@azure/msal-common 14.3.0 → 14.4.1-beta.0

package/src/cache/CacheManager.ts

@@ -46,6 +46,7 @@ import { StoreInCache } from "../request/StoreInCache";
 import { getAliasesFromStaticSources } from "../authority/AuthorityMetadata";
 import { StaticAuthorityOptions } from "../authority/AuthorityOptions";
 import { TokenClaims } from "../account/TokenClaims";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 
 /**
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
@@ -876,29 +877,40 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Retrieve the cached credentials into a cacherecord
-     * @param account
-     * @param clientId
-     * @param scopes
-     * @param environment
-     * @param authScheme
+     * @param account {AccountInfo}
+     * @param request {BaseAuthRequest}
+     * @param environment {string}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     readCacheRecord(
         account: AccountInfo,
         request: BaseAuthRequest,
-        environment: string
+        environment: string,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): CacheRecord {
         const tokenKeys = this.getTokenKeys();
         const cachedAccount = this.readAccountFromCache(account);
-        const cachedIdToken = this.getIdToken(account, tokenKeys);
+        const cachedIdToken = this.getIdToken(
+            account,
+            tokenKeys,
+            performanceClient,
+            correlationId
+        );
         const cachedAccessToken = this.getAccessToken(
             account,
             request,
-            tokenKeys
+            tokenKeys,
+            performanceClient,
+            correlationId
         );
         const cachedRefreshToken = this.getRefreshToken(
             account,
             false,
-            tokenKeys
+            tokenKeys,
+            performanceClient,
+            correlationId
         );
         const cachedAppMetadata = this.readAppMetadataFromCache(environment);
 
@@ -930,13 +942,16 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Retrieve IdTokenEntity from cache
-     * @param clientId
-     * @param account
-     * @param inputRealm
+     * @param account {AccountInfo}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getIdToken(
         account: AccountInfo,
-        tokenKeys?: TokenKeys
+        tokenKeys?: TokenKeys,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): IdTokenEntity | null {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter: CredentialFilter = {
@@ -963,6 +978,12 @@ export abstract class CacheManager implements ICacheManager {
             idTokens.forEach((idToken) => {
                 this.removeIdToken(generateCredentialKey(idToken));
             });
+            if (performanceClient && correlationId) {
+                performanceClient.addFields(
+                    { multiMatchedID: idTokens.length },
+                    correlationId
+                );
+            }
             return null;
         }
 
@@ -1047,15 +1068,18 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Retrieve AccessTokenEntity from cache
-     * @param clientId
-     * @param account
-     * @param scopes
-     * @param authScheme
+     * @param account {AccountInfo}
+     * @param request {BaseAuthRequest}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getAccessToken(
         account: AccountInfo,
         request: BaseAuthRequest,
-        tokenKeys?: TokenKeys
+        tokenKeys?: TokenKeys,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): AccessTokenEntity | null {
         this.commonLogger.trace("CacheManager - getAccessToken called");
         const scopes = ScopeSet.createSearchScopes(request.scopes);
@@ -1119,6 +1143,12 @@ export abstract class CacheManager implements ICacheManager {
             accessTokens.forEach((accessToken) => {
                 void this.removeAccessToken(generateCredentialKey(accessToken));
             });
+            if (performanceClient && correlationId) {
+                performanceClient.addFields(
+                    { multiMatchedAT: accessTokens.length },
+                    correlationId
+                );
+            }
             return null;
         }
 
@@ -1216,14 +1246,18 @@ export abstract class CacheManager implements ICacheManager {
 
     /**
      * Helper to retrieve the appropriate refresh token from cache
-     * @param clientId
-     * @param account
-     * @param familyRT
+     * @param account {AccountInfo}
+     * @param familyRT {boolean}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
     getRefreshToken(
         account: AccountInfo,
         familyRT: boolean,
-        tokenKeys?: TokenKeys
+        tokenKeys?: TokenKeys,
+        performanceClient?: IPerformanceClient,
+        correlationId?: string
     ): RefreshTokenEntity | null {
         this.commonLogger.trace("CacheManager - getRefreshToken called");
         const id = familyRT ? THE_FAMILY_ID : undefined;
@@ -1266,6 +1300,13 @@ export abstract class CacheManager implements ICacheManager {
         }
         // address the else case after remove functions address environment aliases
 
