@azure/msal-common 14.1.0-alpha.0 → 14.1.0

package/dist/utils/StringUtils.mjs

@@ -1,99 +1,99 @@
-/*! @azure/msal-common v14.1.0-alpha.0 2023-09-20 */
+/*! @azure/msal-common v14.1.0 2023-10-05 */
 'use strict';
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * @hidden
- */
-class StringUtils {
-    /**
-     * Check if stringified object is empty
-     * @param strObj
-     */
-    static isEmptyObj(strObj) {
-        if (strObj) {
-            try {
-                const obj = JSON.parse(strObj);
-                return Object.keys(obj).length === 0;
-            }
-            catch (e) { }
-        }
-        return true;
-    }
-    static startsWith(str, search) {
-        return str.indexOf(search) === 0;
-    }
-    static endsWith(str, search) {
-        return (str.length >= search.length &&
-            str.lastIndexOf(search) === str.length - search.length);
-    }
-    /**
-     * Parses string into an object.
-     *
-     * @param query
-     */
-    static queryStringToObject(query) {
-        const obj = {};
-        const params = query.split("&");
-        const decode = (s) => decodeURIComponent(s.replace(/\+/g, " "));
-        params.forEach((pair) => {
-            if (pair.trim()) {
-                const [key, value] = pair.split(/=(.+)/g, 2); // Split on the first occurence of the '=' character
-                if (key && value) {
-                    obj[decode(key)] = decode(value);
-                }
-            }
-        });
-        return obj;
-    }
-    /**
-     * Trims entries in an array.
-     *
-     * @param arr
-     */
-    static trimArrayEntries(arr) {
-        return arr.map((entry) => entry.trim());
-    }
-    /**
-     * Removes empty strings from array
-     * @param arr
-     */
-    static removeEmptyStringsFromArray(arr) {
-        return arr.filter((entry) => {
-            return !!entry;
-        });
-    }
-    /**
-     * Attempts to parse a string into JSON
-     * @param str
-     */
-    static jsonParseHelper(str) {
-        try {
-            return JSON.parse(str);
-        }
-        catch (e) {
-            return null;
-        }
-    }
-    /**
-     * Tests if a given string matches a given pattern, with support for wildcards and queries.
-     * @param pattern Wildcard pattern to string match. Supports "*" for wildcards and "?" for queries
-     * @param input String to match against
-     */
-    static matchPattern(pattern, input) {
-        /**
-         * Wildcard support: https://stackoverflow.com/a/3117248/4888559
-         * Queries: replaces "?" in string with escaped "\?" for regex test
-         */
-        // eslint-disable-next-line security/detect-non-literal-regexp
-        const regex = new RegExp(pattern
-            .replace(/\\/g, "\\\\")
-            .replace(/\*/g, "[^ ]*")
-            .replace(/\?/g, "\\?"));
-        return regex.test(input);
-    }
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * @hidden
+ */
+class StringUtils {
+    /**
+     * Check if stringified object is empty
+     * @param strObj
+     */
+    static isEmptyObj(strObj) {
+        if (strObj) {
+            try {
+                const obj = JSON.parse(strObj);
+                return Object.keys(obj).length === 0;
+            }
+            catch (e) { }
+        }
+        return true;
+    }
+    static startsWith(str, search) {
+        return str.indexOf(search) === 0;
+    }
+    static endsWith(str, search) {
+        return (str.length >= search.length &&
+            str.lastIndexOf(search) === str.length - search.length);
+    }
+    /**
+     * Parses string into an object.
+     *
+     * @param query
+     */
+    static queryStringToObject(query) {
+        const obj = {};
+        const params = query.split("&");
+        const decode = (s) => decodeURIComponent(s.replace(/\+/g, " "));
+        params.forEach((pair) => {
+            if (pair.trim()) {
+                const [key, value] = pair.split(/=(.+)/g, 2); // Split on the first occurence of the '=' character
+                if (key && value) {
+                    obj[decode(key)] = decode(value);
+                }
+            }
+        });
+        return obj;
+    }
+    /**
+     * Trims entries in an array.
+     *
+     * @param arr
+     */
+    static trimArrayEntries(arr) {
+        return arr.map((entry) => entry.trim());
+    }
+    /**
+     * Removes empty strings from array
+     * @param arr
+     */
+    static removeEmptyStringsFromArray(arr) {
+        return arr.filter((entry) => {
+            return !!entry;
+        });
+    }
+    /**
+     * Attempts to parse a string into JSON
+     * @param str
+     */
+    static jsonParseHelper(str) {
+        try {
+            return JSON.parse(str);
+        }
+        catch (e) {
+            return null;
+        }
+    }
+    /**
+     * Tests if a given string matches a given pattern, with support for wildcards and queries.
+     * @param pattern Wildcard pattern to string match. Supports "*" for wildcards and "?" for queries
+     * @param input String to match against
+     */
+    static matchPattern(pattern, input) {
+        /**
+         * Wildcard support: https://stackoverflow.com/a/3117248/4888559
+         * Queries: replaces "?" in string with escaped "\?" for regex test
+         */
+        // eslint-disable-next-line security/detect-non-literal-regexp
+        const regex = new RegExp(pattern
+            .replace(/\\/g, "\\\\")
+            .replace(/\*/g, "[^ ]*")
+            .replace(/\?/g, "\\?"));
+        return regex.test(input);
+    }
 }
 
