@azure/msal-common 14.4.1-beta.0 → 14.5.0

package/package.json

@@ -1,95 +1,96 @@
 {
-    "name": "@azure/msal-common",
-    "author": {
-        "name": "Microsoft",
-        "email": "nugetaad@microsoft.com",
-        "url": "https://www.microsoft.com"
+  "name": "@azure/msal-common",
+  "author": {
+    "name": "Microsoft",
+    "email": "nugetaad@microsoft.com",
+    "url": "https://www.microsoft.com"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
+  },
+  "version": "14.5.0",
+  "description": "Microsoft Authentication Library for js",
+  "keywords": [
+    "implicit",
+    "authorization code",
+    "PKCE",
+    "js",
+    "AAD",
+    "msal",
+    "oauth"
+  ],
+  "sideEffects": false,
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "module": "./dist/index.mjs",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.mjs"
     },
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
-    },
-    "version": "14.4.1-beta.0",
-    "description": "Microsoft Authentication Library for js",
-    "keywords": [
-        "implicit",
-        "authorization code",
-        "PKCE",
-        "js",
-        "AAD",
-        "msal",
-        "oauth"
-    ],
-    "sideEffects": false,
-    "module": "./dist/index.mjs",
-    "types": "./dist/index.d.ts",
-    "exports": {
-        ".": {
-            "types": "./dist/index.d.ts",
-            "module": "./dist/index.mjs",
-            "import": "./dist/index.mjs",
-            "require": "./dist/index.cjs",
-            "default": "./dist/index.mjs"
-        },
-        "./package.json": "./package.json"
-    },
-    "engines": {
-        "node": ">=0.8.0"
-    },
-    "directories": {
-        "test": "test"
-    },
-    "files": [
-        "dist",
-        "src"
-    ],
-    "scripts": {
-        "clean": "shx rm -rf dist lib",
-        "clean:coverage": "rimraf ../../.nyc_output/*",
-        "lint": "eslint src --ext .ts",
-        "lint:fix": "npm run lint -- --fix",
-        "test": "jest",
-        "test:coverage": "jest --coverage",
-        "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
-        "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
-        "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
-        "build": "npm run clean && npm run build:modules",
-        "build:all": "npm run build",
-        "prepack": "npm run build",
-        "metadata:check": "ts-node scripts/metadata.ts",
-        "format:check": "npx prettier --ignore-path .gitignore --check src test",
-        "format:fix": "npx prettier --ignore-path .gitignore --write src test"
-    },
-    "beachball": {
-        "disallowedChangeTypes": [
-            "major"
-        ]
-    },
-    "devDependencies": {
-        "@babel/core": "^7.7.2",
-        "@babel/plugin-proposal-class-properties": "^7.7.0",
-        "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
-        "@babel/preset-env": "^7.7.1",
-        "@babel/preset-typescript": "^7.7.2",
-        "@rollup/plugin-typescript": "^11.0.0",
-        "@types/debug": "^4.1.5",
-        "@types/jest": "^29.5.0",
-        "@types/lodash": "^4.14.182",
-        "@types/node": "^20.3.1",
-        "@types/sinon": "^7.5.0",
-        "eslint-config-msal": "^0.0.0",
-        "jest": "^29.5.0",
-        "lodash": "^4.17.21",
-        "prettier": "2.8.7",
-        "rimraf": "^3.0.2",
-        "rollup": "^3.14.0",
-        "shx": "^0.3.2",
-        "sinon": "^7.5.0",
-        "ts-jest": "^29.1.0",
-        "ts-node": "^10.9.1",
-        "tslib": "^1.10.0",
-        "typescript": "^4.9.5",
-        "yargs": "^17.5.1"
-    }
+    "./package.json": "./package.json"
+  },
+  "engines": {
+    "node": ">=0.8.0"
+  },
+  "directories": {
+    "test": "test"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "scripts": {
+    "clean": "shx rm -rf dist lib",
+    "clean:coverage": "rimraf ../../.nyc_output/*",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "npm run lint -- --fix",
+    "test": "jest",
+    "test:coverage": "jest --coverage",
+    "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
+    "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
+    "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
+    "build": "npm run clean && npm run build:modules",
+    "build:all": "npm run build",
+    "prepack": "npm run build",
+    "metadata:check": "ts-node scripts/metadata.ts",
+    "format:check": "npx prettier --ignore-path .gitignore --check src test",
+    "format:fix": "npx prettier --ignore-path .gitignore --write src test"
+  },
+  "beachball": {
+    "disallowedChangeTypes": [
+      "major"
+    ]
+  },
+  "devDependencies": {
+    "@babel/core": "^7.7.2",
+    "@babel/plugin-proposal-class-properties": "^7.7.0",
+    "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
+    "@babel/preset-env": "^7.7.1",
+    "@babel/preset-typescript": "^7.7.2",
+    "@rollup/plugin-typescript": "^11.0.0",
+    "@types/debug": "^4.1.5",
+    "@types/jest": "^29.5.0",
+    "@types/lodash": "^4.14.182",
+    "@types/node": "^20.3.1",
+    "@types/sinon": "^7.5.0",
+    "eslint-config-msal": "^0.0.0",
+    "msal-test-utils": "^0.0.1",
+    "jest": "^29.5.0",
+    "lodash": "^4.17.21",
+    "prettier": "2.8.7",
+    "rimraf": "^3.0.2",
+    "rollup": "^3.14.0",
+    "shx": "^0.3.2",
+    "sinon": "^7.5.0",
+    "ts-jest": "^29.1.0",
+    "ts-node": "^10.9.1",
+    "tslib": "^1.10.0",
+    "typescript": "^4.9.5",
+    "yargs": "^17.5.1"
+  }
 }

