@azure/msal-common 16.8.0 → 16.10.0

package/src/client/RefreshTokenClient.ts

@@ -177,13 +177,15 @@ export class RefreshTokenClient {
         // Cannot renew token if no request object is given.
         if (!request) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.tokenRequestEmpty
+                ClientConfigurationErrorCodes.tokenRequestEmpty,
+                ""
             );
         }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.noAccountInSilentRequest
+                ClientAuthErrorCodes.noAccountInSilentRequest,
+                request.correlationId
             );
         }
 
@@ -258,7 +260,8 @@ export class RefreshTokenClient {
 
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(
-                InteractionRequiredAuthErrorCodes.noTokensFound
+                InteractionRequiredAuthErrorCodes.noTokensFound,
+                request.correlationId
             );
         }
 
@@ -276,7 +279,8 @@ export class RefreshTokenClient {
 
             if (TimeUtils.isTokenExpired(refreshToken.expiresOn, offset)) {
                 throw createInteractionRequiredAuthError(
-                    InteractionRequiredAuthErrorCodes.refreshTokenExpired
+                    InteractionRequiredAuthErrorCodes.refreshTokenExpired,
+                    request.correlationId
                 );
             }
         }
@@ -407,6 +411,7 @@ export class RefreshTokenClient {
         RequestParameterBuilder.addScopes(
             parameters,
             request.scopes,
+            request.correlationId,
             true,
             this.config.authOptions.authority.options.OIDCOptions?.defaultScopes
         );
@@ -497,7 +502,8 @@ export class RefreshTokenClient {
                 RequestParameterBuilder.addSshJwk(parameters, request.sshJwk);
             } else {
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.missingSshJwk
+                    ClientConfigurationErrorCodes.missingSshJwk,
+                    request.correlationId
                 );
             }
         }
@@ -554,6 +560,7 @@ export class RefreshTokenClient {
 
         RequestParameterBuilder.addClaims(
             parameters,
+            request.correlationId,
             request.claims,
             this.config.authOptions.clientCapabilities,
             request.skipBrokerClaims

package/src/client/SilentFlowClient.ts

@@ -20,7 +20,7 @@ import { CacheRecord } from "../cache/entities/CacheRecord.js";
 import { CacheOutcome } from "../utils/Constants.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
 import { StringUtils } from "../utils/StringUtils.js";
-import { checkMaxAge, extractTokenClaims } from "../account/AuthToken.js";
+import { extractTokenClaims } from "../account/AuthToken.js";
 import { TokenClaims } from "../account/TokenClaims.js";
 import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
 import { invokeAsync } from "../utils/FunctionWrappers.js";
@@ -106,20 +106,25 @@ export class SilentFlowClient {
                 request.correlationId
             );
             throw createClientAuthError(
-                ClientAuthErrorCodes.tokenRefreshRequired
+                ClientAuthErrorCodes.tokenRefreshRequired,
+                request.correlationId
             );
         }
 
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.noAccountInSilentRequest
+                ClientAuthErrorCodes.noAccountInSilentRequest,
+                request.correlationId
             );
         }
 
