@azure/msal-common 15.13.3 → 16.0.0-beta.0

package/src/protocol/Token.ts

@@ -0,0 +1,230 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CcsCredential, CcsCredentialType } from "../account/CcsCredential.js";
+import { buildClientInfoFromHomeAccountId } from "../account/ClientInfo.js";
+import { Logger } from "../logger/Logger.js";
+import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import { HeaderNames, URL_FORM_CONTENT_TYPE } from "../utils/Constants.js";
+import * as RequestParameterBuilder from "../request/RequestParameterBuilder.js";
+import * as UrlUtils from "../utils/UrlUtils.js";
+import { IPerformanceClient } from "../exports-browser-only.js";
+import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
+import { RequestThumbprint } from "../network/RequestThumbprint.js";
+import {
+    INetworkModule,
+    NetworkRequestOptions,
+} from "../network/INetworkModule.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
+import { ThrottlingUtils } from "../network/ThrottlingUtils.js";
+import { NetworkError } from "../error/NetworkError.js";
+import { AuthError } from "../error/AuthError.js";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../error/ClientAuthError.js";
+import { invokeAsync } from "../utils/FunctionWrappers.js";
+import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+
+/**
+ * Creates default headers for requests to token endpoint
+ */
+export function createTokenRequestHeaders(
+    logger: Logger,
+    preventCorsPreflight: boolean,
+    ccsCred?: CcsCredential
+): Record<string, string> {
+    const headers: Record<string, string> = {};
+    headers[HeaderNames.CONTENT_TYPE] = URL_FORM_CONTENT_TYPE;
+    if (!preventCorsPreflight && ccsCred) {
+        switch (ccsCred.type) {
+            case CcsCredentialType.HOME_ACCOUNT_ID:
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(
+                        ccsCred.credential
+                    );
+                    headers[
+                        HeaderNames.CCS_HEADER
+                    ] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
+                } catch (e) {
+                    logger.verbose(
+                        `Could not parse home account ID for CCS Header: '${e}'`,
+                        ""
+                    );
+                }
+                break;
+            case CcsCredentialType.UPN:
+                headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;
+                break;
+        }
+    }
+    return headers;
+}
+
+/**
+ * Creates query string for the /token request
+ * @param request
+ */
+export function createTokenQueryParameters(
+    request: BaseAuthRequest,
+    clientId: string,
+    redirectUri: string,
+    performanceClient: IPerformanceClient
+): string {
+    const parameters = new Map<string, string>();
+
+    if (request.embeddedClientId) {
+        RequestParameterBuilder.addBrokerParameters(
+            parameters,
+            clientId,
+            redirectUri
+        );
+    }
+
+    if (request.extraQueryParameters) {
+        RequestParameterBuilder.addExtraParameters(
+            parameters,
+            request.extraQueryParameters
+        );
+    }
+
+    RequestParameterBuilder.addCorrelationId(parameters, request.correlationId);
+
+    RequestParameterBuilder.instrumentBrokerParams(
+        parameters,
+        request.correlationId,
+        performanceClient
+    );
+    return UrlUtils.mapToQueryString(parameters);
+}
+
+/**
+ * Http post to token endpoint
+ * @param tokenEndpoint
+ * @param queryString
+ * @param headers
+ * @param thumbprint
+ */
+export async function executePostToTokenEndpoint(
+    tokenEndpoint: string,
+    queryString: string,
+    headers: Record<string, string>,
+    thumbprint: RequestThumbprint,
+    correlationId: string,
+    cacheManager: CacheManager,
+    networkClient: INetworkModule,
+    logger: Logger,
+    performanceClient: IPerformanceClient,
+    serverTelemetryManager: ServerTelemetryManager | null
+): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
+    const response = await sendPostRequest<ServerAuthorizationTokenResponse>(
+        thumbprint,
+        tokenEndpoint,
+        { body: queryString, headers: headers },
+        correlationId,
+        cacheManager,
+        networkClient,
+        logger,
+        performanceClient
+    );
+
+    if (
+        serverTelemetryManager &&
+        response.status < 500 &&
+        response.status !== 429
+    ) {
+        // Telemetry data successfully logged by server, clear Telemetry cache
+        serverTelemetryManager.clearTelemetryCache();
+    }
+
+    return response;
+}
+
+/**
+ * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+ * @param thumbprint - Request thumbprint for throttling
+ * @param tokenEndpoint - Endpoint to make the POST to
+ * @param options - Body and Headers to include on the POST request
+ * @param correlationId - CorrelationId for telemetry
+ * @param cacheManager - Cache manager instance
+ * @param networkClient - Network module instance
+ * @param logger - Logger instance
+ * @param performanceClient - Performance client instance
+ */
+export async function sendPostRequest<
+    T extends ServerAuthorizationTokenResponse
+>(
+    thumbprint: RequestThumbprint,
+    tokenEndpoint: string,
+    options: NetworkRequestOptions,
+    correlationId: string,
+    cacheManager: CacheManager,
+    networkClient: INetworkModule,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<NetworkResponse<T>> {
+    ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
+
+    let response;
+    try {
+        response = await invokeAsync(
+            networkClient.sendPostRequestAsync.bind(networkClient)<T>,
+            PerformanceEvents.NetworkClientSendPostRequestAsync,
+            logger,
+            performanceClient,
+            correlationId
+        )(tokenEndpoint, options);
+        const responseHeaders = response.headers || {};
+        performanceClient?.addFields(
+            {
+                refreshTokenSize: response.body.refresh_token?.length || 0,
+                httpVerToken:
+                    responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+            },
+            correlationId
+        );
+    } catch (e) {
+        if (e instanceof NetworkError) {
+            const responseHeaders = e.responseHeaders;
+            if (responseHeaders) {
+                performanceClient?.addFields(
+                    {
+                        httpVerToken:
+                            responseHeaders[HeaderNames.X_MS_HTTP_VERSION] ||
+                            "",
+                        requestId:
+                            responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+                        contentTypeHeader:
+                            responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                            undefined,
+                        contentLengthHeader:
+                            responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                            undefined,
+                        httpStatus: e.httpStatus,
+                    },
+                    correlationId
+                );
+            }
+            throw e.error;
+        }
+        if (e instanceof AuthError) {
+            throw e;
+        } else {
+            throw createClientAuthError(ClientAuthErrorCodes.networkError);
+        }
+    }
+
+    ThrottlingUtils.postProcess(
+        cacheManager,
+        thumbprint,
+        response,
+        correlationId
+    );
+
+    return response;
+}

