@azure/msal-common 16.0.0-beta.0 → 16.0.2

package/dist-browser/client/RefreshTokenClient.mjs

@@ -0,0 +1,254 @@
+/*! @azure/msal-common v16.0.2 2026-01-17 */
+'use strict';
+import { buildClientConfiguration, isOidcProtocolMode } from '../config/ClientConfiguration.mjs';
+import { addClientId, addRedirectUri, addScopes, addGrantType, addClientInfo, addLibraryInfo, addApplicationTelemetry, addThrottling, addServerTelemetry, addRefreshToken, addClientSecret, addClientAssertion, addClientAssertionType, addPopToken, addSshJwk, addClaims, addCcsUpn, addCcsOid, addBrokerParameters, addExtraParameters, instrumentBrokerParams } from '../request/RequestParameterBuilder.mjs';
+import { mapToQueryString } from '../utils/UrlUtils.mjs';
+import { AuthenticationScheme, HeaderNames, INVALID_GRANT_ERROR, CLIENT_MISMATCH_ERROR, GrantType } from '../utils/Constants.mjs';
+import { CLIENT_ID } from '../constants/AADServerParamKeys.mjs';
+import { ResponseHandler } from '../response/ResponseHandler.mjs';
+import { PopTokenGenerator } from '../crypto/PopTokenGenerator.mjs';
+import { StringUtils } from '../utils/StringUtils.mjs';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { ServerError } from '../error/ServerError.mjs';
+import { nowSeconds, isTokenExpired } from '../utils/TimeUtils.mjs';
+import { UrlString } from '../url/UrlString.mjs';
+import { CcsCredentialType } from '../account/CcsCredential.mjs';
+import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';
+import { createInteractionRequiredAuthError, InteractionRequiredAuthError } from '../error/InteractionRequiredAuthError.mjs';
+import { RefreshTokenClientAcquireTokenWithCachedRefreshToken, RefreshTokenClientAcquireToken, RefreshTokenClientExecuteTokenRequest, HandleServerTokenResponse, CacheManagerGetRefreshToken, RefreshTokenClientCreateTokenRequestBody, RefreshTokenClientExecutePostToTokenEndpoint, PopTokenGenerateCnf } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync, invoke } from '../utils/FunctionWrappers.mjs';
+import { getClientAssertion } from '../utils/ClientAssertionUtils.mjs';
+import { getRequestThumbprint } from '../network/RequestThumbprint.mjs';
+import { createTokenQueryParameters, createTokenRequestHeaders, executePostToTokenEndpoint } from '../protocol/Token.mjs';
+import { Logger } from '../logger/Logger.mjs';
+import { name, version } from '../packageMetadata.mjs';
+import { badToken, noTokensFound, refreshTokenExpired } from '../error/InteractionRequiredAuthErrorCodes.mjs';
+import { tokenRequestEmpty, missingSshJwk } from '../error/ClientConfigurationErrorCodes.mjs';
+import { noAccountInSilentRequest } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
+/**
+ * OAuth2.0 refresh token client
+ * @internal
+ */
+class RefreshTokenClient {
+    constructor(configuration, performanceClient) {
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
+    }
+    async acquireToken(request) {
+        const reqTimestamp = nowSeconds();
+        const response = await invokeAsync(this.executeTokenRequest.bind(this), RefreshTokenClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(request, this.authority);
+        // Retrieve requestId from response headers
+        const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
+        const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
+        responseHandler.validateTokenResponse(response.body, request.correlationId);
+        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId);
+    }
+    /**
+     * Gets cached refresh token and attaches to request, then calls acquireToken API
+     * @param request
+     */
+    async acquireTokenByRefreshToken(request) {
+        // Cannot renew token if no request object is given.
+        if (!request) {
+            throw createClientConfigurationError(tokenRequestEmpty);
+        }
+        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+        if (!request.account) {
+            throw createClientAuthError(noAccountInSilentRequest);
+        }
+        // try checking if FOCI is enabled for the given application
+        const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, request.correlationId);
+        // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
+        if (isFOCI) {
+            try {
+                return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true);
+            }
+            catch (e) {
+                const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
+                    e.errorCode ===
+                        noTokensFound;
+                const clientMismatchErrorWithFamilyRT = e instanceof ServerError &&
+                    e.errorCode === INVALID_GRANT_ERROR &&
+                    e.subError === CLIENT_MISMATCH_ERROR;
+                // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
+                if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
+                    return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
+                    // throw in all other cases
+                }
+                else {
+                    throw e;
+                }
+            }
+        }
+        // fall back to application refresh token acquisition
+        return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, false);
+    }
+    /**
+     * makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached
+     * @param request
+     */
+    async acquireTokenWithCachedRefreshToken(request, foci) {
+        // fetches family RT or application RT based on FOCI value
