@azure/msal-common 16.0.1 → 16.0.3

package/dist-browser/protocol/Authorize.mjs

@@ -0,0 +1,237 @@
+/*! @azure/msal-common v16.0.3 2026-01-28 */
+'use strict';
+import { addClientId, addScopes, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addClaims, addBrokerParameters, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
+import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';
+import { PromptValue } from '../utils/Constants.mjs';
+import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';
+import { mapToQueryString } from '../utils/UrlUtils.mjs';
+import { UrlString } from '../url/UrlString.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { isInteractionRequiredError, InteractionRequiredAuthError } from '../error/InteractionRequiredAuthError.mjs';
+import { ServerError } from '../error/ServerError.mjs';
+import { authorizationCodeMissingFromServerResponse, stateNotFound, invalidState, stateMismatch } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
+ * @param config
+ * @param request
+ * @param logger
+ * @param performanceClient
+ * @returns
+ */
+function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
+    // generate the correlationId if not set by the user and add
+    const correlationId = request.correlationId;
+    const parameters = new Map();
+    addClientId(parameters, request.embeddedClientId ||
+        request.extraQueryParameters?.[CLIENT_ID] ||
+        authOptions.clientId);
+    const requestScopes = [
+        ...(request.scopes || []),
+        ...(request.extraScopesToConsent || []),
+    ];
+    addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addRedirectUri(parameters, request.redirectUri);
+    addCorrelationId(parameters, correlationId);
+    // add response_mode. If not passed in it defaults to query.
+    addResponseMode(parameters, request.responseMode);
+    // add client_info=1
+    addClientInfo(parameters);
+    if (request.prompt) {
+        addPrompt(parameters, request.prompt);
+        performanceClient?.addFields({ prompt: request.prompt }, correlationId);
+    }
+    if (request.domainHint) {
+        addDomainHint(parameters, request.domainHint);
+        performanceClient?.addFields({ domainHintFromRequest: true }, correlationId);
+    }
+    // Add sid or loginHint with preference for login_hint claim (in request) -> sid -> loginHint (upn/email) -> username of AccountInfo object
+    if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+        // AAD will throw if prompt=select_account is passed with an account hint
+        if (request.sid && request.prompt === PromptValue.NONE) {
+            // SessionID is only used in silent calls
+            logger.verbose("1tvqyx", request.correlationId);
+            addSid(parameters, request.sid);
+            performanceClient?.addFields({ sidFromRequest: true }, correlationId);
+        }
+        else if (request.account) {
+            const accountSid = extractAccountSid(request.account);
+            let accountLoginHintClaim = extractLoginHint(request.account);
+            if (accountLoginHintClaim && request.domainHint) {
+                logger.warning("0wkg3v", request.correlationId);
+                accountLoginHintClaim = null;
+            }
+            // If login_hint claim is present, use it over sid/username
+            if (accountLoginHintClaim) {
+                logger.verbose("1eyfsw", request.correlationId);
+                addLoginHint(parameters, accountLoginHintClaim);
+                performanceClient?.addFields({ loginHintFromClaim: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("12ugck", request.correlationId);
+                }
+            }
+            else if (accountSid && request.prompt === PromptValue.NONE) {
+                /*
+                 * If account and loginHint are provided, we will check account first for sid before adding loginHint
+                 * SessionId is only used in silent calls
+                 */
+                logger.verbose("1rmd8s", request.correlationId);
+                addSid(parameters, accountSid);
+                performanceClient?.addFields({ sidFromClaim: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("12ugck", request.correlationId);
+                }
+            }
+            else if (request.loginHint) {
+                logger.verbose("0y3007", request.correlationId);
+                addLoginHint(parameters, request.loginHint);
+                addCcsUpn(parameters, request.loginHint);
+                performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
+            }
+            else if (request.account.username) {
+                // Fallback to account username if provided
+                logger.verbose("02f507", request.correlationId);
+                addLoginHint(parameters, request.account.username);
+                performanceClient?.addFields({ loginHintFromUpn: true }, correlationId);
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                    addCcsOid(parameters, clientInfo);
+                }
+                catch (e) {
+                    logger.verbose("12ugck", request.correlationId);
+                }
+            }
+        }
+        else if (request.loginHint) {
+            logger.verbose("0g01ey", request.correlationId);
+            addLoginHint(parameters, request.loginHint);
+            addCcsUpn(parameters, request.loginHint);
+            performanceClient?.addFields({ loginHintFromRequest: true }, correlationId);
+        }
+    }
+    else {
+        logger.verbose("169k9v", request.correlationId);
+    }
+    if (request.nonce) {
+        addNonce(parameters, request.nonce);
+    }
+    if (request.state) {
+        addState(parameters, request.state);
+    }
+    if (request.claims ||
+        (authOptions.clientCapabilities &&
+            authOptions.clientCapabilities.length > 0)) {
+        addClaims(parameters, request.claims, authOptions.clientCapabilities);
+    }
+    if (request.embeddedClientId) {
+        addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
+    }
+    // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
+    if (authOptions.instanceAware &&
+        (!request.extraQueryParameters ||
+            !Object.keys(request.extraQueryParameters).includes(INSTANCE_AWARE))) {
+        addInstanceAware(parameters);
+    }
+    return parameters;
+}
+/**
+ * Returns authorize endpoint with given request parameters in the query string
+ * @param authority
+ * @param requestParameters
+ * @returns
+ */
+function getAuthorizeUrl(authority, requestParameters) {
+    const queryString = mapToQueryString(requestParameters);
+    return UrlString.appendQueryString(authority.authorizationEndpoint, queryString);
+}
+/**
+ * Handles the hash fragment response from public client code request. Returns a code response used by
+ * the client to exchange for a token in acquireToken.
+ * @param serverParams
+ * @param cachedState
+ */
+function getAuthorizationCodePayload(serverParams, cachedState) {
+    // Get code response
+    validateAuthorizationResponse(serverParams, cachedState);
+    // throw when there is no auth code in the response
+    if (!serverParams.code) {
+        throw createClientAuthError(authorizationCodeMissingFromServerResponse);
+    }
+    return serverParams;
+}
+/**
+ * Function which validates server authorization code response.
+ * @param serverResponseHash
+ * @param requestState
+ */
+function validateAuthorizationResponse(serverResponse, requestState) {
+    if (!serverResponse.state || !requestState) {
+        throw serverResponse.state
+            ? createClientAuthError(stateNotFound, "Cached State")
+            : createClientAuthError(stateNotFound, "Server State");
+    }
+    let decodedServerResponseState;
+    let decodedRequestState;
+    try {
+        decodedServerResponseState = decodeURIComponent(serverResponse.state);
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState, serverResponse.state);
+    }
+    try {
+        decodedRequestState = decodeURIComponent(requestState);
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState, serverResponse.state);
+    }
+    if (decodedServerResponseState !== decodedRequestState) {
+        throw createClientAuthError(stateMismatch);
+    }
+    // Check for error
+    if (serverResponse.error ||
+        serverResponse.error_description ||
+        serverResponse.suberror) {
+        const serverErrorNo = parseServerErrorNo(serverResponse);
+        if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
+            throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+        }
+        throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
+    }
+}
+/**
+ * Get server error No from the error_uri
+ * @param serverResponse
+ * @returns
+ */
+function parseServerErrorNo(serverResponse) {
+    const errorCodePrefix = "code=";
+    const errorCodePrefixIndex = serverResponse.error_uri?.lastIndexOf(errorCodePrefix);
+    return errorCodePrefixIndex && errorCodePrefixIndex >= 0
+        ? serverResponse.error_uri?.substring(errorCodePrefixIndex + errorCodePrefix.length)
+        : undefined;
+}
+/**
+ * Helper to get sid from account. Returns null if idTokenClaims are not present or sid is not present.
+ * @param account
+ */
+function extractAccountSid(account) {
+    return account.idTokenClaims?.sid || null;
+}
+function extractLoginHint(account) {
+    return account.loginHint || account.idTokenClaims?.login_hint || null;
+}
+
+export { getAuthorizationCodePayload, getAuthorizeUrl, getStandardAuthorizeRequestParameters, validateAuthorizationResponse };
+//# sourceMappingURL=Authorize.mjs.map

