@azure/msal-browser 4.18.0 → 4.20.0

package/src/cache/CacheHelpers.ts

@@ -4,16 +4,21 @@
  */
 
 import { TokenKeys } from "@azure/msal-common/browser";
-import { StaticCacheKeys } from "../utils/BrowserConstants.js";
 import { IWindowStorage } from "./IWindowStorage.js";
+import * as CacheKeys from "./CacheKeys.js";
 
 /**
  * Returns a list of cache keys for all known accounts
  * @param storage
  * @returns
  */
-export function getAccountKeys(storage: IWindowStorage<string>): Array<string> {
-    const accountKeys = storage.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+export function getAccountKeys(
+    storage: IWindowStorage<string>,
+    schemaVersion?: number
+): Array<string> {
+    const accountKeys = storage.getItem(
+        CacheKeys.getAccountKeysCacheKey(schemaVersion)
+    );
     if (accountKeys) {
         return JSON.parse(accountKeys);
     }
@@ -29,9 +34,12 @@ export function getAccountKeys(storage: IWindowStorage<string>): Array<string> {
  */
 export function getTokenKeys(
     clientId: string,
-    storage: IWindowStorage<string>
+    storage: IWindowStorage<string>,
+    schemaVersion?: number
 ): TokenKeys {
-    const item = storage.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${clientId}`);
+    const item = storage.getItem(
+        CacheKeys.getTokenKeysCacheKey(clientId, schemaVersion)
+    );
     if (item) {
         const tokenKeys = JSON.parse(item);
         if (

package/src/cache/CacheKeys.ts

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const PREFIX = "msal";
+const BROWSER_PREFIX = "browser";
+export const CACHE_KEY_SEPARATOR = "-";
+export const CREDENTIAL_SCHEMA_VERSION = 1;
+export const ACCOUNT_SCHEMA_VERSION = 1;
+
+export const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
+export const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
+export const BROWSER_PERF_ENABLED_KEY = `${PREFIX}.${BROWSER_PREFIX}.performance.enabled`;
+export const PLATFORM_AUTH_DOM_SUPPORT = `${PREFIX}.${BROWSER_PREFIX}.platform.auth.dom`;
+export const VERSION_CACHE_KEY = `${PREFIX}.version`;
+export const ACCOUNT_KEYS = "account.keys";
+export const TOKEN_KEYS = "token.keys";
+
+export function getAccountKeysCacheKey(
+    schema: number = ACCOUNT_SCHEMA_VERSION
+): string {
+    if (schema < 1) {
+        return `${PREFIX}.${ACCOUNT_KEYS}`;
+    }
+
+    return `${PREFIX}.${schema}.${ACCOUNT_KEYS}`;
+}
+
+export function getTokenKeysCacheKey(
+    clientId: string,
+    schema: number = CREDENTIAL_SCHEMA_VERSION
+): string {
+    if (schema < 1) {
+        return `${PREFIX}.${TOKEN_KEYS}.${clientId}`;
+    }
+
+    return `${PREFIX}.${schema}.${TOKEN_KEYS}.${clientId}`;
+}

package/src/cache/CookieStorage.ts

@@ -92,6 +92,11 @@ export class CookieStorage implements IWindowStorage<string> {
     containsKey(key: string): boolean {
         return this.getKeys().includes(key);
     }
+
+    decryptData(): Promise<object | null> {
+        // Cookie storage does not support encryption, so this method is a no-op
+        return Promise.resolve(null);
+    }
 }
 
 /**

package/src/cache/EncryptedData.ts

@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type EncryptedData = {
+    id: string;
+    nonce: string;
+    data: string;
+    lastUpdatedAt: string;
+};
+
+export function isEncrypted(data: object): data is EncryptedData {
+    return (
+        data.hasOwnProperty("id") &&
+        data.hasOwnProperty("nonce") &&
+        data.hasOwnProperty("data")
+    );
+}

package/src/cache/IWindowStorage.ts

@@ -3,6 +3,8 @@
  * Licensed under the MIT License.
  */
 
+import { EncryptedData } from "./EncryptedData.js";
+
 export interface IWindowStorage<T> {
     /**
      * Async initializer
@@ -52,4 +54,10 @@ export interface IWindowStorage<T> {
      * @param key
      */
     containsKey(key: string): boolean;
+
+    decryptData(
+        key: string,
+        data: EncryptedData,
+        correlationId: string
+    ): Promise<object | null>;
 }

