@azure/msal-common 15.9.0 → 15.11.0

package/src/cache/CacheManager.ts

@@ -19,10 +19,8 @@ import {
     THE_FAMILY_ID,
     AUTHORITY_METADATA_CONSTANTS,
     AuthenticationScheme,
-    Separators,
 } from "../utils/Constants.js";
 import { CredentialEntity } from "./entities/CredentialEntity.js";
-import { generateCredentialKey } from "./utils/CacheHelpers.js";
 import { ScopeSet } from "../request/ScopeSet.js";
 import { AccountEntity } from "./entities/AccountEntity.js";
 import { AccessTokenEntity } from "./entities/AccessTokenEntity.js";
@@ -252,6 +250,18 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract getTokenKeys(): TokenKeys;
 
+    /**
+     * Returns credential cache key from the entity
+     * @param credential
+     */
+    abstract generateCredentialKey(credential: CredentialEntity): string;
+
+    /**
+     * Returns the account cache key from the account info
+     * @param account
+     */
+    abstract generateAccountKey(account: AccountInfo): string;
+
     /**
      * Returns all the accounts in the cache that match the optional filter. If no filter is provided, all accounts are returned.
      * @param accountFilter - (Optional) filter to narrow down the accounts returned
@@ -275,6 +285,15 @@ export abstract class CacheManager implements ICacheManager {
         accountFilter: AccountFilter,
         correlationId: string
     ): AccountInfo | null {
+        if (
+            Object.keys(accountFilter).length === 0 ||
+            Object.values(accountFilter).every((value) => !value)
+        ) {
+            this.commonLogger.warning(
+                "getAccountInfoFilteredBy: Account filter is empty or invalid, returning null"
+            );
+            return null;
+        }
         const allAccounts = this.getAllAccounts(accountFilter, correlationId);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
@@ -635,11 +654,6 @@ export abstract class CacheManager implements ICacheManager {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts: AccountEntity[] = [];
         allAccountKeys.forEach((cacheKey) => {
-            if (!this.isAccountKey(cacheKey, accountFilter.homeAccountId)) {
-                // Don't parse value if the key doesn't match the account filters
-                return;
-            }
-
             const entity: AccountEntity | null = this.getAccount(
                 cacheKey,
                 correlationId
@@ -722,86 +736,6 @@ export abstract class CacheManager implements ICacheManager {
         return matchingAccounts;
     }
 
-    /**
-     * Returns true if the given key matches our account key schema. Also matches homeAccountId and/or tenantId if provided
-     * @param key
-     * @param homeAccountId
-     * @param tenantId
-     * @returns
-     */
-    isAccountKey(
-        key: string,
-        homeAccountId?: string,
-        tenantId?: string
-    ): boolean {
-        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 3) {
-            // Account cache keys contain 3 items separated by '-' (each item may also contain '-')
-            return false;
-        }
-
-        if (
-            homeAccountId &&
-            !key.toLowerCase().includes(homeAccountId.toLowerCase())
-        ) {
-            return false;
-        }
-
-        if (tenantId && !key.toLowerCase().includes(tenantId.toLowerCase())) {
-            return false;
-        }
-
-        // Do not check environment as aliasing can cause false negatives
-
-        return true;
-    }
-
-    /**
-     * Returns true if the given key matches our credential key schema.
-     * @param key
-     */
-    isCredentialKey(key: string): boolean {
-        if (key.split(Separators.CACHE_KEY_SEPARATOR).length < 6) {
-            // Credential cache keys contain 6 items separated by '-' (each item may also contain '-')
-            return false;
-        }
-
-        const lowerCaseKey = key.toLowerCase();
-        // Credential keys must indicate what credential type they represent
-        if (
-            lowerCaseKey.indexOf(CredentialType.ID_TOKEN.toLowerCase()) ===
-                -1 &&
-            lowerCaseKey.indexOf(CredentialType.ACCESS_TOKEN.toLowerCase()) ===
-                -1 &&
-            lowerCaseKey.indexOf(
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()
-            ) === -1 &&
-            lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) ===
-                -1
-        ) {
-            return false;
-        }
-
-        if (
-            lowerCaseKey.indexOf(CredentialType.REFRESH_TOKEN.toLowerCase()) >
-            -1
-        ) {
-            // Refresh tokens must contain the client id or family id
-            const clientIdValidation = `${CredentialType.REFRESH_TOKEN}${Separators.CACHE_KEY_SEPARATOR}${this.clientId}${Separators.CACHE_KEY_SEPARATOR}`;
-            const familyIdValidation = `${CredentialType.REFRESH_TOKEN}${Separators.CACHE_KEY_SEPARATOR}${THE_FAMILY_ID}${Separators.CACHE_KEY_SEPARATOR}`;
-            if (
-                lowerCaseKey.indexOf(clientIdValidation.toLowerCase()) === -1 &&
-                lowerCaseKey.indexOf(familyIdValidation.toLowerCase()) === -1
-            ) {
-                return false;
-            }
-        } else if (lowerCaseKey.indexOf(this.clientId.toLowerCase()) === -1) {
-            // Tokens must contain the clientId
-            return false;
-        }
-
-        return true;
-    }
-
     /**
      * Returns whether or not the given credential entity matches the filter
      * @param entity
@@ -974,10 +908,9 @@ export abstract class CacheManager implements ICacheManager {
      * Removes all accounts and related tokens from cache.
      */
     removeAllAccounts(correlationId: string): void {
-        const allAccountKeys = this.getAccountKeys();
-
-        allAccountKeys.forEach((cacheKey) => {
-            this.removeAccount(cacheKey, correlationId);
+        const accounts = this.getAllAccounts({}, correlationId);
+        accounts.forEach((account) => {
+            this.removeAccount(account, correlationId);
         });
     }
 
