@azure/msal-browser 4.22.1 → 4.23.0

package/src/custom_auth/core/network_client/custom_auth_api/CustomAuthApiClient.ts

@@ -6,6 +6,7 @@
 import { ResetPasswordApiClient } from "./ResetPasswordApiClient.js";
 import { SignupApiClient } from "./SignupApiClient.js";
 import { SignInApiClient } from "./SignInApiClient.js";
+import { RegisterApiClient } from "./RegisterApiClient.js";
 import { ICustomAuthApiClient } from "./ICustomAuthApiClient.js";
 import { IHttpClient } from "../http_client/IHttpClient.js";
 
@@ -13,6 +14,7 @@ export class CustomAuthApiClient implements ICustomAuthApiClient {
     signInApi: SignInApiClient;
     signUpApi: SignupApiClient;
     resetPasswordApi: ResetPasswordApiClient;
+    registerApi: RegisterApiClient;
 
     constructor(
         customAuthApiBaseUrl: string,
@@ -42,5 +44,10 @@ export class CustomAuthApiClient implements ICustomAuthApiClient {
             capabilities,
             customAuthApiQueryParams
         );
+        this.registerApi = new RegisterApiClient(
+            customAuthApiBaseUrl,
+            clientId,
+            httpClient
+        );
     }
 }

package/src/custom_auth/core/network_client/custom_auth_api/CustomAuthApiEndpoint.ts

@@ -16,3 +16,7 @@ export const RESET_PWD_CHALLENGE = "/resetpassword/v1.0/challenge";
 export const RESET_PWD_CONTINUE = "/resetpassword/v1.0/continue";
 export const RESET_PWD_SUBMIT = "/resetpassword/v1.0/submit";
 export const RESET_PWD_POLL = "/resetpassword/v1.0/poll_completion";
+
+export const REGISTER_INTROSPECT = "/register/v1.0/introspect";
+export const REGISTER_CHALLENGE = "/register/v1.0/challenge";
+export const REGISTER_CONTINUE = "/register/v1.0/continue";

package/src/custom_auth/core/network_client/custom_auth_api/ICustomAuthApiClient.ts

@@ -6,8 +6,10 @@
 import { ResetPasswordApiClient } from "./ResetPasswordApiClient.js";
 import { SignupApiClient } from "./SignupApiClient.js";
 import { SignInApiClient } from "./SignInApiClient.js";
+import { RegisterApiClient } from "./RegisterApiClient.js";
 export interface ICustomAuthApiClient {
     signInApi: SignInApiClient;
     signUpApi: SignupApiClient;
     resetPasswordApi: ResetPasswordApiClient;
+    registerApi: RegisterApiClient;
 }

