@azure/msal-common 5.1.0 → 5.2.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v5.1.0 2021-11-02 */
+/*! @azure/msal-common v5.2.0 2021-12-07 */
 'use strict';
 'use strict';
 
@@ -225,6 +225,7 @@ var AADServerParamKeys;
     AADServerParamKeys["ON_BEHALF_OF"] = "on_behalf_of";
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
+    AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
  * Claims request keys
@@ -1325,7 +1326,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "5.1.0";
+var version = "5.2.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4720,7 +4721,7 @@ var ResponseHandler = /** @class */ (function () {
                         _a.sent();
                         _a.label = 7;
                     case 7: return [7 /*endfinally*/];
-                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
                 }
             });
         });
@@ -4806,7 +4807,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param fromTokenCache
      * @param stateString
      */
-    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState) {
+    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
             var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
@@ -4855,7 +4856,8 @@ var ResponseHandler = /** @class */ (function () {
                                 tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
                                 state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
-                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING
+                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
+                                code: code
                             }];
                 }
             });
@@ -4874,7 +4876,10 @@ var ResponseHandler = /** @class */ (function () {
 var AuthorizationCodeClient = /** @class */ (function (_super) {
     __extends(AuthorizationCodeClient, _super);
     function AuthorizationCodeClient(configuration) {
-        return _super.call(this, configuration) || this;
+        var _this = _super.call(this, configuration) || this;
+        // Flag to indicate if client is for hybrid spa auth code redemption
+        _this.includeRedirectUri = true;
+        return _this;
     }
     /**
      * Creates the URL of the authorization request letting the user input credentials and consent to the
@@ -5023,13 +5028,24 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         parameterBuilder = new RequestParameterBuilder();
                         parameterBuilder.addClientId(this.config.authOptions.clientId);
-                        // validate the redirectUri (to be a non null value)
-                        parameterBuilder.addRedirectUri(request.redirectUri);
+                        /*
+                         * For hybrid spa flow, there will be a code but no verifier
+                         * In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
+                         */
+                        if (!this.includeRedirectUri) {
+                            // Just validate
+                            RequestValidator.validateRedirectUri(request.redirectUri);
+                        }
+                        else {
+                            // Validate and include redirect uri
+                            parameterBuilder.addRedirectUri(request.redirectUri);
+                        }
                         // Add scope array, parameter builder will add default scopes and dedupe
                         parameterBuilder.addScopes(request.scopes);
                         // add code: user set, not validated
@@ -5058,7 +5074,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _a.sent();
+                        cnfString = _b.sent();
                         parameterBuilder.addPopToken(cnfString);
                         return [3 /*break*/, 3];
                     case 2:
@@ -5070,7 +5086,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                                 throw ClientConfigurationError.createMissingSshJwkError();
                             }
                         }
-                        _a.label = 3;
+                        _b.label = 3;
                     case 3:
                         correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
                         parameterBuilder.addCorrelationId(correlationId);
@@ -5110,6 +5126,15 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                                     break;
                             }
                         }
+                        if (request.tokenBodyParameters) {
+                            parameterBuilder.addExtraQueryParameters(request.tokenBodyParameters);
+                        }
+                        // Add hybrid spa parameters if not already provided
+                        if (request.enableSpaAuthorizationCode && (!request.tokenBodyParameters || !request.tokenBodyParameters[AADServerParamKeys.RETURN_SPA_CODE])) {
+                            parameterBuilder.addExtraQueryParameters((_a = {},
+                                _a[AADServerParamKeys.RETURN_SPA_CODE] = "1",
+                                _a));
+                        }
                         return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
             });