@azure/msal-browser 5.0.0-alpha.0 → 5.0.1

package/src/cache/CacheKeys.ts

@@ -5,9 +5,9 @@
 
 export const PREFIX = "msal";
 const BROWSER_PREFIX = "browser";
-export const CACHE_KEY_SEPARATOR = "-";
-export const CREDENTIAL_SCHEMA_VERSION = 1;
-export const ACCOUNT_SCHEMA_VERSION = 1;
+export const CACHE_KEY_SEPARATOR = "|";
+export const CREDENTIAL_SCHEMA_VERSION = 2;
+export const ACCOUNT_SCHEMA_VERSION = 2;
 
 export const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
 export const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;

package/src/cache/IWindowStorage.ts

@@ -35,7 +35,8 @@ export interface IWindowStorage<T> {
         key: string,
         value: T,
         correlationId: string,
-        timestamp: string
+        timestamp: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**

package/src/cache/LocalStorage.ts

@@ -208,7 +208,10 @@ export class LocalStorage implements IWindowStorage<string> {
         }
 
         try {
-            return JSON.parse(decryptedData);
+            return {
+                ...JSON.parse(decryptedData),
+                lastUpdatedAt: data.lastUpdatedAt,
+            };
         } catch (e) {
             this.performanceClient.incrementFields(
                 { encryptedCacheCorruptionCount: 1 },
@@ -226,7 +229,8 @@ export class LocalStorage implements IWindowStorage<string> {
         key: string,
         value: string,
         correlationId: string,
-        timestamp: string
+        timestamp: string,
+        kmsi: boolean
     ): Promise<void> {
         if (!this.initialized || !this.encryptionCookie) {
             throw createBrowserAuthError(
@@ -234,22 +238,26 @@ export class LocalStorage implements IWindowStorage<string> {
             );
         }
 
-        const { data, nonce } = await invokeAsync(
-            encrypt,
-            BrowserPerformanceEvents.Encrypt,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(this.encryptionCookie.key, value, this.getContext(key));
-        const encryptedData: EncryptedData = {
-            id: this.encryptionCookie.id,
-            nonce: nonce,
-            data: data,
-            lastUpdatedAt: timestamp,
-        };
+        if (kmsi) {
+            this.setItem(key, value);
+        } else {
+            const { data, nonce } = await invokeAsync(
+                encrypt,
+                BrowserPerformanceEvents.Encrypt,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(this.encryptionCookie.key, value, this.getContext(key));
+            const encryptedData: EncryptedData = {
+                id: this.encryptionCookie.id,
+                nonce: nonce,
+                data: data,
+                lastUpdatedAt: timestamp,
+            };
+            this.setItem(key, JSON.stringify(encryptedData));
+        }
 
         this.memoryStorage.setItem(key, value);
-        this.setItem(key, JSON.stringify(encryptedData));
 
         // Notify other frames to update their in-memory cache
         this.broadcast.postMessage({
@@ -385,7 +393,7 @@ export class LocalStorage implements IWindowStorage<string> {
                 { unencryptedCacheCount: 1 },
                 correlationId
             );
-            return encObj;
+            return rawCache;
         }
 
         if (encObj.id !== this.encryptionCookie.id) {
@@ -397,6 +405,11 @@ export class LocalStorage implements IWindowStorage<string> {
             return null;
         }
 
+        this.performanceClient.incrementFields(
+            { encryptedCacheCount: 1 },
+            correlationId
+        );
+
         return invokeAsync(
             decrypt,
             BrowserPerformanceEvents.Decrypt,

package/src/cache/TokenCache.ts

@@ -22,6 +22,9 @@ import {
     TimeUtils,
     AccountEntityUtils,
     buildStaticAuthorityOptions,
+    invokeAsync,
+    IPerformanceClient,
+    StubPerformanceClient,
 } from "@azure/msal-common/browser";
 import { buildConfiguration, Configuration } from "../config/Configuration.js";
 import type { SilentRequest } from "../request/SilentRequest.js";
@@ -36,6 +39,8 @@ import * as BrowserCrypto from "../crypto/BrowserCrypto.js";
 import { CryptoOps } from "../crypto/CryptoOps.js";
 import { EventHandler } from "../event/EventHandler.js";
 import * as BrowserUtils from "../utils/BrowserUtils.js";
+import * as BrowserRootPerformanceEvents from "../telemetry/BrowserRootPerformanceEvents.js";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 
 export type LoadTokenOptions = {
     clientInfo?: string;
@@ -45,16 +50,19 @@ export type LoadTokenOptions = {
 
