@azure/msal-browser 4.22.1 → 4.24.0

package/src/custom_auth/core/interaction_client/mfa/MfaClient.ts

@@ -0,0 +1,148 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CustomAuthInteractionClientBase } from "../CustomAuthInteractionClientBase.js";
+import {
+    MfaRequestChallengeParams,
+    MfaSubmitChallengeParams,
+} from "./parameter/MfaClientParameters.js";
+import {
+    MfaVerificationRequiredResult,
+    MfaCompletedResult,
+    createMfaVerificationRequiredResult,
+    createMfaCompletedResult,
+} from "./result/MfaActionResult.js";
+import {
+    DefaultCustomAuthApiCodeLength,
+    ChallengeType,
+    GrantType,
+} from "../../../CustomAuthConstants.js";
+import * as PublicApiId from "../../telemetry/PublicApiId.js";
+import {
+    SignInChallengeRequest,
+    SignInOobTokenRequest,
+} from "../../network_client/custom_auth_api/types/ApiRequestTypes.js";
+import { ensureArgumentIsNotEmptyString } from "../../utils/ArgumentValidator.js";
+import { CustomAuthApiError } from "../../error/CustomAuthApiError.js";
+import * as CustomAuthApiErrorCode from "../../network_client/custom_auth_api/types/ApiErrorCodes.js";
+
+/**
+ * MFA client for handling multi-factor authentication flows.
+ */
+export class MfaClient extends CustomAuthInteractionClientBase {
+    /**
+     * Requests an MFA challenge to be sent to the user.
+     * @param parameters The parameters for requesting the challenge.
+     * @returns Promise that resolves to either MfaVerificationRequiredResult.
+     */
+    async requestChallenge(
+        parameters: MfaRequestChallengeParams
+    ): Promise<MfaVerificationRequiredResult> {
+        const apiId = PublicApiId.MFA_REQUEST_CHALLENGE;
+        const telemetryManager = this.initializeServerTelemetryManager(apiId);
+
+        this.logger.verbose(
+            "Calling challenge endpoint for MFA.",
+            parameters.correlationId
+        );
+
+        const challengeReq: SignInChallengeRequest = {
+            challenge_type: this.getChallengeTypes(parameters.challengeType),
+            continuation_token: parameters.continuationToken,
+            id: parameters.authMethodId,
+            correlationId: parameters.correlationId,
+            telemetryManager: telemetryManager,
+        };
+
+        const challengeResponse =
+            await this.customAuthApiClient.signInApi.requestChallenge(
+                challengeReq
+            );
+
+        this.logger.verbose(
+            "Challenge endpoint called for MFA.",
+            parameters.correlationId
+        );
+
+        if (challengeResponse.challenge_type === ChallengeType.OOB) {
+            // Verification required - code will be sent
+            return createMfaVerificationRequiredResult({
+                correlationId: challengeResponse.correlation_id,
+                continuationToken: challengeResponse.continuation_token ?? "",
+                challengeChannel: challengeResponse.challenge_channel ?? "",
+                challengeTargetLabel:
+                    challengeResponse.challenge_target_label ?? "",
+                codeLength:
+                    challengeResponse.code_length ??
+                    DefaultCustomAuthApiCodeLength,
+                bindingMethod: challengeResponse.binding_method ?? "",
+            });
+        }
+
+        this.logger.error(
+            `Unsupported challenge type '${challengeResponse.challenge_type}' for MFA.`,
+            parameters.correlationId
+        );
+
+        throw new CustomAuthApiError(
+            CustomAuthApiErrorCode.UNSUPPORTED_CHALLENGE_TYPE,
+            `Unsupported challenge type '${challengeResponse.challenge_type}'.`,
+            challengeResponse.correlation_id
+        );
+    }
+
+    /**
+     * Submits the MFA challenge response (e.g., OTP code).
+     * @param parameters The parameters for submitting the challenge.
+     * @returns Promise that resolves to MfaCompletedResult.
+     */
+    async submitChallenge(
+        parameters: MfaSubmitChallengeParams
+    ): Promise<MfaCompletedResult> {
+        ensureArgumentIsNotEmptyString(
+            "parameters.challenge",
+            parameters.challenge,
+            parameters.correlationId
+        );
+
+        const apiId = PublicApiId.MFA_SUBMIT_CHALLENGE;
+        const telemetryManager = this.initializeServerTelemetryManager(apiId);
+        const scopes = this.getScopes(parameters.scopes);
+
+        const request: SignInOobTokenRequest = {
+            continuation_token: parameters.continuationToken,
+            oob: parameters.challenge,
+            grant_type: GrantType.MFA_OOB,
+            scope: scopes.join(" "),
+            correlationId: parameters.correlationId,
+            telemetryManager: telemetryManager,
+            ...(parameters.claims && {
+                claims: parameters.claims,
+            }),
+        };
+
+        this.logger.verbose(
+            "Calling token endpoint for MFA challenge submission.",
+            parameters.correlationId
+        );
+
+        const tokenResponse =
+            await this.customAuthApiClient.signInApi.requestTokensWithOob(
+                request
+            );
+
+        // Save tokens and create authentication result
+        const result = await this.handleTokenResponse(
+            tokenResponse,
+            scopes,
+            tokenResponse.correlation_id ?? parameters.correlationId
+        );
+
+        return createMfaCompletedResult({
+            correlationId: parameters.correlationId,
+            authenticationResult: result,
+        });
+    }
+}

