@azure/msal-common 14.3.0 → 14.4.0

package/src/cache/CacheManager.ts

@@ -46,6 +46,7 @@ import { StoreInCache } from "../request/StoreInCache";
 import { getAliasesFromStaticSources } from "../authority/AuthorityMetadata";
 import { StaticAuthorityOptions } from "../authority/AuthorityOptions";
 import { TokenClaims } from "../account/TokenClaims";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 
 /**
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
@@ -876,29 +877,40 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Retrieve the cached credentials into a cacherecord
-     * @param account
-     * @param clientId
-     * @param scopes
-     * @param environment
-     * @param authScheme
+     * @param account {AccountInfo}
+     * @param request {BaseAuthRequest}
+     * @param environment {string}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     readCacheRecord(
         account: AccountInfo,
         request: BaseAuthRequest,
-        environment: string
+        environment: string,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): CacheRecord {
         const tokenKeys = this.getTokenKeys();
         const cachedAccount = this.readAccountFromCache(account);
-        const cachedIdToken = this.getIdToken(account, tokenKeys);
+        const cachedIdToken = this.getIdToken(
+            account,
+            tokenKeys,
+            performanceClient,
+            correlationId
+        );
         const cachedAccessToken = this.getAccessToken(
             account,
             request,
-            tokenKeys
+            tokenKeys,
+            performanceClient,
+            correlationId
         );
         const cachedRefreshToken = this.getRefreshToken(
             account,
             false,
-            tokenKeys
+            tokenKeys,
+            performanceClient,
+            correlationId
         );
         const cachedAppMetadata = this.readAppMetadataFromCache(environment);
 
@@ -930,13 +942,16 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Retrieve IdTokenEntity from cache
-     * @param clientId
-     * @param account
-     * @param inputRealm
+     * @param account {AccountInfo}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getIdToken(
         account: AccountInfo,
-        tokenKeys?: TokenKeys
+        tokenKeys?: TokenKeys,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): IdTokenEntity | null {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter: CredentialFilter = {
@@ -963,6 +978,12 @@ export abstract class CacheManager implements ICacheManager {
             idTokens.forEach((idToken) => {
                 this.removeIdToken(generateCredentialKey(idToken));
             });
+            if (performanceClient && correlationId) {
+                performanceClient.addFields(
+                    { multiMatchedID: idTokens.length },
+                    correlationId
+                );
+            }
             return null;
         }
 
@@ -1047,15 +1068,18 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Retrieve AccessTokenEntity from cache
-     * @param clientId
-     * @param account
-     * @param scopes
-     * @param authScheme
+     * @param account {AccountInfo}
+     * @param request {BaseAuthRequest}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getAccessToken(
         account: AccountInfo,
         request: BaseAuthRequest,
-        tokenKeys?: TokenKeys
+        tokenKeys?: TokenKeys,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): AccessTokenEntity | null {
         this.commonLogger.trace("CacheManager - getAccessToken called");
         const scopes = ScopeSet.createSearchScopes(request.scopes);
@@ -1119,6 +1143,12 @@ export abstract class CacheManager implements ICacheManager {
             accessTokens.forEach((accessToken) => {
                 void this.removeAccessToken(generateCredentialKey(accessToken));
             });
+            if (performanceClient && correlationId) {
+                performanceClient.addFields(
+                    { multiMatchedAT: accessTokens.length },
+                    correlationId
+                );
+            }
             return null;
         }
 
@@ -1216,14 +1246,18 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Helper to retrieve the appropriate refresh token from cache
-     * @param clientId
-     * @param account
-     * @param familyRT
+     * @param account {AccountInfo}
+     * @param familyRT {boolean}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getRefreshToken(
         account: AccountInfo,
         familyRT: boolean,
-        tokenKeys?: TokenKeys
+        tokenKeys?: TokenKeys,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): RefreshTokenEntity | null {
         this.commonLogger.trace("CacheManager - getRefreshToken called");
         const id = familyRT ? THE_FAMILY_ID : undefined;
@@ -1266,6 +1300,13 @@ export abstract class CacheManager implements ICacheManager {
         }
         // address the else case after remove functions address environment aliases
 
