@azure/msal-common 14.11.0 → 14.12.1-alpha.0

package/dist/utils/UrlUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.1-alpha.0 2024-06-19 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { hashNotDeserialized } from '../error/ClientAuthErrorCodes.mjs';

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "14.11.0",
+  "version": "14.12.1-alpha.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",

package/src/cache/CacheManager.ts

@@ -1905,7 +1905,7 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * Returns true if the credential's keyId matches the one in the request, false otherwise
      * @param entity
-     * @param tokenType
+     * @param keyId
      */
     private matchKeyId(entity: CredentialEntity, keyId: string): boolean {
         return !!(entity.keyId && entity.keyId === keyId);

package/src/cache/entities/AccountEntity.ts

@@ -135,7 +135,7 @@ export class AccountEntity {
     static createAccount(
         accountDetails: {
             homeAccountId: string;
-            idTokenClaims: TokenClaims;
+            idTokenClaims?: TokenClaims;
             clientInfo?: string;
             cloudGraphHostName?: string;
             msGraphHost?: string;
@@ -189,8 +189,8 @@ export class AccountEntity {
         // How do you account for MSA CID here?
         account.localAccountId =
             clientInfo?.uid ||
-            accountDetails.idTokenClaims.oid ||
-            accountDetails.idTokenClaims.sub ||
+            accountDetails.idTokenClaims?.oid ||
+            accountDetails.idTokenClaims?.sub ||
             "";
 
         /*
@@ -199,14 +199,14 @@ export class AccountEntity {
          * policy is configured to return more than 1 email.
          */
         const preferredUsername =
-            accountDetails.idTokenClaims.preferred_username ||
-            accountDetails.idTokenClaims.upn;
-        const email = accountDetails.idTokenClaims.emails
+            accountDetails.idTokenClaims?.preferred_username ||
+            accountDetails.idTokenClaims?.upn;
+        const email = accountDetails.idTokenClaims?.emails
             ? accountDetails.idTokenClaims.emails[0]
             : null;
 
         account.username = preferredUsername || email || "";
-        account.name = accountDetails.idTokenClaims.name;
+        account.name = accountDetails.idTokenClaims?.name || "";
 
         account.cloudGraphHostName = accountDetails.cloudGraphHostName;
         account.msGraphHost = accountDetails.msGraphHost;

package/src/cache/entities/CacheRecord.ts

@@ -10,24 +10,10 @@ import { AccountEntity } from "./AccountEntity";
 import { AppMetadataEntity } from "./AppMetadataEntity";
 
 /** @internal */
-export class CacheRecord {
-    account: AccountEntity | null;
-    idToken: IdTokenEntity | null;
-    accessToken: AccessTokenEntity | null;
-    refreshToken: RefreshTokenEntity | null;
-    appMetadata: AppMetadataEntity | null;
-
-    constructor(
-        accountEntity?: AccountEntity | null,
-        idTokenEntity?: IdTokenEntity | null,
-        accessTokenEntity?: AccessTokenEntity | null,
-        refreshTokenEntity?: RefreshTokenEntity | null,
-        appMetadataEntity?: AppMetadataEntity | null
-    ) {
-        this.account = accountEntity || null;
-        this.idToken = idTokenEntity || null;
-        this.accessToken = accessTokenEntity || null;
-        this.refreshToken = refreshTokenEntity || null;
-        this.appMetadata = appMetadataEntity || null;
-    }
-}
+export type CacheRecord = {
+    account?: AccountEntity | null;
+    idToken?: IdTokenEntity | null;
+    accessToken?: AccessTokenEntity | null;
+    refreshToken?: RefreshTokenEntity | null;
+    appMetadata?: AppMetadataEntity | null;
+};

package/src/client/AuthorizationCodeClient.ts

@@ -390,15 +390,22 @@ export class AuthorizationCodeClient extends BaseClient {
                 this.performanceClient
             );
 
