@azure/msal-common 14.1.0 → 14.2.0-alpha.0

package/dist/client/SilentFlowClient.mjs

@@ -1,139 +1,132 @@
-/*! @azure/msal-common v14.1.0 2023-10-05 */
+/*! @azure/msal-common v14.2.0-alpha.0 2023-12-07 */
 'use strict';
 import { BaseClient } from './BaseClient.mjs';
 import { TimeUtils } from '../utils/TimeUtils.mjs';
 import { RefreshTokenClient } from './RefreshTokenClient.mjs';
 import { ClientAuthError, createClientAuthError } from '../error/ClientAuthError.mjs';
-import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { ResponseHandler } from '../response/ResponseHandler.mjs';
 import { CacheOutcome } from '../utils/Constants.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';
 import { extractTokenClaims, checkMaxAge } from '../account/AuthToken.mjs';
+import { PerformanceEvents } from '../telemetry/performance/PerformanceEvent.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
 import { tokenRefreshRequired, noAccountInSilentRequest, authTimeNotFound } from '../error/ClientAuthErrorCodes.mjs';
-import { tokenRequestEmpty } from '../error/ClientConfigurationErrorCodes.mjs';
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class SilentFlowClient extends BaseClient {
-    constructor(configuration, performanceClient) {
-        super(configuration, performanceClient);
-    }
-    /**
-     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
-     * the given token and returns the renewed token
-     * @param request
-     */
-    async acquireToken(request) {
-        try {
-            const [authResponse, cacheOutcome] = await this.acquireCachedToken(request);
-            // if the token is not expired but must be refreshed; get a new one in the background
-            if (cacheOutcome === CacheOutcome.PROACTIVELY_REFRESHED) {
-                this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.");
-                // refresh the access token in the background
-                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
-                refreshTokenClient
-                    .acquireTokenByRefreshToken(request)
-                    .catch(() => {
-                    // do nothing, this is running in the background and no action is to be taken upon success or failure
-                });
-            }
-            // return the cached token
-            return authResponse;
-        }
-        catch (e) {
-            if (e instanceof ClientAuthError &&
-                e.errorCode === tokenRefreshRequired) {
-                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
-                return refreshTokenClient.acquireTokenByRefreshToken(request);
-            }
-            else {
-                throw e;
-            }
-        }
-    }
-    /**
-     * Retrieves token from cache or throws an error if it must be refreshed.
-     * @param request
-     */
-    async acquireCachedToken(request) {
-        let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
-        // Cannot renew token if no request object is given.
-        if (!request) {
-            throw createClientConfigurationError(tokenRequestEmpty);
-        }
-        if (request.forceRefresh) {
-            // Must refresh due to present force_refresh flag.
-            lastCacheOutcome = CacheOutcome.FORCE_REFRESH_OR_CLAIMS;
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS);
-            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
-            throw createClientAuthError(tokenRefreshRequired);
-        }
-        else if (!this.config.cacheOptions.claimsBasedCachingEnabled &&
-            !StringUtils.isEmptyObj(request.claims)) {
-            lastCacheOutcome = CacheOutcome.FORCE_REFRESH_OR_CLAIMS;
-            // Must refresh due to request parameters.
-            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims-based caching is disabled and claims were requested.");
-            throw createClientAuthError(tokenRefreshRequired);
-        }
-        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
-        if (!request.account) {
-            throw createClientAuthError(noAccountInSilentRequest);
-        }
-        const environment = request.authority || this.authority.getPreferredCache();
-        const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
-        if (!cacheRecord.accessToken) {
-            // must refresh due to non-existent access_token
-            lastCacheOutcome = CacheOutcome.NO_CACHED_ACCESS_TOKEN;
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
-            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
-            throw createClientAuthError(tokenRefreshRequired);
-        }
-        else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
-            TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
-            // must refresh due to the expires_in value
-            lastCacheOutcome = CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED;
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
-            this.logger.info(`SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`);
-            throw createClientAuthError(tokenRefreshRequired);
-        }
-        else if (cacheRecord.accessToken.refreshOn &&
-            TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
-            // must refresh (in the background) due to the refresh_in value
-            lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
-            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.PROACTIVELY_REFRESHED);
-            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
-            // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
-        }
-        if (this.config.serverTelemetryManager) {
