@azure/msal-common 6.2.0 → 6.4.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v6.2.0 2022-04-04 */
+/*! @azure/msal-common v6.4.0 2022-06-06 */
 'use strict';
 'use strict';
 
@@ -136,7 +136,9 @@ var Constants = {
     IMDS_TIMEOUT: 2000,
     AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
-    KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"]
+    KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
+    TOKEN_RESPONSE_TYPE: "token",
+    ID_TOKEN_RESPONSE_TYPE: "id_token"
 };
 var OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
@@ -229,6 +231,7 @@ var AADServerParamKeys;
     AADServerParamKeys["FOCI"] = "foci";
     AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
     AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
+    AADServerParamKeys["NATIVE_BROKER"] = "nativebroker";
     AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
 })(AADServerParamKeys || (AADServerParamKeys = {}));
 /**
@@ -459,7 +462,12 @@ var CacheOutcome;
     CacheOutcome["NO_CACHED_ACCESS_TOKEN"] = "2";
     CacheOutcome["CACHED_ACCESS_TOKEN_EXPIRED"] = "3";
     CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
-})(CacheOutcome || (CacheOutcome = {}));
+})(CacheOutcome || (CacheOutcome = {}));
+var JsonTypes;
+(function (JsonTypes) {
+    JsonTypes["Jwt"] = "JWT";
+    JsonTypes["Jwk"] = "JWK";
+})(JsonTypes || (JsonTypes = {}));
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -764,6 +772,10 @@ var ClientAuthErrorMessage = {
     logoutNotSupported: {
         code: "end_session_endpoint_not_supported",
         desc: "Provided authority does not support logout."
+    },
+    keyIdMissing: {
+        code: "key_id_missing",
+        desc: "A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key."
     }
 };
 /**
@@ -1033,6 +1045,12 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createLogoutNotSupportedError = function () {
         return new ClientAuthError(ClientAuthErrorMessage.logoutNotSupported.code, ClientAuthErrorMessage.logoutNotSupported.desc);
     };
+    /**
+     * Create an error when kid attribute is missing from a PoP token's cache record
+     */
+    ClientAuthError.createKeyIdMissingError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.keyIdMissing.code, ClientAuthErrorMessage.keyIdMissing.desc);
+    };
     return ClientAuthError;
 }(AuthError));
 
@@ -1339,7 +1357,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "6.2.0";
+var version = "6.4.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2027,6 +2045,7 @@ exports.AuthorityType = void 0;
  *      lastModificationApp:
  *      oboAssertion: access token passed in as part of OBO request
  *      idTokenClaims: Object containing claims parsed from ID token
+ *      nativeAccountId: Account identifier on the native device
  * }
  */
 var AccountEntity = /** @class */ (function () {
@@ -2080,7 +2099,8 @@ var AccountEntity = /** @class */ (function () {
             username: this.username,
             localAccountId: this.localAccountId,
             name: this.name,
-            idTokenClaims: this.idTokenClaims
+            idTokenClaims: this.idTokenClaims,
+            nativeAccountId: this.nativeAccountId
         };
     };
     /**
@@ -2102,12 +2122,13 @@ var AccountEntity = /** @class */ (function () {
      * @param idToken
      * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
         var _a, _b, _c, _d, _e, _f;
         var account = new AccountEntity();
         account.authorityType = exports.CacheAccountType.MSSTS_ACCOUNT_TYPE;
         account.clientInfo = clientInfo;
         account.homeAccountId = homeAccountId;
+        account.nativeAccountId = nativeAccountId;
         var env = environment || (authority && authority.getPreferredCache());
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -2229,6 +2250,7 @@ var AccountEntity = /** @class */ (function () {
             (accountA.username === accountB.username) &&
             (accountA.tenantId === accountB.tenantId) &&
             (accountA.environment === accountB.environment) &&
+            (accountA.nativeAccountId === accountB.nativeAccountId) &&
             claimsMatch;
     };
     return AccountEntity;
@@ -2636,7 +2658,7 @@ var CacheManager = /** @class */ (function () {
         });
     };
     /**
-     * returns a boolean if the given account is removed
+     * Removes credentials associated with the provided account
      * @param account
      */
     CacheManager.prototype.removeAccountContext = function (account) {
@@ -3556,6 +3578,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addResponseTypeCode = function () {
         this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
     };
+    /**
+     * add response_type = token id_token
+     */
+    RequestParameterBuilder.prototype.addResponseTypeForTokenAndIdToken = function () {
+        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.TOKEN_RESPONSE_TYPE + " " + Constants.ID_TOKEN_RESPONSE_TYPE));
+    };
     /**
      * add response_mode. defaults to query.
