@azure/msal-common 14.5.0 → 14.6.0-alpha.0

package/src/cache/utils/CacheHelpers.ts

@@ -14,6 +14,7 @@ import {
     CredentialType,
     SERVER_TELEM_CONSTANTS,
     Separators,
+    ThrottlingConstants,
 } from "../../utils/Constants";
 import { TimeUtils } from "../../utils/TimeUtils";
 import { AccessTokenEntity } from "../entities/AccessTokenEntity";
@@ -168,7 +169,8 @@ export function createRefreshTokenEntity(
     refreshToken: string,
     clientId: string,
     familyId?: string,
-    userAssertionHash?: string
+    userAssertionHash?: string,
+    expiresOn?: number
 ): RefreshTokenEntity {
     const rtEntity: RefreshTokenEntity = {
         credentialType: CredentialType.REFRESH_TOKEN,
@@ -186,6 +188,10 @@ export function createRefreshTokenEntity(
         rtEntity.familyId = familyId;
     }
 
+    if (expiresOn) {
+        rtEntity.expiresOn = expiresOn.toString();
+    }
+
     return rtEntity;
 }
 
@@ -325,3 +331,22 @@ export function isServerTelemetryEntity(key: string, entity?: object): boolean {
 
     return validateKey && validateEntity;
 }
+
+/**
+ * validates if a given cache entry is "Throttling", parses <key,value>
+ * @param key
+ * @param entity
+ */
+export function isThrottlingEntity(key: string, entity?: object): boolean {
+    let validateKey: boolean = false;
+    if (key) {
+        validateKey = key.indexOf(ThrottlingConstants.THROTTLING_PREFIX) === 0;
+    }
+
+    let validateEntity: boolean = true;
+    if (entity) {
+        validateEntity = entity.hasOwnProperty("throttleTime");
+    }
+
+    return validateKey && validateEntity;
+}

package/src/client/RefreshTokenClient.ts

@@ -47,6 +47,10 @@ import {
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 import { invoke, invokeAsync } from "../utils/FunctionWrappers";
+import { generateCredentialKey } from "../cache/utils/CacheHelpers";
+
+const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
+
 /**
  * OAuth2.0 refresh token client
  * @internal
@@ -215,6 +219,19 @@ export class RefreshTokenClient extends BaseClient {
                 InteractionRequiredAuthErrorCodes.noTokensFound
             );
         }
+
+        if (
+            refreshToken.expiresOn &&
+            TimeUtils.isTokenExpired(
+                refreshToken.expiresOn,
+                request.refreshTokenExpirationOffsetSeconds ||
+                    DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS
+            )
+        ) {
+            throw createInteractionRequiredAuthError(
+                InteractionRequiredAuthErrorCodes.refreshTokenExpired
+            );
+        }
         // attach cached RT size to the current measurement
 
         const refreshTokenRequest: CommonRefreshTokenRequest = {
@@ -228,13 +245,29 @@ export class RefreshTokenClient extends BaseClient {
             },
         };
 
-        return invokeAsync(
-            this.acquireToken.bind(this),
-            PerformanceEvents.RefreshTokenClientAcquireToken,
-            this.logger,
-            this.performanceClient,
-            request.correlationId
-        )(refreshTokenRequest);
+        try {
+            return await invokeAsync(
+                this.acquireToken.bind(this),
+                PerformanceEvents.RefreshTokenClientAcquireToken,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(refreshTokenRequest);
+        } catch (e) {
+            if (
+                e instanceof InteractionRequiredAuthError &&
+                e.subError === InteractionRequiredAuthErrorCodes.badToken
+            ) {
+                // Remove bad refresh token from cache
+                this.logger.verbose(
+                    "acquireTokenWithRefreshToken: bad refresh token, removing from cache"
+                );
+                const badRefreshTokenKey = generateCredentialKey(refreshToken);
+                this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+            }
+
+            throw e;
+        }
     }
 
     /**

package/src/client/SilentFlowClient.ts

@@ -23,6 +23,7 @@ import { checkMaxAge, extractTokenClaims } from "../account/AuthToken";
 import { TokenClaims } from "../account/TokenClaims";
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { invokeAsync } from "../utils/FunctionWrappers";
+import { getTenantFromAuthorityString } from "../authority/Authority";
 
 /** @internal */
 export class SilentFlowClient extends BaseClient {
@@ -118,18 +119,20 @@ export class SilentFlowClient extends BaseClient {
             );
         }
 
