@azure/msal-common 4.5.0 → 5.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (186) hide show
  1. package/CHANGELOG.json +178 -0
  2. package/{changelog.md → CHANGELOG.md} +446 -390
  3. package/LICENSE +21 -21
  4. package/README.md +62 -61
  5. package/dist/_virtual/_tslib.js +1 -1
  6. package/dist/account/AuthToken.js +7 -7
  7. package/dist/account/AuthToken.js.map +1 -1
  8. package/dist/account/CcsCredential.js +1 -1
  9. package/dist/account/CcsCredential.js.map +1 -1
  10. package/dist/account/ClientInfo.js +10 -10
  11. package/dist/account/ClientInfo.js.map +1 -1
  12. package/dist/account/TokenClaims.d.ts +5 -0
  13. package/dist/account/TokenClaims.d.ts.map +1 -1
  14. package/dist/authority/Authority.d.ts.map +1 -1
  15. package/dist/authority/Authority.js +60 -54
  16. package/dist/authority/Authority.js.map +1 -1
  17. package/dist/authority/AuthorityFactory.js +9 -9
  18. package/dist/authority/AuthorityFactory.js.map +1 -1
  19. package/dist/authority/AuthorityType.js +1 -1
  20. package/dist/authority/AuthorityType.js.map +1 -1
  21. package/dist/authority/CloudInstanceDiscoveryResponse.js +1 -1
  22. package/dist/authority/CloudInstanceDiscoveryResponse.js.map +1 -1
  23. package/dist/authority/OpenIdConfigResponse.d.ts +1 -1
  24. package/dist/authority/OpenIdConfigResponse.d.ts.map +1 -1
  25. package/dist/authority/OpenIdConfigResponse.js +1 -2
  26. package/dist/authority/OpenIdConfigResponse.js.map +1 -1
  27. package/dist/authority/ProtocolMode.js +1 -1
  28. package/dist/authority/ProtocolMode.js.map +1 -1
  29. package/dist/authority/RegionDiscovery.js +9 -9
  30. package/dist/authority/RegionDiscovery.js.map +1 -1
  31. package/dist/cache/CacheManager.d.ts +23 -9
  32. package/dist/cache/CacheManager.d.ts.map +1 -1
  33. package/dist/cache/CacheManager.js +244 -114
  34. package/dist/cache/CacheManager.js.map +1 -1
  35. package/dist/cache/entities/AccessTokenEntity.d.ts +3 -2
  36. package/dist/cache/entities/AccessTokenEntity.d.ts.map +1 -1
  37. package/dist/cache/entities/AccessTokenEntity.js +23 -17
  38. package/dist/cache/entities/AccessTokenEntity.js.map +1 -1
  39. package/dist/cache/entities/AccountEntity.d.ts +2 -2
  40. package/dist/cache/entities/AccountEntity.d.ts.map +1 -1
  41. package/dist/cache/entities/AccountEntity.js +18 -18
  42. package/dist/cache/entities/AccountEntity.js.map +1 -1
  43. package/dist/cache/entities/AppMetadataEntity.js +1 -1
  44. package/dist/cache/entities/AppMetadataEntity.js.map +1 -1
  45. package/dist/cache/entities/AuthorityMetadataEntity.d.ts +1 -1
  46. package/dist/cache/entities/AuthorityMetadataEntity.d.ts.map +1 -1
  47. package/dist/cache/entities/AuthorityMetadataEntity.js +5 -6
  48. package/dist/cache/entities/AuthorityMetadataEntity.js.map +1 -1
  49. package/dist/cache/entities/CacheRecord.js +1 -1
  50. package/dist/cache/entities/CacheRecord.js.map +1 -1
  51. package/dist/cache/entities/CredentialEntity.d.ts +7 -3
  52. package/dist/cache/entities/CredentialEntity.d.ts.map +1 -1
  53. package/dist/cache/entities/CredentialEntity.js +16 -9
  54. package/dist/cache/entities/CredentialEntity.js.map +1 -1
  55. package/dist/cache/entities/IdTokenEntity.js +3 -3
  56. package/dist/cache/entities/IdTokenEntity.js.map +1 -1
  57. package/dist/cache/entities/RefreshTokenEntity.js +3 -3
  58. package/dist/cache/entities/RefreshTokenEntity.js.map +1 -1
  59. package/dist/cache/entities/ServerTelemetryEntity.js +1 -1
  60. package/dist/cache/entities/ServerTelemetryEntity.js.map +1 -1
  61. package/dist/cache/entities/ThrottlingEntity.js +1 -1
  62. package/dist/cache/entities/ThrottlingEntity.js.map +1 -1
  63. package/dist/cache/interface/ICacheManager.d.ts +5 -5
  64. package/dist/cache/interface/ICacheManager.d.ts.map +1 -1
  65. package/dist/cache/persistence/TokenCacheContext.js +3 -3
  66. package/dist/cache/persistence/TokenCacheContext.js.map +1 -1
  67. package/dist/cache/utils/CacheTypes.d.ts +4 -1
  68. package/dist/cache/utils/CacheTypes.d.ts.map +1 -1
  69. package/dist/client/AuthorizationCodeClient.d.ts +1 -1
  70. package/dist/client/AuthorizationCodeClient.d.ts.map +1 -1
  71. package/dist/client/AuthorizationCodeClient.js +56 -43
  72. package/dist/client/AuthorizationCodeClient.js.map +1 -1
  73. package/dist/client/BaseClient.js +11 -11
  74. package/dist/client/BaseClient.js.map +1 -1
  75. package/dist/client/ClientCredentialClient.d.ts.map +1 -1
  76. package/dist/client/ClientCredentialClient.js +24 -18
  77. package/dist/client/ClientCredentialClient.js.map +1 -1
  78. package/dist/client/DeviceCodeClient.d.ts.map +1 -1
