@azure/msal-common 14.4.0 → 14.4.1-beta.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/account/AccountInfo.d.ts +31 -31
- package/dist/account/AuthToken.d.ts +17 -17
- package/dist/account/AuthToken.mjs +58 -58
- package/dist/account/CcsCredential.d.ts +9 -9
- package/dist/account/CcsCredential.mjs +8 -8
- package/dist/account/ClientCredentials.d.ts +14 -14
- package/dist/account/ClientInfo.d.ts +19 -19
- package/dist/account/ClientInfo.mjs +37 -37
- package/dist/account/TokenClaims.d.ts +65 -65
- package/dist/authority/Authority.d.ts +249 -249
- package/dist/authority/Authority.mjs +788 -788
- package/dist/authority/AuthorityFactory.d.ts +31 -31
- package/dist/authority/AuthorityFactory.mjs +47 -47
- package/dist/authority/AuthorityMetadata.d.ts +503 -503
- package/dist/authority/AuthorityMetadata.mjs +603 -603
- package/dist/authority/AuthorityOptions.d.ts +27 -27
- package/dist/authority/AuthorityOptions.mjs +18 -18
- package/dist/authority/AuthorityType.d.ts +10 -10
- package/dist/authority/AuthorityType.mjs +13 -13
- package/dist/authority/AzureRegion.d.ts +1 -1
- package/dist/authority/AzureRegionConfiguration.d.ts +5 -5
- package/dist/authority/CloudDiscoveryMetadata.d.ts +5 -5
- package/dist/authority/CloudInstanceDiscoveryErrorResponse.d.ts +13 -13
- package/dist/authority/CloudInstanceDiscoveryErrorResponse.mjs +8 -8
- package/dist/authority/CloudInstanceDiscoveryResponse.d.ts +9 -9
- package/dist/authority/CloudInstanceDiscoveryResponse.mjs +8 -8
- package/dist/authority/ImdsOptions.d.ts +5 -5
- package/dist/authority/OIDCOptions.d.ts +8 -8
- package/dist/authority/OpenIdConfigResponse.d.ts +11 -11
- package/dist/authority/OpenIdConfigResponse.mjs +10 -10
- package/dist/authority/ProtocolMode.d.ts +8 -8
- package/dist/authority/ProtocolMode.mjs +11 -11
- package/dist/authority/RegionDiscovery.d.ts +32 -32
- package/dist/authority/RegionDiscovery.mjs +106 -106
- package/dist/authority/RegionDiscoveryMetadata.d.ts +6 -6
- package/dist/broker/nativeBroker/INativeBrokerPlugin.d.ts +15 -15
- package/dist/cache/CacheManager.d.ts +485 -485
- package/dist/cache/CacheManager.mjs +1102 -1102
- package/dist/cache/entities/AccessTokenEntity.d.ts +25 -25
- package/dist/cache/entities/AccountEntity.d.ts +101 -101
- package/dist/cache/entities/AccountEntity.mjs +218 -218
- package/dist/cache/entities/AppMetadataEntity.d.ts +39 -39
- package/dist/cache/entities/AppMetadataEntity.mjs +66 -66
- package/dist/cache/entities/AuthorityMetadataEntity.d.ts +48 -48
- package/dist/cache/entities/AuthorityMetadataEntity.mjs +78 -78
- package/dist/cache/entities/CacheRecord.d.ts +14 -14
- package/dist/cache/entities/CacheRecord.mjs +14 -14
- package/dist/cache/entities/CredentialEntity.d.ts +30 -30
- package/dist/cache/entities/IdTokenEntity.d.ts +8 -8
- package/dist/cache/entities/RefreshTokenEntity.d.ts +7 -5
- package/dist/cache/entities/RefreshTokenEntity.d.ts.map +1 -1
- package/dist/cache/entities/ServerTelemetryEntity.d.ts +5 -5
- package/dist/cache/entities/ThrottlingEntity.d.ts +13 -13
- package/dist/cache/entities/ThrottlingEntity.mjs +23 -23
- package/dist/cache/interface/ICacheManager.d.ts +166 -166
- package/dist/cache/interface/ICachePlugin.d.ts +5 -5
- package/dist/cache/interface/ISerializableTokenCache.d.ts +4 -4
