@azure/msal-browser 4.24.1 → 4.25.0

package/src/custom_auth/core/network_client/custom_auth_api/types/ApiSuberrors.ts

@@ -14,3 +14,4 @@ export const ATTRIBUTE_VALIATION_FAILED = "attribute_validation_failed";
 export const NATIVEAUTHAPI_DISABLED = "nativeauthapi_disabled";
 export const REGISTRATION_REQUIRED = "registration_required";
 export const MFA_REQUIRED = "mfa_required";
+export const PROVIDER_BLOCKED_BY_REPUTATION = "provider_blocked_by_rep";

package/src/custom_auth/get_account/interaction_client/CustomAuthSilentCacheClient.ts

@@ -37,12 +37,14 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
     override async acquireToken(
         silentRequest: CommonSilentFlowRequest
     ): Promise<AuthenticationResult> {
+        const correlationId = silentRequest.correlationId || this.correlationId;
         const telemetryManager = this.initializeServerTelemetryManager(
             PublicApiId.ACCOUNT_GET_ACCESS_TOKEN
         );
         const clientConfig = this.getCustomAuthClientConfiguration(
             telemetryManager,
-            this.customAuthAuthority
+            this.customAuthAuthority,
+            correlationId
         );
         const silentFlowClient = new SilentFlowClient(
             clientConfig,
@@ -52,7 +54,7 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
         try {
             this.logger.verbose(
                 "Starting silent flow to acquire token from cache",
-                this.correlationId
+                correlationId
             );
 
             const result = await silentFlowClient.acquireCachedToken(
@@ -61,7 +63,7 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
 
             this.logger.verbose(
                 "Silent flow to acquire token from cache is completed and token is found",
-                this.correlationId
+                correlationId
             );
 
             return result[0] as AuthenticationResult;
@@ -72,7 +74,7 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
             ) {
                 this.logger.verbose(
                     "Token refresh is required to acquire token silently",
-                    this.correlationId
+                    correlationId
                 );
 
                 const refreshTokenClient = new RefreshTokenClient(
@@ -82,7 +84,7 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
 
                 this.logger.verbose(
                     "Starting refresh flow to refresh token",
-                    this.correlationId
+                    correlationId
                 );
 
                 const refreshTokenResult =
@@ -92,7 +94,7 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
 
                 this.logger.verbose(
                     "Refresh flow to refresh token is completed",
-                    this.correlationId
+                    correlationId
                 );
 
                 return refreshTokenResult as AuthenticationResult;
@@ -103,18 +105,17 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
     }
 
     override async logout(logoutRequest?: ClearCacheRequest): Promise<void> {
+        const correlationId =
+            logoutRequest?.correlationId || this.correlationId;
         const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
 
         // Clear the cache
-        this.logger.verbose(
-            "Start to clear the cache",
-            logoutRequest?.correlationId
-        );
+        this.logger.verbose("Start to clear the cache", correlationId);
         await this.clearCacheOnLogout(
-            validLogoutRequest.correlationId,
+            correlationId,
             validLogoutRequest?.account
         );
-        this.logger.verbose("Cache cleared", logoutRequest?.correlationId);
+        this.logger.verbose("Cache cleared", correlationId);
 
         const postLogoutRedirectUri = this.config.auth.postLogoutRedirectUri;
 
@@ -126,7 +127,7 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
 
             this.logger.verbose(
                 "Post logout redirect uri is set, redirecting to uri",
-                logoutRequest?.correlationId
+                correlationId
             );
 
             // Redirect to post logout redirect uri
@@ -173,7 +174,8 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
 
     private getCustomAuthClientConfiguration(
         serverTelemetryManager: ServerTelemetryManager,
-        customAuthAuthority: CustomAuthAuthority
+        customAuthAuthority: CustomAuthAuthority,
+        correlationId: string
     ): ClientConfiguration {
         const logger = this.config.system.loggerOptions;
 
@@ -193,7 +195,7 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
                 loggerCallback: logger.loggerCallback,
                 piiLoggingEnabled: logger.piiLoggingEnabled,
                 logLevel: logger.logLevel,
-                correlationId: this.correlationId,
+                correlationId: correlationId,
             },
             cacheOptions: {
                 claimsBasedCachingEnabled:

package/src/custom_auth/index.ts

@@ -212,5 +212,27 @@ export {
 // Auth Method Registration Types
 export { AuthMethodDetails } from "./core/auth_flow/jit/AuthMethodDetails.js";
 
