@azure/msal-common 14.4.1-beta.0 → 14.5.0

package/src/response/ResponseHandler.ts

@@ -42,8 +42,15 @@ import { BaseAuthRequest } from "../request/BaseAuthRequest";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { checkMaxAge, extractTokenClaims } from "../account/AuthToken";
-import { TokenClaims } from "../account/TokenClaims";
-import { AccountInfo } from "../account/AccountInfo";
+import {
+    TokenClaims,
+    getTenantIdFromIdTokenClaims,
+} from "../account/TokenClaims";
+import {
+    AccountInfo,
+    buildTenantProfileFromIdTokenClaims,
+    updateAccountTenantProfileData,
+} from "../account/AccountInfo";
 import * as CacheHelpers from "../cache/utils/CacheHelpers";
 
 /**
@@ -245,8 +252,7 @@ export class ResponseHandler {
         userAssertionHash?: string,
         handlingRefreshTokenResponse?: boolean,
         forceCacheRefreshTokenResponse?: boolean,
-        serverRequestId?: string,
-        rtExpiresOn?: string
+        serverRequestId?: string
     ): Promise<AuthenticationResult> {
         this.performanceClient?.addQueueMeasurement(
             PerformanceEvents.HandleServerTokenResponse,
@@ -312,8 +318,7 @@ export class ResponseHandler {
             request,
             idTokenClaims,
             userAssertionHash,
-            authCodePayload,
-            rtExpiresOn
+            authCodePayload
         );
         let cacheContext;
         try {
@@ -339,12 +344,12 @@ export class ResponseHandler {
                 cacheRecord.account
             ) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key);
+                const account = this.cacheStorage.getAccount(key, this.logger);
                 if (!account) {
                     this.logger.warning(
                         "Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache"
                     );
-                    return ResponseHandler.generateAuthenticationResult(
+                    return await ResponseHandler.generateAuthenticationResult(
                         this.cryptoObj,
                         authority,
                         cacheRecord,
@@ -373,6 +378,7 @@ export class ResponseHandler {
                 await this.persistencePlugin.afterCacheAccess(cacheContext);
             }
         }
+
         return ResponseHandler.generateAuthenticationResult(
             this.cryptoObj,
             authority,
@@ -399,8 +405,7 @@ export class ResponseHandler {
         request: BaseAuthRequest,
         idTokenClaims?: TokenClaims,
         userAssertionHash?: string,
-        authCodePayload?: AuthorizationCodePayload,
-        rtExpiresOn?: string
+        authCodePayload?: AuthorizationCodePayload
     ): CacheRecord {
         const env = authority.getPreferredCache();
         if (!env) {
@@ -409,6 +414,8 @@ export class ResponseHandler {
             );
         }
 
+        const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
+
         // IdToken: non AAD scenarios can have empty realm
         let cachedIdToken: IdTokenEntity | undefined;
         let cachedAccount: AccountEntity | undefined;
@@ -418,18 +425,20 @@ export class ResponseHandler {
                 env,
                 serverTokenResponse.id_token,
                 this.clientId,
-                idTokenClaims.tid || ""
+                claimsTenantId || ""
             );
 
-            cachedAccount = AccountEntity.createAccount(
-                {
-                    homeAccountId: this.homeAccountIdentifier,
-                    idTokenClaims: idTokenClaims,
-                    clientInfo: serverTokenResponse.client_info,
-                    cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
-                    msGraphHost: authCodePayload?.msgraph_host,
-                },
-                authority
+            cachedAccount = buildAccountToCache(
+                this.cacheStorage,
+                authority,
+                this.homeAccountIdentifier,
+                idTokenClaims,
+                this.cryptoObj.base64Decode,
+                serverTokenResponse.client_info,
+                claimsTenantId,
+                authCodePayload,
+                undefined,
+                this.logger
             );
         }
 
@@ -471,7 +480,7 @@ export class ResponseHandler {
                 env,
                 serverTokenResponse.access_token,
                 this.clientId,
-                idTokenClaims?.tid || authority.tenant,
+                claimsTenantId || authority.tenant,
                 responseScopes.printScopes(),
                 tokenExpirationSeconds,
                 extendedTokenExpirationSeconds,
@@ -494,8 +503,7 @@ export class ResponseHandler {
                 serverTokenResponse.refresh_token,
                 this.clientId,
                 serverTokenResponse.foci,
-                userAssertionHash,
-                rtExpiresOn
+                userAssertionHash
             );
         }
 
@@ -600,10 +608,11 @@ export class ResponseHandler {
         }
 
         const accountInfo: AccountInfo | null = cacheRecord.account
-            ? {
-                  ...cacheRecord.account.getAccountInfo(),
-                  idTokenClaims,
-              }
+            ? updateAccountTenantProfileData(
+                  cacheRecord.account.getAccountInfo(),
+                  undefined, // tenantProfile optional
+                  idTokenClaims
+              )
             : null;
 