package/src/custom_auth/core/interaction_client/mfa/parameter/MfaClientParameters.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export interface MfaClientParametersBase {
+    correlationId: string;
+    continuationToken: string;
+}
+
+export interface MfaRequestChallengeParams extends MfaClientParametersBase {
+    challengeType: string[];
+    authMethodId: string;
+}
+
+export interface MfaSubmitChallengeParams extends MfaClientParametersBase {
+    challenge: string;
+    scopes: string[];
+    claims?: string;
+}

package/src/custom_auth/core/interaction_client/mfa/result/MfaActionResult.ts

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthenticationResult } from "../../../../../response/AuthenticationResult.js";
+
+interface MfaActionResult {
+    type: string;
+    correlationId: string;
+}
+
+export interface MfaVerificationRequiredResult extends MfaActionResult {
+    type: typeof MFA_VERIFICATION_REQUIRED_RESULT_TYPE;
+    continuationToken: string;
+    challengeChannel: string;
+    challengeTargetLabel: string;
+    codeLength: number;
+    bindingMethod: string;
+}
+
+export interface MfaCompletedResult extends MfaActionResult {
+    type: typeof MFA_COMPLETED_RESULT_TYPE;
+    authenticationResult: AuthenticationResult;
+}
+
+// Result type constants
+export const MFA_VERIFICATION_REQUIRED_RESULT_TYPE =
+    "MfaVerificationRequiredResult";
+export const MFA_COMPLETED_RESULT_TYPE = "MfaCompletedResult";
+
+export function createMfaVerificationRequiredResult(
+    input: Omit<MfaVerificationRequiredResult, "type">
+): MfaVerificationRequiredResult {
+    return {
+        type: MFA_VERIFICATION_REQUIRED_RESULT_TYPE,
+        ...input,
+    };
+}
+
+export function createMfaCompletedResult(
+    input: Omit<MfaCompletedResult, "type">
+): MfaCompletedResult {
+    return {
+        type: MFA_COMPLETED_RESULT_TYPE,
+        ...input,
+    };
+}

package/src/custom_auth/core/network_client/custom_auth_api/CustomAuthApiClient.ts

@@ -6,6 +6,7 @@
 import { ResetPasswordApiClient } from "./ResetPasswordApiClient.js";
 import { SignupApiClient } from "./SignupApiClient.js";
 import { SignInApiClient } from "./SignInApiClient.js";
+import { RegisterApiClient } from "./RegisterApiClient.js";
 import { ICustomAuthApiClient } from "./ICustomAuthApiClient.js";
 import { IHttpClient } from "../http_client/IHttpClient.js";
 
@@ -13,6 +14,7 @@ export class CustomAuthApiClient implements ICustomAuthApiClient {
     signInApi: SignInApiClient;
     signUpApi: SignupApiClient;
     resetPasswordApi: ResetPasswordApiClient;
+    registerApi: RegisterApiClient;
 
     constructor(
         customAuthApiBaseUrl: string,
@@ -42,5 +44,10 @@ export class CustomAuthApiClient implements ICustomAuthApiClient {
             capabilities,
             customAuthApiQueryParams
         );
+        this.registerApi = new RegisterApiClient(
+            customAuthApiBaseUrl,
+            clientId,
+            httpClient
+        );
     }
 }

package/src/custom_auth/core/network_client/custom_auth_api/CustomAuthApiEndpoint.ts

