@azure/msal-common 7.4.1 → 7.5.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v7.4.1 2022-09-12 */
+/*! @azure/msal-common v7.5.0 2022-10-03 */
 'use strict';
 'use strict';
 
@@ -105,6 +105,7 @@ var Constants = {
     DEFAULT_COMMON_TENANT: "common",
     // ADFS String
     ADFS: "adfs",
+    DSTS: "dstsv2",
     // Default AAD Instance Discovery Endpoint
     AAD_INSTANCE_DISCOVERY_ENDPT: "https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",
     // Resource delimiter - used for certain cache entries
@@ -136,6 +137,7 @@ var Constants = {
     IMDS_TIMEOUT: 2000,
     AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
+    REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
     KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
     TOKEN_RESPONSE_TYPE: "token",
     ID_TOKEN_RESPONSE_TYPE: "id_token",
@@ -159,6 +161,7 @@ exports.HeaderNames = void 0;
     HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
     HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
     HeaderNames["AuthenticationInfo"] = "Authentication-Info";
+    HeaderNames["X_MS_REQUEST_ID"] = "x-ms-request-id";
 })(exports.HeaderNames || (exports.HeaderNames = {}));
 /**
  * Persistent cache keys MSAL which stay while user is logged in.
@@ -254,7 +257,8 @@ var PromptValue = {
     SELECT_ACCOUNT: "select_account",
     CONSENT: "consent",
     NONE: "none",
-    CREATE: "create"
+    CREATE: "create",
+    NO_SESSION: "no_session"
 };
 /**
  * SSO Types - generated to populate hints
@@ -479,7 +483,8 @@ var JsonTypes;
 (function (JsonTypes) {
     JsonTypes["Jwt"] = "JWT";
     JsonTypes["Jwk"] = "JWK";
-})(JsonTypes || (JsonTypes = {}));
+})(JsonTypes || (JsonTypes = {}));
+var ONE_DAY_IN_MS = 86400000;
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -672,6 +677,16 @@ var ClientAuthErrorMessage = {
         code: "nonce_not_found",
         desc: "nonce not found"
     },
+    authTimeNotFoundError: {
+        code: "auth_time_not_found",
+        desc: "Max Age was requested and the ID token is missing the auth_time variable." +
+            " auth_time is an optional claim and is not enabled by default - it must be enabled." +
+            " See https://aka.ms/msaljs/optional-claims for more information."
+    },
+    maxAgeTranspiredError: {
+        code: "max_age_transpired",
+        desc: "Max Age is set to 0, or too much time has elapsed since the last end-user authentication."
+    },
     noTokensFoundError: {
         code: "no_tokens_found",
         desc: "No tokens were found for the given scopes, and no authorization code was passed to acquireToken. You must retrieve an authorization code before making a call to acquireToken()."
@@ -892,6 +907,19 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createNonceMismatchError = function () {
         return new ClientAuthError(ClientAuthErrorMessage.nonceMismatchError.code, ClientAuthErrorMessage.nonceMismatchError.desc);
     };
+    /**
+     * Creates an error thrown when max_age was provided in the request, but auth_time is not in the token claims
+     * @param missingNonce
+     */
+    ClientAuthError.createAuthTimeNotFoundError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.authTimeNotFoundError.code, ClientAuthErrorMessage.authTimeNotFoundError.desc);
+    };
+    /**
+     * Creates an error thrown when too much time has elapsed since the last end-user authentication
+     */
+    ClientAuthError.createMaxAgeTranspiredError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.maxAgeTranspiredError.code, ClientAuthErrorMessage.maxAgeTranspiredError.desc);
+    };
     /**
      * Creates an error thrown when the mnonce is not present
      * @param missingNonce
@@ -1381,7 +1409,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "7.4.1";
+var version = "7.5.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1606,7 +1634,7 @@ var ClientConfigurationErrorMessage = {
     },
     invalidPrompt: {
         code: "invalid_prompt_value",
-        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create' and 'none'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
+        desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create', 'none' and 'no_session'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
     },
     invalidClaimsRequest: {
         code: "invalid_claims",
@@ -2042,6 +2070,7 @@ exports.AuthorityType = void 0;
 (function (AuthorityType) {
     AuthorityType[AuthorityType["Default"] = 0] = "Default";
     AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
+    AuthorityType[AuthorityType["Dsts"] = 2] = "Dsts";
 })(exports.AuthorityType || (exports.AuthorityType = {}));
 
 /*
@@ -2164,10 +2193,13 @@ var AccountEntity = /** @class */ (function () {
             // How do you account for MSA CID here?
             account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || Constants.EMPTY_STRING;
             /*
-             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array. In most cases it will contain a single email.
