@azure/msal-browser 4.27.0 → 5.0.0-beta.0

package/src/controllers/UnknownOperatingContextController.ts

@@ -5,7 +5,6 @@
 
 import {
     CommonAuthorizationUrlRequest,
-    CommonSilentFlowRequest,
     PerformanceCallbackFunction,
     AccountInfo,
     Logger,
@@ -14,7 +13,6 @@ import {
     DEFAULT_CRYPTO_IMPLEMENTATION,
     AccountFilter,
 } from "@azure/msal-common/browser";
-import { ITokenCache } from "../cache/ITokenCache.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import {
     BrowserCacheManager,
@@ -29,7 +27,7 @@ import { RedirectRequest } from "../request/RedirectRequest.js";
 import { SilentRequest } from "../request/SilentRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
-import { ApiId, WrapperSKU } from "../utils/BrowserConstants.js";
+import { WrapperSKU } from "../utils/BrowserConstants.js";
 import { IController } from "./IController.js";
 import { UnknownOperatingContext } from "../operatingcontext/UnknownOperatingContext.js";
 import { CryptoOps } from "../crypto/CryptoOps.js";
@@ -41,6 +39,7 @@ import { EventCallbackFunction } from "../event/EventMessage.js";
 import { ClearCacheRequest } from "../request/ClearCacheRequest.js";
 import { EventType } from "../event/EventType.js";
 import { EventHandler } from "../event/EventHandler.js";
+import { HandleRedirectPromiseOptions } from "../request/HandleRedirectPromiseOptions.js";
 
 /**
  * UnknownOperatingContextController class
@@ -112,8 +111,7 @@ export class UnknownOperatingContextController implements IController {
                   this.browserCrypto,
                   this.logger,
                   this.performanceClient,
-                  this.eventHandler,
-                  undefined
+                  this.eventHandler
               )
             : DEFAULT_BROWSER_CACHE_MANAGER(
                   this.config.auth.clientId,
@@ -122,26 +120,11 @@ export class UnknownOperatingContextController implements IController {
                   this.eventHandler
               );
     }
-    getBrowserStorage(): BrowserCacheManager {
-        return this.browserStorage;
-    }
 
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     getAccount(accountFilter: AccountFilter): AccountInfo | null {
         return null;
     }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    getAccountByHomeId(homeAccountId: string): AccountInfo | null {
-        return null;
-    }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    getAccountByLocalId(localAccountId: string): AccountInfo | null {
-        return null;
-    }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    getAccountByUsername(username: string): AccountInfo | null {
-        return null;
-    }
     getAllAccounts(): AccountInfo[] {
         return [];
     }
@@ -177,41 +160,6 @@ export class UnknownOperatingContextController implements IController {
         blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
-    acquireTokenNative(
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        request:
-            | PopupRequest
-            | SilentRequest
-            | Partial<
-                  Omit<
-                      CommonAuthorizationUrlRequest,
-                      | "responseMode"
-                      | "earJwk"
-                      | "codeChallenge"
-                      | "codeChallengeMethod"
-                      | "requestedClaimsHash"
-                      | "platformBroker"
-                  >
-              >,
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        apiId: ApiId,
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        accountId?: string | undefined
-    ): Promise<AuthenticationResult> {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as Promise<AuthenticationResult>;
-    }
-    acquireTokenByRefreshToken(
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        commonRequest: CommonSilentFlowRequest,
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        silentRequest: SilentRequest
-    ): Promise<AuthenticationResult> {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as Promise<AuthenticationResult>;
-    }
     addEventCallback(
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         callback: EventCallbackFunction,
@@ -236,18 +184,10 @@ export class UnknownOperatingContextController implements IController {
         blockNonBrowserEnvironment();
         return true;
     }
-    enableAccountStorageEvents(): void {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-    }
-    disableAccountStorageEvents(): void {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-    }
 
