@azure/msal-common 14.1.0 → 14.3.0

package/src/cache/CacheManager.ts

@@ -21,6 +21,7 @@ import {
     Separators,
 } from "../utils/Constants";
 import { CredentialEntity } from "./entities/CredentialEntity";
+import { generateCredentialKey } from "./utils/CacheHelpers";
 import { ScopeSet } from "../request/ScopeSet";
 import { AccountEntity } from "./entities/AccountEntity";
 import { AccessTokenEntity } from "./entities/AccessTokenEntity";
@@ -42,6 +43,9 @@ import { BaseAuthRequest } from "../request/BaseAuthRequest";
 import { Logger } from "../logger/Logger";
 import { name, version } from "../packageMetadata";
 import { StoreInCache } from "../request/StoreInCache";
+import { getAliasesFromStaticSources } from "../authority/AuthorityMetadata";
+import { StaticAuthorityOptions } from "../authority/AuthorityOptions";
+import { TokenClaims } from "../account/TokenClaims";
 
 /**
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
@@ -52,11 +56,18 @@ export abstract class CacheManager implements ICacheManager {
     protected cryptoImpl: ICrypto;
     // Instance of logger for functions defined in the msal-common layer
     private commonLogger: Logger;
-
-    constructor(clientId: string, cryptoImpl: ICrypto, logger: Logger) {
+    private staticAuthorityOptions?: StaticAuthorityOptions;
+
+    constructor(
+        clientId: string,
+        cryptoImpl: ICrypto,
+        logger: Logger,
+        staticAuthorityOptions?: StaticAuthorityOptions
+    ) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
         this.commonLogger = logger.clone(name, version);
+        this.staticAuthorityOptions = staticAuthorityOptions;
     }
 
     /**
@@ -226,67 +237,99 @@ export abstract class CacheManager implements ICacheManager {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
-        if (accountFilter) {
-            return this.getAccountsFilteredBy(accountFilter).map(
-                (accountEntity) => {
-                    return accountEntity.getAccountInfo();
-                }
-            );
-        }
-
-        const allAccountKeys = this.getAccountKeys();
-        if (allAccountKeys.length < 1) {
-            return [];
-        }
-
-        const accountEntities: AccountEntity[] = allAccountKeys.reduce(
-            (accounts: AccountEntity[], key: string) => {
-                const entity: AccountEntity | null = this.getAccount(key);
-
-                if (!entity) {
-                    return accounts;
+        const validAccounts: AccountInfo[] = [];
+        this.getAccountsFilteredBy(accountFilter || {}).forEach(
+            (accountEntity: AccountEntity) => {
+                const accountInfo = this.getAccountInfoFromEntity(
+                    accountEntity,
+                    accountFilter
+                );
+                if (accountInfo) {
+                    validAccounts.push(accountInfo);
                 }
-                accounts.push(entity);
-                return accounts;
-            },
-            []
-        );
-
-        const allAccounts = accountEntities.map<AccountInfo>(
-            (accountEntity) => {
-                return this.getAccountInfoFromEntity(accountEntity);
             }
         );
-        return allAccounts;
+        return validAccounts;
     }
 
     /**
      * Gets accountInfo object based on provided filters
      */
     getAccountInfoFilteredBy(accountFilter: AccountFilter): AccountInfo | null {
-        const allAccounts = this.getAccountsFilteredBy(accountFilter);
-        if (allAccounts.length > 0) {
-            return this.getAccountInfoFromEntity(allAccounts[0]);
+        const allAccounts = this.getAllAccounts(accountFilter);
+        if (allAccounts.length > 1) {
+            // If one or more accounts are found, further filter to the first account that has an ID token
+            return allAccounts.filter((account) => {
+                return !!account.idTokenClaims;
+            })[0];
+        } else if (allAccounts.length === 1) {
+            // If only one account is found, return it regardless of whether a matching ID token was found
+            return allAccounts[0];
+        } else {
+            return null;
+        }
+    }
+
+    /**
+     * Returns a single matching
+     * @param accountFilter
+     * @returns
+     */
+    getBaseAccountInfo(accountFilter: AccountFilter): AccountInfo | null {
+        const accountEntities = this.getAccountsFilteredBy(accountFilter);
+        if (accountEntities.length > 0) {
+            return accountEntities[0].getAccountInfo();
         } else {
             return null;
         }
     }
 