-        const environment =
-            request.authority || this.authority.getPreferredCache();
-
-        const cacheRecord = this.cacheManager.readCacheRecord(
+        const requestTenantId =
+            request.account.tenantId ||
+            getTenantFromAuthorityString(request.authority);
+        const tokenKeys = this.cacheManager.getTokenKeys();
+        const cachedAccessToken = this.cacheManager.getAccessToken(
             request.account,
             request,
-            environment,
+            tokenKeys,
+            requestTenantId,
             this.performanceClient,
             request.correlationId
         );
 
-        if (!cacheRecord.accessToken) {
+        if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(
                 CacheOutcome.NO_CACHED_ACCESS_TOKEN,
@@ -139,9 +142,9 @@ export class SilentFlowClient extends BaseClient {
                 ClientAuthErrorCodes.tokenRefreshRequired
             );
         } else if (
-            TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
+            TimeUtils.wasClockTurnedBack(cachedAccessToken.cachedAt) ||
             TimeUtils.isTokenExpired(
-                cacheRecord.accessToken.expiresOn,
+                cachedAccessToken.expiresOn,
                 this.config.systemOptions.tokenRenewalOffsetSeconds
             )
         ) {
@@ -154,8 +157,8 @@ export class SilentFlowClient extends BaseClient {
                 ClientAuthErrorCodes.tokenRefreshRequired
             );
         } else if (
-            cacheRecord.accessToken.refreshOn &&
-            TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)
+            cachedAccessToken.refreshOn &&
+            TimeUtils.isTokenExpired(cachedAccessToken.refreshOn, 0)
         ) {
             // must refresh (in the background) due to the refresh_in value
             lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
@@ -163,6 +166,23 @@ export class SilentFlowClient extends BaseClient {
             // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
         }
 
+        const environment =
+            request.authority || this.authority.getPreferredCache();
+        const cacheRecord: CacheRecord = {
+            account: this.cacheManager.readAccountFromCache(request.account),
+            accessToken: cachedAccessToken,
+            idToken: this.cacheManager.getIdToken(
+                request.account,
+                tokenKeys,
+                requestTenantId,
+                this.performanceClient,
+                request.correlationId
+            ),
+            refreshToken: null,
+            appMetadata:
+                this.cacheManager.readAppMetadataFromCache(environment),
+        };
+
         this.setCacheOutcome(lastCacheOutcome, request.correlationId);
 
         if (this.config.serverTelemetryManager) {

package/src/config/ClientConfiguration.ts

@@ -6,7 +6,10 @@
 import { INetworkModule } from "../network/INetworkModule";
 import { DEFAULT_CRYPTO_IMPLEMENTATION, ICrypto } from "../crypto/ICrypto";
 import { ILoggerCallback, Logger, LogLevel } from "../logger/Logger";
-import { Constants } from "../utils/Constants";
+import {
+    Constants,
+    DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+} from "../utils/Constants";
 import { version } from "../packageMetadata";
 import { Authority } from "../authority/Authority";
 import { AzureCloudInstance } from "../authority/AuthorityOptions";
@@ -21,9 +24,6 @@ import {
     createClientAuthError,
 } from "../error/ClientAuthError";
 
-// Token renewal offset default in seconds
-const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-
 /**
  * Use the configuration object to configure MSAL Modules and initialize the base interfaces for MSAL.
  *

package/src/constants/AADServerParamKeys.ts

@@ -16,6 +16,7 @@ export const ACCESS_TOKEN = "access_token";
 export const ID_TOKEN = "id_token";
 export const REFRESH_TOKEN = "refresh_token";
 export const EXPIRES_IN = "expires_in";
+export const REFRESH_TOKEN_EXPIRES_IN = "refresh_token_expires_in";
 export const STATE = "state";
 export const NONCE = "nonce";
 export const PROMPT = "prompt";

package/src/error/InteractionRequiredAuthError.ts

@@ -15,6 +15,7 @@ export const InteractionRequiredServerErrorMessage = [
     InteractionRequiredAuthErrorCodes.interactionRequired,
     InteractionRequiredAuthErrorCodes.consentRequired,
     InteractionRequiredAuthErrorCodes.loginRequired,
+    InteractionRequiredAuthErrorCodes.badToken,
 ];
 
 export const InteractionRequiredAuthSubErrorMessage = [
@@ -23,6 +24,7 @@ export const InteractionRequiredAuthSubErrorMessage = [
     "basic_action",
     "user_password_expired",
     "consent_required",
+    "bad_token",
 ];
 
 const InteractionRequiredAuthErrorMessages = {
@@ -30,6 +32,10 @@ const InteractionRequiredAuthErrorMessages = {
         "No refresh token found in the cache. Please sign-in.",
     [InteractionRequiredAuthErrorCodes.nativeAccountUnavailable]:
         "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
+    [InteractionRequiredAuthErrorCodes.refreshTokenExpired]:
+        "Refresh token has expired.",
+    [InteractionRequiredAuthErrorCodes.badToken]:
+        "Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",
 };
 
