@azure/msal-common 14.8.1 → 14.9.1-alpha.0

package/src/client/AuthorizationCodeClient.ts

@@ -50,6 +50,8 @@ import { RequestValidator } from "../request/RequestValidator";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { invokeAsync } from "../utils/FunctionWrappers";
+import { ClientAssertion } from "../account/ClientCredentials";
+import { getClientAssertion } from "../utils/ClientAssertionUtils";
 
 /**
  * Oauth2.0 Authorization Code client
@@ -364,9 +366,16 @@ export class AuthorizationCodeClient extends BaseClient {
         }
 
         if (this.config.clientCredentials.clientAssertion) {
-            const clientAssertion =
+            const clientAssertion: ClientAssertion =
                 this.config.clientCredentials.clientAssertion;
-            parameterBuilder.addClientAssertion(clientAssertion.assertion);
+
+            parameterBuilder.addClientAssertion(
+                await getClientAssertion(
+                    clientAssertion.assertion,
+                    this.config.authOptions.clientId,
+                    request.resourceRequestUri
+                )
+            );
             parameterBuilder.addClientAssertionType(
                 clientAssertion.assertionType
             );
@@ -557,9 +566,17 @@ export class AuthorizationCodeClient extends BaseClient {
                 parameterBuilder.addSid(request.sid);
             } else if (request.account) {
                 const accountSid = this.extractAccountSid(request.account);
-                const accountLoginHintClaim = this.extractLoginHint(
+                let accountLoginHintClaim = this.extractLoginHint(
                     request.account
                 );
+
+                if (accountLoginHintClaim && request.domainHint) {
+                    this.logger.warning(
+                        `AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`
+                    );
+                    accountLoginHintClaim = null;
+                }
+
                 // If login_hint claim is present, use it over sid/username
                 if (accountLoginHintClaim) {
                     this.logger.verbose(

package/src/client/RefreshTokenClient.ts

@@ -48,6 +48,8 @@ import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient";
 import { invoke, invokeAsync } from "../utils/FunctionWrappers";
 import { generateCredentialKey } from "../cache/utils/CacheHelpers";
+import { ClientAssertion } from "../account/ClientCredentials";
+import { getClientAssertion } from "../utils/ClientAssertionUtils";
 
 const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
 
@@ -385,9 +387,16 @@ export class RefreshTokenClient extends BaseClient {
         }
 
         if (this.config.clientCredentials.clientAssertion) {
-            const clientAssertion =
+            const clientAssertion: ClientAssertion =
                 this.config.clientCredentials.clientAssertion;
-            parameterBuilder.addClientAssertion(clientAssertion.assertion);
+
+            parameterBuilder.addClientAssertion(
+                await getClientAssertion(
+                    clientAssertion.assertion,
+                    this.config.authOptions.clientId,
+                    request.resourceRequestUri
+                )
+            );
             parameterBuilder.addClientAssertionType(
                 clientAssertion.assertionType
             );

package/src/config/ClientConfiguration.ts

@@ -6,7 +6,10 @@
 import { INetworkModule } from "../network/INetworkModule";
 import { DEFAULT_CRYPTO_IMPLEMENTATION, ICrypto } from "../crypto/ICrypto";
 import { ILoggerCallback, Logger, LogLevel } from "../logger/Logger";
-import { Constants } from "../utils/Constants";
+import {
+    Constants,
+    DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
+} from "../utils/Constants";
 import { version } from "../packageMetadata";
 import { Authority } from "../authority/Authority";
 import { AzureCloudInstance } from "../authority/AuthorityOptions";
@@ -21,9 +24,6 @@ import {
     createClientAuthError,
 } from "../error/ClientAuthError";
 
-// Token renewal offset default in seconds
-const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-
 /**
  * Use the configuration object to configure MSAL Modules and initialize the base interfaces for MSAL.
  *

package/src/error/CacheError.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import * as CacheErrorCodes from "./CacheErrorCodes";
+export { CacheErrorCodes };
+
+export const CacheErrorMessages = {
+    [CacheErrorCodes.cacheQuotaExceededErrorCode]:
+        "Exceeded cache storage capacity.",
+    [CacheErrorCodes.cacheUnknownErrorCode]:
+        "Unexpected error occurred when using cache storage.",
+};
+
+/**
+ * Error thrown when there is an error with the cache
+ */
+export class CacheError extends Error {
+    /**
+     * Short string denoting error
+     */
+    errorCode: string;
+
+    /**
+     * Detailed description of error
+     */
+    errorMessage: string;
+
+    constructor(errorCode: string, errorMessage?: string) {
+        const message =
+            errorMessage ||
+            (CacheErrorMessages[errorCode]
+                ? CacheErrorMessages[errorCode]
+                : CacheErrorMessages[CacheErrorCodes.cacheUnknownErrorCode]);
+
+        super(`${errorCode}: ${message}`);
+        Object.setPrototypeOf(this, CacheError.prototype);
+
+        this.name = "CacheError";
+        this.errorCode = errorCode;
+        this.errorMessage = message;
+    }
+}

package/src/error/CacheErrorCodes.ts

@@ -0,0 +1,7 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
+export const cacheUnknownErrorCode = "cache_error_unknown";

package/src/error/InteractionRequiredAuthError.ts

@@ -88,6 +88,11 @@ export class InteractionRequiredAuthError extends AuthError {
      */
     claims: string;
 