package/dist-browser/protocol/Authorize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorize.mjs","sources":["../../src/protocol/Authorize.ts"],"sourcesContent":[null],"names":["RequestParameterBuilder.addClientId","AADServerParamKeys.CLIENT_ID","RequestParameterBuilder.addScopes","RequestParameterBuilder.addRedirectUri","RequestParameterBuilder.addCorrelationId","RequestParameterBuilder.addResponseMode","RequestParameterBuilder.addClientInfo","RequestParameterBuilder.addPrompt","RequestParameterBuilder.addDomainHint","RequestParameterBuilder.addSid","RequestParameterBuilder.addLoginHint","RequestParameterBuilder.addCcsOid","RequestParameterBuilder.addCcsUpn","RequestParameterBuilder.addNonce","RequestParameterBuilder.addState","RequestParameterBuilder.addClaims","RequestParameterBuilder.addBrokerParameters","AADServerParamKeys.INSTANCE_AWARE","RequestParameterBuilder.addInstanceAware","ClientAuthErrorCodes.authorizationCodeMissingFromServerResponse","ClientAuthErrorCodes.stateNotFound","ClientAuthErrorCodes.invalidState","ClientAuthErrorCodes.stateMismatch"],"mappings":";;;;;;;;;;;;;AAAA;;;AAGG;AA0BH;;;;;;;AAOG;AACG,SAAU,qCAAqC,CACjD,WAAwB,EACxB,OAAsC,EACtC,MAAc,EACd,iBAAsC,EAAA;;AAGtC,IAAA,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAE5C,IAAA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C,IAAAA,WAAmC,CAC/B,UAAU,EACV,OAAO,CAAC,gBAAgB;AACpB,QAAA,OAAO,CAAC,oBAAoB,GAAGC,SAA4B,CAAC;QAC5D,WAAW,CAAC,QAAQ,CAC3B,CAAC;AAEF,IAAA,MAAM,aAAa,GAAG;AAClB,QAAA,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;AACzB,QAAA,IAAI,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;KAC1C,CAAC;AACF,IAAAC,SAAiC,CAC7B,UAAU,EACV,aAAa,EACb,IAAI,EACJ,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAC3D,CAAC;IAEFC,cAAsC,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AAExE,IAAAC,gBAAwC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;;IAGpEC,eAAuC,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;;AAG1E,IAAAC,aAAqC,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,OAAO,CAAC,MAAM,EAAE;QAChBC,SAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AAC9D,QAAA,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;AAC3E,KAAA;IAED,IAAI,OAAO,CAAC,UAAU,EAAE;QACpBC,aAAqC,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACtE,iBAAiB,EAAE,SAAS,CACxB,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAC/B,aAAa,CAChB,CAAC;AACL,KAAA;;AAGD,IAAA,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,cAAc,EAAE;;QAE/C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE;;YAEpD,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;YAGJC,MAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACxD,iBAAiB,EAAE,SAAS,CACxB,EAAE,cAAc,EAAE,IAAI,EAAE,EACxB,aAAa,CAChB,CAAC;AACL,SAAA;aAAM,IAAI,OAAO,CAAC,OAAO,EAAE;YACxB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,qBAAqB,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9D,YAAA,IAAI,qBAAqB,IAAI,OAAO,CAAC,UAAU,EAAE;gBAC7C,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;gBAGJ,qBAAqB,GAAG,IAAI,CAAC;AAChC,aAAA;;AAGD,YAAA,IAAI,qBAAqB,EAAE;gBACvB,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGJ,gBAAAC,YAAoC,CAChC,UAAU,EACV,qBAAqB,CACxB,CAAC;gBACF,iBAAiB,EAAE,SAAS,CACxB,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAC5B,aAAa,CAChB,CAAC;gBACF,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,OAAO,CAAC,aAAa,CAChC,CAAC;AACF,oBAAAC,SAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,iBAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,iBAAA;AACJ,aAAA;iBAAM,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE;AAC1D;;;AAGG;gBACH,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGJ,gBAAAF,MAA8B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBACvD,iBAAiB,EAAE,SAAS,CACxB,EAAE,YAAY,EAAE,IAAI,EAAE,EACtB,aAAa,CAChB,CAAC;gBACF,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,OAAO,CAAC,aAAa,CAChC,CAAC;AACF,oBAAAE,SAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,iBAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,iBAAA;AACJ,aAAA;iBAAM,IAAI,OAAO,CAAC,SAAS,EAAE;gBAC1B,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;gBAGJD,YAAoC,CAChC,UAAU,EACV,OAAO,CAAC,SAAS,CACpB,CAAC;gBACFE,SAAiC,CAC7B,UAAU,EACV,OAAO,CAAC,SAAS,CACpB,CAAC;gBACF,iBAAiB,EAAE,SAAS,CACxB,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAC9B,aAAa,CAChB,CAAC;AACL,aAAA;AAAM,iBAAA,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