@azure/msal-browser 4.22.1 → 4.23.0

package/src/custom_auth/controller/CustomAuthStandardController.ts

@@ -29,6 +29,8 @@ import { DefaultPackageInfo } from "../CustomAuthConstants.js";
 import {
     SIGN_IN_CODE_SEND_RESULT_TYPE,
     SIGN_IN_PASSWORD_REQUIRED_RESULT_TYPE,
+    SIGN_IN_COMPLETED_RESULT_TYPE,
+    SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
 } from "../sign_in/interaction_client/result/SignInActionResult.js";
 import { SignUpClient } from "../sign_up/interaction_client/SignUpClient.js";
 import { CustomAuthInterationClientFactory } from "../core/interaction_client/CustomAuthInterationClientFactory.js";
@@ -40,6 +42,7 @@ import { ICustomAuthApiClient } from "../core/network_client/custom_auth_api/ICu
 import { CustomAuthApiClient } from "../core/network_client/custom_auth_api/CustomAuthApiClient.js";
 import { FetchHttpClient } from "../core/network_client/http_client/FetchHttpClient.js";
 import { ResetPasswordClient } from "../reset_password/interaction_client/ResetPasswordClient.js";
+import { JitClient } from "../core/interaction_client/jit/JitClient.js";
 import { NoCachedAccountFoundError } from "../core/error/NoCachedAccountFoundError.js";
 import * as ArgumentValidator from "../core/utils/ArgumentValidator.js";
 import { UserAlreadySignedInError } from "../core/error/UserAlreadySignedInError.js";
@@ -48,6 +51,7 @@ import { UnsupportedEnvironmentError } from "../core/error/UnsupportedEnvironmen
 import { SignInCodeRequiredState } from "../sign_in/auth_flow/state/SignInCodeRequiredState.js";
 import { SignInPasswordRequiredState } from "../sign_in/auth_flow/state/SignInPasswordRequiredState.js";
 import { SignInCompletedState } from "../sign_in/auth_flow/state/SignInCompletedState.js";
+import { AuthMethodRegistrationRequiredState } from "../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 import { SignUpCodeRequiredState } from "../sign_up/auth_flow/state/SignUpCodeRequiredState.js";
 import { SignUpPasswordRequiredState } from "../sign_up/auth_flow/state/SignUpPasswordRequiredState.js";
 import { ResetPasswordCodeRequiredState } from "../reset_password/auth_flow/state/ResetPasswordCodeRequiredState.js";
@@ -63,6 +67,7 @@ export class CustomAuthStandardController
     private readonly signInClient: SignInClient;
     private readonly signUpClient: SignUpClient;
     private readonly resetPasswordClient: ResetPasswordClient;
+    private readonly jitClient: JitClient;
     private readonly cacheClient: CustomAuthSilentCacheClient;
     private readonly customAuthConfig: CustomAuthBrowserConfiguration;
     private readonly authority: CustomAuthAuthority;
@@ -123,6 +128,7 @@ export class CustomAuthStandardController
         this.signUpClient = interactionClientFactory.create(SignUpClient);
         this.resetPasswordClient =
             interactionClientFactory.create(ResetPasswordClient);
+        this.jitClient = interactionClientFactory.create(JitClient);
         this.cacheClient = interactionClientFactory.create(
             CustomAuthSilentCacheClient
         );
@@ -235,6 +241,7 @@ export class CustomAuthStandardController
                         config: this.customAuthConfig,
                         signInClient: this.signInClient,
                         cacheClient: this.cacheClient,
+                        jitClient: this.jitClient,
                         username: signInInputs.username,
                         codeLength: startResult.codeLength,
                         scopes: signInInputs.scopes ?? [],
@@ -264,6 +271,7 @@ export class CustomAuthStandardController
                             config: this.customAuthConfig,
                             signInClient: this.signInClient,
                             cacheClient: this.cacheClient,
+                            jitClient: this.jitClient,
                             username: signInInputs.username,
                             scopes: signInInputs.scopes ?? [],
                             claims: signInInputs.claims,
@@ -289,24 +297,61 @@ export class CustomAuthStandardController
                     claims: signInInputs.claims,
                 };
 