 /**
@@ -49,6 +55,12 @@ export const InteractionRequiredAuthErrorMessage = {
             InteractionRequiredAuthErrorCodes.nativeAccountUnavailable
         ],
     },
+    bad_token: {
+        code: InteractionRequiredAuthErrorCodes.badToken,
+        desc: InteractionRequiredAuthErrorMessages[
+            InteractionRequiredAuthErrorCodes.badToken
+        ],
+    },
 };
 
 /**

package/src/error/InteractionRequiredAuthErrorCodes.ts

@@ -6,8 +6,10 @@
 // Codes defined by MSAL
 export const noTokensFound = "no_tokens_found";
 export const nativeAccountUnavailable = "native_account_unavailable";
+export const refreshTokenExpired = "refresh_token_expired";
 
 // Codes potentially returned by server
 export const interactionRequired = "interaction_required";
 export const consentRequired = "consent_required";
 export const loginRequired = "login_required";
+export const badToken = "bad_token";

package/src/index.ts

@@ -204,6 +204,7 @@ export {
     GrantType,
     AADAuthorityConstants,
     HttpStatus,
+    DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
     JsonWebTokenTypes,
 } from "./utils/Constants";
 export * as AADServerParamKeys from "./constants/AADServerParamKeys";

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.5.0";
+export const version = "14.6.0-alpha.0";

package/src/request/CommonSilentFlowRequest.ts

@@ -20,7 +20,14 @@ import { BaseAuthRequest } from "./BaseAuthRequest";
  * - tokenQueryParameters   - String to string map of custom query parameters added to the /token call
  */
 export type CommonSilentFlowRequest = BaseAuthRequest & {
+    /** Account object to lookup the credentials */
     account: AccountInfo;
+    /** Skip cache lookup and forces network call(s) to get fresh tokens */
     forceRefresh: boolean;
+    /** RedirectUri registered on the app registration - only required in brokering scenarios */
+    redirectUri?: string;
+    /** Key value pairs to include on the POST body to the /token endpoint */
     tokenBodyParameters?: StringDict;
+    /** If refresh token will expire within the configured value, consider it already expired. Used to pre-emptively invoke interaction when cached refresh token is close to expiry. */
+    refreshTokenExpirationOffsetSeconds?: number;
 };

package/src/response/ResponseHandler.ts

@@ -435,9 +435,10 @@ export class ResponseHandler {
                 idTokenClaims,
                 this.cryptoObj.base64Decode,
                 serverTokenResponse.client_info,
+                env,
                 claimsTenantId,
                 authCodePayload,
-                undefined,
+                undefined, // nativeAccountId
                 this.logger
             );
         }
@@ -497,13 +498,26 @@ export class ResponseHandler {
         // refreshToken
         let cachedRefreshToken: RefreshTokenEntity | null = null;
         if (serverTokenResponse.refresh_token) {
+            let rtExpiresOn: number | undefined;
+            if (serverTokenResponse.refresh_token_expires_in) {
+                const rtExpiresIn: number =
+                    typeof serverTokenResponse.refresh_token_expires_in ===
+                    "string"
+                        ? parseInt(
+                              serverTokenResponse.refresh_token_expires_in,
+                              10
+                          )
+                        : serverTokenResponse.refresh_token_expires_in;
+                rtExpiresOn = reqTimestamp + rtExpiresIn;
+            }
             cachedRefreshToken = CacheHelpers.createRefreshTokenEntity(
                 this.homeAccountIdentifier,
                 env,
                 serverTokenResponse.refresh_token,
                 this.clientId,
                 serverTokenResponse.foci,
-                userAssertionHash
+                userAssertionHash,
+                rtExpiresOn
             );
         }
 
