@azure/msal-common 14.15.0 → 14.16.1

package/src/error/NetworkError.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "./AuthError.js";
+
+/**
+ * Represents network related errors
+ */
+export class NetworkError extends AuthError {
+    error: AuthError;
+    httpStatus?: number;
+    responseHeaders?: Record<string, string>;
+
+    constructor(
+        error: AuthError,
+        httpStatus?: number,
+        responseHeaders?: Record<string, string>
+    ) {
+        super(error.errorCode, error.errorMessage, error.subError);
+
+        Object.setPrototypeOf(this, NetworkError.prototype);
+        this.name = "NetworkError";
+        this.error = error;
+        this.httpStatus = httpStatus;
+        this.responseHeaders = responseHeaders;
+    }
+}
+
+/**
+ * Creates NetworkError object for a failed network request
+ * @param error - Error to be thrown back to the caller
+ * @param httpStatus - Status code of the network request
+ * @param responseHeaders - Response headers of the network request, when available
+ * @returns NetworkError object
+ */
+export function createNetworkError(
+    error: AuthError,
+    httpStatus?: number,
+    responseHeaders?: Record<string, string>
+): NetworkError {
+    return new NetworkError(error, httpStatus, responseHeaders);
+}

package/src/exports-common.ts

@@ -91,11 +91,7 @@ export {
     NetworkRequestOptions,
     StubbedNetworkModule,
 } from "./network/INetworkModule.js";
-export {
-    NetworkManager,
-    NetworkResponse,
-    UrlToHttpRequestOptions,
-} from "./network/NetworkManager.js";
+export { NetworkResponse } from "./network/NetworkResponse.js";
 export { ThrottlingUtils } from "./network/ThrottlingUtils.js";
 export { RequestThumbprint } from "./network/RequestThumbprint.js";
 export { IUri } from "./url/IUri.js";
@@ -140,7 +136,12 @@ export {
     createAuthError,
 } from "./error/AuthError.js";
 export { ServerError } from "./error/ServerError.js";
-export { CacheError, CacheErrorCodes } from "./error/CacheError.js";
+export { NetworkError, createNetworkError } from "./error/NetworkError.js";
+export {
+    CacheError,
+    CacheErrorCodes,
+    createCacheError,
+} from "./error/CacheError.js";
 export {
     ClientAuthError,
     ClientAuthErrorMessage,

package/src/network/INetworkModule.ts

@@ -7,7 +7,7 @@ import {
     ClientAuthErrorCodes,
     createClientAuthError,
 } from "../error/ClientAuthError.js";
-import { NetworkResponse } from "./NetworkManager.js";
+import { NetworkResponse } from "./NetworkResponse.js";
 
 /**
  * Options allowed by network request APIs.

package/src/network/NetworkResponse.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type NetworkResponse<T> = {
+    headers: Record<string, string>;
+    body: T;
+    status: number;
+};

package/src/network/ThrottlingUtils.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { NetworkResponse } from "./NetworkManager.js";
+import { NetworkResponse } from "./NetworkResponse.js";
 import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
 import {
     HeaderNames,
@@ -35,14 +35,15 @@ export class ThrottlingUtils {
      */
     static preProcess(
         cacheManager: CacheManager,
-        thumbprint: RequestThumbprint
+        thumbprint: RequestThumbprint,
+        correlationId: string
     ): void {
         const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
         const value = cacheManager.getThrottlingCache(key);
 
         if (value) {
             if (value.throttleTime < Date.now()) {
-                cacheManager.removeItem(key);
+                cacheManager.removeItem(key, correlationId);
                 return;
             }
             throw new ServerError(
@@ -62,7 +63,8 @@ export class ThrottlingUtils {
     static postProcess(
         cacheManager: CacheManager,
         thumbprint: RequestThumbprint,
-        response: NetworkResponse<ServerAuthorizationTokenResponse>
+        response: NetworkResponse<ServerAuthorizationTokenResponse>,
+        correlationId: string
     ): void {
         if (
             ThrottlingUtils.checkResponseStatus(response) ||
@@ -79,7 +81,8 @@ export class ThrottlingUtils {
             };
             cacheManager.setThrottlingCache(
                 ThrottlingUtils.generateThrottlingStorageKey(thumbprint),
-                thumbprintValue
+                thumbprintValue,
+                correlationId
             );
         }
     }
@@ -151,6 +154,6 @@ export class ThrottlingUtils {
         };
 
         const key = this.generateThrottlingStorageKey(thumbprint);
-        cacheManager.removeItem(key);
+        cacheManager.removeItem(key, request.correlationId);
     }
 }

