@azure/msal-common 16.0.0-alpha.0 → 16.0.0-beta.0

package/src/logger/Logger.ts

@@ -33,6 +33,141 @@ export interface ILoggerCallback {
     (level: LogLevel, message: string, containsPii: boolean): void;
 }
 
+/**
+ * Represents a single logged message with metadata
+ */
+export interface LoggedMessage {
+    hash: string;
+    level: LogLevel;
+    containsPii: boolean;
+    milliseconds: number;
+}
+
+/**
+ * LRU cache node for correlation ID management
+ */
+interface CorrelationLogData {
+    logs: LoggedMessage[];
+    firstEventTime: number;
+}
+
+// Shared cache state for better minification - using Map's insertion order for LRU
+const CACHE_CAPACITY = 50;
+const MAX_LOGS_PER_CORRELATION = 500;
+const correlationCache = new Map<string, CorrelationLogData>();
+
+/**
+ * Mark correlation ID as recently used by moving it to end of Map
+ * @param correlationId
+ * @param {CorrelationLogData} data
+ */
+function markAsRecentlyUsed(
+    correlationId: string,
+    data: CorrelationLogData
+): void {
+    correlationCache.delete(correlationId);
+    correlationCache.set(correlationId, data);
+}
+
+/**
+ * Add log message to cache for specific correlation ID
+ * @param correlationId
+ * @param {LoggedMessage} loggedMessage
+ */
+function addLogToCache(
+    correlationId: string,
+    loggedMessage: LoggedMessage
+): void {
+    const currentTime = Date.now();
+
+    let data = correlationCache.get(correlationId);
+
+    if (data) {
+        // Mark as recently used
+        markAsRecentlyUsed(correlationId, data);
+    } else {
+        // Create new entry
+        data = { logs: [], firstEventTime: currentTime };
+        correlationCache.set(correlationId, data);
+
+        // Remove LRU (first entry) if capacity exceeded
+        if (correlationCache.size > CACHE_CAPACITY) {
+            const firstKey = correlationCache.keys().next().value;
+            if (firstKey) {
+                correlationCache.delete(firstKey);
+            }
+        }
+    }
+
+    // Add log to the data, maintaining max logs per correlation
+    data.logs.push({
+        ...loggedMessage,
+        milliseconds: currentTime - data.firstEventTime,
+    });
+    if (data.logs.length > MAX_LOGS_PER_CORRELATION) {
+        data.logs.shift(); // Remove oldest log
+    }
+}
+
+/**
+ * Get all logs for specific correlation ID
+ * @param correlationId
+ */
+export function getLogsFromCache(correlationId: string): LoggedMessage[] {
+    const data = correlationCache.get(correlationId);
+    if (data) {
+        markAsRecentlyUsed(correlationId, data);
+        return [...data.logs]; // Return copy
+    }
+    return [];
+}
+
+/**
+ * Get logs for correlation ID and flush them from cache
+ * Attaches logs with empty correlation id to the requested correlation logs
+ * @param correlationId
+ */
+export function getAndFlushLogsFromCache(
+    correlationId: string
+): LoggedMessage[] {
+    const res: LoggedMessage[] = [];
+    for (const id of ["", correlationId]) {
+        const data = correlationCache.get(id);
+        res.push(...(data?.logs ?? []));
+        correlationCache.delete(id); // Remove the correlation ID completely from cache
+    }
+    return res;
+}
+
+/**
+ * Get all correlation IDs that have logs
+ */
+export function getCachedCorrelationIds(): string[] {
+    return Array.from(correlationCache.keys());
+}
+
+/**
+ * Checks if a string is already a hashed logging string (6 alphanumeric characters)
+ */
+function isHashedString(str: string): boolean {
+    if (str.length !== 6) {
+        return false;
+    }
+
+    for (let i = 0; i < str.length; i++) {
+        const char = str[i];
+        const isAlphaNumeric =
+            (char >= "a" && char <= "z") ||
+            (char >= "A" && char <= "Z") ||
+            (char >= "0" && char <= "9");
+        if (!isAlphaNumeric) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
 /**
  * Class which facilitates logging of messages to a specific place.
  */
@@ -105,6 +240,19 @@ export class Logger {
         logMessage: string,
         options: LoggerMessageOptions
     ): void {
+        const correlationId = options.correlationId;
+        const isHashedInput = isHashedString(logMessage);
+
+        if (isHashedInput) {
+            const loggedMessage: LoggedMessage = {
+                hash: logMessage,
+                level: options.logLevel,
+                containsPii: options.containsPii || false,
+                milliseconds: 0, // Will be calculated in addLogToCache
+            };
+            addLogToCache(correlationId, loggedMessage);
+        }
+
         if (
             options.logLevel > this.level ||
             (!this.piiLoggingEnabled && options.containsPii)
@@ -114,12 +262,12 @@ export class Logger {
         const timestamp = new Date().toUTCString();
 