         const requestTenantId =
             request.account.tenantId ||
-            getTenantFromAuthorityString(request.authority);
+            getTenantFromAuthorityString(
+                request.authority,
+                request.correlationId
+            );
         const tokenKeys = this.cacheManager.getTokenKeys();
         const cachedAccessToken = this.cacheManager.getAccessToken(
             request.account,
@@ -135,7 +140,8 @@ export class SilentFlowClient {
                 request.correlationId
             );
             throw createClientAuthError(
-                ClientAuthErrorCodes.tokenRefreshRequired
+                ClientAuthErrorCodes.tokenRefreshRequired,
+                request.correlationId
             );
         } else if (
             TimeUtils.wasClockTurnedBack(cachedAccessToken.cachedAt) ||
@@ -150,7 +156,8 @@ export class SilentFlowClient {
                 request.correlationId
             );
             throw createClientAuthError(
-                ClientAuthErrorCodes.tokenRefreshRequired
+                ClientAuthErrorCodes.tokenRefreshRequired,
+                request.correlationId
             );
         } else if (request.resource) {
             // cached access token must have a resource that matches the request resource for MCP scenarios
@@ -160,7 +167,8 @@ export class SilentFlowClient {
                     request.correlationId
                 );
                 throw createClientAuthError(
-                    ClientAuthErrorCodes.tokenRefreshRequired
+                    ClientAuthErrorCodes.tokenRefreshRequired,
+                    request.correlationId
                 );
             }
         } else if (
@@ -243,22 +251,11 @@ export class SilentFlowClient {
         if (cacheRecord.idToken) {
             idTokenClaims = extractTokenClaims(
                 cacheRecord.idToken.secret,
-                this.config.cryptoInterface.base64Decode
+                this.config.cryptoInterface.base64Decode,
+                request.correlationId
             );
         }
 
-        // token max_age check
-        if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenClaims?.auth_time;
-            if (!authTime) {
-                throw createClientAuthError(
-                    ClientAuthErrorCodes.authTimeNotFound
-                );
-            }
-
-            checkMaxAge(authTime, request.maxAge);
-        }
-
         return ResponseHandler.generateAuthenticationResult(
             this.cryptoUtils,
             this.authority,

package/src/config/ClientConfiguration.ts

@@ -11,7 +11,7 @@ import {
     DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
     SKU,
 } from "../utils/Constants.js";
-import { version } from "../packageMetadata.js";
+import { version, name } from "../packageMetadata.js";
 import type { Authority } from "../authority/Authority.js";
 import { AzureCloudInstance } from "../authority/AuthorityOptions.js";
 import { CacheManager, DefaultStorageClass } from "../cache/CacheManager.js";
@@ -56,6 +56,9 @@ export type ClientConfiguration = {
     serializableCache?: ISerializableTokenCache | null;
 };
 
+/**
+ * @internal
+ */
 export type CommonClientConfiguration = {
     authOptions: Required<AuthOptions>;
     systemOptions: Required<SystemOptions>;
@@ -171,10 +174,16 @@ const DEFAULT_LOGGER_IMPLEMENTATION: Required<LoggerOptions> = {
 
 const DEFAULT_NETWORK_IMPLEMENTATION: INetworkModule = {
     async sendGetRequestAsync<T>(): Promise<T> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async sendPostRequestAsync<T>(): Promise<T> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
 };
 
@@ -208,6 +217,7 @@ const DEFAULT_TELEMETRY_OPTIONS: Required<TelemetryOptions> = {
  * @param Configuration
  *
  * @returns Configuration
+ * @internal
  */
 export function buildClientConfiguration({
     authOptions: userAuthOptions,
@@ -237,7 +247,7 @@ export function buildClientConfiguration({
             new DefaultStorageClass(
                 userAuthOptions.clientId,
                 DEFAULT_CRYPTO_IMPLEMENTATION,
-                new Logger(loggerOptions),
+                new Logger(loggerOptions, name, version),
                 new StubPerformanceClient()
             ),
         networkInterface:

package/src/constants/AADServerParamKeys.ts

@@ -63,3 +63,8 @@ export const EAR_JWK = "ear_jwk";
 export const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 export const RESOURCE = "resource";
 export const CLI_DATA = "clidata";
+export const USER_FEDERATED_IDENTITY_CREDENTIAL =
+    "user_federated_identity_credential";
+export const USERNAME = "username";
+export const USER_ID = "user_id";
+export const FMI_PATH = "fmi_path";

package/src/crypto/ICrypto.ts

@@ -96,33 +96,63 @@ export interface ICrypto {
 
 export const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {
     createNewGuid: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     base64Decode: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     base64Encode: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     base64UrlEncode: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     encodeKid: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async getPublicKeyThumbprint(): Promise<string> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async removeTokenBindingKey(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async clearKeystore(): Promise<boolean> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async signJwt(): Promise<string> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async hashString(): Promise<string> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
 };

package/src/crypto/JoseHeader.ts

@@ -38,12 +38,18 @@ export class JoseHeader {
     static getShrHeaderString(shrHeaderOptions: JoseHeaderOptions): string {
         // KeyID is required on the SHR header
         if (!shrHeaderOptions.kid) {
-            throw createJoseHeaderError(JoseHeaderErrorCodes.missingKidError);
+            throw createJoseHeaderError(
+                JoseHeaderErrorCodes.missingKidError,
+                ""
+            );
         }
 