+        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined);
+        if (!refreshToken) {
+            throw createInteractionRequiredAuthError(noTokensFound);
+        }
+        if (refreshToken.expiresOn) {
+            const offset = request.refreshTokenExpirationOffsetSeconds ||
+                DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS;
+            this.performanceClient?.addFields({
+                cacheRtExpiresOnSeconds: Number(refreshToken.expiresOn),
+                rtOffsetSeconds: offset,
+            }, request.correlationId);
+            if (isTokenExpired(refreshToken.expiresOn, offset)) {
+                throw createInteractionRequiredAuthError(refreshTokenExpired);
+            }
+        }
+        // attach cached RT size to the current measurement
+        const refreshTokenRequest = {
+            ...request,
+            refreshToken: refreshToken.secret,
+            authenticationScheme: request.authenticationScheme ||
+                AuthenticationScheme.BEARER,
+            ccsCredential: {
+                credential: request.account.homeAccountId,
+                type: CcsCredentialType.HOME_ACCOUNT_ID,
+            },
+        };
+        try {
+            return await invokeAsync(this.acquireToken.bind(this), RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest);
+        }
+        catch (e) {
+            if (e instanceof InteractionRequiredAuthError) {
+                if (e.subError === badToken) {
+                    // Remove bad refresh token from cache
+                    this.logger.verbose("1pg3ap", request.correlationId);
+                    const badRefreshTokenKey = this.cacheManager.generateCredentialKey(refreshToken);
+                    this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
+                }
+            }
+            throw e;
+        }
+    }
+    /**
+     * Constructs the network message and makes a NW call to the underlying secure token service
+     * @param request
+     * @param authority
+     */
+    async executeTokenRequest(request, authority) {
+        const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
+        const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
+        const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), RefreshTokenClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
+        const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, request.ccsCredential);
+        const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
+        return invokeAsync(executePostToTokenEndpoint, RefreshTokenClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, this.serverTelemetryManager);
+    }
+    /**
+     * Helper function to create the token request body
+     * @param request
+     */
+    async createTokenRequestBody(request) {
+        const parameters = new Map();
+        addClientId(parameters, request.embeddedClientId ||
+            request.extraParameters?.[CLIENT_ID] ||
+            this.config.authOptions.clientId);
+        if (request.redirectUri) {
+            addRedirectUri(parameters, request.redirectUri);
+        }
+        addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addGrantType(parameters, GrantType.REFRESH_TOKEN_GRANT);
+        addClientInfo(parameters);
+        addLibraryInfo(parameters, this.config.libraryInfo);
+        addApplicationTelemetry(parameters, this.config.telemetry.application);
+        addThrottling(parameters);
+        if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
+            addServerTelemetry(parameters, this.serverTelemetryManager);
+        }
+        addRefreshToken(parameters, request.refreshToken);
+        if (this.config.clientCredentials.clientSecret) {
+            addClientSecret(parameters, this.config.clientCredentials.clientSecret);
+        }
+        if (this.config.clientCredentials.clientAssertion) {
+            const clientAssertion = this.config.clientCredentials.clientAssertion;
+            addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
+            addClientAssertionType(parameters, clientAssertion.assertionType);
+        }
+        if (request.authenticationScheme === AuthenticationScheme.POP) {
+            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+            // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+            addPopToken(parameters, reqCnfData);
+        }
+        else if (request.authenticationScheme === AuthenticationScheme.SSH) {
+            if (request.sshJwk) {
+                addSshJwk(parameters, request.sshJwk);
+            }
+            else {
+                throw createClientConfigurationError(missingSshJwk);
+            }
+        }
+        if (!StringUtils.isEmptyObj(request.claims) ||
+            (this.config.authOptions.clientCapabilities &&
+                this.config.authOptions.clientCapabilities.length > 0)) {
+            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
+        }
+        if (this.config.systemOptions.preventCorsPreflight &&
+            request.ccsCredential) {
+            switch (request.ccsCredential.type) {
+                case CcsCredentialType.HOME_ACCOUNT_ID:
+                    try {
+                        const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);
+                        addCcsOid(parameters, clientInfo);
+                    }
+                    catch (e) {
+                        this.logger.verbose("1qhtee", request.correlationId);
