@azure/msal-common 16.8.0 → 16.10.0

package/src/cache/CacheManager.ts

@@ -402,7 +402,8 @@ export abstract class CacheManager implements ICacheManager {
         if (idToken) {
             idTokenClaims = extractTokenClaims(
                 idToken.secret,
-                this.cryptoImpl.base64Decode
+                this.cryptoImpl.base64Decode,
+                correlationId
             );
 
             if (
@@ -525,6 +526,14 @@ export abstract class CacheManager implements ICacheManager {
             return false;
         }
 
+        if (
+            !!tenantProfileFilter.nativeAccountId &&
+            tenantProfile.nativeAccountId !==
+                tenantProfileFilter.nativeAccountId
+        ) {
+            return false;
+        }
+
         return true;
     }
 
@@ -601,7 +610,8 @@ export abstract class CacheManager implements ICacheManager {
     ): Promise<void> {
         if (!cacheRecord) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.invalidCacheRecord
+                ClientAuthErrorCodes.invalidCacheRecord,
+                correlationId
             );
         }
 
@@ -680,7 +690,10 @@ export abstract class CacheManager implements ICacheManager {
         };
 
         const tokenKeys = this.getTokenKeys();
-        const currentScopes = ScopeSet.fromString(credential.target);
+        const currentScopes = ScopeSet.fromString(
+            credential.target,
+            correlationId
+        );
 
         tokenKeys.accessToken.forEach((key) => {
             if (
@@ -702,7 +715,10 @@ export abstract class CacheManager implements ICacheManager {
                     correlationId
                 )
             ) {
-                const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                const tokenScopeSet = ScopeSet.fromString(
+                    tokenEntity.target,
+                    correlationId
+                );
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
                     this.removeAccessToken(key, correlationId);
                 }
@@ -759,16 +775,6 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
-            if (
-                !!accountFilter.nativeAccountId &&
-                !this.matchNativeAccountId(
-                    entity,
-                    accountFilter.nativeAccountId
-                )
-            ) {
-                return;
-            }
-
             if (
                 !!accountFilter.authorityType &&
                 !this.matchAuthorityType(entity, accountFilter.authorityType)
@@ -783,6 +789,7 @@ export abstract class CacheManager implements ICacheManager {
                 username: accountFilter?.username,
                 loginHint: accountFilter?.loginHint,
                 upn: accountFilter?.upn,
+                nativeAccountId: accountFilter?.nativeAccountId,
             };
 
             const matchingTenantProfiles = entity.tenantProfiles?.filter(
@@ -865,7 +872,10 @@ export abstract class CacheManager implements ICacheManager {
          * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
          * Resource specific refresh tokens case will be added when the support is deemed necessary
          */
-        if (!!filter.target && !this.matchTarget(entity, filter.target)) {
+        if (
+            !!filter.target &&
+            !this.matchTarget(entity, filter.target, correlationId)
+        ) {
             return false;
         }
 
@@ -889,6 +899,34 @@ export abstract class CacheManager implements ICacheManager {
             }
         }
 
+        // Additional cache key components matching (bidirectional isolation)
+        const entityComponents = entity.additionalCacheKeyComponents;
+        const filterComponents = filter.additionalCacheKeyComponents;
+        const entityHasComponents =
+            !!entityComponents && Object.keys(entityComponents).length > 0;
+        const filterHasComponents =
+            !!filterComponents && Object.keys(filterComponents).length > 0;
+
+        if (entityHasComponents !== filterHasComponents) {
+            return false;
+        }
+        if (entityHasComponents && filterHasComponents) {
+            const entityKeys = Object.keys(entityComponents).sort();
+            const filterKeys = Object.keys(filterComponents).sort();
+            if (entityKeys.length !== filterKeys.length) {
+                return false;
+            }
+            for (let i = 0; i < entityKeys.length; i++) {
+                if (
+                    entityKeys[i] !== filterKeys[i] ||
+                    entityComponents[entityKeys[i]] !==
+                        filterComponents[filterKeys[i]]
+                ) {
+                    return false;
+                }
+            }
+        }
+
         return true;
     }
 
@@ -1289,7 +1327,10 @@ export abstract class CacheManager implements ICacheManager {
             "CacheManager - getAccessToken called",
             correlationId
         );
-        const scopes = ScopeSet.createSearchScopes(request.scopes);
+        const scopes = ScopeSet.createSearchScopes(
+            request.scopes,
+            correlationId
+        );
         const authScheme =
             request.authenticationScheme ||
             Constants.AuthenticationScheme.BEARER;
@@ -1599,7 +1640,8 @@ export abstract class CacheManager implements ICacheManager {
             return null;
         } else if (numAppMetadata > 1) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.multipleMatchingAppMetadata
+                ClientAuthErrorCodes.multipleMatchingAppMetadata,
+                correlationId
             );
         }
 