  79. package/dist/client/DeviceCodeClient.js +39 -27
  80. package/dist/client/DeviceCodeClient.js.map +1 -1
  81. package/dist/client/OnBehalfOfClient.d.ts.map +1 -1
  82. package/dist/client/OnBehalfOfClient.js +26 -20
  83. package/dist/client/OnBehalfOfClient.js.map +1 -1
  84. package/dist/client/RefreshTokenClient.d.ts.map +1 -1
  85. package/dist/client/RefreshTokenClient.js +49 -32
  86. package/dist/client/RefreshTokenClient.js.map +1 -1
  87. package/dist/client/SilentFlowClient.d.ts.map +1 -1
  88. package/dist/client/SilentFlowClient.js +40 -35
  89. package/dist/client/SilentFlowClient.js.map +1 -1
  90. package/dist/client/UsernamePasswordClient.d.ts.map +1 -1
  91. package/dist/client/UsernamePasswordClient.js +18 -12
  92. package/dist/client/UsernamePasswordClient.js.map +1 -1
  93. package/dist/config/ClientConfiguration.d.ts.map +1 -1
  94. package/dist/config/ClientConfiguration.js +8 -7
  95. package/dist/config/ClientConfiguration.js.map +1 -1
  96. package/dist/crypto/ICrypto.d.ts +11 -1
  97. package/dist/crypto/ICrypto.d.ts.map +1 -1
  98. package/dist/crypto/ICrypto.js +26 -8
  99. package/dist/crypto/ICrypto.js.map +1 -1
  100. package/dist/crypto/PopTokenGenerator.d.ts +21 -4
  101. package/dist/crypto/PopTokenGenerator.d.ts.map +1 -1
  102. package/dist/crypto/PopTokenGenerator.js +42 -31
  103. package/dist/crypto/PopTokenGenerator.js.map +1 -1
  104. package/dist/error/AuthError.d.ts +5 -0
  105. package/dist/error/AuthError.d.ts.map +1 -1
  106. package/dist/error/AuthError.js +6 -3
  107. package/dist/error/AuthError.js.map +1 -1
  108. package/dist/error/ClientAuthError.d.ts +13 -4
  109. package/dist/error/ClientAuthError.d.ts.map +1 -1
  110. package/dist/error/ClientAuthError.js +20 -9
  111. package/dist/error/ClientAuthError.js.map +1 -1
  112. package/dist/error/ClientConfigurationError.d.ts +29 -0
  113. package/dist/error/ClientConfigurationError.d.ts.map +1 -1
  114. package/dist/error/ClientConfigurationError.js +45 -5
  115. package/dist/error/ClientConfigurationError.js.map +1 -1
  116. package/dist/error/InteractionRequiredAuthError.d.ts +24 -5
  117. package/dist/error/InteractionRequiredAuthError.d.ts.map +1 -1
  118. package/dist/error/InteractionRequiredAuthError.js +30 -9
  119. package/dist/error/InteractionRequiredAuthError.js.map +1 -1
  120. package/dist/error/ServerError.js +3 -3
  121. package/dist/error/ServerError.js.map +1 -1
  122. package/dist/index.cjs.js +675 -244
  123. package/dist/index.cjs.js.map +1 -1
  124. package/dist/index.d.ts +7 -2
  125. package/dist/index.d.ts.map +1 -1
  126. package/dist/index.js +33 -29
  127. package/dist/index.js.map +1 -1
  128. package/dist/logger/Logger.d.ts.map +1 -1
  129. package/dist/logger/Logger.js +11 -9
  130. package/dist/logger/Logger.js.map +1 -1
  131. package/dist/network/INetworkModule.js +4 -4
  132. package/dist/network/INetworkModule.js.map +1 -1
  133. package/dist/network/NetworkManager.js +8 -8
  134. package/dist/network/NetworkManager.js.map +1 -1
  135. package/dist/network/RequestThumbprint.d.ts +7 -0
  136. package/dist/network/RequestThumbprint.d.ts.map +1 -1
  137. package/dist/network/ThrottlingUtils.d.ts +2 -1
  138. package/dist/network/ThrottlingUtils.d.ts.map +1 -1
  139. package/dist/network/ThrottlingUtils.js +14 -8
  140. package/dist/network/ThrottlingUtils.js.map +1 -1
  141. package/dist/packageMetadata.d.ts +1 -1
  142. package/dist/packageMetadata.js +2 -2
  143. package/dist/packageMetadata.js.map +1 -1
  144. package/dist/request/AuthenticationHeaderParser.d.ts +20 -0
  145. package/dist/request/AuthenticationHeaderParser.d.ts.map +1 -0
  146. package/dist/request/AuthenticationHeaderParser.js +64 -0
  147. package/dist/request/AuthenticationHeaderParser.js.map +1 -0
  148. package/dist/request/BaseAuthRequest.d.ts +7 -1
  149. package/dist/request/BaseAuthRequest.d.ts.map +1 -1
  150. package/dist/request/CommonEndSessionRequest.d.ts +4 -0
  151. package/dist/request/CommonEndSessionRequest.d.ts.map +1 -1
  152. package/dist/request/RequestParameterBuilder.d.ts +4 -0
  153. package/dist/request/RequestParameterBuilder.d.ts.map +1 -1
  154. package/dist/request/RequestParameterBuilder.js +27 -18
  155. package/dist/request/RequestParameterBuilder.js.map +1 -1
  156. package/dist/request/RequestValidator.js +10 -10
  157. package/dist/request/RequestValidator.js.map +1 -1
  158. package/dist/request/ScopeSet.js +14 -14
  159. package/dist/request/ScopeSet.js.map +1 -1
  160. package/dist/response/AuthenticationResult.d.ts +2 -1
  161. package/dist/response/AuthenticationResult.d.ts.map +1 -1
