@azure/msal-common 9.0.0 → 9.0.2

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v9.0.0 2022-11-22 */
+/*! @azure/msal-common v9.0.2 2023-01-09 */
 'use strict';
 'use strict';
 
@@ -142,7 +142,8 @@ var Constants = {
     KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
     TOKEN_RESPONSE_TYPE: "token",
     ID_TOKEN_RESPONSE_TYPE: "id_token",
-    SHR_NONCE_VALIDITY: 240
+    SHR_NONCE_VALIDITY: 240,
+    INVALID_INSTANCE: "invalid_instance",
 };
 var OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
@@ -163,6 +164,7 @@ exports.HeaderNames = void 0;
     HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
     HeaderNames["AuthenticationInfo"] = "Authentication-Info";
     HeaderNames["X_MS_REQUEST_ID"] = "x-ms-request-id";
+    HeaderNames["X_MS_HTTP_VERSION"] = "x-ms-httpver";
 })(exports.HeaderNames || (exports.HeaderNames = {}));
 /**
  * Persistent cache keys MSAL which stay while user is logged in.
@@ -1255,13 +1257,23 @@ var Logger = /** @class */ (function () {
         var defaultLoggerCallback = function () {
             return;
         };
-        this.localCallback = loggerOptions.loggerCallback || defaultLoggerCallback;
-        this.piiLoggingEnabled = loggerOptions.piiLoggingEnabled || false;
-        this.level = typeof (loggerOptions.logLevel) === "number" ? loggerOptions.logLevel : exports.LogLevel.Info;
-        this.correlationId = loggerOptions.correlationId || Constants.EMPTY_STRING;
+        var setLoggerOptions = loggerOptions || Logger.createDefaultLoggerOptions();
+        this.localCallback = setLoggerOptions.loggerCallback || defaultLoggerCallback;
+        this.piiLoggingEnabled = setLoggerOptions.piiLoggingEnabled || false;
+        this.level = typeof (setLoggerOptions.logLevel) === "number" ? setLoggerOptions.logLevel : exports.LogLevel.Info;
+        this.correlationId = setLoggerOptions.correlationId || Constants.EMPTY_STRING;
         this.packageName = packageName || Constants.EMPTY_STRING;
         this.packageVersion = packageVersion || Constants.EMPTY_STRING;
     }
+    Logger.createDefaultLoggerOptions = function () {
+        return {
+            loggerCallback: function () {
+                // allow users to not set loggerCallback
+            },
+            piiLoggingEnabled: false,
+            logLevel: exports.LogLevel.Info
+        };
+    };
     /**
      * Create new Logger with existing configurations.
      */
@@ -1410,7 +1422,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "9.0.0";
+var version = "9.0.2";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1507,19 +1519,16 @@ var CredentialEntity = /** @class */ (function () {
      * @param key
      */
     CredentialEntity.getCredentialType = function (key) {
-        // First keyword search will match all "AccessToken" and "AccessToken_With_AuthScheme" credentials
-        if (key.indexOf(exports.CredentialType.ACCESS_TOKEN.toLowerCase()) !== -1) {
-            // Perform second search to differentiate between "AccessToken" and "AccessToken_With_AuthScheme" credential types
-            if (key.indexOf(exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) !== -1) {
-                return exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
+        var separator = Separators.CACHE_KEY_SEPARATOR;
+        // Match host names like "login.microsoftonline.com", "https://accounts.google.com:4000", etc.
