@azure/msal-common 16.0.0-alpha.0 → 16.0.1

package/src/client/RefreshTokenClient.ts

@@ -4,10 +4,11 @@
  */
 
 import {
+    buildClientConfiguration,
     ClientConfiguration,
+    CommonClientConfiguration,
     isOidcProtocolMode,
 } from "../config/ClientConfiguration.js";
-import { BaseClient } from "./BaseClient.js";
 import { CommonRefreshTokenRequest } from "../request/CommonRefreshTokenRequest.js";
 import { Authority } from "../authority/Authority.js";
 import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
@@ -45,6 +46,17 @@ import { invoke, invokeAsync } from "../utils/FunctionWrappers.js";
 import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
 import { getRequestThumbprint } from "../network/RequestThumbprint.js";
+import {
+    createTokenQueryParameters,
+    createTokenRequestHeaders,
+    executePostToTokenEndpoint,
+} from "../protocol/Token.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { INetworkModule } from "../network/INetworkModule.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { Logger } from "../logger/Logger.js";
+import { version, name } from "../packageMetadata.js";
 
 const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
 
@@ -52,12 +64,58 @@ const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
  * OAuth2.0 refresh token client
  * @internal
  */
-export class RefreshTokenClient extends BaseClient {
+export class RefreshTokenClient {
+    // Logger object
+    public logger: Logger;
+
+    // Application config
+    protected config: CommonClientConfiguration;
+
+    // Crypto Interface
+    protected cryptoUtils: ICrypto;
+
+    // Storage Interface
+    protected cacheManager: CacheManager;
+
+    // Network Interface
+    protected networkClient: INetworkModule;
+
+    // Server Telemetry Manager
+    protected serverTelemetryManager: ServerTelemetryManager | null;
+
+    // Default authority object
+    public authority: Authority;
+
+    // Performance telemetry client
+    protected performanceClient: IPerformanceClient;
+
     constructor(
         configuration: ClientConfiguration,
         performanceClient: IPerformanceClient
     ) {
-        super(configuration, performanceClient);
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
     }
     public async acquireToken(
         request: CommonRefreshTokenRequest
@@ -201,21 +259,23 @@ export class RefreshTokenClient extends BaseClient {
             );
         }
 
-        if (
-            refreshToken.expiresOn &&
-            TimeUtils.isTokenExpired(
-                refreshToken.expiresOn,
+        if (refreshToken.expiresOn) {
+            const offset =
                 request.refreshTokenExpirationOffsetSeconds ||
-                    DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS
-            )
-        ) {
+                DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS;
             this.performanceClient?.addFields(
-                { rtExpiresOnMs: Number(refreshToken.expiresOn) },
+                {
+                    cacheRtExpiresOnSeconds: Number(refreshToken.expiresOn),
+                    rtOffsetSeconds: offset,
+                },
                 request.correlationId
             );
-            throw createInteractionRequiredAuthError(
-                InteractionRequiredAuthErrorCodes.refreshTokenExpired
-            );
+
+            if (TimeUtils.isTokenExpired(refreshToken.expiresOn, offset)) {
+                throw createInteractionRequiredAuthError(
+                    InteractionRequiredAuthErrorCodes.refreshTokenExpired
+                );
+            }
         }
         // attach cached RT size to the current measurement
 
