@azure/msal-common 13.0.0 → 13.2.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v13.0.0 2023-05-01 */
+/*! @azure/msal-common v13.2.0 2023-07-05 */
 'use strict';
 'use strict';
 
@@ -461,6 +461,7 @@ var CacheOutcome;
     CacheOutcome["NO_CACHED_ACCESS_TOKEN"] = "2";
     CacheOutcome["CACHED_ACCESS_TOKEN_EXPIRED"] = "3";
     CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
+    CacheOutcome["CLAIMS_REQUESTED_CACHE_SKIPPED"] = "5";
 })(CacheOutcome || (CacheOutcome = {}));
 var JsonTypes;
 (function (JsonTypes) {
@@ -1423,7 +1424,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "13.0.0";
+var version = "13.2.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1544,6 +1545,10 @@ var ClientConfigurationErrorMessage = {
     invalidAuthenticationHeader: {
         code: "invalid_authentication_header",
         desc: "Invalid authentication header provided"
+    },
+    authorityMismatch: {
+        code: "authority_mismatch",
+        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority."
     }
 };
 /**
@@ -1695,6 +1700,12 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     ClientConfigurationError.createInvalidAuthenticationHeaderError = function (invalidHeaderName, details) {
         return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc + ". Invalid header: " + invalidHeaderName + ". Details: " + details);
     };
+    /**
+     * Create an error when the authority provided in request does not match authority provided in account or MSAL.js configuration.
+     */
+    ClientConfigurationError.createAuthorityMismatchError = function () {
+        return new ClientConfigurationError(ClientConfigurationErrorMessage.authorityMismatch.code, ClientConfigurationErrorMessage.authorityMismatch.desc);
+    };
     return ClientConfigurationError;
 }(ClientAuthError));
 
@@ -3297,6 +3308,9 @@ var DEFAULT_LOGGER_IMPLEMENTATION = {
     logLevel: exports.LogLevel.Info,
     correlationId: Constants.EMPTY_STRING
 };
+var DEFAULT_CACHE_OPTIONS = {
+    claimsBasedCachingEnabled: true
+};
 var DEFAULT_NETWORK_IMPLEMENTATION = {
     sendGetRequestAsync: function () {
         return __awaiter(this, void 0, void 0, function () {
@@ -3345,12 +3359,13 @@ var DEFAULT_TELEMETRY_OPTIONS = {
  * @returns Configuration
  */
 function buildClientConfiguration(_a) {
-    var userAuthOptions = _a.authOptions, userSystemOptions = _a.systemOptions, userLoggerOption = _a.loggerOptions, storageImplementation = _a.storageInterface, networkImplementation = _a.networkInterface, cryptoImplementation = _a.cryptoInterface, clientCredentials = _a.clientCredentials, libraryInfo = _a.libraryInfo, telemetry = _a.telemetry, serverTelemetryManager = _a.serverTelemetryManager, persistencePlugin = _a.persistencePlugin, serializableCache = _a.serializableCache;
+    var userAuthOptions = _a.authOptions, userSystemOptions = _a.systemOptions, userLoggerOption = _a.loggerOptions, userCacheOptions = _a.cacheOptions, storageImplementation = _a.storageInterface, networkImplementation = _a.networkInterface, cryptoImplementation = _a.cryptoInterface, clientCredentials = _a.clientCredentials, libraryInfo = _a.libraryInfo, telemetry = _a.telemetry, serverTelemetryManager = _a.serverTelemetryManager, persistencePlugin = _a.persistencePlugin, serializableCache = _a.serializableCache;
     var loggerOptions = __assign(__assign({}, DEFAULT_LOGGER_IMPLEMENTATION), userLoggerOption);
     return {
         authOptions: buildAuthOptions(userAuthOptions),
         systemOptions: __assign(__assign({}, DEFAULT_SYSTEM_OPTIONS), userSystemOptions),
         loggerOptions: loggerOptions,
+        cacheOptions: __assign(__assign({}, DEFAULT_CACHE_OPTIONS), userCacheOptions),
         storageInterface: storageImplementation || new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions)),
         networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
@@ -6072,7 +6087,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
                         reqCnfData = _b.sent();
-                        parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                         _b.label = 2;
                     case 2: return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
@@ -7090,11 +7105,11 @@ var SilentFlowClient = /** @class */ (function (_super) {
      * @param request
      */
     SilentFlowClient.prototype.acquireCachedToken = function (request) {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e;
         return __awaiter(this, void 0, void 0, function () {
             var environment, cacheRecord;
-            return __generator(this, function (_e) {
-                switch (_e.label) {
+            return __generator(this, function (_f) {
+                switch (_f.label) {
                     case 0:
                         // Cannot renew token if no request object is given.