;;gBAEjC,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;gBAGJF,YAAoC,CAChC,UAAU,EACV,OAAO,CAAC,OAAO,CAAC,QAAQ,CAC3B,CAAC;gBACF,iBAAiB,EAAE,SAAS,CACxB,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAC1B,aAAa,CAChB,CAAC;gBACF,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,OAAO,CAAC,aAAa,CAChC,CAAC;AACF,oBAAAC,SAAiC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7D,iBAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,iBAAA;AACJ,aAAA;AACJ,SAAA;aAAM,IAAI,OAAO,CAAC,SAAS,EAAE;YAC1B,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;YAGJD,YAAoC,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACpEE,SAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACjE,iBAAiB,EAAE,SAAS,CACxB,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAC9B,aAAa,CAChB,CAAC;AACL,SAAA;AACJ,KAAA;AAAM,SAAA;QACH,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,OAAA,CAAA,aAAA,CAAA,CAAA;AAGP,KAAA;IAED,IAAI,OAAO,CAAC,KAAK,EAAE;QACfC,QAAgC,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/D,KAAA;IAED,IAAI,OAAO,CAAC,KAAK,EAAE;QACfC,QAAgC,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/D,KAAA;IAED,IACI,OAAO,CAAC,MAAM;SACb,WAAW,CAAC,kBAAkB;AAC3B,YAAA,WAAW,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,EAChD;AACE,QAAAC,SAAiC,CAC7B,UAAU,EACV,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,kBAAkB,CACjC,CAAC;AACL,KAAA;IAED,IAAI,OAAO,CAAC,gBAAgB,EAAE;AAC1B,QAAAC,mBAA2C,CACvC,UAAU,EACV,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,WAAW,CAC1B,CAAC;AACL,KAAA;;IAGD,IACI,WAAW,CAAC,aAAa;SACxB,CAAC,OAAO,CAAC,oBAAoB;AAC1B,YAAA,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAC/CC,cAAiC,CACpC,CAAC,EACR;AACE,QAAAC,gBAAwC,CAAC,UAAU,CAAC,CAAC;AACxD,KAAA;AAED,IAAA,OAAO,UAAU,CAAC;AACtB,CAAC;AAED;;;;;AAKG;AACa,SAAA,eAAe,CAC3B,SAAoB,EACpB,iBAAsC,EAAA;AAEtC,IAAA,MAAM,WAAW,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACxD,OAAO,SAAS,CAAC,iBAAiB,CAC9B,SAAS,CAAC,qBAAqB,EAC/B,WAAW,CACd,CAAC;AACN,CAAC;AAED;;;;;AAKG;AACa,SAAA,2BAA2B,CACvC,YAA+B,EAC/B,WAAmB,EAAA;;AAGnB,IAAA,6BAA6B,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;;AAGzD,IAAA,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;AACpB,QAAA,MAAM,qBAAqB,CACvBC,0CAA+D,CAClE,CAAC;AACL,KAAA;AAED,IAAA,OAAO,YAAwC,CAAC;AACpD,CAAC;AAED;;;;AAIG;AACa,SAAA,6BAA6B,CACzC,cAAiC,EACjC,YAAoB,EAAA;AAEpB,IAAA,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE;QACxC,MAAM,cAAc,CAAC,KAAK;cACpB,qBAAqB,CACjBC,aAAkC,EAClC,cAAc,CACjB;cACD,qBAAqB,CACjBA,aAAkC,EAClC,cAAc,CACjB,CAAC;AACX,KAAA;AAED,IAAA,IAAI,0BAAkC,CAAC;AACvC,IAAA,IAAI,mBAA2B,CAAC;IAEhC,IAAI;AACA,QAAA,0BAA0B,GAAG,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AACzE,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,MAAM,qBAAqB,CACvBC,YAAiC,EACjC,cAAc,CAAC,KAAK,CACvB,CAAC;AACL,KAAA;IAED,IAAI;AACA,QAAA,mBAAmB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC1D,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,MAAM,qBAAqB,CACvBA,YAAiC,EACjC,cAAc,CAAC,KAAK,CACvB,CAAC;AACL,KAAA;IAED,IAAI,0BAA0B,KAAK,mBAAmB,EAAE;AACpD,QAAA,MAAM,qBAAqB,CAACC,aAAkC,CAAC,CAAC;AACnE,KAAA;;IAGD,IACI,cAAc,CAAC,KAAK;AACpB,QAAA,cAAc,CAAC,iBAAiB;QAChC,cAAc,CAAC,QAAQ,EACzB;AACE,QAAA,MAAM,aAAa,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;AACzD,QAAA,IACI,0BAA0B,CACtB,cAAc,CAAC,KAAK,EACpB,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,QAAQ,CAC1B,EACH;AACE,YAAA,MAAM,IAAI,4BAA4B,CAClC,cAAc,CAAC,KAAK,IAAI,EAAE,EAC1B,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,SAAS,IAAI,EAAE,EAC9B,cAAc,CAAC,QAAQ,IAAI,EAAE,EAC7B,cAAc,CAAC,cAAc,IAAI,EAAE,EACnC,cAAc,CAAC,MAAM,IAAI,EAAE,EAC3B,aAAa,CAChB,CAAC;AACL,SAAA;AAED,QAAA,MAAM,IAAI,WAAW,CACjB,cAAc,CAAC,KAAK,IAAI,EAAE,EAC1B,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,QAAQ,EACvB,aAAa,CAChB,CAAC;AACL,KAAA;AACL,CAAC;AAED;;;;AAIG;AACH,SAAS,kBAAkB,CACvB,cAAiC,EAAA;IAEjC,MAAM,eAAe,GAAG,OAAO,CAAC;IAChC,MAAM,oBAAoB,GACtB,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;AAC3D,IAAA,OAAO,oBAAoB,IAAI,oBAAoB,IAAI,CAAC;AACpD,UAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAC/B,oBAAoB,GAAG,eAAe,CAAC,MAAM,CAChD;UACD,SAAS,CAAC;AACpB,CAAC;AAED;;;AAGG;AACH,SAAS,iBAAiB,CAAC,OAAoB,EAAA;AAC3C,IAAA,OAAO,OAAO,CAAC,aAAa,EAAE,GAAG,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoB,EAAA;IAC1C,OAAO,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,UAAU,IAAI,IAAI,CAAC;AAC1E;;;;"}

