@azure/msal-common 5.0.0 → 5.1.1

package/dist/client/OnBehalfOfClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"OnBehalfOfClient.js","sources":["../../src/client/OnBehalfOfClient.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { ClientConfiguration } from \"../config/ClientConfiguration\";\r\nimport { BaseClient } from \"./BaseClient\";\r\nimport { Authority } from \"../authority/Authority\";\r\nimport { RequestParameterBuilder } from \"../request/RequestParameterBuilder\";\r\nimport { ScopeSet } from \"../request/ScopeSet\";\r\nimport { GrantType, AADServerParamKeys , CredentialType, Constants, CacheOutcome } from \"../utils/Constants\";\r\nimport { ResponseHandler } from \"../response/ResponseHandler\";\r\nimport { AuthenticationResult } from \"../response/AuthenticationResult\";\r\nimport { CommonOnBehalfOfRequest } from \"../request/CommonOnBehalfOfRequest\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { CredentialFilter, CredentialCache } from \"../cache/utils/CacheTypes\";\r\nimport { AccessTokenEntity } from \"../cache/entities/AccessTokenEntity\";\r\nimport { IdTokenEntity } from \"../cache/entities/IdTokenEntity\";\r\nimport { AccountEntity } from \"../cache/entities/AccountEntity\";\r\nimport { AuthToken } from \"../account/AuthToken\";\r\nimport { ClientAuthError } from \"../error/ClientAuthError\";\r\nimport { RequestThumbprint } from \"../network/RequestThumbprint\";\r\nimport { AccountInfo } from \"../account/AccountInfo\";\r\n\r\n/**\r\n * On-Behalf-Of client\r\n */\r\nexport class OnBehalfOfClient extends BaseClient {\r\n\r\n    private scopeSet: ScopeSet;\r\n\r\n    constructor(configuration: ClientConfiguration) {\r\n        super(configuration);\r\n    }\r\n\r\n    /**\r\n     * Public API to acquire tokens with on behalf of flow\r\n     * @param request\r\n     */\r\n    public async acquireToken(request: CommonOnBehalfOfRequest): Promise<AuthenticationResult | null> {\r\n        this.scopeSet = new ScopeSet(request.scopes || []);\r\n\r\n        if (request.skipCache) {\r\n            return await this.executeTokenRequest(request, this.authority);\r\n        }\r\n\r\n        const cachedAuthenticationResult = await this.getCachedAuthenticationResult(request);\r\n        if (cachedAuthenticationResult) {\r\n            return cachedAuthenticationResult;\r\n        } else {\r\n            return await this.executeTokenRequest(request, this.authority);\r\n        }\r\n    }\r\n\r\n    /**\r\n     * look up cache for tokens\r\n     * @param request\r\n     */\r\n    private async getCachedAuthenticationResult(request: CommonOnBehalfOfRequest): Promise<AuthenticationResult | null> {\r\n        const cachedAccessToken = this.readAccessTokenFromCache();\r\n        if (!cachedAccessToken ||\r\n            TimeUtils.isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {\r\n\r\n            // Update the server telemetry outcome\r\n            this.serverTelemetryManager?.setCacheOutcome(!cachedAccessToken ? CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED : CacheOutcome.NO_CACHED_ACCESS_TOKEN);\r\n\r\n            return null;\r\n        }\r\n\r\n        const cachedIdToken = this.readIdTokenFromCache(request);\r\n        let idTokenObject: AuthToken | undefined;\r\n        let cachedAccount: AccountEntity | null = null;\r\n        if (cachedIdToken) {\r\n            idTokenObject = new AuthToken(cachedIdToken.secret, this.config.cryptoInterface);\r\n            const localAccountId = idTokenObject.claims.oid ? idTokenObject.claims.oid : idTokenObject.claims.sub;\r\n            const accountInfo: AccountInfo = {\r\n                homeAccountId: cachedIdToken.homeAccountId,\r\n                environment: cachedIdToken.environment,\r\n                tenantId: cachedIdToken.realm,\r\n                username: Constants.EMPTY_STRING,\r\n                localAccountId: localAccountId || \"\"\r\n            };\r\n\r\n            cachedAccount = this.readAccountFromCache(accountInfo);\r\n        }\r\n\r\n        return await ResponseHandler.generateAuthenticationResult(\r\n            this.cryptoUtils,\r\n            this.authority,\r\n            {\r\n                account: cachedAccount,\r\n                accessToken: cachedAccessToken,\r\n                idToken: cachedIdToken,\r\n                refreshToken: null,\r\n                appMetadata: null\r\n            },\r\n            true,\r\n            request,\r\n            idTokenObject);\r\n    }\r\n\r\n    /**\r\n     * read access token from cache TODO: CacheManager API should be used here\r\n     * @param request\r\n     */\r\n    private readAccessTokenFromCache(): AccessTokenEntity | null {\r\n        const accessTokenFilter: CredentialFilter = {\r\n            environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,\r\n            credentialType: CredentialType.ACCESS_TOKEN,\r\n            clientId: this.config.authOptions.clientId,\r\n            realm: this.authority.tenant,\r\n            target: this.scopeSet.printScopesLowerCase(),\r\n        };\r\n\r\n        const credentialCache: CredentialCache = this.cacheManager.getCredentialsFilteredBy(accessTokenFilter);\r\n        const accessTokens = Object.keys(credentialCache.accessTokens).map(key => credentialCache.accessTokens[key]);\r\n\r\n        const numAccessTokens = accessTokens.length;\r\n        if (numAccessTokens < 1) {\r\n            return null;\r\n        } else if (numAccessTokens > 1) {\r\n            throw ClientAuthError.createMultipleMatchingTokensInCacheError();\r\n        }\r\n        return accessTokens[0] as AccessTokenEntity;\r\n    }\r\n\r\n    /**\r\n     * read idtoken from cache TODO: CacheManager API should be used here instead\r\n     * @param request\r\n     */\r\n    private readIdTokenFromCache(request: CommonOnBehalfOfRequest): IdTokenEntity | null {\r\n        const idTokenFilter: CredentialFilter = {\r\n            environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,\r\n            credentialType: CredentialType.ID_TOKEN,\r\n            clientId: this.config.authOptions.clientId,\r\n            realm: this.authority.tenant,\r\n            oboAssertion: request.oboAssertion\r\n        };\r\n\r\n        const credentialCache: CredentialCache = this.cacheManager.getCredentialsFilteredBy(idTokenFilter);\r\n        const idTokens = Object.keys(credentialCache.idTokens).map(key => credentialCache.idTokens[key]);\r\n        // When acquiring a token on behalf of an application, there might not be an id token in the cache\r\n        if (idTokens.length < 1) {\r\n            return null;\r\n        }\r\n        return idTokens[0] as IdTokenEntity;\r\n    }\r\n\r\n    /**\r\n     * read account from cache, TODO: CacheManager API should be used here instead\r\n     * @param account\r\n     */\r\n    private readAccountFromCache(account: AccountInfo): AccountEntity | null {\r\n        return this.cacheManager.readAccountFromCache(account);\r\n    }\r\n\r\n    /**\r\n     * Make a network call to the server requesting credentials\r\n     * @param request\r\n     * @param authority\r\n     */\r\n    private async executeTokenRequest(request: CommonOnBehalfOfRequest, authority: Authority)\r\n        : Promise<AuthenticationResult | null> {\r\n\r\n        const requestBody = this.createTokenRequestBody(request);\r\n        const headers: Record<string, string> = this.createTokenRequestHeaders();\r\n        const thumbprint: RequestThumbprint = {\r\n            clientId: this.config.authOptions.clientId,\r\n            authority: request.authority,\r\n            scopes: request.scopes,\r\n            authenticationScheme: request.authenticationScheme,\r\n            resourceRequestMethod: request.resourceRequestMethod,\r\n            resourceRequestUri: request.resourceRequestUri,\r\n            shrClaims: request.shrClaims\r\n        };\r\n\r\n        const reqTimestamp = TimeUtils.nowSeconds();\r\n        const response = await this.executePostToTokenEndpoint(authority.tokenEndpoint, requestBody, headers, thumbprint);\r\n\r\n        const responseHandler = new ResponseHandler(\r\n            this.config.authOptions.clientId,\r\n            this.cacheManager,\r\n            this.cryptoUtils,\r\n            this.logger,\r\n            this.config.serializableCache,\r\n            this.config.persistencePlugin\r\n        );\r\n\r\n        responseHandler.validateTokenResponse(response.body);\r\n        const tokenResponse = await responseHandler.handleServerTokenResponse(\r\n            response.body,\r\n            this.authority,\r\n            reqTimestamp,\r\n            request\r\n        );\r\n\r\n        return tokenResponse;\r\n    }\r\n\r\n    /**\r\n     * generate a server request in accepable format\r\n     * @param request\r\n     */\r\n    private createTokenRequestBody(request: CommonOnBehalfOfRequest): string {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n\r\n        parameterBuilder.addClientId(this.config.authOptions.clientId);\r\n\r\n        parameterBuilder.addScopes(request.scopes);\r\n\r\n        parameterBuilder.addGrantType(GrantType.JWT_BEARER);\r\n\r\n        parameterBuilder.addClientInfo();\r\n\r\n        parameterBuilder.addLibraryInfo(this.config.libraryInfo);\r\n\r\n        parameterBuilder.addThrottling();\r\n        \r\n        if (this.serverTelemetryManager) {\r\n            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);\r\n        }\r\n\r\n        const correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();\r\n        parameterBuilder.addCorrelationId(correlationId);\r\n\r\n        parameterBuilder.addRequestTokenUse(AADServerParamKeys.ON_BEHALF_OF);\r\n\r\n        parameterBuilder.addOboAssertion(request.oboAssertion);\r\n\r\n        if (this.config.clientCredentials.clientSecret) {\r\n            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);\r\n        }\r\n\r\n        if (this.config.clientCredentials.clientAssertion) {\r\n            const clientAssertion = this.config.clientCredentials.clientAssertion;\r\n            parameterBuilder.addClientAssertion(clientAssertion.assertion);\r\n            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);\r\n        }\r\n\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;AAwBA;;;;IAGsC,oCAAU;IAI5C,0BAAY,aAAkC;eAC1C,kBAAM,aAAa,CAAC;KACvB;;;;;IAMY,uCAAY,GAAzB,UAA0B,OAAgC;;;;;;wBACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;6BAE/C,OAAO,CAAC,SAAS,EAAjB,wBAAiB;wBACV,qBAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAA;4BAA9D,sBAAO,SAAuD,EAAC;4BAGhC,qBAAM,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,EAAA;;wBAA9E,0BAA0B,GAAG,SAAiD;6BAChF,0BAA0B,EAA1B,wBAA0B;wBAC1B,sBAAO,0BAA0B,EAAC;4BAE3B,qBAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAA;4BAA9D,sBAAO,SAAuD,EAAC;;;;KAEtE;;;;;IAMa,wDAA6B,GAA3C,UAA4C,OAAgC;;;;;;;wBAClE,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAC;wBAC1D,IAAI,CAAC,iBAAiB;4BAClB,SAAS,CAAC,cAAc,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,EAAE;;4BAG5G,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,CAAC,iBAAiB,GAAG,YAAY,CAAC,2BAA2B,GAAG,YAAY,CAAC,sBAAsB,EAAE;4BAElJ,sBAAO,IAAI,EAAC;yBACf;wBAEK,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;wBAErD,aAAa,GAAyB,IAAI,CAAC;wBAC/C,IAAI,aAAa,EAAE;4BACf,aAAa,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;4BAC3E,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;4BAChG,WAAW,GAAgB;gCAC7B,aAAa,EAAE,aAAa,CAAC,aAAa;gCAC1C,WAAW,EAAE,aAAa,CAAC,WAAW;gCACtC,QAAQ,EAAE,aAAa,CAAC,KAAK;gCAC7B,QAAQ,EAAE,SAAS,CAAC,YAAY;gCAChC,cAAc,EAAE,cAAc,IAAI,EAAE;6BACvC,CAAC;4BAEF,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;yBAC1D;wBAEM,qBAAM,eAAe,CAAC,4BAA4B,CACrD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd;gCACI,OAAO,EAAE,aAAa;gCACtB,WAAW,EAAE,iBAAiB;gCAC9B,OAAO,EAAE,aAAa;gCACtB,YAAY,EAAE,IAAI;gCAClB,WAAW,EAAE,IAAI;6BACpB,EACD,IAAI,EACJ,OAAO,EACP,aAAa,CAAC,EAAA;4BAZlB,sBAAO,SAYW,EAAC;;;;KACtB;;;;;IAMO,mDAAwB,GAAhC;QACI,IAAM,iBAAiB,GAAqB;YACxC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,+BAA+B,CAAC,eAAe;YAC3E,cAAc,EAAE,cAAc,CAAC,YAAY;YAC3C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;YAC1C,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;YAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE;SAC/C,CAAC;QAEF,IAAM,eAAe,GAAoB,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QACvG,IAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,UAAA,GAAG,IAAI,OAAA,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,GAAA,CAAC,CAAC;QAE7G,IAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC;QAC5C,IAAI,eAAe,GAAG,CAAC,EAAE;YACrB,OAAO,IAAI,CAAC;SACf;aAAM,IAAI,eAAe,GAAG,CAAC,EAAE;YAC5B,MAAM,eAAe,CAAC,wCAAwC,EAAE,CAAC;SACpE;QACD,OAAO,YAAY,CAAC,CAAC,CAAsB,CAAC;KAC/C;;;;;IAMO,+CAAoB,GAA5B,UAA6B,OAAgC;QACzD,IAAM,aAAa,GAAqB;YACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,+BAA+B,CAAC,eAAe;YAC3E,cAAc,EAAE,cAAc,CAAC,QAAQ;YACvC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;YAC1C,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;YAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;SACrC,CAAC;QAEF,IAAM,eAAe,GAAoB,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC;QACnG,IAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAA,GAAG,IAAI,OAAA,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAA,CAAC,CAAC;;QAEjG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACrB,OAAO,IAAI,CAAC;SACf;QACD,OAAO,QAAQ,CAAC,CAAC,CAAkB,CAAC;KACvC;;;;;IAMO,+CAAoB,GAA5B,UAA6B,OAAoB;QAC7C,OAAO,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;KAC1D;;;;;;IAOa,8CAAmB,GAAjC,UAAkC,OAAgC,EAAE,SAAoB;;;;;;wBAG9E,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;wBACnD,OAAO,GAA2B,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBACnE,UAAU,GAAsB;4BAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;4BAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;4BAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;4BACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;4BAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;yBAC/B,CAAC;wBAEI,YAAY,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;wBAC3B,qBAAM,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,EAAA;;wBAA3G,QAAQ,GAAG,SAAgG;wBAE3G,eAAe,GAAG,IAAI,eAAe,CACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAChC,CAAC;wBAEF,eAAe,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC/B,qBAAM,eAAe,CAAC,yBAAyB,CACjE,QAAQ,CAAC,IAAI,EACb,IAAI,CAAC,SAAS,EACd,YAAY,EACZ,OAAO,CACV,EAAA;;wBALK,aAAa,GAAG,SAKrB;wBAED,sBAAO,aAAa,EAAC;;;;KACxB;;;;;IAMO,iDAAsB,GAA9B,UAA+B,OAAgC;QAC3D,IAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAEvD,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAE/D,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE3C,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAEpD,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAEjC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEzD,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAEjC,IAAI,IAAI,CAAC,sBAAsB,EAAE;YAC7B,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;SACpE;QAED,IAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;QAC3F,gBAAgB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAEjD,gBAAgB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAErE,gBAAgB,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEvD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE;YAC5C,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;SAChF;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE;YAC/C,IAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC;YACtE,gBAAgB,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC/D,gBAAgB,CAAC,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;SAC1E;QAED,OAAO,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;KAC/C;IACL,uBAAC;AAAD,CAtNA,CAAsC,UAAU;;;;"}