-             * This field should not be relied upon if a custom policy is configured to return more than 1 email.
+             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+             * In most cases it will contain a single email. This field should not be relied upon if a custom
+             * policy is configured to return more than 1 email.
              */
-            account.username = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username) || (((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : Constants.EMPTY_STRING);
+            var preferredUsername = (_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username;
+            var email = ((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : null;
+            account.username = preferredUsername || email || Constants.EMPTY_STRING;
             account.name = (_f = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _f === void 0 ? void 0 : _f.name;
         }
         account.cloudGraphHostName = cloudGraphHostName;
@@ -2182,7 +2214,8 @@ var AccountEntity = /** @class */ (function () {
     AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
         var _a, _b, _c, _d;
         var account = new AccountEntity();
-        account.authorityType = (authority && authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.authorityType = (authority &&
+            authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
         account.realm = Constants.EMPTY_STRING;
@@ -2216,7 +2249,7 @@ var AccountEntity = /** @class */ (function () {
         var _a;
         var accountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.sub) ? idToken.claims.sub : Constants.EMPTY_STRING;
         // since ADFS does not have tid and does not set client_info
-        if (authType === exports.AuthorityType.Adfs) {
+        if (authType === exports.AuthorityType.Adfs || authType === exports.AuthorityType.Dsts) {
             return accountId;
         }
         // for cases where there is clientInfo
@@ -2310,6 +2343,20 @@ var AuthToken = /** @class */ (function () {
             throw ClientAuthError.createTokenParsingError(err);
         }
     };
+    /**
+     * Determine if the token's max_age has transpired
+     */
+    AuthToken.checkMaxAge = function (authTime, maxAge) {
+        /*
+         * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+         * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
+         * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
+         */
+        var fiveMinuteSkew = 300000; // five minutes in milliseconds
+        if ((maxAge === 0) || ((Date.now() - fiveMinuteSkew) > (authTime + maxAge))) {
+            throw ClientAuthError.createMaxAgeTranspiredError();
+        }
+    };
     return AuthToken;
 }());
 
@@ -4934,9 +4981,9 @@ var ResponseHandler = /** @class */ (function () {
      * @param serverTokenResponse
      * @param authority
      */
-    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse) {
+    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
         return __awaiter(this, void 0, void 0, function () {
-            var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
+            var idTokenObj, authTime, requestStateObj, cacheRecord, cacheContext, key, account;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -4948,6 +4995,14 @@ var ResponseHandler = /** @class */ (function () {
                                     throw ClientAuthError.createNonceMismatchError();
                                 }
                             }
+                            // token max_age check
+                            if (request.maxAge || (request.maxAge === 0)) {
+                                authTime = idTokenObj.claims.auth_time;
+                                if (!authTime) {
+                                    throw ClientAuthError.createAuthTimeNotFoundError();
+                                }
+                                AuthToken.checkMaxAge(authTime, request.maxAge);
+                            }
                         }
                         // generate homeAccountId
                         this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
@@ -4979,7 +5034,7 @@ var ResponseHandler = /** @class */ (function () {
                             account = this.cacheStorage.getAccount(key);
                             if (!account) {
                                 this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined)];
+                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId)];
                             }
                         }
                         return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
@@ -4994,7 +5049,7 @@ var ResponseHandler = /** @class */ (function () {
                         _a.sent();
                         _a.label = 7;
                     case 7: return [7 /*endfinally*/];
-                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
+                    case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code, serverRequestId)];
                 }
             });
         });
@@ -5080,7 +5135,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param fromTokenCache
      * @param stateString
      */
-    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
+    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code, requestId) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
             var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
@@ -5128,6 +5183,7 @@ var ResponseHandler = /** @class */ (function () {
                                 fromCache: fromTokenCache,
                                 expiresOn: expiresOn,
                                 correlationId: request.correlationId,
+                                requestId: requestId || Constants.EMPTY_STRING,
                                 extExpiresOn: extExpiresOn,
                                 familyId: familyId,
                                 tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
@@ -5188,10 +5244,11 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      * @param request
      */
     AuthorizationCodeClient.prototype.acquireToken = function (request, authCodePayload) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var reqTimestamp, response, responseHandler;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var reqTimestamp, response, requestId, responseHandler;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         this.logger.info("in acquireToken call");
                         if (!request || StringUtils.isEmpty(request.code)) {
@@ -5200,12 +5257,13 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executeTokenRequest(this.authority, request)];
                     case 1:
-                        response = _a.sent();
+                        response = _b.sent();
+                        requestId = (_a = response.headers) === null || _a === void 0 ? void 0 : _a[exports.HeaderNames.X_MS_REQUEST_ID];
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         // Validate response. This function throws a server error if an error is returned by the server.