+                    }
+                    break;
+                case CcsCredentialType.UPN:
+                    addCcsUpn(parameters, request.ccsCredential.credential);
+                    break;
+            }
+        }
+        if (request.embeddedClientId) {
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
+        }
+        if (request.extraParameters) {
+            addExtraParameters(parameters, {
+                ...request.extraParameters,
+            });
+        }
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
+    }
+}
+
+export { RefreshTokenClient };
+//# sourceMappingURL=RefreshTokenClient.mjs.map

package/dist-browser/client/RefreshTokenClient.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshTokenClient.mjs","sources":["../../src/client/RefreshTokenClient.ts"],"sourcesContent":[null],"names":["TimeUtils.nowSeconds","PerformanceEvents.RefreshTokenClientExecuteTokenRequest","Constants.HeaderNames","PerformanceEvents.HandleServerTokenResponse","ClientConfigurationErrorCodes.tokenRequestEmpty","ClientAuthErrorCodes.noAccountInSilentRequest","PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken","InteractionRequiredAuthErrorCodes.noTokensFound","Constants.INVALID_GRANT_ERROR","Constants.CLIENT_MISMATCH_ERROR","PerformanceEvents.CacheManagerGetRefreshToken","TimeUtils.isTokenExpired","InteractionRequiredAuthErrorCodes.refreshTokenExpired","Constants.AuthenticationScheme","PerformanceEvents.RefreshTokenClientAcquireToken","InteractionRequiredAuthErrorCodes.badToken","PerformanceEvents.RefreshTokenClientCreateTokenRequestBody","PerformanceEvents.RefreshTokenClientExecutePostToTokenEndpoint","RequestParameterBuilder.addClientId","AADServerParamKeys.CLIENT_ID","RequestParameterBuilder.addRedirectUri","RequestParameterBuilder.addScopes","RequestParameterBuilder.addGrantType","Constants.GrantType","RequestParameterBuilder.addClientInfo","RequestParameterBuilder.addLibraryInfo","RequestParameterBuilder.addApplicationTelemetry","RequestParameterBuilder.addThrottling","RequestParameterBuilder.addServerTelemetry","RequestParameterBuilder.addRefreshToken","RequestParameterBuilder.addClientSecret","RequestParameterBuilder.addClientAssertion","RequestParameterBuilder.addClientAssertionType","PerformanceEvents.PopTokenGenerateCnf","RequestParameterBuilder.addPopToken","RequestParameterBuilder.addSshJwk","ClientConfigurationErrorCodes.missingSshJwk","RequestParameterBuilder.addClaims","RequestParameterBuilder.addCcsOid","RequestParameterBuilder.addCcsUpn","RequestParameterBuilder.addBrokerParameters","RequestParameterBuilder.addExtraParameters","RequestParameterBuilder.instrumentBrokerParams","UrlUtils.mapToQueryString"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;AAGG;AAyDH,MAAM,+CAA+C,GAAG,GAAG,CAAC;AAE5D;;;AAGG;MACU,kBAAkB,CAAA;IAyB3B,WACI,CAAA,aAAkC,EAClC,iBAAqC,EAAA;;AAGrC,QAAA,IAAI,CAAC,MAAM,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;;AAGtD,QAAA,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;;QAGnE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;;QAG/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;;QAGjD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;;QAGlD,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC;;QAGjE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;;AAGnD,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;KAC9C;IACM,MAAM,YAAY,CACrB,OAAkC,EAAA;AAElC,QAAA,MAAM,YAAY,GAAGA,UAAoB,EAAE,CAAC;AAC5C,QAAA,MAAM,QAAQ,GAAG,MAAM,WAAW,CAC9B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EACnCC,qCAAuD,EACvD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;;AAG3B,QAAA,MAAM,SAAS,GACX,QAAQ,CAAC,OAAO,GAAGC,WAAqB,CAAC,eAAe,CAAC,CAAC;AAC9D,QAAA,MAAM,eAAe,GAAG,IAAI,eAAe,CACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAChC,CAAC;QACF,eAAe,CAAC,qBAAqB,CACjC,QAAQ,CAAC,IAAI,EACb,OAAO,CAAC,aAAa,CACxB,CAAC;QAEF,OAAO,WAAW,CACd,eAAe,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,EAC/DC,yBAA2C,EAC3C,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CACG,QAAQ,CAAC,IAAI,EACb,IAAI,CAAC,SAAS,EACd,YAAY,EACZ,OAAO,EACP,SAAS,EACT,SAAS,EACT,IAAI,EACJ,OAAO,CAAC,UAAU,EAClB,SAAS,CACZ,CAAC;KACL;AAED;;;AAGG;IACI,MAAM,0BAA0B,CACnC,OAAgC,EAAA;;QAGhC,IAAI,CAAC,OAAO,EAAE;AACV,YAAA,MAAM,8BAA8B,CAChCC,iBAA+C,CAClD,CAAC;AACL,SAAA;;AAED,QAAA,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;AAClB,YAAA,MAAM,qBAAqB,CACvBC,wBAA6C,CAChD,CAAC;AACL,SAAA;;AAGD,QAAA,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAC9C,OAAO,CAAC,OAAO,CAAC,WAAW,EAC3B,OAAO,CAAC,aAAa,CACxB,CAAC;;AAGF,QAAA,IAAI,MAAM,EAAE;YACR,IAAI;AACA,gBAAA,OAAO,MAAM,WAAW,CACpB,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAClDC,oDAAsE,EACtE,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACpB,aAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,MAAM,iBAAiB,GACnB,CAAC,YAAY,4BAA4B;AACzC,oBAAA,CAAC,CAAC,SAAS;wBACPC,aAA+C,CAAC;AACxD,gBAAA,MAAM,+BAA+B,GACjC,CAAC,YAAY,WAAW;AACxB,oBAAA,CAAC,CAAC,SAAS,KAAKC,mBAA6B;AAC7C,oBAAA,CAAC,CAAC,QAAQ,KAAKC,qBAA+B,CAAC;;gBAGnD,IAAI,iBAAiB,IAAI,+BAA+B,EAAE;AACtD,oBAAA,OAAO,WAAW,CACd,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAClDH,oDAAsE,EACtE,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;;AAErB,iBAAA;AAAM,qBAAA;AACH,oBAAA,MAAM,CAAC,CAAC;AACX,iBAAA;AACJ,aAAA;AACJ,SAAA;;AAED,QAAA,OAAO,WAAW,CACd,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAClDA,oDAAsE,EACtE,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;KACrB;AAED;;;AAGG;AACK,IAAA,MAAM,kCAAkC,CAC5C,OAAgC,EAChC,IAAa,EAAA;;QAGb