      * @param responseMode
@@ -3563,6 +3591,12 @@ var RequestParameterBuilder = /** @class */ (function () {
     RequestParameterBuilder.prototype.addResponseMode = function (responseMode) {
         this.parameters.set(AADServerParamKeys.RESPONSE_MODE, encodeURIComponent((responseMode) ? responseMode : exports.ResponseMode.QUERY));
     };
+    /**
+     * Add flag to indicate STS should attempt to use WAM if available
+     */
+    RequestParameterBuilder.prototype.addNativeBroker = function () {
+        this.parameters.set(AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
+    };
     /**
      * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
      * @param scopeSet
@@ -3841,14 +3875,14 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param username
      */
     RequestParameterBuilder.prototype.addUsername = function (username) {
-        this.parameters.set(PasswordGrantConstants.username, username);
+        this.parameters.set(PasswordGrantConstants.username, encodeURIComponent(username));
     };
     /**
      * adds `password` for Password Grant flow
      * @param password
      */
     RequestParameterBuilder.prototype.addPassword = function (password) {
-        this.parameters.set(PasswordGrantConstants.password, password);
+        this.parameters.set(PasswordGrantConstants.password, encodeURIComponent(password));
     };
     /**
      * add pop_jwk to query params
@@ -4549,19 +4583,37 @@ var PopTokenGenerator = /** @class */ (function () {
     function PopTokenGenerator(cryptoUtils) {
         this.cryptoUtils = cryptoUtils;
     }
+    /**
+     * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.generateCnf = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var reqCnf;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var reqCnf, reqCnfString, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0: return [4 /*yield*/, this.generateKid(request)];
                     case 1:
-                        reqCnf = _a.sent();
-                        return [2 /*return*/, this.cryptoUtils.base64Encode(JSON.stringify(reqCnf))];
+                        reqCnf = _b.sent();
+                        reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+                        _a = {
+                            kid: reqCnf.kid,
+                            reqCnfString: reqCnfString
+                        };
+                        return [4 /*yield*/, this.cryptoUtils.hashString(reqCnfString)];
+                    case 2: return [2 /*return*/, (_a.reqCnfHash = _b.sent(),
+                            _a)];
                 }
             });
         });
     };
+    /**
+     * Generates key_id for a SHR token request
+     * @param request
+     * @returns
+     */
     PopTokenGenerator.prototype.generateKid = function (request) {
         return __awaiter(this, void 0, void 0, function () {
             var kidThumbprint;
@@ -4578,20 +4630,28 @@ var PopTokenGenerator = /** @class */ (function () {
             });
         });
     };
-    PopTokenGenerator.prototype.signPopToken = function (accessToken, request) {
-        var _a;
+    /**
+     * Signs the POP access_token with the local generated key-pair
+     * @param accessToken
+     * @param request
+     * @returns
+     */
+    PopTokenGenerator.prototype.signPopToken = function (accessToken, keyId, request) {
         return __awaiter(this, void 0, void 0, function () {
-            var tokenClaims;
-            return __generator(this, function (_b) {
-                tokenClaims = AuthToken.extractTokenClaims(accessToken, this.cryptoUtils);
-                if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
-                    throw ClientAuthError.createTokenClaimsRequiredError();
-                }
-                return [2 /*return*/, this.signPayload(accessToken, tokenClaims.cnf.kid, request)];
+            return __generator(this, function (_a) {
+                return [2 /*return*/, this.signPayload(accessToken, keyId, request)];
             });
         });
     };
-    PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
+    /**
+     * Utility function to generate the signed JWT for an access_token
+     * @param payload
+     * @param kid
+     * @param request
+     * @param claims
+     * @returns
+     */
+    PopTokenGenerator.prototype.signPayload = function (payload, keyId, request, claims) {
         return __awaiter(this, void 0, void 0, function () {
             var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
             return __generator(this, function (_a) {
@@ -4600,7 +4660,7 @@ var PopTokenGenerator = /** @class */ (function () {
                         resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                         resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                         resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid, request.correlationId)];
+                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), keyId, request.correlationId)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -4919,9 +4979,9 @@ var ResponseHandler = /** @class */ (function () {
     ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
-            var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
-            return __generator(this, function (_d) {
-                switch (_d.label) {