                         if (!request) {
@@ -7106,6 +7121,12 @@ var SilentFlowClient = /** @class */ (function (_super) {
                             this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
+                        else if (!this.config.cacheOptions.claimsBasedCachingEnabled && !StringUtils.isEmptyObj(request.claims)) {
+                            // Must refresh due to presence of claims in request preventing cache lookup
+                            (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.CLAIMS_REQUESTED_CACHE_SKIPPED);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims-based caching is disabled and claims were requested.");
+                            throw ClientAuthError.createRefreshRequiredError();
+                        }
                         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
                         if (!request.account) {
                             throw ClientAuthError.createNoAccountInSilentRequestError();
@@ -7114,20 +7135,20 @@ var SilentFlowClient = /** @class */ (function (_super) {
                         cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
                         if (!cacheRecord.accessToken) {
                             // Must refresh due to non-existent access_token.
-                            (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+                            (_c = this.serverTelemetryManager) === null || _c === void 0 ? void 0 : _c.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
                             this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
                             TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
                             // Must refresh due to expired access_token.
-                            (_c = this.serverTelemetryManager) === null || _c === void 0 ? void 0 : _c.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+                            (_d = this.serverTelemetryManager) === null || _d === void 0 ? void 0 : _d.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
                             this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within " + this.config.systemOptions.tokenRenewalOffsetSeconds + " seconds.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (cacheRecord.accessToken.refreshOn && TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
                             // Must refresh due to the refresh_in value.
-                            (_d = this.serverTelemetryManager) === null || _d === void 0 ? void 0 : _d.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);
+                            (_e = this.serverTelemetryManager) === null || _e === void 0 ? void 0 : _e.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);
                             this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
@@ -7135,7 +7156,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
                             this.config.serverTelemetryManager.incrementCacheHits();
                         }
                         return [4 /*yield*/, this.generateResultFromCacheRecord(cacheRecord, request)];
-                    case 1: return [2 /*return*/, _e.sent()];
+                    case 1: return [2 /*return*/, _f.sent()];
                 }
             });
         });
@@ -7561,23 +7582,31 @@ var Authority = /** @class */ (function () {
         this.correlationId = correlationId;
         this.regionDiscovery = new RegionDiscovery(networkInterface, this.performanceClient, this.correlationId);
     }
+    /**
+     * Get {@link AuthorityType}
+     * @param authorityUri {@link IUri}
+     * @private
+     */
+    Authority.prototype.getAuthorityType = function (authorityUri) {
+        // CIAM auth url pattern is being standardized as: <tenant>.ciamlogin.com
+        if (authorityUri.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL)) {
+            return exports.AuthorityType.Ciam;
+        }
+        var pathSegments = authorityUri.PathSegments;
+        if (pathSegments.length) {
+            switch (pathSegments[0].toLowerCase()) {
+                case Constants.ADFS:
+                    return exports.AuthorityType.Adfs;
+                case Constants.DSTS:
+                    return exports.AuthorityType.Dsts;
+            }
+        }
+        return exports.AuthorityType.Default;
+    };
     Object.defineProperty(Authority.prototype, "authorityType", {
         // See above for AuthorityType
         get: function () {
-            // CIAM auth url pattern is being standardized as: <tenant>.ciamlogin.com
-            if (this.canonicalAuthorityUrlComponents.HostNameAndPort.endsWith(Constants.CIAM_AUTH_URL)) {
-                return exports.AuthorityType.Ciam;
-            }
-            var pathSegments = this.canonicalAuthorityUrlComponents.PathSegments;
-            if (pathSegments.length) {
