@azure/msal-common 14.0.2 → 14.1.0-alpha.0

package/src/client/BaseClient.ts

@@ -0,0 +1,208 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    ClientConfiguration,
+    buildClientConfiguration,
+    CommonClientConfiguration,
+} from "../config/ClientConfiguration";
+import { INetworkModule } from "../network/INetworkModule";
+import { NetworkManager, NetworkResponse } from "../network/NetworkManager";
+import { ICrypto } from "../crypto/ICrypto";
+import { Authority } from "../authority/Authority";
+import { Logger } from "../logger/Logger";
+import { Constants, HeaderNames } from "../utils/Constants";
+import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse";
+import { CacheManager } from "../cache/CacheManager";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager";
+import { RequestThumbprint } from "../network/RequestThumbprint";
+import { version, name } from "../packageMetadata";
+import {
+    createClientAuthError,
+    ClientAuthErrorCodes,
+} from "../error/ClientAuthError";
+import { CcsCredential, CcsCredentialType } from "../account/CcsCredential";
+import { buildClientInfoFromHomeAccountId } from "../account/ClientInfo";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
+import { RequestParameterBuilder } from "../request/RequestParameterBuilder";
+import { BaseAuthRequest } from "../request/BaseAuthRequest";
+import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
+
+/**
+ * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
+ * @internal
+ */
+export abstract class BaseClient {
+    // Logger object
+    public logger: Logger;
+
+    // Application config
+    protected config: CommonClientConfiguration;
+
+    // Crypto Interface
+    protected cryptoUtils: ICrypto;
+
+    // Storage Interface
+    protected cacheManager: CacheManager;
+
+    // Network Interface
+    protected networkClient: INetworkModule;
+
+    // Server Telemetry Manager
+    protected serverTelemetryManager: ServerTelemetryManager | null;
+
+    // Network Manager
+    protected networkManager: NetworkManager;
+
+    // Default authority object
+    public authority: Authority;
+
+    // Performance telemetry client
+    protected performanceClient?: IPerformanceClient;
+
+    protected constructor(
+        configuration: ClientConfiguration,
+        performanceClient?: IPerformanceClient
+    ) {
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+
+        // Set the NetworkManager
+        this.networkManager = new NetworkManager(
+            this.networkClient,
+            this.cacheManager
+        );
+
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
+    }
+
+    /**
+     * Creates default headers for requests to token endpoint
+     */
+    protected createTokenRequestHeaders(
+        ccsCred?: CcsCredential
+    ): Record<string, string> {
+        const headers: Record<string, string> = {};
+        headers[HeaderNames.CONTENT_TYPE] = Constants.URL_FORM_CONTENT_TYPE;
+        if (!this.config.systemOptions.preventCorsPreflight && ccsCred) {
+            switch (ccsCred.type) {
+                case CcsCredentialType.HOME_ACCOUNT_ID:
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(
+                            ccsCred.credential
+                        );
+                        headers[
+                            HeaderNames.CCS_HEADER
+                        ] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
+                    } catch (e) {
+                        this.logger.verbose(
+                            "Could not parse home account ID for CCS Header: " +
+                                e
+                        );
+                    }
+                    break;
+                case CcsCredentialType.UPN:
+                    headers[
+                        HeaderNames.CCS_HEADER
+                    ] = `UPN: ${ccsCred.credential}`;
+                    break;
+            }
+        }
+        return headers;
+    }
+
+    /**
+     * Http post to token endpoint
+     * @param tokenEndpoint
+     * @param queryString
+     * @param headers
+     * @param thumbprint
+     */
+    protected async executePostToTokenEndpoint(
+        tokenEndpoint: string,
+        queryString: string,
+        headers: Record<string, string>,
+        thumbprint: RequestThumbprint,
+        correlationId: string
+    ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
+        this.performanceClient?.addQueueMeasurement(
+            PerformanceEvents.BaseClientExecutePostToTokenEndpoint,
+            correlationId
+        );
+        const response =
+            await this.networkManager.sendPostRequest<ServerAuthorizationTokenResponse>(
+                thumbprint,
+                tokenEndpoint,
+                { body: queryString, headers: headers }
+            );
+        this.performanceClient?.addFields(
+            {
+                refreshTokenSize: response.body.refresh_token?.length || 0,
+                httpVerToken:
+                    response.headers?.[HeaderNames.X_MS_HTTP_VERSION] || "",
+            },
+            correlationId
+        );
+
+        if (
+            this.config.serverTelemetryManager &&
+            response.status < 500 &&
+            response.status !== 429
+        ) {
+            // Telemetry data successfully logged by server, clear Telemetry cache
+            this.config.serverTelemetryManager.clearTelemetryCache();
+        }
+
+        return response;
+    }
+
+    /**
+     * Updates the authority object of the client. Endpoint discovery must be completed.
