@azure/msal-common 14.4.1-beta.0 → 14.5.0

package/src/cache/entities/AccountEntity.ts

@@ -3,18 +3,25 @@
  * Licensed under the MIT License.
  */
 
-import { Separators, CacheAccountType, Constants } from "../../utils/Constants";
+import { CacheAccountType, Separators } from "../../utils/Constants";
 import { Authority } from "../../authority/Authority";
 import { ICrypto } from "../../crypto/ICrypto";
-import { buildClientInfo } from "../../account/ClientInfo";
-import { AccountInfo } from "../../account/AccountInfo";
+import { ClientInfo, buildClientInfo } from "../../account/ClientInfo";
+import {
+    AccountInfo,
+    TenantProfile,
+    buildTenantProfileFromIdTokenClaims,
+} from "../../account/AccountInfo";
 import {
     createClientAuthError,
     ClientAuthErrorCodes,
 } from "../../error/ClientAuthError";
 import { AuthorityType } from "../../authority/AuthorityType";
 import { Logger } from "../../logger/Logger";
-import { TokenClaims } from "../../account/TokenClaims";
+import {
+    TokenClaims,
+    getTenantIdFromIdTokenClaims,
+} from "../../account/TokenClaims";
 import { ProtocolMode } from "../../authority/ProtocolMode";
 
 /**
@@ -35,8 +42,8 @@ import { ProtocolMode } from "../../authority/ProtocolMode";
  *      name: Full name for the account, including given name and family name,
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
- *      idTokenClaims: Object containing claims parsed from ID token
  *      nativeAccountId: Account identifier on the native device
+ *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
  * }
  * @internal
  */
@@ -53,8 +60,8 @@ export class AccountEntity {
     lastModificationApp?: string;
     cloudGraphHostName?: string;
     msGraphHost?: string;
-    idTokenClaims?: TokenClaims;
     nativeAccountId?: string;
+    tenantProfiles?: Array<TenantProfile>;
 
     /**
      * Generate Account Id key component as per the schema: <home_account_id>-<environment>
@@ -88,21 +95,34 @@ export class AccountEntity {
             username: this.username,
             localAccountId: this.localAccountId,
             name: this.name,
-            idTokenClaims: this.idTokenClaims,
             nativeAccountId: this.nativeAccountId,
             authorityType: this.authorityType,
+            // Deserialize tenant profiles array into a Map
+            tenantProfiles: new Map(
+                (this.tenantProfiles || []).map((tenantProfile) => {
+                    return [tenantProfile.tenantId, tenantProfile];
+                })
+            ),
         };
     }
 
+    /**
+     * Returns true if the account entity is in single tenant format (outdated), false otherwise
+     */
+    isSingleTenant(): boolean {
+        return !this.tenantProfiles;
+    }
+
     /**
      * Generates account key from interface
      * @param accountInterface
      */
     static generateAccountCacheKey(accountInterface: AccountInfo): string {
+        const homeTenantId = accountInterface.homeAccountId.split(".")[1];
         const accountKey = [
             accountInterface.homeAccountId,
-            accountInterface.environment || Constants.EMPTY_STRING,
-            accountInterface.tenantId || Constants.EMPTY_STRING,
+            accountInterface.environment || "",
+            homeTenantId || accountInterface.tenantId || "",
         ];
 
         return accountKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
@@ -121,8 +141,10 @@ export class AccountEntity {
             msGraphHost?: string;
             environment?: string;
             nativeAccountId?: string;
+            tenantProfiles?: Array<TenantProfile>;
         },
-        authority: Authority
+        authority: Authority,
+        base64Decode?: (input: string) => string
     ): AccountEntity {
         const account: AccountEntity = new AccountEntity();
 
@@ -134,6 +156,15 @@ export class AccountEntity {
             account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
         }
 
+        let clientInfo: ClientInfo | undefined;
+
+        if (accountDetails.clientInfo && base64Decode) {
+            clientInfo = buildClientInfo(
+                accountDetails.clientInfo,
+                base64Decode
+            );
+        }
+
         account.clientInfo = accountDetails.clientInfo;
         account.homeAccountId = accountDetails.homeAccountId;
         account.nativeAccountId = accountDetails.nativeAccountId;
@@ -151,13 +182,16 @@ export class AccountEntity {
         account.environment = env;
         // non AAD scenarios can have empty realm
         account.realm =
-            accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
+            clientInfo?.utid ||
+            getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+            "";
 