  162. package/dist/response/ExternalTokenResponse.d.ts +15 -0
  163. package/dist/response/ExternalTokenResponse.d.ts.map +1 -0
  164. package/dist/response/ResponseHandler.d.ts.map +1 -1
  165. package/dist/response/ResponseHandler.js +74 -69
  166. package/dist/response/ResponseHandler.js.map +1 -1
  167. package/dist/response/ServerAuthorizationTokenResponse.d.ts +5 -2
  168. package/dist/response/ServerAuthorizationTokenResponse.d.ts.map +1 -1
  169. package/dist/telemetry/server/ServerTelemetryManager.js +13 -13
  170. package/dist/telemetry/server/ServerTelemetryManager.js.map +1 -1
  171. package/dist/url/UrlString.d.ts +0 -6
  172. package/dist/url/UrlString.d.ts.map +1 -1
  173. package/dist/url/UrlString.js +25 -40
  174. package/dist/url/UrlString.js.map +1 -1
  175. package/dist/utils/Constants.d.ts +5 -2
  176. package/dist/utils/Constants.d.ts.map +1 -1
  177. package/dist/utils/Constants.js +5 -2
  178. package/dist/utils/Constants.js.map +1 -1
  179. package/dist/utils/ProtocolUtils.js +13 -13
  180. package/dist/utils/ProtocolUtils.js.map +1 -1
  181. package/dist/utils/StringUtils.d.ts.map +1 -1
  182. package/dist/utils/StringUtils.js +15 -14
  183. package/dist/utils/StringUtils.js.map +1 -1
  184. package/dist/utils/TimeUtils.js +1 -1
  185. package/dist/utils/TimeUtils.js.map +1 -1
  186. package/package.json +1 -1
@@ -1,13 +1,13 @@
1
- /*! @azure/msal-common v4.5.0 2021-07-22 */
1
+ /*! @azure/msal-common v5.1.0 2021-11-02 */
2
2
  'use strict';
3
- import { __extends } from '../_virtual/_tslib.js';
4
- import { Constants as Constants$1, CredentialType, CacheSchemaType, THE_FAMILY_ID, APP_METADATA, AUTHORITY_METADATA_CONSTANTS, AuthenticationScheme } from '../utils/Constants.js';
5
- import { AuthError as AuthError$1 } from '../error/AuthError.js';
6
- import { ClientAuthError as ClientAuthError$1 } from '../error/ClientAuthError.js';
7
- import { CredentialEntity as CredentialEntity$1 } from './entities/CredentialEntity.js';
8
- import { ScopeSet as ScopeSet$1 } from '../request/ScopeSet.js';
9
- import { AccountEntity as AccountEntity$1 } from './entities/AccountEntity.js';
10
- import { AuthToken as AuthToken$1 } from '../account/AuthToken.js';
3
+ import { __awaiter, __generator, __extends } from '../_virtual/_tslib.js';
4
+ import { Constants, CredentialType, AuthenticationScheme, CacheSchemaType, THE_FAMILY_ID, APP_METADATA, AUTHORITY_METADATA_CONSTANTS } from '../utils/Constants.js';
5
+ import { CredentialEntity } from './entities/CredentialEntity.js';
6
+ import { ScopeSet } from '../request/ScopeSet.js';
7
+ import { AccountEntity } from './entities/AccountEntity.js';
8
+ import { AuthError } from '../error/AuthError.js';
9
+ import { ClientAuthError } from '../error/ClientAuthError.js';
10
+ import { AuthToken } from '../account/AuthToken.js';
11
11
 
12
12
  /*
13
13
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -34,11 +34,11 @@ var CacheManager = /** @class */ (function () {
34
34
  }
35
35
  else {
36
36
  var allAccounts = accountValues.map(function (value) {
37
- var accountEntity = CacheManager.toObject(new AccountEntity$1(), value);
37
+ var accountEntity = CacheManager.toObject(new AccountEntity(), value);
38
38
  var accountInfo = accountEntity.getAccountInfo();
39
39
  var idToken = _this.readIdTokenFromCache(_this.clientId, accountInfo);
40
40
  if (idToken && !accountInfo.idTokenClaims) {
41
- accountInfo.idTokenClaims = new AuthToken$1(idToken.secret, _this.cryptoImpl).claims;
41
+ accountInfo.idTokenClaims = new AuthToken(idToken.secret, _this.cryptoImpl).claims;
42
42
  }
43
43
  return accountInfo;
44
44
  });
@@ -50,49 +50,75 @@ var CacheManager = /** @class */ (function () {
50
50
  * @param cacheRecord
51
51
  */
52
52
  CacheManager.prototype.saveCacheRecord = function (cacheRecord) {
53
- if (!cacheRecord) {
54
- throw ClientAuthError$1.createNullOrUndefinedCacheRecord();
55
- }
56
- if (!!cacheRecord.account) {
57
- this.setAccount(cacheRecord.account);
58
- }
59
- if (!!cacheRecord.idToken) {
60
- this.setIdTokenCredential(cacheRecord.idToken);
61
- }
62
- if (!!cacheRecord.accessToken) {
63
- this.saveAccessToken(cacheRecord.accessToken);
64
- }
65
- if (!!cacheRecord.refreshToken) {
66
- this.setRefreshTokenCredential(cacheRecord.refreshToken);
67
- }
68
- if (!!cacheRecord.appMetadata) {
69
- this.setAppMetadata(cacheRecord.appMetadata);
70
- }
53
+ return __awaiter(this, void 0, void 0, function () {
54
+ return __generator(this, function (_a) {
55
+ switch (_a.label) {
56
+ case 0:
57
+ if (!cacheRecord) {
58
+ throw ClientAuthError.createNullOrUndefinedCacheRecord();
59
+ }
60
+ if (!!cacheRecord.account) {