@@ -985,39 +918,47 @@ export abstract class CacheManager implements ICacheManager {
      * Removes the account and related tokens for a given account key
      * @param account
      */
-    removeAccount(accountKey: string, correlationId: string): void {
-        const account = this.getAccount(accountKey, correlationId);
-        if (!account) {
-            return;
-        }
+    removeAccount(account: AccountInfo, correlationId: string): void {
         this.removeAccountContext(account, correlationId);
-        this.removeItem(accountKey, correlationId);
+        const accountKeys = this.getAccountKeys();
+        const keyFilter = (key: string): boolean => {
+            return (
+                key.includes(account.homeAccountId) &&
+                key.includes(account.environment)
+            );
+        };
+        accountKeys.filter(keyFilter).forEach((key) => {
+            this.removeItem(key, correlationId);
+            this.performanceClient.incrementFields(
+                { accountsRemoved: 1 },
+                correlationId
+            );
+        });
     }
 
     /**
      * Removes credentials associated with the provided account
      * @param account
      */
-    removeAccountContext(account: AccountEntity, correlationId: string): void {
+    removeAccountContext(account: AccountInfo, correlationId: string): void {
         const allTokenKeys = this.getTokenKeys();
-        const accountId = account.generateAccountId();
+        const keyFilter = (key: string): boolean => {
+            return (
+                key.includes(account.homeAccountId) &&
+                key.includes(account.environment)
+            );
+        };
 
-        allTokenKeys.idToken.forEach((key) => {
-            if (key.indexOf(accountId) === 0) {
-                this.removeIdToken(key, correlationId);
-            }
+        allTokenKeys.idToken.filter(keyFilter).forEach((key) => {
+            this.removeIdToken(key, correlationId);
         });
 
-        allTokenKeys.accessToken.forEach((key) => {
-            if (key.indexOf(accountId) === 0) {
-                this.removeAccessToken(key, correlationId);
-            }
+        allTokenKeys.accessToken.filter(keyFilter).forEach((key) => {
+            this.removeAccessToken(key, correlationId);
         });
 
-        allTokenKeys.refreshToken.forEach((key) => {
-            if (key.indexOf(accountId) === 0) {
-                this.removeRefreshToken(key, correlationId);
-            }
+        allTokenKeys.refreshToken.filter(keyFilter).forEach((key) => {
+            this.removeRefreshToken(key, correlationId);
         });
     }
 
