@azure/msal-common 4.5.0 → 5.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.json +178 -0
- package/{changelog.md → CHANGELOG.md} +446 -390
- package/LICENSE +21 -21
- package/README.md +62 -61
- package/dist/_virtual/_tslib.js +1 -1
- package/dist/account/AuthToken.js +7 -7
- package/dist/account/AuthToken.js.map +1 -1
- package/dist/account/CcsCredential.js +1 -1
- package/dist/account/CcsCredential.js.map +1 -1
- package/dist/account/ClientInfo.js +10 -10
- package/dist/account/ClientInfo.js.map +1 -1
- package/dist/account/TokenClaims.d.ts +5 -0
- package/dist/account/TokenClaims.d.ts.map +1 -1
- package/dist/authority/Authority.d.ts.map +1 -1
- package/dist/authority/Authority.js +60 -54
- package/dist/authority/Authority.js.map +1 -1
- package/dist/authority/AuthorityFactory.js +9 -9
- package/dist/authority/AuthorityFactory.js.map +1 -1
- package/dist/authority/AuthorityType.js +1 -1
- package/dist/authority/AuthorityType.js.map +1 -1
- package/dist/authority/CloudInstanceDiscoveryResponse.js +1 -1
- package/dist/authority/CloudInstanceDiscoveryResponse.js.map +1 -1
- package/dist/authority/OpenIdConfigResponse.d.ts +1 -1
- package/dist/authority/OpenIdConfigResponse.d.ts.map +1 -1
- package/dist/authority/OpenIdConfigResponse.js +1 -2
- package/dist/authority/OpenIdConfigResponse.js.map +1 -1
- package/dist/authority/ProtocolMode.js +1 -1
- package/dist/authority/ProtocolMode.js.map +1 -1
- package/dist/authority/RegionDiscovery.js +9 -9
- package/dist/authority/RegionDiscovery.js.map +1 -1
- package/dist/cache/CacheManager.d.ts +23 -9
- package/dist/cache/CacheManager.d.ts.map +1 -1
- package/dist/cache/CacheManager.js +244 -114
- package/dist/cache/CacheManager.js.map +1 -1
- package/dist/cache/entities/AccessTokenEntity.d.ts +3 -2
- package/dist/cache/entities/AccessTokenEntity.d.ts.map +1 -1
- package/dist/cache/entities/AccessTokenEntity.js +23 -17
- package/dist/cache/entities/AccessTokenEntity.js.map +1 -1
- package/dist/cache/entities/AccountEntity.d.ts +2 -2
- package/dist/cache/entities/AccountEntity.d.ts.map +1 -1
- package/dist/cache/entities/AccountEntity.js +18 -18
- package/dist/cache/entities/AccountEntity.js.map +1 -1
- package/dist/cache/entities/AppMetadataEntity.js +1 -1
- package/dist/cache/entities/AppMetadataEntity.js.map +1 -1
- package/dist/cache/entities/AuthorityMetadataEntity.d.ts +1 -1
- package/dist/cache/entities/AuthorityMetadataEntity.d.ts.map +1 -1
- package/dist/cache/entities/AuthorityMetadataEntity.js +5 -6
- package/dist/cache/entities/AuthorityMetadataEntity.js.map +1 -1
- package/dist/cache/entities/CacheRecord.js +1 -1
- package/dist/cache/entities/CacheRecord.js.map +1 -1
- package/dist/cache/entities/CredentialEntity.d.ts +7 -3
- package/dist/cache/entities/CredentialEntity.d.ts.map +1 -1
- package/dist/cache/entities/CredentialEntity.js +16 -9
- package/dist/cache/entities/CredentialEntity.js.map +1 -1
- package/dist/cache/entities/IdTokenEntity.js +3 -3
- package/dist/cache/entities/IdTokenEntity.js.map +1 -1
- package/dist/cache/entities/RefreshTokenEntity.js +3 -3
- package/dist/cache/entities/RefreshTokenEntity.js.map +1 -1
- package/dist/cache/entities/ServerTelemetryEntity.js +1 -1
- package/dist/cache/entities/ServerTelemetryEntity.js.map +1 -1
- package/dist/cache/entities/ThrottlingEntity.js +1 -1
- package/dist/cache/entities/ThrottlingEntity.js.map +1 -1
- package/dist/cache/interface/ICacheManager.d.ts +5 -5
- package/dist/cache/interface/ICacheManager.d.ts.map +1 -1
- package/dist/cache/persistence/TokenCacheContext.js +3 -3
- package/dist/cache/persistence/TokenCacheContext.js.map +1 -1
- package/dist/cache/utils/CacheTypes.d.ts +4 -1
- package/dist/cache/utils/CacheTypes.d.ts.map +1 -1
- package/dist/client/AuthorizationCodeClient.d.ts +1 -1
- package/dist/client/AuthorizationCodeClient.d.ts.map +1 -1
- package/dist/client/AuthorizationCodeClient.js +56 -43
- package/dist/client/AuthorizationCodeClient.js.map +1 -1
- package/dist/client/BaseClient.js +11 -11
- package/dist/client/BaseClient.js.map +1 -1
- package/dist/client/ClientCredentialClient.d.ts.map +1 -1
- package/dist/client/ClientCredentialClient.js +24 -18
- package/dist/client/ClientCredentialClient.js.map +1 -1
- package/dist/client/DeviceCodeClient.d.ts.map +1 -1
- package/dist/client/DeviceCodeClient.js +39 -27
- package/dist/client/DeviceCodeClient.js.map +1 -1
- package/dist/client/OnBehalfOfClient.d.ts.map +1 -1
