@azure/msal-common 16.0.0-alpha.0 → 16.0.0-beta.0

package/src/client/AuthorizationCodeClient.ts

@@ -3,7 +3,6 @@
  * Licensed under the MIT License.
  */
 
-import { BaseClient } from "./BaseClient.js";
 import { CommonAuthorizationCodeRequest } from "../request/CommonAuthorizationCodeRequest.js";
 import { Authority } from "../authority/Authority.js";
 import * as RequestParameterBuilder from "../request/RequestParameterBuilder.js";
@@ -11,7 +10,9 @@ import * as UrlUtils from "../utils/UrlUtils.js";
 import * as Constants from "../utils/Constants.js";
 import * as AADServerParamKeys from "../constants/AADServerParamKeys.js";
 import {
+    buildClientConfiguration,
     ClientConfiguration,
+    CommonClientConfiguration,
     isOidcProtocolMode,
 } from "../config/ClientConfiguration.js";
 import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
@@ -43,21 +44,79 @@ import { invokeAsync } from "../utils/FunctionWrappers.js";
 import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
 import { getRequestThumbprint } from "../network/RequestThumbprint.js";
+import {
+    createTokenQueryParameters,
+    createTokenRequestHeaders,
+    executePostToTokenEndpoint,
+} from "../protocol/Token.js";
+import { createDiscoveredInstance } from "../authority/AuthorityFactory.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { Logger } from "../logger/Logger.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { INetworkModule } from "../network/INetworkModule.js";
+import { version, name } from "../packageMetadata.js";
 
 /**
  * Oauth2.0 Authorization Code client
  * @internal
  */
-export class AuthorizationCodeClient extends BaseClient {
+export class AuthorizationCodeClient {
     // Flag to indicate if client is for hybrid spa auth code redemption
     protected includeRedirectUri: boolean = true;
     private oidcDefaultScopes;
 
+    // Logger object
+    public logger: Logger;
+
+    // Application config
+    protected config: CommonClientConfiguration;
+
+    // Crypto Interface
+    protected cryptoUtils: ICrypto;
+
+    // Storage Interface
+    protected cacheManager: CacheManager;
+
+    // Network Interface
+    protected networkClient: INetworkModule;
+
+    // Server Telemetry Manager
+    protected serverTelemetryManager: ServerTelemetryManager | null;
+
+    // Default authority object
+    public authority: Authority;
+
+    // Performance telemetry client
+    protected performanceClient: IPerformanceClient;
+
     constructor(
         configuration: ClientConfiguration,
         performanceClient: IPerformanceClient
     ) {
-        super(configuration, performanceClient);
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
         this.oidcDefaultScopes =
             this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
     }
@@ -77,6 +136,17 @@ export class AuthorizationCodeClient extends BaseClient {
             );
         }
 
+        // Check for new cloud instance
+        if (authCodePayload && authCodePayload.cloud_instance_host_name) {
+            await invokeAsync(
+                this.updateTokenEndpointAuthority.bind(this),
+                PerformanceEvents.UpdateTokenEndpointAuthority,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(authCodePayload.cloud_instance_host_name, request.correlationId);
+        }
+
         const reqTimestamp = TimeUtils.nowSeconds();
         const response = await invokeAsync(
             this.executeTokenRequest.bind(this),
@@ -84,7 +154,7 @@ export class AuthorizationCodeClient extends BaseClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(this.authority, request);
+        )(this.authority, request, this.serverTelemetryManager);
 
