@azure/msal-common 16.9.0 → 16.10.0

package/src/client/SilentFlowClient.ts

@@ -20,7 +20,7 @@ import { CacheRecord } from "../cache/entities/CacheRecord.js";
 import { CacheOutcome } from "../utils/Constants.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
 import { StringUtils } from "../utils/StringUtils.js";
-import { checkMaxAge, extractTokenClaims } from "../account/AuthToken.js";
+import { extractTokenClaims } from "../account/AuthToken.js";
 import { TokenClaims } from "../account/TokenClaims.js";
 import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
 import { invokeAsync } from "../utils/FunctionWrappers.js";
@@ -106,20 +106,25 @@ export class SilentFlowClient {
                 request.correlationId
             );
             throw createClientAuthError(
-                ClientAuthErrorCodes.tokenRefreshRequired
+                ClientAuthErrorCodes.tokenRefreshRequired,
+                request.correlationId
             );
         }
 
         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
         if (!request.account) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.noAccountInSilentRequest
+                ClientAuthErrorCodes.noAccountInSilentRequest,
+                request.correlationId
             );
         }
 
         const requestTenantId =
             request.account.tenantId ||
-            getTenantFromAuthorityString(request.authority);
+            getTenantFromAuthorityString(
+                request.authority,
+                request.correlationId
+            );
         const tokenKeys = this.cacheManager.getTokenKeys();
         const cachedAccessToken = this.cacheManager.getAccessToken(
             request.account,
@@ -135,7 +140,8 @@ export class SilentFlowClient {
                 request.correlationId
             );
             throw createClientAuthError(
-                ClientAuthErrorCodes.tokenRefreshRequired
+                ClientAuthErrorCodes.tokenRefreshRequired,
+                request.correlationId
             );
         } else if (
             TimeUtils.wasClockTurnedBack(cachedAccessToken.cachedAt) ||
@@ -150,7 +156,8 @@ export class SilentFlowClient {
                 request.correlationId
             );
             throw createClientAuthError(
-                ClientAuthErrorCodes.tokenRefreshRequired
+                ClientAuthErrorCodes.tokenRefreshRequired,
+                request.correlationId
             );
         } else if (request.resource) {
             // cached access token must have a resource that matches the request resource for MCP scenarios
@@ -160,7 +167,8 @@ export class SilentFlowClient {
                     request.correlationId
                 );
                 throw createClientAuthError(
-                    ClientAuthErrorCodes.tokenRefreshRequired
+                    ClientAuthErrorCodes.tokenRefreshRequired,
+                    request.correlationId
                 );
             }
         } else if (
@@ -243,22 +251,11 @@ export class SilentFlowClient {
         if (cacheRecord.idToken) {
             idTokenClaims = extractTokenClaims(
                 cacheRecord.idToken.secret,
-                this.config.cryptoInterface.base64Decode
+                this.config.cryptoInterface.base64Decode,
+                request.correlationId
             );
         }
 
-        // token max_age check
-        if (request.maxAge || request.maxAge === 0) {
-            const authTime = idTokenClaims?.auth_time;
-            if (!authTime) {
-                throw createClientAuthError(
-                    ClientAuthErrorCodes.authTimeNotFound
-                );
-            }
-
-            checkMaxAge(authTime, request.maxAge);
-        }
-
         return ResponseHandler.generateAuthenticationResult(
             this.cryptoUtils,
             this.authority,

package/src/config/ClientConfiguration.ts

@@ -174,10 +174,16 @@ const DEFAULT_LOGGER_IMPLEMENTATION: Required<LoggerOptions> = {
 
 const DEFAULT_NETWORK_IMPLEMENTATION: INetworkModule = {
     async sendGetRequestAsync<T>(): Promise<T> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async sendPostRequestAsync<T>(): Promise<T> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
 };
 

package/src/constants/AADServerParamKeys.ts

@@ -63,3 +63,8 @@ export const EAR_JWK = "ear_jwk";
 export const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 export const RESOURCE = "resource";
 export const CLI_DATA = "clidata";
+export const USER_FEDERATED_IDENTITY_CREDENTIAL =
+    "user_federated_identity_credential";
+export const USERNAME = "username";
+export const USER_ID = "user_id";
+export const FMI_PATH = "fmi_path";