- package/dist/cache/persistence/TokenCacheContext.d.ts +23 -23
- package/dist/cache/persistence/TokenCacheContext.mjs +25 -25
- package/dist/cache/utils/CacheHelpers.d.ts +64 -64
- package/dist/cache/utils/CacheHelpers.d.ts.map +1 -1
- package/dist/cache/utils/CacheHelpers.mjs +234 -231
- package/dist/cache/utils/CacheHelpers.mjs.map +1 -1
- package/dist/cache/utils/CacheTypes.d.ts +67 -67
- package/dist/client/AuthorizationCodeClient.d.ts +74 -74
- package/dist/client/AuthorizationCodeClient.d.ts.map +1 -1
- package/dist/client/AuthorizationCodeClient.mjs +402 -402
- package/dist/client/AuthorizationCodeClient.mjs.map +1 -1
- package/dist/client/BaseClient.d.ts +51 -51
- package/dist/client/BaseClient.mjs +100 -100
- package/dist/client/RefreshTokenClient.d.ts +35 -35
- package/dist/client/RefreshTokenClient.d.ts.map +1 -1
- package/dist/client/RefreshTokenClient.mjs +193 -187
- package/dist/client/RefreshTokenClient.mjs.map +1 -1
- package/dist/client/SilentFlowClient.d.ts +27 -27
- package/dist/client/SilentFlowClient.mjs +118 -118
- package/dist/config/AppTokenProvider.d.ts +38 -38
- package/dist/config/ClientConfiguration.d.ts +150 -150
- package/dist/config/ClientConfiguration.mjs +97 -97
- package/dist/crypto/ICrypto.d.ts +58 -58
- package/dist/crypto/ICrypto.mjs +30 -30
- package/dist/crypto/IGuidGenerator.d.ts +4 -4
- package/dist/crypto/JoseHeader.d.ts +22 -22
- package/dist/crypto/JoseHeader.mjs +37 -37
- package/dist/crypto/PopTokenGenerator.d.ts +60 -60
- package/dist/crypto/PopTokenGenerator.mjs +82 -82
- package/dist/crypto/SignedHttpRequest.d.ts +15 -15
- package/dist/error/AuthError.d.ts +44 -44
- package/dist/error/AuthError.mjs +46 -46
- package/dist/error/AuthErrorCodes.d.ts +5 -5
- package/dist/error/AuthErrorCodes.mjs +9 -9
- package/dist/error/ClientAuthError.d.ts +237 -237
- package/dist/error/ClientAuthError.mjs +249 -249
- package/dist/error/ClientAuthErrorCodes.d.ts +44 -44
- package/dist/error/ClientAuthErrorCodes.mjs +48 -48
- package/dist/error/ClientConfigurationError.d.ts +128 -128
- package/dist/error/ClientConfigurationError.mjs +135 -135
- package/dist/error/ClientConfigurationErrorCodes.d.ts +22 -22
- package/dist/error/ClientConfigurationErrorCodes.mjs +26 -26
- package/dist/error/InteractionRequiredAuthError.d.ts +57 -57
- package/dist/error/InteractionRequiredAuthError.d.ts.map +1 -1
- package/dist/error/InteractionRequiredAuthError.mjs +78 -77
- package/dist/error/InteractionRequiredAuthError.mjs.map +1 -1
- package/dist/error/InteractionRequiredAuthErrorCodes.d.ts +6 -5
- package/dist/error/InteractionRequiredAuthErrorCodes.d.ts.map +1 -1
- package/dist/error/InteractionRequiredAuthErrorCodes.mjs +13 -12
- package/dist/error/InteractionRequiredAuthErrorCodes.mjs.map +1 -1
- package/dist/error/JoseHeaderError.d.ts +15 -15
- package/dist/error/JoseHeaderError.mjs +22 -22
- package/dist/error/JoseHeaderErrorCodes.d.ts +2 -2
- package/dist/error/JoseHeaderErrorCodes.mjs +6 -6
- package/dist/error/ServerError.d.ts +7 -7
- package/dist/error/ServerError.mjs +14 -14
- package/dist/index.cjs +8289 -8277
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.ts +98 -98
- package/dist/index.mjs +1 -1
- package/dist/logger/Logger.d.ts +95 -95
- package/dist/logger/Logger.mjs +188 -188
- package/dist/network/INetworkModule.d.ts +29 -29