+// MFA State
+export { MfaAwaitingState } from "./core/auth_flow/mfa/state/MfaState.js";
+export { MfaVerificationRequiredState } from "./core/auth_flow/mfa/state/MfaState.js";
+export { MfaCompletedState } from "./core/auth_flow/mfa/state/MfaCompletedState.js";
+export { MfaFailedState } from "./core/auth_flow/mfa/state/MfaFailedState.js";
+
+// MFA Results
+export {
+    MfaRequestChallengeResult,
+    MfaRequestChallengeResultState,
+} from "./core/auth_flow/mfa/result/MfaRequestChallengeResult.js";
+export {
+    MfaSubmitChallengeResult,
+    MfaSubmitChallengeResultState,
+} from "./core/auth_flow/mfa/result/MfaSubmitChallengeResult.js";
+
+// MFA Errors
+export {
+    MfaRequestChallengeError,
+    MfaSubmitChallengeError,
+} from "./core/auth_flow/mfa/error_type/MfaError.js";
+
 // Components from msal_browser
 export { LogLevel } from "@azure/msal-common/browser";

package/src/custom_auth/reset_password/auth_flow/state/ResetPasswordCodeRequiredState.ts

@@ -56,6 +56,7 @@ export class ResetPasswordCodeRequiredState extends ResetPasswordState<ResetPass
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
                     jitClient: this.stateParameters.jitClient,
+                    mfaClient: this.stateParameters.mfaClient,
                     username: this.stateParameters.username,
                 })
             );
@@ -108,6 +109,7 @@ export class ResetPasswordCodeRequiredState extends ResetPasswordState<ResetPass
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
                     jitClient: this.stateParameters.jitClient,
+                    mfaClient: this.stateParameters.mfaClient,
                     username: this.stateParameters.username,
                     codeLength: result.codeLength,
                 })

package/src/custom_auth/reset_password/auth_flow/state/ResetPasswordPasswordRequiredState.ts

@@ -59,6 +59,7 @@ export class ResetPasswordPasswordRequiredState extends ResetPasswordState<Reset
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
                     jitClient: this.stateParameters.jitClient,
+                    mfaClient: this.stateParameters.mfaClient,
                     signInScenario: SignInScenario.SignInAfterPasswordReset,
                 })
             );

package/src/custom_auth/reset_password/auth_flow/state/ResetPasswordStateParameters.ts

@@ -8,6 +8,7 @@ import { SignInClient } from "../../../sign_in/interaction_client/SignInClient.j
 import { CustomAuthSilentCacheClient } from "../../../get_account/interaction_client/CustomAuthSilentCacheClient.js";
 import { AuthFlowActionRequiredStateParameters } from "../../../core/auth_flow/AuthFlowState.js";
 import { JitClient } from "../../../core/interaction_client/jit/JitClient.js";
+import { MfaClient } from "../../../core/interaction_client/mfa/MfaClient.js";
 
 export interface ResetPasswordStateParameters
     extends AuthFlowActionRequiredStateParameters {
@@ -16,6 +17,7 @@ export interface ResetPasswordStateParameters
     signInClient: SignInClient;
     cacheClient: CustomAuthSilentCacheClient;
     jitClient: JitClient;
+    mfaClient: MfaClient;
 }
 
 export type ResetPasswordPasswordRequiredStateParameters =

package/src/custom_auth/sign_in/auth_flow/result/SignInResult.ts

@@ -11,6 +11,7 @@ import { SignInPasswordRequiredState } from "../state/SignInPasswordRequiredStat
 import { SignInFailedState } from "../state/SignInFailedState.js";
 import { SignInCompletedState } from "../state/SignInCompletedState.js";
 import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
+import { MfaAwaitingState } from "../../../core/auth_flow/mfa/state/MfaState.js";
 
 /*
  * Result of a sign-in operation.
@@ -81,6 +82,14 @@ export class SignInResult extends AuthFlowResultBase<
     } {
         return this.state instanceof AuthMethodRegistrationRequiredState;
     }
+
+    /**
+     * Checks if the result requires MFA.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isMfaRequired(): this is SignInResult & { state: MfaAwaitingState } {
+        return this.state instanceof MfaAwaitingState;
+    }
 }
 
