@azure/msal-common 15.7.0 → 15.8.0

package/src/cache/CacheManager.ts

@@ -52,7 +52,8 @@ import { getAliasesFromStaticSources } from "../authority/AuthorityMetadata.js";
 import { StaticAuthorityOptions } from "../authority/AuthorityOptions.js";
 import { TokenClaims } from "../account/TokenClaims.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
-import { CacheError, CacheErrorCodes } from "../error/CacheError.js";
+import { createCacheError } from "../error/CacheError.js";
+import { AuthError } from "../error/AuthError.js";
 
 /**
  * Interface class which implement cache storage functions used by MSAL to perform validity checks, and store tokens.
@@ -64,17 +65,20 @@ export abstract class CacheManager implements ICacheManager {
     // Instance of logger for functions defined in the msal-common layer
     private commonLogger: Logger;
     private staticAuthorityOptions?: StaticAuthorityOptions;
+    protected performanceClient: IPerformanceClient;
 
     constructor(
         clientId: string,
         cryptoImpl: ICrypto,
         logger: Logger,
+        performanceClient: IPerformanceClient,
         staticAuthorityOptions?: StaticAuthorityOptions
     ) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
         this.commonLogger = logger.clone(name, version);
         this.staticAuthorityOptions = staticAuthorityOptions;
+        this.performanceClient = performanceClient;
     }
 
     /**
@@ -83,7 +87,7 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract getAccount(
         accountKey: string,
-        logger?: Logger
+        correlationId: string
     ): AccountEntity | null;
 
     /**
@@ -100,7 +104,10 @@ export abstract class CacheManager implements ICacheManager {
      * fetch the idToken entity from the platform cache
      * @param idTokenKey
      */
-    abstract getIdTokenCredential(idTokenKey: string): IdTokenEntity | null;
+    abstract getIdTokenCredential(
+        idTokenKey: string,
+        correlationId: string
+    ): IdTokenEntity | null;
 
     /**
      * set idToken entity to the platform cache
@@ -117,7 +124,8 @@ export abstract class CacheManager implements ICacheManager {
      * @param accessTokenKey
      */
     abstract getAccessTokenCredential(
-        accessTokenKey: string
+        accessTokenKey: string,
+        correlationId: string
     ): AccessTokenEntity | null;
 
     /**
@@ -135,7 +143,8 @@ export abstract class CacheManager implements ICacheManager {
      * @param refreshTokenKey
      */
     abstract getRefreshTokenCredential(
-        refreshTokenKey: string
+        refreshTokenKey: string,
+        correlationId: string
     ): RefreshTokenEntity | null;
 
     /**
@@ -158,7 +167,10 @@ export abstract class CacheManager implements ICacheManager {
      * set appMetadata entity to the platform cache
      * @param appMetadata
      */
-    abstract setAppMetadata(appMetadata: AppMetadataEntity): void;
+    abstract setAppMetadata(
+        appMetadata: AppMetadataEntity,
+        correlationId: string
+    ): void;
 
     /**
      * fetch server telemetry entity from the platform cache
@@ -175,7 +187,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setServerTelemetry(
         serverTelemetryKey: string,
-        serverTelemetry: ServerTelemetryEntity
+        serverTelemetry: ServerTelemetryEntity,
+        correlationId: string
     ): void;
 
     /**
@@ -214,14 +227,15 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setThrottlingCache(
         throttlingCacheKey: string,
-        throttlingCache: ThrottlingEntity
+        throttlingCache: ThrottlingEntity,
+        correlationId: string
     ): void;
 
     /**
      * Function to remove an item from cache given its key.
      * @param key
      */
-    abstract removeItem(key: string): void;
+    abstract removeItem(key: string, correlationId: string): void;
 