+    /**
+     * Server error number;
+     */
+    readonly errorNo?: string;
+
     constructor(
         errorCode?: string,
         errorMessage?: string,
@@ -95,7 +100,8 @@ export class InteractionRequiredAuthError extends AuthError {
         timestamp?: string,
         traceId?: string,
         correlationId?: string,
-        claims?: string
+        claims?: string,
+        errorNo?: string
     ) {
         super(errorCode, errorMessage, subError);
         Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
@@ -105,6 +111,7 @@ export class InteractionRequiredAuthError extends AuthError {
         this.correlationId = correlationId || Constants.EMPTY_STRING;
         this.claims = claims || Constants.EMPTY_STRING;
         this.name = "InteractionRequiredAuthError";
+        this.errorNo = errorNo;
     }
 }
 

package/src/error/ServerError.ts

@@ -9,9 +9,20 @@ import { AuthError } from "./AuthError";
  * Error thrown when there is an error with the server code, for example, unavailability.
  */
 export class ServerError extends AuthError {
-    constructor(errorCode?: string, errorMessage?: string, subError?: string) {
+    /**
+     * Server error number;
+     */
+    readonly errorNo?: string;
+
+    constructor(
+        errorCode?: string,
+        errorMessage?: string,
+        subError?: string,
+        errorNo?: string
+    ) {
         super(errorCode, errorMessage, subError);
         this.name = "ServerError";
+        this.errorNo = errorNo;
 
         Object.setPrototypeOf(this, ServerError.prototype);
     }

package/src/index.ts

@@ -133,7 +133,11 @@ export { NativeRequest } from "./request/NativeRequest";
 export { NativeSignOutRequest } from "./request/NativeSignOutRequest";
 export { RequestParameterBuilder } from "./request/RequestParameterBuilder";
 export { StoreInCache } from "./request/StoreInCache";
-export { ClientAssertion } from "./account/ClientCredentials";
+export {
+    ClientAssertion,
+    ClientAssertionConfig,
+    ClientAssertionCallback,
+} from "./account/ClientCredentials";
 // Response
 export { AzureRegion } from "./authority/AzureRegion";
 export { AzureRegionConfiguration } from "./authority/AzureRegionConfiguration";
@@ -168,6 +172,7 @@ export {
     createAuthError,
 } from "./error/AuthError";
 export { ServerError } from "./error/ServerError";
+export { CacheError, CacheErrorCodes } from "./error/CacheError";
 export {
     ClientAuthError,
     ClientAuthErrorMessage,
@@ -181,6 +186,7 @@ export {
     createClientConfigurationError,
 } from "./error/ClientConfigurationError";
 // Constants and Utils
+export { getClientAssertion } from "./utils/ClientAssertionUtils";
 export {
     Constants,
     OIDC_DEFAULT_SCOPES,
@@ -204,6 +210,7 @@ export {
     GrantType,
     AADAuthorityConstants,
     HttpStatus,
+    DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
     JsonWebTokenTypes,
 } from "./utils/Constants";
 export * as AADServerParamKeys from "./constants/AADServerParamKeys";
@@ -216,6 +223,7 @@ export {
 } from "./utils/ProtocolUtils";
 export * as TimeUtils from "./utils/TimeUtils";
 export * as UrlUtils from "./utils/UrlUtils";
+export * as ClientAssertionUtils from "./utils/ClientAssertionUtils";
 export * from "./utils/FunctionWrappers";
 // Server Telemetry
 export { ServerTelemetryManager } from "./telemetry/server/ServerTelemetryManager";

package/src/network/INetworkModule.ts

@@ -31,7 +31,7 @@ export interface INetworkModule {
     sendGetRequestAsync<T>(
         url: string,
         options?: NetworkRequestOptions,
-        cancellationToken?: number
+        timeout?: number
     ): Promise<NetworkResponse<T>>;
 
