@azure/msal-browser 4.27.0 → 4.28.1

package/src/cache/TokenCache.ts

@@ -10,6 +10,7 @@ import {
     Logger,
     ScopeSet,
     Authority,
+    AuthorityFactory,
     AuthorityOptions,
     ExternalTokenResponse,
     AccountEntity,
@@ -20,6 +21,9 @@ import {
     CacheHelpers,
     buildAccountToCache,
     TimeUtils,
+    IPerformanceClient,
+    PerformanceEvents,
+    invokeAsync,
 } from "@azure/msal-common/browser";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import type { SilentRequest } from "../request/SilentRequest.js";
@@ -32,6 +36,7 @@ import {
 import type { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { base64Decode } from "../encode/Base64Decode.js";
 import * as BrowserCrypto from "../crypto/BrowserCrypto.js";
+import { ApiId } from "../utils/BrowserConstants.js";
 
 export type LoadTokenOptions = {
     clientInfo?: string;
@@ -53,18 +58,22 @@ export class TokenCache implements ITokenCache {
     private logger: Logger;
     // Crypto class
     private cryptoObj: ICrypto;
+    // Perf client
+    private performanceClient: IPerformanceClient;
 
     constructor(
         configuration: BrowserConfiguration,
         storage: BrowserCacheManager,
         logger: Logger,
-        cryptoObj: ICrypto
+        cryptoObj: ICrypto,
+        performanceClient: IPerformanceClient
     ) {
         this.isBrowserEnvironment = typeof window !== "undefined";
         this.config = configuration;
         this.storage = storage;
         this.logger = logger;
         this.cryptoObj = cryptoObj;
+        this.performanceClient = performanceClient;
     }
 
     // Move getAllAccounts here and cache utility APIs
@@ -90,80 +99,121 @@ export class TokenCache implements ITokenCache {
         const correlationId =
             request.correlationId || BrowserCrypto.createNewGuid();
 
-        const idTokenClaims = response.id_token
-            ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
-            : undefined;
-        const kmsi = AuthToken.isKmsi(idTokenClaims || {});
-
-        const authorityOptions: AuthorityOptions = {
-            protocolMode: this.config.auth.protocolMode,
-            knownAuthorities: this.config.auth.knownAuthorities,
-            cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-            authorityMetadata: this.config.auth.authorityMetadata,
-            skipAuthorityMetadataCache:
-                this.config.auth.skipAuthorityMetadataCache,
-        };
-        const authority = request.authority
-            ? new Authority(
-                  Authority.generateAuthority(
-                      request.authority,
-                      request.azureCloudOptions
-                  ),
-                  this.config.system.networkClient,
-                  this.storage,
-                  authorityOptions,
-                  this.logger,
-                  request.correlationId || BrowserCrypto.createNewGuid()
-              )
-            : undefined;
-
-        const cacheRecordAccount: AccountEntity = await this.loadAccount(
-            request,
-            options.clientInfo || response.client_info || "",
-            correlationId,
-            idTokenClaims,
-            authority
+        const rootMeasurement = this.performanceClient.startMeasurement(
+            PerformanceEvents.LoadExternalTokens,
+            correlationId
         );
 
-        const idToken = await this.loadIdToken(
-            response,
-            cacheRecordAccount.homeAccountId,
-            cacheRecordAccount.environment,
-            cacheRecordAccount.realm,
-            correlationId,
-            kmsi
-        );
+        try {
+            const idTokenClaims = response.id_token
+                ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
+                : undefined;
+            const kmsi = AuthToken.isKmsi(idTokenClaims || {});
+
+            const authorityOptions: AuthorityOptions = {
+                protocolMode: this.config.auth.protocolMode,
+                knownAuthorities: this.config.auth.knownAuthorities,
+                cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
+                authorityMetadata: this.config.auth.authorityMetadata,
+                skipAuthorityMetadataCache:
+                    this.config.auth.skipAuthorityMetadataCache,
+            };
+            const authorityString =
+                request.authority || this.config.auth.authority;
+            const authority = await AuthorityFactory.createDiscoveredInstance(
+                Authority.generateAuthority(
+                    authorityString,
+                    request.azureCloudOptions
+                ),
+                this.config.system.networkClient,
+                this.storage,
+                authorityOptions,
+                this.logger,
+                correlationId,
+                this.performanceClient
+            );
 
