@azure/msal-browser 4.5.1 → 4.8.0

package/src/interaction_handler/RedirectHandler.ts

@@ -14,7 +14,8 @@ import {
     CcsCredential,
     invokeAsync,
     PerformanceEvents,
-    ServerAuthorizationCodeResponse,
+    AuthorizeResponse,
+    AuthorizeProtocol,
 } from "@azure/msal-common/browser";
 import {
     createBrowserAuthError,
@@ -143,7 +144,7 @@ export class RedirectHandler {
      * @param hash
      */
     async handleCodeResponse(
-        response: ServerAuthorizationCodeResponse,
+        response: AuthorizeResponse,
         state: string
     ): Promise<AuthenticationResult> {
         this.logger.verbose("RedirectHandler.handleCodeResponse called");
@@ -163,7 +164,7 @@ export class RedirectHandler {
 
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(
+            authCodeResponse = AuthorizeProtocol.getAuthorizationCodePayload(
                 response,
                 requestState
             );

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -29,6 +29,7 @@ import {
     AccessTokenEntity,
     TenantProfile,
     buildTenantProfile,
+    TimeUtils,
 } from "@azure/msal-common/browser";
 import { isBridgeError } from "../BridgeError.js";
 import { BridgeStatusCode } from "../BridgeStatusCode.js";
@@ -74,8 +75,7 @@ export class NestedAppAuthAdapter {
 
         const correlationId =
             request.correlationId || this.crypto.createNewGuid();
-        const requestBuilder = new RequestParameterBuilder(correlationId);
-        const claims = requestBuilder.addClientCapabilitiesToClaims(
+        const claims = RequestParameterBuilder.addClientCapabilitiesToClaims(
             request.claims,
             this.clientCapabilities
         );
@@ -105,8 +105,9 @@ export class NestedAppAuthAdapter {
             throw createClientAuthError(ClientAuthErrorCodes.nullOrEmptyToken);
         }
 
-        const expiresOn = new Date(
-            (reqTimestamp + (response.token.expires_in || 0)) * 1000
+        // Request timestamp and AuthResult expires_in are in seconds, converting to Date for AuthenticationResult
+        const expiresOn = TimeUtils.toDateFromSeconds(
+            reqTimestamp + (response.token.expires_in || 0)
         );
         const idTokenClaims = AuthToken.extractTokenClaims(
             response.token.id_token,
@@ -304,13 +305,13 @@ export class NestedAppAuthAdapter {
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken.secret,
             fromCache: true,
-            expiresOn: new Date(Number(accessToken.expiresOn) * 1000),
+            expiresOn: TimeUtils.toDateFromSeconds(accessToken.expiresOn),
+            extExpiresOn: TimeUtils.toDateFromSeconds(
+                accessToken.extendedExpiresOn
+            ),
             tokenType:
                 request.authenticationScheme || AuthenticationScheme.BEARER,
             correlationId,
-            extExpiresOn: new Date(
-                Number(accessToken.extendedExpiresOn) * 1000
-            ),
             state: request.state,
         };
 

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.5.1";
+export const version = "4.8.0";

