@azure/msal-common 15.2.1 → 15.4.0

package/src/response/AuthorizeResponse.ts

@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * Response properties that may be returned by the /authorize endpoint
+ */
+export type AuthorizeResponse = {
+    /**
+     * Authorization Code to be exchanged for tokens
+     */
+    code?: string;
+    /**
+     * Encrypted Authorize Response (EAR) JWE
+     */
+    ear_jwe?: string;
+    /**
+     * Client info object containing UserId and TenantId
+     */
+    client_info?: string;
+    /**
+     * State string, should match what was sent on request
+     */
+    state?: string;
+    /**
+     * Cloud instance returned when application is instance aware
+     */
+    cloud_instance_name?: string;
+    /**
+     * Cloud instance hostname returned when application is instance aware
+     */
+    cloud_instance_host_name?: string;
+    /**
+     * AAD Graph hostname returned when application is instance aware
+     * https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api
+     */
+    cloud_graph_host_name?: string;
+    /**
+     * Microsoft Graph hostname returned when application is instance aware
+     * https://docs.microsoft.com/en-us/graph/overview
+     */
+    msgraph_host?: string;
+    /**
+     * Server error code
+     */
+    error?: string;
+    /**
+     * Server error URI
+     */
+    error_uri?: string;
+    /**
+     * Server error description
+     */
+    error_description?: string;
+    /**
+     * Server Sub-Error
+     */
+    suberror?: string;
+    /**
+     * Timestamp of request
+     */
+    timestamp?: string;
+    /**
+     * Trace Id used to look up request in logs
+     */
+    trace_id?: string;
+    /**
+     * Correlation ID use to look up request in logs
+     */
+    correlation_id?: string;
+    /**
+     * Claims
+     */
+    claims?: string;
+    /**
+     * AccountId for the user, returned when platform broker is available to use
+     */
+    accountId?: string;
+};

package/src/response/ResponseHandler.ts

@@ -9,7 +9,6 @@ import {
     ClientAuthErrorCodes,
     createClientAuthError,
 } from "../error/ClientAuthError.js";
-import { ServerAuthorizationCodeResponse } from "./ServerAuthorizationCodeResponse.js";
 import { Logger } from "../logger/Logger.js";
 import { ServerError } from "../error/ServerError.js";
 import { ScopeSet } from "../request/ScopeSet.js";
@@ -54,19 +53,6 @@ import {
 import * as CacheHelpers from "../cache/utils/CacheHelpers.js";
 import * as TimeUtils from "../utils/TimeUtils.js";
 
-function parseServerErrorNo(
-    serverResponse: ServerAuthorizationCodeResponse
-): string | undefined {
-    const errorCodePrefix = "code=";
-    const errorCodePrefixIndex =
-        serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
-    return errorCodePrefixIndex && errorCodePrefixIndex >= 0
-        ? serverResponse.error_uri?.substring(
-              errorCodePrefixIndex + errorCodePrefix.length
-          )
-        : undefined;
-}
-
 /**
  * Class that handles response parsing.
  * @internal
@@ -99,90 +85,6 @@ export class ResponseHandler {
         this.performanceClient = performanceClient;
     }
 
-    /**
-     * Function which validates server authorization code response.
-     * @param serverResponseHash
-     * @param requestState
-     * @param cryptoObj
-     */
-    validateServerAuthorizationCodeResponse(
-        serverResponse: ServerAuthorizationCodeResponse,
-        requestState: string
-    ): void {
-        if (!serverResponse.state || !requestState) {
-            throw serverResponse.state
-                ? createClientAuthError(
-                      ClientAuthErrorCodes.stateNotFound,
-                      "Cached State"
-                  )
-                : createClientAuthError(
-                      ClientAuthErrorCodes.stateNotFound,
-                      "Server State"
-                  );
-        }
-
-        let decodedServerResponseState: string;
-        let decodedRequestState: string;
-
-        try {
-            decodedServerResponseState = decodeURIComponent(
-                serverResponse.state
-            );
-        } catch (e) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.invalidState,
-                serverResponse.state
-            );
-        }
-
-        try {
-            decodedRequestState = decodeURIComponent(requestState);
-        } catch (e) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.invalidState,
-                serverResponse.state
-            );
-        }
-
-        if (decodedServerResponseState !== decodedRequestState) {
-            throw createClientAuthError(ClientAuthErrorCodes.stateMismatch);
-        }
-
-        // Check for error
-        if (
-            serverResponse.error ||
-            serverResponse.error_description ||
-            serverResponse.suberror
-        ) {
-            const serverErrorNo = parseServerErrorNo(serverResponse);
-            if (
-                isInteractionRequiredError(
-                    serverResponse.error,
-                    serverResponse.error_description,
-                    serverResponse.suberror
-                )
-            ) {
-                throw new InteractionRequiredAuthError(
-                    serverResponse.error || "",
-                    serverResponse.error_description,
-                    serverResponse.suberror,
-                    serverResponse.timestamp || "",
-                    serverResponse.trace_id || "",
-                    serverResponse.correlation_id || "",
-                    serverResponse.claims || "",
-                    serverErrorNo
-                );
-            }
-
-            throw new ServerError(
-                serverResponse.error || "",
-                serverResponse.error_description,
-                serverResponse.suberror,
-                serverErrorNo
-            );
-        }
-    }
-
     /**
      * Function which validates server authorization token response.
      * @param serverResponse