 export { StringUtils };

package/dist/utils/TimeUtils.d.ts

@@ -1,28 +1,28 @@
-/**
- * Utility class which exposes functions for managing date and time operations.
- */
-export declare class TimeUtils {
-    /**
-     * return the current time in Unix time (seconds).
-     */
-    static nowSeconds(): number;
-    /**
-     * check if a token is expired based on given UTC time in seconds.
-     * @param expiresOn
-     */
-    static isTokenExpired(expiresOn: string, offset: number): boolean;
-    /**
-     * If the current time is earlier than the time that a token was cached at, we must discard the token
-     * i.e. The system clock was turned back after acquiring the cached token
-     * @param cachedAt
-     * @param offset
-     */
-    static wasClockTurnedBack(cachedAt: string): boolean;
-    /**
-     * Waits for t number of milliseconds
-     * @param t number
-     * @param value T
-     */
-    static delay<T>(t: number, value?: T): Promise<T | void>;
-}
+/**
+ * Utility class which exposes functions for managing date and time operations.
+ */
+export declare class TimeUtils {
+    /**
+     * return the current time in Unix time (seconds).
+     */
+    static nowSeconds(): number;
+    /**
+     * check if a token is expired based on given UTC time in seconds.
+     * @param expiresOn
+     */
+    static isTokenExpired(expiresOn: string, offset: number): boolean;
+    /**
+     * If the current time is earlier than the time that a token was cached at, we must discard the token
+     * i.e. The system clock was turned back after acquiring the cached token
+     * @param cachedAt
+     * @param offset
+     */
+    static wasClockTurnedBack(cachedAt: string): boolean;
+    /**
+     * Waits for t number of milliseconds
+     * @param t number
+     * @param value T
+     */
+    static delay<T>(t: number, value?: T): Promise<T | void>;
+}
 //# sourceMappingURL=TimeUtils.d.ts.map