                         responseHandler.validateTokenResponse(response.body);
-                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload)];
-                    case 2: return [2 /*return*/, _a.sent()];
+                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)];
+                    case 2: return [2 /*return*/, _b.sent()];
                 }
             });
         });
@@ -5893,10 +5951,6 @@ exports.PerformanceEvents = void 0;
      * Used to acquire a token from Native component when native brokering is enabled.
      */
     PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
-    /**
-     * Time spent on the network for refresh token acquisition
-     */
-    PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
     /**
      * Time spent creating default headers for requests to token endpoint
      */
@@ -5910,10 +5964,21 @@ exports.PerformanceEvents = void 0;
      */
     PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
     /**
-     * acquireToken API in BrokerClientApplication.
-     * Used to acquire a token on behalf of the embedded application (PW-Broker).
+     * Time taken for token acquisition by broker
      */
     PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
+    /**
+     * Time spent on the network for refresh token acquisition
+     */
+    PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
+    /**
+     * Time taken for acquiring refresh token , records RT size
+     */
+    PerformanceEvents["RefreshTokenClientAcquireToken"] = "refreshTokenClientAcquireToken";
+    /**
+     * Time taken for acquiring cached refresh token
+     */
+    PerformanceEvents["RefreshTokenClientAcquireTokenWithCachedRefreshToken"] = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
 })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
 /**
  * State of the performance event.
@@ -5941,18 +6006,40 @@ var RefreshTokenClient = /** @class */ (function (_super) {
         return _super.call(this, configuration, performanceClient) || this;
     }
     RefreshTokenClient.prototype.acquireToken = function (request) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function () {
-            var reqTimestamp, response, responseHandler;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var atsMeasurement, reqTimestamp, response, requestId, responseHandler;
+            var _this = this;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
+                        atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
+                        this.logger.verbose("RefreshTokenClientAcquireToken called", request.correlationId);
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
                     case 1:
-                        response = _a.sent();
+                        response = _c.sent();
+                        requestId = (_b = response.headers) === null || _b === void 0 ? void 0 : _b[exports.HeaderNames.X_MS_REQUEST_ID];
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         responseHandler.validateTokenResponse(response.body);
-                        return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache)];
+                        return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId).then(function (result) {
+                                var _a;
+                                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                    success: true,
+                                    refreshTokenSize: ((_a = response.body.refresh_token) === null || _a === void 0 ? void 0 : _a.length) || 0
+                                });
+                                return result;
+                            })
+                                .catch(function (error) {
+                                _this.logger.verbose("Error in fetching refresh token", request.correlationId);
+                                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                    errorCode: error.errorCode,
+                                    subErrorCode: error.subError,
+                                    success: false,
+                                    refreshTokenSize: undefined
+                                });
+                                throw error;
+                            })];
                 }
             });
         });
@@ -6002,14 +6089,21 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      * @param request
      */
     RefreshTokenClient.prototype.acquireTokenWithCachedRefreshToken = function (request, foci) {
+        var _a;
         return __awaiter(this, void 0, void 0, function () {
-            var refreshToken, refreshTokenRequest;
-            return __generator(this, function (_a) {
+            var atsMeasurement, refreshToken, refreshTokenRequest;
+            return __generator(this, function (_b) {
+                atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
+                this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
                 refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
-                // no refresh Token
                 if (!refreshToken) {
+                    atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.discardMeasurement();
                     throw InteractionRequiredAuthError.createNoTokensFoundError();
                 }
+                // attach cached RT size to the current measurement
+                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                    success: true
+                });
                 refreshTokenRequest = __assign(__assign({}, request), { refreshToken: refreshToken.secret, authenticationScheme: request.authenticationScheme || exports.AuthenticationScheme.BEARER, ccsCredential: {
