@azure/msal-browser 4.22.1 → 4.24.0

package/src/controllers/StandardController.ts

@@ -94,30 +94,15 @@ import {
 import { IPlatformAuthHandler } from "../broker/nativeBroker/IPlatformAuthHandler.js";
 import { collectInstanceStats } from "../utils/MsalFrameStatsUtils.js";
 
-function getAccountType(
-    account?: AccountInfo
-): "AAD" | "MSA" | "B2C" | undefined {
-    const idTokenClaims = account?.idTokenClaims;
-    if (idTokenClaims?.tfp || idTokenClaims?.acr) {
-        return "B2C";
-    }
-
-    if (!idTokenClaims?.tid) {
-        return undefined;
-    } else if (idTokenClaims?.tid === "9188040d-6c67-4c5b-b112-36a304b66dad") {
-        return "MSA";
-    }
-    return "AAD";
-}
-
 function preflightCheck(
     initialized: boolean,
-    performanceEvent: InProgressPerformanceEvent
+    performanceEvent: InProgressPerformanceEvent,
+    account?: AccountInfo
 ) {
     try {
         BrowserUtils.preflightCheck(initialized);
     } catch (e) {
-        performanceEvent.end({ success: false }, e);
+        performanceEvent.end({ success: false }, e, account);
         throw e;
     }
 }
@@ -572,17 +557,20 @@ export class StandardController implements IController {
                             "handleRedirectResponse returned result, acquire token success"
                         );
                     }
-                    rootMeasurement.end({
-                        success: true,
-                        accountType: getAccountType(result.account),
-                    });
+                    rootMeasurement.end(
+                        {
+                            success: true,
+                        },
+                        undefined,
+                        result.account
+                    );
                 } else {
                     /*
                      * Instrument an event only if an error code is set. Otherwise, discard it when the redirect response
                      * is empty and the error code is missing.
                      */
                     if (rootMeasurement.event.errorCode) {
-                        rootMeasurement.end({ success: false });
+                        rootMeasurement.end({ success: false }, undefined);
                     } else {
                         rootMeasurement.discard();
                     }
@@ -649,7 +637,6 @@ export class StandardController implements IController {
             correlationId
         );
         atrMeasurement.add({
-            accountType: getAccountType(request.account),
             scenarioId: request.scenarioId,
         });
 
@@ -665,8 +652,11 @@ export class StandardController implements IController {
                     navigateCallbackResult: navigate !== false,
                 });
                 atrMeasurement.event =
-                    atrMeasurement.end({ success: true }) ||
-                    atrMeasurement.event;
+                    atrMeasurement.end(
+                        { success: true },
+                        undefined,
+                        request.account
+                    ) || atrMeasurement.event;
                 return navigate;
             };
         } else {
@@ -681,8 +671,11 @@ export class StandardController implements IController {
                     navigateCallbackResult: navigate !== false,
                 });
                 atrMeasurement.event =
-                    atrMeasurement.end({ success: true }) ||
-                    atrMeasurement.event;
+                    atrMeasurement.end(
+                        { success: true },
+                        undefined,
+                        request.account
+                    ) || atrMeasurement.event;
                 return navigate;
             };
         }
@@ -774,9 +767,9 @@ export class StandardController implements IController {
                         PerformanceEvents.AcquireTokenRedirect,
                         correlationId
                     )
-                    .end({ success: false }, e);
+                    .end({ success: false }, e, request.account);
             } else {
-                atrMeasurement.end({ success: false }, e);
+                atrMeasurement.end({ success: false }, e, request.account);
             }
 
             if (isLoggedIn) {
@@ -818,12 +811,15 @@ export class StandardController implements IController {
 
         atPopupMeasurement.add({
             scenarioId: request.scenarioId,
-            accountType: getAccountType(request.account),
         });
 
         try {
             this.logger.verbose("acquireTokenPopup called", correlationId);
-            preflightCheck(this.initialized, atPopupMeasurement);
+            preflightCheck(
+                this.initialized,
+                atPopupMeasurement,
+                request.account
+            );
             this.browserStorage.setInteractionInProgress(
                 true,
                 INTERACTION_TYPE.SIGNIN
@@ -864,10 +860,13 @@ export class StandardController implements IController {
                 ApiId.acquireTokenPopup
             )
                 .then((response) => {
-                    atPopupMeasurement.end({
-                        success: true,
-                        accountType: getAccountType(response.account),
-                    });
+                    atPopupMeasurement.end(
+                        {
+                            success: true,
+                        },
+                        undefined,
+                        response.account
+                    );
                     return response;
                 })
                 .catch((e: AuthError) => {
@@ -919,12 +918,15 @@ export class StandardController implements IController {
                     );
                 }
 
