@azure/msal-common 14.2.0 → 14.4.0

package/src/cache/entities/IdTokenEntity.ts

@@ -4,71 +4,11 @@
  */
 
 import { CredentialEntity } from "./CredentialEntity";
-import { CredentialType } from "../../utils/Constants";
 
 /**
- * ID_TOKEN Cache
- *
- * Key:Value Schema:
- *
- * Key Example: uid.utid-login.microsoftonline.com-idtoken-clientId-contoso.com-
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      realm: Full tenant or organizational identifier that the account belongs to
- * }
+ * Id Token Cache Type
  */
-export class IdTokenEntity extends CredentialEntity {
+export type IdTokenEntity = CredentialEntity & {
+    /**  Full tenant or organizational identifier that the account belongs to */
     realm: string;
-
-    /**
-     * Create IdTokenEntity
-     * @param homeAccountId
-     * @param authenticationResult
-     * @param clientId
-     * @param authority
-     */
-    static createIdTokenEntity(
-        homeAccountId: string,
-        environment: string,
-        idToken: string,
-        clientId: string,
-        tenantId: string
-    ): IdTokenEntity {
-        const idTokenEntity = new IdTokenEntity();
-
-        idTokenEntity.credentialType = CredentialType.ID_TOKEN;
-        idTokenEntity.homeAccountId = homeAccountId;
-        idTokenEntity.environment = environment;
-        idTokenEntity.clientId = clientId;
-        idTokenEntity.secret = idToken;
-        idTokenEntity.realm = tenantId;
-
-        return idTokenEntity;
-    }
-
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isIdTokenEntity(entity: object): boolean {
-        if (!entity) {
-            return false;
-        }
-
-        return (
-            entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("credentialType") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("secret") &&
-            entity["credentialType"] === CredentialType.ID_TOKEN
-        );
-    }
-}
+};

package/src/cache/entities/RefreshTokenEntity.ts

@@ -4,75 +4,8 @@
  */
 
 import { CredentialEntity } from "./CredentialEntity";
-import { CredentialType } from "../../utils/Constants";
 
 /**
- * REFRESH_TOKEN Cache
- *
- * Key:Value Schema:
- *
- * Key Example: uid.utid-login.microsoftonline.com-refreshtoken-clientId--
- *
- * Value:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      credentialType: Type of credential as a string, can be one of the following: RefreshToken, AccessToken, IdToken, Password, Cookie, Certificate, Other
- *      clientId: client ID of the application
- *      secret: Actual credential as a string
- *      familyId: Family ID identifier, '1' represents Microsoft Family
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- * }
+ * Refresh Token Cache Type
  */
-export class RefreshTokenEntity extends CredentialEntity {
-    familyId?: string;
-
-    /**
-     * Create RefreshTokenEntity
-     * @param homeAccountId
-     * @param authenticationResult
-     * @param clientId
-     * @param authority
-     */
-    static createRefreshTokenEntity(
-        homeAccountId: string,
-        environment: string,
-        refreshToken: string,
-        clientId: string,
-        familyId?: string,
-        userAssertionHash?: string
-    ): RefreshTokenEntity {
-        const rtEntity = new RefreshTokenEntity();
-
-        rtEntity.clientId = clientId;
-        rtEntity.credentialType = CredentialType.REFRESH_TOKEN;
-        rtEntity.environment = environment;
-        rtEntity.homeAccountId = homeAccountId;
-        rtEntity.secret = refreshToken;
-        rtEntity.userAssertionHash = userAssertionHash;
-
-        if (familyId) rtEntity.familyId = familyId;
-
-        return rtEntity;
-    }
-
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isRefreshTokenEntity(entity: object): boolean {
-        if (!entity) {
-            return false;
-        }
-
-        return (
-            entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("credentialType") &&
-            entity.hasOwnProperty("clientId") &&
-            entity.hasOwnProperty("secret") &&
-            entity["credentialType"] === CredentialType.REFRESH_TOKEN
-        );
-    }
-}
+export type RefreshTokenEntity = CredentialEntity;

package/src/cache/entities/ServerTelemetryEntity.ts

@@ -3,36 +3,8 @@
  * Licensed under the MIT License.
  */
 
-import { SERVER_TELEM_CONSTANTS } from "../../utils/Constants";
-
-export class ServerTelemetryEntity {
+export type ServerTelemetryEntity = {
     failedRequests: Array<string | number>;
     errors: string[];
     cacheHits: number;
-
-    constructor() {
-        this.failedRequests = [];
-        this.errors = [];
-        this.cacheHits = 0;
-    }
-
-    /**
-     * validates if a given cache entry is "Telemetry", parses <key,value>
-     * @param key
-     * @param entity
-     */
-    static isServerTelemetryEntity(key: string, entity?: object): boolean {
-        const validateKey: boolean =
-            key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
-        let validateEntity: boolean = true;
-
-        if (entity) {
-            validateEntity =
-                entity.hasOwnProperty("failedRequests") &&
-                entity.hasOwnProperty("errors") &&
-                entity.hasOwnProperty("cacheHits");
-        }
-
-        return validateKey && validateEntity;
-    }
-}
+};

package/src/cache/utils/CacheHelpers.ts

@@ -0,0 +1,327 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { extractTokenClaims } from "../../account/AuthToken";
+import { TokenClaims } from "../../account/TokenClaims";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../../error/ClientAuthError";
+import {
+    AuthenticationScheme,
+    CredentialType,
+    SERVER_TELEM_CONSTANTS,
+    Separators,
+} from "../../utils/Constants";
+import { TimeUtils } from "../../utils/TimeUtils";
+import { AccessTokenEntity } from "../entities/AccessTokenEntity";
+import { CredentialEntity } from "../entities/CredentialEntity";
+import { IdTokenEntity } from "../entities/IdTokenEntity";
+import { RefreshTokenEntity } from "../entities/RefreshTokenEntity";
+
+/**
+ * Cache Key: <home_account_id>-<environment>-<credential_type>-<client_id or familyId>-<realm>-<scopes>-<claims hash>-<scheme>
+ * IdToken Example: uid.utid-login.microsoftonline.com-idtoken-app_client_id-contoso.com
+ * AccessToken Example: uid.utid-login.microsoftonline.com-accesstoken-app_client_id-contoso.com-scope1 scope2--pop
+ * RefreshToken Example: uid.utid-login.microsoftonline.com-refreshtoken-1-contoso.com
+ * @param credentialEntity
+ * @returns
+ */
+export function generateCredentialKey(
+    credentialEntity: CredentialEntity
+): string {
+    const credentialKey = [
+        generateAccountId(credentialEntity),
+        generateCredentialId(credentialEntity),
+        generateTarget(credentialEntity),
+        generateClaimsHash(credentialEntity),
+        generateScheme(credentialEntity),
+    ];
+
+    return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+}
+
+/**
+ * Create IdTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
+ */
+export function createIdTokenEntity(
+    homeAccountId: string,
+    environment: string,
+    idToken: string,
+    clientId: string,
+    tenantId: string
+): IdTokenEntity {
+    const idTokenEntity: IdTokenEntity = {
+        credentialType: CredentialType.ID_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: idToken,
+        realm: tenantId,
+    };
+
+    return idTokenEntity;
+}
+
+/**
+ * Create AccessTokenEntity
+ * @param homeAccountId
+ * @param environment
+ * @param accessToken
+ * @param clientId
+ * @param tenantId
+ * @param scopes
+ * @param expiresOn
+ * @param extExpiresOn
+ */
+export function createAccessTokenEntity(
+    homeAccountId: string,
+    environment: string,
+    accessToken: string,
+    clientId: string,
+    tenantId: string,
+    scopes: string,
+    expiresOn: number,
+    extExpiresOn: number,
+    base64Decode: (input: string) => string,
+    refreshOn?: number,
+    tokenType?: AuthenticationScheme,
+    userAssertionHash?: string,
+    keyId?: string,
+    requestedClaims?: string,
+    requestedClaimsHash?: string
+): AccessTokenEntity {
+    const atEntity: AccessTokenEntity = {
+        homeAccountId: homeAccountId,
+        credentialType: CredentialType.ACCESS_TOKEN,
+        secret: accessToken,
+        cachedAt: TimeUtils.nowSeconds().toString(),
+        expiresOn: expiresOn.toString(),
+        extendedExpiresOn: extExpiresOn.toString(),
+        environment: environment,
+        clientId: clientId,
+        realm: tenantId,
+        target: scopes,
+        tokenType: tokenType || AuthenticationScheme.BEARER,
+    };
+
+    if (userAssertionHash) {
+        atEntity.userAssertionHash = userAssertionHash;
+    }
+
+    if (refreshOn) {
+        atEntity.refreshOn = refreshOn.toString();
+    }
+
+    if (requestedClaims) {
+        atEntity.requestedClaims = requestedClaims;
+        atEntity.requestedClaimsHash = requestedClaimsHash;
+    }
+
+    /*
+     * Create Access Token With Auth Scheme instead of regular access token
+     * Cast to lower to handle "bearer" from ADFS
+     */
+    if (
+        atEntity.tokenType?.toLowerCase() !==
+        AuthenticationScheme.BEARER.toLowerCase()
+    ) {
+        atEntity.credentialType = CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+        switch (atEntity.tokenType) {
+            case AuthenticationScheme.POP:
+                // Make sure keyId is present and add it to credential
+                const tokenClaims: TokenClaims | null = extractTokenClaims(
+                    accessToken,
+                    base64Decode
+                );
+                if (!tokenClaims?.cnf?.kid) {
+                    throw createClientAuthError(
+                        ClientAuthErrorCodes.tokenClaimsCnfRequiredForSignedJwt
+                    );
+                }
+                atEntity.keyId = tokenClaims.cnf.kid;
+                break;
+            case AuthenticationScheme.SSH:
+                atEntity.keyId = keyId;
+        }
+    }
+
+    return atEntity;
+}
+
+/**
+ * Create RefreshTokenEntity
+ * @param homeAccountId
+ * @param authenticationResult
+ * @param clientId
+ * @param authority
+ */
+export function createRefreshTokenEntity(
+    homeAccountId: string,
+    environment: string,
+    refreshToken: string,
+    clientId: string,
+    familyId?: string,
+    userAssertionHash?: string
+): RefreshTokenEntity {
+    const rtEntity: RefreshTokenEntity = {
+        credentialType: CredentialType.REFRESH_TOKEN,
+        homeAccountId: homeAccountId,
+        environment: environment,
+        clientId: clientId,
+        secret: refreshToken,
+    };
+
+    if (userAssertionHash) {
+        rtEntity.userAssertionHash = userAssertionHash;
+    }
+
+    if (familyId) {
+        rtEntity.familyId = familyId;
+    }
+
+    return rtEntity;
+}
+
+export function isCredentialEntity(entity: object): boolean {
+    return (
+        entity.hasOwnProperty("homeAccountId") &&
+        entity.hasOwnProperty("environment") &&
+        entity.hasOwnProperty("credentialType") &&
+        entity.hasOwnProperty("clientId") &&
+        entity.hasOwnProperty("secret")
+    );
+}
+
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isAccessTokenEntity(entity: object): boolean {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity.hasOwnProperty("target") &&
+        (entity["credentialType"] === CredentialType.ACCESS_TOKEN ||
+            entity["credentialType"] ===
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME)
+    );
+}
+
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isIdTokenEntity(entity: object): boolean {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        isCredentialEntity(entity) &&
+        entity.hasOwnProperty("realm") &&
+        entity["credentialType"] === CredentialType.ID_TOKEN
+    );
+}
+
+/**
+ * Validates an entity: checks for all expected params
+ * @param entity
+ */
+export function isRefreshTokenEntity(entity: object): boolean {
+    if (!entity) {
+        return false;
+    }
+
+    return (
+        isCredentialEntity(entity) &&
+        entity["credentialType"] === CredentialType.REFRESH_TOKEN
+    );
+}
+
+/**
+ * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+ */
+function generateAccountId(credentialEntity: CredentialEntity): string {
+    const accountId: Array<string> = [
+        credentialEntity.homeAccountId,
+        credentialEntity.environment,
+    ];
+    return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+}
+
+/**
+ * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
+ */
+function generateCredentialId(credentialEntity: CredentialEntity): string {
+    const clientOrFamilyId =
+        credentialEntity.credentialType === CredentialType.REFRESH_TOKEN
+            ? credentialEntity.familyId || credentialEntity.clientId
+            : credentialEntity.clientId;
+    const credentialId: Array<string> = [
+        credentialEntity.credentialType,
+        clientOrFamilyId,
+        credentialEntity.realm || "",
+    ];
+
+    return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
+}
+
+/**
+ * Generate target key component as per schema: <target>
+ */
+function generateTarget(credentialEntity: CredentialEntity): string {
+    return (credentialEntity.target || "").toLowerCase();
+}
+
+/**
+ * Generate requested claims key component as per schema: <requestedClaims>
+ */
+function generateClaimsHash(credentialEntity: CredentialEntity): string {
+    return (credentialEntity.requestedClaimsHash || "").toLowerCase();
+}
+
+/**
+ * Generate scheme key componenet as per schema: <scheme>
+ */
+function generateScheme(credentialEntity: CredentialEntity): string {
+    /*
+     * PoP Tokens and SSH certs include scheme in cache key
+     * Cast to lowercase to handle "bearer" from ADFS
+     */
+    return credentialEntity.tokenType &&
+        credentialEntity.tokenType.toLowerCase() !==
+            AuthenticationScheme.BEARER.toLowerCase()
+        ? credentialEntity.tokenType.toLowerCase()
+        : "";
+}
+
+/**
+ * validates if a given cache entry is "Telemetry", parses <key,value>
+ * @param key
+ * @param entity
+ */
+export function isServerTelemetryEntity(key: string, entity?: object): boolean {
+    const validateKey: boolean =
+        key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
+    let validateEntity: boolean = true;
+
+    if (entity) {
+        validateEntity =
+            entity.hasOwnProperty("failedRequests") &&
+            entity.hasOwnProperty("errors") &&
+            entity.hasOwnProperty("cacheHits");
+    }
+
+    return validateKey && validateEntity;
+}

package/src/client/AuthorizationCodeClient.ts

@@ -171,7 +171,7 @@ export class AuthorizationCodeClient extends BaseClient {
      * @param hashFragment
      */
     handleFragmentResponse(
-        hashFragment: string,
+        serverParams: ServerAuthorizationCodeResponse,
         cachedState: string
     ): AuthorizationCodePayload {
         // Handle responses.
@@ -184,18 +184,10 @@ export class AuthorizationCodeClient extends BaseClient {
             null
         );
 
-        const serverParams: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedCodeResponse(
-                this.config.authOptions.authority.options.OIDCOptions
-                    ?.serverResponseType,
-                hashFragment
-            );
-
         // Get code response
         responseHandler.validateServerAuthorizationCodeResponse(
             serverParams,
-            cachedState,
-            this.cryptoUtils
+            cachedState
         );
 
         // throw when there is no auth code in the response
@@ -204,11 +196,8 @@ export class AuthorizationCodeClient extends BaseClient {
                 ClientAuthErrorCodes.authorizationCodeMissingFromServerResponse
             );
         }
-        return {
-            ...serverParams,
-            // Code param is optional in ServerAuthorizationCodeResponse but required in AuthorizationCodePaylod
-            code: serverParams.code,
-        };
+
+        return serverParams as AuthorizationCodePayload;
     }
 
     /**

package/src/client/BaseClient.ts

@@ -19,15 +19,13 @@ import { CacheManager } from "../cache/CacheManager";
 import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager";
 import { RequestThumbprint } from "../network/RequestThumbprint";
 import { version, name } from "../packageMetadata";
-import {
-    createClientAuthError,
-    ClientAuthErrorCodes,
-} from "../error/ClientAuthError";
 import { CcsCredential, CcsCredentialType } from "../account/CcsCredential";
 import { buildClientInfoFromHomeAccountId } from "../account/ClientInfo";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 import { RequestParameterBuilder } from "../request/RequestParameterBuilder";
 import { BaseAuthRequest } from "../request/BaseAuthRequest";
+import { AuthorityFactory } from "../authority/AuthorityFactory";
+import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 
 /**
  * Base application class which will construct requests to send to and handle responses from the Microsoft STS using the authorization code flow.
@@ -184,13 +182,26 @@ export abstract class BaseClient {
      * Updates the authority object of the client. Endpoint discovery must be completed.
      * @param updatedAuthority
      */
-    updateAuthority(updatedAuthority: Authority): void {
-        if (!updatedAuthority.discoveryComplete()) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.endpointResolutionError
+    async updateAuthority(
+        cloudInstanceHostname: string,
+        correlationId: string
+    ): Promise<void> {
+        this.performanceClient?.addQueueMeasurement(
+            PerformanceEvents.UpdateTokenEndpointAuthority,
+            correlationId
+        );
+        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${this.authority.tenant}/`;
+        const cloudInstanceAuthority =
+            await AuthorityFactory.createDiscoveredInstance(
+                cloudInstanceAuthorityUri,
+                this.networkClient,
+                this.cacheManager,
+                this.authority.options,
+                this.logger,
+                this.performanceClient,
+                correlationId
             );
-        }
-        this.authority = updatedAuthority;
+        this.authority = cloudInstanceAuthority;
     }
 
     /**

package/src/client/RefreshTokenClient.ts

@@ -202,7 +202,13 @@ export class RefreshTokenClient extends BaseClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(request.account, foci);
+        )(
+            request.account,
+            foci,
+            undefined,
+            this.performanceClient,
+            request.correlationId
+        );
 
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(

package/src/client/SilentFlowClient.ts

@@ -124,7 +124,9 @@ export class SilentFlowClient extends BaseClient {
         const cacheRecord = this.cacheManager.readCacheRecord(
             request.account,
             request,
-            environment
+            environment,
+            this.performanceClient,
+            request.correlationId
         );
 
         if (!cacheRecord.accessToken) {
@@ -190,9 +192,11 @@ export class SilentFlowClient extends BaseClient {
             },
             correlationId
         );
-        this.logger.info(
-            `Token refresh is required due to cache outcome: ${cacheOutcome}`
-        );
+        if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
+            this.logger.info(
+                `Token refresh is required due to cache outcome: ${cacheOutcome}`
+            );
+        }
     }
 
     /**

package/src/crypto/ICrypto.ts

@@ -8,7 +8,7 @@ import {
     createClientAuthError,
 } from "../error/ClientAuthError";
 import { BaseAuthRequest } from "../request/BaseAuthRequest";
-import { SignedHttpRequest } from "./SignedHttpRequest";
+import { ShrOptions, SignedHttpRequest } from "./SignedHttpRequest";
 
 /**
  * The PkceCodes type describes the structure
@@ -22,7 +22,11 @@ export type PkceCodes = {
 
 export type SignedHttpRequestParameters = Pick<
     BaseAuthRequest,
-    "resourceRequestMethod" | "resourceRequestUri" | "shrClaims" | "shrNonce"
+    | "resourceRequestMethod"
+    | "resourceRequestUri"
+    | "shrClaims"
+    | "shrNonce"
+    | "shrOptions"
 > & {
     correlationId?: string;
 };
@@ -68,6 +72,7 @@ export interface ICrypto {
     signJwt(
         payload: SignedHttpRequest,
         kid: string,
+        shrOptions?: ShrOptions,
         correlationId?: string
     ): Promise<string>;
     /**