@azure/msal-common 16.0.0-alpha.0 → 16.0.1

package/src/cache/CacheManager.ts

@@ -90,7 +90,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setAccount(
         account: AccountEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -109,7 +110,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setIdTokenCredential(
         idToken: IdTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -128,7 +130,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setAccessTokenCredential(
         accessToken: AccessTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -147,7 +150,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     abstract setRefreshTokenCredential(
         refreshToken: RefreshTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -544,6 +548,7 @@ export abstract class CacheManager implements ICacheManager {
     async saveCacheRecord(
         cacheRecord: CacheRecord,
         correlationId: string,
+        kmsi: boolean,
         storeInCache?: StoreInCache
     ): Promise<void> {
         if (!cacheRecord) {
@@ -554,13 +559,14 @@ export abstract class CacheManager implements ICacheManager {
 
         try {
             if (!!cacheRecord.account) {
-                await this.setAccount(cacheRecord.account, correlationId);
+                await this.setAccount(cacheRecord.account, correlationId, kmsi);
             }
 
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
                 await this.setIdTokenCredential(
                     cacheRecord.idToken,
-                    correlationId
+                    correlationId,
+                    kmsi
                 );
             }
 
@@ -570,7 +576,8 @@ export abstract class CacheManager implements ICacheManager {
             ) {
                 await this.saveAccessToken(
                     cacheRecord.accessToken,
-                    correlationId
+                    correlationId,
+                    kmsi
                 );
             }
 
@@ -580,7 +587,8 @@ export abstract class CacheManager implements ICacheManager {
             ) {
                 await this.setRefreshTokenCredential(
                     cacheRecord.refreshToken,
-                    correlationId
+                    correlationId,
+                    kmsi
                 );
             }
 
@@ -606,7 +614,8 @@ export abstract class CacheManager implements ICacheManager {
      */
     private async saveAccessToken(
         credential: AccessTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void> {
         const accessTokenFilter: CredentialFilter = {
             clientId: credential.clientId,
@@ -646,7 +655,7 @@ export abstract class CacheManager implements ICacheManager {
                 }
             }
         });
-        await this.setAccessTokenCredential(credential, correlationId);
+        await this.setAccessTokenCredential(credential, correlationId, kmsi);
     }
 
     /**

package/src/cache/entities/AccountEntity.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { TenantProfile } from "../../account/AccountInfo.js";
+import { TenantProfile, DataBoundary } from "../../account/AccountInfo.js";
 
 /**
  * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
@@ -46,4 +46,5 @@ export type AccountEntity = {
     tenantProfiles?: Array<TenantProfile>;
     /** Timestamp when the entry was last updated */
     lastUpdatedAt: string;
+    dataBoundary?: DataBoundary;
 };

package/src/cache/interface/ICacheManager.ts

@@ -29,7 +29,11 @@ export interface ICacheManager {
      * @param account
      * @param correlationId
      */
-    setAccount(account: AccountEntity, correlationId: string): Promise<void>;
+    setAccount(
+        account: AccountEntity,
+        correlationId: string,
+        kmsi: boolean
+    ): Promise<void>;
 
     /**
      * fetch the idToken entity from the platform cache
@@ -48,7 +52,8 @@ export interface ICacheManager {
      */
     setIdTokenCredential(
         idToken: IdTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -68,7 +73,8 @@ export interface ICacheManager {
      */
     setAccessTokenCredential(
         accessToken: AccessTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -88,7 +94,8 @@ export interface ICacheManager {
      */
     setRefreshTokenCredential(
         refreshToken: RefreshTokenEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**
@@ -216,6 +223,7 @@ export interface ICacheManager {
     saveCacheRecord(
         cacheRecord: CacheRecord,
         correlationId: string,
+        kmsi: boolean,
         storeInCache?: StoreInCache
     ): Promise<void>;
 

package/src/cache/utils/AccountEntityUtils.ts

@@ -11,6 +11,7 @@ import {
     AccountInfo,
     TenantProfile,
     buildTenantProfile,
+    DataBoundary,
 } from "../../account/AccountInfo.js";
 import {
     createClientAuthError,
@@ -56,6 +57,7 @@ export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
                 return [tenantProfile.tenantId, tenantProfile];
             })
         ),
+        dataBoundary: accountEntity.dataBoundary,
     };
 }
 
@@ -94,9 +96,13 @@ export function createAccountEntity(
     }
 
     let clientInfo: ClientInfo | undefined;
+    let dataBoundary: DataBoundary | undefined;
 
     if (accountDetails.clientInfo && base64Decode) {
         clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+        if (clientInfo.xms_tdbr) {
+            dataBoundary = clientInfo.xms_tdbr === "EU" ? "EU" : "None";
+        }
     }
 
     const env =
@@ -164,6 +170,7 @@ export function createAccountEntity(
         msGraphHost: accountDetails.msGraphHost,
         nativeAccountId: accountDetails.nativeAccountId,
         tenantProfiles: tenantProfiles,
+        dataBoundary,
     } as AccountEntity;
 }
 
