@equinor/fusion-framework-module-msal 10.0.1 → 11.0.0-next.0

package/src/MsalConfigurator.ts

@@ -1,68 +1,23 @@
-import z from 'zod';
-import { BaseConfigBuilder } from '@equinor/fusion-framework-module';
-import semver from 'semver';
-import type { IMsalProvider } from './MsalProvider.interface';
 import {
-  TelemetryLevel,
-  type ITelemetryProvider,
-} from '@equinor/fusion-framework-module-telemetry';
+  BaseConfigBuilder,
+  type ConfigBuilderCallbackArgs,
+} from '@equinor/fusion-framework-module';
+import { TelemetryLevel } from '@equinor/fusion-framework-module-telemetry';
+import { CacheLookupPolicy, LogLevel } from '@azure/msal-browser';
+
+import type { ITelemetryProvider } from '@equinor/fusion-framework-module-telemetry';
+import type { IMsalProvider } from './MsalProvider.interface';
 import { MsalClient, type MsalClientConfig, type IMsalClient } from './MsalClient';
 import { createClientLogCallback } from './create-client-log-callback';
-import { CacheLookupPolicy, LogLevel } from '@azure/msal-browser';
 import { version } from './version';
+import { MsalConfigSchema, type MsalConfig } from './msal-config-schema';
 
-/**
- * Zod schema for telemetry configuration validation.
- *
- * @internal
- */
-const TelemetryConfigSchema = z.object({
-  provider: z.custom<ITelemetryProvider>().optional(),
-  metadata: z.record(z.string(), z.unknown()).optional().default({
-    module: 'msal',
-    version,
-  }),
-  scope: z.array(z.string()).optional().default(['framework', 'authentication']),
-});
-
-/**
- * Telemetry configuration for MSAL module.
- *
- * This configuration controls how authentication events are tracked and logged
- * through the framework's telemetry system.
- */
-export type TelemetryConfig = z.infer<typeof TelemetryConfigSchema>;
-
-/**
- * Zod schema for MSAL module configuration validation.
- *
- * @internal
- */
-const MsalConfigSchema = z.object({
-  client: z.custom<IMsalClient>().optional(),
-  provider: z.custom<IMsalProvider>().optional(),
-  requiresAuth: z.boolean().optional(),
-  redirectUri: z.string().optional(),
-  loginHint: z.string().optional(),
-  authCode: z.string().optional(),
-  cacheLookupPolicy: z
-    .custom<CacheLookupPolicy>(
-      (val) =>
-        typeof val === 'number' &&
-        Object.values(CacheLookupPolicy).includes(val as CacheLookupPolicy),
-    )
-    .optional(),
-  version: z.string().transform((x: string) => String(semver.coerce(x))),
-  telemetry: TelemetryConfigSchema,
-});
-
-/**
- * Complete configuration object for MSAL authentication module.
- *
- * This type represents the full configuration including client setup, authentication
- * requirements, telemetry, and version information.
- */
-export type MsalConfig = z.infer<typeof MsalConfigSchema>;
+export {
+  MsalConfigSchema,
+  type MsalConfig,
+  type MsalConfigExtension,
+} from './msal-config-schema';
+export { TelemetryConfigSchema, type TelemetryConfig } from './telemetry-config-schema';
 
 /**
  * Configuration builder for MSAL v4 authentication module.
@@ -79,11 +34,13 @@ export type MsalConfig = z.infer<typeof MsalConfigSchema>;
  */
 export class MsalConfigurator extends BaseConfigBuilder<MsalConfig> {
   #msalConfig?: MsalClientConfig;
+  #client?: IMsalClient;
 
   /**
    * The MSAL module version being configured.
    *
    * @default Latest
+   * @returns The configured MSAL module version.
    */
   public get version(): string {
     return version;
@@ -100,11 +57,15 @@ export class MsalConfigurator extends BaseConfigBuilder<MsalConfig> {
     this._set('version', async () => this.version);
     // Auto-detect and integrate telemetry module if available
     this._set('telemetry.provider', async (args) => {
+      // Only resolve the telemetry instance when the telemetry module is registered
       if (args.hasModule('telemetry')) {
         const telemetry = await args.requireInstance('telemetry');
         return telemetry;
       }
     });
+    // Always resolve the configured client instance through the builder.
+    // This keeps the client getter live and avoids re-registering the same config key.
+    this._set('client', async () => this.#client);
     // Default cache lookup policy to AccessTokenAndRefreshToken to avoid iframe fallback delays
     this._set('cacheLookupPolicy', async () => CacheLookupPolicy.AccessTokenAndRefreshToken);
   }
@@ -134,6 +95,23 @@ export class MsalConfigurator extends BaseConfigBuilder<MsalConfig> {
     return this;
   }
 
