@azure/msal-common 14.15.0 → 14.16.0

package/src/client/AuthorizationCodeClient.ts

@@ -21,7 +21,7 @@ import {
     isOidcProtocolMode,
 } from "../config/ClientConfiguration.js";
 import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
-import { NetworkResponse } from "../network/NetworkManager.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
 import { ResponseHandler } from "../response/ResponseHandler.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { StringUtils } from "../utils/StringUtils.js";
@@ -314,10 +314,14 @@ export class AuthorizationCodeClient extends BaseClient {
             request.correlationId
         );
 
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            request.correlationId,
+            this.performanceClient
+        );
 
         parameterBuilder.addClientId(
-            request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+            request.embeddedClientId ||
+                request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -416,11 +420,6 @@ export class AuthorizationCodeClient extends BaseClient {
             }
         }
 
-        const correlationId =
-            request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
-        parameterBuilder.addCorrelationId(correlationId);
-
         if (
             !StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
@@ -474,6 +473,13 @@ export class AuthorizationCodeClient extends BaseClient {
             }
         }
 
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
+
         if (request.tokenBodyParameters) {
             parameterBuilder.addExtraQueryParameters(
                 request.tokenBodyParameters
@@ -503,15 +509,24 @@ export class AuthorizationCodeClient extends BaseClient {
     private async createAuthCodeUrlQueryString(
         request: CommonAuthorizationUrlRequest
     ): Promise<string> {
+        // generate the correlationId if not set by the user and add
+        const correlationId =
+            request.correlationId ||
+            this.config.cryptoInterface.createNewGuid();
+
         this.performanceClient?.addQueueMeasurement(
             PerformanceEvents.AuthClientCreateQueryString,
-            request.correlationId
+            correlationId
         );
 
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            correlationId,
+            this.performanceClient
+        );
 
         parameterBuilder.addClientId(
-            request.extraQueryParameters?.[AADServerParamKeys.CLIENT_ID] ||
+            request.embeddedClientId ||
+                request.extraQueryParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -524,10 +539,6 @@ export class AuthorizationCodeClient extends BaseClient {
         // validate the redirectUri (to be a non null value)
         parameterBuilder.addRedirectUri(request.redirectUri);
 
-        // generate the correlationId if not set by the user and add
-        const correlationId =
-            request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
         parameterBuilder.addCorrelationId(correlationId);
 
         // add response_mode. If not passed in it defaults to query.
@@ -674,6 +685,13 @@ export class AuthorizationCodeClient extends BaseClient {
             );
         }
 
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
+
         this.addExtraQueryParams(request, parameterBuilder);
 
         if (request.nativeBroker) {
@@ -714,7 +732,10 @@ export class AuthorizationCodeClient extends BaseClient {
     private createLogoutUrlQueryString(
         request: CommonEndSessionRequest
     ): string {
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            request.correlationId,
+            this.performanceClient
+        );
 
         if (request.postLogoutRedirectUri) {
             parameterBuilder.addPostLogoutRedirectUri(

package/src/client/BaseClient.ts

@@ -8,8 +8,11 @@ import {
     buildClientConfiguration,
     CommonClientConfiguration,
 } from "../config/ClientConfiguration.js";
-import { INetworkModule } from "../network/INetworkModule.js";
-import { NetworkManager, NetworkResponse } from "../network/NetworkManager.js";
+import {
+    INetworkModule,
+    NetworkRequestOptions,
+} from "../network/INetworkModule.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
 import { ICrypto } from "../crypto/ICrypto.js";
 import { Authority } from "../authority/Authority.js";
 import { Logger } from "../logger/Logger.js";
@@ -26,6 +29,14 @@ import { RequestParameterBuilder } from "../request/RequestParameterBuilder.js";
 import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
 import { createDiscoveredInstance } from "../authority/AuthorityFactory.js";
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent.js";
+import { ThrottlingUtils } from "../network/ThrottlingUtils.js";
+import { AuthError } from "../error/AuthError.js";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../error/ClientAuthError.js";
+import { NetworkError } from "../error/NetworkError.js";
+import { invokeAsync } from "../utils/FunctionWrappers.js";
 