         // How do you account for MSA CID here?
         account.localAccountId =
+            clientInfo?.uid ||
             accountDetails.idTokenClaims.oid ||
             accountDetails.idTokenClaims.sub ||
-            Constants.EMPTY_STRING;
+            "";
 
         /*
          * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
@@ -171,12 +205,26 @@ export class AccountEntity {
             ? accountDetails.idTokenClaims.emails[0]
             : null;
 
-        account.username = preferredUsername || email || Constants.EMPTY_STRING;
+        account.username = preferredUsername || email || "";
         account.name = accountDetails.idTokenClaims.name;
 
         account.cloudGraphHostName = accountDetails.cloudGraphHostName;
         account.msGraphHost = accountDetails.msGraphHost;
 
+        if (accountDetails.tenantProfiles) {
+            account.tenantProfiles = accountDetails.tenantProfiles;
+        } else {
+            const tenantProfiles = [];
+            if (accountDetails.idTokenClaims) {
+                const tenantProfile = buildTenantProfileFromIdTokenClaims(
+                    accountDetails.homeAccountId,
+                    accountDetails.idTokenClaims
+                );
+                tenantProfiles.push(tenantProfile);
+            }
+            account.tenantProfiles = tenantProfiles;
+        }
+
         return account;
     }
 
@@ -208,6 +256,10 @@ export class AccountEntity {
 
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;
+        // Serialize tenant profiles map into an array
+        account.tenantProfiles = Array.from(
+            accountInfo.tenantProfiles?.values() || []
+        );
 
         return account;
     }
@@ -224,31 +276,30 @@ export class AccountEntity {
         cryptoObj: ICrypto,
         idTokenClaims?: TokenClaims
     ): string {
-        const accountId = idTokenClaims?.sub
-            ? idTokenClaims.sub
-            : Constants.EMPTY_STRING;
-
-        // since ADFS does not have tid and does not set client_info
+        // since ADFS/DSTS do not have tid and does not set client_info
         if (
-            authType === AuthorityType.Adfs ||
-            authType === AuthorityType.Dsts
+            !(
+                authType === AuthorityType.Adfs ||
+                authType === AuthorityType.Dsts
+            )
         ) {
-            return accountId;
-        }
-
-        // for cases where there is clientInfo
-        if (serverClientInfo) {
-            try {
-                const clientInfo = buildClientInfo(serverClientInfo, cryptoObj);
-                if (clientInfo.uid && clientInfo.utid) {
-                    return `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`;
-                }
-            } catch (e) {}
+            // for cases where there is clientInfo
+            if (serverClientInfo) {
+                try {
+                    const clientInfo = buildClientInfo(
+                        serverClientInfo,
+                        cryptoObj.base64Decode
+                    );
+                    if (clientInfo.uid && clientInfo.utid) {
+                        return `${clientInfo.uid}.${clientInfo.utid}`;
+                    }
+                } catch (e) {}
+            }
+            logger.warning("No client info in response");
         }
 
         // default to "sub" claim
-        logger.verbose("No client info in response");
-        return accountId;
+        return idTokenClaims?.sub || "";
     }
 
     /**

package/src/cache/entities/RefreshTokenEntity.ts

@@ -8,6 +8,4 @@ import { CredentialEntity } from "./CredentialEntity";
 /**
  * Refresh Token Cache Type
  */
-export type RefreshTokenEntity = CredentialEntity & {
-    expiresOn?: string;
-};
+export type RefreshTokenEntity = CredentialEntity;

package/src/cache/utils/CacheHelpers.ts

@@ -168,8 +168,7 @@ export function createRefreshTokenEntity(
     refreshToken: string,
     clientId: string,
     familyId?: string,
-    userAssertionHash?: string,
-    expiresOn?: string
+    userAssertionHash?: string
 ): RefreshTokenEntity {
     const rtEntity: RefreshTokenEntity = {
         credentialType: CredentialType.REFRESH_TOKEN,
@@ -187,10 +186,6 @@ export function createRefreshTokenEntity(
         rtEntity.familyId = familyId;
     }
 
