@azure/msal-browser 4.24.1 → 5.0.0-alpha.0

package/src/cache/TokenCache.ts

@@ -20,11 +20,12 @@ import {
     CacheHelpers,
     buildAccountToCache,
     TimeUtils,
+    AccountEntityUtils,
+    buildStaticAuthorityOptions,
 } from "@azure/msal-common/browser";
-import { BrowserConfiguration } from "../config/Configuration.js";
+import { buildConfiguration, Configuration } from "../config/Configuration.js";
 import type { SilentRequest } from "../request/SilentRequest.js";
 import { BrowserCacheManager } from "./BrowserCacheManager.js";
-import type { ITokenCache } from "./ITokenCache.js";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -32,6 +33,9 @@ import {
 import type { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { base64Decode } from "../encode/Base64Decode.js";
 import * as BrowserCrypto from "../crypto/BrowserCrypto.js";
+import { CryptoOps } from "../crypto/CryptoOps.js";
+import { EventHandler } from "../event/EventHandler.js";
+import * as BrowserUtils from "../utils/BrowserUtils.js";
 
 export type LoadTokenOptions = {
     clientInfo?: string;
@@ -40,387 +44,390 @@ export type LoadTokenOptions = {
 };
 
 /**
- * Token cache manager
+ * API to load tokens to msal-browser cache.
+ * @param request
+ * @param response
+ * @param options
+ * @returns `AuthenticationResult` for the response that was loaded.
  */
-export class TokenCache implements ITokenCache {
-    // Flag to indicate if in browser environment
-    public isBrowserEnvironment: boolean;
-    // Input configuration by developer/user
-    protected config: BrowserConfiguration;
-    // Browser cache storage
-    private storage: BrowserCacheManager;
-    // Logger
-    private logger: Logger;
-    // Crypto class
-    private cryptoObj: ICrypto;
-
-    constructor(
-        configuration: BrowserConfiguration,
-        storage: BrowserCacheManager,
-        logger: Logger,
-        cryptoObj: ICrypto
-    ) {
-        this.isBrowserEnvironment = typeof window !== "undefined";
-        this.config = configuration;
-        this.storage = storage;
-        this.logger = logger;
-        this.cryptoObj = cryptoObj;
-    }
+export async function loadExternalTokens(
+    config: Configuration,
+    request: SilentRequest,
+    response: ExternalTokenResponse,
+    options: LoadTokenOptions
+): Promise<AuthenticationResult> {
+    BrowserUtils.blockNonBrowserEnvironment();
+
+    const browserConfig = buildConfiguration(config, true);
+
+    const correlationId =
+        request.correlationId || BrowserCrypto.createNewGuid();
+
+    const idTokenClaims = response.id_token
+        ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
+        : undefined;
+
+    const authorityOptions: AuthorityOptions = {
+        protocolMode: browserConfig.system.protocolMode,
+        knownAuthorities: browserConfig.auth.knownAuthorities,
+        cloudDiscoveryMetadata: browserConfig.auth.cloudDiscoveryMetadata,
+        authorityMetadata: browserConfig.auth.authorityMetadata,
+    };
+
+    const logger = new Logger(browserConfig.system.loggerOptions || {});
+    const cryptoOps = new CryptoOps(logger, browserConfig.telemetry.client);
+    const storage = new BrowserCacheManager(
+        browserConfig.auth.clientId,
+        browserConfig.cache,
+        cryptoOps,
+        logger,
+        browserConfig.telemetry.client,
+        new EventHandler(logger),
+        buildStaticAuthorityOptions(browserConfig.auth)
+    );
+
+    const authority = request.authority
+        ? new Authority(
+              Authority.generateAuthority(
+                  request.authority,
+                  request.azureCloudOptions
+              ),
+              browserConfig.system.networkClient,
+              storage,
+              authorityOptions,
+              logger,
+              request.correlationId || BrowserCrypto.createNewGuid(),
+              browserConfig.telemetry.client
+          )
+        : undefined;
+
+    const cacheRecordAccount: AccountEntity = await loadAccount(
+        request,
+        options.clientInfo || response.client_info || "",
+        correlationId,
+        storage,
+        logger,
+        cryptoOps,
+        idTokenClaims,
+        authority
+    );
+
+    const idToken = await loadIdToken(
+        response,
+        cacheRecordAccount.homeAccountId,
+        cacheRecordAccount.environment,
+        cacheRecordAccount.realm,
+        correlationId,
+        storage,
+        logger,
+        config.auth.clientId
+    );
+
+    const accessToken = await loadAccessToken(
+        request,
+        response,
+        cacheRecordAccount.homeAccountId,
+        cacheRecordAccount.environment,
+        cacheRecordAccount.realm,
+        options,
+        correlationId,
+        storage,
+        logger,
+        config.auth.clientId
+    );
+
+    const refreshToken = await loadRefreshToken(
+        response,
+        cacheRecordAccount.homeAccountId,
+        cacheRecordAccount.environment,
+        correlationId,
+        storage,
+        logger,
+        config.auth.clientId
+    );
+
+    return generateAuthenticationResult(
+        request,
+        {
+            account: cacheRecordAccount,
+            idToken,
+            accessToken,
+            refreshToken,
+        },
+        idTokenClaims,
+        authority
+    );
+}
 