+        if (numRefreshTokens > 1 && performanceClient && correlationId) {
+            performanceClient.addFields(
+                { multiMatchedRT: numRefreshTokens },
+                correlationId
+            );
+        }
+
         this.commonLogger.info(
             "CacheManager:getRefreshToken - returning refresh token"
         );

package/src/cache/entities/RefreshTokenEntity.ts

@@ -8,4 +8,6 @@ import { CredentialEntity } from "./CredentialEntity";
 /**
  * Refresh Token Cache Type
  */
-export type RefreshTokenEntity = CredentialEntity;
+export type RefreshTokenEntity = CredentialEntity & {
+    expiresOn?: string;
+};

package/src/cache/entities/ServerTelemetryEntity.ts

@@ -3,36 +3,8 @@
  * Licensed under the MIT License.
  */
 
-import { SERVER_TELEM_CONSTANTS } from "../../utils/Constants";
-
-export class ServerTelemetryEntity {
+export type ServerTelemetryEntity = {
     failedRequests: Array<string | number>;
     errors: string[];
     cacheHits: number;
-
-    constructor() {
-        this.failedRequests = [];
-        this.errors = [];
-        this.cacheHits = 0;
-    }
-
-    /**
-     * validates if a given cache entry is "Telemetry", parses <key,value>
-     * @param key
-     * @param entity
-     */
-    static isServerTelemetryEntity(key: string, entity?: object): boolean {
-        const validateKey: boolean =
-            key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
-        let validateEntity: boolean = true;
-
-        if (entity) {
-            validateEntity =
-                entity.hasOwnProperty("failedRequests") &&
-                entity.hasOwnProperty("errors") &&
-                entity.hasOwnProperty("cacheHits");
-        }
-
-        return validateKey && validateEntity;
-    }
-}
+};

package/src/cache/utils/CacheHelpers.ts

@@ -12,6 +12,7 @@ import {
 import {
     AuthenticationScheme,
     CredentialType,
+    SERVER_TELEM_CONSTANTS,
     Separators,
 } from "../../utils/Constants";
 import { TimeUtils } from "../../utils/TimeUtils";
@@ -167,7 +168,8 @@ export function createRefreshTokenEntity(
     refreshToken: string,
     clientId: string,
     familyId?: string,
-    userAssertionHash?: string
+    userAssertionHash?: string,
+    expiresOn?: string
 ): RefreshTokenEntity {
     const rtEntity: RefreshTokenEntity = {
         credentialType: CredentialType.REFRESH_TOKEN,
@@ -185,6 +187,10 @@ export function createRefreshTokenEntity(
         rtEntity.familyId = familyId;
     }
 
+    if (expiresOn) {
+        rtEntity.expiresOn = expiresOn;
+    }
+
     return rtEntity;
 }
 
@@ -304,3 +310,23 @@ function generateScheme(credentialEntity: CredentialEntity): string {
         ? credentialEntity.tokenType.toLowerCase()
         : "";
 }
+
+/**
+ * validates if a given cache entry is "Telemetry", parses <key,value>
+ * @param key
+ * @param entity
+ */
+export function isServerTelemetryEntity(key: string, entity?: object): boolean {
+    const validateKey: boolean =
+        key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
+    let validateEntity: boolean = true;
+
+    if (entity) {
+        validateEntity =
+            entity.hasOwnProperty("failedRequests") &&
+            entity.hasOwnProperty("errors") &&
+            entity.hasOwnProperty("cacheHits");
+    }
+
+    return validateKey && validateEntity;
+}

package/src/client/AuthorizationCodeClient.ts

@@ -161,7 +161,8 @@ export class AuthorizationCodeClient extends BaseClient {
             undefined,
             undefined,
             undefined,
-            requestId
+            requestId,
+            (TimeUtils.nowSeconds() + 24 * 60 * 60).toString()
         );
     }
 
@@ -171,7 +172,7 @@ export class AuthorizationCodeClient extends BaseClient {
      * @param hashFragment
      */
     handleFragmentResponse(
-        hashFragment: string,
+        serverParams: ServerAuthorizationCodeResponse,
         cachedState: string
     ): AuthorizationCodePayload {
         // Handle responses.
@@ -184,13 +185,6 @@ export class AuthorizationCodeClient extends BaseClient {
             null
         );
 
