@azure/msal-common 14.4.1-beta.1 → 14.6.0-alpha.0

package/src/cache/entities/AccountEntity.ts

@@ -3,18 +3,25 @@
  * Licensed under the MIT License.
  */
 
-import { Separators, CacheAccountType, Constants } from "../../utils/Constants";
+import { CacheAccountType, Separators } from "../../utils/Constants";
 import { Authority } from "../../authority/Authority";
 import { ICrypto } from "../../crypto/ICrypto";
-import { buildClientInfo } from "../../account/ClientInfo";
-import { AccountInfo } from "../../account/AccountInfo";
+import { ClientInfo, buildClientInfo } from "../../account/ClientInfo";
+import {
+    AccountInfo,
+    TenantProfile,
+    buildTenantProfileFromIdTokenClaims,
+} from "../../account/AccountInfo";
 import {
     createClientAuthError,
     ClientAuthErrorCodes,
 } from "../../error/ClientAuthError";
 import { AuthorityType } from "../../authority/AuthorityType";
 import { Logger } from "../../logger/Logger";
-import { TokenClaims } from "../../account/TokenClaims";
+import {
+    TokenClaims,
+    getTenantIdFromIdTokenClaims,
+} from "../../account/TokenClaims";
 import { ProtocolMode } from "../../authority/ProtocolMode";
 
 /**
@@ -35,8 +42,8 @@ import { ProtocolMode } from "../../authority/ProtocolMode";
  *      name: Full name for the account, including given name and family name,
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
- *      idTokenClaims: Object containing claims parsed from ID token
  *      nativeAccountId: Account identifier on the native device
+ *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
  * }
  * @internal
  */
@@ -53,8 +60,8 @@ export class AccountEntity {
     lastModificationApp?: string;
     cloudGraphHostName?: string;
     msGraphHost?: string;
-    idTokenClaims?: TokenClaims;
     nativeAccountId?: string;
+    tenantProfiles?: Array<TenantProfile>;
 
     /**
      * Generate Account Id key component as per the schema: <home_account_id>-<environment>
@@ -88,21 +95,34 @@ export class AccountEntity {
             username: this.username,
             localAccountId: this.localAccountId,
             name: this.name,
-            idTokenClaims: this.idTokenClaims,
             nativeAccountId: this.nativeAccountId,
             authorityType: this.authorityType,
+            // Deserialize tenant profiles array into a Map
+            tenantProfiles: new Map(
+                (this.tenantProfiles || []).map((tenantProfile) => {
+                    return [tenantProfile.tenantId, tenantProfile];
+                })
+            ),
         };
     }
 
+    /**
+     * Returns true if the account entity is in single tenant format (outdated), false otherwise
+     */
+    isSingleTenant(): boolean {
+        return !this.tenantProfiles;
+    }
+
     /**
      * Generates account key from interface
      * @param accountInterface
      */
     static generateAccountCacheKey(accountInterface: AccountInfo): string {
+        const homeTenantId = accountInterface.homeAccountId.split(".")[1];
         const accountKey = [
             accountInterface.homeAccountId,
-            accountInterface.environment || Constants.EMPTY_STRING,
-            accountInterface.tenantId || Constants.EMPTY_STRING,
+            accountInterface.environment || "",
+            homeTenantId || accountInterface.tenantId || "",
         ];
 
         return accountKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
@@ -121,8 +141,10 @@ export class AccountEntity {
             msGraphHost?: string;
             environment?: string;
             nativeAccountId?: string;
+            tenantProfiles?: Array<TenantProfile>;
         },
-        authority: Authority
+        authority: Authority,
+        base64Decode?: (input: string) => string
     ): AccountEntity {
         const account: AccountEntity = new AccountEntity();
 
@@ -134,6 +156,15 @@ export class AccountEntity {
             account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
         }
 
+        let clientInfo: ClientInfo | undefined;
+
+        if (accountDetails.clientInfo && base64Decode) {
+            clientInfo = buildClientInfo(
+                accountDetails.clientInfo,
+                base64Decode
+            );
+        }
+
         account.clientInfo = accountDetails.clientInfo;
         account.homeAccountId = accountDetails.homeAccountId;
         account.nativeAccountId = accountDetails.nativeAccountId;
@@ -151,13 +182,16 @@ export class AccountEntity {
         account.environment = env;
         // non AAD scenarios can have empty realm
         account.realm =
-            accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
+            clientInfo?.utid ||
+            getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+            "";
 