-    // Move getAllAccounts here and cache utility APIs
-
-    /**
-     * API to load tokens to msal-browser cache.
-     * @param request
-     * @param response
-     * @param options
-     * @returns `AuthenticationResult` for the response that was loaded.
-     */
-    async loadExternalTokens(
-        request: SilentRequest,
-        response: ExternalTokenResponse,
-        options: LoadTokenOptions
-    ): Promise<AuthenticationResult> {
-        if (!this.isBrowserEnvironment) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.nonBrowserEnvironment
+/**
+ * Helper function to load account to msal-browser cache
+ * @param idToken
+ * @param environment
+ * @param clientInfo
+ * @param authorityType
+ * @param requestHomeAccountId
+ * @returns `AccountEntity`
+ */
+async function loadAccount(
+    request: SilentRequest,
+    clientInfo: string,
+    correlationId: string,
+    storage: BrowserCacheManager,
+    logger: Logger,
+    cryptoObj: ICrypto,
+    idTokenClaims?: TokenClaims,
+    authority?: Authority
+): Promise<AccountEntity> {
+    logger.verbose("TokenCache - loading account", correlationId);
+
+    if (request.account) {
+        const accountEntity =
+            AccountEntityUtils.createAccountEntityFromAccountInfo(
+                request.account
             );
-        }
-
-        const correlationId =
-            request.correlationId || BrowserCrypto.createNewGuid();
-
-        const idTokenClaims = response.id_token
-            ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
-            : undefined;
-
-        const authorityOptions: AuthorityOptions = {
-            protocolMode: this.config.auth.protocolMode,
-            knownAuthorities: this.config.auth.knownAuthorities,
-            cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-            authorityMetadata: this.config.auth.authorityMetadata,
-            skipAuthorityMetadataCache:
-                this.config.auth.skipAuthorityMetadataCache,
-        };
-        const authority = request.authority
-            ? new Authority(
-                  Authority.generateAuthority(
-                      request.authority,
-                      request.azureCloudOptions
-                  ),
-                  this.config.system.networkClient,
-                  this.storage,
-                  authorityOptions,
-                  this.logger,
-                  request.correlationId || BrowserCrypto.createNewGuid()
-              )
-            : undefined;
-
-        const cacheRecordAccount: AccountEntity = await this.loadAccount(
-            request,
-            options.clientInfo || response.client_info || "",
-            correlationId,
-            idTokenClaims,
-            authority
-        );
-
-        const idToken = await this.loadIdToken(
-            response,
-            cacheRecordAccount.homeAccountId,
-            cacheRecordAccount.environment,
-            cacheRecordAccount.realm,
+        await storage.setAccount(accountEntity, correlationId);
+        return accountEntity;
+    } else if (!authority || (!clientInfo && !idTokenClaims)) {
+        logger.error(
+            "TokenCache - if an account is not provided on the request, authority and either clientInfo or idToken must be provided instead.",
             correlationId
         );
+        throw createBrowserAuthError(BrowserAuthErrorCodes.unableToLoadToken);
+    }
 