- package/dist/client/OnBehalfOfClient.js +26 -20
- package/dist/client/OnBehalfOfClient.js.map +1 -1
- package/dist/client/RefreshTokenClient.d.ts.map +1 -1
- package/dist/client/RefreshTokenClient.js +49 -32
- package/dist/client/RefreshTokenClient.js.map +1 -1
- package/dist/client/SilentFlowClient.d.ts.map +1 -1
- package/dist/client/SilentFlowClient.js +40 -35
- package/dist/client/SilentFlowClient.js.map +1 -1
- package/dist/client/UsernamePasswordClient.d.ts.map +1 -1
- package/dist/client/UsernamePasswordClient.js +18 -12
- package/dist/client/UsernamePasswordClient.js.map +1 -1
- package/dist/config/ClientConfiguration.d.ts.map +1 -1
- package/dist/config/ClientConfiguration.js +8 -7
- package/dist/config/ClientConfiguration.js.map +1 -1
- package/dist/crypto/ICrypto.d.ts +11 -1
- package/dist/crypto/ICrypto.d.ts.map +1 -1
- package/dist/crypto/ICrypto.js +26 -8
- package/dist/crypto/ICrypto.js.map +1 -1
- package/dist/crypto/PopTokenGenerator.d.ts +21 -4
- package/dist/crypto/PopTokenGenerator.d.ts.map +1 -1
- package/dist/crypto/PopTokenGenerator.js +42 -31
- package/dist/crypto/PopTokenGenerator.js.map +1 -1
- package/dist/error/AuthError.d.ts +5 -0
- package/dist/error/AuthError.d.ts.map +1 -1
- package/dist/error/AuthError.js +6 -3
- package/dist/error/AuthError.js.map +1 -1
- package/dist/error/ClientAuthError.d.ts +13 -4
- package/dist/error/ClientAuthError.d.ts.map +1 -1
- package/dist/error/ClientAuthError.js +20 -9
- package/dist/error/ClientAuthError.js.map +1 -1
- package/dist/error/ClientConfigurationError.d.ts +29 -0
- package/dist/error/ClientConfigurationError.d.ts.map +1 -1
- package/dist/error/ClientConfigurationError.js +45 -5
- package/dist/error/ClientConfigurationError.js.map +1 -1
- package/dist/error/InteractionRequiredAuthError.d.ts +24 -5
- package/dist/error/InteractionRequiredAuthError.d.ts.map +1 -1
- package/dist/error/InteractionRequiredAuthError.js +30 -9
- package/dist/error/InteractionRequiredAuthError.js.map +1 -1
- package/dist/error/ServerError.js +3 -3
- package/dist/error/ServerError.js.map +1 -1
- package/dist/index.cjs.js +675 -244
- package/dist/index.cjs.js.map +1 -1
- package/dist/index.d.ts +7 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +33 -29
- package/dist/index.js.map +1 -1
- package/dist/logger/Logger.d.ts.map +1 -1
- package/dist/logger/Logger.js +11 -9
- package/dist/logger/Logger.js.map +1 -1
- package/dist/network/INetworkModule.js +4 -4
- package/dist/network/INetworkModule.js.map +1 -1
- package/dist/network/NetworkManager.js +8 -8
- package/dist/network/NetworkManager.js.map +1 -1
- package/dist/network/RequestThumbprint.d.ts +7 -0
- package/dist/network/RequestThumbprint.d.ts.map +1 -1
- package/dist/network/ThrottlingUtils.d.ts +2 -1
- package/dist/network/ThrottlingUtils.d.ts.map +1 -1
- package/dist/network/ThrottlingUtils.js +14 -8
- package/dist/network/ThrottlingUtils.js.map +1 -1
- package/dist/packageMetadata.d.ts +1 -1
- package/dist/packageMetadata.js +2 -2
- package/dist/packageMetadata.js.map +1 -1
- package/dist/request/AuthenticationHeaderParser.d.ts +20 -0
- package/dist/request/AuthenticationHeaderParser.d.ts.map +1 -0
- package/dist/request/AuthenticationHeaderParser.js +64 -0
- package/dist/request/AuthenticationHeaderParser.js.map +1 -0
- package/dist/request/BaseAuthRequest.d.ts +7 -1
- package/dist/request/BaseAuthRequest.d.ts.map +1 -1
- package/dist/request/CommonEndSessionRequest.d.ts +4 -0
- package/dist/request/CommonEndSessionRequest.d.ts.map +1 -1
- package/dist/request/RequestParameterBuilder.d.ts +4 -0
- package/dist/request/RequestParameterBuilder.d.ts.map +1 -1
- package/dist/request/RequestParameterBuilder.js +27 -18
- package/dist/request/RequestParameterBuilder.js.map +1 -1
- package/dist/request/RequestValidator.js +10 -10
- package/dist/request/RequestValidator.js.map +1 -1
- package/dist/request/ScopeSet.js +14 -14
- package/dist/request/ScopeSet.js.map +1 -1
- package/dist/response/AuthenticationResult.d.ts +2 -1
- package/dist/response/AuthenticationResult.d.ts.map +1 -1
- package/dist/response/ExternalTokenResponse.d.ts +15 -0
- package/dist/response/ExternalTokenResponse.d.ts.map +1 -0
- package/dist/response/ResponseHandler.d.ts.map +1 -1
- package/dist/response/ResponseHandler.js +74 -69
- package/dist/response/ResponseHandler.js.map +1 -1
- package/dist/response/ServerAuthorizationTokenResponse.d.ts +5 -2