package/src/crypto/ICrypto.ts

@@ -96,33 +96,63 @@ export interface ICrypto {
 
 export const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {
     createNewGuid: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     base64Decode: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     base64Encode: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     base64UrlEncode: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     encodeKid: (): string => {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async getPublicKeyThumbprint(): Promise<string> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async removeTokenBindingKey(): Promise<void> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async clearKeystore(): Promise<boolean> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async signJwt(): Promise<string> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
     async hashString(): Promise<string> {
-        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.methodNotImplemented,
+            ""
+        );
     },
 };

package/src/crypto/JoseHeader.ts

@@ -38,12 +38,18 @@ export class JoseHeader {
     static getShrHeaderString(shrHeaderOptions: JoseHeaderOptions): string {
         // KeyID is required on the SHR header
         if (!shrHeaderOptions.kid) {
-            throw createJoseHeaderError(JoseHeaderErrorCodes.missingKidError);
+            throw createJoseHeaderError(
+                JoseHeaderErrorCodes.missingKidError,
+                ""
+            );
         }
 
         // Alg is required on the SHR header
         if (!shrHeaderOptions.alg) {
-            throw createJoseHeaderError(JoseHeaderErrorCodes.missingAlgError);
+            throw createJoseHeaderError(
+                JoseHeaderErrorCodes.missingAlgError,
+                ""
+            );
         }
 
         const shrHeader = new JoseHeader({

package/src/crypto/PopTokenGenerator.ts

@@ -125,7 +125,7 @@ export class PopTokenGenerator {
         } = request;
 
         const resourceUrlString = resourceRequestUri
-            ? new UrlString(resourceRequestUri)
+            ? new UrlString(resourceRequestUri, request.correlationId)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
         return this.cryptoUtils.signJwt(

package/src/error/AuthError.ts

@@ -40,7 +40,12 @@ export class AuthError extends Error {
      */
     platformBrokerError?: PlatformBrokerError;
 
-    constructor(errorCode?: string, errorMessage?: string, suberror?: string) {
+    constructor(
+        errorCode: string,
+        correlationId: string,
+        errorMessage?: string,
+        suberror?: string
+    ) {
         const message =
             errorMessage ||
             (errorCode ? getDefaultErrorMessage(errorCode) : "");
@@ -51,20 +56,19 @@ export class AuthError extends Error {
         this.errorCode = errorCode || "";
         this.errorMessage = message || "";
         this.subError = suberror || "";
-        this.name = "AuthError";
-    }
-
-    setCorrelationId(correlationId: string): void {
         this.correlationId = correlationId;
+        this.name = "AuthError";
     }
 }
 
 export function createAuthError(
     code: string,
+    correlationId: string,
     additionalMessage?: string
 ): AuthError {
     return new AuthError(
         code,
+        correlationId,
         additionalMessage || getDefaultErrorMessage(code)
     );
 }

package/src/error/ClientAuthError.ts

@@ -15,8 +15,12 @@ export { ClientAuthErrorCodes }; // Allow importing as "ClientAuthErrorCodes";
  * Error thrown when there is an error in the client code running on the browser.
  */
 export class ClientAuthError extends AuthError {
-    constructor(errorCode: string, additionalMessage?: string) {
-        super(errorCode, additionalMessage);
+    constructor(
+        errorCode: string,
+        correlationId: string,
+        additionalMessage?: string
+    ) {
+        super(errorCode, correlationId, additionalMessage);
         this.name = "ClientAuthError";
 
         Object.setPrototypeOf(this, ClientAuthError.prototype);
@@ -25,7 +29,8 @@ export class ClientAuthError extends AuthError {
 
 export function createClientAuthError(
     errorCode: string,
+    correlationId: string,
     additionalMessage?: string
 ): ClientAuthError {
-    return new ClientAuthError(errorCode, additionalMessage);
+    return new ClientAuthError(errorCode, correlationId, additionalMessage);
 }

