@azure/msal-common 14.4.1-beta.1 → 14.6.0-alpha.0

package/src/error/InteractionRequiredAuthError.ts

@@ -15,6 +15,7 @@ export const InteractionRequiredServerErrorMessage = [
     InteractionRequiredAuthErrorCodes.interactionRequired,
     InteractionRequiredAuthErrorCodes.consentRequired,
     InteractionRequiredAuthErrorCodes.loginRequired,
+    InteractionRequiredAuthErrorCodes.badToken,
 ];
 
 export const InteractionRequiredAuthSubErrorMessage = [
@@ -23,15 +24,18 @@ export const InteractionRequiredAuthSubErrorMessage = [
     "basic_action",
     "user_password_expired",
     "consent_required",
+    "bad_token",
 ];
 
 const InteractionRequiredAuthErrorMessages = {
     [InteractionRequiredAuthErrorCodes.noTokensFound]:
         "No refresh token found in the cache. Please sign-in.",
-    [InteractionRequiredAuthErrorCodes.refreshTokenExpired]:
-        "Refresh token has expired.",
     [InteractionRequiredAuthErrorCodes.nativeAccountUnavailable]:
         "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
+    [InteractionRequiredAuthErrorCodes.refreshTokenExpired]:
+        "Refresh token has expired.",
+    [InteractionRequiredAuthErrorCodes.badToken]:
+        "Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",
 };
 
 /**
@@ -51,6 +55,12 @@ export const InteractionRequiredAuthErrorMessage = {
             InteractionRequiredAuthErrorCodes.nativeAccountUnavailable
         ],
     },
+    bad_token: {
+        code: InteractionRequiredAuthErrorCodes.badToken,
+        desc: InteractionRequiredAuthErrorMessages[
+            InteractionRequiredAuthErrorCodes.badToken
+        ],
+    },
 };
 
 /**

package/src/error/InteractionRequiredAuthErrorCodes.ts

@@ -12,3 +12,4 @@ export const refreshTokenExpired = "refresh_token_expired";
 export const interactionRequired = "interaction_required";
 export const consentRequired = "consent_required";
 export const loginRequired = "login_required";
+export const badToken = "bad_token";

package/src/index.ts

@@ -28,9 +28,19 @@ export {
 } from "./config/AppTokenProvider";
 export { ClientConfiguration } from "./config/ClientConfiguration";
 // Account
-export { AccountInfo, ActiveAccountFilters } from "./account/AccountInfo";
+export {
+    AccountInfo,
+    ActiveAccountFilters,
+    TenantProfile,
+    updateAccountTenantProfileData,
+    tenantIdMatchesHomeTenant,
+    buildTenantProfileFromIdTokenClaims,
+} from "./account/AccountInfo";
 export * as AuthToken from "./account/AuthToken";
-export { TokenClaims } from "./account/TokenClaims";
+export {
+    TokenClaims,
+    getTenantIdFromIdTokenClaims,
+} from "./account/TokenClaims";
 export { TokenClaims as IdTokenClaims } from "./account/TokenClaims";
 export { CcsCredential, CcsCredentialType } from "./account/CcsCredential";
 export {
@@ -136,7 +146,10 @@ export {
     DeviceCodeResponse,
     ServerDeviceCodeResponse,
 } from "./response/DeviceCodeResponse";
-export { ResponseHandler } from "./response/ResponseHandler";
+export {
+    ResponseHandler,
+    buildAccountToCache,
+} from "./response/ResponseHandler";
 export { ScopeSet } from "./request/ScopeSet";
 export { AuthenticationHeaderParser } from "./request/AuthenticationHeaderParser";
 // Logger Callback
@@ -181,20 +194,20 @@ export {
     CacheAccountType,
     AuthenticationScheme,
     CodeChallengeMethodValues,
-    SSOTypes,
     PasswordGrantConstants,
     ThrottlingConstants,
     ClaimsRequestKeys,
     HeaderNames,
-    AADServerParamKeys,
     Errors,
     THE_FAMILY_ID,
     ONE_DAY_IN_MS,
     GrantType,
     AADAuthorityConstants,
     HttpStatus,
+    DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
     JsonWebTokenTypes,
 } from "./utils/Constants";
+export * as AADServerParamKeys from "./constants/AADServerParamKeys";
 export { StringUtils } from "./utils/StringUtils";
 export { StringDict } from "./utils/MsalTypes";
 export {