package/src/protocol/Authorize.ts

@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    AuthenticationScheme,
+    Authority,
+    AuthorizeProtocol,
+    ClientConfigurationErrorCodes,
+    CommonAuthorizationUrlRequest,
+    createClientConfigurationError,
+    invokeAsync,
+    IPerformanceClient,
+    Logger,
+    PerformanceEvents,
+    PopTokenGenerator,
+    ProtocolMode,
+    RequestParameterBuilder,
+    Constants,
+} from "@azure/msal-common/browser";
+import { BrowserConfiguration } from "../config/Configuration.js";
+import { BrowserConstants } from "../utils/BrowserConstants.js";
+import { version } from "../packageMetadata.js";
+import { CryptoOps } from "../crypto/CryptoOps.js";
+
+/**
+ * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+ * @param config
+ * @param authority
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+async function getStandardParameters(
+    config: BrowserConfiguration,
+    authority: Authority,
+    request: CommonAuthorizationUrlRequest,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<Map<string, string>> {
+    const parameters = AuthorizeProtocol.getStandardAuthorizeRequestParameters(
+        { ...config.auth, authority: authority },
+        request,
+        logger,
+        performanceClient
+    );
+    RequestParameterBuilder.addLibraryInfo(parameters, {
+        sku: BrowserConstants.MSAL_SKU,
+        version: version,
+        os: "",
+        cpu: "",
+    });
+    if (config.auth.protocolMode !== ProtocolMode.OIDC) {
+        RequestParameterBuilder.addApplicationTelemetry(
+            parameters,
+            config.telemetry.application
+        );
+    }
+
+    if (request.platformBroker) {
+        // signal ests that this is a WAM call
+        RequestParameterBuilder.addNativeBroker(parameters);
+
+        // pass the req_cnf for POP
+        if (request.authenticationScheme === AuthenticationScheme.POP) {
+            const cryptoOps = new CryptoOps(logger, performanceClient);
+            const popTokenGenerator = new PopTokenGenerator(cryptoOps);
+
+            // req_cnf is always sent as a string for SPAs
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    logger,
+                    performanceClient,
+                    request.correlationId
+                )(request, logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            } else {
+                reqCnfData = cryptoOps.encodeKid(request.popKid);
+            }
+            RequestParameterBuilder.addPopToken(parameters, reqCnfData);
+        }
+    }
+
+    RequestParameterBuilder.instrumentBrokerParams(
+        parameters,
+        request.correlationId,
+        performanceClient
+    );
+
+    return parameters;
+}
+
+/**
+ * Gets the full /authorize URL with request parameters when using Auth Code + PKCE
+ * @param config
+ * @param authority
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+export async function getAuthCodeRequestUrl(
+    config: BrowserConfiguration,
+    authority: Authority,
+    request: CommonAuthorizationUrlRequest,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<string> {
+    if (!request.codeChallenge) {
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.pkceParamsMissing
+        );
+    }
+
+    const parameters = await invokeAsync(
+        getStandardParameters,
+        PerformanceEvents.GetStandardParams,
+        logger,
+        performanceClient,
+        request.correlationId
+    )(config, authority, request, logger, performanceClient);
+    RequestParameterBuilder.addResponseTypeCode(parameters);
+
+    RequestParameterBuilder.addCodeChallengeParams(
+        parameters,
+        request.codeChallenge,
+        Constants.S256_CODE_CHALLENGE_METHOD
+    );
+
+    return AuthorizeProtocol.getAuthorizeUrl(authority, parameters);
+}

package/src/request/PopupRequest.ts

@@ -3,10 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import {
-    CommonAuthorizationUrlRequest,
-    StringDict,
-} from "@azure/msal-common/browser";
+import { CommonAuthorizationUrlRequest } from "@azure/msal-common/browser";
 import { PopupWindowAttributes } from "./PopupWindowAttributes.js";
 
 /**
@@ -51,6 +48,5 @@ export type PopupRequest = Partial<
 > & {
     scopes: Array<string>;
     popupWindowAttributes?: PopupWindowAttributes;
-    tokenBodyParameters?: StringDict;
     popupWindowParent?: Window;
 };

package/src/request/RedirectRequest.ts

@@ -3,10 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import {
-    CommonAuthorizationUrlRequest,
-    StringDict,
-} from "@azure/msal-common/browser";
+import { CommonAuthorizationUrlRequest } from "@azure/msal-common/browser";
 
 /**
  * RedirectRequest: Request object passed by user to retrieve a Code from the
@@ -55,5 +52,4 @@ export type RedirectRequest = Partial<
      * Set onRedirectNavigate in Configuration instead.
      */
     onRedirectNavigate?: (url: string) => boolean | void;
-    tokenBodyParameters?: StringDict;
 };

package/src/request/SilentRequest.ts

@@ -46,5 +46,4 @@ export type SilentRequest = Omit<
     cacheLookupPolicy?: CacheLookupPolicy;
     prompt?: string;
     state?: string;
-    tokenBodyParameters?: StringDict;
 };

package/src/request/SsoSilentRequest.ts

@@ -3,10 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import {
-    CommonAuthorizationUrlRequest,
-    StringDict,
-} from "@azure/msal-common/browser";
+import { CommonAuthorizationUrlRequest } from "@azure/msal-common/browser";
 
 /**
  * Request object passed by user to ssoSilent to retrieve a Code from the server (first leg of authorization code grant flow)
@@ -42,6 +39,4 @@ export type SsoSilentRequest = Partial<
         | "requestedClaimsHash"
         | "platformBroker"
     >
-> & {
-    tokenBodyParameters?: StringDict;
-};
+>;

package/src/response/ResponseHandler.ts

@@ -6,7 +6,7 @@
 import {
     ICrypto,
     Logger,
-    ServerAuthorizationCodeResponse,
+    AuthorizeResponse,
     UrlUtils,
 } from "@azure/msal-common/browser";
 import {
@@ -20,7 +20,7 @@ export function deserializeResponse(
     responseString: string,
     responseLocation: string,
     logger: Logger
-): ServerAuthorizationCodeResponse {
+): AuthorizeResponse {
     // Deserialize hash fragment response parameters.
     const serverParams = UrlUtils.getDeserializedResponse(responseString);
     if (!serverParams) {
@@ -49,7 +49,7 @@ export function deserializeResponse(
  * Returns the interaction type that the response object belongs to
  */
 export function validateInteractionType(
-    response: ServerAuthorizationCodeResponse,
+    response: AuthorizeResponse,
     browserCrypto: ICrypto,
     interactionType: InteractionType
 ): void {