@azure/msal-common 14.14.0 → 14.14.2

package/dist/client/SilentFlowClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.14.0 2024-07-23 */
+/*! @azure/msal-common v14.14.2 2024-08-28 */
 'use strict';
 import { BaseClient } from './BaseClient.mjs';
 import { wasClockTurnedBack, isTokenExpired } from '../utils/TimeUtils.mjs';
@@ -13,138 +13,138 @@ import { invokeAsync } from '../utils/FunctionWrappers.mjs';
 import { getTenantFromAuthorityString } from '../authority/Authority.mjs';
 import { tokenRefreshRequired, noAccountInSilentRequest, authTimeNotFound } from '../error/ClientAuthErrorCodes.mjs';
 
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class SilentFlowClient extends BaseClient {
-    constructor(configuration, performanceClient) {
-        super(configuration, performanceClient);
-    }
-    /**
-     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
-     * the given token and returns the renewed token
-     * @param request
-     */
-    async acquireToken(request) {
-        try {
-            const [authResponse, cacheOutcome] = await this.acquireCachedToken({
-                ...request,
-                scopes: request.scopes?.length
-                    ? request.scopes
-                    : [...OIDC_DEFAULT_SCOPES],
-            });
-            // if the token is not expired but must be refreshed; get a new one in the background
-            if (cacheOutcome === CacheOutcome.PROACTIVELY_REFRESHED) {
-                this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.");
-                // refresh the access token in the background
-                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
-                refreshTokenClient
-                    .acquireTokenByRefreshToken(request)
-                    .catch(() => {
-                    // do nothing, this is running in the background and no action is to be taken upon success or failure
-                });
-            }
-            // return the cached token
-            return authResponse;
-        }
-        catch (e) {
-            if (e instanceof ClientAuthError &&
-                e.errorCode === tokenRefreshRequired) {
-                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
-                return refreshTokenClient.acquireTokenByRefreshToken(request);
-            }
-            else {
-                throw e;
-            }
-        }
-    }
-    /**
-     * Retrieves token from cache or throws an error if it must be refreshed.
-     * @param request
-     */
-    async acquireCachedToken(request) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientAcquireCachedToken, request.correlationId);
-        let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
-        if (request.forceRefresh ||
-            (!this.config.cacheOptions.claimsBasedCachingEnabled &&
-                !StringUtils.isEmptyObj(request.claims))) {
-            // Must refresh due to present force_refresh flag.
-            this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
-        }
-        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
-        if (!request.account) {
-            throw createClientAuthError(noAccountInSilentRequest);
-        }
-        const requestTenantId = request.account.tenantId ||
-            getTenantFromAuthorityString(request.authority);
-        const tokenKeys = this.cacheManager.getTokenKeys();
-        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);
-        if (!cachedAccessToken) {
-            // must refresh due to non-existent access_token
-            this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
-        }
-        else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
-            isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
-            // must refresh due to the expires_in value
-            this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
-            throw createClientAuthError(tokenRefreshRequired);
-        }
-        else if (cachedAccessToken.refreshOn &&
-            isTokenExpired(cachedAccessToken.refreshOn, 0)) {
-            // must refresh (in the background) due to the refresh_in value
-            lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
-            // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
-        }
-        const environment = request.authority || this.authority.getPreferredCache();
-        const cacheRecord = {
-            account: this.cacheManager.readAccountFromCache(request.account),
-            accessToken: cachedAccessToken,
-            idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),
-            refreshToken: null,
-            appMetadata: this.cacheManager.readAppMetadataFromCache(environment),
-        };
-        this.setCacheOutcome(lastCacheOutcome, request.correlationId);
-        if (this.config.serverTelemetryManager) {
-            this.config.serverTelemetryManager.incrementCacheHits();
-        }
-        return [
-            await invokeAsync(this.generateResultFromCacheRecord.bind(this), PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, this.logger, this.performanceClient, request.correlationId)(cacheRecord, request),
-            lastCacheOutcome,
-        ];
-    }
-    setCacheOutcome(cacheOutcome, correlationId) {
-        this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);
-        this.performanceClient?.addFields({
-            cacheOutcome: cacheOutcome,
-        }, correlationId);
-        if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
-            this.logger.info(`Token refresh is required due to cache outcome: ${cacheOutcome}`);
-        }
-    }
-    /**
-     * Helper function to build response object from the CacheRecord
-     * @param cacheRecord
-     */
-    async generateResultFromCacheRecord(cacheRecord, request) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, request.correlationId);
-        let idTokenClaims;
-        if (cacheRecord.idToken) {
-            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