     handleRedirectPromise(
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        hash?: string | undefined
+        options?: HandleRedirectPromiseOptions
     ): Promise<AuthenticationResult | null> {
         blockAPICallsBeforeInitialize(this.initialized);
         return Promise.resolve(null);
@@ -297,7 +237,6 @@ export class UnknownOperatingContextController implements IController {
                 | "earJwk"
                 | "codeChallenge"
                 | "codeChallengeMethod"
-                | "requestedClaimsHash"
                 | "platformBroker"
             >
         >
@@ -306,11 +245,6 @@ export class UnknownOperatingContextController implements IController {
         blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
-    getTokenCache(): ITokenCache {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as ITokenCache;
-    }
     getLogger(): Logger {
         return this.logger;
     }
@@ -341,26 +275,6 @@ export class UnknownOperatingContextController implements IController {
     getConfiguration(): BrowserConfiguration {
         return this.config;
     }
-    isBrowserEnv(): boolean {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return true;
-    }
-    getBrowserCrypto(): ICrypto {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as ICrypto;
-    }
-    getPerformanceClient(): IPerformanceClient {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as IPerformanceClient;
-    }
-    getRedirectResponse(): Map<string, Promise<AuthenticationResult | null>> {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment();
-        return {} as Map<string, Promise<AuthenticationResult | null>>;
-    }
 
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     async clearCache(logoutRequest?: ClearCacheRequest): Promise<void> {

package/src/crypto/BrowserCrypto.ts

@@ -7,10 +7,6 @@ import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError.js";
-import {
-    IPerformanceClient,
-    PerformanceEvents,
-} from "@azure/msal-common/browser";
 import { KEY_FORMAT_JWK } from "../utils/BrowserConstants.js";
 import { base64Encode, urlEncodeArr } from "../encode/Base64Encode.js";
 import { base64Decode, base64DecToArr } from "../encode/Base64Decode.js";
@@ -83,15 +79,7 @@ export function validateCryptoAvailable(
  * @param performanceClient {?IPerformanceClient}
  * @param correlationId {?string} correlation id
  */
-export async function sha256Digest(
-    dataString: string,
-    performanceClient?: IPerformanceClient,
-    correlationId?: string
-): Promise<ArrayBuffer> {
-    performanceClient?.addQueueMeasurement(
-        PerformanceEvents.Sha256Digest,
-        correlationId
-    );
+export async function sha256Digest(dataString: string): Promise<ArrayBuffer> {
     const encoder = new TextEncoder();
     const data = encoder.encode(dataString);
     return window.crypto.subtle.digest(

package/src/crypto/CryptoOps.ts

@@ -10,11 +10,11 @@ import {
     IPerformanceClient,
     JoseHeader,
     Logger,
-    PerformanceEvents,
     ShrOptions,
     SignedHttpRequest,
     SignedHttpRequestParameters,
 } from "@azure/msal-common/browser";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import {
     base64Encode,
     urlEncode,
@@ -116,7 +116,7 @@ export class CryptoOps implements ICrypto {
     ): Promise<string> {
         const publicKeyThumbMeasurement =
             this.performanceClient?.startMeasurement(
-                PerformanceEvents.CryptoOptsGetPublicKeyThumbprint,
+                BrowserPerformanceEvents.CryptoOptsGetPublicKeyThumbprint,
                 request.correlationId
             );
 
@@ -150,12 +150,16 @@ export class CryptoOps implements ICrypto {
             await BrowserCrypto.importJwk(privateKeyJwk, false, ["sign"]);
 
         // Store Keypair data in keystore
-        await this.cache.setItem(publicJwkHash, {
-            privateKey: unextractablePrivateKey,
-            publicKey: keyPair.publicKey,
-            requestMethod: request.resourceRequestMethod,
-            requestUri: request.resourceRequestUri,
-        });
+        await this.cache.setItem(
+            publicJwkHash,
+            {
+                privateKey: unextractablePrivateKey,
+                publicKey: keyPair.publicKey,
+                requestMethod: request.resourceRequestMethod,
+                requestUri: request.resourceRequestUri,
+            },
+            request.correlationId
+        );
 
         if (publicKeyThumbMeasurement) {
             publicKeyThumbMeasurement.end({
@@ -169,10 +173,14 @@ export class CryptoOps implements ICrypto {
     /**
      * Removes cryptographic keypair from key store matching the keyId passed in
      * @param kid
+     * @param correlationId
      */
-    async removeTokenBindingKey(kid: string): Promise<void> {
-        await this.cache.removeItem(kid);
-        const keyFound = await this.cache.containsKey(kid);
+    async removeTokenBindingKey(
+        kid: string,
+        correlationId: string
+    ): Promise<void> {
+        await this.cache.removeItem(kid, correlationId);
+        const keyFound = await this.cache.containsKey(kid, correlationId);
         if (keyFound) {
             throw createClientAuthError(
                 ClientAuthErrorCodes.bindingKeyNotRemoved
@@ -182,26 +190,29 @@ export class CryptoOps implements ICrypto {
 