-                atPopupMeasurement.end({
-                    success: true,
-                    accessTokenSize: result.accessToken.length,
-                    idTokenSize: result.idToken.length,
-                    accountType: getAccountType(result.account),
-                });
+                atPopupMeasurement.end(
+                    {
+                        success: true,
+                        accessTokenSize: result.accessToken.length,
+                        idTokenSize: result.idToken.length,
+                    },
+                    undefined,
+                    result.account
+                );
                 return result;
             })
             .catch((e: Error) => {
@@ -948,7 +950,8 @@ export class StandardController implements IController {
                     {
                         success: false,
                     },
-                    e
+                    e,
+                    request.account
                 );
 
                 // Since this function is syncronous we need to reject
@@ -1011,9 +1014,12 @@ export class StandardController implements IController {
         );
         this.ssoSilentMeasurement?.add({
             scenarioId: request.scenarioId,
-            accountType: getAccountType(request.account),
         });
-        preflightCheck(this.initialized, this.ssoSilentMeasurement);
+        preflightCheck(
+            this.initialized,
+            this.ssoSilentMeasurement,
+            request.account
+        );
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
         });
@@ -1067,12 +1073,15 @@ export class StandardController implements IController {
                     InteractionType.Silent,
                     response
                 );
-                this.ssoSilentMeasurement?.end({
-                    success: true,
-                    accessTokenSize: response.accessToken.length,
-                    idTokenSize: response.idToken.length,
-                    accountType: getAccountType(response.account),
-                });
+                this.ssoSilentMeasurement?.end(
+                    {
+                        success: true,
+                        accessTokenSize: response.accessToken.length,
+                        idTokenSize: response.idToken.length,
+                    },
+                    undefined,
+                    response.account
+                );
                 return response;
             })
             .catch((e: Error) => {
@@ -1086,7 +1095,8 @@ export class StandardController implements IController {
                     {
                         success: false,
                     },
-                    e
+                    e,
+                    request.account
                 );
                 throw e;
             })
@@ -1150,12 +1160,15 @@ export class StandardController implements IController {
                                 result
                             );
                             this.hybridAuthCodeResponses.delete(hybridAuthCode);
-                            atbcMeasurement.end({
-                                success: true,
-                                accessTokenSize: result.accessToken.length,
-                                idTokenSize: result.idToken.length,
-                                accountType: getAccountType(result.account),
-                            });
+                            atbcMeasurement.end(
+                                {
+                                    success: true,
+                                    accessTokenSize: result.accessToken.length,
+                                    idTokenSize: result.idToken.length,
+                                },
+                                undefined,
+                                result.account
+                            );
                             return result;
                         })
                         .catch((error: Error) => {
@@ -1211,10 +1224,13 @@ export class StandardController implements IController {
                         });
                         throw e;
                     });
-                    atbcMeasurement.end({
-                        accountType: getAccountType(result.account),
-                        success: true,
-                    });
+                    atbcMeasurement.end(
+                        {
+                            success: true,
+                        },
+                        undefined,
+                        result.account
+                    );
                     return result;
                 } else {
                     throw createBrowserAuthError(
@@ -2069,23 +2085,26 @@ export class StandardController implements IController {
             scenarioId: request.scenarioId,
         });
 
-        preflightCheck(this.initialized, atsMeasurement);
+        preflightCheck(this.initialized, atsMeasurement, request.account);
         this.logger.verbose("acquireTokenSilent called", correlationId);
 
         const account = request.account || this.getActiveAccount();
         if (!account) {
             throw createBrowserAuthError(BrowserAuthErrorCodes.noAccountError);
         }
-        atsMeasurement.add({ accountType: getAccountType(account) });
 