-        const serverParams: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedCodeResponse(
-                this.config.authOptions.authority.options.OIDCOptions
-                    ?.serverResponseType,
-                hashFragment
-            );
-
         // Get code response
         responseHandler.validateServerAuthorizationCodeResponse(
             serverParams,
@@ -203,11 +197,8 @@ export class AuthorizationCodeClient extends BaseClient {
                 ClientAuthErrorCodes.authorizationCodeMissingFromServerResponse
             );
         }
-        return {
-            ...serverParams,
-            // Code param is optional in ServerAuthorizationCodeResponse but required in AuthorizationCodePaylod
-            code: serverParams.code,
-        };
+
+        return serverParams as AuthorizationCodePayload;
     }
 
     /**

package/src/client/RefreshTokenClient.ts

@@ -102,7 +102,8 @@ export class RefreshTokenClient extends BaseClient {
             undefined,
             true,
             request.forceCache,
-            requestId
+            requestId,
+            request.expiresOn
         );
     }
 
@@ -202,13 +203,29 @@ export class RefreshTokenClient extends BaseClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(request.account, foci);
+        )(
+            request.account,
+            foci,
+            undefined,
+            this.performanceClient,
+            request.correlationId
+        );
 
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(
                 InteractionRequiredAuthErrorCodes.noTokensFound
             );
         }
+
+        if (
+            request.enableRTExpiryCheck &&
+            refreshToken.expiresOn &&
+            Number(refreshToken.expiresOn) < TimeUtils.nowSeconds() + 5 * 60
+        ) {
+            throw createInteractionRequiredAuthError(
+                InteractionRequiredAuthErrorCodes.refreshTokenExpired
+            );
+        }
         // attach cached RT size to the current measurement
 
         const refreshTokenRequest: CommonRefreshTokenRequest = {
@@ -220,6 +237,7 @@ export class RefreshTokenClient extends BaseClient {
                 credential: request.account.homeAccountId,
                 type: CcsCredentialType.HOME_ACCOUNT_ID,
             },
+            expiresOn: refreshToken.expiresOn,
         };
 
         return invokeAsync(

package/src/client/SilentFlowClient.ts

@@ -124,7 +124,9 @@ export class SilentFlowClient extends BaseClient {
         const cacheRecord = this.cacheManager.readCacheRecord(
             request.account,
             request,
-            environment
+            environment,
+            this.performanceClient,
+            request.correlationId
         );
 
         if (!cacheRecord.accessToken) {
@@ -190,9 +192,11 @@ export class SilentFlowClient extends BaseClient {
             },
             correlationId
         );
-        this.logger.info(
-            `Token refresh is required due to cache outcome: ${cacheOutcome}`
-        );
+        if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
+            this.logger.info(
+                `Token refresh is required due to cache outcome: ${cacheOutcome}`
+            );
+        }
     }
 
     /**

package/src/crypto/ICrypto.ts

@@ -8,7 +8,7 @@ import {
     createClientAuthError,
 } from "../error/ClientAuthError";
 import { BaseAuthRequest } from "../request/BaseAuthRequest";
-import { SignedHttpRequest } from "./SignedHttpRequest";
+import { ShrOptions, SignedHttpRequest } from "./SignedHttpRequest";
 
 /**
  * The PkceCodes type describes the structure
@@ -22,7 +22,11 @@ export type PkceCodes = {
 
 export type SignedHttpRequestParameters = Pick<
     BaseAuthRequest,
-    "resourceRequestMethod" | "resourceRequestUri" | "shrClaims" | "shrNonce"
+    | "resourceRequestMethod"
+    | "resourceRequestUri"
+    | "shrClaims"
+    | "shrNonce"
+    | "shrOptions"
 > & {
     correlationId?: string;
 };
@@ -68,6 +72,7 @@ export interface ICrypto {
     signJwt(
         payload: SignedHttpRequest,
         kid: string,
+        shrOptions?: ShrOptions,
         correlationId?: string
     ): Promise<string>;
     /**

package/src/crypto/JoseHeader.ts

@@ -7,17 +7,17 @@ import {
     JoseHeaderErrorCodes,
     createJoseHeaderError,
 } from "../error/JoseHeaderError";
-import { JsonTypes } from "../utils/Constants";
+import { JsonWebTokenTypes } from "../utils/Constants";
 
 export type JoseHeaderOptions = {
-    typ?: JsonTypes;
+    typ?: JsonWebTokenTypes;
     alg?: string;
     kid?: string;
 };
 
 /** @internal */
 export class JoseHeader {
-    public typ?: JsonTypes;
+    public typ?: JsonWebTokenTypes;
     public alg?: string;
     public kid?: string;
 