- package/dist/network/INetworkModule.mjs +12 -12
- package/dist/network/NetworkManager.d.ts +33 -33
- package/dist/network/NetworkManager.mjs +34 -34
- package/dist/network/RequestThumbprint.d.ts +18 -18
- package/dist/network/ThrottlingUtils.d.ts +42 -42
- package/dist/network/ThrottlingUtils.mjs +95 -95
- package/dist/packageMetadata.d.ts +2 -2
- package/dist/packageMetadata.mjs +3 -3
- package/dist/request/AuthenticationHeaderParser.d.ts +19 -19
- package/dist/request/AuthenticationHeaderParser.mjs +55 -55
- package/dist/request/BaseAuthRequest.d.ts +43 -43
- package/dist/request/CommonAuthorizationCodeRequest.d.ts +27 -27
- package/dist/request/CommonAuthorizationUrlRequest.d.ts +50 -50
- package/dist/request/CommonClientCredentialRequest.d.ts +17 -17
- package/dist/request/CommonDeviceCodeRequest.d.ts +21 -21
- package/dist/request/CommonEndSessionRequest.d.ts +21 -21
- package/dist/request/CommonOnBehalfOfRequest.d.ts +13 -13
- package/dist/request/CommonRefreshTokenRequest.d.ts +23 -22
- package/dist/request/CommonRefreshTokenRequest.d.ts.map +1 -1
- package/dist/request/CommonSilentFlowRequest.d.ts +21 -20
- package/dist/request/CommonSilentFlowRequest.d.ts.map +1 -1
- package/dist/request/CommonUsernamePasswordRequest.d.ts +17 -17
- package/dist/request/NativeRequest.d.ts +19 -19
- package/dist/request/NativeSignOutRequest.d.ts +5 -5
- package/dist/request/RequestParameterBuilder.d.ts +217 -217
- package/dist/request/RequestParameterBuilder.mjs +381 -381
- package/dist/request/RequestValidator.d.ts +33 -33
- package/dist/request/RequestValidator.mjs +81 -81
- package/dist/request/ScopeSet.d.ts +88 -88
- package/dist/request/ScopeSet.mjs +197 -197
- package/dist/request/StoreInCache.d.ts +8 -8
- package/dist/response/AuthenticationResult.d.ts +41 -41
- package/dist/response/AuthorizationCodePayload.d.ts +13 -13
- package/dist/response/DeviceCodeResponse.d.ts +25 -25
- package/dist/response/ExternalTokenResponse.d.ts +15 -15
- package/dist/response/IMDSBadResponse.d.ts +4 -4
- package/dist/response/ResponseHandler.d.ts +67 -67
- package/dist/response/ResponseHandler.d.ts.map +1 -1
- package/dist/response/ResponseHandler.mjs +312 -312
- package/dist/response/ResponseHandler.mjs.map +1 -1
- package/dist/response/ServerAuthorizationCodeResponse.d.ts +25 -25
- package/dist/response/ServerAuthorizationTokenResponse.d.ts +46 -46
- package/dist/telemetry/performance/IPerformanceClient.d.ts +51 -51
- package/dist/telemetry/performance/IPerformanceMeasurement.d.ts +5 -5
- package/dist/telemetry/performance/PerformanceClient.d.ts +191 -191
- package/dist/telemetry/performance/PerformanceClient.mjs +409 -409
- package/dist/telemetry/performance/PerformanceEvent.d.ts +464 -464
- package/dist/telemetry/performance/PerformanceEvent.mjs +253 -253
- package/dist/telemetry/performance/StubPerformanceClient.d.ts +24 -24
- package/dist/telemetry/performance/StubPerformanceClient.mjs +76 -76
- package/dist/telemetry/server/ServerTelemetryManager.d.ts +66 -66
- package/dist/telemetry/server/ServerTelemetryManager.mjs +201 -201
- package/dist/telemetry/server/ServerTelemetryRequest.d.ts +8 -8
- package/dist/url/IUri.d.ts +12 -12
- package/dist/url/UrlString.d.ts +48 -48
- package/dist/url/UrlString.mjs +161 -161
- package/dist/utils/Constants.d.ts +365 -365