         return this.acquireTokenSilentDeduped(request, account, correlationId)
             .then((result) => {
-                atsMeasurement.end({
-                    success: true,
-                    fromCache: result.fromCache,
-                    accessTokenSize: result.accessToken.length,
-                    idTokenSize: result.idToken.length,
-                });
+                atsMeasurement.end(
+                    {
+                        success: true,
+                        fromCache: result.fromCache,
+                        accessTokenSize: result.accessToken.length,
+                        idTokenSize: result.idToken.length,
+                    },
+                    undefined,
+                    result.account
+                );
                 return {
                     ...result,
                     state: request.state,
@@ -2102,7 +2121,8 @@ export class StandardController implements IController {
                     {
                         success: false,
                     },
-                    error
+                    error,
+                    account
                 );
                 throw error;
             });
@@ -2317,14 +2337,12 @@ export class StandardController implements IController {
                     InteractionType.Silent,
                     response
                 );
-                if (request.correlationId) {
-                    this.performanceClient.addFields(
-                        {
-                            fromCache: response.fromCache,
-                        },
-                        request.correlationId
-                    );
-                }
+                this.performanceClient.addFields(
+                    {
+                        fromCache: response.fromCache,
+                    },
+                    request.correlationId
+                );
 
                 return response;
             })

package/src/custom_auth/CustomAuthConstants.ts

@@ -12,12 +12,14 @@ export const GrantType = {
     CONTINUATION_TOKEN: "continuation_token",
     REDIRECT: "redirect",
     ATTRIBUTES: "attributes",
+    MFA_OOB: "mfa_oob",
 } as const;
 
 export const ChallengeType = {
     PASSWORD: "password",
     OOB: "oob",
     REDIRECT: "redirect",
+    PREVERIFIED: "preverified",
 } as const;
 
 export const DefaultScopes = [

package/src/custom_auth/controller/CustomAuthStandardController.ts

@@ -29,6 +29,8 @@ import { DefaultPackageInfo } from "../CustomAuthConstants.js";
 import {
     SIGN_IN_CODE_SEND_RESULT_TYPE,
     SIGN_IN_PASSWORD_REQUIRED_RESULT_TYPE,
+    SIGN_IN_COMPLETED_RESULT_TYPE,
+    SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
 } from "../sign_in/interaction_client/result/SignInActionResult.js";
 import { SignUpClient } from "../sign_up/interaction_client/SignUpClient.js";
 import { CustomAuthInterationClientFactory } from "../core/interaction_client/CustomAuthInterationClientFactory.js";
@@ -40,6 +42,7 @@ import { ICustomAuthApiClient } from "../core/network_client/custom_auth_api/ICu
 import { CustomAuthApiClient } from "../core/network_client/custom_auth_api/CustomAuthApiClient.js";
 import { FetchHttpClient } from "../core/network_client/http_client/FetchHttpClient.js";
 import { ResetPasswordClient } from "../reset_password/interaction_client/ResetPasswordClient.js";
+import { JitClient } from "../core/interaction_client/jit/JitClient.js";
 import { NoCachedAccountFoundError } from "../core/error/NoCachedAccountFoundError.js";
 import * as ArgumentValidator from "../core/utils/ArgumentValidator.js";
 import { UserAlreadySignedInError } from "../core/error/UserAlreadySignedInError.js";
@@ -48,6 +51,7 @@ import { UnsupportedEnvironmentError } from "../core/error/UnsupportedEnvironmen
 import { SignInCodeRequiredState } from "../sign_in/auth_flow/state/SignInCodeRequiredState.js";
 import { SignInPasswordRequiredState } from "../sign_in/auth_flow/state/SignInPasswordRequiredState.js";
 import { SignInCompletedState } from "../sign_in/auth_flow/state/SignInCompletedState.js";
+import { AuthMethodRegistrationRequiredState } from "../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 import { SignUpCodeRequiredState } from "../sign_up/auth_flow/state/SignUpCodeRequiredState.js";
 import { SignUpPasswordRequiredState } from "../sign_up/auth_flow/state/SignUpPasswordRequiredState.js";
 import { ResetPasswordCodeRequiredState } from "../reset_password/auth_flow/state/ResetPasswordCodeRequiredState.js";
@@ -63,6 +67,7 @@ export class CustomAuthStandardController
     private readonly signInClient: SignInClient;
     private readonly signUpClient: SignUpClient;
     private readonly resetPasswordClient: ResetPasswordClient;
+    private readonly jitClient: JitClient;
     private readonly cacheClient: CustomAuthSilentCacheClient;
     private readonly customAuthConfig: CustomAuthBrowserConfiguration;
     private readonly authority: CustomAuthAuthority;
@@ -123,6 +128,7 @@ export class CustomAuthStandardController
         this.signUpClient = interactionClientFactory.create(SignUpClient);
         this.resetPasswordClient =
             interactionClientFactory.create(ResetPasswordClient);
+        this.jitClient = interactionClientFactory.create(JitClient);
         this.cacheClient = interactionClientFactory.create(
             CustomAuthSilentCacheClient
         );
@@ -235,6 +241,7 @@ export class CustomAuthStandardController
                         config: this.customAuthConfig,
                         signInClient: this.signInClient,
                         cacheClient: this.cacheClient,
+                        jitClient: this.jitClient,
                         username: signInInputs.username,
                         codeLength: startResult.codeLength,
                         scopes: signInInputs.scopes ?? [],
@@ -264,6 +271,7 @@ export class CustomAuthStandardController
                             config: this.customAuthConfig,
                             signInClient: this.signInClient,
                             cacheClient: this.cacheClient,
+                            jitClient: this.jitClient,
                             username: signInInputs.username,
                             scopes: signInInputs.scopes ?? [],
                             claims: signInInputs.claims,
@@ -289,24 +297,61 @@ export class CustomAuthStandardController
                     claims: signInInputs.claims,
                 };
 
