@azure/msal-common 13.3.0 → 13.3.3

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v13.3.0 2023-08-24 */
+/*! @azure/msal-common v13.3.3 2024-06-06 */
 'use strict';
 'use strict';
 
@@ -1424,7 +1424,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "13.3.0";
+var version = "13.3.3";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1957,6 +1957,19 @@ exports.AuthorityType = void 0;
     AuthorityType[AuthorityType["Ciam"] = 3] = "Ciam";
 })(exports.AuthorityType || (exports.AuthorityType = {}));
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Protocol modes supported by MSAL.
+ */
+exports.ProtocolMode = void 0;
+(function (ProtocolMode) {
+    ProtocolMode["AAD"] = "AAD";
+    ProtocolMode["OIDC"] = "OIDC";
+})(exports.ProtocolMode || (exports.ProtocolMode = {}));
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1976,8 +1989,8 @@ exports.AuthorityType = void 0;
  *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
  *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
  *      authorityType: Accounts authority type as a string
- *      name: Full name for the account, including given name and family name,
  *      clientInfo: Full base64 encoded client info received from ESTS
+ *      name: Full name for the account, including given name and family name
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
  *      idTokenClaims: Object containing claims parsed from ID token
@@ -2006,24 +2019,6 @@ var AccountEntity = /** @class */ (function () {
             localAccountId: this.localAccountId
         });
     };
-    /**
-     * returns the type of the cache (in this case account)
-     */
-    AccountEntity.prototype.generateType = function () {
-        switch (this.authorityType) {
-            case exports.CacheAccountType.ADFS_ACCOUNT_TYPE:
-                return exports.CacheType.ADFS;
-            case exports.CacheAccountType.MSAV1_ACCOUNT_TYPE:
-                return exports.CacheType.MSA;
-            case exports.CacheAccountType.MSSTS_ACCOUNT_TYPE:
-                return exports.CacheType.MSSTS;
-            case exports.CacheAccountType.GENERIC_ACCOUNT_TYPE:
-                return exports.CacheType.GENERIC;
-            default: {
-                throw ClientAuthError.createUnexpectedAccountTypeError();
-            }
-        }
-    };
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -2036,7 +2031,8 @@ var AccountEntity = /** @class */ (function () {
             localAccountId: this.localAccountId,
             name: this.name,
             idTokenClaims: this.idTokenClaims,
-            nativeAccountId: this.nativeAccountId
+            nativeAccountId: this.nativeAccountId,
+            authorityType: this.authorityType
         };
     };
     /**
@@ -2052,76 +2048,73 @@ var AccountEntity = /** @class */ (function () {
         return accountKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
     /**
-     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-     * @param clientInfo
+     * Build Account cache from account properties.
+     * @param accountDetails
      * @param authority
-     * @param idToken
-     * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
-        var _a, _b, _c, _d, _e, _f;
+    AccountEntity.createAccount = function (accountDetails, authority) {
         var account = new AccountEntity();
-        account.authorityType = exports.CacheAccountType.MSSTS_ACCOUNT_TYPE;
-        account.clientInfo = clientInfo;
-        account.homeAccountId = homeAccountId;
-        account.nativeAccountId = nativeAccountId;
-        var env = environment || (authority && authority.getPreferredCache());
+        if (authority.authorityType === exports.AuthorityType.Adfs) {
+            account.authorityType = exports.CacheAccountType.ADFS_ACCOUNT_TYPE;
+        }
+        else if (authority.protocolMode === exports.ProtocolMode.AAD) {
+            account.authorityType = exports.CacheAccountType.MSSTS_ACCOUNT_TYPE;
+        }
+        else {
+            account.authorityType = exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        }
+        account.clientInfo = accountDetails.clientInfo;
+        account.homeAccountId = accountDetails.homeAccountId;
+        account.nativeAccountId = accountDetails.nativeAccountId;
+        var env = accountDetails.environment || (authority && authority.getPreferredCache());
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
         }
         account.environment = env;
         // non AAD scenarios can have empty realm
-        account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || Constants.EMPTY_STRING;
-        if (idToken) {
-            account.idTokenClaims = idToken.claims;
-            // How do you account for MSA CID here?
