@azure/msal-browser 5.6.2 → 5.7.0

package/dist/controllers/StandardController.mjs

@@ -1,10 +1,11 @@
-/*! @azure/msal-browser v5.6.2 2026-03-27 */
+/*! @azure/msal-browser v5.7.0 2026-04-16 */
 'use strict';
 import { CryptoOps } from '../crypto/CryptoOps.mjs';
 import { DEFAULT_CRYPTO_IMPLEMENTATION, buildStaticAuthorityOptions, invokeAsync, enforceResourceParameter, InteractionRequiredAuthError, createClientAuthError, ClientAuthErrorCodes, AccountEntityUtils, AuthToken, Constants, AuthError, getRequestThumbprint, InteractionRequiredAuthErrorCodes } from '@azure/msal-common/browser';
-import { InitializeCache, HandleNativeRedirectPromiseMeasurement, HandleRedirectPromiseMeasurement, AcquireTokenByCodeAsync, SilentCacheClientAcquireToken, SilentRefreshClientAcquireToken, SilentIframeClientAcquireToken, AcquireTokenSilentAsync, InitializeSilentRequest, AcquireTokenBySilentIframe, AwaitConcurrentIframe, AcquireTokenFromCache, AcquireTokenByRefreshToken, GeneratePkceCodes } from '../telemetry/BrowserPerformanceEvents.mjs';
-import { InitializeClientApplication, AcquireTokenRedirect, AcquireTokenPreRedirect, AcquireTokenPopup, SsoSilent, AcquireTokenByCode, AcquireTokenSilent } from '../telemetry/BrowserRootPerformanceEvents.mjs';
+import { InitializeCache, HandleNativeRedirectPromiseMeasurement, HandleRedirectPromiseMeasurement, NativeInteractionClientAcquireTokenRedirect, AcquireTokenByCodeAsync, SilentCacheClientAcquireToken, SilentRefreshClientAcquireToken, SilentIframeClientAcquireToken, NativeInteractionClientAcquireToken, AcquireTokenSilentAsync, InitializeSilentRequest, AcquireTokenBySilentIframe, AwaitConcurrentIframe, AcquireTokenFromCache, AcquireTokenByRefreshToken, GeneratePkceCodes } from '../telemetry/BrowserPerformanceEvents.mjs';
+import { InitializeClientApplication, AcquireTokenRedirect, AcquireTokenPreRedirect, AcquireTokenPopup, SsoCapable, SsoSilent, AcquireTokenByCode, AcquireTokenSilent } from '../telemetry/BrowserRootPerformanceEvents.mjs';
 import { BrowserCacheManager, DEFAULT_BROWSER_CACHE_MANAGER } from '../cache/BrowserCacheManager.mjs';
+import { SSO_CAPABLE } from '../cache/CacheKeys.mjs';
 import { getAllAccounts, getAccount, setActiveAccount, getActiveAccount } from '../cache/AccountManager.mjs';
 import { BrowserCacheLocation, INTERACTION_TYPE, InteractionType, ApiId, CacheLookupPolicy, DEFAULT_REQUEST, iFrameRenewalPolicies, BrowserConstants } from '../utils/BrowserConstants.mjs';
 import { blockAPICallsBeforeInitialize, redirectPreflightCheck, preflightCheck as preflightCheck$1, blockNonBrowserEnvironment } from '../utils/BrowserUtils.mjs';
@@ -98,22 +99,32 @@ class StandardController {
         this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, this.performanceClient, this.eventHandler);
         this.activeSilentTokenRequests = new Map();
         // Register listener functions
-        this.trackPageVisibility = this.trackPageVisibility.bind(this);
+        this.trackStateChange = this.trackStateChange.bind(this);
         // Register listener functions
-        this.trackPageVisibilityWithMeasurement =
-            this.trackPageVisibilityWithMeasurement.bind(this);
+        this.trackStateChangeWithMeasurement =
+            this.trackStateChangeWithMeasurement.bind(this);
     }
     static async createController(operatingContext, request) {
         const controller = new StandardController(operatingContext);
         await controller.initialize(request);
         return controller;
     }
-    trackPageVisibility(correlationId) {
+    trackStateChange(correlationId, event) {
         if (!correlationId) {
             return;
         }
-        this.logger.info("16v6hv", correlationId);
-        this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        if (event.type === "visibilitychange") {
+            this.logger.info("16v6hv", correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "online") {
+            this.logger.info("0zirfd", correlationId);
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
+        else if (event.type === "offline") {
+            this.logger.info("1xk9ef", correlationId);
+            this.performanceClient.incrementFields({ onlineStatusChangeCount: 1 }, correlationId);
+        }
     }
     /**
      * Initializer function to perform async startup tasks such as connecting to WAM extension
@@ -213,22 +224,25 @@ class StandardController {
         }
         const loggedInAccounts = this.getAllAccounts();
         const platformBrokerRequest = this.browserStorage.getCachedNativeRequest();
-        const useNative = platformBrokerRequest &&
-            this.platformAuthProvider &&
-            !options?.hash;
+        const useNative = platformBrokerRequest && !options?.hash;
