@azure/msal-common 15.13.3 → 16.0.0-beta.0

package/src/cache/entities/AccessTokenEntity.ts

@@ -24,8 +24,4 @@ export type AccessTokenEntity = CredentialEntity & {
     refreshOn?: string;
     /** Matches the authentication scheme for which the token was issued (i.e. Bearer or pop) */
     tokenType?: AuthenticationScheme;
-    /** Stringified claims object */
-    requestedClaims?: string;
-    /** Matches the SHA 256 hash of the claims object included in the token request */
-    requestedClaimsHash?: string;
 };

package/src/cache/entities/AccountEntity.ts

@@ -3,27 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { CacheAccountType } from "../../utils/Constants.js";
-import type { Authority } from "../../authority/Authority.js";
-import { ICrypto } from "../../crypto/ICrypto.js";
-import { ClientInfo, buildClientInfo } from "../../account/ClientInfo.js";
-import {
-    AccountInfo,
-    TenantProfile,
-    buildTenantProfile,
-    DataBoundary,
-} from "../../account/AccountInfo.js";
-import {
-    createClientAuthError,
-    ClientAuthErrorCodes,
-} from "../../error/ClientAuthError.js";
-import { AuthorityType } from "../../authority/AuthorityType.js";
-import { Logger } from "../../logger/Logger.js";
-import {
-    TokenClaims,
-    getTenantIdFromIdTokenClaims,
-} from "../../account/TokenClaims.js";
-import { ProtocolMode } from "../../authority/ProtocolMode.js";
+import { TenantProfile, DataBoundary } from "../../account/AccountInfo.js";
 