package/src/error/ClientAuthErrorCodes.ts

@@ -15,8 +15,6 @@ export const invalidState = "invalid_state";
 export const stateMismatch = "state_mismatch";
 export const stateNotFound = "state_not_found";
 export const nonceMismatch = "nonce_mismatch";
-export const authTimeNotFound = "auth_time_not_found";
-export const maxAgeTranspired = "max_age_transpired";
 export const multipleMatchingTokens = "multiple_matching_tokens";
 export const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
 export const requestCannotBeMade = "request_cannot_be_made";

package/src/error/ClientConfigurationError.ts

@@ -11,15 +11,16 @@ export { ClientConfigurationErrorCodes };
  * Error thrown when there is an error in configuration of the MSAL.js library.
  */
 export class ClientConfigurationError extends AuthError {
-    constructor(errorCode: string) {
-        super(errorCode);
+    constructor(errorCode: string, correlationId: string) {
+        super(errorCode, correlationId);
         this.name = "ClientConfigurationError";
         Object.setPrototypeOf(this, ClientConfigurationError.prototype);
     }
 }
 
 export function createClientConfigurationError(
-    errorCode: string
+    errorCode: string,
+    correlationId: string
 ): ClientConfigurationError {
-    return new ClientConfigurationError(errorCode);
+    return new ClientConfigurationError(errorCode, correlationId);
 }

package/src/error/InteractionRequiredAuthError.ts

@@ -61,21 +61,20 @@ export class InteractionRequiredAuthError extends AuthError {
     readonly errorNo?: string;
 
     constructor(
-        errorCode?: string,
+        errorCode: string,
+        correlationId: string,
         errorMessage?: string,
         subError?: string,
         timestamp?: string,
         traceId?: string,
-        correlationId?: string,
         claims?: string,
         errorNo?: string
     ) {
-        super(errorCode, errorMessage, subError);
+        super(errorCode, correlationId, errorMessage, subError);
         Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
 
         this.timestamp = timestamp || "";
         this.traceId = traceId || "";
-        this.correlationId = correlationId || "";
         this.claims = claims || "";
         this.name = "InteractionRequiredAuthError";
         this.errorNo = errorNo;
@@ -117,7 +116,12 @@ export function isInteractionRequiredError(
  */
 export function createInteractionRequiredAuthError(
     errorCode: string,
+    correlationId: string,
     errorMessage?: string
 ): InteractionRequiredAuthError {
-    return new InteractionRequiredAuthError(errorCode, errorMessage);
+    return new InteractionRequiredAuthError(
+        errorCode,
+        correlationId,
+        errorMessage
+    );
 }

package/src/error/JoseHeaderError.ts

@@ -11,8 +11,12 @@ export { JoseHeaderErrorCodes };
  * Error thrown when there is an error in the client code running on the browser.
  */
 export class JoseHeaderError extends AuthError {
-    constructor(errorCode: string, errorMessage?: string) {
-        super(errorCode, errorMessage);
+    constructor(
+        errorCode: string,
+        correlationId: string,
+        errorMessage?: string
+    ) {
+        super(errorCode, correlationId, errorMessage);
         this.name = "JoseHeaderError";
 
         Object.setPrototypeOf(this, JoseHeaderError.prototype);
@@ -20,6 +24,9 @@ export class JoseHeaderError extends AuthError {
 }
 
 /** Returns JoseHeaderError object */
-export function createJoseHeaderError(code: string): JoseHeaderError {
-    return new JoseHeaderError(code);
+export function createJoseHeaderError(
+    code: string,
+    correlationId: string
+): JoseHeaderError {
+    return new JoseHeaderError(code, correlationId);
 }

package/src/error/NetworkError.ts

@@ -18,7 +18,12 @@ export class NetworkError extends AuthError {
         httpStatus?: number,
         responseHeaders?: Record<string, string>
     ) {
-        super(error.errorCode, error.errorMessage, error.subError);
+        super(
+            error.errorCode,
+            error.correlationId,
+            error.errorMessage,
+            error.subError
+        );
 
         Object.setPrototypeOf(this, NetworkError.prototype);
         this.name = "NetworkError";

package/src/error/PlatformBrokerError.ts

@@ -49,6 +49,7 @@ export class PlatformBrokerError extends AuthError {
 
     constructor(
         errorStatus: string,
+        correlationId: string,
         errorContext: string,
         errorCode: number,
         errorTag: number
@@ -58,7 +59,7 @@ export class PlatformBrokerError extends AuthError {
             ? `${errorContext} (Error Code: ${errorCode}, Tag: ${tagString})`
             : `(Error Code: ${errorCode}, Tag: ${tagString})`;
 
