@azure/msal-common 16.5.0 → 16.5.1

package/lib/types/cache/utils/CacheTypes.d.ts

@@ -38,7 +38,7 @@ export type AccountFilter = Omit<Partial<AccountInfo>, "idToken" | "idTokenClaim
     sid?: string;
     isHomeTenant?: boolean;
 };
-export type TenantProfileFilter = Pick<AccountFilter, "localAccountId" | "loginHint" | "name" | "sid" | "isHomeTenant" | "username">;
+export type TenantProfileFilter = Pick<AccountFilter, "localAccountId" | "loginHint" | "name" | "sid" | "isHomeTenant" | "username" | "upn">;
 /**
  * Credential: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme*>
  */

package/lib/types/cache/utils/CacheTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CacheTypes.d.ts","sourceRoot":"","sources":["../../../../src/cache/utils/CacheTypes.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3D,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACzD,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACzD,gBAAgB;AAChB,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AACjE,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACnE,gBAAgB;AAChB,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,MAAM,cAAc,GACpB,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,uBAAuB,GACvB,qBAAqB,GACrB,gBAAgB,GAChB,MAAM,CAAC;AAEb;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GACzB,aAAa,GACb,iBAAiB,GACjB,kBAAkB,CAAC;AAEzB;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC5B,OAAO,CAAC,WAAW,CAAC,EACpB,SAAS,GAAG,eAAe,CAC9B,GAAG;IACA,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAClC,aAAa,EACX,gBAAgB,GAChB,WAAW,GACX,MAAM,GACN,KAAK,GACL,cAAc,GACd,UAAU,CACf,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC"}
+{"version":3,"file":"CacheTypes.d.ts","sourceRoot":"","sources":["../../../../src/cache/utils/CacheTypes.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3D,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACzD,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACzD,gBAAgB;AAChB,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AACjE,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACnE,gBAAgB;AAChB,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,MAAM,cAAc,GACpB,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,uBAAuB,GACvB,qBAAqB,GACrB,gBAAgB,GAChB,MAAM,CAAC;AAEb;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GACzB,aAAa,GACb,iBAAiB,GACjB,kBAAkB,CAAC;AAEzB;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC5B,OAAO,CAAC,WAAW,CAAC,EACpB,SAAS,GAAG,eAAe,CAC9B,GAAG;IACA,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAClC,aAAa,EACX,gBAAgB,GAChB,WAAW,GACX,MAAM,GACN,KAAK,GACL,cAAc,GACd,UAAU,GACV,KAAK,CACV,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC"}

package/lib/types/packageMetadata.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "@azure/msal-common";
-export declare const version = "16.5.0";
+export declare const version = "16.5.1";
 //# sourceMappingURL=packageMetadata.d.ts.map

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "16.5.0",
+  "version": "16.5.1",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",

package/src/account/AccountInfo.ts

@@ -13,6 +13,7 @@ export type DataBoundary = "EU" | "None";
  * - environment            - Entity which issued the token represented by the domain of the issuer (e.g. login.microsoftonline.com)
  * - tenantId               - Full tenant or organizational id that this account belongs to
  * - username               - preferred_username claim of the id_token that represents this account
+ * - upn                    - The user's UPN used to populate the account username in cases where preferred_username is not present in the ID token claims.
  * - localAccountId         - Local, tenant-specific account identifer for this account object, usually used in legacy cases
  * - name                   - Full name for the account, including given name and family name
  * - idToken                - raw ID token
@@ -29,6 +30,7 @@ export type AccountInfo = {
     localAccountId: string;
     loginHint?: string;
     name?: string;
+    upn?: string;
     idToken?: string;
     idTokenClaims?: TokenClaims & {
         [key: string]:
@@ -50,7 +52,7 @@ export type AccountInfo = {
  */
 export type TenantProfile = Pick<
     AccountInfo,
-    "tenantId" | "localAccountId" | "name" | "username" | "loginHint"
+    "tenantId" | "localAccountId" | "name" | "username" | "loginHint" | "upn"
 > & {
     /**
      * - isHomeTenant           - True if this is the home tenant profile of the account, false if it's a guest tenant profile
@@ -123,6 +125,7 @@ export function buildTenantProfile(
             username: preferred_username || upn || "",
             loginHint: login_hint,
             isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+            upn: upn,
         };
     } else {
         return {
@@ -156,7 +159,7 @@ export function updateAccountTenantProfileData(
 