 /**
  * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
@@ -48,7 +28,7 @@ import { ProtocolMode } from "../../authority/ProtocolMode.js";
  * }
  * @internal
  */
-export class AccountEntity {
+export type AccountEntity = {
     homeAccountId: string;
     environment: string;
     realm: string;
@@ -64,275 +44,7 @@ export class AccountEntity {
     msGraphHost?: string;
     nativeAccountId?: string;
     tenantProfiles?: Array<TenantProfile>;
+    /** Timestamp when the entry was last updated */
     lastUpdatedAt: string;
     dataBoundary?: DataBoundary;
-
-    /**
-     * Returns the AccountInfo interface for this account.
-     */
-    static getAccountInfo(accountEntity: AccountEntity): AccountInfo {
-        return {
-            homeAccountId: accountEntity.homeAccountId,
-            environment: accountEntity.environment,
-            tenantId: accountEntity.realm,
-            username: accountEntity.username,
-            localAccountId: accountEntity.localAccountId,
-            loginHint: accountEntity.loginHint,
-            name: accountEntity.name,
-            nativeAccountId: accountEntity.nativeAccountId,
-            authorityType: accountEntity.authorityType,
-            // Deserialize tenant profiles array into a Map
-            tenantProfiles: new Map(
-                (accountEntity.tenantProfiles || []).map((tenantProfile) => {
-                    return [tenantProfile.tenantId, tenantProfile];
-                })
-            ),
-            dataBoundary: accountEntity.dataBoundary,
-        };
-    }
-
-    /**
-     * Returns true if the account entity is in single tenant format (outdated), false otherwise
-     */
-    isSingleTenant(): boolean {
-        return !this.tenantProfiles;
-    }
-
-    /**
-     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-     * @param accountDetails
-     */
-    static createAccount(
-        accountDetails: {
-            homeAccountId: string;
-            idTokenClaims?: TokenClaims;
-            clientInfo?: string;
-            cloudGraphHostName?: string;
-            msGraphHost?: string;
-            environment?: string;
-            nativeAccountId?: string;
-            tenantProfiles?: Array<TenantProfile>;
-        },
-        authority: Authority,
-        base64Decode?: (input: string) => string
-    ): AccountEntity {
-        const account: AccountEntity = new AccountEntity();
-
-        if (authority.authorityType === AuthorityType.Adfs) {
-            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
-        } else if (authority.protocolMode === ProtocolMode.OIDC) {
-            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        } else {
-            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
-        }
-
-        let clientInfo: ClientInfo | undefined;
-
-        if (accountDetails.clientInfo && base64Decode) {
-            clientInfo = buildClientInfo(
-                accountDetails.clientInfo,
-                base64Decode
-            );
-            if (clientInfo.xms_tdbr) {
-                account.dataBoundary =
-                    clientInfo.xms_tdbr === "EU" ? "EU" : "None";
-            }
-        }
-
-        account.clientInfo = accountDetails.clientInfo;
-        account.homeAccountId = accountDetails.homeAccountId;
-        account.nativeAccountId = accountDetails.nativeAccountId;
-
-        const env =
-            accountDetails.environment ||
-            (authority && authority.getPreferredCache());
-
-        if (!env) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.invalidCacheEnvironment
-            );
-        }
-
-        account.environment = env;
-        // non AAD scenarios can have empty realm
-        account.realm =
-            clientInfo?.utid ||
-            getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
-            "";
-
-        // How do you account for MSA CID here?
-        account.localAccountId =
-            clientInfo?.uid ||
-            accountDetails.idTokenClaims?.oid ||
-            accountDetails.idTokenClaims?.sub ||
-            "";
-
-        /*
-         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-         * In most cases it will contain a single email. This field should not be relied upon if a custom
-         * policy is configured to return more than 1 email.
-         */
-        const preferredUsername =
-            accountDetails.idTokenClaims?.preferred_username ||
-            accountDetails.idTokenClaims?.upn;
-        const email = accountDetails.idTokenClaims?.emails
-            ? accountDetails.idTokenClaims.emails[0]
-            : null;
-
-        account.username = preferredUsername || email || "";
-        account.loginHint = accountDetails.idTokenClaims?.login_hint;
-        account.name = accountDetails.idTokenClaims?.name || "";
-
-        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
-        account.msGraphHost = accountDetails.msGraphHost;
-
-        if (accountDetails.tenantProfiles) {
-            account.tenantProfiles = accountDetails.tenantProfiles;
-        } else {
-            const tenantProfile = buildTenantProfile(
-                accountDetails.homeAccountId,
-                account.localAccountId,
-                account.realm,
-                accountDetails.idTokenClaims
-            );
-            account.tenantProfiles = [tenantProfile];
-        }
-
-        return account;
-    }
-
-    /**
-     * Creates an AccountEntity object from AccountInfo
-     * @param accountInfo
-     * @param cloudGraphHostName
-     * @param msGraphHost
-     * @returns
-     */
-    static createFromAccountInfo(
-        accountInfo: AccountInfo,
-        cloudGraphHostName?: string,
-        msGraphHost?: string
-    ): AccountEntity {
-        const account: AccountEntity = new AccountEntity();
-
-        account.authorityType =
-            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        account.homeAccountId = accountInfo.homeAccountId;
-        account.localAccountId = accountInfo.localAccountId;
-        account.nativeAccountId = accountInfo.nativeAccountId;
-
-        account.realm = accountInfo.tenantId;
-        account.environment = accountInfo.environment;
-
-        account.username = accountInfo.username;
-        account.name = accountInfo.name;
-        account.loginHint = accountInfo.loginHint;
-
-        account.cloudGraphHostName = cloudGraphHostName;
-        account.msGraphHost = msGraphHost;
-        // Serialize tenant profiles map into an array
-        account.tenantProfiles = Array.from(
-            accountInfo.tenantProfiles?.values() || []
-        );
-        account.dataBoundary = accountInfo.dataBoundary;
-
-        return account;
-    }
-
-    /**
-     * Generate HomeAccountId from server response
-     * @param serverClientInfo
-     * @param authType
-     */
-    static generateHomeAccountId(
-        serverClientInfo: string,
-        authType: AuthorityType,
-        logger: Logger,
-        cryptoObj: ICrypto,
-        idTokenClaims?: TokenClaims
-    ): string {
-        // since ADFS/DSTS do not have tid and does not set client_info
-        if (
-            !(
-                authType === AuthorityType.Adfs ||
-                authType === AuthorityType.Dsts
-            )
-        ) {
-            // for cases where there is clientInfo
-            if (serverClientInfo) {
-                try {
-                    const clientInfo = buildClientInfo(
-                        serverClientInfo,
-                        cryptoObj.base64Decode
-                    );
-                    if (clientInfo.uid && clientInfo.utid) {
-                        return `${clientInfo.uid}.${clientInfo.utid}`;
-                    }
-                } catch (e) {}
-            }
-            logger.warning("No client info in response");
-        }
-
-        // default to "sub" claim
-        return idTokenClaims?.sub || "";
-    }
-
-    /**
-     * Validates an entity: checks for all expected params
-     * @param entity
-     */
-    static isAccountEntity(entity: object): entity is AccountEntity {
-        if (!entity) {
-            return false;
-        }
-
-        return (
-            entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("localAccountId") &&
-            entity.hasOwnProperty("username") &&
-            entity.hasOwnProperty("authorityType")
-        );
-    }
-
-    /**
-     * Helper function to determine whether 2 accountInfo objects represent the same account
-     * @param accountA
-     * @param accountB
-     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
-     */
-    static accountInfoIsEqual(
-        accountA: AccountInfo | null,
-        accountB: AccountInfo | null,
-        compareClaims?: boolean
-    ): boolean {
-        if (!accountA || !accountB) {
-            return false;
-        }
-
-        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
-        if (compareClaims) {
-            const accountAClaims = (accountA.idTokenClaims ||
-                {}) as TokenClaims;
-            const accountBClaims = (accountB.idTokenClaims ||
-                {}) as TokenClaims;
-
-            // issued at timestamp and nonce are expected to change each time a new id token is acquired
-            claimsMatch =
-                accountAClaims.iat === accountBClaims.iat &&
-                accountAClaims.nonce === accountBClaims.nonce;
-        }
-
-        return (
-            accountA.homeAccountId === accountB.homeAccountId &&
-            accountA.localAccountId === accountB.localAccountId &&
-            accountA.username === accountB.username &&
-            accountA.tenantId === accountB.tenantId &&
-            accountA.loginHint === accountB.loginHint &&
-            accountA.environment === accountB.environment &&
-            accountA.nativeAccountId === accountB.nativeAccountId &&
-            claimsMatch
-        );
-    }
-}
+};