         // Add correlationId to logs if set, correlationId provided on log messages take precedence
-        const logHeader = `[${timestamp}] : [${options.correlationId}]`;
+        const logHeader = `[${timestamp}] : [${correlationId}]`;
 
         const log = `${logHeader} : ${this.packageName}@${
             this.packageVersion
         } : ${LogLevel[options.logLevel]} - ${logMessage}`;
-        // debug(`msal:${LogLevel[options.logLevel]}${options.containsPii ? "-Pii": Constants.""}${options.context ? `:${options.context}` : Constants.""}`)(logMessage);
+
         this.executeCallback(
             options.logLevel,
             log,

package/src/network/RequestThumbprint.ts

@@ -42,6 +42,6 @@ export function getRequestThumbprint(
         shrClaims: request.shrClaims,
         sshKid: request.sshKid,
         embeddedClientId:
-            request.embeddedClientId || request.tokenBodyParameters?.clientId,
+            request.embeddedClientId || request.extraParameters?.clientId,
     };
 }

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.0.0-alpha.0";
+export const version = "16.0.0-beta.0";

package/src/protocol/Token.ts

@@ -0,0 +1,230 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { CcsCredential, CcsCredentialType } from "../account/CcsCredential.js";
+import { buildClientInfoFromHomeAccountId } from "../account/ClientInfo.js";
+import { Logger } from "../logger/Logger.js";
+import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import { HeaderNames, URL_FORM_CONTENT_TYPE } from "../utils/Constants.js";
+import * as RequestParameterBuilder from "../request/RequestParameterBuilder.js";
+import * as UrlUtils from "../utils/UrlUtils.js";
+import { IPerformanceClient } from "../exports-browser-only.js";
+import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
+import { RequestThumbprint } from "../network/RequestThumbprint.js";
+import {
+    INetworkModule,
+    NetworkRequestOptions,
+} from "../network/INetworkModule.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
+import { ThrottlingUtils } from "../network/ThrottlingUtils.js";
+import { NetworkError } from "../error/NetworkError.js";
+import { AuthError } from "../error/AuthError.js";
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "../error/ClientAuthError.js";
+import { invokeAsync } from "../utils/FunctionWrappers.js";
+import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+
+/**
+ * Creates default headers for requests to token endpoint
+ */
+export function createTokenRequestHeaders(
+    logger: Logger,
+    preventCorsPreflight: boolean,
+    ccsCred?: CcsCredential
+): Record<string, string> {
+    const headers: Record<string, string> = {};
+    headers[HeaderNames.CONTENT_TYPE] = URL_FORM_CONTENT_TYPE;
+    if (!preventCorsPreflight && ccsCred) {
+        switch (ccsCred.type) {
+            case CcsCredentialType.HOME_ACCOUNT_ID:
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(
+                        ccsCred.credential
+                    );
+                    headers[
+                        HeaderNames.CCS_HEADER
+                    ] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
+                } catch (e) {
+                    logger.verbose(
+                        `Could not parse home account ID for CCS Header: '${e}'`,
+                        ""
+                    );
+                }
+                break;
+            case CcsCredentialType.UPN:
+                headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;
+                break;
+        }
+    }
+    return headers;
+}
+
+/**
+ * Creates query string for the /token request
+ * @param request
+ */
+export function createTokenQueryParameters(
+    request: BaseAuthRequest,
+    clientId: string,
+    redirectUri: string,
+    performanceClient: IPerformanceClient
+): string {
+    const parameters = new Map<string, string>();
+
+    if (request.embeddedClientId) {
+        RequestParameterBuilder.addBrokerParameters(
+            parameters,
+            clientId,
+            redirectUri
+        );
+    }
+
+    if (request.extraQueryParameters) {
+        RequestParameterBuilder.addExtraParameters(
+            parameters,
+            request.extraQueryParameters
+        );
+    }
+
+    RequestParameterBuilder.addCorrelationId(parameters, request.correlationId);
