@azure/msal-browser 5.14.0 → 5.15.0

package/src/interaction_client/RedirectClient.ts

@@ -176,7 +176,7 @@ export class RedirectClient extends StandardInteractionClient {
             }
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(this.correlationId);
+                e.correlationId = this.correlationId;
             }
             window.removeEventListener("pageshow", handleBackButton);
             throw e;
@@ -260,7 +260,7 @@ export class RedirectClient extends StandardInteractionClient {
             }
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(this.correlationId);
+                e.correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -341,6 +341,7 @@ export class RedirectClient extends StandardInteractionClient {
                 reject(
                     createBrowserAuthError(
                         BrowserAuthErrorCodes.timedOut,
+                        "",
                         "failed_to_redirect"
                     )
                 );
@@ -388,6 +389,7 @@ export class RedirectClient extends StandardInteractionClient {
                 reject(
                     createBrowserAuthError(
                         BrowserAuthErrorCodes.timedOut,
+                        "",
                         "failed_to_redirect"
                     )
                 );
@@ -530,7 +532,9 @@ export class RedirectClient extends StandardInteractionClient {
                 let processHashOnRedirect: boolean = true;
                 if (!loginRequestUrl) {
                     // Redirect to home page if login request url is empty
-                    const homepage = BrowserUtils.getHomepage();
+                    const homepage = BrowserUtils.getHomepage(
+                        this.correlationId
+                    );
                     // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                     this.browserStorage.setTemporaryCache(
                         TemporaryCacheKeys.ORIGIN_URI,
@@ -573,7 +577,7 @@ export class RedirectClient extends StandardInteractionClient {
             return null;
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -613,7 +617,8 @@ export class RedirectClient extends StandardInteractionClient {
                 ResponseHandler.validateInteractionType(
                     response,
                     this.browserCrypto,
-                    InteractionType.Redirect
+                    InteractionType.Redirect,
+                    this.correlationId
                 );
             } catch (e) {
                 if (e instanceof AuthError) {
@@ -669,7 +674,10 @@ export class RedirectClient extends StandardInteractionClient {
     ): Promise<AuthenticationResult> {
         const state = serverParams.state;
         if (!state) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.noStateInHash,
+                request.correlationId
+            );
         }
 
         const { authority, azureCloudOptions, extraQueryParameters, account } =
@@ -812,7 +820,8 @@ export class RedirectClient extends StandardInteractionClient {
                 this.correlationId
             );
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.emptyNavigateUri
+                BrowserAuthErrorCodes.emptyNavigateUri,
+                this.correlationId
             );
         }
     }
@@ -894,7 +903,8 @@ export class RedirectClient extends StandardInteractionClient {
                 validLogoutRequest.state || "",
                 {
                     interactionType: InteractionType.Redirect,
-                }
+                },
+                validLogoutRequest.correlationId
             );
 
             // Create logout string and navigate user window to logout.
@@ -955,7 +965,7 @@ export class RedirectClient extends StandardInteractionClient {
             }
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             this.eventHandler.emitEvent(
@@ -988,7 +998,8 @@ export class RedirectClient extends StandardInteractionClient {
         const redirectStartPage = requestStartPage || window.location.href;
         const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(
             redirectStartPage,
-            BrowserUtils.getCurrentUri()
+            BrowserUtils.getCurrentUri(),
+            this.correlationId
         );
         // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
         UrlUtils.validateUrl(

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -73,7 +73,8 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
         // Auth code payload is required
         if (!request.code) {
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.authCodeRequired
+                BrowserAuthErrorCodes.authCodeRequired,
+                this.correlationId
             );
         }
 
@@ -168,7 +169,7 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             );
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -182,7 +183,8 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
         // Synchronous so we must reject
         return Promise.reject(
             createBrowserAuthError(
-                BrowserAuthErrorCodes.silentLogoutUnsupported
+                BrowserAuthErrorCodes.silentLogoutUnsupported,
+                ""
             )
         );
     }

package/src/interaction_client/SilentIframeClient.ts

@@ -230,7 +230,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             )(authClient, request);
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
 
@@ -497,7 +497,8 @@ export class SilentIframeClient extends StandardInteractionClient {
         // Validate the response - this checks for errors and validates state
         AuthorizeProtocol.validateAuthorizationResponse(
             serverParams,
-            silentRequest.state
+            silentRequest.state,
+            correlationId
         );
 
