@azure/msal-browser 5.0.2 → 5.2.0

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -27,6 +27,7 @@ import {
     AccessTokenEntity,
     TenantProfile,
     buildTenantProfile,
+    getTenantIdFromIdTokenClaims,
     TimeUtils,
     Constants,
 } from "@azure/msal-common/browser";
@@ -178,18 +179,41 @@ export class NestedAppAuthAdapter {
             effectiveIdTokenClaims?.sub ||
             "";
 
+        /*
+         * In B2C scenarios tid may not be present, use getTenantIdFromIdTokenClaims
+         * which handles tid, tfp (modern B2C), and acr (legacy B2C) claims
+         */
         const tenantId =
-            fromAccount.tenantId || effectiveIdTokenClaims?.tid || "";
+            fromAccount.tenantId ||
+            getTenantIdFromIdTokenClaims(effectiveIdTokenClaims) ||
+            "";
 
         const homeAccountId =
             fromAccount.homeAccountId || `${localAccountId}.${tenantId}`;
 
-        const username =
-            fromAccount.username ||
+        // Validate environment - required field
+        const environment = fromAccount.environment;
+        if (!environment) {
+            throw createClientAuthError(
+                ClientAuthErrorCodes.invalidCacheEnvironment
+            );
+        }
+
+        /*
+         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+         * In most cases it will contain a single email. This field should not be relied upon if a custom
+         * policy is configured to return more than 1 email.
+         */
+        const preferredUsername =
             effectiveIdTokenClaims?.preferred_username ||
-            "";
+            effectiveIdTokenClaims?.upn;
+
+        const email = effectiveIdTokenClaims?.emails?.[0] || null;
+
+        const username =
+            fromAccount.username || preferredUsername || email || "";
 
-        const name = fromAccount.name || effectiveIdTokenClaims?.name;
+        const name = fromAccount.name || effectiveIdTokenClaims?.name || "";
 
         const loginHint =
             fromAccount.loginHint || effectiveIdTokenClaims?.login_hint;
@@ -206,7 +230,7 @@ export class NestedAppAuthAdapter {
 
         const account: MsalAccountInfo = {
             homeAccountId,
-            environment: fromAccount.environment,
+            environment,
             tenantId,
             username,
             localAccountId,

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "5.0.2";
+export const version = "5.2.0";

package/src/protocol/Authorize.ts

@@ -214,6 +214,13 @@ export async function getEARForm(
         queryParams,
         request.extraQueryParameters || {}
     );
+
+    // Add correlationId to query params so gateway can propagate it to IDPs
+    RequestParameterBuilder.addCorrelationId(
+        queryParams,
+        request.correlationId
+    );
+
     const url = AuthorizeProtocol.getAuthorizeUrl(authority, queryParams);
 
     return createForm(frame, url, parameters);
@@ -261,6 +268,12 @@ export async function getCodeForm(
         request.extraQueryParameters || {}
     );
 
+    // Add correlationId to query params so gateway can propagate it to IDPs
+    RequestParameterBuilder.addCorrelationId(
+        queryParams,
+        request.correlationId
+    );
+
     const url = AuthorizeProtocol.getAuthorizeUrl(authority, queryParams);
 
     return createForm(frame, url, parameters);
@@ -434,7 +447,7 @@ export async function handleResponseCode(
         logger,
         performanceClient,
         request.correlationId
-    )(response, request);
+    )(response, request, apiId);
 
     return result;
 }
@@ -552,6 +565,7 @@ export async function handleResponseEAR(
         authority,
         TimeUtils.nowSeconds(),
         request,
+        apiId,
         additionalData,
         undefined,
         undefined,

package/src/utils/BrowserConstants.ts

@@ -111,6 +111,7 @@ export type InMemoryCacheKeys =
  * Before adding a new code you must claim it in the MSAL Telemetry tracker as these number spaces are shared across all MSALs
  * 0-99 Silent Flow
  * 800-899 Auth Code Flow
+ * 900-999 Misc
  */
 export const ApiId = {
     acquireTokenRedirect: 861,
@@ -122,9 +123,35 @@ export const ApiId = {
     acquireTokenSilent_silentFlow: 61,
     logout: 961,
     logoutPopup: 962,
+    hydrateCache: 963,
+    loadExternalTokens: 964,
 } as const;
 export type ApiId = (typeof ApiId)[keyof typeof ApiId];
 
+/**
+ * API Names for Telemetry purposes.
+ */
+export const ApiName = {
+    861: "acquireTokenRedirect",
+    862: "acquireTokenPopup",
+    863: "ssoSilent",
+    864: "acquireTokenSilent_authCode",
+    865: "handleRedirectPromise",
+    866: "acquireTokenByCode",
+    61: "acquireTokenSilent_silentFlow",
+    961: "logout",
+    962: "logoutPopup",
+    963: "hydrateCache",
+    964: "loadExternalTokens",
+} as const satisfies Record<ApiId, string>;
+
+export const apiIdToName = (id: number | undefined): string => {
+    if (typeof id === "number" && id in ApiName) {
+        return ApiName[id as ApiId];
+    }
+    return "unknown";
+};
+
 /*
  * Interaction type of the API - used for state and telemetry
  */