@@ -1806,21 +1848,6 @@ export abstract class CacheManager implements ICacheManager {
         return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
     }
 
-    /**
-     * helper to match nativeAccountId
-     * @param entity
-     * @param nativeAccountId
-     * @returns boolean indicating the match result
-     */
-    private matchNativeAccountId(
-        entity: AccountEntity,
-        nativeAccountId: string
-    ): boolean {
-        return !!(
-            entity.nativeAccountId && nativeAccountId === entity.nativeAccountId
-        );
-    }
-
     /**
      * helper to match loginHint which can be either:
      * 1. login_hint ID token claim
@@ -1879,7 +1906,11 @@ export abstract class CacheManager implements ICacheManager {
      * @param entity
      * @param target
      */
-    private matchTarget(entity: CredentialEntity, target: ScopeSet): boolean {
+    private matchTarget(
+        entity: CredentialEntity,
+        target: ScopeSet,
+        correlationId: string
+    ): boolean {
         const isNotAccessTokenCredential =
             entity.credentialType !== Constants.CredentialType.ACCESS_TOKEN &&
             entity.credentialType !==
@@ -1889,7 +1920,10 @@ export abstract class CacheManager implements ICacheManager {
             return false;
         }
 
-        const entityScopeSet: ScopeSet = ScopeSet.fromString(entity.target);
+        const entityScopeSet: ScopeSet = ScopeSet.fromString(
+            entity.target,
+            correlationId
+        );
 
         return entityScopeSet.containsScopeSet(target);
     }
@@ -1954,72 +1988,141 @@ export abstract class CacheManager implements ICacheManager {
 /** @internal */
 export class DefaultStorageClass extends CacheManager {
     async setAccount(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAccount(): AccountEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     async setIdTokenCredential(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getIdTokenCredential(): IdTokenEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     async setAccessTokenCredential(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAccessTokenCredential(): AccessTokenEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     async setRefreshTokenCredential(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getRefreshTokenCredential(): RefreshTokenEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     setAppMetadata(): void {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAppMetadata(): AppMetadataEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     setServerTelemetry(): void {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getServerTelemetry(): ServerTelemetryEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     setAuthorityMetadata(): void {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAuthorityMetadata(): AuthorityMetadataEntity | null {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAuthorityMetadataKeys(): Array<string> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     setThrottlingCache(): void {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getThrottlingCache(): ThrottlingEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     removeItem(): boolean {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getKeys(): string[] {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAccountKeys(): string[] {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getTokenKeys(): TokenKeys {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     generateCredentialKey(): string {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     generateAccountKey(): string {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
 }

package/src/cache/entities/AccountEntity.ts

@@ -42,6 +42,10 @@ export type AccountEntity = {
     lastModificationApp?: string;
     cloudGraphHostName?: string;
     msGraphHost?: string;
+    /**
+     * @deprecated Use tenantProfiles[].nativeAccountId instead. Kept for cache downgrade compatibility.
+     * Will be removed at the next ACCOUNT_SCHEMA_VERSION bump.
+     */
     nativeAccountId?: string;
     tenantProfiles?: Array<TenantProfile>;
     /** Timestamp when the entry was last updated */

package/src/cache/entities/CredentialEntity.ts

@@ -31,6 +31,8 @@ export type CredentialEntity = {
     tokenType?: AuthenticationScheme;
     /** KeyId for PoP and SSH tokens stored in the kid claim */
     keyId?: string;
+    /** Additional cache key components for cache isolation (e.g., { fmi_path: "..." }). Stored as raw key-value pairs; a combined hash is computed at key-generation time. */
+    additionalCacheKeyComponents?: Record<string, string>;
     /** Timestamp when the entry was last updated */
     lastUpdatedAt: string;
 };

package/src/cache/interface/ICacheManager.ts

@@ -16,6 +16,7 @@ import { RefreshTokenEntity } from "../entities/RefreshTokenEntity.js";
 import { AuthorityMetadataEntity } from "../entities/AuthorityMetadataEntity.js";
 import { StoreInCache } from "../../request/StoreInCache.js";
 
+/** @internal */
 export interface ICacheManager {
     /**
      * fetch the account entity from the platform cache

package/src/cache/utils/AccountEntityUtils.ts

@@ -28,6 +28,7 @@ import { AccountEntity } from "../entities/AccountEntity.js";
 
