@azure/msal-common 16.6.2 → 16.7.0

package/dist-browser/utils/ProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 'use strict';
 import { RESOURCE_DELIM } from './Constants.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist-browser/utils/StringUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/TimeUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/UrlUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { StringUtils } from './StringUtils.mjs';

package/lib/index-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 'use strict';
 'use strict';
 
-var indexNode = require('./index-node-9_Gz5QUk.js');
+var indexNode = require('./index-node-DHSwXao8.js');
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/lib/{index-node-9_Gz5QUk.js → index-node-DHSwXao8.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.6.2 2026-05-19 */
+/*! @azure/msal-common v16.7.0 2026-06-05 */
 'use strict';
 'use strict';
 
@@ -2410,7 +2410,7 @@ class Authority {
             }
         }
         // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
-        if (this.isInKnownAuthorities()) {
+        if (this.isInKnownAuthorities(this.hostnameAndPort)) {
             this.logger.verbose("The host is included in knownAuthorities. Creating new cloud discovery metadata from the host.", this.correlationId);
             return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
         }
@@ -2478,13 +2478,14 @@ class Authority {
         return match;
     }
     /**
-     * Helper function to determine if this host is included in the knownAuthorities config option
+     * Helper function to determine if a host is included in the knownAuthorities config option.
      */
-    isInKnownAuthorities() {
+    isInKnownAuthorities(host) {
+        const normalizedHost = host.toLowerCase();
         const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
             return (authority &&
                 UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                    this.hostnameAndPort);
+                    normalizedHost);
         });
         return matches.length > 0;
     }
@@ -2561,6 +2562,10 @@ class Authority {
      *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
      *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
      *     path.
+     *  5. The issuer host is HTTPS and is explicitly listed in the
+     *     developer-configured `knownAuthorities`. This covers scenarios where
+     *     the OIDC discovery document returns an issuer host that differs from
+     *     the authority (e.g., a GUID-based issuer for a name-based CIAM authority).
      *
      * @param issuer The `issuer` value returned in the OIDC discovery document.
      * @throws ClientConfigurationError("issuer_validation_failed") on failure.
@@ -2597,11 +2602,19 @@ class Authority {
          * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
          */
         const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+        /*
+         * Rule 5: The issuer host is explicitly listed in the developer-configured
+         * knownAuthorities. This covers scenarios where the OIDC discovery document
+         * returns an issuer with a different host than the authority
+         * (e.g., a GUID-based issuer for a name-based authority).
+         */
+        const matchesKnownAuthority = issuerScheme === "https:" && this.isInKnownAuthorities(issuerHost);
         // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
         if (matchesAuthorityOrigin ||
             matchesKnownMicrosoftHost ||
             matchesRegionalMicrosoftHost ||
-            matchesCiamTenantPattern) {
+            matchesCiamTenantPattern ||
+            matchesKnownAuthority) {
             return;
         }
         // issuer validation fails if none of the above rules are satisfied
@@ -4413,7 +4426,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.6.2";
+const version = "16.7.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4602,8 +4615,8 @@ class CacheManager {
             return false;
         }
         if (!!tenantProfileFilter.username &&
-            !(this.matchUsername(tenantProfile.username, tenantProfileFilter.username) ||
-                !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username))) {
+            !this.matchUsername(tenantProfile.username, tenantProfileFilter.username) &&
+            !this.matchUsername(tenantProfile.upn, tenantProfileFilter.username)) {
             return false;
         }
         if (!!tenantProfileFilter.loginHint &&
@@ -5918,7 +5931,7 @@ const refreshTokenExpired = "refresh_token_expired";
  * MSAL-defined error code indicating UI/UX is not allowed (e.g., blocked by policy), requiring alternate interaction.
  * @public
  */
-const uxNotAllowed = "ux_not_allowed";
+const uiNotAllowed = "ui_not_allowed";
 /**
  * Server-originated error code indicating interaction is required to complete the request.
  * @public
@@ -5955,7 +5968,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     nativeAccountUnavailable: nativeAccountUnavailable,
     noTokensFound: noTokensFound,
     refreshTokenExpired: refreshTokenExpired,
-    uxNotAllowed: uxNotAllowed
+    uiNotAllowed: uiNotAllowed
 });
 
 /*
@@ -5970,7 +5983,7 @@ const InteractionRequiredServerErrorMessage = [
     consentRequired,
     loginRequired,
     badToken,
-    uxNotAllowed,
+    uiNotAllowed,
     interruptedUser,
 ];
 const InteractionRequiredAuthSubErrorMessage = [
@@ -5980,7 +5993,7 @@ const InteractionRequiredAuthSubErrorMessage = [
     "user_password_expired",
     "consent_required",
     "bad_token",
-    "ux_not_allowed",
+    "ui_not_allowed",
     "interrupted_user",
 ];
 /**
@@ -8041,4 +8054,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-9_Gz5QUk.js.map
+//# sourceMappingURL=index-node-DHSwXao8.js.map