@azure/msal-browser 4.23.0 → 4.24.1

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiSuberrors.ts

@@ -13,3 +13,4 @@ export const INVALID_OOB_VALUE = "invalid_oob_value";
 export const ATTRIBUTE_VALIATION_FAILED = "attribute_validation_failed";
 export const NATIVEAUTHAPI_DISABLED = "nativeauthapi_disabled";
 export const REGISTRATION_REQUIRED = "registration_required";
+export const MFA_REQUIRED = "mfa_required";

package/src/custom_auth/core/telemetry/PublicApiId.ts

@@ -37,6 +37,9 @@ export const ACCOUNT_SIGN_OUT = 100062;
 export const ACCOUNT_GET_ACCESS_TOKEN = 100063;
 
 // JIT (Just-In-Time) Auth Method Registration
-export const JIT_GET_AUTH_METHODS = 100081;
-export const JIT_CHALLENGE_AUTH_METHOD = 100082;
-export const JIT_SUBMIT_CHALLENGE = 100083;
+export const JIT_CHALLENGE_AUTH_METHOD = 100081;
+export const JIT_SUBMIT_CHALLENGE = 100082;
+
+// MFA
+export const MFA_REQUEST_CHALLENGE = 100101;
+export const MFA_SUBMIT_CHALLENGE = 100102;

package/src/custom_auth/sign_in/auth_flow/state/SignInCodeRequiredState.ts

@@ -13,6 +13,7 @@ import { SignInSubmitCodeResult } from "../result/SignInSubmitCodeResult.js";
 import { SignInCodeRequiredStateParameters } from "./SignInStateParameters.js";
 import { SignInState } from "./SignInState.js";
 import { SignInCompletedState } from "./SignInCompletedState.js";
+import { SIGN_IN_COMPLETED_RESULT_TYPE } from "../../interaction_client/result/SignInActionResult.js";
 
 /*
  * Sign-in code required state.
@@ -45,7 +46,7 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                 this.stateParameters.correlationId
             );
 
-            const completedResult =
+            const submitCodeResult =
                 await this.stateParameters.signInClient.submitCode(
                     submitCodeParams
                 );
@@ -55,18 +56,27 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                 this.stateParameters.correlationId
             );
 
-            const accountInfo = new CustomAuthAccountData(
-                completedResult.authenticationResult.account,
-                this.stateParameters.config,
-                this.stateParameters.cacheClient,
-                this.stateParameters.logger,
-                this.stateParameters.correlationId
-            );
+            if (submitCodeResult.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
+                const accountInfo = new CustomAuthAccountData(
+                    submitCodeResult.authenticationResult.account,
+                    this.stateParameters.config,
+                    this.stateParameters.cacheClient,
+                    this.stateParameters.logger,
+                    this.stateParameters.correlationId
+                );
 
-            return new SignInSubmitCodeResult(
-                new SignInCompletedState(),
-                accountInfo
-            );
+                return new SignInSubmitCodeResult(
+                    new SignInCompletedState(),
+                    accountInfo
+                );
+            } else {
+                // Unexpected result type
+                const result = submitCodeResult as { type: string };
+                const error = new Error(
+                    `Unexpected result type: ${result.type}`
+                );
+                return SignInSubmitCodeResult.createWithError(error);
+            }
         } catch (error) {
             this.stateParameters.logger.errorPii(
                 `Failed to submit code for sign-in. Error: ${error}.`,

package/src/custom_auth/sign_in/interaction_client/SignInClient.ts

@@ -6,10 +6,14 @@
 import {
     ChallengeType,
     DefaultCustomAuthApiCodeLength,
+    GrantType,
 } from "../../CustomAuthConstants.js";
 import { CustomAuthApiError } from "../../core/error/CustomAuthApiError.js";
 import * as CustomAuthApiErrorCode from "../../core/network_client/custom_auth_api/types/ApiErrorCodes.js";
-import { REGISTRATION_REQUIRED } from "../../core/network_client/custom_auth_api/types/ApiSuberrors.js";
+import {
+    MFA_REQUIRED,
+    REGISTRATION_REQUIRED,
+} from "../../core/network_client/custom_auth_api/types/ApiSuberrors.js";
 