 /**
@@ -91,10 +100,12 @@ export class SignInResult extends AuthFlowResultBase<
  * - SignInFailedState: The sign-in process has failed.
  * - SignInCompletedState: The sign-in process is completed.
  * - AuthMethodRegistrationRequiredState: The sign-in process requires authentication method registration.
+ * - MfaAwaitingState: The sign-in process requires MFA.
  */
 export type SignInResultState =
     | SignInCodeRequiredState
     | SignInPasswordRequiredState
     | SignInFailedState
     | SignInCompletedState
-    | AuthMethodRegistrationRequiredState;
+    | AuthMethodRegistrationRequiredState
+    | MfaAwaitingState;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitCodeResult.ts

@@ -8,6 +8,8 @@ import { SignInCompletedState } from "../state/SignInCompletedState.js";
 import { SignInFailedState } from "../state/SignInFailedState.js";
 import { AuthFlowResultBase } from "../../../core/auth_flow/AuthFlowResultBase.js";
 import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
+import { MfaAwaitingState } from "../../../core/auth_flow/mfa/state/MfaState.js";
 
 /*
  * Result of a sign-in submit code operation.
@@ -46,6 +48,26 @@ export class SignInSubmitCodeResult extends AuthFlowResultBase<
     } {
         return this.state instanceof SignInCompletedState;
     }
+
+    /**
+     * Checks if the result requires authentication method registration.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isAuthMethodRegistrationRequired(): this is SignInSubmitCodeResult & {
+        state: AuthMethodRegistrationRequiredState;
+    } {
+        return this.state instanceof AuthMethodRegistrationRequiredState;
+    }
+
+    /**
+     * Checks if the result requires MFA.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isMfaRequired(): this is SignInSubmitCodeResult & {
+        state: MfaAwaitingState;
+    } {
+        return this.state instanceof MfaAwaitingState;
+    }
 }
 
 /**
@@ -53,7 +75,11 @@ export class SignInSubmitCodeResult extends AuthFlowResultBase<
  * This includes:
  * - SignInCompletedState: The sign-in process has completed successfully.
  * - SignInFailedState: The sign-in process has failed.
+ * - AuthMethodRegistrationRequiredState: The user needs to register an authentication method.
+ * - MfaAwaitingState: The user is in a multi-factor authentication (MFA) waiting state.
  */
 export type SignInSubmitCodeResultState =
     | SignInCompletedState
-    | SignInFailedState;
+    | SignInFailedState
+    | AuthMethodRegistrationRequiredState
+    | MfaAwaitingState;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitPasswordResult.ts

@@ -9,6 +9,7 @@ import { SignInFailedState } from "../state/SignInFailedState.js";
 import { AuthFlowResultBase } from "../../../core/auth_flow/AuthFlowResultBase.js";
 import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
 import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
+import { MfaAwaitingState } from "../../../core/auth_flow/mfa/state/MfaState.js";
 
 /*
  * Result of a sign-in submit password operation.
@@ -54,6 +55,16 @@ export class SignInSubmitPasswordResult extends AuthFlowResultBase<
     } {
         return this.state instanceof AuthMethodRegistrationRequiredState;
     }
+
+    /**
+     * Checks if the result requires MFA.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
+     */
+    isMfaRequired(): this is SignInSubmitPasswordResult & {
+        state: MfaAwaitingState;
+    } {
+        return this.state instanceof MfaAwaitingState;
+    }
 }
 
 /**
@@ -62,8 +73,10 @@ export class SignInSubmitPasswordResult extends AuthFlowResultBase<
  * - SignInCompletedState: The sign-in process has completed successfully.
  * - SignInFailedState: The sign-in process has failed.
  * - AuthMethodRegistrationRequiredState: The sign-in process requires authentication method registration.
+ * - MfaAwaitingState: The sign-in process requires MFA.
  */
 export type SignInSubmitPasswordResultState =
     | SignInCompletedState
     | SignInFailedState
-    | AuthMethodRegistrationRequiredState;
+    | AuthMethodRegistrationRequiredState
+    | MfaAwaitingState;

package/src/custom_auth/sign_in/auth_flow/state/SignInCodeRequiredState.ts

@@ -3,7 +3,6 @@
  * Licensed under the MIT License.
  */
 
-import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
 import {
     SignInResendCodeParams,
     SignInSubmitCodeParams,
@@ -12,8 +11,6 @@ import { SignInResendCodeResult } from "../result/SignInResendCodeResult.js";
 import { SignInSubmitCodeResult } from "../result/SignInSubmitCodeResult.js";
 import { SignInCodeRequiredStateParameters } from "./SignInStateParameters.js";
 import { SignInState } from "./SignInState.js";
-import { SignInCompletedState } from "./SignInCompletedState.js";
-import { SIGN_IN_COMPLETED_RESULT_TYPE } from "../../interaction_client/result/SignInActionResult.js";
 