         // Verify a valid authorization code is present
@@ -523,7 +524,8 @@ export class SilentIframeClient extends StandardInteractionClient {
         // Synchronous so we must reject
         return Promise.reject(
             createBrowserAuthError(
-                BrowserAuthErrorCodes.silentLogoutUnsupported
+                BrowserAuthErrorCodes.silentLogoutUnsupported,
+                ""
             )
         );
     }

package/src/interaction_client/SilentRefreshClient.ts

@@ -90,7 +90,7 @@ export class SilentRefreshClient extends StandardInteractionClient {
             request.correlationId
         )(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(
             (e: AuthError) => {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
                 throw e;
             }
@@ -104,7 +104,8 @@ export class SilentRefreshClient extends StandardInteractionClient {
         // Synchronous so we must reject
         return Promise.reject(
             createBrowserAuthError(
-                BrowserAuthErrorCodes.silentLogoutUnsupported
+                BrowserAuthErrorCodes.silentLogoutUnsupported,
+                ""
             )
         );
     }

package/src/interaction_client/StandardInteractionClient.ts

@@ -120,7 +120,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 validLogoutRequest.postLogoutRedirectUri =
                     UrlString.getAbsoluteUrl(
                         logoutRequest.postLogoutRedirectUri,
-                        BrowserUtils.getCurrentUri()
+                        BrowserUtils.getCurrentUri(),
+                        validLogoutRequest.correlationId
                     );
             } else if (this.config.auth.postLogoutRedirectUri === null) {
                 this.logger.verbose(
@@ -135,7 +136,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 validLogoutRequest.postLogoutRedirectUri =
                     UrlString.getAbsoluteUrl(
                         this.config.auth.postLogoutRedirectUri,
-                        BrowserUtils.getCurrentUri()
+                        BrowserUtils.getCurrentUri(),
+                        validLogoutRequest.correlationId
                     );
             } else {
                 this.logger.verbose(
@@ -145,7 +147,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 validLogoutRequest.postLogoutRedirectUri =
                     UrlString.getAbsoluteUrl(
                         BrowserUtils.getCurrentUri(),
-                        BrowserUtils.getCurrentUri()
+                        BrowserUtils.getCurrentUri(),
+                        validLogoutRequest.correlationId
                     );
             }
         } else {
@@ -349,7 +352,8 @@ export async function initializeAuthorizationRequest(
     const state = ProtocolUtils.setRequestState(
         browserCrypto,
         (request && request.state) || "",
-        browserState
+        browserState,
+        correlationId
     );
 
     const baseRequest: BaseAuthRequest = await invokeAsync(

package/src/interaction_handler/InteractionHandler.ts

@@ -64,7 +64,8 @@ export class InteractionHandler {
         try {
             authCodeResponse = AuthorizeProtocol.getAuthorizationCodePayload(
                 response,
-                request.state
+                request.state,
+                request.correlationId
             );
         } catch (e) {
             if (
@@ -73,7 +74,8 @@ export class InteractionHandler {
             ) {
                 // Translate server error caused by user closing native prompt to corresponding first class MSAL error
                 throw createBrowserAuthError(
-                    BrowserAuthErrorCodes.userCancelled
+                    BrowserAuthErrorCodes.userCancelled,
+                    request.correlationId
                 );
             } else {
                 throw e;

package/src/interaction_handler/SilentHandler.ts

@@ -30,7 +30,10 @@ export async function initiateCodeRequest(
     if (!requestUrl) {
         // Throw error if request URL is empty.
         logger.info("Navigate url is empty", correlationId);
-        throw createBrowserAuthError(BrowserAuthErrorCodes.emptyNavigateUri);
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.emptyNavigateUri,
+            correlationId
+        );
     }
 
     frame.src = requestUrl;

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -75,7 +75,7 @@ export class NestedAppAuthAdapter {
 
         const correlationId =
             request.correlationId || this.crypto.createNewGuid();
-        const claims = RequestParameterBuilder.addClientCapabilitiesToClaims(
+        const claims = RequestParameterBuilder.buildMergedClaims(
             request.claims,
             this.clientCapabilities
         );
@@ -104,7 +104,10 @@ export class NestedAppAuthAdapter {
         reqTimestamp: number
     ): AuthenticationResult {
         if (!response.token.id_token || !response.token.access_token) {
-            throw createClientAuthError(ClientAuthErrorCodes.nullOrEmptyToken);
+            throw createClientAuthError(
+                ClientAuthErrorCodes.nullOrEmptyToken,
+                request.correlationId
+            );
         }
 
