@azure/msal-browser 4.25.0 → 4.26.0

package/src/cache/CacheKeys.ts

@@ -5,9 +5,9 @@
 
 export const PREFIX = "msal";
 const BROWSER_PREFIX = "browser";
-export const CACHE_KEY_SEPARATOR = "-";
-export const CREDENTIAL_SCHEMA_VERSION = 1;
-export const ACCOUNT_SCHEMA_VERSION = 1;
+export const CACHE_KEY_SEPARATOR = "|";
+export const CREDENTIAL_SCHEMA_VERSION = 2;
+export const ACCOUNT_SCHEMA_VERSION = 2;
 
 export const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
 export const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;

package/src/cache/IWindowStorage.ts

@@ -35,7 +35,8 @@ export interface IWindowStorage<T> {
         key: string,
         value: T,
         correlationId: string,
-        timestamp: string
+        timestamp: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**

package/src/cache/LocalStorage.ts

@@ -205,7 +205,10 @@ export class LocalStorage implements IWindowStorage<string> {
         }
 
         try {
-            return JSON.parse(decryptedData);
+            return {
+                ...JSON.parse(decryptedData),
+                lastUpdatedAt: data.lastUpdatedAt,
+            };
         } catch (e) {
             this.performanceClient.incrementFields(
                 { encryptedCacheCorruptionCount: 1 },
@@ -223,7 +226,8 @@ export class LocalStorage implements IWindowStorage<string> {
         key: string,
         value: string,
         correlationId: string,
-        timestamp: string
+        timestamp: string,
+        kmsi: boolean
     ): Promise<void> {
         if (!this.initialized || !this.encryptionCookie) {
             throw createBrowserAuthError(
@@ -231,22 +235,26 @@ export class LocalStorage implements IWindowStorage<string> {
             );
         }
 
-        const { data, nonce } = await invokeAsync(
-            encrypt,
-            PerformanceEvents.Encrypt,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(this.encryptionCookie.key, value, this.getContext(key));
-        const encryptedData: EncryptedData = {
-            id: this.encryptionCookie.id,
-            nonce: nonce,
-            data: data,
-            lastUpdatedAt: timestamp,
-        };
+        if (kmsi) {
+            this.setItem(key, value);
+        } else {
+            const { data, nonce } = await invokeAsync(
+                encrypt,
+                PerformanceEvents.Encrypt,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(this.encryptionCookie.key, value, this.getContext(key));
+            const encryptedData: EncryptedData = {
+                id: this.encryptionCookie.id,
+                nonce: nonce,
+                data: data,
+                lastUpdatedAt: timestamp,
+            };
+            this.setItem(key, JSON.stringify(encryptedData));
+        }
 
         this.memoryStorage.setItem(key, value);
-        this.setItem(key, JSON.stringify(encryptedData));
 
         // Notify other frames to update their in-memory cache
         this.broadcast.postMessage({
@@ -382,7 +390,7 @@ export class LocalStorage implements IWindowStorage<string> {
                 { unencryptedCacheCount: 1 },
                 correlationId
             );
-            return encObj;
+            return rawCache;
         }
 
         if (encObj.id !== this.encryptionCookie.id) {
@@ -394,6 +402,11 @@ export class LocalStorage implements IWindowStorage<string> {
             return null;
         }
 
+        this.performanceClient.incrementFields(
+            { encryptedCacheCount: 1 },
+            correlationId
+        );
+
         return invokeAsync(
             decrypt,
             PerformanceEvents.Decrypt,

package/src/cache/TokenCache.ts

@@ -93,6 +93,7 @@ export class TokenCache implements ITokenCache {
         const idTokenClaims = response.id_token
             ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
             : undefined;
+        const kmsi = AuthToken.isKmsi(idTokenClaims || {});
 
         const authorityOptions: AuthorityOptions = {
             protocolMode: this.config.auth.protocolMode,
@@ -129,7 +130,8 @@ export class TokenCache implements ITokenCache {
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
             cacheRecordAccount.realm,
-            correlationId
+            correlationId,
+            kmsi
         );
 
         const accessToken = await this.loadAccessToken(
@@ -139,14 +141,16 @@ export class TokenCache implements ITokenCache {
             cacheRecordAccount.environment,
             cacheRecordAccount.realm,
             options,
-            correlationId
+            correlationId,
+            kmsi
         );
 
         const refreshToken = await this.loadRefreshToken(
             response,
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
-            correlationId
+            correlationId,
+            kmsi
         );
 
         return this.generateAuthenticationResult(
@@ -184,7 +188,11 @@ export class TokenCache implements ITokenCache {
             const accountEntity = AccountEntity.createFromAccountInfo(
                 request.account
             );
-            await this.storage.setAccount(accountEntity, correlationId);
+            await this.storage.setAccount(
+                accountEntity,
+                correlationId,
+                AuthToken.isKmsi(idTokenClaims || {})
+            );
             return accountEntity;
         } else if (!authority || (!clientInfo && !idTokenClaims)) {
             this.logger.error(
@@ -220,7 +228,11 @@ export class TokenCache implements ITokenCache {
             this.logger
         );
 
