@azure/msal-browser 4.24.0 → 5.0.0-alpha.0

package/src/protocol/Authorize.ts

@@ -4,7 +4,6 @@
  */
 
 import {
-    AuthenticationScheme,
     Authority,
     AuthorizeProtocol,
     ClientConfigurationErrorCodes,
@@ -17,8 +16,6 @@ import {
     PopTokenGenerator,
     ProtocolMode,
     RequestParameterBuilder,
-    OAuthResponseType,
-    Constants,
     CommonAuthorizationCodeRequest,
     AuthorizationCodeClient,
     ProtocolUtils,
@@ -28,7 +25,9 @@ import {
     TimeUtils,
     AuthorizationCodePayload,
     ServerAuthorizationTokenResponse,
+    Constants,
 } from "@azure/msal-common/browser";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import { ApiId, BrowserConstants } from "../utils/BrowserConstants.js";
 import { version } from "../packageMetadata.js";
@@ -73,7 +72,7 @@ async function getStandardParameters(
         os: "",
         cpu: "",
     });
-    if (config.auth.protocolMode !== ProtocolMode.OIDC) {
+    if (config.system.protocolMode !== ProtocolMode.OIDC) {
         RequestParameterBuilder.addApplicationTelemetry(
             parameters,
             config.telemetry.application
@@ -84,18 +83,15 @@ async function getStandardParameters(
         // signal ests that this is a WAM call
         RequestParameterBuilder.addNativeBroker(parameters);
 
-        // instrument JS-platform bridge specific fields
-        performanceClient.addFields(
-            {
-                isPlatformAuthorizeRequest: true,
-            },
-            request.correlationId
-        );
-
         // pass the req_cnf for POP
-        if (request.authenticationScheme === AuthenticationScheme.POP) {
+        if (
+            request.authenticationScheme === Constants.AuthenticationScheme.POP
+        ) {
             const cryptoOps = new CryptoOps(logger, performanceClient);
-            const popTokenGenerator = new PopTokenGenerator(cryptoOps);
+            const popTokenGenerator = new PopTokenGenerator(
+                cryptoOps,
+                performanceClient
+            );
 
             // req_cnf is always sent as a string for SPAs
             let reqCnfData;
@@ -148,12 +144,15 @@ export async function getAuthCodeRequestUrl(
 
     const parameters = await invokeAsync(
         getStandardParameters,
-        PerformanceEvents.GetStandardParams,
+        BrowserPerformanceEvents.GetStandardParams,
         logger,
         performanceClient,
         request.correlationId
     )(config, authority, request, logger, performanceClient);
-    RequestParameterBuilder.addResponseType(parameters, OAuthResponseType.CODE);
+    RequestParameterBuilder.addResponseType(
+        parameters,
+        Constants.OAuthResponseType.CODE
+    );
 
     RequestParameterBuilder.addCodeChallengeParams(
         parameters,
@@ -166,12 +165,7 @@ export async function getAuthCodeRequestUrl(
         request.extraQueryParameters || {}
     );
 
-    return AuthorizeProtocol.getAuthorizeUrl(
-        authority,
-        parameters,
-        config.auth.encodeExtraQueryParams,
-        request.extraQueryParameters
-    );
+    return AuthorizeProtocol.getAuthorizeUrl(authority, parameters);
 }
 
 /**
@@ -199,7 +193,7 @@ export async function getEARForm(
 
     RequestParameterBuilder.addResponseType(
         parameters,
-        OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN
+        Constants.OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN
     );
     RequestParameterBuilder.addEARParameters(parameters, request.earJwk);
 
@@ -208,60 +202,7 @@ export async function getEARForm(
         queryParams,
         request.extraQueryParameters || {}
     );
-    const url = AuthorizeProtocol.getAuthorizeUrl(
-        authority,
-        queryParams,
-        config.auth.encodeExtraQueryParams,
-        request.extraQueryParameters
-    );
-
-    return createForm(frame, url, parameters);
-}
-
-/**
- * Gets the form that will be posted to /authorize with request parameters when using POST method
- */
-export async function getCodeForm(
-    frame: Document,
-    config: BrowserConfiguration,
-    authority: Authority,
-    request: CommonAuthorizationUrlRequest,
-    logger: Logger,
-    performanceClient: IPerformanceClient
-): Promise<HTMLFormElement> {
-    const parameters = await getStandardParameters(
-        config,
-        authority,
-        request,
-        logger,
-        performanceClient
-    );
-
-    RequestParameterBuilder.addResponseType(parameters, OAuthResponseType.CODE);
-
-    RequestParameterBuilder.addCodeChallengeParams(
-        parameters,
-        request.codeChallenge,
-        request.codeChallengeMethod || Constants.S256_CODE_CHALLENGE_METHOD
-    );
-
-    RequestParameterBuilder.addPostBodyParameters(
-        parameters,
-        request.authorizePostBodyParameters || {}
-    );
-
-    const queryParams = new Map<string, string>();
-    RequestParameterBuilder.addExtraQueryParameters(
-        queryParams,
-        request.extraQueryParameters || {}
-    );
-
-    const url = AuthorizeProtocol.getAuthorizeUrl(
-        authority,
-        queryParams,
-        config.auth.encodeExtraQueryParams,
-        request.extraQueryParameters
-    );
+    const url = AuthorizeProtocol.getAuthorizeUrl(authority, queryParams);
 
