@azure/msal-common 14.4.0 → 14.4.1-beta.0

package/src/cache/entities/RefreshTokenEntity.ts

@@ -8,4 +8,6 @@ import { CredentialEntity } from "./CredentialEntity";
 /**
  * Refresh Token Cache Type
  */
-export type RefreshTokenEntity = CredentialEntity;
+export type RefreshTokenEntity = CredentialEntity & {
+    expiresOn?: string;
+};

package/src/cache/utils/CacheHelpers.ts

@@ -168,7 +168,8 @@ export function createRefreshTokenEntity(
     refreshToken: string,
     clientId: string,
     familyId?: string,
-    userAssertionHash?: string
+    userAssertionHash?: string,
+    expiresOn?: string
 ): RefreshTokenEntity {
     const rtEntity: RefreshTokenEntity = {
         credentialType: CredentialType.REFRESH_TOKEN,
@@ -186,6 +187,10 @@ export function createRefreshTokenEntity(
         rtEntity.familyId = familyId;
     }
 
+    if (expiresOn) {
+        rtEntity.expiresOn = expiresOn;
+    }
+
     return rtEntity;
 }
 

package/src/client/AuthorizationCodeClient.ts

@@ -161,7 +161,8 @@ export class AuthorizationCodeClient extends BaseClient {
             undefined,
             undefined,
             undefined,
-            requestId
+            requestId,
+            (TimeUtils.nowSeconds() + 24 * 60 * 60).toString()
         );
     }
 

package/src/client/RefreshTokenClient.ts

@@ -102,7 +102,8 @@ export class RefreshTokenClient extends BaseClient {
             undefined,
             true,
             request.forceCache,
-            requestId
+            requestId,
+            request.expiresOn
         );
     }
 
@@ -215,6 +216,16 @@ export class RefreshTokenClient extends BaseClient {
                 InteractionRequiredAuthErrorCodes.noTokensFound
             );
         }
+
+        if (
+            request.enableRTExpiryCheck &&
+            refreshToken.expiresOn &&
+            Number(refreshToken.expiresOn) < TimeUtils.nowSeconds() + 5 * 60
+        ) {
+            throw createInteractionRequiredAuthError(
+                InteractionRequiredAuthErrorCodes.refreshTokenExpired
+            );
+        }
         // attach cached RT size to the current measurement
 
         const refreshTokenRequest: CommonRefreshTokenRequest = {
@@ -226,6 +237,7 @@ export class RefreshTokenClient extends BaseClient {
                 credential: request.account.homeAccountId,
                 type: CcsCredentialType.HOME_ACCOUNT_ID,
             },
+            expiresOn: refreshToken.expiresOn,
         };
 
         return invokeAsync(

package/src/error/InteractionRequiredAuthError.ts

@@ -28,6 +28,8 @@ export const InteractionRequiredAuthSubErrorMessage = [
 const InteractionRequiredAuthErrorMessages = {
     [InteractionRequiredAuthErrorCodes.noTokensFound]:
         "No refresh token found in the cache. Please sign-in.",
+    [InteractionRequiredAuthErrorCodes.refreshTokenExpired]:
+        "Refresh token has expired.",
     [InteractionRequiredAuthErrorCodes.nativeAccountUnavailable]:
         "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
 };

package/src/error/InteractionRequiredAuthErrorCodes.ts

@@ -6,6 +6,7 @@
 // Codes defined by MSAL
 export const noTokensFound = "no_tokens_found";
 export const nativeAccountUnavailable = "native_account_unavailable";
+export const refreshTokenExpired = "refresh_token_expired";
 
 // Codes potentially returned by server
 export const interactionRequired = "interaction_required";

package/src/request/CommonRefreshTokenRequest.ts

@@ -21,6 +21,7 @@ import { StringDict } from "../utils/MsalTypes";
  */
 export type CommonRefreshTokenRequest = BaseAuthRequest & {
     refreshToken: string;
+    expiresOn?: string;
     ccsCredential?: CcsCredential;
     forceCache?: boolean;
     tokenBodyParameters?: StringDict;

package/src/request/CommonSilentFlowRequest.ts

@@ -23,4 +23,5 @@ export type CommonSilentFlowRequest = BaseAuthRequest & {
     account: AccountInfo;
     forceRefresh: boolean;
     tokenBodyParameters?: StringDict;
+    enableRTExpiryCheck?: boolean;
 };

package/src/response/ResponseHandler.ts

@@ -245,7 +245,8 @@ export class ResponseHandler {
         userAssertionHash?: string,
         handlingRefreshTokenResponse?: boolean,
         forceCacheRefreshTokenResponse?: boolean,
-        serverRequestId?: string
+        serverRequestId?: string,
+        rtExpiresOn?: string
     ): Promise<AuthenticationResult> {
         this.performanceClient?.addQueueMeasurement(
             PerformanceEvents.HandleServerTokenResponse,
@@ -311,7 +312,8 @@ export class ResponseHandler {
             request,
             idTokenClaims,
             userAssertionHash,
-            authCodePayload
+            authCodePayload,
+            rtExpiresOn
         );
         let cacheContext;
         try {
@@ -397,7 +399,8 @@ export class ResponseHandler {
         request: BaseAuthRequest,
         idTokenClaims?: TokenClaims,
         userAssertionHash?: string,
-        authCodePayload?: AuthorizationCodePayload
+        authCodePayload?: AuthorizationCodePayload,
+        rtExpiresOn?: string
     ): CacheRecord {
         const env = authority.getPreferredCache();
         if (!env) {
@@ -491,7 +494,8 @@ export class ResponseHandler {
                 serverTokenResponse.refresh_token,
                 this.clientId,
                 serverTokenResponse.foci,
-                userAssertionHash
+                userAssertionHash,
+                rtExpiresOn
             );
         }