 /*
  * Sign-in code required state.
@@ -56,27 +53,19 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                 this.stateParameters.correlationId
             );
 
-            if (submitCodeResult.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
-                const accountInfo = new CustomAuthAccountData(
-                    submitCodeResult.authenticationResult.account,
-                    this.stateParameters.config,
-                    this.stateParameters.cacheClient,
-                    this.stateParameters.logger,
-                    this.stateParameters.correlationId
-                );
+            const nextState = this.handleSignInResult(
+                submitCodeResult,
+                this.stateParameters.scopes
+            );
 
-                return new SignInSubmitCodeResult(
-                    new SignInCompletedState(),
-                    accountInfo
-                );
-            } else {
-                // Unexpected result type
-                const result = submitCodeResult as { type: string };
-                const error = new Error(
-                    `Unexpected result type: ${result.type}`
-                );
-                return SignInSubmitCodeResult.createWithError(error);
+            if (nextState.error) {
+                return SignInSubmitCodeResult.createWithError(nextState.error);
             }
+
+            return new SignInSubmitCodeResult(
+                nextState.state,
+                nextState.accountInfo
+            );
         } catch (error) {
             this.stateParameters.logger.errorPii(
                 `Failed to submit code for sign-in. Error: ${error}.`,
@@ -125,6 +114,7 @@ export class SignInCodeRequiredState extends SignInState<SignInCodeRequiredState
                     signInClient: this.stateParameters.signInClient,
                     cacheClient: this.stateParameters.cacheClient,
                     jitClient: this.stateParameters.jitClient,
+                    mfaClient: this.stateParameters.mfaClient,
                     username: this.stateParameters.username,
                     codeLength: result.codeLength,
                     scopes: this.stateParameters.scopes,

package/src/custom_auth/sign_in/auth_flow/state/SignInContinuationState.ts

@@ -3,18 +3,11 @@
  * Licensed under the MIT License.
  */
 
-import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
 import { SignInContinuationTokenParams } from "../../interaction_client/parameter/SignInParams.js";
 import { SignInResult } from "../result/SignInResult.js";
 import { SignInWithContinuationTokenInputs } from "../../../CustomAuthActionInputs.js";
 import { SignInContinuationStateParameters } from "./SignInStateParameters.js";
 import { SignInState } from "./SignInState.js";
-import { SignInCompletedState } from "./SignInCompletedState.js";
-import {
-    SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
-    SIGN_IN_COMPLETED_RESULT_TYPE,
-} from "../../interaction_client/result/SignInActionResult.js";
-import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 import * as ArgumentValidator from "../../../core/utils/ArgumentValidator.js";
 
 /*
@@ -65,51 +58,16 @@ export class SignInContinuationState extends SignInState<SignInContinuationState
                 this.stateParameters.correlationId
             );
 
-            if (signInResult.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
-                // Sign-in completed successfully
-                const accountInfo = new CustomAuthAccountData(
-                    signInResult.authenticationResult.account,
-                    this.stateParameters.config,
-                    this.stateParameters.cacheClient,
-                    this.stateParameters.logger,
-                    this.stateParameters.correlationId
-                );
-
-                return new SignInResult(
-                    new SignInCompletedState(),
-                    accountInfo
-                );
-            } else if (signInResult.type === SIGN_IN_JIT_REQUIRED_RESULT_TYPE) {
-                // JIT is required
-                this.stateParameters.logger.warning(
-                    "Auth method registration required during continuation token sign-in.",
-                    this.stateParameters.correlationId
-                );
-
-                // Return AuthMethodRegistrationRequiredState to handle JIT scenario
-                const authMethodRegistrationState =
-                    new AuthMethodRegistrationRequiredState({
-                        correlationId: this.stateParameters.correlationId,
-                        continuationToken: signInResult.continuationToken,
-                        logger: this.stateParameters.logger,
-                        config: this.stateParameters.config,
-                        jitClient: this.stateParameters.jitClient,
-                        cacheClient: this.stateParameters.cacheClient,
-                        authMethods: signInResult.authMethods,
-                        username: this.stateParameters.username,
-                        scopes: signInWithContinuationTokenInputs?.scopes ?? [],
-                        claims: this.stateParameters.claims,
-                    });
+            const nextState = this.handleSignInResult(
+                signInResult,
+                signInWithContinuationTokenInputs?.scopes
+            );
 