     /**
      * Function which retrieves all current keys from the cache.
@@ -243,9 +257,13 @@ export abstract class CacheManager implements ICacheManager {
      * @param accountFilter - (Optional) filter to narrow down the accounts returned
      * @returns Array of AccountInfo objects in cache
      */
-    getAllAccounts(accountFilter?: AccountFilter): AccountInfo[] {
+    getAllAccounts(
+        accountFilter: AccountFilter,
+        correlationId: string
+    ): AccountInfo[] {
         return this.buildTenantProfiles(
-            this.getAccountsFilteredBy(accountFilter || {}),
+            this.getAccountsFilteredBy(accountFilter, correlationId),
+            correlationId,
             accountFilter
         );
     }
@@ -253,8 +271,11 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * Gets first tenanted AccountInfo object found based on provided filters
      */
-    getAccountInfoFilteredBy(accountFilter: AccountFilter): AccountInfo | null {
-        const allAccounts = this.getAllAccounts(accountFilter);
+    getAccountInfoFilteredBy(
+        accountFilter: AccountFilter,
+        correlationId: string
+    ): AccountInfo | null {
+        const allAccounts = this.getAllAccounts(accountFilter, correlationId);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
             const sortedAccounts = allAccounts.sort((account) => {
@@ -274,8 +295,14 @@ export abstract class CacheManager implements ICacheManager {
      * @param accountFilter
      * @returns
      */
-    getBaseAccountInfo(accountFilter: AccountFilter): AccountInfo | null {
-        const accountEntities = this.getAccountsFilteredBy(accountFilter);
+    getBaseAccountInfo(
+        accountFilter: AccountFilter,
+        correlationId: string
+    ): AccountInfo | null {
+        const accountEntities = this.getAccountsFilteredBy(
+            accountFilter,
+            correlationId
+        );
         if (accountEntities.length > 0) {
             return accountEntities[0].getAccountInfo();
         } else {
@@ -292,11 +319,13 @@ export abstract class CacheManager implements ICacheManager {
      */
     private buildTenantProfiles(
         cachedAccounts: AccountEntity[],
+        correlationId: string,
         accountFilter?: AccountFilter
     ): AccountInfo[] {
         return cachedAccounts.flatMap((accountEntity) => {
             return this.getTenantProfilesFromAccountEntity(
                 accountEntity,
+                correlationId,
                 accountFilter?.tenantId,
                 accountFilter
             );
@@ -307,6 +336,7 @@ export abstract class CacheManager implements ICacheManager {
         accountInfo: AccountInfo,
         tokenKeys: TokenKeys,
         tenantProfile: TenantProfile,
+        correlationId: string,
         tenantProfileFilter?: TenantProfileFilter
     ): AccountInfo | null {
         let tenantedAccountInfo: AccountInfo | null = null;
@@ -325,6 +355,7 @@ export abstract class CacheManager implements ICacheManager {
 
         const idToken = this.getIdToken(
             accountInfo,
+            correlationId,
             tokenKeys,
             tenantProfile.tenantId
         );
@@ -359,6 +390,7 @@ export abstract class CacheManager implements ICacheManager {
 
     private getTenantProfilesFromAccountEntity(
         accountEntity: AccountEntity,
+        correlationId: string,
         targetTenantId?: string,
         tenantProfileFilter?: TenantProfileFilter
     ): AccountInfo[] {
@@ -387,6 +419,7 @@ export abstract class CacheManager implements ICacheManager {
                 accountInfo,
                 tokenKeys,
                 tenantProfile,
+                correlationId,
                 tenantProfileFilter
             );
             if (tenantedAccountInfo) {
@@ -532,37 +565,14 @@ export abstract class CacheManager implements ICacheManager {
             }
 
             if (!!cacheRecord.appMetadata) {
-                this.setAppMetadata(cacheRecord.appMetadata);
+                this.setAppMetadata(cacheRecord.appMetadata, correlationId);
             }
         } catch (e: unknown) {
             this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);
-            if (e instanceof Error) {
-                this.commonLogger?.errorPii(
-                    `CacheManager.saveCacheRecord: ${e.message}`,
-                    correlationId
-                );
-
-                if (
-                    e.name === "QuotaExceededError" ||
-                    e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
-                    e.message.includes("exceeded the quota")
-                ) {
-                    this.commonLogger?.error(
-                        `CacheManager.saveCacheRecord: exceeded storage quota`,
-                        correlationId
-                    );
-                    throw new CacheError(
-                        CacheErrorCodes.cacheQuotaExceededErrorCode
-                    );
-                } else {
-                    throw new CacheError(e.name, e.message);
-                }
+            if (e instanceof AuthError) {
+                throw e;
             } else {
-                this.commonLogger?.errorPii(
-                    `CacheManager.saveCacheRecord: ${e}`,
-                    correlationId
-                );
-                throw new CacheError(CacheErrorCodes.cacheUnknownErrorCode);
+                throw createCacheError(e);
             }
         }
     }
@@ -588,7 +598,6 @@ export abstract class CacheManager implements ICacheManager {
         const tokenKeys = this.getTokenKeys();
         const currentScopes = ScopeSet.fromString(credential.target);
 