@@ -1075,19 +1016,6 @@ export abstract class CacheManager implements ICacheManager {
         return true;
     }
 
-    /**
-     * Retrieve AccountEntity from cache
-     * @param account
-     */
-    readAccountFromCache(
-        account: AccountInfo,
-        correlationId: string
-    ): AccountEntity | null {
-        const accountKey: string =
-            AccountEntity.generateAccountCacheKey(account);
-        return this.getAccount(accountKey, correlationId);
-    }
-
     /**
      * Retrieve IdTokenEntity from cache
      * @param account {AccountInfo}
@@ -1335,7 +1263,7 @@ export abstract class CacheManager implements ICacheManager {
             );
             accessTokens.forEach((accessToken) => {
                 this.removeAccessToken(
-                    generateCredentialKey(accessToken),
+                    this.generateCredentialKey(accessToken),
                     correlationId
                 );
             });
@@ -1958,4 +1886,10 @@ export class DefaultStorageClass extends CacheManager {
     getTokenKeys(): TokenKeys {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     }
+    generateCredentialKey(): string {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    }
+    generateAccountKey(): string {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    }
 }

package/src/cache/entities/AccountEntity.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { CacheAccountType, Separators } from "../../utils/Constants.js";
+import { CacheAccountType } from "../../utils/Constants.js";
 import type { Authority } from "../../authority/Authority.js";
 import { ICrypto } from "../../crypto/ICrypto.js";
 import { ClientInfo, buildClientInfo } from "../../account/ClientInfo.js";
@@ -54,6 +54,7 @@ export class AccountEntity {
     localAccountId: string;
     username: string;
     authorityType: string;
+    loginHint?: string;
     clientInfo?: string;
     name?: string;
     lastModificationTime?: string;
@@ -62,28 +63,7 @@ export class AccountEntity {
     msGraphHost?: string;
     nativeAccountId?: string;
     tenantProfiles?: Array<TenantProfile>;
-    lastUpdatedAt?: string;
-
-    /**
-     * Generate Account Id key component as per the schema: <home_account_id>-<environment>
-     */
-    generateAccountId(): string {
-        const accountId: Array<string> = [this.homeAccountId, this.environment];
-        return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    }
-
-    /**
-     * Generate Account Cache Key as per the schema: <home_account_id>-<environment>-<realm*>
-     */
-    generateAccountKey(): string {
-        return AccountEntity.generateAccountCacheKey({
-            homeAccountId: this.homeAccountId,
-            environment: this.environment,
-            tenantId: this.realm,
-            username: this.username,
-            localAccountId: this.localAccountId,
-        });
-    }
+    lastUpdatedAt: string;
 
     /**
      * Returns the AccountInfo interface for this account.
@@ -95,6 +75,7 @@ export class AccountEntity {
             tenantId: this.realm,
             username: this.username,
             localAccountId: this.localAccountId,
+            loginHint: this.loginHint,
             name: this.name,
             nativeAccountId: this.nativeAccountId,
             authorityType: this.authorityType,
@@ -114,21 +95,6 @@ export class AccountEntity {
         return !this.tenantProfiles;
     }
 
-    /**
-     * Generates account key from interface
-     * @param accountInterface
-     */
-    static generateAccountCacheKey(accountInterface: AccountInfo): string {
-        const homeTenantId = accountInterface.homeAccountId.split(".")[1];
-        const accountKey = [
-            accountInterface.homeAccountId,
-            accountInterface.environment || "",
-            homeTenantId || accountInterface.tenantId || "",
-        ];
-
-        return accountKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-    }
-
     /**
      * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
      * @param accountDetails
@@ -207,6 +173,7 @@ export class AccountEntity {
             : null;
 
         account.username = preferredUsername || email || "";
+        account.loginHint = accountDetails.idTokenClaims?.login_hint;
         account.name = accountDetails.idTokenClaims?.name || "";
 
         account.cloudGraphHostName = accountDetails.cloudGraphHostName;
@@ -252,6 +219,7 @@ export class AccountEntity {
 
         account.username = accountInfo.username;
         account.name = accountInfo.name;
+        account.loginHint = accountInfo.loginHint;
 
