@azure/msal-common 14.15.0 → 14.16.1

package/src/cache/entities/AccountEntity.ts

@@ -62,6 +62,7 @@ export class AccountEntity {
     msGraphHost?: string;
     nativeAccountId?: string;
     tenantProfiles?: Array<TenantProfile>;
+    lastUpdatedAt?: string;
 
     /**
      * Generate Account Id key component as per the schema: <home_account_id>-<environment>

package/src/cache/entities/CredentialEntity.ts

@@ -33,4 +33,6 @@ export type CredentialEntity = {
     keyId?: string;
     /** Matches the SHA 256 hash of the claims object included in the token request */
     requestedClaimsHash?: string;
+    /** Timestamp when the entry was last updated */
+    lastUpdatedAt?: string;
 };

package/src/cache/interface/ICacheManager.ts

@@ -21,13 +21,13 @@ export interface ICacheManager {
      * fetch the account entity from the platform cache
      * @param accountKey
      */
-    getAccount(accountKey: string): AccountEntity | null;
+    getAccount(accountKey: string, correlationId: string): AccountEntity | null;
 
     /**
      * set account entity in the platform cache
      * @param account
      */
-    setAccount(account: AccountEntity): void;
+    setAccount(account: AccountEntity, correlationId: string): void;
 
     /**
      * Returns true if the given key matches our account key schema. Also matches homeAccountId and/or tenantId if provided
@@ -46,39 +46,52 @@ export interface ICacheManager {
      * fetch the idToken entity from the platform cache
      * @param idTokenKey
      */
-    getIdTokenCredential(idTokenKey: string): IdTokenEntity | null;
+    getIdTokenCredential(
+        idTokenKey: string,
+        correlationId: string
+    ): IdTokenEntity | null;
 
     /**
      * set idToken entity to the platform cache
      * @param idToken
      */
-    setIdTokenCredential(idToken: IdTokenEntity): void;
+    setIdTokenCredential(idToken: IdTokenEntity, correlationId: string): void;
 
     /**
      * fetch the idToken entity from the platform cache
      * @param accessTokenKey
      */
-    getAccessTokenCredential(accessTokenKey: string): AccessTokenEntity | null;
+    getAccessTokenCredential(
+        accessTokenKey: string,
+        correlationId: string
+    ): AccessTokenEntity | null;
 
     /**
      * set idToken entity to the platform cache
      * @param accessToken
      */
-    setAccessTokenCredential(accessToken: AccessTokenEntity): void;
+    setAccessTokenCredential(
+        accessToken: AccessTokenEntity,
+        correlationId: string
+    ): void;
 
     /**
      * fetch the idToken entity from the platform cache
      * @param refreshTokenKey
      */
     getRefreshTokenCredential(
-        refreshTokenKey: string
+        refreshTokenKey: string,
+        correlationId: string
     ): RefreshTokenEntity | null;
 
     /**
      * set idToken entity to the platform cache
      * @param refreshToken
      */
-    setRefreshTokenCredential(refreshToken: RefreshTokenEntity): void;
+    setRefreshTokenCredential(
+        refreshToken: RefreshTokenEntity,
+        correlationId: string
+    ): void;
 
     /**
      * fetch appMetadata entity from the platform cache
@@ -90,7 +103,7 @@ export interface ICacheManager {
      * set appMetadata entity to the platform cache
      * @param appMetadata
      */
-    setAppMetadata(appMetadata: AppMetadataEntity): void;
+    setAppMetadata(appMetadata: AppMetadataEntity, correlationId: string): void;
 
     /**
      * fetch server telemetry entity from the platform cache
@@ -107,7 +120,8 @@ export interface ICacheManager {
      */
     setServerTelemetry(
         serverTelemetryKey: string,
-        serverTelemetry: ServerTelemetryEntity
+        serverTelemetry: ServerTelemetryEntity,
+        correlationId: string
     ): void;
 
     /**
@@ -153,13 +167,14 @@ export interface ICacheManager {
      */
     setThrottlingCache(
         throttlingCacheKey: string,
-        throttlingCache: ThrottlingEntity
+        throttlingCache: ThrottlingEntity,
+        correlationId: string
     ): void;
 
     /**
      * Returns all accounts in cache
      */
-    getAllAccounts(): AccountInfo[];
+    getAllAccounts(correlationId: string): AccountInfo[];
 