+            var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
                     case 0:
                         accessToken = Constants.EMPTY_STRING;
                         responseScopes = [];
@@ -4930,18 +4990,22 @@ var ResponseHandler = /** @class */ (function () {
                         if (!cacheRecord.accessToken) return [3 /*break*/, 4];
                         if (!(cacheRecord.accessToken.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         popTokenGenerator = new PopTokenGenerator(cryptoObj);
-                        return [4 /*yield*/, popTokenGenerator.signPopToken(cacheRecord.accessToken.secret, request)];
+                        _d = cacheRecord.accessToken, secret = _d.secret, keyId = _d.keyId;
+                        if (!keyId) {
+                            throw ClientAuthError.createKeyIdMissingError();
+                        }
+                        return [4 /*yield*/, popTokenGenerator.signPopToken(secret, keyId, request)];
                     case 1:
-                        accessToken = _d.sent();
+                        accessToken = _e.sent();
                         return [3 /*break*/, 3];
                     case 2:
                         accessToken = cacheRecord.accessToken.secret;
-                        _d.label = 3;
+                        _e.label = 3;
                     case 3:
                         responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
                         expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
                         extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
-                        _d.label = 4;
+                        _e.label = 4;
                     case 4:
                         if (cacheRecord.appMetadata) {
                             familyId = cacheRecord.appMetadata.familyId === THE_FAMILY_ID ? THE_FAMILY_ID : Constants.EMPTY_STRING;
@@ -4966,7 +5030,8 @@ var ResponseHandler = /** @class */ (function () {
                                 state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
                                 msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
-                                code: code
+                                code: code,
+                                fromNativeBroker: false
                             }];
                 }
             });
@@ -5004,8 +5069,12 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
         return __awaiter(this, void 0, void 0, function () {
             var queryString;
             return __generator(this, function (_a) {
-                queryString = this.createAuthCodeUrlQueryString(request);
-                return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.createAuthCodeUrlQueryString(request)];
+                    case 1:
+                        queryString = _a.sent();
+                        return [2 /*return*/, UrlString.appendQueryString(this.authority.authorizationEndpoint, queryString)];
+                }
             });
         });
     };
@@ -5136,7 +5205,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      */
     AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
+            var parameterBuilder, clientAssertion, popTokenGenerator, reqCnfData, correlationId, ccsCred, clientInfo, clientInfo;
             var _a;
             return __generator(this, function (_b) {
                 switch (_b.label) {
@@ -5173,8 +5242,8 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         if (this.config.clientCredentials.clientSecret) {
                             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                         }
-                        if (this.config.clientCredentials.clientAssertion) {
-                            clientAssertion = this.config.clientCredentials.clientAssertion;
+                        clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
+                        if (clientAssertion) {
                             parameterBuilder.addClientAssertion(clientAssertion.assertion);
                             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                         }
@@ -5184,8 +5253,9 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _b.sent();
-                        parameterBuilder.addPopToken(cnfString);
+                        reqCnfData = _b.sent();
+                        // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                         return [3 /*break*/, 3];
                     case 2:
                         if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
@@ -5255,96 +5325,113 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      * @param request
      */
     AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
-        var parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(this.config.authOptions.clientId);
-        var requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
-        parameterBuilder.addScopes(requestScopes);
-        // validate the redirectUri (to be a non null value)
-        parameterBuilder.addRedirectUri(request.redirectUri);
-        // generate the correlationId if not set by the user and add
-        var correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
-        parameterBuilder.addCorrelationId(correlationId);
-        // add response_mode. If not passed in it defaults to query.