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;
@@ -353,6 +321,7 @@ export class AccountEntity {
             accountA.localAccountId === accountB.localAccountId &&
             accountA.username === accountB.username &&
             accountA.tenantId === accountB.tenantId &&
+            accountA.loginHint === accountB.loginHint &&
             accountA.environment === accountB.environment &&
             accountA.nativeAccountId === accountB.nativeAccountId &&
             claimsMatch

package/src/cache/entities/CredentialEntity.ts

@@ -34,5 +34,5 @@ export type CredentialEntity = {
     /** Matches the SHA 256 hash of the claims object included in the token request */
     requestedClaimsHash?: string;
     /** Timestamp when the entry was last updated */
-    lastUpdatedAt?: string;
+    lastUpdatedAt: string;
 };

package/src/cache/interface/ICacheManager.ts

@@ -29,19 +29,6 @@ export interface ICacheManager {
      */
     setAccount(account: AccountEntity, correlationId: string): Promise<void>;
 
-    /**
-     * Returns true if the given key matches our account key schema. Also matches homeAccountId and/or tenantId if provided
-     * @param key
-     * @param homeAccountId
-     * @param tenantId
-     * @returns
-     */
-    isAccountKey(
-        key: string,
-        homeAccountId?: string,
-        tenantId?: string
-    ): boolean;
-
     /**
      * fetch the idToken entity from the platform cache
      * @param idTokenKey
@@ -221,13 +208,13 @@ export interface ICacheManager {
      * returns a boolean if the given account is removed
      * @param account
      */
-    removeAccount(accountKey: string, correlationId: string): void;
+    removeAccount(account: AccountInfo, correlationId: string): void;
 
     /**
      * returns a boolean if the given account is removed
      * @param account
      */
-    removeAccountContext(account: AccountEntity, correlationId: string): void;
+    removeAccountContext(account: AccountInfo, correlationId: string): void;
 
     /**
      * @param key

package/src/cache/utils/CacheHelpers.ts

@@ -28,28 +28,6 @@ import { CredentialEntity } from "../entities/CredentialEntity.js";
 import { IdTokenEntity } from "../entities/IdTokenEntity.js";
 import { RefreshTokenEntity } from "../entities/RefreshTokenEntity.js";
 
-/**
- * Cache Key: <home_account_id>-<environment>-<credential_type>-<client_id or familyId>-<realm>-<scopes>-<claims hash>-<scheme>
- * IdToken Example: uid.utid-login.microsoftonline.com-idtoken-app_client_id-contoso.com
- * AccessToken Example: uid.utid-login.microsoftonline.com-accesstoken-app_client_id-contoso.com-scope1 scope2--pop
- * RefreshToken Example: uid.utid-login.microsoftonline.com-refreshtoken-1-contoso.com
- * @param credentialEntity
- * @returns
- */
-export function generateCredentialKey(
-    credentialEntity: CredentialEntity
-): string {
-    const credentialKey = [
-        generateAccountId(credentialEntity),
-        generateCredentialId(credentialEntity),
-        generateTarget(credentialEntity),
-        generateClaimsHash(credentialEntity),
-        generateScheme(credentialEntity),
-    ];
-
-    return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-}
-
 /**
  * Create IdTokenEntity
  * @param homeAccountId
@@ -71,6 +49,7 @@ export function createIdTokenEntity(
         clientId: clientId,
         secret: idToken,
         realm: tenantId,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
     };
 
     return idTokenEntity;
@@ -116,6 +95,7 @@ export function createAccessTokenEntity(
         realm: tenantId,
         target: scopes,
         tokenType: tokenType || AuthenticationScheme.BEARER,
+        lastUpdatedAt: Date.now().toString(), // Set the last updated time to now
     };
 
     if (userAssertionHash) {
@@ -184,6 +164,7 @@ export function createRefreshTokenEntity(
         environment: environment,
         clientId: clientId,
         secret: refreshToken,
+        lastUpdatedAt: Date.now().toString(),
     };
 
     if (userAssertionHash) {
@@ -201,7 +182,7 @@ export function createRefreshTokenEntity(
     return rtEntity;
 }
 