- package/dist/response/ServerAuthorizationTokenResponse.d.ts.map +1 -1
- package/dist/telemetry/server/ServerTelemetryManager.js +13 -13
- package/dist/telemetry/server/ServerTelemetryManager.js.map +1 -1
- package/dist/url/UrlString.d.ts +0 -6
- package/dist/url/UrlString.d.ts.map +1 -1
- package/dist/url/UrlString.js +25 -40
- package/dist/url/UrlString.js.map +1 -1
- package/dist/utils/Constants.d.ts +5 -2
- package/dist/utils/Constants.d.ts.map +1 -1
- package/dist/utils/Constants.js +5 -2
- package/dist/utils/Constants.js.map +1 -1
- package/dist/utils/ProtocolUtils.js +13 -13
- package/dist/utils/ProtocolUtils.js.map +1 -1
- package/dist/utils/StringUtils.d.ts.map +1 -1
- package/dist/utils/StringUtils.js +15 -14
- package/dist/utils/StringUtils.js.map +1 -1
- package/dist/utils/TimeUtils.js +1 -1
- package/dist/utils/TimeUtils.js.map +1 -1
- package/package.json +1 -1
|
@@ -1,13 +1,13 @@
|
|
|
1
|
-
/*! @azure/msal-common
|
|
1
|
+
/*! @azure/msal-common v5.1.0 2021-11-02 */
|
|
2
2
|
'use strict';
|
|
3
|
-
import { __extends } from '../_virtual/_tslib.js';
|
|
4
|
-
import { Constants
|
|
5
|
-
import {
|
|
6
|
-
import {
|
|
7
|
-
import {
|
|
8
|
-
import {
|
|
9
|
-
import {
|
|
10
|
-
import { AuthToken
|
|
3
|
+
import { __awaiter, __generator, __extends } from '../_virtual/_tslib.js';
|
|
4
|
+
import { Constants, CredentialType, AuthenticationScheme, CacheSchemaType, THE_FAMILY_ID, APP_METADATA, AUTHORITY_METADATA_CONSTANTS } from '../utils/Constants.js';
|
|
5
|
+
import { CredentialEntity } from './entities/CredentialEntity.js';
|
|
6
|
+
import { ScopeSet } from '../request/ScopeSet.js';
|
|
7
|
+
import { AccountEntity } from './entities/AccountEntity.js';
|
|
8
|
+
import { AuthError } from '../error/AuthError.js';
|
|
9
|
+
import { ClientAuthError } from '../error/ClientAuthError.js';
|
|
10
|
+
import { AuthToken } from '../account/AuthToken.js';
|
|
11
11
|
|
|
12
12
|
/*
|
|
13
13
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
@@ -34,11 +34,11 @@ var CacheManager = /** @class */ (function () {
|
|
|
34
34
|
}
|
|
35
35
|
else {
|
|
36
36
|
var allAccounts = accountValues.map(function (value) {
|
|
37
|
-
var accountEntity = CacheManager.toObject(new AccountEntity
|
|
37
|
+
var accountEntity = CacheManager.toObject(new AccountEntity(), value);
|
|
38
38
|
var accountInfo = accountEntity.getAccountInfo();
|
|
39
39
|
var idToken = _this.readIdTokenFromCache(_this.clientId, accountInfo);
|
|
40
40
|
if (idToken && !accountInfo.idTokenClaims) {
|
|
41
|
-
accountInfo.idTokenClaims = new AuthToken
|
|
41
|
+
accountInfo.idTokenClaims = new AuthToken(idToken.secret, _this.cryptoImpl).claims;
|
|
42
42
|
}
|
|
43
43
|
return accountInfo;
|
|
44
44
|
});
|
|
@@ -50,49 +50,75 @@ var CacheManager = /** @class */ (function () {
|
|
|
50
50
|
* @param cacheRecord
|
|
51
51
|
*/
|
|
52
52
|
CacheManager.prototype.saveCacheRecord = function (cacheRecord) {
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
53
|
+
return __awaiter(this, void 0, void 0, function () {
|
|
54
|
+
return __generator(this, function (_a) {
|
|
55
|
+
switch (_a.label) {
|
|
56
|
+
case 0:
|
|
57
|
+
if (!cacheRecord) {
|
|
58
|
+
throw ClientAuthError.createNullOrUndefinedCacheRecord();
|
|
59
|
+
}
|
|
60
|
+
if (!!cacheRecord.account) {
|
|
61
|
+
this.setAccount(cacheRecord.account);
|
|
62
|
+
}
|
|
63
|
+
if (!!cacheRecord.idToken) {
|
|
64
|
+
this.setIdTokenCredential(cacheRecord.idToken);
|
|
65
|
+
}
|
|
66
|
+
if (!!!cacheRecord.accessToken) return [3 /*break*/, 2];
|
|
67
|
+
return [4 /*yield*/, this.saveAccessToken(cacheRecord.accessToken)];
|
|
68
|
+
case 1:
|
|
69
|
+
_a.sent();
|
|
70
|
+
_a.label = 2;
|
|
71
|
+
case 2:
|
|
72
|
+
if (!!cacheRecord.refreshToken) {
|
|
73
|
+
this.setRefreshTokenCredential(cacheRecord.refreshToken);
|
|
74
|
+
}
|
|
75
|
+
if (!!cacheRecord.appMetadata) {
|
|
76
|
+
this.setAppMetadata(cacheRecord.appMetadata);
|
|
77
|
+
}
|
|
78
|
+
return [2 /*return*/];
|
|
79
|
+
}
|
|
80
|
+
});
|
|
81
|
+
});
|
|
71
82
|
};
|
|
72
83
|
/**
|
|
73
84
|
* saves access token credential
|
|
74
85
|
* @param credential
|
|
75
86
|
*/
|
|
76
87
|
CacheManager.prototype.saveAccessToken = function (credential) {
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
88
|
+
return __awaiter(this, void 0, void 0, function () {
|
|
89
|
+
var currentTokenCache, currentScopes, currentAccessTokens, removedAccessTokens_1;