+
+    RequestParameterBuilder.instrumentBrokerParams(
+        parameters,
+        request.correlationId,
+        performanceClient
+    );
+    return UrlUtils.mapToQueryString(parameters);
+}
+
+/**
+ * Http post to token endpoint
+ * @param tokenEndpoint
+ * @param queryString
+ * @param headers
+ * @param thumbprint
+ */
+export async function executePostToTokenEndpoint(
+    tokenEndpoint: string,
+    queryString: string,
+    headers: Record<string, string>,
+    thumbprint: RequestThumbprint,
+    correlationId: string,
+    cacheManager: CacheManager,
+    networkClient: INetworkModule,
+    logger: Logger,
+    performanceClient: IPerformanceClient,
+    serverTelemetryManager: ServerTelemetryManager | null
+): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
+    const response = await sendPostRequest<ServerAuthorizationTokenResponse>(
+        thumbprint,
+        tokenEndpoint,
+        { body: queryString, headers: headers },
+        correlationId,
+        cacheManager,
+        networkClient,
+        logger,
+        performanceClient
+    );
+
+    if (
+        serverTelemetryManager &&
+        response.status < 500 &&
+        response.status !== 429
+    ) {
+        // Telemetry data successfully logged by server, clear Telemetry cache
+        serverTelemetryManager.clearTelemetryCache();
+    }
+
+    return response;
+}
+
+/**
+ * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+ * @param thumbprint - Request thumbprint for throttling
+ * @param tokenEndpoint - Endpoint to make the POST to
+ * @param options - Body and Headers to include on the POST request
+ * @param correlationId - CorrelationId for telemetry
+ * @param cacheManager - Cache manager instance
+ * @param networkClient - Network module instance
+ * @param logger - Logger instance
+ * @param performanceClient - Performance client instance
+ */
+export async function sendPostRequest<
+    T extends ServerAuthorizationTokenResponse
+>(
+    thumbprint: RequestThumbprint,
+    tokenEndpoint: string,
+    options: NetworkRequestOptions,
+    correlationId: string,
+    cacheManager: CacheManager,
+    networkClient: INetworkModule,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<NetworkResponse<T>> {
+    ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
+
+    let response;
+    try {
+        response = await invokeAsync(
+            networkClient.sendPostRequestAsync.bind(networkClient)<T>,
+            PerformanceEvents.NetworkClientSendPostRequestAsync,
+            logger,
+            performanceClient,
+            correlationId
+        )(tokenEndpoint, options);
+        const responseHeaders = response.headers || {};
+        performanceClient?.addFields(
+            {
+                refreshTokenSize: response.body.refresh_token?.length || 0,
+                httpVerToken:
+                    responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+            },
+            correlationId
+        );
+    } catch (e) {
+        if (e instanceof NetworkError) {
+            const responseHeaders = e.responseHeaders;
+            if (responseHeaders) {
+                performanceClient?.addFields(
+                    {
+                        httpVerToken:
+                            responseHeaders[HeaderNames.X_MS_HTTP_VERSION] ||
+                            "",
+                        requestId:
+                            responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+                        contentTypeHeader:
+                            responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                            undefined,
+                        contentLengthHeader:
+                            responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                            undefined,
+                        httpStatus: e.httpStatus,
+                    },
+                    correlationId
+                );
+            }
+            throw e.error;
+        }
+        if (e instanceof AuthError) {
+            throw e;
+        } else {
+            throw createClientAuthError(ClientAuthErrorCodes.networkError);
+        }
+    }
+
+    ThrottlingUtils.postProcess(
+        cacheManager,
+        thumbprint,
+        response,
+        correlationId
+    );
+
+    return response;
+}