61
+ this.setAccount(cacheRecord.account);
62
+ }
63
+ if (!!cacheRecord.idToken) {
64
+ this.setIdTokenCredential(cacheRecord.idToken);
65
+ }
66
+ if (!!!cacheRecord.accessToken) return [3 /*break*/, 2];
67
+ return [4 /*yield*/, this.saveAccessToken(cacheRecord.accessToken)];
68
+ case 1:
69
+ _a.sent();
70
+ _a.label = 2;
71
+ case 2:
72
+ if (!!cacheRecord.refreshToken) {
73
+ this.setRefreshTokenCredential(cacheRecord.refreshToken);
74
+ }
75
+ if (!!cacheRecord.appMetadata) {
76
+ this.setAppMetadata(cacheRecord.appMetadata);
77
+ }
78
+ return [2 /*return*/];
79
+ }
80
+ });
81
+ });
71
82
  };
72
83
  /**
73
84
  * saves access token credential
74
85
  * @param credential
75
86
  */
76
87
  CacheManager.prototype.saveAccessToken = function (credential) {
77
- var _this = this;
78
- var currentTokenCache = this.getCredentialsFilteredBy({
79
- clientId: credential.clientId,
80
- credentialType: credential.credentialType,
81
- environment: credential.environment,
82
- homeAccountId: credential.homeAccountId,
83
- realm: credential.realm,
84
- });
85
- var currentScopes = ScopeSet$1.fromString(credential.target);
86
- var currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
87
- if (currentAccessTokens) {
88
- currentAccessTokens.forEach(function (tokenEntity) {
89
- var tokenScopeSet = ScopeSet$1.fromString(tokenEntity.target);
90
- if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
91
- _this.removeCredential(tokenEntity);
88
+ return __awaiter(this, void 0, void 0, function () {
89
+ var currentTokenCache, currentScopes, currentAccessTokens, removedAccessTokens_1;
90
+ var _this = this;
91
+ return __generator(this, function (_a) {
92
+ switch (_a.label) {
93
+ case 0:
94
+ currentTokenCache = this.getCredentialsFilteredBy({
95
+ clientId: credential.clientId,
96
+ credentialType: credential.credentialType,
97
+ environment: credential.environment,
98
+ homeAccountId: credential.homeAccountId,
99
+ realm: credential.realm,
100
+ tokenType: credential.tokenType
101
+ });
102
+ currentScopes = ScopeSet.fromString(credential.target);
103
+ currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
104
+ if (!currentAccessTokens) return [3 /*break*/, 2];
105
+ removedAccessTokens_1 = [];
106
+ currentAccessTokens.forEach(function (tokenEntity) {
107
+ var tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
108
+ if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
109
+ removedAccessTokens_1.push(_this.removeCredential(tokenEntity));
110
+ }
111
+ });
112
+ return [4 /*yield*/, Promise.all(removedAccessTokens_1)];
113
+ case 1:
114
+ _a.sent();
115
+ _a.label = 2;
116
+ case 2:
117
+ this.setAccessTokenCredential(credential);
118
+ return [2 /*return*/];
92
119
  }
93
120
  });
94
- }
95
- this.setAccessTokenCredential(credential);
121
+ });
96
122
  };
97
123
  /**
98
124
  * retrieve accounts matching all provided filters; if no filter is set, get all accounts
@@ -143,7 +169,7 @@ var CacheManager = /** @class */ (function () {
143
169
  * @param target
144
170
  */
145
171
  CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
146
- return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion);
172
+ return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId);
147
173
  };
148
174
  /**
149
175
  * Support function to help match credentials
@@ -153,8 +179,10 @@ var CacheManager = /** @class */ (function () {
153
179
  * @param clientId
154
180
  * @param realm
155
181
  * @param target
182
+ * @param oboAssertion
183
+ * @param tokenType
156
184
  */
157
- CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion) {
185
+ CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId) {
158
186
  var _this = this;
159
187
  var allCacheKeys = this.getKeys();
160
188
  var matchingCredentials = {
@@ -164,8 +192,8 @@ var CacheManager = /** @class */ (function () {
164
192
  };
165
193
  allCacheKeys.forEach(function (cacheKey) {
166
194
  // don't parse any non-credential type cache entities
167
- var credType = CredentialEntity$1.getCredentialType(cacheKey);
168
- if (credType === Constants$1.NOT_DEFINED) {
195
+ var credType = CredentialEntity.getCredentialType(cacheKey);
196
+ if (credType === Constants.NOT_DEFINED) {
169
197
  return;
170
198
  }
171
199
  // Attempt retrieval
@@ -201,6 +229,28 @@ var CacheManager = /** @class */ (function () {
201
229
  if (!!target && !_this.matchTarget(entity, target)) {
202
230
  return;
203
231
  }
232
+ // Access Token with Auth Scheme specific matching
233
+ if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
234
+ if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
