@azure/msal-common 14.16.0 → 15.0.1

package/src/cache/CacheManager.ts

@@ -36,7 +36,6 @@ import {
 import {
     AccountInfo,
     TenantProfile,
-    tenantIdMatchesHomeTenant,
     updateAccountTenantProfileData,
 } from "../account/AccountInfo.js";
 import { AppMetadataEntity } from "./entities/AppMetadataEntity.js";
@@ -87,21 +86,15 @@ export abstract class CacheManager implements ICacheManager {
         logger?: Logger
     ): AccountEntity | null;
 
-    /**
-     * Returns deserialized account if found in the cache, otherwiser returns null
-     */
-    abstract getCachedAccountEntity(accountKey: string): AccountEntity | null;
-
     /**
      * set account entity in the platform cache
      * @param account
+     * @param correlationId
      */
-    abstract setAccount(account: AccountEntity): void;
-
-    /**
-     * remove account entity from the platform cache if it's outdated
-     */
-    abstract removeOutdatedAccount(accountKey: string): void;
+    abstract setAccount(
+        account: AccountEntity,
+        correlationId: string
+    ): Promise<void>;
 
     /**
      * fetch the idToken entity from the platform cache
@@ -112,8 +105,12 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * set idToken entity to the platform cache
      * @param idToken
+     * @param correlationId
      */
-    abstract setIdTokenCredential(idToken: IdTokenEntity): void;
+    abstract setIdTokenCredential(
+        idToken: IdTokenEntity,
+        correlationId: string
+    ): Promise<void>;
 
     /**
      * fetch the idToken entity from the platform cache
@@ -124,10 +121,14 @@ export abstract class CacheManager implements ICacheManager {
     ): AccessTokenEntity | null;
 
     /**
-     * set idToken entity to the platform cache
+     * set accessToken entity to the platform cache
      * @param accessToken
+     * @param correlationId
      */
-    abstract setAccessTokenCredential(accessToken: AccessTokenEntity): void;
+    abstract setAccessTokenCredential(
+        accessToken: AccessTokenEntity,
+        correlationId: string
+    ): Promise<void>;
 
     /**
      * fetch the idToken entity from the platform cache
@@ -138,10 +139,14 @@ export abstract class CacheManager implements ICacheManager {
     ): RefreshTokenEntity | null;
 
     /**
-     * set idToken entity to the platform cache
+     * set refreshToken entity to the platform cache
      * @param refreshToken
+     * @param correlationId
      */
-    abstract setRefreshTokenCredential(refreshToken: RefreshTokenEntity): void;
+    abstract setRefreshTokenCredential(
+        refreshToken: RefreshTokenEntity,
+        correlationId: string
+    ): Promise<void>;
 
     /**
      * fetch appMetadata entity from the platform cache
@@ -233,14 +238,6 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract getTokenKeys(): TokenKeys;
 
-    /**
-     * Function which updates an outdated credential cache key
-     */
-    abstract updateCredentialCacheKey(
-        currentCacheKey: string,
-        credential: ValidCredentialType
-    ): string;
-
     /**
      * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
      * @param accountFilter - (Optional) filter to narrow down the accounts returned
@@ -493,8 +490,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     async saveCacheRecord(
         cacheRecord: CacheRecord,
-        storeInCache?: StoreInCache,
-        correlationId?: string
+        correlationId: string,
+        storeInCache?: StoreInCache
     ): Promise<void> {
         if (!cacheRecord) {
             throw createClientAuthError(
@@ -504,25 +501,34 @@ export abstract class CacheManager implements ICacheManager {
 
         try {
             if (!!cacheRecord.account) {
-                this.setAccount(cacheRecord.account);
+                await this.setAccount(cacheRecord.account, correlationId);
             }
 
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                this.setIdTokenCredential(cacheRecord.idToken);
+                await this.setIdTokenCredential(
+                    cacheRecord.idToken,
+                    correlationId
+                );
             }
 
             if (
                 !!cacheRecord.accessToken &&
                 storeInCache?.accessToken !== false
             ) {
-                await this.saveAccessToken(cacheRecord.accessToken);
+                await this.saveAccessToken(
+                    cacheRecord.accessToken,
+                    correlationId
+                );
             }
 
             if (
                 !!cacheRecord.refreshToken &&
                 storeInCache?.refreshToken !== false
             ) {
-                this.setRefreshTokenCredential(cacheRecord.refreshToken);
+                await this.setRefreshTokenCredential(
+                    cacheRecord.refreshToken,
+                    correlationId
+                );
             }
 
             if (!!cacheRecord.appMetadata) {
@@ -566,7 +572,8 @@ export abstract class CacheManager implements ICacheManager {
      * @param credential
      */
     private async saveAccessToken(
-        credential: AccessTokenEntity
+        credential: AccessTokenEntity,
+        correlationId: string
     ): Promise<void> {
         const accessTokenFilter: CredentialFilter = {
             clientId: credential.clientId,
@@ -602,7 +609,7 @@ export abstract class CacheManager implements ICacheManager {
             }
         });
         await Promise.all(removedAccessTokens);
-        this.setAccessTokenCredential(credential);
+        await this.setAccessTokenCredential(credential, correlationId);
     }
 