         let rootMeasurement;
         let redirectResponse;
+        let cachedRedirectRequest;
         try {
             if (useNative && this.platformAuthProvider) {
                 const correlationId = platformBrokerRequest?.correlationId || "";
                 this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, InteractionType.Redirect);
                 rootMeasurement = this.performanceClient.startMeasurement(AcquireTokenRedirect, correlationId);
                 this.logger.trace("12v7is", correlationId);
+                rootMeasurement.add({
+                    isPlatformBrokerRequest: true,
+                });
                 const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.platformAuthProvider, platformBrokerRequest.accountId, this.nativeInternalStorage, platformBrokerRequest.correlationId);
-                redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
+                redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)();
             }
             else {
                 const [standardRequest, codeVerifier] = this.browserStorage.getCachedRequest("");
+                cachedRedirectRequest = standardRequest;
                 const correlationId = standardRequest.correlationId;
                 this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, correlationId, InteractionType.Redirect);
                 // Reset rootMeasurement now that we have correlationId
@@ -257,6 +271,8 @@ class StandardController {
                 rootMeasurement.end({
                     success: true,
                 }, undefined, result.account);
+                // Fire-and-forget SSO capability verification in background
+                this.verifySsoCapability(cachedRedirectRequest, InteractionType.Redirect);
             }
             else {
                 /*
@@ -322,12 +338,14 @@ class StandardController {
             if (this.platformAuthProvider &&
                 this.canUsePlatformBroker(request)) {
                 const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.platformAuthProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-                result = nativeClient
-                    .acquireTokenRedirect(request, atrMeasurement)
-                    .catch((e) => {
+                result = invokeAsync(nativeClient.acquireTokenRedirect.bind(nativeClient), NativeInteractionClientAcquireTokenRedirect, this.logger, this.performanceClient, correlationId)(request, atrMeasurement).catch((e) => {
+                    atrMeasurement.add({
+                        brokerErrorName: e.name,
+                        brokerErrorCode: e.errorCode,
+                    });
                     if (e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)) {
-                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                         const redirectClient = this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
@@ -393,6 +411,9 @@ class StandardController {
         let result;
         const pkce = this.getPreGeneratedPkceCodes(correlationId);
         if (this.canUsePlatformBroker(request)) {
+            atPopupMeasurement.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative({
                 ...request,
                 correlationId,
@@ -405,9 +426,13 @@ class StandardController {
                 return response;
             })
                 .catch((e) => {
+                atPopupMeasurement.add({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                });
                 if (e instanceof NativeAuthError &&
                     isFatalNativeAuthError(e)) {
-                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                     const popupClient = this.createPopupClient(correlationId);
                     return popupClient.acquireToken(request, pkce);
                 }
@@ -438,6 +463,8 @@ class StandardController {
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             }, undefined, result.account);
+            // SSO capability verification in background
+            this.verifySsoCapability(request, InteractionType.Popup);
             return result;
         })
             .catch((e) => {
@@ -455,15 +482,137 @@ class StandardController {
             }
         });
     }
-    trackPageVisibilityWithMeasurement() {
+    trackStateChangeWithMeasurement(event) {
         const measurement = this.ssoSilentMeasurement ||
             this.acquireTokenByCodeAsyncMeasurement;
         if (!measurement) {
             return;
         }
-        measurement.increment({
-            visibilityChangeCount: 1,
+        if (event.type === "visibilitychange") {
+            this.logger.info("0yzimq", measurement.event.correlationId);
+            measurement.increment({