 /**
  * API to load tokens to msal-browser cache.
- * @param request
- * @param response
- * @param options
+ * @param config - Object to configure the MSAL app.
+ * @param request - Silent request containing authority, scopes, and account.
+ * @param response - External token response to load into the cache.
+ * @param options - Options controlling how tokens are loaded into the cache.
+ * @param performanceClient - Optional performance client used for telemetry measurements.
  * @returns `AuthenticationResult` for the response that was loaded.
  */
 export async function loadExternalTokens(
     config: Configuration,
     request: SilentRequest,
     response: ExternalTokenResponse,
-    options: LoadTokenOptions
+    options: LoadTokenOptions,
+    performanceClient: IPerformanceClient = new StubPerformanceClient()
 ): Promise<AuthenticationResult> {
     BrowserUtils.blockNonBrowserEnvironment();
 
@@ -63,100 +71,144 @@ export async function loadExternalTokens(
     const correlationId =
         request.correlationId || BrowserCrypto.createNewGuid();
 
-    const idTokenClaims = response.id_token
-        ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
-        : undefined;
+    const rootMeasurement = performanceClient.startMeasurement(
+        BrowserRootPerformanceEvents.LoadExternalTokens,
+        correlationId
+    );
 
-    const authorityOptions: AuthorityOptions = {
-        protocolMode: browserConfig.system.protocolMode,
-        knownAuthorities: browserConfig.auth.knownAuthorities,
-        cloudDiscoveryMetadata: browserConfig.auth.cloudDiscoveryMetadata,
-        authorityMetadata: browserConfig.auth.authorityMetadata,
-    };
+    try {
+        const idTokenClaims = response.id_token
+            ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
+            : undefined;
+        const kmsi = AuthToken.isKmsi(idTokenClaims || {});
+
+        const authorityOptions: AuthorityOptions = {
+            protocolMode: browserConfig.system.protocolMode,
+            knownAuthorities: browserConfig.auth.knownAuthorities,
+            cloudDiscoveryMetadata: browserConfig.auth.cloudDiscoveryMetadata,
+            authorityMetadata: browserConfig.auth.authorityMetadata,
+        };
+
+        const logger = new Logger(browserConfig.system.loggerOptions || {});
+        const cryptoOps = new CryptoOps(logger, browserConfig.telemetry.client);
+        const storage = new BrowserCacheManager(
+            browserConfig.auth.clientId,
+            browserConfig.cache,
+            cryptoOps,
+            logger,
+            browserConfig.telemetry.client,
+            new EventHandler(logger),
+            buildStaticAuthorityOptions(browserConfig.auth)
+        );
 
-    const logger = new Logger(browserConfig.system.loggerOptions || {});
-    const cryptoOps = new CryptoOps(logger, browserConfig.telemetry.client);
-    const storage = new BrowserCacheManager(
-        browserConfig.auth.clientId,
-        browserConfig.cache,
-        cryptoOps,
-        logger,
-        browserConfig.telemetry.client,
-        new EventHandler(logger),
-        buildStaticAuthorityOptions(browserConfig.auth)
-    );
+        const authority = request.authority
+            ? new Authority(
+                  Authority.generateAuthority(
+                      request.authority,
+                      request.azureCloudOptions
+                  ),
+                  browserConfig.system.networkClient,
+                  storage,
+                  authorityOptions,
+                  logger,
+                  request.correlationId || BrowserCrypto.createNewGuid(),
+                  browserConfig.telemetry.client
+              )
+            : undefined;
+
+        const cacheRecordAccount: AccountEntity = await invokeAsync(
+            loadAccount,
+            BrowserPerformanceEvents.LoadAccount,
+            logger,
+            performanceClient,
+            correlationId
+        )(
+            request,
+            options.clientInfo || response.client_info || "",
+            correlationId,
+            storage,
+            logger,
+            cryptoOps,
+            idTokenClaims,
+            authority
+        );
 
-    const authority = request.authority
-        ? new Authority(
-              Authority.generateAuthority(
-                  request.authority,
-                  request.azureCloudOptions
-              ),
-              browserConfig.system.networkClient,
-              storage,
-              authorityOptions,
-              logger,
-              request.correlationId || BrowserCrypto.createNewGuid(),
-              browserConfig.telemetry.client
-          )
-        : undefined;
-
-    const cacheRecordAccount: AccountEntity = await loadAccount(
-        request,
-        options.clientInfo || response.client_info || "",
-        correlationId,
-        storage,
-        logger,
-        cryptoOps,
-        idTokenClaims,
-        authority
-    );
+        const idToken = await invokeAsync(
+            loadIdToken,
+            BrowserPerformanceEvents.LoadIdToken,
+            logger,
+            performanceClient,
+            correlationId
+        )(
+            response,
+            cacheRecordAccount.homeAccountId,
+            cacheRecordAccount.environment,
+            cacheRecordAccount.realm,
+            kmsi,
+            correlationId,
+            storage,
+            logger,
+            config.auth.clientId
+        );
 