     /**
      * saves a cache record
@@ -167,6 +182,7 @@ export interface ICacheManager {
      */
     saveCacheRecord(
         cacheRecord: CacheRecord,
+        correlationId: string,
         storeInCache?: StoreInCache
     ): Promise<void>;
 
@@ -176,43 +192,52 @@ export interface ICacheManager {
      * @param environment
      * @param realm
      */
-    getAccountsFilteredBy(filter: AccountFilter): AccountEntity[];
+    getAccountsFilteredBy(
+        filter: AccountFilter,
+        correlationId: string
+    ): AccountEntity[];
 
     /**
      * Get AccountInfo object based on provided filters
      * @param filter
      */
-    getAccountInfoFilteredBy(filter: AccountFilter): AccountInfo | null;
+    getAccountInfoFilteredBy(
+        filter: AccountFilter,
+        correlationId: string
+    ): AccountInfo | null;
 
     /**
      * Removes all accounts and related tokens from cache.
      */
-    removeAllAccounts(): Promise<void>;
+    removeAllAccounts(correlationId: string): Promise<void>;
 
     /**
      * returns a boolean if the given account is removed
      * @param account
      */
-    removeAccount(accountKey: string): Promise<void>;
+    removeAccount(accountKey: string, correlationId: string): Promise<void>;
 
     /**
      * returns a boolean if the given account is removed
      * @param account
      */
-    removeAccountContext(account: AccountEntity): Promise<void>;
+    removeAccountContext(
+        account: AccountEntity,
+        correlationId: string
+    ): Promise<void>;
 
     /**
      * @param key
      */
-    removeIdToken(key: string): void;
+    removeIdToken(key: string, correlationId: string): void;
 
     /**
      * @param key
      */
-    removeAccessToken(key: string): Promise<void>;
+    removeAccessToken(key: string, correlationId: string): void;
 
     /**
      * @param key
      */
-    removeRefreshToken(key: string): void;
+    removeRefreshToken(key: string, correlationId: string): void;
 }

package/src/client/AuthorizationCodeClient.ts

@@ -21,7 +21,7 @@ import {
     isOidcProtocolMode,
 } from "../config/ClientConfiguration.js";
 import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
-import { NetworkResponse } from "../network/NetworkManager.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
 import { ResponseHandler } from "../response/ResponseHandler.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { StringUtils } from "../utils/StringUtils.js";
@@ -314,10 +314,14 @@ export class AuthorizationCodeClient extends BaseClient {
             request.correlationId
         );
 
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            request.correlationId,
+            this.performanceClient
+        );
 
         parameterBuilder.addClientId(
-            request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+            request.embeddedClientId ||
+                request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -416,11 +420,6 @@ export class AuthorizationCodeClient extends BaseClient {
             }
         }
 
-        const correlationId =
-            request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
-        parameterBuilder.addCorrelationId(correlationId);
-
         if (
             !StringUtils.isEmptyObj(request.claims) ||
             (this.config.authOptions.clientCapabilities &&
@@ -474,6 +473,13 @@ export class AuthorizationCodeClient extends BaseClient {
             }
         }
 
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
+
         if (request.tokenBodyParameters) {
             parameterBuilder.addExtraQueryParameters(
                 request.tokenBodyParameters
@@ -503,15 +509,24 @@ export class AuthorizationCodeClient extends BaseClient {
     private async createAuthCodeUrlQueryString(
         request: CommonAuthorizationUrlRequest
     ): Promise<string> {
+        // generate the correlationId if not set by the user and add
+        const correlationId =
+            request.correlationId ||
+            this.config.cryptoInterface.createNewGuid();
+
         this.performanceClient?.addQueueMeasurement(
             PerformanceEvents.AuthClientCreateQueryString,
-            request.correlationId
+            correlationId
         );
 
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            correlationId,
+            this.performanceClient
+        );
 
         parameterBuilder.addClientId(
-            request.extraQueryParameters?.[AADServerParamKeys.CLIENT_ID] ||
+            request.embeddedClientId ||
+                request.extraQueryParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -524,10 +539,6 @@ export class AuthorizationCodeClient extends BaseClient {
         // validate the redirectUri (to be a non null value)
         parameterBuilder.addRedirectUri(request.redirectUri);
 
-        // generate the correlationId if not set by the user and add
-        const correlationId =
-            request.correlationId ||
-            this.config.cryptoInterface.createNewGuid();
         parameterBuilder.addCorrelationId(correlationId);
 
