@azure/msal-common 6.2.0 → 6.3.0-beta.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
 'use strict';
 'use strict';
 
@@ -136,7 +136,9 @@ var Constants = {
     IMDS_TIMEOUT: 2000,
     AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
-    KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"]
+    KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
+    TOKEN_RESPONSE_TYPE: "token",
+    ID_TOKEN_RESPONSE_TYPE: "id_token"
 };
 var OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
@@ -229,6 +231,7 @@ var AADServerParamKeys;
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
     AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
+    AADServerParamKeys["NATIVE_BROKER"] = "nativebroker";
     AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
@@ -1339,7 +1342,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "6.2.0";
+var version = "6.3.0-beta.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2027,6 +2030,7 @@ exports.AuthorityType = void 0;
  *      lastModificationApp:
  *      oboAssertion: access token passed in as part of OBO request
  *      idTokenClaims: Object containing claims parsed from ID token
+ *      nativeAccountId: Account identifier on the native device
  * }
  */
 var AccountEntity = /** @class */ (function () {
@@ -2080,7 +2084,8 @@ var AccountEntity = /** @class */ (function () {
             username: this.username,
             localAccountId: this.localAccountId,
             name: this.name,
-            idTokenClaims: this.idTokenClaims
+            idTokenClaims: this.idTokenClaims,
+            nativeAccountId: this.nativeAccountId
         };
     };
     /**
@@ -2102,12 +2107,13 @@ var AccountEntity = /** @class */ (function () {
      * @param idToken
      * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
         var _a, _b, _c, _d, _e, _f;
         var account = new AccountEntity();
         account.authorityType = exports.CacheAccountType.MSSTS_ACCOUNT_TYPE;
         account.clientInfo = clientInfo;
         account.homeAccountId = homeAccountId;
+        account.nativeAccountId = nativeAccountId;
         var env = environment || (authority && authority.getPreferredCache());
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -2229,6 +2235,7 @@ var AccountEntity = /** @class */ (function () {
             (accountA.username === accountB.username) &&
             (accountA.tenantId === accountB.tenantId) &&
             (accountA.environment === accountB.environment) &&
+            (accountA.nativeAccountId === accountB.nativeAccountId) &&
             claimsMatch;
     };
     return AccountEntity;
@@ -2636,7 +2643,7 @@ var CacheManager = /** @class */ (function () {
         });
     };
     /**
-     * returns a boolean if the given account is removed
+     * Removes credentials associated with the provided account
      * @param account
      */
     CacheManager.prototype.removeAccountContext = function (account) {
@@ -3556,6 +3563,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addResponseTypeCode = function () {
         this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
     };
+    /**
+     * add response_type = token id_token
+     */
+    RequestParameterBuilder.prototype.addResponseTypeForTokenAndIdToken = function () {
+        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.TOKEN_RESPONSE_TYPE + " " + Constants.ID_TOKEN_RESPONSE_TYPE));
+    };
     /**
      * add response_mode. defaults to query.
      * @param responseMode
@@ -3563,6 +3576,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addResponseMode = function (responseMode) {
         this.parameters.set(AADServerParamKeys.RESPONSE_MODE, encodeURIComponent((responseMode) ? responseMode : exports.ResponseMode.QUERY));
     };
+    /**
+     * Add flag to indicate STS should attempt to use WAM if available
+     */
+    RequestParameterBuilder.prototype.addNativeBroker = function () {
+        this.parameters.set(AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
+    };
     /**
      * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
      * @param scopeSet
@@ -4549,6 +4568,11 @@ var PopTokenGenerator = /** @class */ (function () {
     function PopTokenGenerator(cryptoUtils) {
         this.cryptoUtils = cryptoUtils;
     }
+    /**
+     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.generateCnf = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var reqCnf;
@@ -4562,6 +4586,23 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Generates the hash of the req_cnf
+     * @param cnf
+     * @returns
+     */
+    PopTokenGenerator.prototype.generateCnfHash = function (cnf) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                return [2 /*return*/, this.cryptoUtils.hashString(cnf)];
+            });
+        });
+    };
+    /**
+     * Generates key_id for a SHR token request
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.generateKid = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var kidThumbprint;
@@ -4578,6 +4619,12 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Signs the POP access_token with the local generated key-pair
+     * @param accessToken
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.signPopToken = function (accessToken, request) {
         var _a;
         return __awaiter(this, void 0, void 0, function () {
@@ -4591,6 +4638,14 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Utility function to generate the signed JWT for an access_token
+     * @param payload