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.15.0";
+export const version = "14.16.1";

package/src/request/BaseAuthRequest.ts

@@ -29,6 +29,7 @@ import { ShrOptions } from "../crypto/SignedHttpRequest.js";
  * - storeInCache            - Object containing boolean values indicating whether to store tokens in the cache or not (default is true)
  * - scenarioId              - Scenario id to track custom user prompts
  * - popKid                  - Key ID to identify the public key for PoP token request
+ * - embeddedClientId        - Embedded client id. When specified, broker client id (brk_client_id) and redirect uri (brk_redirect_uri) params are set with values from the config, overriding the corresponding extra parameters, if present.
  */
 export type BaseAuthRequest = {
     authority: string;
@@ -50,4 +51,5 @@ export type BaseAuthRequest = {
     storeInCache?: StoreInCache;
     scenarioId?: string;
     popKid?: string;
+    embeddedClientId?: string;
 };

package/src/request/RequestParameterBuilder.ts

@@ -28,13 +28,44 @@ import {
 } from "../config/ClientConfiguration.js";
 import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
 import { ClientInfo } from "../account/ClientInfo.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+
+function instrumentBrokerParams(
+    parameters: Map<string, string>,
+    correlationId?: string,
+    performanceClient?: IPerformanceClient
+) {
+    if (!correlationId) {
+        return;
+    }
+
+    const clientId = parameters.get(AADServerParamKeys.CLIENT_ID);
+    if (clientId && parameters.has(AADServerParamKeys.BROKER_CLIENT_ID)) {
+        performanceClient?.addFields(
+            {
+                embeddedClientId: clientId,
+                embeddedRedirectUri: parameters.get(
+                    AADServerParamKeys.REDIRECT_URI
+                ),
+            },
+            correlationId
+        );
+    }
+}
 
 /** @internal */
 export class RequestParameterBuilder {
     private parameters: Map<string, string>;
+    private readonly performanceClient?: IPerformanceClient;
+    private readonly correlationId?: string;
 
-    constructor() {
+    constructor(
+        correlationId?: string,
+        performanceClient?: IPerformanceClient
+    ) {
         this.parameters = new Map<string, string>();
+        this.performanceClient = performanceClient;
+        this.correlationId = correlationId;
     }
 
     /**
@@ -598,6 +629,19 @@ export class RequestParameterBuilder {
         );
     }
 
+    addBrokerParameters(params: {
+        brokerClientId: string;
+        brokerRedirectUri: string;
+    }): void {
+        const brokerParams: StringDict = {};
+        brokerParams[AADServerParamKeys.BROKER_CLIENT_ID] =
+            params.brokerClientId;
+        brokerParams[AADServerParamKeys.BROKER_REDIRECT_URI] =
+            params.brokerRedirectUri;
+
+        this.addExtraQueryParameters(brokerParams);
+    }
+
     /**
      * Utility to create a URL from the params map
      */
@@ -608,6 +652,12 @@ export class RequestParameterBuilder {
             queryParameterArray.push(`${key}=${value}`);
         });
 
