
 
             this.stateParameters.logger.verbose(

package/src/custom_auth/sign_in/auth_flow/state/SignInStateParameters.ts

@@ -13,6 +13,7 @@ export interface SignInStateParameters
     username: string;
     signInClient: SignInClient;
     cacheClient: CustomAuthSilentCacheClient;
+    claims?: string;
 }
 
 export interface SignInPasswordRequiredStateParameters

package/src/custom_auth/sign_in/interaction_client/SignInClient.ts

@@ -195,6 +195,9 @@ export class SignInClient extends CustomAuthInteractionClientBase {
             scope: scopes.join(" "),
             correlationId: parameters.correlationId,
             telemetryManager: telemetryManager,
+            ...(parameters.claims && {
+                claims: parameters.claims,
+            }),
         };
 
         return this.performTokenRequest(
@@ -230,6 +233,9 @@ export class SignInClient extends CustomAuthInteractionClientBase {
             scope: scopes.join(" "),
             correlationId: parameters.correlationId,
             telemetryManager: telemetryManager,
+            ...(parameters.claims && {
+                claims: parameters.claims,
+            }),
         };
 
         return this.performTokenRequest(
@@ -263,6 +269,9 @@ export class SignInClient extends CustomAuthInteractionClientBase {
             correlationId: parameters.correlationId,
             telemetryManager: telemetryManager,
             scope: scopes.join(" "),
+            ...(parameters.claims && {
+                claims: parameters.claims,
+            }),
         };
 
         // Call token endpoint.

package/src/custom_auth/sign_in/interaction_client/parameter/SignInParams.ts

@@ -24,16 +24,19 @@ export interface SignInSubmitCodeParams extends SignInParamsBase {
     continuationToken: string;
     code: string;
     scopes: Array<string>;
+    claims?: string;
 }
 
 export interface SignInSubmitPasswordParams extends SignInParamsBase {
     continuationToken: string;
     password: string;
     scopes: Array<string>;
+    claims?: string;
 }
 
 export interface SignInContinuationTokenParams extends SignInParamsBase {
     continuationToken: string;
     signInScenario: SignInScenarioType;
     scopes: Array<string>;
+    claims?: string;
 }

package/src/interaction_client/PopupClient.ts

@@ -19,6 +19,7 @@ import {
     invoke,
     PkceCodes,
     CommonAuthorizationUrlRequest,
+    HttpMethod,
 } from "@azure/msal-common/browser";
 import { StandardInteractionClient } from "./StandardInteractionClient.js";
 import { EventType } from "../event/EventType.js";
@@ -48,6 +49,7 @@ import { generatePkceCodes } from "../crypto/PkceGenerator.js";
 import { isPlatformAuthAllowed } from "../broker/nativeBroker/PlatformAuthProvider.js";
 import { generateEarKey } from "../crypto/BrowserCrypto.js";
 import { IPlatformAuthHandler } from "../broker/nativeBroker/IPlatformAuthHandler.js";
+import { validateRequestMethod } from "../request/RequestHelpers.js";
 
 export type PopupParams = {
     popup?: Window | null;
@@ -98,12 +100,13 @@ export class PopupClient extends StandardInteractionClient {
         request: PopupRequest,
         pkceCodes?: PkceCodes
     ): Promise<AuthenticationResult> {
+        let popupParams: PopupParams | undefined = undefined;
         try {
             const popupName = this.generatePopupName(
                 request.scopes || OIDC_DEFAULT_SCOPES,
                 request.authority || this.config.auth.authority
             );
-            const popupParams: PopupParams = {
+            popupParams = {
                 popupName,
                 popupWindowAttributes: request.popupWindowAttributes || {},
                 popupWindowParent: request.popupWindowParent ?? window,
@@ -124,6 +127,14 @@ export class PopupClient extends StandardInteractionClient {
                     pkceCodes
                 );
             } else {
+                // Pre-validate request method to avoid opening popup if the request is invalid
+                const validatedRequest: PopupRequest = {
+                    ...request,
+                    httpMethod: validateRequestMethod(
+                        request,
+                        this.config.auth.protocolMode
+                    ),
+                };
                 // asyncPopups flag is set to false. Opens popup before acquiring token.
                 this.logger.verbose(
                     "asyncPopup set to false, opening popup before acquiring token"
@@ -133,7 +144,7 @@ export class PopupClient extends StandardInteractionClient {
                     popupParams
                 );
                 return this.acquireTokenPopupAsync(
-                    request,
+                    validatedRequest,
                     popupParams,
                     pkceCodes
                 );
@@ -286,71 +297,80 @@ export class PopupClient extends StandardInteractionClient {
                 account: popupRequest.account,
             });
 
-            // Create acquire token url.
-            const navigateUrl = await invokeAsync(
-                Authorize.getAuthCodeRequestUrl,
-                PerformanceEvents.GetAuthCodeUrl,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(
-                this.config,
-                authClient.authority,
-                popupRequest,
-                this.logger,
-                this.performanceClient
-            );
+            if (popupRequest.httpMethod === HttpMethod.POST) {
+                return await this.executeCodeFlowWithPost(
+                    popupRequest,
+                    popupParams,
+                    authClient,
+                    pkce.verifier
+                );
+            } else {
+                // Create acquire token url.
+                const navigateUrl = await invokeAsync(
+                    Authorize.getAuthCodeRequestUrl,
+                    PerformanceEvents.GetAuthCodeUrl,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(
+                    this.config,
+                    authClient.authority,
+                    popupRequest,
+                    this.logger,
+                    this.performanceClient
+                );
 
