@azure/msal-common 14.1.0-alpha.0 → 14.2.0

package/src/cache/CacheManager.ts

@@ -42,6 +42,12 @@ import { BaseAuthRequest } from "../request/BaseAuthRequest";
 import { Logger } from "../logger/Logger";
 import { name, version } from "../packageMetadata";
 import { StoreInCache } from "../request/StoreInCache";
+import {
+    getAliasesFromConfigMetadata,
+    getHardcodedAliasesForCanonicalAuthority,
+} from "../authority/AuthorityMetadata";
+import { StaticAuthorityOptions } from "../authority/AuthorityOptions";
+import { TokenClaims } from "../account/TokenClaims";
 
 /**
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
@@ -52,11 +58,18 @@ export abstract class CacheManager implements ICacheManager {
     protected cryptoImpl: ICrypto;
     // Instance of logger for functions defined in the msal-common layer
     private commonLogger: Logger;
-
-    constructor(clientId: string, cryptoImpl: ICrypto, logger: Logger) {
+    private staticAuthorityOptions?: StaticAuthorityOptions;
+
+    constructor(
+        clientId: string,
+        cryptoImpl: ICrypto,
+        logger: Logger,
+        staticAuthorityOptions?: StaticAuthorityOptions
+    ) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
         this.commonLogger = logger.clone(name, version);
+        this.staticAuthorityOptions = staticAuthorityOptions;
     }
 
     /**
@@ -221,66 +234,98 @@ export abstract class CacheManager implements ICacheManager {
     ): string;
 
     /**
-     * Returns all accounts in cache
+     * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
+     * @param accountFilter - (Optional) filter to narrow down the accounts returned
+     * @returns Array of AccountInfo objects in cache
      */
-    getAllAccounts(): AccountInfo[] {
-        const allAccountKeys = this.getAccountKeys();
-        if (allAccountKeys.length < 1) {
-            return [];
-        }
-
-        const accountEntities: AccountEntity[] = allAccountKeys.reduce(
-            (accounts: AccountEntity[], key: string) => {
-                const entity: AccountEntity | null = this.getAccount(key);
-
-                if (!entity) {
-                    return accounts;
+    getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
+        const validAccounts: AccountInfo[] = [];
+        this.getAccountsFilteredBy(accountFilter || {}).forEach(
+            (accountEntity: AccountEntity) => {
+                const accountInfo = this.getAccountInfoFromEntity(
+                    accountEntity,
+                    accountFilter
+                );
+                if (accountInfo) {
+                    validAccounts.push(accountInfo);
                 }
-                accounts.push(entity);
-                return accounts;
-            },
-            []
+            }
         );
-
-        if (accountEntities.length < 1) {
-            return [];
-        } else {
-            const allAccounts = accountEntities.map<AccountInfo>(
-                (accountEntity) => {
-                    return this.getAccountInfoFromEntity(accountEntity);
-                }
-            );
-            return allAccounts;
-        }
+        return validAccounts;
     }
 
     /**
      * Gets accountInfo object based on provided filters
      */
     getAccountInfoFilteredBy(accountFilter: AccountFilter): AccountInfo | null {
-        const allAccounts = this.getAccountsFilteredBy(accountFilter);
+        const allAccounts = this.getAllAccounts(accountFilter);
         if (allAccounts.length > 0) {
-            return this.getAccountInfoFromEntity(allAccounts[0]);
+            return allAccounts[0];
+        } else {
+            return null;
+        }
+    }
+
+    /**
+     * Returns a single matching
+     * @param accountFilter
+     * @returns
+     */
+    getBaseAccountInfo(accountFilter: AccountFilter): AccountInfo | null {
+        const accountEntities = this.getAccountsFilteredBy(accountFilter);
+        if (accountEntities.length > 0) {
+            return accountEntities[0].getAccountInfo();
         } else {
             return null;
         }
     }
 
     private getAccountInfoFromEntity(
-        accountEntity: AccountEntity
-    ): AccountInfo {
+        accountEntity: AccountEntity,
+        accountFilter?: AccountFilter
+    ): AccountInfo | null {
         const accountInfo = accountEntity.getAccountInfo();
         const idToken = this.getIdToken(accountInfo);
         if (idToken) {
-            accountInfo.idToken = idToken.secret;
-            accountInfo.idTokenClaims = extractTokenClaims(
+            const idTokenClaims = extractTokenClaims(
                 idToken.secret,
                 this.cryptoImpl.base64Decode
             );
+
+            if (
+                this.idTokenClaimsMatchAccountFilter(
+                    idTokenClaims,
+                    accountFilter
+                )
+            ) {
+                accountInfo.idToken = idToken.secret;
+                accountInfo.idTokenClaims = idTokenClaims;
+                return accountInfo;
+            }
         }
-        return accountInfo;
+        return null;
     }
 