+  /**
+   * Returns the client configuration declared through
+   * {@link MsalConfigurator.setClientConfig | setClientConfig}, if any.
+   *
+   * @remarks
+   * This is the configuration as declared, not the resolved one a client is
+   * built from — see
+   * {@link MsalConfigurator._createClientConfig | _createClientConfig} for that.
+   * Reading it is how a subclass can tell "nothing was declared" apart from
+   * "declared, and here it is", without re-deriving that from a resolved value.
+   *
+   * @returns The declared client configuration, or `undefined` when none was declared.
+   */
+  public getClientConfig(): MsalClientConfig | undefined {
+    return this.#msalConfig;
+  }
+
   /**
    * Sets the cache lookup policy used for every silent token acquisition.
    *
@@ -272,10 +250,23 @@ export class MsalConfigurator extends BaseConfigBuilder<MsalConfig> {
    * ```
    */
   setClient(client: IMsalClient): this {
-    this._set('client', async () => client);
+    this.#client = client;
     return this;
   }
 
+  /**
+   * Returns the currently configured MSAL client, if one has been set.
+   *
+   * @remarks
+   * This is useful in tests when a mock client has been provided and the test
+   * wants to adjust its state after it has been assigned to the configurator.
+   *
+   * @returns The configured client, or `undefined` when none has been set.
+   */
+  public getClient(): IMsalClient | undefined {
+    return this.#client;
+  }
+
   /**
    * Sets telemetry provider for MSAL authentication events.
    *
@@ -326,72 +317,170 @@ export class MsalConfigurator extends BaseConfigBuilder<MsalConfig> {
   /**
    * Processes and validates the configuration.
    *
-   * @param config - Raw configuration object
+   * @param rawConfig - Raw configuration object
+   * @param init - The builder arguments, carrying the host reference when hoisted
    * @returns Processed and validated configuration
    */
-  async _processConfig(rawConfig: MsalConfig): Promise<MsalConfig> {
+  async _processConfig(
+    rawConfig: MsalConfig,
+    init?: ConfigBuilderCallbackArgs,
+  ): Promise<MsalConfig> {
     // Validate and coerce configuration using Zod schema
     const config = await MsalConfigSchema.parseAsync(rawConfig);
 
-    // Auto-create client if config provided but no client instance
+    // Auto-create client if no client instance was supplied
     // This allows users to provide configuration without manually instantiating the client
-    if (!config.client && !!this.#msalConfig) {
-      const clientConfig = this.#msalConfig;
+    // A hoisted module authenticates through the host's provider, so any client built here
+    // would be discarded — gate it here rather than in `_createClient`, so a substituted
+    // client (see `MsalMockConfigurator`) cannot shadow the host's signed-in user
+    if (!config.client && !this._isHoisted(init)) {
+      config.client = await this._createClient(config, init);
+    }
 
-      config.telemetry.provider?.trackEvent({
-        name: 'module-msal.configurator._processConfig.creating-client',
-        level: TelemetryLevel.Debug,
-        scope: config.telemetry.scope,
-        metadata: { ...config.telemetry.metadata, clientConfig },
-      });
+    return config;
+  }
 