-            // Show the UI once the url has been created. Get the window handle for the popup.
-            const popupWindow: Window = this.initiateAuthRequest(
-                navigateUrl,
-                popupParams
-            );
-            this.eventHandler.emitEvent(
-                EventType.POPUP_OPENED,
-                InteractionType.Popup,
-                { popupWindow },
-                null
-            );
+                // Show the UI once the url has been created. Get the window handle for the popup.
+                const popupWindow: Window = this.initiateAuthRequest(
+                    navigateUrl,
+                    popupParams
+                );
+                this.eventHandler.emitEvent(
+                    EventType.POPUP_OPENED,
+                    InteractionType.Popup,
+                    { popupWindow },
+                    null
+                );
 
-            // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const responseString = await this.monitorPopupForHash(
-                popupWindow,
-                popupParams.popupWindowParent
-            );
+                // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+                const responseString = await this.monitorPopupForHash(
+                    popupWindow,
+                    popupParams.popupWindowParent
+                );
 
-            const serverParams = invoke(
-                ResponseHandler.deserializeResponse,
-                PerformanceEvents.DeserializeResponse,
-                this.logger,
-                this.performanceClient,
-                this.correlationId
-            )(
-                responseString,
-                this.config.auth.OIDCOptions.serverResponseType,
-                this.logger
-            );
+                const serverParams = invoke(
+                    ResponseHandler.deserializeResponse,
+                    PerformanceEvents.DeserializeResponse,
+                    this.logger,
+                    this.performanceClient,
+                    this.correlationId
+                )(
+                    responseString,
+                    this.config.auth.OIDCOptions.serverResponseType,
+                    this.logger
+                );
 
-            return await invokeAsync(
-                Authorize.handleResponseCode,
-                PerformanceEvents.HandleResponseCode,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(
-                request,
-                serverParams,
-                pkce.verifier,
-                ApiId.acquireTokenPopup,
-                this.config,
-                authClient,
-                this.browserStorage,
-                this.nativeStorage,
-                this.eventHandler,
-                this.logger,
-                this.performanceClient,
-                this.platformAuthProvider
-            );
+                return await invokeAsync(
+                    Authorize.handleResponseCode,
+                    PerformanceEvents.HandleResponseCode,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(
+                    request,
+                    serverParams,
+                    pkce.verifier,
+                    ApiId.acquireTokenPopup,
+                    this.config,
+                    authClient,
+                    this.browserStorage,
+                    this.nativeStorage,
+                    this.eventHandler,
+                    this.logger,
+                    this.performanceClient,
+                    this.platformAuthProvider
+                );
+            }
         } catch (e) {
             // Close the synchronous popup if an error is thrown before the window unload event is registered
             popupParams.popup?.close();
@@ -452,6 +472,84 @@ export class PopupClient extends StandardInteractionClient {
         );
     }
 
+    async executeCodeFlowWithPost(
+        request: CommonAuthorizationUrlRequest,
+        popupParams: PopupParams,
+        authClient: AuthorizationCodeClient,
+        pkceVerifier: string
+    ): Promise<AuthenticationResult> {
+        const correlationId = request.correlationId;
+        // Get the frame handle for the silent request
+        const discoveredAuthority = await invokeAsync(
+            this.getDiscoveredAuthority.bind(this),
+            PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )({
+            requestAuthority: request.authority,
+            requestAzureCloudOptions: request.azureCloudOptions,
+            requestExtraQueryParameters: request.extraQueryParameters,
+            account: request.account,
+        });
+
+        const popupWindow =
+            popupParams.popup || this.openPopup("about:blank", popupParams);
+
+        const form = await Authorize.getCodeForm(
+            popupWindow.document,
+            this.config,
+            discoveredAuthority,
+            request,
+            this.logger,
+            this.performanceClient
+        );
+
+        form.submit();
+
+        // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+        const responseString = await invokeAsync(
+            this.monitorPopupForHash.bind(this),
+            PerformanceEvents.SilentHandlerMonitorIframeForHash,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(popupWindow, popupParams.popupWindowParent);
+
+        const serverParams = invoke(
+            ResponseHandler.deserializeResponse,
+            PerformanceEvents.DeserializeResponse,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(
+            responseString,
+            this.config.auth.OIDCOptions.serverResponseType,
+            this.logger
+        );
+
+        return invokeAsync(
+            Authorize.handleResponseCode,
+            PerformanceEvents.HandleResponseCode,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            request,
+            serverParams,
+            pkceVerifier,
+            ApiId.acquireTokenPopup,
+            this.config,
+            authClient,
+            this.browserStorage,
+            this.nativeStorage,
+            this.eventHandler,
+            this.logger,
+            this.performanceClient,
+            this.platformAuthProvider
+        );
+    }
+
     /**
      *
      * @param validRequest