     return createForm(frame, url, parameters);
 }
@@ -321,7 +262,10 @@ export async function handleResponsePlatformBroker(
     performanceClient: IPerformanceClient,
     platformAuthProvider?: IPlatformAuthHandler
 ): Promise<AuthenticationResult> {
-    logger.verbose("Account id found, calling WAM for token");
+    logger.verbose(
+        "Account id found, calling WAM for token",
+        request.correlationId
+    );
 
     if (!platformAuthProvider) {
         throw createBrowserAuthError(
@@ -349,7 +293,7 @@ export async function handleResponsePlatformBroker(
     );
     return invokeAsync(
         nativeInteractionClient.acquireToken.bind(nativeInteractionClient),
-        PerformanceEvents.NativeInteractionClientAcquireToken,
+        BrowserPerformanceEvents.NativeInteractionClientAcquireToken,
         logger,
         performanceClient,
         request.correlationId
@@ -394,7 +338,7 @@ export async function handleResponseCode(
     if (response.accountId) {
         return invokeAsync(
             handleResponsePlatformBroker,
-            PerformanceEvents.HandleResponsePlatformBroker,
+            BrowserPerformanceEvents.HandleResponsePlatformBroker,
             logger,
             performanceClient,
             request.correlationId
@@ -427,7 +371,7 @@ export async function handleResponseCode(
     // Handle response from hash string.
     const result = await invokeAsync(
         interactionHandler.handleCodeResponse.bind(interactionHandler),
-        PerformanceEvents.HandleCodeResponse,
+        BrowserPerformanceEvents.HandleCodeResponse,
         logger,
         performanceClient,
         request.correlationId
@@ -485,7 +429,7 @@ export async function handleResponseEAR(
     const decryptedData = JSON.parse(
         await invokeAsync(
             decryptEarResponse,
-            PerformanceEvents.DecryptEarResponse,
+            BrowserPerformanceEvents.DecryptEarResponse,
             logger,
             performanceClient,
             request.correlationId
@@ -495,7 +439,7 @@ export async function handleResponseEAR(
     if (decryptedData.accountId) {
         return invokeAsync(
             handleResponsePlatformBroker,
-            PerformanceEvents.HandleResponsePlatformBroker,
+            BrowserPerformanceEvents.HandleResponsePlatformBroker,
             logger,
             performanceClient,
             request.correlationId
@@ -518,13 +462,13 @@ export async function handleResponseEAR(
         browserStorage,
         new CryptoOps(logger, performanceClient),
         logger,
+        performanceClient,
         null,
-        null,
-        performanceClient
+        null
     );
 
     // Validate response. This function throws a server error if an error is returned by the server.
-    responseHandler.validateTokenResponse(decryptedData);
+    responseHandler.validateTokenResponse(decryptedData, request.correlationId);
 
     // Temporary until response handler is refactored to be more flow agnostic.
     const additionalData: AuthorizationCodePayload = {

package/src/request/AuthorizationCodeRequest.ts

@@ -6,10 +6,7 @@
 import { CommonAuthorizationCodeRequest } from "@azure/msal-common/browser";
 
 export type AuthorizationCodeRequest = Partial<
-    Omit<
-        CommonAuthorizationCodeRequest,
-        "code" | "enableSpaAuthorizationCode" | "requestedClaimsHash"
-    >
+    Omit<CommonAuthorizationCodeRequest, "code" | "enableSpaAuthorizationCode">
 > & {
     code?: string;
     nativeAccountId?: string;

package/src/request/PopupRequest.ts

@@ -43,7 +43,6 @@ export type PopupRequest = Partial<
         | "earJwk"
         | "codeChallenge"
         | "codeChallengeMethod"
-        | "requestedClaimsHash"
         | "platformBroker"
     >
 > & {