+                visibilityChangeCount: 1,
+            });
+        }
+        else if (event.type === "online") {
+            this.logger.info("1caf53", measurement.event.correlationId);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+        else if (event.type === "offline") {
+            this.logger.info("0fdyk7", measurement.event.correlationId);
+            measurement.increment({
+                onlineStatusChangeCount: 1,
+            });
+        }
+    }
+    addStateChangeListeners(listener) {
+        document.addEventListener("visibilitychange", listener);
+        window.addEventListener("online", listener);
+        window.addEventListener("offline", listener);
+    }
+    removeStateChangeListeners(listener) {
+        document.removeEventListener("visibilitychange", listener);
+        window.removeEventListener("online", listener);
+        window.removeEventListener("offline", listener);
+    }
+    /**
+     * Reads the cached ssoCapable value from localStorage.
+     * @returns The cached ssoCapable boolean value, or undefined if not cached or expired.
+     */
+    getCachedSsoCapable() {
+        try {
+            const cachedValue = window.localStorage.getItem(SSO_CAPABLE);
+            if (cachedValue) {
+                const parsed = JSON.parse(cachedValue);
+                if (parsed &&
+                    typeof parsed.ssoCapable === "boolean" &&
+                    parsed.expiresOn &&
+                    Date.now() < parsed.expiresOn) {
+                    return parsed.ssoCapable;
+                }
+            }
+        }
+        catch {
+            // If parsing fails, return undefined
+        }
+        return undefined;
+    }
+    /**
+     * SSO capability verification in the background.
+     * This method makes an iframe request to /authorize to verify SSO capability without calling /token.
+     * This method does not block the caller and tracks telemetry for success/failure.
+     * This method only executes if verifySSO is set to true in the auth configuration.
+     * The result is cached in localStorage with a 24-hour TTL; the SSO verification call
+     * is only attempted when the cached value is absent or expired.
+     * @param request - The original request used for the authentication flow
+     * @param interactionType - The interactionType of the AT operation for logging purposes
+     */
+    verifySsoCapability(request, interactionType) {
+        // Check if SSO capability verification is enabled
+        if (!this.config.auth.verifySSO) {
+            return;
+        }
+        // Check TTL: derive ssoCapable state from localStorage and skip if not expired
+        const ssoCacheKey = SSO_CAPABLE;
+        const SSO_CAPABLE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+        const cachedSsoCapable = this.getCachedSsoCapable();
+        if (cachedSsoCapable !== undefined) {
+            this.logger.verbose("13poou", "");
+            return;
+        }
+        const correlationId = createNewGuid();
+        const ssoCapableMeasurement = this.performanceClient.startMeasurement(SsoCapable, correlationId);
+        ssoCapableMeasurement.add({
+            "ext.interactionType": interactionType,
         });
+        this.logger.verbose("0pbr0i", correlationId);
+        /*
+         * Use setTimeout to ensure this runs in a separate macrotask after the current call stack completes
+         * This ensures the result is returned to the caller before the SSO verification starts and doesn't affect performance
+         */
+        setTimeout(() => {
+            const ssoVerificationRequest = {
+                ...request,
+                correlationId: correlationId,
+            };
+            const silentIframeClient = this.createSilentIframeClient(correlationId);
+            silentIframeClient
+                .verifySso(ssoVerificationRequest)
+                .then((result) => {
+                this.logger.verbose("1gd1iv", correlationId);
+                // TBD to add profileTelemetry later in localStorage with 24h TTL
+                try {
+                    const cacheEntry = JSON.stringify({
+                        ssoCapable: result,
+                        expiresOn: Date.now() + SSO_CAPABLE_TTL_MS,
+                    });
+                    window.localStorage.setItem(ssoCacheKey, cacheEntry);
+                }
+                catch {
+                    this.logger.warning("18lmoj", correlationId);
+                }
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: result,
+                }, undefined);
+            })
+                .catch((error) => {
+                this.logger.warning("05g83w", correlationId);
+                // reset the cache
