@azure/msal-common 14.2.0 → 14.4.0

package/src/cache/CacheManager.ts

@@ -21,6 +21,7 @@ import {
     Separators,
 } from "../utils/Constants";
 import { CredentialEntity } from "./entities/CredentialEntity";
+import { generateCredentialKey } from "./utils/CacheHelpers";
 import { ScopeSet } from "../request/ScopeSet";
 import { AccountEntity } from "./entities/AccountEntity";
 import { AccessTokenEntity } from "./entities/AccessTokenEntity";
@@ -42,12 +43,10 @@ import { BaseAuthRequest } from "../request/BaseAuthRequest";
 import { Logger } from "../logger/Logger";
 import { name, version } from "../packageMetadata";
 import { StoreInCache } from "../request/StoreInCache";
-import {
-    getAliasesFromConfigMetadata,
-    getHardcodedAliasesForCanonicalAuthority,
-} from "../authority/AuthorityMetadata";
+import { getAliasesFromStaticSources } from "../authority/AuthorityMetadata";
 import { StaticAuthorityOptions } from "../authority/AuthorityOptions";
 import { TokenClaims } from "../account/TokenClaims";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 
 /**
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
@@ -259,7 +258,13 @@ export abstract class CacheManager implements ICacheManager {
      */
     getAccountInfoFilteredBy(accountFilter: AccountFilter): AccountInfo | null {
         const allAccounts = this.getAllAccounts(accountFilter);
-        if (allAccounts.length > 0) {
+        if (allAccounts.length > 1) {
+            // If one or more accounts are found, further filter to the first account that has an ID token
+            return allAccounts.filter((account) => {
+                return !!account.idTokenClaims;
+            })[0];
+        } else if (allAccounts.length === 1) {
+            // If only one account is found, return it regardless of whether a matching ID token was found
             return allAccounts[0];
         } else {
             return null;
@@ -303,7 +308,7 @@ export abstract class CacheManager implements ICacheManager {
                 return accountInfo;
             }
         }
-        return null;
+        return accountInfo;
     }
 
     private idTokenClaimsMatchAccountFilter(
@@ -872,29 +877,40 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Retrieve the cached credentials into a cacherecord
-     * @param account
-     * @param clientId
-     * @param scopes
-     * @param environment
-     * @param authScheme
+     * @param account {AccountInfo}
+     * @param request {BaseAuthRequest}
+     * @param environment {string}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     readCacheRecord(
         account: AccountInfo,
         request: BaseAuthRequest,
-        environment: string
+        environment: string,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): CacheRecord {
         const tokenKeys = this.getTokenKeys();
         const cachedAccount = this.readAccountFromCache(account);
-        const cachedIdToken = this.getIdToken(account, tokenKeys);
+        const cachedIdToken = this.getIdToken(
+            account,
+            tokenKeys,
+            performanceClient,
+            correlationId
+        );
         const cachedAccessToken = this.getAccessToken(
             account,
             request,
-            tokenKeys
+            tokenKeys,
+            performanceClient,
+            correlationId
         );
         const cachedRefreshToken = this.getRefreshToken(
             account,
             false,
-            tokenKeys
+            tokenKeys,
+            performanceClient,
+            correlationId
         );
         const cachedAppMetadata = this.readAppMetadataFromCache(environment);
 
@@ -926,13 +942,16 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Retrieve IdTokenEntity from cache
-     * @param clientId
-     * @param account
-     * @param inputRealm
+     * @param account {AccountInfo}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getIdToken(
         account: AccountInfo,
-        tokenKeys?: TokenKeys
+        tokenKeys?: TokenKeys,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): IdTokenEntity | null {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter: CredentialFilter = {
@@ -957,8 +976,14 @@ export abstract class CacheManager implements ICacheManager {
                 "CacheManager:getIdToken - Multiple id tokens found, clearing them"
             );
             idTokens.forEach((idToken) => {
-                this.removeIdToken(idToken.generateCredentialKey());
+                this.removeIdToken(generateCredentialKey(idToken));
             });
+            if (performanceClient && correlationId) {
+                performanceClient.addFields(
+                    { multiMatchedID: idTokens.length },
+                    correlationId
+                );
+            }
             return null;
         }
 