package/src/request/RedirectRequest.ts

@@ -31,7 +31,6 @@ import { CommonAuthorizationUrlRequest } from "@azure/msal-common/browser";
  * - claims                     - In cases where Azure AD tenant admin has enabled conditional access policies, and the policy has not been met, exceptions will contain claims that need to be consented to.
  * - nonce                      - A value included in the request that is returned in the id token. A randomly generated unique value is typically used to mitigate replay attacks.
  * - redirectStartPage          - The page that should be returned to after loginRedirect or acquireTokenRedirect. This should only be used if this is different from the redirectUri and will default to the page that initiates the request. When the navigateToLoginRequestUrl config option is set to false this parameter will be ignored.
- * - onRedirectNavigate         - Callback that will be passed the url that MSAL will navigate to. Returning false in the callback will stop navigation.
  */
 export type RedirectRequest = Partial<
     Omit<
@@ -41,16 +40,9 @@ export type RedirectRequest = Partial<
         | "earJwk"
         | "codeChallenge"
         | "codeChallengeMethod"
-        | "requestedClaimsHash"
         | "platformBroker"
     >
 > & {
     scopes: Array<string>;
     redirectStartPage?: string;
-    /**
-     * @deprecated
-     * onRedirectNavigate is deprecated and will be removed in the next major version.
-     * Set onRedirectNavigate in Configuration instead.
-     */
-    onRedirectNavigate?: (url: string) => boolean | void;
 };

package/src/request/RequestHelpers.ts

@@ -5,39 +5,34 @@
 
 import {
     AccountInfo,
-    AuthenticationScheme,
+    Constants,
     BaseAuthRequest,
     ClientConfigurationErrorCodes,
     CommonSilentFlowRequest,
-    HttpMethod,
     IPerformanceClient,
     Logger,
-    PerformanceEvents,
-    ProtocolMode,
-    StringUtils,
     createClientConfigurationError,
     invokeAsync,
 } from "@azure/msal-common/browser";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import { SilentRequest } from "./SilentRequest.js";
-import { hashString } from "../crypto/BrowserCrypto.js";
-import { PopupRequest } from "./PopupRequest.js";
-import { RedirectRequest } from "./RedirectRequest.js";
 
 /**
  * Initializer function for all request APIs
  * @param request
+ * @param config
+ * @param performanceClient
+ * @param logger
+ * @param correlationId
  */
 export async function initializeBaseRequest(
     request: Partial<BaseAuthRequest> & { correlationId: string },
     config: BrowserConfiguration,
     performanceClient: IPerformanceClient,
-    logger: Logger
+    logger: Logger,
+    correlationId: string
 ): Promise<BaseAuthRequest> {
-    performanceClient.addQueueMeasurement(
-        PerformanceEvents.InitializeBaseRequest,
-        request.correlationId
-    );
     const authority = request.authority || config.auth.authority;
 
     const scopes = [...((request && request.scopes) || [])];
@@ -51,13 +46,16 @@ export async function initializeBaseRequest(
 
     // Set authenticationScheme to BEARER if not explicitly set in the request
     if (!validatedRequest.authenticationScheme) {
-        validatedRequest.authenticationScheme = AuthenticationScheme.BEARER;
+        validatedRequest.authenticationScheme =
+            Constants.AuthenticationScheme.BEARER;
         logger.verbose(
-            'Authentication Scheme wasn\'t explicitly set in request, defaulting to "Bearer" request'
+            'Authentication Scheme was not explicitly set in request, defaulting to "Bearer" request',
+            correlationId
         );
     } else {
         if (
-            validatedRequest.authenticationScheme === AuthenticationScheme.SSH
+            validatedRequest.authenticationScheme ===
+            Constants.AuthenticationScheme.SSH
         ) {
             if (!request.sshJwk) {
                 throw createClientConfigurationError(
@@ -71,20 +69,11 @@ export async function initializeBaseRequest(
             }
         }
         logger.verbose(
-            `Authentication Scheme set to "${validatedRequest.authenticationScheme}" as configured in Auth request`
+            `Authentication Scheme set to "'${validatedRequest.authenticationScheme}'" as configured in Auth request`,
+            correlationId
         );
     }
 
-    // Set requested claims hash if claims-based caching is enabled and claims were requested
-    if (
-        config.cache.claimsBasedCachingEnabled &&
-        request.claims &&
-        // Checks for empty stringified object "{}" which doesn't qualify as requested claims
-        !StringUtils.isEmptyObj(request.claims)
-    ) {
-        validatedRequest.requestedClaimsHash = await hashString(request.claims);
-    }
-
     return validatedRequest;
 }
 
