@azure/msal-common 16.0.0-alpha.0 → 16.0.0-beta.0

package/package.json

@@ -1,125 +1,127 @@
 {
-    "name": "@azure/msal-common",
-    "author": {
-        "name": "Microsoft",
-        "email": "nugetaad@microsoft.com",
-        "url": "https://www.microsoft.com"
+  "name": "@azure/msal-common",
+  "author": {
+    "name": "Microsoft",
+    "email": "nugetaad@microsoft.com",
+    "url": "https://www.microsoft.com"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
+  },
+  "version": "16.0.0-beta.0",
+  "description": "Microsoft Authentication Library for js",
+  "keywords": [
+    "implicit",
+    "authorization code",
+    "PKCE",
+    "js",
+    "AAD",
+    "msal",
+    "oauth"
+  ],
+  "sideEffects": false,
+  "type": "module",
+  "main": "./lib/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    "./browser": {
+      "import": {
+        "types": "./dist-browser/index-browser.d.ts",
+        "default": "./dist-browser/index-browser.mjs"
+      },
+      "require": {
+        "types": "./lib/types/index-browser.d.ts",
+        "default": "./lib/index-browser.cjs"
+      }
     },
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
+    "./node": {
+      "import": {
+        "types": "./dist/index-node.d.ts",
+        "default": "./dist/index-node.mjs"
+      },
+      "require": {
+        "types": "./lib/types/index-node.d.ts",
+        "default": "./lib/index-node.cjs"
+      }
     },
-    "version": "16.0.0-alpha.0",
-    "description": "Microsoft Authentication Library for js",
-    "keywords": [
-        "implicit",
-        "authorization code",
-        "PKCE",
-        "js",
-        "AAD",
-        "msal",
-        "oauth"
-    ],
-    "sideEffects": false,
-    "type": "module",
-    "main": "./lib/index.cjs",
-    "module": "./dist/index.mjs",
-    "types": "./dist/index.d.ts",
-    "exports": {
-        "./browser": {
-            "import": {
-                "types": "./dist/index-browser.d.ts",
-                "default": "./dist/index-browser.mjs"
-            },
-            "require": {
-                "types": "./lib/types/index-browser.d.ts",
-                "default": "./lib/index-browser.cjs"
-            }
-        },
-        "./node": {
-            "import": {
-                "types": "./dist/index-node.d.ts",
-                "default": "./dist/index-node.mjs"
-            },
-            "require": {
-                "types": "./lib/types/index-node.d.ts",
-                "default": "./lib/index-node.cjs"
-            }
-        },
-        ".": {
-            "import": {
-                "types": "./dist/index.d.ts",
-                "default": "./dist/index.mjs"
-            },
-            "require": {
-                "types": "./lib/types/index.d.ts",
-                "default": "./lib/index.cjs"
-            }
-        },
-        "./package.json": "./package.json"
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./lib/types/index.d.ts",
+        "default": "./lib/index.cjs"
+      }
     },
-    "engines": {
-        "node": ">=0.8.0"
-    },
-    "directories": {
-        "test": "test"
-    },
-    "files": [
-        "dist",
-        "lib",
-        "src",
-        "node",
-        "browser"
-    ],
-    "scripts": {
-        "clean": "shx rm -rf dist lib",
-        "clean:coverage": "rimraf ../../.nyc_output/*",
-        "lint": "eslint src --ext .ts",
-        "lint:fix": "npm run lint -- --fix",
-        "test": "jest",
-        "test:coverage": "jest --coverage",
-        "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
-        "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
-        "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
-        "build": "npm run clean && npm run build:modules",
-        "build:all": "npm run build",