         // add response_mode. If not passed in it defaults to query.
@@ -674,6 +685,13 @@ export class AuthorizationCodeClient extends BaseClient {
             );
         }
 
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
+
         this.addExtraQueryParams(request, parameterBuilder);
 
         if (request.nativeBroker) {
@@ -714,7 +732,10 @@ export class AuthorizationCodeClient extends BaseClient {
     private createLogoutUrlQueryString(
         request: CommonEndSessionRequest
     ): string {
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            request.correlationId,
+            this.performanceClient
+        );
 
         if (request.postLogoutRedirectUri) {
             parameterBuilder.addPostLogoutRedirectUri(

package/src/client/BaseClient.ts

@@ -8,8 +8,11 @@ import {
     buildClientConfiguration,
     CommonClientConfiguration,
 } from "../config/ClientConfiguration.js";
-import { INetworkModule } from "../network/INetworkModule.js";
-import { NetworkManager, NetworkResponse } from "../network/NetworkManager.js";
+import {
+    INetworkModule,
+    NetworkRequestOptions,
+} from "../network/INetworkModule.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
 import { ICrypto } from "../crypto/ICrypto.js";
 import { Authority } from "../authority/Authority.js";
 import { Logger } from "../logger/Logger.js";
@@ -26,6 +29,14 @@ import { RequestParameterBuilder } from "../request/RequestParameterBuilder.js";
 import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
 import { createDiscoveredInstance } from "../authority/AuthorityFactory.js";
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent.js";
+import { ThrottlingUtils } from "../network/ThrottlingUtils.js";
+import { AuthError } from "../error/AuthError.js";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../error/ClientAuthError.js";
+import { NetworkError } from "../error/NetworkError.js";
+import { invokeAsync } from "../utils/FunctionWrappers.js";
 
 /**
  * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
@@ -50,9 +61,6 @@ export abstract class BaseClient {
     // Server Telemetry Manager
     protected serverTelemetryManager: ServerTelemetryManager | null;
 
-    // Network Manager
-    protected networkManager: NetworkManager;
-
     // Default authority object
     public authority: Authority;
 
@@ -78,12 +86,6 @@ export abstract class BaseClient {
         // Set the network interface
         this.networkClient = this.config.networkInterface;
 
-        // Set the NetworkManager
-        this.networkManager = new NetworkManager(
-            this.networkClient,
-            this.cacheManager
-        );
-
         // Set TelemetryManager
         this.serverTelemetryManager = this.config.serverTelemetryManager;
 
@@ -152,19 +154,12 @@ export abstract class BaseClient {
         }
 
         const response =
-            await this.networkManager.sendPostRequest<ServerAuthorizationTokenResponse>(
+            await this.sendPostRequest<ServerAuthorizationTokenResponse>(
                 thumbprint,
                 tokenEndpoint,
-                { body: queryString, headers: headers }
+                { body: queryString, headers: headers },
+                correlationId
             );
-        this.performanceClient?.addFields(
-            {
-                refreshTokenSize: response.body.refresh_token?.length || 0,
-                httpVerToken:
-                    response.headers?.[HeaderNames.X_MS_HTTP_VERSION] || "",
-            },
-            correlationId
-        );
 
         if (
             this.config.serverTelemetryManager &&
@@ -178,6 +173,90 @@ export abstract class BaseClient {
         return response;
     }
 
