@azure/msal-common 13.0.0 → 14.0.0-alpha.2

package/dist/response/ResponseHandler.js

@@ -1,6 +1,5 @@
-/*! @azure/msal-common v13.0.0 2023-05-01 */
+/*! @azure/msal-common v14.0.0-alpha.2 2023-05-17 */
 'use strict';
-import { __awaiter, __generator } from '../_virtual/_tslib.js';
 import { buildClientInfo } from '../account/ClientInfo.js';
 import { ClientAuthError } from '../error/ClientAuthError.js';
 import { StringUtils } from '../utils/StringUtils.js';
@@ -21,290 +20,306 @@ import { AppMetadataEntity } from '../cache/entities/AppMetadataEntity.js';
 import { TokenCacheContext } from '../cache/persistence/TokenCacheContext.js';
 import { PerformanceEvents } from '../telemetry/performance/PerformanceEvent.js';
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Class that handles response parsing.
- */
-var ResponseHandler = /** @class */ (function () {
-    function ResponseHandler(clientId, cacheStorage, cryptoObj, logger, serializableCache, persistencePlugin, performanceClient) {
-        this.clientId = clientId;
-        this.cacheStorage = cacheStorage;
-        this.cryptoObj = cryptoObj;
-        this.logger = logger;
-        this.serializableCache = serializableCache;
-        this.persistencePlugin = persistencePlugin;
-        this.performanceClient = performanceClient;
-    }
-    /**
-     * Function which validates server authorization code response.
-     * @param serverResponseHash
-     * @param cachedState
-     * @param cryptoObj
-     */
-    ResponseHandler.prototype.validateServerAuthorizationCodeResponse = function (serverResponseHash, cachedState, cryptoObj) {
-        if (!serverResponseHash.state || !cachedState) {
-            throw !serverResponseHash.state ? ClientAuthError.createStateNotFoundError("Server State") : ClientAuthError.createStateNotFoundError("Cached State");
-        }
-        if (decodeURIComponent(serverResponseHash.state) !== decodeURIComponent(cachedState)) {
-            throw ClientAuthError.createStateMismatchError();
-        }
-        // Check for error
-        if (serverResponseHash.error || serverResponseHash.error_description || serverResponseHash.suberror) {
-            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponseHash.error, serverResponseHash.error_description, serverResponseHash.suberror)) {
-                throw new InteractionRequiredAuthError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror, serverResponseHash.timestamp || Constants.EMPTY_STRING, serverResponseHash.trace_id || Constants.EMPTY_STRING, serverResponseHash.correlation_id || Constants.EMPTY_STRING, serverResponseHash.claims || Constants.EMPTY_STRING);
-            }
-            throw new ServerError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror);
-        }
-        if (serverResponseHash.client_info) {
-            buildClientInfo(serverResponseHash.client_info, cryptoObj);
-        }
-    };
-    /**
-     * Function which validates server authorization token response.
-     * @param serverResponse
-     */
-    ResponseHandler.prototype.validateTokenResponse = function (serverResponse) {
-        // Check for error
-        if (serverResponse.error || serverResponse.error_description || serverResponse.suberror) {
-            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-                throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || Constants.EMPTY_STRING, serverResponse.trace_id || Constants.EMPTY_STRING, serverResponse.correlation_id || Constants.EMPTY_STRING, serverResponse.claims || Constants.EMPTY_STRING);
-            }
-            var errString = serverResponse.error_codes + " - [" + serverResponse.timestamp + "]: " + serverResponse.error_description + " - Correlation ID: " + serverResponse.correlation_id + " - Trace ID: " + serverResponse.trace_id;
-            throw new ServerError(serverResponse.error, errString, serverResponse.suberror);
-        }
-    };
-    /**
-     * Returns a constructed token response based on given string. Also manages the cache updates and cleanups.
-     * @param serverTokenResponse
-     * @param authority
-     */
-    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function () {
-            var idTokenObj, authTime, requestStateObj, cacheRecord, cacheContext, key, account;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0:
-                        (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.addQueueMeasurement(PerformanceEvents.HandleServerTokenResponse, serverTokenResponse.correlation_id);
-                        if (serverTokenResponse.id_token) {
-                            idTokenObj = new AuthToken(serverTokenResponse.id_token || Constants.EMPTY_STRING, this.cryptoObj);
-                            // token nonce check (TODO: Add a warning if no nonce is given?)