     private getAccountInfoFromEntity(
-        accountEntity: AccountEntity
-    ): AccountInfo {
+        accountEntity: AccountEntity,
+        accountFilter?: AccountFilter
+    ): AccountInfo | null {
         const accountInfo = accountEntity.getAccountInfo();
         const idToken = this.getIdToken(accountInfo);
         if (idToken) {
-            accountInfo.idToken = idToken.secret;
-            accountInfo.idTokenClaims = extractTokenClaims(
+            const idTokenClaims = extractTokenClaims(
                 idToken.secret,
                 this.cryptoImpl.base64Decode
             );
+
+            if (
+                this.idTokenClaimsMatchAccountFilter(
+                    idTokenClaims,
+                    accountFilter
+                )
+            ) {
+                accountInfo.idToken = idToken.secret;
+                accountInfo.idTokenClaims = idTokenClaims;
+                return accountInfo;
+            }
         }
         return accountInfo;
     }
 
+    private idTokenClaimsMatchAccountFilter(
+        idTokenClaims: TokenClaims,
+        accountFilter?: AccountFilter
+    ): boolean {
+        if (accountFilter) {
+            if (
+                !!accountFilter.loginHint &&
+                !this.matchLoginHint(idTokenClaims, accountFilter.loginHint)
+            ) {
+                return false;
+            }
+            if (
+                !!accountFilter.sid &&
+                !this.matchSid(idTokenClaims, accountFilter.sid)
+            ) {
+                return false;
+            }
+        }
+        return true;
+    }
     /**
      * saves a cache record
      * @param cacheRecord
@@ -377,7 +420,6 @@ export abstract class CacheManager implements ICacheManager {
     getAccountsFilteredBy(accountFilter: AccountFilter): AccountEntity[] {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts: AccountEntity[] = [];
-
         allAccountKeys.forEach((cacheKey) => {
             if (
                 !this.isAccountKey(
@@ -449,13 +491,6 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
-            if (
-                !!accountFilter.loginHint &&
-                !this.matchLoginHint(entity, accountFilter.loginHint)
-            ) {
-                return;
-            }
-
             if (
                 !!accountFilter.authorityType &&
                 !this.matchAuthorityType(entity, accountFilter.authorityType)
@@ -926,7 +961,7 @@ export abstract class CacheManager implements ICacheManager {
                 "CacheManager:getIdToken - Multiple id tokens found, clearing them"
             );
             idTokens.forEach((idToken) => {
-                this.removeIdToken(idToken.generateCredentialKey());
+                this.removeIdToken(generateCredentialKey(idToken));
             });
             return null;
         }
@@ -957,7 +992,6 @@ export abstract class CacheManager implements ICacheManager {
             ) {
                 return;
             }
-
             const idToken = this.getIdTokenCredential(key);
             if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                 idTokens.push(idToken);
@@ -1083,9 +1117,7 @@ export abstract class CacheManager implements ICacheManager {
                 "CacheManager:getAccessToken - Multiple access tokens found, clearing them"
             );
             accessTokens.forEach((accessToken) => {
-                void this.removeAccessToken(
-                    accessToken.generateCredentialKey()
-                );
+                void this.removeAccessToken(generateCredentialKey(accessToken));
             });
             return null;
         }
@@ -1391,6 +1423,21 @@ export abstract class CacheManager implements ICacheManager {
         entity: AccountEntity | CredentialEntity | AppMetadataEntity,
         environment: string
     ): boolean {
+        // Check static authority options first for cases where authority metadata has not been resolved and cached yet
+        if (this.staticAuthorityOptions) {
+            const staticAliases = getAliasesFromStaticSources(
+                this.staticAuthorityOptions,
+                this.commonLogger
+            );
+            if (
+                staticAliases.includes(environment) &&
+                staticAliases.includes(entity.environment)
+            ) {
+                return true;
+            }
+        }
+
+        // Query metadata cache if no static authority configuration has aliases that match enviroment
         const cloudMetadata = this.getAuthorityMetadataByAlias(environment);
         if (
             cloudMetadata &&
@@ -1398,7 +1445,6 @@ export abstract class CacheManager implements ICacheManager {
         ) {
             return true;
         }
-
         return false;
     }
 
