@azure/msal-common 16.2.0 → 16.4.0

package/lib/{index-node-DF7nODCX.js → index-node-5qBGS-xm.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.2.0 2026-03-02 */
+/*! @azure/msal-common v16.4.0 2026-03-18 */
 'use strict';
 'use strict';
 
@@ -88,7 +88,9 @@ const noNetworkConnectivity = "no_network_connectivity";
 const userCanceled = "user_canceled";
 const methodNotImplemented = "method_not_implemented";
 const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
-const platformBrokerError = "platform_broker_error";
+const platformBrokerError = "platform_broker_error";
+const resourceParameterRequired = "resource_parameter_required";
+const misplacedResourceParam = "misplaced_resource_parameter";
 
 var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -109,6 +111,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     keyIdMissing: keyIdMissing,
     maxAgeTranspired: maxAgeTranspired,
     methodNotImplemented: methodNotImplemented,
+    misplacedResourceParam: misplacedResourceParam,
     multipleMatchingAppMetadata: multipleMatchingAppMetadata,
     multipleMatchingTokens: multipleMatchingTokens,
     nestedAppAuthBridgeDisabled: nestedAppAuthBridgeDisabled,
@@ -122,6 +125,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     openIdConfigError: openIdConfigError,
     platformBrokerError: platformBrokerError,
     requestCannotBeMade: requestCannotBeMade,
+    resourceParameterRequired: resourceParameterRequired,
     stateMismatch: stateMismatch,
     stateNotFound: stateNotFound,
     tokenClaimsCnfRequiredForSignedJwt: tokenClaimsCnfRequiredForSignedJwt,
@@ -2870,7 +2874,9 @@ const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
-const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const EAR_JWE_CRYPTO = "ear_jwe_crypto";
+const RESOURCE = "resource";
+const CLI_DATA = "clidata";
 
 var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -2885,6 +2891,7 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     CLIENT_INFO: CLIENT_INFO,
     CLIENT_REQUEST_ID: CLIENT_REQUEST_ID,
     CLIENT_SECRET: CLIENT_SECRET,
+    CLI_DATA: CLI_DATA,
     CODE: CODE,
     CODE_CHALLENGE: CODE_CHALLENGE,
     CODE_CHALLENGE_METHOD: CODE_CHALLENGE_METHOD,
@@ -2914,6 +2921,7 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     REFRESH_TOKEN_EXPIRES_IN: REFRESH_TOKEN_EXPIRES_IN,
     REQUESTED_TOKEN_USE: REQUESTED_TOKEN_USE,
     REQ_CNF: REQ_CNF,
+    RESOURCE: RESOURCE,
     RESPONSE_MODE: RESPONSE_MODE,
     RESPONSE_TYPE: RESPONSE_TYPE,
     RETURN_SPA_CODE: RETURN_SPA_CODE,
@@ -3755,6 +3763,12 @@ function addGrantType(parameters, grantType) {
 function addClientInfo(parameters) {
     parameters.set(CLIENT_INFO$1, "1");
 }
+/**
+ * add clidata=1 to request to indicate client data support
+ */
+function addCliData(parameters) {
+    parameters.set(CLI_DATA, "1");
+}
 function addInstanceAware(parameters) {
     if (!parameters.has(INSTANCE_AWARE)) {
         parameters.set(INSTANCE_AWARE, "true");
@@ -3868,6 +3882,11 @@ function addEARParameters(parameters, jwk) {
     // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
     const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+function addResource(parameters, resource) {
+    if (resource) {
+        parameters.set(RESOURCE, resource);
+    }
 }
 
 var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
@@ -3878,6 +3897,7 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     addCcsOid: addCcsOid,
     addCcsUpn: addCcsUpn,
     addClaims: addClaims,
+    addCliData: addCliData,
     addClientAssertion: addClientAssertion,
     addClientAssertionType: addClientAssertionType,
     addClientCapabilitiesToClaims: addClientCapabilitiesToClaims,
@@ -3907,6 +3927,7 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     addRedirectUri: addRedirectUri,
     addRefreshToken: addRefreshToken,
     addRequestTokenUse: addRequestTokenUse,
+    addResource: addResource,
     addResponseMode: addResponseMode,
     addResponseType: addResponseType,
     addScopes: addScopes,
@@ -4232,7 +4253,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.2.0";
+const version = "16.4.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4311,6 +4332,11 @@ class CacheManager {
      * Gets first tenanted AccountInfo object found based on provided filters
      */
     getAccountInfoFilteredBy(accountFilter, correlationId) {
+        if (Object.keys(accountFilter).length === 0 ||
+            Object.values(accountFilter).every((value) => value === null || value === undefined || value === "")) {
+            this.commonLogger.warning("getAccountInfoFilteredBy: Account filter is empty or invalid, returning null", correlationId);
+            return null;
+        }
         const allAccounts = this.getAllAccounts(accountFilter, correlationId);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
@@ -5423,6 +5449,9 @@ const IntFields = new Set([
     "currRefreshCount",
     "expiredCacheRemovedCount",
     "upgradedCacheCount",
+    "networkRtt",
+    "redirectBridgeTimeoutMs",
+    "redirectBridgeMessageVersion",
 ]);
 