@@ -241,11 +301,6 @@ export class RefreshTokenClient extends BaseClient {
             )(refreshTokenRequest);
         } catch (e) {
             if (e instanceof InteractionRequiredAuthError) {
-                this.performanceClient?.addFields(
-                    { rtExpiresOnMs: Number(refreshToken.expiresOn) },
-                    request.correlationId
-                );
-
                 if (e.subError === InteractionRequiredAuthErrorCodes.badToken) {
                     // Remove bad refresh token from cache
                     this.logger.verbose(
@@ -274,7 +329,12 @@ export class RefreshTokenClient extends BaseClient {
         request: CommonRefreshTokenRequest,
         authority: Authority
     ): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {
-        const queryParametersString = this.createTokenQueryParameters(request);
+        const queryParametersString = createTokenQueryParameters(
+            request,
+            this.config.authOptions.clientId,
+            this.config.authOptions.redirectUri,
+            this.performanceClient
+        );
         const endpoint = UrlString.appendQueryString(
             authority.tokenEndpoint,
             queryParametersString
@@ -287,7 +347,9 @@ export class RefreshTokenClient extends BaseClient {
             this.performanceClient,
             request.correlationId
         )(request);
-        const headers: Record<string, string> = this.createTokenRequestHeaders(
+        const headers: Record<string, string> = createTokenRequestHeaders(
+            this.logger,
+            this.config.systemOptions.preventCorsPreflight,
             request.ccsCredential
         );
 
@@ -297,12 +359,23 @@ export class RefreshTokenClient extends BaseClient {
         );
 
         return invokeAsync(
-            this.executePostToTokenEndpoint.bind(this),
+            executePostToTokenEndpoint,
             PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(endpoint, requestBody, headers, thumbprint, request.correlationId);
+        )(
+            endpoint,
+            requestBody,
+            headers,
+            thumbprint,
+            request.correlationId,
+            this.cacheManager,
+            this.networkClient,
+            this.logger,
+            this.performanceClient,
+            this.serverTelemetryManager
+        );
     }
 
     /**
@@ -317,7 +390,7 @@ export class RefreshTokenClient extends BaseClient {
         RequestParameterBuilder.addClientId(
             parameters,
             request.embeddedClientId ||
-                request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+                request.extraParameters?.[AADServerParamKeys.CLIENT_ID] ||
                 this.config.authOptions.clientId
         );
 
@@ -476,11 +549,10 @@ export class RefreshTokenClient extends BaseClient {
             );
         }
 
-        if (request.tokenBodyParameters) {
-            RequestParameterBuilder.addExtraQueryParameters(
-                parameters,
-                request.tokenBodyParameters
-            );
+        if (request.extraParameters) {
+            RequestParameterBuilder.addExtraParameters(parameters, {
+                ...request.extraParameters,
+            });
         }
 
         RequestParameterBuilder.instrumentBrokerParams(

package/src/client/SilentFlowClient.ts

@@ -3,8 +3,11 @@
  * Licensed under the MIT License.
  */
 
-import { BaseClient } from "./BaseClient.js";
-import { ClientConfiguration } from "../config/ClientConfiguration.js";
+import {
+    buildClientConfiguration,
+    ClientConfiguration,
+    CommonClientConfiguration,
+} from "../config/ClientConfiguration.js";
 import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import * as TimeUtils from "../utils/TimeUtils.js";
@@ -21,15 +24,70 @@ import { checkMaxAge, extractTokenClaims } from "../account/AuthToken.js";
 import { TokenClaims } from "../account/TokenClaims.js";
 import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
 import { invokeAsync } from "../utils/FunctionWrappers.js";
-import { getTenantFromAuthorityString } from "../authority/Authority.js";
+import {
+    Authority,
+    getTenantFromAuthorityString,
+} from "../authority/Authority.js";
+import { Logger } from "../logger/Logger.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { INetworkModule } from "../network/INetworkModule.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { version, name } from "../packageMetadata.js";
 
 /** @internal */
-export class SilentFlowClient extends BaseClient {
+export class SilentFlowClient {
+    // Logger object
+    public logger: Logger;
+
+    // Application config
+    protected config: CommonClientConfiguration;
+
+    // Crypto Interface
+    protected cryptoUtils: ICrypto;
+
+    // Storage Interface
+    protected cacheManager: CacheManager;
+
+    // Network Interface
+    protected networkClient: INetworkModule;
+
+    // Server Telemetry Manager
+    protected serverTelemetryManager: ServerTelemetryManager | null;
+
+    // Default authority object
+    public authority: Authority;
+
+    // Performance telemetry client
+    protected performanceClient: IPerformanceClient;
+
     constructor(
         configuration: ClientConfiguration,
         performanceClient: IPerformanceClient
     ) {
-        super(configuration, performanceClient);
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
     }
 