@@ -654,6 +668,7 @@ export function buildAccountToCache(
     idTokenClaims: TokenClaims,
     base64Decode: (input: string) => string,
     clientInfo?: string,
+    environment?: string,
     claimsTenantId?: string | null,
     authCodePayload?: AuthorizationCodePayload,
     nativeAccountId?: string,
@@ -676,9 +691,10 @@ export function buildAccountToCache(
         cachedAccount ||
         AccountEntity.createAccount(
             {
-                homeAccountId: homeAccountId,
-                idTokenClaims: idTokenClaims,
-                clientInfo: clientInfo,
+                homeAccountId,
+                idTokenClaims,
+                clientInfo,
+                environment,
                 cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
                 msGraphHost: authCodePayload?.msgraph_host,
                 nativeAccountId: nativeAccountId,

package/src/response/ServerAuthorizationTokenResponse.ts

@@ -36,6 +36,7 @@ export type ServerAuthorizationTokenResponse = {
     ext_expires_in?: number;
     access_token?: string;
     refresh_token?: string;
+    refresh_token_expires_in?: number;
     id_token?: string;
     client_info?: string;
     foci?: string;

package/src/telemetry/performance/IPerformanceClient.ts

@@ -14,6 +14,9 @@ export type InProgressPerformanceEvent = {
     add: (fields: { [key: string]: {} | undefined }) => void;
     increment: (fields: { [key: string]: number | undefined }) => void;
     event: PerformanceEvent;
+    /**
+     * @deprecated This attribute will be removed in the next major version
+     */
     measurement: IPerformanceMeasurement;
 };
 
@@ -35,6 +38,9 @@ export interface IPerformanceClient {
     removePerformanceCallback(callbackId: string): boolean;
     addPerformanceCallback(callback: PerformanceCallbackFunction): string;
     emitEvents(events: PerformanceEvent[], correlationId: string): void;
+    /**
+     * @deprecated This method will be removed in the next major version
+     */
     startPerformanceMeasurement(
         measureName: string,
         correlationId: string

package/src/telemetry/performance/PerformanceClient.ts

@@ -11,13 +11,14 @@ import {
     PerformanceCallbackFunction,
     QueueMeasurement,
 } from "./IPerformanceClient";
-import { IPerformanceMeasurement } from "./IPerformanceMeasurement";
 import {
     IntFields,
     PerformanceEvent,
     PerformanceEvents,
     PerformanceEventStatus,
 } from "./PerformanceEvent";
+import { IPerformanceMeasurement } from "./IPerformanceMeasurement";
+import { StubPerformanceMeasurement } from "./StubPerformanceClient";
 
 export interface PreQueueEvent {
     name: PerformanceEvents;
@@ -111,6 +112,7 @@ export abstract class PerformanceClient implements IPerformanceClient {
      * @param {string} measureName
      * @param {string} correlationId
      * @returns {IPerformanceMeasurement}
+     * @deprecated This method will be removed in the next major version
      */
     startPerformanceMeasurement(
         measureName: string, // eslint-disable-line @typescript-eslint/no-unused-vars
@@ -273,11 +275,6 @@ export abstract class PerformanceClient implements IPerformanceClient {
             `PerformanceClient: Performance measurement started for ${measureName}`,
             eventCorrelationId
         );
-        const performanceMeasurement = this.startPerformanceMeasurement(
-            measureName,
-            eventCorrelationId
-        );
-        performanceMeasurement.startMeasurement();
 
         const inProgressEvent: PerformanceEvent = {
             eventId: this.generateId(),
@@ -301,15 +298,12 @@ export abstract class PerformanceClient implements IPerformanceClient {
             end: (
                 event?: Partial<PerformanceEvent>
             ): PerformanceEvent | null => {
-                return this.endMeasurement(
-                    {
-                        // Initial set of event properties
-                        ...inProgressEvent,
-                        // Properties set when event ends
-                        ...event,
-                    },
-                    performanceMeasurement
-                );
+                return this.endMeasurement({
+                    // Initial set of event properties
+                    ...inProgressEvent,
+                    // Properties set when event ends
+                    ...event,
+                });
             },
             discard: () => {
                 return this.discardMeasurements(inProgressEvent.correlationId);
@@ -323,8 +317,8 @@ export abstract class PerformanceClient implements IPerformanceClient {
                     inProgressEvent.correlationId
                 );
             },
-            measurement: performanceMeasurement,
             event: inProgressEvent,
+            measurement: new StubPerformanceMeasurement(),
         };
     }
 