     /**
@@ -1006,88 +1013,6 @@ export abstract class CacheManager implements ICacheManager {
         await Promise.all(removedCredentials);
     }
 
-    /**
-     * Migrates a single-tenant account and all it's associated alternate cross-tenant account objects in the
-     * cache into a condensed multi-tenant account object with tenant profiles.
-     * @param accountKey
-     * @param accountEntity
-     * @param logger
-     * @returns
-     */
-    protected updateOutdatedCachedAccount(
-        accountKey: string,
-        accountEntity: AccountEntity | null,
-        logger?: Logger
-    ): AccountEntity | null {
-        // Only update if account entity is defined and has no tenantProfiles object (is outdated)
-        if (accountEntity && accountEntity.isSingleTenant()) {
-            this.commonLogger?.verbose(
-                "updateOutdatedCachedAccount: Found a single-tenant (outdated) account entity in the cache, migrating to multi-tenant account entity"
-            );
-
-            // Get keys of all accounts belonging to user
-            const matchingAccountKeys = this.getAccountKeys().filter(
-                (key: string) => {
-                    return key.startsWith(accountEntity.homeAccountId);
-                }
-            );
-
-            // Get all account entities belonging to user
-            const accountsToMerge: AccountEntity[] = [];
-            matchingAccountKeys.forEach((key: string) => {
-                const account = this.getCachedAccountEntity(key);
-                if (account) {
-                    accountsToMerge.push(account);
-                }
-            });
-
-            // Set base account to home account if available, any account if not
-            const baseAccount =
-                accountsToMerge.find((account) => {
-                    return tenantIdMatchesHomeTenant(
-                        account.realm,
-                        account.homeAccountId
-                    );
-                }) || accountsToMerge[0];
-
-            // Populate tenant profiles built from each account entity belonging to the user
-            baseAccount.tenantProfiles = accountsToMerge.map(
-                (account: AccountEntity) => {
-                    return {
-                        tenantId: account.realm,
-                        localAccountId: account.localAccountId,
-                        name: account.name,
-                        isHomeTenant: tenantIdMatchesHomeTenant(
-                            account.realm,
-                            account.homeAccountId
-                        ),
-                    };
-                }
-            );
-
-            const updatedAccount = CacheManager.toObject(new AccountEntity(), {
-                ...baseAccount,
-            });
-
-            const newAccountKey = updatedAccount.generateAccountKey();
-
-            // Clear cache of legacy account objects that have been collpsed into tenant profiles
-            matchingAccountKeys.forEach((key: string) => {
-                if (key !== newAccountKey) {
-                    this.removeOutdatedAccount(accountKey);
-                }
-            });
-
-            // Cache updated account object
-            this.setAccount(updatedAccount);
-            logger?.verbose("Updated an outdated account entity in the cache");
-            return updatedAccount;
-        }
-
-        // No update is necessary
-        return accountEntity;
-    }
-
     /**
      * returns a boolean if the given credential is removed
      * @param credential
@@ -1934,28 +1859,25 @@ export abstract class CacheManager implements ICacheManager {
 
 /** @internal */
 export class DefaultStorageClass extends CacheManager {
-    setAccount(): void {
+    async setAccount(): Promise<void> {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     }
     getAccount(): AccountEntity {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     }
-    getCachedAccountEntity(): AccountEntity | null {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
-    }
-    setIdTokenCredential(): void {
+    async setIdTokenCredential(): Promise<void> {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     }
     getIdTokenCredential(): IdTokenEntity {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     }
-    setAccessTokenCredential(): void {
+    async setAccessTokenCredential(): Promise<void> {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     }
     getAccessTokenCredential(): AccessTokenEntity {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     }
-    setRefreshTokenCredential(): void {
+    async setRefreshTokenCredential(): Promise<void> {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     }
     getRefreshTokenCredential(): RefreshTokenEntity {
@@ -2000,10 +1922,4 @@ export class DefaultStorageClass extends CacheManager {
     getTokenKeys(): TokenKeys {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     }
-    updateCredentialCacheKey(): string {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
-    }
-    removeOutdatedAccount(): void {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
-    }
 }

package/src/cache/interface/ICacheManager.ts

@@ -27,7 +27,7 @@ export interface ICacheManager {
      * set account entity in the platform cache
      * @param account
      */
-    setAccount(account: AccountEntity): void;
+    setAccount(account: AccountEntity, correlationId: string): Promise<void>;
 