+     * @param kid
+     * @param request
+     * @param claims
+     * @returns
+     */
     PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
         return __awaiter(this, void 0, void 0, function () {
             var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
@@ -4966,7 +5021,8 @@ var ResponseHandler = /** @class */ (function () {
                                 state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
                                 msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
-                                code: code
+                                code: code,
+                                fromNativeBroker: false
                             }];
                 }
             });
@@ -5004,8 +5060,12 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
         return __awaiter(this, void 0, void 0, function () {
             var queryString;
             return __generator(this, function (_a) {
-                queryString = this.createAuthCodeUrlQueryString(request);
-                return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.createAuthCodeUrlQueryString(request)];
+                    case 1:
+                        queryString = _a.sent();
+                        return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                }
             });
         });
     };
@@ -5255,96 +5315,116 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      * @param request
      */
     AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
-        var parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(this.config.authOptions.clientId);
-        var requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
-        parameterBuilder.addScopes(requestScopes);
-        // validate the redirectUri (to be a non null value)
-        parameterBuilder.addRedirectUri(request.redirectUri);
-        // generate the correlationId if not set by the user and add
-        var correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
-        parameterBuilder.addCorrelationId(correlationId);
-        // add response_mode. If not passed in it defaults to query.
-        parameterBuilder.addResponseMode(request.responseMode);
-        // add response_type = code
-        parameterBuilder.addResponseTypeCode();
-        // add library info parameters
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        // add client_info=1
-        parameterBuilder.addClientInfo();
-        if (request.codeChallenge && request.codeChallengeMethod) {
-            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
-        }
-        if (request.prompt) {
-            parameterBuilder.addPrompt(request.prompt);
-        }
-        if (request.domainHint) {
-            parameterBuilder.addDomainHint(request.domainHint);
-        }
-        // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
-        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
-            // AAD will throw if prompt=select_account is passed with an account hint
-            if (request.sid && request.prompt === PromptValue.NONE) {
-                // SessionID is only used in silent calls
-                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
-                parameterBuilder.addSid(request.sid);
-            }
-            else if (request.account) {
-                var accountSid = this.extractAccountSid(request.account);
-                // If account and loginHint are provided, we will check account first for sid before adding loginHint
-                if (accountSid && request.prompt === PromptValue.NONE) {
-                    // SessionId is only used in silent calls
-                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
-                    parameterBuilder.addSid(accountSid);
-                    try {
-                        var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                    }
-                }
-                else if (request.loginHint) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
-                    parameterBuilder.addLoginHint(request.loginHint);
-                    parameterBuilder.addCcsUpn(request.loginHint);
-                }
-                else if (request.account.username) {
-                    // Fallback to account username if provided
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
-                    parameterBuilder.addLoginHint(request.account.username);
-                    try {
-                        var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                    }
+        return __awaiter(this, void 0, void 0, function () {
+            var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, cnf, cnfHash;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        parameterBuilder = new RequestParameterBuilder();
+                        parameterBuilder.addClientId(this.config.authOptions.clientId);
+                        requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
+                        parameterBuilder.addScopes(requestScopes);
+                        // validate the redirectUri (to be a non null value)
+                        parameterBuilder.addRedirectUri(request.redirectUri);
+                        correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
+                        parameterBuilder.addCorrelationId(correlationId);
+                        // add response_mode. If not passed in it defaults to query.