@@ -1043,15 +1068,18 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Retrieve AccessTokenEntity from cache
-     * @param clientId
-     * @param account
-     * @param scopes
-     * @param authScheme
+     * @param account {AccountInfo}
+     * @param request {BaseAuthRequest}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getAccessToken(
         account: AccountInfo,
         request: BaseAuthRequest,
-        tokenKeys?: TokenKeys
+        tokenKeys?: TokenKeys,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): AccessTokenEntity | null {
         this.commonLogger.trace("CacheManager - getAccessToken called");
         const scopes = ScopeSet.createSearchScopes(request.scopes);
@@ -1113,10 +1141,14 @@ export abstract class CacheManager implements ICacheManager {
                 "CacheManager:getAccessToken - Multiple access tokens found, clearing them"
             );
             accessTokens.forEach((accessToken) => {
-                void this.removeAccessToken(
-                    accessToken.generateCredentialKey()
-                );
+                void this.removeAccessToken(generateCredentialKey(accessToken));
             });
+            if (performanceClient && correlationId) {
+                performanceClient.addFields(
+                    { multiMatchedAT: accessTokens.length },
+                    correlationId
+                );
+            }
             return null;
         }
 
@@ -1214,14 +1246,18 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Helper to retrieve the appropriate refresh token from cache
-     * @param clientId
-     * @param account
-     * @param familyRT
+     * @param account {AccountInfo}
+     * @param familyRT {boolean}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getRefreshToken(
         account: AccountInfo,
         familyRT: boolean,
-        tokenKeys?: TokenKeys
+        tokenKeys?: TokenKeys,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): RefreshTokenEntity | null {
         this.commonLogger.trace("CacheManager - getRefreshToken called");
         const id = familyRT ? THE_FAMILY_ID : undefined;
@@ -1264,6 +1300,13 @@ export abstract class CacheManager implements ICacheManager {
         }
         // address the else case after remove functions address environment aliases
 
+        if (numRefreshTokens > 1 && performanceClient && correlationId) {
+            performanceClient.addFields(
+                { multiMatchedRT: numRefreshTokens },
+                correlationId
+            );
+        }
+
         this.commonLogger.info(
             "CacheManager:getRefreshToken - returning refresh token"
         );
@@ -1423,17 +1466,11 @@ export abstract class CacheManager implements ICacheManager {
     ): boolean {
         // Check static authority options first for cases where authority metadata has not been resolved and cached yet
         if (this.staticAuthorityOptions) {
-            const staticAliases =
-                getAliasesFromConfigMetadata(
-                    this.staticAuthorityOptions.canonicalAuthority,
-                    this.staticAuthorityOptions.cloudDiscoveryMetadata
-                ) ||
-                getHardcodedAliasesForCanonicalAuthority(
-                    this.staticAuthorityOptions.canonicalAuthority
-                ) ||
-                this.staticAuthorityOptions.knownAuthorities;
+            const staticAliases = getAliasesFromStaticSources(
+                this.staticAuthorityOptions,
+                this.commonLogger
+            );
             if (
-                staticAliases &&
                 staticAliases.includes(environment) &&
                 staticAliases.includes(entity.environment)
             ) {

package/src/cache/entities/AccessTokenEntity.ts

@@ -4,164 +4,28 @@
  */
 
 import { CredentialEntity } from "./CredentialEntity";
-import { CredentialType, AuthenticationScheme } from "../../utils/Constants";
-import { TimeUtils } from "../../utils/TimeUtils";
-import { ICrypto } from "../../crypto/ICrypto";
-import { TokenClaims } from "../../account/TokenClaims";
-import {
-    createClientAuthError,
-    ClientAuthErrorCodes,
-} from "../../error/ClientAuthError";
-import { extractTokenClaims } from "../../account/AuthToken";
+import { AuthenticationScheme } from "../../utils/Constants";
 