         // Alg is required on the SHR header
         if (!shrHeaderOptions.alg) {
-            throw createJoseHeaderError(JoseHeaderErrorCodes.missingAlgError);
+            throw createJoseHeaderError(
+                JoseHeaderErrorCodes.missingAlgError,
+                ""
+            );
         }
 
         const shrHeader = new JoseHeader({

package/src/crypto/PopTokenGenerator.ts

@@ -125,7 +125,7 @@ export class PopTokenGenerator {
         } = request;
 
         const resourceUrlString = resourceRequestUri
-            ? new UrlString(resourceRequestUri)
+            ? new UrlString(resourceRequestUri, request.correlationId)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
         return this.cryptoUtils.signJwt(

package/src/error/AuthError.ts

@@ -40,7 +40,12 @@ export class AuthError extends Error {
      */
     platformBrokerError?: PlatformBrokerError;
 
-    constructor(errorCode?: string, errorMessage?: string, suberror?: string) {
+    constructor(
+        errorCode: string,
+        correlationId: string,
+        errorMessage?: string,
+        suberror?: string
+    ) {
         const message =
             errorMessage ||
             (errorCode ? getDefaultErrorMessage(errorCode) : "");
@@ -51,20 +56,19 @@ export class AuthError extends Error {
         this.errorCode = errorCode || "";
         this.errorMessage = message || "";
         this.subError = suberror || "";
-        this.name = "AuthError";
-    }
-
-    setCorrelationId(correlationId: string): void {
         this.correlationId = correlationId;
+        this.name = "AuthError";
     }
 }
 
 export function createAuthError(
     code: string,
+    correlationId: string,
     additionalMessage?: string
 ): AuthError {
     return new AuthError(
         code,
+        correlationId,
         additionalMessage || getDefaultErrorMessage(code)
     );
 }

package/src/error/ClientAuthError.ts

@@ -15,8 +15,12 @@ export { ClientAuthErrorCodes }; // Allow importing as "ClientAuthErrorCodes";
  * Error thrown when there is an error in the client code running on the browser.
  */
 export class ClientAuthError extends AuthError {
-    constructor(errorCode: string, additionalMessage?: string) {
-        super(errorCode, additionalMessage);
+    constructor(
+        errorCode: string,
+        correlationId: string,
+        additionalMessage?: string
+    ) {
+        super(errorCode, correlationId, additionalMessage);
         this.name = "ClientAuthError";
 
         Object.setPrototypeOf(this, ClientAuthError.prototype);
@@ -25,7 +29,8 @@ export class ClientAuthError extends AuthError {
 
 export function createClientAuthError(
     errorCode: string,
+    correlationId: string,
     additionalMessage?: string
 ): ClientAuthError {
-    return new ClientAuthError(errorCode, additionalMessage);
+    return new ClientAuthError(errorCode, correlationId, additionalMessage);
 }

package/src/error/ClientAuthErrorCodes.ts

@@ -15,8 +15,6 @@ export const invalidState = "invalid_state";
 export const stateMismatch = "state_mismatch";
 export const stateNotFound = "state_not_found";
 export const nonceMismatch = "nonce_mismatch";
-export const authTimeNotFound = "auth_time_not_found";
-export const maxAgeTranspired = "max_age_transpired";
 export const multipleMatchingTokens = "multiple_matching_tokens";
 export const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
 export const requestCannotBeMade = "request_cannot_be_made";