@@ -6,6 +6,7 @@
 export const SIGNIN_INITIATE = "/oauth2/v2.0/initiate";
 export const SIGNIN_CHALLENGE = "/oauth2/v2.0/challenge";
 export const SIGNIN_TOKEN = "/oauth2/v2.0/token";
+export const SIGNIN_INTROSPECT = "/oauth2/v2.0/introspect";
 
 export const SIGNUP_START = "/signup/v1.0/start";
 export const SIGNUP_CHALLENGE = "/signup/v1.0/challenge";
@@ -16,3 +17,7 @@ export const RESET_PWD_CHALLENGE = "/resetpassword/v1.0/challenge";
 export const RESET_PWD_CONTINUE = "/resetpassword/v1.0/continue";
 export const RESET_PWD_SUBMIT = "/resetpassword/v1.0/submit";
 export const RESET_PWD_POLL = "/resetpassword/v1.0/poll_completion";
+
+export const REGISTER_INTROSPECT = "/register/v1.0/introspect";
+export const REGISTER_CHALLENGE = "/register/v1.0/challenge";
+export const REGISTER_CONTINUE = "/register/v1.0/continue";

package/src/custom_auth/core/network_client/custom_auth_api/ICustomAuthApiClient.ts

@@ -6,8 +6,10 @@
 import { ResetPasswordApiClient } from "./ResetPasswordApiClient.js";
 import { SignupApiClient } from "./SignupApiClient.js";
 import { SignInApiClient } from "./SignInApiClient.js";
+import { RegisterApiClient } from "./RegisterApiClient.js";
 export interface ICustomAuthApiClient {
     signInApi: SignInApiClient;
     signUpApi: SignupApiClient;
     resetPasswordApi: ResetPasswordApiClient;
+    registerApi: RegisterApiClient;
 }

package/src/custom_auth/core/network_client/custom_auth_api/RegisterApiClient.ts

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { BaseApiClient } from "./BaseApiClient.js";
+import * as CustomAuthApiEndpoint from "./CustomAuthApiEndpoint.js";
+import {
+    RegisterIntrospectRequest,
+    RegisterChallengeRequest,
+    RegisterContinueRequest,
+} from "./types/ApiRequestTypes.js";
+import {
+    RegisterIntrospectResponse,
+    RegisterChallengeResponse,
+    RegisterContinueResponse,
+} from "./types/ApiResponseTypes.js";
+
+export class RegisterApiClient extends BaseApiClient {
+    /**
+     * Gets available authentication methods for registration
+     */
+    async introspect(
+        params: RegisterIntrospectRequest
+    ): Promise<RegisterIntrospectResponse> {
+        const result = await this.request<RegisterIntrospectResponse>(
+            CustomAuthApiEndpoint.REGISTER_INTROSPECT,
+            {
+                continuation_token: params.continuation_token,
+            },
+            params.telemetryManager,
+            params.correlationId
+        );
+
+        this.ensureContinuationTokenIsValid(
+            result.continuation_token,
+            params.correlationId
+        );
+
+        return result;
+    }
+
+    /**
+     * Sends challenge to specified authentication method
+     */
+    async challenge(
+        params: RegisterChallengeRequest
+    ): Promise<RegisterChallengeResponse> {
+        const result = await this.request<RegisterChallengeResponse>(
+            CustomAuthApiEndpoint.REGISTER_CHALLENGE,
+            {
+                continuation_token: params.continuation_token,
+                challenge_type: params.challenge_type,
+                challenge_target: params.challenge_target,
+                ...(params.challenge_channel && {
+                    challenge_channel: params.challenge_channel,
+                }),
+            },
+            params.telemetryManager,
+            params.correlationId
+        );
+
+        this.ensureContinuationTokenIsValid(
+            result.continuation_token,
+            params.correlationId
+        );
+
+        return result;
+    }
+
+    /**
+     * Submits challenge response and continues registration
+     */
+    async continue(
+        params: RegisterContinueRequest
+    ): Promise<RegisterContinueResponse> {
+        const result = await this.request<RegisterContinueResponse>(
+            CustomAuthApiEndpoint.REGISTER_CONTINUE,
+            {
+                continuation_token: params.continuation_token,
+                grant_type: params.grant_type,
+                ...(params.oob && { oob: params.oob }),
+            },
+            params.telemetryManager,
+            params.correlationId
+        );
+
+        this.ensureContinuationTokenIsValid(
+            result.continuation_token,
+            params.correlationId
+        );
+
+        return result;
+    }
+}