package/dist/utils/TimeUtils.mjs

@@ -1,49 +1,49 @@
-/*! @azure/msal-common v14.1.0-alpha.0 2023-09-20 */
+/*! @azure/msal-common v14.1.0 2023-10-05 */
 'use strict';
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Utility class which exposes functions for managing date and time operations.
- */
-class TimeUtils {
-    /**
-     * return the current time in Unix time (seconds).
-     */
-    static nowSeconds() {
-        // Date.getTime() returns in milliseconds.
-        return Math.round(new Date().getTime() / 1000.0);
-    }
-    /**
-     * check if a token is expired based on given UTC time in seconds.
-     * @param expiresOn
-     */
-    static isTokenExpired(expiresOn, offset) {
-        // check for access token expiry
-        const expirationSec = Number(expiresOn) || 0;
-        const offsetCurrentTimeSec = TimeUtils.nowSeconds() + offset;
-        // If current time + offset is greater than token expiration time, then token is expired.
-        return offsetCurrentTimeSec > expirationSec;
-    }
-    /**
-     * If the current time is earlier than the time that a token was cached at, we must discard the token
-     * i.e. The system clock was turned back after acquiring the cached token
-     * @param cachedAt
-     * @param offset
-     */
-    static wasClockTurnedBack(cachedAt) {
-        const cachedAtSec = Number(cachedAt);
-        return cachedAtSec > TimeUtils.nowSeconds();
-    }
-    /**
-     * Waits for t number of milliseconds
-     * @param t number
-     * @param value T
-     */
-    static delay(t, value) {
-        return new Promise((resolve) => setTimeout(() => resolve(value), t));
-    }
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Utility class which exposes functions for managing date and time operations.
+ */
+class TimeUtils {
+    /**
+     * return the current time in Unix time (seconds).
+     */
+    static nowSeconds() {
+        // Date.getTime() returns in milliseconds.
+        return Math.round(new Date().getTime() / 1000.0);
+    }
+    /**
+     * check if a token is expired based on given UTC time in seconds.
+     * @param expiresOn
+     */
+    static isTokenExpired(expiresOn, offset) {
+        // check for access token expiry
+        const expirationSec = Number(expiresOn) || 0;
+        const offsetCurrentTimeSec = TimeUtils.nowSeconds() + offset;
+        // If current time + offset is greater than token expiration time, then token is expired.
+        return offsetCurrentTimeSec > expirationSec;
+    }
+    /**
+     * If the current time is earlier than the time that a token was cached at, we must discard the token
+     * i.e. The system clock was turned back after acquiring the cached token
+     * @param cachedAt
+     * @param offset
+     */
+    static wasClockTurnedBack(cachedAt) {
+        const cachedAtSec = Number(cachedAt);
+        return cachedAtSec > TimeUtils.nowSeconds();
+    }
+    /**
+     * Waits for t number of milliseconds
+     * @param t number
+     * @param value T
+     */
+    static delay(t, value) {
+        return new Promise((resolve) => setTimeout(() => resolve(value), t));
+    }
 }
 
 export { TimeUtils };

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "14.1.0-alpha.0",
+  "version": "14.1.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",

package/src/account/AccountInfo.ts

@@ -14,7 +14,6 @@ import { TokenClaims } from "./TokenClaims";
  * - name                   - Full name for the account, including given name and family name
  * - idToken                - raw ID token
  * - idTokenClaims          - Object contains claims from ID token
- * - localAccountId         - The user's account ID
  * - nativeAccountId        - The user's native account ID
  */
 export type AccountInfo = {

package/src/cache/CacheManager.ts

@@ -221,9 +221,19 @@ export abstract class CacheManager implements ICacheManager {
     ): string;
 
     /**
-     * Returns all accounts in cache
+     * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
+     * @param accountFilter - (Optional) filter to narrow down the accounts returned
+     * @returns Array of AccountInfo objects in cache
      */
-    getAllAccounts(): AccountInfo[] {
+    getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
+        if (accountFilter) {
+            return this.getAccountsFilteredBy(accountFilter).map(
+                (accountEntity) => {
+                    return accountEntity.getAccountInfo();
+                }
+            );
+        }
+
         const allAccountKeys = this.getAccountKeys();
         if (allAccountKeys.length < 1) {
             return [];
@@ -242,16 +252,12 @@ export abstract class CacheManager implements ICacheManager {
             []
         );
 
-        if (accountEntities.length < 1) {
-            return [];
-        } else {
-            const allAccounts = accountEntities.map<AccountInfo>(
-                (accountEntity) => {
-                    return this.getAccountInfoFromEntity(accountEntity);
-                }
-            );
-            return allAccounts;
-        }
+        const allAccounts = accountEntities.map<AccountInfo>(
+            (accountEntity) => {
+                return this.getAccountInfoFromEntity(accountEntity);
+            }
+        );
+        return allAccounts;
     }
 
