@azure/msal-browser 4.22.1 → 4.24.0

package/src/custom_auth/sign_in/auth_flow/result/SignInResult.ts

@@ -10,6 +10,7 @@ import { SignInCodeRequiredState } from "../state/SignInCodeRequiredState.js";
 import { SignInPasswordRequiredState } from "../state/SignInPasswordRequiredState.js";
 import { SignInFailedState } from "../state/SignInFailedState.js";
 import { SignInCompletedState } from "../state/SignInCompletedState.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 
 /*
  * Result of a sign-in operation.
@@ -70,6 +71,16 @@ export class SignInResult extends AuthFlowResultBase<
     isCompleted(): this is SignInResult & { state: SignInCompletedState } {
         return this.state instanceof SignInCompletedState;
     }
+
+    /**
+     * Checks if the result requires authentication method registration.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isAuthMethodRegistrationRequired(): this is SignInResult & {
+        state: AuthMethodRegistrationRequiredState;
+    } {
+        return this.state instanceof AuthMethodRegistrationRequiredState;
+    }
 }
 
 /**
@@ -79,9 +90,11 @@ export class SignInResult extends AuthFlowResultBase<
  * - SignInPasswordRequiredState: The sign-in process requires a password.
  * - SignInFailedState: The sign-in process has failed.
  * - SignInCompletedState: The sign-in process is completed.
+ * - AuthMethodRegistrationRequiredState: The sign-in process requires authentication method registration.
  */
 export type SignInResultState =
     | SignInCodeRequiredState
     | SignInPasswordRequiredState
     | SignInFailedState
-    | SignInCompletedState;
+    | SignInCompletedState
+    | AuthMethodRegistrationRequiredState;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitCodeResult.ts

@@ -6,12 +6,17 @@
 import { SignInSubmitCodeError } from "../error_type/SignInError.js";
 import { SignInCompletedState } from "../state/SignInCompletedState.js";
 import { SignInFailedState } from "../state/SignInFailedState.js";
-import { SignInSubmitCredentialResult } from "./SignInSubmitCredentialResult.js";
+import { AuthFlowResultBase } from "../../../core/auth_flow/AuthFlowResultBase.js";
+import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
 
 /*
  * Result of a sign-in submit code operation.
  */
-export class SignInSubmitCodeResult extends SignInSubmitCredentialResult<SignInSubmitCodeError> {
+export class SignInSubmitCodeResult extends AuthFlowResultBase<
+    SignInSubmitCodeResultState,
+    SignInSubmitCodeError,
+    CustomAuthAccountData
+> {
     /**
      * Creates a new instance of SignInSubmitCodeResult with error data.
      * @param error The error that occurred.
@@ -42,3 +47,13 @@ export class SignInSubmitCodeResult extends SignInSubmitCredentialResult<SignInS
         return this.state instanceof SignInCompletedState;
     }
 }
+
+/**
+ * The possible states of the SignInSubmitCodeResult.
+ * This includes:
+ * - SignInCompletedState: The sign-in process has completed successfully.
+ * - SignInFailedState: The sign-in process has failed.
+ */
+export type SignInSubmitCodeResultState =
+    | SignInCompletedState
+    | SignInFailedState;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitPasswordResult.ts

@@ -6,12 +6,18 @@
 import { SignInSubmitPasswordError } from "../error_type/SignInError.js";
 import { SignInCompletedState } from "../state/SignInCompletedState.js";
 import { SignInFailedState } from "../state/SignInFailedState.js";
-import { SignInSubmitCredentialResult } from "./SignInSubmitCredentialResult.js";
+import { AuthFlowResultBase } from "../../../core/auth_flow/AuthFlowResultBase.js";
+import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 
 /*
  * Result of a sign-in submit password operation.
  */
-export class SignInSubmitPasswordResult extends SignInSubmitCredentialResult<SignInSubmitPasswordError> {
+export class SignInSubmitPasswordResult extends AuthFlowResultBase<
+    SignInSubmitPasswordResultState,
+    SignInSubmitPasswordError,
+    CustomAuthAccountData
+> {
     static createWithError(error: unknown): SignInSubmitPasswordResult {
         const result = new SignInSubmitPasswordResult(new SignInFailedState());
         result.error = new SignInSubmitPasswordError(
@@ -38,4 +44,26 @@ export class SignInSubmitPasswordResult extends SignInSubmitCredentialResult<Sig
     } {
         return this.state instanceof SignInCompletedState;
     }
+
+    /**
+     * Checks if the result requires authentication method registration.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isAuthMethodRegistrationRequired(): this is SignInSubmitPasswordResult & {
+        state: AuthMethodRegistrationRequiredState;
+    } {
+        return this.state instanceof AuthMethodRegistrationRequiredState;
+    }
 }
+
+/**
+ * The possible states of the SignInSubmitPasswordResult.
+ * This includes:
+ * - SignInCompletedState: The sign-in process has completed successfully.
+ * - SignInFailedState: The sign-in process has failed.
+ * - AuthMethodRegistrationRequiredState: The sign-in process requires authentication method registration.
+ */
+export type SignInSubmitPasswordResultState =
+    | SignInCompletedState
+    | SignInFailedState
+    | AuthMethodRegistrationRequiredState;

package/src/custom_auth/sign_in/auth_flow/state/SignInCodeRequiredState.ts

@@ -13,6 +13,7 @@ import { SignInSubmitCodeResult } from "../result/SignInSubmitCodeResult.js";
 import { SignInCodeRequiredStateParameters } from "./SignInStateParameters.js";
 import { SignInState } from "./SignInState.js";
 import { SignInCompletedState } from "./SignInCompletedState.js";
+import { SIGN_IN_COMPLETED_RESULT_TYPE } from "../../interaction_client/result/SignInActionResult.js";
 