-        super(errorStatus, enhancedErrorContext);
+        super(errorStatus, correlationId, enhancedErrorContext);
         this.name = "PlatformBrokerError";
         this.statusCode = errorCode;
         this.tag = tagString;

package/src/error/ServerError.ts

@@ -20,13 +20,14 @@ export class ServerError extends AuthError {
     readonly status?: number;
 
     constructor(
-        errorCode?: string,
+        errorCode: string,
+        correlationId: string,
         errorMessage?: string,
         subError?: string,
         errorNo?: string,
         status?: number
     ) {
-        super(errorCode, errorMessage, subError);
+        super(errorCode, correlationId, errorMessage, subError);
         this.name = "ServerError";
         this.errorNo = errorNo;
         this.status = status;

package/src/network/INetworkModule.ts

@@ -46,14 +46,15 @@ export interface INetworkModule {
 }
 
 export const StubbedNetworkModule: INetworkModule = {
+    // Module-level singleton: no per-request correlationId available
     sendGetRequestAsync: () => {
         return Promise.reject(
-            createClientAuthError(ClientAuthErrorCodes.methodNotImplemented)
+            createClientAuthError(ClientAuthErrorCodes.methodNotImplemented, "")
         );
     },
     sendPostRequestAsync: () => {
         return Promise.reject(
-            createClientAuthError(ClientAuthErrorCodes.methodNotImplemented)
+            createClientAuthError(ClientAuthErrorCodes.methodNotImplemented, "")
         );
     },
 };

package/src/network/ThrottlingUtils.ts

@@ -45,6 +45,7 @@ export class ThrottlingUtils {
             }
             throw new ServerError(
                 value.errorCodes?.join(" ") || "",
+                correlationId,
                 value.errorMessage,
                 value.subError
             );

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.9.0";
+export const version = "16.10.0";

package/src/protocol/Authorize.ts

@@ -61,6 +61,7 @@ export function getStandardAuthorizeRequestParameters(
     RequestParameterBuilder.addScopes(
         parameters,
         requestScopes,
+        request.correlationId,
         true,
         authOptions.authority.options.OIDCOptions?.defaultScopes
     );
@@ -249,6 +250,7 @@ export function getStandardAuthorizeRequestParameters(
 
     RequestParameterBuilder.addClaims(
         parameters,
+        request.correlationId,
         request.claims,
         authOptions.clientCapabilities,
         request.skipBrokerClaims
@@ -291,18 +293,21 @@ export function getAuthorizeUrl(
  * the client to exchange for a token in acquireToken.
  * @param serverParams
  * @param cachedState
+ * @param correlationId
  */
 export function getAuthorizationCodePayload(
     serverParams: AuthorizeResponse,
-    cachedState: string
+    cachedState: string,
+    correlationId: string
 ): AuthorizationCodePayload {
     // Get code response
-    validateAuthorizationResponse(serverParams, cachedState);
+    validateAuthorizationResponse(serverParams, cachedState, correlationId);
 
     // throw when there is no auth code in the response
     if (!serverParams.code) {
         throw createClientAuthError(
-            ClientAuthErrorCodes.authorizationCodeMissingFromServerResponse
+            ClientAuthErrorCodes.authorizationCodeMissingFromServerResponse,
+            correlationId
         );
     }
 