@@ -48,7 +48,7 @@ export class JoseHeader {
 
         const shrHeader = new JoseHeader({
             // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
-            typ: shrHeaderOptions.typ || JsonTypes.Pop,
+            typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
             kid: shrHeaderOptions.kid,
             alg: shrHeaderOptions.alg,
         });

package/src/crypto/PopTokenGenerator.ts

@@ -133,6 +133,7 @@ export class PopTokenGenerator {
             resourceRequestUri,
             shrClaims,
             shrNonce,
+            shrOptions,
         } = request;
 
         const resourceUrlString = resourceRequestUri
@@ -154,6 +155,7 @@ export class PopTokenGenerator {
                 ...claims,
             },
             keyId,
+            shrOptions,
             request.correlationId
         );
     }

package/src/crypto/SignedHttpRequest.ts

@@ -3,6 +3,8 @@
  * Licensed under the MIT License.
  */
 
+import { JoseHeaderOptions } from "./JoseHeader";
+
 export type SignedHttpRequest = {
     at?: string;
     cnf?: object;
@@ -14,3 +16,7 @@ export type SignedHttpRequest = {
     nonce?: string;
     client_claims?: string;
 };
+
+export type ShrOptions = {
+    header: JoseHeaderOptions;
+};

package/src/error/InteractionRequiredAuthError.ts

@@ -28,6 +28,8 @@ export const InteractionRequiredAuthSubErrorMessage = [
 const InteractionRequiredAuthErrorMessages = {
     [InteractionRequiredAuthErrorCodes.noTokensFound]:
         "No refresh token found in the cache. Please sign-in.",
+    [InteractionRequiredAuthErrorCodes.refreshTokenExpired]:
+        "Refresh token has expired.",
     [InteractionRequiredAuthErrorCodes.nativeAccountUnavailable]:
         "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
 };

package/src/error/InteractionRequiredAuthErrorCodes.ts

@@ -6,6 +6,7 @@
 // Codes defined by MSAL
 export const noTokensFound = "no_tokens_found";
 export const nativeAccountUnavailable = "native_account_unavailable";
+export const refreshTokenExpired = "refresh_token_expired";
 
 // Codes potentially returned by server
 export const interactionRequired = "interaction_required";

package/src/index.ts

@@ -105,7 +105,7 @@ export {
     DEFAULT_CRYPTO_IMPLEMENTATION,
     SignedHttpRequestParameters,
 } from "./crypto/ICrypto";
-export { SignedHttpRequest } from "./crypto/SignedHttpRequest";
+export { SignedHttpRequest, ShrOptions } from "./crypto/SignedHttpRequest";
 export { IGuidGenerator } from "./crypto/IGuidGenerator";
 export { JoseHeader } from "./crypto/JoseHeader";
 // Request
@@ -193,6 +193,7 @@ export {
     GrantType,
     AADAuthorityConstants,
     HttpStatus,
+    JsonWebTokenTypes,
 } from "./utils/Constants";
 export { StringUtils } from "./utils/StringUtils";
 export { StringDict } from "./utils/MsalTypes";
@@ -202,6 +203,7 @@ export {
     LibraryStateObject,
 } from "./utils/ProtocolUtils";
 export { TimeUtils } from "./utils/TimeUtils";
+export * as UrlUtils from "./utils/UrlUtils";
 export * from "./utils/FunctionWrappers";
 // Server Telemetry
 export { ServerTelemetryManager } from "./telemetry/server/ServerTelemetryManager";

package/src/network/RequestThumbprint.ts

@@ -3,6 +3,7 @@
  * Licensed under the MIT License.
  */
 
+import { ShrOptions } from "../crypto/SignedHttpRequest";
 import { AuthenticationScheme } from "../utils/Constants";
 
 /**
@@ -19,4 +20,5 @@ export type RequestThumbprint = {
     resourceRequestUri?: string;
     shrClaims?: string;
     sshKid?: string;
+    shrOptions?: ShrOptions;
 };

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.3.0";
+export const version = "14.4.0";

package/src/request/BaseAuthRequest.ts

@@ -7,6 +7,7 @@ import { AuthenticationScheme } from "../utils/Constants";
 import { AzureCloudOptions } from "../config/ClientConfiguration";
 import { StringDict } from "../utils/MsalTypes";
 import { StoreInCache } from "./StoreInCache";
+import { ShrOptions } from "../crypto/SignedHttpRequest";
 