-            const reqCnfData = await invokeAsync(
-                popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                PerformanceEvents.PopTokenGenerateCnf,
-                this.logger,
-                this.performanceClient,
-                request.correlationId
-            )(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            } else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         } else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
                 parameterBuilder.addSshJwk(request.sshJwk);
@@ -682,15 +689,22 @@ export class AuthorizationCodeClient extends BaseClient {
                 const popTokenGenerator = new PopTokenGenerator(
                     this.cryptoUtils
                 );
-                // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                const reqCnfData = await invokeAsync(
-                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                    PerformanceEvents.PopTokenGenerateCnf,
-                    this.logger,
-                    this.performanceClient,
-                    request.correlationId
-                )(request, this.logger);
-                parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+
+                // req_cnf is always sent as a string for SPAs
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(
+                        popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                        PerformanceEvents.PopTokenGenerateCnf,
+                        this.logger,
+                        this.performanceClient,
+                        request.correlationId
+                    )(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                } else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
+                parameterBuilder.addPopToken(reqCnfData);
             }
         }
 

package/src/client/RefreshTokenClient.ts

@@ -407,15 +407,24 @@ export class RefreshTokenClient extends BaseClient {
                 this.cryptoUtils,
                 this.performanceClient
             );
-            const reqCnfData = await invokeAsync(
-                popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                PerformanceEvents.PopTokenGenerateCnf,
-                this.logger,
-                this.performanceClient,
-                request.correlationId
-            )(request, this.logger);
+
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(request, this.logger);
+
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            } else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         } else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
                 parameterBuilder.addSshJwk(request.sshJwk);

package/src/crypto/ICrypto.ts

@@ -49,6 +49,16 @@ export interface ICrypto {
      * @param input
      */
     base64Decode(input: string): string;
+    /**
+     * base64 URL safe encoded string
+     */
+    base64UrlEncode(input: string): string;
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid: string): string;
     /**
      * Generates an JWK RSA S256 Thumbprint
      * @param request
@@ -92,6 +102,12 @@ export const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {
     base64Encode: (): string => {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     },
+    base64UrlEncode: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    encodeKid: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
     async getPublicKeyThumbprint(): Promise<string> {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     },

package/src/crypto/PopTokenGenerator.ts

@@ -26,7 +26,6 @@ type ReqCnf = {
 export type ReqCnfData = {
     kid: string;
     reqCnfString: string;
-    reqCnfHash: string;
 };
 
 const KeyLocation = {
@@ -67,14 +66,13 @@ export class PopTokenGenerator {
             this.performanceClient,
             request.correlationId
         )(request);
-        const reqCnfString: string = this.cryptoUtils.base64Encode(
+        const reqCnfString: string = this.cryptoUtils.base64UrlEncode(
             JSON.stringify(reqCnf)
         );
 
         return {
             kid: reqCnf.kid,
             reqCnfString,
-            reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
         };
     }
 

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.11.0";
+export const version = "14.12.1-alpha.0";

package/src/request/BaseAuthRequest.ts

@@ -28,6 +28,7 @@ import { ShrOptions } from "../crypto/SignedHttpRequest";
  * - tokenQueryParameters    - String to string map of custom query parameters added to the /token call
  * - storeInCache            - Object containing boolean values indicating whether to store tokens in the cache or not (default is true)
  * - scenarioId              - Scenario id to track custom user prompts
+ * - popKid                  - Key ID to identify the public key for PoP token request
  */
 export type BaseAuthRequest = {
     authority: string;
@@ -48,4 +49,5 @@ export type BaseAuthRequest = {
     tokenQueryParameters?: StringDict;
     storeInCache?: StoreInCache;
     scenarioId?: string;
+    popKid?: string;
 };