+                try {
+                    window.localStorage.removeItem(ssoCacheKey);
+                }
+                catch {
+                    this.logger.warning("0nlf9q", correlationId);
+                }
+                ssoCapableMeasurement.end({
+                    fromCache: false,
+                    success: false,
+                }, error);
+            });
+        }, 0);
     }
     // #endregion
     // #region Silent Flow
@@ -486,28 +635,35 @@ class StandardController {
         const correlationId = this.getRequestCorrelationId(request);
         const validRequest = {
             ...request,
-            // will be PromptValue.NONE or PromptValue.NO_SESSION
-            prompt: request.prompt,
             correlationId: correlationId,
         };
         this.ssoSilentMeasurement = this.performanceClient.startMeasurement(SsoSilent, correlationId);
         this.ssoSilentMeasurement?.add({
             scenarioId: request.scenarioId,
+            ssoCapable: this.getCachedSsoCapable(),
         });
         preflightCheck(this.initialized, this.ssoSilentMeasurement, this.config, validRequest);
         this.ssoSilentMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const loggedInAccounts = this.getAllAccounts();
         this.logger.verbose("0w1b45", correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, correlationId, InteractionType.Silent, validRequest);
         let result;
         if (this.canUsePlatformBroker(validRequest)) {
+            this.ssoSilentMeasurement?.add({
+                isPlatformBrokerRequest: true,
+            });
             result = this.acquireTokenNative(validRequest, ApiId.ssoSilent).catch((e) => {
+                this.ssoSilentMeasurement?.add({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                });
                 // If native token acquisition fails for availability reasons fallback to standard flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
-                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                    this.platformAuthProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt platform broker calls
                     const silentIframeClient = this.createSilentIframeClient(validRequest.correlationId);
                     return silentIframeClient.acquireToken(validRequest);
                 }
@@ -541,7 +697,7 @@ class StandardController {
             throw e;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
     }
     /**
@@ -580,7 +736,6 @@ class StandardController {
                         this.hybridAuthCodeResponses.delete(hybridAuthCode);
                         atbcMeasurement.end({
                             success: true,
-                            isNativeBroker: result.fromPlatformBroker,
                             accessTokenSize: result.accessToken.length,
                             idTokenSize: result.idToken.length,
                         }, undefined, result.account);
@@ -604,10 +759,17 @@ class StandardController {
             }
             else if (request.nativeAccountId) {
                 if (this.canUsePlatformBroker(request, request.nativeAccountId)) {
+                    atbcMeasurement.add({
+                        isPlatformBrokerRequest: true,
+                    });
                     const result = await this.acquireTokenNative({
                         ...request,
                         correlationId,
                     }, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
+                        atbcMeasurement.add({
+                            brokerErrorName: e.name,
+                            brokerErrorCode: e.errorCode,
+                        });
                         // If native token acquisition fails for availability reasons fallback to standard flow
                         if (e instanceof NativeAuthError &&
                             isFatalNativeAuthError(e)) {
@@ -648,8 +810,9 @@ class StandardController {
             this.performanceClient.startMeasurement(AcquireTokenByCodeAsync, correlationId);
         this.acquireTokenByCodeAsyncMeasurement?.increment({
             visibilityChangeCount: 0,
+            onlineStatusChangeCount: 0,
         });
-        document.addEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+        this.addStateChangeListeners(this.trackStateChangeWithMeasurement);
         const silentAuthCodeClient = this.createSilentAuthCodeClient(correlationId);
         const silentTokenResult = await silentAuthCodeClient
             .acquireToken(request)
@@ -657,7 +820,6 @@ class StandardController {
             this.acquireTokenByCodeAsyncMeasurement?.end({
                 success: true,
                 fromCache: response.fromCache,