- package/dist/utils/Constants.mjs +375 -375
- package/dist/utils/FunctionWrappers.d.ts +27 -27
- package/dist/utils/FunctionWrappers.mjs +84 -84
- package/dist/utils/MsalTypes.d.ts +6 -6
- package/dist/utils/ProtocolUtils.d.ts +42 -42
- package/dist/utils/ProtocolUtils.mjs +69 -69
- package/dist/utils/StringUtils.d.ts +40 -40
- package/dist/utils/StringUtils.mjs +95 -95
- package/dist/utils/TimeUtils.d.ts +27 -27
- package/dist/utils/TimeUtils.mjs +45 -45
- package/dist/utils/UrlUtils.d.ts +10 -10
- package/dist/utils/UrlUtils.mjs +44 -44
- package/package.json +92 -92
- package/src/cache/entities/RefreshTokenEntity.ts +3 -1
- package/src/cache/utils/CacheHelpers.ts +6 -1
- package/src/client/AuthorizationCodeClient.ts +2 -1
- package/src/client/RefreshTokenClient.ts +13 -1
- package/src/error/InteractionRequiredAuthError.ts +2 -0
- package/src/error/InteractionRequiredAuthErrorCodes.ts +1 -0
- package/src/request/CommonRefreshTokenRequest.ts +1 -0
- package/src/request/CommonSilentFlowRequest.ts +1 -0
- package/src/response/ResponseHandler.ts +8 -4
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! @azure/msal-common v14.4.0 2023-11-
|
|
1
|
+
/*! @azure/msal-common v14.4.1-beta.0 2023-11-14 */
|
|
2
2
|
'use strict';
|
|
3
3
|
import { isOidcProtocolMode } from '../config/ClientConfiguration.mjs';
|
|
4
4
|
import { BaseClient } from './BaseClient.mjs';
|
|
@@ -19,193 +19,199 @@ import { PerformanceEvents } from '../telemetry/performance/PerformanceEvent.mjs
|
|
|
19
19
|
import { invokeAsync, invoke } from '../utils/FunctionWrappers.mjs';
|
|
20
20
|
import { tokenRequestEmpty, missingSshJwk } from '../error/ClientConfigurationErrorCodes.mjs';
|
|
21
21
|
import { noAccountInSilentRequest } from '../error/ClientAuthErrorCodes.mjs';
|
|
22
|
-
import { noTokensFound } from '../error/InteractionRequiredAuthErrorCodes.mjs';
|
|
22
|
+
import { noTokensFound, refreshTokenExpired } from '../error/InteractionRequiredAuthErrorCodes.mjs';
|
|
23
23
|
|
|
24
|
-
/*
|
|
25
|
-
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
26
|
-
* Licensed under the MIT License.
|
|
27
|
-
*/
|
|
28
|
-
/**
|
|
29
|
-
* OAuth2.0 refresh token client
|
|
30
|
-
* @internal
|
|
31
|
-
*/
|
|
32
|
-
class RefreshTokenClient extends BaseClient {
|
|
33
|
-
constructor(configuration, performanceClient) {
|
|
34
|
-
super(configuration, performanceClient);
|
|
35
|
-
}
|
|
36
|
-
async acquireToken(request) {
|
|
37
|
-
this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
|
|
38
|
-
const reqTimestamp = TimeUtils.nowSeconds();
|
|
39
|
-
const response = await invokeAsync(this.executeTokenRequest.bind(this), PerformanceEvents.RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
|
|
40
|
-
// Retrieve requestId from response headers
|
|
41
|
-
const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
|
|
42
|
-
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
|
|
43
|
-
responseHandler.validateTokenResponse(response.body);
|
|
44
|
-
return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId);
|
|
45
|
-
}
|
|
46
|
-
/**
|
|
47
|
-
* Gets cached refresh token and attaches to request, then calls acquireToken API
|
|
48
|
-
* @param request
|
|
49
|
-
*/
|
|
50
|
-
async acquireTokenByRefreshToken(request) {
|
|
51
|
-
// Cannot renew token if no request object is given.