-        const accessToken = await this.loadAccessToken(
-            request,
-            response,
-            cacheRecordAccount.homeAccountId,
-            cacheRecordAccount.environment,
-            cacheRecordAccount.realm,
-            options,
-            correlationId,
-            kmsi
-        );
+            const cacheRecordAccount: AccountEntity = await invokeAsync(
+                this.loadAccount.bind(this),
+                PerformanceEvents.LoadAccount,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                request,
+                options.clientInfo || response.client_info || "",
+                correlationId,
+                authority,
+                idTokenClaims
+            );
 
-        const refreshToken = await this.loadRefreshToken(
-            response,
-            cacheRecordAccount.homeAccountId,
-            cacheRecordAccount.environment,
-            correlationId,
-            kmsi
-        );
+            const idToken = await invokeAsync(
+                this.loadIdToken.bind(this),
+                PerformanceEvents.LoadIdToken,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                response,
+                cacheRecordAccount.homeAccountId,
+                cacheRecordAccount.environment,
+                cacheRecordAccount.realm,
+                correlationId,
+                kmsi
+            );
 
-        return this.generateAuthenticationResult(
-            request,
-            {
-                account: cacheRecordAccount,
-                idToken,
-                accessToken,
-                refreshToken,
-            },
-            idTokenClaims,
-            authority
-        );
+            const accessToken = await invokeAsync(
+                this.loadAccessToken.bind(this),
+                PerformanceEvents.LoadAccessToken,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                request,
+                response,
+                cacheRecordAccount.homeAccountId,
+                cacheRecordAccount.environment,
+                cacheRecordAccount.realm,
+                options,
+                correlationId,
+                kmsi
+            );
+
+            const refreshToken = await invokeAsync(
+                this.loadRefreshToken.bind(this),
+                PerformanceEvents.LoadRefreshToken,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                response,
+                cacheRecordAccount.homeAccountId,
+                cacheRecordAccount.environment,
+                correlationId,
+                kmsi
+            );
+
+            rootMeasurement.end(
+                { success: true },
+                undefined,
+                AccountEntity.getAccountInfo(cacheRecordAccount)
+            );
+
+            return this.generateAuthenticationResult(
+                request,
+                {
+                    account: cacheRecordAccount,
+                    idToken,
+                    accessToken,
+                    refreshToken,
+                },
+                authority,
+                idTokenClaims
+            );
+        } catch (error) {
+            rootMeasurement.end({ success: false }, error);
+            throw error;
+        }
     }
 
     /**
@@ -179,8 +229,8 @@ export class TokenCache implements ITokenCache {
         request: SilentRequest,
         clientInfo: string,
         correlationId: string,
-        idTokenClaims?: TokenClaims,
-        authority?: Authority
+        authority: Authority,
+        idTokenClaims?: TokenClaims
     ): Promise<AccountEntity> {
         this.logger.verbose("TokenCache - loading account");
 