package/src/cache/LocalStorage.ts

@@ -4,7 +4,6 @@
  */
 
 import {
-    Constants,
     TokenKeys,
     IPerformanceClient,
     invokeAsync,
@@ -33,7 +32,8 @@ import { CookieStorage, SameSiteOptions } from "./CookieStorage.js";
 import { IWindowStorage } from "./IWindowStorage.js";
 import { MemoryStorage } from "./MemoryStorage.js";
 import { getAccountKeys, getTokenKeys } from "./CacheHelpers.js";
-import { StaticCacheKeys } from "../utils/BrowserConstants.js";
+import * as CacheKeys from "./CacheKeys.js";
+import { EncryptedData, isEncrypted } from "./EncryptedData.js";
 
 const ENCRYPTION_KEY = "msal.cache.encryption";
 const BROADCAST_CHANNEL_NAME = "msal.broadcast.cache";
@@ -43,13 +43,6 @@ type EncryptionCookie = {
     key: CryptoKey;
 };
 
-type EncryptedData = {
-    id: string;
-    nonce: string;
-    data: string;
-    lastUpdatedAt: string;
-};
-
 export class LocalStorage implements IWindowStorage<string> {
     private clientId: string;
     private initialized: boolean;
@@ -105,16 +98,8 @@ export class LocalStorage implements IWindowStorage<string> {
                     correlationId
                 )(baseKey),
             };
-            await invokeAsync(
-                this.importExistingCache.bind(this),
-                PerformanceEvents.ImportExistingCache,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(correlationId);
         } else {
-            // Encryption key doesn't exist or is invalid, generate a new one and clear existing cache
-            this.clear();
+            // Encryption key doesn't exist or is invalid, generate a new one
             const id = createNewGuid();
             const baseKey = await invokeAsync(
                 generateBaseKey,
@@ -155,6 +140,14 @@ export class LocalStorage implements IWindowStorage<string> {
             );
         }
 
+        await invokeAsync(
+            this.importExistingCache.bind(this),
+            PerformanceEvents.ImportExistingCache,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(correlationId);
+
         // Register listener for cache updates in other tabs
         this.broadcast.addEventListener("message", this.updateCache.bind(this));
 
@@ -174,6 +167,54 @@ export class LocalStorage implements IWindowStorage<string> {
         return this.memoryStorage.getItem(key);
     }
 
+    async decryptData(
+        key: string,
+        data: EncryptedData,
+        correlationId: string
+    ): Promise<object | null> {
+        if (!this.initialized || !this.encryptionCookie) {
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.uninitializedPublicClientApplication
+            );
+        }
+
+        if (data.id !== this.encryptionCookie.id) {
+            // Data was encrypted with a different key. It must be removed because it is from a previous session.
+            this.performanceClient.incrementFields(
+                { encryptedCacheExpiredCount: 1 },
+                correlationId
+            );
+            return null;
+        }
+
+        const decryptedData = await invokeAsync(
+            decrypt,
+            PerformanceEvents.Decrypt,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            this.encryptionCookie.key,
+            data.nonce,
+            this.getContext(key),
+            data.data
+        );
+
+        if (!decryptedData) {
+            return null;
+        }
+
+        try {
+            return JSON.parse(decryptedData);
+        } catch (e) {
+            this.performanceClient.incrementFields(
+                { encryptedCacheCorruptionCount: 1 },
+                correlationId
+            );
+            return null;
+        }
+    }
+
     setItem(key: string, value: string): void {
         window.localStorage.setItem(key, value);
     }
@@ -252,7 +293,7 @@ export class LocalStorage implements IWindowStorage<string> {
         // Clean up anything left
         this.getKeys().forEach((cacheKey: string) => {
             if (
-                cacheKey.startsWith(Constants.CACHE_PREFIX) ||
+                cacheKey.startsWith(CacheKeys.PREFIX) ||
                 cacheKey.indexOf(this.clientId) !== -1
             ) {
                 this.removeItem(cacheKey);
@@ -272,7 +313,14 @@ export class LocalStorage implements IWindowStorage<string> {
         let accountKeys = getAccountKeys(this);
         accountKeys = await this.importArray(accountKeys, correlationId);
         // Write valid account keys back to map
-        this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+        if (accountKeys.length) {
+            this.setItem(
+                CacheKeys.getAccountKeysCacheKey(),
+                JSON.stringify(accountKeys)
+            );
+        } else {
+            this.removeItem(CacheKeys.getAccountKeysCacheKey());
+        }
 