 /**
  * Generate Account Id key component as per the schema: <home_account_id>-<environment>
+ * @internal
  */
 export function generateAccountId(accountEntity: AccountEntity): string {
     const accountId: Array<string> = [
@@ -39,6 +40,7 @@ export function generateAccountId(accountEntity: AccountEntity): string {
 
 /**
  * Returns the AccountInfo interface for this account.
+ * @internal
  */
 export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
     const tenantProfiles = accountEntity.tenantProfiles || [];
@@ -52,10 +54,18 @@ export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
             buildTenantProfile(
                 accountEntity.homeAccountId,
                 accountEntity.localAccountId,
-                accountEntity.realm
+                accountEntity.realm,
+                accountEntity.nativeAccountId
             )
         );
     }
+    // Resolve nativeAccountId from the home tenant profile first, fall back to top-level (deprecated) for old cache entries
+    const homeTenantProfile = tenantProfiles.find(
+        (tp) => tp.tenantId === accountEntity.realm
+    );
+    const nativeAccountId =
+        homeTenantProfile?.nativeAccountId || accountEntity.nativeAccountId;
+
     return {
         homeAccountId: accountEntity.homeAccountId,
         environment: accountEntity.environment,
@@ -64,7 +74,7 @@ export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
         localAccountId: accountEntity.localAccountId,
         loginHint: accountEntity.loginHint,
         name: accountEntity.name,
-        nativeAccountId: accountEntity.nativeAccountId,
+        nativeAccountId: nativeAccountId,
         authorityType: accountEntity.authorityType,
         // Deserialize tenant profiles array into a Map
         tenantProfiles: new Map(
@@ -78,6 +88,7 @@ export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
 
 /**
  * Returns true if the account entity is in single tenant format (outdated), false otherwise
+ * @internal
  */
 export function isSingleTenant(accountEntity: AccountEntity): boolean {
     return !accountEntity.tenantProfiles;
@@ -86,6 +97,7 @@ export function isSingleTenant(accountEntity: AccountEntity): boolean {
 /**
  * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
  * @param accountDetails
+ * @internal
  */
 export function createAccountEntity(
     accountDetails: {
@@ -99,6 +111,7 @@ export function createAccountEntity(
         tenantProfiles?: Array<TenantProfile>;
     },
     authority: Authority,
+    correlationId: string,
     base64Decode?: (input: string) => string
 ): AccountEntity {
     let authorityType;
@@ -126,7 +139,8 @@ export function createAccountEntity(
 
     if (!env) {
         throw createClientAuthError(
-            ClientAuthErrorCodes.invalidCacheEnvironment
+            ClientAuthErrorCodes.invalidCacheEnvironment,
+            correlationId
         );
     }
 
@@ -164,6 +178,7 @@ export function createAccountEntity(
             accountDetails.homeAccountId,
             localAccountId,
             realm,
+            accountDetails.nativeAccountId,
             accountDetails.idTokenClaims
         );
         tenantProfiles = [tenantProfile];
@@ -195,6 +210,7 @@ export function createAccountEntity(
  * @param cloudGraphHostName
  * @param msGraphHost
  * @returns
+ * @internal
  */
 export function createAccountEntityFromAccountInfo(
     accountInfo: AccountInfo,
@@ -216,9 +232,18 @@ export function createAccountEntityFromAccountInfo(
                 accountInfo.homeAccountId,
                 accountInfo.localAccountId,
                 accountInfo.tenantId,
+                accountInfo.nativeAccountId,
                 accountInfo.idTokenClaims
             )
         );
+    } else if (accountInfo.nativeAccountId) {
+        // Ensure nativeAccountId is set on the matching tenant profile
+        const matchingProfile = tenantProfiles.find(
+            (tp) => tp.tenantId === accountInfo.tenantId
+        );
+        if (matchingProfile && !matchingProfile.nativeAccountId) {
+            matchingProfile.nativeAccountId = accountInfo.nativeAccountId;
+        }
     }
     return {
         authorityType:
@@ -275,6 +300,7 @@ export function generateHomeAccountId(
 /**
  * Validates an entity: checks for all expected params
  * @param entity
+ * @internal
  */
 export function isAccountEntity(entity: object): entity is AccountEntity {
     if (!entity) {