,MAAM,YAAY,GAAG,MAAM,CACvB,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EACzDI,2BAA6C,EAC7C,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAE3D,IAAI,CAAC,YAAY,EAAE;AACf,YAAA,MAAM,kCAAkC,CACpCH,aAA+C,CAClD,CAAC;AACL,SAAA;QAED,IAAI,YAAY,CAAC,SAAS,EAAE;AACxB,YAAA,MAAM,MAAM,GACR,OAAO,CAAC,mCAAmC;AAC3C,gBAAA,+CAA+C,CAAC;AACpD,YAAA,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAC7B;AACI,gBAAA,uBAAuB,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;AACvD,gBAAA,eAAe,EAAE,MAAM;AAC1B,aAAA,EACD,OAAO,CAAC,aAAa,CACxB,CAAC;YAEF,IAAII,cAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE;AAC1D,gBAAA,MAAM,kCAAkC,CACpCC,mBAAqD,CACxD,CAAC;AACL,aAAA;AACJ,SAAA;;AAGD,QAAA,MAAM,mBAAmB,GAA8B;AACnD,YAAA,GAAG,OAAO;YACV,YAAY,EAAE,YAAY,CAAC,MAAM;YACjC,oBAAoB,EAChB,OAAO,CAAC,oBAAoB;gBAC5BC,oBAA8B,CAAC,MAAM;AACzC,YAAA,aAAa,EAAE;AACX,gBAAA,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;gBACzC,IAAI,EAAE,iBAAiB,CAAC,eAAe;AAC1C,aAAA;SACJ,CAAC;QAEF,IAAI;AACA,YAAA,OAAO,MAAM,WAAW,CACpB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5BC,8BAAgD,EAChD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,mBAAmB,CAAC,CAAC;AAC1B,SAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,IAAI,CAAC,YAAY,4BAA4B,EAAE;AAC3C,gBAAA,IAAI,CAAC,CAAC,QAAQ,KAAKC,QAA0C,EAAE;;oBAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,CACf,QAAsE,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;oBAG1E,MAAM,kBAAkB,GACpB,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC1D,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAChC,kBAAkB,EAClB,OAAO,CAAC,aAAa,CACxB,CAAC;AACL,iBAAA;AACJ,aAAA;AAED,YAAA,MAAM,CAAC,CAAC;AACX,SAAA;KACJ;AAED;;;;AAIG;AACK,IAAA,MAAM,mBAAmB,CAC7B,OAAkC,EAClC,SAAoB,EAAA;QAEpB,MAAM,qBAAqB,GAAG,0BAA0B,CACpD,OAAO,EACP,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EACnC,IAAI,CAAC,iBAAiB,CACzB,CAAC;AACF,QAAA,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CACxC,SAAS,CAAC,aAAa,EACvB,qBAAqB,CACxB,CAAC;AAEF,QAAA,MAAM,WAAW,GAAG,MAAM,WAAW,CACjC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EACtCC,wCAA0D,EAC1D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,CAAC,CAAC;QACX,MAAM,OAAO,GAA2B,yBAAyB,CAC7D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,EAC9C,OAAO,CAAC,aAAa,CACxB,CAAC;AAEF,QAAA,MAAM,UAAU,GAAG,oBAAoB,CACnC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,OAAO,CACV,CAAC;QAEF,OAAO,WAAW,CACd,0BAA0B,EAC1BC,4CAA8D,EAC9D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CACG,QAAQ,EACR,WAAW,EACX,OAAO,EACP,UAAU,EACV,OAAO,CAAC,aAAa,EACrB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,sBAAsB,CAC9B,CAAC;KACL;AAED;;;AAGG;IACK,MAAM,sBAAsB,CAChC,OAAkC,EAAA;AAElC,QAAA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C,QAAAC,WAAmC,CAC/B,UAAU,EACV,OAAO,CAAC,gBAAgB;AACpB,YAAA,OAAO,CAAC,eAAe,GAAGC,SAA4B,CAAC;AACvD,YAAA,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CACvC,CAAC;QAEF,IAAI,OAAO,CAAC,WAAW,EAAE;YACrBC,cAAsC,CAClC,UAAU,EACV,OAAO,CAAC,WAAW,CACtB,CAAC;AACL,SAAA;QAEDC,SAAiC,CAC7B,UAAU,EACV,OAAO,CAAC,MAAM,EACd,IAAI,EACJ,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CACvE,CAAC;QAEFC,YAAoC,CAChC,UAAU,EACVC,SAAmB,CAAC,mBAAmB,CAC1C,CAAC;AAEF,QAAAC,aAAqC,CAAC,UAAU,CAAC,CAAC;QAElDC,cAAsC,CAClC,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,WAAW,CAC1B,CAAC;AACF,QAAAC,uBAA+C,CAC3C,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CACpC,CAAC;AACF,QAAAC,aAAqC,CAAC,UAAU,CAAC,CAAC;QAElD,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACjEC,kBAA0C,CACtC,UAAU,EACV,IAAI,CAAC,sBAAsB,CAC9B,CAAC;AACL,SAAA;QAEDC,eAAuC,CACnC,UAAU,EACV,OAAO,CAAC,YAAY,CACvB,CAAC;AAEF,QAAA,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE;AAC5C,YAAAC,eAAuC,CACnC,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAC7C,CAAC;AACL,SAAA;AAED,QAAA,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE;YAC/C,MAAM,eAAe,GACjB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAElDC,kBAA0C,CACtC,UAAU,EACV,MAAM,kBAAkB,CACpB,eAAe,CAAC,SAAS,EACzB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,OAAO,CAAC,kBAAkB,CAC7B,CACJ,CAAC;YACFC,sBAA8C,CAC1C,UAAU,EACV,eAAe,CAAC,aAAa,CAChC,CAAC;AACL,SAAA;QAED,IACI,OAAO,CAAC,oBAAoB,KAAKnB,oBAA8B,CAAC,GAAG,EACrE;AACE,YAAA,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC3C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,iBAAiB,CACzB,CAAC;AAEF,YAAA,IAAI,UAAU,CAAC;AACf,YAAA,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;AACjB,gBAAA,MAAM,mBAAmB,GAAG,MAAM,WAAW,CACzC,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,EACrDoB,mBAAqC,EACrC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AAExB,gBAAA,UAAU,GAAG,mBAAmB,CAAC,YAAY,CAAC;AACjD,aAAA;AAAM,iBAAA;gBACH,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAC3D,aAAA;;AAGD,YAAAC,WAAmC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC/D,SAAA;aAAM,IACH,OAAO,CAAC,oBAAoB,KAAKrB,oBAA8B,CAAC,GAAG,EACrE;YACE,IAAI,OAAO,CAAC,MAAM,EAAE;gBAChBsB,SAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACjE,aAAA;AAAM,iBAAA;AACH,gBAAA,MAAM,8BAA8B,CAChCC,aAA2C,CAC9C,CAAC;AACL,aAAA;AACJ,SAAA;QAED,IACI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;AACvC,aAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB;gBACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,EAC5D;AACE,YAAAC,SAAiC,CAC7B,UAAU,EACV,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAC7C,CAAC;AACL,SAAA;AAED,QAAA,IACI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB;YAC9C,OAAO,CAAC,aAAa,EACvB;AACE,YAAA,QAAQ,OAAO,CAAC,aAAa,CAAC,IAAI;gBAC9B,KAAK,iBAAiB,CAAC,eAAe;oBAClC,IAAI;wBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,aAAa,CAAC,UAAU,CACnC,CAAC;AACF,wBAAAC,SAAiC,CAC7B,UAAU,EACV,UAAU,CACb,CAAC;AACL,qBAAA;AAAC,oBAAA,OAAO,CAAC,EAAE;AACR,wBAAA,IAAI,CAAC,MAAM,CAAC,OAAO,CACf,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,qBAAA;oBACD,MAAM;gBACV,KAAK,iBAAiB,CAAC,GAAG;oBACtBC,SAAiC,CAC7B,UAAU,EACV,OAAO,CAAC,aAAa,CAAC,UAAU,CACnC,CAAC;oBACF,MAAM;AACb,aAAA;AACJ,SAAA;QAED,IAAI,OAAO,CAAC,gBAAgB,EAAE;YAC1BC,mBAA2C,CACvC,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CACtC,CAAC;AACL,SAAA;QAED,IAAI,OAAO,CAAC,eAAe,EAAE;AACzB,YAAAC,kBAA0C,CAAC,UAAU,EAAE;gBACnD,GAAG,OAAO,CAAC,eAAe;AAC7B,aAAA,CAAC,CAAC;AACN,SAAA;AAED,QAAAC,sBAA8C,CAC1C,UAAU,EACV,OAAO,CAAC,aAAa,EACrB,IAAI,CAAC,iBAAiB,CACzB,CAAC;AACF,QAAA,OAAOC,gBAAyB,CAAC,UAAU,CAAC,CAAC;KAChD;AACJ;;;;"}