     /**
      * Removes all cryptographic keys from IndexedDB storage
+     * @param correlationId
      */
-    async clearKeystore(): Promise<boolean> {
+    async clearKeystore(correlationId: string): Promise<boolean> {
         // Delete in-memory keystores
-        this.cache.clearInMemory();
+        this.cache.clearInMemory(correlationId);
 
         /**
          * There is only one database, so calling clearPersistent on asymmetric keystore takes care of
          * every persistent keystore
          */
         try {
-            await this.cache.clearPersistent();
+            await this.cache.clearPersistent(correlationId);
             return true;
         } catch (e) {
             if (e instanceof Error) {
                 this.logger.error(
-                    `Clearing keystore failed with error: ${e.message}`
+                    `Clearing keystore failed with error: '${e.message}'`,
+                    correlationId
                 );
             } else {
                 this.logger.error(
-                    "Clearing keystore failed with unknown error"
+                    "Clearing keystore failed with unknown error",
+                    correlationId
                 );
             }
 
@@ -221,10 +232,13 @@ export class CryptoOps implements ICrypto {
         correlationId?: string
     ): Promise<string> {
         const signJwtMeasurement = this.performanceClient?.startMeasurement(
-            PerformanceEvents.CryptoOptsSignJwt,
+            BrowserPerformanceEvents.CryptoOptsSignJwt,
             correlationId
         );
-        const cachedKeyPair = await this.cache.getItem(kid);
+        const cachedKeyPair = await this.cache.getItem(
+            kid,
+            correlationId || ""
+        );
 
         if (!cachedKeyPair) {
             throw createBrowserAuthError(

package/src/crypto/PkceGenerator.ts

@@ -6,11 +6,11 @@
 import {
     IPerformanceClient,
     Logger,
-    PerformanceEvents,
     PkceCodes,
     invoke,
     invokeAsync,
 } from "@azure/msal-common/browser";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -33,20 +33,16 @@ export async function generatePkceCodes(
     logger: Logger,
     correlationId: string
 ): Promise<PkceCodes> {
-    performanceClient.addQueueMeasurement(
-        PerformanceEvents.GeneratePkceCodes,
-        correlationId
-    );
     const codeVerifier = invoke(
         generateCodeVerifier,
-        PerformanceEvents.GenerateCodeVerifier,
+        BrowserPerformanceEvents.GenerateCodeVerifier,
         logger,
         performanceClient,
         correlationId
     )(performanceClient, logger, correlationId);
     const codeChallenge = await invokeAsync(
         generateCodeChallengeFromVerifier,
-        PerformanceEvents.GenerateCodeChallengeFromVerifier,
+        BrowserPerformanceEvents.GenerateCodeChallengeFromVerifier,
         logger,
         performanceClient,
         correlationId
@@ -71,7 +67,7 @@ function generateCodeVerifier(
         const buffer: Uint8Array = new Uint8Array(RANDOM_BYTE_ARR_LENGTH);
         invoke(
             getRandomValues,
-            PerformanceEvents.GetRandomValues,
+            BrowserPerformanceEvents.GetRandomValues,
             logger,
             performanceClient,
             correlationId
@@ -94,19 +90,15 @@ async function generateCodeChallengeFromVerifier(
     logger: Logger,
     correlationId: string
 ): Promise<string> {
-    performanceClient.addQueueMeasurement(
-        PerformanceEvents.GenerateCodeChallengeFromVerifier,
-        correlationId
-    );
     try {
         // hashed verifier
         const pkceHashedCodeVerifier = await invokeAsync(
             sha256Digest,
-            PerformanceEvents.Sha256Digest,
+            BrowserPerformanceEvents.Sha256Digest,
             logger,
             performanceClient,
             correlationId
-        )(pkceCodeVerifier, performanceClient, correlationId);
+        )(pkceCodeVerifier);
         // encode hash as base64
         return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
     } catch (e) {

package/src/crypto/SignedHttpRequest.ts

@@ -5,12 +5,11 @@
 
 import { CryptoOps } from "./CryptoOps.js";
 import {
-    ClientAuthError,
-    ClientAuthErrorCodes,
     Logger,
     LoggerOptions,
     PopTokenGenerator,
     SignedHttpRequestParameters,
+    StubPerformanceClient,
 } from "@azure/msal-common/browser";
 import { version, name } from "../packageMetadata.js";
 