     /**

package/src/error/AuthError.ts

@@ -4,6 +4,7 @@
  */
 
 import * as AuthErrorCodes from "./AuthErrorCodes.js";
+import type { PlatformBrokerError } from "./PlatformBrokerError.js";
 export { AuthErrorCodes };
 
 export function getDefaultErrorMessage(code: string): string {
@@ -34,6 +35,11 @@ export class AuthError extends Error {
      */
     correlationId: string;
 
+    /**
+     * Default PlatformBrokerError from MsalNodeRuntime when broker is enabled
+     */
+    platformBrokerError?: PlatformBrokerError;
+
     constructor(errorCode?: string, errorMessage?: string, suberror?: string) {
         const message =
             errorMessage ||

package/src/error/ClientAuthErrorCodes.ts

@@ -42,3 +42,4 @@ export const noNetworkConnectivity = "no_network_connectivity";
 export const userCanceled = "user_canceled";
 export const methodNotImplemented = "method_not_implemented";
 export const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
+export const platformBrokerError = "platform_broker_error";

package/src/error/ClientConfigurationErrorCodes.ts

@@ -25,3 +25,4 @@ export const invalidAuthenticationHeader = "invalid_authentication_header";
 export const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 export const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 export const authorityMismatch = "authority_mismatch";
+export const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";

package/src/error/PlatformBrokerError.ts

@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { AuthError } from "./AuthError.js";
+
+/**
+ * Converts a numeric tag from MSAL Runtime to a 5-character string representation.
+ * Tags are encoded as 30-bit values (6 bits per character) using a custom symbol space.
+ * @param tag - The numeric tag to convert
+ * @returns The string representation of the tag
+ */
+function tagToString(tag: number): string {
+    if (tag === 0) {
+        return "UNTAG";
+    }
+
+    const tagSymbolSpace =
+        "abcdefghijklmnopqrstuvwxyz0123456789****************************";
+    let tagBuffer = "*****";
+
+    const chars = [
+        tagSymbolSpace[(tag >> 24) & 0x3f],
+        tagSymbolSpace[(tag >> 18) & 0x3f],
+        tagSymbolSpace[(tag >> 12) & 0x3f],
+        tagSymbolSpace[(tag >> 6) & 0x3f],
+        tagSymbolSpace[(tag >> 0) & 0x3f],
+    ];
+
+    tagBuffer = chars.join("");
+
+    return tagBuffer;
+}
+
+/**
+ * Error class for MSAL Runtime errors that preserves detailed broker information
+ */
+export class PlatformBrokerError extends AuthError {
+    /**
+     * Numeric error code from MSAL Runtime
+     */
+    public statusCode: number;
+
+    /**
+     * Error tag from MSAL Runtime
+     */
+    public tag: string;
+
+    constructor(
+        errorStatus: string,
+        errorContext: string,
+        errorCode: number,
+        errorTag: number
+    ) {
+        const tagString = tagToString(errorTag);
+        const enhancedErrorContext = errorContext
+            ? `${errorContext} (Error Code: ${errorCode}, Tag: ${tagString})`
+            : `(Error Code: ${errorCode}, Tag: ${tagString})`;
+
+        super(errorStatus, enhancedErrorContext);
+        this.name = "PlatformBrokerError";
+        this.statusCode = errorCode;
+        this.tag = tagString;
+        Object.setPrototypeOf(this, PlatformBrokerError.prototype);
+    }
+}

package/src/exports-common.ts

@@ -22,7 +22,6 @@ export { AccountEntityUtils };
 export { AuthorizationCodeClient } from "./client/AuthorizationCodeClient.js";
 export { RefreshTokenClient } from "./client/RefreshTokenClient.js";
 export { SilentFlowClient } from "./client/SilentFlowClient.js";
-export { BaseClient } from "./client/BaseClient.js";
 export {
     AuthOptions,
     SystemOptions,
@@ -108,6 +107,8 @@ export {
 } from "./crypto/ICrypto.js";
 