-        await this.storage.setAccount(cachedAccount, correlationId);
+        await this.storage.setAccount(
+            cachedAccount,
+            correlationId,
+            AuthToken.isKmsi(idTokenClaims || {})
+        );
         return cachedAccount;
     }
 
@@ -237,7 +249,8 @@ export class TokenCache implements ITokenCache {
         homeAccountId: string,
         environment: string,
         tenantId: string,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<IdTokenEntity | null> {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
@@ -253,7 +266,11 @@ export class TokenCache implements ITokenCache {
             tenantId
         );
 
-        await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
+        await this.storage.setIdTokenCredential(
+            idTokenEntity,
+            correlationId,
+            kmsi
+        );
         return idTokenEntity;
     }
 
@@ -273,7 +290,8 @@ export class TokenCache implements ITokenCache {
         environment: string,
         tenantId: string,
         options: LoadTokenOptions,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<AccessTokenEntity | null> {
         if (!response.access_token) {
             this.logger.verbose(
@@ -322,7 +340,8 @@ export class TokenCache implements ITokenCache {
 
         await this.storage.setAccessTokenCredential(
             accessTokenEntity,
-            correlationId
+            correlationId,
+            kmsi
         );
         return accessTokenEntity;
     }
@@ -339,7 +358,8 @@ export class TokenCache implements ITokenCache {
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<RefreshTokenEntity | null> {
         if (!response.refresh_token) {
             this.logger.verbose(
@@ -361,7 +381,8 @@ export class TokenCache implements ITokenCache {
 
         await this.storage.setRefreshTokenCredential(
             refreshTokenEntity,
-            correlationId
+            correlationId,
+            kmsi
         );
         return refreshTokenEntity;
     }
@@ -406,7 +427,7 @@ export class TokenCache implements ITokenCache {
             uniqueId: cacheRecord.account.localAccountId,
             tenantId: cacheRecord.account.realm,
             scopes: responseScopes,
-            account: accountEntity.getAccountInfo(),
+            account: AccountEntity.getAccountInfo(accountEntity),
             idToken: cacheRecord.idToken?.secret || "",
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken,

package/src/controllers/NestedAppAuthController.ts

@@ -20,6 +20,7 @@ import {
     BaseAuthRequest,
     AccountFilter,
     AuthError,
+    AuthToken,
 } from "@azure/msal-common/browser";
 import { ITokenCache } from "../cache/ITokenCache.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
@@ -937,7 +938,8 @@ export class NestedAppAuthController implements IController {
         );
         await this.browserStorage.setAccount(
             accountEntity,
-            result.correlationId
+            result.correlationId,
+            AuthToken.isKmsi(result.idTokenClaims)
         );
         return this.browserStorage.hydrateCache(result, request);
     }

package/src/controllers/StandardController.ts

@@ -30,6 +30,7 @@ import {
     buildStaticAuthorityOptions,
     InteractionRequiredAuthErrorCodes,
     PkceCodes,
+    AuthToken,
 } from "@azure/msal-common/browser";
 import {
     BrowserCacheManager,
@@ -1624,7 +1625,8 @@ export class StandardController implements IController {
         );
         await this.browserStorage.setAccount(
             accountEntity,
-            result.correlationId
+            result.correlationId,
+            AuthToken.isKmsi(result.idTokenClaims)
         );
 
         if (result.fromNativeBroker) {

package/src/custom_auth/core/auth_flow/AuthFlowState.ts

@@ -19,7 +19,12 @@ export interface AuthFlowActionRequiredStateParameters {
 /**
  * Base class for the state of an authentication flow.
  */
-export abstract class AuthFlowStateBase {}
+export abstract class AuthFlowStateBase {
+    /**
+     * The type of the state.
+     */
+    abstract stateType: string;
+}
 
 /**
  * Base class for the action requried state in an authentication flow.