+     * @param updatedAuthority
+     */
+    updateAuthority(updatedAuthority: Authority): void {
+        if (!updatedAuthority.discoveryComplete()) {
+            throw createClientAuthError(
+                ClientAuthErrorCodes.endpointResolutionError
+            );
+        }
+        this.authority = updatedAuthority;
+    }
+
+    /**
+     * Creates query string for the /token request
+     * @param request
+     */
+    createTokenQueryParameters(request: BaseAuthRequest): string {
+        const parameterBuilder = new RequestParameterBuilder();
+
+        if (request.tokenQueryParameters) {
+            parameterBuilder.addExtraQueryParameters(
+                request.tokenQueryParameters
+            );
+        }
+
+        return parameterBuilder.createQueryString();
+    }
+}

package/src/client/RefreshTokenClient.ts

@@ -0,0 +1,399 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    ClientConfiguration,
+    isOidcProtocolMode,
+} from "../config/ClientConfiguration";
+import { BaseClient } from "./BaseClient";
+import { CommonRefreshTokenRequest } from "../request/CommonRefreshTokenRequest";
+import { Authority } from "../authority/Authority";
+import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse";
+import { RequestParameterBuilder } from "../request/RequestParameterBuilder";
+import {
+    GrantType,
+    AuthenticationScheme,
+    Errors,
+    HeaderNames,
+} from "../utils/Constants";
+import { ResponseHandler } from "../response/ResponseHandler";
+import { AuthenticationResult } from "../response/AuthenticationResult";
+import { PopTokenGenerator } from "../crypto/PopTokenGenerator";
+import { StringUtils } from "../utils/StringUtils";
+import { RequestThumbprint } from "../network/RequestThumbprint";
+import { NetworkResponse } from "../network/NetworkManager";
+import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest";
+import {
+    createClientConfigurationError,
+    ClientConfigurationErrorCodes,
+} from "../error/ClientConfigurationError";
+import {
+    createClientAuthError,
+    ClientAuthErrorCodes,
+} from "../error/ClientAuthError";
+import { ServerError } from "../error/ServerError";
+import { TimeUtils } from "../utils/TimeUtils";
+import { UrlString } from "../url/UrlString";
+import { CcsCredentialType } from "../account/CcsCredential";
+import { buildClientInfoFromHomeAccountId } from "../account/ClientInfo";
+import {
+    InteractionRequiredAuthError,
+    InteractionRequiredAuthErrorCodes,
+    createInteractionRequiredAuthError,
+} from "../error/InteractionRequiredAuthError";
+import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
+import { invokeAsync } from "../utils/FunctionWrappers";
+/**
+ * OAuth2.0 refresh token client
+ * @internal
+ */
+export class RefreshTokenClient extends BaseClient {
+    constructor(
+        configuration: ClientConfiguration,
+        performanceClient?: IPerformanceClient
+    ) {
+        super(configuration, performanceClient);
+    }
+    public async acquireToken(
+        request: CommonRefreshTokenRequest
+    ): Promise<AuthenticationResult> {
+        this.performanceClient?.addQueueMeasurement(
+            PerformanceEvents.RefreshTokenClientAcquireToken,
+            request.correlationId
+        );
+
+        const reqTimestamp = TimeUtils.nowSeconds();
+        const response = await invokeAsync(
+            this.executeTokenRequest.bind(this),
+            PerformanceEvents.RefreshTokenClientExecuteTokenRequest,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(request, this.authority);
+
+        // Retrieve requestId from response headers
+        const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
+        const responseHandler = new ResponseHandler(
+            this.config.authOptions.clientId,
+            this.cacheManager,
+            this.cryptoUtils,
+            this.logger,
+            this.config.serializableCache,
+            this.config.persistencePlugin
+        );
+        responseHandler.validateTokenResponse(response.body);
+
+        return invokeAsync(
+            responseHandler.handleServerTokenResponse.bind(responseHandler),
+            PerformanceEvents.HandleServerTokenResponse,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(
+            response.body,
+            this.authority,
+            reqTimestamp,
+            request,
+            undefined,
+            undefined,
+            true,
+            request.forceCache,
+            requestId
+        );
+    }
+
+    /**
+     * Gets cached refresh token and attaches to request, then calls acquireToken API
+     * @param request
+     */
+    public async acquireTokenByRefreshToken(
+        request: CommonSilentFlowRequest
+    ): Promise<AuthenticationResult> {
+        // Cannot renew token if no request object is given.