+        var domainRe = "(https?:\\/\\/)?([\\w-]+\\.)*([\\w-]{1,63})(\\.(\\w{2,3}))(\\:[0-9]{4,5})?";
+        for (var _i = 0, _a = Object.keys(exports.CredentialType); _i < _a.length; _i++) {
+            var credKey = _a[_i];
+            var credVal = exports.CredentialType[credKey].toLowerCase();
+            // Verify credential type is preceded by a valid host name (environment)
+            if (key.toLowerCase().search("(?<=" + separator + domainRe + ")" + separator + credVal + separator) !== -1) {
+                return exports.CredentialType[credKey];
             }
-            return exports.CredentialType.ACCESS_TOKEN;
-        }
-        else if (key.indexOf(exports.CredentialType.ID_TOKEN.toLowerCase()) !== -1) {
-            return exports.CredentialType.ID_TOKEN;
-        }
-        else if (key.indexOf(exports.CredentialType.REFRESH_TOKEN.toLowerCase()) !== -1) {
-            return exports.CredentialType.REFRESH_TOKEN;
         }
         return Constants.NOT_DEFINED;
     };
@@ -5196,7 +5205,7 @@ var ResponseHandler = /** @class */ (function () {
                                 cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
                                 msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
                                 code: code,
-                                fromNativeBroker: false
+                                fromNativeBroker: false,
                             }];
                 }
             });
@@ -5214,8 +5223,8 @@ var ResponseHandler = /** @class */ (function () {
  */
 var AuthorizationCodeClient = /** @class */ (function (_super) {
     __extends(AuthorizationCodeClient, _super);
-    function AuthorizationCodeClient(configuration) {
-        var _this = _super.call(this, configuration) || this;
+    function AuthorizationCodeClient(configuration, performanceClient) {
+        var _this = _super.call(this, configuration, performanceClient) || this;
         // Flag to indicate if client is for hybrid spa auth code redemption
         _this.includeRedirectUri = true;
         return _this;
@@ -5249,26 +5258,47 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      * @param request
      */
     AuthorizationCodeClient.prototype.acquireToken = function (request, authCodePayload) {
-        var _a;
+        var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
-            var reqTimestamp, response, requestId, responseHandler;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            var atsMeasurement, reqTimestamp, response, requestId, httpVerAuthority, responseHandler;
+            var _this = this;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
                     case 0:
-                        this.logger.info("in acquireToken call");
+                        atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement("AuthCodeClientAcquireToken", request.correlationId);
+                        this.logger.info("in acquireToken call in auth-code client");
                         if (!request || StringUtils.isEmpty(request.code)) {
                             throw ClientAuthError.createTokenRequestCannotBeMadeError();
                         }
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executeTokenRequest(this.authority, request)];
                     case 1:
-                        response = _b.sent();
-                        requestId = (_a = response.headers) === null || _a === void 0 ? void 0 : _a[exports.HeaderNames.X_MS_REQUEST_ID];
+                        response = _d.sent();
+                        requestId = (_b = response.headers) === null || _b === void 0 ? void 0 : _b[exports.HeaderNames.X_MS_REQUEST_ID];
+                        httpVerAuthority = (_c = response.headers) === null || _c === void 0 ? void 0 : _c[exports.HeaderNames.X_MS_HTTP_VERSION];
+                        if (httpVerAuthority) {
+                            atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.addStaticFields({
+                                httpVerAuthority: httpVerAuthority
+                            });
+                        }
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         // Validate response. This function throws a server error if an error is returned by the server.
                         responseHandler.validateTokenResponse(response.body);
-                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)];
-                    case 2: return [2 /*return*/, _b.sent()];
+                        return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId).then(function (result) {
+                                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                    success: true
+                                });
+                                return result;
+                            })
+                                .catch(function (error) {
+                                _this.logger.verbose("Error in fetching token in ACC", request.correlationId);
+                                atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                    errorCode: error.errorCode,
+                                    subErrorCode: error.subError,
+                                    success: false
+                                });
+                                throw error;
+                            })];
                 }
             });
         });
@@ -5984,6 +6014,11 @@ exports.PerformanceEvents = void 0;
      * Time taken for acquiring cached refresh token
      */
     PerformanceEvents["RefreshTokenClientAcquireTokenWithCachedRefreshToken"] = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
+    PerformanceEvents["GetEndpointMetadataFromNetwork"] = "getEndpointMetadataFromNetwork";
+    PerformanceEvents["GetCloudDiscoveryMetadataFromNetworkMeasurement"] = "getCloudDiscoveryMetadataFromNetworkMeasurement";
+    PerformanceEvents["HandleRedirectPromiseMeasurement"] = "handleRedirectPromiseMeasurement";
+    PerformanceEvents["UpdateCloudDiscoveryMetadataMeasurement"] = "updateCloudDiscoveryMetadataMeasurement";
+    PerformanceEvents["UsernamePasswordClientAcquireToken"] = "usernamePasswordClientAcquireToken";
 })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
 /**
  * State of the performance event.