@@ -191,12 +241,13 @@ export class TokenCache implements ITokenCache {
             await this.storage.setAccount(
                 accountEntity,
                 correlationId,
-                AuthToken.isKmsi(idTokenClaims || {})
+                AuthToken.isKmsi(idTokenClaims || {}),
+                ApiId.loadExternalTokens
             );
             return accountEntity;
-        } else if (!authority || (!clientInfo && !idTokenClaims)) {
+        } else if (!clientInfo && !idTokenClaims) {
             this.logger.error(
-                "TokenCache - if an account is not provided on the request, authority and either clientInfo or idToken must be provided instead."
+                "TokenCache - if an account is not provided on the request, clientInfo or idToken must be provided instead."
             );
             throw createBrowserAuthError(
                 BrowserAuthErrorCodes.unableToLoadToken
@@ -221,7 +272,7 @@ export class TokenCache implements ITokenCache {
             correlationId,
             idTokenClaims,
             clientInfo,
-            authority.hostnameAndPort,
+            authority.getPreferredCache(),
             claimsTenantId,
             undefined, // authCodePayload
             undefined, // nativeAccountId
@@ -231,7 +282,8 @@ export class TokenCache implements ITokenCache {
         await this.storage.setAccount(
             cachedAccount,
             correlationId,
-            AuthToken.isKmsi(idTokenClaims || {})
+            AuthToken.isKmsi(idTokenClaims || {}),
+            ApiId.loadExternalTokens
         );
         return cachedAccount;
     }
@@ -368,6 +420,16 @@ export class TokenCache implements ITokenCache {
             return null;
         }
 
+        const expiresOn = response.refresh_token_expires_in
+            ? response.refresh_token_expires_in + TimeUtils.nowSeconds()
+            : undefined;
+        this.performanceClient.addFields(
+            {
+                extRtExpiresOnSeconds: expiresOn,
+            },
+            correlationId
+        );
+
         this.logger.verbose("TokenCache - loading refresh token");
         const refreshTokenEntity = CacheHelpers.createRefreshTokenEntity(
             homeAccountId,
@@ -376,7 +438,7 @@ export class TokenCache implements ITokenCache {
             this.config.auth.clientId,
             response.foci,
             undefined, // userAssertionHash
-            response.refresh_token_expires_in
+            expiresOn
         );
 
         await this.storage.setRefreshTokenCredential(
@@ -398,8 +460,8 @@ export class TokenCache implements ITokenCache {
     private generateAuthenticationResult(
         request: SilentRequest,
         cacheRecord: CacheRecord & { account: AccountEntity },
-        idTokenClaims?: TokenClaims,
-        authority?: Authority
+        authority: Authority,
+        idTokenClaims?: TokenClaims
     ): AuthenticationResult {
         let accessToken: string = "";
         let responseScopes: Array<string> = [];

package/src/controllers/NestedAppAuthController.ts

@@ -939,7 +939,8 @@ export class NestedAppAuthController implements IController {
         await this.browserStorage.setAccount(
             accountEntity,
             result.correlationId,
-            AuthToken.isKmsi(result.idTokenClaims)
+            AuthToken.isKmsi(result.idTokenClaims),
+            ApiId.hydrateCache
         );
         return this.browserStorage.hydrateCache(result, request);
     }

package/src/controllers/StandardController.ts

@@ -269,7 +269,8 @@ export class StandardController implements IController {
             this.config,
             this.browserStorage,
             this.logger,
-            this.browserCrypto
+            this.browserCrypto,
+            this.performanceClient
         );
 
         this.activeSilentTokenRequests = new Map();
@@ -1627,7 +1628,8 @@ export class StandardController implements IController {
         await this.browserStorage.setAccount(
             accountEntity,
             result.correlationId,
-            AuthToken.isKmsi(result.idTokenClaims)
+            AuthToken.isKmsi(result.idTokenClaims),
+            ApiId.hydrateCache
         );
 
         if (result.fromNativeBroker) {

package/src/custom_auth/core/interaction_client/CustomAuthInteractionClientBase.ts

@@ -97,7 +97,8 @@ export abstract class CustomAuthInteractionClientBase extends StandardInteractio
     protected async handleTokenResponse(
         tokenResponse: SignInTokenResponse,
         requestScopes: string[],
-        correlationId: string
+        correlationId: string,
+        apiId: number
     ): Promise<AuthenticationResult> {
         this.logger.verbose("Processing token response.", correlationId);
 