-        const removedAccessTokens: Array<Promise<void>> = [];
         tokenKeys.accessToken.forEach((key) => {
             if (
                 !this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)
@@ -596,7 +605,10 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
-            const tokenEntity = this.getAccessTokenCredential(key);
+            const tokenEntity = this.getAccessTokenCredential(
+                key,
+                correlationId
+            );
 
             if (
                 tokenEntity &&
@@ -604,11 +616,10 @@ export abstract class CacheManager implements ICacheManager {
             ) {
                 const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                    removedAccessTokens.push(this.removeAccessToken(key));
+                    this.removeAccessToken(key, correlationId);
                 }
             }
         });
-        await Promise.all(removedAccessTokens);
         await this.setAccessTokenCredential(credential, correlationId);
     }
 
@@ -617,7 +628,10 @@ export abstract class CacheManager implements ICacheManager {
      * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
      * @param accountFilter - An object containing Account properties to filter by
      */
-    getAccountsFilteredBy(accountFilter: AccountFilter): AccountEntity[] {
+    getAccountsFilteredBy(
+        accountFilter: AccountFilter,
+        correlationId: string
+    ): AccountEntity[] {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts: AccountEntity[] = [];
         allAccountKeys.forEach((cacheKey) => {
@@ -628,7 +642,7 @@ export abstract class CacheManager implements ICacheManager {
 
             const entity: AccountEntity | null = this.getAccount(
                 cacheKey,
-                this.commonLogger
+                correlationId
             );
 
             // Match base account fields
@@ -959,103 +973,102 @@ export abstract class CacheManager implements ICacheManager {
     /**
      * Removes all accounts and related tokens from cache.
      */
-    async removeAllAccounts(): Promise<void> {
+    removeAllAccounts(correlationId: string): void {
         const allAccountKeys = this.getAccountKeys();
-        const removedAccounts: Array<Promise<void>> = [];
 
         allAccountKeys.forEach((cacheKey) => {
-            removedAccounts.push(this.removeAccount(cacheKey));
+            this.removeAccount(cacheKey, correlationId);
         });
-
-        await Promise.all(removedAccounts);
     }
 
     /**
      * Removes the account and related tokens for a given account key
      * @param account
      */
-    async removeAccount(accountKey: string): Promise<void> {
-        const account = this.getAccount(accountKey, this.commonLogger);
+    removeAccount(accountKey: string, correlationId: string): void {
+        const account = this.getAccount(accountKey, correlationId);
         if (!account) {
             return;
         }
-        await this.removeAccountContext(account);
-        this.removeItem(accountKey);
+        this.removeAccountContext(account, correlationId);
+        this.removeItem(accountKey, correlationId);
     }
 
     /**
      * Removes credentials associated with the provided account
      * @param account
      */
-    async removeAccountContext(account: AccountEntity): Promise<void> {
+    removeAccountContext(account: AccountEntity, correlationId: string): void {
         const allTokenKeys = this.getTokenKeys();
         const accountId = account.generateAccountId();
-        const removedCredentials: Array<Promise<void>> = [];
 
         allTokenKeys.idToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             }
         });
 
         allTokenKeys.accessToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                removedCredentials.push(this.removeAccessToken(key));
+                this.removeAccessToken(key, correlationId);
             }
         });
 
         allTokenKeys.refreshToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeRefreshToken(key);
+                this.removeRefreshToken(key, correlationId);
             }
         });
-
-        await Promise.all(removedCredentials);
     }
 
     /**
-     * returns a boolean if the given credential is removed
-     * @param credential
+     * Removes accessToken from the cache
+     * @param key
+     * @param correlationId
      */
-    async removeAccessToken(key: string): Promise<void> {
-        const credential = this.getAccessTokenCredential(key);
-        if (!credential) {
-            return;
-        }
+    removeAccessToken(key: string, correlationId: string): void {
+        const credential = this.getAccessTokenCredential(key, correlationId);
+        this.removeItem(key, correlationId);
+        this.performanceClient.incrementFields(
+            { accessTokensRemoved: 1 },
+            correlationId
+        );
 
-        // Remove Token Binding Key from key store for PoP Tokens Credentials
         if (
-            credential.credentialType.toLowerCase() ===
-            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()
+            !credential ||
+            credential.credentialType.toLowerCase() !==
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase() ||
+            credential.tokenType !== AuthenticationScheme.POP
         ) {
-            if (credential.tokenType === AuthenticationScheme.POP) {
-                const accessTokenWithAuthSchemeEntity =
-                    credential as AccessTokenEntity;
-                const kid = accessTokenWithAuthSchemeEntity.keyId;
-
-                if (kid) {
-                    try {
-                        await this.cryptoImpl.removeTokenBindingKey(kid);
-                    } catch (error) {
-                        throw createClientAuthError(
-                            ClientAuthErrorCodes.bindingKeyNotRemoved
-                        );
-                    }
-                }
-            }
+            // If the credential is not a PoP token, we can return
+            return;
         }
 