-export function isCredentialEntity(entity: object): boolean {
+export function isCredentialEntity(entity: object): entity is CredentialEntity {
     return (
         entity.hasOwnProperty("homeAccountId") &&
         entity.hasOwnProperty("environment") &&
@@ -215,7 +196,9 @@ export function isCredentialEntity(entity: object): boolean {
  * Validates an entity: checks for all expected params
  * @param entity
  */
-export function isAccessTokenEntity(entity: object): boolean {
+export function isAccessTokenEntity(
+    entity: object
+): entity is AccessTokenEntity {
     if (!entity) {
         return false;
     }
@@ -234,7 +217,7 @@ export function isAccessTokenEntity(entity: object): boolean {
  * Validates an entity: checks for all expected params
  * @param entity
  */
-export function isIdTokenEntity(entity: object): boolean {
+export function isIdTokenEntity(entity: object): entity is IdTokenEntity {
     if (!entity) {
         return false;
     }
@@ -250,7 +233,9 @@ export function isIdTokenEntity(entity: object): boolean {
  * Validates an entity: checks for all expected params
  * @param entity
  */
-export function isRefreshTokenEntity(entity: object): boolean {
+export function isRefreshTokenEntity(
+    entity: object
+): entity is RefreshTokenEntity {
     if (!entity) {
         return false;
     }
@@ -261,63 +246,6 @@ export function isRefreshTokenEntity(entity: object): boolean {
     );
 }
 
-/**
- * Generate Account Id key component as per the schema: <home_account_id>-<environment>
- */
-function generateAccountId(credentialEntity: CredentialEntity): string {
-    const accountId: Array<string> = [
-        credentialEntity.homeAccountId,
-        credentialEntity.environment,
-    ];
-    return accountId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-}
-
-/**
- * Generate Credential Id key component as per the schema: <credential_type>-<client_id>-<realm>
- */
-function generateCredentialId(credentialEntity: CredentialEntity): string {
-    const clientOrFamilyId =
-        credentialEntity.credentialType === CredentialType.REFRESH_TOKEN
-            ? credentialEntity.familyId || credentialEntity.clientId
-            : credentialEntity.clientId;
-    const credentialId: Array<string> = [
-        credentialEntity.credentialType,
-        clientOrFamilyId,
-        credentialEntity.realm || "",
-    ];
-
-    return credentialId.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
-}
-
-/**
- * Generate target key component as per schema: <target>
- */
-function generateTarget(credentialEntity: CredentialEntity): string {
-    return (credentialEntity.target || "").toLowerCase();
-}
-
-/**
- * Generate requested claims key component as per schema: <requestedClaims>
- */
-function generateClaimsHash(credentialEntity: CredentialEntity): string {
-    return (credentialEntity.requestedClaimsHash || "").toLowerCase();
-}
-
-/**
- * Generate scheme key componenet as per schema: <scheme>
- */
-function generateScheme(credentialEntity: CredentialEntity): string {
-    /*
-     * PoP Tokens and SSH certs include scheme in cache key
-     * Cast to lowercase to handle "bearer" from ADFS
-     */
-    return credentialEntity.tokenType &&
-        credentialEntity.tokenType.toLowerCase() !==
-            AuthenticationScheme.BEARER.toLowerCase()
-        ? credentialEntity.tokenType.toLowerCase()
-        : "";
-}
-
 /**
  * validates if a given cache entry is "Telemetry", parses <key,value>
  * @param key

package/src/client/RefreshTokenClient.ts

@@ -47,7 +47,6 @@ import {
 import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
 import { invoke, invokeAsync } from "../utils/FunctionWrappers.js";
-import { generateCredentialKey } from "../cache/utils/CacheHelpers.js";
 import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
 import { getRequestThumbprint } from "../network/RequestThumbprint.js";
@@ -273,7 +272,7 @@ export class RefreshTokenClient extends BaseClient {
                         "acquireTokenWithRefreshToken: bad refresh token, removing from cache"
                     );
                     const badRefreshTokenKey =
-                        generateCredentialKey(refreshToken);
+                        this.cacheManager.generateCredentialKey(refreshToken);
                     this.cacheManager.removeRefreshToken(
                         badRefreshTokenKey,
                         request.correlationId