package/dist-browser/client/SilentFlowClient.d.ts

@@ -0,0 +1,35 @@
+import { ClientConfiguration, CommonClientConfiguration } from "../config/ClientConfiguration.js";
+import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest.js";
+import { AuthenticationResult } from "../response/AuthenticationResult.js";
+import { CacheOutcome } from "../utils/Constants.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+import { Authority } from "../authority/Authority.js";
+import { Logger } from "../logger/Logger.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { INetworkModule } from "../network/INetworkModule.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+/** @internal */
+export declare class SilentFlowClient {
+    logger: Logger;
+    protected config: CommonClientConfiguration;
+    protected cryptoUtils: ICrypto;
+    protected cacheManager: CacheManager;
+    protected networkClient: INetworkModule;
+    protected serverTelemetryManager: ServerTelemetryManager | null;
+    authority: Authority;
+    protected performanceClient: IPerformanceClient;
+    constructor(configuration: ClientConfiguration, performanceClient: IPerformanceClient);
+    /**
+     * Retrieves token from cache or throws an error if it must be refreshed.
+     * @param request
+     */
+    acquireCachedToken(request: CommonSilentFlowRequest): Promise<[AuthenticationResult, CacheOutcome]>;
+    private setCacheOutcome;
+    /**
+     * Helper function to build response object from the CacheRecord
+     * @param cacheRecord
+     */
+    private generateResultFromCacheRecord;
+}
+//# sourceMappingURL=SilentFlowClient.d.ts.map

package/dist-browser/client/SilentFlowClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SilentFlowClient.d.ts","sourceRoot":"","sources":["../../src/client/SilentFlowClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAEH,mBAAmB,EACnB,yBAAyB,EAC5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAQ3E,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EACH,SAAS,EAEZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAGvF,gBAAgB;AAChB,qBAAa,gBAAgB;IAElB,MAAM,EAAE,MAAM,CAAC;IAGtB,SAAS,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAG5C,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC;IAG/B,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IAGrC,SAAS,CAAC,aAAa,EAAE,cAAc,CAAC;IAGxC,SAAS,CAAC,sBAAsB,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAGzD,SAAS,EAAE,SAAS,CAAC;IAG5B,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;gBAG5C,aAAa,EAAE,mBAAmB,EAClC,iBAAiB,EAAE,kBAAkB;IA2BzC;;;OAGG;IACG,kBAAkB,CACpB,OAAO,EAAE,uBAAuB,GACjC,OAAO,CAAC,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;IAyGhD,OAAO,CAAC,eAAe;IAmBvB;;;OAGG;YACW,6BAA6B;CAkC9C"}

package/dist-browser/client/SilentFlowClient.mjs

@@ -0,0 +1,125 @@
+/*! @azure/msal-common v16.0.2 2026-01-17 */
+'use strict';
+import { buildClientConfiguration } from '../config/ClientConfiguration.mjs';
+import { wasClockTurnedBack, isTokenExpired } from '../utils/TimeUtils.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { ResponseHandler } from '../response/ResponseHandler.mjs';
+import { CacheOutcome } from '../utils/Constants.mjs';
+import { StringUtils } from '../utils/StringUtils.mjs';
+import { extractTokenClaims, checkMaxAge } from '../account/AuthToken.mjs';
+import { SilentFlowClientGenerateResultFromCacheRecord } from '../telemetry/performance/PerformanceEvents.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+import { getTenantFromAuthorityString } from '../authority/Authority.mjs';
+import { Logger } from '../logger/Logger.mjs';
+import { name, version } from '../packageMetadata.mjs';
+import { tokenRefreshRequired, noAccountInSilentRequest, authTimeNotFound } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/** @internal */
+class SilentFlowClient {
+    constructor(configuration, performanceClient) {
+        // Set the configuration
+        this.config = buildClientConfiguration(configuration);
+        // Initialize the logger
+        this.logger = new Logger(this.config.loggerOptions, name, version);
+        // Initialize crypto
+        this.cryptoUtils = this.config.cryptoInterface;
+        // Initialize storage interface
+        this.cacheManager = this.config.storageInterface;
+        // Set the network interface
+        this.networkClient = this.config.networkInterface;
+        // Set TelemetryManager
+        this.serverTelemetryManager = this.config.serverTelemetryManager;
+        // set Authority
+        this.authority = this.config.authOptions.authority;
+        // set performance telemetry client
+        this.performanceClient = performanceClient;
+    }
+    /**
+     * Retrieves token from cache or throws an error if it must be refreshed.
