@azure/msal-common 14.1.0 → 14.2.0

package/src/cache/CacheManager.ts

@@ -42,6 +42,12 @@ import { BaseAuthRequest } from "../request/BaseAuthRequest";
 import { Logger } from "../logger/Logger";
 import { name, version } from "../packageMetadata";
 import { StoreInCache } from "../request/StoreInCache";
+import {
+    getAliasesFromConfigMetadata,
+    getHardcodedAliasesForCanonicalAuthority,
+} from "../authority/AuthorityMetadata";
+import { StaticAuthorityOptions } from "../authority/AuthorityOptions";
+import { TokenClaims } from "../account/TokenClaims";
 
 /**
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
@@ -52,11 +58,18 @@ export abstract class CacheManager implements ICacheManager {
     protected cryptoImpl: ICrypto;
     // Instance of logger for functions defined in the msal-common layer
     private commonLogger: Logger;
-
-    constructor(clientId: string, cryptoImpl: ICrypto, logger: Logger) {
+    private staticAuthorityOptions?: StaticAuthorityOptions;
+
+    constructor(
+        clientId: string,
+        cryptoImpl: ICrypto,
+        logger: Logger,
+        staticAuthorityOptions?: StaticAuthorityOptions
+    ) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
         this.commonLogger = logger.clone(name, version);
+        this.staticAuthorityOptions = staticAuthorityOptions;
     }
 
     /**
@@ -226,67 +239,93 @@ export abstract class CacheManager implements ICacheManager {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
-        if (accountFilter) {
-            return this.getAccountsFilteredBy(accountFilter).map(
-                (accountEntity) => {
-                    return accountEntity.getAccountInfo();
-                }
-            );
-        }
-
-        const allAccountKeys = this.getAccountKeys();
-        if (allAccountKeys.length < 1) {
-            return [];
-        }
-
-        const accountEntities: AccountEntity[] = allAccountKeys.reduce(
-            (accounts: AccountEntity[], key: string) => {
-                const entity: AccountEntity | null = this.getAccount(key);
-
-                if (!entity) {
-                    return accounts;
+        const validAccounts: AccountInfo[] = [];
+        this.getAccountsFilteredBy(accountFilter || {}).forEach(
+            (accountEntity: AccountEntity) => {
+                const accountInfo = this.getAccountInfoFromEntity(
+                    accountEntity,
+                    accountFilter
+                );
+                if (accountInfo) {
+                    validAccounts.push(accountInfo);
                 }
-                accounts.push(entity);
-                return accounts;
-            },
-            []
-        );
-
-        const allAccounts = accountEntities.map<AccountInfo>(
-            (accountEntity) => {
-                return this.getAccountInfoFromEntity(accountEntity);
             }
         );
-        return allAccounts;
+        return validAccounts;
     }
 
     /**
      * Gets accountInfo object based on provided filters
      */
     getAccountInfoFilteredBy(accountFilter: AccountFilter): AccountInfo | null {
-        const allAccounts = this.getAccountsFilteredBy(accountFilter);
+        const allAccounts = this.getAllAccounts(accountFilter);
         if (allAccounts.length > 0) {
-            return this.getAccountInfoFromEntity(allAccounts[0]);
+            return allAccounts[0];
+        } else {
+            return null;
+        }
+    }
+
+    /**
+     * Returns a single matching
+     * @param accountFilter
+     * @returns
+     */
+    getBaseAccountInfo(accountFilter: AccountFilter): AccountInfo | null {
+        const accountEntities = this.getAccountsFilteredBy(accountFilter);
+        if (accountEntities.length > 0) {
+            return accountEntities[0].getAccountInfo();
         } else {
             return null;
         }
     }
 
     private getAccountInfoFromEntity(
-        accountEntity: AccountEntity
-    ): AccountInfo {
+        accountEntity: AccountEntity,
+        accountFilter?: AccountFilter
+    ): AccountInfo | null {
         const accountInfo = accountEntity.getAccountInfo();
         const idToken = this.getIdToken(accountInfo);
         if (idToken) {
-            accountInfo.idToken = idToken.secret;
-            accountInfo.idTokenClaims = extractTokenClaims(
+            const idTokenClaims = extractTokenClaims(
                 idToken.secret,
                 this.cryptoImpl.base64Decode
             );
+
+            if (
+                this.idTokenClaimsMatchAccountFilter(
+                    idTokenClaims,
+                    accountFilter
+                )
+            ) {
+                accountInfo.idToken = idToken.secret;
+                accountInfo.idTokenClaims = idTokenClaims;
+                return accountInfo;
+            }
         }
-        return accountInfo;
+        return null;
     }
 