         // How do you account for MSA CID here?
         account.localAccountId =
+            clientInfo?.uid ||
             accountDetails.idTokenClaims.oid ||
             accountDetails.idTokenClaims.sub ||
-            Constants.EMPTY_STRING;
+            "";
 
         /*
          * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
@@ -171,12 +205,26 @@ export class AccountEntity {
             ? accountDetails.idTokenClaims.emails[0]
             : null;
 
-        account.username = preferredUsername || email || Constants.EMPTY_STRING;
+        account.username = preferredUsername || email || "";
         account.name = accountDetails.idTokenClaims.name;
 
         account.cloudGraphHostName = accountDetails.cloudGraphHostName;
         account.msGraphHost = accountDetails.msGraphHost;
 
+        if (accountDetails.tenantProfiles) {
+            account.tenantProfiles = accountDetails.tenantProfiles;
+        } else {
+            const tenantProfiles = [];
+            if (accountDetails.idTokenClaims) {
+                const tenantProfile = buildTenantProfileFromIdTokenClaims(
+                    accountDetails.homeAccountId,
+                    accountDetails.idTokenClaims
+                );
+                tenantProfiles.push(tenantProfile);
+            }
+            account.tenantProfiles = tenantProfiles;
+        }
+
         return account;
     }
 
@@ -208,6 +256,10 @@ export class AccountEntity {
 
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;
+        // Serialize tenant profiles map into an array
+        account.tenantProfiles = Array.from(
+            accountInfo.tenantProfiles?.values() || []
+        );
 
         return account;
     }
@@ -224,31 +276,30 @@ export class AccountEntity {
         cryptoObj: ICrypto,
         idTokenClaims?: TokenClaims
     ): string {
-        const accountId = idTokenClaims?.sub
-            ? idTokenClaims.sub
-            : Constants.EMPTY_STRING;
-
-        // since ADFS does not have tid and does not set client_info
+        // since ADFS/DSTS do not have tid and does not set client_info
         if (
-            authType === AuthorityType.Adfs ||
-            authType === AuthorityType.Dsts
+            !(
+                authType === AuthorityType.Adfs ||
+                authType === AuthorityType.Dsts
+            )
         ) {
-            return accountId;
-        }
-
-        // for cases where there is clientInfo
-        if (serverClientInfo) {
-            try {
-                const clientInfo = buildClientInfo(serverClientInfo, cryptoObj);
-                if (clientInfo.uid && clientInfo.utid) {
-                    return `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`;
-                }
-            } catch (e) {}
+            // for cases where there is clientInfo
+            if (serverClientInfo) {
+                try {
+                    const clientInfo = buildClientInfo(
+                        serverClientInfo,
+                        cryptoObj.base64Decode
+                    );
+                    if (clientInfo.uid && clientInfo.utid) {
+                        return `${clientInfo.uid}.${clientInfo.utid}`;
+                    }
+                } catch (e) {}
+            }
+            logger.warning("No client info in response");
         }
 
         // default to "sub" claim
-        logger.verbose("No client info in response");
-        return accountId;
+        return idTokenClaims?.sub || "";
     }
 
     /**

package/src/cache/entities/ThrottlingEntity.ts

@@ -3,9 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { ThrottlingConstants } from "../../utils/Constants";
-
-export class ThrottlingEntity {
+export type ThrottlingEntity = {
     // Unix-time value representing the expiration of the throttle
     throttleTime: number;
     // Information provided by the server
@@ -13,24 +11,4 @@ export class ThrottlingEntity {
     errorCodes?: Array<string>;
     errorMessage?: string;
     subError?: string;
-
-    /**
-     * validates if a given cache entry is "Throttling", parses <key,value>
-     * @param key
-     * @param entity
-     */
-    static isThrottlingEntity(key: string, entity?: object): boolean {
-        let validateKey: boolean = false;
-        if (key) {
-            validateKey =
-                key.indexOf(ThrottlingConstants.THROTTLING_PREFIX) === 0;
-        }
-
-        let validateEntity: boolean = true;
-        if (entity) {
-            validateEntity = entity.hasOwnProperty("throttleTime");
-        }
-
-        return validateKey && validateEntity;
-    }
-}
+};