package/src/custom_auth/core/network_client/custom_auth_api/SignInApiClient.ts

@@ -14,12 +14,14 @@ import {
     SignInChallengeRequest,
     SignInContinuationTokenRequest,
     SignInInitiateRequest,
+    SignInIntrospectRequest,
     SignInOobTokenRequest,
     SignInPasswordTokenRequest,
 } from "./types/ApiRequestTypes.js";
 import {
     SignInChallengeResponse,
     SignInInitiateResponse,
+    SignInIntrospectResponse,
     SignInTokenResponse,
 } from "./types/ApiResponseTypes.js";
 
@@ -84,6 +86,7 @@ export class SignInApiClient extends BaseApiClient {
             {
                 continuation_token: params.continuation_token,
                 challenge_type: params.challenge_type,
+                ...(params.id && { id: params.id }),
             },
             params.telemetryManager,
             params.correlationId
@@ -127,7 +130,7 @@ export class SignInApiClient extends BaseApiClient {
                 continuation_token: params.continuation_token,
                 scope: params.scope,
                 oob: params.oob,
-                grant_type: GrantType.OOB,
+                grant_type: params.grant_type,
                 ...(params.claims && { claims: params.claims }),
             },
             params.telemetryManager,
@@ -141,15 +144,39 @@ export class SignInApiClient extends BaseApiClient {
         return this.requestTokens(
             {
                 continuation_token: params.continuation_token,
-                username: params.username,
                 scope: params.scope,
                 grant_type: GrantType.CONTINUATION_TOKEN,
                 client_info: true,
                 ...(params.claims && { claims: params.claims }),
+                ...(params.username && { username: params.username }),
+            },
+            params.telemetryManager,
+            params.correlationId
+        );
+    }
+
+    /**
+     * Requests available authentication methods for MFA
+     * @param continuationToken Token from previous response
+     */
+    async requestAuthMethods(
+        params: SignInIntrospectRequest
+    ): Promise<SignInIntrospectResponse> {
+        const result = await this.request<SignInIntrospectResponse>(
+            CustomAuthApiEndpoint.SIGNIN_INTROSPECT,
+            {
+                continuation_token: params.continuation_token,
             },
             params.telemetryManager,
             params.correlationId
         );
+
+        this.ensureContinuationTokenIsValid(
+            result.continuation_token,
+            params.correlationId
+        );
+
+        return result;
     }
 
     private async requestTokens(

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiRequestTypes.ts

@@ -3,6 +3,7 @@
  * Licensed under the MIT License.
  */
 
+import { GrantType } from "../../../../CustomAuthConstants.js";
 import { ApiRequestBase } from "./ApiTypesBase.js";
 
 /* Sign-in API request types */
@@ -14,6 +15,7 @@ export interface SignInInitiateRequest extends ApiRequestBase {
 export interface SignInChallengeRequest extends ApiRequestBase {
     challenge_type: string;
     continuation_token: string;
+    id?: string;
 }
 
 interface SignInTokenRequestBase extends ApiRequestBase {
@@ -28,10 +30,15 @@ export interface SignInPasswordTokenRequest extends SignInTokenRequestBase {
 
 export interface SignInOobTokenRequest extends SignInTokenRequestBase {
     oob: string;
+    grant_type: typeof GrantType.OOB | typeof GrantType.MFA_OOB;
 }
 
 export interface SignInContinuationTokenRequest extends SignInTokenRequestBase {
-    username: string;
+    username?: string;
+}
+
+export interface SignInIntrospectRequest extends ApiRequestBase {
+    continuation_token: string;
 }
 
 /* Sign-up API request types */
@@ -90,3 +97,21 @@ export interface ResetPasswordSubmitRequest extends ApiRequestBase {
 export interface ResetPasswordPollCompletionRequest extends ApiRequestBase {
     continuation_token: string;
 }
+
+/* Register API request types */
+export interface RegisterIntrospectRequest extends ApiRequestBase {
+    continuation_token: string;
+}
+
+export interface RegisterChallengeRequest extends ApiRequestBase {
+    continuation_token: string;
+    challenge_type: string;
+    challenge_target: string;
+    challenge_channel?: string;
+}
+
+export interface RegisterContinueRequest extends ApiRequestBase {
+    continuation_token: string;
+    grant_type: string;
+    oob?: string;
+}