235
+ return;
236
+ }
237
+ switch (tokenType) {
238
+ case AuthenticationScheme.POP:
239
+ // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
240
+ if (cacheKey.indexOf(AuthenticationScheme.POP) === -1) {
241
+ // AccessToken_With_AuthScheme that doesn't have "-pop" in the key is outdated and needs to be removed
242
+ _this.removeItem(cacheKey, CacheSchemaType.CREDENTIAL);
243
+ return;
244
+ }
245
+ break;
246
+ case AuthenticationScheme.SSH:
247
+ // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
248
+ if (keyId && !_this.matchKeyId(entity, keyId)) {
249
+ return;
250
+ }
251
+ break;
252
+ }
253
+ }
204
254
  switch (credType) {
205
255
  case CredentialType.ID_TOKEN:
206
256
  matchingCredentials.idTokens[cacheKey] = entity;
@@ -281,56 +331,112 @@ var CacheManager = /** @class */ (function () {
281
331
  * Removes all accounts and related tokens from cache.
282
332
  */
283
333
  CacheManager.prototype.removeAllAccounts = function () {
284
- var _this = this;
285
- var allCacheKeys = this.getKeys();
286
- allCacheKeys.forEach(function (cacheKey) {
287
- var entity = _this.getAccount(cacheKey);
288
- if (!entity) {
289
- return;
290
- }
291
- _this.removeAccount(cacheKey);
334
+ return __awaiter(this, void 0, void 0, function () {
335
+ var allCacheKeys, removedAccounts;
336
+ var _this = this;
337
+ return __generator(this, function (_a) {
338
+ switch (_a.label) {
339
+ case 0:
340
+ allCacheKeys = this.getKeys();
341
+ removedAccounts = [];
342
+ allCacheKeys.forEach(function (cacheKey) {
343
+ var entity = _this.getAccount(cacheKey);
344
+ if (!entity) {
345
+ return;
346
+ }
347
+ removedAccounts.push(_this.removeAccount(cacheKey));
348
+ });
349
+ return [4 /*yield*/, Promise.all(removedAccounts)];
350
+ case 1:
351
+ _a.sent();
352
+ return [2 /*return*/, true];
353
+ }
354
+ });
292
355
  });
293
- return true;
294
356
  };
295
357
  /**
296
358
  * returns a boolean if the given account is removed
297
359
  * @param account
298
360
  */
299
361
  CacheManager.prototype.removeAccount = function (accountKey) {
300
- var account = this.getAccount(accountKey);
301
- if (!account) {
302
- throw ClientAuthError$1.createNoAccountFoundError();
303
- }
304
- return (this.removeAccountContext(account) && this.removeItem(accountKey, CacheSchemaType.ACCOUNT));
362
+ return __awaiter(this, void 0, void 0, function () {
363
+ var account;
364
+ return __generator(this, function (_a) {
365
+ switch (_a.label) {
366
+ case 0:
367
+ account = this.getAccount(accountKey);
368
+ if (!account) {
369
+ throw ClientAuthError.createNoAccountFoundError();
370
+ }
371
+ return [4 /*yield*/, this.removeAccountContext(account)];
372
+ case 1: return [2 /*return*/, ((_a.sent()) && this.removeItem(accountKey, CacheSchemaType.ACCOUNT))];
373
+ }
374
+ });
375
+ });
305
376
  };
306
377
  /**
307
378
  * returns a boolean if the given account is removed
308
379
  * @param account
309
380
  */
310
381
  CacheManager.prototype.removeAccountContext = function (account) {
311
- var _this = this;
312
- var allCacheKeys = this.getKeys();
313
- var accountId = account.generateAccountId();
314
- allCacheKeys.forEach(function (cacheKey) {
315
- // don't parse any non-credential type cache entities
316
- var credType = CredentialEntity$1.getCredentialType(cacheKey);
317
- if (credType === Constants$1.NOT_DEFINED) {
318
- return;
319
- }
320
- var cacheEntity = _this.getSpecificCredential(cacheKey, credType);
321
- if (!!cacheEntity && accountId === cacheEntity.generateAccountId()) {
322
- _this.removeCredential(cacheEntity);
323
- }
382
+ return __awaiter(this, void 0, void 0, function () {
383
+ var allCacheKeys, accountId, removedCredentials;
384
+ var _this = this;
385
+ return __generator(this, function (_a) {
386
+ switch (_a.label) {
387
+ case 0:
388
+ allCacheKeys = this.getKeys();
389
+ accountId = account.generateAccountId();
390
+ removedCredentials = [];
391
+ allCacheKeys.forEach(function (cacheKey) {
392
+ // don't parse any non-credential type cache entities
393
+ var credType = CredentialEntity.getCredentialType(cacheKey);
394
+ if (credType === Constants.NOT_DEFINED) {
395
+ return;
396
+ }
397
+ var cacheEntity = _this.getSpecificCredential(cacheKey, credType);
398
+ if (!!cacheEntity && accountId === cacheEntity.generateAccountId()) {
399
+ removedCredentials.push(_this.removeCredential(cacheEntity));
400
+ }
401
+ });
402
+ return [4 /*yield*/, Promise.all(removedCredentials)];
403
+ case 1:
404
+ _a.sent();
405
+ return [2 /*return*/, true];
406
+ }
407
+ });
324
408
  });
325
- return true;
326
409
  };
327
410
  /**
328
411