package/src/custom_auth/core/network_client/custom_auth_api/RegisterApiClient.ts

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { BaseApiClient } from "./BaseApiClient.js";
+import * as CustomAuthApiEndpoint from "./CustomAuthApiEndpoint.js";
+import {
+    RegisterIntrospectRequest,
+    RegisterChallengeRequest,
+    RegisterContinueRequest,
+} from "./types/ApiRequestTypes.js";
+import {
+    RegisterIntrospectResponse,
+    RegisterChallengeResponse,
+    RegisterContinueResponse,
+} from "./types/ApiResponseTypes.js";
+
+export class RegisterApiClient extends BaseApiClient {
+    /**
+     * Gets available authentication methods for registration
+     */
+    async introspect(
+        params: RegisterIntrospectRequest
+    ): Promise<RegisterIntrospectResponse> {
+        const result = await this.request<RegisterIntrospectResponse>(
+            CustomAuthApiEndpoint.REGISTER_INTROSPECT,
+            {
+                continuation_token: params.continuation_token,
+            },
+            params.telemetryManager,
+            params.correlationId
+        );
+
+        this.ensureContinuationTokenIsValid(
+            result.continuation_token,
+            params.correlationId
+        );
+
+        return result;
+    }
+
+    /**
+     * Sends challenge to specified authentication method
+     */
+    async challenge(
+        params: RegisterChallengeRequest
+    ): Promise<RegisterChallengeResponse> {
+        const result = await this.request<RegisterChallengeResponse>(
+            CustomAuthApiEndpoint.REGISTER_CHALLENGE,
+            {
+                continuation_token: params.continuation_token,
+                challenge_type: params.challenge_type,
+                challenge_target: params.challenge_target,
+                ...(params.challenge_channel && {
+                    challenge_channel: params.challenge_channel,
+                }),
+            },
+            params.telemetryManager,
+            params.correlationId
+        );
+
+        this.ensureContinuationTokenIsValid(
+            result.continuation_token,
+            params.correlationId
+        );
+
+        return result;
+    }
+
+    /**
+     * Submits challenge response and continues registration
+     */
+    async continue(
+        params: RegisterContinueRequest
+    ): Promise<RegisterContinueResponse> {
+        const result = await this.request<RegisterContinueResponse>(
+            CustomAuthApiEndpoint.REGISTER_CONTINUE,
+            {
+                continuation_token: params.continuation_token,
+                grant_type: params.grant_type,
+                ...(params.oob && { oob: params.oob }),
+            },
+            params.telemetryManager,
+            params.correlationId
+        );
+
+        this.ensureContinuationTokenIsValid(
+            result.continuation_token,
+            params.correlationId
+        );
+
+        return result;
+    }
+}

package/src/custom_auth/core/network_client/custom_auth_api/SignInApiClient.ts

@@ -84,6 +84,7 @@ export class SignInApiClient extends BaseApiClient {
             {
                 continuation_token: params.continuation_token,
                 challenge_type: params.challenge_type,
+                ...(params.id && { id: params.id }),
             },
             params.telemetryManager,
             params.correlationId
@@ -141,11 +142,11 @@ export class SignInApiClient extends BaseApiClient {
         return this.requestTokens(
             {
                 continuation_token: params.continuation_token,
-                username: params.username,
                 scope: params.scope,
                 grant_type: GrantType.CONTINUATION_TOKEN,
                 client_info: true,
                 ...(params.claims && { claims: params.claims }),
+                ...(params.username && { username: params.username }),
             },
             params.telemetryManager,
             params.correlationId

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiRequestTypes.ts

@@ -14,6 +14,7 @@ export interface SignInInitiateRequest extends ApiRequestBase {
 export interface SignInChallengeRequest extends ApiRequestBase {
     challenge_type: string;
     continuation_token: string;
+    id?: string;
 }
 
 interface SignInTokenRequestBase extends ApiRequestBase {
@@ -31,7 +32,7 @@ export interface SignInOobTokenRequest extends SignInTokenRequestBase {
 }
 
 export interface SignInContinuationTokenRequest extends SignInTokenRequestBase {
-    username: string;
+    username?: string;
 }
 
 /* Sign-up API request types */
@@ -90,3 +91,21 @@ export interface ResetPasswordSubmitRequest extends ApiRequestBase {
 export interface ResetPasswordPollCompletionRequest extends ApiRequestBase {
     continuation_token: string;
 }
+
+/* Register API request types */
+export interface RegisterIntrospectRequest extends ApiRequestBase {
+    continuation_token: string;
+}
+
+export interface RegisterChallengeRequest extends ApiRequestBase {
+    continuation_token: string;
+    challenge_type: string;
+    challenge_target: string;
+    challenge_channel?: string;
+}
+
+export interface RegisterContinueRequest extends ApiRequestBase {
+    continuation_token: string;
+    grant_type: string;
+    oob?: string;
+}

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiResponseTypes.ts

@@ -38,6 +38,13 @@ export interface SignInTokenResponse extends ApiResponseBase {
     ext_expires_in?: number;
 }
 
+export interface AuthenticationMethod {
+    id: string;
+    challenge_type: string;
+    challenge_channel: string;
+    login_hint: string;
+}
+
 /* Sign-up API response types */
 export type SignUpStartResponse = InitiateResponse;
 