package/src/cache/utils/CacheHelpers.ts

@@ -14,6 +14,7 @@ import {
     CredentialType,
     SERVER_TELEM_CONSTANTS,
     Separators,
+    ThrottlingConstants,
 } from "../../utils/Constants";
 import { TimeUtils } from "../../utils/TimeUtils";
 import { AccessTokenEntity } from "../entities/AccessTokenEntity";
@@ -169,7 +170,7 @@ export function createRefreshTokenEntity(
     clientId: string,
     familyId?: string,
     userAssertionHash?: string,
-    expiresOn?: string
+    expiresOn?: number
 ): RefreshTokenEntity {
     const rtEntity: RefreshTokenEntity = {
         credentialType: CredentialType.REFRESH_TOKEN,
@@ -188,7 +189,7 @@ export function createRefreshTokenEntity(
     }
 
     if (expiresOn) {
-        rtEntity.expiresOn = expiresOn;
+        rtEntity.expiresOn = expiresOn.toString();
     }
 
     return rtEntity;
@@ -330,3 +331,22 @@ export function isServerTelemetryEntity(key: string, entity?: object): boolean {
 
     return validateKey && validateEntity;
 }
+
+/**
+ * validates if a given cache entry is "Throttling", parses <key,value>
+ * @param key
+ * @param entity
+ */
+export function isThrottlingEntity(key: string, entity?: object): boolean {
+    let validateKey: boolean = false;
+    if (key) {
+        validateKey = key.indexOf(ThrottlingConstants.THROTTLING_PREFIX) === 0;
+    }
+
+    let validateEntity: boolean = true;
+    if (entity) {
+        validateEntity = entity.hasOwnProperty("throttleTime");
+    }
+
+    return validateKey && validateEntity;
+}

package/src/cache/utils/CacheTypes.ts

@@ -60,8 +60,19 @@ export type AccountFilter = Omit<
     realm?: string;
     loginHint?: string;
     sid?: string;
+    isHomeTenant?: boolean;
 };
 
+export type TenantProfileFilter = Pick<
+    AccountFilter,
+    | "localAccountId"
+    | "loginHint"
+    | "name"
+    | "sid"
+    | "isHomeTenant"
+    | "username"
+>;
+
 /**
  * Credential: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme*>
  */

package/src/client/AuthorizationCodeClient.ts

@@ -13,9 +13,9 @@ import {
     AuthenticationScheme,
     PromptValue,
     Separators,
-    AADServerParamKeys,
     HeaderNames,
 } from "../utils/Constants";
+import * as AADServerParamKeys from "../constants/AADServerParamKeys";
 import {
     ClientConfiguration,
     isOidcProtocolMode,
@@ -161,8 +161,7 @@ export class AuthorizationCodeClient extends BaseClient {
             undefined,
             undefined,
             undefined,
-            requestId,
-            (TimeUtils.nowSeconds() + 24 * 60 * 60).toString()
+            requestId
         );
     }
 
@@ -255,7 +254,7 @@ export class AuthorizationCodeClient extends BaseClient {
             try {
                 const clientInfo = buildClientInfo(
                     request.clientInfo,
-                    this.cryptoUtils
+                    this.cryptoUtils.base64Decode
                 );
                 ccsCredential = {
                     credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
@@ -422,7 +421,7 @@ export class AuthorizationCodeClient extends BaseClient {
             try {
                 const clientInfo = buildClientInfo(
                     request.clientInfo,
-                    this.cryptoUtils
+                    this.cryptoUtils.base64Decode
                 );
                 ccsCred = {
                     credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,

package/src/client/RefreshTokenClient.ts

@@ -17,8 +17,8 @@ import {
     AuthenticationScheme,
     Errors,
     HeaderNames,
-    AADServerParamKeys,
 } from "../utils/Constants";
+import * as AADServerParamKeys from "../constants/AADServerParamKeys";
 import { ResponseHandler } from "../response/ResponseHandler";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { PopTokenGenerator } from "../crypto/PopTokenGenerator";
@@ -47,6 +47,10 @@ import {
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 import { invoke, invokeAsync } from "../utils/FunctionWrappers";
+import { generateCredentialKey } from "../cache/utils/CacheHelpers";
+
+const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
+
 /**
  * OAuth2.0 refresh token client
  * @internal
@@ -102,8 +106,7 @@ export class RefreshTokenClient extends BaseClient {
             undefined,
             true,
             request.forceCache,
-            requestId,
-            request.expiresOn
+            requestId
         );
     }
 