     /**

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.8.1";
+export const version = "14.9.1-alpha.0";

package/src/request/BaseAuthRequest.ts

@@ -27,6 +27,7 @@ import { ShrOptions } from "../crypto/SignedHttpRequest";
  * - requestedClaimsHash     - SHA 256 hash string of the requested claims string, used as part of an access token cache key so tokens can be filtered by requested claims
  * - tokenQueryParameters    - String to string map of custom query parameters added to the /token call
  * - storeInCache            - Object containing boolean values indicating whether to store tokens in the cache or not (default is true)
+ * - scenarioId              - Scenario id to track custom user prompts
  */
 export type BaseAuthRequest = {
     authority: string;
@@ -46,4 +47,5 @@ export type BaseAuthRequest = {
     maxAge?: number;
     tokenQueryParameters?: StringDict;
     storeInCache?: StoreInCache;
+    scenarioId?: string;
 };

package/src/response/ResponseHandler.ts

@@ -53,6 +53,19 @@ import {
 } from "../account/AccountInfo";
 import * as CacheHelpers from "../cache/utils/CacheHelpers";
 
+function parseServerErrorNo(
+    serverResponse: ServerAuthorizationCodeResponse
+): string | undefined {
+    const errorCodePrefix = "code=";
+    const errorCodePrefixIndex =
+        serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
+    return errorCodePrefixIndex && errorCodePrefixIndex >= 0
+        ? serverResponse.error_uri?.substring(
+              errorCodePrefixIndex + errorCodePrefix.length
+          )
+        : undefined;
+}
+
 /**
  * Class that handles response parsing.
  * @internal
@@ -140,6 +153,7 @@ export class ResponseHandler {
             serverResponse.error_description ||
             serverResponse.suberror
         ) {
+            const serverErrorNo = parseServerErrorNo(serverResponse);
             if (
                 isInteractionRequiredError(
                     serverResponse.error,
@@ -154,14 +168,16 @@ export class ResponseHandler {
                     serverResponse.timestamp || "",
                     serverResponse.trace_id || "",
                     serverResponse.correlation_id || "",
-                    serverResponse.claims || ""
+                    serverResponse.claims || "",
+                    serverErrorNo
                 );
             }
 
             throw new ServerError(
                 serverResponse.error || "",
                 serverResponse.error_description,
-                serverResponse.suberror
+                serverResponse.suberror,
+                serverErrorNo
             );
         }
     }
@@ -182,10 +198,14 @@ export class ResponseHandler {
             serverResponse.suberror
         ) {
             const errString = `${serverResponse.error_codes} - [${serverResponse.timestamp}]: ${serverResponse.error_description} - Correlation ID: ${serverResponse.correlation_id} - Trace ID: ${serverResponse.trace_id}`;
+            const serverErrorNo = serverResponse.error_codes?.length
+                ? serverResponse.error_codes[0]
+                : undefined;
             const serverError = new ServerError(
                 serverResponse.error,
                 errString,
-                serverResponse.suberror
+                serverResponse.suberror,
+                serverErrorNo
             );
 
             // check if 500 error
@@ -230,7 +250,8 @@ export class ResponseHandler {
                     serverResponse.timestamp || Constants.EMPTY_STRING,
                     serverResponse.trace_id || Constants.EMPTY_STRING,
                     serverResponse.correlation_id || Constants.EMPTY_STRING,
-                    serverResponse.claims || Constants.EMPTY_STRING
+                    serverResponse.claims || Constants.EMPTY_STRING,
+                    serverErrorNo
                 );
             }
 
@@ -364,7 +385,8 @@ export class ResponseHandler {
             }
             await this.cacheStorage.saveCacheRecord(
                 cacheRecord,
-                request.storeInCache
+                request.storeInCache,
+                request.correlationId
             );
         } finally {
             if (

package/src/response/ServerAuthorizationCodeResponse.ts

@@ -22,6 +22,7 @@ export type ServerAuthorizationCodeResponse = {
     msgraph_host?: string;
     // Error case
     error?: string;
+    error_uri?: string;
     error_description?: string;
     suberror?: string;
     timestamp?: string;

package/src/telemetry/performance/PerformanceClient.ts

@@ -23,6 +23,9 @@ import {
 import { IPerformanceMeasurement } from "./IPerformanceMeasurement";
 import { StubPerformanceMeasurement } from "./StubPerformanceClient";
 import { AuthError } from "../../error/AuthError";
+import { CacheError } from "../../error/CacheError";
+import { ServerError } from "../../error/ServerError";
+import { InteractionRequiredAuthError } from "../../error/InteractionRequiredAuthError";
 
 export interface PreQueueEvent {
     name: PerformanceEvents;
@@ -153,6 +156,15 @@ export function addError(
     } else if (error instanceof AuthError) {
         event.errorCode = error.errorCode;
         event.subErrorCode = error.subError;
+        if (
+            error instanceof ServerError ||
+            error instanceof InteractionRequiredAuthError
+        ) {
+            event.serverErrorNo = error.errorNo;
+        }
+        return;
+    } else if (error instanceof CacheError) {
+        event.errorCode = error.errorCode;
         return;
     } else if (event.errorStack?.length) {
         logger.trace(
@@ -608,7 +620,7 @@ export abstract class PerformanceClient implements IPerformanceClient {
 
         if (isRoot) {
             queueInfo = this.getQueueInfo(event.correlationId);
-            this.discardCache(rootEvent.correlationId);
+            this.discardMeasurements(rootEvent.correlationId);
         } else {
             rootEvent.incompleteSubMeasurements?.delete(event.eventId);
         }
@@ -769,7 +781,7 @@ export abstract class PerformanceClient implements IPerformanceClient {
     }
 