+    private idTokenClaimsMatchAccountFilter(
+        idTokenClaims: TokenClaims,
+        accountFilter?: AccountFilter
+    ): boolean {
+        if (accountFilter) {
+            if (
+                !!accountFilter.loginHint &&
+                !this.matchLoginHint(idTokenClaims, accountFilter.loginHint)
+            ) {
+                return false;
+            }
+            if (
+                !!accountFilter.sid &&
+                !this.matchSid(idTokenClaims, accountFilter.sid)
+            ) {
+                return false;
+            }
+        }
+        return true;
+    }
     /**
      * saves a cache record
      * @param cacheRecord
@@ -364,22 +409,19 @@ export abstract class CacheManager implements ICacheManager {
     }
 
     /**
-     * retrieve accounts matching all provided filters; if no filter is set, get all accounts
-     * not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
-     * @param homeAccountId
-     * @param environment
-     * @param realm
+     * Retrieve accounts matching all provided filters; if no filter is set, get all accounts
+     * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
+     * @param accountFilter - An object containing Account properties to filter by
      */
     getAccountsFilteredBy(accountFilter: AccountFilter): AccountEntity[] {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts: AccountEntity[] = [];
-
         allAccountKeys.forEach((cacheKey) => {
             if (
                 !this.isAccountKey(
                     cacheKey,
                     accountFilter.homeAccountId,
-                    accountFilter.realm
+                    accountFilter.tenantId
                 )
             ) {
                 // Don't parse value if the key doesn't match the account filters
@@ -427,6 +469,14 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
+            // tenantId is another name for realm
+            if (
+                !!accountFilter.tenantId &&
+                !this.matchRealm(entity, accountFilter.tenantId)
+            ) {
+                return;
+            }
+
             if (
                 !!accountFilter.nativeAccountId &&
                 !this.matchNativeAccountId(
@@ -437,6 +487,20 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
+            if (
+                !!accountFilter.authorityType &&
+                !this.matchAuthorityType(entity, accountFilter.authorityType)
+            ) {
+                return;
+            }
+
+            if (
+                !!accountFilter.name &&
+                !this.matchName(entity, accountFilter.name)
+            ) {
+                return;
+            }
+
             matchingAccounts.push(entity);
         });
 
@@ -924,7 +988,6 @@ export abstract class CacheManager implements ICacheManager {
             ) {
                 return;
             }
-
             const idToken = this.getIdTokenCredential(key);
             if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                 idTokens.push(idToken);
@@ -1324,6 +1387,16 @@ export abstract class CacheManager implements ICacheManager {
         );
     }
 
+    /**
+     * helper to match names
+     * @param entity
+     * @param name
+     * @returns true if the downcased name properties are present and match in the filter and the entity
+     */
+    private matchName(entity: AccountEntity, name: string): boolean {
+        return !!(name.toLowerCase() === entity.name?.toLowerCase());
+    }
+
     /**
      * helper to match assertion
      * @param value
@@ -1348,6 +1421,27 @@ export abstract class CacheManager implements ICacheManager {
         entity: AccountEntity | CredentialEntity | AppMetadataEntity,
         environment: string
     ): boolean {
+        // Check static authority options first for cases where authority metadata has not been resolved and cached yet
+        if (this.staticAuthorityOptions) {
+            const staticAliases =
+                getAliasesFromConfigMetadata(
+                    this.staticAuthorityOptions.canonicalAuthority,
+                    this.staticAuthorityOptions.cloudDiscoveryMetadata
+                ) ||
+                getHardcodedAliasesForCanonicalAuthority(
+                    this.staticAuthorityOptions.canonicalAuthority
+                ) ||
+                this.staticAuthorityOptions.knownAuthorities;
+            if (
+                staticAliases &&
+                staticAliases.includes(environment) &&
+                staticAliases.includes(entity.environment)
+            ) {
+                return true;
+            }
+        }
+
+        // Query metadata cache if no static authority configuration has aliases that match enviroment
         const cloudMetadata = this.getAuthorityMetadataByAlias(environment);
         if (
             cloudMetadata &&
@@ -1355,7 +1449,6 @@ export abstract class CacheManager implements ICacheManager {
         ) {
             return true;
         }
-
         return false;
     }
 