-    if (expiresOn) {
-        rtEntity.expiresOn = expiresOn;
-    }
-
     return rtEntity;
 }
 

package/src/cache/utils/CacheTypes.ts

@@ -60,8 +60,19 @@ export type AccountFilter = Omit<
     realm?: string;
     loginHint?: string;
     sid?: string;
+    isHomeTenant?: boolean;
 };
 
+export type TenantProfileFilter = Pick<
+    AccountFilter,
+    | "localAccountId"
+    | "loginHint"
+    | "name"
+    | "sid"
+    | "isHomeTenant"
+    | "username"
+>;
+
 /**
  * Credential: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme*>
  */

package/src/client/AuthorizationCodeClient.ts

@@ -13,9 +13,9 @@ import {
     AuthenticationScheme,
     PromptValue,
     Separators,
-    AADServerParamKeys,
     HeaderNames,
 } from "../utils/Constants";
+import * as AADServerParamKeys from "../constants/AADServerParamKeys";
 import {
     ClientConfiguration,
     isOidcProtocolMode,
@@ -161,8 +161,7 @@ export class AuthorizationCodeClient extends BaseClient {
             undefined,
             undefined,
             undefined,
-            requestId,
-            (TimeUtils.nowSeconds() + 24 * 60 * 60).toString()
+            requestId
         );
     }
 
@@ -255,7 +254,7 @@ export class AuthorizationCodeClient extends BaseClient {
             try {
                 const clientInfo = buildClientInfo(
                     request.clientInfo,
-                    this.cryptoUtils
+                    this.cryptoUtils.base64Decode
                 );
                 ccsCredential = {
                     credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
@@ -422,7 +421,7 @@ export class AuthorizationCodeClient extends BaseClient {
             try {
                 const clientInfo = buildClientInfo(
                     request.clientInfo,
-                    this.cryptoUtils
+                    this.cryptoUtils.base64Decode
                 );
                 ccsCred = {
                     credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,

package/src/client/RefreshTokenClient.ts

@@ -17,8 +17,8 @@ import {
     AuthenticationScheme,
     Errors,
     HeaderNames,
-    AADServerParamKeys,
 } from "../utils/Constants";
+import * as AADServerParamKeys from "../constants/AADServerParamKeys";
 import { ResponseHandler } from "../response/ResponseHandler";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { PopTokenGenerator } from "../crypto/PopTokenGenerator";
@@ -102,8 +102,7 @@ export class RefreshTokenClient extends BaseClient {
             undefined,
             true,
             request.forceCache,
-            requestId,
-            request.expiresOn
+            requestId
         );
     }
 
@@ -141,7 +140,7 @@ export class RefreshTokenClient extends BaseClient {
         // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
         if (isFOCI) {
             try {
-                return invokeAsync(
+                return await invokeAsync(
                     this.acquireTokenWithCachedRefreshToken.bind(this),
                     PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken,
                     this.logger,
@@ -216,16 +215,6 @@ export class RefreshTokenClient extends BaseClient {
                 InteractionRequiredAuthErrorCodes.noTokensFound
             );
         }
-
-        if (
-            request.enableRTExpiryCheck &&
-            refreshToken.expiresOn &&
-            Number(refreshToken.expiresOn) < TimeUtils.nowSeconds() + 5 * 60
-        ) {
-            throw createInteractionRequiredAuthError(
-                InteractionRequiredAuthErrorCodes.refreshTokenExpired
-            );
-        }
         // attach cached RT size to the current measurement
 
         const refreshTokenRequest: CommonRefreshTokenRequest = {
@@ -237,7 +226,6 @@ export class RefreshTokenClient extends BaseClient {
                 credential: request.account.homeAccountId,
                 type: CcsCredentialType.HOME_ACCOUNT_ID,
             },
-            expiresOn: refreshToken.expiresOn,
         };
 
         return invokeAsync(

package/src/client/SilentFlowClient.ts

@@ -231,7 +231,7 @@ export class SilentFlowClient extends BaseClient {
             checkMaxAge(authTime, request.maxAge);
         }
 