+        if (numRefreshTokens > 1 && performanceClient && correlationId) {
+            performanceClient.addFields(
+                { multiMatchedRT: numRefreshTokens },
+                correlationId
+            );
+        }
+
         this.commonLogger.info(
             "CacheManager:getRefreshToken - returning refresh token"
         );

package/src/cache/entities/ServerTelemetryEntity.ts

@@ -3,36 +3,8 @@
  * Licensed under the MIT License.
  */
 
-import { SERVER_TELEM_CONSTANTS } from "../../utils/Constants";
-
-export class ServerTelemetryEntity {
+export type ServerTelemetryEntity = {
     failedRequests: Array<string | number>;
     errors: string[];
     cacheHits: number;
-
-    constructor() {
-        this.failedRequests = [];
-        this.errors = [];
-        this.cacheHits = 0;
-    }
-
-    /**
-     * validates if a given cache entry is "Telemetry", parses <key,value>
-     * @param key
-     * @param entity
-     */
-    static isServerTelemetryEntity(key: string, entity?: object): boolean {
-        const validateKey: boolean =
-            key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
-        let validateEntity: boolean = true;
-
-        if (entity) {
-            validateEntity =
-                entity.hasOwnProperty("failedRequests") &&
-                entity.hasOwnProperty("errors") &&
-                entity.hasOwnProperty("cacheHits");
-        }
-
-        return validateKey && validateEntity;
-    }
-}
+};

package/src/cache/utils/CacheHelpers.ts

@@ -12,6 +12,7 @@ import {
 import {
     AuthenticationScheme,
     CredentialType,
+    SERVER_TELEM_CONSTANTS,
     Separators,
 } from "../../utils/Constants";
 import { TimeUtils } from "../../utils/TimeUtils";
@@ -304,3 +305,23 @@ function generateScheme(credentialEntity: CredentialEntity): string {
         ? credentialEntity.tokenType.toLowerCase()
         : "";
 }
+
+/**
+ * validates if a given cache entry is "Telemetry", parses <key,value>
+ * @param key
+ * @param entity
+ */
+export function isServerTelemetryEntity(key: string, entity?: object): boolean {
+    const validateKey: boolean =
+        key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
+    let validateEntity: boolean = true;
+
+    if (entity) {
+        validateEntity =
+            entity.hasOwnProperty("failedRequests") &&
+            entity.hasOwnProperty("errors") &&
+            entity.hasOwnProperty("cacheHits");
+    }
+
+    return validateKey && validateEntity;
+}

package/src/client/AuthorizationCodeClient.ts

@@ -171,7 +171,7 @@ export class AuthorizationCodeClient extends BaseClient {
      * @param hashFragment
      */
     handleFragmentResponse(
-        hashFragment: string,
+        serverParams: ServerAuthorizationCodeResponse,
         cachedState: string
     ): AuthorizationCodePayload {
         // Handle responses.
@@ -184,13 +184,6 @@ export class AuthorizationCodeClient extends BaseClient {
             null
         );
 
-        const serverParams: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedCodeResponse(
-                this.config.authOptions.authority.options.OIDCOptions
-                    ?.serverResponseType,
-                hashFragment
-            );
-
         // Get code response
         responseHandler.validateServerAuthorizationCodeResponse(
             serverParams,
@@ -203,11 +196,8 @@ export class AuthorizationCodeClient extends BaseClient {
                 ClientAuthErrorCodes.authorizationCodeMissingFromServerResponse
             );
         }
-        return {
-            ...serverParams,
-            // Code param is optional in ServerAuthorizationCodeResponse but required in AuthorizationCodePaylod
-            code: serverParams.code,
-        };
+
+        return serverParams as AuthorizationCodePayload;
     }
 
     /**

package/src/client/RefreshTokenClient.ts

@@ -202,7 +202,13 @@ export class RefreshTokenClient extends BaseClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(request.account, foci);
+        )(
+            request.account,
+            foci,
+            undefined,
+            this.performanceClient,
+            request.correlationId
+        );
 
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(

package/src/client/SilentFlowClient.ts

@@ -124,7 +124,9 @@ export class SilentFlowClient extends BaseClient {
         const cacheRecord = this.cacheManager.readCacheRecord(
             request.account,
             request,
-            environment
+            environment,
+            this.performanceClient,
+            request.correlationId
         );
 
         if (!cacheRecord.accessToken) {
@@ -190,9 +192,11 @@ export class SilentFlowClient extends BaseClient {
             },
             correlationId
         );
-        this.logger.info(
-            `Token refresh is required due to cache outcome: ${cacheOutcome}`
-        );
+        if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
+            this.logger.info(
+                `Token refresh is required due to cache outcome: ${cacheOutcome}`
+            );
+        }
     }
 
     /**

package/src/crypto/ICrypto.ts

@@ -8,7 +8,7 @@ import {
     createClientAuthError,
 } from "../error/ClientAuthError";
 import { BaseAuthRequest } from "../request/BaseAuthRequest";
-import { SignedHttpRequest } from "./SignedHttpRequest";
+import { ShrOptions, SignedHttpRequest } from "./SignedHttpRequest";
 