|
|
52
|
-
if (!request) {
|
|
53
|
-
throw createClientConfigurationError(tokenRequestEmpty);
|
|
54
|
-
}
|
|
55
|
-
this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken, request.correlationId);
|
|
56
|
-
// We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
|
|
57
|
-
if (!request.account) {
|
|
58
|
-
throw createClientAuthError(noAccountInSilentRequest);
|
|
59
|
-
}
|
|
60
|
-
// try checking if FOCI is enabled for the given application
|
|
61
|
-
const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment);
|
|
62
|
-
// if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
|
|
63
|
-
if (isFOCI) {
|
|
64
|
-
try {
|
|
65
|
-
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true);
|
|
66
|
-
}
|
|
67
|
-
catch (e) {
|
|
68
|
-
const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
|
|
69
|
-
e.errorCode ===
|
|
70
|
-
noTokensFound;
|
|
71
|
-
const clientMismatchErrorWithFamilyRT = e instanceof ServerError &&
|
|
72
|
-
e.errorCode === Errors.INVALID_GRANT_ERROR &&
|
|
73
|
-
e.subError === Errors.CLIENT_MISMATCH_ERROR;
|
|
74
|
-
// if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
|
|
75
|
-
if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
|
|
76
|
-
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
|
|
77
|
-
// throw in all other cases
|
|
78
|
-
}
|
|
79
|
-
else {
|
|
80
|
-
throw e;
|
|
81
|
-
}
|
|
82
|
-
}
|
|
83
|
-
}
|
|
84
|
-
// fall back to application refresh token acquisition
|
|
85
|
-
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
|
|
86
|
-
}
|
|
87
|
-
/**
|
|
88
|
-
* makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
|
|
89
|
-
* @param request
|
|
90
|
-
*/
|
|
91
|
-
async acquireTokenWithCachedRefreshToken(request, foci) {
|
|
92
|
-
this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
|
|
93
|
-
// fetches family RT or application RT based on FOCI value
|
|
94
|
-
const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
|
|
95
|
-
if (!refreshToken) {
|
|
96
|
-
throw createInteractionRequiredAuthError(noTokensFound);
|
|
97
|
-
}
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
parameterBuilder
|
|
149
|
-
parameterBuilder.
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
parameterBuilder.
|
|
158
|
-
parameterBuilder.
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
const
|
|
170
|
-
|
|
171
|
-
parameterBuilder.
|
|
172
|
-
}
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
24
|
+
/*
|
|
25
|
+
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
26
|
+
* Licensed under the MIT License.
|
|
27
|
+
*/
|
|
28
|
+
/**
|
|
29
|
+
* OAuth2.0 refresh token client
|
|
30
|
+
* @internal
|
|
31
|
+
*/
|
|
32
|
+
class RefreshTokenClient extends BaseClient {
|
|
33
|
+
constructor(configuration, performanceClient) {
|
|
34
|
+
super(configuration, performanceClient);
|
|
35
|
+
}
|
|
36
|
+
async acquireToken(request) {
|
|
37
|
+
this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
|
|
38
|
+
const reqTimestamp = TimeUtils.nowSeconds();
|
|
39
|
+
const response = await invokeAsync(this.executeTokenRequest.bind(this), PerformanceEvents.RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
|
|
40
|
+
// Retrieve requestId from response headers
|
|
41
|
+
const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
|
|
42
|
+
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
|
|
43
|
+
responseHandler.validateTokenResponse(response.body);
|
|
44
|
+
return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId, request.expiresOn);
|
|
45
|
+
}
|
|
46
|
+
/**
|
|
47
|
+
* Gets cached refresh token and attaches to request, then calls acquireToken API
|
|
48
|
+
* @param request
|
|
49
|
+
*/
|
|
50
|
+
async acquireTokenByRefreshToken(request) {
|
|
51
|
+
// Cannot renew token if no request object is given.