@@ -141,7 +144,7 @@ export class RefreshTokenClient extends BaseClient {
         // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
         if (isFOCI) {
             try {
-                return invokeAsync(
+                return await invokeAsync(
                     this.acquireTokenWithCachedRefreshToken.bind(this),
                     PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken,
                     this.logger,
@@ -218,9 +221,12 @@ export class RefreshTokenClient extends BaseClient {
         }
 
         if (
-            request.enableRTExpiryCheck &&
             refreshToken.expiresOn &&
-            Number(refreshToken.expiresOn) < TimeUtils.nowSeconds() + 5 * 60
+            TimeUtils.isTokenExpired(
+                refreshToken.expiresOn,
+                request.refreshTokenExpirationOffsetSeconds ||
+                    DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS
+            )
         ) {
             throw createInteractionRequiredAuthError(
                 InteractionRequiredAuthErrorCodes.refreshTokenExpired
@@ -237,16 +243,31 @@ export class RefreshTokenClient extends BaseClient {
                 credential: request.account.homeAccountId,
                 type: CcsCredentialType.HOME_ACCOUNT_ID,
             },
-            expiresOn: refreshToken.expiresOn,
         };
 
-        return invokeAsync(
-            this.acquireToken.bind(this),
-            PerformanceEvents.RefreshTokenClientAcquireToken,
-            this.logger,
-            this.performanceClient,
-            request.correlationId
-        )(refreshTokenRequest);
+        try {
+            return await invokeAsync(
+                this.acquireToken.bind(this),
+                PerformanceEvents.RefreshTokenClientAcquireToken,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(refreshTokenRequest);
+        } catch (e) {
+            if (
+                e instanceof InteractionRequiredAuthError &&
+                e.subError === InteractionRequiredAuthErrorCodes.badToken
+            ) {
+                // Remove bad refresh token from cache
+                this.logger.verbose(
+                    "acquireTokenWithRefreshToken: bad refresh token, removing from cache"
+                );
+                const badRefreshTokenKey = generateCredentialKey(refreshToken);
+                this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+            }
+
+            throw e;
+        }
     }
 
     /**

package/src/client/SilentFlowClient.ts

@@ -23,6 +23,7 @@ import { checkMaxAge, extractTokenClaims } from "../account/AuthToken";
 import { TokenClaims } from "../account/TokenClaims";
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { invokeAsync } from "../utils/FunctionWrappers";
+import { getTenantFromAuthorityString } from "../authority/Authority";
 
 /** @internal */
 export class SilentFlowClient extends BaseClient {
@@ -118,18 +119,20 @@ export class SilentFlowClient extends BaseClient {
             );
         }
 
-        const environment =
-            request.authority || this.authority.getPreferredCache();
-
-        const cacheRecord = this.cacheManager.readCacheRecord(
+        const requestTenantId =
+            request.account.tenantId ||
+            getTenantFromAuthorityString(request.authority);
+        const tokenKeys = this.cacheManager.getTokenKeys();
+        const cachedAccessToken = this.cacheManager.getAccessToken(
             request.account,
             request,
-            environment,
+            tokenKeys,
+            requestTenantId,
             this.performanceClient,
             request.correlationId
         );
 
-        if (!cacheRecord.accessToken) {
+        if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(
                 CacheOutcome.NO_CACHED_ACCESS_TOKEN,
@@ -139,9 +142,9 @@ export class SilentFlowClient extends BaseClient {
                 ClientAuthErrorCodes.tokenRefreshRequired
             );
         } else if (
-            TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
+            TimeUtils.wasClockTurnedBack(cachedAccessToken.cachedAt) ||
             TimeUtils.isTokenExpired(
-                cacheRecord.accessToken.expiresOn,
+                cachedAccessToken.expiresOn,
                 this.config.systemOptions.tokenRenewalOffsetSeconds
             )
         ) {
@@ -154,8 +157,8 @@ export class SilentFlowClient extends BaseClient {
                 ClientAuthErrorCodes.tokenRefreshRequired
             );
         } else if (
-            cacheRecord.accessToken.refreshOn &&
-            TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)
+            cachedAccessToken.refreshOn &&
+            TimeUtils.isTokenExpired(cachedAccessToken.refreshOn, 0)
         ) {
             // must refresh (in the background) due to the refresh_in value
             lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
@@ -163,6 +166,23 @@ export class SilentFlowClient extends BaseClient {
             // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
         }
 
+        const environment =
+            request.authority || this.authority.getPreferredCache();
+        const cacheRecord: CacheRecord = {
+            account: this.cacheManager.readAccountFromCache(request.account),
+            accessToken: cachedAccessToken,
+            idToken: this.cacheManager.getIdToken(
+                request.account,
+                tokenKeys,
+                requestTenantId,
+                this.performanceClient,
+                request.correlationId
+            ),
+            refreshToken: null,
+            appMetadata:
+                this.cacheManager.readAppMetadataFromCache(environment),
+        };
+
         this.setCacheOutcome(lastCacheOutcome, request.correlationId);
 
         if (this.config.serverTelemetryManager) {
@@ -231,7 +251,7 @@ export class SilentFlowClient extends BaseClient {
             checkMaxAge(authTime, request.maxAge);
         }
 