|
|
90
|
+
var _this = this;
|
|
91
|
+
return __generator(this, function (_a) {
|
|
92
|
+
switch (_a.label) {
|
|
93
|
+
case 0:
|
|
94
|
+
currentTokenCache = this.getCredentialsFilteredBy({
|
|
95
|
+
clientId: credential.clientId,
|
|
96
|
+
credentialType: credential.credentialType,
|
|
97
|
+
environment: credential.environment,
|
|
98
|
+
homeAccountId: credential.homeAccountId,
|
|
99
|
+
realm: credential.realm,
|
|
100
|
+
tokenType: credential.tokenType
|
|
101
|
+
});
|
|
102
|
+
currentScopes = ScopeSet.fromString(credential.target);
|
|
103
|
+
currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
|
|
104
|
+
if (!currentAccessTokens) return [3 /*break*/, 2];
|
|
105
|
+
removedAccessTokens_1 = [];
|
|
106
|
+
currentAccessTokens.forEach(function (tokenEntity) {
|
|
107
|
+
var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
|
|
108
|
+
if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
|
|
109
|
+
removedAccessTokens_1.push(_this.removeCredential(tokenEntity));
|
|
110
|
+
}
|
|
111
|
+
});
|
|
112
|
+
return [4 /*yield*/, Promise.all(removedAccessTokens_1)];
|
|
113
|
+
case 1:
|
|
114
|
+
_a.sent();
|
|
115
|
+
_a.label = 2;
|
|
116
|
+
case 2:
|
|
117
|
+
this.setAccessTokenCredential(credential);
|
|
118
|
+
return [2 /*return*/];
|
|
92
119
|
}
|
|
93
120
|
});
|
|
94
|
-
}
|
|
95
|
-
this.setAccessTokenCredential(credential);
|
|
121
|
+
});
|
|
96
122
|
};
|
|
97
123
|
/**
|
|
98
124
|
* retrieve accounts matching all provided filters; if no filter is set, get all accounts
|
|
@@ -143,7 +169,7 @@ var CacheManager = /** @class */ (function () {
|
|
|
143
169
|
* @param target
|
|
144
170
|
*/
|
|
145
171
|
CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
|
|
146
|
-
return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion);
|
|
172
|
+
return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId);
|
|
147
173
|
};
|
|
148
174
|
/**
|
|
149
175
|
* Support function to help match credentials
|
|
@@ -153,8 +179,10 @@ var CacheManager = /** @class */ (function () {
|
|
|
153
179
|
* @param clientId
|
|
154
180
|
* @param realm
|
|
155
181
|
* @param target
|
|
182
|
+
* @param oboAssertion
|
|
183
|
+
* @param tokenType
|
|
156
184
|
*/
|
|
157
|
-
CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion) {
|
|
185
|
+
CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId) {
|
|
158
186
|
var _this = this;
|
|
159
187
|
var allCacheKeys = this.getKeys();
|
|
160
188
|
var matchingCredentials = {
|
|
@@ -164,8 +192,8 @@ var CacheManager = /** @class */ (function () {
|
|
|
164
192
|
};
|
|
165
193
|
allCacheKeys.forEach(function (cacheKey) {
|
|
166
194
|
// don't parse any non-credential type cache entities
|
|
167
|
-
var credType = CredentialEntity
|
|
168
|
-
if (credType === Constants
|
|
195
|
+
var credType = CredentialEntity.getCredentialType(cacheKey);
|
|
196
|
+
if (credType === Constants.NOT_DEFINED) {
|
|
169
197
|
return;
|
|
170
198
|
}
|
|
171
199
|
// Attempt retrieval
|
|
@@ -201,6 +229,28 @@ var CacheManager = /** @class */ (function () {
|
|
|
201
229
|
if (!!target && !_this.matchTarget(entity, target)) {
|
|
202
230
|
return;
|
|
203
231
|
}
|
|
232
|
+
// Access Token with Auth Scheme specific matching
|
|
233
|
+
if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
|
|
234
|
+
if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
|
|
235
|
+
return;
|
|
236
|
+
}
|
|
237
|
+
switch (tokenType) {
|
|
238
|
+
case AuthenticationScheme.POP:
|
|
239
|
+
// This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
|
|
240
|
+
if (cacheKey.indexOf(AuthenticationScheme.POP) === -1) {
|
|
241
|
+
// AccessToken_With_AuthScheme that doesn't have "-pop" in the key is outdated and needs to be removed
|
|
242
|
+
_this.removeItem(cacheKey, CacheSchemaType.CREDENTIAL);
|
|
243
|
+
return;
|
|
244
|
+
}
|
|
245
|
+
break;
|
|
246
|
+
case AuthenticationScheme.SSH:
|
|
247
|
+
// KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
|
|
248
|
+
if (keyId && !_this.matchKeyId(entity, keyId)) {
|
|
249
|
+
return;
|
|
250
|
+
}
|
|
251
|
+
break;
|
|
252
|
+
}
|
|
253
|
+
}
|
|
204
254
|
switch (credType) {
|
|
205
255
|
case CredentialType.ID_TOKEN:
|
|
206
256
|
matchingCredentials.idTokens[cacheKey] = entity;
|
|
@@ -281,56 +331,112 @@ var CacheManager = /** @class */ (function () {
|
|
|
281
331
|
* Removes all accounts and related tokens from cache.