+{"version":3,"file":"OnBehalfOfClient.js","sources":["../../src/client/OnBehalfOfClient.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { ClientConfiguration } from \"../config/ClientConfiguration\";\r\nimport { BaseClient } from \"./BaseClient\";\r\nimport { Authority } from \"../authority/Authority\";\r\nimport { RequestParameterBuilder } from \"../request/RequestParameterBuilder\";\r\nimport { ScopeSet } from \"../request/ScopeSet\";\r\nimport { GrantType, AADServerParamKeys , CredentialType, Constants, CacheOutcome } from \"../utils/Constants\";\r\nimport { ResponseHandler } from \"../response/ResponseHandler\";\r\nimport { AuthenticationResult } from \"../response/AuthenticationResult\";\r\nimport { CommonOnBehalfOfRequest } from \"../request/CommonOnBehalfOfRequest\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { CredentialFilter, CredentialCache } from \"../cache/utils/CacheTypes\";\r\nimport { AccessTokenEntity } from \"../cache/entities/AccessTokenEntity\";\r\nimport { IdTokenEntity } from \"../cache/entities/IdTokenEntity\";\r\nimport { AccountEntity } from \"../cache/entities/AccountEntity\";\r\nimport { AuthToken } from \"../account/AuthToken\";\r\nimport { ClientAuthError } from \"../error/ClientAuthError\";\r\nimport { RequestThumbprint } from \"../network/RequestThumbprint\";\r\nimport { AccountInfo } from \"../account/AccountInfo\";\r\n\r\n/**\r\n * On-Behalf-Of client\r\n */\r\nexport class OnBehalfOfClient extends BaseClient {\r\n\r\n    private scopeSet: ScopeSet;\r\n\r\n    constructor(configuration: ClientConfiguration) {\r\n        super(configuration);\r\n    }\r\n\r\n    /**\r\n     * Public API to acquire tokens with on behalf of flow\r\n     * @param request\r\n     */\r\n    public async acquireToken(request: CommonOnBehalfOfRequest): Promise<AuthenticationResult | null> {\r\n        this.scopeSet = new ScopeSet(request.scopes || []);\r\n\r\n        if (request.skipCache) {\r\n            return await this.executeTokenRequest(request, this.authority);\r\n        }\r\n\r\n        const cachedAuthenticationResult = await this.getCachedAuthenticationResult(request);\r\n        if (cachedAuthenticationResult) {\r\n            return cachedAuthenticationResult;\r\n        } else {\r\n            return await this.executeTokenRequest(request, this.authority);\r\n        }\r\n    }\r\n\r\n    /**\r\n     * look up cache for tokens\r\n     * @param request\r\n     */\r\n    private async getCachedAuthenticationResult(request: CommonOnBehalfOfRequest): Promise<AuthenticationResult | null> {\r\n        const cachedAccessToken = this.readAccessTokenFromCache();\r\n        if (!cachedAccessToken ||\r\n            TimeUtils.isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {\r\n\r\n            // Update the server telemetry outcome\r\n            this.serverTelemetryManager?.setCacheOutcome(!cachedAccessToken ? CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED : CacheOutcome.NO_CACHED_ACCESS_TOKEN);\r\n\r\n            return null;\r\n        }\r\n\r\n        const cachedIdToken = this.readIdTokenFromCache(request);\r\n        let idTokenObject: AuthToken | undefined;\r\n        let cachedAccount: AccountEntity | null = null;\r\n        if (cachedIdToken) {\r\n            idTokenObject = new AuthToken(cachedIdToken.secret, this.config.cryptoInterface);\r\n            const localAccountId = idTokenObject.claims.oid ? idTokenObject.claims.oid : idTokenObject.claims.sub;\r\n            const accountInfo: AccountInfo = {\r\n                homeAccountId: cachedIdToken.homeAccountId,\r\n                environment: cachedIdToken.environment,\r\n                tenantId: cachedIdToken.realm,\r\n                username: Constants.EMPTY_STRING,\r\n                localAccountId: localAccountId || \"\"\r\n            };\r\n\r\n            cachedAccount = this.readAccountFromCache(accountInfo);\r\n        }\r\n\r\n        return await ResponseHandler.generateAuthenticationResult(\r\n            this.cryptoUtils,\r\n            this.authority,\r\n            {\r\n                account: cachedAccount,\r\n                accessToken: cachedAccessToken,\r\n                idToken: cachedIdToken,\r\n                refreshToken: null,\r\n                appMetadata: null\r\n            },\r\n            true,\r\n            request,\r\n            idTokenObject);\r\n    }\r\n\r\n    /**\r\n     * read access token from cache TODO: CacheManager API should be used here\r\n     * @param request\r\n     */\r\n    private readAccessTokenFromCache(): AccessTokenEntity | null {\r\n        const accessTokenFilter: CredentialFilter = {\r\n            environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,\r\n            credentialType: CredentialType.ACCESS_TOKEN,\r\n            clientId: this.config.authOptions.clientId,\r\n            realm: this.authority.tenant,\r\n            target: this.scopeSet.printScopesLowerCase(),\r\n        };\r\n\r\n        const credentialCache: CredentialCache = this.cacheManager.getCredentialsFilteredBy(accessTokenFilter);\r\n        const accessTokens = Object.keys(credentialCache.accessTokens).map(key => credentialCache.accessTokens[key]);\r\n\r\n        const numAccessTokens = accessTokens.length;\r\n        if (numAccessTokens < 1) {\r\n            return null;\r\n        } else if (numAccessTokens > 1) {\r\n            throw ClientAuthError.createMultipleMatchingTokensInCacheError();\r\n        }\r\n        return accessTokens[0] as AccessTokenEntity;\r\n    }\r\n\r\n    /**\r\n     * read idtoken from cache TODO: CacheManager API should be used here instead\r\n     * @param request\r\n     */\r\n    private readIdTokenFromCache(request: CommonOnBehalfOfRequest): IdTokenEntity | null {\r\n        const idTokenFilter: CredentialFilter = {\r\n            environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,\r\n            credentialType: CredentialType.ID_TOKEN,\r\n            clientId: this.config.authOptions.clientId,\r\n            realm: this.authority.tenant,\r\n            oboAssertion: request.oboAssertion\r\n        };\r\n\r\n        const credentialCache: CredentialCache = this.cacheManager.getCredentialsFilteredBy(idTokenFilter);\r\n        const idTokens = Object.keys(credentialCache.idTokens).map(key => credentialCache.idTokens[key]);\r\n        // When acquiring a token on behalf of an application, there might not be an id token in the cache\r\n        if (idTokens.length < 1) {\r\n            return null;\r\n        }\r\n        return idTokens[0] as IdTokenEntity;\r\n    }\r\n\r\n    /**\r\n     * read account from cache, TODO: CacheManager API should be used here instead\r\n     * @param account\r\n     */\r\n    private readAccountFromCache(account: AccountInfo): AccountEntity | null {\r\n        return this.cacheManager.readAccountFromCache(account);\r\n    }\r\n\r\n    /**\r\n     * Make a network call to the server requesting credentials\r\n     * @param request\r\n     * @param authority\r\n     */\r\n    private async executeTokenRequest(request: CommonOnBehalfOfRequest, authority: Authority)\r\n        : Promise<AuthenticationResult | null> {\r\n\r\n        const requestBody = this.createTokenRequestBody(request);\r\n        const headers: Record<string, string> = this.createTokenRequestHeaders();\r\n        const thumbprint: RequestThumbprint = {\r\n            clientId: this.config.authOptions.clientId,\r\n            authority: request.authority,\r\n            scopes: request.scopes,\r\n            authenticationScheme: request.authenticationScheme,\r\n            resourceRequestMethod: request.resourceRequestMethod,\r\n            resourceRequestUri: request.resourceRequestUri,\r\n            shrClaims: request.shrClaims,\r\n            sshJwk: request.sshJwk,\r\n            sshKid: request.sshKid\r\n        };\r\n\r\n        const reqTimestamp = TimeUtils.nowSeconds();\r\n        const response = await this.executePostToTokenEndpoint(authority.tokenEndpoint, requestBody, headers, thumbprint);\r\n\r\n        const responseHandler = new ResponseHandler(\r\n            this.config.authOptions.clientId,\r\n            this.cacheManager,\r\n            this.cryptoUtils,\r\n            this.logger,\r\n            this.config.serializableCache,\r\n            this.config.persistencePlugin\r\n        );\r\n\r\n        responseHandler.validateTokenResponse(response.body);\r\n        const tokenResponse = await responseHandler.handleServerTokenResponse(\r\n            response.body,\r\n            this.authority,\r\n            reqTimestamp,\r\n            request\r\n        );\r\n\r\n        return tokenResponse;\r\n    }\r\n\r\n    /**\r\n     * generate a server request in accepable format\r\n     * @param request\r\n     */\r\n    private createTokenRequestBody(request: CommonOnBehalfOfRequest): string {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n\r\n        parameterBuilder.addClientId(this.config.authOptions.clientId);\r\n\r\n        parameterBuilder.addScopes(request.scopes);\r\n\r\n        parameterBuilder.addGrantType(GrantType.JWT_BEARER);\r\n\r\n        parameterBuilder.addClientInfo();\r\n\r\n        parameterBuilder.addLibraryInfo(this.config.libraryInfo);\r\n\r\n        parameterBuilder.addThrottling();\r\n        \r\n        if (this.serverTelemetryManager) {\r\n            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);\r\n        }\r\n\r\n        const correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();\r\n        parameterBuilder.addCorrelationId(correlationId);\r\n\r\n        parameterBuilder.addRequestTokenUse(AADServerParamKeys.ON_BEHALF_OF);\r\n\r\n        parameterBuilder.addOboAssertion(request.oboAssertion);\r\n\r\n        if (this.config.clientCredentials.clientSecret) {\r\n            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);\r\n        }\r\n\r\n        if (this.config.clientCredentials.clientAssertion) {\r\n            const clientAssertion = this.config.clientCredentials.clientAssertion;\r\n            parameterBuilder.addClientAssertion(clientAssertion.assertion);\r\n            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);\r\n        }\r\n\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;AAwBA;;;;IAGsC,oCAAU;IAI5C,0BAAY,aAAkC;eAC1C,kBAAM,aAAa,CAAC;KACvB;;;;;IAMY,uCAAY,GAAzB,UAA0B,OAAgC;;;;;;wBACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;6BAE/C,OAAO,CAAC,SAAS,EAAjB,wBAAiB;wBACV,qBAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAA;4BAA9D,sBAAO,SAAuD,EAAC;4BAGhC,qBAAM,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,EAAA;;wBAA9E,0BAA0B,GAAG,SAAiD;6BAChF,0BAA0B,EAA1B,wBAA0B;wBAC1B,sBAAO,0BAA0B,EAAC;4BAE3B,qBAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAA;4BAA9D,sBAAO,SAAuD,EAAC;;;;KAEtE;;;;;IAMa,wDAA6B,GAA3C,UAA4C,OAAgC;;;;;;;wBAClE,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAC;wBAC1D,IAAI,CAAC,iBAAiB;4BAClB,SAAS,CAAC,cAAc,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,EAAE;;4BAG5G,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,CAAC,iBAAiB,GAAG,YAAY,CAAC,2BAA2B,GAAG,YAAY,CAAC,sBAAsB,EAAE;4BAElJ,sBAAO,IAAI,EAAC;yBACf;wBAEK,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;wBAErD,aAAa,GAAyB,IAAI,CAAC;wBAC/C,IAAI,aAAa,EAAE;4BACf,aAAa,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;4BAC3E,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;4BAChG,WAAW,GAAgB;gCAC7B,aAAa,EAAE,aAAa,CAAC,aAAa;gCAC1C,WAAW,EAAE,aAAa,CAAC,WAAW;gCACtC,QAAQ,EAAE,aAAa,CAAC,KAAK;gCAC7B,QAAQ,EAAE,SAAS,CAAC,YAAY;gCAChC,cAAc,EAAE,cAAc,IAAI,EAAE;6BACvC,CAAC;4BAEF,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;yBAC1D;wBAEM,qBAAM,eAAe,CAAC,4BAA4B,CACrD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd;gCACI,OAAO,EAAE,aAAa;gCACtB,WAAW,EAAE,iBAAiB;gCAC9B,OAAO,EAAE,aAAa;gCACtB,YAAY,EAAE,IAAI;gCAClB,WAAW,EAAE,IAAI;6BACpB,EACD,IAAI,EACJ,OAAO,EACP,aAAa,CAAC,EAAA;4BAZlB,sBAAO,SAYW,EAAC;;;;KACtB;;;;;IAMO,mDAAwB,GAAhC;QACI,IAAM,iBAAiB,GAAqB;YACxC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,+BAA+B,CAAC,eAAe;YAC3E,cAAc,EAAE,cAAc,CAAC,YAAY;YAC3C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;YAC1C,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;YAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE;SAC/C,CAAC;QAEF,IAAM,eAAe,GAAoB,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QACvG,IAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,UAAA,GAAG,IAAI,OAAA,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,GAAA,CAAC,CAAC;QAE7G,IAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC;QAC5C,IAAI,eAAe,GAAG,CAAC,EAAE;YACrB,OAAO,IAAI,CAAC;SACf;aAAM,IAAI,eAAe,GAAG,CAAC,EAAE;YAC5B,MAAM,eAAe,CAAC,wCAAwC,EAAE,CAAC;SACpE;QACD,OAAO,YAAY,CAAC,CAAC,CAAsB,CAAC;KAC/C;;;;;IAMO,+CAAoB,GAA5B,UAA6B,OAAgC;QACzD,IAAM,aAAa,GAAqB;YACpC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,+BAA+B,CAAC,eAAe;YAC3E,cAAc,EAAE,cAAc,CAAC,QAAQ;YACvC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;YAC1C,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;YAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;SACrC,CAAC;QAEF,IAAM,eAAe,GAAoB,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC;QACnG,IAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAA,GAAG,IAAI,OAAA,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAA,CAAC,CAAC;;QAEjG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACrB,OAAO,IAAI,CAAC;SACf;QACD,OAAO,QAAQ,CAAC,CAAC,CAAkB,CAAC;KACvC;;;;;IAMO,+CAAoB,GAA5B,UAA6B,OAAoB;QAC7C,OAAO,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;KAC1D;;;;;;IAOa,8CAAmB,GAAjC,UAAkC,OAAgC,EAAE,SAAoB;;;;;;wBAG9E,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;wBACnD,OAAO,GAA2B,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBACnE,UAAU,GAAsB;4BAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;4BAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;4BAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;4BACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;4BAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,MAAM,EAAE,OAAO,CAAC,MAAM;yBACzB,CAAC;wBAEI,YAAY,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;wBAC3B,qBAAM,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,EAAA;;wBAA3G,QAAQ,GAAG,SAAgG;wBAE3G,eAAe,GAAG,IAAI,eAAe,CACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAChC,CAAC;wBAEF,eAAe,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC/B,qBAAM,eAAe,CAAC,yBAAyB,CACjE,QAAQ,CAAC,IAAI,EACb,IAAI,CAAC,SAAS,EACd,YAAY,EACZ,OAAO,CACV,EAAA;;wBALK,aAAa,GAAG,SAKrB;wBAED,sBAAO,aAAa,EAAC;;;;KACxB;;;;;IAMO,iDAAsB,GAA9B,UAA+B,OAAgC;QAC3D,IAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAEvD,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAE/D,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE3C,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAEpD,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAEjC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEzD,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAEjC,IAAI,IAAI,CAAC,sBAAsB,EAAE;YAC7B,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;SACpE;QAED,IAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;QAC3F,gBAAgB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAEjD,gBAAgB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAErE,gBAAgB,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEvD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE;YAC5C,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;SAChF;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE;YAC/C,IAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC;YACtE,gBAAgB,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC/D,gBAAgB,CAAC,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;SAC1E;QAED,OAAO,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;KAC/C;IACL,uBAAC;AAAD,CAxNA,CAAsC,UAAU;;;;"}

