@azure/msal-common 16.4.1 → 16.5.1

package/lib/index-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 'use strict';
 'use strict';
 
-var indexNode = require('./index-node-5FoJ00Jc.js');
+var indexNode = require('./index-node-CJl1_QbT.js');
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/lib/{index-node-5FoJ00Jc.js → index-node-CJl1_QbT.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.4.1 2026-04-01 */
+/*! @azure/msal-common v16.5.1 2026-04-21 */
 'use strict';
 'use strict';
 
@@ -3018,6 +3018,7 @@ function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClai
             username: preferred_username || upn || "",
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            upn: upn,
         };
     }
     else {
@@ -3045,7 +3046,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     }
     // ID token claims override passed in account info and tenant profile
     if (idTokenClaims) {
-        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
         updatedAccountInfo = {
@@ -3597,18 +3598,29 @@ function addSid(parameters, sid) {
     parameters.set(SID, sid);
 }
 /**
- * add claims
- * @param claims
- */
-function addClaims(parameters, claims, clientCapabilities) {
-    const mergedClaims = addClientCapabilitiesToClaims(claims, clientCapabilities);
-    try {
-        JSON.parse(mergedClaims);
-    }
-    catch (e) {
-        throw createClientConfigurationError(invalidClaims);
+ * Adds claims to request parameters, conditionally excluding clientCapabilities
+ * when skipBrokerClaims is true and a brokered flow is in effect.
+ * @param parameters - The request parameters map
+ * @param claims - The claims string from the request
+ * @param clientCapabilities - The client capabilities from configuration
+ * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
+ */
+function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+    // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
+    const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
+        ? undefined
+        : clientCapabilities;
+    if (!StringUtils.isEmptyObj(claims) ||
+        (configClaims && configClaims.length > 0)) {
+        const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
+        try {
+            JSON.parse(mergedClaims);
+        }
+        catch (e) {
+            throw createClientConfigurationError(invalidClaims);
+        }
+        parameters.set(CLAIMS, mergedClaims);
     }
-    parameters.set(CLAIMS, mergedClaims);
 }
 /**
  * add correlationId
@@ -4253,7 +4265,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.4.1";
+const version = "16.5.1";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4439,6 +4451,19 @@ class CacheManager {
             !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
             return false;
         }
+        if (!!tenantProfileFilter.username &&
+            !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
+                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+            return false;
+        }
+        if (!!tenantProfileFilter.loginHint &&
+            !this.matchLoginHintWithTenantProfile(tenantProfile, tenantProfileFilter.loginHint)) {
+            return false;
+        }
+        if (!!tenantProfileFilter.upn &&
+            !(tenantProfile.upn === tenantProfileFilter.upn)) {
+            return false;
+        }
         return true;
     }
     idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -4453,7 +4478,8 @@ class CacheManager {
                 return false;
             }
             if (!!tenantProfileFilter.username &&
-                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {
+                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username) &&
+                !this.matchUsername(idTokenClaims.upn, tenantProfileFilter.username)) {
                 return false;
             }
             if (!!tenantProfileFilter.name &&
@@ -4554,10 +4580,6 @@ class CacheManager {
                 !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                 return;
             }
-            if (!!accountFilter.username &&
-                !this.matchUsername(entity.username, accountFilter.username)) {
-                return;
-            }
             if (!!accountFilter.environment &&
                 !this.matchEnvironment(entity, accountFilter.environment, correlationId)) {
                 return;
@@ -4578,6 +4600,9 @@ class CacheManager {
             const tenantProfileFilter = {
                 localAccountId: accountFilter?.localAccountId,
                 name: accountFilter?.name,
+                username: accountFilter?.username,
+                loginHint: accountFilter?.loginHint,
+                upn: accountFilter?.upn,
             };
             const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                 return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -4828,11 +4853,11 @@ class CacheManager {
                 const numHomeIdTokens = homeIdTokenMap.size;
                 if (numHomeIdTokens < 1) {
                     this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result", correlationId);
-                    return idTokenMap.values().next().value;
+                    return idTokenMap.values().next().value ?? null;
                 }
                 else if (numHomeIdTokens === 1) {
                     this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile", correlationId);
-                    return homeIdTokenMap.values().next().value;
+                    return homeIdTokenMap.values().next().value ?? null;
                 }
                 else {
                     // Multiple ID tokens for home tenant profile, remove all and return null
@@ -4848,7 +4873,7 @@ class CacheManager {
             return null;
         }
         this.commonLogger.info("CacheManager:getIdToken - Returning ID token", correlationId);
-        return idTokenMap.values().next().value;
+        return idTokenMap.values().next().value ?? null;
     }
     /**
      * Gets all idTokens matching the given filter
@@ -5161,6 +5186,17 @@ class CacheManager {
             typeof cachedUsername === "string" &&
             filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
     }
+    /**
+     * helper to match loginhints
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    matchLoginHintWithTenantProfile(tenantProfile, loginHintFilter) {
+        return (tenantProfile.loginHint === loginHintFilter ||
+            tenantProfile.username === loginHintFilter ||
+            tenantProfile.upn === loginHintFilter);
+    }
     /**
      * helper to match assertion
      * @param value
@@ -5253,6 +5289,10 @@ class CacheManager {
         if (tokenClaims.upn === loginHint) {
             return true;
         }
+        // check login hint against list of emails in token claims
+        if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
+            return true;
+        }
         return false;
     }
     /**
@@ -6717,11 +6757,6 @@ class AuthorizationCodeClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         let ccsCred = undefined;
         if (request.clientInfo) {
             try {
@@ -6770,6 +6805,7 @@ class AuthorizationCodeClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
     /**
@@ -7001,11 +7037,6 @@ class RefreshTokenClient {
                 throw createClientConfigurationError(missingSshJwk);
             }
         }
-        if (!StringUtils.isEmptyObj(request.claims) ||
-            (this.config.authOptions.clientCapabilities &&
-                this.config.authOptions.clientCapabilities.length > 0)) {
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities);
-        }
         if (this.config.systemOptions.preventCorsPreflight &&
             request.ccsCredential) {
             switch (request.ccsCredential.type) {
@@ -7032,6 +7063,7 @@ class RefreshTokenClient {
             });
         }
         instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
         return mapToQueryString(parameters);
     }
 }
@@ -7285,14 +7317,10 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
     if (request.state) {
         addState(parameters, request.state);
     }
-    if (request.claims ||
-        (authOptions.clientCapabilities &&
-            authOptions.clientCapabilities.length > 0)) {
-        addClaims(parameters, request.claims, authOptions.clientCapabilities);
-    }
     if (request.embeddedClientId) {
         addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
     }
+    addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
     // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
     if (authOptions.instanceAware &&
         (!request.extraQueryParameters ||
@@ -7863,4 +7891,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-5FoJ00Jc.js.map
+//# sourceMappingURL=index-node-CJl1_QbT.js.map