@@ -1425,6 +1518,54 @@ export abstract class CacheManager implements ICacheManager {
         );
     }
 
+    /**
+     * helper to match loginHint which can be either:
+     * 1. login_hint ID token claim
+     * 2. username in cached account object
+     * 3. upn in ID token claims
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    private matchLoginHint(
+        idTokenClaims: TokenClaims,
+        loginHint: string
+    ): boolean {
+        if (idTokenClaims?.login_hint === loginHint) {
+            return true;
+        }
+
+        if (idTokenClaims.preferred_username === loginHint) {
+            return true;
+        }
+
+        if (idTokenClaims?.upn === loginHint) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * Helper to match sid
+     * @param idTokenClaims
+     * @param sid
+     * @returns true if the sid claim is present and matches the filter
+     */
+    private matchSid(idTokenClaims: TokenClaims, sid: string): boolean {
+        return !!(idTokenClaims?.sid && idTokenClaims.sid === sid);
+    }
+
+    private matchAuthorityType(
+        entity: AccountEntity,
+        authorityType: string
+    ): boolean {
+        return !!(
+            entity.authorityType &&
+            authorityType.toLowerCase() === entity.authorityType.toLowerCase()
+        );
+    }
+
     /**
      * Returns true if the target scopes are a subset of the current entity's scopes, false otherwise.
      * @param entity

package/src/cache/entities/AccountEntity.ts

@@ -153,8 +153,6 @@ export class AccountEntity {
         account.realm =
             accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
 
-        account.idTokenClaims = accountDetails.idTokenClaims;
-
         // How do you account for MSA CID here?
         account.localAccountId =
             accountDetails.idTokenClaims.oid ||
@@ -207,7 +205,6 @@ export class AccountEntity {
 
         account.username = accountInfo.username;
         account.name = accountInfo.name;
-        account.idTokenClaims = accountInfo.idTokenClaims;
 
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;

package/src/cache/utils/CacheTypes.ts

@@ -13,6 +13,7 @@ import { ThrottlingEntity } from "../entities/ThrottlingEntity";
 import { AuthorityMetadataEntity } from "../entities/AuthorityMetadataEntity";
 import { AuthenticationScheme } from "../../utils/Constants";
 import { ScopeSet } from "../../request/ScopeSet";
+import { AccountInfo } from "../../account/AccountInfo";
 
 /** @internal */
 export type AccountCache = Record<string, AccountEntity>;
@@ -52,13 +53,13 @@ export type ValidCredentialType =
 /**
  * Account:	<home_account_id>-<environment>-<realm*>
  */
-export type AccountFilter = {
-    homeAccountId?: string;
-    localAccountId?: string;
-    username?: string;
-    environment?: string;
+export type AccountFilter = Omit<
+    Partial<AccountInfo>,
+    "idToken" | "idTokenClaims"
+> & {
     realm?: string;
-    nativeAccountId?: string;
+    loginHint?: string;
+    sid?: string;
 };
 
 /**

package/src/client/AuthorizationCodeClient.ts

@@ -282,7 +282,9 @@ export class AuthorizationCodeClient extends BaseClient {
         );
 
         const thumbprint: RequestThumbprint = {
-            clientId: this.config.authOptions.clientId,
+            clientId:
+                request.tokenBodyParameters?.clientId ||
+                this.config.authOptions.clientId,
             authority: authority.canonicalAuthority,
             scopes: request.scopes,
             claims: request.claims,
@@ -295,11 +297,18 @@ export class AuthorizationCodeClient extends BaseClient {
 
         return invokeAsync(
             this.executePostToTokenEndpoint.bind(this),
-            PerformanceEvents.BaseClientExecutePostToTokenEndpoint,
+            PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
+        )(
+            endpoint,
+            requestBody,
+            headers,
+            thumbprint,
+            request.correlationId,
+            PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint
+        );
     }
 