 /**
  * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
@@ -50,9 +61,6 @@ export abstract class BaseClient {
     // Server Telemetry Manager
     protected serverTelemetryManager: ServerTelemetryManager | null;
 
-    // Network Manager
-    protected networkManager: NetworkManager;
-
     // Default authority object
     public authority: Authority;
 
@@ -78,12 +86,6 @@ export abstract class BaseClient {
         // Set the network interface
         this.networkClient = this.config.networkInterface;
 
-        // Set the NetworkManager
-        this.networkManager = new NetworkManager(
-            this.networkClient,
-            this.cacheManager
-        );
-
         // Set TelemetryManager
         this.serverTelemetryManager = this.config.serverTelemetryManager;
 
@@ -152,19 +154,12 @@ export abstract class BaseClient {
         }
 
         const response =
-            await this.networkManager.sendPostRequest<ServerAuthorizationTokenResponse>(
+            await this.sendPostRequest<ServerAuthorizationTokenResponse>(
                 thumbprint,
                 tokenEndpoint,
-                { body: queryString, headers: headers }
+                { body: queryString, headers: headers },
+                correlationId
             );
-        this.performanceClient?.addFields(
-            {
-                refreshTokenSize: response.body.refresh_token?.length || 0,
-                httpVerToken:
-                    response.headers?.[HeaderNames.X_MS_HTTP_VERSION] || "",
-            },
-            correlationId
-        );
 
         if (
             this.config.serverTelemetryManager &&
@@ -178,6 +173,81 @@ export abstract class BaseClient {
         return response;
     }
 
+    /**
+     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+     * @param thumbprint - Request thumbprint for throttling
+     * @param tokenEndpoint - Endpoint to make the POST to
+     * @param options - Body and Headers to include on the POST request
+     * @param correlationId - CorrelationId for telemetry
+     */
+    async sendPostRequest<T extends ServerAuthorizationTokenResponse>(
+        thumbprint: RequestThumbprint,
+        tokenEndpoint: string,
+        options: NetworkRequestOptions,
+        correlationId: string
+    ): Promise<NetworkResponse<T>> {
+        ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
+
+        let response;
+        try {
+            response = await invokeAsync(
+                this.networkClient.sendPostRequestAsync.bind(
+                    this.networkClient
+                )<T>,
+                PerformanceEvents.NetworkClientSendPostRequestAsync,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(tokenEndpoint, options);
+            const responseHeaders = response.headers || {};
+            this.performanceClient?.addFields(
+                {
+                    refreshTokenSize: response.body.refresh_token?.length || 0,
+                    httpVerToken:
+                        responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                    requestId:
+                        responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+                },
+                correlationId
+            );
+        } catch (e) {
+            if (e instanceof NetworkError) {
+                const responseHeaders = e.responseHeaders;
+                if (responseHeaders) {
+                    this.performanceClient?.addFields(
+                        {
+                            httpVerToken:
+                                responseHeaders[
+                                    HeaderNames.X_MS_HTTP_VERSION
+                                ] || "",
+                            requestId:
+                                responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
+                                "",
+                            contentTypeHeader:
+                                responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                                undefined,
+                            contentLengthHeader:
+                                responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                                undefined,
+                            httpStatus: e.httpStatus,
+                        },
+                        correlationId
+                    );
+                }
+                throw e.error;
+            }
+            if (e instanceof AuthError) {
+                throw e;
+            } else {
+                throw createClientAuthError(ClientAuthErrorCodes.networkError);
+            }
+        }
+
+        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
+
+        return response;
+    }
+
     /**
      * Updates the authority object of the client. Endpoint discovery must be completed.
      * @param updatedAuthority
@@ -208,7 +278,17 @@ export abstract class BaseClient {
      * @param request
      */
     createTokenQueryParameters(request: BaseAuthRequest): string {
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            request.correlationId,
+            this.performanceClient
+        );
+
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
 
         if (request.tokenQueryParameters) {
             parameterBuilder.addExtraQueryParameters(
@@ -216,6 +296,8 @@ export abstract class BaseClient {
             );
         }
 