         const tokenKeys: TokenKeys = getTokenKeys(this.clientId, this);
         tokenKeys.idToken = await this.importArray(
@@ -288,10 +336,18 @@ export class LocalStorage implements IWindowStorage<string> {
             correlationId
         );
         // Write valid token keys back to map
-        this.setItem(
-            `${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`,
-            JSON.stringify(tokenKeys)
-        );
+        if (
+            tokenKeys.idToken.length ||
+            tokenKeys.accessToken.length ||
+            tokenKeys.refreshToken.length
+        ) {
+            this.setItem(
+                CacheKeys.getTokenKeysCacheKey(this.clientId),
+                JSON.stringify(tokenKeys)
+            );
+        } else {
+            this.removeItem(CacheKeys.getTokenKeysCacheKey(this.clientId));
+        }
     }
 
     /**
@@ -320,13 +376,13 @@ export class LocalStorage implements IWindowStorage<string> {
             return null;
         }
 
-        if (!encObj.id || !encObj.nonce || !encObj.data) {
-            // Data is not encrypted, likely from old version of MSAL. It must be removed because we don't know how old it is.
+        if (!isEncrypted(encObj)) {
+            // Data is not encrypted
             this.performanceClient.incrementFields(
                 { unencryptedCacheCount: 1 },
                 correlationId
             );
-            return null;
+            return encObj;
         }
 
         if (encObj.id !== this.encryptionCookie.id) {

package/src/cache/MemoryStorage.ts

@@ -51,4 +51,9 @@ export class MemoryStorage<T> implements IWindowStorage<T> {
     clear(): void {
         this.cache.clear();
     }
+
+    decryptData(): Promise<object | null> {
+        // Memory storage does not support encryption, so this method is a no-op
+        return Promise.resolve(null);
+    }
 }

package/src/cache/SessionStorage.ts

@@ -49,4 +49,9 @@ export class SessionStorage implements IWindowStorage<string> {
     containsKey(key: string): boolean {
         return window.sessionStorage.hasOwnProperty(key);
     }
+
+    decryptData(): Promise<object | null> {
+        // Session storage does not support encryption, so this method is a no-op
+        return Promise.resolve(null);
+    }
 }

package/src/config/Configuration.ts

@@ -132,6 +132,10 @@ export type CacheOptions = {
      * Used to specify the cacheLocation user wants to set. Valid values are "localStorage", "sessionStorage" and "memoryStorage".
      */
     cacheLocation?: BrowserCacheLocation | string;
+    /**
+     * Used to specify the number of days cache entries written by previous versions of MSAL.js should be retained in the browser. Defaults to 5 days.
+     */
+    cacheRetentionDays?: number;
     /**
      * Used to specify the temporaryCacheLocation user wants to set. Valid values are "localStorage", "sessionStorage" and "memoryStorage".
      * @deprecated This option is deprecated and will be removed in the next major version.
@@ -311,6 +315,7 @@ export function buildConfiguration(
     // Default cache options for browser
     const DEFAULT_CACHE_OPTIONS: Required<CacheOptions> = {
         cacheLocation: BrowserCacheLocation.SessionStorage,
+        cacheRetentionDays: 5,
         temporaryCacheLocation: BrowserCacheLocation.SessionStorage,
         storeAuthStateInCookie: false,
         secureCookies: false,