     // ID token claims override passed in account info and tenant profile
     if (idTokenClaims) {
-        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         const { isHomeTenant, ...claimsSourcedTenantProfile } =
             buildTenantProfile(

package/src/cache/CacheManager.ts

@@ -495,6 +495,39 @@ export abstract class CacheManager implements ICacheManager {
             return false;
         }
 
+        if (
+            !!tenantProfileFilter.username &&
+            !(
+                this.matchUsername(
+                    tenantProfile.username,
+                    tenantProfileFilter.username
+                ) ||
+                !this.matchUsername(
+                    tenantProfile.upn,
+                    tenantProfileFilter.username
+                )
+            )
+        ) {
+            return false;
+        }
+
+        if (
+            !!tenantProfileFilter.loginHint &&
+            !this.matchLoginHintWithTenantProfile(
+                tenantProfile,
+                tenantProfileFilter.loginHint
+            )
+        ) {
+            return false;
+        }
+
+        if (
+            !!tenantProfileFilter.upn &&
+            !(tenantProfile.upn === tenantProfileFilter.upn)
+        ) {
+            return false;
+        }
+
         return true;
     }
 
@@ -529,6 +562,10 @@ export abstract class CacheManager implements ICacheManager {
                 !this.matchUsername(
                     idTokenClaims.preferred_username,
                     tenantProfileFilter.username
+                ) &&
+                !this.matchUsername(
+                    idTokenClaims.upn,
+                    tenantProfileFilter.username
                 )
             ) {
                 return false;
@@ -707,13 +744,6 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
-            if (
-                !!accountFilter.username &&
-                !this.matchUsername(entity.username, accountFilter.username)
-            ) {
-                return;
-            }
-
             if (
                 !!accountFilter.environment &&
                 !this.matchEnvironment(
@@ -753,6 +783,9 @@ export abstract class CacheManager implements ICacheManager {
             const tenantProfileFilter: TenantProfileFilter = {
                 localAccountId: accountFilter?.localAccountId,
                 name: accountFilter?.name,
+                username: accountFilter?.username,
+                loginHint: accountFilter?.loginHint,
+                upn: accountFilter?.upn,
             };
 
             const matchingTenantProfiles = entity.tenantProfiles?.filter(
@@ -1125,13 +1158,13 @@ export abstract class CacheManager implements ICacheManager {
                         "CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result",
                         correlationId
                     );
-                    return idTokenMap.values().next().value;
+                    return idTokenMap.values().next().value ?? null;
                 } else if (numHomeIdTokens === 1) {
                     this.commonLogger.info(
                         "CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile",
                         correlationId
                     );
-                    return homeIdTokenMap.values().next().value;
+                    return homeIdTokenMap.values().next().value ?? null;
                 } else {
                     // Multiple ID tokens for home tenant profile, remove all and return null
                     tokensToBeRemoved = homeIdTokenMap;
@@ -1156,7 +1189,7 @@ export abstract class CacheManager implements ICacheManager {
             "CacheManager:getIdToken - Returning ID token",
             correlationId
         );
-        return idTokenMap.values().next().value;
+        return idTokenMap.values().next().value ?? null;
     }
 
     /**
@@ -1654,6 +1687,23 @@ export abstract class CacheManager implements ICacheManager {
         );
     }
 
+    /**
+     * helper to match loginhints
+     * @param entity
+     * @param loginHint
+     * @returns
+     */
+    private matchLoginHintWithTenantProfile(
+        tenantProfile: TenantProfile,
+        loginHintFilter: string
+    ): boolean {
+        return (
+            tenantProfile.loginHint === loginHintFilter ||
+            tenantProfile.username === loginHintFilter ||
+            tenantProfile.upn === loginHintFilter
+        );
+    }
+
     /**
      * helper to match assertion
      * @param value
@@ -1799,6 +1849,11 @@ export abstract class CacheManager implements ICacheManager {
             return true;
         }
 
+        // check login hint against list of emails in token claims
+        if (tokenClaims.emails && tokenClaims.emails.includes(loginHint)) {
+            return true;
+        }
+
         return false;
     }
 

package/src/cache/utils/CacheTypes.ts

@@ -71,6 +71,7 @@ export type TenantProfileFilter = Pick<
     | "sid"
     | "isHomeTenant"
     | "username"
+    | "upn"
 >;
 
 /**

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.5.0";
+export const version = "16.5.1";