|
|
52
|
+
if (!request) {
|
|
53
|
+
throw createClientConfigurationError(tokenRequestEmpty);
|
|
54
|
+
}
|
|
55
|
+
this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken, request.correlationId);
|
|
56
|
+
// We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
|
|
57
|
+
if (!request.account) {
|
|
58
|
+
throw createClientAuthError(noAccountInSilentRequest);
|
|
59
|
+
}
|
|
60
|
+
// try checking if FOCI is enabled for the given application
|
|
61
|
+
const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment);
|
|
62
|
+
// if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
|
|
63
|
+
if (isFOCI) {
|
|
64
|
+
try {
|
|
65
|
+
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true);
|
|
66
|
+
}
|
|
67
|
+
catch (e) {
|
|
68
|
+
const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
|
|
69
|
+
e.errorCode ===
|
|
70
|
+
noTokensFound;
|
|
71
|
+
const clientMismatchErrorWithFamilyRT = e instanceof ServerError &&
|
|
72
|
+
e.errorCode === Errors.INVALID_GRANT_ERROR &&
|
|
73
|
+
e.subError === Errors.CLIENT_MISMATCH_ERROR;
|
|
74
|
+
// if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
|
|
75
|
+
if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
|
|
76
|
+
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
|
|
77
|
+
// throw in all other cases
|
|
78
|
+
}
|
|
79
|
+
else {
|
|
80
|
+
throw e;
|
|
81
|
+
}
|
|
82
|
+
}
|
|
83
|
+
}
|
|
84
|
+
// fall back to application refresh token acquisition
|
|
85
|
+
return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
|
|
86
|
+
}
|
|
87
|
+
/**
|
|
88
|
+
* makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
|
|
89
|
+
* @param request
|
|
90
|
+
*/
|
|
91
|
+
async acquireTokenWithCachedRefreshToken(request, foci) {
|
|
92
|
+
this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
|
|
93
|
+
// fetches family RT or application RT based on FOCI value
|
|
94
|
+
const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
|
|
95
|
+
if (!refreshToken) {
|
|
96
|
+
throw createInteractionRequiredAuthError(noTokensFound);
|
|
97
|
+
}
|
|
98
|
+
if (request.enableRTExpiryCheck &&
|
|
99
|
+
refreshToken.expiresOn &&
|
|
100
|
+
Number(refreshToken.expiresOn) < TimeUtils.nowSeconds() + 5 * 60) {
|
|
101
|
+
throw createInteractionRequiredAuthError(refreshTokenExpired);
|
|
102
|
+
}
|
|
103
|
+
// attach cached RT size to the current measurement
|
|
104
|
+
const refreshTokenRequest = {
|
|
105
|
+
...request,
|
|
106
|
+
refreshToken: refreshToken.secret,
|
|
107
|
+
authenticationScheme: request.authenticationScheme || AuthenticationScheme.BEARER,
|
|
108
|
+
ccsCredential: {
|
|
109
|
+
credential: request.account.homeAccountId,
|
|
110
|
+
type: CcsCredentialType.HOME_ACCOUNT_ID,
|
|
111
|
+
},
|
|
112
|
+
expiresOn: refreshToken.expiresOn,
|
|
113
|
+
};
|
|
114
|
+
return invokeAsync(this.acquireToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest);
|
|
115
|
+
}
|
|
116
|
+
/**
|
|
117
|
+
* Constructs the network message and makes a NW call to the underlying secure token service
|
|
118
|
+
* @param request
|
|
119
|
+
* @param authority
|
|
120
|
+
*/
|
|
121
|
+
async executeTokenRequest(request, authority) {
|
|
122
|
+
this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientExecuteTokenRequest, request.correlationId);
|
|
123
|
+
const queryParametersString = this.createTokenQueryParameters(request);
|
|
124
|
+
const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
|
|
125
|
+
const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
|
|
126
|
+
const headers = this.createTokenRequestHeaders(request.ccsCredential);
|
|
127
|
+
const thumbprint = {
|
|
128
|
+
clientId: request.tokenBodyParameters?.clientId ||
|
|
129
|
+
this.config.authOptions.clientId,
|
|
130
|
+
authority: authority.canonicalAuthority,
|
|
131
|
+
scopes: request.scopes,
|
|
132
|
+
claims: request.claims,
|
|
133