 /*
@@ -5559,6 +5588,7 @@ function buildAuthOptions(authOptions) {
         clientCapabilities: [],
         azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
         instanceAware: false,
+        isMcp: false,
         ...authOptions,
     };
 }
@@ -6076,6 +6106,11 @@ class ResponseHandler {
                 : undefined;
             // non AAD scenarios can have empty realm
             cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+            // Set resource (to be used for MCP scenarios)
+            const resource = request.resource || null;
+            if (resource) {
+                cachedAccessToken.resource = resource;
+            }
         }
         // refreshToken
         let cachedRefreshToken = null;
@@ -6629,6 +6664,7 @@ class AuthorizationCodeClient {
         }
         // Add scope array, parameter builder will add default scopes and dedupe
         addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+        addResource(parameters, request.resource);
         // add code: user set, not validated
         addAuthorizationCode(parameters, request.code);
         // Add library metadata
@@ -7046,6 +7082,13 @@ class SilentFlowClient {
             this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
             throw createClientAuthError(tokenRefreshRequired);
         }
+        else if (request.resource) {
+            // cached access token must have a resource that matches the request resource for MCP scenarios
+            if (cachedAccessToken.resource !== request.resource) {
+                this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
+                throw createClientAuthError(tokenRefreshRequired);
+            }
+        }
         else if (cachedAccessToken.refreshOn &&
             isTokenExpired(cachedAccessToken.refreshOn, 0)) {
             // must refresh (in the background) due to the refresh_in value
@@ -7136,12 +7179,15 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
         ...(request.extraScopesToConsent || []),
     ];
     addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+    addResource(parameters, request.resource);
     addRedirectUri(parameters, request.redirectUri);
     addCorrelationId(parameters, correlationId);
     // add response_mode. If not passed in it defaults to query.
     addResponseMode(parameters, request.responseMode);
     // add client_info=1
     addClientInfo(parameters);
+    // add clidata=1
+    addCliData(parameters);
     if (request.prompt) {
         addPrompt(parameters, request.prompt);
         performanceClient?.addFields({ prompt: request.prompt }, correlationId);
@@ -7342,6 +7388,37 @@ var Authorize = /*#__PURE__*/Object.freeze({
     validateAuthorizationResponse: validateAuthorizationResponse
 });
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Helper to enforce resource parameter presence in token requests when isMcp is set in the configuration.
+ * If resource parameter is set in both the request and in extraQueryParameters or extraParameters, an error will be thrown.
+ * This is used for MCP flows.
+ * @param isMcp - Flag indicating if application is an MCP app, from configuration
+ * @param request - Auth request
+ */
+function enforceResourceParameter(isMcp, request) {
+    if (!isMcp) {
+        return;
+    }
+    if (request.resource &&
+        (containsResourceParam(request.extraParameters) ||
+            containsResourceParam(request.extraQueryParameters))) {
+        throw createClientAuthError(misplacedResourceParam);
+    }
+    if (!request.resource) {
+        throw createClientAuthError(resourceParameterRequired);
+    }
+}
+function containsResourceParam(params) {
+    if (!params) {
+        return false;
+    }
+    return Object.prototype.hasOwnProperty.call(params, "resource");
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7767,6 +7844,7 @@ exports.createClientAuthError = createClientAuthError;
 exports.createClientConfigurationError = createClientConfigurationError;
 exports.createInteractionRequiredAuthError = createInteractionRequiredAuthError;
 exports.createNetworkError = createNetworkError;
+exports.enforceResourceParameter = enforceResourceParameter;
 exports.formatAuthorityUri = formatAuthorityUri;
 exports.getAndFlushLogsFromCache = getAndFlushLogsFromCache;
 exports.getClientAssertion = getClientAssertion;
@@ -7777,4 +7855,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-DF7nODCX.js.map
+//# sourceMappingURL=index-node-5qBGS-xm.js.map