-                isNativeBroker: response.fromPlatformBroker,
             });
             return response;
         })
@@ -668,7 +830,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", this.trackPageVisibilityWithMeasurement);
+            this.removeStateChangeListeners(this.trackStateChangeWithMeasurement);
         });
         return silentTokenResult;
     }
@@ -826,7 +988,7 @@ class StandardController {
             throw createBrowserAuthError(nativeConnectionNotEstablished);
         }
         const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.platformAuthProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-        return nativeClient.acquireToken(request, cacheLookupPolicy);
+        return invokeAsync(nativeClient.acquireToken.bind(nativeClient), NativeInteractionClientAcquireToken, this.logger, this.performanceClient, correlationId)(request, cacheLookupPolicy);
     }
     /**
      * Returns boolean indicating if this request can use the platform broker
@@ -840,7 +1002,7 @@ class StandardController {
             return false;
         }
         if (!isPlatformAuthAllowed(this.config, this.logger, correlationId, this.platformAuthProvider, request.authenticationScheme)) {
-            this.logger.trace("1m4bzf", correlationId);
+            this.logger.trace("0yoy1g", correlationId);
             return false;
         }
         if (request.prompt) {
@@ -1059,6 +1221,7 @@ class StandardController {
         atsMeasurement.add({
             cacheLookupPolicy: request.cacheLookupPolicy,
             scenarioId: request.scenarioId,
+            ssoCapable: this.getCachedSsoCapable(),
         });
         preflightCheck(this.initialized, atsMeasurement, this.config, request);
         this.logger.verbose("0x1c4s", correlationId);
@@ -1071,7 +1234,6 @@ class StandardController {
             atsMeasurement.end({
                 success: true,
                 fromCache: result.fromCache,
-                isNativeBroker: result.fromPlatformBroker,
                 accessTokenSize: result.accessToken.length,
                 idTokenSize: result.idToken.length,
             }, undefined, result.account);
@@ -1132,12 +1294,12 @@ class StandardController {
      * @returns {Promise.<AuthenticationResult>} - a promise that is fulfilled when this function has completed, or rejected if an error was raised. Returns the {@link AuthResponse}
      */
     async acquireTokenSilentAsync(request, account) {
-        const trackPageVisibility = () => this.trackPageVisibility(request.correlationId);
+        const trackStateChange = (event) => this.trackStateChange(request.correlationId, event);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, request.correlationId, InteractionType.Silent, request);
         if (request.correlationId) {
-            this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
+            this.performanceClient.incrementFields({ visibilityChangeCount: 0, onlineStatusChangeCount: 0 }, request.correlationId);
         }
-        document.addEventListener("visibilitychange", trackPageVisibility);
+        this.addStateChangeListeners(trackStateChange);
         const silentRequest = await invokeAsync(initializeSilentRequest, InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
         const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
         const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
@@ -1219,7 +1381,7 @@ class StandardController {
             throw tokenRenewalError;
         })
             .finally(() => {
-            document.removeEventListener("visibilitychange", trackPageVisibility);
+            this.removeStateChangeListeners(trackStateChange);
         });
     }
     /**
@@ -1233,7 +1395,12 @@ class StandardController {
         if (isPlatformAuthAllowed(this.config, this.logger, silentRequest.correlationId, this.platformAuthProvider, silentRequest.authenticationScheme) &&
             silentRequest.account.nativeAccountId) {
             this.logger.verbose("0sczo4", silentRequest.correlationId);
+            this.performanceClient.addFields({ isPlatformBrokerRequest: true }, silentRequest.correlationId);
             return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow, silentRequest.account.nativeAccountId, cacheLookupPolicy).catch(async (e) => {
+                this.performanceClient.addFields({
+                    brokerErrorName: e.name,
+                    brokerErrorCode: e.errorCode,
+                }, silentRequest.correlationId);
                 // If native token acquisition fails for availability reasons fallback to web flow
                 if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
                     this.logger.verbose("07rkmb", silentRequest.correlationId);