                         credential: request.account.homeAccountId,
                         type: exports.CcsCredentialType.HOME_ACCOUNT_ID
@@ -6678,13 +6772,21 @@ var SilentFlowClient = /** @class */ (function (_super) {
      */
     SilentFlowClient.prototype.generateResultFromCacheRecord = function (cacheRecord, request) {
         return __awaiter(this, void 0, void 0, function () {
-            var idTokenObj;
+            var idTokenObj, authTime;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         if (cacheRecord.idToken) {
                             idTokenObj = new AuthToken(cacheRecord.idToken.secret, this.config.cryptoInterface);
                         }
+                        // token max_age check
+                        if (request.maxAge || (request.maxAge === 0)) {
+                            authTime = idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.auth_time;
+                            if (!authTime) {
+                                throw ClientAuthError.createAuthTimeNotFoundError();
+                            }
+                            AuthToken.checkMaxAge(authTime, request.maxAge);
+                        }
                         return [4 /*yield*/, ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenObj)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
@@ -7060,8 +7162,13 @@ var Authority = /** @class */ (function () {
         // See above for AuthorityType
         get: function () {
             var pathSegments = this.canonicalAuthorityUrlComponents.PathSegments;
-            if (pathSegments.length && pathSegments[0].toLowerCase() === Constants.ADFS) {
-                return exports.AuthorityType.Adfs;
+            if (pathSegments.length) {
+                switch (pathSegments[0].toLowerCase()) {
+                    case Constants.ADFS:
+                        return exports.AuthorityType.Adfs;
+                    case Constants.DSTS:
+                        return exports.AuthorityType.Dsts;
+                }
             }
             return exports.AuthorityType.Default;
         },
@@ -7265,7 +7372,9 @@ var Authority = /** @class */ (function () {
          * The default open id configuration endpoint for any canonical authority.
          */
         get: function () {
-            if (this.authorityType === exports.AuthorityType.Adfs || this.protocolMode === exports.ProtocolMode.OIDC) {
+            if (this.authorityType === exports.AuthorityType.Adfs ||
+                this.authorityType === exports.AuthorityType.Dsts ||
+                this.protocolMode === exports.ProtocolMode.OIDC) {
                 return this.canonicalAuthority + ".well-known/openid-configuration";
             }
             return this.canonicalAuthority + "v2.0/.well-known/openid-configuration";
@@ -7363,8 +7472,9 @@ var Authority = /** @class */ (function () {
         });
     };
     /**
-     * Compares the number of url components after the domain to determine if the cached authority metadata can be used for the requested authority
-     * Protects against same domain different authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
+     * Compares the number of url components after the domain to determine if the cached
+     * authority metadata can be used for the requested authority. Protects against same domain different
+     * authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
      * @param metadataEntity
      */
     Authority.prototype.isAuthoritySameType = function (metadataEntity) {
@@ -7404,7 +7514,8 @@ var Authority = /** @class */ (function () {
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
-                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
+                        return [4 /*yield*/, this.networkInterface.
+                                sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
                     case 2:
                         response = _a.sent();
                         return [2 /*return*/, isOpenIdConfigResponse(response.body) ? response.body : null];
@@ -7465,7 +7576,8 @@ var Authority = /** @class */ (function () {
         });
     };
     /**
-     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from
+     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
+     * and returns where the information was retrieved from
      * @param cachedMetadata
      * @param newMetadata
      */
@@ -7688,7 +7800,7 @@ var Authority = /** @class */ (function () {
     Authority.replaceWithRegionalInformation = function (metadata, azureRegion) {
         metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
         // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
-        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
+        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
         if (metadata.end_session_endpoint) {
             metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
         }
@@ -8331,6 +8443,9 @@ var PerformanceClient = /** @class */ (function () {
                         if (current.idTokenSize) {
                             previous.idTokenSize = current.idTokenSize;
                         }
+                        if (current.refreshTokenSize) {
+                            previous.refreshTokenSize = current.refreshTokenSize;
+                        }
                     }
                     return previous;
                 }, topLevelEvent);
@@ -8461,6 +8576,7 @@ exports.JoseHeader = JoseHeader;
 exports.Logger = Logger;
 exports.NetworkManager = NetworkManager;
 exports.OIDC_DEFAULT_SCOPES = OIDC_DEFAULT_SCOPES;
+exports.ONE_DAY_IN_MS = ONE_DAY_IN_MS;
 exports.OnBehalfOfClient = OnBehalfOfClient;
 exports.PerformanceClient = PerformanceClient;
 exports.PopTokenGenerator = PopTokenGenerator;