@azure/msal-common 16.9.0 → 16.10.0

package/src/cache/CacheManager.ts

@@ -402,7 +402,8 @@ export abstract class CacheManager implements ICacheManager {
         if (idToken) {
             idTokenClaims = extractTokenClaims(
                 idToken.secret,
-                this.cryptoImpl.base64Decode
+                this.cryptoImpl.base64Decode,
+                correlationId
             );
 
             if (
@@ -525,6 +526,14 @@ export abstract class CacheManager implements ICacheManager {
             return false;
         }
 
+        if (
+            !!tenantProfileFilter.nativeAccountId &&
+            tenantProfile.nativeAccountId !==
+                tenantProfileFilter.nativeAccountId
+        ) {
+            return false;
+        }
+
         return true;
     }
 
@@ -601,7 +610,8 @@ export abstract class CacheManager implements ICacheManager {
     ): Promise<void> {
         if (!cacheRecord) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.invalidCacheRecord
+                ClientAuthErrorCodes.invalidCacheRecord,
+                correlationId
             );
         }
 
@@ -680,7 +690,10 @@ export abstract class CacheManager implements ICacheManager {
         };
 
         const tokenKeys = this.getTokenKeys();
-        const currentScopes = ScopeSet.fromString(credential.target);
+        const currentScopes = ScopeSet.fromString(
+            credential.target,
+            correlationId
+        );
 
         tokenKeys.accessToken.forEach((key) => {
             if (
@@ -702,7 +715,10 @@ export abstract class CacheManager implements ICacheManager {
                     correlationId
                 )
             ) {
-                const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                const tokenScopeSet = ScopeSet.fromString(
+                    tokenEntity.target,
+                    correlationId
+                );
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
                     this.removeAccessToken(key, correlationId);
                 }
@@ -759,16 +775,6 @@ export abstract class CacheManager implements ICacheManager {
                 return;
             }
 
-            if (
-                !!accountFilter.nativeAccountId &&
-                !this.matchNativeAccountId(
-                    entity,
-                    accountFilter.nativeAccountId
-                )
-            ) {
-                return;
-            }
-
             if (
                 !!accountFilter.authorityType &&
                 !this.matchAuthorityType(entity, accountFilter.authorityType)
@@ -783,6 +789,7 @@ export abstract class CacheManager implements ICacheManager {
                 username: accountFilter?.username,
                 loginHint: accountFilter?.loginHint,
                 upn: accountFilter?.upn,
+                nativeAccountId: accountFilter?.nativeAccountId,
             };
 
             const matchingTenantProfiles = entity.tenantProfiles?.filter(
@@ -865,7 +872,10 @@ export abstract class CacheManager implements ICacheManager {
          * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
          * Resource specific refresh tokens case will be added when the support is deemed necessary
          */
-        if (!!filter.target && !this.matchTarget(entity, filter.target)) {
+        if (
+            !!filter.target &&
+            !this.matchTarget(entity, filter.target, correlationId)
+        ) {
             return false;
         }
 
@@ -889,6 +899,34 @@ export abstract class CacheManager implements ICacheManager {
             }
         }
 
+        // Additional cache key components matching (bidirectional isolation)
+        const entityComponents = entity.additionalCacheKeyComponents;
+        const filterComponents = filter.additionalCacheKeyComponents;
+        const entityHasComponents =
+            !!entityComponents && Object.keys(entityComponents).length > 0;
+        const filterHasComponents =
+            !!filterComponents && Object.keys(filterComponents).length > 0;
+
+        if (entityHasComponents !== filterHasComponents) {
+            return false;
+        }
+        if (entityHasComponents && filterHasComponents) {
+            const entityKeys = Object.keys(entityComponents).sort();
+            const filterKeys = Object.keys(filterComponents).sort();
+            if (entityKeys.length !== filterKeys.length) {
+                return false;
+            }
+            for (let i = 0; i < entityKeys.length; i++) {
+                if (
+                    entityKeys[i] !== filterKeys[i] ||
+                    entityComponents[entityKeys[i]] !==
+                        filterComponents[filterKeys[i]]
+                ) {
+                    return false;
+                }
+            }
+        }
+
         return true;
     }
 