@@ -114,7 +115,8 @@ export abstract class CustomAuthInteractionClientBase extends StandardInteractio
                     correlationId:
                         tokenResponse.correlation_id ?? correlationId,
                     scopes: requestScopes,
-                }
+                },
+                apiId
             );
 
         return result as AuthenticationResult;

package/src/custom_auth/core/interaction_client/jit/JitClient.ts

@@ -154,7 +154,8 @@ export class JitClient extends CustomAuthInteractionClientBase {
         const authResult = await this.handleTokenResponse(
             tokenResponse,
             scopes,
-            tokenResponse.correlation_id || continueResponse.correlation_id
+            tokenResponse.correlation_id || continueResponse.correlation_id,
+            apiId
         );
 
         return createJitCompletedResult({

package/src/custom_auth/core/interaction_client/mfa/MfaClient.ts

@@ -137,7 +137,8 @@ export class MfaClient extends CustomAuthInteractionClientBase {
         const result = await this.handleTokenResponse(
             tokenResponse,
             scopes,
-            tokenResponse.correlation_id ?? parameters.correlationId
+            tokenResponse.correlation_id ?? parameters.correlationId,
+            apiId
         );
 
         return createMfaCompletedResult({

package/src/custom_auth/get_account/interaction_client/CustomAuthSilentCacheClient.ts

@@ -89,7 +89,8 @@ export class CustomAuthSilentCacheClient extends CustomAuthInteractionClientBase
 
                 const refreshTokenResult =
                     await refreshTokenClient.acquireTokenByRefreshToken(
-                        silentRequest
+                        silentRequest,
+                        PublicApiId.ACCOUNT_GET_ACCESS_TOKEN
                     );
 
                 this.logger.verbose(

package/src/custom_auth/sign_in/interaction_client/SignInClient.ts

@@ -176,7 +176,8 @@ export class SignInClient extends CustomAuthInteractionClientBase {
                 ),
             scopes,
             parameters.correlationId,
-            telemetryManager
+            telemetryManager,
+            apiId
         );
     }
 
@@ -220,7 +221,8 @@ export class SignInClient extends CustomAuthInteractionClientBase {
                 ),
             scopes,
             parameters.correlationId,
-            telemetryManager
+            telemetryManager,
+            apiId
         );
     }
 
@@ -263,7 +265,8 @@ export class SignInClient extends CustomAuthInteractionClientBase {
                 ),
             scopes,
             parameters.correlationId,
-            telemetryManager
+            telemetryManager,
+            apiId
         );
     }
 
@@ -279,7 +282,8 @@ export class SignInClient extends CustomAuthInteractionClientBase {
         tokenEndpointCaller: () => Promise<SignInTokenResponse>,
         scopes: string[],
         correlationId: string,
-        telemetryManager: ServerTelemetryManager
+        telemetryManager: ServerTelemetryManager,
+        apiId: number
     ): Promise<
         | SignInCompletedResult
         | SignInJitRequiredResult
@@ -301,7 +305,8 @@ export class SignInClient extends CustomAuthInteractionClientBase {
             const authResult = await this.handleTokenResponse(
                 tokenResponse,
                 scopes,
-                correlationId
+                correlationId,
+                apiId
             );
 
             return createSignInCompleteResult({

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -741,7 +741,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         await this.browserStorage.setAccount(
             accountEntity,
             this.correlationId,
-            kmsi
+            kmsi,
+            this.apiId
         );
         // Remove any existing cached tokens for this account in browser storage
         this.browserStorage.removeAccountContext(
@@ -817,6 +818,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             nativeCacheRecord,
             this.correlationId,
             AuthToken.isKmsi(idTokenClaims),
+            this.apiId,
             request.storeInCache
         );
     }