package/src/custom_auth/core/auth_flow/AuthFlowStateTypes.ts

@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+// Sign in state types
+export const SIGN_IN_CODE_REQUIRED_STATE_TYPE = "SignInCodeRequiredState";
+export const SIGN_IN_PASSWORD_REQUIRED_STATE_TYPE =
+    "SignInPasswordRequiredState";
+export const SIGN_IN_CONTINUATION_STATE_TYPE = "SignInContinuationState";
+export const SIGN_IN_COMPLETED_STATE_TYPE = "SignInCompletedState";
+export const SIGN_IN_FAILED_STATE_TYPE = "SignInFailedState";
+
+// Sign up state types
+export const SIGN_UP_CODE_REQUIRED_STATE_TYPE = "SignUpCodeRequiredState";
+export const SIGN_UP_PASSWORD_REQUIRED_STATE_TYPE =
+    "SignUpPasswordRequiredState";
+export const SIGN_UP_ATTRIBUTES_REQUIRED_STATE_TYPE =
+    "SignUpAttributesRequiredState";
+export const SIGN_UP_COMPLETED_STATE_TYPE = "SignUpCompletedState";
+export const SIGN_UP_FAILED_STATE_TYPE = "SignUpFailedState";
+
+// Reset password state types
+export const RESET_PASSWORD_CODE_REQUIRED_STATE_TYPE =
+    "ResetPasswordCodeRequiredState";
+export const RESET_PASSWORD_PASSWORD_REQUIRED_STATE_TYPE =
+    "ResetPasswordPasswordRequiredState";
+export const RESET_PASSWORD_COMPLETED_STATE_TYPE =
+    "ResetPasswordCompletedState";
+export const RESET_PASSWORD_FAILED_STATE_TYPE = "ResetPasswordFailedState";
+
+// Get account state types
+export const GET_ACCOUNT_COMPLETED_STATE_TYPE = "GetAccountCompletedState";
+export const GET_ACCOUNT_FAILED_STATE_TYPE = "GetAccountFailedState";
+
+// Get access token state types
+export const GET_ACCESS_TOKEN_COMPLETED_STATE_TYPE =
+    "GetAccessTokenCompletedState";
+export const GET_ACCESS_TOKEN_FAILED_STATE_TYPE = "GetAccessTokenFailedState";
+
+// Sign out state types
+export const SIGN_OUT_COMPLETED_STATE_TYPE = "SignOutCompletedState";
+export const SIGN_OUT_FAILED_STATE_TYPE = "SignOutFailedState";
+
+// MFA state types
+export const MFA_AWAITING_STATE_TYPE = "MfaAwaitingState";
+export const MFA_VERIFICATION_REQUIRED_STATE_TYPE =
+    "MfaVerificationRequiredState";
+export const MFA_COMPLETED_STATE_TYPE = "MfaCompletedState";
+export const MFA_FAILED_STATE_TYPE = "MfaFailedState";
+
+// Auth method registration (JIT) state types
+export const AUTH_METHOD_REGISTRATION_REQUIRED_STATE_TYPE =
+    "AuthMethodRegistrationRequiredState";
+export const AUTH_METHOD_VERIFICATION_REQUIRED_STATE_TYPE =
+    "AuthMethodVerificationRequiredState";
+export const AUTH_METHOD_REGISTRATION_COMPLETED_STATE_TYPE =
+    "AuthMethodRegistrationCompletedState";
+export const AUTH_METHOD_REGISTRATION_FAILED_STATE_TYPE =
+    "AuthMethodRegistrationFailedState";

package/src/custom_auth/core/auth_flow/jit/result/AuthMethodRegistrationChallengeMethodResult.ts

@@ -9,6 +9,11 @@ import type { AuthMethodVerificationRequiredState } from "../state/AuthMethodReg
 import { CustomAuthAccountData } from "../../../../get_account/auth_flow/CustomAuthAccountData.js";
 import { AuthMethodRegistrationCompletedState } from "../state/AuthMethodRegistrationCompletedState.js";
 import { AuthMethodRegistrationFailedState } from "../state/AuthMethodRegistrationFailedState.js";
+import {
+    AUTH_METHOD_VERIFICATION_REQUIRED_STATE_TYPE,
+    AUTH_METHOD_REGISTRATION_COMPLETED_STATE_TYPE,
+    AUTH_METHOD_REGISTRATION_FAILED_STATE_TYPE,
+} from "../../AuthFlowStateTypes.js";
 