+        parameterBuilder.addCorrelationId(request.correlationId);
+
         return parameterBuilder.createQueryString();
     }
 }

package/src/client/RefreshTokenClient.ts

@@ -24,7 +24,7 @@ import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { PopTokenGenerator } from "../crypto/PopTokenGenerator.js";
 import { StringUtils } from "../utils/StringUtils.js";
 import { RequestThumbprint } from "../network/RequestThumbprint.js";
-import { NetworkResponse } from "../network/NetworkManager.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
 import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest.js";
 import {
     createClientConfigurationError,
@@ -345,10 +345,14 @@ export class RefreshTokenClient extends BaseClient {
         );
 
         const correlationId = request.correlationId;
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            correlationId,
+            this.performanceClient
+        );
 
         parameterBuilder.addClientId(
-            request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+            request.embeddedClientId ||
+                request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -376,8 +380,6 @@ export class RefreshTokenClient extends BaseClient {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
         }
 
-        parameterBuilder.addCorrelationId(correlationId);
-
         parameterBuilder.addRefreshToken(request.refreshToken);
 
         if (this.config.clientCredentials.clientSecret) {
@@ -472,6 +474,13 @@ export class RefreshTokenClient extends BaseClient {
             }
         }
 
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
+
         if (request.tokenBodyParameters) {
             parameterBuilder.addExtraQueryParameters(
                 request.tokenBodyParameters

package/src/config/ClientConfiguration.ts

@@ -82,11 +82,13 @@ export type CommonClientConfiguration = {
  * - protocolMode                - Enum that represents the protocol that msal follows. Used for configuring proper endpoints.
  * - skipAuthorityMetadataCache  - A flag to choose whether to use or not use the local metadata cache during authority initialization. Defaults to false.
  * - instanceAware               - A flag of whether the STS will send back additional parameters to specify where the tokens should be retrieved from.
+ * - redirectUri                 - The redirect URI where authentication responses can be received by your application. It must exactly match one of the redirect URIs registered in the Azure portal.
  * @internal
  */
 export type AuthOptions = {
     clientId: string;
     authority: Authority;
+    redirectUri: string;
     clientCapabilities?: Array<string>;
     azureCloudOptions?: AzureCloudOptions;
     skipAuthorityMetadataCache?: boolean;

package/src/constants/AADServerParamKeys.ts

@@ -56,3 +56,5 @@ export const SID = "sid";
 export const LOGIN_HINT = "login_hint";
 export const DOMAIN_HINT = "domain_hint";
 export const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+export const BROKER_CLIENT_ID = "brk_client_id";
+export const BROKER_REDIRECT_URI = "brk_redirect_uri";

package/src/error/NetworkError.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "./AuthError.js";
+
+/**
+ * Represents network related errors
+ */
+export class NetworkError extends AuthError {
+    error: AuthError;
+    httpStatus?: number;
+    responseHeaders?: Record<string, string>;
+
+    constructor(
+        error: AuthError,
+        httpStatus?: number,
+        responseHeaders?: Record<string, string>
+    ) {
+        super(error.errorCode, error.errorMessage, error.subError);
+
+        Object.setPrototypeOf(this, NetworkError.prototype);
+        this.name = "NetworkError";
+        this.error = error;
+        this.httpStatus = httpStatus;
+        this.responseHeaders = responseHeaders;
+    }
+}
+
+/**
+ * Creates NetworkError object for a failed network request
+ * @param error - Error to be thrown back to the caller
+ * @param httpStatus - Status code of the network request
+ * @param responseHeaders - Response headers of the network request, when available
+ * @returns NetworkError object
+ */
+export function createNetworkError(
+    error: AuthError,
+    httpStatus?: number,
+    responseHeaders?: Record<string, string>
+): NetworkError {
+    return new NetworkError(error, httpStatus, responseHeaders);
+}