         // Retrieve requestId from response headers
         const requestId =
@@ -153,9 +223,15 @@ export class AuthorizationCodeClient extends BaseClient {
      */
     private async executeTokenRequest(
         authority: Authority,
-        request: CommonAuthorizationCodeRequest
+        request: CommonAuthorizationCodeRequest,
+        serverTelemetryManager: ServerTelemetryManager | null
     ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
-        const queryParametersString = this.createTokenQueryParameters(request);
+        const queryParametersString = createTokenQueryParameters(
+            request,
+            this.config.authOptions.clientId,
+            this.config.authOptions.redirectUri,
+            this.performanceClient
+        );
         const endpoint = UrlString.appendQueryString(
             authority.tokenEndpoint,
             queryParametersString
@@ -187,7 +263,9 @@ export class AuthorizationCodeClient extends BaseClient {
                 );
             }
         }
-        const headers: Record<string, string> = this.createTokenRequestHeaders(
+        const headers: Record<string, string> = createTokenRequestHeaders(
+            this.logger,
+            this.config.systemOptions.preventCorsPreflight,
             ccsCredential || request.ccsCredential
         );
 
@@ -197,12 +275,23 @@ export class AuthorizationCodeClient extends BaseClient {
         );
 
         return invokeAsync(
-            this.executePostToTokenEndpoint.bind(this),
+            executePostToTokenEndpoint,
             PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
+        )(
+            endpoint,
+            requestBody,
+            headers,
+            thumbprint,
+            request.correlationId,
+            this.cacheManager,
+            this.networkClient,
+            this.logger,
+            this.performanceClient,
+            serverTelemetryManager
+        );
     }
 
     /**
@@ -217,7 +306,7 @@ export class AuthorizationCodeClient extends BaseClient {
         RequestParameterBuilder.addClientId(
             parameters,
             request.embeddedClientId ||
-                request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+                request.extraParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -413,22 +502,20 @@ export class AuthorizationCodeClient extends BaseClient {
             );
         }
 
-        if (request.tokenBodyParameters) {
-            RequestParameterBuilder.addExtraQueryParameters(
+        if (request.extraParameters) {
+            RequestParameterBuilder.addExtraParameters(
                 parameters,
-                request.tokenBodyParameters
+                request.extraParameters
             );
         }
 
         // Add hybrid spa parameters if not already provided
         if (
             request.enableSpaAuthorizationCode &&
-            (!request.tokenBodyParameters ||
-                !request.tokenBodyParameters[
-                    AADServerParamKeys.RETURN_SPA_CODE
-                ])
+            (!request.extraParameters ||
+                !request.extraParameters[AADServerParamKeys.RETURN_SPA_CODE])
         ) {
-            RequestParameterBuilder.addExtraQueryParameters(parameters, {
+            RequestParameterBuilder.addExtraParameters(parameters, {
                 [AADServerParamKeys.RETURN_SPA_CODE]: "1",
             });
         }
@@ -483,7 +570,7 @@ export class AuthorizationCodeClient extends BaseClient {
         }
 
         if (request.extraQueryParameters) {
-            RequestParameterBuilder.addExtraQueryParameters(
+            RequestParameterBuilder.addExtraParameters(
                 parameters,
                 request.extraQueryParameters
             );
@@ -495,4 +582,26 @@ export class AuthorizationCodeClient extends BaseClient {
 
         return UrlUtils.mapToQueryString(parameters);
     }
+
+    /**
+     * Updates the authority to the cloud instance provided in the authorization response
+     * @param cloudInstanceHostName - cloud instance host name from authorization code payload
+     * @param correlationId - request correlation id
+     */
+    private async updateTokenEndpointAuthority(
+        cloudInstanceHostName: string,
+        correlationId: string
+    ): Promise<void> {
+        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostName}/${this.authority.tenant}/`;
+        const cloudInstanceAuthority = await createDiscoveredInstance(
+            cloudInstanceAuthorityUri,
+            this.networkClient,
+            this.cacheManager,
+            this.authority.options,
+            this.logger,
+            correlationId,
+            this.performanceClient
+        );
+        this.authority = cloudInstanceAuthority;
+    }
 }