@@ -6011,23 +6046,29 @@ var RefreshTokenClient = /** @class */ (function (_super) {
         return _super.call(this, configuration, performanceClient) || this;
     }
     RefreshTokenClient.prototype.acquireToken = function (request) {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function () {
-            var atsMeasurement, reqTimestamp, response, requestId, responseHandler;
+            var atsMeasurement, reqTimestamp, response, httpVerToken, requestId, responseHandler;
             var _this = this;
-            return __generator(this, function (_d) {
-                switch (_d.label) {
+            return __generator(this, function (_e) {
+                switch (_e.label) {
                     case 0:
                         atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
                         this.logger.verbose("RefreshTokenClientAcquireToken called", request.correlationId);
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
                     case 1:
-                        response = _d.sent();
+                        response = _e.sent();
+                        httpVerToken = (_b = response.headers) === null || _b === void 0 ? void 0 : _b[exports.HeaderNames.X_MS_HTTP_VERSION];
                         atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.addStaticFields({
-                            refreshTokenSize: ((_b = response.body.refresh_token) === null || _b === void 0 ? void 0 : _b.length) || 0
+                            refreshTokenSize: ((_c = response.body.refresh_token) === null || _c === void 0 ? void 0 : _c.length) || 0,
                         });
-                        requestId = (_c = response.headers) === null || _c === void 0 ? void 0 : _c[exports.HeaderNames.X_MS_REQUEST_ID];
+                        if (httpVerToken) {
+                            atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.addStaticFields({
+                                httpVerToken: httpVerToken,
+                            });
+                        }
+                        requestId = (_d = response.headers) === null || _d === void 0 ? void 0 : _d[exports.HeaderNames.X_MS_REQUEST_ID];
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         responseHandler.validateTokenResponse(response.body);
                         return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId).then(function (result) {
@@ -6820,16 +6861,22 @@ var UsernamePasswordClient = /** @class */ (function (_super) {
      * @param request
      */
     UsernamePasswordClient.prototype.acquireToken = function (request) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function () {
-            var reqTimestamp, response, responseHandler, tokenResponse;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var atsMeasurement, reqTimestamp, response, httpVerToken, responseHandler, tokenResponse;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
-                        this.logger.info("in acquireToken call");
+                        atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement("UsernamePasswordClientAcquireToken", request.correlationId);
+                        this.logger.info("in acquireToken call in username-password client");
                         reqTimestamp = TimeUtils.nowSeconds();
                         return [4 /*yield*/, this.executeTokenRequest(this.authority, request)];
                     case 1:
-                        response = _a.sent();
+                        response = _c.sent();
+                        httpVerToken = (_b = response.headers) === null || _b === void 0 ? void 0 : _b[exports.HeaderNames.X_MS_HTTP_VERSION];
+                        atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.addStaticFields({
+                            httpVerToken: httpVerToken
+                        });
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         // Validate response. This function throws a server error if an error is returned by the server.
                         responseHandler.validateTokenResponse(response.body);
@@ -7024,6 +7071,15 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function isCloudInstanceDiscoveryErrorResponse(response) {
+    return (response.hasOwnProperty("error") &&
+        response.hasOwnProperty("error_description"));
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7619,7 +7675,7 @@ var Authority = /** @class */ (function () {
                     case 1:
                         metadata = _a.sent();
                         if (metadata) {
-                            this.logger.verbose("Found cloud discovery metadata from the network.");
+                            this.logger.verbose("cloud discovery metadata was successfully returned from getCloudDiscoveryMetadataFromNetwork()");
                             metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
                             return [2 /*return*/, AuthorityMetadataSource.NETWORK];
                         }
@@ -7630,8 +7686,8 @@ var Authority = /** @class */ (function () {
                             metadataEntity.updateCloudDiscoveryMetadata(harcodedMetadata, false);
                             return [2 /*return*/, AuthorityMetadataSource.HARDCODED_VALUES];
                         }
-                        // Metadata could not be obtained from config, cache or network
-                        this.logger.verbose("Did not find cloud discovery metadata from hardcoded values... Metadata could not be obtained from config, cache, network or hardcoded value. Throwing Untrusted Authority Error.");
+                        // Metadata could not be obtained from the config, cache, network or hardcoded values
+                        this.logger.error("Did not find cloud discovery metadata from hardcoded values... Metadata could not be obtained from config, cache, network or hardcoded values. Throwing Untrusted Authority Error.");