         // Request timestamp and AuthResult expires_in are in seconds, converting to Date for AuthenticationResult
@@ -113,7 +116,8 @@ export class NestedAppAuthAdapter {
         );
         const idTokenClaims = AuthToken.extractTokenClaims(
             response.token.id_token,
-            this.crypto.base64Decode
+            this.crypto.base64Decode,
+            request.correlationId
         );
         const account = this.fromNaaAccountInfo(
             response.account,
@@ -196,7 +200,8 @@ export class NestedAppAuthAdapter {
         const environment = fromAccount.environment;
         if (!environment) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.invalidCacheEnvironment
+                ClientAuthErrorCodes.invalidCacheEnvironment,
+                ""
             );
         }
 
@@ -225,6 +230,7 @@ export class NestedAppAuthAdapter {
             homeAccountId,
             localAccountId,
             tenantId,
+            fromAccount.platformBrokerId,
             effectiveIdTokenClaims
         );
         tenantProfiles.set(tenantId, tenantProfile);
@@ -239,6 +245,7 @@ export class NestedAppAuthAdapter {
             loginHint,
             idToken: idToken,
             idTokenClaims: effectiveIdTokenClaims,
+            nativeAccountId: fromAccount.platformBrokerId,
             tenantProfiles,
         };
 
@@ -262,39 +269,57 @@ export class NestedAppAuthAdapter {
             switch (error.status) {
                 case BridgeStatusCode.UserCancel:
                     return new ClientAuthError(
-                        ClientAuthErrorCodes.userCanceled
+                        ClientAuthErrorCodes.userCanceled,
+                        ""
                     );
                 case BridgeStatusCode.NoNetwork:
                     return new ClientAuthError(
-                        ClientAuthErrorCodes.noNetworkConnectivity
+                        ClientAuthErrorCodes.noNetworkConnectivity,
+                        ""
                     );
                 case BridgeStatusCode.AccountUnavailable:
                     return new ClientAuthError(
-                        ClientAuthErrorCodes.noAccountFound
+                        ClientAuthErrorCodes.noAccountFound,
+                        ""
                     );
                 case BridgeStatusCode.Disabled:
                     return new ClientAuthError(
-                        ClientAuthErrorCodes.nestedAppAuthBridgeDisabled
+                        ClientAuthErrorCodes.nestedAppAuthBridgeDisabled,
+                        ""
                     );
                 case BridgeStatusCode.NestedAppAuthUnavailable:
                     return new ClientAuthError(
                         error.code ||
                             ClientAuthErrorCodes.nestedAppAuthBridgeDisabled,
+                        "",
                         error.description
                     );
                 case BridgeStatusCode.TransientError:
                 case BridgeStatusCode.PersistentError:
-                    return new ServerError(error.code, error.description);
+                    return new ServerError(
+                        error.code || "",
+                        "",
+                        error.description
+                    );
                 case BridgeStatusCode.UserInteractionRequired:
                     return new InteractionRequiredAuthError(
-                        error.code,
+                        error.code || "",
+                        "",
                         error.description
                     );
                 default:
-                    return new AuthError(error.code, error.description);
+                    return new AuthError(
+                        error.code || "",
+                        "",
+                        error.description
+                    );
             }
         } else {
-            return new AuthError("unknown_error", "An unknown error occurred");
+            return new AuthError(
+                "unknown_error",
+                "",
+                "An unknown error occurred"
+            );
         }
     }
 
@@ -315,12 +340,16 @@ export class NestedAppAuthAdapter {
         correlationId: string
     ): AuthenticationResult {
         if (!idToken || !accessToken) {
-            throw createClientAuthError(ClientAuthErrorCodes.nullOrEmptyToken);
+            throw createClientAuthError(
+                ClientAuthErrorCodes.nullOrEmptyToken,
+                correlationId
+            );
         }
 
         const idTokenClaims = AuthToken.extractTokenClaims(
             idToken.secret,
-            this.crypto.base64Decode
+            this.crypto.base64Decode,
+            correlationId
         );
 
         const scopes = accessToken.target || request.scopes.join(" ");