  * returns a boolean if the given credential is removed
329
412
  * @param credential
330
413
  */
331
414
  CacheManager.prototype.removeCredential = function (credential) {
332
- var key = credential.generateCredentialKey();
333
- return this.removeItem(key, CacheSchemaType.CREDENTIAL);
415
+ return __awaiter(this, void 0, void 0, function () {
416
+ var key, accessTokenWithAuthSchemeEntity, kid;
417
+ return __generator(this, function (_a) {
418
+ switch (_a.label) {
419
+ case 0:
420
+ key = credential.generateCredentialKey();
421
+ if (!(credential.credentialType.toLowerCase() === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())) return [3 /*break*/, 4];
422
+ if (!(credential.tokenType === AuthenticationScheme.POP)) return [3 /*break*/, 4];
423
+ accessTokenWithAuthSchemeEntity = credential;
424
+ kid = accessTokenWithAuthSchemeEntity.keyId;
425
+ if (!kid) return [3 /*break*/, 4];
426
+ _a.label = 1;
427
+ case 1:
428
+ _a.trys.push([1, 3, , 4]);
429
+ return [4 /*yield*/, this.cryptoImpl.removeTokenBindingKey(kid)];
430
+ case 2:
431
+ _a.sent();
432
+ return [3 /*break*/, 4];
433
+ case 3:
434
+ _a.sent();
435
+ throw ClientAuthError.createBindingKeyNotRemovedError();
436
+ case 4: return [2 /*return*/, this.removeItem(key, CacheSchemaType.CREDENTIAL)];
437
+ }
438
+ });
439
+ });
334
440
  };
335
441
  /**
336
442
  * Removes all app metadata objects from cache.
@@ -353,14 +459,14 @@ var CacheManager = /** @class */ (function () {
353
459
  * @param environment
354
460
  * @param authScheme
355
461
  */
356
- CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme) {
462
+ CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme, keyId) {
357
463
  var cachedAccount = this.readAccountFromCache(account);
358
464
  var cachedIdToken = this.readIdTokenFromCache(clientId, account);
359
- var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme);
465
+ var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme, keyId);
360
466
  var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
361
467
  var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
362
468
  if (cachedAccount && cachedIdToken) {
363
- cachedAccount.idTokenClaims = new AuthToken$1(cachedIdToken.secret, this.cryptoImpl).claims;
469
+ cachedAccount.idTokenClaims = new AuthToken(cachedIdToken.secret, this.cryptoImpl).claims;
364
470
  }
365
471
  return {
366
472
  account: cachedAccount,
@@ -375,7 +481,7 @@ var CacheManager = /** @class */ (function () {
375
481
  * @param account
376
482
  */
377
483
  CacheManager.prototype.readAccountFromCache = function (account) {
378
- var accountKey = AccountEntity$1.generateAccountCacheKey(account);
484
+ var accountKey = AccountEntity.generateAccountCacheKey(account);
379
485
  return this.getAccount(accountKey);
380
486
  };
381
487
  /**
@@ -399,7 +505,7 @@ var CacheManager = /** @class */ (function () {
399
505
  return null;
400
506
  }
401
507
  else if (numIdTokens > 1) {
402
- throw ClientAuthError$1.createMultipleMatchingTokensInCacheError();
508
+ throw ClientAuthError.createMultipleMatchingTokensInCacheError();
403
509
  }
404
510
  return idTokens[0];
405
511
  };
@@ -410,8 +516,9 @@ var CacheManager = /** @class */ (function () {
410
516
  * @param scopes
411
517
  * @param authScheme
412
518
  */
413
- CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme) {
414
- var credentialType = (authScheme === AuthenticationScheme.POP) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
519
+ CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme, keyId) {
520
+ // Distinguish between Bearer and PoP/SSH token cache types
521
+ var credentialType = (authScheme && authScheme !== AuthenticationScheme.BEARER) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
415
522
  var accessTokenFilter = {
416
523
  homeAccountId: account.homeAccountId,
417
524
  environment: account.environment,
@@ -419,6 +526,8 @@ var CacheManager = /** @class */ (function () {
419
526
  clientId: clientId,
420
527
  realm: account.tenantId,
421
528
  target: scopes.printScopesLowerCase(),
529
+ tokenType: authScheme,
530
+ keyId: keyId
422
531
  };
423
532
  var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
424
533
  var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -427,7 +536,7 @@ var CacheManager = /** @class */ (function () {
427
536
  return null;
428
537
  }
429
538
  else if (numAccessTokens > 1) {
430
- throw ClientAuthError$1.createMultipleMatchingTokensInCacheError();
539
+ throw ClientAuthError.createMultipleMatchingTokensInCacheError();
431
540
  }
432
541
  return accessTokens[0];
433
542
  };