 export * as AuthorizeProtocol from "./protocol/Authorize.js";
+export * as TokenProtocol from "./protocol/Token.js";
+
 export { BaseAuthRequest } from "./request/BaseAuthRequest.js";
 export { CommonAuthorizationUrlRequest } from "./request/CommonAuthorizationUrlRequest.js";
 export { CommonAuthorizationCodeRequest } from "./request/CommonAuthorizationCodeRequest.js";
@@ -139,6 +140,7 @@ export {
     AuthErrorCodes,
     createAuthError,
 } from "./error/AuthError.js";
+export { PlatformBrokerError } from "./error/PlatformBrokerError.js";
 export { ServerError } from "./error/ServerError.js";
 export { NetworkError, createNetworkError } from "./error/NetworkError.js";
 export {
@@ -160,11 +162,8 @@ export * as Constants from "./utils/Constants.js";
 
 export { StringUtils } from "./utils/StringUtils.js";
 export { StringDict } from "./utils/MsalTypes.js";
-export {
-    ProtocolUtils,
-    RequestStateObject,
-    LibraryStateObject,
-} from "./utils/ProtocolUtils.js";
+export { RequestStateObject, LibraryStateObject } from "./utils/StateTypes.js";
+export * as ProtocolUtils from "./utils/ProtocolUtils.js";
 export * from "./utils/FunctionWrappers.js";
 export { ServerTelemetryManager } from "./telemetry/server/ServerTelemetryManager.js";
 export { ServerTelemetryRequest } from "./telemetry/server/ServerTelemetryRequest.js";

package/src/exports-node-only.ts

@@ -30,3 +30,7 @@ export {
 export { getClientAssertion } from "./utils/ClientAssertionUtils.js";
 export { IGuidGenerator } from "./crypto/IGuidGenerator.js";
 export { StubPerformanceClient } from "./telemetry/performance/StubPerformanceClient.js";
+export {
+    buildClientConfiguration,
+    CommonClientConfiguration,
+} from "./config/ClientConfiguration.js";

package/src/logger/Logger.ts

@@ -33,6 +33,141 @@ export interface ILoggerCallback {
     (level: LogLevel, message: string, containsPii: boolean): void;
 }
 