+     * @param request
+     */
+    async acquireCachedToken(request) {
+        let lastCacheOutcome = CacheOutcome.NOT_APPLICABLE;
+        if (request.forceRefresh || !StringUtils.isEmptyObj(request.claims)) {
+            // Must refresh due to present force_refresh flag.
+            this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
+        if (!request.account) {
+            throw createClientAuthError(noAccountInSilentRequest);
+        }
+        const requestTenantId = request.account.tenantId ||
+            getTenantFromAuthorityString(request.authority);
+        const tokenKeys = this.cacheManager.getTokenKeys();
+        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
+        if (!cachedAccessToken) {
+            // must refresh due to non-existent access_token
+            this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
+            isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
+            // must refresh due to the expires_in value
+            this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
+            throw createClientAuthError(tokenRefreshRequired);
+        }
+        else if (cachedAccessToken.refreshOn &&
+            isTokenExpired(cachedAccessToken.refreshOn, 0)) {
+            // must refresh (in the background) due to the refresh_in value
+            lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
+            // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
+        }
+        const environment = request.authority || this.authority.getPreferredCache();
+        const cacheRecord = {
+            account: this.cacheManager.getAccount(this.cacheManager.generateAccountKey(request.account), request.correlationId),
+            accessToken: cachedAccessToken,
+            idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId),
+            refreshToken: null,
+            appMetadata: this.cacheManager.readAppMetadataFromCache(environment, request.correlationId),
+        };
+        this.setCacheOutcome(lastCacheOutcome, request.correlationId);
+        if (this.config.serverTelemetryManager) {
+            this.config.serverTelemetryManager.incrementCacheHits();
+        }
+        return [
+            await invokeAsync(this.generateResultFromCacheRecord.bind(this), SilentFlowClientGenerateResultFromCacheRecord, this.logger, this.performanceClient, request.correlationId)(cacheRecord, request),
+            lastCacheOutcome,
+        ];
+    }
+    setCacheOutcome(cacheOutcome, correlationId) {
+        this.serverTelemetryManager?.setCacheOutcome(cacheOutcome);
+        this.performanceClient?.addFields({
+            cacheOutcome: cacheOutcome,
+        }, correlationId);
+        if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
+            this.logger.info("09ingz", correlationId);
+        }
+    }
+    /**
+     * Helper function to build response object from the CacheRecord
+     * @param cacheRecord
+     */
+    async generateResultFromCacheRecord(cacheRecord, request) {
+        let idTokenClaims;
+        if (cacheRecord.idToken) {
+            idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
+        }
+        // token max_age check
+        if (request.maxAge || request.maxAge === 0) {
+            const authTime = idTokenClaims?.auth_time;
+            if (!authTime) {
+                throw createClientAuthError(authTimeNotFound);
+            }
+            checkMaxAge(authTime, request.maxAge);
+        }
+        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
+    }
+}
+
+export { SilentFlowClient };
+//# sourceMappingURL=SilentFlowClient.mjs.map

package/dist-browser/client/SilentFlowClient.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SilentFlowClient.mjs","sources":["../../src/client/SilentFlowClient.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.tokenRefreshRequired","ClientAuthErrorCodes.noAccountInSilentRequest","TimeUtils.wasClockTurnedBack","TimeUtils.isTokenExpired","PerformanceEvents.SilentFlowClientGenerateResultFromCacheRecord","ClientAuthErrorCodes.authTimeNotFound"],"mappings":";;;;;;;;;;;;;;;;AAAA;;;AAGG;AAkCH;MACa,gBAAgB,CAAA;IAyBzB,WACI,CAAA,aAAkC,EAClC,iBAAqC,EAAA;;AAGrC,QAAA,IAAI,CAAC,MAAM,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;;AAGtD,QAAA,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;;QAGnE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;;QAG/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;;QAGjD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;;QAGlD,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC;;QAGjE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;;AAGnD,QAAA,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;KAC9C;AAED;;;AAGG;IACH,MAAM,kBAAkB,CACpB,OAAgC,EAAA;AAEhC,QAAA,IAAI,gBAAgB,GAAiB,YAAY,CAAC,cAAc,CAAC;AAEjE,QAAA,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;;YAEjE,IAAI,CAAC,eAAe,CAChB,YAAY,CAAC,uBAAuB,EACpC,OAAO,CAAC,aAAa,CACxB,CAAC;AACF,YAAA,MAAM,qBAAqB,CACvBA,oBAAyC,CAC5C,CAAC;AACL,SAAA;;AAGD,QAAA,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;AAClB,YAAA,MAAM,qBAAqB,CACvBC,wBAA6C,CAChD,CAAC;AACL,SAAA;AAED,QAAA,MAAM,eAAe,GACjB,OAAO,CAAC,OAAO,CAAC,QAAQ;AACxB,YAAA,4BAA4B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;AACnD,QAAA,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CACtD,OAAO,CAAC,OAAO,EACf,OAAO,EACP,SAAS,EACT,eAAe,CAClB,CAAC;QAEF,IAAI,CAAC,iBAAiB,EAAE;;YAEpB,IAAI,CAAC,eAAe,CAChB,YAAY,CAAC,sBAAsB,EACnC,OAAO,CAAC,aAAa,CACxB,CAAC;AACF,YAAA,MAAM,qBAAqB,CACvBD,oBAAyC,CAC5C,CAAC;AACL,SAAA;AAAM,aAAA,IACHE,kBAA4B,CAAC,iBAAiB,CAAC,QAAQ,CAAC;AACxD,YAAAC,cAAwB,CACpB,iBAAiB,CAAC,SAAS,EAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CACtD,EACH;;YAEE,IAAI,CAAC,eAAe,CAChB,YAAY,CAAC,2BAA2B,EACxC,OAAO,CAAC,aAAa,CACxB,CAAC;AACF,YAAA,MAAM,qBAAqB,CACvBH,oBAAyC,CAC5C,CAAC;AACL,SAAA;aAAM,IACH,iBAAiB,CAAC,SAAS;YAC3BG,cAAwB,CAAC,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC,EAC1D;;AAEE,YAAA,gBAAgB,GAAG,YAAY,CAAC,qBAAqB,CAAC;;AAGzD,SAAA;AAED,QAAA,MAAM,WAAW,GACb,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;AAC5D,QAAA,MAAM,WAAW,GAAgB;YAC7B,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EACrD,OAAO,CAAC,aAAa,CACxB;AACD,YAAA,WAAW,EAAE,iBAAiB;AAC9B,YAAA,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,aAAa,EACrB,SAAS,EACT,eAAe,CAClB;AACD,YAAA,YAAY,EAAE,IAAI;AAClB,YAAA,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,wBAAwB,CACnD,WAAW,EACX,OAAO,CAAC,aAAa,CACxB;SACJ,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;AAE9D,QAAA,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;AACpC,YAAA,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,CAAC;AAC3D,SAAA;QAED,OAAO;AACH,YAAA,MAAM,WAAW,CACb,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAC7CC,6CAA+D,EAC/D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,aAAa,CACxB,CAAC,WAAW,EAAE,OAAO,CAAC;YACvB,gBAAgB;SACnB,CAAC;KACL;IAEO,eAAe,CACnB,YAA0B,EAC1B,aAAqB,EAAA;AAErB,QAAA,IAAI,CAAC,sBAAsB,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;AAC3D,QAAA,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAC7B;AACI,YAAA,YAAY,EAAE,YAAY;SAC7B,EACD,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,YAAY,KAAK,YAAY,CAAC,cAAc,EAAE;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,QAAoD,EAAA,aAAA,CAAA,CAAA;AAG3D,SAAA;KACJ;AAED;;;AAGG;AACK,IAAA,MAAM,6BAA6B,CACvC,WAAwB,EACxB,OAAgC,EAAA;AAEhC,QAAA,IAAI,aAAsC,CAAC;QAC3C,IAAI,WAAW,CAAC,OAAO,EAAE;AACrB,YAAA,aAAa,GAAG,kBAAkB,CAC9B,WAAW,CAAC,OAAO,CAAC,MAAM,EAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,YAAY,CAC3C,CAAC;AACL,SAAA;;QAGD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;AACxC,YAAA,MAAM,QAAQ,GAAG,aAAa,EAAE,SAAS,CAAC;YAC1C,IAAI,CAAC,QAAQ,EAAE;AACX,gBAAA,MAAM,qBAAqB,CACvBC,gBAAqC,CACxC,CAAC;AACL,aAAA;AAED,YAAA,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACzC,SAAA;QAED,OAAO,eAAe,CAAC,4BAA4B,CAC/C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd,WAAW,EACX,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,iBAAiB,EACtB,aAAa,CAChB,CAAC;KACL;AACJ;;;;"}

package/dist-browser/config/AppTokenProvider.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Extensibility interface, which allows the app developer to return a token, based on the passed-in parameters, instead of fetching tokens from
+ * the Identity Provider (AAD).
+ * Developers need to construct and return an AppTokenProviderResult object back to MSAL. MSAL will cache the token response
+ * in the same way it would do if the result were comming from AAD.
+ * This extensibility point is only defined for the client_credential flow, i.e. acquireTokenByClientCredential and
+ * meant for Azure SDK to enhance Managed Identity support.
+ */
+export interface IAppTokenProvider {
+    (appTokenProviderParameters: AppTokenProviderParameters): Promise<AppTokenProviderResult>;
+}
+/**
+ * Input object for the IAppTokenProvider extensiblity. MSAL will create this object, which can be used
+ * to help create an AppTokenProviderResult.
+ *
+ * - correlationId           - the correlation Id associated with the request
+ * - tenantId                - the tenant Id for which the token must be provided
+ * - scopes                  - the scopes for which the token must be provided
+ * - claims                  - any extra claims that the token must satisfy
+ */
+export type AppTokenProviderParameters = {
+    readonly correlationId?: string;
+    readonly tenantId: string;
+    readonly scopes: Array<string>;
+    readonly claims?: string;
+};
+/**
+ * Output object for IAppTokenProvider extensiblity.
+ *
+ * - accessToken            - the actual access token, typically in JWT format, that satisfies the request data AppTokenProviderParameters
+ * - expiresInSeconds       - how long the tokens has before expiry, in seconds. Similar to the "expires_in" field in an AAD token response.
+ * - refreshInSeconds       - how long the token has before it should be proactively refreshed. Similar to the "refresh_in" field in an AAD token response.
+ */
+export type AppTokenProviderResult = {
+    accessToken: string;
+    expiresInSeconds: number;
+    refreshInSeconds?: number;
+};
+//# sourceMappingURL=AppTokenProvider.d.ts.map

package/dist-browser/config/AppTokenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppTokenProvider.d.ts","sourceRoot":"","sources":["../../src/config/AppTokenProvider.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAC9B,CACI,0BAA0B,EAAE,0BAA0B,GACvD,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC"}

package/dist-browser/config/ClientConfiguration.d.ts

@@ -0,0 +1,143 @@
+import { INetworkModule } from "../network/INetworkModule.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { ILoggerCallback, LogLevel } from "../logger/Logger.js";
+import type { Authority } from "../authority/Authority.js";
+import { AzureCloudInstance } from "../authority/AuthorityOptions.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { ICachePlugin } from "../cache/interface/ICachePlugin.js";
+import { ISerializableTokenCache } from "../cache/interface/ISerializableTokenCache.js";
+import { ClientCredentials } from "../account/ClientCredentials.js";
+/**
+ * Use the configuration object to configure MSAL Modules and initialize the base interfaces for MSAL.
