@azure/msal-browser 4.7.0 → 4.8.0

package/src/interaction_client/StandardInteractionClient.ts

@@ -5,7 +5,6 @@
 
 import {
     ServerTelemetryManager,
-    CommonAuthorizationCodeRequest,
     Constants,
     AuthorizationCodeClient,
     ClientConfiguration,
@@ -20,7 +19,6 @@ import {
     invokeAsync,
     BaseAuthRequest,
     StringDict,
-    PkceCodes,
 } from "@azure/msal-common/browser";
 import { BaseInteractionClient } from "./BaseInteractionClient.js";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest.js";
@@ -35,7 +33,6 @@ import * as BrowserUtils from "../utils/BrowserUtils.js";
 import { RedirectRequest } from "../request/RedirectRequest.js";
 import { PopupRequest } from "../request/PopupRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
-import { generatePkceCodes } from "../crypto/PkceGenerator.js";
 import { createNewGuid } from "../crypto/BrowserCrypto.js";
 import { initializeBaseRequest } from "../request/RequestHelpers.js";
 
@@ -43,43 +40,6 @@ import { initializeBaseRequest } from "../request/RequestHelpers.js";
  * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
  */
 export abstract class StandardInteractionClient extends BaseInteractionClient {
-    /**
-     * Generates an auth code request tied to the url request.
-     * @param request
-     * @param pkceCodes
-     */
-    protected async initializeAuthorizationCodeRequest(
-        request: AuthorizationUrlRequest,
-        pkceCodes?: PkceCodes
-    ): Promise<CommonAuthorizationCodeRequest> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-            this.correlationId
-        );
-
-        const generatedPkceParams: PkceCodes =
-            pkceCodes ||
-            (await invokeAsync(
-                generatePkceCodes,
-                PerformanceEvents.GeneratePkceCodes,
-                this.logger,
-                this.performanceClient,
-                this.correlationId
-            )(this.performanceClient, this.logger, this.correlationId));
-
-        const authCodeRequest: CommonAuthorizationCodeRequest = {
-            ...request,
-            redirectUri: request.redirectUri,
-            code: Constants.EMPTY_STRING,
-            codeVerifier: generatedPkceParams.verifier,
-        };
-
-        request.codeChallenge = generatedPkceParams.challenge;
-        request.codeChallengeMethod = Constants.S256_CODE_CHALLENGE_METHOD;
-
-        return authCodeRequest;
-    }
-
     /**
      * Initializer for the logout request.
      * @param logoutRequest

package/src/interaction_handler/InteractionHandler.ts

@@ -14,7 +14,8 @@ import {
     PerformanceEvents,
     invokeAsync,
     CcsCredentialType,
-    ServerAuthorizationCodeResponse,
+    AuthorizeResponse,
+    AuthorizeProtocol,
 } from "@azure/msal-common/browser";
 
 import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
@@ -54,7 +55,7 @@ export class InteractionHandler {
      * @param locationHash
      */
     async handleCodeResponse(
-        response: ServerAuthorizationCodeResponse,
+        response: AuthorizeResponse,
         request: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
@@ -64,7 +65,7 @@ export class InteractionHandler {
 
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(
+            authCodeResponse = AuthorizeProtocol.getAuthorizationCodePayload(
                 response,
                 request.state
             );

package/src/interaction_handler/RedirectHandler.ts

@@ -14,7 +14,8 @@ import {
     CcsCredential,
     invokeAsync,
     PerformanceEvents,
-    ServerAuthorizationCodeResponse,
+    AuthorizeResponse,
+    AuthorizeProtocol,
 } from "@azure/msal-common/browser";
 import {
     createBrowserAuthError,
@@ -143,7 +144,7 @@ export class RedirectHandler {
      * @param hash
      */
     async handleCodeResponse(
-        response: ServerAuthorizationCodeResponse,
+        response: AuthorizeResponse,
         state: string
     ): Promise<AuthenticationResult> {
         this.logger.verbose("RedirectHandler.handleCodeResponse called");
@@ -163,7 +164,7 @@ export class RedirectHandler {
 
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(
+            authCodeResponse = AuthorizeProtocol.getAuthorizationCodePayload(
                 response,
                 requestState
             );

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -75,8 +75,7 @@ export class NestedAppAuthAdapter {
 
         const correlationId =
             request.correlationId || this.crypto.createNewGuid();
-        const requestBuilder = new RequestParameterBuilder(correlationId);
-        const claims = requestBuilder.addClientCapabilitiesToClaims(
+        const claims = RequestParameterBuilder.addClientCapabilitiesToClaims(
             request.claims,
             this.clientCapabilities
         );