-            account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || Constants.EMPTY_STRING;
-            /*
-             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-             * In most cases it will contain a single email. This field should not be relied upon if a custom
-             * policy is configured to return more than 1 email.
-             */
-            var preferredUsername = (_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username;
-            var email = ((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : null;
-            account.username = preferredUsername || email || Constants.EMPTY_STRING;
-            account.name = (_f = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _f === void 0 ? void 0 : _f.name;
+        account.realm = accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
+        account.idTokenClaims = accountDetails.idTokenClaims;
+        // How do you account for MSA CID here?
+        account.localAccountId = accountDetails.idTokenClaims.oid || accountDetails.idTokenClaims.sub || Constants.EMPTY_STRING;
+        /*
+         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+         * In most cases it will contain a single email. This field should not be relied upon if a custom
+         * policy is configured to return more than 1 email.
+         */
+        if (account.authorityType === exports.CacheAccountType.MSSTS_ACCOUNT_TYPE) {
+            var preferredUsername = accountDetails.idTokenClaims.preferred_username;
+            var email = (accountDetails.idTokenClaims.emails) ? accountDetails.idTokenClaims.emails[0] : null;
+            account.username = preferredUsername || email || "";
         }
-        account.cloudGraphHostName = cloudGraphHostName;
-        account.msGraphHost = msGraphHost;
+        else {
+            account.username = accountDetails.idTokenClaims.upn || "";
+        }
+        account.name = accountDetails.idTokenClaims.name;
+        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
+        account.msGraphHost = accountDetails.msGraphHost;
         return account;
     };
     /**
-     * Builds non-AAD/ADFS account.
-     * @param authority
-     * @param idToken
+     * Creates an account object from AccountInfo
+     * @param accountInfo
+     * @param cloudGraphHostName
+     * @param msGraphHost
+     * @returns AccountEntity
      */
-    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
-        var _a, _b, _c, _d;
+    AccountEntity.createFromAccountInfo = function (accountInfo, cloudGraphHostName, msGraphHost) {
         var account = new AccountEntity();
-        account.authorityType = (authority &&
-            authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        account.homeAccountId = homeAccountId;
-        // non AAD scenarios can have empty realm
-        account.realm = Constants.EMPTY_STRING;
-        var env = environment || authority && authority.getPreferredCache();
-        if (!env) {
-            throw ClientAuthError.createInvalidCacheEnvironmentError();
-        }
-        if (idToken) {
-            // How do you account for MSA CID here?
-            account.localAccountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.oid) || ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.sub) || Constants.EMPTY_STRING;
-            // upn claim for most ADFS scenarios
-            account.username = ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.upn) || Constants.EMPTY_STRING;
-            account.name = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.name) || Constants.EMPTY_STRING;
-            account.idTokenClaims = idToken === null || idToken === void 0 ? void 0 : idToken.claims;
-        }
-        account.environment = env;
+        account.authorityType =
+            accountInfo.authorityType || exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.homeAccountId = accountInfo.homeAccountId;
+        account.localAccountId = accountInfo.localAccountId;
+        account.nativeAccountId = accountInfo.nativeAccountId;
+        account.realm = accountInfo.tenantId;
+        account.environment = accountInfo.environment;
+        account.username = accountInfo.username;
+        account.name = accountInfo.name;
+        account.idTokenClaims = accountInfo.idTokenClaims;
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;
-        /*
-         * add uniqueName to claims
-         * account.name = idToken.claims.uniqueName;
-         */
         return account;
     };
     /**
@@ -2129,9 +2122,8 @@ var AccountEntity = /** @class */ (function () {
      * @param serverClientInfo
      * @param authType
      */
-    AccountEntity.generateHomeAccountId = function (serverClientInfo, authType, logger, cryptoObj, idToken) {
-        var _a;
-        var accountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.sub) ? idToken.claims.sub : Constants.EMPTY_STRING;
+    AccountEntity.generateHomeAccountId = function (serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
+        var accountId = (idTokenClaims === null || idTokenClaims === void 0 ? void 0 : idTokenClaims.sub) ? idTokenClaims.sub : Constants.EMPTY_STRING;