@@ -95,18 +84,13 @@ export async function initializeSilentRequest(
     performanceClient: IPerformanceClient,
     logger: Logger
 ): Promise<CommonSilentFlowRequest> {
-    performanceClient.addQueueMeasurement(
-        PerformanceEvents.InitializeSilentRequest,
-        request.correlationId
-    );
-
     const baseRequest = await invokeAsync(
         initializeBaseRequest,
-        PerformanceEvents.InitializeBaseRequest,
+        BrowserPerformanceEvents.InitializeBaseRequest,
         logger,
         performanceClient,
         request.correlationId
-    )(request, config, performanceClient, logger);
+    )(request, config, performanceClient, logger, request.correlationId);
     return {
         ...request,
         ...baseRequest,
@@ -114,44 +98,3 @@ export async function initializeSilentRequest(
         forceRefresh: request.forceRefresh || false,
     };
 }
-
-/**
- * Validates that the combination of request method, protocol mode and authorize body parameters is correct.
- * Returns the validated or defaulted HTTP method or throws if the configured combination is invalid.
- * @param interactionRequest
- * @param protocolMode
- * @returns
- */
-export function validateRequestMethod(
-    interactionRequest: BaseAuthRequest | PopupRequest | RedirectRequest,
-    protocolMode: ProtocolMode
-): HttpMethod {
-    let httpMethod: HttpMethod | undefined;
-    const requestMethod = interactionRequest.httpMethod;
-
-    if (protocolMode === ProtocolMode.EAR) {
-        // Don't override httpMethod if it is already set, default to POST if not set
-        httpMethod = requestMethod || HttpMethod.POST;
-        // Validate that method is not GET if protocol mode is EAR
-        if (httpMethod !== HttpMethod.POST) {
-            throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.invalidRequestMethodForEAR
-            );
-        }
-    } else {
-        // For non-EAR protocol modes, default to GET if httpMethod is not set
-        httpMethod = requestMethod || HttpMethod.GET;
-    }
-
-    // Regardless of protocolMode, if there are authorizePostBodyParameters, validate the request method is POST
-    if (
-        interactionRequest.authorizePostBodyParameters &&
-        httpMethod !== HttpMethod.POST
-    ) {
-        throw createClientConfigurationError(
-            ClientConfigurationErrorCodes.invalidAuthorizePostBodyParameters
-        );
-    }
-
-    return httpMethod;
-}

package/src/request/SilentRequest.ts

@@ -31,11 +31,7 @@ import { CacheLookupPolicy } from "../utils/BrowserConstants.js";
  */
 export type SilentRequest = Omit<
     CommonSilentFlowRequest,
-    | "authority"
-    | "correlationId"
-    | "forceRefresh"
-    | "account"
-    | "requestedClaimsHash"
+    "authority" | "correlationId" | "forceRefresh" | "account"
 > & {
     redirectUri?: string;
     extraQueryParameters?: StringDict;

package/src/request/SsoSilentRequest.ts

@@ -37,7 +37,6 @@ export type SsoSilentRequest = Partial<
         | "earJwk"
         | "codeChallenge"
         | "codeChallengeMethod"
-        | "requestedClaimsHash"
         | "platformBroker"
     >
 >;

package/src/response/ResponseHandler.ts

@@ -19,7 +19,8 @@ import { InteractionType } from "../utils/BrowserConstants.js";
 export function deserializeResponse(
     responseString: string,
     responseLocation: string,
-    logger: Logger
+    logger: Logger,
+    correlationId: string
 ): AuthorizeResponse {
     // Deserialize hash fragment response parameters.
     const serverParams = UrlUtils.getDeserializedResponse(responseString);
@@ -27,15 +28,18 @@ export function deserializeResponse(
         if (!UrlUtils.stripLeadingHashOrQuery(responseString)) {
             // Hash or Query string is empty
             logger.error(
-                `The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`
+                `The request has returned to the redirectUri but a '${responseLocation}' is not present. It's likely that the '${responseLocation}' has been removed or the page has been redirected by code running on the redirectUri page.`,
+                correlationId
             );
             throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
         } else {
             logger.error(
-                `A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`
+                `A '${responseLocation}' is present in the iframe but it does not contain known properties. It's likely that the '${responseLocation}' has been replaced by code running on the redirectUri page.`,
+                correlationId
             );
             logger.errorPii(
-                `The ${responseLocation} detected is: ${responseString}`
+                `The '${responseLocation}' detected is: '${responseString}'`,
+                correlationId
             );
             throw createBrowserAuthError(
                 BrowserAuthErrorCodes.hashDoesNotContainKnownProperties