package/src/request/AuthenticationHeaderParser.ts

@@ -7,7 +7,7 @@ import {
     createClientConfigurationError,
     ClientConfigurationErrorCodes,
 } from "../error/ClientConfigurationError.js";
-import { Constants, HeaderNames } from "../utils/Constants.js";
+import { HeaderNames } from "../utils/Constants.js";
 
 type WWWAuthenticateChallenges = {
     nonce?: string;
@@ -82,9 +82,7 @@ export class AuthenticationHeaderParser {
         challenges.forEach((challenge: string) => {
             const [key, value] = challenge.split("=");
             // Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
-            challengeMap[key] = unescape(
-                value.replace(/['"]+/g, Constants.EMPTY_STRING)
-            );
+            challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
         });
 
         return challengeMap;

package/src/request/BaseAuthRequest.ts

@@ -24,15 +24,13 @@ import { ShrOptions } from "../crypto/SignedHttpRequest.js";
  * - sshJwk                  - A stringified JSON Web Key representing a public key that can be signed by an SSH certificate.
  * - sshKid                  - Key ID that uniquely identifies the SSH public key mentioned above.
  * - azureCloudOptions       - Convenience string enums for users to provide public/sovereign cloud ids
- * - requestedClaimsHash     - SHA 256 hash string of the requested claims string, used as part of an access token cache key so tokens can be filtered by requested claims
- * - tokenQueryParameters    - String to string map of custom query parameters added to the /token call
- * - tokenBodyParameters     - String to string map of custom parameters added to the body of the /token call
+ * - extraQueryParameters    - String to string map of custom query parameters added to outgoing token service requests
  * - storeInCache            - Object containing boolean values indicating whether to store tokens in the cache or not (default is true)
  * - scenarioId              - Scenario id to track custom user prompts
  * - popKid                  - Key ID to identify the public key for PoP token request
  * - embeddedClientId        - Embedded client id. When specified, broker client id (brk_client_id) and redirect uri (brk_redirect_uri) params are set with values from the config, overriding the corresponding extra parameters, if present.
  * - httpMethod              - HTTP method to use for the /authorize request. Defaults to GET, but can be set to POST if the request requires body parameters
- * - authorizePostBodyParameters - String to string map of custom parameters added to the body of the /authorize call when httpMethod is set to POST
+ * - extraParameters             - String to string map of custom parameters added to outgoing token service requests
  */
 export type BaseAuthRequest = {
     authority: string;
@@ -48,14 +46,12 @@ export type BaseAuthRequest = {
     sshJwk?: string;
     sshKid?: string;
     azureCloudOptions?: AzureCloudOptions;
-    requestedClaimsHash?: string;
     maxAge?: number;
-    tokenBodyParameters?: StringDict;
-    tokenQueryParameters?: StringDict;
     storeInCache?: StoreInCache;
     scenarioId?: string;
     popKid?: string;
     embeddedClientId?: string;
     httpMethod?: HttpMethod;
-    authorizePostBodyParameters?: StringDict;
+    extraQueryParameters?: StringDict;
+    extraParameters?: StringDict;
 };