-        return this.removeItem(key);
+        // Remove Token Binding Key from key store for PoP Tokens Credentials
+        const kid = credential.keyId;
+
+        if (kid) {
+            void this.cryptoImpl.removeTokenBindingKey(kid).catch(() => {
+                this.commonLogger.error(
+                    `Failed to remove token binding key ${kid}`,
+                    correlationId
+                );
+                this.performanceClient?.incrementFields(
+                    { removeTokenBindingKeyFailure: 1 },
+                    correlationId
+                );
+            });
+        }
     }
 
     /**
      * Removes all app metadata objects from cache.
      */
-    removeAppMetadata(): boolean {
+    removeAppMetadata(correlationId: string): boolean {
         const allCacheKeys = this.getKeys();
         allCacheKeys.forEach((cacheKey) => {
             if (this.isAppMetadata(cacheKey)) {
-                this.removeItem(cacheKey);
+                this.removeItem(cacheKey, correlationId);
             }
         });
 
@@ -1066,10 +1079,13 @@ export abstract class CacheManager implements ICacheManager {
      * Retrieve AccountEntity from cache
      * @param account
      */
-    readAccountFromCache(account: AccountInfo): AccountEntity | null {
+    readAccountFromCache(
+        account: AccountInfo,
+        correlationId: string
+    ): AccountEntity | null {
         const accountKey: string =
             AccountEntity.generateAccountCacheKey(account);
-        return this.getAccount(accountKey, this.commonLogger);
+        return this.getAccount(accountKey, correlationId);
     }
 
     /**
@@ -1082,10 +1098,10 @@ export abstract class CacheManager implements ICacheManager {
      */
     getIdToken(
         account: AccountInfo,
+        correlationId: string,
         tokenKeys?: TokenKeys,
         targetRealm?: string,
-        performanceClient?: IPerformanceClient,
-        correlationId?: string
+        performanceClient?: IPerformanceClient
     ): IdTokenEntity | null {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter: CredentialFilter = {
@@ -1098,6 +1114,7 @@ export abstract class CacheManager implements ICacheManager {
 
         const idTokenMap: Map<string, IdTokenEntity> = this.getIdTokensByFilter(
             idTokenFilter,
+            correlationId,
             tokenKeys
         );
 
@@ -1140,7 +1157,7 @@ export abstract class CacheManager implements ICacheManager {
                 "CacheManager:getIdToken - Multiple matching ID tokens found, clearing them"
             );
             tokensToBeRemoved.forEach((idToken, key) => {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             });
             if (performanceClient && correlationId) {
                 performanceClient.addFields(
@@ -1162,6 +1179,7 @@ export abstract class CacheManager implements ICacheManager {
      */
     getIdTokensByFilter(
         filter: CredentialFilter,
+        correlationId: string,
         tokenKeys?: TokenKeys
     ): Map<string, IdTokenEntity> {
         const idTokenKeys =
@@ -1180,7 +1198,7 @@ export abstract class CacheManager implements ICacheManager {
             ) {
                 return;
             }
-            const idToken = this.getIdTokenCredential(key);
+            const idToken = this.getIdTokenCredential(key, correlationId);
             if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                 idTokens.set(key, idToken);
             }
@@ -1221,35 +1239,37 @@ export abstract class CacheManager implements ICacheManager {
      * Removes idToken from the cache
      * @param key
      */
-    removeIdToken(key: string): void {
-        this.removeItem(key);
+    removeIdToken(key: string, correlationId: string): void {
+        this.removeItem(key, correlationId);
     }
 
     /**
      * Removes refresh token from the cache
      * @param key
      */
-    removeRefreshToken(key: string): void {
-        this.removeItem(key);
+    removeRefreshToken(key: string, correlationId: string): void {
+        this.removeItem(key, correlationId);
     }
 
     /**
      * Retrieve AccessTokenEntity from cache
      * @param account {AccountInfo}
      * @param request {BaseAuthRequest}
+     * @param correlationId {?string}
      * @param tokenKeys {?TokenKeys}
      * @param performanceClient {?IPerformanceClient}
-     * @param correlationId {?string}
      */
     getAccessToken(
         account: AccountInfo,
         request: BaseAuthRequest,
         tokenKeys?: TokenKeys,
-        targetRealm?: string,
-        performanceClient?: IPerformanceClient,
-        correlationId?: string
+        targetRealm?: string
     ): AccessTokenEntity | null {
-        this.commonLogger.trace("CacheManager - getAccessToken called");
+        const correlationId = request.correlationId;
+        this.commonLogger.trace(
+            "CacheManager - getAccessToken called",
+            correlationId
+        );
         const scopes = ScopeSet.createSearchScopes(request.scopes);
         const authScheme =
             request.authenticationScheme || AuthenticationScheme.BEARER;
@@ -1286,7 +1306,10 @@ export abstract class CacheManager implements ICacheManager {
             if (
                 this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)
             ) {
-                const accessToken = this.getAccessTokenCredential(key);
+                const accessToken = this.getAccessTokenCredential(
+                    key,
+                    correlationId
+                );
 