 /**
- * ACCESS_TOKEN Credential Type
- *
- * Key:Value Schema:
- *
- * Key Example: uid.utid-login.microsoftonline.com-accesstoken-clientId-contoso.com-user.read
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      familyId: Family ID identifier, usually only used for refresh tokens
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      cachedAt: Absolute device time when entry was created in the cache.
- *      expiresOn: Token expiry time, calculated based on current UTC time in seconds. Represented as a string.
- *      extendedExpiresOn: Additional extended expiry time until when token is valid in case of server-side outage. Represented as string in UTC seconds.
- *      keyId: used for POP and SSH tokenTypes
- *      tokenType: Type of the token issued. Usually "Bearer"
- * }
+ * Access token cache type
  */
-export class AccessTokenEntity extends CredentialEntity {
+export type AccessTokenEntity = CredentialEntity & {
+    /** Full tenant or organizational identifier that the account belongs to */
     realm: string;
+    /** Permissions that are included in the token, or for refresh tokens, the resource identifier. */
     target: string;
+    /** Absolute device time when entry was created in the cache. */
     cachedAt: string;
+    /** Token expiry time, calculated based on current UTC time in seconds. Represented as a string. */
     expiresOn: string;
+    /** Additional extended expiry time until when token is valid in case of server-side outage. Represented as string in UTC seconds. */
     extendedExpiresOn?: string;
+    /** Used for proactive refresh */
     refreshOn?: string;
-    keyId?: string; // for POP and SSH tokenTypes
+    /** Matches the authentication scheme for which the token was issued (i.e. Bearer or pop) */
     tokenType?: AuthenticationScheme;
+    /** Stringified claims object */
     requestedClaims?: string;
+    /** Matches the SHA 256 hash of the claims object included in the token request */
     requestedClaimsHash?: string;
-
-    /**
-     * Create AccessTokenEntity
-     * @param homeAccountId
-     * @param environment
-     * @param accessToken
-     * @param clientId
-     * @param tenantId
-     * @param scopes
-     * @param expiresOn
-     * @param extExpiresOn
-     */
-    static createAccessTokenEntity(
-        homeAccountId: string,
-        environment: string,
-        accessToken: string,
-        clientId: string,
-        tenantId: string,
-        scopes: string,
-        expiresOn: number,
-        extExpiresOn: number,
-        cryptoUtils: ICrypto,
-        refreshOn?: number,
-        tokenType?: AuthenticationScheme,
-        userAssertionHash?: string,
-        keyId?: string,
-        requestedClaims?: string,
-        requestedClaimsHash?: string
-    ): AccessTokenEntity {
-        const atEntity: AccessTokenEntity = new AccessTokenEntity();
-
-        atEntity.homeAccountId = homeAccountId;
-        atEntity.credentialType = CredentialType.ACCESS_TOKEN;
-        atEntity.secret = accessToken;
-
-        const currentTime = TimeUtils.nowSeconds();
-        atEntity.cachedAt = currentTime.toString();
-
-        /*
-         * Token expiry time.
-         * This value should be  calculated based on the current UTC time measured locally and the value  expires_in Represented as a string in JSON.
-         */
-        atEntity.expiresOn = expiresOn.toString();
-        atEntity.extendedExpiresOn = extExpiresOn.toString();
-        if (refreshOn) {
-            atEntity.refreshOn = refreshOn.toString();
-        }
-
-        atEntity.environment = environment;
-        atEntity.clientId = clientId;
-        atEntity.realm = tenantId;
-        atEntity.target = scopes;
-        atEntity.userAssertionHash = userAssertionHash;
-
-        atEntity.tokenType = tokenType || AuthenticationScheme.BEARER;
-
-        if (requestedClaims) {
-            atEntity.requestedClaims = requestedClaims;
-            atEntity.requestedClaimsHash = requestedClaimsHash;
-        }
-
-        /*
-         * Create Access Token With Auth Scheme instead of regular access token
-         * Cast to lower to handle "bearer" from ADFS
-         */
-        if (
-            atEntity.tokenType?.toLowerCase() !==
-            AuthenticationScheme.BEARER.toLowerCase()
-        ) {
-            atEntity.credentialType =
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-            switch (atEntity.tokenType) {
-                case AuthenticationScheme.POP:
-                    // Make sure keyId is present and add it to credential
-                    const tokenClaims: TokenClaims | null = extractTokenClaims(
-                        accessToken,
-                        cryptoUtils.base64Decode
-                    );
-                    if (!tokenClaims?.cnf?.kid) {
-                        throw createClientAuthError(
-                            ClientAuthErrorCodes.tokenClaimsCnfRequiredForSignedJwt
-                        );
-                    }
-                    atEntity.keyId = tokenClaims.cnf.kid;
-                    break;
-                case AuthenticationScheme.SSH:
-                    atEntity.keyId = keyId;
-            }
-        }
-
-        return atEntity;
-    }
-
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isAccessTokenEntity(entity: object): boolean {
-        if (!entity) {
-            return false;
-        }
-
-        return (
-            entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("credentialType") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("secret") &&
-            entity.hasOwnProperty("target") &&
-            (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
-                entity["credentialType"] ===
-                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME)
-        );
-    }
-}
+};