+    private idTokenClaimsMatchAccountFilter(
+        idTokenClaims: TokenClaims,
+        accountFilter?: AccountFilter
+    ): boolean {
+        if (accountFilter) {
+            if (
+                !!accountFilter.loginHint &&
+                !this.matchLoginHint(idTokenClaims, accountFilter.loginHint)
+            ) {
+                return false;
+            }
+            if (
+                !!accountFilter.sid &&
+                !this.matchSid(idTokenClaims, accountFilter.sid)
+            ) {
+                return false;
+            }
+        }
+        return true;
+    }
     /**
      * saves a cache record
      * @param cacheRecord
@@ -377,7 +416,6 @@ export abstract class CacheManager implements ICacheManager {
     getAccountsFilteredBy(accountFilter: AccountFilter): AccountEntity[] {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts: AccountEntity[] = [];
-
         allAccountKeys.forEach((cacheKey) => {
             if (
                 !this.isAccountKey(
@@ -449,13 +487,6 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
-            if (
-                !!accountFilter.loginHint &&
-                !this.matchLoginHint(entity, accountFilter.loginHint)
-            ) {
-                return;
-            }
-
             if (
                 !!accountFilter.authorityType &&
                 !this.matchAuthorityType(entity, accountFilter.authorityType)
@@ -957,7 +988,6 @@ export abstract class CacheManager implements ICacheManager {
             ) {
                 return;
             }
-
             const idToken = this.getIdTokenCredential(key);
             if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                 idTokens.push(idToken);
@@ -1391,6 +1421,27 @@ export abstract class CacheManager implements ICacheManager {
         entity: AccountEntity | CredentialEntity | AppMetadataEntity,
         environment: string
     ): boolean {
+        // Check static authority options first for cases where authority metadata has not been resolved and cached yet
+        if (this.staticAuthorityOptions) {
+            const staticAliases =
+                getAliasesFromConfigMetadata(
+                    this.staticAuthorityOptions.canonicalAuthority,
+                    this.staticAuthorityOptions.cloudDiscoveryMetadata
+                ) ||
+                getHardcodedAliasesForCanonicalAuthority(
+                    this.staticAuthorityOptions.canonicalAuthority
+                ) ||
+                this.staticAuthorityOptions.knownAuthorities;
+            if (
+                staticAliases &&
+                staticAliases.includes(environment) &&
+                staticAliases.includes(entity.environment)
+            ) {
+                return true;
+            }
+        }
+
+        // Query metadata cache if no static authority configuration has aliases that match enviroment
         const cloudMetadata = this.getAuthorityMetadataByAlias(environment);
         if (
             cloudMetadata &&
@@ -1398,7 +1449,6 @@ export abstract class CacheManager implements ICacheManager {
         ) {
             return true;
         }
-
         return false;
     }
 
@@ -1477,22 +1527,35 @@ export abstract class CacheManager implements ICacheManager {
      * @param loginHint
      * @returns
      */
-    private matchLoginHint(entity: AccountEntity, loginHint: string): boolean {
-        if (entity.idTokenClaims?.login_hint === loginHint) {
+    private matchLoginHint(
+        idTokenClaims: TokenClaims,
+        loginHint: string
+    ): boolean {
+        if (idTokenClaims?.login_hint === loginHint) {
             return true;
         }
 
-        if (entity.username === loginHint) {
+        if (idTokenClaims.preferred_username === loginHint) {
             return true;
         }
 
-        if (entity.idTokenClaims?.upn === loginHint) {
+        if (idTokenClaims?.upn === loginHint) {
             return true;
         }
 
         return false;
     }
 
+    /**
+     * Helper to match sid
+     * @param idTokenClaims
+     * @param sid
+     * @returns true if the sid claim is present and matches the filter
+     */
+    private matchSid(idTokenClaims: TokenClaims, sid: string): boolean {
+        return !!(idTokenClaims?.sid && idTokenClaims.sid === sid);
+    }
+
     private matchAuthorityType(
         entity: AccountEntity,
         authorityType: string

package/src/cache/entities/AccountEntity.ts

@@ -153,8 +153,6 @@ export class AccountEntity {
         account.realm =
             accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
 