package/src/client/RefreshTokenClient.ts

@@ -4,10 +4,11 @@
  */
 
 import {
+    buildClientConfiguration,
     ClientConfiguration,
+    CommonClientConfiguration,
     isOidcProtocolMode,
 } from "../config/ClientConfiguration.js";
-import { BaseClient } from "./BaseClient.js";
 import { CommonRefreshTokenRequest } from "../request/CommonRefreshTokenRequest.js";
 import { Authority } from "../authority/Authority.js";
 import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
@@ -45,6 +46,17 @@ import { invoke, invokeAsync } from "../utils/FunctionWrappers.js";
 import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
 import { getRequestThumbprint } from "../network/RequestThumbprint.js";
+import {
+    createTokenQueryParameters,
+    createTokenRequestHeaders,
+    executePostToTokenEndpoint,
+} from "../protocol/Token.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { INetworkModule } from "../network/INetworkModule.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { Logger } from "../logger/Logger.js";
+import { version, name } from "../packageMetadata.js";
 
 const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
 
@@ -52,12 +64,58 @@ const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
  * OAuth2.0 refresh token client
  * @internal
  */
-export class RefreshTokenClient extends BaseClient {
+export class RefreshTokenClient {
+    // Logger object
+    public logger: Logger;
+
+    // Application config
+    protected config: CommonClientConfiguration;
+
+    // Crypto Interface
+    protected cryptoUtils: ICrypto;
+
+    // Storage Interface
+    protected cacheManager: CacheManager;
+
+    // Network Interface
+    protected networkClient: INetworkModule;
+
+    // Server Telemetry Manager
+    protected serverTelemetryManager: ServerTelemetryManager | null;
+
+    // Default authority object
+    public authority: Authority;
+
+    // Performance telemetry client
+    protected performanceClient: IPerformanceClient;
+
     constructor(
         configuration: ClientConfiguration,
         performanceClient: IPerformanceClient
     ) {
-        super(configuration, performanceClient);
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
     }
     public async acquireToken(
         request: CommonRefreshTokenRequest
@@ -274,7 +332,12 @@ export class RefreshTokenClient extends BaseClient {
         request: CommonRefreshTokenRequest,
         authority: Authority
     ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
-        const queryParametersString = this.createTokenQueryParameters(request);
+        const queryParametersString = createTokenQueryParameters(
+            request,
+            this.config.authOptions.clientId,
+            this.config.authOptions.redirectUri,
+            this.performanceClient
+        );
         const endpoint = UrlString.appendQueryString(
             authority.tokenEndpoint,
             queryParametersString
@@ -287,7 +350,9 @@ export class RefreshTokenClient extends BaseClient {
             this.performanceClient,
             request.correlationId
         )(request);
-        const headers: Record<string, string> = this.createTokenRequestHeaders(
+        const headers: Record<string, string> = createTokenRequestHeaders(
+            this.logger,
+            this.config.systemOptions.preventCorsPreflight,
             request.ccsCredential
         );
 
@@ -297,12 +362,23 @@ export class RefreshTokenClient extends BaseClient {
         );
 
         return invokeAsync(
-            this.executePostToTokenEndpoint.bind(this),
+            executePostToTokenEndpoint,
             PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
+        )(
+            endpoint,
+            requestBody,
+            headers,
+            thumbprint,
+            request.correlationId,
+            this.cacheManager,
+            this.networkClient,
+            this.logger,
+            this.performanceClient,
+            this.serverTelemetryManager
+        );
     }
 
     /**
@@ -317,7 +393,7 @@ export class RefreshTokenClient extends BaseClient {
         RequestParameterBuilder.addClientId(
             parameters,
             request.embeddedClientId ||
-                request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+                request.extraParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -476,11 +552,10 @@ export class RefreshTokenClient extends BaseClient {
             );
         }
 
-        if (request.tokenBodyParameters) {
-            RequestParameterBuilder.addExtraQueryParameters(
-                parameters,
-                request.tokenBodyParameters
-            );
+        if (request.extraParameters) {
+            RequestParameterBuilder.addExtraParameters(parameters, {
+                ...request.extraParameters,
+            });
         }
 