     /**

package/src/client/BaseClient.ts

@@ -28,7 +28,6 @@ import { buildClientInfoFromHomeAccountId } from "../account/ClientInfo";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 import { RequestParameterBuilder } from "../request/RequestParameterBuilder";
 import { BaseAuthRequest } from "../request/BaseAuthRequest";
-import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 
 /**
  * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
@@ -144,12 +143,16 @@ export abstract class BaseClient {
         queryString: string,
         headers: Record<string, string>,
         thumbprint: RequestThumbprint,
-        correlationId: string
+        correlationId: string,
+        queuedEvent?: string
     ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
-        this.performanceClient?.addQueueMeasurement(
-            PerformanceEvents.BaseClientExecutePostToTokenEndpoint,
-            correlationId
-        );
+        if (queuedEvent) {
+            this.performanceClient?.addQueueMeasurement(
+                queuedEvent,
+                correlationId
+            );
+        }
+
         const response =
             await this.networkManager.sendPostRequest<ServerAuthorizationTokenResponse>(
                 thumbprint,

package/src/client/RefreshTokenClient.ts

@@ -17,6 +17,7 @@ import {
     AuthenticationScheme,
     Errors,
     HeaderNames,
+    AADServerParamKeys,
 } from "../utils/Constants";
 import { ResponseHandler } from "../response/ResponseHandler";
 import { AuthenticationResult } from "../response/AuthenticationResult";
@@ -45,7 +46,7 @@ import {
 } from "../error/InteractionRequiredAuthError";
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
-import { invokeAsync } from "../utils/FunctionWrappers";
+import { invoke, invokeAsync } from "../utils/FunctionWrappers";
 /**
  * OAuth2.0 refresh token client
  * @internal
@@ -195,10 +196,13 @@ export class RefreshTokenClient extends BaseClient {
         );
 
         // fetches family RT or application RT based on FOCI value
-        const refreshToken = this.cacheManager.getRefreshToken(
-            request.account,
-            foci
-        );
+        const refreshToken = invoke(
+            this.cacheManager.getRefreshToken.bind(this.cacheManager),
+            PerformanceEvents.CacheManagerGetRefreshToken,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(request.account, foci);
 
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(
@@ -258,7 +262,9 @@ export class RefreshTokenClient extends BaseClient {
             request.ccsCredential
         );
         const thumbprint: RequestThumbprint = {
-            clientId: this.config.authOptions.clientId,
+            clientId:
+                request.tokenBodyParameters?.clientId ||
+                this.config.authOptions.clientId,
             authority: authority.canonicalAuthority,
             scopes: request.scopes,
             claims: request.claims,
@@ -271,11 +277,18 @@ export class RefreshTokenClient extends BaseClient {
 
         return invokeAsync(
             this.executePostToTokenEndpoint.bind(this),
-            PerformanceEvents.BaseClientExecutePostToTokenEndpoint,
+            PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
+        )(
+            endpoint,
+            requestBody,
+            headers,
+            thumbprint,
+            request.correlationId,
+            PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint
+        );
     }
 
     /**
@@ -293,7 +306,14 @@ export class RefreshTokenClient extends BaseClient {
         const correlationId = request.correlationId;
         const parameterBuilder = new RequestParameterBuilder();
 
-        parameterBuilder.addClientId(this.config.authOptions.clientId);
+        parameterBuilder.addClientId(
+            request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+                this.config.authOptions.clientId
+        );
+
+        if (request.redirectUri) {
+            parameterBuilder.addRedirectUri(request.redirectUri);
+        }
 
         parameterBuilder.addScopes(
             request.scopes,
@@ -394,6 +414,13 @@ export class RefreshTokenClient extends BaseClient {
                     break;
             }
         }
+
+        if (request.tokenBodyParameters) {
+            parameterBuilder.addExtraQueryParameters(
+                request.tokenBodyParameters
+            );
+        }
+
         return parameterBuilder.createQueryString();
     }
 }