-      // Auto-generate authority URL from tenant ID if not explicitly provided
-      // This simplifies configuration for most common cases
-      if (!clientConfig.auth.authority && clientConfig.auth.tenantId) {
-        clientConfig.auth.authority = `https://login.microsoftonline.com/${clientConfig.auth.tenantId}`;
-      }
+  /**
+   * Creates the client to authenticate through, when none was supplied.
+   *
+   * @remarks
+   * Called by {@link MsalConfigurator._processConfig | _processConfig} only when
+   * no client was set, so a client supplied through
+   * {@link MsalConfigurator.setClient | setClient} always wins. It is likewise
+   * not called when the module is hoisted onto a host application's provider —
+   * see {@link MsalConfigurator._isHoisted | _isHoisted}.
+   *
+   * This is the seam for authenticating through something other than Entra ID.
+   * Overriding it replaces only the client, leaving the builder, the schema
+   * validation and `MsalProvider` untouched — which is how
+   * `MsalMockConfigurator` substitutes an in-process client for tests.
+   *
+   * An override normally builds from
+   * {@link MsalConfigurator._createClientConfig | _createClientConfig}, so it
+   * receives the same fully-resolved {@link MsalClientConfig} the real client is
+   * built from rather than re-deriving it.
+   *
+   * Returning `undefined` is legitimate and means "there is nothing to build a
+   * client from", which leaves the module without one.
+   *
+   * @param config - The validated configuration the client is built from.
+   * @param init - The builder arguments, carrying the host reference when hoisted.
+   * @returns The client, or `undefined` when there is nothing to build one from.
+   */
+  protected async _createClient(
+    config: MsalConfig,
+    _init?: ConfigBuilderCallbackArgs,
+  ): Promise<IMsalClient | undefined> {
+    const clientConfig = this._createClientConfig(config);
+    // A client can be omitted for a hoisted module or an intentionally incomplete setup.
+    if (!clientConfig) {
+      return undefined;
+    }
 
-      // Set default cache location to localStorage for browser environments
-      // MSAL supports sessionStorage as well, but localStorage is the standard for persistent auth
-      if (!clientConfig.cache) {
-        clientConfig.cache = { cacheLocation: 'localStorage' };
-      }
+    // Instantiate MSAL client with fully configured options
+    return new MsalClient(clientConfig);
+  }
 
-      // Integrate framework telemetry with MSAL logging system
-      // This allows MSAL events to flow through the framework's telemetry pipeline
-      if (!clientConfig.system?.loggerOptions && config.telemetry?.provider) {
-        const { provider, metadata, scope } = config.telemetry;
-
-        provider.trackEvent({
-          name: 'module-msal.configurator._processConfig.client-telemetry-connected',
-          level: TelemetryLevel.Debug,
-          scope,
-          metadata,
-        });
-
-        clientConfig.system = {
-          ...clientConfig.system,
-          loggerOptions: {
-            // Only log PII in development to protect user privacy in production
-            piiLoggingEnabled: process.env.NODE_ENV === 'development',
-            // Bridge MSAL log events to framework telemetry system
-            loggerCallback: createClientLogCallback(provider, metadata, [...scope, '3rd-party']),
-            // Use Warning level by default - captures errors and warnings without being verbose
-            logLevel: LogLevel.Warning,
-            // Preserve any user-provided logger options (allows customization)
-            ...clientConfig.system?.loggerOptions,
-          },
-        };
-      }
-      // Apply silent cache lookup policy if configured
-      if (config.cacheLookupPolicy !== undefined) {
-        clientConfig.cacheLookupPolicy = config.cacheLookupPolicy;
-      }
+  /**
+   * Whether this module is hoisted onto a host application's authentication.
+   *
+   * @remarks
+   * When an application runs inside a host — a portal loading an app, or an app
+   * loading a widget — the module initializer returns a proxy of the host's
+   * provider instead of building its own (see the host-provider branch of the
+   * module initializer). A client built during configuration would therefore be
+   * constructed and immediately discarded.
+   *
+   * Detecting this during configuration lets the configurator skip building a
+   * client entirely, which matters most for substituted clients: a mock client
+   * built here would otherwise silently shadow the host's real signed-in user.
+   *
+   * @param init - The builder arguments, carrying the host reference when hoisted.
+   * @returns `true` when a host provider will be used instead of a locally built client.
+   */
+  protected _isHoisted(init?: ConfigBuilderCallbackArgs): boolean {
+    return !!(init?.ref as { auth?: IMsalProvider } | undefined)?.auth;
+  }
 
-      // Instantiate MSAL client with fully configured options
-      config.client = new MsalClient(clientConfig);
+  /**
+   * Resolves the full MSAL client configuration to build a client from.
+   *
+   * @remarks
+   * Applies the defaults a client is expected to be built with — authority
+   * derived from the tenant, cache location, telemetry-backed logging and the
+   * configured cache lookup policy.
+   *
+   * Kept separate from {@link MsalConfigurator._createClient | _createClient} so
+   * that substituting the client does not also mean re-implementing this
+   * resolution. `MsalMockConfigurator` relies on it to hand its mock client the
+   * very same configuration the real client would have received.
+   *
+   * @param config - The validated configuration.
+   * @returns The client configuration, or `undefined` when none was declared.
+   */
+  protected _createClientConfig(config: MsalConfig): MsalClientConfig | undefined {
+    const declared = this.#msalConfig;
+    // Do not construct a client when configuration has not supplied client settings.
+    if (!declared) {
+      return undefined;
     }
 