package/src/cache/entities/CredentialEntity.ts

@@ -3,218 +3,34 @@
  * Licensed under the MIT License.
  */
 
-import {
-    Separators,
-    CredentialType,
-    CacheType,
-    Constants,
-    AuthenticationScheme,
-} from "../../utils/Constants";
-import {
-    ClientAuthErrorCodes,
-    createClientAuthError,
-} from "../../error/ClientAuthError";
+import { CredentialType, AuthenticationScheme } from "../../utils/Constants";
 
 /**
- * Base type for credentials to be stored in the cache: eg: ACCESS_TOKEN, ID_TOKEN etc
- *
- * Key:Value Schema:
- *
- * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      familyId: Family ID identifier, usually only used for refresh tokens
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
- *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
- *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
- * }
+ * Credential Cache Type
  */
-export class CredentialEntity {
+export type CredentialEntity = {
+    /** Identifier for the user in their home tenant*/
     homeAccountId: string;
+    /** Entity that issued the token, represented as a full host */
     environment: string;
+    /** Type of credential */
     credentialType: CredentialType;
+    /** Client ID of the application */
     clientId: string;
+    /** Actual credential as a string */
     secret: string;
+    /** Family ID identifier, usually only used for refresh tokens */
     familyId?: string;
+    /** Full tenant or organizational identifier that the account belongs to */
     realm?: string;
+    /** Permissions that are included in the token, or for refresh tokens, the resource identifier. */
     target?: string;
+    /** Matches the SHA 256 hash of the obo_assertion for the OBO flow */
     userAssertionHash?: string;
+    /** Matches the authentication scheme for which the token was issued (i.e. Bearer or pop) */
     tokenType?: AuthenticationScheme;
+    /** KeyId for PoP and SSH tokens stored in the kid claim */
     keyId?: string;
+    /** Matches the SHA 256 hash of the claims object included in the token request */
     requestedClaimsHash?: string;
-
-    /**
-     * Generate Account Id key component as per the schema: <home_account_id>-<environment>
-     */
-    generateAccountId(): string {
-        return CredentialEntity.generateAccountIdForCacheKey(
-            this.homeAccountId,
-            this.environment
-        );
-    }
-
-    /**
-     * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
-     */
-    generateCredentialId(): string {
-        return CredentialEntity.generateCredentialIdForCacheKey(
-            this.credentialType,
-            this.clientId,
-            this.realm,
-            this.familyId
-        );
-    }
-
-    /**
-     * Generate target key component as per schema: <target>
-     */
-    generateTarget(): string {
-        return CredentialEntity.generateTargetForCacheKey(this.target);
-    }
-
-    /**
-     * generates credential key
-     */
-    generateCredentialKey(): string {
-        return CredentialEntity.generateCredentialCacheKey(
-            this.homeAccountId,
-            this.environment,
-            this.credentialType,
-            this.clientId,
-            this.realm,
-            this.target,
-            this.familyId,
-            this.tokenType,
-            this.requestedClaimsHash
-        );
-    }
-
-    /**
-     * returns the type of the cache (in this case credential)
-     */
-    generateType(): number {
-        switch (this.credentialType) {
-            case CredentialType.ID_TOKEN:
-                return CacheType.ID_TOKEN;
-            case CredentialType.ACCESS_TOKEN:
-            case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                return CacheType.ACCESS_TOKEN;
-            case CredentialType.REFRESH_TOKEN:
-                return CacheType.REFRESH_TOKEN;
-            default: {
-                throw createClientAuthError(
-                    ClientAuthErrorCodes.unexpectedCredentialType
-                );
-            }
-        }
-    }
-
-    /**
-     * generates credential key
-     * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
-     */
-    static generateCredentialCacheKey(
-        homeAccountId: string,
-        environment: string,
-        credentialType: CredentialType,
-        clientId: string,
-        realm?: string,
-        target?: string,
-        familyId?: string,
-        tokenType?: AuthenticationScheme,
-        requestedClaimsHash?: string
-    ): string {
-        const credentialKey = [
-            this.generateAccountIdForCacheKey(homeAccountId, environment),
-            this.generateCredentialIdForCacheKey(
-                credentialType,
-                clientId,
-                realm,
-                familyId
-            ),
-            this.generateTargetForCacheKey(target),
-            this.generateClaimsHashForCacheKey(requestedClaimsHash),
-            this.generateSchemeForCacheKey(tokenType),
-        ];
-
-        return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    }
-
-    /**
-     * generates Account Id for keys
-     * @param homeAccountId
-     * @param environment
-     */
-    private static generateAccountIdForCacheKey(
-        homeAccountId: string,
-        environment: string
-    ): string {
-        const accountId: Array<string> = [homeAccountId, environment];
-        return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    }
-
-    /**
-     * Generates Credential Id for keys
-     * @param credentialType
-     * @param realm
-     * @param clientId
-     * @param familyId
-     */
-    private static generateCredentialIdForCacheKey(
-        credentialType: CredentialType,
-        clientId: string,
-        realm?: string,
-        familyId?: string
-    ): string {
-        const clientOrFamilyId =
-            credentialType === CredentialType.REFRESH_TOKEN
-                ? familyId || clientId
-                : clientId;
-        const credentialId: Array<string> = [
-            credentialType,
-            clientOrFamilyId,
-            realm || Constants.EMPTY_STRING,
-        ];
-
-        return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    }
-
-    /**
-     * Generate target key component as per schema: <target>
-     */
-    private static generateTargetForCacheKey(scopes?: string): string {
-        return (scopes || Constants.EMPTY_STRING).toLowerCase();
-    }
-
-    /**
-     * Generate requested claims key component as per schema: <requestedClaims>
-     */
-    private static generateClaimsHashForCacheKey(
-        requestedClaimsHash?: string
-    ): string {
-        return (requestedClaimsHash || Constants.EMPTY_STRING).toLowerCase();
-    }
-
-    /**
-     * Generate scheme key componenet as per schema: <scheme>
-     */
-    private static generateSchemeForCacheKey(tokenType?: string): string {
-        /*
-         * PoP Tokens and SSH certs include scheme in cache key
-         * Cast to lowercase to handle "bearer" from ADFS
-         */
-        return tokenType &&
-            tokenType.toLowerCase() !==
-                AuthenticationScheme.BEARER.toLowerCase()
-            ? tokenType.toLowerCase()
-            : Constants.EMPTY_STRING;
-    }
-}
+};