@azure/msal-common 14.0.2 → 14.1.0-alpha.0

package/dist/client/SilentFlowClient.mjs

@@ -1,115 +1,139 @@
-/*! @azure/msal-common v14.0.2 2023-08-18 */
+/*! @azure/msal-common v14.1.0-alpha.0 2023-09-20 */
 'use strict';
 import { BaseClient } from './BaseClient.mjs';
-import { AuthToken } from '../account/AuthToken.mjs';
 import { TimeUtils } from '../utils/TimeUtils.mjs';
 import { RefreshTokenClient } from './RefreshTokenClient.mjs';
-import { ClientAuthError, ClientAuthErrorMessage } from '../error/ClientAuthError.mjs';
-import { ClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { ClientAuthError, createClientAuthError } from '../error/ClientAuthError.mjs';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { ResponseHandler } from '../response/ResponseHandler.mjs';
 import { CacheOutcome } from '../utils/Constants.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';
+import { extractTokenClaims, checkMaxAge } from '../account/AuthToken.mjs';
+import { tokenRefreshRequired, noAccountInSilentRequest, authTimeNotFound } from '../error/ClientAuthErrorCodes.mjs';
+import { tokenRequestEmpty } from '../error/ClientConfigurationErrorCodes.mjs';
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class SilentFlowClient extends BaseClient {
-    constructor(configuration, performanceClient) {
-        super(configuration, performanceClient);
-    }
-    /**
-     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
-     * the given token and returns the renewed token
-     * @param request
-     */
-    async acquireToken(request) {
-        try {
-            return await this.acquireCachedToken(request);
-        }
-        catch (e) {
-            if (e instanceof ClientAuthError &&
-                e.errorCode === ClientAuthErrorMessage.tokenRefreshRequired.code) {
-                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
-                return refreshTokenClient.acquireTokenByRefreshToken(request);
-            }
-            else {
-                throw e;
-            }
-        }
-    }
-    /**
-     * Retrieves token from cache or throws an error if it must be refreshed.
-     * @param request
-     */
-    async acquireCachedToken(request) {
-        // Cannot renew token if no request object is given.
-        if (!request) {
-            throw ClientConfigurationError.createEmptyTokenRequestError();
-        }
-        if (request.forceRefresh) {
-            // Must refresh due to present force_refresh flag.
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
-            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
-            throw ClientAuthError.createRefreshRequiredError();
-        }
-        else if (!this.config.cacheOptions.claimsBasedCachingEnabled &&
-            !StringUtils.isEmptyObj(request.claims)) {
-            // Must refresh due to request parameters.
-            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims-based caching is disabled and claims were requested.");
-            throw ClientAuthError.createRefreshRequiredError();
-        }
-        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
-        if (!request.account) {
-            throw ClientAuthError.createNoAccountInSilentRequestError();
-        }
-        const environment = request.authority || this.authority.getPreferredCache();
-        const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
-        if (!cacheRecord.accessToken) {
-            // Must refresh due to non-existent access_token.
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
-            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
-            throw ClientAuthError.createRefreshRequiredError();
-        }
-        else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
-            TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
-            // Must refresh due to expired access_token.
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
-            this.logger.info(`SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`);
-            throw ClientAuthError.createRefreshRequiredError();
-        }
-        else if (cacheRecord.accessToken.refreshOn &&
-            TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
-            // Must refresh due to the refresh_in value.