package/dist/client/RefreshTokenClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RefreshTokenClient.d.ts","sourceRoot":"","sources":["../../src/client/RefreshTokenClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAMjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAKxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAS7E;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;gBAElC,aAAa,EAAE,mBAAmB;IAIjC,YAAY,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyB5F;;;OAGG;IACU,0BAA0B,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoCxG;;;OAGG;YACW,kCAAkC;IAsBhD;;;;OAIG;YACW,mBAAmB;IAoBjC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAUlC;;;OAGG;YACW,sBAAsB;CA8DvC"}
+{"version":3,"file":"RefreshTokenClient.d.ts","sourceRoot":"","sources":["../../src/client/RefreshTokenClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAMjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAKxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAU7E;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;gBAElC,aAAa,EAAE,mBAAmB;IAIjC,YAAY,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyB5F;;;OAGG;IACU,0BAA0B,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoCxG;;;OAGG;YACW,kCAAkC;IAsBhD;;;;OAIG;YACW,mBAAmB;IAsBjC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAUlC;;;OAGG;YACW,sBAAsB;CAoEvC"}

package/dist/client/RefreshTokenClient.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v5.1.1 2022-08-03 */
 'use strict';
 import { __extends, __awaiter, __generator, __assign } from '../_virtual/_tslib.js';
 import { BaseClient } from './BaseClient.js';
@@ -8,12 +8,13 @@ import { ResponseHandler } from '../response/ResponseHandler.js';
 import { PopTokenGenerator } from '../crypto/PopTokenGenerator.js';
 import { StringUtils } from '../utils/StringUtils.js';
 import { ClientConfigurationError } from '../error/ClientConfigurationError.js';
-import { ClientAuthError, ClientAuthErrorMessage } from '../error/ClientAuthError.js';
+import { ClientAuthError } from '../error/ClientAuthError.js';
 import { ServerError } from '../error/ServerError.js';
 import { TimeUtils } from '../utils/TimeUtils.js';
 import { UrlString } from '../url/UrlString.js';
 import { CcsCredentialType } from '../account/CcsCredential.js';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.js';
+import { InteractionRequiredAuthError, InteractionRequiredAuthErrorMessage } from '../error/InteractionRequiredAuthError.js';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -67,7 +68,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         return [2 /*return*/, this.acquireTokenWithCachedRefreshToken(request, true)];
                     }
                     catch (e) {
-                        noFamilyRTInCache = e instanceof ClientAuthError && e.errorCode === ClientAuthErrorMessage.noTokensFoundError.code;
+                        noFamilyRTInCache = e instanceof InteractionRequiredAuthError && e.errorCode === InteractionRequiredAuthErrorMessage.noTokensFoundError.code;
                         clientMismatchErrorWithFamilyRT = e instanceof ServerError && e.errorCode === Errors.INVALID_GRANT_ERROR && e.subError === Errors.CLIENT_MISMATCH_ERROR;
                         // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)
                         if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {
@@ -95,7 +96,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                 refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
                 // no refresh Token
                 if (!refreshToken) {
-                    throw ClientAuthError.createNoTokensFoundError();
+                    throw InteractionRequiredAuthError.createNoTokensFoundError();
                 }
                 refreshTokenRequest = __assign(__assign({}, request), { refreshToken: refreshToken.secret, authenticationScheme: request.authenticationScheme || AuthenticationScheme.BEARER, ccsCredential: {
                         credential: request.account.homeAccountId,
@@ -127,7 +128,9 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
-                            shrClaims: request.shrClaims
+                            shrClaims: request.shrClaims,
+                            sshJwk: request.sshJwk,
+                            sshKid: request.sshKid
                         };
                         endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
                         return [2 /*return*/, this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)];
@@ -152,9 +155,9 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      */
     RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, _a, _b, clientInfo;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
+            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, cnfString, clientInfo;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
@@ -179,12 +182,22 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         }
                         if (!(request.authenticationScheme === AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                        _b = (_a = parameterBuilder).addPopToken;
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        _b.apply(_a, [_c.sent()]);
-                        _c.label = 2;
+                        cnfString = _a.sent();
+                        parameterBuilder.addPopToken(cnfString);
+                        return [3 /*break*/, 3];
                     case 2:
+                        if (request.authenticationScheme === AuthenticationScheme.SSH) {
+                            if (request.sshJwk) {
+                                parameterBuilder.addSshJwk(request.sshJwk);
+                            }
+                            else {
+                                throw ClientConfigurationError.createMissingSshJwkError();
+                            }
+                        }
+                        _a.label = 3;
+                    case 3:
                         if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
                             parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
                         }

