@azure/msal-common 14.11.0 → 14.12.1-alpha.0

package/dist/crypto/PopTokenGenerator.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 import { nowSeconds } from '../utils/TimeUtils.mjs';
 import { UrlString } from '../url/UrlString.mjs';
@@ -28,11 +28,10 @@ class PopTokenGenerator {
     async generateCnf(request, logger) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
         const reqCnf = await invokeAsync(this.generateKid.bind(this), PerformanceEvents.PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
-        const reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+        const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
         return {
             kid: reqCnf.kid,
             reqCnfString,
-            reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
         };
     }
     /**

package/dist/crypto/PopTokenGenerator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"PopTokenGenerator.mjs","sources":["../../src/crypto/PopTokenGenerator.ts"],"sourcesContent":[null],"names":["TimeUtils.nowSeconds"],"mappings":";;;;;;;AAAA;;;AAGG;AA4BH,MAAM,WAAW,GAAG;AAChB,IAAA,EAAE,EAAE,IAAI;AACR,IAAA,GAAG,EAAE,KAAK;CACJ,CAAC;AAGX;MACa,iBAAiB,CAAA;IAI1B,WAAY,CAAA,WAAoB,EAAE,iBAAsC,EAAA;AACpE,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AAC/B,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;KAC9C;AAED;;;;;AAKG;AACH,IAAA,MAAM,WAAW,CACb,OAAoC,EACpC,MAAc,EAAA;AAEd,QAAA,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CACvC,iBAAiB,CAAC,mBAAmB,EACrC,OAAO,CAAC,aAAa,CACxB,CAAC;AAEF,QAAA,MAAM,MAAM,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3B,iBAAiB,CAAC,mBAAmB,EACrC,MAAM,EACN,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,CAAC,CAAC;AACX,QAAA,MAAM,YAAY,GAAW,IAAI,CAAC,WAAW,CAAC,YAAY,CACtD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CACzB,CAAC;QAEF,OAAO;YACH,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,YAAY;YACZ,UAAU,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC;SAC9D,CAAC;KACL;AAED;;;;AAIG;IACH,MAAM,WAAW,CAAC,OAAoC,EAAA;AAClD,QAAA,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CACvC,iBAAiB,CAAC,mBAAmB,EACrC,OAAO,CAAC,aAAa,CACxB,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAC/D,OAAO,CACV,CAAC;QAEF,OAAO;AACH,YAAA,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,WAAW,CAAC,EAAE;SAC1B,CAAC;KACL;AAED;;;;;AAKG;AACH,IAAA,MAAM,YAAY,CACd,WAAmB,EACnB,KAAa,EACb,OAAoC,EAAA;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;KACxD;AAED;;;;;;;AAOG;IACH,MAAM,WAAW,CACb,OAAe,EACf,KAAa,EACb,OAAoC,EACpC,MAAe,EAAA;;AAGf,QAAA,MAAM,EACF,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,UAAU,GACb,GAAG,OAAO,CAAC;QAEZ,MAAM,iBAAiB,GAAG,kBAAkB;AACxC,cAAE,IAAI,SAAS,CAAC,kBAAkB,CAAC;cACjC,SAAS,CAAC;AAChB,QAAA,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AACpE,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAC3B;AACI,YAAA,EAAE,EAAE,OAAO;AACX,YAAA,EAAE,EAAEA,UAAoB,EAAE;AAC1B,YAAA,CAAC,EAAE,qBAAqB,EAAE,WAAW,EAAE;YACvC,CAAC,EAAE,qBAAqB,EAAE,eAAe;YACzC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;YACnD,CAAC,EAAE,qBAAqB,EAAE,YAAY;YACtC,CAAC,EAAE,qBAAqB,EAAE,WAAW;AACjC,kBAAE,CAAC,EAAE,EAAE,qBAAqB,CAAC,WAAW,CAAC;AACzC,kBAAE,SAAS;YACf,aAAa,EAAE,SAAS,IAAI,SAAS;AACrC,YAAA,GAAG,MAAM;SACZ,EACD,KAAK,EACL,UAAU,EACV,OAAO,CAAC,aAAa,CACxB,CAAC;KACL;AACJ;;;;"}
+{"version":3,"file":"PopTokenGenerator.mjs","sources":["../../src/crypto/PopTokenGenerator.ts"],"sourcesContent":[null],"names":["TimeUtils.nowSeconds"],"mappings":";;;;;;;AAAA;;;AAGG;AA2BH,MAAM,WAAW,GAAG;AAChB,IAAA,EAAE,EAAE,IAAI;AACR,IAAA,GAAG,EAAE,KAAK;CACJ,CAAC;AAGX;MACa,iBAAiB,CAAA;IAI1B,WAAY,CAAA,WAAoB,EAAE,iBAAsC,EAAA;AACpE,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;AAC/B,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;KAC9C;AAED;;;;;AAKG;AACH,IAAA,MAAM,WAAW,CACb,OAAoC,EACpC,MAAc,EAAA;AAEd,QAAA,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CACvC,iBAAiB,CAAC,mBAAmB,EACrC,OAAO,CAAC,aAAa,CACxB,CAAC;AAEF,QAAA,MAAM,MAAM,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3B,iBAAiB,CAAC,mBAAmB,EACrC,MAAM,EACN,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,CAAC,CAAC;AACX,QAAA,MAAM,YAAY,GAAW,IAAI,CAAC,WAAW,CAAC,eAAe,CACzD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CACzB,CAAC;QAEF,OAAO;YACH,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,YAAY;SACf,CAAC;KACL;AAED;;;;AAIG;IACH,MAAM,WAAW,CAAC,OAAoC,EAAA;AAClD,QAAA,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CACvC,iBAAiB,CAAC,mBAAmB,EACrC,OAAO,CAAC,aAAa,CACxB,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAC/D,OAAO,CACV,CAAC;QAEF,OAAO;AACH,YAAA,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,WAAW,CAAC,EAAE;SAC1B,CAAC;KACL;AAED;;;;;AAKG;AACH,IAAA,MAAM,YAAY,CACd,WAAmB,EACnB,KAAa,EACb,OAAoC,EAAA;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;KACxD;AAED;;;;;;;AAOG;IACH,MAAM,WAAW,CACb,OAAe,EACf,KAAa,EACb,OAAoC,EACpC,MAAe,EAAA;;AAGf,QAAA,MAAM,EACF,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,UAAU,GACb,GAAG,OAAO,CAAC;QAEZ,MAAM,iBAAiB,GAAG,kBAAkB;AACxC,cAAE,IAAI,SAAS,CAAC,kBAAkB,CAAC;cACjC,SAAS,CAAC;AAChB,QAAA,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AACpE,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAC3B;AACI,YAAA,EAAE,EAAE,OAAO;AACX,YAAA,EAAE,EAAEA,UAAoB,EAAE;AAC1B,YAAA,CAAC,EAAE,qBAAqB,EAAE,WAAW,EAAE;YACvC,CAAC,EAAE,qBAAqB,EAAE,eAAe;YACzC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;YACnD,CAAC,EAAE,qBAAqB,EAAE,YAAY;YACtC,CAAC,EAAE,qBAAqB,EAAE,WAAW;AACjC,kBAAE,CAAC,EAAE,EAAE,qBAAqB,CAAC,WAAW,CAAC;AACzC,kBAAE,SAAS;YACf,aAAa,EAAE,SAAS,IAAI,SAAS;AACrC,YAAA,GAAG,MAAM;SACZ,EACD,KAAK,EACL,UAAU,EACV,OAAO,CAAC,aAAa,CACxB,CAAC;KACL;AACJ;;;;"}

