@azure/msal-common 14.0.2 → 14.0.3

package/src/error/ClientConfigurationError.ts

@@ -0,0 +1,396 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { ClientAuthError } from "./ClientAuthError";
+
+/**
+ * ClientConfigurationErrorMessage class containing string constants used by error codes and messages.
+ */
+export const ClientConfigurationErrorMessage = {
+    redirectUriNotSet: {
+        code: "redirect_uri_empty",
+        desc: "A redirect URI is required for all calls, and none has been set.",
+    },
+    postLogoutUriNotSet: {
+        code: "post_logout_uri_empty",
+        desc: "A post logout redirect has not been set.",
+    },
+    claimsRequestParsingError: {
+        code: "claims_request_parsing_error",
+        desc: "Could not parse the given claims request object.",
+    },
+    authorityUriInsecure: {
+        code: "authority_uri_insecure",
+        desc: "Authority URIs must use https.  Please see here for valid authority configuration options: https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-initializing-client-applications#configuration-options",
+    },
+    urlParseError: {
+        code: "url_parse_error",
+        desc: "URL could not be parsed into appropriate segments.",
+    },
+    urlEmptyError: {
+        code: "empty_url_error",
+        desc: "URL was empty or null.",
+    },
+    emptyScopesError: {
+        code: "empty_input_scopes_error",
+        desc: "Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",
+    },
+    nonArrayScopesError: {
+        code: "nonarray_input_scopes_error",
+        desc: "Scopes cannot be passed as non-array.",
+    },
+    clientIdSingleScopeError: {
+        code: "clientid_input_scopes_error",
+        desc: "Client ID can only be provided as a single scope.",
+    },
+    invalidPrompt: {
+        code: "invalid_prompt_value",
+        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create', 'none' and 'no_session'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
+    },
+    invalidClaimsRequest: {
+        code: "invalid_claims",
+        desc: "Given claims parameter must be a stringified JSON object.",
+    },
+    tokenRequestEmptyError: {
+        code: "token_request_empty",
+        desc: "Token request was empty and not found in cache.",
+    },
+    logoutRequestEmptyError: {
+        code: "logout_request_empty",
+        desc: "The logout request was null or undefined.",
+    },
+    invalidCodeChallengeMethod: {
+        code: "invalid_code_challenge_method",
+        desc: 'code_challenge_method passed is invalid. Valid values are "plain" and "S256".',
+    },
+    invalidCodeChallengeParams: {
+        code: "pkce_params_missing",
+        desc: "Both params: code_challenge and code_challenge_method are to be passed if to be sent in the request",
+    },
+    invalidCloudDiscoveryMetadata: {
+        code: "invalid_cloud_discovery_metadata",
+        desc: "Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields",
+    },
+    invalidAuthorityMetadata: {
+        code: "invalid_authority_metadata",
+        desc: "Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields.",
+    },
+    untrustedAuthority: {
+        code: "untrusted_authority",
+        desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.",
+    },
+    invalidAzureCloudInstance: {
+        code: "invalid_azure_cloud_instance",
+        desc: "Invalid AzureCloudInstance provided. Please refer MSAL JS docs: aks.ms/msaljs/azure_cloud_instance for valid values",
+    },
+    missingSshJwk: {
+        code: "missing_ssh_jwk",
+        desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme.",
+    },
+    missingSshKid: {
+        code: "missing_ssh_kid",
+        desc: "Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme.",
+    },
+    missingNonceAuthenticationHeader: {
+        code: "missing_nonce_authentication_header",
+        desc: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce.",
+    },
+    invalidAuthenticationHeader: {
+        code: "invalid_authentication_header",
+        desc: "Invalid authentication header provided",
+    },
+    cannotSetOIDCOptions: {
+        code: "cannot_set_OIDCOptions",
+        desc: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
+    },
+    cannotAllowNativeBroker: {
+        code: "cannot_allow_native_broker",
+        desc: "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
+    },
+    authorityMismatch: {
+        code: "authority_mismatch",
+        desc: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+    },