-        "prepack": "npm run build",
-        "metadata:check": "ts-node scripts/metadata.ts",
-        "format:check": "prettier --ignore-path .gitignore --check src test",
-        "format:fix": "prettier --ignore-path .gitignore --write src test",
-        "apiExtractor": "api-extractor run"
-    },
-    "beachball": {
-        "disallowedChangeTypes": []
-    },
-    "devDependencies": {
-        "@babel/core": "^7.7.2",
-        "@babel/plugin-proposal-class-properties": "^7.7.0",
-        "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
-        "@babel/preset-env": "^7.7.1",
-        "@babel/preset-typescript": "^7.7.2",
-        "@microsoft/api-extractor": "^7.43.4",
-        "@rollup/plugin-typescript": "^11.0.0",
-        "@types/debug": "^4.1.5",
-        "@types/jest": "^29.5.0",
-        "@types/lodash": "^4.14.182",
-        "@types/node": "^20.3.1",
-        "eslint-config-msal": "file:../../shared-configs/eslint-config-msal",
-        "jest": "^29.5.0",
-        "jest-junit": "^16.0.0",
-        "lodash": "^4.17.21",
-        "msal-test-utils": "file:../../shared-test-utils",
-        "prettier": "2.8.7",
-        "rimraf": "^3.0.2",
-        "rollup": "^4.22.4",
-        "rollup-msal": "file:../../shared-configs/rollup-msal",
-        "shx": "^0.3.2",
-        "ts-jest": "^29.1.0",
-        "ts-jest-resolver": "^2.0.1",
-        "ts-node": "^10.9.1",
-        "tslib": "^1.10.0",
-        "typescript": "^4.9.5",
-        "yargs": "^17.5.1"
-    }
+    "./package.json": "./package.json"
+  },
+  "engines": {
+    "node": ">=0.8.0"
+  },
+  "directories": {
+    "test": "test"
+  },
+  "files": [
+    "dist",
+    "lib",
+    "src",
+    "node",
+    "browser"
+  ],
+  "scripts": {
+    "clean": "shx rm -rf dist dist-browser lib",
+    "clean:coverage": "rimraf ../../.nyc_output/*",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "npm run lint -- --fix",
+    "test": "jest",
+    "test:coverage": "jest --coverage",
+    "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
+    "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
+    "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
+    "build": "npm run clean && npm run build:modules",
+    "build:debug": "npm run clean && MSAL_MINIFY_LOGS=false npm run build:modules",
+    "build:all": "npm run build",
+    "build:all:debug": "MSAL_MINIFY_LOGS=false npm run build",
+    "prepack": "npm run build",
+    "metadata:check": "ts-node scripts/metadata.ts",
+    "format:check": "prettier --ignore-path .gitignore --check src test",
+    "format:fix": "prettier --ignore-path .gitignore --write src test",
+    "apiExtractor": "api-extractor run"
+  },
+  "beachball": {
+    "disallowedChangeTypes": []
+  },
+  "devDependencies": {
+    "@babel/core": "^7.7.2",
+    "@babel/plugin-proposal-class-properties": "^7.7.0",
+    "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
+    "@babel/preset-env": "^7.7.1",
+    "@babel/preset-typescript": "^7.7.2",
+    "@microsoft/api-extractor": "^7.43.4",
+    "@rollup/plugin-typescript": "^11.0.0",
+    "@types/debug": "^4.1.5",
+    "@types/jest": "^29.5.0",
+    "@types/lodash": "^4.14.182",
+    "@types/node": "^20.3.1",
+    "eslint-config-msal": "file:../../shared-configs/eslint-config-msal",
+    "jest": "^29.5.0",
+    "jest-junit": "^16.0.0",
+    "lodash": "^4.17.21",
+    "msal-test-utils": "file:../../shared-test-utils",
+    "prettier": "2.8.7",
+    "rimraf": "^3.0.2",
+    "rollup": "^4.22.4",
+    "rollup-msal": "file:../../shared-configs/rollup-msal",
+    "shx": "^0.3.2",
+    "ts-jest": "^29.1.0",
+    "ts-jest-resolver": "^2.0.1",
+    "ts-node": "^10.9.1",
+    "tslib": "^1.10.0",
+    "typescript": "^4.9.5",
+    "yargs": "^17.5.1"
+  }
 }