package/src/controllers/StandardController.ts

@@ -262,6 +262,7 @@ export class StandardController implements IController {
         // initialize in memory storage for native flows
         const nativeCacheOptions: Required<CacheOptions> = {
             cacheLocation: BrowserCacheLocation.MemoryStorage,
+            cacheRetentionDays: 5,
             temporaryCacheLocation: BrowserCacheLocation.MemoryStorage,
             storeAuthStateInCookie: false,
             secureCookies: false,
@@ -657,11 +658,12 @@ export class StandardController implements IController {
                     typeof onRedirectNavigateCb === "function"
                         ? onRedirectNavigateCb(url)
                         : undefined;
-                if (navigate !== false) {
-                    atrMeasurement.end({ success: true });
-                } else {
-                    atrMeasurement.discard();
-                }
+                atrMeasurement.add({
+                    navigateCallbackResult: navigate !== false,
+                });
+                atrMeasurement.event =
+                    atrMeasurement.end({ success: true }) ||
+                    atrMeasurement.event;
                 return navigate;
             };
         } else {
@@ -672,11 +674,12 @@ export class StandardController implements IController {
                     typeof configOnRedirectNavigateCb === "function"
                         ? configOnRedirectNavigateCb(url)
                         : undefined;
-                if (navigate !== false) {
-                    atrMeasurement.end({ success: true });
-                } else {
-                    atrMeasurement.discard();
-                }
+                atrMeasurement.add({
+                    navigateCallbackResult: navigate !== false,
+                });
+                atrMeasurement.event =
+                    atrMeasurement.end({ success: true }) ||
+                    atrMeasurement.event;
                 return navigate;
             };
         }
@@ -753,7 +756,21 @@ export class StandardController implements IController {
             return await result;
         } catch (e) {
             this.browserStorage.resetRequestCache();
-            atrMeasurement.end({ success: false }, e);
+            /*
+             * Pre-redirect event completes before navigation occurs.
+             * Timed out navigation needs to be instrumented separately as a post-redirect event.
+             */
+            if (atrMeasurement.event.status === 2) {
+                this.performanceClient
+                    .startMeasurement(
+                        PerformanceEvents.AcquireTokenRedirect,
+                        correlationId
+                    )
+                    .end({ success: false }, e);
+            } else {
+                atrMeasurement.end({ success: false }, e);
+            }
+
             if (isLoggedIn) {
                 this.eventHandler.emitEvent(
                     EventType.ACQUIRE_TOKEN_FAILURE,

package/src/interaction_client/BaseInteractionClient.ts

@@ -8,7 +8,6 @@ import {
     INetworkModule,
     Logger,
     AccountInfo,
-    AccountEntity,
     UrlString,
     ServerTelemetryManager,
     ServerTelemetryRequest,
@@ -91,22 +90,9 @@ export abstract class BaseInteractionClient {
         account?: AccountInfo | null
     ): Promise<void> {
         if (account) {
-            if (
-                AccountEntity.accountInfoIsEqual(
-                    account,
-                    this.browserStorage.getActiveAccount(correlationId),
-                    false
-                )
-            ) {
-                this.logger.verbose("Setting active account to null");
-                this.browserStorage.setActiveAccount(null, correlationId);
-            }
             // Clear given account.
             try {
-                this.browserStorage.removeAccount(
-                    AccountEntity.generateAccountCacheKey(account),
-                    correlationId
-                );
+                this.browserStorage.removeAccount(account, correlationId);
                 this.logger.verbose(
                     "Cleared cache items belonging to the account provided in the logout request."
                 );

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -722,9 +722,11 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
     ): Promise<void> {
         // Store the account info and hence `nativeAccountId` in browser cache
         await this.browserStorage.setAccount(accountEntity, this.correlationId);
-
         // Remove any existing cached tokens for this account in browser storage
-        this.browserStorage.removeAccountContext(accountEntity, correlationId);
+        this.browserStorage.removeAccountContext(
+            accountEntity.getAccountInfo(),
+            correlationId
+        );
     }
 
     /**

package/src/interaction_client/PopupClient.ts

@@ -604,11 +604,6 @@ export class PopupClient extends StandardInteractionClient {
                     validRequest.postLogoutRedirectUri &&
                     authClient.authority.protocolMode === ProtocolMode.OIDC
                 ) {
-                    this.browserStorage.removeAccount(
-                        validRequest.account?.homeAccountId,
-                        this.correlationId
-                    );
-
                     this.eventHandler.emitEvent(
                         EventType.LOGOUT_SUCCESS,
                         InteractionType.Popup,

package/src/interaction_client/RedirectClient.ts

@@ -768,11 +768,6 @@ export class RedirectClient extends StandardInteractionClient {
                     authClient.authority.endSessionEndpoint;
                 } catch {
                     if (validLogoutRequest.account?.homeAccountId) {
-                        this.browserStorage.removeAccount(
-                            validLogoutRequest.account?.homeAccountId,
-                            this.correlationId
-                        );
-
                         this.eventHandler.emitEvent(
                             EventType.LOGOUT_SUCCESS,
                             InteractionType.Redirect,

package/src/naa/AccountInfo.ts

@@ -13,4 +13,5 @@ export type AccountInfo = {
     idToken?: string; // idTokenClaims can be parsed from idToken in MSAL.js
     platformBrokerId?: string; // Used by WAM previous called nativeAccountId
     idTokenClaims?: object;
+    loginHint?: string;
 };