 /*
  * Sign-in code required state.
@@ -45,7 +46,7 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                 this.stateParameters.correlationId
             );
 
-            const completedResult =
+            const submitCodeResult =
                 await this.stateParameters.signInClient.submitCode(
                     submitCodeParams
                 );
@@ -55,18 +56,27 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                 this.stateParameters.correlationId
             );
 
-            const accountInfo = new CustomAuthAccountData(
-                completedResult.authenticationResult.account,
-                this.stateParameters.config,
-                this.stateParameters.cacheClient,
-                this.stateParameters.logger,
-                this.stateParameters.correlationId
-            );
+            if (submitCodeResult.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
+                const accountInfo = new CustomAuthAccountData(
+                    submitCodeResult.authenticationResult.account,
+                    this.stateParameters.config,
+                    this.stateParameters.cacheClient,
+                    this.stateParameters.logger,
+                    this.stateParameters.correlationId
+                );
 
-            return new SignInSubmitCodeResult(
-                new SignInCompletedState(),
-                accountInfo
-            );
+                return new SignInSubmitCodeResult(
+                    new SignInCompletedState(),
+                    accountInfo
+                );
+            } else {
+                // Unexpected result type
+                const result = submitCodeResult as { type: string };
+                const error = new Error(
+                    `Unexpected result type: ${result.type}`
+                );
+                return SignInSubmitCodeResult.createWithError(error);
+            }
         } catch (error) {
             this.stateParameters.logger.errorPii(
                 `Failed to submit code for sign-in. Error: ${error}.`,
@@ -114,6 +124,7 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                     config: this.stateParameters.config,
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
+                    jitClient: this.stateParameters.jitClient,
                     username: this.stateParameters.username,
                     codeLength: result.codeLength,
                     scopes: this.stateParameters.scopes,

package/src/custom_auth/sign_in/auth_flow/state/SignInContinuationState.ts

@@ -10,6 +10,11 @@ import { SignInWithContinuationTokenInputs } from "../../../CustomAuthActionInpu
 import { SignInContinuationStateParameters } from "./SignInStateParameters.js";
 import { SignInState } from "./SignInState.js";
 import { SignInCompletedState } from "./SignInCompletedState.js";
+import {
+    SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
+    SIGN_IN_COMPLETED_RESULT_TYPE,
+} from "../../interaction_client/result/SignInActionResult.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 import * as ArgumentValidator from "../../../core/utils/ArgumentValidator.js";
 
 /*
@@ -50,7 +55,7 @@ export class SignInContinuationState extends SignInState<SignInContinuationState
                 this.stateParameters.correlationId
             );
 
-            const completedResult =
+            const signInResult =
                 await this.stateParameters.signInClient.signInWithContinuationToken(
                     continuationTokenParams
                 );
@@ -60,15 +65,51 @@ export class SignInContinuationState extends SignInState<SignInContinuationState
                 this.stateParameters.correlationId
             );
 
-            const accountInfo = new CustomAuthAccountData(
-                completedResult.authenticationResult.account,
-                this.stateParameters.config,
-                this.stateParameters.cacheClient,
-                this.stateParameters.logger,
-                this.stateParameters.correlationId
-            );
+            if (signInResult.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
+                // Sign-in completed successfully
+                const accountInfo = new CustomAuthAccountData(
+                    signInResult.authenticationResult.account,
+                    this.stateParameters.config,
+                    this.stateParameters.cacheClient,
+                    this.stateParameters.logger,
+                    this.stateParameters.correlationId
+                );
 