package/src/account/AccountInfo.ts

@@ -4,6 +4,9 @@
  */
 
 import { TokenClaims } from "./TokenClaims.js";
+
+export type DataBoundary = "EU" | "None";
+
 /**
  * Account object with the following signature:
  * - homeAccountId          - Home account identifier for this account object
@@ -16,6 +19,7 @@ import { TokenClaims } from "./TokenClaims.js";
  * - idTokenClaims          - Object contains claims from ID token
  * - nativeAccountId        - The user's native account ID
  * - tenantProfiles         - Map of tenant profile objects for each tenant that the account has authenticated with in the browser
+ * - dataBoundary           - Data boundary extracted from clientInfo
  */
 export type AccountInfo = {
     homeAccountId: string;
@@ -38,6 +42,7 @@ export type AccountInfo = {
     nativeAccountId?: string;
     authorityType?: string;
     tenantProfiles?: Map<string, TenantProfile>;
+    dataBoundary?: DataBoundary;
 };
 
 /**

package/src/account/AuthToken.ts

@@ -30,6 +30,28 @@ export function extractTokenClaims(
     }
 }
 
+/**
+ * Check if the signin_state claim contains "kmsi"
+ * @param idTokenClaims
+ * @returns
+ */
+export function isKmsi(idTokenClaims: TokenClaims): boolean {
+    if (!idTokenClaims.signin_state) {
+        return false;
+    }
+    /**
+     * Signin_state claim known values:
+     * dvc_mngd - device is managed
+     * dvc_dmjd - device is domain joined
+     * kmsi - user opted to "keep me signed in"
+     * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
+     */
+    const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
+    return idTokenClaims.signin_state.some((value) =>
+        kmsiClaims.includes(value.trim().toLowerCase())
+    );
+}
+
 /**
  * decode a JWT
  *

package/src/account/ClientInfo.ts

@@ -10,11 +10,15 @@ import {
 import * as Constants from "../utils/Constants.js";
 
 /**
- * Client info object which consists of two IDs. Need to add more info here.
+ * Client info object which consists of:
+ * uid: user id
+ * utid: tenant id
+ * xms_tdbr: optional, only for non-US tenants
  */
 export type ClientInfo = {
     uid: string;
     utid: string;
+    xms_tdbr?: string;
 };
 
 /**

package/src/account/TokenClaims.ts

@@ -47,6 +47,10 @@ export type TokenClaims = {
     upn?: string;
     preferred_username?: string;
     login_hint?: string;
+    /**
+     * Contains KMSI (Keep Me Signed In) status among other things
+     */
+    signin_state?: Array<string>;
     emails?: string[];
     name?: string;
     nonce?: string;

package/src/authority/AuthorityMetadata.ts

@@ -16,42 +16,40 @@ type RawMetadata = {
     instanceDiscoveryMetadata: CloudInstanceDiscoveryResponse;
 };
 