 /**
  * Result of challenging an authentication method for registration.
@@ -41,10 +46,12 @@ export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultB
      * @returns true if verification is required, false otherwise.
      * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
-    isVerificationRequired(): boolean {
+    isVerificationRequired(): this is AuthMethodRegistrationChallengeMethodResult & {
+        state: AuthMethodVerificationRequiredState;
+    } {
         return (
-            this.state.constructor?.name ===
-            "AuthMethodVerificationRequiredState"
+            this.state.stateType ===
+            AUTH_METHOD_VERIFICATION_REQUIRED_STATE_TYPE
         );
     }
 
@@ -53,10 +60,12 @@ export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultB
      * @returns true if registration is completed, false otherwise.
      * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
-    isCompleted(): boolean {
+    isCompleted(): this is AuthMethodRegistrationChallengeMethodResult & {
+        state: AuthMethodRegistrationCompletedState;
+    } {
         return (
-            this.state.constructor?.name ===
-            "AuthMethodRegistrationCompletedState"
+            this.state.stateType ===
+            AUTH_METHOD_REGISTRATION_COMPLETED_STATE_TYPE
         );
     }
 
@@ -65,8 +74,12 @@ export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultB
      * @returns true if the result is failed, false otherwise.
      * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
-    isFailed(): boolean {
-        return this.state instanceof AuthMethodRegistrationFailedState;
+    isFailed(): this is AuthMethodRegistrationChallengeMethodResult & {
+        state: AuthMethodRegistrationFailedState;
+    } {
+        return (
+            this.state.stateType === AUTH_METHOD_REGISTRATION_FAILED_STATE_TYPE
+        );
     }
 }
 

package/src/custom_auth/core/auth_flow/jit/result/AuthMethodRegistrationSubmitChallengeResult.ts

@@ -8,6 +8,10 @@ import { AuthMethodRegistrationSubmitChallengeError } from "../error_type/AuthMe
 import { CustomAuthAccountData } from "../../../../get_account/auth_flow/CustomAuthAccountData.js";
 import { AuthMethodRegistrationFailedState } from "../state/AuthMethodRegistrationFailedState.js";
 import { AuthMethodRegistrationCompletedState } from "../state/AuthMethodRegistrationCompletedState.js";
+import {
+    AUTH_METHOD_REGISTRATION_COMPLETED_STATE_TYPE,
+    AUTH_METHOD_REGISTRATION_FAILED_STATE_TYPE,
+} from "../../AuthFlowStateTypes.js";
 
 /**
  * Result of submitting a challenge for authentication method registration.
@@ -39,10 +43,12 @@ export class AuthMethodRegistrationSubmitChallengeResult extends AuthFlowResultB
      * @returns true if registration is completed, false otherwise.
      * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
-    isCompleted(): boolean {
+    isCompleted(): this is AuthMethodRegistrationSubmitChallengeResult & {
+        state: AuthMethodRegistrationCompletedState;
+    } {
         return (
-            this.state.constructor?.name ===
-            "AuthMethodRegistrationCompletedState"
+            this.state.stateType ===
+            AUTH_METHOD_REGISTRATION_COMPLETED_STATE_TYPE
         );
     }
 
@@ -51,8 +57,12 @@ export class AuthMethodRegistrationSubmitChallengeResult extends AuthFlowResultB
      * @returns true if the result is failed, false otherwise.
      * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
-    isFailed(): boolean {
-        return this.state instanceof AuthMethodRegistrationFailedState;
+    isFailed(): this is AuthMethodRegistrationSubmitChallengeResult & {
+        state: AuthMethodRegistrationFailedState;
+    } {
+        return (
+            this.state.stateType === AUTH_METHOD_REGISTRATION_FAILED_STATE_TYPE
+        );
     }
 }
 

package/src/custom_auth/core/auth_flow/jit/state/AuthMethodRegistrationCompletedState.ts

@@ -4,5 +4,14 @@
  */
 
 import { AuthFlowStateBase } from "../../AuthFlowState.js";
+import { AUTH_METHOD_REGISTRATION_COMPLETED_STATE_TYPE } from "../../AuthFlowStateTypes.js";
 
-export class AuthMethodRegistrationCompletedState extends AuthFlowStateBase {}
+/**
+ * State indicating that the auth method registration flow has completed successfully.
+ */
+export class AuthMethodRegistrationCompletedState extends AuthFlowStateBase {
+    /**
+     * The type of the state.
+     */
+    stateType = AUTH_METHOD_REGISTRATION_COMPLETED_STATE_TYPE;
+}

package/src/custom_auth/core/auth_flow/jit/state/AuthMethodRegistrationFailedState.ts