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.4.1-beta.1";
+export const version = "14.6.0-alpha.0";

package/src/request/CommonRefreshTokenRequest.ts

@@ -21,7 +21,6 @@ import { StringDict } from "../utils/MsalTypes";
  */
 export type CommonRefreshTokenRequest = BaseAuthRequest & {
     refreshToken: string;
-    expiresOn?: string;
     ccsCredential?: CcsCredential;
     forceCache?: boolean;
     tokenBodyParameters?: StringDict;

package/src/request/CommonSilentFlowRequest.ts

@@ -20,8 +20,14 @@ import { BaseAuthRequest } from "./BaseAuthRequest";
  * - tokenQueryParameters   - String to string map of custom query parameters added to the /token call
  */
 export type CommonSilentFlowRequest = BaseAuthRequest & {
+    /** Account object to lookup the credentials */
     account: AccountInfo;
+    /** Skip cache lookup and forces network call(s) to get fresh tokens */
     forceRefresh: boolean;
+    /** RedirectUri registered on the app registration - only required in brokering scenarios */
+    redirectUri?: string;
+    /** Key value pairs to include on the POST body to the /token endpoint */
     tokenBodyParameters?: StringDict;
-    enableRTExpiryCheck?: boolean;
+    /** If refresh token will expire within the configured value, consider it already expired. Used to pre-emptively invoke interaction when cached refresh token is close to expiry. */
+    refreshTokenExpirationOffsetSeconds?: number;
 };

package/src/request/RequestParameterBuilder.ts

@@ -4,10 +4,8 @@
  */
 
 import {
-    AADServerParamKeys,
     Constants,
     ResponseMode,
-    SSOTypes,
     CLIENT_INFO,
     AuthenticationScheme,
     ClaimsRequestKeys,
@@ -16,6 +14,7 @@ import {
     ThrottlingConstants,
     HeaderNames,
 } from "../utils/Constants";
+import * as AADServerParamKeys from "../constants/AADServerParamKeys";
 import { ScopeSet } from "./ScopeSet";
 import {
     createClientConfigurationError,
@@ -161,7 +160,7 @@ export class RequestParameterBuilder {
      */
     addDomainHint(domainHint: string): void {
         this.parameters.set(
-            SSOTypes.DOMAIN_HINT,
+            AADServerParamKeys.DOMAIN_HINT,
             encodeURIComponent(domainHint)
         );
     }
@@ -171,7 +170,10 @@ export class RequestParameterBuilder {
      * @param loginHint
      */
     addLoginHint(loginHint: string): void {
-        this.parameters.set(SSOTypes.LOGIN_HINT, encodeURIComponent(loginHint));
+        this.parameters.set(
+            AADServerParamKeys.LOGIN_HINT,
+            encodeURIComponent(loginHint)
+        );
     }
 
     /**
@@ -201,7 +203,7 @@ export class RequestParameterBuilder {
      * @param sid
      */
     addSid(sid: string): void {
-        this.parameters.set(SSOTypes.SID, encodeURIComponent(sid));
+        this.parameters.set(AADServerParamKeys.SID, encodeURIComponent(sid));
     }
 
     /**

package/src/response/ResponseHandler.ts

@@ -42,8 +42,15 @@ import { BaseAuthRequest } from "../request/BaseAuthRequest";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { checkMaxAge, extractTokenClaims } from "../account/AuthToken";
-import { TokenClaims } from "../account/TokenClaims";
-import { AccountInfo } from "../account/AccountInfo";
+import {
+    TokenClaims,
+    getTenantIdFromIdTokenClaims,
+} from "../account/TokenClaims";
+import {
+    AccountInfo,
+    buildTenantProfileFromIdTokenClaims,
+    updateAccountTenantProfileData,
+} from "../account/AccountInfo";
 import * as CacheHelpers from "../cache/utils/CacheHelpers";
 