-        parameterBuilder.addResponseMode(request.responseMode);
-        // add response_type = code
-        parameterBuilder.addResponseTypeCode();
-        // add library info parameters
-        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
-        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
-        // add client_info=1
-        parameterBuilder.addClientInfo();
-        if (request.codeChallenge && request.codeChallengeMethod) {
-            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
-        }
-        if (request.prompt) {
-            parameterBuilder.addPrompt(request.prompt);
-        }
-        if (request.domainHint) {
-            parameterBuilder.addDomainHint(request.domainHint);
-        }
-        // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
-        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
-            // AAD will throw if prompt=select_account is passed with an account hint
-            if (request.sid && request.prompt === PromptValue.NONE) {
-                // SessionID is only used in silent calls
-                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
-                parameterBuilder.addSid(request.sid);
-            }
-            else if (request.account) {
-                var accountSid = this.extractAccountSid(request.account);
-                // If account and loginHint are provided, we will check account first for sid before adding loginHint
-                if (accountSid && request.prompt === PromptValue.NONE) {
-                    // SessionId is only used in silent calls
-                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
-                    parameterBuilder.addSid(accountSid);
-                    try {
-                        var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                    }
-                }
-                else if (request.loginHint) {
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
-                    parameterBuilder.addLoginHint(request.loginHint);
-                    parameterBuilder.addCcsUpn(request.loginHint);
-                }
-                else if (request.account.username) {
-                    // Fallback to account username if provided
-                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
-                    parameterBuilder.addLoginHint(request.account.username);
-                    try {
-                        var clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
-                        parameterBuilder.addCcsOid(clientInfo);
-                    }
-                    catch (e) {
-                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
-                    }
+        return __awaiter(this, void 0, void 0, function () {
+            var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, reqCnfData;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        parameterBuilder = new RequestParameterBuilder();
+                        parameterBuilder.addClientId(this.config.authOptions.clientId);
+                        requestScopes = __spreadArrays(request.scopes || [], request.extraScopesToConsent || []);
+                        parameterBuilder.addScopes(requestScopes);
+                        // validate the redirectUri (to be a non null value)
+                        parameterBuilder.addRedirectUri(request.redirectUri);
+                        correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
+                        parameterBuilder.addCorrelationId(correlationId);
+                        // add response_mode. If not passed in it defaults to query.
+                        parameterBuilder.addResponseMode(request.responseMode);
+                        // add response_type = code
+                        parameterBuilder.addResponseTypeCode();
+                        // add library info parameters
+                        parameterBuilder.addLibraryInfo(this.config.libraryInfo);
+                        parameterBuilder.addApplicationTelemetry(this.config.telemetry.application);
+                        // add client_info=1
+                        parameterBuilder.addClientInfo();
+                        if (request.codeChallenge && request.codeChallengeMethod) {
+                            parameterBuilder.addCodeChallengeParams(request.codeChallenge, request.codeChallengeMethod);
+                        }
+                        if (request.prompt) {
+                            parameterBuilder.addPrompt(request.prompt);
+                        }
+                        if (request.domainHint) {
+                            parameterBuilder.addDomainHint(request.domainHint);
+                        }
+                        // Add sid or loginHint with preference for sid -> loginHint -> username of AccountInfo object
+                        if (request.prompt !== PromptValue.SELECT_ACCOUNT) {
+                            // AAD will throw if prompt=select_account is passed with an account hint
+                            if (request.sid && request.prompt === PromptValue.NONE) {
+                                // SessionID is only used in silent calls
+                                this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from request");
+                                parameterBuilder.addSid(request.sid);
+                            }
+                            else if (request.account) {
+                                accountSid = this.extractAccountSid(request.account);
+                                // If account and loginHint are provided, we will check account first for sid before adding loginHint
+                                if (accountSid && request.prompt === PromptValue.NONE) {
+                                    // SessionId is only used in silent calls
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Prompt is none, adding sid from account");
+                                    parameterBuilder.addSid(accountSid);
+                                    try {
+                                        clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                        parameterBuilder.addCcsOid(clientInfo);
+                                    }
+                                    catch (e) {
+                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                    }
+                                }
+                                else if (request.loginHint) {
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from request");
+                                    parameterBuilder.addLoginHint(request.loginHint);
+                                    parameterBuilder.addCcsUpn(request.loginHint);
+                                }
+                                else if (request.account.username) {
+                                    // Fallback to account username if provided
+                                    this.logger.verbose("createAuthCodeUrlQueryString: Adding login_hint from account");
+                                    parameterBuilder.addLoginHint(request.account.username);
+                                    try {
+                                        clientInfo = buildClientInfoFromHomeAccountId(request.account.homeAccountId);