-        const accessToken = await this.loadAccessToken(
-            request,
-            response,
-            cacheRecordAccount.homeAccountId,
-            cacheRecordAccount.environment,
-            cacheRecordAccount.realm,
-            options,
-            correlationId
-        );
+    const homeAccountId = AccountEntityUtils.generateHomeAccountId(
+        clientInfo,
+        authority.authorityType,
+        logger,
+        cryptoObj,
+        correlationId,
+        idTokenClaims
+    );
+
+    const claimsTenantId = idTokenClaims?.tid;
+
+    const cachedAccount = buildAccountToCache(
+        storage,
+        authority,
+        homeAccountId,
+        base64Decode,
+        correlationId,
+        idTokenClaims,
+        clientInfo,
+        authority.hostnameAndPort,
+        claimsTenantId,
+        undefined, // authCodePayload
+        undefined, // nativeAccountId
+        logger
+    );
+
+    await storage.setAccount(cachedAccount, correlationId);
+    return cachedAccount;
+}
 
-        const refreshToken = await this.loadRefreshToken(
-            response,
-            cacheRecordAccount.homeAccountId,
-            cacheRecordAccount.environment,
+/**
+ * Helper function to load id tokens to msal-browser cache
+ * @param idToken
+ * @param homeAccountId
+ * @param environment
+ * @param tenantId
+ * @returns `IdTokenEntity`
+ */
+async function loadIdToken(
+    response: ExternalTokenResponse,
+    homeAccountId: string,
+    environment: string,
+    tenantId: string,
+    correlationId: string,
+    storage: BrowserCacheManager,
+    logger: Logger,
+    clientId: string
+): Promise<IdTokenEntity | null> {
+    if (!response.id_token) {
+        logger.verbose(
+            "TokenCache - no id token found in response",
             correlationId
         );
-
-        return this.generateAuthenticationResult(
-            request,
-            {
-                account: cacheRecordAccount,
-                idToken,
-                accessToken,
-                refreshToken,
-            },
-            idTokenClaims,
-            authority
-        );
+        return null;
     }
 
-    /**
-     * Helper function to load account to msal-browser cache
-     * @param idToken
-     * @param environment
-     * @param clientInfo
-     * @param authorityType
-     * @param requestHomeAccountId
-     * @returns `AccountEntity`
-     */
-    private async loadAccount(
-        request: SilentRequest,
-        clientInfo: string,
-        correlationId: string,
-        idTokenClaims?: TokenClaims,
-        authority?: Authority
-    ): Promise<AccountEntity> {
-        this.logger.verbose("TokenCache - loading account");
-
-        if (request.account) {
-            const accountEntity = AccountEntity.createFromAccountInfo(
-                request.account
-            );
-            await this.storage.setAccount(accountEntity, correlationId);
-            return accountEntity;
-        } else if (!authority || (!clientInfo && !idTokenClaims)) {
-            this.logger.error(
-                "TokenCache - if an account is not provided on the request, authority and either clientInfo or idToken must be provided instead."
-            );
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToLoadToken
-            );
-        }
-
-        const homeAccountId = AccountEntity.generateHomeAccountId(
-            clientInfo,
-            authority.authorityType,
-            this.logger,
-            this.cryptoObj,
-            idTokenClaims
-        );
+    logger.verbose("TokenCache - loading id token", correlationId);
+    const idTokenEntity = CacheHelpers.createIdTokenEntity(
+        homeAccountId,
+        environment,
+        response.id_token,
+        clientId,
+        tenantId
+    );
+
+    await storage.setIdTokenCredential(idTokenEntity, correlationId);
+    return idTokenEntity;
+}
 