package/src/cache/entities/CredentialEntity.ts

@@ -31,8 +31,6 @@ export type CredentialEntity = {
     tokenType?: AuthenticationScheme;
     /** KeyId for PoP and SSH tokens stored in the kid claim */
     keyId?: string;
-    /** Matches the SHA 256 hash of the claims object included in the token request */
-    requestedClaimsHash?: string;
     /** Timestamp when the entry was last updated */
     lastUpdatedAt: string;
 };

package/src/cache/interface/ICacheManager.ts

@@ -20,6 +20,7 @@ export interface ICacheManager {
     /**
      * fetch the account entity from the platform cache
      * @param accountKey
+     * @param correlationId
      */
     getAccount(accountKey: string, correlationId: string): AccountEntity | null;
 
@@ -27,7 +28,6 @@ export interface ICacheManager {
      * set account entity in the platform cache
      * @param account
      * @param correlationId
-     * @param kmsi
      */
     setAccount(
         account: AccountEntity,
@@ -38,6 +38,7 @@ export interface ICacheManager {
     /**
      * fetch the idToken entity from the platform cache
      * @param idTokenKey
+     * @param correlationId
      */
     getIdTokenCredential(
         idTokenKey: string,
@@ -48,7 +49,6 @@ export interface ICacheManager {
      * set idToken entity to the platform cache
      * @param idToken
      * @param correlationId
-     * @param kmsi
      */
     setIdTokenCredential(
         idToken: IdTokenEntity,
@@ -59,6 +59,7 @@ export interface ICacheManager {
     /**
      * fetch the idToken entity from the platform cache
      * @param accessTokenKey
+     * @param correlationId
      */
     getAccessTokenCredential(
         accessTokenKey: string,
@@ -69,7 +70,6 @@ export interface ICacheManager {
      * set idToken entity to the platform cache
      * @param accessToken
      * @param correlationId
-     * @param kmsi
      */
     setAccessTokenCredential(
         accessToken: AccessTokenEntity,
@@ -80,6 +80,7 @@ export interface ICacheManager {
     /**
      * fetch the idToken entity from the platform cache
      * @param refreshTokenKey
+     * @param correlationId
      */
     getRefreshTokenCredential(
         refreshTokenKey: string,
@@ -90,7 +91,6 @@ export interface ICacheManager {
      * set idToken entity to the platform cache
      * @param refreshToken
      * @param correlationId
-     * @param kmsi
      */
     setRefreshTokenCredential(
         refreshToken: RefreshTokenEntity,
@@ -101,27 +101,35 @@ export interface ICacheManager {
     /**
      * fetch appMetadata entity from the platform cache
      * @param appMetadataKey
+     * @param correlationId
      */
-    getAppMetadata(appMetadataKey: string): AppMetadataEntity | null;
+    getAppMetadata(
+        appMetadataKey: string,
+        correlationId: string
+    ): AppMetadataEntity | null;
 
     /**
      * set appMetadata entity to the platform cache
      * @param appMetadata
+     * @param correlationId
      */
     setAppMetadata(appMetadata: AppMetadataEntity, correlationId: string): void;
 
     /**
      * fetch server telemetry entity from the platform cache
      * @param serverTelemetryKey
+     * @param correlationId
      */
     getServerTelemetry(
-        serverTelemetryKey: string
+        serverTelemetryKey: string,
+        correlationId: string
     ): ServerTelemetryEntity | null;
 