@@ -1289,7 +1327,10 @@ export abstract class CacheManager implements ICacheManager {
             "CacheManager - getAccessToken called",
             correlationId
         );
-        const scopes = ScopeSet.createSearchScopes(request.scopes);
+        const scopes = ScopeSet.createSearchScopes(
+            request.scopes,
+            correlationId
+        );
         const authScheme =
             request.authenticationScheme ||
             Constants.AuthenticationScheme.BEARER;
@@ -1599,7 +1640,8 @@ export abstract class CacheManager implements ICacheManager {
             return null;
         } else if (numAppMetadata > 1) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.multipleMatchingAppMetadata
+                ClientAuthErrorCodes.multipleMatchingAppMetadata,
+                correlationId
             );
         }
 
@@ -1806,21 +1848,6 @@ export abstract class CacheManager implements ICacheManager {
         return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
     }
 
-    /**
-     * helper to match nativeAccountId
-     * @param entity
-     * @param nativeAccountId
-     * @returns boolean indicating the match result
-     */
-    private matchNativeAccountId(
-        entity: AccountEntity,
-        nativeAccountId: string
-    ): boolean {
-        return !!(
-            entity.nativeAccountId && nativeAccountId === entity.nativeAccountId
-        );
-    }
-
     /**
      * helper to match loginHint which can be either:
      * 1. login_hint ID token claim
@@ -1879,7 +1906,11 @@ export abstract class CacheManager implements ICacheManager {
      * @param entity
      * @param target
      */
-    private matchTarget(entity: CredentialEntity, target: ScopeSet): boolean {
+    private matchTarget(
+        entity: CredentialEntity,
+        target: ScopeSet,
+        correlationId: string
+    ): boolean {
         const isNotAccessTokenCredential =
             entity.credentialType !== Constants.CredentialType.ACCESS_TOKEN &&
             entity.credentialType !==
@@ -1889,7 +1920,10 @@ export abstract class CacheManager implements ICacheManager {
             return false;
         }
 
-        const entityScopeSet: ScopeSet = ScopeSet.fromString(entity.target);
+        const entityScopeSet: ScopeSet = ScopeSet.fromString(
+            entity.target,
+            correlationId
+        );
 
         return entityScopeSet.containsScopeSet(target);
     }
@@ -1954,72 +1988,141 @@ export abstract class CacheManager implements ICacheManager {
 /** @internal */
 export class DefaultStorageClass extends CacheManager {
     async setAccount(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAccount(): AccountEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     async setIdTokenCredential(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getIdTokenCredential(): IdTokenEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     async setAccessTokenCredential(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAccessTokenCredential(): AccessTokenEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     async setRefreshTokenCredential(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getRefreshTokenCredential(): RefreshTokenEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     setAppMetadata(): void {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAppMetadata(): AppMetadataEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     setServerTelemetry(): void {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getServerTelemetry(): ServerTelemetryEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     setAuthorityMetadata(): void {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAuthorityMetadata(): AuthorityMetadataEntity | null {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAuthorityMetadataKeys(): Array<string> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     setThrottlingCache(): void {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getThrottlingCache(): ThrottlingEntity {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     removeItem(): boolean {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getKeys(): string[] {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getAccountKeys(): string[] {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     getTokenKeys(): TokenKeys {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     generateCredentialKey(): string {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
     generateAccountKey(): string {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     }
 }

package/src/cache/entities/AccountEntity.ts

@@ -42,6 +42,10 @@ export type AccountEntity = {
     lastModificationApp?: string;
     cloudGraphHostName?: string;
     msGraphHost?: string;
+    /**
+     * @deprecated Use tenantProfiles[].nativeAccountId instead. Kept for cache downgrade compatibility.
+     * Will be removed at the next ACCOUNT_SCHEMA_VERSION bump.
+     */
     nativeAccountId?: string;
     tenantProfiles?: Array<TenantProfile>;
     /** Timestamp when the entry was last updated */

package/src/cache/entities/CredentialEntity.ts

@@ -31,6 +31,8 @@ export type CredentialEntity = {
     tokenType?: AuthenticationScheme;
     /** KeyId for PoP and SSH tokens stored in the kid claim */
     keyId?: string;
+    /** Additional cache key components for cache isolation (e.g., { fmi_path: "..." }). Stored as raw key-value pairs; a combined hash is computed at key-generation time. */
+    additionalCacheKeyComponents?: Record<string, string>;
     /** Timestamp when the entry was last updated */
     lastUpdatedAt: string;
 };