|
|
282
332
|
*/
|
|
283
333
|
CacheManager.prototype.removeAllAccounts = function () {
|
|
284
|
-
|
|
285
|
-
|
|
286
|
-
|
|
287
|
-
|
|
288
|
-
|
|
289
|
-
|
|
290
|
-
|
|
291
|
-
|
|
334
|
+
return __awaiter(this, void 0, void 0, function () {
|
|
335
|
+
var allCacheKeys, removedAccounts;
|
|
336
|
+
var _this = this;
|
|
337
|
+
return __generator(this, function (_a) {
|
|
338
|
+
switch (_a.label) {
|
|
339
|
+
case 0:
|
|
340
|
+
allCacheKeys = this.getKeys();
|
|
341
|
+
removedAccounts = [];
|
|
342
|
+
allCacheKeys.forEach(function (cacheKey) {
|
|
343
|
+
var entity = _this.getAccount(cacheKey);
|
|
344
|
+
if (!entity) {
|
|
345
|
+
return;
|
|
346
|
+
}
|
|
347
|
+
removedAccounts.push(_this.removeAccount(cacheKey));
|
|
348
|
+
});
|
|
349
|
+
return [4 /*yield*/, Promise.all(removedAccounts)];
|
|
350
|
+
case 1:
|
|
351
|
+
_a.sent();
|
|
352
|
+
return [2 /*return*/, true];
|
|
353
|
+
}
|
|
354
|
+
});
|
|
292
355
|
});
|
|
293
|
-
return true;
|
|
294
356
|
};
|
|
295
357
|
/**
|
|
296
358
|
* returns a boolean if the given account is removed
|
|
297
359
|
* @param account
|
|
298
360
|
*/
|
|
299
361
|
CacheManager.prototype.removeAccount = function (accountKey) {
|
|
300
|
-
|
|
301
|
-
|
|
302
|
-
|
|
303
|
-
|
|
304
|
-
|
|
362
|
+
return __awaiter(this, void 0, void 0, function () {
|
|
363
|
+
var account;
|
|
364
|
+
return __generator(this, function (_a) {
|
|
365
|
+
switch (_a.label) {
|
|
366
|
+
case 0:
|
|
367
|
+
account = this.getAccount(accountKey);
|
|
368
|
+
if (!account) {
|
|
369
|
+
throw ClientAuthError.createNoAccountFoundError();
|
|
370
|
+
}
|
|
371
|
+
return [4 /*yield*/, this.removeAccountContext(account)];
|
|
372
|
+
case 1: return [2 /*return*/, ((_a.sent()) && this.removeItem(accountKey, CacheSchemaType.ACCOUNT))];
|
|
373
|
+
}
|
|
374
|
+
});
|
|
375
|
+
});
|
|
305
376
|
};
|
|
306
377
|
/**
|
|
307
378
|
* returns a boolean if the given account is removed
|
|
308
379
|
* @param account
|
|
309
380
|
*/
|
|
310
381
|
CacheManager.prototype.removeAccountContext = function (account) {
|
|
311
|
-
|
|
312
|
-
|
|
313
|
-
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
|
|
319
|
-
|
|
320
|
-
|
|
321
|
-
|
|
322
|
-
|
|
323
|
-
|
|
382
|
+
return __awaiter(this, void 0, void 0, function () {
|
|
383
|
+
var allCacheKeys, accountId, removedCredentials;
|
|
384
|
+
var _this = this;
|
|
385
|
+
return __generator(this, function (_a) {
|
|
386
|
+
switch (_a.label) {
|
|
387
|
+
case 0:
|
|
388
|
+
allCacheKeys = this.getKeys();
|
|
389
|
+
accountId = account.generateAccountId();
|
|
390
|
+
removedCredentials = [];
|
|
391
|
+
allCacheKeys.forEach(function (cacheKey) {
|
|
392
|
+
// don't parse any non-credential type cache entities
|
|
393
|
+
var credType = CredentialEntity.getCredentialType(cacheKey);
|
|
394
|
+
if (credType === Constants.NOT_DEFINED) {
|
|
395
|
+
return;
|
|
396
|
+
}
|
|
397
|
+
var cacheEntity = _this.getSpecificCredential(cacheKey, credType);
|
|
398
|
+
if (!!cacheEntity && accountId === cacheEntity.generateAccountId()) {
|
|
399
|
+
removedCredentials.push(_this.removeCredential(cacheEntity));
|
|
400
|
+
}
|
|
401
|
+
});
|
|
402
|
+
return [4 /*yield*/, Promise.all(removedCredentials)];
|
|
403
|
+
case 1:
|
|
404
|
+
_a.sent();
|
|
405
|
+
return [2 /*return*/, true];
|
|
406
|
+
}
|
|
407
|
+
});
|
|
324
408
|
});
|
|
325
|
-
return true;
|
|
326
409
|
};
|
|
327
410
|
/**
|
|
328
411
|
* returns a boolean if the given credential is removed
|
|
329
412
|
* @param credential
|
|
330
413
|
*/
|
|
331
414
|
CacheManager.prototype.removeCredential = function (credential) {
|
|
332
|
-
|
|
333
|
-
|
|
415
|
+
return __awaiter(this, void 0, void 0, function () {
|
|
416
|
+
var key, accessTokenWithAuthSchemeEntity, kid;
|
|
417
|
+
return __generator(this, function (_a) {
|
|
418
|
+
switch (_a.label) {
|
|
419
|
+
case 0:
|
|
420
|
+
key = credential.generateCredentialKey();
|
|
421
|
+
if (!(credential.credentialType.toLowerCase() === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())) return [3 /*break*/, 4];
|
|
422
|
+
if (!(credential.tokenType === AuthenticationScheme.POP)) return [3 /*break*/, 4];
|
|
423
|
+
accessTokenWithAuthSchemeEntity = credential;
|
|
424
|
+