package/src/request/CommonAuthorizationCodeRequest.ts

@@ -19,7 +19,8 @@ import { CcsCredential } from "../account/CcsCredential.js";
  * - resourceRequestMethod   - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri      - URI that token will be used for. Used for proof-of-possession flows.
  * - enableSpaAuthCode       - Enables the acqusition of a spa authorization code (confidential clients only)
- * - tokenQueryParameters    - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters    - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters         - String to string map of custom query parameters added to outgoing token service requests
  */
 export type CommonAuthorizationCodeRequest = BaseAuthRequest & {
     code: string;

package/src/request/CommonAuthorizationUrlRequest.ts

@@ -4,7 +4,6 @@
  */
 
 import { ResponseMode } from "../utils/Constants.js";
-import { StringDict } from "../utils/MsalTypes.js";
 import { BaseAuthRequest } from "./BaseAuthRequest.js";
 import { AccountInfo } from "../account/AccountInfo.js";
 
@@ -32,8 +31,8 @@ import { AccountInfo } from "../account/AccountInfo.js";
  * - loginHint                  - Can be used to pre-fill the username/email address field of the sign-in page for the user, if you know the username/email address ahead of time. Often apps use this parameter during re-authentication, having already extracted the username from a previous sign-in using the preferred_username claim.
  * - sid                        - Session ID, unique identifier for the session. Available as an optional claim on ID tokens.
  * - domainHint                 - Provides a hint about the tenant or domain that the user should use to sign in. The value of the domain hint is a registered domain for the tenant.
- * - extraQueryParameters       - String to string map of custom query parameters added to the /authorize call
- * - tokenQueryParameters       - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters       - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters            - String to string map of custom query parameters added to outgoing token service requests
  * - nonce                      - A value included in the request that is returned in the id token. A randomly generated unique value is typically used to mitigate replay attacks.
  * - resourceRequestMethod      - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri         - URI that token will be used for. Used for proof-of-possession flows.
@@ -46,7 +45,6 @@ export type CommonAuthorizationUrlRequest = BaseAuthRequest & {
     codeChallenge?: string;
     codeChallengeMethod?: string;
     domainHint?: string;
-    extraQueryParameters?: StringDict;
     extraScopesToConsent?: Array<string>;
     loginHint?: string;
     nonce: string;

package/src/request/CommonRefreshTokenRequest.ts

@@ -16,7 +16,8 @@ import { CcsCredential } from "../account/CcsCredential.js";
  * - resourceRequestMethod   - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri      - URI that token will be used for. Used for proof-of-possession flows.
  * - forceCache              - Force MSAL to cache a refresh token flow response when there is no account in the cache. Used for migration scenarios.
- * - tokenQueryParameters    - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters    - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters         - String to string map of custom query parameters added to outgoing token service requests
  */
 export type CommonRefreshTokenRequest = BaseAuthRequest & {
     refreshToken: string;

package/src/request/CommonSilentFlowRequest.ts

@@ -16,7 +16,8 @@ import { BaseAuthRequest } from "./BaseAuthRequest.js";
  * - forceRefresh           - Forces silent requests to make network calls if true.
  * - resourceRequestMethod  - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri     - URI that token will be used for. Used for proof-of-possession flows.
- * - tokenQueryParameters   - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters   - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters        - String to string map of custom query parameters added to outgoing token service requests
  */
 export type CommonSilentFlowRequest = BaseAuthRequest & {
     /** Account object to lookup the credentials */