+        if (!request) {
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.tokenRequestEmpty
+            );
+        }
+
+        this.performanceClient?.addQueueMeasurement(
+            PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken,
+            request.correlationId
+        );
+
+        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+        if (!request.account) {
+            throw createClientAuthError(
+                ClientAuthErrorCodes.noAccountInSilentRequest
+            );
+        }
+
+        // try checking if FOCI is enabled for the given application
+        const isFOCI = this.cacheManager.isAppMetadataFOCI(
+            request.account.environment
+        );
+
+        // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
+        if (isFOCI) {
+            try {
+                return invokeAsync(
+                    this.acquireTokenWithCachedRefreshToken.bind(this),
+                    PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(request, true);
+            } catch (e) {
+                const noFamilyRTInCache =
+                    e instanceof InteractionRequiredAuthError &&
+                    e.errorCode ===
+                        InteractionRequiredAuthErrorCodes.noTokensFound;
+                const clientMismatchErrorWithFamilyRT =
+                    e instanceof ServerError &&
+                    e.errorCode === Errors.INVALID_GRANT_ERROR &&
+                    e.subError === Errors.CLIENT_MISMATCH_ERROR;
+
+                // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
+                if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
+                    return invokeAsync(
+                        this.acquireTokenWithCachedRefreshToken.bind(this),
+                        PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken,
+                        this.logger,
+                        this.performanceClient,
+                        request.correlationId
+                    )(request, false);
+                    // throw in all other cases
+                } else {
+                    throw e;
+                }
+            }
+        }
+        // fall back to application refresh token acquisition
+        return invokeAsync(
+            this.acquireTokenWithCachedRefreshToken.bind(this),
+            PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(request, false);
+    }
+
+    /**
+     * makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
+     * @param request
+     */
+    private async acquireTokenWithCachedRefreshToken(
+        request: CommonSilentFlowRequest,
+        foci: boolean
+    ) {
+        this.performanceClient?.addQueueMeasurement(
+            PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken,
+            request.correlationId
+        );
+
+        // fetches family RT or application RT based on FOCI value
+        const refreshToken = this.cacheManager.getRefreshToken(
+            request.account,
+            foci
+        );
+
+        if (!refreshToken) {
+            throw createInteractionRequiredAuthError(
+                InteractionRequiredAuthErrorCodes.noTokensFound
+            );
+        }
+        // attach cached RT size to the current measurement
+
+        const refreshTokenRequest: CommonRefreshTokenRequest = {
+            ...request,
+            refreshToken: refreshToken.secret,
+            authenticationScheme:
+                request.authenticationScheme || AuthenticationScheme.BEARER,
+            ccsCredential: {
+                credential: request.account.homeAccountId,
+                type: CcsCredentialType.HOME_ACCOUNT_ID,
+            },
+        };
+
+        return invokeAsync(
+            this.acquireToken.bind(this),
+            PerformanceEvents.RefreshTokenClientAcquireToken,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(refreshTokenRequest);
+    }
+
+    /**
+     * Constructs the network message and makes a NW call to the underlying secure token service
+     * @param request
+     * @param authority
+     */
+    private async executeTokenRequest(
+        request: CommonRefreshTokenRequest,
+        authority: Authority
+    ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
+        this.performanceClient?.addQueueMeasurement(
+            PerformanceEvents.RefreshTokenClientExecuteTokenRequest,
+            request.correlationId
+        );
+
+        const queryParametersString = this.createTokenQueryParameters(request);
+        const endpoint = UrlString.appendQueryString(
+            authority.tokenEndpoint,
+            queryParametersString
+        );
+
+        const requestBody = await invokeAsync(
+            this.createTokenRequestBody.bind(this),
+            PerformanceEvents.RefreshTokenClientCreateTokenRequestBody,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(request);
+        const headers: Record<string, string> = this.createTokenRequestHeaders(
+            request.ccsCredential