kid = accessTokenWithAuthSchemeEntity.keyId;
|
|
425
|
+
if (!kid) return [3 /*break*/, 4];
|
|
426
|
+
_a.label = 1;
|
|
427
|
+
case 1:
|
|
428
|
+
_a.trys.push([1, 3, , 4]);
|
|
429
|
+
return [4 /*yield*/, this.cryptoImpl.removeTokenBindingKey(kid)];
|
|
430
|
+
case 2:
|
|
431
|
+
_a.sent();
|
|
432
|
+
return [3 /*break*/, 4];
|
|
433
|
+
case 3:
|
|
434
|
+
_a.sent();
|
|
435
|
+
throw ClientAuthError.createBindingKeyNotRemovedError();
|
|
436
|
+
case 4: return [2 /*return*/, this.removeItem(key, CacheSchemaType.CREDENTIAL)];
|
|
437
|
+
}
|
|
438
|
+
});
|
|
439
|
+
});
|
|
334
440
|
};
|
|
335
441
|
/**
|
|
336
442
|
* Removes all app metadata objects from cache.
|
|
@@ -353,14 +459,14 @@ var CacheManager = /** @class */ (function () {
|
|
|
353
459
|
* @param environment
|
|
354
460
|
* @param authScheme
|
|
355
461
|
*/
|
|
356
|
-
CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme) {
|
|
462
|
+
CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme, keyId) {
|
|
357
463
|
var cachedAccount = this.readAccountFromCache(account);
|
|
358
464
|
var cachedIdToken = this.readIdTokenFromCache(clientId, account);
|
|
359
|
-
var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme);
|
|
465
|
+
var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme, keyId);
|
|
360
466
|
var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
|
|
361
467
|
var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
|
|
362
468
|
if (cachedAccount && cachedIdToken) {
|
|
363
|
-
cachedAccount.idTokenClaims = new AuthToken
|
|
469
|
+
cachedAccount.idTokenClaims = new AuthToken(cachedIdToken.secret, this.cryptoImpl).claims;
|
|
364
470
|
}
|
|
365
471
|
return {
|
|
366
472
|
account: cachedAccount,
|
|
@@ -375,7 +481,7 @@ var CacheManager = /** @class */ (function () {
|
|
|
375
481
|
* @param account
|
|
376
482
|
*/
|
|
377
483
|
CacheManager.prototype.readAccountFromCache = function (account) {
|
|
378
|
-
var accountKey = AccountEntity
|
|
484
|
+
var accountKey = AccountEntity.generateAccountCacheKey(account);
|
|
379
485
|
return this.getAccount(accountKey);
|
|
380
486
|
};
|
|
381
487
|
/**
|
|
@@ -399,7 +505,7 @@ var CacheManager = /** @class */ (function () {
|
|
|
399
505
|
return null;
|
|
400
506
|
}
|
|
401
507
|
else if (numIdTokens > 1) {
|
|
402
|
-
throw ClientAuthError
|
|
508
|
+
throw ClientAuthError.createMultipleMatchingTokensInCacheError();
|
|
403
509
|
}
|
|
404
510
|
return idTokens[0];
|
|
405
511
|
};
|
|
@@ -410,8 +516,9 @@ var CacheManager = /** @class */ (function () {
|
|
|
410
516
|
* @param scopes
|
|
411
517
|
* @param authScheme
|
|
412
518
|
*/
|
|
413
|
-
CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme) {
|
|
414
|
-
|
|
519
|
+
CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme, keyId) {
|
|
520
|
+
// Distinguish between Bearer and PoP/SSH token cache types
|
|
521
|
+
var credentialType = (authScheme && authScheme !== AuthenticationScheme.BEARER) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
|
|
415
522
|
var accessTokenFilter = {
|
|
416
523
|
homeAccountId: account.homeAccountId,
|
|
417
524
|
environment: account.environment,
|
|
@@ -419,6 +526,8 @@ var CacheManager = /** @class */ (function () {
|
|
|
419
526
|
clientId: clientId,
|
|
420
527
|
realm: account.tenantId,
|
|
421
528
|
target: scopes.printScopesLowerCase(),
|
|
529
|
+
tokenType: authScheme,
|
|
530
|
+
keyId: keyId
|
|
422
531
|
};
|
|
423
532
|
var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
|
|
424
533
|
var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
|
|
@@ -427,7 +536,7 @@ var CacheManager = /** @class */ (function () {
|
|
|
427
536
|
return null;
|
|
428
537
|
}
|
|
429
538
|
else if (numAccessTokens > 1) {
|
|
430
|
-
throw ClientAuthError
|
|
539
|
+
throw ClientAuthError.createMultipleMatchingTokensInCacheError();
|
|
431
540
|
}
|
|
432
541
|
return accessTokens[0];
|
|
433
542
|
};
|
|
@@ -470,7 +579,7 @@ var CacheManager = /** @class */ (function () {
|
|
|
470
579
|
return null;
|
|
471
580
|
}
|
|
472
581
|
else if (numAppMetadata > 1) {
|
|
473
|
-
throw ClientAuthError
|
|
582
|
+
throw ClientAuthError.createMultipleMatchingAppMetadataInCacheError();
|
|
474
583
|
}
|
|
475
584
|
return appMetadataEntries[0];
|
|
476
585
|
};
|
|