                         throw ClientConfigurationError.createUntrustedAuthorityError();
                 }
             });
@@ -7676,7 +7732,7 @@ var Authority = /** @class */ (function () {
      */
     Authority.prototype.getCloudDiscoveryMetadataFromNetwork = function () {
         return __awaiter(this, void 0, void 0, function () {
-            var instanceDiscoveryEndpoint, options, match, response, metadata;
+            var instanceDiscoveryEndpoint, options, match, response, typedResponseBody, metadata, error_1, typedError;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -7692,21 +7748,47 @@ var Authority = /** @class */ (function () {
                         return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options)];
                     case 2:
                         response = _a.sent();
-                        metadata = isCloudInstanceDiscoveryResponse(response.body)
-                            ? response.body.metadata
-                            : [];
-                        if (metadata.length === 0) {
-                            // If no metadata is returned, authority is untrusted
+                        typedResponseBody = void 0;
+                        metadata = void 0;
+                        if (isCloudInstanceDiscoveryResponse(response.body)) {
+                            typedResponseBody = response.body;
+                            metadata = typedResponseBody.metadata;
+                            this.logger.verbosePii("tenant_discovery_endpoint is: " + typedResponseBody.tenant_discovery_endpoint);
+                        }
+                        else if (isCloudInstanceDiscoveryErrorResponse(response.body)) {
+                            this.logger.warning("A CloudInstanceDiscoveryErrorResponse was returned. The cloud instance discovery network request's status code is: " + response.status);
+                            typedResponseBody = response.body;
+                            if (typedResponseBody.error === Constants.INVALID_INSTANCE) {
+                                this.logger.error("The CloudInstanceDiscoveryErrorResponse error is invalid_instance.");
+                                return [2 /*return*/, null];
+                            }
+                            this.logger.warning("The CloudInstanceDiscoveryErrorResponse error is " + typedResponseBody.error);
+                            this.logger.warning("The CloudInstanceDiscoveryErrorResponse error description is " + typedResponseBody.error_description);
+                            this.logger.warning("Setting the value of the CloudInstanceDiscoveryMetadata (returned from the network) to []");
+                            metadata = [];
+                        }
+                        else {
+                            this.logger.error("AAD did not return a CloudInstanceDiscoveryResponse or CloudInstanceDiscoveryErrorResponse");
                             return [2 /*return*/, null];
                         }
+                        this.logger.verbose("Attempting to find a match between the developer's authority and the CloudInstanceDiscoveryMetadata returned from the network request.");
                         match = Authority.getCloudDiscoveryMetadataFromNetworkResponse(metadata, this.hostnameAndPort);
                         return [3 /*break*/, 4];
                     case 3:
-                        _a.sent();
+                        error_1 = _a.sent();
+                        if (error_1 instanceof AuthError) {
+                            this.logger.error("There was a network error while attempting to get the cloud discovery instance metadata.\nError: " + error_1.errorCode + "\nError Description: " + error_1.errorMessage);
+                        }
+                        else {
+                            typedError = error_1;
+                            this.logger.error("A non-MSALJS error was thrown while attempting to get the cloud instance discovery metadata.\nError: " + typedError.name + "\nError Description: " + typedError.message);
+                        }
                         return [2 /*return*/, null];
                     case 4:
+                        // Custom Domain scenario, host is trusted because Instance Discovery call succeeded
                         if (!match) {
-                            // Custom Domain scenario, host is trusted because Instance Discovery call succeeded
+                            this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the network request.");
+                            this.logger.verbose("Creating custom Authority for custom domain scenario.");
                             match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
                         }
                         return [2 /*return*/, match];
@@ -8309,7 +8391,7 @@ var PerformanceClient = /** @class */ (function () {
             this.logger.info("PerformanceClient: No correlation id provided for " + measureName + ", generating", eventCorrelationId);
         }
         this.logger.trace("PerformanceClient: Performance measurement started for " + measureName, eventCorrelationId);
-        var performanceMeasurement = this.startPerformanceMeasuremeant(measureName, eventCorrelationId);
+        var performanceMeasurement = this.startPerformanceMeasurement(measureName, eventCorrelationId);
         performanceMeasurement.startMeasurement();
         var inProgressEvent = {
             eventId: this.generateId(),
@@ -8582,7 +8664,7 @@ var StubPerformanceClient = /** @class */ (function (_super) {
     StubPerformanceClient.prototype.generateId = function () {
         return "callback-id";
     };
-    StubPerformanceClient.prototype.startPerformanceMeasuremeant = function () {
+    StubPerformanceClient.prototype.startPerformanceMeasurement = function () {
         return new StubPerformanceMeasurement();
     };
     return StubPerformanceClient;