-                            if (authCodePayload && !StringUtils.isEmpty(authCodePayload.nonce)) {
-                                if (idTokenObj.claims.nonce !== authCodePayload.nonce) {
-                                    throw ClientAuthError.createNonceMismatchError();
-                                }
-                            }
-                            // token max_age check
-                            if (request.maxAge || (request.maxAge === 0)) {
-                                authTime = idTokenObj.claims.auth_time;
-                                if (!authTime) {
-                                    throw ClientAuthError.createAuthTimeNotFoundError();
-                                }
-                                AuthToken.checkMaxAge(authTime, request.maxAge);
-                            }
-                        }
-                        // generate homeAccountId
-                        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
-                        if (!!authCodePayload && !!authCodePayload.state) {
-                            requestStateObj = ProtocolUtils.parseRequestState(this.cryptoObj, authCodePayload.state);
-                        }
-                        // Add keyId from request to serverTokenResponse if defined
-                        serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload);
-                        _b.label = 1;
-                    case 1:
-                        _b.trys.push([1, , 5, 8]);
-                        if (!(this.persistencePlugin && this.serializableCache)) return [3 /*break*/, 3];
-                        this.logger.verbose("Persistence enabled, calling beforeCacheAccess");
-                        cacheContext = new TokenCacheContext(this.serializableCache, true);
-                        return [4 /*yield*/, this.persistencePlugin.beforeCacheAccess(cacheContext)];
-                    case 2:
-                        _b.sent();
-                        _b.label = 3;
-                    case 3:
-                        /*
-                         * When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.
-                         * If not present, we should return null, as it's the case that another application called removeAccount in between
-                         * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal, unless explicitly flagged by
-                         * the developer, as in the case of refresh token flow used in ADAL Node to MSAL Node migration.
-                         */
-                        if (handlingRefreshTokenResponse && !forceCacheRefreshTokenResponse && cacheRecord.account) {
-                            key = cacheRecord.account.generateAccountKey();
-                            account = this.cacheStorage.getAccount(key);
-                            if (!account) {
-                                this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId)];
-                            }
-                        }
-                        return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
-                    case 4:
-                        _b.sent();
-                        return [3 /*break*/, 8];
-                    case 5:
-                        if (!(this.persistencePlugin && this.serializableCache && cacheContext)) return [3 /*break*/, 7];
-                        this.logger.verbose("Persistence enabled, calling afterCacheAccess");
-                        return [4 /*yield*/, this.persistencePlugin.afterCacheAccess(cacheContext)];
-                    case 6:
-                        _b.sent();
-                        _b.label = 7;
-                    case 7: return [7 /*endfinally*/];
-                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse, serverRequestId)];
-                }
-            });
-        });
-    };
-    /**
-     * Generates CacheRecord
-     * @param serverTokenResponse
-     * @param idTokenObj
-     * @param authority
-     */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload) {
-        var env = authority.getPreferredCache();
-        if (StringUtils.isEmpty(env)) {
-            throw ClientAuthError.createInvalidCacheEnvironmentError();
-        }
-        // IdToken: non AAD scenarios can have empty realm
-        var cachedIdToken;
-        var cachedAccount;
-        if (!StringUtils.isEmpty(serverTokenResponse.id_token) && !!idTokenObj) {
-            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
-            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
-        }
-        // AccessToken
-        var cachedAccessToken = null;
-        if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
-            // If scopes not returned in server response, use request scopes
-            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(request.scopes || []);
-            /*
-             * Use timestamp calculated before request
-             * Server may return timestamps as strings, parse to numbers if so.