@@ -553,16 +662,32 @@ var CacheManager = /** @class */ (function () {
|
|
|
553
662
|
if (isNotAccessTokenCredential || !entity.target) {
|
|
554
663
|
return false;
|
|
555
664
|
}
|
|
556
|
-
var entityScopeSet = ScopeSet
|
|
557
|
-
var requestTargetScopeSet = ScopeSet
|
|
665
|
+
var entityScopeSet = ScopeSet.fromString(entity.target);
|
|
666
|
+
var requestTargetScopeSet = ScopeSet.fromString(target);
|
|
558
667
|
if (!requestTargetScopeSet.containsOnlyOIDCScopes()) {
|
|
559
668
|
requestTargetScopeSet.removeOIDCScopes(); // ignore OIDC scopes
|
|
560
669
|
}
|
|
561
670
|
else {
|
|
562
|
-
requestTargetScopeSet.removeScope(Constants
|
|
671
|
+
requestTargetScopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
|
|
563
672
|
}
|
|
564
673
|
return entityScopeSet.containsScopeSet(requestTargetScopeSet);
|
|
565
674
|
};
|
|
675
|
+
/**
|
|
676
|
+
* Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise
|
|
677
|
+
* @param entity
|
|
678
|
+
* @param tokenType
|
|
679
|
+
*/
|
|
680
|
+
CacheManager.prototype.matchTokenType = function (entity, tokenType) {
|
|
681
|
+
return !!(entity.tokenType && entity.tokenType === tokenType);
|
|
682
|
+
};
|
|
683
|
+
/**
|
|
684
|
+
* Returns true if the credential's keyId matches the one in the request, false otherwise
|
|
685
|
+
* @param entity
|
|
686
|
+
* @param tokenType
|
|
687
|
+
*/
|
|
688
|
+
CacheManager.prototype.matchKeyId = function (entity, keyId) {
|
|
689
|
+
return !!(entity.keyId && entity.keyId === keyId);
|
|
690
|
+
};
|
|
566
691
|
/**
|
|
567
692
|
* returns if a given cache entity is of the type appmetadata
|
|
568
693
|
* @param key
|
|
@@ -624,87 +749,92 @@ var DefaultStorageClass = /** @class */ (function (_super) {
|
|
|
624
749
|
}
|
|
625
750
|
DefaultStorageClass.prototype.setAccount = function () {
|
|
626
751
|
var notImplErr = "Storage interface - setAccount() has not been implemented for the cacheStorage interface.";
|
|
627
|
-
throw AuthError
|
|
752
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
628
753
|
};
|
|
629
754
|
DefaultStorageClass.prototype.getAccount = function () {
|
|
630
755
|
var notImplErr = "Storage interface - getAccount() has not been implemented for the cacheStorage interface.";
|
|
631
|
-
throw AuthError
|
|
756
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
632
757
|
};
|
|
633
758
|
DefaultStorageClass.prototype.setIdTokenCredential = function () {
|
|
634
759
|
var notImplErr = "Storage interface - setIdTokenCredential() has not been implemented for the cacheStorage interface.";
|
|
635
|
-
throw AuthError
|
|
760
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
636
761
|
};
|
|
637
762
|
DefaultStorageClass.prototype.getIdTokenCredential = function () {
|
|
638
763
|
var notImplErr = "Storage interface - getIdTokenCredential() has not been implemented for the cacheStorage interface.";
|
|
639
|
-
throw AuthError
|
|
764
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
640
765
|
};
|
|
641
766
|
DefaultStorageClass.prototype.setAccessTokenCredential = function () {
|
|
642
767
|
var notImplErr = "Storage interface - setAccessTokenCredential() has not been implemented for the cacheStorage interface.";
|
|
643
|
-
throw AuthError
|
|
768
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
644
769
|
};
|
|
645
770
|
DefaultStorageClass.prototype.getAccessTokenCredential = function () {
|
|
646
771
|
var notImplErr = "Storage interface - getAccessTokenCredential() has not been implemented for the cacheStorage interface.";
|
|
647
|
-
throw AuthError
|
|
772
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
648
773
|
};
|
|
649
774
|
DefaultStorageClass.prototype.setRefreshTokenCredential = function () {
|
|
650
775
|
var notImplErr = "Storage interface - setRefreshTokenCredential() has not been implemented for the cacheStorage interface.";
|
|
651
|
-
throw AuthError
|
|
776
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
652
777
|
};
|
|
653
778
|
DefaultStorageClass.prototype.getRefreshTokenCredential = function () {
|
|
654
779
|
var notImplErr = "Storage interface - getRefreshTokenCredential() has not been implemented for the cacheStorage interface.";
|
|
655
|
-
throw AuthError
|
|
780
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
656