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiResponseTypes.ts

@@ -38,6 +38,18 @@ export interface SignInTokenResponse extends ApiResponseBase {
     ext_expires_in?: number;
 }
 
+export interface AuthenticationMethod {
+    id: string;
+    challenge_type: string;
+    challenge_channel: string;
+    login_hint?: string;
+}
+
+export interface SignInIntrospectResponse extends ApiResponseBase {
+    continuation_token: string;
+    methods: AuthenticationMethod[];
+}
+
 /* Sign-up API response types */
 export type SignUpStartResponse = InitiateResponse;
 
@@ -64,3 +76,23 @@ export interface ResetPasswordPollCompletionResponse
     extends ContinuousResponse {
     status: string;
 }
+
+/* Register API response types */
+export interface RegisterIntrospectResponse extends ApiResponseBase {
+    continuation_token: string;
+    methods: AuthenticationMethod[];
+}
+
+export interface RegisterChallengeResponse extends ApiResponseBase {
+    continuation_token: string;
+    challenge_type: string;
+    binding_method: string;
+    challenge_target: string;
+    challenge_channel: string;
+    code_length?: number;
+    interval?: number;
+}
+
+export interface RegisterContinueResponse extends ApiResponseBase {
+    continuation_token: string;
+}

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiSuberrors.ts

@@ -12,3 +12,5 @@ export const PASSWORD_IS_INVALID = "password_is_invalid";
 export const INVALID_OOB_VALUE = "invalid_oob_value";
 export const ATTRIBUTE_VALIATION_FAILED = "attribute_validation_failed";
 export const NATIVEAUTHAPI_DISABLED = "nativeauthapi_disabled";
+export const REGISTRATION_REQUIRED = "registration_required";
+export const MFA_REQUIRED = "mfa_required";

package/src/custom_auth/core/telemetry/PublicApiId.ts

@@ -35,3 +35,11 @@ export const PASSWORD_RESET_RESEND_CODE = 100044;
 export const ACCOUNT_GET_ACCOUNT = 100061;
 export const ACCOUNT_SIGN_OUT = 100062;
 export const ACCOUNT_GET_ACCESS_TOKEN = 100063;
+
+// JIT (Just-In-Time) Auth Method Registration
+export const JIT_CHALLENGE_AUTH_METHOD = 100081;
+export const JIT_SUBMIT_CHALLENGE = 100082;
+
+// MFA
+export const MFA_REQUEST_CHALLENGE = 100101;
+export const MFA_SUBMIT_CHALLENGE = 100102;

package/src/custom_auth/index.ts

@@ -20,8 +20,9 @@ export { ICustomAuthPublicClientApplication } from "./ICustomAuthPublicClientApp
 // Configuration
 export { CustomAuthConfiguration } from "./configuration/CustomAuthConfiguration.js";
 
-// Account Data
+// Models
 export { CustomAuthAccountData } from "./get_account/auth_flow/CustomAuthAccountData.js";
+export { AuthenticationMethod } from "./core/network_client/custom_auth_api/types/ApiResponseTypes.js";
 
 // Operation Inputs
 export {
@@ -50,13 +51,18 @@ export {
     SignInResult,
     SignInResultState,
 } from "./sign_in/auth_flow/result/SignInResult.js";
-export { SignInSubmitCodeResult } from "./sign_in/auth_flow/result/SignInSubmitCodeResult.js";
+export {
+    SignInSubmitCodeResult,
+    SignInSubmitCodeResultState,
+} from "./sign_in/auth_flow/result/SignInSubmitCodeResult.js";
 export {
     SignInResendCodeResult,
     SignInResendCodeResultState,
 } from "./sign_in/auth_flow/result/SignInResendCodeResult.js";
-export { SignInSubmitPasswordResult } from "./sign_in/auth_flow/result/SignInSubmitPasswordResult.js";
-export { SignInSubmitCredentialResultState } from "./sign_in/auth_flow/result/SignInSubmitCredentialResult.js";
+export {
+    SignInSubmitPasswordResult,
+    SignInSubmitPasswordResultState,
+} from "./sign_in/auth_flow/result/SignInSubmitPasswordResult.js";
 