-            this.config.serverTelemetryManager.incrementCacheHits();
-        }
-        return [
-            await this.generateResultFromCacheRecord(cacheRecord, request),
-            lastCacheOutcome,
-        ];
-    }
-    /**
-     * Helper function to build response object from the CacheRecord
-     * @param cacheRecord
-     */
-    async generateResultFromCacheRecord(cacheRecord, request) {
-        let idTokenClaims;
-        if (cacheRecord.idToken) {
-            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
-        }
-        // token max_age check
-        if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenClaims?.auth_time;
-            if (!authTime) {
-                throw createClientAuthError(authTimeNotFound);
-            }
-            checkMaxAge(authTime, request.maxAge);
-        }
-        return await ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
-    }
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class SilentFlowClient extends BaseClient {
+    constructor(configuration, performanceClient) {
+        super(configuration, performanceClient);
+    }
+    /**
+     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
+     * the given token and returns the renewed token
+     * @param request
+     */
+    async acquireToken(request) {
+        try {
+            const [authResponse, cacheOutcome] = await this.acquireCachedToken(request);
+            // if the token is not expired but must be refreshed; get a new one in the background
+            if (cacheOutcome === CacheOutcome.PROACTIVELY_REFRESHED) {
+                this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.");
+                // refresh the access token in the background
+                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
+                refreshTokenClient
+                    .acquireTokenByRefreshToken(request)
+                    .catch(() => {
+                    // do nothing, this is running in the background and no action is to be taken upon success or failure
+                });
+            }
+            // return the cached token
+            return authResponse;
+        }
+        catch (e) {
+            if (e instanceof ClientAuthError &&
+                e.errorCode === tokenRefreshRequired) {
+                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
+                return refreshTokenClient.acquireTokenByRefreshToken(request);
+            }
+            else {
+                throw e;
+            }
+        }
+    }
+    /**
+     * Retrieves token from cache or throws an error if it must be refreshed.
+     * @param request
+     */
+    async acquireCachedToken(request) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientAcquireCachedToken, request.correlationId);
+        let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
+        if (request.forceRefresh ||
+            (!this.config.cacheOptions.claimsBasedCachingEnabled &&
+                !StringUtils.isEmptyObj(request.claims))) {
+            // Must refresh due to present force_refresh flag.
+            this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+        if (!request.account) {
+            throw createClientAuthError(noAccountInSilentRequest);
+        }
+        const environment = request.authority || this.authority.getPreferredCache();
+        const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
+        if (!cacheRecord.accessToken) {
+            // must refresh due to non-existent access_token
+            this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
+            TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
+            // must refresh due to the expires_in value
+            this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (cacheRecord.accessToken.refreshOn &&
+            TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
+            // must refresh (in the background) due to the refresh_in value
+            lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
+            // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
+        }
+        this.setCacheOutcome(lastCacheOutcome, request.correlationId);
+        if (this.config.serverTelemetryManager) {
+            this.config.serverTelemetryManager.incrementCacheHits();
+        }
+        return [
+            await invokeAsync(this.generateResultFromCacheRecord.bind(this), PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, this.logger, this.performanceClient, request.correlationId)(cacheRecord, request),
+            lastCacheOutcome,
+        ];
+    }
+    setCacheOutcome(cacheOutcome, correlationId) {
+        this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);
+        this.performanceClient?.addFields({
+            cacheOutcome: cacheOutcome,
+        }, correlationId);
+        this.logger.info(`Token refresh is required due to cache outcome: ${cacheOutcome}`);
+    }
+    /**
+     * Helper function to build response object from the CacheRecord
+     * @param cacheRecord
+     */
+    async generateResultFromCacheRecord(cacheRecord, request) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, request.correlationId);
+        let idTokenClaims;
+        if (cacheRecord.idToken) {
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
+        }
+        // token max_age check
+        if (request.maxAge || request.maxAge === 0) {
+            const authTime = idTokenClaims?.auth_time;
+            if (!authTime) {
+                throw createClientAuthError(authTimeNotFound);
+            }
+            checkMaxAge(authTime, request.maxAge);
+        }
+        return await ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
+    }
 }
 