package/dist-browser/protocol/Token.d.ts

@@ -0,0 +1,40 @@
+import { CcsCredential } from "../account/CcsCredential.js";
+import { Logger } from "../logger/Logger.js";
+import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import { IPerformanceClient } from "../exports-browser-only.js";
+import { ServerAuthorizationTokenResponse } from "../response/ServerAuthorizationTokenResponse.js";
+import { RequestThumbprint } from "../network/RequestThumbprint.js";
+import { INetworkModule, NetworkRequestOptions } from "../network/INetworkModule.js";
+import { NetworkResponse } from "../network/NetworkResponse.js";
+import { CacheManager } from "../cache/CacheManager.js";
+import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+/**
+ * Creates default headers for requests to token endpoint
+ */
+export declare function createTokenRequestHeaders(logger: Logger, preventCorsPreflight: boolean, ccsCred?: CcsCredential): Record<string, string>;
+/**
+ * Creates query string for the /token request
+ * @param request
+ */
+export declare function createTokenQueryParameters(request: BaseAuthRequest, clientId: string, redirectUri: string, performanceClient: IPerformanceClient): string;
+/**
+ * Http post to token endpoint
+ * @param tokenEndpoint
+ * @param queryString
+ * @param headers
+ * @param thumbprint
+ */
+export declare function executePostToTokenEndpoint(tokenEndpoint: string, queryString: string, headers: Record<string, string>, thumbprint: RequestThumbprint, correlationId: string, cacheManager: CacheManager, networkClient: INetworkModule, logger: Logger, performanceClient: IPerformanceClient, serverTelemetryManager: ServerTelemetryManager | null): Promise<NetworkResponse<ServerAuthorizationTokenResponse>>;
+/**
+ * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+ * @param thumbprint - Request thumbprint for throttling
+ * @param tokenEndpoint - Endpoint to make the POST to
+ * @param options - Body and Headers to include on the POST request
+ * @param correlationId - CorrelationId for telemetry
+ * @param cacheManager - Cache manager instance
+ * @param networkClient - Network module instance
+ * @param logger - Logger instance
+ * @param performanceClient - Performance client instance
+ */
+export declare function sendPostRequest<T extends ServerAuthorizationTokenResponse>(thumbprint: RequestThumbprint, tokenEndpoint: string, options: NetworkRequestOptions, correlationId: string, cacheManager: CacheManager, networkClient: INetworkModule, logger: Logger, performanceClient: IPerformanceClient): Promise<NetworkResponse<T>>;
+//# sourceMappingURL=Token.d.ts.map