|
+
authenticationScheme: request.authenticationScheme,
|
|
134
|
+
resourceRequestMethod: request.resourceRequestMethod,
|
|
135
|
+
resourceRequestUri: request.resourceRequestUri,
|
|
136
|
+
shrClaims: request.shrClaims,
|
|
137
|
+
sshKid: request.sshKid,
|
|
138
|
+
};
|
|
139
|
+
return invokeAsync(this.executePostToTokenEndpoint.bind(this), PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint);
|
|
140
|
+
}
|
|
141
|
+
/**
|
|
142
|
+
* Helper function to create the token request body
|
|
143
|
+
* @param request
|
|
144
|
+
*/
|
|
145
|
+
async createTokenRequestBody(request) {
|
|
146
|
+
this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);
|
|
147
|
+
const correlationId = request.correlationId;
|
|
148
|
+
const parameterBuilder = new RequestParameterBuilder();
|
|
149
|
+
parameterBuilder.addClientId(request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
|
|
150
|
+
this.config.authOptions.clientId);
|
|
151
|
+
if (request.redirectUri) {
|
|
152
|
+
parameterBuilder.addRedirectUri(request.redirectUri);
|
|
153
|
+
}
|
|
154
|
+
parameterBuilder.addScopes(request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
|
|
155
|
+
parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);
|
|
156
|
+
parameterBuilder.addClientInfo();
|
|
157
|
+
parameterBuilder.addLibraryInfo(this.config.libraryInfo);
|
|
158
|
+
parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
|
|
159
|
+
parameterBuilder.addThrottling();
|
|
160
|
+
if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
|
|
161
|
+
parameterBuilder.addServerTelemetry(this.serverTelemetryManager);
|
|
162
|
+
}
|
|
163
|
+
parameterBuilder.addCorrelationId(correlationId);
|
|
164
|
+
parameterBuilder.addRefreshToken(request.refreshToken);
|
|
165
|
+
if (this.config.clientCredentials.clientSecret) {
|
|
166
|
+
parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
|
|
167
|
+
}
|
|
168
|
+
if (this.config.clientCredentials.clientAssertion) {
|
|
169
|
+
const clientAssertion = this.config.clientCredentials.clientAssertion;
|
|
170
|
+
parameterBuilder.addClientAssertion(clientAssertion.assertion);
|
|
171
|
+
parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
|
|
172
|
+
}
|
|
173
|
+
if (request.authenticationScheme === AuthenticationScheme.POP) {
|
|
174
|
+
const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
|
|
175
|
+
const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
|
|
176
|
+
// SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
|
|
177
|
+
parameterBuilder.addPopToken(reqCnfData.reqCnfString);
|
|
178
|
+
}
|
|
179
|
+
else if (request.authenticationScheme === AuthenticationScheme.SSH) {
|
|
180
|
+
if (request.sshJwk) {
|
|
181
|
+
parameterBuilder.addSshJwk(request.sshJwk);
|
|
182
|
+
}
|
|
183
|
+
else {
|
|
184
|
+
throw createClientConfigurationError(missingSshJwk);
|
|
185
|
+
}
|
|
186
|
+
}
|
|
187
|
+
if (!StringUtils.isEmptyObj(request.claims) ||
|
|
188
|
+
(this.config.authOptions.clientCapabilities &&
|
|
189
|
+
this.config.authOptions.clientCapabilities.length > 0)) {
|
|
190
|
+
parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
|
|
191
|
+
}
|
|
192
|
+
if (this.config.systemOptions.preventCorsPreflight &&
|
|
193
|
+
request.ccsCredential) {
|
|
194
|
+
switch (request.ccsCredential.type) {
|
|
195
|
+
case CcsCredentialType.HOME_ACCOUNT_ID:
|
|
196
|
+
try {
|
|
197
|
+
const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);
|
|
198
|
+
parameterBuilder.addCcsOid(clientInfo);
|
|
199
|
+
}
|
|
200
|
+
catch (e) {
|
|
201
|
+
this.logger.verbose("Could not parse home account ID for CCS Header: " +
|
|
202
|
+
e);
|
|
203
|
+
}
|
|
204
|
+
break;
|
|
205
|
+
case CcsCredentialType.UPN:
|
|
206
|
+
parameterBuilder.addCcsUpn(request.ccsCredential.credential);
|
|
207
|
+
break;
|
|
208
|
+
}
|
|
209
|
+
}
|
|
210
|
+
if (request.tokenBodyParameters) {
|
|