@@ -313,19 +318,23 @@ export function getAuthorizationCodePayload(
  * Function which validates server authorization code response.
  * @param serverResponseHash
  * @param requestState
+ * @param correlationId
  */
 export function validateAuthorizationResponse(
     serverResponse: AuthorizeResponse,
-    requestState: string
+    requestState: string,
+    correlationId: string
 ): void {
     if (!serverResponse.state || !requestState) {
         throw serverResponse.state
             ? createClientAuthError(
                   ClientAuthErrorCodes.stateNotFound,
+                  correlationId,
                   "Cached State"
               )
             : createClientAuthError(
                   ClientAuthErrorCodes.stateNotFound,
+                  correlationId,
                   "Server State"
               );
     }
@@ -338,6 +347,7 @@ export function validateAuthorizationResponse(
     } catch (e) {
         throw createClientAuthError(
             ClientAuthErrorCodes.invalidState,
+            correlationId,
             serverResponse.state
         );
     }
@@ -347,12 +357,16 @@ export function validateAuthorizationResponse(
     } catch (e) {
         throw createClientAuthError(
             ClientAuthErrorCodes.invalidState,
+            correlationId,
             serverResponse.state
         );
     }
 
     if (decodedServerResponseState !== decodedRequestState) {
-        throw createClientAuthError(ClientAuthErrorCodes.stateMismatch);
+        throw createClientAuthError(
+            ClientAuthErrorCodes.stateMismatch,
+            correlationId
+        );
     }
 
     // Check for error
@@ -371,11 +385,11 @@ export function validateAuthorizationResponse(
         ) {
             throw new InteractionRequiredAuthError(
                 serverResponse.error || "",
+                serverResponse.correlation_id || correlationId,
                 serverResponse.error_description,
                 serverResponse.suberror,
                 serverResponse.timestamp || "",
                 serverResponse.trace_id || "",
-                serverResponse.correlation_id || "",
                 serverResponse.claims || "",
                 serverErrorNo
             );
@@ -383,6 +397,7 @@ export function validateAuthorizationResponse(
 
         throw new ServerError(
             serverResponse.error || "",
+            serverResponse.correlation_id || correlationId,
             serverResponse.error_description,
             serverResponse.suberror,
             serverErrorNo

package/src/protocol/Token.ts

@@ -217,7 +217,10 @@ export async function sendPostRequest<
         if (e instanceof AuthError) {
             throw e;
         } else {
-            throw createClientAuthError(ClientAuthErrorCodes.networkError);
+            throw createClientAuthError(
+                ClientAuthErrorCodes.networkError,
+                correlationId
+            );
         }
     }
 

package/src/request/AuthenticationHeaderParser.ts

@@ -44,7 +44,8 @@ export class AuthenticationHeaderParser {
                 return authenticationInfoChallenges.nextnonce;
             }
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.invalidAuthenticationHeader
+                ClientConfigurationErrorCodes.invalidAuthenticationHeader,
+                ""
             );
         }
 
@@ -59,13 +60,15 @@ export class AuthenticationHeaderParser {
                 return wwwAuthenticateChallenges.nonce;
             }
             throw createClientConfigurationError(
-                ClientConfigurationErrorCodes.invalidAuthenticationHeader
+                ClientConfigurationErrorCodes.invalidAuthenticationHeader,
+                ""
             );
         }
 
         // If neither header is present, throw missing headers error
         throw createClientConfigurationError(
-            ClientConfigurationErrorCodes.missingNonceAuthenticationHeader
+            ClientConfigurationErrorCodes.missingNonceAuthenticationHeader,
+            ""
         );
     }
 

package/src/request/BaseAuthRequest.ts

@@ -69,6 +69,10 @@ export type BaseAuthRequest = {
     azureCloudOptions?: AzureCloudOptions;
     /**
      * Maximum allowed age, in milliseconds, of the user's authentication before a new sign-in is required.
+     * @deprecated This option no longer has any effect and will be removed in a future major version.
+     * MSAL does not validate the authentication age of returned tokens. To enforce the OIDC `max_age`
+     * parameter, send it via `extraQueryParameters` and validate the `auth_time` claim of the returned
+     * token yourself.
      */
     maxAge?: number;
     /**
@@ -130,13 +134,15 @@ export function enforceResourceParameter(
             containsResourceParam(request.extraQueryParameters))
     ) {
         throw createClientAuthError(
-            ClientAuthErrorCodes.misplacedResourceParam
+            ClientAuthErrorCodes.misplacedResourceParam,
+            request.correlationId || ""
         );
     }
 
     if (!request.resource) {
         throw createClientAuthError(
-            ClientAuthErrorCodes.resourceParameterRequired
+            ClientAuthErrorCodes.resourceParameterRequired,
+            request.correlationId || ""
         );
     }
 }