@@ -338,10 +332,7 @@ export abstract class PerformanceClient implements IPerformanceClient {
      * @param {IPerformanceMeasurement} measurement
      * @returns {(PerformanceEvent | null)}
      */
-    endMeasurement(
-        event: PerformanceEvent,
-        measurement?: IPerformanceMeasurement
-    ): PerformanceEvent | null {
+    endMeasurement(event: PerformanceEvent): PerformanceEvent | null {
         const rootEvent: PerformanceEvent | undefined =
             this.eventsByCorrelationId.get(event.correlationId);
         if (!rootEvent) {
@@ -365,17 +356,8 @@ export abstract class PerformanceClient implements IPerformanceClient {
             rootEvent.incompleteSubMeasurements?.delete(event.eventId);
         }
 
-        measurement?.endMeasurement();
-        const durationMs = measurement?.flushMeasurement();
-        // null indicates no measurement was taken (e.g. needed performance APIs not present)
-        if (!durationMs) {
-            this.logger.trace(
-                "PerformanceClient: Performance measurement not taken",
-                rootEvent.correlationId
-            );
-            return null;
-        }
-
+        const durationMs =
+            event.durationMs || this.getDurationMs(event.startTimeMs);
         this.logger.trace(
             `PerformanceClient: Performance measurement ended for ${event.name}: ${durationMs} ms`,
             event.correlationId
@@ -633,4 +615,15 @@ export abstract class PerformanceClient implements IPerformanceClient {
             }
         });
     }
+
+    /**
+     * Returns event duration in milliseconds
+     * @param startTimeMs {number}
+     * @returns {number}
+     */
+    private getDurationMs(startTimeMs: number): number {
+        const durationMs = Date.now() - startTimeMs;
+        // Handle clock skew
+        return durationMs < 0 ? durationMs : 0;
+    }
 }

package/src/telemetry/performance/StubPerformanceClient.ts

@@ -54,7 +54,6 @@ export class StubPerformanceClient implements IPerformanceClient {
     startPerformanceMeasurement(): IPerformanceMeasurement {
         return new StubPerformanceMeasurement();
     }
-
     calculateQueuedTime(): number {
         return 0;
     }

package/src/utils/Constants.ts

@@ -68,6 +68,7 @@ export const HttpStatus = {
     SUCCESS_RANGE_END: 299,
     REDIRECT: 302,
     CLIENT_ERROR_RANGE_START: 400,
+    UNAUTHORIZED: 401,
     CLIENT_ERROR_RANGE_END: 499,
     SERVER_ERROR_RANGE_START: 500,
     SERVER_ERROR_RANGE_END: 599,
@@ -370,3 +371,6 @@ export type JsonWebTokenTypes =
     (typeof JsonWebTokenTypes)[keyof typeof JsonWebTokenTypes];
 
 export const ONE_DAY_IN_MS = 86400000;
+
+// Token renewal offset default in seconds
+export const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;

package/dist/cache/entities/ThrottlingEntity.mjs

@@ -1,30 +0,0 @@
-/*! @azure/msal-common v14.5.0 2023-12-01 */
-'use strict';
-import { ThrottlingConstants } from '../../utils/Constants.mjs';
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class ThrottlingEntity {
-    /**
-     * validates if a given cache entry is "Throttling", parses <key,value>
-     * @param key
-     * @param entity
-     */
-    static isThrottlingEntity(key, entity) {
-        let validateKey = false;
-        if (key) {
-            validateKey =
-                key.indexOf(ThrottlingConstants.THROTTLING_PREFIX) === 0;
-        }
-        let validateEntity = true;
-        if (entity) {
-            validateEntity = entity.hasOwnProperty("throttleTime");
-        }
-        return validateKey && validateEntity;
-    }
-}
-
-export { ThrottlingEntity };
-//# sourceMappingURL=ThrottlingEntity.mjs.map

package/dist/cache/entities/ThrottlingEntity.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ThrottlingEntity.mjs","sources":["../../../src/cache/entities/ThrottlingEntity.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAAA;;;AAGG;MAIU,gBAAgB,CAAA;AASzB;;;;AAIG;AACH,IAAA,OAAO,kBAAkB,CAAC,GAAW,EAAE,MAAe,EAAA;QAClD,IAAI,WAAW,GAAY,KAAK,CAAC;AACjC,QAAA,IAAI,GAAG,EAAE;YACL,WAAW;gBACP,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAChE,SAAA;QAED,IAAI,cAAc,GAAY,IAAI,CAAC;AACnC,QAAA,IAAI,MAAM,EAAE;AACR,YAAA,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;AAC1D,SAAA;QAED,OAAO,WAAW,IAAI,cAAc,CAAC;KACxC;AACJ;;;;"}