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);
-            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
-            throw ClientAuthError.createRefreshRequiredError();
-        }
-        if (this.config.serverTelemetryManager) {
-            this.config.serverTelemetryManager.incrementCacheHits();
-        }
-        return await this.generateResultFromCacheRecord(cacheRecord, request);
-    }
-    /**
-     * Helper function to build response object from the CacheRecord
-     * @param cacheRecord
-     */
-    async generateResultFromCacheRecord(cacheRecord, request) {
-        let idTokenObj;
-        if (cacheRecord.idToken) {
-            idTokenObj = new AuthToken(cacheRecord.idToken.secret, this.config.cryptoInterface);
-        }
-        // token max_age check
-        if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenObj?.claims.auth_time;
-            if (!authTime) {
-                throw ClientAuthError.createAuthTimeNotFoundError();
-            }
-            AuthToken.checkMaxAge(authTime, request.maxAge);
-        }
-        return await ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenObj);
-    }
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class SilentFlowClient extends BaseClient {
+    constructor(configuration, performanceClient) {
+        super(configuration, performanceClient);
+    }
+    /**
+     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
+     * the given token and returns the renewed token
+     * @param request
+     */
+    async acquireToken(request) {
+        try {
+            const [authResponse, cacheOutcome] = await this.acquireCachedToken(request);
+            // if the token is not expired but must be refreshed; get a new one in the background
+            if (cacheOutcome === CacheOutcome.PROACTIVELY_REFRESHED) {
+                this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.");
+                // refresh the access token in the background
+                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
+                refreshTokenClient
+                    .acquireTokenByRefreshToken(request)
+                    .catch(() => {
+                    // do nothing, this is running in the background and no action is to be taken upon success or failure
+                });
+            }
+            // return the cached token
+            return authResponse;
+        }
+        catch (e) {
+            if (e instanceof ClientAuthError &&
+                e.errorCode === tokenRefreshRequired) {
+                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
+                return refreshTokenClient.acquireTokenByRefreshToken(request);
+            }
+            else {
+                throw e;
+            }
+        }
+    }
+    /**
+     * Retrieves token from cache or throws an error if it must be refreshed.
+     * @param request
+     */
+    async acquireCachedToken(request) {
+        let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
+        // Cannot renew token if no request object is given.
+        if (!request) {
+            throw createClientConfigurationError(tokenRequestEmpty);
+        }
+        if (request.forceRefresh) {
+            // Must refresh due to present force_refresh flag.
+            lastCacheOutcome = CacheOutcome.FORCE_REFRESH_OR_CLAIMS;
+            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS);
+            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (!this.config.cacheOptions.claimsBasedCachingEnabled &&
+            !StringUtils.isEmptyObj(request.claims)) {
+            lastCacheOutcome = CacheOutcome.FORCE_REFRESH_OR_CLAIMS;
+            // Must refresh due to request parameters.
+            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims-based caching is disabled and claims were requested.");
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+        if (!request.account) {
+            throw createClientAuthError(noAccountInSilentRequest);
+        }
+        const environment = request.authority || this.authority.getPreferredCache();
+        const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
+        if (!cacheRecord.accessToken) {
+            // must refresh due to non-existent access_token
+            lastCacheOutcome = CacheOutcome.NO_CACHED_ACCESS_TOKEN;
+            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
+            TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
+            // must refresh due to the expires_in value
+            lastCacheOutcome = CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED;
+            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+            this.logger.info(`SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (cacheRecord.accessToken.refreshOn &&
+            TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
+            // must refresh (in the background) due to the refresh_in value
+            lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
+            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.PROACTIVELY_REFRESHED);
+            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
+            // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
+        }
+        if (this.config.serverTelemetryManager) {
+            this.config.serverTelemetryManager.incrementCacheHits();
+        }
+        return [