-             */
-            var expiresIn = (typeof serverTokenResponse.expires_in === "string" ? parseInt(serverTokenResponse.expires_in, 10) : serverTokenResponse.expires_in) || 0;
-            var extExpiresIn = (typeof serverTokenResponse.ext_expires_in === "string" ? parseInt(serverTokenResponse.ext_expires_in, 10) : serverTokenResponse.ext_expires_in) || 0;
-            var refreshIn = (typeof serverTokenResponse.refresh_in === "string" ? parseInt(serverTokenResponse.refresh_in, 10) : serverTokenResponse.refresh_in) || undefined;
-            var tokenExpirationSeconds = reqTimestamp + expiresIn;
-            var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
-            var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
-            // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
-        }
-        // refreshToken
-        var cachedRefreshToken = null;
-        if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {
-            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, userAssertionHash);
-        }
-        // appMetadata
-        var cachedAppMetadata = null;
-        if (!StringUtils.isEmpty(serverTokenResponse.foci)) {
-            cachedAppMetadata = AppMetadataEntity.createAppMetadataEntity(this.clientId, env, serverTokenResponse.foci);
-        }
-        return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
-    };
-    /**
-     * Generate Account
-     * @param serverTokenResponse
-     * @param idToken
-     * @param authority
-     */
-    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, authCodePayload) {
-        var authorityType = authority.authorityType;
-        var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : Constants.EMPTY_STRING;
-        var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : Constants.EMPTY_STRING;
-        // ADFS does not require client_info in the response
-        if (authorityType === AuthorityType.Adfs) {
-            this.logger.verbose("Authority type is ADFS, creating ADFS account");
-            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
-        }
-        // This fallback applies to B2C as well as they fall under an AAD account type.
-        if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === "AAD") {
-            throw ClientAuthError.createClientInfoEmptyError();
-        }
-        return serverTokenResponse.client_info ?
-            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost) :
-            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
-    };
-    /**
-     * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
-     *
-     * Optionally takes a state string that is set as-is in the response.
-     *
-     * @param cacheRecord
-     * @param idTokenObj
-     * @param fromTokenCache
-     * @param stateString
-     */
-    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, serverTokenResponse, requestId) {
-        var _a, _b, _c;
-        return __awaiter(this, void 0, void 0, function () {
-            var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
-            return __generator(this, function (_e) {
-                switch (_e.label) {
-                    case 0:
-                        accessToken = Constants.EMPTY_STRING;
-                        responseScopes = [];
-                        expiresOn = null;
-                        familyId = Constants.EMPTY_STRING;
-                        if (!cacheRecord.accessToken) return [3 /*break*/, 4];
-                        if (!(cacheRecord.accessToken.tokenType === AuthenticationScheme.POP)) return [3 /*break*/, 2];
-                        popTokenGenerator = new PopTokenGenerator(cryptoObj);
-                        _d = cacheRecord.accessToken, secret = _d.secret, keyId = _d.keyId;
-                        if (!keyId) {
-                            throw ClientAuthError.createKeyIdMissingError();
-                        }
-                        return [4 /*yield*/, popTokenGenerator.signPopToken(secret, keyId, request)];
-                    case 1:
-                        accessToken = _e.sent();
-                        return [3 /*break*/, 3];
-                    case 2:
-                        accessToken = cacheRecord.accessToken.secret;
-                        _e.label = 3;
-                    case 3:
-                        responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
-                        expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
-                        extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
-                        _e.label = 4;
-                    case 4:
-                        if (cacheRecord.appMetadata) {
-                            familyId = cacheRecord.appMetadata.familyId === THE_FAMILY_ID ? THE_FAMILY_ID : Constants.EMPTY_STRING;
-                        }
-                        uid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.oid) || (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.sub) || Constants.EMPTY_STRING;
-                        tid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.tid) || Constants.EMPTY_STRING;
-                        // for hybrid + native bridge enablement, send back the native account Id
-                        if ((serverTokenResponse === null || serverTokenResponse === void 0 ? void 0 : serverTokenResponse.spa_accountid) && !!cacheRecord.account) {
-                            cacheRecord.account.nativeAccountId = serverTokenResponse === null || serverTokenResponse === void 0 ? void 0 : serverTokenResponse.spa_accountid;
-                        }
-                        return [2 /*return*/, {
-                                authority: authority.canonicalAuthority,
-                                uniqueId: uid,
-                                tenantId: tid,
-                                scopes: responseScopes,
-                                account: cacheRecord.account ? cacheRecord.account.getAccountInfo() : null,
-                                idToken: idTokenObj ? idTokenObj.rawToken : Constants.EMPTY_STRING,
-                                idTokenClaims: idTokenObj ? idTokenObj.claims : {},
-                                accessToken: accessToken,
-                                fromCache: fromTokenCache,
-                                expiresOn: expiresOn,
-                                correlationId: request.correlationId,
-                                requestId: requestId || Constants.EMPTY_STRING,
-                                extExpiresOn: extExpiresOn,
-                                familyId: familyId,
-                                tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
-                                state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
-                                cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
-                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
-                                code: serverTokenResponse === null || serverTokenResponse === void 0 ? void 0 : serverTokenResponse.spa_code,
-                                fromNativeBroker: false,
-                            }];
-                }
-            });
-        });
-    };
-    return ResponseHandler;
-}());
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Class that handles response parsing.