package/src/navigation/NavigationClient.ts

@@ -55,6 +55,7 @@ export class NavigationClient implements INavigationClient {
                 reject(
                     createBrowserAuthError(
                         BrowserAuthErrorCodes.timedOut,
+                        "",
                         "failed_to_redirect"
                     )
                 );

package/src/network/FetchClient.ts

@@ -43,7 +43,8 @@ export class FetchClient implements INetworkModule {
                 createBrowserAuthError(
                     window.navigator.onLine
                         ? BrowserAuthErrorCodes.getRequestFailed
-                        : BrowserAuthErrorCodes.noNetworkConnectivity
+                        : BrowserAuthErrorCodes.noNetworkConnectivity,
+                    ""
                 ),
                 undefined,
                 undefined,
@@ -62,7 +63,8 @@ export class FetchClient implements INetworkModule {
         } catch (e) {
             throw createNetworkError(
                 createBrowserAuthError(
-                    BrowserAuthErrorCodes.failedToParseResponse
+                    BrowserAuthErrorCodes.failedToParseResponse,
+                    ""
                 ),
                 responseStatus,
                 responseHeaders,
@@ -98,7 +100,8 @@ export class FetchClient implements INetworkModule {
                 createBrowserAuthError(
                     window.navigator.onLine
                         ? BrowserAuthErrorCodes.postRequestFailed
-                        : BrowserAuthErrorCodes.noNetworkConnectivity
+                        : BrowserAuthErrorCodes.noNetworkConnectivity,
+                    ""
                 ),
                 undefined,
                 undefined,
@@ -117,7 +120,8 @@ export class FetchClient implements INetworkModule {
         } catch (e) {
             throw createNetworkError(
                 createBrowserAuthError(
-                    BrowserAuthErrorCodes.failedToParseResponse
+                    BrowserAuthErrorCodes.failedToParseResponse,
+                    ""
                 ),
                 responseStatus,
                 responseHeaders,
@@ -144,7 +148,10 @@ function getFetchHeaders(options?: NetworkRequestOptions): Headers {
         return headers;
     } catch (e) {
         throw createNetworkError(
-            createBrowserAuthError(BrowserAuthErrorCodes.failedToBuildHeaders),
+            createBrowserAuthError(
+                BrowserAuthErrorCodes.failedToBuildHeaders,
+                ""
+            ),
             undefined,
             undefined,
             e as Error
@@ -166,7 +173,8 @@ function getHeaderDict(headers: Headers): Record<string, string> {
         return headerDict;
     } catch (e) {
         throw createBrowserAuthError(
-            BrowserAuthErrorCodes.failedToParseHeaders
+            BrowserAuthErrorCodes.failedToParseHeaders,
+            ""
         );
     }
 }

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "5.14.0";
+export const version = "5.15.0";

package/src/protocol/Authorize.ts

@@ -239,7 +239,8 @@ export async function getAuthCodeRequestUrl(
 ): Promise<string> {
     if (!request.codeChallenge) {
         throw createClientConfigurationError(
-            ClientConfigurationErrorCodes.pkceParamsMissing
+            ClientConfigurationErrorCodes.pkceParamsMissing,
+            request.correlationId
         );
     }
 
@@ -282,7 +283,10 @@ export async function getEARForm(
     performanceClient: IPerformanceClient
 ): Promise<HTMLFormElement> {
     if (!request.earJwk) {
-        throw createBrowserAuthError(BrowserAuthErrorCodes.earJwkEmpty);
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.earJwkEmpty,
+            request.correlationId
+        );
     }
 
     const parameters = await getStandardParameters(
@@ -442,7 +446,8 @@ export async function handleResponsePlatformBroker(
 
     if (!platformAuthProvider) {
         throw createBrowserAuthError(
-            BrowserAuthErrorCodes.nativeConnectionNotEstablished
+            BrowserAuthErrorCodes.nativeConnectionNotEstablished,
+            request.correlationId
         );
     }
     const browserCrypto = new CryptoOps(logger, performanceClient);
@@ -462,7 +467,8 @@ export async function handleResponsePlatformBroker(
     );
     const { userRequestState } = ProtocolUtils.parseRequestState(
         browserCrypto.base64Decode,
-        request.state
+        request.state,
+        request.correlationId
     );
     return invokeAsync(
         nativeInteractionClient.acquireToken.bind(nativeInteractionClient),
@@ -596,14 +602,24 @@ export async function handleResponseEAR(
     instrumentClientData(response, request.correlationId, performanceClient);
 