@@ -31,7 +30,10 @@ export class SignedHttpRequest {
         const loggerOptions = (shrOptions && shrOptions.loggerOptions) || {};
         this.logger = new Logger(loggerOptions, name, version);
         this.cryptoOps = new CryptoOps(this.logger);
-        this.popTokenGenerator = new PopTokenGenerator(this.cryptoOps);
+        this.popTokenGenerator = new PopTokenGenerator(
+            this.cryptoOps,
+            new StubPerformanceClient()
+        );
         this.shrParameters = shrParameters;
     }
 
@@ -70,25 +72,16 @@ export class SignedHttpRequest {
     /**
      * Removes cached keys from browser for given public key thumbprint
      * @param publicKeyThumbprint Public key digest (from generatePublicKeyThumbprint API)
+     * @param correlationId
      * @returns If keys are properly deleted
      */
-    async removeKeys(publicKeyThumbprint: string): Promise<boolean> {
-        return this.cryptoOps
-            .removeTokenBindingKey(publicKeyThumbprint)
-            .then(() => true)
-            .catch((error) => {
-                /*
-                 * @deprecated - To maintain public API signature, we return false if the error is due to the key still being present in indexedDB.
-                 */
-                if (
-                    error instanceof ClientAuthError &&
-                    error.errorCode ===
-                        ClientAuthErrorCodes.bindingKeyNotRemoved
-                ) {
-                    return false;
-                }
-
-                throw error;
-            });
+    async removeKeys(
+        publicKeyThumbprint: string,
+        correlationId: string
+    ): Promise<void> {
+        return this.cryptoOps.removeTokenBindingKey(
+            publicKeyThumbprint,
+            correlationId
+        );
     }
 }

package/src/custom_auth/controller/CustomAuthStandardController.ts

@@ -89,7 +89,8 @@ export class CustomAuthStandardController
 
         if (!this.isBrowserEnvironment) {
             this.logger.verbose(
-                "The SDK can only be used in a browser environment."
+                "The SDK can only be used in a browser environment.",
+                ""
             );
             throw new UnsupportedEnvironmentError();
         }
@@ -106,6 +107,7 @@ export class CustomAuthStandardController
             this.networkClient,
             this.browserStorage,
             this.logger,
+            this.performanceClient,
             this.customAuthConfig.customAuth?.authApiProxyUrl
         );
 
@@ -170,7 +172,7 @@ export class CustomAuthStandardController
             throw new NoCachedAccountFoundError(correlationId);
         } catch (error) {
             this.logger.errorPii(
-                `An error occurred during getting current account: ${error}`,
+                `An error occurred during getting current account: '${error}'`,
                 correlationId
             );
 
@@ -219,9 +221,9 @@ export class CustomAuthStandardController
             };
 
             this.logger.verbose(
-                `Starting sign-in flow ${
+                `Starting sign-in flow '${
                     !!signInInputs.password ? "with" : "without"
-                } password.`,
+                }' password.`,
                 correlationId
             );
 
@@ -395,7 +397,7 @@ export class CustomAuthStandardController
             );
         } catch (error) {
             this.logger.errorPii(
-                `An error occurred during starting sign-in: ${error}`,
+                `An error occurred during starting sign-in: '${error}'`,
                 correlationId
             );
 
@@ -426,7 +428,7 @@ export class CustomAuthStandardController
             this.ensureUserNotSignedIn(correlationId);
 
             this.logger.verbose(
-                `Starting sign-up flow${
+                `Starting sign-up flow'${
                     !!signUpInputs.password
                         ? ` with ${
                               !!signUpInputs.attributes
@@ -434,7 +436,7 @@ export class CustomAuthStandardController
                                   : "password"
                           }`
                         : ""
-                }.`,
+                }'.`,
                 correlationId
             );
 