package/src/cache/utils/CacheHelpers.ts

@@ -68,10 +68,12 @@ export function createAccessTokenEntity(
     expiresOn: number,
     extExpiresOn: number,
     base64Decode: (input: string) => string,
+    correlationId: string,
     refreshOn?: number,
     tokenType?: Constants.AuthenticationScheme,
     userAssertionHash?: string,
-    keyId?: string
+    keyId?: string,
+    additionalCacheKeyComponents?: Record<string, string>
 ): AccessTokenEntity {
     const atEntity: AccessTokenEntity = {
         homeAccountId: homeAccountId,
@@ -111,11 +113,13 @@ export function createAccessTokenEntity(
                 // Make sure keyId is present and add it to credential
                 const tokenClaims: TokenClaims | null = extractTokenClaims(
                     accessToken,
-                    base64Decode
+                    base64Decode,
+                    correlationId
                 );
                 if (!tokenClaims?.cnf?.kid) {
                     throw createClientAuthError(
-                        ClientAuthErrorCodes.tokenClaimsCnfRequiredForSignedJwt
+                        ClientAuthErrorCodes.tokenClaimsCnfRequiredForSignedJwt,
+                        correlationId
                     );
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
@@ -125,6 +129,14 @@ export function createAccessTokenEntity(
         }
     }
 
+    /* Additional cache key components for cache isolation (e.g., FMI path) */
+    if (
+        additionalCacheKeyComponents &&
+        Object.keys(additionalCacheKeyComponents).length > 0
+    ) {
+        atEntity.additionalCacheKeyComponents = additionalCacheKeyComponents;
+    }
+
     return atEntity;
 }
 
@@ -342,6 +354,7 @@ export function generateAuthorityMetadataExpiresAt(): number {
     );
 }
 
+/** @internal */
 export function updateAuthorityEndpointMetadata(
     authorityMetadata: AuthorityMetadataEntity,
     updatedValues: OpenIdConfigResponse,
@@ -356,6 +369,7 @@ export function updateAuthorityEndpointMetadata(
     authorityMetadata.jwks_uri = updatedValues.jwks_uri;
 }
 
+/** @internal */
 export function updateCloudDiscoveryMetadata(
     authorityMetadata: AuthorityMetadataEntity,
     updatedValues: CloudDiscoveryMetadata,
@@ -369,6 +383,7 @@ export function updateCloudDiscoveryMetadata(
 
 /**
  * Returns whether or not the data needs to be refreshed
+ * @internal
  */
 export function isAuthorityMetadataExpired(
     metadata: AuthorityMetadataEntity

package/src/cache/utils/CacheTypes.ts

@@ -72,6 +72,7 @@ export type TenantProfileFilter = Pick<
     | "isHomeTenant"
     | "username"
     | "upn"
+    | "nativeAccountId"
 >;
 
 /**
@@ -88,6 +89,7 @@ export type CredentialFilter = {
     userAssertionHash?: string;
     tokenType?: AuthenticationScheme;
     keyId?: string;
+    additionalCacheKeyComponents?: Record<string, string>;
 };
 
 /**

package/src/client/AuthorizationCodeClient.ts

@@ -132,7 +132,8 @@ export class AuthorizationCodeClient {
     ): Promise<AuthenticationResult> {
         if (!request.code) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.requestCannotBeMade
+                ClientAuthErrorCodes.requestCannotBeMade,
+                request.correlationId
             );
         }
 
@@ -205,7 +206,8 @@ export class AuthorizationCodeClient {
         // Throw error if logoutRequest is null/undefined
         if (!logoutRequest) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.logoutRequestEmpty
+                ClientConfigurationErrorCodes.logoutRequestEmpty,
+                ""
             );
         }
         const queryString = this.createLogoutUrlQueryString(logoutRequest);
@@ -319,7 +321,8 @@ export class AuthorizationCodeClient {
             // Just validate
             if (!request.redirectUri) {
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.redirectUriEmpty
+                    ClientConfigurationErrorCodes.redirectUriEmpty,
+                    request.correlationId
                 );
             }
         } else {
@@ -334,6 +337,7 @@ export class AuthorizationCodeClient {
         RequestParameterBuilder.addScopes(
             parameters,
             request.scopes,
+            request.correlationId,
             true,
             this.oidcDefaultScopes
         );
@@ -431,7 +435,8 @@ export class AuthorizationCodeClient {
                 RequestParameterBuilder.addSshJwk(parameters, request.sshJwk);
             } else {
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.missingSshJwk
+                    ClientConfigurationErrorCodes.missingSshJwk,
+                    request.correlationId
                 );
             }
         }
@@ -519,6 +524,7 @@ export class AuthorizationCodeClient {
 
         RequestParameterBuilder.addClaims(
             parameters,
+            request.correlationId,
             request.claims,
             this.config.authOptions.clientCapabilities,
             request.skipBrokerClaims