@@ -193,6 +200,7 @@ export function createAccountEntityFromAccountInfo(
         cloudGraphHostName: cloudGraphHostName,
         msGraphHost: msGraphHost,
         tenantProfiles: Array.from(accountInfo.tenantProfiles?.values() || []),
+        dataBoundary: accountInfo.dataBoundary,
     } as AccountEntity;
 }
 
@@ -248,40 +256,3 @@ export function isAccountEntity(entity: object): entity is AccountEntity {
         entity.hasOwnProperty("authorityType")
     );
 }
-
-/**
- * Helper function to determine whether 2 accountInfo objects represent the same account
- * @param accountA
- * @param accountB
- * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
- */
-export function accountInfoIsEqual(
-    accountA: AccountInfo | null,
-    accountB: AccountInfo | null,
-    compareClaims?: boolean
-): boolean {
-    if (!accountA || !accountB) {
-        return false;
-    }
-
-    let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
-    if (compareClaims) {
-        const accountAClaims = (accountA.idTokenClaims || {}) as TokenClaims;
-        const accountBClaims = (accountB.idTokenClaims || {}) as TokenClaims;
-
-        // issued at timestamp and nonce are expected to change each time a new id token is acquired
-        claimsMatch =
-            accountAClaims.iat === accountBClaims.iat &&
-            accountAClaims.nonce === accountBClaims.nonce;
-    }
-
-    return (
-        accountA.homeAccountId === accountB.homeAccountId &&
-        accountA.localAccountId === accountB.localAccountId &&
-        accountA.username === accountB.username &&
-        accountA.tenantId === accountB.tenantId &&
-        accountA.environment === accountB.environment &&
-        accountA.nativeAccountId === accountB.nativeAccountId &&
-        claimsMatch
-    );
-}

package/src/client/AuthorizationCodeClient.ts

@@ -3,7 +3,6 @@
  * Licensed under the MIT License.
  */
 
-import { BaseClient } from "./BaseClient.js";
 import { CommonAuthorizationCodeRequest } from "../request/CommonAuthorizationCodeRequest.js";
 import { Authority } from "../authority/Authority.js";
 import * as RequestParameterBuilder from "../request/RequestParameterBuilder.js";
@@ -11,7 +10,9 @@ import * as UrlUtils from "../utils/UrlUtils.js";
 import * as Constants from "../utils/Constants.js";
 import * as AADServerParamKeys from "../constants/AADServerParamKeys.js";
 import {
+    buildClientConfiguration,
     ClientConfiguration,
+    CommonClientConfiguration,
     isOidcProtocolMode,
 } from "../config/ClientConfiguration.js";
 import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
@@ -43,21 +44,79 @@ import { invokeAsync } from "../utils/FunctionWrappers.js";
 import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
 import { getRequestThumbprint } from "../network/RequestThumbprint.js";
+import {
+    createTokenQueryParameters,
+    createTokenRequestHeaders,
+    executePostToTokenEndpoint,
+} from "../protocol/Token.js";
+import { createDiscoveredInstance } from "../authority/AuthorityFactory.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { Logger } from "../logger/Logger.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { INetworkModule } from "../network/INetworkModule.js";
+import { version, name } from "../packageMetadata.js";
 
 /**
  * Oauth2.0 Authorization Code client
  * @internal
  */
-export class AuthorizationCodeClient extends BaseClient {
+export class AuthorizationCodeClient {
     // Flag to indicate if client is for hybrid spa auth code redemption
     protected includeRedirectUri: boolean = true;
     private oidcDefaultScopes;
 
+    // Logger object
+    public logger: Logger;
+
+    // Application config
+    protected config: CommonClientConfiguration;
+
+    // Crypto Interface
+    protected cryptoUtils: ICrypto;
+
+    // Storage Interface
+    protected cacheManager: CacheManager;
+
+    // Network Interface
+    protected networkClient: INetworkModule;
+
+    // Server Telemetry Manager
+    protected serverTelemetryManager: ServerTelemetryManager | null;
+
+    // Default authority object
+    public authority: Authority;
+
+    // Performance telemetry client
+    protected performanceClient: IPerformanceClient;
+
     constructor(
         configuration: ClientConfiguration,
         performanceClient: IPerformanceClient
     ) {
-        super(configuration, performanceClient);
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
         this.oidcDefaultScopes =
             this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
     }
@@ -77,6 +136,17 @@ export class AuthorizationCodeClient extends BaseClient {
             );
         }
 