 import { CustomAuthInteractionClientBase } from "../../core/interaction_client/CustomAuthInteractionClientBase.js";
 import {
@@ -29,6 +33,8 @@ import {
     SignInCompletedResult,
     SignInPasswordRequiredResult,
     SignInJitRequiredResult,
+    SignInMfaRequiredResult,
+    createSignInMfaRequiredResult,
 } from "./result/SignInActionResult.js";
 import * as PublicApiId from "../../core/telemetry/PublicApiId.js";
 import {
@@ -38,6 +44,7 @@ import {
     SignInOobTokenRequest,
     SignInPasswordTokenRequest,
     RegisterIntrospectRequest,
+    SignInIntrospectRequest,
 } from "../../core/network_client/custom_auth_api/types/ApiRequestTypes.js";
 import { SignInTokenResponse } from "../../core/network_client/custom_auth_api/types/ApiResponseTypes.js";
 import {
@@ -135,7 +142,11 @@ export class SignInClient extends CustomAuthInteractionClientBase {
      */
     async submitCode(
         parameters: SignInSubmitCodeParams
-    ): Promise<SignInCompletedResult> {
+    ): Promise<
+        | SignInCompletedResult
+        | SignInJitRequiredResult
+        | SignInMfaRequiredResult
+    > {
         ensureArgumentIsNotEmptyString(
             "parameters.code",
             parameters.code,
@@ -149,6 +160,7 @@ export class SignInClient extends CustomAuthInteractionClientBase {
         const request: SignInOobTokenRequest = {
             continuation_token: parameters.continuationToken,
             oob: parameters.code,
+            grant_type: GrantType.OOB,
             scope: scopes.join(" "),
             correlationId: parameters.correlationId,
             telemetryManager: telemetryManager,
@@ -157,18 +169,15 @@ export class SignInClient extends CustomAuthInteractionClientBase {
             }),
         };
 
-        const result = this.performTokenRequest(
+        return this.performTokenRequest(
             () =>
                 this.customAuthApiClient.signInApi.requestTokensWithOob(
                     request
                 ),
             scopes,
             parameters.correlationId,
-            telemetryManager,
-            false // Don't handle JIT for code submission
+            telemetryManager
         );
-
-        return result as Promise<SignInCompletedResult>;
     }
 
     /**
@@ -178,7 +187,11 @@ export class SignInClient extends CustomAuthInteractionClientBase {
      */
     async submitPassword(
         parameters: SignInSubmitPasswordParams
-    ): Promise<SignInCompletedResult | SignInJitRequiredResult> {
+    ): Promise<
+        | SignInCompletedResult
+        | SignInJitRequiredResult
+        | SignInMfaRequiredResult
+    > {
         ensureArgumentIsNotEmptyString(
             "parameters.password",
             parameters.password,
@@ -207,8 +220,7 @@ export class SignInClient extends CustomAuthInteractionClientBase {
                 ),
             scopes,
             parameters.correlationId,
-            telemetryManager,
-            true // Handle JIT for password submission
+            telemetryManager
         );
     }
 
@@ -219,7 +231,11 @@ export class SignInClient extends CustomAuthInteractionClientBase {
      */
     async signInWithContinuationToken(
         parameters: SignInContinuationTokenParams
-    ): Promise<SignInCompletedResult | SignInJitRequiredResult> {
+    ): Promise<
+        | SignInCompletedResult
+        | SignInJitRequiredResult
+        | SignInMfaRequiredResult
+    > {
         const apiId = this.getPublicApiIdBySignInScenario(
             parameters.signInScenario,
             parameters.correlationId
@@ -247,9 +263,8 @@ export class SignInClient extends CustomAuthInteractionClientBase {
                 ),
             scopes,
             parameters.correlationId,
-            telemetryManager,
-            true // Handle JIT for continuation token sign-in (e.g., after sign-up or SSPR)
-        ) as Promise<SignInCompletedResult | SignInJitRequiredResult>;
+            telemetryManager
+        );
     }
 