+            await this.generateResultFromCacheRecord(cacheRecord, request),
+            lastCacheOutcome,
+        ];
+    }
+    /**
+     * Helper function to build response object from the CacheRecord
+     * @param cacheRecord
+     */
+    async generateResultFromCacheRecord(cacheRecord, request) {
+        let idTokenClaims;
+        if (cacheRecord.idToken) {
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
+        }
+        // token max_age check
+        if (request.maxAge || request.maxAge === 0) {
+            const authTime = idTokenClaims?.auth_time;
+            if (!authTime) {
+                throw createClientAuthError(authTimeNotFound);
+            }
+            checkMaxAge(authTime, request.maxAge);
+        }
+        return await ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
+    }
 }
 
 export { SilentFlowClient };

package/dist/client/SilentFlowClient.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"SilentFlowClient.mjs","sources":["../../src/client/SilentFlowClient.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;AAGG;AAoBH;AACM,MAAO,gBAAiB,SAAQ,UAAU,CAAA;IAC5C,WACI,CAAA,aAAkC,EAClC,iBAAsC,EAAA;AAEtC,QAAA,KAAK,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;KAC3C;AAED;;;;AAIG;IACH,MAAM,YAAY,CACd,OAAgC,EAAA;QAEhC,IAAI;AACA,YAAA,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACjD,SAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,IACI,CAAC,YAAY,eAAe;gBAC5B,CAAC,CAAC,SAAS,KAAK,sBAAsB,CAAC,oBAAoB,CAAC,IAAI,EAClE;AACE,gBAAA,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAC7C,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,CACzB,CAAC;AACF,gBAAA,OAAO,kBAAkB,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACjE,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,CAAC,CAAC;AACX,aAAA;AACJ,SAAA;KACJ;AAED;;;AAGG;IACH,MAAM,kBAAkB,CACpB,OAAgC,EAAA;;QAGhC,IAAI,CAAC,OAAO,EAAE;AACV,YAAA,MAAM,wBAAwB,CAAC,4BAA4B,EAAE,CAAC;AACjE,SAAA;QAED,IAAI,OAAO,CAAC,YAAY,EAAE;;YAEtB,IAAI,CAAC,sBAAsB,EAAE,eAAe,CACxC,YAAY,CAAC,aAAa,CAC7B,CAAC;AACF,YAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,oFAAoF,CACvF,CAAC;AACF,YAAA,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;AACtD,SAAA;AAAM,aAAA,IACH,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,yBAAyB;YACnD,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EACzC;;AAEE,YAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,0HAA0H,CAC7H,CAAC;AACF,YAAA,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;AACtD,SAAA;;AAGD,QAAA,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;AAClB,YAAA,MAAM,eAAe,CAAC,mCAAmC,EAAE,CAAC;AAC/D,SAAA;AAED,QAAA,MAAM,WAAW,GACb,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;AAE5D,QAAA,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,CACjD,OAAO,CAAC,OAAO,EACf,OAAO,EACP,WAAW,CACd,CAAC;AAEF,QAAA,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;;YAE1B,IAAI,CAAC,sBAAsB,EAAE,eAAe,CACxC,YAAY,CAAC,sBAAsB,CACtC,CAAC;AACF,YAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,gGAAgG,CACnG,CAAC;AACF,YAAA,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;AACtD,SAAA;aAAM,IACH,SAAS,CAAC,kBAAkB,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC;AAC9D,YAAA,SAAS,CAAC,cAAc,CACpB,WAAW,CAAC,WAAW,CAAC,SAAS,EACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CACtD,EACH;;YAEE,IAAI,CAAC,sBAAsB,EAAE,eAAe,CACxC,YAAY,CAAC,2BAA2B,CAC3C,CAAC;AACF,YAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,CAA8F,2FAAA,EAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAA,SAAA,CAAW,CAC/J,CAAC;AACF,YAAA,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;AACtD,SAAA;AAAM,aAAA,IACH,WAAW,CAAC,WAAW,CAAC,SAAS;YACjC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,EAChE;;YAEE,IAAI,CAAC,sBAAsB,EAAE,eAAe,CACxC,YAAY,CAAC,2BAA2B,CAC3C,CAAC;AACF,YAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,oGAAoG,CACvG,CAAC;AACF,YAAA,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;AACtD,SAAA;AAED,QAAA,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;AACpC,YAAA,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,CAAC;AAC3D,SAAA;QAED,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;KACzE;AAED;;;AAGG;AACK,IAAA,MAAM,6BAA6B,CACvC,WAAwB,EACxB,OAAgC,EAAA;AAEhC,QAAA,IAAI,UAAiC,CAAC;QACtC,IAAI,WAAW,CAAC,OAAO,EAAE;AACrB,YAAA,UAAU,GAAG,IAAI,SAAS,CACtB,WAAW,CAAC,OAAO,CAAC,MAAM,EAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,CAC9B,CAAC;AACL,SAAA;;QAGD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;AACxC,YAAA,MAAM,QAAQ,GAAG,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE;AACX,gBAAA,MAAM,eAAe,CAAC,2BAA2B,EAAE,CAAC;AACvD,aAAA;YAED,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACnD,SAAA;QAED,OAAO,MAAM,eAAe,CAAC,4BAA4B,CACrD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd,WAAW,EACX,IAAI,EACJ,OAAO,EACP,UAAU,CACb,CAAC;KACL;AACJ;;;;"}
+{"version":3,"file":"SilentFlowClient.mjs","sources":["../../src/client/SilentFlowClient.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AAiCO;AACe,MAAA,gBACL,SAAA,UAAA,CAAuB;AA4CpC,IAAA,WAAA,CAAA,aAAA,EAAA,iBAAA,EAAA;;;AAGG;AACG;AA8GN;;;AAGG,IAAA,MAAA,YAAA,CAAA,OAAA,EAAA;YACW;AAiCjB,YAAA,MAAA,CAAA,YAAA,EAAA,YAAA,CAAA,GAAA,MAAA,IAAA,CAAA,kBAAA,CAAA,OAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/config/AppTokenProvider.d.ts

@@ -1,39 +1,39 @@
-/**
- * Extensibility interface, which allows the app developer to return a token, based on the passed-in parameters, instead of fetching tokens from
- * the Identity Provider (AAD).