package/src/cache/utils/AccountEntityUtils.ts

@@ -54,10 +54,18 @@ export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
             buildTenantProfile(
                 accountEntity.homeAccountId,
                 accountEntity.localAccountId,
-                accountEntity.realm
+                accountEntity.realm,
+                accountEntity.nativeAccountId
             )
         );
     }
+    // Resolve nativeAccountId from the home tenant profile first, fall back to top-level (deprecated) for old cache entries
+    const homeTenantProfile = tenantProfiles.find(
+        (tp) => tp.tenantId === accountEntity.realm
+    );
+    const nativeAccountId =
+        homeTenantProfile?.nativeAccountId || accountEntity.nativeAccountId;
+
     return {
         homeAccountId: accountEntity.homeAccountId,
         environment: accountEntity.environment,
@@ -66,7 +74,7 @@ export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
         localAccountId: accountEntity.localAccountId,
         loginHint: accountEntity.loginHint,
         name: accountEntity.name,
-        nativeAccountId: accountEntity.nativeAccountId,
+        nativeAccountId: nativeAccountId,
         authorityType: accountEntity.authorityType,
         // Deserialize tenant profiles array into a Map
         tenantProfiles: new Map(
@@ -103,6 +111,7 @@ export function createAccountEntity(
         tenantProfiles?: Array<TenantProfile>;
     },
     authority: Authority,
+    correlationId: string,
     base64Decode?: (input: string) => string
 ): AccountEntity {
     let authorityType;
@@ -130,7 +139,8 @@ export function createAccountEntity(
 
     if (!env) {
         throw createClientAuthError(
-            ClientAuthErrorCodes.invalidCacheEnvironment
+            ClientAuthErrorCodes.invalidCacheEnvironment,
+            correlationId
         );
     }
 
@@ -168,6 +178,7 @@ export function createAccountEntity(
             accountDetails.homeAccountId,
             localAccountId,
             realm,
+            accountDetails.nativeAccountId,
             accountDetails.idTokenClaims
         );
         tenantProfiles = [tenantProfile];
@@ -221,9 +232,18 @@ export function createAccountEntityFromAccountInfo(
                 accountInfo.homeAccountId,
                 accountInfo.localAccountId,
                 accountInfo.tenantId,
+                accountInfo.nativeAccountId,
                 accountInfo.idTokenClaims
             )
         );
+    } else if (accountInfo.nativeAccountId) {
+        // Ensure nativeAccountId is set on the matching tenant profile
+        const matchingProfile = tenantProfiles.find(
+            (tp) => tp.tenantId === accountInfo.tenantId
+        );
+        if (matchingProfile && !matchingProfile.nativeAccountId) {
+            matchingProfile.nativeAccountId = accountInfo.nativeAccountId;
+        }
     }
     return {
         authorityType:

package/src/cache/utils/CacheHelpers.ts

@@ -68,10 +68,12 @@ export function createAccessTokenEntity(
     expiresOn: number,
     extExpiresOn: number,
     base64Decode: (input: string) => string,
+    correlationId: string,
     refreshOn?: number,
     tokenType?: Constants.AuthenticationScheme,
     userAssertionHash?: string,
-    keyId?: string
+    keyId?: string,
+    additionalCacheKeyComponents?: Record<string, string>
 ): AccessTokenEntity {
     const atEntity: AccessTokenEntity = {
         homeAccountId: homeAccountId,
@@ -111,11 +113,13 @@ export function createAccessTokenEntity(
                 // Make sure keyId is present and add it to credential
                 const tokenClaims: TokenClaims | null = extractTokenClaims(
                     accessToken,
-                    base64Decode
+                    base64Decode,
+                    correlationId
                 );
                 if (!tokenClaims?.cnf?.kid) {
                     throw createClientAuthError(
-                        ClientAuthErrorCodes.tokenClaimsCnfRequiredForSignedJwt
+                        ClientAuthErrorCodes.tokenClaimsCnfRequiredForSignedJwt,
+                        correlationId
                     );
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
@@ -125,6 +129,14 @@ export function createAccessTokenEntity(
         }
     }
 
+    /* Additional cache key components for cache isolation (e.g., FMI path) */
+    if (
+        additionalCacheKeyComponents &&
+        Object.keys(additionalCacheKeyComponents).length > 0
+    ) {
+        atEntity.additionalCacheKeyComponents = additionalCacheKeyComponents;
+    }
+
     return atEntity;
 }
 

package/src/cache/utils/CacheTypes.ts

@@ -72,6 +72,7 @@ export type TenantProfileFilter = Pick<
     | "isHomeTenant"
     | "username"
     | "upn"
+    | "nativeAccountId"
 >;
 