+                                        parameterBuilder.addCcsOid(clientInfo);
+                                    }
+                                    catch (e) {
+                                        this.logger.verbose("Could not parse home account ID for CCS Header: " + e);
+                                    }
+                                }
+                            }
+                            else if (request.loginHint) {
+                                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
+                                parameterBuilder.addLoginHint(request.loginHint);
+                                parameterBuilder.addCcsUpn(request.loginHint);
+                            }
+                        }
+                        else {
+                            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
+                        }
+                        if (request.nonce) {
+                            parameterBuilder.addNonce(request.nonce);
+                        }
+                        if (request.state) {
+                            parameterBuilder.addState(request.state);
+                        }
+                        if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
+                            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
+                        }
+                        if (request.extraQueryParameters) {
+                            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
+                        }
+                        if (!request.nativeBroker) return [3 /*break*/, 2];
+                        // signal ests that this is a WAM call
+                        parameterBuilder.addNativeBroker();
+                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
+                        popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
+                        return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
+                    case 1:
+                        reqCnfData = _a.sent();
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                        _a.label = 2;
+                    case 2: return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
-            }
-            else if (request.loginHint) {
-                this.logger.verbose("createAuthCodeUrlQueryString: No account, adding login_hint from request");
-                parameterBuilder.addLoginHint(request.loginHint);
-                parameterBuilder.addCcsUpn(request.loginHint);
-            }
-        }
-        else {
-            this.logger.verbose("createAuthCodeUrlQueryString: Prompt is select_account, ignoring account hints");
-        }
-        if (request.nonce) {
-            parameterBuilder.addNonce(request.nonce);
-        }
-        if (request.state) {
-            parameterBuilder.addState(request.state);
-        }
-        if (!StringUtils.isEmpty(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
-            parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
-        }
-        if (request.extraQueryParameters) {
-            parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
-        }
-        return parameterBuilder.createQueryString();
+            });
+        });
     };
     /**
      * This API validates the `EndSessionRequest` and creates a URL
@@ -5738,7 +5825,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      */
     RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, cnfString, clientInfo;
+            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, reqCnfData, clientInfo;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -5759,8 +5846,8 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         if (this.config.clientCredentials.clientSecret) {
                             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                         }
-                        if (this.config.clientCredentials.clientAssertion) {
-                            clientAssertion = this.config.clientCredentials.clientAssertion;
+                        clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
+                        if (clientAssertion) {
                             parameterBuilder.addClientAssertion(clientAssertion.assertion);
                             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                         }
@@ -5768,8 +5855,9 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _a.sent();
-                        parameterBuilder.addPopToken(cnfString);
+                        reqCnfData = _a.sent();
+                        // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                         return [3 /*break*/, 3];
                     case 2:
                         if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
@@ -5958,8 +6046,9 @@ var ClientCredentialClient = /** @class */ (function (_super) {
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
         }
-        if (this.config.clientCredentials.clientAssertion) {
-            var clientAssertion = this.config.clientCredentials.clientAssertion;
+        // Use clientAssertion from request, fallback to client assertion in base configuration
+        var clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
+        if (clientAssertion) {
             parameterBuilder.addClientAssertion(clientAssertion.assertion);
             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
         }
@@ -6163,8 +6252,9 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
         }
-        if (this.config.clientCredentials.clientAssertion) {
-            var clientAssertion = this.config.clientCredentials.clientAssertion;
+        // Use clientAssertion from request, fallback to client assertion in base configuration
+        var clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
+        if (clientAssertion) {
             parameterBuilder.addClientAssertion(clientAssertion.assertion);
             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
         }
@@ -6364,6 +6454,7 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
         parameterBuilder.addUsername(request.username);
         parameterBuilder.addPassword(request.password);
         parameterBuilder.addScopes(request.scopes);
+        parameterBuilder.addResponseTypeForTokenAndIdToken();
         parameterBuilder.addGrantType(GrantType.RESOURCE_OWNER_PASSWORD_GRANT);
         parameterBuilder.addClientInfo();
         parameterBuilder.addLibraryInfo(this.config.libraryInfo);
@@ -6377,8 +6468,9 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
         }
-        if (this.config.clientCredentials.clientAssertion) {
-            var clientAssertion = this.config.clientCredentials.clientAssertion;
+        // Use clientAssertion from request, fallback to client assertion in base configuration
+        var clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
+        if (clientAssertion) {
             parameterBuilder.addClientAssertion(clientAssertion.assertion);
             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
         }
@@ -7335,6 +7427,87 @@ var StubbedNetworkModule = {
     }
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * ClientAuthErrorMessage class containing string constants used by error codes and messages.