@@ -470,7 +579,7 @@ var CacheManager = /** @class */ (function () {
470
579
  return null;
471
580
  }
472
581
  else if (numAppMetadata > 1) {
473
- throw ClientAuthError$1.createMultipleMatchingAppMetadataInCacheError();
582
+ throw ClientAuthError.createMultipleMatchingAppMetadataInCacheError();
474
583
  }
475
584
  return appMetadataEntries[0];
476
585
  };
@@ -553,16 +662,32 @@ var CacheManager = /** @class */ (function () {
553
662
  if (isNotAccessTokenCredential || !entity.target) {
554
663
  return false;
555
664
  }
556
- var entityScopeSet = ScopeSet$1.fromString(entity.target);
557
- var requestTargetScopeSet = ScopeSet$1.fromString(target);
665
+ var entityScopeSet = ScopeSet.fromString(entity.target);
666
+ var requestTargetScopeSet = ScopeSet.fromString(target);
558
667
  if (!requestTargetScopeSet.containsOnlyOIDCScopes()) {
559
668
  requestTargetScopeSet.removeOIDCScopes(); // ignore OIDC scopes
560
669
  }
561
670
  else {
562
- requestTargetScopeSet.removeScope(Constants$1.OFFLINE_ACCESS_SCOPE);
671
+ requestTargetScopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
563
672
  }
564
673
  return entityScopeSet.containsScopeSet(requestTargetScopeSet);
565
674
  };
675
+ /**
676
+ * Returns true if the credential's tokenType or Authentication Scheme matches the one in the request, false otherwise
677
+ * @param entity
678
+ * @param tokenType
679
+ */
680
+ CacheManager.prototype.matchTokenType = function (entity, tokenType) {
681
+ return !!(entity.tokenType && entity.tokenType === tokenType);
682
+ };
683
+ /**
684
+ * Returns true if the credential's keyId matches the one in the request, false otherwise
685
+ * @param entity
686
+ * @param tokenType
687
+ */
688
+ CacheManager.prototype.matchKeyId = function (entity, keyId) {
689
+ return !!(entity.keyId && entity.keyId === keyId);
690
+ };
566
691
  /**
567
692
  * returns if a given cache entity is of the type appmetadata
568
693
  * @param key
@@ -624,87 +749,92 @@ var DefaultStorageClass = /** @class */ (function (_super) {
624
749
  }
625
750
  DefaultStorageClass.prototype.setAccount = function () {
626
751
  var notImplErr = "Storage interface - setAccount() has not been implemented for the cacheStorage interface.";
627
- throw AuthError$1.createUnexpectedError(notImplErr);
752
+ throw AuthError.createUnexpectedError(notImplErr);
628
753
  };
629
754
  DefaultStorageClass.prototype.getAccount = function () {
630
755
  var notImplErr = "Storage interface - getAccount() has not been implemented for the cacheStorage interface.";
631
- throw AuthError$1.createUnexpectedError(notImplErr);
756
+ throw AuthError.createUnexpectedError(notImplErr);
632
757
  };
633
758
  DefaultStorageClass.prototype.setIdTokenCredential = function () {
634
759
  var notImplErr = "Storage interface - setIdTokenCredential() has not been implemented for the cacheStorage interface.";
635
- throw AuthError$1.createUnexpectedError(notImplErr);
760
+ throw AuthError.createUnexpectedError(notImplErr);
636
761
  };
637
762
  DefaultStorageClass.prototype.getIdTokenCredential = function () {
638
763
  var notImplErr = "Storage interface - getIdTokenCredential() has not been implemented for the cacheStorage interface.";
639
- throw AuthError$1.createUnexpectedError(notImplErr);
764
+ throw AuthError.createUnexpectedError(notImplErr);
640
765
  };
641
766
  DefaultStorageClass.prototype.setAccessTokenCredential = function () {
642
767
  var notImplErr = "Storage interface - setAccessTokenCredential() has not been implemented for the cacheStorage interface.";
643
- throw AuthError$1.createUnexpectedError(notImplErr);
768
+ throw AuthError.createUnexpectedError(notImplErr);
644
769
  };
645
770
  DefaultStorageClass.prototype.getAccessTokenCredential = function () {
646
771
  var notImplErr = "Storage interface - getAccessTokenCredential() has not been implemented for the cacheStorage interface.";
647
- throw AuthError$1.createUnexpectedError(notImplErr);
772
+ throw AuthError.createUnexpectedError(notImplErr);
648
773
  };
649
774
  DefaultStorageClass.prototype.setRefreshTokenCredential = function () {
650
775
  var notImplErr = "Storage interface - setRefreshTokenCredential() has not been implemented for the cacheStorage interface.";
651
- throw AuthError$1.createUnexpectedError(notImplErr);
776
+ throw AuthError.createUnexpectedError(notImplErr);
652
777
  };
653
778
  DefaultStorageClass.prototype.getRefreshTokenCredential = function () {
654
779
  var notImplErr = "Storage interface - getRefreshTokenCredential() has not been implemented for the cacheStorage interface.";
655
- throw AuthError$1.createUnexpectedError(notImplErr);