-export const rawMetdataJSON: RawMetadata = {
-    endpointMetadata: {
-        "login.microsoftonline.com": {
-            token_endpoint:
-                "https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/token",
-            jwks_uri:
-                "https://login.microsoftonline.com/{tenantid}/discovery/v2.0/keys",
-            issuer: "https://login.microsoftonline.com/{tenantid}/v2.0",
-            authorization_endpoint:
-                "https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/authorize",
-            end_session_endpoint:
-                "https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/logout",
-        },
-        "login.chinacloudapi.cn": {
-            token_endpoint:
-                "https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/token",
-            jwks_uri:
-                "https://login.chinacloudapi.cn/{tenantid}/discovery/v2.0/keys",
-            issuer: "https://login.partner.microsoftonline.cn/{tenantid}/v2.0",
-            authorization_endpoint:
-                "https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/authorize",
-            end_session_endpoint:
-                "https://login.chinacloudapi.cn/{tenantid}/oauth2/v2.0/logout",
-        },
-        "login.microsoftonline.us": {
-            token_endpoint:
-                "https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/token",
-            jwks_uri:
-                "https://login.microsoftonline.us/{tenantid}/discovery/v2.0/keys",
-            issuer: "https://login.microsoftonline.us/{tenantid}/v2.0",
-            authorization_endpoint:
-                "https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/authorize",
-            end_session_endpoint:
-                "https://login.microsoftonline.us/{tenantid}/oauth2/v2.0/logout",
-        },
+// Build endpoint metadata dynamically to avoid string duplication
+const endpointHosts: Array<{ host: string; issuerHost?: string }> = [
+    { host: "login.microsoftonline.com" },
+    {
+        host: "login.chinacloudapi.cn",
+        issuerHost: "login.partner.microsoftonline.cn", // Issuer differs
     },
+    { host: "login.microsoftonline.us" },
+    { host: "login.sovcloud-identity.fr" },
+    { host: "login.sovcloud-identity.de" },
+    { host: "login.sovcloud-identity.sg" },
+];
+
+function buildOpenIdConfig(
+    host: string,
+    issuerHost: string
+): OpenIdConfigResponse {
+    return {
+        token_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/token`,
+        jwks_uri: `https://${host}/{tenantid}/discovery/v2.0/keys`,
+        issuer: `https://${issuerHost}/{tenantid}/v2.0`,
+        authorization_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/authorize`,
+        end_session_endpoint: `https://${host}/{tenantid}/oauth2/v2.0/logout`,
+    };
+}
+
+const dynamicEndpointMetadata: RawMetadata["endpointMetadata"] =
+    endpointHosts.reduce((acc, { host, issuerHost }) => {
+        acc[host] = buildOpenIdConfig(host, issuerHost || host);
+        return acc;
+    }, {} as Record<string, OpenIdConfigResponse>);
+
+export const rawMetdataJSON: RawMetadata = {
+    endpointMetadata: dynamicEndpointMetadata,
     instanceDiscoveryMetadata: {
         tenant_discovery_endpoint:
             "https://{canonicalAuthority}/v2.0/.well-known/openid-configuration",

package/src/cache/CacheManager.ts

@@ -90,7 +90,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setAccount(
         account: AccountEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -109,7 +110,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setIdTokenCredential(
         idToken: IdTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -128,7 +130,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setAccessTokenCredential(
         accessToken: AccessTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -147,7 +150,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setRefreshTokenCredential(
         refreshToken: RefreshTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -544,6 +548,7 @@ export abstract class CacheManager implements ICacheManager {
     async saveCacheRecord(
         cacheRecord: CacheRecord,
         correlationId: string,
+        kmsi: boolean,
         storeInCache?: StoreInCache
     ): Promise<void> {
         if (!cacheRecord) {
@@ -554,13 +559,14 @@ export abstract class CacheManager implements ICacheManager {
 
         try {
             if (!!cacheRecord.account) {
-                await this.setAccount(cacheRecord.account, correlationId);
+                await this.setAccount(cacheRecord.account, correlationId, kmsi);
             }
 
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
                 await this.setIdTokenCredential(
                     cacheRecord.idToken,
-                    correlationId
+                    correlationId,
+                    kmsi
                 );
             }
 
@@ -570,7 +576,8 @@ export abstract class CacheManager implements ICacheManager {
             ) {
                 await this.saveAccessToken(
                     cacheRecord.accessToken,
-                    correlationId
+                    correlationId,
+                    kmsi
                 );
             }
 
@@ -580,7 +587,8 @@ export abstract class CacheManager implements ICacheManager {
             ) {
                 await this.setRefreshTokenCredential(
                     cacheRecord.refreshToken,
-                    correlationId
+                    correlationId,
+                    kmsi
                 );
             }
 
@@ -606,7 +614,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     private async saveAccessToken(
         credential: AccessTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void> {
         const accessTokenFilter: CredentialFilter = {
             clientId: credential.clientId,
@@ -646,7 +655,7 @@ export abstract class CacheManager implements ICacheManager {
                 }
             }
         });
-        await this.setAccessTokenCredential(credential, correlationId);
+        await this.setAccessTokenCredential(credential, correlationId, kmsi);
     }
 
     /**

package/src/cache/entities/AccountEntity.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { TenantProfile } from "../../account/AccountInfo.js";
+import { TenantProfile, DataBoundary } from "../../account/AccountInfo.js";
 