-                return new SignInResult(authMethodRegistrationState);
-            } else {
-                // Unexpected result type
-                const result = signInResult as { type: string };
-                const error = new Error(
-                    `Unexpected result type: ${result.type}`
-                );
-                return SignInResult.createWithError(error);
+            if (nextState.error) {
+                return SignInResult.createWithError(nextState.error);
             }
+
+            return new SignInResult(nextState.state, nextState.accountInfo);
         } catch (error) {
             this.stateParameters.logger.errorPii(
                 `Failed to sign in with continuation token. Error: ${error}.`,

package/src/custom_auth/sign_in/auth_flow/state/SignInPasswordRequiredState.ts

@@ -3,17 +3,10 @@
  * Licensed under the MIT License.
  */
 
-import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
 import { SignInSubmitPasswordParams } from "../../interaction_client/parameter/SignInParams.js";
 import { SignInSubmitPasswordResult } from "../result/SignInSubmitPasswordResult.js";
-import { SignInCompletedState } from "./SignInCompletedState.js";
 import { SignInState } from "./SignInState.js";
 import { SignInPasswordRequiredStateParameters } from "./SignInStateParameters.js";
-import {
-    SIGN_IN_COMPLETED_RESULT_TYPE,
-    SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
-} from "../../interaction_client/result/SignInActionResult.js";
-import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
 
 /*
  * Sign-in password required state.
@@ -57,51 +50,21 @@ export class SignInPasswordRequiredState extends SignInState<SignInPasswordRequi
                 this.stateParameters.correlationId
             );
 
-            if (submitPasswordResult.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
-                const accountInfo = new CustomAuthAccountData(
-                    submitPasswordResult.authenticationResult.account,
-                    this.stateParameters.config,
-                    this.stateParameters.cacheClient,
-                    this.stateParameters.logger,
-                    this.stateParameters.correlationId
-                );
-
-                return new SignInSubmitPasswordResult(
-                    new SignInCompletedState(),
-                    accountInfo
-                );
-            } else if (
-                submitPasswordResult.type === SIGN_IN_JIT_REQUIRED_RESULT_TYPE
-            ) {
-                // JIT is required - return AuthMethodRegistrationRequiredState
-                this.stateParameters.logger.verbose(
-                    "Authentication method registration required after password submission.",
-                    this.stateParameters.correlationId
-                );
+            const nextState = this.handleSignInResult(
+                submitPasswordResult,
+                this.stateParameters.scopes
+            );
 
-                return new SignInSubmitPasswordResult(
-                    new AuthMethodRegistrationRequiredState({
-                        correlationId: this.stateParameters.correlationId,
-                        continuationToken:
-                            submitPasswordResult.continuationToken,
-                        logger: this.stateParameters.logger,
-                        config: this.stateParameters.config,
-                        jitClient: this.stateParameters.jitClient,
-                        cacheClient: this.stateParameters.cacheClient,
-                        authMethods: submitPasswordResult.authMethods,
-                        username: this.stateParameters.username,
-                        scopes: this.stateParameters.scopes ?? [],
-                        claims: this.stateParameters.claims,
-                    })
-                );
-            } else {
-                // Unexpected result type
-                const result = submitPasswordResult as { type: string };
-                const error = new Error(
-                    `Unexpected result type: ${result.type}`
+            if (nextState.error) {
+                return SignInSubmitPasswordResult.createWithError(
+                    nextState.error
                 );
-                return SignInSubmitPasswordResult.createWithError(error);
             }
+
+            return new SignInSubmitPasswordResult(
+                nextState.state,
+                nextState.accountInfo
+            );
         } catch (error) {
             this.stateParameters.logger.errorPii(
                 `Failed to sign in after submitting password. Error: ${error}.`,