+        instrumentBrokerParams(
+            this.parameters,
+            this.correlationId,
+            this.performanceClient
+        );
+
         return queryParameterArray.join("&");
     }
 }

package/src/response/ResponseHandler.ts

@@ -376,7 +376,11 @@ export class ResponseHandler {
                 cacheRecord.account
             ) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key, this.logger);
+                const account = this.cacheStorage.getAccount(
+                    key,
+                    request.correlationId,
+                    this.logger
+                );
                 if (!account) {
                     this.logger.warning(
                         "Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache"
@@ -396,8 +400,8 @@ export class ResponseHandler {
             }
             await this.cacheStorage.saveCacheRecord(
                 cacheRecord,
-                request.storeInCache,
-                request.correlationId
+                request.correlationId,
+                request.storeInCache
             );
         } finally {
             if (
@@ -466,6 +470,7 @@ export class ResponseHandler {
                 authority,
                 this.homeAccountIdentifier,
                 this.cryptoObj.base64Decode,
+                request.correlationId,
                 idTokenClaims,
                 serverTokenResponse.client_info,
                 env,
@@ -706,6 +711,7 @@ export function buildAccountToCache(
     authority: Authority,
     homeAccountId: string,
     base64Decode: (input: string) => string,
+    correlationId: string,
     idTokenClaims?: TokenClaims,
     clientInfo?: string,
     environment?: string,
@@ -724,7 +730,11 @@ export function buildAccountToCache(
 
     let cachedAccount: AccountEntity | null = null;
     if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+        cachedAccount = cacheStorage.getAccount(
+            baseAccountKey,
+            correlationId,
+            logger
+        );
     }
 
     const baseAccount =

package/src/telemetry/performance/PerformanceClient.ts

@@ -198,22 +198,39 @@ export function compactStack(stack: string, stackMaxSize: number): string[] {
     }
 
     const stackArr = stack.split("\n") || [];
-    if (stackArr.length < 2) {
-        return [];
-    }
 
     const res = [];
-    // Get top N stack lines
-    for (
-        // Skip first line as it may contain PII data
-        let ix = Math.max(stackArr.length - stackMaxSize - 1, 1);
-        ix < stackArr.length;
-        ix++
+
+    // Check for a handful of known, common runtime errors and log them (with redaction where applicable).
+    const firstLine = stackArr[0];
+    if (
+        firstLine.startsWith("TypeError: Cannot read property") ||
+        firstLine.startsWith("TypeError: Cannot read properties of") ||
+        firstLine.startsWith("TypeError: Cannot set property") ||
+        firstLine.startsWith("TypeError: Cannot set properties of") ||
+        firstLine.endsWith("is not a function")
     ) {
-        const line = stackArr[ix];
+        // These types of errors are not at risk of leaking PII. They will indicate unavailable APIs
+        res.push(compactStackLine(firstLine));
+    } else if (
+        firstLine.startsWith("SyntaxError") ||
+        firstLine.startsWith("TypeError")
+    ) {
+        // Prevent unintentional leaking of arbitrary info by redacting contents between both single and double quotes
+        res.push(
+            compactStackLine(
+                // Example: SyntaxError: Unexpected token 'e', "test" is not valid JSON -> SyntaxError: Unexpected token <redacted>, <redacted> is not valid JSON
+                firstLine.replace(/['].*[']|["].*["]/g, "<redacted>")
+            )
+        );
+    }
+
+    // Get top N stack lines
+    for (let ix = 1; ix < stackArr.length; ix++) {
         if (res.length >= stackMaxSize) {
             break;
         }
+        const line = stackArr[ix];
         res.push(compactStackLine(line));
     }
     return res;
@@ -630,14 +647,27 @@ export abstract class PerformanceClient implements IPerformanceClient {
             event.correlationId
         );
 
+        if (error) {
+            addError(error, this.logger, rootEvent);
+        }
+
         // Add sub-measurement attribute to root event.
         if (!isRoot) {
             rootEvent[event.name + "DurationMs"] = Math.floor(event.durationMs);
             return { ...rootEvent };
         }
 
-        if (error) {
-            addError(error, this.logger, rootEvent);
+        if (
+            isRoot &&
+            !error &&
+            (rootEvent.errorCode || rootEvent.subErrorCode)
+        ) {
+            this.logger.trace(
+                `PerformanceClient: Remove error and sub-error codes for root event ${event.name} as intermediate error was successfully handled`,
+                event.correlationId
+            );
+            rootEvent.errorCode = undefined;
+            rootEvent.subErrorCode = undefined;
         }
 
         let finalEvent: PerformanceEvent = { ...rootEvent, ...event };