package/src/telemetry/performance/PerformanceEvent.ts

@@ -214,19 +214,21 @@ export const PerformanceEvents = {
         "standardInteractionClientGetClientConfiguration",
     StandardInteractionClientInitializeAuthorizationRequest:
         "standardInteractionClientInitializeAuthorizationRequest",
-    StandardInteractionClientInitializeAuthorizationCodeRequest:
-        "standardInteractionClientInitializeAuthorizationCodeRequest",
 
     /**
      * getAuthCodeUrl API (msal-browser and msal-node).
      */
     GetAuthCodeUrl: "getAuthCodeUrl",
+    GetStandardParams: "getStandardParams",
 
     /**
      * Functions from InteractionHandler (msal-browser)
      */
     HandleCodeResponseFromServer: "handleCodeResponseFromServer",
     HandleCodeResponse: "handleCodeResponse",
+    HandleResponseEar: "handleResponseEar",
+    HandleResponsePlatformBroker: "handleResponsePlatformBroker",
+    HandleResponseCode: "handleResponseCode",
     UpdateTokenEndpointAuthority: "updateTokenEndpointAuthority",
 
     /**
@@ -235,7 +237,6 @@ export const PerformanceEvents = {
     AuthClientAcquireToken: "authClientAcquireToken",
     AuthClientExecuteTokenRequest: "authClientExecuteTokenRequest",
     AuthClientCreateTokenRequestBody: "authClientCreateTokenRequestBody",
-    AuthClientCreateQueryString: "authClientCreateQueryString",
 
     /**
      * Generate functions in PopTokenGenerator (msal-common)
@@ -317,6 +318,8 @@ export const PerformanceEvents = {
     UrlEncodeArr: "urlEncodeArr",
     Encrypt: "encrypt",
     Decrypt: "decrypt",
+    GenerateEarKey: "generateEarKey",
+    DecryptEarResponse: "decryptEarResponse",
 } as const;
 export type PerformanceEvents =
     (typeof PerformanceEvents)[keyof typeof PerformanceEvents];
@@ -433,10 +436,6 @@ export const PerformanceEventAbbreviations: ReadonlyMap<string, string> =
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
             "StdIntClientInitAuthReq",
         ],
-        [
-            PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-            "StdIntClientInitAuthCodeReq",
-        ],
 
         [PerformanceEvents.GetAuthCodeUrl, "GetAuthCodeUrl"],
 
@@ -445,6 +444,12 @@ export const PerformanceEventAbbreviations: ReadonlyMap<string, string> =
             "HandleCodeResFromServer",
         ],
         [PerformanceEvents.HandleCodeResponse, "HandleCodeResp"],
+        [PerformanceEvents.HandleResponseEar, "HandleRespEar"],
+        [PerformanceEvents.HandleResponseCode, "HandleRespCode"],
+        [
+            PerformanceEvents.HandleResponsePlatformBroker,
+            "HandleRespPlatBroker",
+        ],
         [PerformanceEvents.UpdateTokenEndpointAuthority, "UpdTEndpointAuth"],
 
         [PerformanceEvents.AuthClientAcquireToken, "AuthClientAT"],
@@ -453,10 +458,6 @@ export const PerformanceEventAbbreviations: ReadonlyMap<string, string> =
             PerformanceEvents.AuthClientCreateTokenRequestBody,
             "AuthClientCreateTReqBody",
         ],
-        [
-            PerformanceEvents.AuthClientCreateQueryString,
-            "AuthClientCreateQueryStr",
-        ],
         [PerformanceEvents.PopTokenGenerateCnf, "PopTGenCnf"],
         [PerformanceEvents.PopTokenGenerateKid, "PopTGenKid"],
         [PerformanceEvents.HandleServerTokenResponse, "HandleServerTRes"],
@@ -552,6 +553,8 @@ export const PerformanceEventAbbreviations: ReadonlyMap<string, string> =
         [PerformanceEvents.UrlEncodeArr, "urlEncArr"],
         [PerformanceEvents.Encrypt, "encrypt"],
         [PerformanceEvents.Decrypt, "decrypt"],
+        [PerformanceEvents.GenerateEarKey, "genEarKey"],
+        [PerformanceEvents.DecryptEarResponse, "decryptEarResp"],
     ]);
 