package/src/custom_auth/sign_in/auth_flow/state/SignInState.ts

@@ -4,7 +4,20 @@
  */
 
 import { AuthFlowActionRequiredStateBase } from "../../../core/auth_flow/AuthFlowState.js";
+import { AuthMethodRegistrationRequiredState } from "../../../core/auth_flow/jit/state/AuthMethodRegistrationState.js";
+import { MfaAwaitingState } from "../../../core/auth_flow/mfa/state/MfaState.js";
 import { ensureArgumentIsNotEmptyString } from "../../../core/utils/ArgumentValidator.js";
+import { CustomAuthAccountData } from "../../../get_account/auth_flow/CustomAuthAccountData.js";
+import {
+    SIGN_IN_COMPLETED_RESULT_TYPE,
+    SIGN_IN_JIT_REQUIRED_RESULT_TYPE,
+    SIGN_IN_MFA_REQUIRED_RESULT_TYPE,
+    SignInCompletedResult,
+    SignInJitRequiredResult,
+    SignInMfaRequiredResult,
+} from "../../interaction_client/result/SignInActionResult.js";
+import { SignInCompletedState } from "./SignInCompletedState.js";
+import { SignInFailedState } from "./SignInFailedState.js";
 import { SignInStateParameters } from "./SignInStateParameters.js";
 
 /*
@@ -31,4 +44,99 @@ export abstract class SignInState<
             stateParameters.correlationId
         );
     }
+
+    /**
+     * Handles the result of a sign-in attempt.
+     * @param result - The result of the sign-in attempt.
+     * @param scopes - The scopes requested for the sign-in.
+     * @returns An object containing the next state and account information, if applicable.
+     */
+    protected handleSignInResult(
+        result:
+            | SignInCompletedResult
+            | SignInJitRequiredResult
+            | SignInMfaRequiredResult,
+        scopes?: string[]
+    ): {
+        state:
+            | SignInCompletedState
+            | AuthMethodRegistrationRequiredState
+            | MfaAwaitingState;
+        accountInfo?: CustomAuthAccountData;
+        error?: Error;
+    } {
+        const correlationId =
+            result.correlationId || this.stateParameters.correlationId;
+
+        if (result.type === SIGN_IN_COMPLETED_RESULT_TYPE) {
+            // Sign-in completed - return SignInCompletedState
+            this.stateParameters.logger.verbose(
+                "Sign-in completed successfully.",
+                correlationId
+            );
+
+            const accountInfo = new CustomAuthAccountData(
+                result.authenticationResult.account,
+                this.stateParameters.config,
+                this.stateParameters.cacheClient,
+                this.stateParameters.logger,
+                correlationId
+            );
+
+            return {
+                state: new SignInCompletedState(),
+                accountInfo: accountInfo,
+            };
+        } else if (result.type === SIGN_IN_JIT_REQUIRED_RESULT_TYPE) {
+            // JIT is required - return AuthMethodRegistrationRequiredState
+            this.stateParameters.logger.verbose(
+                "Authentication method registration is required during sign-in.",
+                correlationId
+            );
+
+            return {
+                state: new AuthMethodRegistrationRequiredState({
+                    correlationId: correlationId,
+                    continuationToken: result.continuationToken,
+                    logger: this.stateParameters.logger,
+                    config: this.stateParameters.config,
+                    jitClient: this.stateParameters.jitClient,
+                    cacheClient: this.stateParameters.cacheClient,
+                    authMethods: result.authMethods,
+                    username: this.stateParameters.username,
+                    scopes: scopes ?? [],
+                    claims: this.stateParameters.claims,
+                }),
+            };
+        } else if (result.type === SIGN_IN_MFA_REQUIRED_RESULT_TYPE) {
+            // MFA is required - return MfaAwaitingState
+            this.stateParameters.logger.verbose(
+                "MFA is required during the sign-in.",
+                correlationId
+            );
+
+            return {
+                state: new MfaAwaitingState({
+                    correlationId: correlationId,
+                    continuationToken: result.continuationToken,
+                    logger: this.stateParameters.logger,
+                    config: this.stateParameters.config,
+                    mfaClient: this.stateParameters.mfaClient,
+                    cacheClient: this.stateParameters.cacheClient,
+                    scopes: scopes ?? [],
+                    authMethods: result.authMethods ?? [],
+                }),
+            };
+        } else {
+            // Unexpected result type
+            const unexpectedResult = result as { type: string };
+            const error = new Error(
+                `Unexpected result type: ${unexpectedResult.type}`
+            );
+            return {
+                state: new SignInFailedState(),
+                error: error,
+            };
+        }
+    }
 }