+ */
+var JoseHeaderErrorMessage = {
+    missingKidError: {
+        code: "missing_kid_error",
+        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided."
+    },
+    missingAlgError: {
+        code: "missing_alg_error",
+        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided."
+    },
+};
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+var JoseHeaderError = /** @class */ (function (_super) {
+    __extends(JoseHeaderError, _super);
+    function JoseHeaderError(errorCode, errorMessage) {
+        var _this = _super.call(this, errorCode, errorMessage) || this;
+        _this.name = "JoseHeaderError";
+        Object.setPrototypeOf(_this, JoseHeaderError.prototype);
+        return _this;
+    }
+    /**
+     * Creates an error thrown when keyId isn't set on JOSE header.
+     */
+    JoseHeaderError.createMissingKidError = function () {
+        return new JoseHeaderError(JoseHeaderErrorMessage.missingKidError.code, JoseHeaderErrorMessage.missingKidError.desc);
+    };
+    /**
+     * Creates an error thrown when algorithm isn't set on JOSE header.
+     */
+    JoseHeaderError.createMissingAlgError = function () {
+        return new JoseHeaderError(JoseHeaderErrorMessage.missingAlgError.code, JoseHeaderErrorMessage.missingAlgError.desc);
+    };
+    return JoseHeaderError;
+}(AuthError));
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var JoseHeader = /** @class */ (function () {
+    function JoseHeader(options) {
+        this.typ = options.typ;
+        this.alg = options.alg;
+        this.kid = options.kid;
+    }
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object and returns
+     * the stringified header object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @returns
+     */
+    JoseHeader.getShrHeaderString = function (shrHeaderOptions) {
+        // KeyID is required on the SHR header
+        if (!shrHeaderOptions.kid) {
+            throw JoseHeaderError.createMissingKidError();
+        }
+        // Alg is required on the SHR header
+        if (!shrHeaderOptions.alg) {
+            throw JoseHeaderError.createMissingAlgError();
+        }
+        var shrHeader = new JoseHeader({
+            // Access Token PoP headers must have type JWT, but the type header can be overriden for special cases
+            typ: shrHeaderOptions.typ || JsonTypes.Jwt,
+            kid: shrHeaderOptions.kid,
+            alg: shrHeaderOptions.alg
+        });
+        return JSON.stringify(shrHeader);
+    };
+    return JoseHeader;
+}());
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7584,6 +7757,11 @@ exports.PerformanceEvents = void 0;
      * Internal API for acquireTokenSilent.
      */
     PerformanceEvents["AcquireTokenSilentAsync"] = "acquireTokenSilentAsync";
+    /**
+     * acquireTokenPopup (msal-browser).
+     * Used to acquire a new access token interactively through pop ups
+     */
+    PerformanceEvents["AcquireTokenPopup"] = "acquireTokenPopup";
     /**
      * getPublicKeyThumbprint API in CryptoOpts class (msal-browser).
      * Used to generate a public/private keypair and generate a public key thumbprint for pop requests.
@@ -7619,6 +7797,16 @@ exports.PerformanceEvents = void 0;
      * Used to load authority metadata for a request.
      */
     PerformanceEvents["StandardInteractionClientGetDiscoveredAuthority"] = "standardInteractionClientGetDiscoveredAuthority";
+    /**
+     * acquireToken APIs in msal-browser.
+     * Used to make an /authorize endpoint call with native brokering enabled.
+     */
+    PerformanceEvents["FetchAccountIdWithNativeBroker"] = "fetchAccountIdWithNativeBroker";
+    /**
+     * acquireToken API in NativeInteractionClient class (msal-browser).
+     * Used to acquire a token from Native component when native brokering is enabled.
+     */
+    PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
 })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
 /**
  * State of the performance event.
@@ -7958,6 +8146,7 @@ exports.IdToken = AuthToken;
 exports.IdTokenEntity = IdTokenEntity;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
 exports.InteractionRequiredAuthErrorMessage = InteractionRequiredAuthErrorMessage;
+exports.JoseHeader = JoseHeader;
 exports.Logger = Logger;
 exports.NetworkManager = NetworkManager;
 exports.OIDC_DEFAULT_SCOPES = OIDC_DEFAULT_SCOPES;