-                const completedResult = await this.signInClient.submitPassword(
-                    submitPasswordParams
-                );
+                const submitPasswordResult =
+                    await this.signInClient.submitPassword(
+                        submitPasswordParams
+                    );
 
                 this.logger.verbose("Sign-in flow completed.", correlationId);
 
-                const accountInfo = new CustomAuthAccountData(
-                    completedResult.authenticationResult.account,
-                    this.customAuthConfig,
-                    this.cacheClient,
-                    this.logger,
-                    correlationId
-                );
+                if (
+                    submitPasswordResult.type === SIGN_IN_COMPLETED_RESULT_TYPE
+                ) {
+                    const accountInfo = new CustomAuthAccountData(
+                        submitPasswordResult.authenticationResult.account,
+                        this.customAuthConfig,
+                        this.cacheClient,
+                        this.logger,
+                        correlationId
+                    );
 
-                return new SignInResult(
-                    new SignInCompletedState(),
-                    accountInfo
-                );
+                    return new SignInResult(
+                        new SignInCompletedState(),
+                        accountInfo
+                    );
+                } else if (
+                    submitPasswordResult.type ===
+                    SIGN_IN_JIT_REQUIRED_RESULT_TYPE
+                ) {
+                    // Authentication method registration is required - create AuthMethodRegistrationRequiredState
+                    this.logger.verbose(
+                        "Authentication method registration required for sign-in.",
+                        correlationId
+                    );
+
+                    return new SignInResult(
+                        new AuthMethodRegistrationRequiredState({
+                            correlationId: correlationId,
+                            continuationToken:
+                                submitPasswordResult.continuationToken,
+                            logger: this.logger,
+                            config: this.customAuthConfig,
+                            jitClient: this.jitClient,
+                            cacheClient: this.cacheClient,
+                            authMethods: submitPasswordResult.authMethods,
+                            username: signInInputs.username,
+                            scopes: signInInputs.scopes ?? [],
+                            claims: signInInputs.claims,
+                        })
+                    );
+                } else {
+                    // Unexpected result type
+                    const result = submitPasswordResult as { type: string };
+                    const error = new Error(
+                        `Unexpected result type: ${result.type}`
+                    );
+                    return SignInResult.createWithError(error);
+                }
             }
 
             this.logger.error(
@@ -391,6 +436,7 @@ export class CustomAuthStandardController
                         signInClient: this.signInClient,
                         signUpClient: this.signUpClient,
                         cacheClient: this.cacheClient,
+                        jitClient: this.jitClient,
                         username: signUpInputs.username,
                         codeLength: startResult.codeLength,
                         codeResendInterval: startResult.interval,
@@ -414,6 +460,7 @@ export class CustomAuthStandardController
                         signInClient: this.signInClient,
                         signUpClient: this.signUpClient,
                         cacheClient: this.cacheClient,
+                        jitClient: this.jitClient,
                         username: signUpInputs.username,
                     })
                 );
@@ -483,6 +530,7 @@ export class CustomAuthStandardController
                     signInClient: this.signInClient,
                     resetPasswordClient: this.resetPasswordClient,
                     cacheClient: this.cacheClient,
+                    jitClient: this.jitClient,
                     username: resetPasswordInputs.username,
                     codeLength: startResult.codeLength,
                 })

package/src/custom_auth/core/auth_flow/AuthFlowErrorBase.ts

@@ -139,6 +139,14 @@ export abstract class AuthFlowErrorBase {
             this.errorData.errorCodes?.includes(50142) === true
         );
     }
+
+    protected isInvalidAuthMethodRegistrationInputError(): boolean {
+        return (
+            this.errorData instanceof CustomAuthApiError &&
+            this.errorData.error === CustomAuthApiErrorCode.INVALID_REQUEST &&
+            this.errorData.errorCodes?.includes(901001) === true
+        );
+    }
 }
 