package/dist/error/AuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 import { Constants } from '../utils/Constants.mjs';
 import { unexpectedError, postRequestFailed } from './AuthErrorCodes.mjs';

package/dist/error/AuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/CacheError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 import { cacheUnknownErrorCode, cacheQuotaExceededErrorCode } from './CacheErrorCodes.mjs';
 import * as CacheErrorCodes from './CacheErrorCodes.mjs';

package/dist/error/CacheErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/ClientAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 import { clientInfoDecodingError, clientInfoEmptyError, tokenParsingError, nullOrEmptyToken, endpointResolutionError, networkError, openIdConfigError, hashNotDeserialized, invalidState, stateMismatch, stateNotFound, nonceMismatch, authTimeNotFound, maxAgeTranspired, multipleMatchingTokens, multipleMatchingAccounts, multipleMatchingAppMetadata, requestCannotBeMade, cannotRemoveEmptyScope, cannotAppendScopeSet, emptyInputScopeSet, deviceCodePollingCancelled, deviceCodeExpired, deviceCodeUnknownError, noAccountInSilentRequest, invalidCacheRecord, invalidCacheEnvironment, noAccountFound, noCryptoObject, unexpectedCredentialType, invalidAssertion, invalidClientCredential, tokenRefreshRequired, userTimeoutReached, tokenClaimsCnfRequiredForSignedJwt, authorizationCodeMissingFromServerResponse, bindingKeyNotRemoved, endSessionEndpointNotSupported, keyIdMissing, noNetworkConnectivity, userCanceled, missingTenantIdError, nestedAppAuthBridgeDisabled, methodNotImplemented } from './ClientAuthErrorCodes.mjs';