 /**
@@ -245,8 +252,7 @@ export class ResponseHandler {
         userAssertionHash?: string,
         handlingRefreshTokenResponse?: boolean,
         forceCacheRefreshTokenResponse?: boolean,
-        serverRequestId?: string,
-        rtExpiresOn?: string
+        serverRequestId?: string
     ): Promise<AuthenticationResult> {
         this.performanceClient?.addQueueMeasurement(
             PerformanceEvents.HandleServerTokenResponse,
@@ -312,8 +318,7 @@ export class ResponseHandler {
             request,
             idTokenClaims,
             userAssertionHash,
-            authCodePayload,
-            rtExpiresOn
+            authCodePayload
         );
         let cacheContext;
         try {
@@ -339,12 +344,12 @@ export class ResponseHandler {
                 cacheRecord.account
             ) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key);
+                const account = this.cacheStorage.getAccount(key, this.logger);
                 if (!account) {
                     this.logger.warning(
                         "Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache"
                     );
-                    return ResponseHandler.generateAuthenticationResult(
+                    return await ResponseHandler.generateAuthenticationResult(
                         this.cryptoObj,
                         authority,
                         cacheRecord,
@@ -373,6 +378,7 @@ export class ResponseHandler {
                 await this.persistencePlugin.afterCacheAccess(cacheContext);
             }
         }
+
         return ResponseHandler.generateAuthenticationResult(
             this.cryptoObj,
             authority,
@@ -399,8 +405,7 @@ export class ResponseHandler {
         request: BaseAuthRequest,
         idTokenClaims?: TokenClaims,
         userAssertionHash?: string,
-        authCodePayload?: AuthorizationCodePayload,
-        rtExpiresOn?: string
+        authCodePayload?: AuthorizationCodePayload
     ): CacheRecord {
         const env = authority.getPreferredCache();
         if (!env) {
@@ -409,6 +414,8 @@ export class ResponseHandler {
             );
         }
 
+        const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
+
         // IdToken: non AAD scenarios can have empty realm
         let cachedIdToken: IdTokenEntity | undefined;
         let cachedAccount: AccountEntity | undefined;
@@ -418,18 +425,21 @@ export class ResponseHandler {
                 env,
                 serverTokenResponse.id_token,
                 this.clientId,
-                idTokenClaims.tid || ""
+                claimsTenantId || ""
             );
 
-            cachedAccount = AccountEntity.createAccount(
-                {
-                    homeAccountId: this.homeAccountIdentifier,
-                    idTokenClaims: idTokenClaims,
-                    clientInfo: serverTokenResponse.client_info,
-                    cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
-                    msGraphHost: authCodePayload?.msgraph_host,
-                },
-                authority
+            cachedAccount = buildAccountToCache(
+                this.cacheStorage,
+                authority,
+                this.homeAccountIdentifier,
+                idTokenClaims,
+                this.cryptoObj.base64Decode,
+                serverTokenResponse.client_info,
+                env,
+                claimsTenantId,
+                authCodePayload,
+                undefined, // nativeAccountId
+                this.logger
             );
         }
 
@@ -471,7 +481,7 @@ export class ResponseHandler {
                 env,
                 serverTokenResponse.access_token,
                 this.clientId,
-                idTokenClaims?.tid || authority.tenant,
+                claimsTenantId || authority.tenant,
                 responseScopes.printScopes(),
                 tokenExpirationSeconds,
                 extendedTokenExpirationSeconds,
@@ -488,6 +498,18 @@ export class ResponseHandler {
         // refreshToken
         let cachedRefreshToken: RefreshTokenEntity | null = null;
         if (serverTokenResponse.refresh_token) {
+            let rtExpiresOn: number | undefined;
+            if (serverTokenResponse.refresh_token_expires_in) {
+                const rtExpiresIn: number =
+                    typeof serverTokenResponse.refresh_token_expires_in ===
+                    "string"
+                        ? parseInt(
+                              serverTokenResponse.refresh_token_expires_in,
+                              10
+                          )
+                        : serverTokenResponse.refresh_token_expires_in;
+                rtExpiresOn = reqTimestamp + rtExpiresIn;
+            }
             cachedRefreshToken = CacheHelpers.createRefreshTokenEntity(
                 this.homeAccountIdentifier,
                 env,
@@ -600,10 +622,11 @@ export class ResponseHandler {
         }
 