     /**
      * set server telemetry entity to the platform cache
      * @param serverTelemetryKey
      * @param serverTelemetry
+     * @param correlationId
      */
     setServerTelemetry(
         serverTelemetryKey: string,
@@ -132,43 +140,66 @@ export interface ICacheManager {
     /**
      * fetch cloud discovery metadata entity from the platform cache
      * @param key
+     * @param correlationId
      */
-    getAuthorityMetadata(key: string): AuthorityMetadataEntity | null;
+    getAuthorityMetadata(
+        key: string,
+        correlationId: string
+    ): AuthorityMetadataEntity | null;
 
     /**
      * Get cache keys for authority metadata
+     * @param correlationId
      */
-    getAuthorityMetadataKeys(): Array<string>;
+    getAuthorityMetadataKeys(correlationId: string): Array<string>;
 
     /**
      * set cloud discovery metadata entity to the platform cache
      * @param key
      * @param value
+     * @param correlationId
      */
-    setAuthorityMetadata(key: string, value: AuthorityMetadataEntity): void;
+    setAuthorityMetadata(
+        key: string,
+        value: AuthorityMetadataEntity,
+        correlationId: string
+    ): void;
 
     /**
      * Provide an alias to find a matching AuthorityMetadataEntity in cache
      * @param host
+     * @param correlationId
      */
-    getAuthorityMetadataByAlias(host: string): AuthorityMetadataEntity | null;
+    getAuthorityMetadataByAlias(
+        host: string,
+        correlationId: string
+    ): AuthorityMetadataEntity | null;
 
     /**
      * given an authority generates the cache key for authorityMetadata
      * @param authority
+     * @param correlationId
      */
-    generateAuthorityMetadataCacheKey(authority: string): string;
+    generateAuthorityMetadataCacheKey(
+        authority: string,
+        correlationId: string
+    ): string;
 
     /**
      * fetch throttling entity from the platform cache
      * @param throttlingCacheKey
+     * @param correlationId
      */
-    getThrottlingCache(throttlingCacheKey: string): ThrottlingEntity | null;
+    getThrottlingCache(
+        throttlingCacheKey: string,
+        correlationId: string
+    ): ThrottlingEntity | null;
 
     /**
      * set throttling entity to the platform cache
      * @param throttlingCacheKey
      * @param throttlingCache
+     * @param correlationId
      */
     setThrottlingCache(
         throttlingCacheKey: string,
@@ -178,17 +209,15 @@ export interface ICacheManager {
 
     /**
      * Returns all accounts in cache
+     * @param filter
+     * @param correlationId
      */
-    getAllAccounts(
-        accountFilter: AccountFilter,
-        correlationId: string
-    ): AccountInfo[];
+    getAllAccounts(filter: AccountFilter, correlationId: string): AccountInfo[];
 
     /**
      * saves a cache record
      * @param cacheRecord
      * @param correlationId
-     * @param kmsi
      * @param storeInCache
      */
     saveCacheRecord(
@@ -200,9 +229,8 @@ export interface ICacheManager {
 
     /**
      * retrieve accounts matching all provided filters; if no filter is set, get all accounts
-     * @param homeAccountId
-     * @param environment
-     * @param realm
+     * @param filter
+     * @param correlationId
      */
     getAccountsFilteredBy(
         filter: AccountFilter,
@@ -212,6 +240,7 @@ export interface ICacheManager {
     /**
      * Get AccountInfo object based on provided filters
      * @param filter
+     * @param correlationId
      */
     getAccountInfoFilteredBy(
         filter: AccountFilter,
@@ -220,33 +249,39 @@ export interface ICacheManager {
 
     /**
      * Removes all accounts and related tokens from cache.
+     * @param correlationId
      */
     removeAllAccounts(correlationId: string): void;
 
     /**
      * returns a boolean if the given account is removed
      * @param account
+     * @param correlationId
      */
     removeAccount(account: AccountInfo, correlationId: string): void;
 
     /**
      * returns a boolean if the given account is removed
      * @param account
+     * @param correlationId
      */
     removeAccountContext(account: AccountInfo, correlationId: string): void;
 
     /**
      * @param key
+     * @param correlationId
      */
     removeIdToken(key: string, correlationId: string): void;
 
     /**
      * @param key
+     * @param correlationId
      */
     removeAccessToken(key: string, correlationId: string): void;
 
     /**
      * @param key
+     * @param correlationId
      */
     removeRefreshToken(key: string, correlationId: string): void;
 }