     /**
@@ -257,16 +272,19 @@ export class SignInClient extends CustomAuthInteractionClientBase {
      * @param tokenEndpointCaller Function that calls the specific token endpoint
      * @param scopes Scopes for the token request
      * @param correlationId Correlation ID for logging and result
-     * @param handleJit Whether to handle JIT required errors or throw them
-     * @returns SignInCompletedResult with authentication result
+     * @param telemetryManager Telemetry manager for telemetry logging
+     * @returns SignInCompletedResult | SignInJitRequiredResult | SignInMfaRequiredResult with authentication result
      */
     private async performTokenRequest(
         tokenEndpointCaller: () => Promise<SignInTokenResponse>,
         scopes: string[],
         correlationId: string,
-        telemetryManager: ServerTelemetryManager,
-        handleJit: boolean
-    ): Promise<SignInCompletedResult | SignInJitRequiredResult> {
+        telemetryManager: ServerTelemetryManager
+    ): Promise<
+        | SignInCompletedResult
+        | SignInJitRequiredResult
+        | SignInMfaRequiredResult
+    > {
         this.logger.verbose(
             "Calling token endpoint for sign in.",
             correlationId
@@ -292,34 +310,23 @@ export class SignInClient extends CustomAuthInteractionClientBase {
             });
         } catch (error) {
             if (
-                handleJit &&
                 error instanceof CustomAuthApiError &&
                 error.subError === REGISTRATION_REQUIRED
             ) {
-                this.logger.verbose(
-                    "Auth method registration required for sign in.",
+                return this.handleJitRequiredError(
+                    error,
+                    telemetryManager,
                     correlationId
                 );
-
-                // Call register introspect endpoint to get available authentication methods
-                const introspectRequest: RegisterIntrospectRequest = {
-                    continuation_token: error.continuationToken ?? "",
-                    correlationId: error.correlationId ?? correlationId,
+            } else if (
+                error instanceof CustomAuthApiError &&
+                error.subError === MFA_REQUIRED
+            ) {
+                return this.handleMfaRequiredError(
+                    error,
                     telemetryManager,
-                };
-
-                const introspectResponse =
-                    await this.customAuthApiClient.registerApi.introspect(
-                        introspectRequest
-                    );
-
-                return createSignInJitRequiredResult({
-                    correlationId:
-                        introspectResponse.correlation_id ?? correlationId,
-                    continuationToken:
-                        introspectResponse.continuation_token ?? "",
-                    authMethods: introspectResponse.methods,
-                });
+                    correlationId
+                );
             }
 
             // Re-throw any other errors or JIT errors when handleJit is false
@@ -404,4 +411,79 @@ export class SignInClient extends CustomAuthInteractionClientBase {
                 );
         }
     }
+
+    private async handleJitRequiredError(
+        error: CustomAuthApiError,
+        telemetryManager: ServerTelemetryManager,
+        correlationId: string
+    ): Promise<SignInJitRequiredResult> {
+        this.logger.verbose(
+            "Auth method registration required for sign in.",
+            correlationId
+        );
+
+        // Call register introspect endpoint to get available authentication methods
+        const introspectRequest: RegisterIntrospectRequest = {
+            continuation_token: error.continuationToken ?? "",
+            correlationId: error.correlationId ?? correlationId,
+            telemetryManager,
+        };
+
+        this.logger.verbose(
+            "Calling introspect endpoint for getting auth methods.",
+            correlationId
+        );
+
+        const introspectResponse =
+            await this.customAuthApiClient.registerApi.introspect(
+                introspectRequest
+            );
+
+        this.logger.verbose(
+            "Introspect endpoint called for getting auth methods.",
+            introspectResponse.correlation_id ?? correlationId
+        );
+
+        return createSignInJitRequiredResult({
+            correlationId: introspectResponse.correlation_id ?? correlationId,
+            continuationToken: introspectResponse.continuation_token ?? "",
+            authMethods: introspectResponse.methods,
+        });
+    }
+
+    private async handleMfaRequiredError(
+        error: CustomAuthApiError,
+        telemetryManager: ServerTelemetryManager,
+        correlationId: string
+    ): Promise<SignInMfaRequiredResult> {
+        this.logger.verbose("MFA required for sign in.", correlationId);
+
+        // Call sign-in introspect endpoint to get available MFA methods
+        const introspectRequest: SignInIntrospectRequest = {
+            continuation_token: error.continuationToken ?? "",
+            correlationId: error.correlationId ?? correlationId,
+            telemetryManager,
+        };
+
+        this.logger.verbose(
+            "Calling introspect endpoint for MFA auth methods.",
+            correlationId
+        );
+
+        const introspectResponse =
+            await this.customAuthApiClient.signInApi.requestAuthMethods(
+                introspectRequest
+            );
+
+        this.logger.verbose(
+            "Introspect endpoint called for MFA auth methods.",
+            introspectResponse.correlation_id ?? correlationId
+        );
+
+        return createSignInMfaRequiredResult({
+            correlationId: introspectResponse.correlation_id ?? correlationId,
+            continuationToken: introspectResponse.continuation_token ?? "",
+            authMethods: introspectResponse.methods,
+        });
+    }
 }