         const accountInfo: AccountInfo | null = cacheRecord.account
-            ? {
-                  ...cacheRecord.account.getAccountInfo(),
-                  idTokenClaims,
-              }
+            ? updateAccountTenantProfileData(
+                  cacheRecord.account.getAccountInfo(),
+                  undefined, // tenantProfile optional
+                  idTokenClaims
+              )
             : null;
 
         return {
@@ -637,3 +660,64 @@ export class ResponseHandler {
         };
     }
 }
+
+export function buildAccountToCache(
+    cacheStorage: CacheManager,
+    authority: Authority,
+    homeAccountId: string,
+    idTokenClaims: TokenClaims,
+    base64Decode: (input: string) => string,
+    clientInfo?: string,
+    environment?: string,
+    claimsTenantId?: string | null,
+    authCodePayload?: AuthorizationCodePayload,
+    nativeAccountId?: string,
+    logger?: Logger
+): AccountEntity {
+    logger?.verbose("setCachedAccount called");
+
+    // Check if base account is already cached
+    const accountKeys = cacheStorage.getAccountKeys();
+    const baseAccountKey = accountKeys.find((accountKey: string) => {
+        return accountKey.startsWith(homeAccountId);
+    });
+
+    let cachedAccount: AccountEntity | null = null;
+    if (baseAccountKey) {
+        cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+    }
+
+    const baseAccount =
+        cachedAccount ||
+        AccountEntity.createAccount(
+            {
+                homeAccountId,
+                idTokenClaims,
+                clientInfo,
+                environment,
+                cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
+                msGraphHost: authCodePayload?.msgraph_host,
+                nativeAccountId: nativeAccountId,
+            },
+            authority,
+            base64Decode
+        );
+
+    const tenantProfiles = baseAccount.tenantProfiles || [];
+
+    if (
+        claimsTenantId &&
+        !tenantProfiles.find((tenantProfile) => {
+            return tenantProfile.tenantId === claimsTenantId;
+        })
+    ) {
+        const newTenantProfile = buildTenantProfileFromIdTokenClaims(
+            homeAccountId,
+            idTokenClaims
+        );
+        tenantProfiles.push(newTenantProfile);
+    }
+    baseAccount.tenantProfiles = tenantProfiles;
+
+    return baseAccount;
+}

package/src/response/ServerAuthorizationTokenResponse.ts

@@ -36,6 +36,7 @@ export type ServerAuthorizationTokenResponse = {
     ext_expires_in?: number;
     access_token?: string;
     refresh_token?: string;
+    refresh_token_expires_in?: number;
     id_token?: string;
     client_info?: string;
     foci?: string;

package/src/telemetry/performance/IPerformanceClient.ts

@@ -14,6 +14,9 @@ export type InProgressPerformanceEvent = {
     add: (fields: { [key: string]: {} | undefined }) => void;
     increment: (fields: { [key: string]: number | undefined }) => void;
     event: PerformanceEvent;
+    /**
+     * @deprecated This attribute will be removed in the next major version
+     */
     measurement: IPerformanceMeasurement;
 };
 
@@ -35,6 +38,9 @@ export interface IPerformanceClient {
     removePerformanceCallback(callbackId: string): boolean;
     addPerformanceCallback(callback: PerformanceCallbackFunction): string;
     emitEvents(events: PerformanceEvent[], correlationId: string): void;
+    /**
+     * @deprecated This method will be removed in the next major version
+     */
     startPerformanceMeasurement(
         measureName: string,
         correlationId: string

package/src/telemetry/performance/PerformanceClient.ts

@@ -11,13 +11,14 @@ import {
     PerformanceCallbackFunction,
     QueueMeasurement,
 } from "./IPerformanceClient";
-import { IPerformanceMeasurement } from "./IPerformanceMeasurement";
 import {
     IntFields,
     PerformanceEvent,
     PerformanceEvents,
     PerformanceEventStatus,
 } from "./PerformanceEvent";
+import { IPerformanceMeasurement } from "./IPerformanceMeasurement";
+import { StubPerformanceMeasurement } from "./StubPerformanceClient";
 