-                switch (pathSegments[0].toLowerCase()) {
-                    case Constants.ADFS:
-                        return exports.AuthorityType.Adfs;
-                    case Constants.DSTS:
-                        return exports.AuthorityType.Dsts;
-                }
-            }
-            return exports.AuthorityType.Default;
+            return this.getAuthorityType(this.canonicalAuthorityUrlComponents);
         },
         enumerable: false,
         configurable: true
@@ -7659,8 +7688,7 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.authorization_endpoint);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.authorization_endpoint);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7675,8 +7703,7 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.token_endpoint);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.token_endpoint);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7688,8 +7715,7 @@ var Authority = /** @class */ (function () {
     Object.defineProperty(Authority.prototype, "deviceCodeEndpoint", {
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7708,8 +7734,7 @@ var Authority = /** @class */ (function () {
                 if (!this.metadata.end_session_endpoint) {
                     throw ClientAuthError.createLogoutNotSupportedError();
                 }
-                var endpoint = this.replacePath(this.metadata.end_session_endpoint);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.end_session_endpoint);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7724,8 +7749,7 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.issuer);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.issuer);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7740,8 +7764,7 @@ var Authority = /** @class */ (function () {
          */
         get: function () {
             if (this.discoveryComplete()) {
-                var endpoint = this.replacePath(this.metadata.jwks_uri);
-                return this.replaceTenant(endpoint);
+                return this.replacePath(this.metadata.jwks_uri);
             }
             else {
                 throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
@@ -7750,6 +7773,17 @@ var Authority = /** @class */ (function () {
         enumerable: false,
         configurable: true
     });
+    /**
+     * Returns a flag indicating that tenant name can be replaced in authority {@link IUri}
+     * @param authorityUri {@link IUri}
+     * @private
+     */
+    Authority.prototype.canReplaceTenant = function (authorityUri) {
+        return authorityUri.PathSegments.length === 1
+            && !Authority.reservedTenantDomains.has(authorityUri.PathSegments[0])
+            && this.getAuthorityType(authorityUri) === exports.AuthorityType.Default
+            && this.protocolMode === exports.ProtocolMode.AAD;
+    };
     /**
      * Replaces tenant in url path with current tenant. Defaults to common.
      * @param urlString
@@ -7762,17 +7796,31 @@ var Authority = /** @class */ (function () {
      * @param urlString
      */
     Authority.prototype.replacePath = function (urlString) {
+        var _this = this;
         var endpoint = urlString;
         var cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
-        var cachedAuthorityParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
+        var cachedAuthorityUrlComponents = cachedAuthorityUrl.getUrlComponents();
+        var cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
         var currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
         currentAuthorityParts.forEach(function (currentPart, index) {
             var cachedPart = cachedAuthorityParts[index];
+            if (index === 0 && _this.canReplaceTenant(cachedAuthorityUrlComponents)) {
+                var tenantId = (new UrlString(_this.metadata.authorization_endpoint)).getUrlComponents().PathSegments[0];
+                /**
+                 * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
+                 * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
+                 * always resolved with tenant id by OIDC.
+                 */
+                if (cachedPart !== tenantId) {
+                    _this.logger.verbose("Replacing tenant domain name " + cachedPart + " with id " + tenantId);
+                    cachedPart = tenantId;
+                }
+            }
             if (currentPart !== cachedPart) {
                 endpoint = endpoint.replace("/" + cachedPart + "/", "/" + currentPart + "/");
             }
         });
-        return endpoint;
+        return this.replaceTenant(endpoint);
     };
     Object.defineProperty(Authority.prototype, "defaultOpenIdConfigurationEndpoint", {
         /**
@@ -7952,42 +8000,35 @@ var Authority = /** @class */ (function () {
     };
     /**
      * Update the retrieved metadata with regional information.
+     * User selected Azure region will be used if configured.