package/dist/client/RefreshTokenClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"RefreshTokenClient.js","sources":["../../src/client/RefreshTokenClient.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { ClientConfiguration } from \"../config/ClientConfiguration\";\r\nimport { BaseClient } from \"./BaseClient\";\r\nimport { CommonRefreshTokenRequest } from \"../request/CommonRefreshTokenRequest\";\r\nimport { Authority } from \"../authority/Authority\";\r\nimport { ServerAuthorizationTokenResponse } from \"../response/ServerAuthorizationTokenResponse\";\r\nimport { RequestParameterBuilder } from \"../request/RequestParameterBuilder\";\r\nimport { GrantType, AuthenticationScheme, Errors  } from \"../utils/Constants\";\r\nimport { ResponseHandler } from \"../response/ResponseHandler\";\r\nimport { AuthenticationResult } from \"../response/AuthenticationResult\";\r\nimport { PopTokenGenerator } from \"../crypto/PopTokenGenerator\";\r\nimport { StringUtils } from \"../utils/StringUtils\";\r\nimport { RequestThumbprint } from \"../network/RequestThumbprint\";\r\nimport { NetworkResponse } from \"../network/NetworkManager\";\r\nimport { CommonSilentFlowRequest } from \"../request/CommonSilentFlowRequest\";\r\nimport { ClientConfigurationError } from \"../error/ClientConfigurationError\";\r\nimport { ClientAuthError, ClientAuthErrorMessage } from \"../error/ClientAuthError\";\r\nimport { ServerError } from \"../error/ServerError\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { UrlString } from \"../url/UrlString\";\r\nimport { CcsCredentialType } from \"../account/CcsCredential\";\r\nimport { buildClientInfoFromHomeAccountId } from \"../account/ClientInfo\";\r\n\r\n/**\r\n * OAuth2.0 refresh token client\r\n */\r\nexport class RefreshTokenClient extends BaseClient {\r\n\r\n    constructor(configuration: ClientConfiguration) {\r\n        super(configuration);\r\n    }\r\n\r\n    public async acquireToken(request: CommonRefreshTokenRequest): Promise<AuthenticationResult>{\r\n        const reqTimestamp = TimeUtils.nowSeconds();\r\n        const response = await this.executeTokenRequest(request, this.authority);\r\n\r\n        const responseHandler = new ResponseHandler(\r\n            this.config.authOptions.clientId,\r\n            this.cacheManager,\r\n            this.cryptoUtils,\r\n            this.logger,\r\n            this.config.serializableCache,\r\n            this.config.persistencePlugin\r\n        );\r\n\r\n        responseHandler.validateTokenResponse(response.body);\r\n        return responseHandler.handleServerTokenResponse(\r\n            response.body,\r\n            this.authority,\r\n            reqTimestamp,\r\n            request,\r\n            undefined,\r\n            undefined,\r\n            true\r\n        );\r\n    }\r\n\r\n    /**\r\n     * Gets cached refresh token and attaches to request, then calls acquireToken API\r\n     * @param request\r\n     */\r\n    public async acquireTokenByRefreshToken(request: CommonSilentFlowRequest): Promise<AuthenticationResult> {\r\n        // Cannot renew token if no request object is given.\r\n        if (!request) {\r\n            throw ClientConfigurationError.createEmptyTokenRequestError();\r\n        }\r\n\r\n        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases\r\n        if (!request.account) {\r\n            throw ClientAuthError.createNoAccountInSilentRequestError();\r\n        }\r\n\r\n        // try checking if FOCI is enabled for the given application\r\n        const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, this.config.authOptions.clientId);\r\n\r\n        // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest\r\n        if (isFOCI) {\r\n            try {\r\n                return this.acquireTokenWithCachedRefreshToken(request, true);\r\n            } catch (e) {\r\n                const noFamilyRTInCache = e instanceof ClientAuthError && e.errorCode === ClientAuthErrorMessage.noTokensFoundError.code;\r\n                const clientMismatchErrorWithFamilyRT = e instanceof ServerError && e.errorCode === Errors.INVALID_GRANT_ERROR && e.subError === Errors.CLIENT_MISMATCH_ERROR;\r\n\r\n                // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)\r\n                if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {\r\n                    return this.acquireTokenWithCachedRefreshToken(request, false);\r\n                // throw in all other cases\r\n                } else {\r\n                    throw e;\r\n                }\r\n            }\r\n        }\r\n\r\n        // fall back to application refresh token acquisition\r\n        return this.acquireTokenWithCachedRefreshToken(request, false);\r\n    }\r\n\r\n    /**\r\n     * makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached\r\n     * @param request\r\n     */\r\n    private async acquireTokenWithCachedRefreshToken(request: CommonSilentFlowRequest, foci: boolean) {\r\n        // fetches family RT or application RT based on FOCI value\r\n        const refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);\r\n\r\n        // no refresh Token\r\n        if (!refreshToken) {\r\n            throw ClientAuthError.createNoTokensFoundError();\r\n        }\r\n\r\n        const refreshTokenRequest: CommonRefreshTokenRequest = {\r\n            ...request,\r\n            refreshToken: refreshToken.secret,\r\n            authenticationScheme: request.authenticationScheme || AuthenticationScheme.BEARER,\r\n            ccsCredential: {\r\n                credential: request.account.homeAccountId,\r\n                type: CcsCredentialType.HOME_ACCOUNT_ID\r\n            }\r\n        };\r\n\r\n        return this.acquireToken(refreshTokenRequest);\r\n    }\r\n\r\n    /**\r\n     * Constructs the network message and makes a NW call to the underlying secure token service\r\n     * @param request\r\n     * @param authority\r\n     */\r\n    private async executeTokenRequest(request: CommonRefreshTokenRequest, authority: Authority)\r\n        : Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {\r\n\r\n        const requestBody = await this.createTokenRequestBody(request);\r\n        const queryParameters = this.createTokenQueryParameters(request);\r\n        const headers: Record<string, string> = this.createTokenRequestHeaders(request.ccsCredential);\r\n        const thumbprint: RequestThumbprint = {\r\n            clientId: this.config.authOptions.clientId,\r\n            authority: authority.canonicalAuthority,\r\n            scopes: request.scopes,\r\n            authenticationScheme: request.authenticationScheme,\r\n            resourceRequestMethod: request.resourceRequestMethod,\r\n            resourceRequestUri: request.resourceRequestUri,\r\n            shrClaims: request.shrClaims\r\n        };\r\n\r\n        const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);\r\n        return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint);\r\n    }\r\n\r\n    /**\r\n     * Creates query string for the /token request\r\n     * @param request \r\n     */\r\n    private createTokenQueryParameters(request: CommonRefreshTokenRequest): string {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n\r\n        if (request.tokenQueryParameters) {\r\n            parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);\r\n        }\r\n\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n\r\n    /**\r\n     * Helper function to create the token request body\r\n     * @param request\r\n     */\r\n    private async createTokenRequestBody(request: CommonRefreshTokenRequest): Promise<string> {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n\r\n        parameterBuilder.addClientId(this.config.authOptions.clientId);\r\n\r\n        parameterBuilder.addScopes(request.scopes);\r\n\r\n        parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);\r\n\r\n        parameterBuilder.addClientInfo();\r\n\r\n        parameterBuilder.addLibraryInfo(this.config.libraryInfo);\r\n\r\n        parameterBuilder.addThrottling();\r\n        \r\n        if (this.serverTelemetryManager) {\r\n            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);\r\n        }\r\n\r\n        const correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();\r\n        parameterBuilder.addCorrelationId(correlationId);\r\n\r\n        parameterBuilder.addRefreshToken(request.refreshToken);\r\n\r\n        if (this.config.clientCredentials.clientSecret) {\r\n            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);\r\n        }\r\n\r\n        if (this.config.clientCredentials.clientAssertion) {\r\n            const clientAssertion = this.config.clientCredentials.clientAssertion;\r\n            parameterBuilder.addClientAssertion(clientAssertion.assertion);\r\n            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);\r\n        }\r\n\r\n        if (request.authenticationScheme === AuthenticationScheme.POP) {\r\n            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);\r\n\r\n            parameterBuilder.addPopToken(await popTokenGenerator.generateCnf(request));\r\n        }\r\n\r\n        if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {\r\n            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);\r\n        }\r\n\r\n        if (this.config.systemOptions.preventCorsPreflight && request.ccsCredential) {\r\n            switch (request.ccsCredential.type) {\r\n                case CcsCredentialType.HOME_ACCOUNT_ID:\r\n                    try {\r\n                        const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);\r\n                        parameterBuilder.addCcsOid(clientInfo);\r\n                    } catch (e) {\r\n                        this.logger.verbose(\"Could not parse home account ID for CCS Header: \" + e);\r\n                    }\r\n                    break;\r\n                case CcsCredentialType.UPN:\r\n                    parameterBuilder.addCcsUpn(request.ccsCredential.credential);\r\n                    break;\r\n            }\r\n        }\r\n\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;AA2BA;;;;IAGwC,sCAAU;IAE9C,4BAAY,aAAkC;eAC1C,kBAAM,aAAa,CAAC;KACvB;IAEY,yCAAY,GAAzB,UAA0B,OAAkC;;;;;;wBAClD,YAAY,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;wBAC3B,qBAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAA;;wBAAlE,QAAQ,GAAG,SAAuD;wBAElE,eAAe,GAAG,IAAI,eAAe,CACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAChC,CAAC;wBAEF,eAAe,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBACrD,sBAAO,eAAe,CAAC,yBAAyB,CAC5C,QAAQ,CAAC,IAAI,EACb,IAAI,CAAC,SAAS,EACd,YAAY,EACZ,OAAO,EACP,SAAS,EACT,SAAS,EACT,IAAI,CACP,EAAC;;;;KACL;;;;;IAMY,uDAA0B,GAAvC,UAAwC,OAAgC;;;;;gBAEpE,IAAI,CAAC,OAAO,EAAE;oBACV,MAAM,wBAAwB,CAAC,4BAA4B,EAAE,CAAC;iBACjE;;gBAGD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;oBAClB,MAAM,eAAe,CAAC,mCAAmC,EAAE,CAAC;iBAC/D;gBAGK,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;;gBAGlH,IAAI,MAAM,EAAE;oBACR,IAAI;wBACA,sBAAO,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAC;qBACjE;oBAAC,OAAO,CAAC,EAAE;wBACF,iBAAiB,GAAG,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,SAAS,KAAK,sBAAsB,CAAC,kBAAkB,CAAC,IAAI,CAAC;wBACnH,+BAA+B,GAAG,CAAC,YAAY,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,qBAAqB,CAAC;;wBAG9J,IAAI,iBAAiB,IAAI,+BAA+B,EAAE;4BACtD,sBAAO,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAC;;yBAElE;6BAAM;4BACH,MAAM,CAAC,CAAC;yBACX;qBACJ;iBACJ;;gBAGD,sBAAO,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAC;;;KAClE;;;;;IAMa,+DAAkC,GAAhD,UAAiD,OAAgC,EAAE,IAAa;;;;gBAEtF,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;;gBAG1H,IAAI,CAAC,YAAY,EAAE;oBACf,MAAM,eAAe,CAAC,wBAAwB,EAAE,CAAC;iBACpD;gBAEK,mBAAmB,yBAClB,OAAO,KACV,YAAY,EAAE,YAAY,CAAC,MAAM,EACjC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,EACjF,aAAa,EAAE;wBACX,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;wBACzC,IAAI,EAAE,iBAAiB,CAAC,eAAe;qBAC1C,GACJ,CAAC;gBAEF,sBAAO,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,EAAC;;;KACjD;;;;;;IAOa,gDAAmB,GAAjC,UAAkC,OAAkC,EAAE,SAAoB;;;;;4BAGlE,qBAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAA;;wBAAxD,WAAW,GAAG,SAA0C;wBACxD,eAAe,GAAG,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;wBAC3D,OAAO,GAA2B,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;wBACxF,UAAU,GAAsB;4BAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;4BAC1C,SAAS,EAAE,SAAS,CAAC,kBAAkB;4BACvC,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;4BAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;4BACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;4BAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;yBAC/B,CAAC;wBAEI,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;wBACvF,sBAAO,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,EAAC;;;;KACtF;;;;;IAMO,uDAA0B,GAAlC,UAAmC,OAAkC;QACjE,IAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAEvD,IAAI,OAAO,CAAC,oBAAoB,EAAE;YAC9B,gBAAgB,CAAC,uBAAuB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;SAC1E;QAED,OAAO,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;KAC/C;;;;;IAMa,mDAAsB,GAApC,UAAqC,OAAkC;;;;;;wBAC7D,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;wBAEvD,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;wBAE/D,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBAE3C,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;wBAE7D,gBAAgB,CAAC,aAAa,EAAE,CAAC;wBAEjC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;wBAEzD,gBAAgB,CAAC,aAAa,EAAE,CAAC;wBAEjC,IAAI,IAAI,CAAC,sBAAsB,EAAE;4BAC7B,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;yBACpE;wBAEK,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;wBAC3F,gBAAgB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;wBAEjD,gBAAgB,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;wBAEvD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE;4BAC5C,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;yBAChF;wBAED,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE;4BACzC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC;4BACtE,gBAAgB,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;4BAC/D,gBAAgB,CAAC,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;yBAC1E;8BAEG,OAAO,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,GAAG,CAAA,EAAzD,wBAAyD;wBACnD,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;wBAElE,KAAA,CAAA,KAAA,gBAAgB,EAAC,WAAW,CAAA;wBAAC,qBAAM,iBAAiB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAA;;wBAAzE,cAA6B,SAA4C,EAAC,CAAC;;;wBAG/E,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE;4BAChJ,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;yBAC1F;wBAED,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,IAAI,OAAO,CAAC,aAAa,EAAE;4BACzE,QAAQ,OAAO,CAAC,aAAa,CAAC,IAAI;gCAC9B,KAAK,iBAAiB,CAAC,eAAe;oCAClC,IAAI;wCACM,UAAU,GAAG,gCAAgC,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;wCACtF,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;qCAC1C;oCAAC,OAAO,CAAC,EAAE;wCACR,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kDAAkD,GAAG,CAAC,CAAC,CAAC;qCAC/E;oCACD,MAAM;gCACV,KAAK,iBAAiB,CAAC,GAAG;oCACtB,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;oCAC7D,MAAM;6BACb;yBACJ;wBAED,sBAAO,gBAAgB,CAAC,iBAAiB,EAAE,EAAC;;;;KAC/C;IACL,yBAAC;AAAD,CA1MA,CAAwC,UAAU;;;;"}
+{"version":3,"file":"RefreshTokenClient.js","sources":["../../src/client/RefreshTokenClient.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { ClientConfiguration } from \"../config/ClientConfiguration\";\r\nimport { BaseClient } from \"./BaseClient\";\r\nimport { CommonRefreshTokenRequest } from \"../request/CommonRefreshTokenRequest\";\r\nimport { Authority } from \"../authority/Authority\";\r\nimport { ServerAuthorizationTokenResponse } from \"../response/ServerAuthorizationTokenResponse\";\r\nimport { RequestParameterBuilder } from \"../request/RequestParameterBuilder\";\r\nimport { GrantType, AuthenticationScheme, Errors  } from \"../utils/Constants\";\r\nimport { ResponseHandler } from \"../response/ResponseHandler\";\r\nimport { AuthenticationResult } from \"../response/AuthenticationResult\";\r\nimport { PopTokenGenerator } from \"../crypto/PopTokenGenerator\";\r\nimport { StringUtils } from \"../utils/StringUtils\";\r\nimport { RequestThumbprint } from \"../network/RequestThumbprint\";\r\nimport { NetworkResponse } from \"../network/NetworkManager\";\r\nimport { CommonSilentFlowRequest } from \"../request/CommonSilentFlowRequest\";\r\nimport { ClientConfigurationError } from \"../error/ClientConfigurationError\";\r\nimport { ClientAuthError } from \"../error/ClientAuthError\";\r\nimport { ServerError } from \"../error/ServerError\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { UrlString } from \"../url/UrlString\";\r\nimport { CcsCredentialType } from \"../account/CcsCredential\";\r\nimport { buildClientInfoFromHomeAccountId } from \"../account/ClientInfo\";\r\nimport { InteractionRequiredAuthError, InteractionRequiredAuthErrorMessage } from \"../error/InteractionRequiredAuthError\";\r\n\r\n/**\r\n * OAuth2.0 refresh token client\r\n */\r\nexport class RefreshTokenClient extends BaseClient {\r\n\r\n    constructor(configuration: ClientConfiguration) {\r\n        super(configuration);\r\n    }\r\n\r\n    public async acquireToken(request: CommonRefreshTokenRequest): Promise<AuthenticationResult>{\r\n        const reqTimestamp = TimeUtils.nowSeconds();\r\n        const response = await this.executeTokenRequest(request, this.authority);\r\n\r\n        const responseHandler = new ResponseHandler(\r\n            this.config.authOptions.clientId,\r\n            this.cacheManager,\r\n            this.cryptoUtils,\r\n            this.logger,\r\n            this.config.serializableCache,\r\n            this.config.persistencePlugin\r\n        );\r\n\r\n        responseHandler.validateTokenResponse(response.body);\r\n        return responseHandler.handleServerTokenResponse(\r\n            response.body,\r\n            this.authority,\r\n            reqTimestamp,\r\n            request,\r\n            undefined,\r\n            undefined,\r\n            true\r\n        );\r\n    }\r\n\r\n    /**\r\n     * Gets cached refresh token and attaches to request, then calls acquireToken API\r\n     * @param request\r\n     */\r\n    public async acquireTokenByRefreshToken(request: CommonSilentFlowRequest): Promise<AuthenticationResult> {\r\n        // Cannot renew token if no request object is given.\r\n        if (!request) {\r\n            throw ClientConfigurationError.createEmptyTokenRequestError();\r\n        }\r\n\r\n        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases\r\n        if (!request.account) {\r\n            throw ClientAuthError.createNoAccountInSilentRequestError();\r\n        }\r\n\r\n        // try checking if FOCI is enabled for the given application\r\n        const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, this.config.authOptions.clientId);\r\n\r\n        // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest\r\n        if (isFOCI) {\r\n            try {\r\n                return this.acquireTokenWithCachedRefreshToken(request, true);\r\n            } catch (e) {\r\n                const noFamilyRTInCache = e instanceof InteractionRequiredAuthError && e.errorCode === InteractionRequiredAuthErrorMessage.noTokensFoundError.code;\r\n                const clientMismatchErrorWithFamilyRT = e instanceof ServerError && e.errorCode === Errors.INVALID_GRANT_ERROR && e.subError === Errors.CLIENT_MISMATCH_ERROR;\r\n\r\n                // if family Refresh Token (FRT) cache acquisition fails or if client_mismatch error is seen with FRT, reattempt with application Refresh Token (ART)\r\n                if (noFamilyRTInCache || clientMismatchErrorWithFamilyRT) {\r\n                    return this.acquireTokenWithCachedRefreshToken(request, false);\r\n                // throw in all other cases\r\n                } else {\r\n                    throw e;\r\n                }\r\n            }\r\n        }\r\n\r\n        // fall back to application refresh token acquisition\r\n        return this.acquireTokenWithCachedRefreshToken(request, false);\r\n    }\r\n\r\n    /**\r\n     * makes a network call to acquire tokens by exchanging RefreshToken available in userCache; throws if refresh token is not cached\r\n     * @param request\r\n     */\r\n    private async acquireTokenWithCachedRefreshToken(request: CommonSilentFlowRequest, foci: boolean) {\r\n        // fetches family RT or application RT based on FOCI value\r\n        const refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);\r\n\r\n        // no refresh Token\r\n        if (!refreshToken) {\r\n            throw InteractionRequiredAuthError.createNoTokensFoundError();\r\n        }\r\n\r\n        const refreshTokenRequest: CommonRefreshTokenRequest = {\r\n            ...request,\r\n            refreshToken: refreshToken.secret,\r\n            authenticationScheme: request.authenticationScheme || AuthenticationScheme.BEARER,\r\n            ccsCredential: {\r\n                credential: request.account.homeAccountId,\r\n                type: CcsCredentialType.HOME_ACCOUNT_ID\r\n            }\r\n        };\r\n\r\n        return this.acquireToken(refreshTokenRequest);\r\n    }\r\n\r\n    /**\r\n     * Constructs the network message and makes a NW call to the underlying secure token service\r\n     * @param request\r\n     * @param authority\r\n     */\r\n    private async executeTokenRequest(request: CommonRefreshTokenRequest, authority: Authority)\r\n        : Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {\r\n\r\n        const requestBody = await this.createTokenRequestBody(request);\r\n        const queryParameters = this.createTokenQueryParameters(request);\r\n        const headers: Record<string, string> = this.createTokenRequestHeaders(request.ccsCredential);\r\n        const thumbprint: RequestThumbprint = {\r\n            clientId: this.config.authOptions.clientId,\r\n            authority: authority.canonicalAuthority,\r\n            scopes: request.scopes,\r\n            authenticationScheme: request.authenticationScheme,\r\n            resourceRequestMethod: request.resourceRequestMethod,\r\n            resourceRequestUri: request.resourceRequestUri,\r\n            shrClaims: request.shrClaims,\r\n            sshJwk: request.sshJwk,\r\n            sshKid: request.sshKid\r\n        };\r\n\r\n        const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);\r\n        return this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint);\r\n    }\r\n\r\n    /**\r\n     * Creates query string for the /token request\r\n     * @param request \r\n     */\r\n    private createTokenQueryParameters(request: CommonRefreshTokenRequest): string {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n\r\n        if (request.tokenQueryParameters) {\r\n            parameterBuilder.addExtraQueryParameters(request.tokenQueryParameters);\r\n        }\r\n\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n\r\n    /**\r\n     * Helper function to create the token request body\r\n     * @param request\r\n     */\r\n    private async createTokenRequestBody(request: CommonRefreshTokenRequest): Promise<string> {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n\r\n        parameterBuilder.addClientId(this.config.authOptions.clientId);\r\n\r\n        parameterBuilder.addScopes(request.scopes);\r\n\r\n        parameterBuilder.addGrantType(GrantType.REFRESH_TOKEN_GRANT);\r\n\r\n        parameterBuilder.addClientInfo();\r\n\r\n        parameterBuilder.addLibraryInfo(this.config.libraryInfo);\r\n\r\n        parameterBuilder.addThrottling();\r\n        \r\n        if (this.serverTelemetryManager) {\r\n            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);\r\n        }\r\n\r\n        const correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();\r\n        parameterBuilder.addCorrelationId(correlationId);\r\n\r\n        parameterBuilder.addRefreshToken(request.refreshToken);\r\n\r\n        if (this.config.clientCredentials.clientSecret) {\r\n            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);\r\n        }\r\n\r\n        if (this.config.clientCredentials.clientAssertion) {\r\n            const clientAssertion = this.config.clientCredentials.clientAssertion;\r\n            parameterBuilder.addClientAssertion(clientAssertion.assertion);\r\n            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);\r\n        }\r\n\r\n        if (request.authenticationScheme === AuthenticationScheme.POP) {\r\n            const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);\r\n            const cnfString = await popTokenGenerator.generateCnf(request);\r\n            parameterBuilder.addPopToken(cnfString);\r\n        } else if (request.authenticationScheme === AuthenticationScheme.SSH) {\r\n            if(request.sshJwk) {\r\n                parameterBuilder.addSshJwk(request.sshJwk);\r\n            } else {\r\n                throw ClientConfigurationError.createMissingSshJwkError();\r\n            }\r\n        }\r\n\r\n        if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {\r\n            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);\r\n        }\r\n\r\n        if (this.config.systemOptions.preventCorsPreflight && request.ccsCredential) {\r\n            switch (request.ccsCredential.type) {\r\n                case CcsCredentialType.HOME_ACCOUNT_ID:\r\n                    try {\r\n                        const clientInfo = buildClientInfoFromHomeAccountId(request.ccsCredential.credential);\r\n                        parameterBuilder.addCcsOid(clientInfo);\r\n                    } catch (e) {\r\n                        this.logger.verbose(\"Could not parse home account ID for CCS Header: \" + e);\r\n                    }\r\n                    break;\r\n                case CcsCredentialType.UPN:\r\n                    parameterBuilder.addCcsUpn(request.ccsCredential.credential);\r\n                    break;\r\n            }\r\n        }\r\n\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA;;;;AA4BA;;;;IAGwC,sCAAU;IAE9C,4BAAY,aAAkC;eAC1C,kBAAM,aAAa,CAAC;KACvB;IAEY,yCAAY,GAAzB,UAA0B,OAAkC;;;;;;wBAClD,YAAY,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;wBAC3B,qBAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAA;;wBAAlE,QAAQ,GAAG,SAAuD;wBAElE,eAAe,GAAG,IAAI,eAAe,CACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAChC,CAAC;wBAEF,eAAe,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBACrD,sBAAO,eAAe,CAAC,yBAAyB,CAC5C,QAAQ,CAAC,IAAI,EACb,IAAI,CAAC,SAAS,EACd,YAAY,EACZ,OAAO,EACP,SAAS,EACT,SAAS,EACT,IAAI,CACP,EAAC;;;;KACL;;;;;IAMY,uDAA0B,GAAvC,UAAwC,OAAgC;;;;;gBAEpE,IAAI,CAAC,OAAO,EAAE;oBACV,MAAM,wBAAwB,CAAC,4BAA4B,EAAE,CAAC;iBACjE;;gBAGD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;oBAClB,MAAM,eAAe,CAAC,mCAAmC,EAAE,CAAC;iBAC/D;gBAGK,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;;gBAGlH,IAAI,MAAM,EAAE;oBACR,IAAI;wBACA,sBAAO,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAC;qBACjE;oBAAC,OAAO,CAAC,EAAE;wBACF,iBAAiB,GAAG,CAAC,YAAY,4BAA4B,IAAI,CAAC,CAAC,SAAS,KAAK,mCAAmC,CAAC,kBAAkB,CAAC,IAAI,CAAC;wBAC7I,+BAA+B,GAAG,CAAC,YAAY,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,qBAAqB,CAAC;;wBAG9J,IAAI,iBAAiB,IAAI,+BAA+B,EAAE;4BACtD,sBAAO,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAC;;yBAElE;6BAAM;4BACH,MAAM,CAAC,CAAC;yBACX;qBACJ;iBACJ;;gBAGD,sBAAO,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAC;;;KAClE;;;;;IAMa,+DAAkC,GAAhD,UAAiD,OAAgC,EAAE,IAAa;;;;gBAEtF,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;;gBAG1H,IAAI,CAAC,YAAY,EAAE;oBACf,MAAM,4BAA4B,CAAC,wBAAwB,EAAE,CAAC;iBACjE;gBAEK,mBAAmB,yBAClB,OAAO,KACV,YAAY,EAAE,YAAY,CAAC,MAAM,EACjC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,EACjF,aAAa,EAAE;wBACX,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;wBACzC,IAAI,EAAE,iBAAiB,CAAC,eAAe;qBAC1C,GACJ,CAAC;gBAEF,sBAAO,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,EAAC;;;KACjD;;;;;;IAOa,gDAAmB,GAAjC,UAAkC,OAAkC,EAAE,SAAoB;;;;;4BAGlE,qBAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAA;;wBAAxD,WAAW,GAAG,SAA0C;wBACxD,eAAe,GAAG,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;wBAC3D,OAAO,GAA2B,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;wBACxF,UAAU,GAAsB;4BAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;4BAC1C,SAAS,EAAE,SAAS,CAAC,kBAAkB;4BACvC,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;4BAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;4BACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;4BAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,MAAM,EAAE,OAAO,CAAC,MAAM;yBACzB,CAAC;wBAEI,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;wBACvF,sBAAO,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,EAAC;;;;KACtF;;;;;IAMO,uDAA0B,GAAlC,UAAmC,OAAkC;QACjE,IAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAEvD,IAAI,OAAO,CAAC,oBAAoB,EAAE;YAC9B,gBAAgB,CAAC,uBAAuB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;SAC1E;QAED,OAAO,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;KAC/C;;;;;IAMa,mDAAsB,GAApC,UAAqC,OAAkC;;;;;;wBAC7D,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;wBAEvD,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;wBAE/D,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBAE3C,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;wBAE7D,gBAAgB,CAAC,aAAa,EAAE,CAAC;wBAEjC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;wBAEzD,gBAAgB,CAAC,aAAa,EAAE,CAAC;wBAEjC,IAAI,IAAI,CAAC,sBAAsB,EAAE;4BAC7B,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;yBACpE;wBAEK,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;wBAC3F,gBAAgB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;wBAEjD,gBAAgB,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;wBAEvD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE;4BAC5C,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;yBAChF;wBAED,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE;4BACzC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC;4BACtE,gBAAgB,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;4BAC/D,gBAAgB,CAAC,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;yBAC1E;8BAEG,OAAO,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,GAAG,CAAA,EAAzD,wBAAyD;wBACnD,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;wBAChD,qBAAM,iBAAiB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAA;;wBAAxD,SAAS,GAAG,SAA4C;wBAC9D,gBAAgB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;;;wBACrC,IAAI,OAAO,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,GAAG,EAAE;4BAClE,IAAG,OAAO,CAAC,MAAM,EAAE;gCACf,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;6BAC9C;iCAAM;gCACH,MAAM,wBAAwB,CAAC,wBAAwB,EAAE,CAAC;6BAC7D;yBACJ;;;wBAED,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE;4BAChJ,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;yBAC1F;wBAED,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,IAAI,OAAO,CAAC,aAAa,EAAE;4BACzE,QAAQ,OAAO,CAAC,aAAa,CAAC,IAAI;gCAC9B,KAAK,iBAAiB,CAAC,eAAe;oCAClC,IAAI;wCACM,UAAU,GAAG,gCAAgC,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;wCACtF,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;qCAC1C;oCAAC,OAAO,CAAC,EAAE;wCACR,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kDAAkD,GAAG,CAAC,CAAC,CAAC;qCAC/E;oCACD,MAAM;gCACV,KAAK,iBAAiB,CAAC,GAAG;oCACtB,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;oCAC7D,MAAM;6BACb;yBACJ;wBAED,sBAAO,gBAAgB,CAAC,iBAAiB,EAAE,EAAC;;;;KAC/C;IACL,yBAAC;AAAD,CAlNA,CAAwC,UAAU;;;;"}