package/src/custom_auth/sign_in/interaction_client/result/SignInActionResult.ts

@@ -38,11 +38,17 @@ export interface SignInJitRequiredResult extends SignInContinuationTokenResult {
     authMethods: AuthenticationMethod[];
 }
 
+export interface SignInMfaRequiredResult extends SignInContinuationTokenResult {
+    type: typeof SIGN_IN_MFA_REQUIRED_RESULT_TYPE;
+    authMethods: AuthenticationMethod[];
+}
+
 export const SIGN_IN_CODE_SEND_RESULT_TYPE = "SignInCodeSendResult";
 export const SIGN_IN_PASSWORD_REQUIRED_RESULT_TYPE =
     "SignInPasswordRequiredResult";
 export const SIGN_IN_COMPLETED_RESULT_TYPE = "SignInCompletedResult";
 export const SIGN_IN_JIT_REQUIRED_RESULT_TYPE = "SignInJitRequiredResult";
+export const SIGN_IN_MFA_REQUIRED_RESULT_TYPE = "SignInMfaRequiredResult";
 
 export function createSignInCompleteResult(
     input: Omit<SignInCompletedResult, "type">
@@ -79,3 +85,12 @@ export function createSignInJitRequiredResult(
         ...input,
     };
 }
+
+export function createSignInMfaRequiredResult(
+    input: Omit<SignInMfaRequiredResult, "type">
+): SignInMfaRequiredResult {
+    return {
+        type: SIGN_IN_MFA_REQUIRED_RESULT_TYPE,
+        ...input,
+    };
+}

package/src/error/NativeAuthError.ts

@@ -67,6 +67,7 @@ export function isFatalNativeAuthError(error: NativeAuthError): boolean {
 
     switch (error.errorCode) {
         case NativeAuthErrorCodes.contentError:
+        case NativeAuthErrorCodes.pageException:
             return true;
         default:
             return false;

package/src/error/NativeAuthErrorCodes.ts

@@ -4,4 +4,5 @@
  */
 
 export const contentError = "ContentError";
+export const pageException = "PageException";
 export const userSwitch = "user_switch";

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -1026,6 +1026,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             case PromptValue.NONE:
             case PromptValue.CONSENT:
             case PromptValue.LOGIN:
+            case PromptValue.SELECT_ACCOUNT:
                 this.logger.trace(
                     "initializeNativeRequest: prompt is compatible with native flow"
                 );

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.23.0";
+export const version = "4.24.1";

package/src/telemetry/BrowserPerformanceClient.ts

@@ -4,6 +4,7 @@
  */
 
 import {
+    AccountInfo,
     Constants,
     InProgressPerformanceEvent,
     IPerformanceClient,
@@ -163,7 +164,8 @@ export class BrowserPerformanceClient
             ...inProgressEvent,
             end: (
                 event?: Partial<PerformanceEvent>,
-                error?: unknown
+                error?: unknown,
+                account?: AccountInfo
             ): PerformanceEvent | null => {
                 const res = inProgressEvent.end(
                     {
@@ -172,7 +174,8 @@ export class BrowserPerformanceClient
                         endPageVisibility: this.getPageVisibility(),
                         durationMs: getPerfDurationMs(startTime),
                     },
-                    error
+                    error,
+                    account
                 );
                 void browserMeasurement?.then((measurement) =>
                     measurement.endMeasurement()