package/dist/error/ClientAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/ClientConfigurationError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 import { redirectUriEmpty, claimsRequestParsingError, authorityUriInsecure, urlParseError, urlEmptyError, emptyInputScopesError, invalidPromptValue, invalidClaims, tokenRequestEmpty, logoutRequestEmpty, invalidCodeChallengeMethod, pkceParamsMissing, invalidCloudDiscoveryMetadata, invalidAuthorityMetadata, untrustedAuthority, missingSshJwk, missingSshKid, missingNonceAuthenticationHeader, invalidAuthenticationHeader, cannotSetOIDCOptions, cannotAllowNativeBroker, authorityMismatch } from './ClientConfigurationErrorCodes.mjs';

package/dist/error/ClientConfigurationErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/InteractionRequiredAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 import { Constants } from '../utils/Constants.mjs';
 import { AuthError } from './AuthError.mjs';

package/dist/error/InteractionRequiredAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/JoseHeaderError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 import { missingKidError, missingAlgError } from './JoseHeaderErrorCodes.mjs';

package/dist/error/JoseHeaderErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/error/ServerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist/index.cjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 'use strict';
 
@@ -47,6 +47,7 @@ const Constants = {
     NOT_DEFINED: "not_defined",
     EMPTY_STRING: "",
     NOT_APPLICABLE: "N/A",
+    NOT_AVAILABLE: "Not Available",
     FORWARD_SLASH: "/",
     IMDS_ENDPOINT: "http://169.254.169.254/metadata/instance/compute/location",
     IMDS_VERSION: "2020-06-01",
@@ -3611,6 +3612,12 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     base64Encode: () => {
         throw createClientAuthError(methodNotImplemented);
     },
+    base64UrlEncode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    encodeKid: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
     async getPublicKeyThumbprint() {
         throw createClientAuthError(methodNotImplemented);
     },
@@ -3819,7 +3826,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "14.11.0";
+const version = "14.12.1-alpha.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4260,21 +4267,21 @@ class AccountEntity {
         // How do you account for MSA CID here?
         account.localAccountId =
             clientInfo?.uid ||
-                accountDetails.idTokenClaims.oid ||
-                accountDetails.idTokenClaims.sub ||
+                accountDetails.idTokenClaims?.oid ||
+                accountDetails.idTokenClaims?.sub ||
                 "";
         /*
          * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
          * In most cases it will contain a single email. This field should not be relied upon if a custom
          * policy is configured to return more than 1 email.
          */
-        const preferredUsername = accountDetails.idTokenClaims.preferred_username ||
-            accountDetails.idTokenClaims.upn;
-        const email = accountDetails.idTokenClaims.emails
+        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
+            accountDetails.idTokenClaims?.upn;
+        const email = accountDetails.idTokenClaims?.emails
             ? accountDetails.idTokenClaims.emails[0]
             : null;
         account.username = preferredUsername || email || "";
-        account.name = accountDetails.idTokenClaims.name;
+        account.name = accountDetails.idTokenClaims?.name || "";
         account.cloudGraphHostName = accountDetails.cloudGraphHostName;
         account.msGraphHost = accountDetails.msGraphHost;
         if (accountDetails.tenantProfiles) {
@@ -5559,7 +5566,7 @@ class CacheManager {
     /**
      * Returns true if the credential's keyId matches the one in the request, false otherwise
      * @param entity
-     * @param tokenType
+     * @param keyId
      */
     matchKeyId(entity, keyId) {
         return !!(entity.keyId && entity.keyId === keyId);
@@ -5990,23 +5997,6 @@ class RequestValidator {
             throw createClientConfigurationError(invalidCodeChallengeMethod);
         }
     }
-    /**
-     * Removes unnecessary, duplicate, and empty string query parameters from extraQueryParameters
-     * @param request
-     */
-    static sanitizeEQParams(eQParams, queryParams) {
-        if (!eQParams) {
-            return {};
-        }
-        // Remove any query parameters already included in SSO params
-        queryParams.forEach((_value, key) => {
-            if (eQParams[key]) {
-                delete eQParams[key];
-            }
-        });
-        // remove empty string parameters
-        return Object.fromEntries(Object.entries(eQParams).filter((kv) => kv[1] !== ""));
-    }
 }
 