-    const idToken = await loadIdToken(
-        response,
-        cacheRecordAccount.homeAccountId,
-        cacheRecordAccount.environment,
-        cacheRecordAccount.realm,
-        correlationId,
-        storage,
-        logger,
-        config.auth.clientId
-    );
+        const accessToken = await invokeAsync(
+            loadAccessToken,
+            BrowserPerformanceEvents.LoadAccessToken,
+            logger,
+            performanceClient,
+            correlationId
+        )(
+            request,
+            response,
+            cacheRecordAccount.homeAccountId,
+            cacheRecordAccount.environment,
+            cacheRecordAccount.realm,
+            kmsi,
+            options,
+            correlationId,
+            storage,
+            logger,
+            config.auth.clientId
+        );
 
-    const accessToken = await loadAccessToken(
-        request,
-        response,
-        cacheRecordAccount.homeAccountId,
-        cacheRecordAccount.environment,
-        cacheRecordAccount.realm,
-        options,
-        correlationId,
-        storage,
-        logger,
-        config.auth.clientId
-    );
+        const refreshToken = await invokeAsync(
+            loadRefreshToken,
+            BrowserPerformanceEvents.LoadRefreshToken,
+            logger,
+            performanceClient,
+            correlationId
+        )(
+            response,
+            cacheRecordAccount.homeAccountId,
+            cacheRecordAccount.environment,
+            kmsi,
+            correlationId,
+            storage,
+            logger,
+            config.auth.clientId
+        );
 
-    const refreshToken = await loadRefreshToken(
-        response,
-        cacheRecordAccount.homeAccountId,
-        cacheRecordAccount.environment,
-        correlationId,
-        storage,
-        logger,
-        config.auth.clientId
-    );
+        rootMeasurement.end(
+            { success: true },
+            undefined,
+            AccountEntityUtils.getAccountInfo(cacheRecordAccount)
+        );
 
-    return generateAuthenticationResult(
-        request,
-        {
-            account: cacheRecordAccount,
-            idToken,
-            accessToken,
-            refreshToken,
-        },
-        idTokenClaims,
-        authority
-    );
+        return generateAuthenticationResult(
+            request,
+            {
+                account: cacheRecordAccount,
+                idToken,
+                accessToken,
+                refreshToken,
+            },
+            idTokenClaims,
+            authority
+        );
+    } catch (error) {
+        rootMeasurement.end({ success: false }, error);
+        throw error;
+    }
 }
 
 /**
@@ -185,7 +237,11 @@ async function loadAccount(
             AccountEntityUtils.createAccountEntityFromAccountInfo(
                 request.account
             );
-        await storage.setAccount(accountEntity, correlationId);
+        await storage.setAccount(
+            accountEntity,
+            correlationId,
+            AuthToken.isKmsi(idTokenClaims || {})
+        );
         return accountEntity;
     } else if (!authority || (!clientInfo && !idTokenClaims)) {
         logger.error(
@@ -221,7 +277,11 @@ async function loadAccount(
         logger
     );
 
-    await storage.setAccount(cachedAccount, correlationId);
+    await storage.setAccount(
+        cachedAccount,
+        correlationId,
+        AuthToken.isKmsi(idTokenClaims || {})
+    );
     return cachedAccount;
 }
 
@@ -238,6 +298,7 @@ async function loadIdToken(
     homeAccountId: string,
     environment: string,
     tenantId: string,
+    kmsi: boolean,
     correlationId: string,
     storage: BrowserCacheManager,
     logger: Logger,
@@ -260,7 +321,7 @@ async function loadIdToken(
         tenantId
     );
 
-    await storage.setIdTokenCredential(idTokenEntity, correlationId);
+    await storage.setIdTokenCredential(idTokenEntity, correlationId, kmsi);
     return idTokenEntity;
 }
 
@@ -279,6 +340,7 @@ async function loadAccessToken(
     homeAccountId: string,
     environment: string,
     tenantId: string,
+    kmsi: boolean,
     options: LoadTokenOptions,
     correlationId: string,
     storage: BrowserCacheManager,
@@ -330,7 +392,11 @@ async function loadAccessToken(
         base64Decode
     );
 
-    await storage.setAccessTokenCredential(accessTokenEntity, correlationId);
+    await storage.setAccessTokenCredential(
+        accessTokenEntity,
+        correlationId,
+        kmsi
+    );
     return accessTokenEntity;
 }
 