package/dist/client/SilentFlowClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SilentFlowClient.d.ts","sourceRoot":"","sources":["../../src/client/SilentFlowClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAYxE,qBAAa,gBAAiB,SAAQ,UAAU;gBAEhC,aAAa,EAAE,mBAAmB;IAI9C;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAanF;;;OAGG;IACG,kBAAkB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA8CzF;;;OAGG;YACW,6BAA6B;CAc9C"}
+{"version":3,"file":"SilentFlowClient.d.ts","sourceRoot":"","sources":["../../src/client/SilentFlowClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAYxE,qBAAa,gBAAiB,SAAQ,UAAU;gBAEhC,aAAa,EAAE,mBAAmB;IAI9C;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAanF;;;OAGG;IACG,kBAAkB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsDzF;;;OAGG;YACW,6BAA6B;CAc9C"}

package/dist/client/SilentFlowClient.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v5.1.1 2022-08-03 */
 'use strict';
 import { __extends, __awaiter, __generator } from '../_virtual/_tslib.js';
 import { BaseClient } from './BaseClient.js';
@@ -64,6 +64,17 @@ var SilentFlowClient = /** @class */ (function (_super) {
                         if (!request) {
                             throw ClientConfigurationError.createEmptyTokenRequestError();
                         }
+                        if (request.forceRefresh) {
+                            // Must refresh due to present force_refresh flag.
+                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
+                            throw ClientAuthError.createRefreshRequiredError();
+                        }
+                        else if (!StringUtils.isEmptyObj(request.claims)) {
+                            // Must refresh due to request parameters.
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims are requested.");
+                            throw ClientAuthError.createRefreshRequiredError();
+                        }
                         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
                         if (!request.account) {
                             throw ClientAuthError.createNoAccountInSilentRequestError();
@@ -71,30 +82,24 @@ var SilentFlowClient = /** @class */ (function (_super) {
                         requestScopes = new ScopeSet(request.scopes || []);
                         environment = request.authority || this.authority.getPreferredCache();
                         authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
-                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme);
-                        if (request.forceRefresh) {
-                            // Must refresh due to present force_refresh flag.
-                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
-                            throw ClientAuthError.createRefreshRequiredError();
-                        }
-                        else if (!cacheRecord.accessToken) {
+                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme, request.sshKid);
+                        if (!cacheRecord.accessToken) {
                             // Must refresh due to non-existent access_token.
                             (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
                             TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
                             // Must refresh due to expired access_token.
                             (_c = this.serverTelemetryManager) === null || _c === void 0 ? void 0 : _c.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within " + this.config.systemOptions.tokenRenewalOffsetSeconds + " seconds.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         else if (cacheRecord.accessToken.refreshOn && TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
                             // Must refresh due to the refresh_in value.
                             (_d = this.serverTelemetryManager) === null || _d === void 0 ? void 0 : _d.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);
-                            throw ClientAuthError.createRefreshRequiredError();
-                        }
-                        else if (!StringUtils.isEmptyObj(request.claims)) {
-                            // Must refresh due to request parameters.
+                            this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
                         if (this.config.serverTelemetryManager) {

package/dist/client/SilentFlowClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"SilentFlowClient.js","sources":["../../src/client/SilentFlowClient.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { BaseClient } from \"./BaseClient\";\r\nimport { ClientConfiguration } from \"../config/ClientConfiguration\";\r\nimport { CommonSilentFlowRequest } from \"../request/CommonSilentFlowRequest\";\r\nimport { AuthenticationResult } from \"../response/AuthenticationResult\";\r\nimport { ScopeSet } from \"../request/ScopeSet\";\r\nimport { AuthToken } from \"../account/AuthToken\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { RefreshTokenClient } from \"./RefreshTokenClient\";\r\nimport { ClientAuthError, ClientAuthErrorMessage } from \"../error/ClientAuthError\";\r\nimport { ClientConfigurationError } from \"../error/ClientConfigurationError\";\r\nimport { ResponseHandler } from \"../response/ResponseHandler\";\r\nimport { CacheRecord } from \"../cache/entities/CacheRecord\";\r\nimport { AuthenticationScheme, CacheOutcome } from \"../utils/Constants\";\r\nimport { StringUtils } from \"../utils/StringUtils\";\r\n\r\nexport class SilentFlowClient extends BaseClient {\r\n\r\n    constructor(configuration: ClientConfiguration) {\r\n        super(configuration);\r\n    }\r\n\r\n    /**\r\n     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew\r\n     * the given token and returns the renewed token\r\n     * @param request\r\n     */\r\n    async acquireToken(request: CommonSilentFlowRequest): Promise<AuthenticationResult> {\r\n        try {\r\n            return await this.acquireCachedToken(request);\r\n        } catch (e) {\r\n            if (e instanceof ClientAuthError && e.errorCode === ClientAuthErrorMessage.tokenRefreshRequired.code) {\r\n                const refreshTokenClient = new RefreshTokenClient(this.config);\r\n                return refreshTokenClient.acquireTokenByRefreshToken(request);\r\n            } else {\r\n                throw e;\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Retrieves token from cache or throws an error if it must be refreshed.\r\n     * @param request\r\n     */\r\n    async acquireCachedToken(request: CommonSilentFlowRequest): Promise<AuthenticationResult> {\r\n        // Cannot renew token if no request object is given.\r\n        if (!request) {\r\n            throw ClientConfigurationError.createEmptyTokenRequestError();\r\n        }\r\n\r\n        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases\r\n        if (!request.account) {\r\n            throw ClientAuthError.createNoAccountInSilentRequestError();\r\n        }\r\n        const requestScopes = new ScopeSet(request.scopes || []);\r\n        const environment = request.authority || this.authority.getPreferredCache();\r\n        const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;\r\n        const cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme);\r\n       \r\n        if (request.forceRefresh) {\r\n            // Must refresh due to present force_refresh flag.\r\n            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.FORCE_REFRESH);\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        } else if (!cacheRecord.accessToken) {\r\n            // Must refresh due to non-existent access_token.\r\n            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        } else if (\r\n            TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||\r\n            TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)\r\n        ) {\r\n            // Must refresh due to expired access_token.\r\n            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        } else if (cacheRecord.accessToken.refreshOn && TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {\r\n            // Must refresh due to the refresh_in value.\r\n            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        } else if (!StringUtils.isEmptyObj(request.claims)) {\r\n            // Must refresh due to request parameters.\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        }\r\n\r\n        if (this.config.serverTelemetryManager) {\r\n            this.config.serverTelemetryManager.incrementCacheHits();\r\n        }\r\n\r\n        return await this.generateResultFromCacheRecord(cacheRecord, request);\r\n    }\r\n\r\n    /**\r\n     * Helper function to build response object from the CacheRecord\r\n     * @param cacheRecord\r\n     */\r\n    private async generateResultFromCacheRecord(cacheRecord: CacheRecord, request: CommonSilentFlowRequest): Promise<AuthenticationResult> {\r\n        let idTokenObj: AuthToken | undefined;\r\n        if (cacheRecord.idToken) {\r\n            idTokenObj = new AuthToken(cacheRecord.idToken.secret, this.config.cryptoInterface);\r\n        }\r\n        return await ResponseHandler.generateAuthenticationResult(\r\n            this.cryptoUtils,\r\n            this.authority,\r\n            cacheRecord,\r\n            true,\r\n            request,\r\n            idTokenObj\r\n        );\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA;;;;;IAoBsC,oCAAU;IAE5C,0BAAY,aAAkC;eAC1C,kBAAM,aAAa,CAAC;KACvB;;;;;;IAOK,uCAAY,GAAlB,UAAmB,OAAgC;;;;;;;wBAEpC,qBAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAA;4BAA7C,sBAAO,SAAsC,EAAC;;;wBAE9C,IAAI,GAAC,YAAY,eAAe,IAAI,GAAC,CAAC,SAAS,KAAK,sBAAsB,CAAC,oBAAoB,CAAC,IAAI,EAAE;4BAC5F,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;4BAC/D,sBAAO,kBAAkB,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAC;yBACjE;6BAAM;4BACH,MAAM,GAAC,CAAC;yBACX;;;;;KAER;;;;;IAMK,6CAAkB,GAAxB,UAAyB,OAAgC;;;;;;;;wBAErD,IAAI,CAAC,OAAO,EAAE;4BACV,MAAM,wBAAwB,CAAC,4BAA4B,EAAE,CAAC;yBACjE;;wBAGD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;4BAClB,MAAM,eAAe,CAAC,mCAAmC,EAAE,CAAC;yBAC/D;wBACK,aAAa,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;wBACnD,WAAW,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;wBACtE,UAAU,GAAG,OAAO,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,CAAC;wBACzE,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;wBAEjJ,IAAI,OAAO,CAAC,YAAY,EAAE;;4BAEtB,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,YAAY,CAAC,aAAa,EAAE;4BACzE,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;6BAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;;4BAEjC,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,YAAY,CAAC,sBAAsB,EAAE;4BAClF,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;6BAAM,IACH,SAAS,CAAC,kBAAkB,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC;4BAC9D,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,EAClH;;4BAEE,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,YAAY,CAAC,2BAA2B,EAAE;4BACvF,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;6BAAM,IAAI,WAAW,CAAC,WAAW,CAAC,SAAS,IAAI,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE;;4BAE5G,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,YAAY,CAAC,2BAA2B,EAAE;4BACvF,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;6BAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;;4BAEhD,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;wBAED,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;4BACpC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,CAAC;yBAC3D;wBAEM,qBAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,OAAO,CAAC,EAAA;4BAArE,sBAAO,SAA8D,EAAC;;;;KACzE;;;;;IAMa,wDAA6B,GAA3C,UAA4C,WAAwB,EAAE,OAAgC;;;;;;wBAElG,IAAI,WAAW,CAAC,OAAO,EAAE;4BACrB,UAAU,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;yBACvF;wBACM,qBAAM,eAAe,CAAC,4BAA4B,CACrD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd,WAAW,EACX,IAAI,EACJ,OAAO,EACP,UAAU,CACb,EAAA;4BAPD,sBAAO,SAON,EAAC;;;;KACL;IACL,uBAAC;AAAD,CA5FA,CAAsC,UAAU;;;;"}
+{"version":3,"file":"SilentFlowClient.js","sources":["../../src/client/SilentFlowClient.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { BaseClient } from \"./BaseClient\";\r\nimport { ClientConfiguration } from \"../config/ClientConfiguration\";\r\nimport { CommonSilentFlowRequest } from \"../request/CommonSilentFlowRequest\";\r\nimport { AuthenticationResult } from \"../response/AuthenticationResult\";\r\nimport { ScopeSet } from \"../request/ScopeSet\";\r\nimport { AuthToken } from \"../account/AuthToken\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { RefreshTokenClient } from \"./RefreshTokenClient\";\r\nimport { ClientAuthError, ClientAuthErrorMessage } from \"../error/ClientAuthError\";\r\nimport { ClientConfigurationError } from \"../error/ClientConfigurationError\";\r\nimport { ResponseHandler } from \"../response/ResponseHandler\";\r\nimport { CacheRecord } from \"../cache/entities/CacheRecord\";\r\nimport { AuthenticationScheme, CacheOutcome } from \"../utils/Constants\";\r\nimport { StringUtils } from \"../utils/StringUtils\";\r\n\r\nexport class SilentFlowClient extends BaseClient {\r\n\r\n    constructor(configuration: ClientConfiguration) {\r\n        super(configuration);\r\n    }\r\n\r\n    /**\r\n     * Retrieves a token from cache if it is still valid, or uses the cached refresh token to renew\r\n     * the given token and returns the renewed token\r\n     * @param request\r\n     */\r\n    async acquireToken(request: CommonSilentFlowRequest): Promise<AuthenticationResult> {\r\n        try {\r\n            return await this.acquireCachedToken(request);\r\n        } catch (e) {\r\n            if (e instanceof ClientAuthError && e.errorCode === ClientAuthErrorMessage.tokenRefreshRequired.code) {\r\n                const refreshTokenClient = new RefreshTokenClient(this.config);\r\n                return refreshTokenClient.acquireTokenByRefreshToken(request);\r\n            } else {\r\n                throw e;\r\n            }\r\n        }\r\n    }\r\n\r\n    /**\r\n     * Retrieves token from cache or throws an error if it must be refreshed.\r\n     * @param request\r\n     */\r\n    async acquireCachedToken(request: CommonSilentFlowRequest): Promise<AuthenticationResult> {\r\n        // Cannot renew token if no request object is given.\r\n        if (!request) {\r\n            throw ClientConfigurationError.createEmptyTokenRequestError();\r\n        }\r\n\r\n        if (request.forceRefresh) {\r\n            // Must refresh due to present force_refresh flag.\r\n            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.FORCE_REFRESH);\r\n            this.logger.info(\"SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.\");\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        } else if (!StringUtils.isEmptyObj(request.claims)) {\r\n            // Must refresh due to request parameters.\r\n            this.logger.info(\"SilentFlowClient:acquireCachedToken - Skipping cache because claims are requested.\");\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        }\r\n\r\n        // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases\r\n        if (!request.account) {\r\n            throw ClientAuthError.createNoAccountInSilentRequestError();\r\n        }\r\n\r\n        const requestScopes = new ScopeSet(request.scopes || []);\r\n        const environment = request.authority || this.authority.getPreferredCache();\r\n        const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;\r\n        const cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme, request.sshKid);\r\n        \r\n        if (!cacheRecord.accessToken) {\r\n            // Must refresh due to non-existent access_token.\r\n            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);\r\n            this.logger.info(\"SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.\");\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        } else if (\r\n            TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||\r\n            TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)\r\n        ) {\r\n            // Must refresh due to expired access_token.\r\n            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);\r\n            this.logger.info(`SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within ${this.config.systemOptions.tokenRenewalOffsetSeconds} seconds.`);\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        } else if (cacheRecord.accessToken.refreshOn && TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {\r\n            // Must refresh due to the refresh_in value.\r\n            this.serverTelemetryManager?.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);\r\n            this.logger.info(\"SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.\");\r\n            throw ClientAuthError.createRefreshRequiredError();\r\n        }\r\n\r\n        if (this.config.serverTelemetryManager) {\r\n            this.config.serverTelemetryManager.incrementCacheHits();\r\n        }\r\n\r\n        return await this.generateResultFromCacheRecord(cacheRecord, request);\r\n    }\r\n\r\n    /**\r\n     * Helper function to build response object from the CacheRecord\r\n     * @param cacheRecord\r\n     */\r\n    private async generateResultFromCacheRecord(cacheRecord: CacheRecord, request: CommonSilentFlowRequest): Promise<AuthenticationResult> {\r\n        let idTokenObj: AuthToken | undefined;\r\n        if (cacheRecord.idToken) {\r\n            idTokenObj = new AuthToken(cacheRecord.idToken.secret, this.config.cryptoInterface);\r\n        }\r\n        return await ResponseHandler.generateAuthenticationResult(\r\n            this.cryptoUtils,\r\n            this.authority,\r\n            cacheRecord,\r\n            true,\r\n            request,\r\n            idTokenObj\r\n        );\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA;;;;;IAoBsC,oCAAU;IAE5C,0BAAY,aAAkC;eAC1C,kBAAM,aAAa,CAAC;KACvB;;;;;;IAOK,uCAAY,GAAlB,UAAmB,OAAgC;;;;;;;wBAEpC,qBAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAA;4BAA7C,sBAAO,SAAsC,EAAC;;;wBAE9C,IAAI,GAAC,YAAY,eAAe,IAAI,GAAC,CAAC,SAAS,KAAK,sBAAsB,CAAC,oBAAoB,CAAC,IAAI,EAAE;4BAC5F,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;4BAC/D,sBAAO,kBAAkB,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAC;yBACjE;6BAAM;4BACH,MAAM,GAAC,CAAC;yBACX;;;;;KAER;;;;;IAMK,6CAAkB,GAAxB,UAAyB,OAAgC;;;;;;;;wBAErD,IAAI,CAAC,OAAO,EAAE;4BACV,MAAM,wBAAwB,CAAC,4BAA4B,EAAE,CAAC;yBACjE;wBAED,IAAI,OAAO,CAAC,YAAY,EAAE;;4BAEtB,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,YAAY,CAAC,aAAa,EAAE;4BACzE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;4BACvG,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;6BAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;;4BAEhD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;4BACvG,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;;wBAGD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;4BAClB,MAAM,eAAe,CAAC,mCAAmC,EAAE,CAAC;yBAC/D;wBAEK,aAAa,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;wBACnD,WAAW,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;wBACtE,UAAU,GAAG,OAAO,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,CAAC;wBACzE,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;wBAEjK,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;;4BAE1B,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,YAAY,CAAC,sBAAsB,EAAE;4BAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;4BACnH,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;6BAAM,IACH,SAAS,CAAC,kBAAkB,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC;4BAC9D,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,EAClH;;4BAEE,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,YAAY,CAAC,2BAA2B,EAAE;4BACvF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gGAA8F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,cAAW,CAAC,CAAC;4BAC/K,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;6BAAM,IAAI,WAAW,CAAC,WAAW,CAAC,SAAS,IAAI,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE;;4BAE5G,MAAA,IAAI,CAAC,sBAAsB,0CAAE,eAAe,CAAC,YAAY,CAAC,2BAA2B,EAAE;4BACvF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;4BACvH,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;yBACtD;wBAED,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;4BACpC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,CAAC;yBAC3D;wBAEM,qBAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,OAAO,CAAC,EAAA;4BAArE,sBAAO,SAA8D,EAAC;;;;KACzE;;;;;IAMa,wDAA6B,GAA3C,UAA4C,WAAwB,EAAE,OAAgC;;;;;;wBAElG,IAAI,WAAW,CAAC,OAAO,EAAE;4BACrB,UAAU,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;yBACvF;wBACM,qBAAM,eAAe,CAAC,4BAA4B,CACrD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd,WAAW,EACX,IAAI,EACJ,OAAO,EACP,UAAU,CACb,EAAA;4BAPD,sBAAO,SAON,EAAC;;;;KACL;IACL,uBAAC;AAAD,CApGA,CAAsC,UAAU;;;;"}