+ */
+class ResponseHandler {
+    constructor(clientId, cacheStorage, cryptoObj, logger, serializableCache, persistencePlugin, performanceClient) {
+        this.clientId = clientId;
+        this.cacheStorage = cacheStorage;
+        this.cryptoObj = cryptoObj;
+        this.logger = logger;
+        this.serializableCache = serializableCache;
+        this.persistencePlugin = persistencePlugin;
+        this.performanceClient = performanceClient;
+    }
+    /**
+     * Function which validates server authorization code response.
+     * @param serverResponseHash
+     * @param cachedState
+     * @param cryptoObj
+     */
+    validateServerAuthorizationCodeResponse(serverResponseHash, cachedState, cryptoObj) {
+        if (!serverResponseHash.state || !cachedState) {
+            throw !serverResponseHash.state
+                ? ClientAuthError.createStateNotFoundError("Server State")
+                : ClientAuthError.createStateNotFoundError("Cached State");
+        }
+        if (decodeURIComponent(serverResponseHash.state) !==
+            decodeURIComponent(cachedState)) {
+            throw ClientAuthError.createStateMismatchError();
+        }
+        // Check for error
+        if (serverResponseHash.error ||
+            serverResponseHash.error_description ||
+            serverResponseHash.suberror) {
+            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponseHash.error, serverResponseHash.error_description, serverResponseHash.suberror)) {
+                throw new InteractionRequiredAuthError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror, serverResponseHash.timestamp || Constants.EMPTY_STRING, serverResponseHash.trace_id || Constants.EMPTY_STRING, serverResponseHash.correlation_id || Constants.EMPTY_STRING, serverResponseHash.claims || Constants.EMPTY_STRING);
+            }
+            throw new ServerError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror);
+        }
+        if (serverResponseHash.client_info) {
+            buildClientInfo(serverResponseHash.client_info, cryptoObj);
+        }
+    }
+    /**
+     * Function which validates server authorization token response.
+     * @param serverResponse
+     */
+    validateTokenResponse(serverResponse) {
+        // Check for error
+        if (serverResponse.error ||
+            serverResponse.error_description ||
+            serverResponse.suberror) {
+            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
+                throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || Constants.EMPTY_STRING, serverResponse.trace_id || Constants.EMPTY_STRING, serverResponse.correlation_id || Constants.EMPTY_STRING, serverResponse.claims || Constants.EMPTY_STRING);
+            }
+            const errString = `${serverResponse.error_codes} - [${serverResponse.timestamp}]: ${serverResponse.error_description} - Correlation ID: ${serverResponse.correlation_id} - Trace ID: ${serverResponse.trace_id}`;
+            throw new ServerError(serverResponse.error, errString, serverResponse.suberror);
+        }
+    }
+    /**
+     * Returns a constructed token response based on given string. Also manages the cache updates and cleanups.
+     * @param serverTokenResponse
+     * @param authority
+     */
+    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.HandleServerTokenResponse, serverTokenResponse.correlation_id);
+        // create an idToken object (not entity)
+        let idTokenObj;
+        if (serverTokenResponse.id_token) {
+            idTokenObj = new AuthToken(serverTokenResponse.id_token || Constants.EMPTY_STRING, this.cryptoObj);
+            // token nonce check (TODO: Add a warning if no nonce is given?)