 // Sign-in Errors
 export {
@@ -181,5 +187,30 @@ export { UnsupportedEnvironmentError } from "./core/error/UnsupportedEnvironment
 export { UserAccountAttributeError } from "./core/error/UserAccountAttributeError.js";
 export { UserAlreadySignedInError } from "./core/error/UserAlreadySignedInError.js";
 
+// Auth Method Registration State
+export { AuthMethodRegistrationRequiredState } from "./core/auth_flow/jit/state/AuthMethodRegistrationState.js";
+export { AuthMethodVerificationRequiredState } from "./core/auth_flow/jit/state/AuthMethodRegistrationState.js";
+export { AuthMethodRegistrationCompletedState } from "./core/auth_flow/jit/state/AuthMethodRegistrationCompletedState.js";
+export { AuthMethodRegistrationFailedState } from "./core/auth_flow/jit/state/AuthMethodRegistrationFailedState.js";
+
+// Auth Method Registration Results
+export {
+    AuthMethodRegistrationChallengeMethodResult,
+    AuthMethodRegistrationChallengeMethodResultState,
+} from "./core/auth_flow/jit/result/AuthMethodRegistrationChallengeMethodResult.js";
+export {
+    AuthMethodRegistrationSubmitChallengeResult,
+    AuthMethodRegistrationSubmitChallengeResultState,
+} from "./core/auth_flow/jit/result/AuthMethodRegistrationSubmitChallengeResult.js";
+
+// Auth Method Registration Errors
+export {
+    AuthMethodRegistrationChallengeMethodError,
+    AuthMethodRegistrationSubmitChallengeError,
+} from "./core/auth_flow/jit/error_type/AuthMethodRegistrationError.js";
+
+// Auth Method Registration Types
+export { AuthMethodDetails } from "./core/auth_flow/jit/AuthMethodDetails.js";
+
 // Components from msal_browser
 export { LogLevel } from "@azure/msal-common/browser";

package/src/custom_auth/reset_password/auth_flow/state/ResetPasswordCodeRequiredState.ts

@@ -55,6 +55,7 @@ export class ResetPasswordCodeRequiredState extends ResetPasswordState<ResetPass
                         this.stateParameters.resetPasswordClient,
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
+                    jitClient: this.stateParameters.jitClient,
                     username: this.stateParameters.username,
                 })
             );
@@ -106,6 +107,7 @@ export class ResetPasswordCodeRequiredState extends ResetPasswordState<ResetPass
                         this.stateParameters.resetPasswordClient,
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
+                    jitClient: this.stateParameters.jitClient,
                     username: this.stateParameters.username,
                     codeLength: result.codeLength,
                 })

package/src/custom_auth/reset_password/auth_flow/state/ResetPasswordPasswordRequiredState.ts

@@ -58,6 +58,7 @@ export class ResetPasswordPasswordRequiredState extends ResetPasswordState<Reset
                     username: this.stateParameters.username,
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
+                    jitClient: this.stateParameters.jitClient,
                     signInScenario: SignInScenario.SignInAfterPasswordReset,
                 })
             );

package/src/custom_auth/reset_password/auth_flow/state/ResetPasswordStateParameters.ts

@@ -7,6 +7,7 @@ import { ResetPasswordClient } from "../../interaction_client/ResetPasswordClien
 import { SignInClient } from "../../../sign_in/interaction_client/SignInClient.js";
 import { CustomAuthSilentCacheClient } from "../../../get_account/interaction_client/CustomAuthSilentCacheClient.js";
 import { AuthFlowActionRequiredStateParameters } from "../../../core/auth_flow/AuthFlowState.js";
+import { JitClient } from "../../../core/interaction_client/jit/JitClient.js";
 
 export interface ResetPasswordStateParameters
     extends AuthFlowActionRequiredStateParameters {
@@ -14,6 +15,7 @@ export interface ResetPasswordStateParameters
     resetPasswordClient: ResetPasswordClient;
     signInClient: SignInClient;
     cacheClient: CustomAuthSilentCacheClient;
+    jitClient: JitClient;
 }
 
 export type ResetPasswordPasswordRequiredStateParameters =