@@ -346,6 +412,7 @@ async function loadRefreshToken(
     response: ExternalTokenResponse,
     homeAccountId: string,
     environment: string,
+    kmsi: boolean,
     correlationId: string,
     storage: BrowserCacheManager,
     logger: Logger,
@@ -370,7 +437,11 @@ async function loadRefreshToken(
         response.refresh_token_expires_in
     );
 
-    await storage.setRefreshTokenCredential(refreshTokenEntity, correlationId);
+    await storage.setRefreshTokenCredential(
+        refreshTokenEntity,
+        correlationId,
+        kmsi
+    );
     return refreshTokenEntity;
 }
 

package/src/config/Configuration.ts

@@ -22,14 +22,10 @@ import {
     Logger,
     Constants,
 } from "@azure/msal-common/browser";
-import {
-    BrowserCacheLocation,
-    BrowserConstants,
-} from "../utils/BrowserConstants.js";
+import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
 import { INavigationClient } from "../navigation/INavigationClient.js";
 import { NavigationClient } from "../navigation/NavigationClient.js";
 import { FetchClient } from "../network/FetchClient.js";
-import * as BrowserUtils from "../utils/BrowserUtils.js";
 
 // Default timeout for popup windows and iframes in milliseconds
 export const DEFAULT_POPUP_TIMEOUT_MS = 60000;
@@ -129,17 +125,13 @@ export type BrowserSystemOptions = SystemOptions & {
      */
     navigationClient?: INavigationClient;
     /**
-     * Sets the timeout for waiting for a response hash in a popup. Will take precedence over loadFrameTimeout if both are set.
-     */
-    windowHashTimeout?: number;
-    /**
-     * Sets the timeout for waiting for a response hash in an iframe. Will take precedence over loadFrameTimeout if both are set.
+     * Sets the timeout for waiting for response from a popup using BroadcastChannel
      */
-    iframeHashTimeout?: number;
+    popupBridgeTimeout?: number;
     /**
-     * Sets the timeout for waiting for a response hash in an iframe or popup
+     * Sets the timeout for waiting for response from an iframe using BroadcastChannel
      */
-    loadFrameTimeout?: number;
+    iframeBridgeTimeout?: number;
     /**
      * Time to wait for redirection to occur before resolving promise
      */
@@ -160,10 +152,6 @@ export type BrowserSystemOptions = SystemOptions & {
      * Sets the timeout for waiting for the native broker handshake to resolve
      */
     nativeBrokerHandshakeTimeout?: number;
-    /**
-     * Sets the interval length in milliseconds for polling the location attribute in popup windows (default is 30ms)
-     */
-    pollIntervalMilliseconds?: number;
     /**
      * Enum that represents the protocol that msal follows. Used for configuring proper endpoints.
      */
@@ -240,7 +228,9 @@ export function buildConfiguration(
         cloudDiscoveryMetadata: "",
         authorityMetadata: "",
         redirectUri:
-            typeof window !== "undefined" ? BrowserUtils.getCurrentUri() : "",
+            typeof window !== "undefined" && window.location
+                ? window.location.href.split("?")[0].split("#")[0]
+                : "",
         postLogoutRedirectUri: "",
         clientCapabilities: [],
         OIDCOptions: {
@@ -282,12 +272,10 @@ export function buildConfiguration(
             ? new FetchClient()
             : StubbedNetworkModule,
         navigationClient: new NavigationClient(),
-        loadFrameTimeout: 0,
-        // If loadFrameTimeout is provided, use that as default.
-        windowHashTimeout:
-            userInputSystem?.loadFrameTimeout || DEFAULT_POPUP_TIMEOUT_MS,
-        iframeHashTimeout:
-            userInputSystem?.loadFrameTimeout || DEFAULT_IFRAME_TIMEOUT_MS,
+        popupBridgeTimeout:
+            userInputSystem?.popupBridgeTimeout || DEFAULT_POPUP_TIMEOUT_MS,
+        iframeBridgeTimeout:
+            userInputSystem?.iframeBridgeTimeout || DEFAULT_IFRAME_TIMEOUT_MS,
         redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS,
         allowRedirectInIframe: false,
         navigatePopups: true,
@@ -295,7 +283,6 @@ export function buildConfiguration(
         nativeBrokerHandshakeTimeout:
             userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
-        pollIntervalMilliseconds: BrowserConstants.DEFAULT_POLL_INTERVAL_MS,
         protocolMode: ProtocolMode.AAD,
     };
 