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -136,6 +136,7 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
                     cloud_instance_host_name: request.cloudInstanceHostName,
                 },
                 silentRequest,
+                this.apiId,
                 false
             );
         } catch (e) {

package/src/interaction_client/SilentRefreshClient.ts

@@ -74,11 +74,13 @@ export class SilentRefreshClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(silentRequest).catch((e: AuthError) => {
-            (e as AuthError).setCorrelationId(this.correlationId);
-            serverTelemetryManager.cacheFailedRequest(e);
-            throw e;
-        }) as Promise<AuthenticationResult>;
+        )(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(
+            (e: AuthError) => {
+                (e as AuthError).setCorrelationId(this.correlationId);
+                serverTelemetryManager.cacheFailedRequest(e);
+                throw e;
+            }
+        ) as Promise<AuthenticationResult>;
     }
 
     /**

package/src/interaction_handler/InteractionHandler.ts

@@ -25,6 +25,7 @@ import {
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
+import { ApiId } from "../utils/BrowserConstants.js";
 
 /**
  * Abstract class which defines operations for a browser interaction handling class.
@@ -56,7 +57,8 @@ export class InteractionHandler {
      */
     async handleCodeResponse(
         response: AuthorizeResponse,
-        request: CommonAuthorizationUrlRequest
+        request: CommonAuthorizationUrlRequest,
+        apiId: ApiId
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.HandleCodeResponse,
@@ -89,7 +91,7 @@ export class InteractionHandler {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(authCodeResponse, request);
+        )(authCodeResponse, request, apiId);
     }
 
     /**
@@ -103,6 +105,7 @@ export class InteractionHandler {
     async handleCodeResponseFromServer(
         authCodeResponse: AuthorizationCodePayload,
         request: CommonAuthorizationUrlRequest,
+        apiId: ApiId,
         validateNonce: boolean = true
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
@@ -152,7 +155,11 @@ export class InteractionHandler {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(this.authCodeRequest, authCodeResponse)) as AuthenticationResult;
+        )(
+            this.authCodeRequest,
+            apiId,
+            authCodeResponse
+        )) as AuthenticationResult;
         return tokenResponse;
     }
 

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.27.0";
+export const version = "4.28.1";

package/src/protocol/Authorize.ts

@@ -438,7 +438,7 @@ export async function handleResponseCode(
         logger,
         performanceClient,
         request.correlationId
-    )(response, request);
+    )(response, request, apiId);
 
     return result;
 }
@@ -556,6 +556,7 @@ export async function handleResponseEAR(
         authority,
         TimeUtils.nowSeconds(),
         request,
+        apiId,
         additionalData,
         undefined,
         undefined,

package/src/utils/BrowserConstants.ts

@@ -112,9 +112,9 @@ export type InMemoryCacheKeys =
 
 /**
  * API Codes for Telemetry purposes.
- * Before adding a new code you must claim it in the MSAL Telemetry tracker as these number spaces are shared across all MSALs
  * 0-99 Silent Flow
  * 800-899 Auth Code Flow
+ * 900-999 Miscellaneous
  */
 export const ApiId = {
     acquireTokenRedirect: 861,
@@ -126,9 +126,35 @@ export const ApiId = {
     acquireTokenSilent_silentFlow: 61,
     logout: 961,
     logoutPopup: 962,
+    hydrateCache: 963,
+    loadExternalTokens: 964,
 } as const;
 export type ApiId = (typeof ApiId)[keyof typeof ApiId];
 
+/**
+ * API Names for Telemetry purposes.
+ */
+export const ApiName = {
+    861: "acquireTokenRedirect",
+    862: "acquireTokenPopup",
+    863: "ssoSilent",
+    864: "acquireTokenSilent_authCode",
+    865: "handleRedirectPromise",
+    866: "acquireTokenByCode",
+    61: "acquireTokenSilent_silentFlow",
+    961: "logout",
+    962: "logoutPopup",
+    963: "hydrateCache",
+    964: "loadExternalTokens",
+} as const satisfies Record<ApiId, string>;
+
+export const apiIdToName = (id: number | undefined): string => {
+    if (typeof id === "number" && id in ApiName) {
+        return ApiName[id as ApiId];
+    }
+    return "unknown";
+};
+
 /*
  * Interaction type of the API - used for state and telemetry
  */