+};
+
+/**
+ * Error thrown when there is an error in configuration of the MSAL.js library.
+ */
+export class ClientConfigurationError extends ClientAuthError {
+    constructor(errorCode: string, errorMessage?: string) {
+        super(errorCode, errorMessage);
+        this.name = "ClientConfigurationError";
+        Object.setPrototypeOf(this, ClientConfigurationError.prototype);
+    }
+
+    /**
+     * Creates an error thrown when the redirect uri is empty (not set by caller)
+     */
+    static createRedirectUriEmptyError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.redirectUriNotSet.code,
+            ClientConfigurationErrorMessage.redirectUriNotSet.desc
+        );
+    }
+
+    /**
+     * Creates an error thrown when the post-logout redirect uri is empty (not set by caller)
+     */
+    static createPostLogoutRedirectUriEmptyError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.postLogoutUriNotSet.code,
+            ClientConfigurationErrorMessage.postLogoutUriNotSet.desc
+        );
+    }
+
+    /**
+     * Creates an error thrown when the claims request could not be successfully parsed
+     */
+    static createClaimsRequestParsingError(
+        claimsRequestParseError: string
+    ): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.claimsRequestParsingError.code,
+            `${ClientConfigurationErrorMessage.claimsRequestParsingError.desc} Given value: ${claimsRequestParseError}`
+        );
+    }
+
+    /**
+     * Creates an error thrown if authority uri is given an insecure protocol.
+     * @param urlString
+     */
+    static createInsecureAuthorityUriError(
+        urlString: string
+    ): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.authorityUriInsecure.code,
+            `${ClientConfigurationErrorMessage.authorityUriInsecure.desc} Given URI: ${urlString}`
+        );
+    }
+
+    /**
+     * Creates an error thrown if URL string does not parse into separate segments.
+     * @param urlString
+     */
+    static createUrlParseError(
+        urlParseError: string
+    ): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.urlParseError.code,
+            `${ClientConfigurationErrorMessage.urlParseError.desc} Given Error: ${urlParseError}`
+        );
+    }
+
+    /**
+     * Creates an error thrown if URL string is empty or null.
+     * @param urlString
+     */
+    static createUrlEmptyError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.urlEmptyError.code,
+            ClientConfigurationErrorMessage.urlEmptyError.desc
+        );
+    }
+
+    /**
+     * Error thrown when scopes are empty.
+     * @param scopesValue
+     */
+    static createEmptyScopesArrayError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.emptyScopesError.code,
+            `${ClientConfigurationErrorMessage.emptyScopesError.desc}`
+        );
+    }
+
+    /**
+     * Error thrown when client id scope is not provided as single scope.
+     * @param inputScopes
+     */
+    static createClientIdSingleScopeError(
+        inputScopes: Array<string>
+    ): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.clientIdSingleScopeError.code,
+            `${ClientConfigurationErrorMessage.clientIdSingleScopeError.desc} Given Scopes: ${inputScopes}`
+        );
+    }
+
+    /**
+     * Error thrown when prompt is not an allowed type.
+     * @param promptValue
+     */
+    static createInvalidPromptError(
+        promptValue: string
+    ): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.invalidPrompt.code,
+            `${ClientConfigurationErrorMessage.invalidPrompt.desc} Given value: ${promptValue}`
+        );
+    }
+
+    /**
+     * Creates error thrown when claims parameter is not a stringified JSON object
+     */
+    static createInvalidClaimsRequestError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.invalidClaimsRequest.code,
+            ClientConfigurationErrorMessage.invalidClaimsRequest.desc
+        );
+    }
+
+    /**
+     * Throws error when token request is empty and nothing cached in storage.
+     */
+    static createEmptyLogoutRequestError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.logoutRequestEmptyError.code,
+            ClientConfigurationErrorMessage.logoutRequestEmptyError.desc
+        );
+    }
+
+    /**
+     * Throws error when token request is empty and nothing cached in storage.
+     */
+    static createEmptyTokenRequestError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.tokenRequestEmptyError.code,