@@ -4,5 +4,14 @@
  */
 
 import { AuthFlowStateBase } from "../../AuthFlowState.js";
+import { AUTH_METHOD_REGISTRATION_FAILED_STATE_TYPE } from "../../AuthFlowStateTypes.js";
 
-export class AuthMethodRegistrationFailedState extends AuthFlowStateBase {}
+/**
+ * State indicating that the auth method registration flow has failed.
+ */
+export class AuthMethodRegistrationFailedState extends AuthFlowStateBase {
+    /**
+     * The type of the state.
+     */
+    stateType = AUTH_METHOD_REGISTRATION_FAILED_STATE_TYPE;
+}

package/src/custom_auth/core/auth_flow/jit/state/AuthMethodRegistrationState.ts

@@ -25,6 +25,10 @@ import { GrantType } from "../../../../CustomAuthConstants.js";
 import { AuthMethodRegistrationChallengeMethodResult } from "../result/AuthMethodRegistrationChallengeMethodResult.js";
 import { AuthMethodRegistrationSubmitChallengeResult } from "../result/AuthMethodRegistrationSubmitChallengeResult.js";
 import { AuthMethodRegistrationCompletedState } from "./AuthMethodRegistrationCompletedState.js";
+import {
+    AUTH_METHOD_REGISTRATION_REQUIRED_STATE_TYPE,
+    AUTH_METHOD_VERIFICATION_REQUIRED_STATE_TYPE,
+} from "../../AuthFlowStateTypes.js";
 
 /**
  * Abstract base class for authentication method registration states.
@@ -134,6 +138,11 @@ abstract class AuthMethodRegistrationState<
  * State indicating that authentication method registration is required.
  */
 export class AuthMethodRegistrationRequiredState extends AuthMethodRegistrationState<AuthMethodRegistrationRequiredStateParameters> {
+    /**
+     * The type of the state.
+     */
+    stateType = AUTH_METHOD_REGISTRATION_REQUIRED_STATE_TYPE;
+
     /**
      * Gets the available authentication methods for registration.
      * @returns Array of available authentication methods.
@@ -160,6 +169,11 @@ export class AuthMethodRegistrationRequiredState extends AuthMethodRegistrationS
  * State indicating that verification is required for the challenged authentication method.
  */
 export class AuthMethodVerificationRequiredState extends AuthMethodRegistrationState<AuthMethodVerificationRequiredStateParameters> {
+    /**
+     * The type of the state.
+     */
+    stateType = AUTH_METHOD_VERIFICATION_REQUIRED_STATE_TYPE;
+
     /**
      * Gets the length of the expected verification code.
      * @returns The code length.

package/src/custom_auth/core/auth_flow/mfa/result/MfaRequestChallengeResult.ts

@@ -7,6 +7,10 @@ import { AuthFlowResultBase } from "../../AuthFlowResultBase.js";
 import { MfaRequestChallengeError } from "../error_type/MfaError.js";
 import { MfaFailedState } from "../state/MfaFailedState.js";
 import type { MfaVerificationRequiredState } from "../state/MfaState.js";
+import {
+    MFA_VERIFICATION_REQUIRED_STATE_TYPE,
+    MFA_FAILED_STATE_TYPE,
+} from "../../AuthFlowStateTypes.js";
 
 /**
  * Result of requesting an MFA challenge.
@@ -34,8 +38,10 @@ export class MfaRequestChallengeResult extends AuthFlowResultBase<
      * @returns true if verification is required, false otherwise.
      * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
-    isVerificationRequired(): boolean {
-        return this.state.constructor?.name === "MfaVerificationRequiredState";
+    isVerificationRequired(): this is MfaRequestChallengeResult & {
+        state: MfaVerificationRequiredState;
+    } {
+        return this.state.stateType === MFA_VERIFICATION_REQUIRED_STATE_TYPE;
     }
 
     /**
@@ -43,8 +49,10 @@ export class MfaRequestChallengeResult extends AuthFlowResultBase<
      * @returns true if the result is failed, false otherwise.
      * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
-    isFailed(): boolean {
-        return this.state instanceof MfaFailedState;
+    isFailed(): this is MfaRequestChallengeResult & {
+        state: MfaFailedState;
+    } {
+        return this.state.stateType === MFA_FAILED_STATE_TYPE;
     }
 }
 

package/src/custom_auth/core/auth_flow/mfa/result/MfaSubmitChallengeResult.ts

@@ -8,6 +8,10 @@ import { MfaSubmitChallengeError } from "../error_type/MfaError.js";
 import { CustomAuthAccountData } from "../../../../get_account/auth_flow/CustomAuthAccountData.js";
 import { MfaCompletedState } from "../state/MfaCompletedState.js";
 import { MfaFailedState } from "../state/MfaFailedState.js";
+import {
+    MFA_COMPLETED_STATE_TYPE,
+    MFA_FAILED_STATE_TYPE,
+} from "../../AuthFlowStateTypes.js";
 