+                        parameterBuilder.addResponseMode(request.responseMode);
+                        // add response_type = code
+                        parameterBuilder.addResponseTypeCode();
+                        // add library info parameters
+                        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+                        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+                        // add client_info=1
+                        parameterBuilder.addClientInfo();
+                        if (request.codeChallenge && request.codeChallengeMethod) {
+                            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
+                        }
+                        if (request.prompt) {
+                            parameterBuilder.addPrompt(request.prompt);
+                        }
+                        if (request.domainHint) {
+                            parameterBuilder.addDomainHint(request.domainHint);
+                        }
+                        // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
+                        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+                            // AAD will throw if prompt=select_account is passed with an account hint
+                            if (request.sid && request.prompt === PromptValue.NONE) {
+                                // SessionID is only used in silent calls
+                                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
+                                parameterBuilder.addSid(request.sid);
+                            }
+                            else if (request.account) {
+                                accountSid = this.extractAccountSid(request.account);
+                                // If account and loginHint are provided, we will check account first for sid before adding loginHint
+                                if (accountSid && request.prompt === PromptValue.NONE) {
+                                    // SessionId is only used in silent calls
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
+                                    parameterBuilder.addSid(accountSid);
+                                    try {
+                                        clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                        parameterBuilder.addCcsOid(clientInfo);
+                                    }
+                                    catch (e) {
+                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                    }
+                                }
+                                else if (request.loginHint) {
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
+                                    parameterBuilder.addLoginHint(request.loginHint);
+                                    parameterBuilder.addCcsUpn(request.loginHint);
+                                }
+                                else if (request.account.username) {
+                                    // Fallback to account username if provided
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
+                                    parameterBuilder.addLoginHint(request.account.username);
+                                    try {
+                                        clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                        parameterBuilder.addCcsOid(clientInfo);
+                                    }
+                                    catch (e) {
+                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                    }
+                                }
+                            }
+                            else if (request.loginHint) {
+                                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
+                                parameterBuilder.addLoginHint(request.loginHint);
+                                parameterBuilder.addCcsUpn(request.loginHint);
+                            }
+                        }
+                        else {
+                            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
+                        }
+                        if (request.nonce) {
+                            parameterBuilder.addNonce(request.nonce);
+                        }
+                        if (request.state) {
+                            parameterBuilder.addState(request.state);
+                        }
+                        if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
+                            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+                        }
+                        if (request.extraQueryParameters) {
+                            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+                        }
+                        if (!request.nativeBroker) return [3 /*break*/, 3];
+                        // signal ests that this is a WAM call
+                        parameterBuilder.addNativeBroker();
+                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                        popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
+                        return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
+                    case 1:
+                        cnf = _a.sent();
+                        return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
+                    case 2:
+                        cnfHash = _a.sent();
+                        parameterBuilder.addPopToken(cnfHash);
+                        _a.label = 3;
+                    case 3: return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
-            }
-            else if (request.loginHint) {
-                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
-                parameterBuilder.addLoginHint(request.loginHint);
-                parameterBuilder.addCcsUpn(request.loginHint);
-            }
-        }
-        else {
-            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
-        }
-        if (request.nonce) {
-            parameterBuilder.addNonce(request.nonce);
-        }
-        if (request.state) {
-            parameterBuilder.addState(request.state);
-        }
-        if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
-        }
-        if (request.extraQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
-        }
-        return parameterBuilder.createQueryString();
+            });
+        });
     };
     /**
      * This API validates the `EndSessionRequest` and creates a URL
@@ -6364,6 +6444,7 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
         parameterBuilder.addUsername(request.username);
         parameterBuilder.addPassword(request.password);
         parameterBuilder.addScopes(request.scopes);
+        parameterBuilder.addResponseTypeForTokenAndIdToken();
         parameterBuilder.addGrantType(GrantType.RESOURCE_OWNER_PASSWORD_GRANT);
         parameterBuilder.addClientInfo();
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
@@ -7584,6 +7665,11 @@ exports.PerformanceEvents = void 0;
      * Internal API for acquireTokenSilent.
      */
     PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
+    /**
+     * acquireTokenPopup (msal-browser).
+     * Used to acquire a new access token interactively through pop ups
+     */
+    PerformanceEvents["AcquireTokenPopup"] = "acquireTokenPopup";
     /**
      * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
      * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
@@ -7619,6 +7705,16 @@ exports.PerformanceEvents = void 0;
      * Used to load authority metadata for a request.
      */
     PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
+    /**
+     * acquireToken APIs in msal-browser.
+     * Used to make an /authorize endpoint call with native brokering enabled.
+     */
+    PerformanceEvents["FetchAccountIdWithNativeBroker"] = "fetchAccountIdWithNativeBroker";
+    /**
+     * acquireToken API in NativeInteractionClient class (msal-browser).
+     * Used to acquire a token from Native component when native brokering is enabled.
+     */
+    PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
 })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
 /**
  * State of the performance event.