-        const claimsTenantId = idTokenClaims?.tid;
-
-        const cachedAccount = buildAccountToCache(
-            this.storage,
-            authority,
-            homeAccountId,
-            base64Decode,
-            correlationId,
-            idTokenClaims,
-            clientInfo,
-            authority.hostnameAndPort,
-            claimsTenantId,
-            undefined, // authCodePayload
-            undefined, // nativeAccountId
-            this.logger
+/**
+ * Helper function to load access tokens to msal-browser cache
+ * @param request
+ * @param response
+ * @param homeAccountId
+ * @param environment
+ * @param tenantId
+ * @returns `AccessTokenEntity`
+ */
+async function loadAccessToken(
+    request: SilentRequest,
+    response: ExternalTokenResponse,
+    homeAccountId: string,
+    environment: string,
+    tenantId: string,
+    options: LoadTokenOptions,
+    correlationId: string,
+    storage: BrowserCacheManager,
+    logger: Logger,
+    clientId: string
+): Promise<AccessTokenEntity | null> {
+    if (!response.access_token) {
+        logger.verbose(
+            "TokenCache - no access token found in response",
+            correlationId
         );
-
-        await this.storage.setAccount(cachedAccount, correlationId);
-        return cachedAccount;
-    }
-
-    /**
-     * Helper function to load id tokens to msal-browser cache
-     * @param idToken
-     * @param homeAccountId
-     * @param environment
-     * @param tenantId
-     * @returns `IdTokenEntity`
-     */
-    private async loadIdToken(
-        response: ExternalTokenResponse,
-        homeAccountId: string,
-        environment: string,
-        tenantId: string,
-        correlationId: string
-    ): Promise<IdTokenEntity | null> {
-        if (!response.id_token) {
-            this.logger.verbose("TokenCache - no id token found in response");
-            return null;
-        }
-
-        this.logger.verbose("TokenCache - loading id token");
-        const idTokenEntity = CacheHelpers.createIdTokenEntity(
-            homeAccountId,
-            environment,
-            response.id_token,
-            this.config.auth.clientId,
-            tenantId
+        return null;
+    } else if (!response.expires_in) {
+        logger.error(
+            "TokenCache - no expiration set on the access token. Cannot add it to the cache.",
+            correlationId
         );
-
-        await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
-        return idTokenEntity;
+        return null;
+    } else if (!response.scope && (!request.scopes || !request.scopes.length)) {
+        logger.error(
+            "TokenCache - scopes not specified in the request or response. Cannot add token to the cache.",
+            correlationId
+        );
+        return null;
     }
 
-    /**
-     * Helper function to load access tokens to msal-browser cache
-     * @param request
-     * @param response
-     * @param homeAccountId
-     * @param environment
-     * @param tenantId
-     * @returns `AccessTokenEntity`
-     */
-    private async loadAccessToken(
-        request: SilentRequest,
-        response: ExternalTokenResponse,
-        homeAccountId: string,
-        environment: string,
-        tenantId: string,
-        options: LoadTokenOptions,
-        correlationId: string
-    ): Promise<AccessTokenEntity | null> {
-        if (!response.access_token) {
-            this.logger.verbose(
-                "TokenCache - no access token found in response"
-            );
-            return null;
-        } else if (!response.expires_in) {
-            this.logger.error(
-                "TokenCache - no expiration set on the access token. Cannot add it to the cache."
-            );
-            return null;
-        } else if (
-            !response.scope &&
-            (!request.scopes || !request.scopes.length)
-        ) {
-            this.logger.error(
-                "TokenCache - scopes not specified in the request or response. Cannot add token to the cache."
-            );
-            return null;
-        }
-
-        this.logger.verbose("TokenCache - loading access token");
-
-        const scopes = response.scope
-            ? ScopeSet.fromString(response.scope)
-            : new ScopeSet(request.scopes);
-        const expiresOn =
-            options.expiresOn || response.expires_in + TimeUtils.nowSeconds();
-
-        const extendedExpiresOn =
-            options.extendedExpiresOn ||
-            (response.ext_expires_in || response.expires_in) +
-                TimeUtils.nowSeconds();
-
-        const accessTokenEntity = CacheHelpers.createAccessTokenEntity(
-            homeAccountId,
-            environment,
-            response.access_token,
-            this.config.auth.clientId,
-            tenantId,
-            scopes.printScopes(),
-            expiresOn,
-            extendedExpiresOn,
-            base64Decode
-        );
+    logger.verbose("TokenCache - loading access token", correlationId);
+
+    const scopes = response.scope
+        ? ScopeSet.fromString(response.scope)
+        : new ScopeSet(request.scopes);
+    const expiresOn =
+        options.expiresOn || response.expires_in + TimeUtils.nowSeconds();
+
+    const extendedExpiresOn =
+        options.extendedExpiresOn ||
+        (response.ext_expires_in || response.expires_in) +
+            TimeUtils.nowSeconds();
+
+    const accessTokenEntity = CacheHelpers.createAccessTokenEntity(
+        homeAccountId,
+        environment,
+        response.access_token,
+        clientId,
+        tenantId,
+        scopes.printScopes(),
+        expiresOn,
+        extendedExpiresOn,
+        base64Decode
+    );
+
+    await storage.setAccessTokenCredential(accessTokenEntity, correlationId);
+    return accessTokenEntity;
+}
 