     /**
@@ -364,11 +370,9 @@ export abstract class CacheManager implements ICacheManager {
     }
 
     /**
-     * retrieve accounts matching all provided filters; if no filter is set, get all accounts
-     * not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
-     * @param homeAccountId
-     * @param environment
-     * @param realm
+     * Retrieve accounts matching all provided filters; if no filter is set, get all accounts
+     * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
+     * @param accountFilter - An object containing Account properties to filter by
      */
     getAccountsFilteredBy(accountFilter: AccountFilter): AccountEntity[] {
         const allAccountKeys = this.getAccountKeys();
@@ -379,7 +383,7 @@ export abstract class CacheManager implements ICacheManager {
                 !this.isAccountKey(
                     cacheKey,
                     accountFilter.homeAccountId,
-                    accountFilter.realm
+                    accountFilter.tenantId
                 )
             ) {
                 // Don't parse value if the key doesn't match the account filters
@@ -427,6 +431,14 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
+            // tenantId is another name for realm
+            if (
+                !!accountFilter.tenantId &&
+                !this.matchRealm(entity, accountFilter.tenantId)
+            ) {
+                return;
+            }
+
             if (
                 !!accountFilter.nativeAccountId &&
                 !this.matchNativeAccountId(
@@ -437,6 +449,27 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
+            if (
+                !!accountFilter.loginHint &&
+                !this.matchLoginHint(entity, accountFilter.loginHint)
+            ) {
+                return;
+            }
+
+            if (
+                !!accountFilter.authorityType &&
+                !this.matchAuthorityType(entity, accountFilter.authorityType)
+            ) {
+                return;
+            }
+
+            if (
+                !!accountFilter.name &&
+                !this.matchName(entity, accountFilter.name)
+            ) {
+                return;
+            }
+
             matchingAccounts.push(entity);
         });
 
@@ -1324,6 +1357,16 @@ export abstract class CacheManager implements ICacheManager {
         );
     }
 
+    /**
+     * helper to match names
+     * @param entity
+     * @param name
+     * @returns true if the downcased name properties are present and match in the filter and the entity
+     */
+    private matchName(entity: AccountEntity, name: string): boolean {
+        return !!(name.toLowerCase() === entity.name?.toLowerCase());
+    }
+
     /**
      * helper to match assertion
      * @param value
@@ -1425,6 +1468,41 @@ export abstract class CacheManager implements ICacheManager {
         );
     }
 
+    /**
+     * helper to match loginHint which can be either:
+     * 1. login_hint ID token claim
+     * 2. username in cached account object
+     * 3. upn in ID token claims
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    private matchLoginHint(entity: AccountEntity, loginHint: string): boolean {
+        if (entity.idTokenClaims?.login_hint === loginHint) {
+            return true;
+        }
+
+        if (entity.username === loginHint) {
+            return true;
+        }
+
+        if (entity.idTokenClaims?.upn === loginHint) {
+            return true;
+        }
+
+        return false;
+    }
+
+    private matchAuthorityType(
+        entity: AccountEntity,
+        authorityType: string
+    ): boolean {
+        return !!(
+            entity.authorityType &&
+            authorityType.toLowerCase() === entity.authorityType.toLowerCase()
+        );
+    }
+
     /**
      * Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.
      * @param entity

package/src/cache/utils/CacheTypes.ts

@@ -13,6 +13,7 @@ import { ThrottlingEntity } from "../entities/ThrottlingEntity";
 import { AuthorityMetadataEntity } from "../entities/AuthorityMetadataEntity";
 import { AuthenticationScheme } from "../../utils/Constants";
 import { ScopeSet } from "../../request/ScopeSet";
+import { AccountInfo } from "../../account/AccountInfo";
 
 /** @internal */
 export type AccountCache = Record<string, AccountEntity>;
@@ -52,13 +53,12 @@ export type ValidCredentialType =
 /**
  * Account:	<home_account_id>-<environment>-<realm*>
  */
-export type AccountFilter = {
-    homeAccountId?: string;
-    localAccountId?: string;
-    username?: string;
-    environment?: string;
+export type AccountFilter = Omit<
+    Partial<AccountInfo>,
+    "idToken" | "idTokenClaims"
+> & {
     realm?: string;
-    nativeAccountId?: string;
+    loginHint?: string;
 };
 