package/src/request/RequestParameterBuilder.ts

@@ -3,17 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import {
-    ResponseMode,
-    CLIENT_INFO,
-    AuthenticationScheme,
-    ClaimsRequestKeys,
-    PasswordGrantConstants,
-    OIDC_DEFAULT_SCOPES,
-    ThrottlingConstants,
-    HeaderNames,
-    OAuthResponseType,
-} from "../utils/Constants.js";
+import * as Constants from "../utils/Constants.js";
 import * as AADServerParamKeys from "../constants/AADServerParamKeys.js";
 import { ScopeSet } from "./ScopeSet.js";
 import {
@@ -59,7 +49,7 @@ export function instrumentBrokerParams(
  */
 export function addResponseType(
     parameters: Map<string, string>,
-    responseType: OAuthResponseType
+    responseType: Constants.OAuthResponseType
 ): void {
     parameters.set(AADServerParamKeys.RESPONSE_TYPE, responseType);
 }
@@ -70,11 +60,11 @@ export function addResponseType(
  */
 export function addResponseMode(
     parameters: Map<string, string>,
-    responseMode?: ResponseMode
+    responseMode?: Constants.ResponseMode
 ): void {
     parameters.set(
         AADServerParamKeys.RESPONSE_MODE,
-        responseMode ? responseMode : ResponseMode.QUERY
+        responseMode ? responseMode : Constants.ResponseMode.QUERY
     );
 }
 
@@ -94,7 +84,7 @@ export function addScopes(
     parameters: Map<string, string>,
     scopes: string[],
     addOidcScopes: boolean = true,
-    defaultScopes: Array<string> = OIDC_DEFAULT_SCOPES
+    defaultScopes: Array<string> = Constants.OIDC_DEFAULT_SCOPES
 ): void {
     // Always add openid to the scopes when adding OIDC scopes
     if (
@@ -185,7 +175,7 @@ export function addCcsUpn(
     parameters: Map<string, string>,
     loginHint: string
 ): void {
-    parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
+    parameters.set(Constants.HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
 }
 
 /**
@@ -197,7 +187,7 @@ export function addCcsOid(
     clientInfo: ClientInfo
 ): void {
     parameters.set(
-        HeaderNames.CCS_HEADER,
+        Constants.HeaderNames.CCS_HEADER,
         `Oid:${clientInfo.uid}@${clientInfo.utid}`
     );
 }
@@ -455,7 +445,7 @@ export function addGrantType(
  *
  */
 export function addClientInfo(parameters: Map<string, string>): void {
-    parameters.set(CLIENT_INFO, "1");
+    parameters.set(Constants.CLIENT_INFO, "1");
 }
 
 export function addInstanceAware(parameters: Map<string, string>): void {
@@ -465,14 +455,14 @@ export function addInstanceAware(parameters: Map<string, string>): void {
 }
 
 /**
- * add extraQueryParams
- * @param eQParams
+ * Add extraParameters
+ * @param extraParams - String dictionary containing extra parameters to be added.
  */
-export function addExtraQueryParameters(
+export function addExtraParameters(
     parameters: Map<string, string>,
-    eQParams: StringDict
+    extraParams: StringDict
 ): void {
-    Object.entries(eQParams).forEach(([key, value]) => {
+    Object.entries(extraParams).forEach(([key, value]) => {
         if (!parameters.has(key) && value) {
             parameters.set(key, value);
         }
@@ -499,16 +489,21 @@ export function addClientCapabilitiesToClaims(
     }
 
     if (clientCapabilities && clientCapabilities.length > 0) {
-        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+        if (
+            !mergedClaims.hasOwnProperty(
+                Constants.ClaimsRequestKeys.ACCESS_TOKEN
+            )
+        ) {
             // Add access_token key to claims object
-            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
+            mergedClaims[Constants.ClaimsRequestKeys.ACCESS_TOKEN] = {};
         }
 