 export abstract class AuthActionErrorBase extends AuthFlowErrorBase {

package/src/custom_auth/core/auth_flow/AuthFlowResultBase.ts

@@ -42,10 +42,24 @@ export abstract class AuthFlowResultBase<
         if (error instanceof CustomAuthError) {
             return error;
         } else if (error instanceof AuthError) {
+            const errorCodes: Array<number> = [];
+
+            if ("errorNo" in error) {
+                if (typeof error.errorNo === "string") {
+                    const code = Number(error.errorNo);
+                    if (!isNaN(code)) {
+                        errorCodes.push(code);
+                    }
+                } else if (typeof error.errorNo === "number") {
+                    errorCodes.push(error.errorNo);
+                }
+            }
+
             return new MsalCustomAuthError(
                 error.errorCode,
                 error.errorMessage,
                 error.subError,
+                errorCodes,
                 error.correlationId
             );
         } else {

package/src/custom_auth/core/auth_flow/AuthFlowState.ts

@@ -31,7 +31,7 @@ export abstract class AuthFlowActionRequiredStateBase<
      * Creates a new instance of AuthFlowActionRequiredStateBase.
      * @param stateParameters The parameters for the auth state.
      */
-    protected constructor(protected readonly stateParameters: TParameter) {
+    constructor(protected readonly stateParameters: TParameter) {
         ensureArgumentIsNotEmptyString(
             "correlationId",
             stateParameters.correlationId

package/src/custom_auth/core/auth_flow/jit/AuthMethodDetails.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthenticationMethod } from "../../network_client/custom_auth_api/types/ApiResponseTypes.js";
+
+/**
+ * Details for an authentication method to be registered.
+ */
+export interface AuthMethodDetails {
+    /**
+     * The authentication method type to register.
+     */
+    authMethodType: AuthenticationMethod;
+
+    /**
+     * The verification contact (email, phone number) for the authentication method.
+     */
+    verificationContact: string;
+}

package/src/custom_auth/core/auth_flow/jit/error_type/AuthMethodRegistrationError.ts

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthActionErrorBase } from "../../AuthFlowErrorBase.js";
+
+/**
+ * Error that occurred during authentication method challenge request.
+ */
+export class AuthMethodRegistrationChallengeMethodError extends AuthActionErrorBase {
+    /**
+     * Checks if the input for auth method registration is incorrect.
+     * @returns true if the input is incorrect, false otherwise.
+     */
+    isInvalidInput(): boolean {
+        return this.isInvalidAuthMethodRegistrationInputError();
+    }
+}
+
+/**
+ * Error that occurred during authentication method challenge submission.
+ */
+export class AuthMethodRegistrationSubmitChallengeError extends AuthActionErrorBase {
+    /**
+     * Checks if the submitted challenge code is incorrect.
+     * @returns true if the challenge code is incorrect, false otherwise.
+     */
+    isIncorrectChallenge(): boolean {
+        return this.isInvalidCodeError();
+    }
+}

package/src/custom_auth/core/auth_flow/jit/result/AuthMethodRegistrationChallengeMethodResult.ts

@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthFlowResultBase } from "../../AuthFlowResultBase.js";
+import { AuthMethodRegistrationChallengeMethodError } from "../error_type/AuthMethodRegistrationError.js";
+import type { AuthMethodVerificationRequiredState } from "../state/AuthMethodRegistrationState.js";
+import { CustomAuthAccountData } from "../../../../get_account/auth_flow/CustomAuthAccountData.js";
+import { AuthMethodRegistrationCompletedState } from "../state/AuthMethodRegistrationCompletedState.js";
+import { AuthMethodRegistrationFailedState } from "../state/AuthMethodRegistrationFailedState.js";
+
+/**
+ * Result of challenging an authentication method for registration.
+ * Uses base state type to avoid circular dependencies.
+ */
+export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultBase<
+    AuthMethodRegistrationChallengeMethodResultState,
+    AuthMethodRegistrationChallengeMethodError,
+    CustomAuthAccountData
+> {
+    /**
+     * Creates an AuthMethodRegistrationChallengeMethodResult with an error.
+     * @param error The error that occurred.
+     * @returns The AuthMethodRegistrationChallengeMethodResult with error.
+     */
+    static createWithError(
+        error: unknown
+    ): AuthMethodRegistrationChallengeMethodResult {
+        const result = new AuthMethodRegistrationChallengeMethodResult(
+            new AuthMethodRegistrationFailedState()
+        );
+        result.error = new AuthMethodRegistrationChallengeMethodError(
+            AuthMethodRegistrationChallengeMethodResult.createErrorData(error)
+        );
+        return result;
+    }
+
+    /**
+     * Checks if the result indicates that verification is required.
+     * @returns true if verification is required, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isVerificationRequired(): boolean {
+        return (
+            this.state.constructor?.name ===
+            "AuthMethodVerificationRequiredState"
+        );
+    }
+
+    /**
+     * Checks if the result indicates that registration is completed (fast-pass scenario).
+     * @returns true if registration is completed, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isCompleted(): boolean {
+        return (
+            this.state.constructor?.name ===
+            "AuthMethodRegistrationCompletedState"
+        );
+    }
+
+    /**
+     * Checks if the result is in a failed state.
+     * @returns true if the result is failed, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isFailed(): boolean {
+        return this.state instanceof AuthMethodRegistrationFailedState;
+    }
+}
+
+/**
+ * Type definition for possible states in AuthMethodRegistrationChallengeMethodResult.
+ */
+export type AuthMethodRegistrationChallengeMethodResultState =
+    | AuthMethodVerificationRequiredState
+    | AuthMethodRegistrationCompletedState
+    | AuthMethodRegistrationFailedState;