-        }
-        // token max_age check
-        if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenClaims?.auth_time;
-            if (!authTime) {
-                throw createClientAuthError(authTimeNotFound);
-            }
-            checkMaxAge(authTime, request.maxAge);
-        }
-        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
-    }
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class SilentFlowClient extends BaseClient {
+    constructor(configuration, performanceClient) {
+        super(configuration, performanceClient);
+    }
+    /**
+     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
+     * the given token and returns the renewed token
+     * @param request
+     */
+    async acquireToken(request) {
+        try {
+            const [authResponse, cacheOutcome] = await this.acquireCachedToken({
+                ...request,
+                scopes: request.scopes?.length
+                    ? request.scopes
+                    : [...OIDC_DEFAULT_SCOPES],
+            });
+            // if the token is not expired but must be refreshed; get a new one in the background
+            if (cacheOutcome === CacheOutcome.PROACTIVELY_REFRESHED) {
+                this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'. It's not expired, but must be refreshed.");
+                // refresh the access token in the background
+                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
+                refreshTokenClient
+                    .acquireTokenByRefreshToken(request)
+                    .catch(() => {
+                    // do nothing, this is running in the background and no action is to be taken upon success or failure
+                });
+            }
+            // return the cached token
+            return authResponse;
+        }
+        catch (e) {
+            if (e instanceof ClientAuthError &&
+                e.errorCode === tokenRefreshRequired) {
+                const refreshTokenClient = new RefreshTokenClient(this.config, this.performanceClient);
+                return refreshTokenClient.acquireTokenByRefreshToken(request);
+            }
+            else {
+                throw e;
+            }
+        }
+    }
+    /**
+     * Retrieves token from cache or throws an error if it must be refreshed.
+     * @param request
+     */
+    async acquireCachedToken(request) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientAcquireCachedToken, request.correlationId);
+        let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
+        if (request.forceRefresh ||
+            (!this.config.cacheOptions.claimsBasedCachingEnabled &&
+                !StringUtils.isEmptyObj(request.claims))) {
+            // Must refresh due to present force_refresh flag.
+            this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+        if (!request.account) {
+            throw createClientAuthError(noAccountInSilentRequest);
+        }
+        const requestTenantId = request.account.tenantId ||
+            getTenantFromAuthorityString(request.authority);
+        const tokenKeys = this.cacheManager.getTokenKeys();
+        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);
+        if (!cachedAccessToken) {
+            // must refresh due to non-existent access_token
+            this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
+            isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
+            // must refresh due to the expires_in value
+            this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (cachedAccessToken.refreshOn &&
+            isTokenExpired(cachedAccessToken.refreshOn, 0)) {
+            // must refresh (in the background) due to the refresh_in value
+            lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
+            // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
+        }
+        const environment = request.authority || this.authority.getPreferredCache();
+        const cacheRecord = {
+            account: this.cacheManager.readAccountFromCache(request.account),
+            accessToken: cachedAccessToken,
+            idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),
+            refreshToken: null,
+            appMetadata: this.cacheManager.readAppMetadataFromCache(environment),
+        };
+        this.setCacheOutcome(lastCacheOutcome, request.correlationId);
+        if (this.config.serverTelemetryManager) {
+            this.config.serverTelemetryManager.incrementCacheHits();
+        }
+        return [
+            await invokeAsync(this.generateResultFromCacheRecord.bind(this), PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, this.logger, this.performanceClient, request.correlationId)(cacheRecord, request),
+            lastCacheOutcome,
+        ];
+    }
+    setCacheOutcome(cacheOutcome, correlationId) {
+        this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);
+        this.performanceClient?.addFields({
+            cacheOutcome: cacheOutcome,
+        }, correlationId);
+        if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
+            this.logger.info(`Token refresh is required due to cache outcome: ${cacheOutcome}`);
+        }
+    }
+    /**
+     * Helper function to build response object from the CacheRecord
+     * @param cacheRecord
+     */
+    async generateResultFromCacheRecord(cacheRecord, request) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord, request.correlationId);
+        let idTokenClaims;
+        if (cacheRecord.idToken) {
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
+        }
+        // token max_age check
+        if (request.maxAge || request.maxAge === 0) {
+            const authTime = idTokenClaims?.auth_time;
+            if (!authTime) {
+                throw createClientAuthError(authTimeNotFound);
+            }
+            checkMaxAge(authTime, request.maxAge);
+        }
+        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
+    }
 }
 