-        await this.storage.setAccessTokenCredential(
-            accessTokenEntity,
+/**
+ * Helper function to load refresh tokens to msal-browser cache
+ * @param request
+ * @param response
+ * @param homeAccountId
+ * @param environment
+ * @returns `RefreshTokenEntity`
+ */
+async function loadRefreshToken(
+    response: ExternalTokenResponse,
+    homeAccountId: string,
+    environment: string,
+    correlationId: string,
+    storage: BrowserCacheManager,
+    logger: Logger,
+    clientId: string
+): Promise<RefreshTokenEntity | null> {
+    if (!response.refresh_token) {
+        logger.verbose(
+            "TokenCache - no refresh token found in response",
             correlationId
         );
-        return accessTokenEntity;
+        return null;
     }
 
-    /**
-     * Helper function to load refresh tokens to msal-browser cache
-     * @param request
-     * @param response
-     * @param homeAccountId
-     * @param environment
-     * @returns `RefreshTokenEntity`
-     */
-    private async loadRefreshToken(
-        response: ExternalTokenResponse,
-        homeAccountId: string,
-        environment: string,
-        correlationId: string
-    ): Promise<RefreshTokenEntity | null> {
-        if (!response.refresh_token) {
-            this.logger.verbose(
-                "TokenCache - no refresh token found in response"
-            );
-            return null;
-        }
-
-        this.logger.verbose("TokenCache - loading refresh token");
-        const refreshTokenEntity = CacheHelpers.createRefreshTokenEntity(
-            homeAccountId,
-            environment,
-            response.refresh_token,
-            this.config.auth.clientId,
-            response.foci,
-            undefined, // userAssertionHash
-            response.refresh_token_expires_in
-        );
+    logger.verbose("TokenCache - loading refresh token", correlationId);
+    const refreshTokenEntity = CacheHelpers.createRefreshTokenEntity(
+        homeAccountId,
+        environment,
+        response.refresh_token,
+        clientId,
+        response.foci,
+        undefined, // userAssertionHash
+        response.refresh_token_expires_in
+    );
+
+    await storage.setRefreshTokenCredential(refreshTokenEntity, correlationId);
+    return refreshTokenEntity;
+}
 