@@ -64,3 +71,23 @@ export interface ResetPasswordPollCompletionResponse
     extends ContinuousResponse {
     status: string;
 }
+
+/* Register API response types */
+export interface RegisterIntrospectResponse extends ApiResponseBase {
+    continuation_token: string;
+    methods: AuthenticationMethod[];
+}
+
+export interface RegisterChallengeResponse extends ApiResponseBase {
+    continuation_token: string;
+    challenge_type: string;
+    binding_method: string;
+    challenge_target: string;
+    challenge_channel: string;
+    code_length?: number;
+    interval?: number;
+}
+
+export interface RegisterContinueResponse extends ApiResponseBase {
+    continuation_token: string;
+}

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiSuberrors.ts

@@ -12,3 +12,4 @@ export const PASSWORD_IS_INVALID = "password_is_invalid";
 export const INVALID_OOB_VALUE = "invalid_oob_value";
 export const ATTRIBUTE_VALIATION_FAILED = "attribute_validation_failed";
 export const NATIVEAUTHAPI_DISABLED = "nativeauthapi_disabled";
+export const REGISTRATION_REQUIRED = "registration_required";

package/src/custom_auth/core/telemetry/PublicApiId.ts

@@ -35,3 +35,8 @@ export const PASSWORD_RESET_RESEND_CODE = 100044;
 export const ACCOUNT_GET_ACCOUNT = 100061;
 export const ACCOUNT_SIGN_OUT = 100062;
 export const ACCOUNT_GET_ACCESS_TOKEN = 100063;
+
+// JIT (Just-In-Time) Auth Method Registration
+export const JIT_GET_AUTH_METHODS = 100081;
+export const JIT_CHALLENGE_AUTH_METHOD = 100082;
+export const JIT_SUBMIT_CHALLENGE = 100083;

package/src/custom_auth/index.ts

@@ -20,8 +20,9 @@ export { ICustomAuthPublicClientApplication } from "./ICustomAuthPublicClientApp
 // Configuration
 export { CustomAuthConfiguration } from "./configuration/CustomAuthConfiguration.js";
 
-// Account Data
+// Models
 export { CustomAuthAccountData } from "./get_account/auth_flow/CustomAuthAccountData.js";
+export { AuthenticationMethod } from "./core/network_client/custom_auth_api/types/ApiResponseTypes.js";
 
 // Operation Inputs
 export {
@@ -50,13 +51,18 @@ export {
     SignInResult,
     SignInResultState,
 } from "./sign_in/auth_flow/result/SignInResult.js";
-export { SignInSubmitCodeResult } from "./sign_in/auth_flow/result/SignInSubmitCodeResult.js";
+export {
+    SignInSubmitCodeResult,
+    SignInSubmitCodeResultState,
+} from "./sign_in/auth_flow/result/SignInSubmitCodeResult.js";
 export {
     SignInResendCodeResult,
     SignInResendCodeResultState,
 } from "./sign_in/auth_flow/result/SignInResendCodeResult.js";
-export { SignInSubmitPasswordResult } from "./sign_in/auth_flow/result/SignInSubmitPasswordResult.js";
-export { SignInSubmitCredentialResultState } from "./sign_in/auth_flow/result/SignInSubmitCredentialResult.js";
+export {
+    SignInSubmitPasswordResult,
+    SignInSubmitPasswordResultState,
+} from "./sign_in/auth_flow/result/SignInSubmitPasswordResult.js";
 
 // Sign-in Errors
 export {
@@ -181,5 +187,30 @@ export { UnsupportedEnvironmentError } from "./core/error/UnsupportedEnvironment
 export { UserAccountAttributeError } from "./core/error/UserAccountAttributeError.js";
 export { UserAlreadySignedInError } from "./core/error/UserAlreadySignedInError.js";
 