+            if (authCodePayload &&
+                !StringUtils.isEmpty(authCodePayload.nonce)) {
+                if (idTokenObj.claims.nonce !== authCodePayload.nonce) {
+                    throw ClientAuthError.createNonceMismatchError();
+                }
+            }
+            // token max_age check
+            if (request.maxAge || request.maxAge === 0) {
+                const authTime = idTokenObj.claims.auth_time;
+                if (!authTime) {
+                    throw ClientAuthError.createAuthTimeNotFoundError();
+                }
+                AuthToken.checkMaxAge(authTime, request.maxAge);
+            }
+        }
+        // generate homeAccountId
+        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
+        // save the response tokens
+        let requestStateObj;
+        if (!!authCodePayload && !!authCodePayload.state) {
+            requestStateObj = ProtocolUtils.parseRequestState(this.cryptoObj, authCodePayload.state);
+        }
+        // Add keyId from request to serverTokenResponse if defined
+        serverTokenResponse.key_id =
+            serverTokenResponse.key_id || request.sshKid || undefined;
+        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload);
+        let cacheContext;
+        try {
+            if (this.persistencePlugin && this.serializableCache) {
+                this.logger.verbose("Persistence enabled, calling beforeCacheAccess");
+                cacheContext = new TokenCacheContext(this.serializableCache, true);
+                await this.persistencePlugin.beforeCacheAccess(cacheContext);
+            }
+            /*
+             * When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.
+             * If not present, we should return null, as it's the case that another application called removeAccount in between
+             * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal, unless explicitly flagged by
+             * the developer, as in the case of refresh token flow used in ADAL Node to MSAL Node migration.
+             */
+            if (handlingRefreshTokenResponse &&
+                !forceCacheRefreshTokenResponse &&
+                cacheRecord.account) {
+                const key = cacheRecord.account.generateAccountKey();
+                const account = this.cacheStorage.getAccount(key);
+                if (!account) {
+                    this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
+                    return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId);
+                }
+            }
+            await this.cacheStorage.saveCacheRecord(cacheRecord);
+        }
+        finally {
+            if (this.persistencePlugin &&
+                this.serializableCache &&
+                cacheContext) {
+                this.logger.verbose("Persistence enabled, calling afterCacheAccess");
+                await this.persistencePlugin.afterCacheAccess(cacheContext);
+            }
+        }
+        return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse, serverRequestId);
+    }
+    /**
+     * Generates CacheRecord
+     * @param serverTokenResponse
+     * @param idTokenObj
+     * @param authority
+     */
+    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload) {
+        const env = authority.getPreferredCache();
+        if (StringUtils.isEmpty(env)) {
+            throw ClientAuthError.createInvalidCacheEnvironmentError();
+        }
+        // IdToken: non AAD scenarios can have empty realm
+        let cachedIdToken;
+        let cachedAccount;
+        if (!StringUtils.isEmpty(serverTokenResponse.id_token) &&
+            !!idTokenObj) {
+            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
+        }
+        // AccessToken
+        let cachedAccessToken = null;
+        if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
+            // If scopes not returned in server response, use request scopes
+            const responseScopes = serverTokenResponse.scope
+                ? ScopeSet.fromString(serverTokenResponse.scope)
+                : new ScopeSet(request.scopes || []);
+            /*
+             * Use timestamp calculated before request
+             * Server may return timestamps as strings, parse to numbers if so.
+             */
+            const expiresIn = (typeof serverTokenResponse.expires_in === "string"
+                ? parseInt(serverTokenResponse.expires_in, 10)
+                : serverTokenResponse.expires_in) || 0;
+            const extExpiresIn = (typeof serverTokenResponse.ext_expires_in === "string"
+                ? parseInt(serverTokenResponse.ext_expires_in, 10)
+                : serverTokenResponse.ext_expires_in) || 0;
+            const refreshIn = (typeof serverTokenResponse.refresh_in === "string"
+                ? parseInt(serverTokenResponse.refresh_in, 10)
+                : serverTokenResponse.refresh_in) || undefined;
+            const tokenExpirationSeconds = reqTimestamp + expiresIn;
+            const extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
+            const refreshOnSeconds = refreshIn && refreshIn > 0
+                ? reqTimestamp + refreshIn
+                : undefined;
+            // non AAD scenarios can have empty realm
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj
+                ? idTokenObj.claims.tid || Constants.EMPTY_STRING
+                : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
+        }
+        // refreshToken
+        let cachedRefreshToken = null;
+        if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {
+            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, userAssertionHash);
+        }
+        // appMetadata
+        let cachedAppMetadata = null;
+        if (!StringUtils.isEmpty(serverTokenResponse.foci)) {
+            cachedAppMetadata = AppMetadataEntity.createAppMetadataEntity(this.clientId, env, serverTokenResponse.foci);
+        }
+        return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
+    }
+    /**
+     * Generate Account
+     * @param serverTokenResponse
+     * @param idToken
+     * @param authority
+     */
+    generateAccountEntity(serverTokenResponse, idToken, authority, authCodePayload) {
+        const authorityType = authority.authorityType;
+        const cloudGraphHostName = authCodePayload
+            ? authCodePayload.cloud_graph_host_name
+            : Constants.EMPTY_STRING;
+        const msGraphhost = authCodePayload
+            ? authCodePayload.msgraph_host
+            : Constants.EMPTY_STRING;
+        // ADFS does not require client_info in the response
+        if (authorityType === AuthorityType.Adfs) {
+            this.logger.verbose("Authority type is ADFS, creating ADFS account");
+            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
+        }
+        // This fallback applies to B2C as well as they fall under an AAD account type.