 /**

package/src/utils/Constants.ts

@@ -34,11 +34,8 @@ export const Constants = {
     PROFILE_SCOPE: "profile",
     OFFLINE_ACCESS_SCOPE: "offline_access",
     EMAIL_SCOPE: "email",
-    // Default response type for authorization code flow
-    CODE_RESPONSE_TYPE: "code",
     CODE_GRANT_TYPE: "authorization_code",
     RT_GRANT_TYPE: "refresh_token",
-    FRAGMENT_RESPONSE_MODE: "fragment",
     S256_CODE_CHALLENGE_METHOD: "S256",
     URL_FORM_CONTENT_TYPE: "application/x-www-form-urlencoded;charset=utf-8",
     AUTHORIZATION_PENDING: "authorization_pending",
@@ -58,8 +55,6 @@ export const Constants = {
         "login.microsoft.com",
         "sts.windows.net",
     ],
-    TOKEN_RESPONSE_TYPE: "token",
-    ID_TOKEN_RESPONSE_TYPE: "id_token",
     SHR_NONCE_VALIDITY: 240,
     INVALID_INSTANCE: "invalid_instance",
 };
@@ -161,8 +156,20 @@ export const CodeChallengeMethodValues = {
     S256: "S256",
 };
 
+/**
+ * Allowed values for response_type
+ */
+export const OAuthResponseType = {
+    CODE: "code",
+    IDTOKEN_TOKEN: "id_token token",
+    IDTOKEN_TOKEN_REFRESHTOKEN: "id_token token refresh_token",
+} as const;
+export type OAuthResponseType =
+    (typeof OAuthResponseType)[keyof typeof OAuthResponseType];
+
 /**
  * allowed values for server response type
+ * @deprecated Use ResponseMode instead
  */
 export const ServerResponseType = {
     QUERY: "query",
@@ -175,7 +182,8 @@ export type ServerResponseType =
  * allowed values for response_mode
  */
 export const ResponseMode = {
-    ...ServerResponseType,
+    QUERY: "query",
+    FRAGMENT: "fragment",
     FORM_POST: "form_post",
 } as const;
 export type ResponseMode = (typeof ResponseMode)[keyof typeof ResponseMode];

package/src/utils/UrlUtils.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { ServerAuthorizationCodeResponse } from "../response/ServerAuthorizationCodeResponse.js";
+import { AuthorizeResponse } from "../response/AuthorizeResponse.js";
 import {
     ClientAuthErrorCodes,
     createClientAuthError,
@@ -31,7 +31,7 @@ export function stripLeadingHashOrQuery(responseString: string): string {
  */
 export function getDeserializedResponse(
     responseString: string
-): ServerAuthorizationCodeResponse | null {
+): AuthorizeResponse | null {
     // Check if given hash is empty
     if (!responseString || responseString.indexOf("=") < 0) {
         return null;
@@ -40,12 +40,14 @@ export function getDeserializedResponse(
         // Strip the # or ? symbol if present
         const normalizedResponse = stripLeadingHashOrQuery(responseString);
         // If # symbol was not present, above will return empty string, so give original hash value
-        const deserializedHash: ServerAuthorizationCodeResponse =
-            Object.fromEntries(new URLSearchParams(normalizedResponse));
+        const deserializedHash: AuthorizeResponse = Object.fromEntries(
+            new URLSearchParams(normalizedResponse)
+        );
 
         // Check for known response properties
         if (
             deserializedHash.code ||
+            deserializedHash.ear_jwe ||
             deserializedHash.error ||
             deserializedHash.error_description ||
             deserializedHash.state
@@ -58,3 +60,16 @@ export function getDeserializedResponse(
 
     return null;
 }
+
+/**
+ * Utility to create a URL from the params map
+ */
+export function mapToQueryString(parameters: Map<string, string>): string {
+    const queryParameterArray: Array<string> = new Array<string>();
+
+    parameters.forEach((value, key) => {
+        queryParameterArray.push(`${key}=${encodeURIComponent(value)}`);
+    });
+
+    return queryParameterArray.join("&");
+}

package/dist/response/ServerAuthorizationCodeResponse.d.ts

@@ -1,27 +0,0 @@
-/**
- * Deserialized response object from server authorization code request.
- * - code: authorization code from server
- * - client_info: client info object
- * - state: OAuth2 request state
- * - error: error sent back in hash
- * - error: description
- */
-export type ServerAuthorizationCodeResponse = {
-    code?: string;
-    client_info?: string;
-    state?: string;
-    cloud_instance_name?: string;
-    cloud_instance_host_name?: string;
-    cloud_graph_host_name?: string;
-    msgraph_host?: string;
-    error?: string;
-    error_uri?: string;
-    error_description?: string;
-    suberror?: string;
-    timestamp?: string;
-    trace_id?: string;
-    correlation_id?: string;
-    claims?: string;
-    accountId?: string;
-};
-//# sourceMappingURL=ServerAuthorizationCodeResponse.d.ts.map

package/dist/response/ServerAuthorizationCodeResponse.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ServerAuthorizationCodeResponse.d.ts","sourceRoot":"","sources":["../../src/response/ServerAuthorizationCodeResponse.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAE1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC"}