+// Auth Method Registration State
+export { AuthMethodRegistrationRequiredState } from "./core/auth_flow/jit/state/AuthMethodRegistrationState.js";
+export { AuthMethodVerificationRequiredState } from "./core/auth_flow/jit/state/AuthMethodRegistrationState.js";
+export { AuthMethodRegistrationCompletedState } from "./core/auth_flow/jit/state/AuthMethodRegistrationCompletedState.js";
+export { AuthMethodRegistrationFailedState } from "./core/auth_flow/jit/state/AuthMethodRegistrationFailedState.js";
+
+// Auth Method Registration Results
+export {
+    AuthMethodRegistrationChallengeMethodResult,
+    AuthMethodRegistrationChallengeMethodResultState,
+} from "./core/auth_flow/jit/result/AuthMethodRegistrationChallengeMethodResult.js";
+export {
+    AuthMethodRegistrationSubmitChallengeResult,
+    AuthMethodRegistrationSubmitChallengeResultState,
+} from "./core/auth_flow/jit/result/AuthMethodRegistrationSubmitChallengeResult.js";
+
+// Auth Method Registration Errors
+export {
+    AuthMethodRegistrationChallengeMethodError,
+    AuthMethodRegistrationSubmitChallengeError,
+} from "./core/auth_flow/jit/error_type/AuthMethodRegistrationError.js";
+
+// Auth Method Registration Types
+export { AuthMethodDetails } from "./core/auth_flow/jit/AuthMethodDetails.js";
+
 // Components from msal_browser
 export { LogLevel } from "@azure/msal-common/browser";

package/src/custom_auth/reset_password/auth_flow/state/ResetPasswordCodeRequiredState.ts

@@ -55,6 +55,7 @@ export class ResetPasswordCodeRequiredState extends ResetPasswordState<ResetPass
                         this.stateParameters.resetPasswordClient,
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
+                    jitClient: this.stateParameters.jitClient,
                     username: this.stateParameters.username,
                 })
             );
@@ -106,6 +107,7 @@ export class ResetPasswordCodeRequiredState extends ResetPasswordState<ResetPass
                         this.stateParameters.resetPasswordClient,
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
+                    jitClient: this.stateParameters.jitClient,
                     username: this.stateParameters.username,
                     codeLength: result.codeLength,
                 })

package/src/custom_auth/reset_password/auth_flow/state/ResetPasswordPasswordRequiredState.ts

@@ -58,6 +58,7 @@ export class ResetPasswordPasswordRequiredState extends ResetPasswordState<Reset
                     username: this.stateParameters.username,
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
+                    jitClient: this.stateParameters.jitClient,
                     signInScenario: SignInScenario.SignInAfterPasswordReset,
                 })
             );

package/src/custom_auth/reset_password/auth_flow/state/ResetPasswordStateParameters.ts

@@ -7,6 +7,7 @@ import { ResetPasswordClient } from "../../interaction_client/ResetPasswordClien
 import { SignInClient } from "../../../sign_in/interaction_client/SignInClient.js";
 import { CustomAuthSilentCacheClient } from "../../../get_account/interaction_client/CustomAuthSilentCacheClient.js";
 import { AuthFlowActionRequiredStateParameters } from "../../../core/auth_flow/AuthFlowState.js";
+import { JitClient } from "../../../core/interaction_client/jit/JitClient.js";
 
 export interface ResetPasswordStateParameters
     extends AuthFlowActionRequiredStateParameters {
@@ -14,6 +15,7 @@ export interface ResetPasswordStateParameters
     resetPasswordClient: ResetPasswordClient;
     signInClient: SignInClient;
     cacheClient: CustomAuthSilentCacheClient;
+    jitClient: JitClient;
 }
 