package/src/account/AccountInfo.ts

@@ -15,6 +15,7 @@ import { TokenClaims } from "./TokenClaims";
  * - idToken                - raw ID token
  * - idTokenClaims          - Object contains claims from ID token
  * - nativeAccountId        - The user's native account ID
+ * - tenantProfiles         - Map of tenant profile objects for each tenant that the account has authenticated with in the browser
  */
 export type AccountInfo = {
     homeAccountId: string;
@@ -35,9 +36,104 @@ export type AccountInfo = {
     };
     nativeAccountId?: string;
     authorityType?: string;
+    tenantProfiles?: Map<string, TenantProfile>;
+};
+
+/**
+ * Account details that vary across tenants for the same user
+ */
+export type TenantProfile = Pick<
+    AccountInfo,
+    "tenantId" | "localAccountId" | "name"
+> & {
+    /**
+     * - isHomeTenant           - True if this is the home tenant profile of the account, false if it's a guest tenant profile
+     */
+    isHomeTenant?: boolean;
 };
 
 export type ActiveAccountFilters = {
     homeAccountId: string;
     localAccountId: string;
+    tenantId?: string;
 };
+
+/**
+ * Returns true if tenantId matches the utid portion of homeAccountId
+ * @param tenantId
+ * @param homeAccountId
+ * @returns
+ */
+export function tenantIdMatchesHomeTenant(
+    tenantId?: string,
+    homeAccountId?: string
+): boolean {
+    return (
+        !!tenantId &&
+        !!homeAccountId &&
+        tenantId === homeAccountId.split(".")[1]
+    );
+}
+
+export function buildTenantProfileFromIdTokenClaims(
+    homeAccountId: string,
+    idTokenClaims: TokenClaims
+): TenantProfile {
+    const { oid, sub, tid, name, tfp, acr } = idTokenClaims;
+
+    /**
+     * Since there is no way to determine if the authority is AAD or B2C, we exhaust all the possible claims that can serve as tenant ID with the following precedence:
+     * tid - TenantID claim that identifies the tenant that issued the token in AAD. Expected in all AAD ID tokens, not present in B2C ID Tokens.
+     * tfp - Trust Framework Policy claim that identifies the policy that was used to authenticate the user. Functions as tenant for B2C scenarios.
+     * acr - Authentication Context Class Reference claim used only with older B2C policies. Fallback in case tfp is not present, but likely won't be present anyway.
+     */
+    const tenantId = tid || tfp || acr || "";
+
+    return {
+        tenantId: tenantId,
+        localAccountId: oid || sub || "",
+        name: name,
+        isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+    };
+}
+
+/**
+ * Replaces account info that varies by tenant profile sourced from the ID token claims passed in with the tenant-specific account info
+ * @param baseAccountInfo
+ * @param idTokenClaims
+ * @returns
+ */
+export function updateAccountTenantProfileData(
+    baseAccountInfo: AccountInfo,
+    tenantProfile?: TenantProfile,
+    idTokenClaims?: TokenClaims
+): AccountInfo {
+    let updatedAccountInfo = baseAccountInfo;
+    // Tenant Profile overrides passed in account info
+    if (tenantProfile) {
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { isHomeTenant, ...tenantProfileOverride } = tenantProfile;
+        updatedAccountInfo = { ...baseAccountInfo, ...tenantProfileOverride };
+    }
+
+    // ID token claims override passed in account info and tenant profile
+    if (idTokenClaims) {
+        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { isHomeTenant, ...claimsSourcedTenantProfile } =
+            buildTenantProfileFromIdTokenClaims(
+                baseAccountInfo.homeAccountId,
+                idTokenClaims
+            );
+
+        updatedAccountInfo = {
+            ...updatedAccountInfo,
+            ...claimsSourcedTenantProfile,
+            idTokenClaims: idTokenClaims,
+        };
+
+        return updatedAccountInfo;
+    }
+
+    return updatedAccountInfo;
+}