package/src/exports-common.ts

@@ -91,11 +91,7 @@ export {
     NetworkRequestOptions,
     StubbedNetworkModule,
 } from "./network/INetworkModule.js";
-export {
-    NetworkManager,
-    NetworkResponse,
-    UrlToHttpRequestOptions,
-} from "./network/NetworkManager.js";
+export { NetworkResponse } from "./network/NetworkResponse.js";
 export { ThrottlingUtils } from "./network/ThrottlingUtils.js";
 export { RequestThumbprint } from "./network/RequestThumbprint.js";
 export { IUri } from "./url/IUri.js";
@@ -140,6 +136,7 @@ export {
     createAuthError,
 } from "./error/AuthError.js";
 export { ServerError } from "./error/ServerError.js";
+export { NetworkError, createNetworkError } from "./error/NetworkError.js";
 export { CacheError, CacheErrorCodes } from "./error/CacheError.js";
 export {
     ClientAuthError,

package/src/network/INetworkModule.ts

@@ -7,7 +7,7 @@ import {
     ClientAuthErrorCodes,
     createClientAuthError,
 } from "../error/ClientAuthError.js";
-import { NetworkResponse } from "./NetworkManager.js";
+import { NetworkResponse } from "./NetworkResponse.js";
 
 /**
  * Options allowed by network request APIs.

package/src/network/NetworkResponse.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type NetworkResponse<T> = {
+    headers: Record<string, string>;
+    body: T;
+    status: number;
+};

package/src/network/ThrottlingUtils.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { NetworkResponse } from "./NetworkManager.js";
+import { NetworkResponse } from "./NetworkResponse.js";
 import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
 import {
     HeaderNames,

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.15.0";
+export const version = "14.16.0";

package/src/request/BaseAuthRequest.ts

@@ -29,6 +29,7 @@ import { ShrOptions } from "../crypto/SignedHttpRequest.js";
  * - storeInCache            - Object containing boolean values indicating whether to store tokens in the cache or not (default is true)
  * - scenarioId              - Scenario id to track custom user prompts
  * - popKid                  - Key ID to identify the public key for PoP token request
+ * - embeddedClientId        - Embedded client id. When specified, broker client id (brk_client_id) and redirect uri (brk_redirect_uri) params are set with values from the config, overriding the corresponding extra parameters, if present.
  */
 export type BaseAuthRequest = {
     authority: string;
@@ -50,4 +51,5 @@ export type BaseAuthRequest = {
     storeInCache?: StoreInCache;
     scenarioId?: string;
     popKid?: string;
+    embeddedClientId?: string;
 };

package/src/request/RequestParameterBuilder.ts

@@ -28,13 +28,44 @@ import {
 } from "../config/ClientConfiguration.js";
 import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
 import { ClientInfo } from "../account/ClientInfo.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+
+function instrumentBrokerParams(
+    parameters: Map<string, string>,
+    correlationId?: string,
+    performanceClient?: IPerformanceClient
+) {
+    if (!correlationId) {
+        return;
+    }
+
+    const clientId = parameters.get(AADServerParamKeys.CLIENT_ID);
+    if (clientId && parameters.has(AADServerParamKeys.BROKER_CLIENT_ID)) {
+        performanceClient?.addFields(
+            {
+                embeddedClientId: clientId,
+                embeddedRedirectUri: parameters.get(
+                    AADServerParamKeys.REDIRECT_URI
+                ),
+            },
+            correlationId
+        );
+    }
+}
 
 /** @internal */
 export class RequestParameterBuilder {
     private parameters: Map<string, string>;
+    private readonly performanceClient?: IPerformanceClient;
+    private readonly correlationId?: string;
 
-    constructor() {
+    constructor(
+        correlationId?: string,
+        performanceClient?: IPerformanceClient
+    ) {
         this.parameters = new Map<string, string>();
+        this.performanceClient = performanceClient;
+        this.correlationId = correlationId;
     }
 