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.7.0";
+export const version = "4.8.0";

package/src/protocol/Authorize.ts

@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    AuthenticationScheme,
+    Authority,
+    AuthorizeProtocol,
+    ClientConfigurationErrorCodes,
+    CommonAuthorizationUrlRequest,
+    createClientConfigurationError,
+    invokeAsync,
+    IPerformanceClient,
+    Logger,
+    PerformanceEvents,
+    PopTokenGenerator,
+    ProtocolMode,
+    RequestParameterBuilder,
+    Constants,
+} from "@azure/msal-common/browser";
+import { BrowserConfiguration } from "../config/Configuration.js";
+import { BrowserConstants } from "../utils/BrowserConstants.js";
+import { version } from "../packageMetadata.js";
+import { CryptoOps } from "../crypto/CryptoOps.js";
+
+/**
+ * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+ * @param config
+ * @param authority
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+async function getStandardParameters(
+    config: BrowserConfiguration,
+    authority: Authority,
+    request: CommonAuthorizationUrlRequest,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<Map<string, string>> {
+    const parameters = AuthorizeProtocol.getStandardAuthorizeRequestParameters(
+        { ...config.auth, authority: authority },
+        request,
+        logger,
+        performanceClient
+    );
+    RequestParameterBuilder.addLibraryInfo(parameters, {
+        sku: BrowserConstants.MSAL_SKU,
+        version: version,
+        os: "",
+        cpu: "",
+    });
+    if (config.auth.protocolMode !== ProtocolMode.OIDC) {
+        RequestParameterBuilder.addApplicationTelemetry(
+            parameters,
+            config.telemetry.application
+        );
+    }
+
+    if (request.platformBroker) {
+        // signal ests that this is a WAM call
+        RequestParameterBuilder.addNativeBroker(parameters);
+
+        // pass the req_cnf for POP
+        if (request.authenticationScheme === AuthenticationScheme.POP) {
+            const cryptoOps = new CryptoOps(logger, performanceClient);
+            const popTokenGenerator = new PopTokenGenerator(cryptoOps);
+
+            // req_cnf is always sent as a string for SPAs
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    logger,
+                    performanceClient,
+                    request.correlationId
+                )(request, logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            } else {
+                reqCnfData = cryptoOps.encodeKid(request.popKid);
+            }
+            RequestParameterBuilder.addPopToken(parameters, reqCnfData);
+        }
+    }
+
+    RequestParameterBuilder.instrumentBrokerParams(
+        parameters,
+        request.correlationId,
+        performanceClient
+    );
+
+    return parameters;
+}
+
+/**
+ * Gets the full /authorize URL with request parameters when using Auth Code + PKCE
+ * @param config
+ * @param authority
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+export async function getAuthCodeRequestUrl(
+    config: BrowserConfiguration,
+    authority: Authority,
+    request: CommonAuthorizationUrlRequest,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<string> {
+    if (!request.codeChallenge) {
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.pkceParamsMissing
+        );
+    }
+
+    const parameters = await invokeAsync(
+        getStandardParameters,
+        PerformanceEvents.GetStandardParams,
+        logger,
+        performanceClient,
+        request.correlationId
+    )(config, authority, request, logger, performanceClient);
+    RequestParameterBuilder.addResponseTypeCode(parameters);
+
+    RequestParameterBuilder.addCodeChallengeParams(
+        parameters,
+        request.codeChallenge,
+        Constants.S256_CODE_CHALLENGE_METHOD
+    );
+
+    return AuthorizeProtocol.getAuthorizeUrl(authority, parameters);
+}

package/src/response/ResponseHandler.ts

@@ -6,7 +6,7 @@
 import {
     ICrypto,
     Logger,
-    ServerAuthorizationCodeResponse,
+    AuthorizeResponse,
     UrlUtils,
 } from "@azure/msal-common/browser";
 import {
@@ -20,7 +20,7 @@ export function deserializeResponse(
     responseString: string,
     responseLocation: string,
     logger: Logger
-): ServerAuthorizationCodeResponse {
+): AuthorizeResponse {
     // Deserialize hash fragment response parameters.
     const serverParams = UrlUtils.getDeserializedResponse(responseString);
     if (!serverParams) {
@@ -49,7 +49,7 @@ export function deserializeResponse(
  * Returns the interaction type that the response object belongs to
  */
 export function validateInteractionType(
-    response: ServerAuthorizationCodeResponse,
+    response: AuthorizeResponse,
     browserCrypto: ICrypto,
     interactionType: InteractionType
 ): void {