-            return new SignInResult(new SignInCompletedState(), accountInfo);
+                return new SignInResult(
+                    new SignInCompletedState(),
+                    accountInfo
+                );
+            } else if (signInResult.type === SIGN_IN_JIT_REQUIRED_RESULT_TYPE) {
+                // JIT is required
+                this.stateParameters.logger.warning(
+                    "Auth method registration required during continuation token sign-in.",
+                    this.stateParameters.correlationId
+                );
+
+                // Return AuthMethodRegistrationRequiredState to handle JIT scenario
+                const authMethodRegistrationState =
+                    new AuthMethodRegistrationRequiredState({
+                        correlationId: this.stateParameters.correlationId,
+                        continuationToken: signInResult.continuationToken,
+                        logger: this.stateParameters.logger,
+                        config: this.stateParameters.config,
+                        jitClient: this.stateParameters.jitClient,
+                        cacheClient: this.stateParameters.cacheClient,
+                        authMethods: signInResult.authMethods,
+                        username: this.stateParameters.username,
+                        scopes: signInWithContinuationTokenInputs?.scopes ?? [],
+                        claims: this.stateParameters.claims,
+                    });
+
+                return new SignInResult(authMethodRegistrationState);
+            } else {
+                // Unexpected result type
+                const result = signInResult as { type: string };
+                const error = new Error(
+                    `Unexpected result type: ${result.type}`
+                );
+                return SignInResult.createWithError(error);
+            }
         } catch (error) {
             this.stateParameters.logger.errorPii(
                 `Failed to sign in with continuation token. Error: ${error}.`,

package/src/custom_auth/sign_in/auth_flow/state/SignInPasswordRequiredState.ts

@@ -9,6 +9,11 @@ import { SignInSubmitPasswordResult } from "../result/SignInSubmitPasswordResult
 import { SignInCompletedState } from "./SignInCompletedState.js";
 import { SignInState } from "./SignInState.js";
 import { SignInPasswordRequiredStateParameters } from "./SignInStateParameters.js";
+import {
+    SIGN_IN_COMPLETED_RESULT_TYPE,
+    SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
+} from "../../interaction_client/result/SignInActionResult.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 
 /*
  * Sign-in password required state.
@@ -42,7 +47,7 @@ export class SignInPasswordRequiredState extends SignInState<SignInPasswordRequi
                 this.stateParameters.correlationId
             );
 
-            const completedResult =
+            const submitPasswordResult =
                 await this.stateParameters.signInClient.submitPassword(
                     submitPasswordParams
                 );
@@ -52,18 +57,51 @@ export class SignInPasswordRequiredState extends SignInState<SignInPasswordRequi
                 this.stateParameters.correlationId
             );
 
-            const accountInfo = new CustomAuthAccountData(
-                completedResult.authenticationResult.account,
-                this.stateParameters.config,
-                this.stateParameters.cacheClient,
-                this.stateParameters.logger,
-                this.stateParameters.correlationId
-            );
+            if (submitPasswordResult.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
+                const accountInfo = new CustomAuthAccountData(
+                    submitPasswordResult.authenticationResult.account,
+                    this.stateParameters.config,
+                    this.stateParameters.cacheClient,
+                    this.stateParameters.logger,
+                    this.stateParameters.correlationId
+                );
 
-            return new SignInSubmitPasswordResult(
-                new SignInCompletedState(),
-                accountInfo
-            );
+                return new SignInSubmitPasswordResult(
+                    new SignInCompletedState(),
+                    accountInfo
+                );
+            } else if (
+                submitPasswordResult.type === SIGN_IN_JIT_REQUIRED_RESULT_TYPE
+            ) {
+                // JIT is required - return AuthMethodRegistrationRequiredState
+                this.stateParameters.logger.verbose(
+                    "Authentication method registration required after password submission.",
+                    this.stateParameters.correlationId
+                );
+
+                return new SignInSubmitPasswordResult(
+                    new AuthMethodRegistrationRequiredState({
+                        correlationId: this.stateParameters.correlationId,
+                        continuationToken:
+                            submitPasswordResult.continuationToken,
+                        logger: this.stateParameters.logger,
+                        config: this.stateParameters.config,
+                        jitClient: this.stateParameters.jitClient,
+                        cacheClient: this.stateParameters.cacheClient,
+                        authMethods: submitPasswordResult.authMethods,
+                        username: this.stateParameters.username,
+                        scopes: this.stateParameters.scopes ?? [],
+                        claims: this.stateParameters.claims,
+                    })
+                );
+            } else {
+                // Unexpected result type
+                const result = submitPasswordResult as { type: string };
+                const error = new Error(
+                    `Unexpected result type: ${result.type}`
+                );
+                return SignInSubmitPasswordResult.createWithError(error);
+            }
         } catch (error) {
             this.stateParameters.logger.errorPii(
                 `Failed to sign in after submitting password. Error: ${error}.`,

package/src/custom_auth/sign_in/auth_flow/state/SignInStateParameters.ts

@@ -7,6 +7,7 @@ import { AuthFlowActionRequiredStateParameters } from "../../../core/auth_flow/A
 import { CustomAuthSilentCacheClient } from "../../../get_account/interaction_client/CustomAuthSilentCacheClient.js";
 import { SignInClient } from "../../interaction_client/SignInClient.js";
 import { SignInScenarioType } from "../SignInScenario.js";
+import { JitClient } from "../../../core/interaction_client/jit/JitClient.js";
 
 export interface SignInStateParameters
     extends AuthFlowActionRequiredStateParameters {
@@ -14,6 +15,7 @@ export interface SignInStateParameters
     signInClient: SignInClient;
     cacheClient: CustomAuthSilentCacheClient;
     claims?: string;
+    jitClient: JitClient;
 }
 
 export interface SignInPasswordRequiredStateParameters