 /**
  * The PkceCodes type describes the structure
@@ -22,7 +22,11 @@ export type PkceCodes = {
 
 export type SignedHttpRequestParameters = Pick<
     BaseAuthRequest,
-    "resourceRequestMethod" | "resourceRequestUri" | "shrClaims" | "shrNonce"
+    | "resourceRequestMethod"
+    | "resourceRequestUri"
+    | "shrClaims"
+    | "shrNonce"
+    | "shrOptions"
 > & {
     correlationId?: string;
 };
@@ -68,6 +72,7 @@ export interface ICrypto {
     signJwt(
         payload: SignedHttpRequest,
         kid: string,
+        shrOptions?: ShrOptions,
         correlationId?: string
     ): Promise<string>;
     /**

package/src/crypto/JoseHeader.ts

@@ -7,17 +7,17 @@ import {
     JoseHeaderErrorCodes,
     createJoseHeaderError,
 } from "../error/JoseHeaderError";
-import { JsonTypes } from "../utils/Constants";
+import { JsonWebTokenTypes } from "../utils/Constants";
 
 export type JoseHeaderOptions = {
-    typ?: JsonTypes;
+    typ?: JsonWebTokenTypes;
     alg?: string;
     kid?: string;
 };
 
 /** @internal */
 export class JoseHeader {
-    public typ?: JsonTypes;
+    public typ?: JsonWebTokenTypes;
     public alg?: string;
     public kid?: string;
 
@@ -48,7 +48,7 @@ export class JoseHeader {
 
         const shrHeader = new JoseHeader({
             // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
-            typ: shrHeaderOptions.typ || JsonTypes.Pop,
+            typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
             kid: shrHeaderOptions.kid,
             alg: shrHeaderOptions.alg,
         });

package/src/crypto/PopTokenGenerator.ts

@@ -133,6 +133,7 @@ export class PopTokenGenerator {
             resourceRequestUri,
             shrClaims,
             shrNonce,
+            shrOptions,
         } = request;
 
         const resourceUrlString = resourceRequestUri
@@ -154,6 +155,7 @@ export class PopTokenGenerator {
                 ...claims,
             },
             keyId,
+            shrOptions,
             request.correlationId
         );
     }

package/src/crypto/SignedHttpRequest.ts

@@ -3,6 +3,8 @@
  * Licensed under the MIT License.
  */
 
+import { JoseHeaderOptions } from "./JoseHeader";
+
 export type SignedHttpRequest = {
     at?: string;
     cnf?: object;
@@ -14,3 +16,7 @@ export type SignedHttpRequest = {
     nonce?: string;
     client_claims?: string;
 };
+
+export type ShrOptions = {
+    header: JoseHeaderOptions;
+};

package/src/index.ts

@@ -105,7 +105,7 @@ export {
     DEFAULT_CRYPTO_IMPLEMENTATION,
     SignedHttpRequestParameters,
 } from "./crypto/ICrypto";
-export { SignedHttpRequest } from "./crypto/SignedHttpRequest";
+export { SignedHttpRequest, ShrOptions } from "./crypto/SignedHttpRequest";
 export { IGuidGenerator } from "./crypto/IGuidGenerator";
 export { JoseHeader } from "./crypto/JoseHeader";
 // Request
@@ -193,6 +193,7 @@ export {
     GrantType,
     AADAuthorityConstants,
     HttpStatus,
+    JsonWebTokenTypes,
 } from "./utils/Constants";
 export { StringUtils } from "./utils/StringUtils";
 export { StringDict } from "./utils/MsalTypes";
@@ -202,6 +203,7 @@ export {
     LibraryStateObject,
 } from "./utils/ProtocolUtils";
 export { TimeUtils } from "./utils/TimeUtils";
+export * as UrlUtils from "./utils/UrlUtils";
 export * from "./utils/FunctionWrappers";
 // Server Telemetry
 export { ServerTelemetryManager } from "./telemetry/server/ServerTelemetryManager";

package/src/network/RequestThumbprint.ts

@@ -3,6 +3,7 @@
  * Licensed under the MIT License.
  */
 
+import { ShrOptions } from "../crypto/SignedHttpRequest";
 import { AuthenticationScheme } from "../utils/Constants";
 
 /**
@@ -19,4 +20,5 @@ export type RequestThumbprint = {
     resourceRequestUri?: string;
     shrClaims?: string;
     sshKid?: string;
+    shrOptions?: ShrOptions;
 };