-        account.idTokenClaims = accountDetails.idTokenClaims;
-
         // How do you account for MSA CID here?
         account.localAccountId =
             accountDetails.idTokenClaims.oid ||
@@ -207,7 +205,6 @@ export class AccountEntity {
 
         account.username = accountInfo.username;
         account.name = accountInfo.name;
-        account.idTokenClaims = accountInfo.idTokenClaims;
 
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;

package/src/cache/utils/CacheTypes.ts

@@ -59,6 +59,7 @@ export type AccountFilter = Omit<
 > & {
     realm?: string;
     loginHint?: string;
+    sid?: string;
 };
 
 /**

package/src/client/AuthorizationCodeClient.ts

@@ -297,11 +297,18 @@ export class AuthorizationCodeClient extends BaseClient {
 
         return invokeAsync(
             this.executePostToTokenEndpoint.bind(this),
-            PerformanceEvents.BaseClientExecutePostToTokenEndpoint,
+            PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
+        )(
+            endpoint,
+            requestBody,
+            headers,
+            thumbprint,
+            request.correlationId,
+            PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint
+        );
     }
 
     /**

package/src/client/BaseClient.ts

@@ -28,7 +28,6 @@ import { buildClientInfoFromHomeAccountId } from "../account/ClientInfo";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 import { RequestParameterBuilder } from "../request/RequestParameterBuilder";
 import { BaseAuthRequest } from "../request/BaseAuthRequest";
-import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 
 /**
  * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
@@ -144,12 +143,16 @@ export abstract class BaseClient {
         queryString: string,
         headers: Record<string, string>,
         thumbprint: RequestThumbprint,
-        correlationId: string
+        correlationId: string,
+        queuedEvent?: string
     ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
-        this.performanceClient?.addQueueMeasurement(
-            PerformanceEvents.BaseClientExecutePostToTokenEndpoint,
-            correlationId
-        );
+        if (queuedEvent) {
+            this.performanceClient?.addQueueMeasurement(
+                queuedEvent,
+                correlationId
+            );
+        }
+
         const response =
             await this.networkManager.sendPostRequest<ServerAuthorizationTokenResponse>(
                 thumbprint,

package/src/client/RefreshTokenClient.ts

@@ -46,7 +46,7 @@ import {
 } from "../error/InteractionRequiredAuthError";
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
-import { invokeAsync } from "../utils/FunctionWrappers";
+import { invoke, invokeAsync } from "../utils/FunctionWrappers";
 /**
  * OAuth2.0 refresh token client
  * @internal
@@ -196,10 +196,13 @@ export class RefreshTokenClient extends BaseClient {
         );
 
         // fetches family RT or application RT based on FOCI value
-        const refreshToken = this.cacheManager.getRefreshToken(
-            request.account,
-            foci
-        );
+        const refreshToken = invoke(
+            this.cacheManager.getRefreshToken.bind(this.cacheManager),
+            PerformanceEvents.CacheManagerGetRefreshToken,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(request.account, foci);
 
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(
@@ -274,11 +277,18 @@ export class RefreshTokenClient extends BaseClient {
 
         return invokeAsync(
             this.executePostToTokenEndpoint.bind(this),
-            PerformanceEvents.BaseClientExecutePostToTokenEndpoint,
+            PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
+        )(
+            endpoint,
+            requestBody,
+            headers,
+            thumbprint,
+            request.correlationId,
+            PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint
+        );
     }
 
     /**

package/src/client/SilentFlowClient.ts

@@ -14,10 +14,6 @@ import {
     ClientAuthErrorCodes,
     createClientAuthError,
 } from "../error/ClientAuthError";
-import {
-    createClientConfigurationError,
-    ClientConfigurationErrorCodes,
-} from "../error/ClientConfigurationError";
 import { ResponseHandler } from "../response/ResponseHandler";
 import { CacheRecord } from "../cache/entities/CacheRecord";
 import { CacheOutcome } from "../utils/Constants";
@@ -25,6 +21,8 @@ import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient"
 import { StringUtils } from "../utils/StringUtils";
 import { checkMaxAge, extractTokenClaims } from "../account/AuthToken";
 import { TokenClaims } from "../account/TokenClaims";
+import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
+import { invokeAsync } from "../utils/FunctionWrappers";
 