781
|
};
|
|
657
782
|
DefaultStorageClass.prototype.setAppMetadata = function () {
|
|
658
783
|
var notImplErr = "Storage interface - setAppMetadata() has not been implemented for the cacheStorage interface.";
|
|
659
|
-
throw AuthError
|
|
784
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
660
785
|
};
|
|
661
786
|
DefaultStorageClass.prototype.getAppMetadata = function () {
|
|
662
787
|
var notImplErr = "Storage interface - getAppMetadata() has not been implemented for the cacheStorage interface.";
|
|
663
|
-
throw AuthError
|
|
788
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
664
789
|
};
|
|
665
790
|
DefaultStorageClass.prototype.setServerTelemetry = function () {
|
|
666
791
|
var notImplErr = "Storage interface - setServerTelemetry() has not been implemented for the cacheStorage interface.";
|
|
667
|
-
throw AuthError
|
|
792
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
668
793
|
};
|
|
669
794
|
DefaultStorageClass.prototype.getServerTelemetry = function () {
|
|
670
795
|
var notImplErr = "Storage interface - getServerTelemetry() has not been implemented for the cacheStorage interface.";
|
|
671
|
-
throw AuthError
|
|
796
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
672
797
|
};
|
|
673
798
|
DefaultStorageClass.prototype.setAuthorityMetadata = function () {
|
|
674
799
|
var notImplErr = "Storage interface - setAuthorityMetadata() has not been implemented for the cacheStorage interface.";
|
|
675
|
-
throw AuthError
|
|
800
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
676
801
|
};
|
|
677
802
|
DefaultStorageClass.prototype.getAuthorityMetadata = function () {
|
|
678
803
|
var notImplErr = "Storage interface - getAuthorityMetadata() has not been implemented for the cacheStorage interface.";
|
|
679
|
-
throw AuthError
|
|
804
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
680
805
|
};
|
|
681
806
|
DefaultStorageClass.prototype.getAuthorityMetadataKeys = function () {
|
|
682
807
|
var notImplErr = "Storage interface - getAuthorityMetadataKeys() has not been implemented for the cacheStorage interface.";
|
|
683
|
-
throw AuthError
|
|
808
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
684
809
|
};
|
|
685
810
|
DefaultStorageClass.prototype.setThrottlingCache = function () {
|
|
686
811
|
var notImplErr = "Storage interface - setThrottlingCache() has not been implemented for the cacheStorage interface.";
|
|
687
|
-
throw AuthError
|
|
812
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
688
813
|
};
|
|
689
814
|
DefaultStorageClass.prototype.getThrottlingCache = function () {
|
|
690
815
|
var notImplErr = "Storage interface - getThrottlingCache() has not been implemented for the cacheStorage interface.";
|
|
691
|
-
throw AuthError
|
|
816
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
692
817
|
};
|
|
693
818
|
DefaultStorageClass.prototype.removeItem = function () {
|
|
694
819
|
var notImplErr = "Storage interface - removeItem() has not been implemented for the cacheStorage interface.";
|
|
695
|
-
throw AuthError
|
|
820
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
696
821
|
};
|
|
697
822
|
DefaultStorageClass.prototype.containsKey = function () {
|
|
698
823
|
var notImplErr = "Storage interface - containsKey() has not been implemented for the cacheStorage interface.";
|
|
699
|
-
throw AuthError
|
|
824
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
700
825
|
};
|
|
701
826
|
DefaultStorageClass.prototype.getKeys = function () {
|
|
702
827
|
var notImplErr = "Storage interface - getKeys() has not been implemented for the cacheStorage interface.";
|
|
703
|
-
throw AuthError
|
|
828
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
704
829
|
};
|
|
705
830
|
DefaultStorageClass.prototype.clear = function () {
|
|
706
|
-
|
|
707
|
-
|
|
831
|
+
return __awaiter(this, void 0, void 0, function () {
|
|
832
|
+
var notImplErr;
|
|
833
|
+
return __generator(this, function (_a) {
|
|
834
|
+
notImplErr = "Storage interface - clear() has not been implemented for the cacheStorage interface.";
|
|
835
|
+
throw AuthError.createUnexpectedError(notImplErr);
|
|
836
|
+
});
|
|
837
|
+
});
|
|
708
838
|
};
|
|
709
839
|
return DefaultStorageClass;
|
|
710
840
|
}(CacheManager));
|