package/src/custom_auth/core/auth_flow/jit/result/AuthMethodRegistrationSubmitChallengeResult.ts

@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthFlowResultBase } from "../../AuthFlowResultBase.js";
+import { AuthMethodRegistrationSubmitChallengeError } from "../error_type/AuthMethodRegistrationError.js";
+import { CustomAuthAccountData } from "../../../../get_account/auth_flow/CustomAuthAccountData.js";
+import { AuthMethodRegistrationFailedState } from "../state/AuthMethodRegistrationFailedState.js";
+import { AuthMethodRegistrationCompletedState } from "../state/AuthMethodRegistrationCompletedState.js";
+
+/**
+ * Result of submitting a challenge for authentication method registration.
+ */
+export class AuthMethodRegistrationSubmitChallengeResult extends AuthFlowResultBase<
+    AuthMethodRegistrationSubmitChallengeResultState,
+    AuthMethodRegistrationSubmitChallengeError,
+    CustomAuthAccountData
+> {
+    /**
+     * Creates an AuthMethodRegistrationSubmitChallengeResult with an error.
+     * @param error The error that occurred.
+     * @returns The AuthMethodRegistrationSubmitChallengeResult with error.
+     */
+    static createWithError(
+        error: unknown
+    ): AuthMethodRegistrationSubmitChallengeResult {
+        const result = new AuthMethodRegistrationSubmitChallengeResult(
+            new AuthMethodRegistrationFailedState()
+        );
+        result.error = new AuthMethodRegistrationSubmitChallengeError(
+            AuthMethodRegistrationSubmitChallengeResult.createErrorData(error)
+        );
+        return result;
+    }
+
+    /**
+     * Checks if the result indicates that registration is completed.
+     * @returns true if registration is completed, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isCompleted(): boolean {
+        return (
+            this.state.constructor?.name ===
+            "AuthMethodRegistrationCompletedState"
+        );
+    }
+
+    /**
+     * Checks if the result is in a failed state.
+     * @returns true if the result is failed, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isFailed(): boolean {
+        return this.state instanceof AuthMethodRegistrationFailedState;
+    }
+}
+
+/**
+ * Type definition for possible states in AuthMethodRegistrationSubmitChallengeResult.
+ */
+export type AuthMethodRegistrationSubmitChallengeResultState =
+    | AuthMethodRegistrationCompletedState
+    | AuthMethodRegistrationFailedState;

package/src/custom_auth/core/auth_flow/jit/state/AuthMethodRegistrationCompletedState.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthFlowStateBase } from "../../AuthFlowState.js";
+
+export class AuthMethodRegistrationCompletedState extends AuthFlowStateBase {}

package/src/custom_auth/core/auth_flow/jit/state/AuthMethodRegistrationFailedState.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthFlowStateBase } from "../../AuthFlowState.js";
+
+export class AuthMethodRegistrationFailedState extends AuthFlowStateBase {}