 export type ResetPasswordPasswordRequiredStateParameters =

package/src/custom_auth/sign_in/auth_flow/result/SignInResult.ts

@@ -10,6 +10,7 @@ import { SignInCodeRequiredState } from "../state/SignInCodeRequiredState.js";
 import { SignInPasswordRequiredState } from "../state/SignInPasswordRequiredState.js";
 import { SignInFailedState } from "../state/SignInFailedState.js";
 import { SignInCompletedState } from "../state/SignInCompletedState.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 
 /*
  * Result of a sign-in operation.
@@ -70,6 +71,16 @@ export class SignInResult extends AuthFlowResultBase<
     isCompleted(): this is SignInResult & { state: SignInCompletedState } {
         return this.state instanceof SignInCompletedState;
     }
+
+    /**
+     * Checks if the result requires authentication method registration.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isAuthMethodRegistrationRequired(): this is SignInResult & {
+        state: AuthMethodRegistrationRequiredState;
+    } {
+        return this.state instanceof AuthMethodRegistrationRequiredState;
+    }
 }
 
 /**
@@ -79,9 +90,11 @@ export class SignInResult extends AuthFlowResultBase<
  * - SignInPasswordRequiredState: The sign-in process requires a password.
  * - SignInFailedState: The sign-in process has failed.
  * - SignInCompletedState: The sign-in process is completed.
+ * - AuthMethodRegistrationRequiredState: The sign-in process requires authentication method registration.
  */
 export type SignInResultState =
     | SignInCodeRequiredState
     | SignInPasswordRequiredState
     | SignInFailedState
-    | SignInCompletedState;
+    | SignInCompletedState
+    | AuthMethodRegistrationRequiredState;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitCodeResult.ts

@@ -6,12 +6,17 @@
 import { SignInSubmitCodeError } from "../error_type/SignInError.js";
 import { SignInCompletedState } from "../state/SignInCompletedState.js";
 import { SignInFailedState } from "../state/SignInFailedState.js";
-import { SignInSubmitCredentialResult } from "./SignInSubmitCredentialResult.js";
+import { AuthFlowResultBase } from "../../../core/auth_flow/AuthFlowResultBase.js";
+import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
 
 /*
  * Result of a sign-in submit code operation.
  */
-export class SignInSubmitCodeResult extends SignInSubmitCredentialResult<SignInSubmitCodeError> {
+export class SignInSubmitCodeResult extends AuthFlowResultBase<
+    SignInSubmitCodeResultState,
+    SignInSubmitCodeError,
+    CustomAuthAccountData
+> {
     /**
      * Creates a new instance of SignInSubmitCodeResult with error data.
      * @param error The error that occurred.
@@ -42,3 +47,13 @@ export class SignInSubmitCodeResult extends SignInSubmitCredentialResult<SignInS
         return this.state instanceof SignInCompletedState;
     }
 }
+
+/**
+ * The possible states of the SignInSubmitCodeResult.
+ * This includes:
+ * - SignInCompletedState: The sign-in process has completed successfully.
+ * - SignInFailedState: The sign-in process has failed.
+ */
+export type SignInSubmitCodeResultState =
+    | SignInCompletedState
+    | SignInFailedState;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitPasswordResult.ts

@@ -6,12 +6,18 @@
 import { SignInSubmitPasswordError } from "../error_type/SignInError.js";
 import { SignInCompletedState } from "../state/SignInCompletedState.js";
 import { SignInFailedState } from "../state/SignInFailedState.js";
-import { SignInSubmitCredentialResult } from "./SignInSubmitCredentialResult.js";
+import { AuthFlowResultBase } from "../../../core/auth_flow/AuthFlowResultBase.js";
+import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 
 /*
  * Result of a sign-in submit password operation.
  */
-export class SignInSubmitPasswordResult extends SignInSubmitCredentialResult<SignInSubmitPasswordError> {
+export class SignInSubmitPasswordResult extends AuthFlowResultBase<
+    SignInSubmitPasswordResultState,
+    SignInSubmitPasswordError,
+    CustomAuthAccountData
+> {
     static createWithError(error: unknown): SignInSubmitPasswordResult {
         const result = new SignInSubmitPasswordResult(new SignInFailedState());
         result.error = new SignInSubmitPasswordError(
@@ -38,4 +44,26 @@ export class SignInSubmitPasswordResult extends SignInSubmitCredentialResult<Sig
     } {
         return this.state instanceof SignInCompletedState;
     }
+
+    /**
+     * Checks if the result requires authentication method registration.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isAuthMethodRegistrationRequired(): this is SignInSubmitPasswordResult & {
+        state: AuthMethodRegistrationRequiredState;
+    } {
+        return this.state instanceof AuthMethodRegistrationRequiredState;
+    }
 }
+
+/**
+ * The possible states of the SignInSubmitPasswordResult.
+ * This includes:
+ * - SignInCompletedState: The sign-in process has completed successfully.
+ * - SignInFailedState: The sign-in process has failed.
+ * - AuthMethodRegistrationRequiredState: The sign-in process requires authentication method registration.
+ */
+export type SignInSubmitPasswordResultState =
+    | SignInCompletedState
+    | SignInFailedState
+    | AuthMethodRegistrationRequiredState;