package/dist-browser/protocol/Token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Token.d.ts","sourceRoot":"","sources":["../../src/protocol/Token.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAqB,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EACH,cAAc,EACd,qBAAqB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAUhE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;GAEG;AACH,wBAAgB,yBAAyB,CACrC,MAAM,EAAE,MAAM,EACd,oBAAoB,EAAE,OAAO,EAC7B,OAAO,CAAC,EAAE,aAAa,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BxB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACtC,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,kBAAkB,GACtC,MAAM,CA0BR;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC5C,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,YAAY,EAC1B,aAAa,EAAE,cAAc,EAC7B,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,kBAAkB,EACrC,sBAAsB,EAAE,sBAAsB,GAAG,IAAI,GACtD,OAAO,CAAC,eAAe,CAAC,gCAAgC,CAAC,CAAC,CAsB5D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACjC,CAAC,SAAS,gCAAgC,EAE1C,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,YAAY,EAC1B,aAAa,EAAE,cAAc,EAC7B,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,kBAAkB,GACtC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CA6D7B"}

package/dist-browser/protocol/Token.mjs

@@ -0,0 +1,129 @@
+/*! @azure/msal-common v16.0.3 2026-01-28 */
+'use strict';
+import { CcsCredentialType } from '../account/CcsCredential.mjs';
+import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';
+import { URL_FORM_CONTENT_TYPE, HeaderNames } from '../utils/Constants.mjs';
+import { addBrokerParameters, addExtraParameters, addCorrelationId, instrumentBrokerParams } from '../request/RequestParameterBuilder.mjs';
+import { mapToQueryString } from '../utils/UrlUtils.mjs';
+import { ThrottlingUtils } from '../network/ThrottlingUtils.mjs';
+import { NetworkError } from '../error/NetworkError.mjs';
+import { AuthError } from '../error/AuthError.mjs';
+import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { invokeAsync } from '../utils/FunctionWrappers.mjs';
+import { NetworkClientSendPostRequestAsync } from '../telemetry/performance/PerformanceEvents.mjs';
+import { networkError } from '../error/ClientAuthErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Creates default headers for requests to token endpoint
+ */
+function createTokenRequestHeaders(logger, preventCorsPreflight, ccsCred) {
+    const headers = {};
+    headers[HeaderNames.CONTENT_TYPE] = URL_FORM_CONTENT_TYPE;
+    if (!preventCorsPreflight && ccsCred) {
+        switch (ccsCred.type) {
+            case CcsCredentialType.HOME_ACCOUNT_ID:
+                try {
+                    const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
+                    headers[HeaderNames.CCS_HEADER] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
+                }
+                catch (e) {
+                    logger.verbose("1qhtee", "");
+                }
+                break;
+            case CcsCredentialType.UPN:
+                headers[HeaderNames.CCS_HEADER] = `UPN: ${ccsCred.credential}`;
+                break;
+        }
+    }
+    return headers;
+}
+/**
+ * Creates query string for the /token request
+ * @param request
+ */
+function createTokenQueryParameters(request, clientId, redirectUri, performanceClient) {
+    const parameters = new Map();
+    if (request.embeddedClientId) {
+        addBrokerParameters(parameters, clientId, redirectUri);
+    }
+    if (request.extraQueryParameters) {
+        addExtraParameters(parameters, request.extraQueryParameters);
+    }
+    addCorrelationId(parameters, request.correlationId);
+    instrumentBrokerParams(parameters, request.correlationId, performanceClient);
+    return mapToQueryString(parameters);
+}
+/**
+ * Http post to token endpoint
+ * @param tokenEndpoint
+ * @param queryString
+ * @param headers
+ * @param thumbprint
+ */
+async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, cacheManager, networkClient, logger, performanceClient, serverTelemetryManager) {
+    const response = await sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId, cacheManager, networkClient, logger, performanceClient);
+    if (serverTelemetryManager &&
+        response.status < 500 &&
+        response.status !== 429) {
+        // Telemetry data successfully logged by server, clear Telemetry cache
+        serverTelemetryManager.clearTelemetryCache();
+    }
+    return response;
+}
+/**
+ * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+ * @param thumbprint - Request thumbprint for throttling
+ * @param tokenEndpoint - Endpoint to make the POST to
+ * @param options - Body and Headers to include on the POST request
+ * @param correlationId - CorrelationId for telemetry
+ * @param cacheManager - Cache manager instance
+ * @param networkClient - Network module instance
+ * @param logger - Logger instance
+ * @param performanceClient - Performance client instance
+ */
+async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId, cacheManager, networkClient, logger, performanceClient) {
+    ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
+    let response;
+    try {
+        response = await invokeAsync((networkClient.sendPostRequestAsync.bind(networkClient)), NetworkClientSendPostRequestAsync, logger, performanceClient, correlationId)(tokenEndpoint, options);
+        const responseHeaders = response.headers || {};
+        performanceClient?.addFields({
+            refreshTokenSize: response.body.refresh_token?.length || 0,
+            httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+            requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+        }, correlationId);
+    }
+    catch (e) {
+        if (e instanceof NetworkError) {
+            const responseHeaders = e.responseHeaders;
+            if (responseHeaders) {
+                performanceClient?.addFields({
+                    httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] ||
+                        "",
+                    requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+                    contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                        undefined,
+                    contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                        undefined,
+                    httpStatus: e.httpStatus,
+                }, correlationId);
+            }
+            throw e.error;
+        }
+        if (e instanceof AuthError) {
+            throw e;
+        }
+        else {
+            throw createClientAuthError(networkError);
+        }
+    }
+    ThrottlingUtils.postProcess(cacheManager, thumbprint, response, correlationId);
+    return response;
+}
+
+export { createTokenQueryParameters, createTokenRequestHeaders, executePostToTokenEndpoint, sendPostRequest };
+//# sourceMappingURL=Token.mjs.map