package/src/telemetry/performance/PerformanceEvent.ts

@@ -116,6 +116,7 @@ export const PerformanceEvents = {
     /**
      * Time spent sending/waiting for the response of a request to the token endpoint
      */
+    NetworkClientSendPostRequestAsync: "networkClientSendPostRequestAsync",
     RefreshTokenClientExecutePostToTokenEndpoint:
         "refreshTokenClientExecutePostToTokenEndpoint",
     AuthorizationCodeClientExecutePostToTokenEndpoint:
@@ -342,6 +343,10 @@ export const PerformanceEventAbbreviations: ReadonlyMap<string, string> =
             PerformanceEvents.BaseClientCreateTokenRequestHeaders,
             "BaseClientCreateTReqHead",
         ],
+        [
+            PerformanceEvents.NetworkClientSendPostRequestAsync,
+            "NetClientSendPost",
+        ],
         [
             PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint,
             "RTClientExecPost",
@@ -790,7 +795,14 @@ export type PerformanceEvent = {
     matsSilentStatus?: number;
     matsHttpStatus?: number;
     matsHttpEventCount?: number;
+
+    /**
+     * Http POST metadata
+     */
     httpVerToken?: string;
+    httpStatus?: number;
+    contentTypeHeader?: string;
+    contentLengthHeader?: string;
 
     /**
      * Native broker fields
@@ -834,6 +846,9 @@ export type PerformanceEvent = {
      * @type {string}
      */
     retryError?: string;
+
+    embeddedClientId?: string;
+    embeddedRedirectUri?: string;
 };
 
 export type PerformanceEventContext = {

package/src/telemetry/server/ServerTelemetryManager.ts

@@ -204,7 +204,8 @@ export class ServerTelemetryManager {
 
         this.cacheManager.setServerTelemetry(
             this.telemetryCacheKey,
-            lastRequests
+            lastRequests,
+            this.correlationId
         );
 
         return;
@@ -219,7 +220,8 @@ export class ServerTelemetryManager {
 
         this.cacheManager.setServerTelemetry(
             this.telemetryCacheKey,
-            lastRequests
+            lastRequests,
+            this.correlationId
         );
         return lastRequests.cacheHits;
     }
@@ -250,7 +252,10 @@ export class ServerTelemetryManager {
         const errorCount = lastRequests.errors.length;
         if (numErrorsFlushed === errorCount) {
             // All errors were sent on last request, clear Telemetry cache
-            this.cacheManager.removeItem(this.telemetryCacheKey);
+            this.cacheManager.removeItem(
+                this.telemetryCacheKey,
+                this.correlationId
+            );
         } else {
             // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
             const serverTelemEntity: ServerTelemetryEntity = {
@@ -263,7 +268,8 @@ export class ServerTelemetryManager {
 
             this.cacheManager.setServerTelemetry(
                 this.telemetryCacheKey,
-                serverTelemEntity
+                serverTelemEntity,
+                this.correlationId
             );
         }
     }
@@ -351,7 +357,8 @@ export class ServerTelemetryManager {
         lastRequests.nativeBrokerErrorCode = errorCode;
         this.cacheManager.setServerTelemetry(
             this.telemetryCacheKey,
-            lastRequests
+            lastRequests,
+            this.correlationId
         );
     }
 
@@ -364,7 +371,8 @@ export class ServerTelemetryManager {
         delete lastRequests.nativeBrokerErrorCode;
         this.cacheManager.setServerTelemetry(
             this.telemetryCacheKey,
-            lastRequests
+            lastRequests,
+            this.correlationId
         );
     }
 

package/src/utils/Constants.ts

@@ -99,6 +99,7 @@ export const OIDC_SCOPES = [...OIDC_DEFAULT_SCOPES, Constants.EMAIL_SCOPE];
  */
 export const HeaderNames = {
     CONTENT_TYPE: "Content-Type",
+    CONTENT_LENGTH: "Content-Length",
     RETRY_AFTER: "Retry-After",
     CCS_HEADER: "X-AnchorMailbox",
     WWWAuthenticate: "WWW-Authenticate",