         RequestParameterBuilder.instrumentBrokerParams(

package/src/client/SilentFlowClient.ts

@@ -3,8 +3,11 @@
  * Licensed under the MIT License.
  */
 
-import { BaseClient } from "./BaseClient.js";
-import { ClientConfiguration } from "../config/ClientConfiguration.js";
+import {
+    buildClientConfiguration,
+    ClientConfiguration,
+    CommonClientConfiguration,
+} from "../config/ClientConfiguration.js";
 import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import * as TimeUtils from "../utils/TimeUtils.js";
@@ -21,15 +24,70 @@ import { checkMaxAge, extractTokenClaims } from "../account/AuthToken.js";
 import { TokenClaims } from "../account/TokenClaims.js";
 import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
 import { invokeAsync } from "../utils/FunctionWrappers.js";
-import { getTenantFromAuthorityString } from "../authority/Authority.js";
+import {
+    Authority,
+    getTenantFromAuthorityString,
+} from "../authority/Authority.js";
+import { Logger } from "../logger/Logger.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { INetworkModule } from "../network/INetworkModule.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { version, name } from "../packageMetadata.js";
 
 /** @internal */
-export class SilentFlowClient extends BaseClient {
+export class SilentFlowClient {
+    // Logger object
+    public logger: Logger;
+
+    // Application config
+    protected config: CommonClientConfiguration;
+
+    // Crypto Interface
+    protected cryptoUtils: ICrypto;
+
+    // Storage Interface
+    protected cacheManager: CacheManager;
+
+    // Network Interface
+    protected networkClient: INetworkModule;
+
+    // Server Telemetry Manager
+    protected serverTelemetryManager: ServerTelemetryManager | null;
+
+    // Default authority object
+    public authority: Authority;
+
+    // Performance telemetry client
+    protected performanceClient: IPerformanceClient;
+
     constructor(
         configuration: ClientConfiguration,
         performanceClient: IPerformanceClient
     ) {
-        super(configuration, performanceClient);
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
     }
 
     /**

package/src/error/AuthError.ts

@@ -4,6 +4,7 @@
  */
 
 import * as AuthErrorCodes from "./AuthErrorCodes.js";
+import type { PlatformBrokerError } from "./PlatformBrokerError.js";
 export { AuthErrorCodes };
 
 export function getDefaultErrorMessage(code: string): string {
@@ -34,6 +35,11 @@ export class AuthError extends Error {
      */
     correlationId: string;
 
+    /**
+     * Default PlatformBrokerError from MsalNodeRuntime when broker is enabled
+     */
+    platformBrokerError?: PlatformBrokerError;
+
     constructor(errorCode?: string, errorMessage?: string, suberror?: string) {
         const message =
             errorMessage ||

package/src/error/ClientAuthErrorCodes.ts

@@ -42,3 +42,4 @@ export const noNetworkConnectivity = "no_network_connectivity";
 export const userCanceled = "user_canceled";
 export const methodNotImplemented = "method_not_implemented";
 export const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
+export const platformBrokerError = "platform_broker_error";

package/src/error/ClientConfigurationErrorCodes.ts

@@ -25,3 +25,4 @@ export const invalidAuthenticationHeader = "invalid_authentication_header";
 export const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 export const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 export const authorityMismatch = "authority_mismatch";
+export const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";