package/dist-browser/protocol/Token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Token.mjs","sources":["../../src/protocol/Token.ts"],"sourcesContent":[null],"names":["RequestParameterBuilder.addBrokerParameters","RequestParameterBuilder.addExtraParameters","RequestParameterBuilder.addCorrelationId","RequestParameterBuilder.instrumentBrokerParams","UrlUtils.mapToQueryString","PerformanceEvents.NetworkClientSendPostRequestAsync","ClientAuthErrorCodes.networkError"],"mappings":";;;;;;;;;;;;;;;AAAA;;;AAGG;AA6BH;;AAEG;SACa,yBAAyB,CACrC,MAAc,EACd,oBAA6B,EAC7B,OAAuB,EAAA;IAEvB,MAAM,OAAO,GAA2B,EAAE,CAAC;AAC3C,IAAA,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,qBAAqB,CAAC;AAC1D,IAAA,IAAI,CAAC,oBAAoB,IAAI,OAAO,EAAE;QAClC,QAAQ,OAAO,CAAC,IAAI;YAChB,KAAK,iBAAiB,CAAC,eAAe;gBAClC,IAAI;oBACA,MAAM,UAAU,GAAG,gCAAgC,CAC/C,OAAO,CAAC,UAAU,CACrB,CAAC;AACF,oBAAA,OAAO,CACH,WAAW,CAAC,UAAU,CACzB,GAAG,CAAA,IAAA,EAAO,UAAU,CAAC,GAAG,CAAI,CAAA,EAAA,UAAU,CAAC,IAAI,EAAE,CAAC;AAClD,iBAAA;AAAC,gBAAA,OAAO,CAAC,EAAE;oBACR,MAAM,CAAC,OAAO,CACV,QAAA,EAAA,EAAA,CAAA,CAAA;AAGP,iBAAA;gBACD,MAAM;YACV,KAAK,iBAAiB,CAAC,GAAG;gBACtB,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAA,KAAA,EAAQ,OAAO,CAAC,UAAU,CAAA,CAAE,CAAC;gBAC/D,MAAM;AACb,SAAA;AACJ,KAAA;AACD,IAAA,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;AAGG;AACG,SAAU,0BAA0B,CACtC,OAAwB,EACxB,QAAgB,EAChB,WAAmB,EACnB,iBAAqC,EAAA;AAErC,IAAA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,IAAI,OAAO,CAAC,gBAAgB,EAAE;QAC1BA,mBAA2C,CACvC,UAAU,EACV,QAAQ,EACR,WAAW,CACd,CAAC;AACL,KAAA;IAED,IAAI,OAAO,CAAC,oBAAoB,EAAE;QAC9BC,kBAA0C,CACtC,UAAU,EACV,OAAO,CAAC,oBAAoB,CAC/B,CAAC;AACL,KAAA;IAEDC,gBAAwC,CAAC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAE5EC,sBAA8C,CAC1C,UAAU,EACV,OAAO,CAAC,aAAa,EACrB,iBAAiB,CACpB,CAAC;AACF,IAAA,OAAOC,gBAAyB,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;AAMG;AACI,eAAe,0BAA0B,CAC5C,aAAqB,EACrB,WAAmB,EACnB,OAA+B,EAC/B,UAA6B,EAC7B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EACrC,sBAAqD,EAAA;AAErD,IAAA,MAAM,QAAQ,GAAG,MAAM,eAAe,CAClC,UAAU,EACV,aAAa,EACb,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,aAAa,EACb,YAAY,EACZ,aAAa,EACb,MAAM,EACN,iBAAiB,CACpB,CAAC;AAEF,IAAA,IACI,sBAAsB;QACtB,QAAQ,CAAC,MAAM,GAAG,GAAG;AACrB,QAAA,QAAQ,CAAC,MAAM,KAAK,GAAG,EACzB;;QAEE,sBAAsB,CAAC,mBAAmB,EAAE,CAAC;AAChD,KAAA;AAED,IAAA,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;;;;;;AAUG;AACI,eAAe,eAAe,CAGjC,UAA6B,EAC7B,aAAqB,EACrB,OAA8B,EAC9B,aAAqB,EACrB,YAA0B,EAC1B,aAA6B,EAC7B,MAAc,EACd,iBAAqC,EAAA;IAErC,eAAe,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpE,IAAA,IAAI,QAAQ,CAAC;IACb,IAAI;AACA,QAAA,QAAQ,GAAG,MAAM,WAAW,EACxB,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAI,GACzDC,iCAAmD,EACnD,MAAM,EACN,iBAAiB,EACjB,aAAa,CAChB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAC1B,QAAA,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/C,iBAAiB,EAAE,SAAS,CACxB;YACI,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;YAC1D,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACxD,SAAS,EAAE,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;SAChE,EACD,aAAa,CAChB,CAAC;AACL,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,YAAY,YAAY,EAAE;AAC3B,YAAA,MAAM,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;AAC1C,YAAA,IAAI,eAAe,EAAE;gBACjB,iBAAiB,EAAE,SAAS,CACxB;AACI,oBAAA,YAAY,EACR,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;wBAC9C,EAAE;oBACN,SAAS,EACL,eAAe,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE;AACtD,oBAAA,iBAAiB,EACb,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC;wBACzC,SAAS;AACb,oBAAA,mBAAmB,EACf,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC;wBAC3C,SAAS;oBACb,UAAU,EAAE,CAAC,CAAC,UAAU;iBAC3B,EACD,aAAa,CAChB,CAAC;AACL,aAAA;YACD,MAAM,CAAC,CAAC,KAAK,CAAC;AACjB,SAAA;QACD,IAAI,CAAC,YAAY,SAAS,EAAE;AACxB,YAAA,MAAM,CAAC,CAAC;AACX,SAAA;AAAM,aAAA;AACH,YAAA,MAAM,qBAAqB,CAACC,YAAiC,CAAC,CAAC;AAClE,SAAA;AACJ,KAAA;IAED,eAAe,CAAC,WAAW,CACvB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,CAChB,CAAC;AAEF,IAAA,OAAO,QAAQ,CAAC;AACpB;;;;"}