+        if (StringUtils.isEmpty(serverTokenResponse.client_info) &&
+            authority.protocolMode === "AAD") {
+            throw ClientAuthError.createClientInfoEmptyError();
+        }
+        return serverTokenResponse.client_info
+            ? AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost)
+            : AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
+    }
+    /**
+     * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
+     *
+     * Optionally takes a state string that is set as-is in the response.
+     *
+     * @param cacheRecord
+     * @param idTokenObj
+     * @param fromTokenCache
+     * @param stateString
+     */
+    static async generateAuthenticationResult(cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, serverTokenResponse, requestId) {
+        let accessToken = Constants.EMPTY_STRING;
+        let responseScopes = [];
+        let expiresOn = null;
+        let extExpiresOn;
+        let familyId = Constants.EMPTY_STRING;
+        if (cacheRecord.accessToken) {
+            if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP) {
+                const popTokenGenerator = new PopTokenGenerator(cryptoObj);
+                const { secret, keyId } = cacheRecord.accessToken;
+                if (!keyId) {
+                    throw ClientAuthError.createKeyIdMissingError();
+                }
+                accessToken = await popTokenGenerator.signPopToken(secret, keyId, request);
+            }
+            else {
+                accessToken = cacheRecord.accessToken.secret;
+            }
+            responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
+            expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
+            extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+        }
+        if (cacheRecord.appMetadata) {
+            familyId =
+                cacheRecord.appMetadata.familyId === THE_FAMILY_ID
+                    ? THE_FAMILY_ID
+                    : Constants.EMPTY_STRING;
+        }
+        const uid = idTokenObj?.claims.oid ||
+            idTokenObj?.claims.sub ||
+            Constants.EMPTY_STRING;
+        const tid = idTokenObj?.claims.tid || Constants.EMPTY_STRING;
+        // for hybrid + native bridge enablement, send back the native account Id
+        if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
+            cacheRecord.account.nativeAccountId =
+                serverTokenResponse?.spa_accountid;
+        }
+        return {
+            authority: authority.canonicalAuthority,
+            uniqueId: uid,
+            tenantId: tid,
+            scopes: responseScopes,
+            account: cacheRecord.account
+                ? cacheRecord.account.getAccountInfo()
+                : null,
+            idToken: idTokenObj ? idTokenObj.rawToken : Constants.EMPTY_STRING,
+            idTokenClaims: idTokenObj ? idTokenObj.claims : {},
+            accessToken: accessToken,
+            fromCache: fromTokenCache,
+            expiresOn: expiresOn,
+            correlationId: request.correlationId,
+            requestId: requestId || Constants.EMPTY_STRING,
+            extExpiresOn: extExpiresOn,
+            familyId: familyId,
+            tokenType: cacheRecord.accessToken?.tokenType || Constants.EMPTY_STRING,
+            state: requestState
+                ? requestState.userRequestState
+                : Constants.EMPTY_STRING,
+            cloudGraphHostName: cacheRecord.account?.cloudGraphHostName ||
+                Constants.EMPTY_STRING,
+            msGraphHost: cacheRecord.account?.msGraphHost || Constants.EMPTY_STRING,
+            code: serverTokenResponse?.spa_code,
+            fromNativeBroker: false,
+        };
+    }
+}
 
 export { ResponseHandler };
 //# sourceMappingURL=ResponseHandler.js.map