-        return await ResponseHandler.generateAuthenticationResult(
+        return ResponseHandler.generateAuthenticationResult(
             this.cryptoUtils,
             this.authority,
             cacheRecord,

package/src/constants/AADServerParamKeys.ts

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const CLIENT_ID = "client_id";
+export const REDIRECT_URI = "redirect_uri";
+export const RESPONSE_TYPE = "response_type";
+export const RESPONSE_MODE = "response_mode";
+export const GRANT_TYPE = "grant_type";
+export const CLAIMS = "claims";
+export const SCOPE = "scope";
+export const ERROR = "error";
+export const ERROR_DESCRIPTION = "error_description";
+export const ACCESS_TOKEN = "access_token";
+export const ID_TOKEN = "id_token";
+export const REFRESH_TOKEN = "refresh_token";
+export const EXPIRES_IN = "expires_in";
+export const STATE = "state";
+export const NONCE = "nonce";
+export const PROMPT = "prompt";
+export const SESSION_STATE = "session_state";
+export const CLIENT_INFO = "client_info";
+export const CODE = "code";
+export const CODE_CHALLENGE = "code_challenge";
+export const CODE_CHALLENGE_METHOD = "code_challenge_method";
+export const CODE_VERIFIER = "code_verifier";
+export const CLIENT_REQUEST_ID = "client-request-id";
+export const X_CLIENT_SKU = "x-client-SKU";
+export const X_CLIENT_VER = "x-client-VER";
+export const X_CLIENT_OS = "x-client-OS";
+export const X_CLIENT_CPU = "x-client-CPU";
+export const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
+export const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
+export const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
+export const X_APP_NAME = "x-app-name";
+export const X_APP_VER = "x-app-ver";
+export const POST_LOGOUT_URI = "post_logout_redirect_uri";
+export const ID_TOKEN_HINT = "id_token_hint";
+export const DEVICE_CODE = "device_code";
+export const CLIENT_SECRET = "client_secret";
+export const CLIENT_ASSERTION = "client_assertion";
+export const CLIENT_ASSERTION_TYPE = "client_assertion_type";
+export const TOKEN_TYPE = "token_type";
+export const REQ_CNF = "req_cnf";
+export const OBO_ASSERTION = "assertion";
+export const REQUESTED_TOKEN_USE = "requested_token_use";
+export const ON_BEHALF_OF = "on_behalf_of";
+export const FOCI = "foci";
+export const CCS_HEADER = "X-AnchorMailbox";
+export const RETURN_SPA_CODE = "return_spa_code";
+export const NATIVE_BROKER = "nativebroker";
+export const LOGOUT_HINT = "logout_hint";
+export const SID = "sid";
+export const LOGIN_HINT = "login_hint";
+export const DOMAIN_HINT = "domain_hint";

package/src/crypto/PopTokenGenerator.ts

@@ -140,7 +140,7 @@ export class PopTokenGenerator {
             ? new UrlString(resourceRequestUri)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
-        return await this.cryptoUtils.signJwt(
+        return this.cryptoUtils.signJwt(
             {
                 at: payload,
                 ts: TimeUtils.nowSeconds(),

package/src/error/InteractionRequiredAuthError.ts

@@ -28,8 +28,6 @@ export const InteractionRequiredAuthSubErrorMessage = [
 const InteractionRequiredAuthErrorMessages = {
     [InteractionRequiredAuthErrorCodes.noTokensFound]:
         "No refresh token found in the cache. Please sign-in.",
-    [InteractionRequiredAuthErrorCodes.refreshTokenExpired]:
-        "Refresh token has expired.",
     [InteractionRequiredAuthErrorCodes.nativeAccountUnavailable]:
         "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
 };

package/src/error/InteractionRequiredAuthErrorCodes.ts

@@ -6,7 +6,6 @@
 // Codes defined by MSAL
 export const noTokensFound = "no_tokens_found";
 export const nativeAccountUnavailable = "native_account_unavailable";
-export const refreshTokenExpired = "refresh_token_expired";
 