+ *
+ * This object allows you to configure important elements of MSAL functionality:
+ * - authOptions                - Authentication for application
+ * - cryptoInterface            - Implementation of crypto functions
+ * - libraryInfo                - Library metadata
+ * - telemetry                  - Telemetry options and data
+ * - loggerOptions              - Logging for application
+ * - networkInterface           - Network implementation
+ * - storageInterface           - Storage implementation
+ * - systemOptions              - Additional library options
+ * - clientCredentials          - Credentials options for confidential clients
+ * @internal
+ */
+export type ClientConfiguration = {
+    authOptions: AuthOptions;
+    systemOptions?: SystemOptions;
+    loggerOptions?: LoggerOptions;
+    storageInterface?: CacheManager;
+    networkInterface?: INetworkModule;
+    cryptoInterface?: ICrypto;
+    clientCredentials?: ClientCredentials;
+    libraryInfo?: LibraryInfo;
+    telemetry?: TelemetryOptions;
+    serverTelemetryManager?: ServerTelemetryManager | null;
+    persistencePlugin?: ICachePlugin | null;
+    serializableCache?: ISerializableTokenCache | null;
+};
+export type CommonClientConfiguration = {
+    authOptions: Required<AuthOptions>;
+    systemOptions: Required<SystemOptions>;
+    loggerOptions: Required<LoggerOptions>;
+    storageInterface: CacheManager;
+    networkInterface: INetworkModule;
+    cryptoInterface: Required<ICrypto>;
+    libraryInfo: LibraryInfo;
+    telemetry: Required<TelemetryOptions>;
+    serverTelemetryManager: ServerTelemetryManager | null;
+    clientCredentials: ClientCredentials;
+    persistencePlugin: ICachePlugin | null;
+    serializableCache: ISerializableTokenCache | null;
+};
+/**
+ * Use this to configure the auth options in the ClientConfiguration object
+ *
+ * - clientId                    - Client ID of your app registered with our Application registration portal : https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredAppsPreview in Microsoft Identity Platform
+ * - authority                   - You can configure a specific authority, defaults to " " or "https://login.microsoftonline.com/common"
+ * - knownAuthorities            - An array of URIs that are known to be valid. Used in B2C scenarios.
+ * - cloudDiscoveryMetadata      - A string containing the cloud discovery response. Used in AAD scenarios.
+ * - clientCapabilities          - Array of capabilities which will be added to the claims.access_token.xms_cc request property on every network request.
+ * - instanceAware               - A flag of whether the STS will send back additional parameters to specify where the tokens should be retrieved from.
+ * - redirectUri                 - The redirect URI where authentication responses can be received by your application. It must exactly match one of the redirect URIs registered in the Azure portal.
+ * @internal
+ */
+export type AuthOptions = {
+    clientId: string;
+    authority: Authority;
+    redirectUri: string;
+    clientCapabilities?: Array<string>;
+    azureCloudOptions?: AzureCloudOptions;
+    instanceAware?: boolean;
+};
+/**
+ * Use this to configure token renewal info in the Configuration object
+ *
+ * - tokenRenewalOffsetSeconds    - Sets the window of offset needed to renew the token before expiry
+ * - protocolMode                - Enum that represents the protocol that msal follows. Used for configuring proper endpoints.
+ */
+export type SystemOptions = {
+    tokenRenewalOffsetSeconds?: number;
+    preventCorsPreflight?: boolean;
+};
+/**
+ *  Use this to configure the logging that MSAL does, by configuring logger options in the Configuration object
+ *
+ * - loggerCallback                - Callback for logger
+ * - piiLoggingEnabled             - Sets whether pii logging is enabled
+ * - logLevel                      - Sets the level at which logging happens
+ * - correlationId                 - Sets the correlationId printed by the logger
+ */
+export type LoggerOptions = {
+    loggerCallback?: ILoggerCallback;
+    piiLoggingEnabled?: boolean;
+    logLevel?: LogLevel;
+    correlationId?: string;
+};
+/**
+ * Library-specific options
+ */
+export type LibraryInfo = {
+    sku: string;
+    version: string;
+    cpu: string;
+    os: string;
+};
+/**
+ * AzureCloudInstance specific options
+ *
+ * - azureCloudInstance             - string enum providing short notation for soverign and public cloud authorities
+ * - tenant                         - provision to provide the tenant info
+ */
+export type AzureCloudOptions = {
+    azureCloudInstance: AzureCloudInstance;
+    tenant?: string;
+};
+export type TelemetryOptions = {
+    application: ApplicationTelemetry;
+};
+/**
+ * Telemetry information sent on request
+ * - appName: Unique string name of an application
+ * - appVersion: Version of the application using MSAL
+ */
+export type ApplicationTelemetry = {
+    appName: string;
+    appVersion: string;
+};
+export declare const DEFAULT_SYSTEM_OPTIONS: Required<SystemOptions>;
+/**
+ * Function that sets the default options when not explicitly configured from app developer
+ *
+ * @param Configuration
+ *
+ * @returns Configuration
+ */
+export declare function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }: ClientConfiguration): CommonClientConfiguration;
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+export declare function isOidcProtocolMode(config: ClientConfiguration): boolean;
+//# sourceMappingURL=ClientConfiguration.d.ts.map