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -190,6 +190,9 @@ export class NestedAppAuthAdapter {
 
         const name = fromAccount.name || effectiveIdTokenClaims?.name;
 
+        const loginHint =
+            fromAccount.loginHint || effectiveIdTokenClaims?.login_hint;
+
         const tenantProfiles = new Map<string, TenantProfile>();
 
         const tenantProfile = buildTenantProfile(
@@ -207,6 +210,7 @@ export class NestedAppAuthAdapter {
             username,
             localAccountId,
             name,
+            loginHint,
             idToken: idToken,
             idTokenClaims: effectiveIdTokenClaims,
             tenantProfiles,

package/src/operatingcontext/BaseOperatingContext.ts

@@ -10,11 +10,8 @@ import {
     Configuration,
 } from "../config/Configuration.js";
 import { version, name } from "../packageMetadata.js";
-import {
-    BrowserCacheLocation,
-    LOG_LEVEL_CACHE_KEY,
-    LOG_PII_CACHE_KEY,
-} from "../utils/BrowserConstants.js";
+import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
+import { LOG_LEVEL_CACHE_KEY, LOG_PII_CACHE_KEY } from "../cache/CacheKeys.js";
 
 /**
  * Base class for operating context

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.18.0";
+export const version = "4.20.0";

package/src/telemetry/BrowserPerformanceClient.ts

@@ -16,11 +16,9 @@ import {
 } from "@azure/msal-common/browser";
 import { Configuration } from "../config/Configuration.js";
 import { name, version } from "../packageMetadata.js";
-import {
-    BROWSER_PERF_ENABLED_KEY,
-    BrowserCacheLocation,
-} from "../utils/BrowserConstants.js";
+import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
 import * as BrowserCrypto from "../crypto/BrowserCrypto.js";
+import { BROWSER_PERF_ENABLED_KEY } from "../cache/CacheKeys.js";
 
 /**
  * Returns browser performance measurement module if session flag is enabled. Returns undefined otherwise.

package/src/utils/BrowserConstants.ts

@@ -100,14 +100,6 @@ export const TemporaryCacheKeys = {
 export type TemporaryCacheKeys =
     (typeof TemporaryCacheKeys)[keyof typeof TemporaryCacheKeys];
 
-export const StaticCacheKeys = {
-    ACCOUNT_KEYS: "msal.account.keys",
-    TOKEN_KEYS: "msal.token.keys",
-    VERSION: "msal.version",
-} as const;
-export type StaticCacheKeys =
-    (typeof StaticCacheKeys)[keyof typeof StaticCacheKeys];
-
 /**
  * Cache keys stored in-memory
  */
@@ -249,10 +241,3 @@ export const iFrameRenewalPolicies: CacheLookupPolicy[] = [
     CacheLookupPolicy.Skip,
     CacheLookupPolicy.RefreshTokenAndNetwork,
 ];
-
-export const LOG_LEVEL_CACHE_KEY = "msal.browser.log.level";
-export const LOG_PII_CACHE_KEY = "msal.browser.log.pii";
-
-export const BROWSER_PERF_ENABLED_KEY = "msal.browser.performance.enabled";
-
-export const PLATFORM_AUTH_DOM_SUPPORT = "msal.browser.platform.auth.dom";

package/src/utils/Helpers.ts

@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * Utility function to remove an element from an array in place.
+ * @param array - The array from which to remove the element.
+ * @param element - The element to remove from the array.
+ */
+export function removeElementFromArray(
+    array: Array<string>,
+    element: string
+): void {
+    const index = array.indexOf(element);
+    if (index > -1) {
+        array.splice(index, 1);
+    }
+}