         // Add xms_cc claim with provided clientCapabilities to access_token key
-        mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
-            {
-                values: clientCapabilities,
-            };
+        mergedClaims[Constants.ClaimsRequestKeys.ACCESS_TOKEN][
+            Constants.ClaimsRequestKeys.XMS_CC
+        ] = {
+            values: clientCapabilities,
+        };
     }
 
     return JSON.stringify(mergedClaims);
@@ -522,7 +517,7 @@ export function addUsername(
     parameters: Map<string, string>,
     username: string
 ): void {
-    parameters.set(PasswordGrantConstants.username, username);
+    parameters.set(Constants.PasswordGrantConstants.username, username);
 }
 
 /**
@@ -533,7 +528,7 @@ export function addPassword(
     parameters: Map<string, string>,
     password: string
 ): void {
-    parameters.set(PasswordGrantConstants.password, password);
+    parameters.set(Constants.PasswordGrantConstants.password, password);
 }
 
 /**
@@ -545,7 +540,10 @@ export function addPopToken(
     cnfString: string
 ): void {
     if (cnfString) {
-        parameters.set(AADServerParamKeys.TOKEN_TYPE, AuthenticationScheme.POP);
+        parameters.set(
+            AADServerParamKeys.TOKEN_TYPE,
+            Constants.AuthenticationScheme.POP
+        );
         parameters.set(AADServerParamKeys.REQ_CNF, cnfString);
     }
 }
@@ -558,7 +556,10 @@ export function addSshJwk(
     sshJwkString: string
 ): void {
     if (sshJwkString) {
-        parameters.set(AADServerParamKeys.TOKEN_TYPE, AuthenticationScheme.SSH);
+        parameters.set(
+            AADServerParamKeys.TOKEN_TYPE,
+            Constants.AuthenticationScheme.SSH
+        );
         parameters.set(AADServerParamKeys.REQ_CNF, sshJwkString);
     }
 }
@@ -587,7 +588,7 @@ export function addServerTelemetry(
 export function addThrottling(parameters: Map<string, string>): void {
     parameters.set(
         AADServerParamKeys.X_MS_LIB_CAPABILITY,
-        ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE
+        Constants.X_MS_LIB_CAPABILITY_VALUE
     );
 }
 
@@ -632,19 +633,3 @@ export function addEARParameters(
     const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
     parameters.set(AADServerParamKeys.EAR_JWE_CRYPTO, jweCryptoB64Encoded);
 }
-
-/**
- * Adds authorize body parameters to the request parameters
- * @param parameters
- * @param bodyParameters
- */
-export function addPostBodyParameters(
-    parameters: Map<string, string>,
-    bodyParameters: StringDict
-): void {
-    Object.entries(bodyParameters).forEach(([key, value]) => {
-        if (value) {
-            parameters.set(key, value);
-        }
-    });
-}

package/src/request/ScopeSet.ts

@@ -13,9 +13,9 @@ import {
     createClientAuthError,
 } from "../error/ClientAuthError.js";
 import {
-    Constants,
     OIDC_SCOPES,
     OIDC_DEFAULT_SCOPES,
+    OFFLINE_ACCESS_SCOPE,
 } from "../utils/Constants.js";
 
 /**
@@ -54,7 +54,7 @@ export class ScopeSet {
      * @param scopesRequired
      */
     static fromString(inputScopeString: string): ScopeSet {
-        const scopeString = inputScopeString || Constants.EMPTY_STRING;
+        const scopeString = inputScopeString || "";
         const inputScopes: Array<string> = scopeString.split(" ");
         return new ScopeSet(inputScopes);
     }
@@ -75,7 +75,7 @@ export class ScopeSet {
         if (!scopeSet.containsOnlyOIDCScopes()) {
             scopeSet.removeOIDCScopes();
         } else {
-            scopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
+            scopeSet.removeScope(OFFLINE_ACCESS_SCOPE);
         }
 
         return scopeSet;
@@ -234,7 +234,7 @@ export class ScopeSet {
             const scopeArr = this.asArray();
             return scopeArr.join(" ");
         }
-        return Constants.EMPTY_STRING;
+        return "";
     }
 
     /**

package/src/response/AuthenticationResult.ts

@@ -43,5 +43,5 @@ export type AuthenticationResult = {
     cloudGraphHostName?: string;
     msGraphHost?: string;
     code?: string;
-    fromNativeBroker?: boolean;
+    fromPlatformBroker?: boolean;
 };