package/dist-browser/request/AuthenticationHeaderParser.d.ts

@@ -0,0 +1,20 @@
+/**
+ * This is a helper class that parses supported HTTP response authentication headers to extract and return
+ * header challenge values that can be used outside the basic authorization flows.
+ */
+export declare class AuthenticationHeaderParser {
+    private headers;
+    constructor(headers: Record<string, string>);
+    /**
+     * This method parses the SHR nonce value out of either the Authentication-Info or WWW-Authenticate authentication headers.
+     * @returns
+     */
+    getShrNonce(): string;
+    /**
+     * Parses an HTTP header's challenge set into a key/value map.
+     * @param header
+     * @returns
+     */
+    private parseChallenges;
+}
+//# sourceMappingURL=AuthenticationHeaderParser.d.ts.map

package/dist-browser/request/AuthenticationHeaderParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationHeaderParser.d.ts","sourceRoot":"","sources":["../../src/request/AuthenticationHeaderParser.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,qBAAa,0BAA0B;IACnC,OAAO,CAAC,OAAO,CAAyB;gBAE5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAI3C;;;OAGG;IACH,WAAW,IAAI,MAAM;IAqCrB;;;;OAIG;IACH,OAAO,CAAC,eAAe;CAa1B"}

package/dist-browser/request/AuthenticationHeaderParser.mjs

@@ -0,0 +1,64 @@
+/*! @azure/msal-common v16.0.3 2026-01-28 */
+'use strict';
+import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
+import { HeaderNames } from '../utils/Constants.mjs';
+import { invalidAuthenticationHeader, missingNonceAuthenticationHeader } from '../error/ClientConfigurationErrorCodes.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * This is a helper class that parses supported HTTP response authentication headers to extract and return
+ * header challenge values that can be used outside the basic authorization flows.
+ */
+class AuthenticationHeaderParser {
+    constructor(headers) {
+        this.headers = headers;
+    }
+    /**
+     * This method parses the SHR nonce value out of either the Authentication-Info or WWW-Authenticate authentication headers.
+     * @returns
+     */
+    getShrNonce() {
+        // Attempt to parse nonce from Authentiacation-Info
+        const authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+        if (authenticationInfo) {
+            const authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
+            if (authenticationInfoChallenges.nextnonce) {
+                return authenticationInfoChallenges.nextnonce;
+            }
+            throw createClientConfigurationError(invalidAuthenticationHeader);
+        }
+        // Attempt to parse nonce from WWW-Authenticate
+        const wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+        if (wwwAuthenticate) {
+            const wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
+            if (wwwAuthenticateChallenges.nonce) {
+                return wwwAuthenticateChallenges.nonce;
+            }
+            throw createClientConfigurationError(invalidAuthenticationHeader);
+        }
+        // If neither header is present, throw missing headers error
+        throw createClientConfigurationError(missingNonceAuthenticationHeader);
+    }
+    /**
+     * Parses an HTTP header's challenge set into a key/value map.
+     * @param header
+     * @returns
+     */
+    parseChallenges(header) {
+        const schemeSeparator = header.indexOf(" ");
+        const challenges = header.substr(schemeSeparator + 1).split(",");
+        const challengeMap = {};
+        challenges.forEach((challenge) => {
+            const [key, value] = challenge.split("=");
+            // Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
+            challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
+        });
+        return challengeMap;
+    }
+}
+
+export { AuthenticationHeaderParser };
+//# sourceMappingURL=AuthenticationHeaderParser.mjs.map