package/src/custom_auth/sign_in/auth_flow/state/SignInCodeRequiredState.ts

@@ -114,6 +114,7 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                     config: this.stateParameters.config,
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
+                    jitClient: this.stateParameters.jitClient,
                     username: this.stateParameters.username,
                     codeLength: result.codeLength,
                     scopes: this.stateParameters.scopes,

package/src/custom_auth/sign_in/auth_flow/state/SignInContinuationState.ts

@@ -10,6 +10,11 @@ import { SignInWithContinuationTokenInputs } from "../../../CustomAuthActionInpu
 import { SignInContinuationStateParameters } from "./SignInStateParameters.js";
 import { SignInState } from "./SignInState.js";
 import { SignInCompletedState } from "./SignInCompletedState.js";
+import {
+    SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
+    SIGN_IN_COMPLETED_RESULT_TYPE,
+} from "../../interaction_client/result/SignInActionResult.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 import * as ArgumentValidator from "../../../core/utils/ArgumentValidator.js";
 
 /*
@@ -50,7 +55,7 @@ export class SignInContinuationState extends SignInState<SignInContinuationState
                 this.stateParameters.correlationId
             );
 
-            const completedResult =
+            const signInResult =
                 await this.stateParameters.signInClient.signInWithContinuationToken(
                     continuationTokenParams
                 );
@@ -60,15 +65,51 @@ export class SignInContinuationState extends SignInState<SignInContinuationState
                 this.stateParameters.correlationId
             );
 
-            const accountInfo = new CustomAuthAccountData(
-                completedResult.authenticationResult.account,
-                this.stateParameters.config,
-                this.stateParameters.cacheClient,
-                this.stateParameters.logger,
-                this.stateParameters.correlationId
-            );
+            if (signInResult.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
+                // Sign-in completed successfully
+                const accountInfo = new CustomAuthAccountData(
+                    signInResult.authenticationResult.account,
+                    this.stateParameters.config,
+                    this.stateParameters.cacheClient,
+                    this.stateParameters.logger,
+                    this.stateParameters.correlationId
+                );
 
-            return new SignInResult(new SignInCompletedState(), accountInfo);
+                return new SignInResult(
+                    new SignInCompletedState(),
+                    accountInfo
+                );
+            } else if (signInResult.type === SIGN_IN_JIT_REQUIRED_RESULT_TYPE) {
+                // JIT is required
+                this.stateParameters.logger.warning(
+                    "Auth method registration required during continuation token sign-in.",
+                    this.stateParameters.correlationId
+                );
+
+                // Return AuthMethodRegistrationRequiredState to handle JIT scenario
+                const authMethodRegistrationState =
+                    new AuthMethodRegistrationRequiredState({
+                        correlationId: this.stateParameters.correlationId,
+                        continuationToken: signInResult.continuationToken,
+                        logger: this.stateParameters.logger,
+                        config: this.stateParameters.config,
+                        jitClient: this.stateParameters.jitClient,
+                        cacheClient: this.stateParameters.cacheClient,
+                        authMethods: signInResult.authMethods,
+                        username: this.stateParameters.username,
+                        scopes: signInWithContinuationTokenInputs?.scopes ?? [],
+                        claims: this.stateParameters.claims,
+                    });
+
+                return new SignInResult(authMethodRegistrationState);
+            } else {
+                // Unexpected result type
+                const result = signInResult as { type: string };
+                const error = new Error(
+                    `Unexpected result type: ${result.type}`
+                );
+                return SignInResult.createWithError(error);
+            }
         } catch (error) {
             this.stateParameters.logger.errorPii(
                 `Failed to sign in with continuation token. Error: ${error}.`,