                 // Validate value
                 if (
@@ -1301,27 +1324,31 @@ export abstract class CacheManager implements ICacheManager {
         const numAccessTokens = accessTokens.length;
         if (numAccessTokens < 1) {
             this.commonLogger.info(
-                "CacheManager:getAccessToken - No token found"
+                "CacheManager:getAccessToken - No token found",
+                correlationId
             );
             return null;
         } else if (numAccessTokens > 1) {
             this.commonLogger.info(
-                "CacheManager:getAccessToken - Multiple access tokens found, clearing them"
+                "CacheManager:getAccessToken - Multiple access tokens found, clearing them",
+                correlationId
             );
             accessTokens.forEach((accessToken) => {
-                void this.removeAccessToken(generateCredentialKey(accessToken));
-            });
-            if (performanceClient && correlationId) {
-                performanceClient.addFields(
-                    { multiMatchedAT: accessTokens.length },
+                this.removeAccessToken(
+                    generateCredentialKey(accessToken),
                     correlationId
                 );
-            }
+            });
+            this.performanceClient.addFields(
+                { multiMatchedAT: accessTokens.length },
+                correlationId
+            );
             return null;
         }
 
         this.commonLogger.info(
-            "CacheManager:getAccessToken - Returning access token"
+            "CacheManager:getAccessToken - Returning access token",
+            correlationId
         );
         return accessTokens[0];
     }
@@ -1391,7 +1418,10 @@ export abstract class CacheManager implements ICacheManager {
      * @param filter
      * @returns
      */
-    getAccessTokensByFilter(filter: CredentialFilter): AccessTokenEntity[] {
+    getAccessTokensByFilter(
+        filter: CredentialFilter,
+        correlationId: string
+    ): AccessTokenEntity[] {
         const tokenKeys = this.getTokenKeys();
 
         const accessTokens: AccessTokenEntity[] = [];
@@ -1400,7 +1430,10 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
-            const accessToken = this.getAccessTokenCredential(key);
+            const accessToken = this.getAccessTokenCredential(
+                key,
+                correlationId
+            );
             if (
                 accessToken &&
                 this.credentialMatchesFilter(accessToken, filter)
@@ -1416,16 +1449,16 @@ export abstract class CacheManager implements ICacheManager {
      * Helper to retrieve the appropriate refresh token from cache
      * @param account {AccountInfo}
      * @param familyRT {boolean}
+     * @param correlationId {?string}
      * @param tokenKeys {?TokenKeys}
      * @param performanceClient {?IPerformanceClient}
-     * @param correlationId {?string}
      */
     getRefreshToken(
         account: AccountInfo,
         familyRT: boolean,
+        correlationId: string,
         tokenKeys?: TokenKeys,
-        performanceClient?: IPerformanceClient,
-        correlationId?: string
+        performanceClient?: IPerformanceClient
     ): RefreshTokenEntity | null {
         this.commonLogger.trace("CacheManager - getRefreshToken called");
         const id = familyRT ? THE_FAMILY_ID : undefined;
@@ -1445,7 +1478,10 @@ export abstract class CacheManager implements ICacheManager {
         refreshTokenKeys.forEach((key) => {
             // Validate key
             if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
-                const refreshToken = this.getRefreshTokenCredential(key);
+                const refreshToken = this.getRefreshTokenCredential(
+                    key,
+                    correlationId
+                );
                 // Validate value
                 if (
                     refreshToken &&

package/src/cache/entities/AccountEntity.ts

@@ -62,6 +62,7 @@ export class AccountEntity {
     msGraphHost?: string;
     nativeAccountId?: string;
     tenantProfiles?: Array<TenantProfile>;
+    lastUpdatedAt?: string;
 
     /**
      * Generate Account Id key component as per the schema: <home_account_id>-<environment>

package/src/cache/entities/CredentialEntity.ts

@@ -33,4 +33,6 @@ export type CredentialEntity = {
     keyId?: string;
     /** Matches the SHA 256 hash of the claims object included in the token request */
     requestedClaimsHash?: string;
+    /** Timestamp when the entry was last updated */
+    lastUpdatedAt?: string;
 };