package/src/request/BaseAuthRequest.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { AuthenticationScheme } from "../utils/Constants.js";
+import { AuthenticationScheme, HttpMethod } from "../utils/Constants.js";
 import type { AzureCloudOptions } from "../config/ClientConfiguration.js";
 import { StringDict } from "../utils/MsalTypes.js";
 import { StoreInCache } from "./StoreInCache.js";
@@ -24,12 +24,13 @@ import { ShrOptions } from "../crypto/SignedHttpRequest.js";
  * - sshJwk                  - A stringified JSON Web Key representing a public key that can be signed by an SSH certificate.
  * - sshKid                  - Key ID that uniquely identifies the SSH public key mentioned above.
  * - azureCloudOptions       - Convenience string enums for users to provide public/sovereign cloud ids
- * - tokenQueryParameters    - String to string map of custom query parameters added to the /token call
- * - tokenBodyParameters     - String to string map of custom parameters added to the body of the /token call
+ * - extraQueryParameters    - String to string map of custom query parameters added to outgoing token service requests
  * - storeInCache            - Object containing boolean values indicating whether to store tokens in the cache or not (default is true)
  * - scenarioId              - Scenario id to track custom user prompts
  * - popKid                  - Key ID to identify the public key for PoP token request
  * - embeddedClientId        - Embedded client id. When specified, broker client id (brk_client_id) and redirect uri (brk_redirect_uri) params are set with values from the config, overriding the corresponding extra parameters, if present.
+ * - httpMethod              - HTTP method to use for the /authorize request. Defaults to GET, but can be set to POST if the request requires body parameters
+ * - extraParameters             - String to string map of custom parameters added to outgoing token service requests
  */
 export type BaseAuthRequest = {
     authority: string;
@@ -46,10 +47,11 @@ export type BaseAuthRequest = {
     sshKid?: string;
     azureCloudOptions?: AzureCloudOptions;
     maxAge?: number;
-    tokenBodyParameters?: StringDict;
-    tokenQueryParameters?: StringDict;
     storeInCache?: StoreInCache;
     scenarioId?: string;
     popKid?: string;
     embeddedClientId?: string;
+    httpMethod?: HttpMethod;
+    extraQueryParameters?: StringDict;
+    extraParameters?: StringDict;
 };

package/src/request/CommonAuthorizationCodeRequest.ts

@@ -19,7 +19,8 @@ import { CcsCredential } from "../account/CcsCredential.js";
  * - resourceRequestMethod   - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri      - URI that token will be used for. Used for proof-of-possession flows.
  * - enableSpaAuthCode       - Enables the acqusition of a spa authorization code (confidential clients only)
- * - tokenQueryParameters    - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters    - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters         - String to string map of custom query parameters added to outgoing token service requests
  */
 export type CommonAuthorizationCodeRequest = BaseAuthRequest & {
     code: string;

package/src/request/CommonAuthorizationUrlRequest.ts

@@ -4,7 +4,6 @@
  */
 
 import { ResponseMode } from "../utils/Constants.js";
-import { StringDict } from "../utils/MsalTypes.js";
 import { BaseAuthRequest } from "./BaseAuthRequest.js";
 import { AccountInfo } from "../account/AccountInfo.js";
 
@@ -32,8 +31,8 @@ import { AccountInfo } from "../account/AccountInfo.js";
  * - loginHint                  - Can be used to pre-fill the username/email address field of the sign-in page for the user, if you know the username/email address ahead of time. Often apps use this parameter during re-authentication, having already extracted the username from a previous sign-in using the preferred_username claim.
  * - sid                        - Session ID, unique identifier for the session. Available as an optional claim on ID tokens.
  * - domainHint                 - Provides a hint about the tenant or domain that the user should use to sign in. The value of the domain hint is a registered domain for the tenant.
- * - extraQueryParameters       - String to string map of custom query parameters added to the /authorize call
- * - tokenQueryParameters       - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters       - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters            - String to string map of custom query parameters added to outgoing token service requests
  * - nonce                      - A value included in the request that is returned in the id token. A randomly generated unique value is typically used to mitigate replay attacks.
  * - resourceRequestMethod      - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri         - URI that token will be used for. Used for proof-of-possession flows.
@@ -46,7 +45,6 @@ export type CommonAuthorizationUrlRequest = BaseAuthRequest & {
     codeChallenge?: string;
     codeChallengeMethod?: string;
     domainHint?: string;
-    extraQueryParameters?: StringDict;
     extraScopesToConsent?: Array<string>;
     loginHint?: string;
     nonce: string;

package/src/request/CommonRefreshTokenRequest.ts

@@ -16,7 +16,8 @@ import { CcsCredential } from "../account/CcsCredential.js";
  * - resourceRequestMethod   - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri      - URI that token will be used for. Used for proof-of-possession flows.
  * - forceCache              - Force MSAL to cache a refresh token flow response when there is no account in the cache. Used for migration scenarios.
- * - tokenQueryParameters    - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters    - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters         - String to string map of custom query parameters added to outgoing token service requests
  */
 export type CommonRefreshTokenRequest = BaseAuthRequest & {
     refreshToken: string;