 /**
  * Result of submitting an MFA challenge.
@@ -35,8 +39,10 @@ export class MfaSubmitChallengeResult extends AuthFlowResultBase<
      * @returns true if completed, false otherwise.
      * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
-    isCompleted(): boolean {
-        return this.state instanceof MfaCompletedState;
+    isCompleted(): this is MfaSubmitChallengeResult & {
+        state: MfaCompletedState;
+    } {
+        return this.state.stateType === MFA_COMPLETED_STATE_TYPE;
     }
 
     /**
@@ -44,8 +50,10 @@ export class MfaSubmitChallengeResult extends AuthFlowResultBase<
      * @returns true if the result is failed, false otherwise.
      * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
-    isFailed(): boolean {
-        return this.state instanceof MfaFailedState;
+    isFailed(): this is MfaSubmitChallengeResult & {
+        state: MfaFailedState;
+    } {
+        return this.state.stateType === MFA_FAILED_STATE_TYPE;
     }
 }
 

package/src/custom_auth/core/auth_flow/mfa/state/MfaCompletedState.ts

@@ -4,8 +4,14 @@
  */
 
 import { AuthFlowStateBase } from "../../AuthFlowState.js";
+import { MFA_COMPLETED_STATE_TYPE } from "../../AuthFlowStateTypes.js";
 
 /**
  * State indicating that the MFA flow has completed successfully.
  */
-export class MfaCompletedState extends AuthFlowStateBase {}
+export class MfaCompletedState extends AuthFlowStateBase {
+    /**
+     * The type of the state.
+     */
+    stateType = MFA_COMPLETED_STATE_TYPE;
+}

package/src/custom_auth/core/auth_flow/mfa/state/MfaFailedState.ts

@@ -4,8 +4,14 @@
  */
 
 import { AuthFlowStateBase } from "../../AuthFlowState.js";
+import { MFA_FAILED_STATE_TYPE } from "../../AuthFlowStateTypes.js";
 
 /**
  * State indicating that the MFA flow has failed.
  */
-export class MfaFailedState extends AuthFlowStateBase {}
+export class MfaFailedState extends AuthFlowStateBase {
+    /**
+     * The type of the state.
+     */
+    stateType = MFA_FAILED_STATE_TYPE;
+}

package/src/custom_auth/core/auth_flow/mfa/state/MfaState.ts

@@ -19,6 +19,10 @@ import { MfaCompletedState } from "./MfaCompletedState.js";
 import { ensureArgumentIsNotEmptyString } from "../../../utils/ArgumentValidator.js";
 import { AuthenticationMethod } from "../../../network_client/custom_auth_api/types/ApiResponseTypes.js";
 import { AuthFlowActionRequiredStateBase } from "../../AuthFlowState.js";
+import {
+    MFA_AWAITING_STATE_TYPE,
+    MFA_VERIFICATION_REQUIRED_STATE_TYPE,
+} from "../../AuthFlowStateTypes.js";
 
 abstract class MfaState<
     TParameters extends MfaStateParameters
@@ -89,6 +93,11 @@ abstract class MfaState<
  * This state allows the developer to pause execution before sending the code to the user's email.
  */
 export class MfaAwaitingState extends MfaState<MfaAwaitingStateParameters> {
+    /**
+     * The type of the state.
+     */
+    stateType = MFA_AWAITING_STATE_TYPE;
+
     /**
      * Gets the available authentication methods for MFA.
      * @returns Array of available authentication methods.
@@ -104,6 +113,11 @@ export class MfaAwaitingState extends MfaState<MfaAwaitingStateParameters> {
  * The challenge has been sent and the user needs to provide the code.
  */
 export class MfaVerificationRequiredState extends MfaState<MfaVerificationRequiredStateParameters> {
+    /**
+     * The type of the state.
+     */
+    stateType = MFA_VERIFICATION_REQUIRED_STATE_TYPE;
+
     /**
      * Gets the length of the code that the user needs to provide.
      * @returns The expected code length.