 /**
  * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
@@ -46,4 +46,5 @@ export type AccountEntity = {
     tenantProfiles?: Array<TenantProfile>;
     /** Timestamp when the entry was last updated */
     lastUpdatedAt: string;
+    dataBoundary?: DataBoundary;
 };

package/src/cache/interface/ICacheManager.ts

@@ -29,7 +29,11 @@ export interface ICacheManager {
      * @param account
      * @param correlationId
      */
-    setAccount(account: AccountEntity, correlationId: string): Promise<void>;
+    setAccount(
+        account: AccountEntity,
+        correlationId: string,
+        kmsi: boolean
+    ): Promise<void>;
 
     /**
      * fetch the idToken entity from the platform cache
@@ -48,7 +52,8 @@ export interface ICacheManager {
      */
     setIdTokenCredential(
         idToken: IdTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -68,7 +73,8 @@ export interface ICacheManager {
      */
     setAccessTokenCredential(
         accessToken: AccessTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -88,7 +94,8 @@ export interface ICacheManager {
      */
     setRefreshTokenCredential(
         refreshToken: RefreshTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -216,6 +223,7 @@ export interface ICacheManager {
     saveCacheRecord(
         cacheRecord: CacheRecord,
         correlationId: string,
+        kmsi: boolean,
         storeInCache?: StoreInCache
     ): Promise<void>;
 

package/src/cache/utils/AccountEntityUtils.ts

@@ -11,6 +11,7 @@ import {
     AccountInfo,
     TenantProfile,
     buildTenantProfile,
+    DataBoundary,
 } from "../../account/AccountInfo.js";
 import {
     createClientAuthError,
@@ -56,6 +57,7 @@ export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
                 return [tenantProfile.tenantId, tenantProfile];
             })
         ),
+        dataBoundary: accountEntity.dataBoundary,
     };
 }
 
@@ -94,9 +96,13 @@ export function createAccountEntity(
     }
 
     let clientInfo: ClientInfo | undefined;
+    let dataBoundary: DataBoundary | undefined;
 
     if (accountDetails.clientInfo && base64Decode) {
         clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+        if (clientInfo.xms_tdbr) {
+            dataBoundary = clientInfo.xms_tdbr === "EU" ? "EU" : "None";
+        }
     }
 
     const env =
@@ -164,6 +170,7 @@ export function createAccountEntity(
         msGraphHost: accountDetails.msGraphHost,
         nativeAccountId: accountDetails.nativeAccountId,
         tenantProfiles: tenantProfiles,
+        dataBoundary,
     } as AccountEntity;
 }
 
@@ -193,6 +200,7 @@ export function createAccountEntityFromAccountInfo(
         cloudGraphHostName: cloudGraphHostName,
         msGraphHost: msGraphHost,
         tenantProfiles: Array.from(accountInfo.tenantProfiles?.values() || []),
+        dataBoundary: accountInfo.dataBoundary,
     } as AccountEntity;
 }
 
@@ -248,40 +256,3 @@ export function isAccountEntity(entity: object): entity is AccountEntity {
         entity.hasOwnProperty("authorityType")
     );
 }
-
-/**
- * Helper function to determine whether 2 accountInfo objects represent the same account
- * @param accountA
- * @param accountB
- * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
- */
-export function accountInfoIsEqual(
-    accountA: AccountInfo | null,
-    accountB: AccountInfo | null,
-    compareClaims?: boolean
-): boolean {
-    if (!accountA || !accountB) {
-        return false;
-    }
-
-    let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
-    if (compareClaims) {
-        const accountAClaims = (accountA.idTokenClaims || {}) as TokenClaims;
-        const accountBClaims = (accountB.idTokenClaims || {}) as TokenClaims;
-
-        // issued at timestamp and nonce are expected to change each time a new id token is acquired
-        claimsMatch =
-            accountAClaims.iat === accountBClaims.iat &&
-            accountAClaims.nonce === accountBClaims.nonce;
-    }
-
-    return (
-        accountA.homeAccountId === accountB.homeAccountId &&
-        accountA.localAccountId === accountB.localAccountId &&
-        accountA.username === accountB.username &&
-        accountA.tenantId === accountB.tenantId &&
-        accountA.environment === accountB.environment &&
-        accountA.nativeAccountId === accountB.nativeAccountId &&
-        claimsMatch
-    );
-}