+/**
+ * Represents a single logged message with metadata
+ */
+export interface LoggedMessage {
+    hash: string;
+    level: LogLevel;
+    containsPii: boolean;
+    milliseconds: number;
+}
+
+/**
+ * LRU cache node for correlation ID management
+ */
+interface CorrelationLogData {
+    logs: LoggedMessage[];
+    firstEventTime: number;
+}
+
+// Shared cache state for better minification - using Map's insertion order for LRU
+const CACHE_CAPACITY = 50;
+const MAX_LOGS_PER_CORRELATION = 500;
+const correlationCache = new Map<string, CorrelationLogData>();
+
+/**
+ * Mark correlation ID as recently used by moving it to end of Map
+ * @param correlationId
+ * @param {CorrelationLogData} data
+ */
+function markAsRecentlyUsed(
+    correlationId: string,
+    data: CorrelationLogData
+): void {
+    correlationCache.delete(correlationId);
+    correlationCache.set(correlationId, data);
+}
+
+/**
+ * Add log message to cache for specific correlation ID
+ * @param correlationId
+ * @param {LoggedMessage} loggedMessage
+ */
+function addLogToCache(
+    correlationId: string,
+    loggedMessage: LoggedMessage
+): void {
+    const currentTime = Date.now();
+
+    let data = correlationCache.get(correlationId);
+
+    if (data) {
+        // Mark as recently used
+        markAsRecentlyUsed(correlationId, data);
+    } else {
+        // Create new entry
+        data = { logs: [], firstEventTime: currentTime };
+        correlationCache.set(correlationId, data);
+
+        // Remove LRU (first entry) if capacity exceeded
+        if (correlationCache.size > CACHE_CAPACITY) {
+            const firstKey = correlationCache.keys().next().value;
+            if (firstKey) {
+                correlationCache.delete(firstKey);
+            }
+        }
+    }
+
+    // Add log to the data, maintaining max logs per correlation
+    data.logs.push({
+        ...loggedMessage,
+        milliseconds: currentTime - data.firstEventTime,
+    });
+    if (data.logs.length > MAX_LOGS_PER_CORRELATION) {
+        data.logs.shift(); // Remove oldest log
+    }
+}
+
+/**
+ * Get all logs for specific correlation ID
+ * @param correlationId
+ */
+export function getLogsFromCache(correlationId: string): LoggedMessage[] {
+    const data = correlationCache.get(correlationId);
+    if (data) {
+        markAsRecentlyUsed(correlationId, data);
+        return [...data.logs]; // Return copy
+    }
+    return [];
+}
+
+/**
+ * Get logs for correlation ID and flush them from cache
+ * Attaches logs with empty correlation id to the requested correlation logs
+ * @param correlationId
+ */
+export function getAndFlushLogsFromCache(
+    correlationId: string
+): LoggedMessage[] {
+    const res: LoggedMessage[] = [];
+    for (const id of ["", correlationId]) {
+        const data = correlationCache.get(id);
+        res.push(...(data?.logs ?? []));
+        correlationCache.delete(id); // Remove the correlation ID completely from cache
+    }
+    return res;
+}
+
+/**
+ * Get all correlation IDs that have logs
+ */
+export function getCachedCorrelationIds(): string[] {
+    return Array.from(correlationCache.keys());
+}
+
+/**
+ * Checks if a string is already a hashed logging string (6 alphanumeric characters)
+ */
+function isHashedString(str: string): boolean {
+    if (str.length !== 6) {
+        return false;
+    }
+
+    for (let i = 0; i < str.length; i++) {
+        const char = str[i];
+        const isAlphaNumeric =
+            (char >= "a" && char <= "z") ||
+            (char >= "A" && char <= "Z") ||
+            (char >= "0" && char <= "9");
+        if (!isAlphaNumeric) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
 /**
  * Class which facilitates logging of messages to a specific place.
  */
@@ -105,6 +240,19 @@ export class Logger {
         logMessage: string,
         options: LoggerMessageOptions
     ): void {
+        const correlationId = options.correlationId;
+        const isHashedInput = isHashedString(logMessage);
+
+        if (isHashedInput) {
+            const loggedMessage: LoggedMessage = {
+                hash: logMessage,
+                level: options.logLevel,
+                containsPii: options.containsPii || false,
+                milliseconds: 0, // Will be calculated in addLogToCache
+            };
+            addLogToCache(correlationId, loggedMessage);
+        }
+
         if (
             options.logLevel > this.level ||
             (!this.piiLoggingEnabled && options.containsPii)
@@ -114,12 +262,12 @@ export class Logger {
         const timestamp = new Date().toUTCString();
 
         // Add correlationId to logs if set, correlationId provided on log messages take precedence
-        const logHeader = `[${timestamp}] : [${options.correlationId}]`;
+        const logHeader = `[${timestamp}] : [${correlationId}]`;
 
         const log = `${logHeader} : ${this.packageName}@${
             this.packageVersion
         } : ${LogLevel[options.logLevel]} - ${logMessage}`;
-        // debug(`msal:${LogLevel[options.logLevel]}${options.containsPii ? "-Pii": Constants.""}${options.context ? `:${options.context}` : Constants.""}`)(logMessage);
+
         this.executeCallback(
             options.logLevel,
             log,

package/src/network/RequestThumbprint.ts

@@ -42,6 +42,6 @@ export function getRequestThumbprint(
         shrClaims: request.shrClaims,
         sshKid: request.sshKid,
         embeddedClientId:
-            request.embeddedClientId || request.tokenBodyParameters?.clientId,
+            request.embeddedClientId || request.extraParameters?.clientId,
     };
 }

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.0.0-alpha.0";
+export const version = "16.0.1";