     /**
      * Returns true if the given key matches our account key schema. Also matches homeAccountId and/or tenantId if provided
@@ -52,7 +52,10 @@ export interface ICacheManager {
      * set idToken entity to the platform cache
      * @param idToken
      */
-    setIdTokenCredential(idToken: IdTokenEntity): void;
+    setIdTokenCredential(
+        idToken: IdTokenEntity,
+        correlationId: string
+    ): Promise<void>;
 
     /**
      * fetch the idToken entity from the platform cache
@@ -64,7 +67,10 @@ export interface ICacheManager {
      * set idToken entity to the platform cache
      * @param accessToken
      */
-    setAccessTokenCredential(accessToken: AccessTokenEntity): void;
+    setAccessTokenCredential(
+        accessToken: AccessTokenEntity,
+        correlationId: string
+    ): Promise<void>;
 
     /**
      * fetch the idToken entity from the platform cache
@@ -78,7 +84,10 @@ export interface ICacheManager {
      * set idToken entity to the platform cache
      * @param refreshToken
      */
-    setRefreshTokenCredential(refreshToken: RefreshTokenEntity): void;
+    setRefreshTokenCredential(
+        refreshToken: RefreshTokenEntity,
+        correlationId: string
+    ): Promise<void>;
 
     /**
      * fetch appMetadata entity from the platform cache
@@ -167,6 +176,7 @@ export interface ICacheManager {
      */
     saveCacheRecord(
         cacheRecord: CacheRecord,
+        correlationId: string,
         storeInCache?: StoreInCache
     ): Promise<void>;
 

package/src/client/AuthorizationCodeClient.ts

@@ -694,7 +694,7 @@ export class AuthorizationCodeClient extends BaseClient {
 
         this.addExtraQueryParams(request, parameterBuilder);
 
-        if (request.nativeBroker) {
+        if (request.platformBroker) {
             // signal ests that this is a WAM call
             parameterBuilder.addNativeBroker();
 

package/src/error/ClientConfigurationError.ts

@@ -47,8 +47,8 @@ export const ClientConfigurationErrorMessages = {
         "Invalid authentication header provided",
     [ClientConfigurationErrorCodes.cannotSetOIDCOptions]:
         "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
-    [ClientConfigurationErrorCodes.cannotAllowNativeBroker]:
-        "Cannot set allowNativeBroker parameter to true when not in AAD protocol mode.",
+    [ClientConfigurationErrorCodes.cannotAllowPlatformBroker]:
+        "Cannot set allowPlatformBroker parameter to true when not in AAD protocol mode.",
     [ClientConfigurationErrorCodes.authorityMismatch]:
         "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
 };
@@ -178,10 +178,10 @@ export const ClientConfigurationErrorMessage = {
             ClientConfigurationErrorCodes.cannotSetOIDCOptions
         ],
     },
-    cannotAllowNativeBroker: {
-        code: ClientConfigurationErrorCodes.cannotAllowNativeBroker,
+    cannotAllowPlatformBroker: {
+        code: ClientConfigurationErrorCodes.cannotAllowPlatformBroker,
         desc: ClientConfigurationErrorMessages[
-            ClientConfigurationErrorCodes.cannotAllowNativeBroker
+            ClientConfigurationErrorCodes.cannotAllowPlatformBroker
         ],
     },
     authorityMismatch: {

package/src/error/ClientConfigurationErrorCodes.ts

@@ -24,5 +24,5 @@ export const missingNonceAuthenticationHeader =
     "missing_nonce_authentication_header";
 export const invalidAuthenticationHeader = "invalid_authentication_header";
 export const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
-export const cannotAllowNativeBroker = "cannot_allow_native_broker";
+export const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 export const authorityMismatch = "authority_mismatch";