 /**

package/src/client/AuthorizationCodeClient.ts

@@ -282,7 +282,9 @@ export class AuthorizationCodeClient extends BaseClient {
         );
 
         const thumbprint: RequestThumbprint = {
-            clientId: this.config.authOptions.clientId,
+            clientId:
+                request.tokenBodyParameters?.clientId ||
+                this.config.authOptions.clientId,
             authority: authority.canonicalAuthority,
             scopes: request.scopes,
             claims: request.claims,

package/src/client/RefreshTokenClient.ts

@@ -17,6 +17,7 @@ import {
     AuthenticationScheme,
     Errors,
     HeaderNames,
+    AADServerParamKeys,
 } from "../utils/Constants";
 import { ResponseHandler } from "../response/ResponseHandler";
 import { AuthenticationResult } from "../response/AuthenticationResult";
@@ -258,7 +259,9 @@ export class RefreshTokenClient extends BaseClient {
             request.ccsCredential
         );
         const thumbprint: RequestThumbprint = {
-            clientId: this.config.authOptions.clientId,
+            clientId:
+                request.tokenBodyParameters?.clientId ||
+                this.config.authOptions.clientId,
             authority: authority.canonicalAuthority,
             scopes: request.scopes,
             claims: request.claims,
@@ -293,7 +296,14 @@ export class RefreshTokenClient extends BaseClient {
         const correlationId = request.correlationId;
         const parameterBuilder = new RequestParameterBuilder();
 
-        parameterBuilder.addClientId(this.config.authOptions.clientId);
+        parameterBuilder.addClientId(
+            request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+                this.config.authOptions.clientId
+        );
+
+        if (request.redirectUri) {
+            parameterBuilder.addRedirectUri(request.redirectUri);
+        }
 
         parameterBuilder.addScopes(
             request.scopes,
@@ -394,6 +404,13 @@ export class RefreshTokenClient extends BaseClient {
                     break;
             }
         }
+
+        if (request.tokenBodyParameters) {
+            parameterBuilder.addExtraQueryParameters(
+                request.tokenBodyParameters
+            );
+        }
+
         return parameterBuilder.createQueryString();
     }
 }

package/src/crypto/ICrypto.ts

@@ -45,10 +45,6 @@ export interface ICrypto {
      * @param input
      */
     base64Decode(input: string): string;
-    /**
-     * Generate PKCE codes for OAuth. See RFC here: https://tools.ietf.org/html/rfc7636
-     */
-    generatePkceCodes(): Promise<PkceCodes>;
     /**
      * Generates an JWK RSA S256 Thumbprint
      * @param request
@@ -91,9 +87,6 @@ export const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {
     base64Encode: (): string => {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     },
-    async generatePkceCodes(): Promise<PkceCodes> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
-    },
     async getPublicKeyThumbprint(): Promise<string> {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     },

package/src/index.ts

@@ -54,6 +54,7 @@ export { INativeBrokerPlugin } from "./broker/nativeBroker/INativeBrokerPlugin";
 export { CacheManager, DefaultStorageClass } from "./cache/CacheManager";
 export {
     AccountCache,
+    AccountFilter,
     AccessTokenCache,
     IdTokenCache,
     RefreshTokenCache,

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.0.3";
+export const version = "14.1.0";

package/src/request/CommonRefreshTokenRequest.ts

@@ -5,6 +5,7 @@
 
 import { BaseAuthRequest } from "./BaseAuthRequest";
 import { CcsCredential } from "../account/CcsCredential";
+import { StringDict } from "../utils/MsalTypes";
 
 /**
  * CommonRefreshTokenRequest
@@ -22,4 +23,6 @@ export type CommonRefreshTokenRequest = BaseAuthRequest & {
     refreshToken: string;
     ccsCredential?: CcsCredential;
     forceCache?: boolean;
+    tokenBodyParameters?: StringDict;
+    redirectUri?: string;
 };