@@ -1477,22 +1523,35 @@ export abstract class CacheManager implements ICacheManager {
      * @param loginHint
      * @returns
      */
-    private matchLoginHint(entity: AccountEntity, loginHint: string): boolean {
-        if (entity.idTokenClaims?.login_hint === loginHint) {
+    private matchLoginHint(
+        idTokenClaims: TokenClaims,
+        loginHint: string
+    ): boolean {
+        if (idTokenClaims?.login_hint === loginHint) {
             return true;
         }
 
-        if (entity.username === loginHint) {
+        if (idTokenClaims.preferred_username === loginHint) {
             return true;
         }
 
-        if (entity.idTokenClaims?.upn === loginHint) {
+        if (idTokenClaims?.upn === loginHint) {
             return true;
         }
 
         return false;
     }
 
+    /**
+     * Helper to match sid
+     * @param idTokenClaims
+     * @param sid
+     * @returns true if the sid claim is present and matches the filter
+     */
+    private matchSid(idTokenClaims: TokenClaims, sid: string): boolean {
+        return !!(idTokenClaims?.sid && idTokenClaims.sid === sid);
+    }
+
     private matchAuthorityType(
         entity: AccountEntity,
         authorityType: string

package/src/cache/entities/AccessTokenEntity.ts

@@ -4,164 +4,28 @@
  */
 
 import { CredentialEntity } from "./CredentialEntity";
-import { CredentialType, AuthenticationScheme } from "../../utils/Constants";
-import { TimeUtils } from "../../utils/TimeUtils";
-import { ICrypto } from "../../crypto/ICrypto";
-import { TokenClaims } from "../../account/TokenClaims";
-import {
-    createClientAuthError,
-    ClientAuthErrorCodes,
-} from "../../error/ClientAuthError";
-import { extractTokenClaims } from "../../account/AuthToken";
+import { AuthenticationScheme } from "../../utils/Constants";
 