+    /**
+     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+     * @param thumbprint - Request thumbprint for throttling
+     * @param tokenEndpoint - Endpoint to make the POST to
+     * @param options - Body and Headers to include on the POST request
+     * @param correlationId - CorrelationId for telemetry
+     */
+    async sendPostRequest<T extends ServerAuthorizationTokenResponse>(
+        thumbprint: RequestThumbprint,
+        tokenEndpoint: string,
+        options: NetworkRequestOptions,
+        correlationId: string
+    ): Promise<NetworkResponse<T>> {
+        ThrottlingUtils.preProcess(
+            this.cacheManager,
+            thumbprint,
+            correlationId
+        );
+
+        let response;
+        try {
+            response = await invokeAsync(
+                this.networkClient.sendPostRequestAsync.bind(
+                    this.networkClient
+                )<T>,
+                PerformanceEvents.NetworkClientSendPostRequestAsync,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(tokenEndpoint, options);
+            const responseHeaders = response.headers || {};
+            this.performanceClient?.addFields(
+                {
+                    refreshTokenSize: response.body.refresh_token?.length || 0,
+                    httpVerToken:
+                        responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                    requestId:
+                        responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+                },
+                correlationId
+            );
+        } catch (e) {
+            if (e instanceof NetworkError) {
+                const responseHeaders = e.responseHeaders;
+                if (responseHeaders) {
+                    this.performanceClient?.addFields(
+                        {
+                            httpVerToken:
+                                responseHeaders[
+                                    HeaderNames.X_MS_HTTP_VERSION
+                                ] || "",
+                            requestId:
+                                responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
+                                "",
+                            contentTypeHeader:
+                                responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                                undefined,
+                            contentLengthHeader:
+                                responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                                undefined,
+                            httpStatus: e.httpStatus,
+                        },
+                        correlationId
+                    );
+                }
+                throw e.error;
+            }
+            if (e instanceof AuthError) {
+                throw e;
+            } else {
+                throw createClientAuthError(ClientAuthErrorCodes.networkError);
+            }
+        }
+
+        ThrottlingUtils.postProcess(
+            this.cacheManager,
+            thumbprint,
+            response,
+            correlationId
+        );
+
+        return response;
+    }
+
     /**
      * Updates the authority object of the client. Endpoint discovery must be completed.
      * @param updatedAuthority
@@ -208,7 +287,17 @@ export abstract class BaseClient {
      * @param request
      */
     createTokenQueryParameters(request: BaseAuthRequest): string {
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            request.correlationId,
+            this.performanceClient
+        );
+
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
 
         if (request.tokenQueryParameters) {
             parameterBuilder.addExtraQueryParameters(
@@ -216,6 +305,8 @@ export abstract class BaseClient {
             );
         }
 
+        parameterBuilder.addCorrelationId(request.correlationId);
+
         return parameterBuilder.createQueryString();
     }
 }

package/src/client/RefreshTokenClient.ts

@@ -24,7 +24,7 @@ import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { PopTokenGenerator } from "../crypto/PopTokenGenerator.js";
 import { StringUtils } from "../utils/StringUtils.js";
 import { RequestThumbprint } from "../network/RequestThumbprint.js";
-import { NetworkResponse } from "../network/NetworkManager.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
 import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest.js";
 import {
     createClientConfigurationError,
@@ -211,9 +211,9 @@ export class RefreshTokenClient extends BaseClient {
         )(
             request.account,
             foci,
+            request.correlationId,
             undefined,
-            this.performanceClient,
-            request.correlationId
+            this.performanceClient
         );
 
         if (!refreshToken) {
@@ -265,7 +265,10 @@ export class RefreshTokenClient extends BaseClient {
                     "acquireTokenWithRefreshToken: bad refresh token, removing from cache"
                 );
                 const badRefreshTokenKey = generateCredentialKey(refreshToken);
-                this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+                this.cacheManager.removeRefreshToken(
+                    badRefreshTokenKey,
+                    request.correlationId
+                );
             }
 
             throw e;
@@ -345,10 +348,14 @@ export class RefreshTokenClient extends BaseClient {
         );
 
         const correlationId = request.correlationId;
-        const parameterBuilder = new RequestParameterBuilder();
+        const parameterBuilder = new RequestParameterBuilder(
+            correlationId,
+            this.performanceClient
+        );
 
         parameterBuilder.addClientId(
-            request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+            request.embeddedClientId ||
+                request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -376,8 +383,6 @@ export class RefreshTokenClient extends BaseClient {
             parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
         }
 
-        parameterBuilder.addCorrelationId(correlationId);
-
         parameterBuilder.addRefreshToken(request.refreshToken);
 
         if (this.config.clientCredentials.clientSecret) {
@@ -472,6 +477,13 @@ export class RefreshTokenClient extends BaseClient {
             }
         }
 