-        await this.storage.setRefreshTokenCredential(
-            refreshTokenEntity,
-            correlationId
+/**
+ * Helper function to generate an `AuthenticationResult` for the result.
+ * @param request
+ * @param idTokenObj
+ * @param cacheRecord
+ * @param authority
+ * @returns `AuthenticationResult`
+ */
+function generateAuthenticationResult(
+    request: SilentRequest,
+    cacheRecord: CacheRecord & { account: AccountEntity },
+    idTokenClaims?: TokenClaims,
+    authority?: Authority
+): AuthenticationResult {
+    let accessToken: string = "";
+    let responseScopes: Array<string> = [];
+    let expiresOn: Date | null = null;
+    let extExpiresOn: Date | undefined;
+
+    if (cacheRecord?.accessToken) {
+        accessToken = cacheRecord.accessToken.secret;
+        responseScopes = ScopeSet.fromString(
+            cacheRecord.accessToken.target
+        ).asArray();
+        // Access token expiresOn stored in seconds, converting to Date for AuthenticationResult
+        expiresOn = TimeUtils.toDateFromSeconds(
+            cacheRecord.accessToken.expiresOn
+        );
+        extExpiresOn = TimeUtils.toDateFromSeconds(
+            cacheRecord.accessToken.extendedExpiresOn
         );
-        return refreshTokenEntity;
     }
 
-    /**
-     * Helper function to generate an `AuthenticationResult` for the result.
-     * @param request
-     * @param idTokenObj
-     * @param cacheRecord
-     * @param authority
-     * @returns `AuthenticationResult`
-     */
-    private generateAuthenticationResult(
-        request: SilentRequest,
-        cacheRecord: CacheRecord & { account: AccountEntity },
-        idTokenClaims?: TokenClaims,
-        authority?: Authority
-    ): AuthenticationResult {
-        let accessToken: string = "";
-        let responseScopes: Array<string> = [];
-        let expiresOn: Date | null = null;
-        let extExpiresOn: Date | undefined;
-
-        if (cacheRecord?.accessToken) {
-            accessToken = cacheRecord.accessToken.secret;
-            responseScopes = ScopeSet.fromString(
-                cacheRecord.accessToken.target
-            ).asArray();
-            // Access token expiresOn stored in seconds, converting to Date for AuthenticationResult
-            expiresOn = TimeUtils.toDateFromSeconds(
-                cacheRecord.accessToken.expiresOn
-            );
-            extExpiresOn = TimeUtils.toDateFromSeconds(
-                cacheRecord.accessToken.extendedExpiresOn
-            );
-        }
-
-        const accountEntity = cacheRecord.account;
-
-        return {
-            authority: authority ? authority.canonicalAuthority : "",
-            uniqueId: cacheRecord.account.localAccountId,
-            tenantId: cacheRecord.account.realm,
-            scopes: responseScopes,
-            account: accountEntity.getAccountInfo(),
-            idToken: cacheRecord.idToken?.secret || "",
-            idTokenClaims: idTokenClaims || {},
-            accessToken: accessToken,
-            fromCache: true,
-            expiresOn: expiresOn,
-            correlationId: request.correlationId || "",
-            requestId: "",
-            extExpiresOn: extExpiresOn,
-            familyId: cacheRecord.refreshToken?.familyId || "",
-            tokenType: cacheRecord?.accessToken?.tokenType || "",
-            state: request.state || "",
-            cloudGraphHostName: accountEntity.cloudGraphHostName || "",
-            msGraphHost: accountEntity.msGraphHost || "",
-            fromNativeBroker: false,
-        };
-    }
+    const accountEntity = cacheRecord.account;
+
+    return {
+        authority: authority ? authority.canonicalAuthority : "",
+        uniqueId: cacheRecord.account.localAccountId,
+        tenantId: cacheRecord.account.realm,
+        scopes: responseScopes,
+        account: AccountEntityUtils.getAccountInfo(accountEntity),
+        idToken: cacheRecord.idToken?.secret || "",
+        idTokenClaims: idTokenClaims || {},
+        accessToken: accessToken,
+        fromCache: true,
+        expiresOn: expiresOn,
+        correlationId: request.correlationId || "",
+        requestId: "",
+        extExpiresOn: extExpiresOn,
+        familyId: cacheRecord.refreshToken?.familyId || "",
+        tokenType: cacheRecord?.accessToken?.tokenType || "",
+        state: request.state || "",
+        cloudGraphHostName: accountEntity.cloudGraphHostName || "",
+        msGraphHost: accountEntity.msGraphHost || "",
+        fromPlatformBroker: false,
+    };
 }