package/dist-browser/request/AuthenticationHeaderParser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationHeaderParser.mjs","sources":["../../src/request/AuthenticationHeaderParser.ts"],"sourcesContent":[null],"names":["ClientConfigurationErrorCodes.invalidAuthenticationHeader","ClientConfigurationErrorCodes.missingNonceAuthenticationHeader"],"mappings":";;;;;;AAAA;;;AAGG;AAgBH;;;AAGG;MACU,0BAA0B,CAAA;AAGnC,IAAA,WAAA,CAAY,OAA+B,EAAA;AACvC,QAAA,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;KAC1B;AAED;;;AAGG;IACH,WAAW,GAAA;;QAEP,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;AACxE,QAAA,IAAI,kBAAkB,EAAE;YACpB,MAAM,4BAA4B,GAC9B,IAAI,CAAC,eAAe,CAChB,kBAAkB,CACrB,CAAC;YACN,IAAI,4BAA4B,CAAC,SAAS,EAAE;gBACxC,OAAO,4BAA4B,CAAC,SAAS,CAAC;AACjD,aAAA;AACD,YAAA,MAAM,8BAA8B,CAChCA,2BAAyD,CAC5D,CAAC;AACL,SAAA;;QAGD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;AAClE,QAAA,IAAI,eAAe,EAAE;YACjB,MAAM,yBAAyB,GAC3B,IAAI,CAAC,eAAe,CAChB,eAAe,CAClB,CAAC;YACN,IAAI,yBAAyB,CAAC,KAAK,EAAE;gBACjC,OAAO,yBAAyB,CAAC,KAAK,CAAC;AAC1C,aAAA;AACD,YAAA,MAAM,8BAA8B,CAChCA,2BAAyD,CAC5D,CAAC;AACL,SAAA;;AAGD,QAAA,MAAM,8BAA8B,CAChCC,gCAA8D,CACjE,CAAC;KACL;AAED;;;;AAIG;AACK,IAAA,eAAe,CAAI,MAAc,EAAA;QACrC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC5C,QAAA,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,EAAO,CAAC;AAE7B,QAAA,UAAU,CAAC,OAAO,CAAC,CAAC,SAAiB,KAAI;AACrC,YAAA,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;;AAE1C,YAAA,YAAY,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9D,SAAC,CAAC,CAAC;AAEH,QAAA,OAAO,YAAY,CAAC;KACvB;AACJ;;;;"}

package/dist-browser/request/BaseAuthRequest.d.ts

@@ -0,0 +1,95 @@
+import { AuthenticationScheme, HttpMethod } from "../utils/Constants.js";
+import type { AzureCloudOptions } from "../config/ClientConfiguration.js";
+import { StringDict } from "../utils/MsalTypes.js";
+import { StoreInCache } from "./StoreInCache.js";
+import { ShrOptions } from "../crypto/SignedHttpRequest.js";
+/**
+ * BaseAuthRequest
+ */
+export type BaseAuthRequest = {
+    /**
+     * URL of the authority, the security token service (STS) from which MSAL will acquire tokens. Defaults to https://login.microsoftonline.com/common. If using the same authority for all request, authority should set on client application object and not request, to avoid resolving authority endpoints multiple times.
+     */
+    authority: string;
+    /**
+     * Unique GUID set per request to trace a request end-to-end for telemetry purposes.
+     */
+    correlationId: string;
+    /**
+     * Array of scopes the application is requesting access to.
+     */
+    scopes: Array<string>;
+    /**
+     * The type of token retrieved. Defaults to "Bearer". Can also be type "pop" or "SSH".
+     */
+    authenticationScheme?: AuthenticationScheme;
+    /**
+     * A stringified claims request which will be added to all /authorize and /token calls
+     */
+    claims?: string;
+    /**
+     * A stringified claims object which will be added to a Signed HTTP Request
+     */
+    shrClaims?: string;
+    /**
+     * A server-generated timestamp that has been encrypted and base64URL encoded, which will be added to a Signed HTTP Request.
+     */
+    shrNonce?: string;
+    /**
+     * An object containing options for the Signed HTTP Request
+     */
+    shrOptions?: ShrOptions;
+    /**
+     * HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
+     */
+    resourceRequestMethod?: string;
+    /**
+     * URI that token will be used for. Used for proof-of-possession flows.
+     */
+    resourceRequestUri?: string;
+    /**
+     * A stringified JSON Web Key representing a public key that can be signed by an SSH certificate.
+     */
+    sshJwk?: string;
+    /**
+     * Key ID that uniquely identifies the SSH public key mentioned above.
+     */
+    sshKid?: string;
+    /**
+     * Convenience string enums for users to provide public/sovereign cloud ids
+     */
+    azureCloudOptions?: AzureCloudOptions;
+    /**
+     * Maximum allowed age, in milliseconds, of the user's authentication before a new sign-in is required.
+     */
+    maxAge?: number;
+    /**
+     * Object containing boolean values indicating whether to store tokens in the cache or not (default is true)
+     */
+    storeInCache?: StoreInCache;
+    /**
+     * Scenario id to track custom user prompts
+     */
+    scenarioId?: string;
+    /**
+     * Key ID to identify the public key for PoP token request
+     */
+    popKid?: string;
+    /**
+     * Embedded client id. When specified, broker client id (brk_client_id) and redirect uri (brk_redirect_uri) params are set with values from the config, overriding the corresponding extra parameters, if present.
+     */
+    embeddedClientId?: string;
+    /**
+     * HTTP method to use for the /authorize request. Defaults to GET, but can be set to POST if the request requires body parameters.
+     */
+    httpMethod?: HttpMethod;
+    /**
+     * String to string map of custom query parameters added to outgoing token service requests. Unless the parameter is only supported on query strings use extraParameters instead
+     */
+    extraQueryParameters?: StringDict;
+    /**
+     * String to string map of custom parameters added to outgoing token service requests.
+     */
+    extraParameters?: StringDict;
+};
+//# sourceMappingURL=BaseAuthRequest.d.ts.map

package/dist-browser/request/BaseAuthRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseAuthRequest.d.ts","sourceRoot":"","sources":["../../src/request/BaseAuthRequest.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;OAEG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;OAEG;IACH,oBAAoB,CAAC,EAAE,UAAU,CAAC;IAClC;;OAEG;IACH,eAAe,CAAC,EAAE,UAAU,CAAC;CAChC,CAAC"}