 export { SilentFlowClient };

package/dist/config/AppTokenProvider.d.ts

@@ -1,39 +1,39 @@
-/**
- * Extensibility interface, which allows the app developer to return a token, based on the passed-in parameters, instead of fetching tokens from
- * the Identity Provider (AAD).
- * Developers need to construct and return an AppTokenProviderResult object back to MSAL. MSAL will cache the token response
- * in the same way it would do if the result were comming from AAD.
- * This extensibility point is only defined for the client_credential flow, i.e. acquireTokenByClientCredential and
- * meant for Azure SDK to enhance Managed Identity support.
- */
-export interface IAppTokenProvider {
-    (appTokenProviderParameters: AppTokenProviderParameters): Promise<AppTokenProviderResult>;
-}
-/**
- * Input object for the IAppTokenProvider extensiblity. MSAL will create this object, which can be used
- * to help create an AppTokenProviderResult.
- *
- * - correlationId           - the correlation Id associated with the request
- * - tenantId                - the tenant Id for which the token must be provided
- * - scopes                  - the scopes for which the token must be provided
- * - claims                  - any extra claims that the token must satisfy
- */
-export type AppTokenProviderParameters = {
-    readonly correlationId?: string;
-    readonly tenantId: string;
-    readonly scopes: Array<string>;
-    readonly claims?: string;
-};
-/**
- * Output object for IAppTokenProvider extensiblity.
- *
- * - accessToken            - the actual access token, typically in JWT format, that satisfies the request data AppTokenProviderParameters
- * - expiresInSeconds       - how long the tokens has before expiry, in seconds. Similar to the "expires_in" field in an AAD token response.
- * - refreshInSeconds       - how long the token has before it should be proactively refreshed. Similar to the "refresh_in" field in an AAD token response.
- */
-export type AppTokenProviderResult = {
-    accessToken: string;
-    expiresInSeconds: number;
-    refreshInSeconds?: number;
-};
+/**
+ * Extensibility interface, which allows the app developer to return a token, based on the passed-in parameters, instead of fetching tokens from
+ * the Identity Provider (AAD).
+ * Developers need to construct and return an AppTokenProviderResult object back to MSAL. MSAL will cache the token response
+ * in the same way it would do if the result were comming from AAD.
+ * This extensibility point is only defined for the client_credential flow, i.e. acquireTokenByClientCredential and
+ * meant for Azure SDK to enhance Managed Identity support.
+ */
+export interface IAppTokenProvider {
+    (appTokenProviderParameters: AppTokenProviderParameters): Promise<AppTokenProviderResult>;
+}
+/**
+ * Input object for the IAppTokenProvider extensiblity. MSAL will create this object, which can be used
+ * to help create an AppTokenProviderResult.
+ *
+ * - correlationId           - the correlation Id associated with the request
+ * - tenantId                - the tenant Id for which the token must be provided
+ * - scopes                  - the scopes for which the token must be provided
+ * - claims                  - any extra claims that the token must satisfy
+ */
+export type AppTokenProviderParameters = {
+    readonly correlationId?: string;
+    readonly tenantId: string;
+    readonly scopes: Array<string>;
+    readonly claims?: string;
+};
+/**
+ * Output object for IAppTokenProvider extensiblity.
+ *
+ * - accessToken            - the actual access token, typically in JWT format, that satisfies the request data AppTokenProviderParameters
+ * - expiresInSeconds       - how long the tokens has before expiry, in seconds. Similar to the "expires_in" field in an AAD token response.
+ * - refreshInSeconds       - how long the token has before it should be proactively refreshed. Similar to the "refresh_in" field in an AAD token response.
+ */
+export type AppTokenProviderResult = {
+    accessToken: string;
+    expiresInSeconds: number;
+    refreshInSeconds?: number;
+};
 //# sourceMappingURL=AppTokenProvider.d.ts.map