+            ClientConfigurationErrorMessage.tokenRequestEmptyError.desc
+        );
+    }
+
+    /**
+     * Throws error when an invalid code_challenge_method is passed by the user
+     */
+    static createInvalidCodeChallengeMethodError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.invalidCodeChallengeMethod.code,
+            ClientConfigurationErrorMessage.invalidCodeChallengeMethod.desc
+        );
+    }
+
+    /**
+     * Throws error when both params: code_challenge and code_challenge_method are not passed together
+     */
+    static createInvalidCodeChallengeParamsError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.invalidCodeChallengeParams.code,
+            ClientConfigurationErrorMessage.invalidCodeChallengeParams.desc
+        );
+    }
+
+    /**
+     * Throws an error when the user passes invalid cloudDiscoveryMetadata
+     */
+    static createInvalidCloudDiscoveryMetadataError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.invalidCloudDiscoveryMetadata.code,
+            ClientConfigurationErrorMessage.invalidCloudDiscoveryMetadata.desc
+        );
+    }
+
+    /**
+     * Throws an error when the user passes invalid cloudDiscoveryMetadata
+     */
+    static createInvalidAuthorityMetadataError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.invalidAuthorityMetadata.code,
+            ClientConfigurationErrorMessage.invalidAuthorityMetadata.desc
+        );
+    }
+
+    /**
+     * Throws error when provided authority is not a member of the trusted host list
+     */
+    static createUntrustedAuthorityError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.untrustedAuthority.code,
+            ClientConfigurationErrorMessage.untrustedAuthority.desc
+        );
+    }
+
+    /**
+     * Throws error when the AzureCloudInstance is set to an invalid value
+     */
+    static createInvalidAzureCloudInstanceError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.invalidAzureCloudInstance.code,
+            ClientConfigurationErrorMessage.invalidAzureCloudInstance.desc
+        );
+    }
+
+    /**
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
+     */
+    static createMissingSshJwkError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.missingSshJwk.code,
+            ClientConfigurationErrorMessage.missingSshJwk.desc
+        );
+    }
+
+    /**
+     * Throws an error when the authentication scheme is set to SSH but the SSH public key ID is omitted from the request
+     */
+    static createMissingSshKidError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.missingSshKid.code,
+            ClientConfigurationErrorMessage.missingSshKid.desc
+        );
+    }
+
+    /**
+     * Throws error when provided headers don't contain a header that a server nonce can be extracted from
+     */
+    static createMissingNonceAuthenticationHeadersError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.code,
+            ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.desc
+        );
+    }
+
+    /**
+     * Throws error when a provided header is invalid in any way
+     */
+    static createInvalidAuthenticationHeaderError(
+        invalidHeaderName: string,
+        details: string
+    ): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.invalidAuthenticationHeader.code,
+            `${ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc}. Invalid header: ${invalidHeaderName}. Details: ${details}`
+        );
+    }
+
+    /**
+     * Throws error when provided non-default OIDCOptions when not in OIDC protocol mode
+     */
+    static createCannotSetOIDCOptionsError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.cannotSetOIDCOptions.code,
+            ClientConfigurationErrorMessage.cannotSetOIDCOptions.desc
+        );
+    }
+
+    /**
+     * Throws error when allowNativeBroker is set to true when not in AAD protocol mode
+     */
+    static createCannotAllowNativeBrokerError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.cannotAllowNativeBroker.code,
+            ClientConfigurationErrorMessage.cannotAllowNativeBroker.desc
+        );
+    }
+
+    /**
+     * Create an error when the authority provided in request does not match authority provided in account or MSAL.js configuration.
+     */
+    static createAuthorityMismatchError(): ClientConfigurationError {
+        return new ClientConfigurationError(
+            ClientConfigurationErrorMessage.authorityMismatch.code,
+            ClientConfigurationErrorMessage.authorityMismatch.desc
+        );
+    }
+}

