@azure/msal-common 12.1.0 → 13.1.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v12.1.0 2023-04-18 */
+/*! @azure/msal-common v13.1.0 2023-06-07 */
 'use strict';
 'use strict';
 
@@ -1423,7 +1423,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "12.1.0";
+var version = "13.1.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1544,6 +1544,10 @@ var ClientConfigurationErrorMessage = {
     invalidAuthenticationHeader: {
         code: "invalid_authentication_header",
         desc: "Invalid authentication header provided"
+    },
+    authorityMismatch: {
+        code: "authority_mismatch",
+        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority."
     }
 };
 /**
@@ -1695,6 +1699,12 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     ClientConfigurationError.createInvalidAuthenticationHeaderError = function (invalidHeaderName, details) {
         return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc + ". Invalid header: " + invalidHeaderName + ". Details: " + details);
     };
+    /**
+     * Create an error when the authority provided in request does not match authority provided in account or MSAL.js configuration.
+     */
+    ClientConfigurationError.createAuthorityMismatchError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.authorityMismatch.code, ClientConfigurationErrorMessage.authorityMismatch.desc);
+    };
     return ClientConfigurationError;
 }(ClientAuthError));
 
@@ -6072,7 +6082,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
                         reqCnfData = _b.sent();
-                        parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                         _b.label = 2;
                     case 2: return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
@@ -7561,23 +7571,31 @@ var Authority = /** @class */ (function () {
         this.correlationId = correlationId;
         this.regionDiscovery = new RegionDiscovery(networkInterface, this.performanceClient, this.correlationId);
     }
+    /**
+     * Get {@link AuthorityType}
+     * @param authorityUri {@link IUri}
+     * @private
+     */
+    Authority.prototype.getAuthorityType = function (authorityUri) {
+        // CIAM auth url pattern is being standardized as: <tenant>.ciamlogin.com
+        if (authorityUri.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL)) {
+            return exports.AuthorityType.Ciam;
+        }
+        var pathSegments = authorityUri.PathSegments;
+        if (pathSegments.length) {
+            switch (pathSegments[0].toLowerCase()) {
+                case Constants.ADFS:
+                    return exports.AuthorityType.Adfs;
+                case Constants.DSTS:
+                    return exports.AuthorityType.Dsts;
+            }
+        }
+        return exports.AuthorityType.Default;
+    };
     Object.defineProperty(Authority.prototype, "authorityType", {
         // See above for AuthorityType
         get: function () {
-            // CIAM auth url pattern is being standardized as: <tenant>.ciamlogin.com
-            if (this.canonicalAuthorityUrlComponents.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL)) {
-                return exports.AuthorityType.Ciam;
-            }
-            var pathSegments = this.canonicalAuthorityUrlComponents.PathSegments;
-            if (pathSegments.length) {
-                switch (pathSegments[0].toLowerCase()) {
-                    case Constants.ADFS:
-                        return exports.AuthorityType.Adfs;
-                    case Constants.DSTS:
-                        return exports.AuthorityType.Dsts;
-                }
-            }
-            return exports.AuthorityType.Default;
+            return this.getAuthorityType(this.canonicalAuthorityUrlComponents);
         },
         enumerable: false,
         configurable: true
@@ -7659,8 +7677,7 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.authorization_endpoint);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.authorization_endpoint);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7675,8 +7692,7 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.token_endpoint);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.token_endpoint);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7688,8 +7704,7 @@ var Authority = /** @class */ (function () {
     Object.defineProperty(Authority.prototype, "deviceCodeEndpoint", {
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7708,8 +7723,7 @@ var Authority = /** @class */ (function () {
                 if (!this.metadata.end_session_endpoint) {
                     throw ClientAuthError.createLogoutNotSupportedError();
                 }
-                var endpoint = this.replacePath(this.metadata.end_session_endpoint);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.end_session_endpoint);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7724,8 +7738,7 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.issuer);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.issuer);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7740,8 +7753,7 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.jwks_uri);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.jwks_uri);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7750,6 +7762,17 @@ var Authority = /** @class */ (function () {
         enumerable: false,
         configurable: true
     });
+    /**
+     * Returns a flag indicating that tenant name can be replaced in authority {@link IUri}
+     * @param authorityUri {@link IUri}
+     * @private
+     */
+    Authority.prototype.canReplaceTenant = function (authorityUri) {
+        return authorityUri.PathSegments.length === 1
+            && !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0])
+            && this.getAuthorityType(authorityUri) === exports.AuthorityType.Default
+            && this.protocolMode === exports.ProtocolMode.AAD;
+    };
     /**
      * Replaces tenant in url path with current tenant. Defaults to common.
      * @param urlString
@@ -7762,17 +7785,31 @@ var Authority = /** @class */ (function () {
      * @param urlString
      */
     Authority.prototype.replacePath = function (urlString) {
+        var _this = this;
         var endpoint = urlString;
         var cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
-        var cachedAuthorityParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
+        var cachedAuthorityUrlComponents = cachedAuthorityUrl.getUrlComponents();
+        var cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
         var currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
         currentAuthorityParts.forEach(function (currentPart, index) {
             var cachedPart = cachedAuthorityParts[index];
+            if (index === 0 && _this.canReplaceTenant(cachedAuthorityUrlComponents)) {
+                var tenantId = (new UrlString(_this.metadata.authorization_endpoint)).getUrlComponents().PathSegments[0];
+                /**
+                 * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
+                 * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
+                 * always resolved with tenant id by OIDC.
+                 */
+                if (cachedPart !== tenantId) {
+                    _this.logger.verbose("Replacing tenant domain name " + cachedPart + " with id " + tenantId);
+                    cachedPart = tenantId;
+                }
+            }
             if (currentPart !== cachedPart) {
                 endpoint = endpoint.replace("/" + cachedPart + "/", "/" + currentPart + "/");
             }
         });
-        return endpoint;
+        return this.replaceTenant(endpoint);
     };
     Object.defineProperty(Authority.prototype, "defaultOpenIdConfigurationEndpoint", {
         /**
@@ -8290,7 +8327,7 @@ var Authority = /** @class */ (function () {
      * @param authority
      */
     Authority.transformCIAMAuthority = function (authority) {
-        var ciamAuthority = authority;
+        var ciamAuthority = authority.endsWith(Constants.FORWARD_SLASH) ? authority : "" + authority + Constants.FORWARD_SLASH;
         var authorityUrl = new UrlString(authority);
         var authorityUrlComponents = authorityUrl.getUrlComponents();
         // check if transformation is needed
@@ -8300,6 +8337,14 @@ var Authority = /** @class */ (function () {
         }
         return ciamAuthority;
     };
+    // Reserved tenant domain names that will not be replaced with tenant id
+    Authority.reservedTenantDomains = (new Set([
+        "{tenant}",
+        "{tenantid}",
+        AADAuthorityConstants.COMMON,
+        AADAuthorityConstants.CONSUMERS,
+        AADAuthorityConstants.ORGANIZATIONS
+    ]));
     return Authority;
 }());