     // Validate state & check response for errors
-    AuthorizeProtocol.validateAuthorizationResponse(response, request.state);
+    AuthorizeProtocol.validateAuthorizationResponse(
+        response,
+        request.state,
+        request.correlationId
+    );
 
     if (!response.ear_jwe) {
-        throw createBrowserAuthError(BrowserAuthErrorCodes.earJweEmpty);
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.earJweEmpty,
+            request.correlationId
+        );
     }
 
     if (!request.earJwk) {
-        throw createBrowserAuthError(BrowserAuthErrorCodes.earJwkEmpty);
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.earJwkEmpty,
+            request.correlationId
+        );
     }
 
     const decryptedData = JSON.parse(

package/src/request/RequestHelpers.ts

@@ -62,12 +62,14 @@ export async function initializeBaseRequest(
         ) {
             if (!request.sshJwk) {
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.missingSshJwk
+                    ClientConfigurationErrorCodes.missingSshJwk,
+                    ""
                 );
             }
             if (!request.sshKid) {
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.missingSshKid
+                    ClientConfigurationErrorCodes.missingSshKid,
+                    ""
                 );
             }
         }
@@ -120,7 +122,8 @@ export function validateRequestMethod(
         // Validate that method can only be POST when protocol mode is EAR
         if (requestMethod && requestMethod !== Constants.HttpMethod.POST) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.invalidRequestMethodForEAR
+                ClientConfigurationErrorCodes.invalidRequestMethodForEAR,
+                ""
             );
         } else {
             httpMethod = Constants.HttpMethod.POST;

package/src/response/ResponseHandler.ts

@@ -31,7 +31,10 @@ export function deserializeResponse(
                 `The request has returned to the redirectUri but a '${responseLocation}' is not present. It's likely that the '${responseLocation}' has been removed or the page has been redirected by code running on the redirectUri page.`,
                 correlationId
             );
-            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.hashEmptyError,
+                correlationId
+            );
         } else {
             logger.error(
                 `A '${responseLocation}' is present in the iframe but it does not contain known properties. It's likely that the '${responseLocation}' has been replaced by code running on the redirectUri page.`,
@@ -42,7 +45,8 @@ export function deserializeResponse(
                 correlationId
             );
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
+                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties,
+                correlationId
             );
         }
     }
@@ -55,23 +59,32 @@ export function deserializeResponse(
 export function validateInteractionType(
     response: AuthorizeResponse,
     browserCrypto: ICrypto,
-    interactionType: InteractionType
+    interactionType: InteractionType,
+    correlationId: string
 ): void {
     if (!response.state) {
-        throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.noStateInHash,
+            correlationId
+        );
     }
 
     const platformStateObj = extractBrowserRequestState(
         browserCrypto,
-        response.state
+        response.state,
+        correlationId
     );
     if (!platformStateObj) {
-        throw createBrowserAuthError(BrowserAuthErrorCodes.unableToParseState);
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.unableToParseState,
+            correlationId
+        );
     }
 
     if (platformStateObj.interactionType !== interactionType) {
         throw createBrowserAuthError(
-            BrowserAuthErrorCodes.stateInteractionTypeMismatch
+            BrowserAuthErrorCodes.stateInteractionTypeMismatch,
+            correlationId
         );
     }
 }

package/src/utils/BrowserProtocolUtils.ts

@@ -23,7 +23,8 @@ export type BrowserStateObject = {
  */
 export function extractBrowserRequestState(
     browserCrypto: ICrypto,
-    state: string
+    state: string,
+    correlationId: string
 ): BrowserStateObject | null {
     if (!state) {
         return null;
@@ -31,9 +32,16 @@ export function extractBrowserRequestState(
 
     try {
         const requestStateObj: RequestStateObject =
-            ProtocolUtils.parseRequestState(browserCrypto.base64Decode, state);
+            ProtocolUtils.parseRequestState(
+                browserCrypto.base64Decode,
+                state,
+                correlationId
+            );
         return requestStateObj.libraryState.meta as BrowserStateObject;
     } catch (e) {
-        throw createClientAuthError(ClientAuthErrorCodes.invalidState);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.invalidState,
+            correlationId
+        );
     }
 }