package/src/telemetry/BrowserPerformanceClient.ts

@@ -4,15 +4,12 @@
  */
 
 import {
-    AccountInfo,
     Constants,
     InProgressPerformanceEvent,
     IPerformanceClient,
     Logger,
     PerformanceClient,
     PerformanceEvent,
-    PerformanceEvents,
-    PreQueueEvent,
     SubMeasurement,
 } from "@azure/msal-common/browser";
 import { Configuration } from "../config/Configuration.js";
@@ -68,11 +65,7 @@ export class BrowserPerformanceClient
     extends PerformanceClient
     implements IPerformanceClient
 {
-    constructor(
-        configuration: Configuration,
-        intFields?: Set<string>,
-        abbreviations?: Map<string, string>
-    ) {
+    constructor(configuration: Configuration, intFields?: Set<string>) {
         super(
             configuration.auth.clientId,
             configuration.auth.authority || `${Constants.DEFAULT_AUTHORITY}`,
@@ -87,8 +80,7 @@ export class BrowserPerformanceClient
                 appName: "",
                 appVersion: "",
             },
-            intFields,
-            abbreviations
+            intFields
         );
     }
 
@@ -164,8 +156,7 @@ export class BrowserPerformanceClient
             ...inProgressEvent,
             end: (
                 event?: Partial<PerformanceEvent>,
-                error?: unknown,
-                account?: AccountInfo
+                error?: unknown
             ): PerformanceEvent | null => {
                 const res = inProgressEvent.end(
                     {
@@ -174,8 +165,7 @@ export class BrowserPerformanceClient
                         endPageVisibility: this.getPageVisibility(),
                         durationMs: getPerfDurationMs(startTime),
                     },
-                    error,
-                    account
+                    error
                 );
                 void browserMeasurement?.then((measurement) =>
                     measurement.endMeasurement()
@@ -193,98 +183,4 @@ export class BrowserPerformanceClient
             },
         };
     }
-
-    /**
-     * Adds pre-queue time to preQueueTimeByCorrelationId map.
-     * @param {PerformanceEvents} eventName
-     * @param {?string} correlationId
-     * @returns
-     */
-    setPreQueueTime(
-        eventName: PerformanceEvents,
-        correlationId?: string
-    ): void {
-        if (!supportsBrowserPerformanceNow()) {
-            this.logger.trace(
-                `BrowserPerformanceClient: window performance API not available, unable to set telemetry queue time for ${eventName}`
-            );
-            return;
-        }
-
-        if (!correlationId) {
-            this.logger.trace(
-                `BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to set telemetry queue time`
-            );
-            return;
-        }
-
-        const preQueueEvent: PreQueueEvent | undefined =
-            this.preQueueTimeByCorrelationId.get(correlationId);
-        /**
-         * Manually complete queue measurement if there is an incomplete pre-queue event.
-         * Incomplete pre-queue events are instrumentation bugs that should be fixed.
-         */
-        if (preQueueEvent) {
-            this.logger.trace(
-                `BrowserPerformanceClient: Incomplete pre-queue ${preQueueEvent.name} found`,
-                correlationId
-            );
-            this.addQueueMeasurement(
-                preQueueEvent.name,
-                correlationId,
-                undefined,
-                true
-            );
-        }
-        this.preQueueTimeByCorrelationId.set(correlationId, {
-            name: eventName,
-            time: window.performance.now(),
-        });
-    }
-
-    /**
-     * Calculates and adds queue time measurement for given performance event.
-     *
-     * @param {PerformanceEvents} eventName
-     * @param {?string} correlationId
-     * @param {?number} queueTime
-     * @param {?boolean} manuallyCompleted - indicator for manually completed queue measurements
-     * @returns
-     */
-    addQueueMeasurement(
-        eventName: string,
-        correlationId?: string,
-        queueTime?: number,
-        manuallyCompleted?: boolean
-    ): void {
-        if (!supportsBrowserPerformanceNow()) {
-            this.logger.trace(
-                `BrowserPerformanceClient: window performance API not available, unable to add queue measurement for ${eventName}`
-            );
-            return;
-        }
-
-        if (!correlationId) {
-            this.logger.trace(
-                `BrowserPerformanceClient: correlationId for ${eventName} not provided, unable to add queue measurement`
-            );
-            return;
-        }
-
-        const preQueueTime = super.getPreQueueTime(eventName, correlationId);
-        if (!preQueueTime) {
-            return;
-        }
-
-        const currentTime = window.performance.now();
-        const resQueueTime =
-            queueTime || super.calculateQueuedTime(preQueueTime, currentTime);
-
-        return super.addQueueMeasurement(
-            eventName,
-            correlationId,
-            resQueueTime,
-            manuallyCompleted
-        );
-    }
 }