-                const completedResult = await this.signInClient.submitPassword(
-                    submitPasswordParams
-                );
+                const submitPasswordResult =
+                    await this.signInClient.submitPassword(
+                        submitPasswordParams
+                    );
 
                 this.logger.verbose("Sign-in flow completed.", correlationId);
 
-                const accountInfo = new CustomAuthAccountData(
-                    completedResult.authenticationResult.account,
-                    this.customAuthConfig,
-                    this.cacheClient,
-                    this.logger,
-                    correlationId
-                );
+                if (
+                    submitPasswordResult.type === SIGN_IN_COMPLETED_RESULT_TYPE
+                ) {
+                    const accountInfo = new CustomAuthAccountData(
+                        submitPasswordResult.authenticationResult.account,
+                        this.customAuthConfig,
+                        this.cacheClient,
+                        this.logger,
+                        correlationId
+                    );
 
-                return new SignInResult(
-                    new SignInCompletedState(),
-                    accountInfo
-                );
+                    return new SignInResult(
+                        new SignInCompletedState(),
+                        accountInfo
+                    );
+                } else if (
+                    submitPasswordResult.type ===
+                    SIGN_IN_JIT_REQUIRED_RESULT_TYPE
+                ) {
+                    // Authentication method registration is required - create AuthMethodRegistrationRequiredState
+                    this.logger.verbose(
+                        "Authentication method registration required for sign-in.",
+                        correlationId
+                    );
+
+                    return new SignInResult(
+                        new AuthMethodRegistrationRequiredState({
+                            correlationId: correlationId,
+                            continuationToken:
+                                submitPasswordResult.continuationToken,
+                            logger: this.logger,
+                            config: this.customAuthConfig,
+                            jitClient: this.jitClient,
+                            cacheClient: this.cacheClient,
+                            authMethods: submitPasswordResult.authMethods,
+                            username: signInInputs.username,
+                            scopes: signInInputs.scopes ?? [],
+                            claims: signInInputs.claims,
+                        })
+                    );
+                } else {
+                    // Unexpected result type
+                    const result = submitPasswordResult as { type: string };
+                    const error = new Error(
+                        `Unexpected result type: ${result.type}`
+                    );
+                    return SignInResult.createWithError(error);
+                }
             }
 
             this.logger.error(
@@ -391,6 +436,7 @@ export class CustomAuthStandardController
                         signInClient: this.signInClient,
                         signUpClient: this.signUpClient,
                         cacheClient: this.cacheClient,
+                        jitClient: this.jitClient,
                         username: signUpInputs.username,
                         codeLength: startResult.codeLength,
                         codeResendInterval: startResult.interval,
@@ -414,6 +460,7 @@ export class CustomAuthStandardController
                         signInClient: this.signInClient,
                         signUpClient: this.signUpClient,
                         cacheClient: this.cacheClient,
+                        jitClient: this.jitClient,
                         username: signUpInputs.username,
                     })
                 );
@@ -483,6 +530,7 @@ export class CustomAuthStandardController
                     signInClient: this.signInClient,
                     resetPasswordClient: this.resetPasswordClient,
                     cacheClient: this.cacheClient,
+                    jitClient: this.jitClient,
                     username: resetPasswordInputs.username,
                     codeLength: startResult.codeLength,
                 })

package/src/custom_auth/core/auth_flow/AuthFlowErrorBase.ts

@@ -66,7 +66,9 @@ export abstract class AuthFlowErrorBase {
                 this.errorData.subError ===
                     CustomAuthApiSuberror.INVALID_OOB_VALUE) ||
             (this.errorData instanceof InvalidArgumentError &&
-                this.errorData.errorDescription?.includes("code") === true)
+                (this.errorData.errorDescription?.includes("code") ||
+                    this.errorData.errorDescription?.includes("challenge")) ===
+                    true)
         );
     }
 