 /**
  * BaseAuthRequest
@@ -17,6 +18,7 @@ import { StoreInCache } from "./StoreInCache";
  * - claims                  - A stringified claims request which will be added to all /authorize and /token calls
  * - shrClaims               - A stringified claims object which will be added to a Signed HTTP Request
  * - shrNonce                - A server-generated timestamp that has been encrypted and base64URL encoded, which will be added to a Signed HTTP Request.
+ * - shrOptions              - An object containing options for the Signed HTTP Request
  * - resourceRequestMethod   - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri      - URI that token will be used for. Used for proof-of-possession flows.
  * - sshJwk                  - A stringified JSON Web Key representing a public key that can be signed by an SSH certificate.
@@ -34,6 +36,7 @@ export type BaseAuthRequest = {
     claims?: string;
     shrClaims?: string;
     shrNonce?: string;
+    shrOptions?: ShrOptions;
     resourceRequestMethod?: string;
     resourceRequestUri?: string;
     sshJwk?: string;

package/src/request/CommonRefreshTokenRequest.ts

@@ -21,6 +21,7 @@ import { StringDict } from "../utils/MsalTypes";
  */
 export type CommonRefreshTokenRequest = BaseAuthRequest & {
     refreshToken: string;
+    expiresOn?: string;
     ccsCredential?: CcsCredential;
     forceCache?: boolean;
     tokenBodyParameters?: StringDict;

package/src/request/CommonSilentFlowRequest.ts

@@ -23,4 +23,5 @@ export type CommonSilentFlowRequest = BaseAuthRequest & {
     account: AccountInfo;
     forceRefresh: boolean;
     tokenBodyParameters?: StringDict;
+    enableRTExpiryCheck?: boolean;
 };

package/src/response/ResponseHandler.ts

@@ -245,7 +245,8 @@ export class ResponseHandler {
         userAssertionHash?: string,
         handlingRefreshTokenResponse?: boolean,
         forceCacheRefreshTokenResponse?: boolean,
-        serverRequestId?: string
+        serverRequestId?: string,
+        rtExpiresOn?: string
     ): Promise<AuthenticationResult> {
         this.performanceClient?.addQueueMeasurement(
             PerformanceEvents.HandleServerTokenResponse,
@@ -311,7 +312,8 @@ export class ResponseHandler {
             request,
             idTokenClaims,
             userAssertionHash,
-            authCodePayload
+            authCodePayload,
+            rtExpiresOn
         );
         let cacheContext;
         try {
@@ -397,7 +399,8 @@ export class ResponseHandler {
         request: BaseAuthRequest,
         idTokenClaims?: TokenClaims,
         userAssertionHash?: string,
-        authCodePayload?: AuthorizationCodePayload
+        authCodePayload?: AuthorizationCodePayload,
+        rtExpiresOn?: string
     ): CacheRecord {
         const env = authority.getPreferredCache();
         if (!env) {
@@ -491,7 +494,8 @@ export class ResponseHandler {
                 serverTokenResponse.refresh_token,
                 this.clientId,
                 serverTokenResponse.foci,
-                userAssertionHash
+                userAssertionHash,
+                rtExpiresOn
             );
         }
 

package/src/telemetry/performance/PerformanceEvent.ts

@@ -208,7 +208,7 @@ export const PerformanceEvents = {
      * Functions from InteractionHandler (msal-browser)
      */
     HandleCodeResponseFromServer: "handleCodeResponseFromServer",
-    HandleCodeResponseFromHash: "handleCodeResponseFromHash",
+    HandleCodeResponse: "handleCodeResponse",
     UpdateTokenEndpointAuthority: "updateTokenEndpointAuthority",
 
     /**
@@ -229,6 +229,7 @@ export const PerformanceEvents = {
      * handleServerTokenResponse API in ResponseHandler (msal-common)
      */
     HandleServerTokenResponse: "handleServerTokenResponse",
+    DeserializeResponse: "deserializeResponse",
 
     /**
      * Authority functions
@@ -558,6 +559,13 @@ export type PerformanceEvent = {
      * Nested App Auth Fields
      */
     nestedAppAuthRequest?: boolean;
+
+    /**
+     * Multiple matched access/id/refresh tokens in the cache
+     */
+    multiMatchedAT?: number;
+    multiMatchedID?: number;
+    multiMatchedRT?: number;
 };
 
 export const IntFields: ReadonlySet<string> = new Set([
@@ -570,4 +578,7 @@ export const IntFields: ReadonlySet<string> = new Set([
     "queuedTimeMs",
     "startTimeMs",
     "status",
+    "multiMatchedAT",
+    "multiMatchedID",
+    "multiMatchedRT",
 ]);