 /**
@@ -88,6 +89,7 @@ export type CredentialFilter = {
     userAssertionHash?: string;
     tokenType?: AuthenticationScheme;
     keyId?: string;
+    additionalCacheKeyComponents?: Record<string, string>;
 };
 
 /**

package/src/client/AuthorizationCodeClient.ts

@@ -132,7 +132,8 @@ export class AuthorizationCodeClient {
     ): Promise<AuthenticationResult> {
         if (!request.code) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.requestCannotBeMade
+                ClientAuthErrorCodes.requestCannotBeMade,
+                request.correlationId
             );
         }
 
@@ -205,7 +206,8 @@ export class AuthorizationCodeClient {
         // Throw error if logoutRequest is null/undefined
         if (!logoutRequest) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.logoutRequestEmpty
+                ClientConfigurationErrorCodes.logoutRequestEmpty,
+                ""
             );
         }
         const queryString = this.createLogoutUrlQueryString(logoutRequest);
@@ -319,7 +321,8 @@ export class AuthorizationCodeClient {
             // Just validate
             if (!request.redirectUri) {
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.redirectUriEmpty
+                    ClientConfigurationErrorCodes.redirectUriEmpty,
+                    request.correlationId
                 );
             }
         } else {
@@ -334,6 +337,7 @@ export class AuthorizationCodeClient {
         RequestParameterBuilder.addScopes(
             parameters,
             request.scopes,
+            request.correlationId,
             true,
             this.oidcDefaultScopes
         );
@@ -431,7 +435,8 @@ export class AuthorizationCodeClient {
                 RequestParameterBuilder.addSshJwk(parameters, request.sshJwk);
             } else {
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.missingSshJwk
+                    ClientConfigurationErrorCodes.missingSshJwk,
+                    request.correlationId
                 );
             }
         }
@@ -519,6 +524,7 @@ export class AuthorizationCodeClient {
 
         RequestParameterBuilder.addClaims(
             parameters,
+            request.correlationId,
             request.claims,
             this.config.authOptions.clientCapabilities,
             request.skipBrokerClaims

package/src/client/RefreshTokenClient.ts

@@ -177,13 +177,15 @@ export class RefreshTokenClient {
         // Cannot renew token if no request object is given.
         if (!request) {
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.tokenRequestEmpty
+                ClientConfigurationErrorCodes.tokenRequestEmpty,
+                ""
             );
         }
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.noAccountInSilentRequest
+                ClientAuthErrorCodes.noAccountInSilentRequest,
+                request.correlationId
             );
         }
 
@@ -258,7 +260,8 @@ export class RefreshTokenClient {
 
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(
-                InteractionRequiredAuthErrorCodes.noTokensFound
+                InteractionRequiredAuthErrorCodes.noTokensFound,
+                request.correlationId
             );
         }
 
@@ -276,7 +279,8 @@ export class RefreshTokenClient {
 
             if (TimeUtils.isTokenExpired(refreshToken.expiresOn, offset)) {
                 throw createInteractionRequiredAuthError(
-                    InteractionRequiredAuthErrorCodes.refreshTokenExpired
+                    InteractionRequiredAuthErrorCodes.refreshTokenExpired,
+                    request.correlationId
                 );
             }
         }
@@ -407,6 +411,7 @@ export class RefreshTokenClient {
         RequestParameterBuilder.addScopes(
             parameters,
             request.scopes,
+            request.correlationId,
             true,
             this.config.authOptions.authority.options.OIDCOptions?.defaultScopes
         );
@@ -497,7 +502,8 @@ export class RefreshTokenClient {
                 RequestParameterBuilder.addSshJwk(parameters, request.sshJwk);
             } else {
                 throw createClientConfigurationError(
-                    ClientConfigurationErrorCodes.missingSshJwk
+                    ClientConfigurationErrorCodes.missingSshJwk,
+                    request.correlationId
                 );
             }
         }
@@ -554,6 +560,7 @@ export class RefreshTokenClient {
 
         RequestParameterBuilder.addClaims(
             parameters,
+            request.correlationId,
             request.claims,
             this.config.authOptions.clientCapabilities,
             request.skipBrokerClaims