package/src/controllers/IController.ts

@@ -3,123 +3,6 @@
  * Licensed under the MIT License.
  */
 
-import {
-    AccountInfo,
-    Logger,
-    PerformanceCallbackFunction,
-    IPerformanceClient,
-    AccountFilter,
-} from "@azure/msal-common/browser";
-import { RedirectRequest } from "../request/RedirectRequest.js";
-import { PopupRequest } from "../request/PopupRequest.js";
-import { SilentRequest } from "../request/SilentRequest.js";
-import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
-import { EndSessionRequest } from "../request/EndSessionRequest.js";
-import { ApiId, WrapperSKU } from "../utils/BrowserConstants.js";
-import { INavigationClient } from "../navigation/INavigationClient.js";
-import { EndSessionPopupRequest } from "../request/EndSessionPopupRequest.js";
-import { AuthorizationCodeRequest } from "../request/AuthorizationCodeRequest.js";
-import { BrowserConfiguration } from "../config/Configuration.js";
-import { AuthenticationResult } from "../response/AuthenticationResult.js";
-import { EventCallbackFunction } from "../event/EventMessage.js";
-import { ClearCacheRequest } from "../request/ClearCacheRequest.js";
-import { InitializeApplicationRequest } from "../request/InitializeApplicationRequest.js";
-import { EventType } from "../event/EventType.js";
+import { IPublicClientApplication } from "../app/IPublicClientApplication.js";
 
-export interface IController {
-    // TODO: Make request mandatory in the next major version?
-    initialize(
-        request?: InitializeApplicationRequest,
-        isBroker?: boolean
-    ): Promise<void>;
-
-    acquireTokenPopup(request: PopupRequest): Promise<AuthenticationResult>;
-
-    acquireTokenRedirect(request: RedirectRequest): Promise<void>;
-
-    acquireTokenSilent(
-        silentRequest: SilentRequest
-    ): Promise<AuthenticationResult>;
-
-    acquireTokenByCode(
-        request: AuthorizationCodeRequest
-    ): Promise<AuthenticationResult>;
-
-    acquireTokenNative(
-        request: PopupRequest | SilentRequest | SsoSilentRequest,
-        apiId: ApiId,
-        accountId?: string
-    ): Promise<AuthenticationResult>;
-
-    addEventCallback(
-        callback: EventCallbackFunction,
-        eventTypes?: Array<EventType>
-    ): string | null;
-
-    removeEventCallback(callbackId: string): void;
-
-    addPerformanceCallback(callback: PerformanceCallbackFunction): string;
-
-    removePerformanceCallback(callbackId: string): boolean;
-
-    getAccount(accountFilter: AccountFilter): AccountInfo | null;
-
-    getAccountByHomeId(homeAccountId: string): AccountInfo | null;
-
-    getAccountByLocalId(localId: string): AccountInfo | null;
-
-    getAccountByUsername(userName: string): AccountInfo | null;
-
-    getAllAccounts(accountFilter?: AccountFilter): AccountInfo[];
-
-    handleRedirectPromise(
-        options?: HandleRedirectPromiseOptions
-    ): Promise<AuthenticationResult | null>;
-
-    loginPopup(request?: PopupRequest): Promise<AuthenticationResult>;
-
-    loginRedirect(request?: RedirectRequest): Promise<void>;
-
-    logoutRedirect(logoutRequest?: EndSessionRequest): Promise<void>;
-
-    logoutPopup(logoutRequest?: EndSessionPopupRequest): Promise<void>;
-
-    clearCache(logoutRequest?: ClearCacheRequest): Promise<void>;
-
-    ssoSilent(request: SsoSilentRequest): Promise<AuthenticationResult>;
-
-    getLogger(): Logger;
-
-    setLogger(logger: Logger): void;
-
-    setActiveAccount(account: AccountInfo | null): void;
-
-    getActiveAccount(): AccountInfo | null;
-
-    initializeWrapperLibrary(sku: WrapperSKU, version: string): void;
-
-    setNavigationClient(navigationClient: INavigationClient): void;
-
-    /** @internal */
-    getConfiguration(): BrowserConfiguration;
-
-    hydrateCache(
-        result: AuthenticationResult,
-        request:
-            | SilentRequest
-            | SsoSilentRequest
-            | RedirectRequest
-            | PopupRequest
-    ): Promise<void>;
-
-    /** @internal */
-    isBrowserEnv(): boolean;
-
-    /** @internal */
-    getPerformanceClient(): IPerformanceClient;
-}
-
-export type HandleRedirectPromiseOptions = {
-    hash?: string;
-    navigateToLoginRequestUrl?: boolean;
-};
+export type IController = IPublicClientApplication;