 /*
@@ -6295,9 +6285,10 @@ class RequestParameterBuilder {
      * @param eQParams
      */
     addExtraQueryParameters(eQParams) {
-        const sanitizedEQParams = RequestValidator.sanitizeEQParams(eQParams, this.parameters);
-        Object.keys(sanitizedEQParams).forEach((key) => {
-            this.parameters.set(key, eQParams[key]);
+        Object.entries(eQParams).forEach(([key, value]) => {
+            if (!this.parameters.has(key) && value) {
+                this.parameters.set(key, value);
+            }
         });
     }
     addClientCapabilitiesToClaims(claims, clientCapabilities) {
@@ -6603,21 +6594,6 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class CacheRecord {
-    constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
-        this.account = accountEntity || null;
-        this.idToken = idTokenEntity || null;
-        this.accessToken = accessTokenEntity || null;
-        this.refreshToken = refreshTokenEntity || null;
-        this.appMetadata = appMetadataEntity || null;
-    }
-}
-
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6711,11 +6687,10 @@ class PopTokenGenerator {
     async generateCnf(request, logger) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
         const reqCnf = await invokeAsync(this.generateKid.bind(this), PerformanceEvents.PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
-        const reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+        const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
         return {
             kid: reqCnf.kid,
             reqCnfString,
-            reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
         };
     }
     /**
@@ -6872,7 +6847,7 @@ class ResponseHandler {
         if (serverResponse.error ||
             serverResponse.error_description ||
             serverResponse.suberror) {
-            const errString = `${serverResponse.error_codes} - [${serverResponse.timestamp}]: ${serverResponse.error_description} - Correlation ID: ${serverResponse.correlation_id} - Trace ID: ${serverResponse.trace_id}`;
+            const errString = `Error(s): ${serverResponse.error_codes || Constants.NOT_AVAILABLE} - Timestamp: ${serverResponse.timestamp || Constants.NOT_AVAILABLE} - Description: ${serverResponse.error_description || Constants.NOT_AVAILABLE} - Correlation ID: ${serverResponse.correlation_id || Constants.NOT_AVAILABLE} - Trace ID: ${serverResponse.trace_id || Constants.NOT_AVAILABLE}`;
             const serverErrorNo = serverResponse.error_codes?.length
                 ? serverResponse.error_codes[0]
                 : undefined;
@@ -6990,7 +6965,7 @@ class ResponseHandler {
         let cachedAccount;
         if (serverTokenResponse.id_token && !!idTokenClaims) {
             cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
-            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, idTokenClaims, this.cryptoObj.base64Decode, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
             this.logger);
         }
         // AccessToken
@@ -7043,7 +7018,13 @@ class ResponseHandler {
                 familyId: serverTokenResponse.foci,
             };
         }
-        return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
+        return {
+            account: cachedAccount,
+            idToken: cachedIdToken,
+            accessToken: cachedAccessToken,
+            refreshToken: cachedRefreshToken,
+            appMetadata: cachedAppMetadata,
+        };
     }
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -7063,7 +7044,13 @@ class ResponseHandler {
         let refreshOn;
         let familyId = Constants.EMPTY_STRING;
         if (cacheRecord.accessToken) {
-            if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP) {
+            /*
+             * if the request object has `popKid` property, `signPopToken` will be set to false and
+             * the token will be returned unsigned
+             */
+            if (cacheRecord.accessToken.tokenType ===
+                AuthenticationScheme.POP &&
+                !request.popKid) {
                 const popTokenGenerator = new PopTokenGenerator(cryptoObj);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
@@ -7126,7 +7113,7 @@ class ResponseHandler {
         };
     }
 }
-function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClaims, base64Decode, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
     logger?.verbose("setCachedAccount called");
     // Check if base account is already cached
     const accountKeys = cacheStorage.getAccountKeys();
@@ -7149,6 +7136,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClai
         }, authority, base64Decode);
     const tenantProfiles = baseAccount.tenantProfiles || [];
     if (claimsTenantId &&
+        idTokenClaims &&
         !tenantProfiles.find((tenantProfile) => {
             return tenantProfile.tenantId === claimsTenantId;
         })) {
@@ -7325,9 +7313,16 @@ class AuthorizationCodeClient extends BaseClient {
         parameterBuilder.addClientInfo();
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
@@ -7521,9 +7516,16 @@ class AuthorizationCodeClient extends BaseClient {
             // pass the req_cnf for POP
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                // req_cnf is always sent as a string for SPAs
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                }
+                else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
+                parameterBuilder.addPopToken(reqCnfData);
             }
         }
         return parameterBuilder.createQueryString();
@@ -7729,9 +7731,16 @@ class RefreshTokenClient extends BaseClient {
         }
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
@@ -8930,7 +8939,6 @@ exports.CacheErrorCodes = CacheErrorCodes;
 exports.CacheHelpers = CacheHelpers;
 exports.CacheManager = CacheManager;
 exports.CacheOutcome = CacheOutcome;
-exports.CacheRecord = CacheRecord;
 exports.CacheType = CacheType;
 exports.CcsCredentialType = CcsCredentialType;
 exports.ClaimsRequestKeys = ClaimsRequestKeys;