+        if (request.embeddedClientId) {
+            parameterBuilder.addBrokerParameters({
+                brokerClientId: this.config.authOptions.clientId,
+                brokerRedirectUri: this.config.authOptions.redirectUri,
+            });
+        }
+
         if (request.tokenBodyParameters) {
             parameterBuilder.addExtraQueryParameters(
                 request.tokenBodyParameters

package/src/client/SilentFlowClient.ts

@@ -131,8 +131,7 @@ export class SilentFlowClient extends BaseClient {
             request,
             tokenKeys,
             requestTenantId,
-            this.performanceClient,
-            request.correlationId
+            this.performanceClient
         );
 
         if (!cachedAccessToken) {
@@ -172,14 +171,17 @@ export class SilentFlowClient extends BaseClient {
         const environment =
             request.authority || this.authority.getPreferredCache();
         const cacheRecord: CacheRecord = {
-            account: this.cacheManager.readAccountFromCache(request.account),
+            account: this.cacheManager.readAccountFromCache(
+                request.account,
+                request.correlationId
+            ),
             accessToken: cachedAccessToken,
             idToken: this.cacheManager.getIdToken(
                 request.account,
+                request.correlationId,
                 tokenKeys,
                 requestTenantId,
-                this.performanceClient,
-                request.correlationId
+                this.performanceClient
             ),
             refreshToken: null,
             appMetadata:

package/src/config/ClientConfiguration.ts

@@ -82,11 +82,13 @@ export type CommonClientConfiguration = {
  * - protocolMode                - Enum that represents the protocol that msal follows. Used for configuring proper endpoints.
  * - skipAuthorityMetadataCache  - A flag to choose whether to use or not use the local metadata cache during authority initialization. Defaults to false.
  * - instanceAware               - A flag of whether the STS will send back additional parameters to specify where the tokens should be retrieved from.
+ * - redirectUri                 - The redirect URI where authentication responses can be received by your application. It must exactly match one of the redirect URIs registered in the Azure portal.
  * @internal
  */
 export type AuthOptions = {
     clientId: string;
     authority: Authority;
+    redirectUri: string;
     clientCapabilities?: Array<string>;
     azureCloudOptions?: AzureCloudOptions;
     skipAuthorityMetadataCache?: boolean;

package/src/constants/AADServerParamKeys.ts

@@ -56,3 +56,5 @@ export const SID = "sid";
 export const LOGIN_HINT = "login_hint";
 export const DOMAIN_HINT = "domain_hint";
 export const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
+export const BROKER_CLIENT_ID = "brk_client_id";
+export const BROKER_REDIRECT_URI = "brk_redirect_uri";

package/src/error/CacheError.ts

@@ -7,9 +7,8 @@ import * as CacheErrorCodes from "./CacheErrorCodes.js";
 export { CacheErrorCodes };
 
 export const CacheErrorMessages = {
-    [CacheErrorCodes.cacheQuotaExceededErrorCode]:
-        "Exceeded cache storage capacity.",
-    [CacheErrorCodes.cacheUnknownErrorCode]:
+    [CacheErrorCodes.cacheQuotaExceeded]: "Exceeded cache storage capacity.",
+    [CacheErrorCodes.cacheErrorUnknown]:
         "Unexpected error occurred when using cache storage.",
 };
 
@@ -32,7 +31,7 @@ export class CacheError extends Error {
             errorMessage ||
             (CacheErrorMessages[errorCode]
                 ? CacheErrorMessages[errorCode]
-                : CacheErrorMessages[CacheErrorCodes.cacheUnknownErrorCode]);
+                : CacheErrorMessages[CacheErrorCodes.cacheErrorUnknown]);
 
         super(`${errorCode}: ${message}`);
         Object.setPrototypeOf(this, CacheError.prototype);
@@ -42,3 +41,24 @@ export class CacheError extends Error {
         this.errorMessage = message;
     }
 }
+
+/**
+ * Helper function to wrap browser errors in a CacheError object
+ * @param e
+ * @returns
+ */
+export function createCacheError(e: unknown): CacheError {
+    if (!(e instanceof Error)) {
+        return new CacheError(CacheErrorCodes.cacheErrorUnknown);
+    }
+
+    if (
+        e.name === "QuotaExceededError" ||
+        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+        e.message.includes("exceeded the quota")
+    ) {
+        return new CacheError(CacheErrorCodes.cacheQuotaExceeded);
+    } else {
+        return new CacheError(e.name, e.message);
+    }
+}

package/src/error/CacheErrorCodes.ts

@@ -3,5 +3,5 @@
  * Licensed under the MIT License.
  */
 
-export const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
-export const cacheUnknownErrorCode = "cache_error_unknown";
+export const cacheQuotaExceeded = "cache_quota_exceeded";
+export const cacheErrorUnknown = "cache_error_unknown";