 /** @internal */
 export class SilentFlowClient extends BaseClient {
@@ -92,35 +90,21 @@ export class SilentFlowClient extends BaseClient {
     async acquireCachedToken(
         request: CommonSilentFlowRequest
     ): Promise<[AuthenticationResult, CacheOutcome]> {
+        this.performanceClient?.addQueueMeasurement(
+            PerformanceEvents.SilentFlowClientAcquireCachedToken,
+            request.correlationId
+        );
         let lastCacheOutcome: CacheOutcome = CacheOutcome.NOT_APPLICABLE;
 
-        // Cannot renew token if no request object is given.
-        if (!request) {
-            throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.tokenRequestEmpty
-            );
-        }
-
-        if (request.forceRefresh) {
-            // Must refresh due to present force_refresh flag.
-            lastCacheOutcome = CacheOutcome.FORCE_REFRESH_OR_CLAIMS;
-            this.serverTelemetryManager?.setCacheOutcome(
-                CacheOutcome.FORCE_REFRESH_OR_CLAIMS
-            );
-            this.logger.info(
-                "SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true."
-            );
-            throw createClientAuthError(
-                ClientAuthErrorCodes.tokenRefreshRequired
-            );
-        } else if (
-            !this.config.cacheOptions.claimsBasedCachingEnabled &&
-            !StringUtils.isEmptyObj(request.claims)
+        if (
+            request.forceRefresh ||
+            (!this.config.cacheOptions.claimsBasedCachingEnabled &&
+                !StringUtils.isEmptyObj(request.claims))
         ) {
-            lastCacheOutcome = CacheOutcome.FORCE_REFRESH_OR_CLAIMS;
-            // Must refresh due to request parameters.
-            this.logger.info(
-                "SilentFlowClient:acquireCachedToken - Skipping cache because claims-based caching is disabled and claims were requested."
+            // Must refresh due to present force_refresh flag.
+            this.setCacheOutcome(
+                CacheOutcome.FORCE_REFRESH_OR_CLAIMS,
+                request.correlationId
             );
             throw createClientAuthError(
                 ClientAuthErrorCodes.tokenRefreshRequired
@@ -145,12 +129,9 @@ export class SilentFlowClient extends BaseClient {
 
         if (!cacheRecord.accessToken) {
             // must refresh due to non-existent access_token
-            lastCacheOutcome = CacheOutcome.NO_CACHED_ACCESS_TOKEN;
-            this.serverTelemetryManager?.setCacheOutcome(
-                CacheOutcome.NO_CACHED_ACCESS_TOKEN
-            );
-            this.logger.info(
-                "SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties."
+            this.setCacheOutcome(
+                CacheOutcome.NO_CACHED_ACCESS_TOKEN,
+                request.correlationId
             );
             throw createClientAuthError(
                 ClientAuthErrorCodes.tokenRefreshRequired
@@ -163,12 +144,9 @@ export class SilentFlowClient extends BaseClient {
             )
         ) {
             // must refresh due to the expires_in value
-            lastCacheOutcome = CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED;
-            this.serverTelemetryManager?.setCacheOutcome(
-                CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED
-            );
-            this.logger.info(
-                `SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`
+            this.setCacheOutcome(
+                CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED,
+                request.correlationId
             );
             throw createClientAuthError(
                 ClientAuthErrorCodes.tokenRefreshRequired
@@ -179,26 +157,44 @@ export class SilentFlowClient extends BaseClient {
         ) {
             // must refresh (in the background) due to the refresh_in value
             lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
-            this.serverTelemetryManager?.setCacheOutcome(
-                CacheOutcome.PROACTIVELY_REFRESHED
-            );
-            this.logger.info(
-                "SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'."
-            );
 
             // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
         }
 
+        this.setCacheOutcome(lastCacheOutcome, request.correlationId);
+
         if (this.config.serverTelemetryManager) {
             this.config.serverTelemetryManager.incrementCacheHits();
         }
 
         return [
-            await this.generateResultFromCacheRecord(cacheRecord, request),
+            await invokeAsync(
+                this.generateResultFromCacheRecord.bind(this),
+                PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(cacheRecord, request),
             lastCacheOutcome,
         ];
     }
 
+    private setCacheOutcome(
+        cacheOutcome: CacheOutcome,
+        correlationId: string
+    ): void {
+        this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);
+        this.performanceClient?.addFields(
+            {
+                cacheOutcome: cacheOutcome,
+            },
+            correlationId
+        );
+        this.logger.info(
+            `Token refresh is required due to cache outcome: ${cacheOutcome}`
+        );
+    }
+
     /**
      * Helper function to build response object from the CacheRecord
      * @param cacheRecord
@@ -207,6 +203,10 @@ export class SilentFlowClient extends BaseClient {
         cacheRecord: CacheRecord,
         request: CommonSilentFlowRequest
     ): Promise<AuthenticationResult> {
+        this.performanceClient?.addQueueMeasurement(
+            PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord,
+            request.correlationId
+        );
         let idTokenClaims: TokenClaims | undefined;
         if (cacheRecord.idToken) {
             idTokenClaims = extractTokenClaims(

package/src/error/ClientAuthError.ts

@@ -89,6 +89,8 @@ export const ClientAuthErrorMessages = {
         "A tenant id - not common, organizations, or consumers - must be specified when using the client_credentials flow.",
     [ClientAuthErrorCodes.methodNotImplemented]:
         "This method has not been implemented",
+    [ClientAuthErrorCodes.nestedAppAuthBridgeDisabled]:
+        "The nested app auth bridge is disabled",
 };
 
 /**
@@ -306,6 +308,12 @@ export const ClientAuthErrorMessage = {
             ClientAuthErrorCodes.missingTenantIdError
         ],
     },
+    nestedAppAuthBridgeDisabled: {
+        code: ClientAuthErrorCodes.nestedAppAuthBridgeDisabled,
+        desc: ClientAuthErrorMessages[
+            ClientAuthErrorCodes.nestedAppAuthBridgeDisabled
+        ],
+    },
 };
 
 /**

package/src/error/ClientAuthErrorCodes.ts

@@ -49,3 +49,4 @@ export const noNetworkConnectivity = "no_network_connectivity";
 export const userCanceled = "user_canceled";
 export const missingTenantIdError = "missing_tenant_id_error";
 export const methodNotImplemented = "method_not_implemented";
+export const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";

package/src/index.ts

@@ -39,10 +39,15 @@ export {
     buildClientInfoFromHomeAccountId,
 } from "./account/ClientInfo";
 // Authority
-export { Authority } from "./authority/Authority";
+export {
+    Authority,
+    formatAuthorityUri,
+    buildStaticAuthorityOptions,
+} from "./authority/Authority";
 export {
     AuthorityOptions,
     AzureCloudInstance,
+    StaticAuthorityOptions,
 } from "./authority/AuthorityOptions";
 export { AuthorityFactory } from "./authority/AuthorityFactory";
 export { AuthorityType } from "./authority/AuthorityType";

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.1.0";
+export const version = "14.2.0";

package/src/response/ResponseHandler.ts

@@ -44,6 +44,7 @@ import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient"
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { checkMaxAge, extractTokenClaims } from "../account/AuthToken";
 import { TokenClaims } from "../account/TokenClaims";
+import { AccountInfo } from "../account/AccountInfo";
 
 /**
  * Class that handles response parsing.
@@ -599,14 +600,19 @@ export class ResponseHandler {
                 serverTokenResponse?.spa_accountid;
         }
 
+        const accountInfo: AccountInfo | null = cacheRecord.account
+            ? {
+                  ...cacheRecord.account.getAccountInfo(),
+                  idTokenClaims,
+              }
+            : null;
+
         return {
             authority: authority.canonicalAuthority,
             uniqueId: uid,
             tenantId: tid,
             scopes: responseScopes,
-            account: cacheRecord.account
-                ? cacheRecord.account.getAccountInfo()
-                : null,
+            account: accountInfo,
             idToken: cacheRecord?.idToken?.secret || "",
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken,