@azure/msal-common 14.2.0 → 14.4.0

package/src/crypto/JoseHeader.ts

@@ -7,17 +7,17 @@ import {
     JoseHeaderErrorCodes,
     createJoseHeaderError,
 } from "../error/JoseHeaderError";
-import { JsonTypes } from "../utils/Constants";
+import { JsonWebTokenTypes } from "../utils/Constants";
 
 export type JoseHeaderOptions = {
-    typ?: JsonTypes;
+    typ?: JsonWebTokenTypes;
     alg?: string;
     kid?: string;
 };
 
 /** @internal */
 export class JoseHeader {
-    public typ?: JsonTypes;
+    public typ?: JsonWebTokenTypes;
     public alg?: string;
     public kid?: string;
 
@@ -48,7 +48,7 @@ export class JoseHeader {
 
         const shrHeader = new JoseHeader({
             // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
-            typ: shrHeaderOptions.typ || JsonTypes.Pop,
+            typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
             kid: shrHeaderOptions.kid,
             alg: shrHeaderOptions.alg,
         });

package/src/crypto/PopTokenGenerator.ts

@@ -133,6 +133,7 @@ export class PopTokenGenerator {
             resourceRequestUri,
             shrClaims,
             shrNonce,
+            shrOptions,
         } = request;
 
         const resourceUrlString = resourceRequestUri
@@ -154,6 +155,7 @@ export class PopTokenGenerator {
                 ...claims,
             },
             keyId,
+            shrOptions,
             request.correlationId
         );
     }

package/src/crypto/SignedHttpRequest.ts

@@ -3,6 +3,8 @@
  * Licensed under the MIT License.
  */
 
+import { JoseHeaderOptions } from "./JoseHeader";
+
 export type SignedHttpRequest = {
     at?: string;
     cnf?: object;
@@ -14,3 +16,7 @@ export type SignedHttpRequest = {
     nonce?: string;
     client_claims?: string;
 };
+
+export type ShrOptions = {
+    header: JoseHeaderOptions;
+};

package/src/index.ts

@@ -71,6 +71,7 @@ export {
 } from "./cache/utils/CacheTypes";
 export { CacheRecord } from "./cache/entities/CacheRecord";
 export { CredentialEntity } from "./cache/entities/CredentialEntity";
+export * as CacheHelpers from "./cache/utils/CacheHelpers";
 export { AppMetadataEntity } from "./cache/entities/AppMetadataEntity";
 export { AccountEntity } from "./cache/entities/AccountEntity";
 export { IdTokenEntity } from "./cache/entities/IdTokenEntity";
@@ -104,7 +105,7 @@ export {
     DEFAULT_CRYPTO_IMPLEMENTATION,
     SignedHttpRequestParameters,
 } from "./crypto/ICrypto";
-export { SignedHttpRequest } from "./crypto/SignedHttpRequest";
+export { SignedHttpRequest, ShrOptions } from "./crypto/SignedHttpRequest";
 export { IGuidGenerator } from "./crypto/IGuidGenerator";
 export { JoseHeader } from "./crypto/JoseHeader";
 // Request
@@ -192,6 +193,7 @@ export {
     GrantType,
     AADAuthorityConstants,
     HttpStatus,
+    JsonWebTokenTypes,
 } from "./utils/Constants";
 export { StringUtils } from "./utils/StringUtils";
 export { StringDict } from "./utils/MsalTypes";
@@ -201,6 +203,7 @@ export {
     LibraryStateObject,
 } from "./utils/ProtocolUtils";
 export { TimeUtils } from "./utils/TimeUtils";
+export * as UrlUtils from "./utils/UrlUtils";
 export * from "./utils/FunctionWrappers";
 // Server Telemetry
 export { ServerTelemetryManager } from "./telemetry/server/ServerTelemetryManager";

package/src/network/RequestThumbprint.ts

@@ -3,6 +3,7 @@
  * Licensed under the MIT License.
  */
 
+import { ShrOptions } from "../crypto/SignedHttpRequest";
 import { AuthenticationScheme } from "../utils/Constants";
 
 /**
@@ -19,4 +20,5 @@ export type RequestThumbprint = {
     resourceRequestUri?: string;
     shrClaims?: string;
     sshKid?: string;
+    shrOptions?: ShrOptions;
 };

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.2.0";
+export const version = "14.4.0";

package/src/request/BaseAuthRequest.ts

@@ -7,6 +7,7 @@ import { AuthenticationScheme } from "../utils/Constants";
 import { AzureCloudOptions } from "../config/ClientConfiguration";
 import { StringDict } from "../utils/MsalTypes";
 import { StoreInCache } from "./StoreInCache";
+import { ShrOptions } from "../crypto/SignedHttpRequest";
 
 /**
  * BaseAuthRequest
@@ -17,6 +18,7 @@ import { StoreInCache } from "./StoreInCache";
  * - claims                  - A stringified claims request which will be added to all /authorize and /token calls
  * - shrClaims               - A stringified claims object which will be added to a Signed HTTP Request
  * - shrNonce                - A server-generated timestamp that has been encrypted and base64URL encoded, which will be added to a Signed HTTP Request.
+ * - shrOptions              - An object containing options for the Signed HTTP Request
  * - resourceRequestMethod   - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri      - URI that token will be used for. Used for proof-of-possession flows.
  * - sshJwk                  - A stringified JSON Web Key representing a public key that can be signed by an SSH certificate.
@@ -34,6 +36,7 @@ export type BaseAuthRequest = {
     claims?: string;
     shrClaims?: string;
     shrNonce?: string;
+    shrOptions?: ShrOptions;
     resourceRequestMethod?: string;
     resourceRequestUri?: string;
     sshJwk?: string;

package/src/response/ResponseHandler.ts

@@ -4,7 +4,6 @@
  */
 
 import { ServerAuthorizationTokenResponse } from "./ServerAuthorizationTokenResponse";
-import { buildClientInfo } from "../account/ClientInfo";
 import { ICrypto } from "../crypto/ICrypto";
 import {
     ClientAuthErrorCodes,
@@ -45,6 +44,7 @@ import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { checkMaxAge, extractTokenClaims } from "../account/AuthToken";
 import { TokenClaims } from "../account/TokenClaims";
 import { AccountInfo } from "../account/AccountInfo";
+import * as CacheHelpers from "../cache/utils/CacheHelpers";
 
 /**
  * Class that handles response parsing.
@@ -81,16 +81,15 @@ export class ResponseHandler {
     /**
      * Function which validates server authorization code response.
      * @param serverResponseHash
-     * @param cachedState
+     * @param requestState
      * @param cryptoObj
      */
     validateServerAuthorizationCodeResponse(
-        serverResponseHash: ServerAuthorizationCodeResponse,
-        cachedState: string,
-        cryptoObj: ICrypto
+        serverResponse: ServerAuthorizationCodeResponse,
+        requestState: string
     ): void {
-        if (!serverResponseHash.state || !cachedState) {
-            throw serverResponseHash.state
+        if (!serverResponse.state || !requestState) {
+            throw serverResponse.state
                 ? createClientAuthError(
                       ClientAuthErrorCodes.stateNotFound,
                       "Cached State"
@@ -101,67 +100,63 @@ export class ResponseHandler {
                   );
         }
 
-        let decodedServerResponseHash: string;
-        let decodedCachedState: string;
+        let decodedServerResponseState: string;
+        let decodedRequestState: string;
 
         try {
-            decodedServerResponseHash = decodeURIComponent(
-                serverResponseHash.state
+            decodedServerResponseState = decodeURIComponent(
+                serverResponse.state
             );
         } catch (e) {
             throw createClientAuthError(
                 ClientAuthErrorCodes.invalidState,
-                serverResponseHash.state
+                serverResponse.state
             );
         }
 
         try {
-            decodedCachedState = decodeURIComponent(cachedState);
+            decodedRequestState = decodeURIComponent(requestState);
         } catch (e) {
             throw createClientAuthError(
                 ClientAuthErrorCodes.invalidState,
-                serverResponseHash.state
+                serverResponse.state
             );
         }
 
-        if (decodedServerResponseHash !== decodedCachedState) {
+        if (decodedServerResponseState !== decodedRequestState) {
             throw createClientAuthError(ClientAuthErrorCodes.stateMismatch);
         }
 
         // Check for error
         if (
-            serverResponseHash.error ||
-            serverResponseHash.error_description ||
-            serverResponseHash.suberror
+            serverResponse.error ||
+            serverResponse.error_description ||
+            serverResponse.suberror
         ) {
             if (
                 isInteractionRequiredError(
-                    serverResponseHash.error,
-                    serverResponseHash.error_description,
-                    serverResponseHash.suberror
+                    serverResponse.error,
+                    serverResponse.error_description,
+                    serverResponse.suberror
                 )
             ) {
                 throw new InteractionRequiredAuthError(
-                    serverResponseHash.error || Constants.EMPTY_STRING,
-                    serverResponseHash.error_description,
-                    serverResponseHash.suberror,
-                    serverResponseHash.timestamp || Constants.EMPTY_STRING,
-                    serverResponseHash.trace_id || Constants.EMPTY_STRING,
-                    serverResponseHash.correlation_id || Constants.EMPTY_STRING,
-                    serverResponseHash.claims || Constants.EMPTY_STRING
+                    serverResponse.error || "",
+                    serverResponse.error_description,
+                    serverResponse.suberror,
+                    serverResponse.timestamp || "",
+                    serverResponse.trace_id || "",
+                    serverResponse.correlation_id || "",
+                    serverResponse.claims || ""
                 );
             }
 
             throw new ServerError(
-                serverResponseHash.error || Constants.EMPTY_STRING,
-                serverResponseHash.error_description,
-                serverResponseHash.suberror
+                serverResponse.error || "",
+                serverResponse.error_description,
+                serverResponse.suberror
             );
         }
-
-        if (serverResponseHash.client_info) {
-            buildClientInfo(serverResponseHash.client_info, cryptoObj);
-        }
     }
 
     /**
@@ -415,7 +410,7 @@ export class ResponseHandler {
         let cachedIdToken: IdTokenEntity | undefined;
         let cachedAccount: AccountEntity | undefined;
         if (serverTokenResponse.id_token && !!idTokenClaims) {
-            cachedIdToken = IdTokenEntity.createIdTokenEntity(
+            cachedIdToken = CacheHelpers.createIdTokenEntity(
                 this.homeAccountIdentifier,
                 env,
                 serverTokenResponse.id_token,
@@ -468,16 +463,16 @@ export class ResponseHandler {
                     : undefined;
 
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(
+            cachedAccessToken = CacheHelpers.createAccessTokenEntity(
                 this.homeAccountIdentifier,
                 env,
-                serverTokenResponse.access_token || Constants.EMPTY_STRING,
+                serverTokenResponse.access_token,
                 this.clientId,
                 idTokenClaims?.tid || authority.tenant,
                 responseScopes.printScopes(),
                 tokenExpirationSeconds,
                 extendedTokenExpirationSeconds,
-                this.cryptoObj,
+                this.cryptoObj.base64Decode,
                 refreshOnSeconds,
                 serverTokenResponse.token_type,
                 userAssertionHash,
@@ -490,10 +485,10 @@ export class ResponseHandler {
         // refreshToken
         let cachedRefreshToken: RefreshTokenEntity | null = null;
         if (serverTokenResponse.refresh_token) {
-            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(
+            cachedRefreshToken = CacheHelpers.createRefreshTokenEntity(
                 this.homeAccountIdentifier,
                 env,
-                serverTokenResponse.refresh_token || Constants.EMPTY_STRING,
+                serverTokenResponse.refresh_token,
                 this.clientId,
                 serverTokenResponse.foci,
                 userAssertionHash

package/src/telemetry/performance/PerformanceEvent.ts

@@ -208,7 +208,7 @@ export const PerformanceEvents = {
      * Functions from InteractionHandler (msal-browser)
      */
     HandleCodeResponseFromServer: "handleCodeResponseFromServer",
-    HandleCodeResponseFromHash: "handleCodeResponseFromHash",
+    HandleCodeResponse: "handleCodeResponse",
     UpdateTokenEndpointAuthority: "updateTokenEndpointAuthority",
 
     /**
@@ -229,6 +229,7 @@ export const PerformanceEvents = {
      * handleServerTokenResponse API in ResponseHandler (msal-common)
      */
     HandleServerTokenResponse: "handleServerTokenResponse",
+    DeserializeResponse: "deserializeResponse",
 
     /**
      * Authority functions
@@ -558,6 +559,13 @@ export type PerformanceEvent = {
      * Nested App Auth Fields
      */
     nestedAppAuthRequest?: boolean;
+
+    /**
+     * Multiple matched access/id/refresh tokens in the cache
+     */
+    multiMatchedAT?: number;
+    multiMatchedID?: number;
+    multiMatchedRT?: number;
 };
 
 export const IntFields: ReadonlySet<string> = new Set([
@@ -570,4 +578,7 @@ export const IntFields: ReadonlySet<string> = new Set([
     "queuedTimeMs",
     "startTimeMs",
     "status",
+    "multiMatchedAT",
+    "multiMatchedID",
+    "multiMatchedRT",
 ]);

package/src/telemetry/server/ServerTelemetryManager.ts

@@ -160,7 +160,11 @@ export class ServerTelemetryManager {
      * Get the server telemetry entity from cache or initialize a new one
      */
     getLastRequests(): ServerTelemetryEntity {
-        const initialValue: ServerTelemetryEntity = new ServerTelemetryEntity();
+        const initialValue: ServerTelemetryEntity = {
+            failedRequests: [],
+            errors: [],
+            cacheHits: 0,
+        };
         const lastRequests = this.cacheManager.getServerTelemetry(
             this.telemetryCacheKey
         ) as ServerTelemetryEntity;
@@ -181,11 +185,13 @@ export class ServerTelemetryManager {
             this.cacheManager.removeItem(this.telemetryCacheKey);
         } else {
             // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
-            const serverTelemEntity = new ServerTelemetryEntity();
-            serverTelemEntity.failedRequests =
-                lastRequests.failedRequests.slice(numErrorsFlushed * 2); // failedRequests contains 2 items for each error
-            serverTelemEntity.errors =
-                lastRequests.errors.slice(numErrorsFlushed);
+            const serverTelemEntity: ServerTelemetryEntity = {
+                failedRequests: lastRequests.failedRequests.slice(
+                    numErrorsFlushed * 2
+                ), // failedRequests contains 2 items for each error
+                errors: lastRequests.errors.slice(numErrorsFlushed),
+                cacheHits: 0,
+            };
 
             this.cacheManager.setServerTelemetry(
                 this.telemetryCacheKey,

package/src/url/UrlString.ts

@@ -3,22 +3,14 @@
  * Licensed under the MIT License.
  */
 
-import { ServerAuthorizationCodeResponse } from "../response/ServerAuthorizationCodeResponse";
 import {
     createClientConfigurationError,
     ClientConfigurationErrorCodes,
 } from "../error/ClientConfigurationError";
-import {
-    ClientAuthErrorCodes,
-    createClientAuthError,
-} from "../error/ClientAuthError";
 import { StringUtils } from "../utils/StringUtils";
 import { IUri } from "./IUri";
-import {
-    AADAuthorityConstants,
-    Constants,
-    ServerResponseType,
-} from "../utils/Constants";
+import { AADAuthorityConstants, Constants } from "../utils/Constants";
+import * as UrlUtils from "../utils/UrlUtils";
 
 /**
  * Url object class which can perform various transformations on url strings.
@@ -39,7 +31,7 @@ export class UrlString {
             );
         }
 
-        if (!this.getHash()) {
+        if (!url.includes("#")) {
             this._urlString = UrlString.canonicalizeUri(url);
         }
     }
@@ -142,13 +134,6 @@ export class UrlString {
         return UrlString.constructAuthorityUriFromObject(urlObject);
     }
 
-    /**
-     * Returns the anchor part(#) of the URL
-     */
-    getHash(): string {
-        return UrlString.parseHash(this.urlString);
-    }
-
     /**
      * Parses out the components from a url string.
      * @returns An object with the various components. Please cache this value insted of calling this multiple times on the same url.
@@ -221,58 +206,6 @@ export class UrlString {
         return relativeUrl;
     }
 
-    /**
-     * Parses hash string from given string. Returns empty string if no hash symbol is found.
-     * @param hashString
-     */
-    static parseHash(hashString: string): string {
-        const hashIndex1 = hashString.indexOf("#");
-        const hashIndex2 = hashString.indexOf("#/");
-        if (hashIndex2 > -1) {
-            return hashString.substring(hashIndex2 + 2);
-        } else if (hashIndex1 > -1) {
-            return hashString.substring(hashIndex1 + 1);
-        }
-        return Constants.EMPTY_STRING;
-    }
-
-    /**
-     * Parses query string from given string. Returns empty string if no query symbol is found.
-     * @param queryString
-     */
-    static parseQueryString(queryString: string): string {
-        const queryIndex1 = queryString.indexOf("?");
-        const queryIndex2 = queryString.indexOf("/?");
-        if (queryIndex2 > -1) {
-            return queryString.substring(queryIndex2 + 2);
-        } else if (queryIndex1 > -1) {
-            return queryString.substring(queryIndex1 + 1);
-        }
-        return Constants.EMPTY_STRING;
-    }
-
-    /**
-     * Parses query server response string from given string.
-     * Extract hash between '?code=' and '#' if trailing '# is present.
-     * Returns empty string if no query symbol is found.
-     * @param queryString
-     */
-    static parseQueryServerResponse(queryString: string): string {
-        const queryIndex1 = queryString.indexOf("?code");
-        const queryIndex2 = queryString.indexOf("/?code");
-        const hashIndex = queryString.indexOf("#");
-        if (queryIndex2 > -1 && hashIndex > -1) {
-            return queryString.substring(queryIndex2 + 2, hashIndex);
-        } else if (queryIndex2 > -1) {
-            return queryString.substring(queryIndex2 + 2);
-        } else if (queryIndex1 > -1 && hashIndex > -1) {
-            return queryString.substring(queryIndex1 + 1, hashIndex);
-        } else if (queryIndex1 > -1) {
-            return queryString.substring(queryIndex1 + 1);
-        }
-        return Constants.EMPTY_STRING;
-    }
-
     static constructAuthorityUriFromObject(urlObject: IUri): UrlString {
         return new UrlString(
             urlObject.Protocol +
@@ -283,91 +216,11 @@ export class UrlString {
         );
     }
 
-    /**
-     * Returns URL hash as server auth code response object.
-     */
-    static getDeserializedHash(hash: string): ServerAuthorizationCodeResponse {
-        // Check if given hash is empty
-        if (!hash) {
-            return {};
-        }
-        // Strip the # symbol if present
-        const parsedHash = UrlString.parseHash(hash);
-        // If # symbol was not present, above will return empty string, so give original hash value
-        const deserializedHash: ServerAuthorizationCodeResponse =
-            StringUtils.queryStringToObject<ServerAuthorizationCodeResponse>(
-                parsedHash || hash
-            );
-        // Check if deserialization didn't work
-        if (!deserializedHash) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.hashNotDeserialized
-            );
-        }
-        return deserializedHash;
-    }
-
-    /**
-     * Returns URL query string as server auth code response object.
-     */
-    static getDeserializedQueryString(
-        query: string
-    ): ServerAuthorizationCodeResponse {
-        // Check if given query is empty
-        if (!query) {
-            return {};
-        }
-        // Strip the ? symbol if present
-        const parsedQueryString = UrlString.parseQueryString(query);
-        // If ? symbol was not present, above will return empty string, so give original query value
-        const deserializedQueryString: ServerAuthorizationCodeResponse =
-            StringUtils.queryStringToObject<ServerAuthorizationCodeResponse>(
-                parsedQueryString || query
-            );
-        // Check if deserialization didn't work
-        if (!deserializedQueryString) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.hashNotDeserialized
-            );
-        }
-        return deserializedQueryString;
-    }
-    /**
-     * Returns either deserialized query string or deserialized hash, depending on the serverResponseType
-     * as a server auth code response object.
-     */
-    static getDeserializedCodeResponse(
-        serverResponseType: ServerResponseType | undefined,
-        hashFragment: string
-    ): ServerAuthorizationCodeResponse {
-        const hashUrlString = new UrlString(hashFragment);
-        let serverParams: ServerAuthorizationCodeResponse;
-        if (serverResponseType === ServerResponseType.QUERY) {
-            serverParams = UrlString.getDeserializedQueryString(hashFragment);
-        } else {
-            serverParams = UrlString.getDeserializedHash(
-                hashUrlString.getHash()
-            );
-        }
-        return serverParams;
-    }
-
     /**
      * Check if the hash of the URL string contains known properties
+     * @deprecated This API will be removed in a future version
      */
-    static hashContainsKnownProperties(hash: string): boolean {
-        if (!hash || hash.indexOf("=") < 0) {
-            // Hash doesn't contain key/value pairs
-            return false;
-        }
-
-        const parameters: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedHash(hash);
-        return !!(
-            parameters.code ||
-            parameters.error_description ||
-            parameters.error ||
-            parameters.state
-        );
+    static hashContainsKnownProperties(response: string): boolean {
+        return !!UrlUtils.getDeserializedResponse(response);
     }
 }

package/src/utils/Constants.ts

@@ -51,7 +51,6 @@ export const Constants = {
     IMDS_TIMEOUT: 2000,
     AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
-    REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
     KNOWN_PUBLIC_CLOUDS: [
         "login.microsoftonline.com",
         "login.windows.net",
@@ -434,11 +433,12 @@ export const CacheOutcome = {
 } as const;
 export type CacheOutcome = (typeof CacheOutcome)[keyof typeof CacheOutcome];
 
-export const JsonTypes = {
+export const JsonWebTokenTypes = {
     Jwt: "JWT",
     Jwk: "JWK",
     Pop: "pop",
 } as const;
-export type JsonTypes = (typeof JsonTypes)[keyof typeof JsonTypes];
+export type JsonWebTokenTypes =
+    (typeof JsonWebTokenTypes)[keyof typeof JsonWebTokenTypes];
 
 export const ONE_DAY_IN_MS = 86400000;

package/src/utils/UrlUtils.ts

@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { ServerAuthorizationCodeResponse } from "../response/ServerAuthorizationCodeResponse";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../error/ClientAuthError";
+
+/**
+ * Parses hash string from given string. Returns empty string if no hash symbol is found.
+ * @param hashString
+ */
+export function stripLeadingHashOrQuery(responseString: string): string {
+    if (responseString.startsWith("#/")) {
+        return responseString.substring(2);
+    } else if (
+        responseString.startsWith("#") ||
+        responseString.startsWith("?")
+    ) {
+        return responseString.substring(1);
+    }
+
+    return responseString;
+}
+
+/**
+ * Returns URL hash as server auth code response object.
+ */
+export function getDeserializedResponse(
+    responseString: string
+): ServerAuthorizationCodeResponse | null {
+    // Check if given hash is empty
+    if (!responseString || responseString.indexOf("=") < 0) {
+        return null;
+    }
+    try {
+        // Strip the # or ? symbol if present
+        const normalizedResponse = stripLeadingHashOrQuery(responseString);
+        // If # symbol was not present, above will return empty string, so give original hash value
+        const deserializedHash: ServerAuthorizationCodeResponse =
+            Object.fromEntries(new URLSearchParams(normalizedResponse));
+
+        // Check for known response properties
+        if (
+            deserializedHash.code ||
+            deserializedHash.error ||
+            deserializedHash.error_description ||
+            deserializedHash.state
+        ) {
+            return deserializedHash;
+        }
+    } catch (e) {
+        throw createClientAuthError(ClientAuthErrorCodes.hashNotDeserialized);
+    }
+
+    return null;
+}