 export interface PreQueueEvent {
     name: PerformanceEvents;
@@ -111,6 +112,7 @@ export abstract class PerformanceClient implements IPerformanceClient {
      * @param {string} measureName
      * @param {string} correlationId
      * @returns {IPerformanceMeasurement}
+     * @deprecated This method will be removed in the next major version
      */
     startPerformanceMeasurement(
         measureName: string, // eslint-disable-line @typescript-eslint/no-unused-vars
@@ -273,11 +275,6 @@ export abstract class PerformanceClient implements IPerformanceClient {
             `PerformanceClient: Performance measurement started for ${measureName}`,
             eventCorrelationId
         );
-        const performanceMeasurement = this.startPerformanceMeasurement(
-            measureName,
-            eventCorrelationId
-        );
-        performanceMeasurement.startMeasurement();
 
         const inProgressEvent: PerformanceEvent = {
             eventId: this.generateId(),
@@ -301,15 +298,12 @@ export abstract class PerformanceClient implements IPerformanceClient {
             end: (
                 event?: Partial<PerformanceEvent>
             ): PerformanceEvent | null => {
-                return this.endMeasurement(
-                    {
-                        // Initial set of event properties
-                        ...inProgressEvent,
-                        // Properties set when event ends
-                        ...event,
-                    },
-                    performanceMeasurement
-                );
+                return this.endMeasurement({
+                    // Initial set of event properties
+                    ...inProgressEvent,
+                    // Properties set when event ends
+                    ...event,
+                });
             },
             discard: () => {
                 return this.discardMeasurements(inProgressEvent.correlationId);
@@ -323,8 +317,8 @@ export abstract class PerformanceClient implements IPerformanceClient {
                     inProgressEvent.correlationId
                 );
             },
-            measurement: performanceMeasurement,
             event: inProgressEvent,
+            measurement: new StubPerformanceMeasurement(),
         };
     }
 
@@ -338,10 +332,7 @@ export abstract class PerformanceClient implements IPerformanceClient {
      * @param {IPerformanceMeasurement} measurement
      * @returns {(PerformanceEvent | null)}
      */
-    endMeasurement(
-        event: PerformanceEvent,
-        measurement?: IPerformanceMeasurement
-    ): PerformanceEvent | null {
+    endMeasurement(event: PerformanceEvent): PerformanceEvent | null {
         const rootEvent: PerformanceEvent | undefined =
             this.eventsByCorrelationId.get(event.correlationId);
         if (!rootEvent) {
@@ -365,17 +356,8 @@ export abstract class PerformanceClient implements IPerformanceClient {
             rootEvent.incompleteSubMeasurements?.delete(event.eventId);
         }
 
-        measurement?.endMeasurement();
-        const durationMs = measurement?.flushMeasurement();
-        // null indicates no measurement was taken (e.g. needed performance APIs not present)
-        if (!durationMs) {
-            this.logger.trace(
-                "PerformanceClient: Performance measurement not taken",
-                rootEvent.correlationId
-            );
-            return null;
-        }
-
+        const durationMs =
+            event.durationMs || this.getDurationMs(event.startTimeMs);
         this.logger.trace(
             `PerformanceClient: Performance measurement ended for ${event.name}: ${durationMs} ms`,
             event.correlationId
@@ -633,4 +615,15 @@ export abstract class PerformanceClient implements IPerformanceClient {
             }
         });
     }
+
+    /**
+     * Returns event duration in milliseconds
+     * @param startTimeMs {number}
+     * @returns {number}
+     */
+    private getDurationMs(startTimeMs: number): number {
+        const durationMs = Date.now() - startTimeMs;
+        // Handle clock skew
+        return durationMs < 0 ? durationMs : 0;
+    }
 }

package/src/telemetry/performance/StubPerformanceClient.ts

@@ -54,7 +54,6 @@ export class StubPerformanceClient implements IPerformanceClient {
     startPerformanceMeasurement(): IPerformanceMeasurement {
         return new StubPerformanceMeasurement();
     }
-
     calculateQueuedTime(): number {
         return 0;
     }

package/src/utils/Constants.ts

@@ -68,6 +68,7 @@ export const HttpStatus = {
     SUCCESS_RANGE_END: 299,
     REDIRECT: 302,
     CLIENT_ERROR_RANGE_START: 400,
+    UNAUTHORIZED: 401,
     CLIENT_ERROR_RANGE_END: 499,
     SERVER_ERROR_RANGE_START: 500,
     SERVER_ERROR_RANGE_END: 599,
@@ -122,62 +123,6 @@ export const AADAuthorityConstants = {
 export type AADAuthorityConstants =
     (typeof AADAuthorityConstants)[keyof typeof AADAuthorityConstants];
 