package/src/error/InteractionRequiredAuthError.ts

@@ -0,0 +1,134 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { Constants } from "../utils/Constants";
+import { AuthError } from "./AuthError";
+
+/**
+ * InteractionRequiredServerErrorMessage contains string constants used by error codes and messages returned by the server indicating interaction is required
+ */
+export const InteractionRequiredServerErrorMessage = [
+    "interaction_required",
+    "consent_required",
+    "login_required",
+];
+
+export const InteractionRequiredAuthSubErrorMessage = [
+    "message_only",
+    "additional_action",
+    "basic_action",
+    "user_password_expired",
+    "consent_required",
+];
+
+/**
+ * Interaction required errors defined by the SDK
+ */
+export const InteractionRequiredAuthErrorMessage = {
+    noTokensFoundError: {
+        code: "no_tokens_found",
+        desc: "No refresh token found in the cache. Please sign-in.",
+    },
+    native_account_unavailable: {
+        code: "native_account_unavailable",
+        desc: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
+    },
+};
+
+/**
+ * Error thrown when user interaction is required.
+ */
+export class InteractionRequiredAuthError extends AuthError {
+    /**
+     * The time the error occured at
+     */
+    timestamp: string;
+
+    /**
+     * TraceId associated with the error
+     */
+    traceId: string;
+
+    /**
+     * https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-common/docs/claims-challenge.md
+     *
+     * A string with extra claims needed for the token request to succeed
+     * web site: redirect the user to the authorization page and set the extra claims
+     * web api: include the claims in the WWW-Authenticate header that are sent back to the client so that it knows to request a token with the extra claims
+     * desktop application or browser context: include the claims when acquiring the token interactively
+     * app to app context (client_credentials): include the claims in the AcquireTokenByClientCredential request
+     */
+    claims: string;
+
+    constructor(
+        errorCode?: string,
+        errorMessage?: string,
+        subError?: string,
+        timestamp?: string,
+        traceId?: string,
+        correlationId?: string,
+        claims?: string
+    ) {
+        super(errorCode, errorMessage, subError);
+        Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
+
+        this.timestamp = timestamp || Constants.EMPTY_STRING;
+        this.traceId = traceId || Constants.EMPTY_STRING;
+        this.correlationId = correlationId || Constants.EMPTY_STRING;
+        this.claims = claims || Constants.EMPTY_STRING;
+        this.name = "InteractionRequiredAuthError";
+    }
+
+    /**
+     * Helper function used to determine if an error thrown by the server requires interaction to resolve
+     * @param errorCode
+     * @param errorString
+     * @param subError
+     */
+    static isInteractionRequiredError(
+        errorCode?: string,
+        errorString?: string,
+        subError?: string
+    ): boolean {
+        const isInteractionRequiredErrorCode =
+            !!errorCode &&
+            InteractionRequiredServerErrorMessage.indexOf(errorCode) > -1;
+        const isInteractionRequiredSubError =
+            !!subError &&
+            InteractionRequiredAuthSubErrorMessage.indexOf(subError) > -1;
+        const isInteractionRequiredErrorDesc =
+            !!errorString &&
+            InteractionRequiredServerErrorMessage.some((irErrorCode) => {
+                return errorString.indexOf(irErrorCode) > -1;
+            });
+
+        return (
+            isInteractionRequiredErrorCode ||
+            isInteractionRequiredErrorDesc ||
+            isInteractionRequiredSubError
+        );
+    }
+
+    /**
+     * Creates an error thrown when the authorization code required for a token request is null or empty.
+     */
+    static createNoTokensFoundError(): InteractionRequiredAuthError {
+        return new InteractionRequiredAuthError(
+            InteractionRequiredAuthErrorMessage.noTokensFoundError.code,
+            InteractionRequiredAuthErrorMessage.noTokensFoundError.desc
+        );
+    }
+
+    /**
+     * Creates an error thrown when the native broker returns ACCOUNT_UNAVAILABLE status, indicating that the account was removed and interactive sign-in is required
+     * @returns
+     */
+    static createNativeAccountUnavailableError(): InteractionRequiredAuthError {
+        return new InteractionRequiredAuthError(
+            InteractionRequiredAuthErrorMessage.native_account_unavailable.code,
+            InteractionRequiredAuthErrorMessage.native_account_unavailable.desc
+        );
+    }
+}

package/src/error/JoseHeaderError.ts

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "./AuthError";
+
+/**
+ * ClientAuthErrorMessage class containing string constants used by error codes and messages.
+ */
+export const JoseHeaderErrorMessage = {
+    missingKidError: {
+        code: "missing_kid_error",
+        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided.",
+    },
+    missingAlgError: {
+        code: "missing_alg_error",
+        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided.",
+    },
+};
+
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+export class JoseHeaderError extends AuthError {
+    constructor(errorCode: string, errorMessage?: string) {
+        super(errorCode, errorMessage);
+        this.name = "JoseHeaderError";
+
+        Object.setPrototypeOf(this, JoseHeaderError.prototype);
+    }
+
+    /**
+     * Creates an error thrown when keyId isn't set on JOSE header.
+     */
+    static createMissingKidError(): JoseHeaderError {
+        return new JoseHeaderError(
+            JoseHeaderErrorMessage.missingKidError.code,
+            JoseHeaderErrorMessage.missingKidError.desc
+        );
+    }
+
+    /**
+     * Creates an error thrown when algorithm isn't set on JOSE header.
+     */
+    static createMissingAlgError(): JoseHeaderError {
+        return new JoseHeaderError(
+            JoseHeaderErrorMessage.missingAlgError.code,
+            JoseHeaderErrorMessage.missingAlgError.desc
+        );
+    }
+}

package/src/error/ServerError.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "./AuthError";
+
+/**
+ * Error thrown when there is an error with the server code, for example, unavailability.
+ */
+export class ServerError extends AuthError {
+    constructor(errorCode?: string, errorMessage?: string, subError?: string) {
+        super(errorCode, errorMessage, subError);
+        this.name = "ServerError";
+
+        Object.setPrototypeOf(this, ServerError.prototype);
+    }
+}