     /**
-     * Removes measurements for a given correlation id.
+     * Removes measurements and aux data for a given correlation id.
      *
      * @param {string} correlationId
      */
@@ -779,15 +791,6 @@ export abstract class PerformanceClient implements IPerformanceClient {
             correlationId
         );
         this.eventsByCorrelationId.delete(correlationId);
-    }
-
-    /**
-     * Removes cache for a given correlation id.
-     *
-     * @param {string} correlationId correlation identifier
-     */
-    private discardCache(correlationId: string): void {
-        this.discardMeasurements(correlationId);
 
         this.logger.trace(
             "PerformanceClient: QueueMeasurements discarded",

package/src/telemetry/performance/PerformanceEvent.ts

@@ -69,6 +69,7 @@ export const PerformanceEvents = {
      * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
      */
     SilentIframeClientAcquireToken: "silentIframeClientAcquireToken",
+    AwaitConcurrentIframe: "awaitConcurrentIframe", // Time spent waiting for a concurrent iframe to complete
 
     /**
      * acquireToken API in SilentRereshClient (msal-browser).
@@ -646,6 +647,11 @@ export type PerformanceEvent = {
      */
     subErrorCode?: string;
 
+    /**
+     * Server error number
+     */
+    serverErrorNo?: string;
+
     /**
      * Name of the library used for the operation.
      *
@@ -701,6 +707,11 @@ export type PerformanceEvent = {
 
     visibilityChangeCount?: number;
     incompleteSubsCount?: number;
+
+    /**
+     * CorrelationId of the in progress iframe request that was awaited
+     */
+    awaitIframeCorrelationId?: string;
     /**
      * Amount of times queued in the JS event queue.
      *
@@ -798,6 +809,16 @@ export type PerformanceEvent = {
 
     // Event context as JSON string
     context?: string;
+
+    // Number of tokens in the cache to be reported when cache quota is exceeded
+    cacheRtCount?: number;
+    cacheIdCount?: number;
+    cacheAtCount?: number;
+
+    // Scenario id to track custom user prompts
+    scenarioId?: string;
+
+    accountType?: "AAD" | "MSA" | "B2C";
 };
 
 export type PerformanceEventContext = {

package/src/utils/ClientAssertionUtils.ts

@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    ClientAssertionCallback,
+    ClientAssertionConfig,
+} from "../account/ClientCredentials";
+
+export async function getClientAssertion(
+    clientAssertion: string | ClientAssertionCallback,
+    clientId: string,
+    tokenEndpoint?: string
+): Promise<string> {
+    if (typeof clientAssertion === "string") {
+        return clientAssertion;
+    } else {
+        const config: ClientAssertionConfig = {
+            clientId: clientId,
+            tokenEndpoint: tokenEndpoint,
+        };
+        return clientAssertion(config);
+    }
+}

package/src/utils/Constants.ts

@@ -64,13 +64,24 @@ export const Constants = {
 };
 
 export const HttpStatus = {
+    SUCCESS: 200,
     SUCCESS_RANGE_START: 200,
     SUCCESS_RANGE_END: 299,
     REDIRECT: 302,
+    CLIENT_ERROR: 400,
     CLIENT_ERROR_RANGE_START: 400,
+    BAD_REQUEST: 400,
+    UNAUTHORIZED: 401,
+    NOT_FOUND: 404,
+    REQUEST_TIMEOUT: 408,
+    TOO_MANY_REQUESTS: 429,
     CLIENT_ERROR_RANGE_END: 499,
+    SERVER_ERROR: 500,
     SERVER_ERROR_RANGE_START: 500,
+    SERVICE_UNAVAILABLE: 503,
+    GATEWAY_TIMEOUT: 504,
     SERVER_ERROR_RANGE_END: 599,
+    MULTI_SIDED_ERROR: 600,
 } as const;
 export type HttpStatus = (typeof HttpStatus)[keyof typeof HttpStatus];
 
@@ -370,3 +381,6 @@ export type JsonWebTokenTypes =
     (typeof JsonWebTokenTypes)[keyof typeof JsonWebTokenTypes];
 
 export const ONE_DAY_IN_MS = 86400000;
+
+// Token renewal offset default in seconds
+export const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;