package/src/request/RequestParameterBuilder.ts

@@ -465,12 +465,10 @@ export class RequestParameterBuilder {
      * @param eQParams
      */
     addExtraQueryParameters(eQParams: StringDict): void {
-        const sanitizedEQParams = RequestValidator.sanitizeEQParams(
-            eQParams,
-            this.parameters
-        );
-        Object.keys(sanitizedEQParams).forEach((key) => {
-            this.parameters.set(key, eQParams[key]);
+        Object.entries(eQParams).forEach(([key, value]) => {
+            if (!this.parameters.has(key) && value) {
+                this.parameters.set(key, value);
+            }
         });
     }
 

package/src/request/RequestValidator.ts

@@ -8,7 +8,6 @@ import {
     ClientConfigurationErrorCodes,
 } from "../error/ClientConfigurationError";
 import { PromptValue, CodeChallengeMethodValues } from "../utils/Constants";
-import { StringDict } from "../utils/MsalTypes";
 
 /**
  * Validates server consumable params from the "request" objects
@@ -88,29 +87,4 @@ export class RequestValidator {
             );
         }
     }
-
-    /**
-     * Removes unnecessary, duplicate, and empty string query parameters from extraQueryParameters
-     * @param request
-     */
-    static sanitizeEQParams(
-        eQParams: StringDict,
-        queryParams: Map<string, string>
-    ): StringDict {
-        if (!eQParams) {
-            return {};
-        }
-
-        // Remove any query parameters already included in SSO params
-        queryParams.forEach((_value, key) => {
-            if (eQParams[key]) {
-                delete eQParams[key];
-            }
-        });
-
-        // remove empty string parameters
-        return Object.fromEntries(
-            Object.entries(eQParams).filter((kv) => kv[1] !== "")
-        );
-    }
 }

package/src/response/ExternalTokenResponse.ts

@@ -17,7 +17,14 @@ import { ServerAuthorizationTokenResponse } from "./ServerAuthorizationTokenResp
  */
 export type ExternalTokenResponse = Pick<
     ServerAuthorizationTokenResponse,
-    "token_type" | "scope" | "expires_in" | "id_token" | "refresh_token"
+    | "token_type"
+    | "scope"
+    | "expires_in"
+    | "ext_expires_in"
+    | "id_token"
+    | "refresh_token"
+    | "refresh_token_expires_in"
+    | "foci"
 > & {
     access_token?: string;
     client_info?: string;

package/src/response/ResponseHandler.ts

@@ -197,7 +197,17 @@ export class ResponseHandler {
             serverResponse.error_description ||
             serverResponse.suberror
         ) {
-            const errString = `${serverResponse.error_codes} - [${serverResponse.timestamp}]: ${serverResponse.error_description} - Correlation ID: ${serverResponse.correlation_id} - Trace ID: ${serverResponse.trace_id}`;
+            const errString = `Error(s): ${
+                serverResponse.error_codes || Constants.NOT_AVAILABLE
+            } - Timestamp: ${
+                serverResponse.timestamp || Constants.NOT_AVAILABLE
+            } - Description: ${
+                serverResponse.error_description || Constants.NOT_AVAILABLE
+            } - Correlation ID: ${
+                serverResponse.correlation_id || Constants.NOT_AVAILABLE
+            } - Trace ID: ${
+                serverResponse.trace_id || Constants.NOT_AVAILABLE
+            }`;
             const serverErrorNo = serverResponse.error_codes?.length
                 ? serverResponse.error_codes[0]
                 : undefined;
@@ -454,8 +464,8 @@ export class ResponseHandler {
                 this.cacheStorage,
                 authority,
                 this.homeAccountIdentifier,
-                idTokenClaims,
                 this.cryptoObj.base64Decode,
+                idTokenClaims,
                 serverTokenResponse.client_info,
                 env,
                 claimsTenantId,
@@ -553,13 +563,13 @@ export class ResponseHandler {
             };
         }
 