         // since ADFS does not have tid and does not set client_info
         if (authType === exports.AuthorityType.Adfs || authType === exports.AuthorityType.Dsts) {
             return accountId;
@@ -2770,6 +2762,7 @@ var CacheManager = /** @class */ (function () {
      * @param inputRealm
      */
     CacheManager.prototype.getIdToken = function (account, tokenKeys) {
+        var _this = this;
         this.commonLogger.trace("CacheManager - getIdToken called");
         var idTokenFilter = {
             homeAccountId: account.homeAccountId,
@@ -2785,7 +2778,11 @@ var CacheManager = /** @class */ (function () {
             return null;
         }
         else if (numIdTokens > 1) {
-            throw ClientAuthError.createMultipleMatchingTokensInCacheError();
+            this.commonLogger.info("CacheManager:getIdToken - Multiple id tokens found, clearing them");
+            idTokens.forEach(function (idToken) {
+                _this.removeIdToken(idToken.generateCredentialKey());
+            });
+            return null;
         }
         this.commonLogger.info("CacheManager:getIdToken - Returning id token");
         return idTokens[0];
@@ -2886,7 +2883,11 @@ var CacheManager = /** @class */ (function () {
             return null;
         }
         else if (numAccessTokens > 1) {
-            throw ClientAuthError.createMultipleMatchingTokensInCacheError();
+            this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them");
+            accessTokens.forEach(function (accessToken) {
+                _this.removeAccessToken(accessToken.generateCredentialKey());
+            });
+            return null;
         }
         this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
         return accessTokens[0];
@@ -5464,7 +5465,7 @@ var ResponseHandler = /** @class */ (function () {
                             }
                         }
                         // generate homeAccountId
-                        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
+                        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims);
                         if (!!authCodePayload && !!authCodePayload.state) {
                             requestStateObj = ProtocolUtils.parseRequestState(this.cryptoObj, authCodePayload.state);
                         }
@@ -5529,7 +5530,13 @@ var ResponseHandler = /** @class */ (function () {
         var cachedAccount;
         if (!StringUtils.isEmpty(serverTokenResponse.id_token) && !!idTokenObj) {
             cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
-            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
+            cachedAccount = AccountEntity.createAccount({
+                homeAccountId: this.homeAccountIdentifier,
+                idTokenClaims: idTokenObj.claims,
+                clientInfo: serverTokenResponse.client_info || Constants.EMPTY_STRING,
+                cloudGraphHostName: authCodePayload === null || authCodePayload === void 0 ? void 0 : authCodePayload.cloud_graph_host_name,
+                msGraphHost: authCodePayload === null || authCodePayload === void 0 ? void 0 : authCodePayload.msgraph_host,
+            }, authority);
         }
         // AccessToken
         var cachedAccessToken = null;
@@ -5561,29 +5568,6 @@ var ResponseHandler = /** @class */ (function () {
         }
         return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
     };
-    /**
-     * Generate Account
-     * @param serverTokenResponse
-     * @param idToken
-     * @param authority
-     */
-    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, authCodePayload) {
-        var authorityType = authority.authorityType;
-        var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : Constants.EMPTY_STRING;
-        var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : Constants.EMPTY_STRING;
-        // ADFS does not require client_info in the response
-        if (authorityType === exports.AuthorityType.Adfs) {
-            this.logger.verbose("Authority type is ADFS, creating ADFS account");
-            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
-        }
-        // This fallback applies to B2C as well as they fall under an AAD account type.
-        if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === "AAD") {
-            throw ClientAuthError.createClientInfoEmptyError();
-        }
-        return serverTokenResponse.client_info ?
-            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost) :
-            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
-    };
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
      *
@@ -7329,19 +7313,6 @@ var rawMetdataJSON = { "endpointMetadata": { "https://login.microsoftonline.com/
 var EndpointMetadata = rawMetdataJSON.endpointMetadata;
 var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Protocol modes supported by MSAL.
- */
-exports.ProtocolMode = void 0;
-(function (ProtocolMode) {
-    ProtocolMode["AAD"] = "AAD";
-    ProtocolMode["OIDC"] = "OIDC";
-})(exports.ProtocolMode || (exports.ProtocolMode = {}));
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.