      */
     Authority.prototype.updateMetadataWithRegionalInformation = function (metadata) {
-        var _a, _b, _c, _d, _e, _f, _g;
+        var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function () {
-            var autodetectedRegionName, azureRegion;
-            return __generator(this, function (_h) {
-                switch (_h.label) {
+            var userConfiguredAzureRegion, autodetectedRegionName;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
                     case 0:
                         (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.addQueueMeasurement(exports.PerformanceEvents.AuthorityUpdateMetadataWithRegionalInformation, this.correlationId);
-                        (_b = this.performanceClient) === null || _b === void 0 ? void 0 : _b.setPreQueueTime(exports.PerformanceEvents.RegionDiscoveryDetectRegion, this.correlationId);
-                        return [4 /*yield*/, this.regionDiscovery.detectRegion((_c = this.authorityOptions.azureRegionConfiguration) === null || _c === void 0 ? void 0 : _c.environmentRegion, this.regionDiscoveryMetadata)];
-                    case 1:
-                        autodetectedRegionName = _h.sent();
-                        azureRegion = ((_d = this.authorityOptions.azureRegionConfiguration) === null || _d === void 0 ? void 0 : _d.azureRegion) === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
-                            ? autodetectedRegionName
-                            : (_e = this.authorityOptions.azureRegionConfiguration) === null || _e === void 0 ? void 0 : _e.azureRegion;
-                        if (((_f = this.authorityOptions.azureRegionConfiguration) === null || _f === void 0 ? void 0 : _f.azureRegion) === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
-                            this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName ?
-                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL :
-                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
-                        }
-                        else {
-                            if (autodetectedRegionName) {
-                                this.regionDiscoveryMetadata.region_outcome = (((_g = this.authorityOptions.azureRegionConfiguration) === null || _g === void 0 ? void 0 : _g.azureRegion) === autodetectedRegionName) ?
-                                    RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED :
-                                    RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;
-                            }
-                            else {
-                                this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
-                            }
+                        userConfiguredAzureRegion = (_b = this.authorityOptions.azureRegionConfiguration) === null || _b === void 0 ? void 0 : _b.azureRegion;
+                        if (!userConfiguredAzureRegion) return [3 /*break*/, 2];
+                        if (userConfiguredAzureRegion !== Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
+                            this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                            this.regionDiscoveryMetadata.region_used = userConfiguredAzureRegion;
+                            return [2 /*return*/, Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion)];
                         }
-                        if (azureRegion) {
-                            this.regionDiscoveryMetadata.region_used = azureRegion;
-                            return [2 /*return*/, Authority.replaceWithRegionalInformation(metadata, azureRegion)];
+                        (_c = this.performanceClient) === null || _c === void 0 ? void 0 : _c.setPreQueueTime(exports.PerformanceEvents.RegionDiscoveryDetectRegion, this.correlationId);
+                        return [4 /*yield*/, this.regionDiscovery.detectRegion((_d = this.authorityOptions.azureRegionConfiguration) === null || _d === void 0 ? void 0 : _d.environmentRegion, this.regionDiscoveryMetadata)];
+                    case 1:
+                        autodetectedRegionName = _e.sent();
+                        if (autodetectedRegionName) {
+                            this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
+                            this.regionDiscoveryMetadata.region_used = autodetectedRegionName;
+                            return [2 /*return*/, Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName)];
                         }
-                        return [2 /*return*/, metadata];
+                        this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
+                        _e.label = 2;
+                    case 2: return [2 /*return*/, metadata];
                 }
             });
         });
@@ -8300,6 +8341,14 @@ var Authority = /** @class */ (function () {
         }
         return ciamAuthority;
     };
+    // Reserved tenant domain names that will not be replaced with tenant id
+    Authority.reservedTenantDomains = (new Set([
+        "{tenant}",
+        "{tenantid}",
+        AADAuthorityConstants.COMMON,
+        AADAuthorityConstants.CONSUMERS,
+        AADAuthorityConstants.ORGANIZATIONS
+    ]));
     return Authority;
 }());