package/src/error/PlatformBrokerError.ts

@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "./AuthError.js";
+
+/**
+ * Converts a numeric tag from MSAL Runtime to a 5-character string representation.
+ * Tags are encoded as 30-bit values (6 bits per character) using a custom symbol space.
+ * @param tag - The numeric tag to convert
+ * @returns The string representation of the tag
+ */
+function tagToString(tag: number): string {
+    if (tag === 0) {
+        return "UNTAG";
+    }
+
+    const tagSymbolSpace =
+        "abcdefghijklmnopqrstuvwxyz0123456789****************************";
+    let tagBuffer = "*****";
+
+    const chars = [
+        tagSymbolSpace[(tag >> 24) & 0x3f],
+        tagSymbolSpace[(tag >> 18) & 0x3f],
+        tagSymbolSpace[(tag >> 12) & 0x3f],
+        tagSymbolSpace[(tag >> 6) & 0x3f],
+        tagSymbolSpace[(tag >> 0) & 0x3f],
+    ];
+
+    tagBuffer = chars.join("");
+
+    return tagBuffer;
+}
+
+/**
+ * Error class for MSAL Runtime errors that preserves detailed broker information
+ */
+export class PlatformBrokerError extends AuthError {
+    /**
+     * Numeric error code from MSAL Runtime
+     */
+    public statusCode: number;
+
+    /**
+     * Error tag from MSAL Runtime
+     */
+    public tag: string;
+
+    constructor(
+        errorStatus: string,
+        errorContext: string,
+        errorCode: number,
+        errorTag: number
+    ) {
+        const tagString = tagToString(errorTag);
+        const enhancedErrorContext = errorContext
+            ? `${errorContext} (Error Code: ${errorCode}, Tag: ${tagString})`
+            : `(Error Code: ${errorCode}, Tag: ${tagString})`;
+
+        super(errorStatus, enhancedErrorContext);
+        this.name = "PlatformBrokerError";
+        this.statusCode = errorCode;
+        this.tag = tagString;
+        Object.setPrototypeOf(this, PlatformBrokerError.prototype);
+    }
+}

package/src/exports-common.ts

@@ -22,7 +22,6 @@ export { AccountEntityUtils };
 export { AuthorizationCodeClient } from "./client/AuthorizationCodeClient.js";
 export { RefreshTokenClient } from "./client/RefreshTokenClient.js";
 export { SilentFlowClient } from "./client/SilentFlowClient.js";
-export { BaseClient } from "./client/BaseClient.js";
 export {
     AuthOptions,
     SystemOptions,
@@ -108,6 +107,8 @@ export {
 } from "./crypto/ICrypto.js";
 
 export * as AuthorizeProtocol from "./protocol/Authorize.js";
+export * as TokenProtocol from "./protocol/Token.js";
+
 export { BaseAuthRequest } from "./request/BaseAuthRequest.js";
 export { CommonAuthorizationUrlRequest } from "./request/CommonAuthorizationUrlRequest.js";
 export { CommonAuthorizationCodeRequest } from "./request/CommonAuthorizationCodeRequest.js";
@@ -139,6 +140,7 @@ export {
     AuthErrorCodes,
     createAuthError,
 } from "./error/AuthError.js";
+export { PlatformBrokerError } from "./error/PlatformBrokerError.js";
 export { ServerError } from "./error/ServerError.js";
 export { NetworkError, createNetworkError } from "./error/NetworkError.js";
 export {
@@ -160,11 +162,8 @@ export * as Constants from "./utils/Constants.js";
 
 export { StringUtils } from "./utils/StringUtils.js";
 export { StringDict } from "./utils/MsalTypes.js";
-export {
-    ProtocolUtils,
-    RequestStateObject,
-    LibraryStateObject,
-} from "./utils/ProtocolUtils.js";
+export { RequestStateObject, LibraryStateObject } from "./utils/StateTypes.js";
+export * as ProtocolUtils from "./utils/ProtocolUtils.js";
 export * from "./utils/FunctionWrappers.js";
 export { ServerTelemetryManager } from "./telemetry/server/ServerTelemetryManager.js";
 export { ServerTelemetryRequest } from "./telemetry/server/ServerTelemetryRequest.js";

package/src/exports-node-only.ts

@@ -30,3 +30,7 @@ export {
 export { getClientAssertion } from "./utils/ClientAssertionUtils.js";
 export { IGuidGenerator } from "./crypto/IGuidGenerator.js";
 export { StubPerformanceClient } from "./telemetry/performance/StubPerformanceClient.js";
+export {
+    buildClientConfiguration,
+    CommonClientConfiguration,
+} from "./config/ClientConfiguration.js";