package/src/account/ClientInfo.ts

@@ -7,7 +7,6 @@ import {
     createClientAuthError,
     ClientAuthErrorCodes,
 } from "../error/ClientAuthError";
-import { ICrypto } from "../crypto/ICrypto";
 import { Separators, Constants } from "../utils/Constants";
 
 /**
@@ -25,14 +24,14 @@ export type ClientInfo = {
  */
 export function buildClientInfo(
     rawClientInfo: string,
-    crypto: ICrypto
+    base64Decode: (input: string) => string
 ): ClientInfo {
     if (!rawClientInfo) {
         throw createClientAuthError(ClientAuthErrorCodes.clientInfoEmptyError);
     }
 
     try {
-        const decodedClientInfo: string = crypto.base64Decode(rawClientInfo);
+        const decodedClientInfo: string = base64Decode(rawClientInfo);
         return JSON.parse(decodedClientInfo) as ClientInfo;
     } catch (e) {
         throw createClientAuthError(

package/src/account/TokenClaims.ts

@@ -35,6 +35,14 @@ export type TokenClaims = {
      * Users' tenant or '9188040d-6c67-4c5b-b112-36a304b66dad' for personal accounts.
      */
     tid?: string;
+    /**
+     * Trusted Framework Policy (B2C) The name of the policy that was used to acquire the ID token.
+     */
+    tfp?: string;
+    /**
+     * Authentication Context Class Reference (B2C) Used only with older policies.
+     */
+    acr?: string;
     ver?: string;
     upn?: string;
     preferred_username?: string;
@@ -68,3 +76,23 @@ export type TokenClaims = {
     tenant_region_scope?: string;
     tenant_region_sub_scope?: string;
 };
+
+/**
+ * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+ * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+ * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+ * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+ * Downcased to match the realm case-insensitive comparison requirements
+ * @param idTokenClaims
+ * @returns
+ */
+export function getTenantIdFromIdTokenClaims(
+    idTokenClaims?: TokenClaims
+): string | null {
+    if (idTokenClaims) {
+        const tenantId =
+            idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
+        return tenantId || null;
+    }
+    return null;
+}

package/src/authority/Authority.ts

@@ -1066,12 +1066,12 @@ export class Authority {
         const matches = this.authorityOptions.knownAuthorities.filter(
             (authority) => {
                 return (
+                    authority &&
                     UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                    this.hostnameAndPort
+                        this.hostnameAndPort
                 );
             }
         );
-
         return matches.length > 0;
     }
 
@@ -1253,6 +1253,33 @@ export class Authority {
     }
 }
 
+/**
+ * Extract tenantId from authority
+ */
+export function getTenantFromAuthorityString(
+    authority: string
+): string | undefined {
+    const authorityUrl = new UrlString(authority);
+    const authorityUrlComponents = authorityUrl.getUrlComponents();
+    /**
+     * For credential matching purposes, tenantId is the last path segment of the authority URL:
+     *  AAD Authority - domain/tenantId -> Credentials are cached with realm = tenantId
+     *  B2C Authority - domain/{tenantId}?/.../policy -> Credentials are cached with realm = policy
+     *  tenantId is downcased because B2C policies can have mixed case but tfp claim is downcased
+     */
+    const tenantId =
+        authorityUrlComponents.PathSegments.slice(-1)[0].toLowerCase();
+
+    switch (tenantId) {
+        case AADAuthorityConstants.COMMON:
+        case AADAuthorityConstants.ORGANIZATIONS:
+        case AADAuthorityConstants.CONSUMERS:
+            return undefined;
+        default:
+            return tenantId;
+    }
+}
+
 export function formatAuthorityUri(authorityUri: string): string {
     return authorityUri.endsWith(Constants.FORWARD_SLASH)
         ? authorityUri