         return {
@@ -637,3 +646,62 @@ export class ResponseHandler {
         };
     }
 }
+
+export function buildAccountToCache(
+    cacheStorage: CacheManager,
+    authority: Authority,
+    homeAccountId: string,
+    idTokenClaims: TokenClaims,
+    base64Decode: (input: string) => string,
+    clientInfo?: string,
+    claimsTenantId?: string | null,
+    authCodePayload?: AuthorizationCodePayload,
+    nativeAccountId?: string,
+    logger?: Logger
+): AccountEntity {
+    logger?.verbose("setCachedAccount called");
+
+    // Check if base account is already cached
+    const accountKeys = cacheStorage.getAccountKeys();
+    const baseAccountKey = accountKeys.find((accountKey: string) => {
+        return accountKey.startsWith(homeAccountId);
+    });
+
+    let cachedAccount: AccountEntity | null = null;
+    if (baseAccountKey) {
+        cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+    }
+
+    const baseAccount =
+        cachedAccount ||
+        AccountEntity.createAccount(
+            {
+                homeAccountId: homeAccountId,
+                idTokenClaims: idTokenClaims,
+                clientInfo: clientInfo,
+                cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
+                msGraphHost: authCodePayload?.msgraph_host,
+                nativeAccountId: nativeAccountId,
+            },
+            authority,
+            base64Decode
+        );
+
+    const tenantProfiles = baseAccount.tenantProfiles || [];
+
+    if (
+        claimsTenantId &&
+        !tenantProfiles.find((tenantProfile) => {
+            return tenantProfile.tenantId === claimsTenantId;
+        })
+    ) {
+        const newTenantProfile = buildTenantProfileFromIdTokenClaims(
+            homeAccountId,
+            idTokenClaims
+        );
+        tenantProfiles.push(newTenantProfile);
+    }
+    baseAccount.tenantProfiles = tenantProfiles;
+
+    return baseAccount;
+}

package/src/utils/Constants.ts

@@ -122,62 +122,6 @@ export const AADAuthorityConstants = {
 export type AADAuthorityConstants =
     (typeof AADAuthorityConstants)[keyof typeof AADAuthorityConstants];
 
-/**
- * Keys in the hashParams sent by AAD Server
- */
-export const AADServerParamKeys = {
-    CLIENT_ID: "client_id",
-    REDIRECT_URI: "redirect_uri",
-    RESPONSE_TYPE: "response_type",
-    RESPONSE_MODE: "response_mode",
-    GRANT_TYPE: "grant_type",
-    CLAIMS: "claims",
-    SCOPE: "scope",
-    ERROR: "error",
-    ERROR_DESCRIPTION: "error_description",
-    ACCESS_TOKEN: "access_token",
-    ID_TOKEN: "id_token",
-    REFRESH_TOKEN: "refresh_token",
-    EXPIRES_IN: "expires_in",
-    STATE: "state",
-    NONCE: "nonce",
-    PROMPT: "prompt",
-    SESSION_STATE: "session_state",
-    CLIENT_INFO: "client_info",
-    CODE: "code",
-    CODE_CHALLENGE: "code_challenge",
-    CODE_CHALLENGE_METHOD: "code_challenge_method",
-    CODE_VERIFIER: "code_verifier",
-    CLIENT_REQUEST_ID: "client-request-id",
-    X_CLIENT_SKU: "x-client-SKU",
-    X_CLIENT_VER: "x-client-VER",
-    X_CLIENT_OS: "x-client-OS",
-    X_CLIENT_CPU: "x-client-CPU",
-    X_CLIENT_CURR_TELEM: "x-client-current-telemetry",
-    X_CLIENT_LAST_TELEM: "x-client-last-telemetry",
-    X_MS_LIB_CAPABILITY: "x-ms-lib-capability",
-    X_APP_NAME: "x-app-name",
-    X_APP_VER: "x-app-ver",
-    POST_LOGOUT_URI: "post_logout_redirect_uri",
-    ID_TOKEN_HINT: "id_token_hint",
-    DEVICE_CODE: "device_code",
-    CLIENT_SECRET: "client_secret",
-    CLIENT_ASSERTION: "client_assertion",
-    CLIENT_ASSERTION_TYPE: "client_assertion_type",
-    TOKEN_TYPE: "token_type",
-    REQ_CNF: "req_cnf",
-    OBO_ASSERTION: "assertion",
-    REQUESTED_TOKEN_USE: "requested_token_use",
-    ON_BEHALF_OF: "on_behalf_of",
-    FOCI: "foci",
-    CCS_HEADER: "X-AnchorMailbox",
-    RETURN_SPA_CODE: "return_spa_code",
-    NATIVE_BROKER: "nativebroker",
-    LOGOUT_HINT: "logout_hint",
-} as const;
-export type AADServerParamKeys =
-    (typeof AADServerParamKeys)[keyof typeof AADServerParamKeys];
-
 /**
  * Claims request keys
  */
@@ -202,22 +146,6 @@ export const PromptValue = {
     NO_SESSION: "no_session",
 };
 
-/**
- * SSO Types - generated to populate hints
- */
-export const SSOTypes = {
-    ACCOUNT: "account",
-    SID: "sid",
-    LOGIN_HINT: "login_hint",
-    ID_TOKEN: "id_token",
-    DOMAIN_HINT: "domain_hint",
-    ORGANIZATIONS: "organizations",
-    CONSUMERS: "consumers",
-    ACCOUNT_ID: "accountIdentifier",
-    HOMEACCOUNT_ID: "homeAccountIdentifier",
-} as const;
-export type SSOTypes = (typeof SSOTypes)[keyof typeof SSOTypes];
-
 /**
  * allowed values for codeVerifier
  */