-        return await ResponseHandler.generateAuthenticationResult(
+        return ResponseHandler.generateAuthenticationResult(
             this.cryptoUtils,
             this.authority,
             cacheRecord,

package/src/config/ClientConfiguration.ts

@@ -6,7 +6,10 @@
 import { INetworkModule } from "../network/INetworkModule";
 import { DEFAULT_CRYPTO_IMPLEMENTATION, ICrypto } from "../crypto/ICrypto";
 import { ILoggerCallback, Logger, LogLevel } from "../logger/Logger";
-import { Constants } from "../utils/Constants";
+import {
+    Constants,
+    DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+} from "../utils/Constants";
 import { version } from "../packageMetadata";
 import { Authority } from "../authority/Authority";
 import { AzureCloudInstance } from "../authority/AuthorityOptions";
@@ -21,9 +24,6 @@ import {
     createClientAuthError,
 } from "../error/ClientAuthError";
 
-// Token renewal offset default in seconds
-const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-
 /**
  * Use the configuration object to configure MSAL Modules and initialize the base interfaces for MSAL.
  *

package/src/constants/AADServerParamKeys.ts

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const CLIENT_ID = "client_id";
+export const REDIRECT_URI = "redirect_uri";
+export const RESPONSE_TYPE = "response_type";
+export const RESPONSE_MODE = "response_mode";
+export const GRANT_TYPE = "grant_type";
+export const CLAIMS = "claims";
+export const SCOPE = "scope";
+export const ERROR = "error";
+export const ERROR_DESCRIPTION = "error_description";
+export const ACCESS_TOKEN = "access_token";
+export const ID_TOKEN = "id_token";
+export const REFRESH_TOKEN = "refresh_token";
+export const EXPIRES_IN = "expires_in";
+export const REFRESH_TOKEN_EXPIRES_IN = "refresh_token_expires_in";
+export const STATE = "state";
+export const NONCE = "nonce";
+export const PROMPT = "prompt";
+export const SESSION_STATE = "session_state";
+export const CLIENT_INFO = "client_info";
+export const CODE = "code";
+export const CODE_CHALLENGE = "code_challenge";
+export const CODE_CHALLENGE_METHOD = "code_challenge_method";
+export const CODE_VERIFIER = "code_verifier";
+export const CLIENT_REQUEST_ID = "client-request-id";
+export const X_CLIENT_SKU = "x-client-SKU";
+export const X_CLIENT_VER = "x-client-VER";
+export const X_CLIENT_OS = "x-client-OS";
+export const X_CLIENT_CPU = "x-client-CPU";
+export const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
+export const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
+export const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
+export const X_APP_NAME = "x-app-name";
+export const X_APP_VER = "x-app-ver";
+export const POST_LOGOUT_URI = "post_logout_redirect_uri";
+export const ID_TOKEN_HINT = "id_token_hint";
+export const DEVICE_CODE = "device_code";
+export const CLIENT_SECRET = "client_secret";
+export const CLIENT_ASSERTION = "client_assertion";
+export const CLIENT_ASSERTION_TYPE = "client_assertion_type";
+export const TOKEN_TYPE = "token_type";
+export const REQ_CNF = "req_cnf";
+export const OBO_ASSERTION = "assertion";
+export const REQUESTED_TOKEN_USE = "requested_token_use";
+export const ON_BEHALF_OF = "on_behalf_of";
+export const FOCI = "foci";
+export const CCS_HEADER = "X-AnchorMailbox";
+export const RETURN_SPA_CODE = "return_spa_code";
+export const NATIVE_BROKER = "nativebroker";
+export const LOGOUT_HINT = "logout_hint";
+export const SID = "sid";
+export const LOGIN_HINT = "login_hint";
+export const DOMAIN_HINT = "domain_hint";

package/src/crypto/PopTokenGenerator.ts

@@ -140,7 +140,7 @@ export class PopTokenGenerator {
             ? new UrlString(resourceRequestUri)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
-        return await this.cryptoUtils.signJwt(
+        return this.cryptoUtils.signJwt(
             {
                 at: payload,
                 ts: TimeUtils.nowSeconds(),