@@ -139,6 +141,25 @@ export abstract class AuthFlowErrorBase {
             this.errorData.errorCodes?.includes(50142) === true
         );
     }
+
+    protected isInvalidInputError(): boolean {
+        return (
+            this.errorData instanceof CustomAuthApiError &&
+            this.errorData.error === CustomAuthApiErrorCode.INVALID_REQUEST &&
+            this.errorData.errorCodes?.includes(901001) === true
+        );
+    }
+
+    protected isVerificationContactBlockedError(): boolean {
+        return (
+            this.errorData instanceof CustomAuthApiError &&
+            this.errorData.error === CustomAuthApiErrorCode.INVALID_REQUEST &&
+            this.errorData.errorCodes?.includes(550024) === true &&
+            this.errorData.errorDescription?.includes(
+                "multi-factor authentication method is blocked"
+            ) === true
+        );
+    }
 }
 
 export abstract class AuthActionErrorBase extends AuthFlowErrorBase {

package/src/custom_auth/core/auth_flow/AuthFlowResultBase.ts

@@ -42,10 +42,24 @@ export abstract class AuthFlowResultBase<
         if (error instanceof CustomAuthError) {
             return error;
         } else if (error instanceof AuthError) {
+            const errorCodes: Array<number> = [];
+
+            if ("errorNo" in error) {
+                if (typeof error.errorNo === "string") {
+                    const code = Number(error.errorNo);
+                    if (!isNaN(code)) {
+                        errorCodes.push(code);
+                    }
+                } else if (typeof error.errorNo === "number") {
+                    errorCodes.push(error.errorNo);
+                }
+            }
+
             return new MsalCustomAuthError(
                 error.errorCode,
                 error.errorMessage,
                 error.subError,
+                errorCodes,
                 error.correlationId
             );
         } else {

package/src/custom_auth/core/auth_flow/AuthFlowState.ts

@@ -31,7 +31,7 @@ export abstract class AuthFlowActionRequiredStateBase<
      * Creates a new instance of AuthFlowActionRequiredStateBase.
      * @param stateParameters The parameters for the auth state.
      */
-    protected constructor(protected readonly stateParameters: TParameter) {
+    constructor(protected readonly stateParameters: TParameter) {
         ensureArgumentIsNotEmptyString(
             "correlationId",
             stateParameters.correlationId

package/src/custom_auth/core/auth_flow/jit/AuthMethodDetails.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthenticationMethod } from "../../network_client/custom_auth_api/types/ApiResponseTypes.js";
+
+/**
+ * Details for an authentication method to be registered.
+ */
+export interface AuthMethodDetails {
+    /**
+     * The authentication method type to register.
+     */
+    authMethodType: AuthenticationMethod;
+
+    /**
+     * The verification contact (email, phone number) for the authentication method.
+     */
+    verificationContact: string;
+}

package/src/custom_auth/core/auth_flow/jit/error_type/AuthMethodRegistrationError.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthActionErrorBase } from "../../AuthFlowErrorBase.js";
+
+/**
+ * Error that occurred during authentication method challenge request.
+ */
+export class AuthMethodRegistrationChallengeMethodError extends AuthActionErrorBase {
+    /**
+     * Checks if the input for auth method registration is incorrect.
+     * @returns true if the input is incorrect, false otherwise.
+     */
+    isInvalidInput(): boolean {
+        return this.isInvalidInputError();
+    }
+
+    /**
+     * Checks if the error is due to the verification contact (e.g., phone number or email) being blocked. Consider using a different email/phone number or a different authentication method.
+     * @returns true if the error is due to the verification contact being blocked, false otherwise.
+     */
+    isVerificationContactBlocked(): boolean {
+        return this.isVerificationContactBlockedError();
+    }
+}
+
+/**
+ * Error that occurred during authentication method challenge submission.
+ */
+export class AuthMethodRegistrationSubmitChallengeError extends AuthActionErrorBase {
+    /**
+     * Checks if the submitted challenge code is incorrect.
+     * @returns true if the challenge code is incorrect, false otherwise.
+     */
+    isIncorrectChallenge(): boolean {
+        return this.isInvalidCodeError();
+    }
+}