-        return new CacheRecord(
-            cachedAccount,
-            cachedIdToken,
-            cachedAccessToken,
-            cachedRefreshToken,
-            cachedAppMetadata
-        );
+        return {
+            account: cachedAccount,
+            idToken: cachedIdToken,
+            accessToken: cachedAccessToken,
+            refreshToken: cachedRefreshToken,
+            appMetadata: cachedAppMetadata,
+        };
     }
 
     /**
@@ -591,8 +601,14 @@ export class ResponseHandler {
         let familyId: string = Constants.EMPTY_STRING;
 
         if (cacheRecord.accessToken) {
+            /*
+             * if the request object has `popKid` property, `signPopToken` will be set to false and
+             * the token will be returned unsigned
+             */
             if (
-                cacheRecord.accessToken.tokenType === AuthenticationScheme.POP
+                cacheRecord.accessToken.tokenType ===
+                    AuthenticationScheme.POP &&
+                !request.popKid
             ) {
                 const popTokenGenerator: PopTokenGenerator =
                     new PopTokenGenerator(cryptoObj);
@@ -688,8 +704,8 @@ export function buildAccountToCache(
     cacheStorage: CacheManager,
     authority: Authority,
     homeAccountId: string,
-    idTokenClaims: TokenClaims,
     base64Decode: (input: string) => string,
+    idTokenClaims?: TokenClaims,
     clientInfo?: string,
     environment?: string,
     claimsTenantId?: string | null,
@@ -730,6 +746,7 @@ export function buildAccountToCache(
 
     if (
         claimsTenantId &&
+        idTokenClaims &&
         !tenantProfiles.find((tenantProfile) => {
             return tenantProfile.tenantId === claimsTenantId;
         })

package/src/utils/Constants.ts

@@ -45,6 +45,7 @@ export const Constants = {
     NOT_DEFINED: "not_defined",
     EMPTY_STRING: "",
     NOT_APPLICABLE: "N/A",
+    NOT_AVAILABLE: "Not Available",
     FORWARD_SLASH: "/",
     IMDS_ENDPOINT: "http://169.254.169.254/metadata/instance/compute/location",
     IMDS_VERSION: "2020-06-01",

package/dist/cache/entities/CacheRecord.mjs

@@ -1,19 +0,0 @@
-/*! @azure/msal-common v14.11.0 2024-06-04 */
-'use strict';
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class CacheRecord {
-    constructor(accountEntity, idTokenEntity, accessTokenEntity, refreshTokenEntity, appMetadataEntity) {
-        this.account = accountEntity || null;
-        this.idToken = idTokenEntity || null;
-        this.accessToken = accessTokenEntity || null;
-        this.refreshToken = refreshTokenEntity || null;
-        this.appMetadata = appMetadataEntity || null;
-    }
-}
-
-export { CacheRecord };
-//# sourceMappingURL=CacheRecord.mjs.map

package/dist/cache/entities/CacheRecord.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"CacheRecord.mjs","sources":["../../../src/cache/entities/CacheRecord.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAQH;MACa,WAAW,CAAA;IAOpB,WACI,CAAA,aAAoC,EACpC,aAAoC,EACpC,iBAA4C,EAC5C,kBAA8C,EAC9C,iBAA4C,EAAA;AAE5C,QAAA,IAAI,CAAC,OAAO,GAAG,aAAa,IAAI,IAAI,CAAC;AACrC,QAAA,IAAI,CAAC,OAAO,GAAG,aAAa,IAAI,IAAI,CAAC;AACrC,QAAA,IAAI,CAAC,WAAW,GAAG,iBAAiB,IAAI,IAAI,CAAC;AAC7C,QAAA,IAAI,CAAC,YAAY,GAAG,kBAAkB,IAAI,IAAI,CAAC;AAC/C,QAAA,IAAI,CAAC,WAAW,GAAG,iBAAiB,IAAI,IAAI,CAAC;KAChD;AACJ;;;;"}