- * Developers need to construct and return an AppTokenProviderResult object back to MSAL. MSAL will cache the token response
- * in the same way it would do if the result were comming from AAD.
- * This extensibility point is only defined for the client_credential flow, i.e. acquireTokenByClientCredential and
- * meant for Azure SDK to enhance Managed Identity support.
- */
-export interface IAppTokenProvider {
-    (appTokenProviderParameters: AppTokenProviderParameters): Promise<AppTokenProviderResult>;
-}
-/**
- * Input object for the IAppTokenProvider extensiblity. MSAL will create this object, which can be used
- * to help create an AppTokenProviderResult.
- *
- * - correlationId           - the correlation Id associated with the request
- * - tenantId                - the tenant Id for which the token must be provided
- * - scopes                  - the scopes for which the token must be provided
- * - claims                  - any extra claims that the token must satisfy
- */
-export type AppTokenProviderParameters = {
-    readonly correlationId?: string;
-    readonly tenantId: string;
-    readonly scopes: Array<string>;
-    readonly claims?: string;
-};
-/**
- * Output object for IAppTokenProvider extensiblity.
- *
- * - accessToken            - the actual access token, typically in JWT format, that satisfies the request data AppTokenProviderParameters
- * - expiresInSeconds       - how long the tokens has before expiry, in seconds. Similar to the "expires_in" field in an AAD token response.
- * - refreshInSeconds       - how long the token has before it should be proactively refreshed. Similar to the "refresh_in" field in an AAD token response.
- */
-export type AppTokenProviderResult = {
-    accessToken: string;
-    expiresInSeconds: number;
-    refreshInSeconds?: number;
-};
+/**
+ * Extensibility interface, which allows the app developer to return a token, based on the passed-in parameters, instead of fetching tokens from
+ * the Identity Provider (AAD).
+ * Developers need to construct and return an AppTokenProviderResult object back to MSAL. MSAL will cache the token response
+ * in the same way it would do if the result were comming from AAD.
+ * This extensibility point is only defined for the client_credential flow, i.e. acquireTokenByClientCredential and
+ * meant for Azure SDK to enhance Managed Identity support.
+ */
+export interface IAppTokenProvider {
+    (appTokenProviderParameters: AppTokenProviderParameters): Promise<AppTokenProviderResult>;
+}
+/**
+ * Input object for the IAppTokenProvider extensiblity. MSAL will create this object, which can be used
+ * to help create an AppTokenProviderResult.
+ *
+ * - correlationId           - the correlation Id associated with the request
+ * - tenantId                - the tenant Id for which the token must be provided
+ * - scopes                  - the scopes for which the token must be provided
+ * - claims                  - any extra claims that the token must satisfy
+ */
+export type AppTokenProviderParameters = {
+    readonly correlationId?: string;
+    readonly tenantId: string;
+    readonly scopes: Array<string>;
+    readonly claims?: string;
+};
+/**
+ * Output object for IAppTokenProvider extensiblity.
+ *
+ * - accessToken            - the actual access token, typically in JWT format, that satisfies the request data AppTokenProviderParameters
+ * - expiresInSeconds       - how long the tokens has before expiry, in seconds. Similar to the "expires_in" field in an AAD token response.
+ * - refreshInSeconds       - how long the token has before it should be proactively refreshed. Similar to the "refresh_in" field in an AAD token response.
+ */
+export type AppTokenProviderResult = {
+    accessToken: string;
+    expiresInSeconds: number;
+    refreshInSeconds?: number;
+};
 //# sourceMappingURL=AppTokenProvider.d.ts.map