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.16.0";
+export const version = "15.0.1";

package/src/request/CommonAuthorizationUrlRequest.ts

@@ -52,5 +52,5 @@ export type CommonAuthorizationUrlRequest = BaseAuthRequest & {
     prompt?: string;
     sid?: string;
     state?: string;
-    nativeBroker?: boolean;
+    platformBroker?: boolean;
 };

package/src/response/ResponseHandler.ts

@@ -376,7 +376,7 @@ export class ResponseHandler {
                 cacheRecord.account
             ) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key, this.logger);
+                const account = this.cacheStorage.getAccount(key);
                 if (!account) {
                     this.logger.warning(
                         "Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache"
@@ -396,8 +396,8 @@ export class ResponseHandler {
             }
             await this.cacheStorage.saveCacheRecord(
                 cacheRecord,
-                request.storeInCache,
-                request.correlationId
+                request.correlationId,
+                request.storeInCache
             );
         } finally {
             if (
@@ -724,7 +724,7 @@ export function buildAccountToCache(
 
     let cachedAccount: AccountEntity | null = null;
     if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+        cachedAccount = cacheStorage.getAccount(baseAccountKey);
     }
 
     const baseAccount =

package/src/telemetry/performance/PerformanceEvent.ts

@@ -190,6 +190,8 @@ export const PerformanceEvents = {
 
     InitializeClientApplication: "initializeClientApplication",
 
+    InitializeCache: "initializeCache",
+
     /**
      * Helper function in SilentIframeClient class (msal-browser).
      */
@@ -297,6 +299,8 @@ export const PerformanceEvents = {
      */
     ClearTokensAndKeysWithClaims: "clearTokensAndKeysWithClaims",
     CacheManagerGetRefreshToken: "cacheManagerGetRefreshToken",
+    ImportExistingCache: "importExistingCache",
+    SetUserData: "setUserData",
 
     /**
      * Crypto Operations
@@ -306,6 +310,12 @@ export const PerformanceEvents = {
     GenerateCodeChallengeFromVerifier: "generateCodeChallengeFromVerifier",
     Sha256Digest: "sha256Digest",
     GetRandomValues: "getRandomValues",
+    GenerateHKDF: "generateHKDF",
+    GenerateBaseKey: "generateBaseKey",
+    Base64Decode: "base64Decode",
+    UrlEncodeArr: "urlEncodeArr",
+    Encrypt: "encrypt",
+    Decrypt: "decrypt",
 } as const;
 export type PerformanceEvents =
     (typeof PerformanceEvents)[keyof typeof PerformanceEvents];
@@ -394,6 +404,9 @@ export const PerformanceEventAbbreviations: ReadonlyMap<string, string> =
             PerformanceEvents.InitializeClientApplication,
             "InitClientApplication",
         ],
+        [PerformanceEvents.InitializeCache, "InitCache"],
+        [PerformanceEvents.ImportExistingCache, "importCache"],
+        [PerformanceEvents.SetUserData, "setUserData"],
         [PerformanceEvents.SilentIframeClientTokenHelper, "SIClientTHelper"],
         [
             PerformanceEvents.SilentHandlerInitiateAuthRequest,
@@ -531,6 +544,12 @@ export const PerformanceEventAbbreviations: ReadonlyMap<string, string> =
         ],
         [PerformanceEvents.Sha256Digest, "Sha256Digest"],
         [PerformanceEvents.GetRandomValues, "GetRandomValues"],
+        [PerformanceEvents.GenerateHKDF, "genHKDF"],
+        [PerformanceEvents.GenerateBaseKey, "genBaseKey"],
+        [PerformanceEvents.Base64Decode, "b64Decode"],
+        [PerformanceEvents.UrlEncodeArr, "urlEncArr"],
+        [PerformanceEvents.Encrypt, "encrypt"],
+        [PerformanceEvents.Decrypt, "decrypt"],
     ]);
 
 /**
@@ -805,9 +824,9 @@ export type PerformanceEvent = {
     contentLengthHeader?: string;
 
     /**
-     * Native broker fields
+     * Platform broker fields
      */
-    allowNativeBroker?: boolean;
+    allowPlatformBroker?: boolean;
     extensionInstalled?: boolean;
     extensionHandshakeTimeoutMs?: number;
     extensionHandshakeTimedOut?: boolean;
@@ -876,4 +895,6 @@ export const IntFields: ReadonlySet<string> = new Set([
     "multiMatchedAT",
     "multiMatchedID",
     "multiMatchedRT",
+    "unencryptedCacheCount",
+    "encryptedCacheExpiredCount",
 ]);

package/src/utils/Constants.ts

@@ -113,12 +113,6 @@ export type HeaderNames = (typeof HeaderNames)[keyof typeof HeaderNames];
  * Persistent cache keys MSAL which stay while user is logged in.
  */
 export const PersistentCacheKeys = {
-    ID_TOKEN: "idtoken",
-    CLIENT_INFO: "client.info",
-    ADAL_ID_TOKEN: "adal.idtoken",
-    ERROR: "error",
-    ERROR_DESC: "error.description",
-    ACTIVE_ACCOUNT: "active-account", // Legacy active-account cache key, use new key instead
     ACTIVE_ACCOUNT_FILTERS: "active-account-filters", // new cache entry for active_account for a more robust version for browser
 } as const;
 export type PersistentCacheKeys =