 export { SilentFlowClient };

package/dist/client/SilentFlowClient.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"SilentFlowClient.mjs","sources":["../../src/client/SilentFlowClient.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AAiCO;AACe,MAAA,gBACL,SAAA,UAAA,CAAuB;AA4CpC,IAAA,WAAA,CAAA,aAAA,EAAA,iBAAA,EAAA;;;AAGG;AACG;AA8GN;;;AAGG,IAAA,MAAA,YAAA,CAAA,OAAA,EAAA;YACW;AAiCjB,YAAA,MAAA,CAAA,YAAA,EAAA,YAAA,CAAA,GAAA,MAAA,IAAA,CAAA,kBAAA,CAAA,OAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"SilentFlowClient.mjs","sources":["../../src/client/SilentFlowClient.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;;AA6EI,MAAA,gBAAA,SAAA,UAAA,CAAA;;;AAGG,KAAA;AACG;AA4FN;AAgBA;;;AAGG,IAAA,MAAA,YAAA,CAAA,OAAA,EAAA;YACW;AAqCjB,YAAA,MAAA,CAAA,YAAA,EAAA,YAAA,CAAA,GAAA,MAAA,IAAA,CAAA,kBAAA,CAAA,OAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/config/AppTokenProvider.d.ts

@@ -1,39 +1,39 @@
-/**
- * Extensibility interface, which allows the app developer to return a token, based on the passed-in parameters, instead of fetching tokens from
- * the Identity Provider (AAD).
- * Developers need to construct and return an AppTokenProviderResult object back to MSAL. MSAL will cache the token response
- * in the same way it would do if the result were comming from AAD.
- * This extensibility point is only defined for the client_credential flow, i.e. acquireTokenByClientCredential and
- * meant for Azure SDK to enhance Managed Identity support.
- */
-export interface IAppTokenProvider {
-    (appTokenProviderParameters: AppTokenProviderParameters): Promise<AppTokenProviderResult>;
-}
-/**
- * Input object for the IAppTokenProvider extensiblity. MSAL will create this object, which can be used
- * to help create an AppTokenProviderResult.
- *
- * - correlationId           - the correlation Id associated with the request
- * - tenantId                - the tenant Id for which the token must be provided
- * - scopes                  - the scopes for which the token must be provided
- * - claims                  - any extra claims that the token must satisfy
- */
-export type AppTokenProviderParameters = {
-    readonly correlationId?: string;
-    readonly tenantId: string;
-    readonly scopes: Array<string>;
-    readonly claims?: string;
-};
-/**
- * Output object for IAppTokenProvider extensiblity.
- *
- * - accessToken            - the actual access token, typically in JWT format, that satisfies the request data AppTokenProviderParameters
- * - expiresInSeconds       - how long the tokens has before expiry, in seconds. Similar to the "expires_in" field in an AAD token response.
- * - refreshInSeconds       - how long the token has before it should be proactively refreshed. Similar to the "refresh_in" field in an AAD token response.
- */
-export type AppTokenProviderResult = {
-    accessToken: string;
-    expiresInSeconds: number;
-    refreshInSeconds?: number;
-};
+/**
+ * Extensibility interface, which allows the app developer to return a token, based on the passed-in parameters, instead of fetching tokens from
+ * the Identity Provider (AAD).
+ * Developers need to construct and return an AppTokenProviderResult object back to MSAL. MSAL will cache the token response
+ * in the same way it would do if the result were comming from AAD.
+ * This extensibility point is only defined for the client_credential flow, i.e. acquireTokenByClientCredential and
+ * meant for Azure SDK to enhance Managed Identity support.
+ */
+export interface IAppTokenProvider {
+    (appTokenProviderParameters: AppTokenProviderParameters): Promise<AppTokenProviderResult>;
+}
+/**
+ * Input object for the IAppTokenProvider extensiblity. MSAL will create this object, which can be used
+ * to help create an AppTokenProviderResult.
+ *
+ * - correlationId           - the correlation Id associated with the request
+ * - tenantId                - the tenant Id for which the token must be provided
+ * - scopes                  - the scopes for which the token must be provided
+ * - claims                  - any extra claims that the token must satisfy
+ */
+export type AppTokenProviderParameters = {
+    readonly correlationId?: string;
+    readonly tenantId: string;
+    readonly scopes: Array<string>;
+    readonly claims?: string;
+};
+/**
+ * Output object for IAppTokenProvider extensiblity.
+ *
+ * - accessToken            - the actual access token, typically in JWT format, that satisfies the request data AppTokenProviderParameters
+ * - expiresInSeconds       - how long the tokens has before expiry, in seconds. Similar to the "expires_in" field in an AAD token response.
+ * - refreshInSeconds       - how long the token has before it should be proactively refreshed. Similar to the "refresh_in" field in an AAD token response.
+ */
+export type AppTokenProviderResult = {
+    accessToken: string;
+    expiresInSeconds: number;
+    refreshInSeconds?: number;
+};
 //# sourceMappingURL=AppTokenProvider.d.ts.map