package/dist/client/UsernamePasswordClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UsernamePasswordClient.d.ts","sourceRoot":"","sources":["../../src/client/UsernamePasswordClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAYxE;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;gBAEtC,aAAa,EAAE,mBAAmB;IAI9C;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsBhG;;;;OAIG;YACW,mBAAmB;IAmBjC;;;OAGG;IACH,OAAO,CAAC,sBAAsB;CA2CjC"}
+{"version":3,"file":"UsernamePasswordClient.d.ts","sourceRoot":"","sources":["../../src/client/UsernamePasswordClient.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAYxE;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;gBAEtC,aAAa,EAAE,mBAAmB;IAI9C;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAsBhG;;;;OAIG;YACW,mBAAmB;IAqBjC;;;OAGG;IACH,OAAO,CAAC,sBAAsB;CA2CjC"}

package/dist/client/UsernamePasswordClient.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v5.1.1 2022-08-03 */
 'use strict';
 import { __extends, __awaiter, __generator } from '../_virtual/_tslib.js';
 import { BaseClient } from './BaseClient.js';
@@ -63,7 +63,9 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
                     authenticationScheme: request.authenticationScheme,
                     resourceRequestMethod: request.resourceRequestMethod,
                     resourceRequestUri: request.resourceRequestUri,
-                    shrClaims: request.shrClaims
+                    shrClaims: request.shrClaims,
+                    sshJwk: request.sshJwk,
+                    sshKid: request.sshKid
                 };
                 requestBody = this.createTokenRequestBody(request);
                 headers = this.createTokenRequestHeaders({

package/dist/client/UsernamePasswordClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"UsernamePasswordClient.js","sources":["../../src/client/UsernamePasswordClient.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { BaseClient } from \"./BaseClient\";\r\nimport { ClientConfiguration } from \"../config/ClientConfiguration\";\r\nimport { CommonUsernamePasswordRequest } from \"../request/CommonUsernamePasswordRequest\";\r\nimport { AuthenticationResult } from \"../response/AuthenticationResult\";\r\nimport { ResponseHandler } from \"../response/ResponseHandler\";\r\nimport { Authority } from \"../authority/Authority\";\r\nimport { NetworkResponse } from \"../network/NetworkManager\";\r\nimport { ServerAuthorizationTokenResponse } from \"../response/ServerAuthorizationTokenResponse\";\r\nimport { RequestParameterBuilder } from \"../request/RequestParameterBuilder\";\r\nimport { GrantType } from \"../utils/Constants\";\r\nimport { StringUtils } from \"../utils/StringUtils\";\r\nimport { RequestThumbprint } from \"../network/RequestThumbprint\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { CcsCredentialType } from \"../account/CcsCredential\";\r\n\r\n/**\r\n * Oauth2.0 Password grant client\r\n * Note: We are only supporting public clients for password grant and for purely testing purposes\r\n */\r\nexport class UsernamePasswordClient extends BaseClient {\r\n\r\n    constructor(configuration: ClientConfiguration) {\r\n        super(configuration);\r\n    }\r\n\r\n    /**\r\n     * API to acquire a token by passing the username and password to the service in exchage of credentials\r\n     * password_grant\r\n     * @param request\r\n     */\r\n    async acquireToken(request: CommonUsernamePasswordRequest): Promise<AuthenticationResult | null> {\r\n        this.logger.info(\"in acquireToken call\");\r\n\r\n        const reqTimestamp = TimeUtils.nowSeconds();\r\n        const response = await this.executeTokenRequest(this.authority, request);\r\n\r\n        const responseHandler = new ResponseHandler(\r\n            this.config.authOptions.clientId,\r\n            this.cacheManager,\r\n            this.cryptoUtils,\r\n            this.logger,\r\n            this.config.serializableCache,\r\n            this.config.persistencePlugin\r\n        );\r\n\r\n        // Validate response. This function throws a server error if an error is returned by the server.\r\n        responseHandler.validateTokenResponse(response.body);\r\n        const tokenResponse = responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request);\r\n\r\n        return tokenResponse;\r\n    }\r\n\r\n    /**\r\n     * Executes POST request to token endpoint\r\n     * @param authority\r\n     * @param request\r\n     */\r\n    private async executeTokenRequest(authority: Authority, request: CommonUsernamePasswordRequest): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {\r\n        const thumbprint: RequestThumbprint = {\r\n            clientId: this.config.authOptions.clientId,\r\n            authority: authority.canonicalAuthority,\r\n            scopes: request.scopes,\r\n            authenticationScheme: request.authenticationScheme,\r\n            resourceRequestMethod: request.resourceRequestMethod,\r\n            resourceRequestUri: request.resourceRequestUri,\r\n            shrClaims: request.shrClaims\r\n        };\r\n        const requestBody = this.createTokenRequestBody(request);\r\n        const headers: Record<string, string> = this.createTokenRequestHeaders({\r\n            credential: request.username,\r\n            type: CcsCredentialType.UPN\r\n        });\r\n\r\n        return this.executePostToTokenEndpoint(authority.tokenEndpoint, requestBody, headers, thumbprint);\r\n    }\r\n\r\n    /**\r\n     * Generates a map for all the params to be sent to the service\r\n     * @param request\r\n     */\r\n    private createTokenRequestBody(request: CommonUsernamePasswordRequest): string {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n\r\n        parameterBuilder.addClientId(this.config.authOptions.clientId);\r\n        parameterBuilder.addUsername(request.username);\r\n        parameterBuilder.addPassword(request.password);\r\n\r\n        parameterBuilder.addScopes(request.scopes);\r\n\r\n        parameterBuilder.addGrantType(GrantType.RESOURCE_OWNER_PASSWORD_GRANT);\r\n        parameterBuilder.addClientInfo();\r\n\r\n        parameterBuilder.addLibraryInfo(this.config.libraryInfo);\r\n\r\n        parameterBuilder.addThrottling();\r\n\r\n        if (this.serverTelemetryManager) {\r\n            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);\r\n        }\r\n\r\n        const correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();\r\n        parameterBuilder.addCorrelationId(correlationId);\r\n\r\n        if (this.config.clientCredentials.clientSecret) {\r\n            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);\r\n        }\r\n\r\n        if (this.config.clientCredentials.clientAssertion) {\r\n            const clientAssertion = this.config.clientCredentials.clientAssertion;\r\n            parameterBuilder.addClientAssertion(clientAssertion.assertion);\r\n            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);\r\n        }\r\n\r\n        if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {\r\n            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);\r\n        }\r\n\r\n        if (this.config.systemOptions.preventCorsPreflight && request.username) {\r\n            parameterBuilder.addCcsUpn(request.username);\r\n        }\r\n\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;;;;AAAA;;;;AAoBA;;;;;IAI4C,0CAAU;IAElD,gCAAY,aAAkC;eAC1C,kBAAM,aAAa,CAAC;KACvB;;;;;;IAOK,6CAAY,GAAlB,UAAmB,OAAsC;;;;;;wBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;wBAEnC,YAAY,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;wBAC3B,qBAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAA;;wBAAlE,QAAQ,GAAG,SAAuD;wBAElE,eAAe,GAAG,IAAI,eAAe,CACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAChC,CAAC;;wBAGF,eAAe,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC/C,aAAa,GAAG,eAAe,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;wBAEtH,sBAAO,aAAa,EAAC;;;;KACxB;;;;;;IAOa,oDAAmB,GAAjC,UAAkC,SAAoB,EAAE,OAAsC;;;;gBACpF,UAAU,GAAsB;oBAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;oBAC1C,SAAS,EAAE,SAAS,CAAC,kBAAkB;oBACvC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;oBAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;oBACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;oBAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC/B,CAAC;gBACI,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;gBACnD,OAAO,GAA2B,IAAI,CAAC,yBAAyB,CAAC;oBACnE,UAAU,EAAE,OAAO,CAAC,QAAQ;oBAC5B,IAAI,EAAE,iBAAiB,CAAC,GAAG;iBAC9B,CAAC,CAAC;gBAEH,sBAAO,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,EAAC;;;KACrG;;;;;IAMO,uDAAsB,GAA9B,UAA+B,OAAsC;QACjE,IAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAEvD,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/D,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE/C,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE3C,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACvE,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAEjC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEzD,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAEjC,IAAI,IAAI,CAAC,sBAAsB,EAAE;YAC7B,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;SACpE;QAED,IAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;QAC3F,gBAAgB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAEjD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE;YAC5C,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;SAChF;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE;YAC/C,IAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC;YACtE,gBAAgB,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC/D,gBAAgB,CAAC,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;SAC1E;QAED,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE;YAChJ,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;SAC1F;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,IAAI,OAAO,CAAC,QAAQ,EAAE;YACpE,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;SAChD;QAED,OAAO,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;KAC/C;IACL,6BAAC;AAAD,CAxGA,CAA4C,UAAU;;;;"}
+{"version":3,"file":"UsernamePasswordClient.js","sources":["../../src/client/UsernamePasswordClient.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { BaseClient } from \"./BaseClient\";\r\nimport { ClientConfiguration } from \"../config/ClientConfiguration\";\r\nimport { CommonUsernamePasswordRequest } from \"../request/CommonUsernamePasswordRequest\";\r\nimport { AuthenticationResult } from \"../response/AuthenticationResult\";\r\nimport { ResponseHandler } from \"../response/ResponseHandler\";\r\nimport { Authority } from \"../authority/Authority\";\r\nimport { NetworkResponse } from \"../network/NetworkManager\";\r\nimport { ServerAuthorizationTokenResponse } from \"../response/ServerAuthorizationTokenResponse\";\r\nimport { RequestParameterBuilder } from \"../request/RequestParameterBuilder\";\r\nimport { GrantType } from \"../utils/Constants\";\r\nimport { StringUtils } from \"../utils/StringUtils\";\r\nimport { RequestThumbprint } from \"../network/RequestThumbprint\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { CcsCredentialType } from \"../account/CcsCredential\";\r\n\r\n/**\r\n * Oauth2.0 Password grant client\r\n * Note: We are only supporting public clients for password grant and for purely testing purposes\r\n */\r\nexport class UsernamePasswordClient extends BaseClient {\r\n\r\n    constructor(configuration: ClientConfiguration) {\r\n        super(configuration);\r\n    }\r\n\r\n    /**\r\n     * API to acquire a token by passing the username and password to the service in exchage of credentials\r\n     * password_grant\r\n     * @param request\r\n     */\r\n    async acquireToken(request: CommonUsernamePasswordRequest): Promise<AuthenticationResult | null> {\r\n        this.logger.info(\"in acquireToken call\");\r\n\r\n        const reqTimestamp = TimeUtils.nowSeconds();\r\n        const response = await this.executeTokenRequest(this.authority, request);\r\n\r\n        const responseHandler = new ResponseHandler(\r\n            this.config.authOptions.clientId,\r\n            this.cacheManager,\r\n            this.cryptoUtils,\r\n            this.logger,\r\n            this.config.serializableCache,\r\n            this.config.persistencePlugin\r\n        );\r\n\r\n        // Validate response. This function throws a server error if an error is returned by the server.\r\n        responseHandler.validateTokenResponse(response.body);\r\n        const tokenResponse = responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request);\r\n\r\n        return tokenResponse;\r\n    }\r\n\r\n    /**\r\n     * Executes POST request to token endpoint\r\n     * @param authority\r\n     * @param request\r\n     */\r\n    private async executeTokenRequest(authority: Authority, request: CommonUsernamePasswordRequest): Promise<NetworkResponse<ServerAuthorizationTokenResponse>> {\r\n        const thumbprint: RequestThumbprint = {\r\n            clientId: this.config.authOptions.clientId,\r\n            authority: authority.canonicalAuthority,\r\n            scopes: request.scopes,\r\n            authenticationScheme: request.authenticationScheme,\r\n            resourceRequestMethod: request.resourceRequestMethod,\r\n            resourceRequestUri: request.resourceRequestUri,\r\n            shrClaims: request.shrClaims,\r\n            sshJwk: request.sshJwk,\r\n            sshKid: request.sshKid\r\n        };\r\n        const requestBody = this.createTokenRequestBody(request);\r\n        const headers: Record<string, string> = this.createTokenRequestHeaders({\r\n            credential: request.username,\r\n            type: CcsCredentialType.UPN\r\n        });\r\n\r\n        return this.executePostToTokenEndpoint(authority.tokenEndpoint, requestBody, headers, thumbprint);\r\n    }\r\n\r\n    /**\r\n     * Generates a map for all the params to be sent to the service\r\n     * @param request\r\n     */\r\n    private createTokenRequestBody(request: CommonUsernamePasswordRequest): string {\r\n        const parameterBuilder = new RequestParameterBuilder();\r\n\r\n        parameterBuilder.addClientId(this.config.authOptions.clientId);\r\n        parameterBuilder.addUsername(request.username);\r\n        parameterBuilder.addPassword(request.password);\r\n\r\n        parameterBuilder.addScopes(request.scopes);\r\n\r\n        parameterBuilder.addGrantType(GrantType.RESOURCE_OWNER_PASSWORD_GRANT);\r\n        parameterBuilder.addClientInfo();\r\n\r\n        parameterBuilder.addLibraryInfo(this.config.libraryInfo);\r\n\r\n        parameterBuilder.addThrottling();\r\n\r\n        if (this.serverTelemetryManager) {\r\n            parameterBuilder.addServerTelemetry(this.serverTelemetryManager);\r\n        }\r\n\r\n        const correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();\r\n        parameterBuilder.addCorrelationId(correlationId);\r\n\r\n        if (this.config.clientCredentials.clientSecret) {\r\n            parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);\r\n        }\r\n\r\n        if (this.config.clientCredentials.clientAssertion) {\r\n            const clientAssertion = this.config.clientCredentials.clientAssertion;\r\n            parameterBuilder.addClientAssertion(clientAssertion.assertion);\r\n            parameterBuilder.addClientAssertionType(clientAssertion.assertionType);\r\n        }\r\n\r\n        if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {\r\n            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);\r\n        }\r\n\r\n        if (this.config.systemOptions.preventCorsPreflight && request.username) {\r\n            parameterBuilder.addCcsUpn(request.username);\r\n        }\r\n\r\n        return parameterBuilder.createQueryString();\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;;;;AAAA;;;;AAoBA;;;;;IAI4C,0CAAU;IAElD,gCAAY,aAAkC;eAC1C,kBAAM,aAAa,CAAC;KACvB;;;;;;IAOK,6CAAY,GAAlB,UAAmB,OAAsC;;;;;;wBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;wBAEnC,YAAY,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;wBAC3B,qBAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAA;;wBAAlE,QAAQ,GAAG,SAAuD;wBAElE,eAAe,GAAG,IAAI,eAAe,CACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAChC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAChC,CAAC;;wBAGF,eAAe,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC/C,aAAa,GAAG,eAAe,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;wBAEtH,sBAAO,aAAa,EAAC;;;;KACxB;;;;;;IAOa,oDAAmB,GAAjC,UAAkC,SAAoB,EAAE,OAAsC;;;;gBACpF,UAAU,GAAsB;oBAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ;oBAC1C,SAAS,EAAE,SAAS,CAAC,kBAAkB;oBACvC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;oBAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;oBACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;oBAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACzB,CAAC;gBACI,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;gBACnD,OAAO,GAA2B,IAAI,CAAC,yBAAyB,CAAC;oBACnE,UAAU,EAAE,OAAO,CAAC,QAAQ;oBAC5B,IAAI,EAAE,iBAAiB,CAAC,GAAG;iBAC9B,CAAC,CAAC;gBAEH,sBAAO,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,EAAC;;;KACrG;;;;;IAMO,uDAAsB,GAA9B,UAA+B,OAAsC;QACjE,IAAM,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAEvD,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/D,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE/C,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE3C,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACvE,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAEjC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEzD,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAEjC,IAAI,IAAI,CAAC,sBAAsB,EAAE;YAC7B,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;SACpE;QAED,IAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;QAC3F,gBAAgB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAEjD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE;YAC5C,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;SAChF;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE;YAC/C,IAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC;YACtE,gBAAgB,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC/D,gBAAgB,CAAC,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;SAC1E;QAED,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE;YAChJ,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;SAC1F;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,IAAI,OAAO,CAAC,QAAQ,EAAE;YACpE,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;SAChD;QAED,OAAO,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;KAC/C;IACL,6BAAC;AAAD,CA1GA,CAA4C,UAAU;;;;"}