package/src/custom_auth/sign_in/auth_flow/state/SignInPasswordRequiredState.ts

@@ -9,6 +9,11 @@ import { SignInSubmitPasswordResult } from "../result/SignInSubmitPasswordResult
 import { SignInCompletedState } from "./SignInCompletedState.js";
 import { SignInState } from "./SignInState.js";
 import { SignInPasswordRequiredStateParameters } from "./SignInStateParameters.js";
+import {
+    SIGN_IN_COMPLETED_RESULT_TYPE,
+    SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
+} from "../../interaction_client/result/SignInActionResult.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 
 /*
  * Sign-in password required state.
@@ -42,7 +47,7 @@ export class SignInPasswordRequiredState extends SignInState<SignInPasswordRequi
                 this.stateParameters.correlationId
             );
 
-            const completedResult =
+            const submitPasswordResult =
                 await this.stateParameters.signInClient.submitPassword(
                     submitPasswordParams
                 );
@@ -52,18 +57,51 @@ export class SignInPasswordRequiredState extends SignInState<SignInPasswordRequi
                 this.stateParameters.correlationId
             );
 
-            const accountInfo = new CustomAuthAccountData(
-                completedResult.authenticationResult.account,
-                this.stateParameters.config,
-                this.stateParameters.cacheClient,
-                this.stateParameters.logger,
-                this.stateParameters.correlationId
-            );
+            if (submitPasswordResult.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
+                const accountInfo = new CustomAuthAccountData(
+                    submitPasswordResult.authenticationResult.account,
+                    this.stateParameters.config,
+                    this.stateParameters.cacheClient,
+                    this.stateParameters.logger,
+                    this.stateParameters.correlationId
+                );
 
-            return new SignInSubmitPasswordResult(
-                new SignInCompletedState(),
-                accountInfo
-            );
+                return new SignInSubmitPasswordResult(
+                    new SignInCompletedState(),
+                    accountInfo
+                );
+            } else if (
+                submitPasswordResult.type === SIGN_IN_JIT_REQUIRED_RESULT_TYPE
+            ) {
+                // JIT is required - return AuthMethodRegistrationRequiredState
+                this.stateParameters.logger.verbose(
+                    "Authentication method registration required after password submission.",
+                    this.stateParameters.correlationId
+                );
+
+                return new SignInSubmitPasswordResult(
+                    new AuthMethodRegistrationRequiredState({
+                        correlationId: this.stateParameters.correlationId,
+                        continuationToken:
+                            submitPasswordResult.continuationToken,
+                        logger: this.stateParameters.logger,
+                        config: this.stateParameters.config,
+                        jitClient: this.stateParameters.jitClient,
+                        cacheClient: this.stateParameters.cacheClient,
+                        authMethods: submitPasswordResult.authMethods,
+                        username: this.stateParameters.username,
+                        scopes: this.stateParameters.scopes ?? [],
+                        claims: this.stateParameters.claims,
+                    })
+                );
+            } else {
+                // Unexpected result type
+                const result = submitPasswordResult as { type: string };
+                const error = new Error(
+                    `Unexpected result type: ${result.type}`
+                );
+                return SignInSubmitPasswordResult.createWithError(error);
+            }
         } catch (error) {
             this.stateParameters.logger.errorPii(
                 `Failed to sign in after submitting password. Error: ${error}.`,