package/src/request/CommonSilentFlowRequest.ts

@@ -16,7 +16,8 @@ import { BaseAuthRequest } from "./BaseAuthRequest.js";
  * - forceRefresh           - Forces silent requests to make network calls if true.
  * - resourceRequestMethod  - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
  * - resourceRequestUri     - URI that token will be used for. Used for proof-of-possession flows.
- * - tokenQueryParameters   - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters   - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters        - String to string map of custom query parameters added to outgoing token service requests
  */
 export type CommonSilentFlowRequest = BaseAuthRequest & {
     /** Account object to lookup the credentials */

package/src/request/RequestParameterBuilder.ts

@@ -455,14 +455,14 @@ export function addInstanceAware(parameters: Map<string, string>): void {
 }
 
 /**
- * add extraQueryParams
- * @param eQParams
+ * Add extraParameters
+ * @param extraParams - String dictionary containing extra parameters to be added.
  */
-export function addExtraQueryParameters(
+export function addExtraParameters(
     parameters: Map<string, string>,
-    eQParams: StringDict
+    extraParams: StringDict
 ): void {
-    Object.entries(eQParams).forEach(([key, value]) => {
+    Object.entries(extraParams).forEach(([key, value]) => {
         if (!parameters.has(key) && value) {
             parameters.set(key, value);
         }

package/src/response/ResponseHandler.ts

@@ -24,7 +24,7 @@ import {
 } from "../error/InteractionRequiredAuthError.js";
 import { CacheRecord } from "../cache/entities/CacheRecord.js";
 import { CacheManager } from "../cache/CacheManager.js";
-import { ProtocolUtils, RequestStateObject } from "../utils/ProtocolUtils.js";
+import * as ProtocolUtils from "../utils/ProtocolUtils.js";
 import * as Constants from "../utils/Constants.js";
 import { PopTokenGenerator } from "../crypto/PopTokenGenerator.js";
 import { AppMetadataEntity } from "../cache/entities/AppMetadataEntity.js";
@@ -33,7 +33,11 @@ import { TokenCacheContext } from "../cache/persistence/TokenCacheContext.js";
 import { ISerializableTokenCache } from "../cache/interface/ISerializableTokenCache.js";
 import { AuthorizationCodePayload } from "./AuthorizationCodePayload.js";
 import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
-import { checkMaxAge, extractTokenClaims } from "../account/AuthToken.js";
+import {
+    checkMaxAge,
+    extractTokenClaims,
+    isKmsi,
+} from "../account/AuthToken.js";
 import {
     TokenClaims,
     getTenantIdFromIdTokenClaims,
@@ -47,6 +51,7 @@ import * as CacheHelpers from "../cache/utils/CacheHelpers.js";
 import * as TimeUtils from "../utils/TimeUtils.js";
 import * as AccountEntityUtils from "../cache/utils/AccountEntityUtils.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+import { RequestStateObject } from "../utils/StateTypes.js";
 
 /**
  * Class that handles response parsing.
@@ -234,7 +239,7 @@ export class ResponseHandler {
         let requestStateObj: RequestStateObject | undefined;
         if (!!authCodePayload && !!authCodePayload.state) {
             requestStateObj = ProtocolUtils.parseRequestState(
-                this.cryptoObj,
+                this.cryptoObj.base64Decode,
                 authCodePayload.state
             );
         }
@@ -305,6 +310,7 @@ export class ResponseHandler {
             await this.cacheStorage.saveCacheRecord(
                 cacheRecord,
                 request.correlationId,
+                isKmsi(idTokenClaims || {}),
                 request.storeInCache
             );
         } finally {

package/src/telemetry/performance/IPerformanceClient.ts

@@ -4,13 +4,15 @@
  */
 
 import { PerformanceEvent } from "./PerformanceEvent.js";
+import { AccountInfo } from "../../account/AccountInfo.js";
 
 export type PerformanceCallbackFunction = (events: PerformanceEvent[]) => void;
 
 export type InProgressPerformanceEvent = {
     end: (
         event?: Partial<PerformanceEvent>,
-        error?: unknown
+        error?: unknown,
+        account?: AccountInfo
     ) => PerformanceEvent | null;
     discard: () => void;
     add: (fields: { [key: string]: {} | undefined }) => void;