211
|
+
parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
|
|
212
|
+
}
|
|
213
|
+
return parameterBuilder.createQueryString();
|
|
214
|
+
}
|
|
209
215
|
}
|
|
210
216
|
|
|
211
217
|
export { RefreshTokenClient };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RefreshTokenClient.mjs","sources":["../../src/client/RefreshTokenClient.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAKA;AAIA;AACA;AAYA;
|
|
1
|
+
{"version":3,"file":"RefreshTokenClient.mjs","sources":["../../src/client/RefreshTokenClient.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAKA;AAIA;AACA;AAYA;AAsKO;;AA+DH;;;;AAIG,QAAA,KAAA,CAAA,aAAA,EAAA,iBAAA,CAAA,CAAA;;AAwDH,IAAA,MAAA,YAAA,CAAA,OAAA,EAAA;;;AAGG,QAAA,MAAA,QAAA,GAAA,MAAA,WAAA,CAAA,IAAA,CAAA,mBAAA,CAAA,IAAA,CAAA,IAAA,CAAA,EAAA,iBAAA,CAAA,qCAAA,EAAA,IAAA,CAAA,MAAA,EAAA,IAAA,CAAA,iBAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA,OAAA,EAAA,IAAA,CAAA,SAAA,CAAA,CAAA;;AAiIN,QAAA,MAAA,SAAA,GAAA,QAAA,CAAA,OAAA,GAAA,WAAA,CAAA,eAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
|
|
@@ -1,28 +1,28 @@
|
|
|
1
|
-
import { BaseClient } from "./BaseClient";
|
|
2
|
-
import { ClientConfiguration } from "../config/ClientConfiguration";
|
|
3
|
-
import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest";
|
|
4
|
-
import { AuthenticationResult } from "../response/AuthenticationResult";
|
|
5
|
-
import { CacheOutcome } from "../utils/Constants";
|
|
6
|
-
import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
|
|
7
|
-
/** @internal */
|
|
8
|
-
export declare class SilentFlowClient extends BaseClient {
|
|
9
|
-
constructor(configuration: ClientConfiguration, performanceClient?: IPerformanceClient);
|
|
10
|
-
/**
|
|
11
|
-
* Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
|
|
12
|
-
* the given token and returns the renewed token
|
|
13
|
-
* @param request
|
|
14
|
-
*/
|
|
15
|
-
acquireToken(request: CommonSilentFlowRequest): Promise<AuthenticationResult>;
|
|
16
|
-
/**
|
|
17
|
-
* Retrieves token from cache or throws an error if it must be refreshed.
|
|
18
|
-
* @param request
|
|
19
|
-
*/
|
|
20
|
-
acquireCachedToken(request: CommonSilentFlowRequest): Promise<[AuthenticationResult, CacheOutcome]>;
|
|
21
|
-
private setCacheOutcome;
|
|
22
|
-
/**
|
|
23
|
-
* Helper function to build response object from the CacheRecord
|
|
24
|
-
* @param cacheRecord
|
|
25
|
-
*/
|
|
26
|
-
private generateResultFromCacheRecord;
|
|
27
|
-
}
|
|
1
|
+
import { BaseClient } from "./BaseClient";
|
|
2
|
+
import { ClientConfiguration } from "../config/ClientConfiguration";
|
|
3
|
+
import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest";
|
|
4
|
+
import { AuthenticationResult } from "../response/AuthenticationResult";
|
|
5
|
+
import { CacheOutcome } from "../utils/Constants";
|
|
6
|
+
import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
|
|
7
|
+
/** @internal */
|
|
8
|
+
export declare class SilentFlowClient extends BaseClient {
|
|
9
|
+
constructor(configuration: ClientConfiguration, performanceClient?: IPerformanceClient);
|
|
10
|
+
/**
|
|
11
|
+
* Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew
|
|
12
|
+
* the given token and returns the renewed token
|
|
13
|
+
* @param request
|
|
14
|
+
*/
|
|
15
|
+
acquireToken(request: CommonSilentFlowRequest): Promise<AuthenticationResult>;
|
|
16
|
+
/**
|
|
17
|
+
* Retrieves token from cache or throws an error if it must be refreshed.
|
|
18
|
+
* @param request
|
|
19
|
+
*/
|
|
20
|
+
acquireCachedToken(request: CommonSilentFlowRequest): Promise<[AuthenticationResult, CacheOutcome]>;
|
|
21
|
+
private setCacheOutcome;
|
|
22
|
+
/**
|
|
23
|
+
* Helper function to build response object from the CacheRecord
|
|
24
|
+
* @param cacheRecord
|
|
25
|
+
*/
|
|
26
|
+
private generateResultFromCacheRecord;
|
|
27
|
+
}
|
|
28
28
|
//# sourceMappingURL=SilentFlowClient.d.ts.map
|