+        );
+        const thumbprint: RequestThumbprint = {
+            clientId: this.config.authOptions.clientId,
+            authority: authority.canonicalAuthority,
+            scopes: request.scopes,
+            claims: request.claims,
+            authenticationScheme: request.authenticationScheme,
+            resourceRequestMethod: request.resourceRequestMethod,
+            resourceRequestUri: request.resourceRequestUri,
+            shrClaims: request.shrClaims,
+            sshKid: request.sshKid,
+        };
+
+        return invokeAsync(
+            this.executePostToTokenEndpoint.bind(this),
+            PerformanceEvents.BaseClientExecutePostToTokenEndpoint,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
+    }
+
+    /**
+     * Helper function to create the token request body
+     * @param request
+     */
+    private async createTokenRequestBody(
+        request: CommonRefreshTokenRequest
+    ): Promise<string> {
+        this.performanceClient?.addQueueMeasurement(
+            PerformanceEvents.RefreshTokenClientCreateTokenRequestBody,
+            request.correlationId
+        );
+
+        const correlationId = request.correlationId;
+        const parameterBuilder = new RequestParameterBuilder();
+
+        parameterBuilder.addClientId(this.config.authOptions.clientId);
+
+        parameterBuilder.addScopes(
+            request.scopes,
+            true,
+            this.config.authOptions.authority.options.OIDCOptions?.defaultScopes
+        );
+
+        parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
+
+        parameterBuilder.addClientInfo();
+
+        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+        parameterBuilder.addApplicationTelemetry(
+            this.config.telemetry.application
+        );
+        parameterBuilder.addThrottling();
+
+        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
+            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
+        }
+
+        parameterBuilder.addCorrelationId(correlationId);
+
+        parameterBuilder.addRefreshToken(request.refreshToken);
+
+        if (this.config.clientCredentials.clientSecret) {
+            parameterBuilder.addClientSecret(
+                this.config.clientCredentials.clientSecret
+            );
+        }
+
+        if (this.config.clientCredentials.clientAssertion) {
+            const clientAssertion =
+                this.config.clientCredentials.clientAssertion;
+            parameterBuilder.addClientAssertion(clientAssertion.assertion);
+            parameterBuilder.addClientAssertionType(
+                clientAssertion.assertionType
+            );
+        }
+
+        if (request.authenticationScheme === AuthenticationScheme.POP) {
+            const popTokenGenerator = new PopTokenGenerator(
+                this.cryptoUtils,
+                this.performanceClient
+            );
+            const reqCnfData = await invokeAsync(
+                popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                PerformanceEvents.PopTokenGenerateCnf,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(request, this.logger);
+            // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+        } else if (request.authenticationScheme === AuthenticationScheme.SSH) {
+            if (request.sshJwk) {
+                parameterBuilder.addSshJwk(request.sshJwk);
+            } else {
+                throw createClientConfigurationError(
+                    ClientConfigurationErrorCodes.missingSshJwk
+                );
+            }
+        }
+
+        if (
+            !StringUtils.isEmptyObj(request.claims) ||
+            (this.config.authOptions.clientCapabilities &&
+                this.config.authOptions.clientCapabilities.length > 0)
+        ) {
+            parameterBuilder.addClaims(
+                request.claims,
+                this.config.authOptions.clientCapabilities
+            );
+        }
+
+        if (
+            this.config.systemOptions.preventCorsPreflight &&
+            request.ccsCredential
+        ) {
+            switch (request.ccsCredential.type) {
+                case CcsCredentialType.HOME_ACCOUNT_ID:
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(
+                            request.ccsCredential.credential
+                        );
+                        parameterBuilder.addCcsOid(clientInfo);
+                    } catch (e) {
+                        this.logger.verbose(
+                            "Could not parse home account ID for CCS Header: " +
+                                e
+                        );
+                    }
+                    break;
+                case CcsCredentialType.UPN:
+                    parameterBuilder.addCcsUpn(
+                        request.ccsCredential.credential
+                    );
+                    break;
+            }
+        }
+        return parameterBuilder.createQueryString();
+    }
+}