package/src/client/SilentFlowClient.ts

@@ -115,8 +115,8 @@ export class SilentFlowClient extends BaseClient {
         const environment =
             request.authority || this.authority.getPreferredCache();
         const cacheRecord: CacheRecord = {
-            account: this.cacheManager.readAccountFromCache(
-                request.account,
+            account: this.cacheManager.getAccount(
+                this.cacheManager.generateAccountKey(request.account),
                 request.correlationId
             ),
             accessToken: cachedAccessToken,

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "15.9.0";
+export const version = "15.11.0";

package/src/protocol/Authorize.ts

@@ -411,5 +411,5 @@ function extractAccountSid(account: AccountInfo): string | null {
 }
 
 function extractLoginHint(account: AccountInfo): string | null {
-    return account.idTokenClaims?.login_hint || null;
+    return account.loginHint || account.idTokenClaims?.login_hint || null;
 }

package/src/response/ResponseHandler.ts

@@ -278,7 +278,9 @@ export class ResponseHandler {
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account
             ) {
-                const key = cacheRecord.account.generateAccountKey();
+                const key = this.cacheStorage.generateAccountKey(
+                    cacheRecord.account.getAccountInfo()
+                );
                 const account = this.cacheStorage.getAccount(
                     key,
                     request.correlationId

package/src/telemetry/performance/PerformanceEvent.ts

@@ -859,6 +859,10 @@ export type PerformanceEvent = {
     // Event context as JSON string
     context?: string;
 
+    // Cache Data
+    cacheLocation?: string;
+    cacheRetentionDays?: number;
+
     // Number of tokens in the cache to be reported when cache quota is exceeded
     cacheRtCount?: number;
     cacheIdCount?: number;
@@ -898,6 +902,8 @@ export type PerformanceEvent = {
     msalInstanceCount?: number;
     // Number of MSAL JS instances using the same client id in the frame
     sameClientIdInstanceCount?: number;
+
+    navigateCallbackResult?: boolean;
 };
 
 export type PerformanceEventContext = {
@@ -927,4 +933,14 @@ export const IntFields: ReadonlySet<string> = new Set([
     "multiMatchedRT",
     "unencryptedCacheCount",
     "encryptedCacheExpiredCount",
+    "oldAccountCount",
+    "oldAccessCount",
+    "oldIdCount",
+    "oldRefreshCount",
+    "currAccountCount",
+    "currAccessCount",
+    "currIdCount",
+    "currRefreshCount",
+    "expiredCacheRemovedCount",
+    "upgradedCacheCount",
 ]);

package/src/utils/Constants.ts

@@ -6,8 +6,6 @@
 export const Constants = {
     LIBRARY_NAME: "MSAL.JS",
     SKU: "msal.js.common",
-    // Prefix for all library cache entries
-    CACHE_PREFIX: "msal",
     // default authority
     DEFAULT_AUTHORITY: "https://login.microsoftonline.com/common/",
     DEFAULT_AUTHORITY_HOST: "login.microsoftonline.com",

package/src/utils/TimeUtils.ts

@@ -48,6 +48,21 @@ export function isTokenExpired(expiresOn: string, offset: number): boolean {
     return offsetCurrentTimeSec > expirationSec;
 }
 
+/**
+ * Checks if a cache entry is expired based on the last updated time and cache retention days.
+ * @param lastUpdatedAt
+ * @param cacheRetentionDays
+ * @returns
+ */
+export function isCacheExpired(
+    lastUpdatedAt: string,
+    cacheRetentionDays: number
+): boolean {
+    const cacheExpirationTimestamp =
+        Number(lastUpdatedAt) + cacheRetentionDays * 24 * 60 * 60 * 1000;
+    return Date.now() > cacheExpirationTimestamp;
+}
+
 /**
  * If the current time is earlier than the time that a token was cached at, we must discard the token
  * i.e. The system clock was turned back after acquiring the cached token