package/dist/network/NetworkManager.d.ts

@@ -1,34 +0,0 @@
-import { INetworkModule, NetworkRequestOptions } from "./INetworkModule.js";
-import { RequestThumbprint } from "./RequestThumbprint.js";
-import { CacheManager } from "../cache/CacheManager.js";
-import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
-export type NetworkResponse<T> = {
-    headers: Record<string, string>;
-    body: T;
-    status: number;
-};
-export type UrlToHttpRequestOptions = {
-    protocol: string;
-    hostname: string;
-    hash: string;
-    search: string;
-    pathname: string;
-    path: string;
-    href: string;
-    port?: number;
-    auth?: string;
-};
-/** @internal */
-export declare class NetworkManager {
-    private networkClient;
-    private cacheManager;
-    constructor(networkClient: INetworkModule, cacheManager: CacheManager);
-    /**
-     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
-     * @param thumbprint
-     * @param tokenEndpoint
-     * @param options
-     */
-    sendPostRequest<T extends ServerAuthorizationTokenResponse>(thumbprint: RequestThumbprint, tokenEndpoint: string, options: NetworkRequestOptions): Promise<NetworkResponse<T>>;
-}
-//# sourceMappingURL=NetworkManager.d.ts.map

package/dist/network/NetworkManager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"NetworkManager.d.ts","sourceRoot":"","sources":["../../src/network/NetworkManager.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAMxD,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAC;AAEnG,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC;IACR,MAAM,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,gBAAgB;AAChB,qBAAa,cAAc;IACvB,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,YAAY,CAAe;gBAEvB,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY;IAKrE;;;;;OAKG;IACG,eAAe,CAAC,CAAC,SAAS,gCAAgC,EAC5D,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,qBAAqB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CAqBjC"}

package/dist/network/NetworkManager.mjs

@@ -1,44 +0,0 @@
-/*! @azure/msal-common v14.15.0 2024-09-20 */
-'use strict';
-import { ThrottlingUtils } from './ThrottlingUtils.mjs';
-import { AuthError } from '../error/AuthError.mjs';
-import { createClientAuthError } from '../error/ClientAuthError.mjs';
-import { networkError } from '../error/ClientAuthErrorCodes.mjs';
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/** @internal */
-class NetworkManager {
-    constructor(networkClient, cacheManager) {
-        this.networkClient = networkClient;
-        this.cacheManager = cacheManager;
-    }
-    /**
-     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
-     * @param thumbprint
-     * @param tokenEndpoint
-     * @param options
-     */
-    async sendPostRequest(thumbprint, tokenEndpoint, options) {
-        ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
-        let response;
-        try {
-            response = await this.networkClient.sendPostRequestAsync(tokenEndpoint, options);
-        }
-        catch (e) {
-            if (e instanceof AuthError) {
-                throw e;
-            }
-            else {
-                throw createClientAuthError(networkError);
-            }
-        }
-        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
-        return response;
-    }
-}
-
-export { NetworkManager };
-//# sourceMappingURL=NetworkManager.mjs.map

package/dist/network/NetworkManager.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"NetworkManager.mjs","sources":["../../src/network/NetworkManager.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.networkError"],"mappings":";;;;;;;AAAA;;;AAGG;AA+BH;MACa,cAAc,CAAA;IAIvB,WAAY,CAAA,aAA6B,EAAE,YAA0B,EAAA;AACjE,QAAA,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;AACnC,QAAA,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;KACpC;AAED;;;;;AAKG;AACH,IAAA,MAAM,eAAe,CACjB,UAA6B,EAC7B,aAAqB,EACrB,OAA8B,EAAA;QAE9B,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAE1D,QAAA,IAAI,QAAQ,CAAC;QACb,IAAI;AACA,YAAA,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CACpD,aAAa,EACb,OAAO,CACV,CAAC;AACL,SAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,IAAI,CAAC,YAAY,SAAS,EAAE;AACxB,gBAAA,MAAM,CAAC,CAAC;AACX,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,qBAAqB,CAACA,YAAiC,CAAC,CAAC;AAClE,aAAA;AACJ,SAAA;QAED,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAErE,QAAA,OAAO,QAAQ,CAAC;KACnB;AACJ;;;;"}