 /**
- * ACCESS_TOKEN Credential Type
- *
- * Key:Value Schema:
- *
- * Key Example: uid.utid-login.microsoftonline.com-accesstoken-clientId-contoso.com-user.read
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      familyId: Family ID identifier, usually only used for refresh tokens
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      cachedAt: Absolute device time when entry was created in the cache.
- *      expiresOn: Token expiry time, calculated based on current UTC time in seconds. Represented as a string.
- *      extendedExpiresOn: Additional extended expiry time until when token is valid in case of server-side outage. Represented as string in UTC seconds.
- *      keyId: used for POP and SSH tokenTypes
- *      tokenType: Type of the token issued. Usually "Bearer"
- * }
+ * Access token cache type
  */
-export class AccessTokenEntity extends CredentialEntity {
+export type AccessTokenEntity = CredentialEntity & {
+    /** Full tenant or organizational identifier that the account belongs to */
     realm: string;
+    /** Permissions that are included in the token, or for refresh tokens, the resource identifier. */
     target: string;
+    /** Absolute device time when entry was created in the cache. */
     cachedAt: string;
+    /** Token expiry time, calculated based on current UTC time in seconds. Represented as a string. */
     expiresOn: string;
+    /** Additional extended expiry time until when token is valid in case of server-side outage. Represented as string in UTC seconds. */
     extendedExpiresOn?: string;
+    /** Used for proactive refresh */
     refreshOn?: string;
-    keyId?: string; // for POP and SSH tokenTypes
+    /** Matches the authentication scheme for which the token was issued (i.e. Bearer or pop) */
     tokenType?: AuthenticationScheme;
+    /** Stringified claims object */
     requestedClaims?: string;
+    /** Matches the SHA 256 hash of the claims object included in the token request */
     requestedClaimsHash?: string;
-
-    /**
-     * Create AccessTokenEntity
-     * @param homeAccountId
-     * @param environment
-     * @param accessToken
-     * @param clientId
-     * @param tenantId
-     * @param scopes
-     * @param expiresOn
-     * @param extExpiresOn
-     */
-    static createAccessTokenEntity(
-        homeAccountId: string,
-        environment: string,
-        accessToken: string,
-        clientId: string,
-        tenantId: string,
-        scopes: string,
-        expiresOn: number,
-        extExpiresOn: number,
-        cryptoUtils: ICrypto,
-        refreshOn?: number,
-        tokenType?: AuthenticationScheme,
-        userAssertionHash?: string,
-        keyId?: string,
-        requestedClaims?: string,
-        requestedClaimsHash?: string
-    ): AccessTokenEntity {
-        const atEntity: AccessTokenEntity = new AccessTokenEntity();
-
-        atEntity.homeAccountId = homeAccountId;
-        atEntity.credentialType = CredentialType.ACCESS_TOKEN;
-        atEntity.secret = accessToken;
-
-        const currentTime = TimeUtils.nowSeconds();
-        atEntity.cachedAt = currentTime.toString();
-
-        /*
-         * Token expiry time.
-         * This value should be  calculated based on the current UTC time measured locally and the value  expires_in Represented as a string in JSON.
-         */
-        atEntity.expiresOn = expiresOn.toString();
-        atEntity.extendedExpiresOn = extExpiresOn.toString();
-        if (refreshOn) {
-            atEntity.refreshOn = refreshOn.toString();
-        }
-
-        atEntity.environment = environment;
-        atEntity.clientId = clientId;
-        atEntity.realm = tenantId;
-        atEntity.target = scopes;
-        atEntity.userAssertionHash = userAssertionHash;
-
-        atEntity.tokenType = tokenType || AuthenticationScheme.BEARER;
-
-        if (requestedClaims) {
-            atEntity.requestedClaims = requestedClaims;
-            atEntity.requestedClaimsHash = requestedClaimsHash;
-        }
-
-        /*
-         * Create Access Token With Auth Scheme instead of regular access token
-         * Cast to lower to handle "bearer" from ADFS
-         */
-        if (
-            atEntity.tokenType?.toLowerCase() !==
-            AuthenticationScheme.BEARER.toLowerCase()
-        ) {
-            atEntity.credentialType =
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-            switch (atEntity.tokenType) {
-                case AuthenticationScheme.POP:
-                    // Make sure keyId is present and add it to credential
-                    const tokenClaims: TokenClaims | null = extractTokenClaims(
-                        accessToken,
-                        cryptoUtils.base64Decode
-                    );
-                    if (!tokenClaims?.cnf?.kid) {
-                        throw createClientAuthError(
-                            ClientAuthErrorCodes.tokenClaimsCnfRequiredForSignedJwt
-                        );
-                    }
-                    atEntity.keyId = tokenClaims.cnf.kid;
-                    break;
-                case AuthenticationScheme.SSH:
-                    atEntity.keyId = keyId;
-            }
-        }
-
-        return atEntity;
-    }
-
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isAccessTokenEntity(entity: object): boolean {
-        if (!entity) {
-            return false;
-        }
-
-        return (
-            entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("credentialType") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("secret") &&
-            entity.hasOwnProperty("target") &&
-            (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
-                entity["credentialType"] ===
-                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME)
-        );
-    }
-}
+};

package/src/cache/entities/AccountEntity.ts

@@ -153,8 +153,6 @@ export class AccountEntity {
         account.realm =
             accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
 
-        account.idTokenClaims = accountDetails.idTokenClaims;
-
         // How do you account for MSA CID here?
         account.localAccountId =
             accountDetails.idTokenClaims.oid ||
@@ -207,7 +205,6 @@ export class AccountEntity {
 
         account.username = accountInfo.username;
         account.name = accountInfo.name;
-        account.idTokenClaims = accountInfo.idTokenClaims;
 
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;