package/dist/config/ClientConfiguration.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v5.1.1 2022-08-03 */
 'use strict';
 import { __assign, __awaiter, __generator } from '../_virtual/_tslib.js';
 import { DEFAULT_CRYPTO_IMPLEMENTATION } from '../crypto/ICrypto.js';

package/dist/crypto/ICrypto.d.ts

@@ -9,7 +9,7 @@ export declare type PkceCodes = {
     verifier: string;
     challenge: string;
 };
-export declare type SignedHttpRequestParameters = Pick<BaseAuthRequest, "resourceRequestMethod" | "resourceRequestUri" | "shrClaims">;
+export declare type SignedHttpRequestParameters = Pick<BaseAuthRequest, "resourceRequestMethod" | "resourceRequestUri" | "shrClaims" | "shrNonce">;
 /**
  * Interface for crypto functions used by library
  */

package/dist/crypto/ICrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ICrypto.d.ts","sourceRoot":"","sources":["../../src/crypto/ICrypto.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,oBAAY,SAAS,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAA;CACpB,CAAC;AAEF,oBAAY,2BAA2B,GAAG,IAAI,CAAC,eAAe,EAAE,uBAAuB,GAAG,oBAAoB,GAAG,WAAW,CAAC,CAAC;AAE9H;;GAEG;AACH,MAAM,WAAW,OAAO;IACpB;;OAEG;IACH,aAAa,IAAI,MAAM,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,iBAAiB,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E;;;OAGG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrE;AAED,eAAO,MAAM,6BAA6B,EAAE,OAiC3C,CAAC"}
+{"version":3,"file":"ICrypto.d.ts","sourceRoot":"","sources":["../../src/crypto/ICrypto.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,oBAAY,SAAS,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAA;CACpB,CAAC;AAEF,oBAAY,2BAA2B,GAAG,IAAI,CAAC,eAAe,EAAE,uBAAuB,GAAG,oBAAoB,GAAG,WAAW,GAAG,UAAU,CAAC,CAAC;AAE3I;;GAEG;AACH,MAAM,WAAW,OAAO;IACpB;;OAEG;IACH,aAAa,IAAI,MAAM,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,iBAAiB,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E;;;OAGG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrE;AAED,eAAO,MAAM,6BAA6B,EAAE,OAiC3C,CAAC"}

package/dist/crypto/ICrypto.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v5.1.1 2022-08-03 */
 'use strict';
 import { __awaiter, __generator } from '../_virtual/_tslib.js';
 import { AuthError } from '../error/AuthError.js';

package/dist/crypto/ICrypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"ICrypto.js","sources":["../../src/crypto/ICrypto.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { AuthError } from \"../error/AuthError\";\r\nimport { BaseAuthRequest } from \"../request/BaseAuthRequest\";\r\nimport { SignedHttpRequest } from \"./SignedHttpRequest\";\r\n\r\n/**\r\n * The PkceCodes type describes the structure\r\n * of objects that contain PKCE code\r\n * challenge and verifier pairs\r\n */\r\nexport type PkceCodes = {\r\n    verifier: string,\r\n    challenge: string\r\n};\r\n\r\nexport type SignedHttpRequestParameters = Pick<BaseAuthRequest, \"resourceRequestMethod\" | \"resourceRequestUri\" | \"shrClaims\">;\r\n\r\n/**\r\n * Interface for crypto functions used by library\r\n */\r\nexport interface ICrypto {\r\n    /**\r\n     * Creates a guid randomly.\r\n     */\r\n    createNewGuid(): string;\r\n    /**\r\n     * base64 Encode string\r\n     * @param input \r\n     */\r\n    base64Encode(input: string): string;\r\n    /**\r\n     * base64 decode string\r\n     * @param input \r\n     */\r\n    base64Decode(input: string): string;\r\n    /**\r\n     * Generate PKCE codes for OAuth. See RFC here: https://tools.ietf.org/html/rfc7636\r\n     */\r\n    generatePkceCodes(): Promise<PkceCodes>;\r\n    /**\r\n     * Generates an JWK RSA S256 Thumbprint\r\n     * @param request\r\n     */\r\n    getPublicKeyThumbprint(request: SignedHttpRequestParameters): Promise<string>;\r\n    /**\r\n     * Removes cryptographic keypair from key store matching the keyId passed in\r\n     * @param kid \r\n     */\r\n    removeTokenBindingKey(kid: string): Promise<boolean>;\r\n    /**\r\n     * Removes all cryptographic keys from IndexedDB storage\r\n     */\r\n    clearKeystore(): Promise<boolean>;\r\n    /** \r\n     * Returns a signed proof-of-possession token with a given acces token that contains a cnf claim with the required kid.\r\n     * @param accessToken \r\n     */\r\n    signJwt(payload: SignedHttpRequest, kid: string): Promise<string>;\r\n}\r\n\r\nexport const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {\r\n    createNewGuid: (): string => {\r\n        const notImplErr = \"Crypto interface - createNewGuid() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    base64Decode: (): string => {\r\n        const notImplErr = \"Crypto interface - base64Decode() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    base64Encode: (): string => {\r\n        const notImplErr = \"Crypto interface - base64Encode() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async generatePkceCodes(): Promise<PkceCodes> {\r\n        const notImplErr = \"Crypto interface - generatePkceCodes() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async getPublicKeyThumbprint(): Promise<string> {\r\n        const notImplErr = \"Crypto interface - getPublicKeyThumbprint() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async removeTokenBindingKey(): Promise<boolean> {\r\n        const notImplErr = \"Crypto interface - removeTokenBindingKey() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async clearKeystore(): Promise<boolean> {\r\n        const notImplErr = \"Crypto interface - clearKeystore() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async signJwt(): Promise<string> {\r\n        const notImplErr = \"Crypto interface - signJwt() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    }\r\n};\r\n"],"names":[],"mappings":";;;;;AAAA;;;;IAgEa,6BAA6B,GAAY;IAClD,aAAa,EAAE;QACX,IAAM,UAAU,GAAG,6DAA6D,CAAC;QACjF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;KACrD;IACD,YAAY,EAAE;QACV,IAAM,UAAU,GAAG,4DAA4D,CAAC;QAChF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;KACrD;IACD,YAAY,EAAE;QACV,IAAM,UAAU,GAAG,4DAA4D,CAAC;QAChF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;KACrD;IACK,iBAAiB,EAAvB;;;;gBACU,UAAU,GAAG,iEAAiE,CAAC;gBACrF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;IACK,sBAAsB,EAA5B;;;;gBACU,UAAU,GAAG,sEAAsE,CAAC;gBAC1F,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;IACK,qBAAqB,EAA3B;;;;gBACU,UAAU,GAAG,qEAAqE,CAAC;gBACzF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;IACK,aAAa,EAAnB;;;;gBACU,UAAU,GAAG,6DAA6D,CAAC;gBACjF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;IACK,OAAO,EAAb;;;;gBACU,UAAU,GAAG,uDAAuD,CAAC;gBAC3E,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;;;;;"}
+{"version":3,"file":"ICrypto.js","sources":["../../src/crypto/ICrypto.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { AuthError } from \"../error/AuthError\";\r\nimport { BaseAuthRequest } from \"../request/BaseAuthRequest\";\r\nimport { SignedHttpRequest } from \"./SignedHttpRequest\";\r\n\r\n/**\r\n * The PkceCodes type describes the structure\r\n * of objects that contain PKCE code\r\n * challenge and verifier pairs\r\n */\r\nexport type PkceCodes = {\r\n    verifier: string,\r\n    challenge: string\r\n};\r\n\r\nexport type SignedHttpRequestParameters = Pick<BaseAuthRequest, \"resourceRequestMethod\" | \"resourceRequestUri\" | \"shrClaims\" | \"shrNonce\">;\r\n\r\n/**\r\n * Interface for crypto functions used by library\r\n */\r\nexport interface ICrypto {\r\n    /**\r\n     * Creates a guid randomly.\r\n     */\r\n    createNewGuid(): string;\r\n    /**\r\n     * base64 Encode string\r\n     * @param input \r\n     */\r\n    base64Encode(input: string): string;\r\n    /**\r\n     * base64 decode string\r\n     * @param input \r\n     */\r\n    base64Decode(input: string): string;\r\n    /**\r\n     * Generate PKCE codes for OAuth. See RFC here: https://tools.ietf.org/html/rfc7636\r\n     */\r\n    generatePkceCodes(): Promise<PkceCodes>;\r\n    /**\r\n     * Generates an JWK RSA S256 Thumbprint\r\n     * @param request\r\n     */\r\n    getPublicKeyThumbprint(request: SignedHttpRequestParameters): Promise<string>;\r\n    /**\r\n     * Removes cryptographic keypair from key store matching the keyId passed in\r\n     * @param kid \r\n     */\r\n    removeTokenBindingKey(kid: string): Promise<boolean>;\r\n    /**\r\n     * Removes all cryptographic keys from IndexedDB storage\r\n     */\r\n    clearKeystore(): Promise<boolean>;\r\n    /** \r\n     * Returns a signed proof-of-possession token with a given acces token that contains a cnf claim with the required kid.\r\n     * @param accessToken \r\n     */\r\n    signJwt(payload: SignedHttpRequest, kid: string): Promise<string>;\r\n}\r\n\r\nexport const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {\r\n    createNewGuid: (): string => {\r\n        const notImplErr = \"Crypto interface - createNewGuid() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    base64Decode: (): string => {\r\n        const notImplErr = \"Crypto interface - base64Decode() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    base64Encode: (): string => {\r\n        const notImplErr = \"Crypto interface - base64Encode() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async generatePkceCodes(): Promise<PkceCodes> {\r\n        const notImplErr = \"Crypto interface - generatePkceCodes() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async getPublicKeyThumbprint(): Promise<string> {\r\n        const notImplErr = \"Crypto interface - getPublicKeyThumbprint() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async removeTokenBindingKey(): Promise<boolean> {\r\n        const notImplErr = \"Crypto interface - removeTokenBindingKey() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async clearKeystore(): Promise<boolean> {\r\n        const notImplErr = \"Crypto interface - clearKeystore() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    },\r\n    async signJwt(): Promise<string> {\r\n        const notImplErr = \"Crypto interface - signJwt() has not been implemented\";\r\n        throw AuthError.createUnexpectedError(notImplErr);\r\n    }\r\n};\r\n"],"names":[],"mappings":";;;;;AAAA;;;;IAgEa,6BAA6B,GAAY;IAClD,aAAa,EAAE;QACX,IAAM,UAAU,GAAG,6DAA6D,CAAC;QACjF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;KACrD;IACD,YAAY,EAAE;QACV,IAAM,UAAU,GAAG,4DAA4D,CAAC;QAChF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;KACrD;IACD,YAAY,EAAE;QACV,IAAM,UAAU,GAAG,4DAA4D,CAAC;QAChF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;KACrD;IACK,iBAAiB,EAAvB;;;;gBACU,UAAU,GAAG,iEAAiE,CAAC;gBACrF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;IACK,sBAAsB,EAA5B;;;;gBACU,UAAU,GAAG,sEAAsE,CAAC;gBAC1F,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;IACK,qBAAqB,EAA3B;;;;gBACU,UAAU,GAAG,qEAAqE,CAAC;gBACzF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;IACK,aAAa,EAAnB;;;;gBACU,UAAU,GAAG,6DAA6D,CAAC;gBACjF,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;IACK,OAAO,EAAb;;;;gBACU,UAAU,GAAG,uDAAuD,CAAC;gBAC3E,MAAM,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;;KACrD;;;;;"}