package/src/error/ClientConfigurationError.ts

@@ -11,15 +11,16 @@ export { ClientConfigurationErrorCodes };
  * Error thrown when there is an error in configuration of the MSAL.js library.
  */
 export class ClientConfigurationError extends AuthError {
-    constructor(errorCode: string) {
-        super(errorCode);
+    constructor(errorCode: string, correlationId: string) {
+        super(errorCode, correlationId);
         this.name = "ClientConfigurationError";
         Object.setPrototypeOf(this, ClientConfigurationError.prototype);
     }
 }
 
 export function createClientConfigurationError(
-    errorCode: string
+    errorCode: string,
+    correlationId: string
 ): ClientConfigurationError {
-    return new ClientConfigurationError(errorCode);
+    return new ClientConfigurationError(errorCode, correlationId);
 }

package/src/error/InteractionRequiredAuthError.ts

@@ -61,21 +61,20 @@ export class InteractionRequiredAuthError extends AuthError {
     readonly errorNo?: string;
 
     constructor(
-        errorCode?: string,
+        errorCode: string,
+        correlationId: string,
         errorMessage?: string,
         subError?: string,
         timestamp?: string,
         traceId?: string,
-        correlationId?: string,
         claims?: string,
         errorNo?: string
     ) {
-        super(errorCode, errorMessage, subError);
+        super(errorCode, correlationId, errorMessage, subError);
         Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
 
         this.timestamp = timestamp || "";
         this.traceId = traceId || "";
-        this.correlationId = correlationId || "";
         this.claims = claims || "";
         this.name = "InteractionRequiredAuthError";
         this.errorNo = errorNo;
@@ -117,7 +116,12 @@ export function isInteractionRequiredError(
  */
 export function createInteractionRequiredAuthError(
     errorCode: string,
+    correlationId: string,
     errorMessage?: string
 ): InteractionRequiredAuthError {
-    return new InteractionRequiredAuthError(errorCode, errorMessage);
+    return new InteractionRequiredAuthError(
+        errorCode,
+        correlationId,
+        errorMessage
+    );
 }

package/src/error/JoseHeaderError.ts

@@ -11,8 +11,12 @@ export { JoseHeaderErrorCodes };
  * Error thrown when there is an error in the client code running on the browser.
  */
 export class JoseHeaderError extends AuthError {
-    constructor(errorCode: string, errorMessage?: string) {
-        super(errorCode, errorMessage);
+    constructor(
+        errorCode: string,
+        correlationId: string,
+        errorMessage?: string
+    ) {
+        super(errorCode, correlationId, errorMessage);
         this.name = "JoseHeaderError";
 
         Object.setPrototypeOf(this, JoseHeaderError.prototype);
@@ -20,6 +24,9 @@ export class JoseHeaderError extends AuthError {
 }
 
 /** Returns JoseHeaderError object */
-export function createJoseHeaderError(code: string): JoseHeaderError {
-    return new JoseHeaderError(code);
+export function createJoseHeaderError(
+    code: string,
+    correlationId: string
+): JoseHeaderError {
+    return new JoseHeaderError(code, correlationId);
 }

package/src/error/NetworkError.ts

@@ -18,7 +18,12 @@ export class NetworkError extends AuthError {
         httpStatus?: number,
         responseHeaders?: Record<string, string>
     ) {
-        super(error.errorCode, error.errorMessage, error.subError);
+        super(
+            error.errorCode,
+            error.correlationId,
+            error.errorMessage,
+            error.subError
+        );
 
         Object.setPrototypeOf(this, NetworkError.prototype);
         this.name = "NetworkError";

package/src/error/PlatformBrokerError.ts

@@ -49,6 +49,7 @@ export class PlatformBrokerError extends AuthError {
 
     constructor(
         errorStatus: string,
+        correlationId: string,
         errorContext: string,
         errorCode: number,
         errorTag: number
@@ -58,7 +59,7 @@ export class PlatformBrokerError extends AuthError {
             ? `${errorContext} (Error Code: ${errorCode}, Tag: ${tagString})`
             : `(Error Code: ${errorCode}, Tag: ${tagString})`;
 