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.3.0";
+export const version = "14.4.0";

package/src/request/BaseAuthRequest.ts

@@ -7,6 +7,7 @@ import { AuthenticationScheme } from "../utils/Constants";
 import { AzureCloudOptions } from "../config/ClientConfiguration";
 import { StringDict } from "../utils/MsalTypes";
 import { StoreInCache } from "./StoreInCache";
+import { ShrOptions } from "../crypto/SignedHttpRequest";
 
 /**
  * BaseAuthRequest
@@ -17,6 +18,7 @@ import { StoreInCache } from "./StoreInCache";
  * - claims                  - A stringified claims request which will be added to all /authorize and /token calls
  * - shrClaims               - A stringified claims object which will be added to a Signed HTTP Request
  * - shrNonce                - A server-generated timestamp that has been encrypted and base64URL encoded, which will be added to a Signed HTTP Request.
+ * - shrOptions              - An object containing options for the Signed HTTP Request
  * - resourceRequestMethod   - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri      - URI that token will be used for. Used for proof-of-possession flows.
  * - sshJwk                  - A stringified JSON Web Key representing a public key that can be signed by an SSH certificate.
@@ -34,6 +36,7 @@ export type BaseAuthRequest = {
     claims?: string;
     shrClaims?: string;
     shrNonce?: string;
+    shrOptions?: ShrOptions;
     resourceRequestMethod?: string;
     resourceRequestUri?: string;
     sshJwk?: string;

package/src/telemetry/performance/PerformanceEvent.ts

@@ -208,7 +208,7 @@ export const PerformanceEvents = {
      * Functions from InteractionHandler (msal-browser)
      */
     HandleCodeResponseFromServer: "handleCodeResponseFromServer",
-    HandleCodeResponseFromHash: "handleCodeResponseFromHash",
+    HandleCodeResponse: "handleCodeResponse",
     UpdateTokenEndpointAuthority: "updateTokenEndpointAuthority",
 
     /**
@@ -229,6 +229,7 @@ export const PerformanceEvents = {
      * handleServerTokenResponse API in ResponseHandler (msal-common)
      */
     HandleServerTokenResponse: "handleServerTokenResponse",
+    DeserializeResponse: "deserializeResponse",
 
     /**
      * Authority functions
@@ -558,6 +559,13 @@ export type PerformanceEvent = {
      * Nested App Auth Fields
      */
     nestedAppAuthRequest?: boolean;
+
+    /**
+     * Multiple matched access/id/refresh tokens in the cache
+     */
+    multiMatchedAT?: number;
+    multiMatchedID?: number;
+    multiMatchedRT?: number;
 };
 
 export const IntFields: ReadonlySet<string> = new Set([
@@ -570,4 +578,7 @@ export const IntFields: ReadonlySet<string> = new Set([
     "queuedTimeMs",
     "startTimeMs",
     "status",
+    "multiMatchedAT",
+    "multiMatchedID",
+    "multiMatchedRT",
 ]);

package/src/telemetry/server/ServerTelemetryManager.ts

@@ -160,7 +160,11 @@ export class ServerTelemetryManager {
      * Get the server telemetry entity from cache or initialize a new one
      */
     getLastRequests(): ServerTelemetryEntity {
-        const initialValue: ServerTelemetryEntity = new ServerTelemetryEntity();
+        const initialValue: ServerTelemetryEntity = {
+            failedRequests: [],
+            errors: [],
+            cacheHits: 0,
+        };
         const lastRequests = this.cacheManager.getServerTelemetry(
             this.telemetryCacheKey
         ) as ServerTelemetryEntity;
@@ -181,11 +185,13 @@ export class ServerTelemetryManager {
             this.cacheManager.removeItem(this.telemetryCacheKey);
         } else {
             // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
-            const serverTelemEntity = new ServerTelemetryEntity();
-            serverTelemEntity.failedRequests =
-                lastRequests.failedRequests.slice(numErrorsFlushed * 2); // failedRequests contains 2 items for each error
-            serverTelemEntity.errors =
-                lastRequests.errors.slice(numErrorsFlushed);
+            const serverTelemEntity: ServerTelemetryEntity = {
+                failedRequests: lastRequests.failedRequests.slice(
+                    numErrorsFlushed * 2
+                ), // failedRequests contains 2 items for each error
+                errors: lastRequests.errors.slice(numErrorsFlushed),
+                cacheHits: 0,
+            };
 
             this.cacheManager.setServerTelemetry(
                 this.telemetryCacheKey,