@@ -509,7 +511,7 @@ export class CustomAuthStandardController
             );
         } catch (error) {
             this.logger.errorPii(
-                `An error occurred during starting sign-up: ${error}`,
+                `An error occurred during starting sign-up: '${error}'`,
                 correlationId
             );
 
@@ -570,7 +572,7 @@ export class CustomAuthStandardController
             );
         } catch (error) {
             this.logger.errorPii(
-                `An error occurred during starting reset-password: ${error}`,
+                `An error occurred during starting reset-password: '${error}'`,
                 correlationId
             );
 

package/src/custom_auth/core/CustomAuthAuthority.ts

@@ -7,6 +7,7 @@ import {
     Authority,
     AuthorityOptions,
     INetworkModule,
+    IPerformanceClient,
     Logger,
 } from "@azure/msal-common/browser";
 import * as CustomAuthApiEndpoint from "./network_client/custom_auth_api/CustomAuthApiEndpoint.js";
@@ -33,18 +34,18 @@ export class CustomAuthAuthority extends Authority {
         networkInterface: INetworkModule,
         cacheManager: BrowserCacheManager,
         logger: Logger,
+        performanceClient: IPerformanceClient,
         private customAuthProxyDomain?: string
     ) {
         const ciamAuthorityUrl =
             CustomAuthAuthority.transformCIAMAuthority(authority);
 
         const authorityOptions: AuthorityOptions = {
-            protocolMode: config.auth.protocolMode,
+            protocolMode: config.system.protocolMode,
             OIDCOptions: config.auth.OIDCOptions,
             knownAuthorities: config.auth.knownAuthorities,
             cloudDiscoveryMetadata: config.auth.cloudDiscoveryMetadata,
             authorityMetadata: config.auth.authorityMetadata,
-            skipAuthorityMetadataCache: config.auth.skipAuthorityMetadataCache,
         };
 
         super(
@@ -53,7 +54,8 @@ export class CustomAuthAuthority extends Authority {
             cacheManager,
             authorityOptions,
             logger,
-            ""
+            "",
+            performanceClient
         );
 
         // Set the metadata for the authority
@@ -76,9 +78,14 @@ export class CustomAuthAuthority extends Authority {
             jwks_uri: "",
         };
         const cacheKey = this.cacheManager.generateAuthorityMetadataCacheKey(
-            metadataEntity.preferred_cache
+            metadataEntity.preferred_cache,
+            this.correlationId
+        );
+        cacheManager.setAuthorityMetadata(
+            cacheKey,
+            metadataEntity,
+            this.correlationId
         );
-        cacheManager.setAuthorityMetadata(cacheKey, metadataEntity);
     }
 
     /**

package/src/custom_auth/core/auth_flow/jit/result/AuthMethodRegistrationChallengeMethodResult.ts

@@ -44,6 +44,7 @@ export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultB
     /**
      * Checks if the result indicates that verification is required.
      * @returns true if verification is required, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isVerificationRequired(): this is AuthMethodRegistrationChallengeMethodResult & {
         state: AuthMethodVerificationRequiredState;
@@ -57,6 +58,7 @@ export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultB
     /**
      * Checks if the result indicates that registration is completed (fast-pass scenario).
      * @returns true if registration is completed, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isCompleted(): this is AuthMethodRegistrationChallengeMethodResult & {
         state: AuthMethodRegistrationCompletedState;
@@ -70,6 +72,7 @@ export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultB
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed(): this is AuthMethodRegistrationChallengeMethodResult & {
         state: AuthMethodRegistrationFailedState;

package/src/custom_auth/core/auth_flow/jit/result/AuthMethodRegistrationSubmitChallengeResult.ts

@@ -41,6 +41,7 @@ export class AuthMethodRegistrationSubmitChallengeResult extends AuthFlowResultB
     /**
      * Checks if the result indicates that registration is completed.
      * @returns true if registration is completed, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isCompleted(): this is AuthMethodRegistrationSubmitChallengeResult & {
         state: AuthMethodRegistrationCompletedState;
@@ -54,6 +55,7 @@ export class AuthMethodRegistrationSubmitChallengeResult extends AuthFlowResultB
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
+     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed(): this is AuthMethodRegistrationSubmitChallengeResult & {
         state: AuthMethodRegistrationFailedState;