-        super(errorStatus, enhancedErrorContext);
+        super(errorStatus, correlationId, enhancedErrorContext);
         this.name = "PlatformBrokerError";
         this.statusCode = errorCode;
         this.tag = tagString;

package/src/error/ServerError.ts

@@ -20,13 +20,14 @@ export class ServerError extends AuthError {
     readonly status?: number;
 
     constructor(
-        errorCode?: string,
+        errorCode: string,
+        correlationId: string,
         errorMessage?: string,
         subError?: string,
         errorNo?: string,
         status?: number
     ) {
-        super(errorCode, errorMessage, subError);
+        super(errorCode, correlationId, errorMessage, subError);
         this.name = "ServerError";
         this.errorNo = errorNo;
         this.status = status;

package/src/logger/Logger.ts

@@ -147,25 +147,40 @@ export function getCachedCorrelationIds(): string[] {
 }
 
 /**
- * Checks if a string is already a hashed logging string (6 alphanumeric characters)
+ * Extracts the leading minification hash from a log message, if present.
+ *
+ * Minified messages are produced by the logger-minify rollup plugin and are
+ * either a bare 6-character alphanumeric hash, or that hash followed by a space
+ * and runtime variables appended for local (console) logging, e.g.
+ * "abc123 user-1 popup". Only the leading hash is returned so that telemetry
+ * never captures the appended variables. Returns null when the message is not
+ * a minified message.
  */
-function isHashedString(str: string): boolean {
-    if (str.length !== 6) {
-        return false;
+function getMessageHash(str: string): string | null {
+    if (str.length < 6) {
+        return null;
     }
 
-    for (let i = 0; i < str.length; i++) {
+    /*
+     * If the message is longer than the hash, the hash must be delimited by a
+     * space (the separator the plugin inserts before appended variables).
+     */
+    if (str.length > 6 && str[6] !== " ") {
+        return null;
+    }
+
+    for (let i = 0; i < 6; i++) {
         const char = str[i];
         const isAlphaNumeric =
             (char >= "a" && char <= "z") ||
             (char >= "A" && char <= "Z") ||
             (char >= "0" && char <= "9");
         if (!isAlphaNumeric) {
-            return false;
+            return null;
         }
     }
 
-    return true;
+    return str.substring(0, 6);
 }
 
 /**
@@ -241,11 +256,11 @@ export class Logger {
         options: LoggerMessageOptions
     ): void {
         const correlationId = options.correlationId;
-        const isHashedInput = isHashedString(logMessage);
+        const messageHash = getMessageHash(logMessage);
 
-        if (isHashedInput) {
+        if (messageHash) {
             const loggedMessage: LoggedMessage = {
-                hash: logMessage,
+                hash: messageHash,
                 level: options.logLevel,
                 containsPii: options.containsPii || false,
                 milliseconds: 0, // Will be calculated in addLogToCache

package/src/network/INetworkModule.ts

@@ -46,14 +46,15 @@ export interface INetworkModule {
 }
 
 export const StubbedNetworkModule: INetworkModule = {
+    // Module-level singleton: no per-request correlationId available
     sendGetRequestAsync: () => {
         return Promise.reject(
-            createClientAuthError(ClientAuthErrorCodes.methodNotImplemented)
+            createClientAuthError(ClientAuthErrorCodes.methodNotImplemented, "")
         );
     },
     sendPostRequestAsync: () => {
         return Promise.reject(
-            createClientAuthError(ClientAuthErrorCodes.methodNotImplemented)
+            createClientAuthError(ClientAuthErrorCodes.methodNotImplemented, "")
         );
     },
 };

package/src/network/ThrottlingUtils.ts

@@ -45,6 +45,7 @@ export class ThrottlingUtils {
             }
             throw new ServerError(
                 value.errorCodes?.join(" ") || "",
+                correlationId,
                 value.errorMessage,
                 value.subError
             );

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.8.0";
+export const version = "16.10.0";