 // Codes potentially returned by server
 export const interactionRequired = "interaction_required";

package/src/index.ts

@@ -28,9 +28,19 @@ export {
 } from "./config/AppTokenProvider";
 export { ClientConfiguration } from "./config/ClientConfiguration";
 // Account
-export { AccountInfo, ActiveAccountFilters } from "./account/AccountInfo";
+export {
+    AccountInfo,
+    ActiveAccountFilters,
+    TenantProfile,
+    updateAccountTenantProfileData,
+    tenantIdMatchesHomeTenant,
+    buildTenantProfileFromIdTokenClaims,
+} from "./account/AccountInfo";
 export * as AuthToken from "./account/AuthToken";
-export { TokenClaims } from "./account/TokenClaims";
+export {
+    TokenClaims,
+    getTenantIdFromIdTokenClaims,
+} from "./account/TokenClaims";
 export { TokenClaims as IdTokenClaims } from "./account/TokenClaims";
 export { CcsCredential, CcsCredentialType } from "./account/CcsCredential";
 export {
@@ -136,7 +146,10 @@ export {
     DeviceCodeResponse,
     ServerDeviceCodeResponse,
 } from "./response/DeviceCodeResponse";
-export { ResponseHandler } from "./response/ResponseHandler";
+export {
+    ResponseHandler,
+    buildAccountToCache,
+} from "./response/ResponseHandler";
 export { ScopeSet } from "./request/ScopeSet";
 export { AuthenticationHeaderParser } from "./request/AuthenticationHeaderParser";
 // Logger Callback
@@ -181,12 +194,10 @@ export {
     CacheAccountType,
     AuthenticationScheme,
     CodeChallengeMethodValues,
-    SSOTypes,
     PasswordGrantConstants,
     ThrottlingConstants,
     ClaimsRequestKeys,
     HeaderNames,
-    AADServerParamKeys,
     Errors,
     THE_FAMILY_ID,
     ONE_DAY_IN_MS,
@@ -195,6 +206,7 @@ export {
     HttpStatus,
     JsonWebTokenTypes,
 } from "./utils/Constants";
+export * as AADServerParamKeys from "./constants/AADServerParamKeys";
 export { StringUtils } from "./utils/StringUtils";
 export { StringDict } from "./utils/MsalTypes";
 export {

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.4.0";
+export const version = "14.5.0";

package/src/request/CommonRefreshTokenRequest.ts

@@ -21,7 +21,6 @@ import { StringDict } from "../utils/MsalTypes";
  */
 export type CommonRefreshTokenRequest = BaseAuthRequest & {
     refreshToken: string;
-    expiresOn?: string;
     ccsCredential?: CcsCredential;
     forceCache?: boolean;
     tokenBodyParameters?: StringDict;

package/src/request/CommonSilentFlowRequest.ts

@@ -23,5 +23,4 @@ export type CommonSilentFlowRequest = BaseAuthRequest & {
     account: AccountInfo;
     forceRefresh: boolean;
     tokenBodyParameters?: StringDict;
-    enableRTExpiryCheck?: boolean;
 };

package/src/request/RequestParameterBuilder.ts

@@ -4,10 +4,8 @@
  */
 
 import {
-    AADServerParamKeys,
     Constants,
     ResponseMode,
-    SSOTypes,
     CLIENT_INFO,
     AuthenticationScheme,
     ClaimsRequestKeys,
@@ -16,6 +14,7 @@ import {
     ThrottlingConstants,
     HeaderNames,
 } from "../utils/Constants";
+import * as AADServerParamKeys from "../constants/AADServerParamKeys";
 import { ScopeSet } from "./ScopeSet";
 import {
     createClientConfigurationError,
@@ -161,7 +160,7 @@ export class RequestParameterBuilder {
      */
     addDomainHint(domainHint: string): void {
         this.parameters.set(
-            SSOTypes.DOMAIN_HINT,
+            AADServerParamKeys.DOMAIN_HINT,
             encodeURIComponent(domainHint)
         );
     }
@@ -171,7 +170,10 @@ export class RequestParameterBuilder {
      * @param loginHint
      */
     addLoginHint(loginHint: string): void {
-        this.parameters.set(SSOTypes.LOGIN_HINT, encodeURIComponent(loginHint));
+        this.parameters.set(
+            AADServerParamKeys.LOGIN_HINT,
+            encodeURIComponent(loginHint)
+        );
     }
 
     /**
@@ -201,7 +203,7 @@ export class RequestParameterBuilder {
      * @param sid
      */
     addSid(sid: string): void {
-        this.parameters.set(SSOTypes.SID, encodeURIComponent(sid));
+        this.parameters.set(AADServerParamKeys.SID, encodeURIComponent(sid));
     }
 
     /**