+        // Check for new cloud instance
+        if (authCodePayload && authCodePayload.cloud_instance_host_name) {
+            await invokeAsync(
+                this.updateTokenEndpointAuthority.bind(this),
+                PerformanceEvents.UpdateTokenEndpointAuthority,
+                this.logger,
+                this.performanceClient,
+                request.correlationId
+            )(authCodePayload.cloud_instance_host_name, request.correlationId);
+        }
+
         const reqTimestamp = TimeUtils.nowSeconds();
         const response = await invokeAsync(
             this.executeTokenRequest.bind(this),
@@ -84,7 +154,7 @@ export class AuthorizationCodeClient extends BaseClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(this.authority, request);
+        )(this.authority, request, this.serverTelemetryManager);
 
         // Retrieve requestId from response headers
         const requestId =
@@ -153,9 +223,15 @@ export class AuthorizationCodeClient extends BaseClient {
      */
     private async executeTokenRequest(
         authority: Authority,
-        request: CommonAuthorizationCodeRequest
+        request: CommonAuthorizationCodeRequest,
+        serverTelemetryManager: ServerTelemetryManager | null
     ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
-        const queryParametersString = this.createTokenQueryParameters(request);
+        const queryParametersString = createTokenQueryParameters(
+            request,
+            this.config.authOptions.clientId,
+            this.config.authOptions.redirectUri,
+            this.performanceClient
+        );
         const endpoint = UrlString.appendQueryString(
             authority.tokenEndpoint,
             queryParametersString
@@ -187,7 +263,9 @@ export class AuthorizationCodeClient extends BaseClient {
                 );
             }
         }
-        const headers: Record<string, string> = this.createTokenRequestHeaders(
+        const headers: Record<string, string> = createTokenRequestHeaders(
+            this.logger,
+            this.config.systemOptions.preventCorsPreflight,
             ccsCredential || request.ccsCredential
         );
 
@@ -197,12 +275,23 @@ export class AuthorizationCodeClient extends BaseClient {
         );
 
         return invokeAsync(
-            this.executePostToTokenEndpoint.bind(this),
+            executePostToTokenEndpoint,
             PerformanceEvents.AuthorizationCodeClientExecutePostToTokenEndpoint,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
+        )(
+            endpoint,
+            requestBody,
+            headers,
+            thumbprint,
+            request.correlationId,
+            this.cacheManager,
+            this.networkClient,
+            this.logger,
+            this.performanceClient,
+            serverTelemetryManager
+        );
     }
 
     /**
@@ -217,7 +306,7 @@ export class AuthorizationCodeClient extends BaseClient {
         RequestParameterBuilder.addClientId(
             parameters,
             request.embeddedClientId ||
-                request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+                request.extraParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -413,22 +502,20 @@ export class AuthorizationCodeClient extends BaseClient {
             );
         }
 
-        if (request.tokenBodyParameters) {
-            RequestParameterBuilder.addExtraQueryParameters(
+        if (request.extraParameters) {
+            RequestParameterBuilder.addExtraParameters(
                 parameters,
-                request.tokenBodyParameters
+                request.extraParameters
             );
         }
 
         // Add hybrid spa parameters if not already provided
         if (
             request.enableSpaAuthorizationCode &&
-            (!request.tokenBodyParameters ||
-                !request.tokenBodyParameters[
-                    AADServerParamKeys.RETURN_SPA_CODE
-                ])
+            (!request.extraParameters ||
+                !request.extraParameters[AADServerParamKeys.RETURN_SPA_CODE])
         ) {
-            RequestParameterBuilder.addExtraQueryParameters(parameters, {
+            RequestParameterBuilder.addExtraParameters(parameters, {
                 [AADServerParamKeys.RETURN_SPA_CODE]: "1",
             });
         }
@@ -483,7 +570,7 @@ export class AuthorizationCodeClient extends BaseClient {
         }
 
         if (request.extraQueryParameters) {
-            RequestParameterBuilder.addExtraQueryParameters(
+            RequestParameterBuilder.addExtraParameters(
                 parameters,
                 request.extraQueryParameters
             );
@@ -495,4 +582,26 @@ export class AuthorizationCodeClient extends BaseClient {
 
         return UrlUtils.mapToQueryString(parameters);
     }
+
+    /**
+     * Updates the authority to the cloud instance provided in the authorization response
+     * @param cloudInstanceHostName - cloud instance host name from authorization code payload
+     * @param correlationId - request correlation id
+     */
+    private async updateTokenEndpointAuthority(
+        cloudInstanceHostName: string,
+        correlationId: string
+    ): Promise<void> {
+        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostName}/${this.authority.tenant}/`;
+        const cloudInstanceAuthority = await createDiscoveredInstance(
+            cloudInstanceAuthorityUri,
+            this.networkClient,
+            this.cacheManager,
+            this.authority.options,
+            this.logger,
+            correlationId,
+            this.performanceClient
+        );
+        this.authority = cloudInstanceAuthority;
+    }
 }