780
+ throw AuthError.createUnexpectedError(notImplErr);
656
781
  };
657
782
  DefaultStorageClass.prototype.setAppMetadata = function () {
658
783
  var notImplErr = "Storage interface - setAppMetadata() has not been implemented for the cacheStorage interface.";
659
- throw AuthError$1.createUnexpectedError(notImplErr);
784
+ throw AuthError.createUnexpectedError(notImplErr);
660
785
  };
661
786
  DefaultStorageClass.prototype.getAppMetadata = function () {
662
787
  var notImplErr = "Storage interface - getAppMetadata() has not been implemented for the cacheStorage interface.";
663
- throw AuthError$1.createUnexpectedError(notImplErr);
788
+ throw AuthError.createUnexpectedError(notImplErr);
664
789
  };
665
790
  DefaultStorageClass.prototype.setServerTelemetry = function () {
666
791
  var notImplErr = "Storage interface - setServerTelemetry() has not been implemented for the cacheStorage interface.";
667
- throw AuthError$1.createUnexpectedError(notImplErr);
792
+ throw AuthError.createUnexpectedError(notImplErr);
668
793
  };
669
794
  DefaultStorageClass.prototype.getServerTelemetry = function () {
670
795
  var notImplErr = "Storage interface - getServerTelemetry() has not been implemented for the cacheStorage interface.";
671
- throw AuthError$1.createUnexpectedError(notImplErr);
796
+ throw AuthError.createUnexpectedError(notImplErr);
672
797
  };
673
798
  DefaultStorageClass.prototype.setAuthorityMetadata = function () {
674
799
  var notImplErr = "Storage interface - setAuthorityMetadata() has not been implemented for the cacheStorage interface.";
675
- throw AuthError$1.createUnexpectedError(notImplErr);
800
+ throw AuthError.createUnexpectedError(notImplErr);
676
801
  };
677
802
  DefaultStorageClass.prototype.getAuthorityMetadata = function () {
678
803
  var notImplErr = "Storage interface - getAuthorityMetadata() has not been implemented for the cacheStorage interface.";
679
- throw AuthError$1.createUnexpectedError(notImplErr);
804
+ throw AuthError.createUnexpectedError(notImplErr);
680
805
  };
681
806
  DefaultStorageClass.prototype.getAuthorityMetadataKeys = function () {
682
807
  var notImplErr = "Storage interface - getAuthorityMetadataKeys() has not been implemented for the cacheStorage interface.";
683
- throw AuthError$1.createUnexpectedError(notImplErr);
808
+ throw AuthError.createUnexpectedError(notImplErr);
684
809
  };
685
810
  DefaultStorageClass.prototype.setThrottlingCache = function () {
686
811
  var notImplErr = "Storage interface - setThrottlingCache() has not been implemented for the cacheStorage interface.";
687
- throw AuthError$1.createUnexpectedError(notImplErr);
812
+ throw AuthError.createUnexpectedError(notImplErr);
688
813
  };
689
814
  DefaultStorageClass.prototype.getThrottlingCache = function () {
690
815
  var notImplErr = "Storage interface - getThrottlingCache() has not been implemented for the cacheStorage interface.";
691
- throw AuthError$1.createUnexpectedError(notImplErr);
816
+ throw AuthError.createUnexpectedError(notImplErr);
692
817
  };
693
818
  DefaultStorageClass.prototype.removeItem = function () {
694
819
  var notImplErr = "Storage interface - removeItem() has not been implemented for the cacheStorage interface.";
695
- throw AuthError$1.createUnexpectedError(notImplErr);
820
+ throw AuthError.createUnexpectedError(notImplErr);
696
821
  };
697
822
  DefaultStorageClass.prototype.containsKey = function () {
698
823
  var notImplErr = "Storage interface - containsKey() has not been implemented for the cacheStorage interface.";
699
- throw AuthError$1.createUnexpectedError(notImplErr);
824
+ throw AuthError.createUnexpectedError(notImplErr);
700
825
  };
701
826
  DefaultStorageClass.prototype.getKeys = function () {
702
827
  var notImplErr = "Storage interface - getKeys() has not been implemented for the cacheStorage interface.";
703
- throw AuthError$1.createUnexpectedError(notImplErr);
828
+ throw AuthError.createUnexpectedError(notImplErr);
704
829
  };
705
830
  DefaultStorageClass.prototype.clear = function () {
706
- var notImplErr = "Storage interface - clear() has not been implemented for the cacheStorage interface.";
707
- throw AuthError$1.createUnexpectedError(notImplErr);
831
+ return __awaiter(this, void 0, void 0, function () {
832
+ var notImplErr;
833
+ return __generator(this, function (_a) {
834
+ notImplErr = "Storage interface - clear() has not been implemented for the cacheStorage interface.";
835
+ throw AuthError.createUnexpectedError(notImplErr);
836
+ });
837
+ });
708
838
  };
709
839
  return DefaultStorageClass;
710
840
  }(CacheManager));