package/dist/crypto/PopTokenGenerator.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v5.1.1 2022-08-03 */
 'use strict';
 import { __awaiter, __generator, __assign } from '../_virtual/_tslib.js';
 import { AuthToken } from '../account/AuthToken.js';
@@ -63,14 +63,14 @@ var PopTokenGenerator = /** @class */ (function () {
     };
     PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
         return __awaiter(this, void 0, void 0, function () {
-            var resourceRequestMethod, resourceRequestUri, shrClaims, resourceUrlString, resourceUrlComponents;
+            var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims;
+                        resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                         resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                         resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
+                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
             });

package/dist/crypto/PopTokenGenerator.js.map

@@ -1 +1 @@
-{"version":3,"file":"PopTokenGenerator.js","sources":["../../src/crypto/PopTokenGenerator.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { ICrypto, SignedHttpRequestParameters } from \"./ICrypto\";\r\nimport { AuthToken } from \"../account/AuthToken\";\r\nimport { TokenClaims } from \"../account/TokenClaims\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { UrlString } from \"../url/UrlString\";\r\nimport { ClientAuthError } from \"../error/ClientAuthError\";\r\n\r\n/**\r\n * See eSTS docs for more info.\r\n * - A kid element, with the value containing an RFC 7638-compliant JWK thumbprint that is base64 encoded.\r\n * -  xms_ksl element, representing the storage location of the key's secret component on the client device. One of two values:\r\n *      - sw: software storage\r\n *      - uhw: hardware storage\r\n */\r\ntype ReqCnf = {\r\n    kid: string;\r\n    xms_ksl: KeyLocation;\r\n};\r\n\r\nenum KeyLocation {\r\n    SW = \"sw\",\r\n    UHW = \"uhw\"\r\n}\r\n\r\nexport class PopTokenGenerator {\r\n\r\n    private cryptoUtils: ICrypto;\r\n\r\n    constructor(cryptoUtils: ICrypto) {\r\n        this.cryptoUtils = cryptoUtils;\r\n    }\r\n\r\n    async generateCnf(request: SignedHttpRequestParameters): Promise<string> {\r\n        const reqCnf = await this.generateKid(request);\r\n        return this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));\r\n    }\r\n\r\n    async generateKid(request: SignedHttpRequestParameters): Promise<ReqCnf> {\r\n        const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(request);\r\n\r\n        return {\r\n            kid: kidThumbprint,\r\n            xms_ksl: KeyLocation.SW\r\n        };\r\n    }\r\n\r\n    async signPopToken(accessToken: string, request: SignedHttpRequestParameters): Promise<string> {\r\n        const tokenClaims: TokenClaims | null = AuthToken.extractTokenClaims(accessToken, this.cryptoUtils);\r\n        if (!tokenClaims?.cnf?.kid) {\r\n            throw ClientAuthError.createTokenClaimsRequiredError();\r\n        }\r\n        \r\n        return this.signPayload(accessToken, tokenClaims.cnf.kid, request);\r\n    }\r\n\r\n    async signPayload(payload: string, kid: string, request: SignedHttpRequestParameters, claims?: object): Promise<string> {\r\n        // Deconstruct request to extract SHR parameters\r\n        const { resourceRequestMethod, resourceRequestUri, shrClaims } = request;\r\n\r\n        const resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;\r\n        const resourceUrlComponents = resourceUrlString?.getUrlComponents();\r\n\r\n        return await this.cryptoUtils.signJwt({\r\n            at: payload,\r\n            ts: TimeUtils.nowSeconds(),\r\n            m: resourceRequestMethod?.toUpperCase(),\r\n            u: resourceUrlComponents?.HostNameAndPort,\r\n            nonce: this.cryptoUtils.createNewGuid(),\r\n            p: resourceUrlComponents?.AbsolutePath,\r\n            q: (resourceUrlComponents?.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined,\r\n            client_claims: shrClaims || undefined,\r\n            ...claims\r\n        }, kid);\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;AAAA;;;;AAwBA,IAAK,WAGJ;AAHD,WAAK,WAAW;IACZ,wBAAS,CAAA;IACT,0BAAW,CAAA;AACf,CAAC,EAHI,WAAW,KAAX,WAAW,QAGf;;IAMG,2BAAY,WAAoB;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;KAClC;IAEK,uCAAW,GAAjB,UAAkB,OAAoC;;;;;4BACnC,qBAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAA;;wBAAxC,MAAM,GAAG,SAA+B;wBAC9C,sBAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAC;;;;KAChE;IAEK,uCAAW,GAAjB,UAAkB,OAAoC;;;;;4BAC5B,qBAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAA;;wBAAtE,aAAa,GAAG,SAAsD;wBAE5E,sBAAO;gCACH,GAAG,EAAE,aAAa;gCAClB,OAAO,EAAE,WAAW,CAAC,EAAE;6BAC1B,EAAC;;;;KACL;IAEK,wCAAY,GAAlB,UAAmB,WAAmB,EAAE,OAAoC;;;;;gBAClE,WAAW,GAAuB,SAAS,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACpG,IAAI,QAAC,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,GAAG,0CAAE,GAAG,CAAA,EAAE;oBACxB,MAAM,eAAe,CAAC,8BAA8B,EAAE,CAAC;iBAC1D;gBAED,sBAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,EAAC;;;KACtE;IAEK,uCAAW,GAAjB,UAAkB,OAAe,EAAE,GAAW,EAAE,OAAoC,EAAE,MAAe;;;;;;wBAEzF,qBAAqB,GAAoC,OAAO,sBAA3C,EAAE,kBAAkB,GAAgB,OAAO,mBAAvB,EAAE,SAAS,GAAK,OAAO,UAAZ,CAAa;wBAEnE,iBAAiB,GAAG,CAAC,kBAAkB,IAAI,IAAI,SAAS,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;wBACzF,qBAAqB,GAAG,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,gBAAgB,EAAE,CAAC;wBAE7D,qBAAM,IAAI,CAAC,WAAW,CAAC,OAAO,YACjC,EAAE,EAAE,OAAO,EACX,EAAE,EAAE,SAAS,CAAC,UAAU,EAAE,EAC1B,CAAC,EAAE,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,WAAW,IACrC,CAAC,EAAE,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,eAAe,EACzC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EACvC,CAAC,EAAE,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,YAAY,EACtC,CAAC,EAAE,CAAC,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,WAAW,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC,WAAW,CAAC,GAAG,SAAS,EAC7F,aAAa,EAAE,SAAS,IAAI,SAAS,IAClC,MAAM,GACV,GAAG,CAAC,EAAA;4BAVP,sBAAO,SAUA,EAAC;;;;KACX;IACL,wBAAC;AAAD,CAAC;;;;"}
+{"version":3,"file":"PopTokenGenerator.js","sources":["../../src/crypto/PopTokenGenerator.ts"],"sourcesContent":["/*\r\n * Copyright (c) Microsoft Corporation. All rights reserved.\r\n * Licensed under the MIT License.\r\n */\r\n\r\nimport { ICrypto, SignedHttpRequestParameters } from \"./ICrypto\";\r\nimport { AuthToken } from \"../account/AuthToken\";\r\nimport { TokenClaims } from \"../account/TokenClaims\";\r\nimport { TimeUtils } from \"../utils/TimeUtils\";\r\nimport { UrlString } from \"../url/UrlString\";\r\nimport { ClientAuthError } from \"../error/ClientAuthError\";\r\n\r\n/**\r\n * See eSTS docs for more info.\r\n * - A kid element, with the value containing an RFC 7638-compliant JWK thumbprint that is base64 encoded.\r\n * -  xms_ksl element, representing the storage location of the key's secret component on the client device. One of two values:\r\n *      - sw: software storage\r\n *      - uhw: hardware storage\r\n */\r\ntype ReqCnf = {\r\n    kid: string;\r\n    xms_ksl: KeyLocation;\r\n};\r\n\r\nenum KeyLocation {\r\n    SW = \"sw\",\r\n    UHW = \"uhw\"\r\n}\r\n\r\nexport class PopTokenGenerator {\r\n\r\n    private cryptoUtils: ICrypto;\r\n\r\n    constructor(cryptoUtils: ICrypto) {\r\n        this.cryptoUtils = cryptoUtils;\r\n    }\r\n\r\n    async generateCnf(request: SignedHttpRequestParameters): Promise<string> {\r\n        const reqCnf = await this.generateKid(request);\r\n        return this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));\r\n    }\r\n\r\n    async generateKid(request: SignedHttpRequestParameters): Promise<ReqCnf> {\r\n        const kidThumbprint = await this.cryptoUtils.getPublicKeyThumbprint(request);\r\n\r\n        return {\r\n            kid: kidThumbprint,\r\n            xms_ksl: KeyLocation.SW\r\n        };\r\n    }\r\n\r\n    async signPopToken(accessToken: string, request: SignedHttpRequestParameters): Promise<string> {\r\n        const tokenClaims: TokenClaims | null = AuthToken.extractTokenClaims(accessToken, this.cryptoUtils);\r\n        if (!tokenClaims?.cnf?.kid) {\r\n            throw ClientAuthError.createTokenClaimsRequiredError();\r\n        }\r\n        \r\n        return this.signPayload(accessToken, tokenClaims.cnf.kid, request);\r\n    }\r\n\r\n    async signPayload(payload: string, kid: string, request: SignedHttpRequestParameters, claims?: object): Promise<string> {\r\n        // Deconstruct request to extract SHR parameters\r\n        const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce } = request;\r\n\r\n        const resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;\r\n        const resourceUrlComponents = resourceUrlString?.getUrlComponents();\r\n\r\n        return await this.cryptoUtils.signJwt({\r\n            at: payload,\r\n            ts: TimeUtils.nowSeconds(),\r\n            m: resourceRequestMethod?.toUpperCase(),\r\n            u: resourceUrlComponents?.HostNameAndPort,\r\n            nonce: shrNonce || this.cryptoUtils.createNewGuid(),\r\n            p: resourceUrlComponents?.AbsolutePath,\r\n            q: (resourceUrlComponents?.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined,\r\n            client_claims: shrClaims || undefined,\r\n            ...claims\r\n        }, kid);\r\n    }\r\n}\r\n"],"names":[],"mappings":";;;;;;;;AAAA;;;;AAwBA,IAAK,WAGJ;AAHD,WAAK,WAAW;IACZ,wBAAS,CAAA;IACT,0BAAW,CAAA;AACf,CAAC,EAHI,WAAW,KAAX,WAAW,QAGf;;IAMG,2BAAY,WAAoB;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;KAClC;IAEK,uCAAW,GAAjB,UAAkB,OAAoC;;;;;4BACnC,qBAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAA;;wBAAxC,MAAM,GAAG,SAA+B;wBAC9C,sBAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAC;;;;KAChE;IAEK,uCAAW,GAAjB,UAAkB,OAAoC;;;;;4BAC5B,qBAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAA;;wBAAtE,aAAa,GAAG,SAAsD;wBAE5E,sBAAO;gCACH,GAAG,EAAE,aAAa;gCAClB,OAAO,EAAE,WAAW,CAAC,EAAE;6BAC1B,EAAC;;;;KACL;IAEK,wCAAY,GAAlB,UAAmB,WAAmB,EAAE,OAAoC;;;;;gBAClE,WAAW,GAAuB,SAAS,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACpG,IAAI,QAAC,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,GAAG,0CAAE,GAAG,CAAA,EAAE;oBACxB,MAAM,eAAe,CAAC,8BAA8B,EAAE,CAAC;iBAC1D;gBAED,sBAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,EAAC;;;KACtE;IAEK,uCAAW,GAAjB,UAAkB,OAAe,EAAE,GAAW,EAAE,OAAoC,EAAE,MAAe;;;;;;wBAEzF,qBAAqB,GAA8C,OAAO,sBAArD,EAAE,kBAAkB,GAA0B,OAAO,mBAAjC,EAAE,SAAS,GAAe,OAAO,UAAtB,EAAE,QAAQ,GAAK,OAAO,SAAZ,CAAa;wBAE7E,iBAAiB,GAAG,CAAC,kBAAkB,IAAI,IAAI,SAAS,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;wBACzF,qBAAqB,GAAG,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,gBAAgB,EAAE,CAAC;wBAE7D,qBAAM,IAAI,CAAC,WAAW,CAAC,OAAO,YACjC,EAAE,EAAE,OAAO,EACX,EAAE,EAAE,SAAS,CAAC,UAAU,EAAE,EAC1B,CAAC,EAAE,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,WAAW,IACrC,CAAC,EAAE,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,eAAe,EACzC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EACnD,CAAC,EAAE,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,YAAY,EACtC,CAAC,EAAE,CAAC,qBAAqB,aAArB,qBAAqB,uBAArB,qBAAqB,CAAE,WAAW,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC,WAAW,CAAC,GAAG,SAAS,EAC7F,aAAa,EAAE,SAAS,IAAI,SAAS,IAClC,MAAM,GACV,GAAG,CAAC,EAAA;4BAVP,sBAAO,SAUA,EAAC;;;;KACX;IACL,wBAAC;AAAD,CAAC;;;;"}

package/dist/error/AuthError.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.0.0 2021-09-08 */
+/*! @azure/msal-common v5.1.1 2022-08-03 */
 'use strict';
 import { __extends } from '../_virtual/_tslib.js';
 import { Constants } from '../utils/Constants.js';

package/dist/error/ClientAuthError.d.ts

@@ -179,6 +179,10 @@ export declare const ClientAuthErrorMessage: {
         code: string;
         desc: string;
     };
+    logoutNotSupported: {
+        code: string;
+        desc: string;
+    };
 };
 /**
  * Error thrown when there is an error in the client code running on the browser.
@@ -245,10 +249,6 @@ export declare class ClientAuthError extends AuthError {
      * @param missingNonce
      */
     static createNonceNotFoundError(missingNonce: string): ClientAuthError;
-    /**
-     * Creates an error thrown when the authorization code required for a token request is null or empty.
-     */
-    static createNoTokensFoundError(): ClientAuthError;
     /**
      * Throws error when multiple tokens are in cache.
      */
@@ -356,5 +356,9 @@ export declare class ClientAuthError extends AuthError {
      */
     static createNoAuthCodeInServerResponseError(): ClientAuthError;
     static createBindingKeyNotRemovedError(): ClientAuthError;
+    /**
+     * Thrown when logout is attempted for an authority that doesnt have an end_session_endpoint
+     */
+    static createLogoutNotSupportedError(): ClientAuthError;
 }
 //# sourceMappingURL=ClientAuthError.d.ts.map