     /**
@@ -598,6 +629,19 @@ export class RequestParameterBuilder {
         );
     }
 
+    addBrokerParameters(params: {
+        brokerClientId: string;
+        brokerRedirectUri: string;
+    }): void {
+        const brokerParams: StringDict = {};
+        brokerParams[AADServerParamKeys.BROKER_CLIENT_ID] =
+            params.brokerClientId;
+        brokerParams[AADServerParamKeys.BROKER_REDIRECT_URI] =
+            params.brokerRedirectUri;
+
+        this.addExtraQueryParameters(brokerParams);
+    }
+
     /**
      * Utility to create a URL from the params map
      */
@@ -608,6 +652,12 @@ export class RequestParameterBuilder {
             queryParameterArray.push(`${key}=${value}`);
         });
 
+        instrumentBrokerParams(
+            this.parameters,
+            this.correlationId,
+            this.performanceClient
+        );
+
         return queryParameterArray.join("&");
     }
 }

package/src/telemetry/performance/PerformanceClient.ts

@@ -198,22 +198,39 @@ export function compactStack(stack: string, stackMaxSize: number): string[] {
     }
 
     const stackArr = stack.split("\n") || [];
-    if (stackArr.length < 2) {
-        return [];
-    }
 
     const res = [];
-    // Get top N stack lines
-    for (
-        // Skip first line as it may contain PII data
-        let ix = Math.max(stackArr.length - stackMaxSize - 1, 1);
-        ix < stackArr.length;
-        ix++
+
+    // Check for a handful of known, common runtime errors and log them (with redaction where applicable).
+    const firstLine = stackArr[0];
+    if (
+        firstLine.startsWith("TypeError: Cannot read property") ||
+        firstLine.startsWith("TypeError: Cannot read properties of") ||
+        firstLine.startsWith("TypeError: Cannot set property") ||
+        firstLine.startsWith("TypeError: Cannot set properties of") ||
+        firstLine.endsWith("is not a function")
     ) {
-        const line = stackArr[ix];
+        // These types of errors are not at risk of leaking PII. They will indicate unavailable APIs
+        res.push(compactStackLine(firstLine));
+    } else if (
+        firstLine.startsWith("SyntaxError") ||
+        firstLine.startsWith("TypeError")
+    ) {
+        // Prevent unintentional leaking of arbitrary info by redacting contents between both single and double quotes
+        res.push(
+            compactStackLine(
+                // Example: SyntaxError: Unexpected token 'e', "test" is not valid JSON -> SyntaxError: Unexpected token <redacted>, <redacted> is not valid JSON
+                firstLine.replace(/['].*[']|["].*["]/g, "<redacted>")
+            )
+        );
+    }
+
+    // Get top N stack lines
+    for (let ix = 1; ix < stackArr.length; ix++) {
         if (res.length >= stackMaxSize) {
             break;
         }
+        const line = stackArr[ix];
         res.push(compactStackLine(line));
     }
     return res;
@@ -630,14 +647,27 @@ export abstract class PerformanceClient implements IPerformanceClient {
             event.correlationId
         );
 
+        if (error) {
+            addError(error, this.logger, rootEvent);
+        }
+
         // Add sub-measurement attribute to root event.
         if (!isRoot) {
             rootEvent[event.name + "DurationMs"] = Math.floor(event.durationMs);
             return { ...rootEvent };
         }
 
-        if (error) {
-            addError(error, this.logger, rootEvent);
+        if (
+            isRoot &&
+            !error &&
+            (rootEvent.errorCode || rootEvent.subErrorCode)
+        ) {
+            this.logger.trace(
+                `PerformanceClient: Remove error and sub-error codes for root event ${event.name} as intermediate error was successfully handled`,
+                event.correlationId
+            );
+            rootEvent.errorCode = undefined;
+            rootEvent.subErrorCode = undefined;
         }
 
         let finalEvent: PerformanceEvent = { ...rootEvent, ...event };