-/**
- * Keys in the hashParams sent by AAD Server
- */
-export const AADServerParamKeys = {
-    CLIENT_ID: "client_id",
-    REDIRECT_URI: "redirect_uri",
-    RESPONSE_TYPE: "response_type",
-    RESPONSE_MODE: "response_mode",
-    GRANT_TYPE: "grant_type",
-    CLAIMS: "claims",
-    SCOPE: "scope",
-    ERROR: "error",
-    ERROR_DESCRIPTION: "error_description",
-    ACCESS_TOKEN: "access_token",
-    ID_TOKEN: "id_token",
-    REFRESH_TOKEN: "refresh_token",
-    EXPIRES_IN: "expires_in",
-    STATE: "state",
-    NONCE: "nonce",
-    PROMPT: "prompt",
-    SESSION_STATE: "session_state",
-    CLIENT_INFO: "client_info",
-    CODE: "code",
-    CODE_CHALLENGE: "code_challenge",
-    CODE_CHALLENGE_METHOD: "code_challenge_method",
-    CODE_VERIFIER: "code_verifier",
-    CLIENT_REQUEST_ID: "client-request-id",
-    X_CLIENT_SKU: "x-client-SKU",
-    X_CLIENT_VER: "x-client-VER",
-    X_CLIENT_OS: "x-client-OS",
-    X_CLIENT_CPU: "x-client-CPU",
-    X_CLIENT_CURR_TELEM: "x-client-current-telemetry",
-    X_CLIENT_LAST_TELEM: "x-client-last-telemetry",
-    X_MS_LIB_CAPABILITY: "x-ms-lib-capability",
-    X_APP_NAME: "x-app-name",
-    X_APP_VER: "x-app-ver",
-    POST_LOGOUT_URI: "post_logout_redirect_uri",
-    ID_TOKEN_HINT: "id_token_hint",
-    DEVICE_CODE: "device_code",
-    CLIENT_SECRET: "client_secret",
-    CLIENT_ASSERTION: "client_assertion",
-    CLIENT_ASSERTION_TYPE: "client_assertion_type",
-    TOKEN_TYPE: "token_type",
-    REQ_CNF: "req_cnf",
-    OBO_ASSERTION: "assertion",
-    REQUESTED_TOKEN_USE: "requested_token_use",
-    ON_BEHALF_OF: "on_behalf_of",
-    FOCI: "foci",
-    CCS_HEADER: "X-AnchorMailbox",
-    RETURN_SPA_CODE: "return_spa_code",
-    NATIVE_BROKER: "nativebroker",
-    LOGOUT_HINT: "logout_hint",
-} as const;
-export type AADServerParamKeys =
-    (typeof AADServerParamKeys)[keyof typeof AADServerParamKeys];
-
 /**
  * Claims request keys
  */
@@ -202,22 +147,6 @@ export const PromptValue = {
     NO_SESSION: "no_session",
 };
 
-/**
- * SSO Types - generated to populate hints
- */
-export const SSOTypes = {
-    ACCOUNT: "account",
-    SID: "sid",
-    LOGIN_HINT: "login_hint",
-    ID_TOKEN: "id_token",
-    DOMAIN_HINT: "domain_hint",
-    ORGANIZATIONS: "organizations",
-    CONSUMERS: "consumers",
-    ACCOUNT_ID: "accountIdentifier",
-    HOMEACCOUNT_ID: "homeAccountIdentifier",
-} as const;
-export type SSOTypes = (typeof SSOTypes)[keyof typeof SSOTypes];
-
 /**
  * allowed values for codeVerifier
  */
@@ -442,3 +371,6 @@ export type JsonWebTokenTypes =
     (typeof JsonWebTokenTypes)[keyof typeof JsonWebTokenTypes];
 
 export const ONE_DAY_IN_MS = 86400000;
+
+// Token renewal offset default in seconds
+export const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;