-    return config;
+    config.telemetry.provider?.trackEvent({
+      name: 'module-msal.configurator._processConfig.creating-client',
+      level: TelemetryLevel.Debug,
+      scope: config.telemetry.scope,
+      metadata: { ...config.telemetry.metadata, clientConfig: declared },
+    });
+
+    // Copied rather than enriched in place, so the object a caller passed to
+    // `setClientConfig` is never rewritten behind its back — a caller may well
+    // be reusing or asserting on it
+    const clientConfig: MsalClientConfig = {
+      ...declared,
+      auth: { ...declared.auth },
+      // Default to localStorage: MSAL supports sessionStorage too, but
+      // localStorage is the standard for persistent auth in browsers
+      cache: declared.cache ?? { cacheLocation: 'localStorage' },
+    };
+
+    // Auto-generate authority URL from tenant ID if not explicitly provided
+    // This simplifies configuration for most common cases
+    if (!clientConfig.auth.authority && clientConfig.auth.tenantId) {
+      clientConfig.auth.authority = `https://login.microsoftonline.com/${clientConfig.auth.tenantId}`;
+    }
+
+    // Integrate framework telemetry with MSAL logging system
+    // This allows MSAL events to flow through the framework's telemetry pipeline
+    if (!clientConfig.system?.loggerOptions && config.telemetry?.provider) {
+      const { provider, metadata, scope } = config.telemetry;
+
+      provider.trackEvent({
+        name: 'module-msal.configurator._processConfig.client-telemetry-connected',
+        level: TelemetryLevel.Debug,
+        scope,
+        metadata,
+      });
+
+      clientConfig.system = {
+        ...clientConfig.system,
+        loggerOptions: {
+          // Only log PII in development to protect user privacy in production
+          piiLoggingEnabled: process.env.NODE_ENV === 'development',
+          // Bridge MSAL log events to framework telemetry system
+          loggerCallback: createClientLogCallback(provider, metadata, [...scope, '3rd-party']),
+          // Use Warning level by default - captures errors and warnings without being verbose
+          logLevel: LogLevel.Warning,
+          // Preserve any user-provided logger options (allows customization)
+          ...clientConfig.system?.loggerOptions,
+        },
+      };
+    }
+
+    // Apply silent cache lookup policy if configured
+    if (config.cacheLookupPolicy !== undefined) {
+      clientConfig.cacheLookupPolicy = config.cacheLookupPolicy;
+    }
+
+    return clientConfig;
   }
 }

package/src/MsalProvider.ts

@@ -67,6 +67,8 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
    * Default OAuth scopes used when the caller provides no scopes.
    *
    * Resolves to the app's Entra ID configured permissions via the `/.default` scope.
+   *
+   * @returns The default OAuth scopes derived from the configured client ID.
    */
   get defaultScopes(): string[] {
     const clientId = this.#client.clientId;
@@ -91,6 +93,8 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
    *
    * Provides access to the underlying MSAL PublicClientApplication for advanced use cases.
    * Prefer using provider methods for standard authentication operations.
+   *
+   * @returns The underlying MSAL client instance.
    */
   get client(): IMsalClient {
     return this.#client;
@@ -101,6 +105,8 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
    *
    * Returns the active account if a user is authenticated, or null if no user is logged in.
    * This is a shorthand for `client.getActiveAccount()`.
+   *
+   * @returns The currently authenticated account, or `null` if no user is logged in.
    */
   get account(): AccountInfo | null {
     return this.#client.getActiveAccount();
@@ -175,6 +181,8 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
    *
    * The provider will attempt automatic login with empty scopes if requiresAuth is true.
    * Apps should call acquireToken with actual scopes after initialization completes.
+   *
+   * @throws {Error} If auth code exchange requires a client ID but none is configured.
    */
   async initialize(): Promise<void> {
     // Guard: skip authentication when running inside MSAL's hidden iframe.
@@ -204,6 +212,7 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
         // Use MSAL's acquireTokenByCode to exchange backend auth code for tokens
         // This follows Microsoft's standard SPA Auth Code Flow pattern
         const clientId = this.#client.clientId;
+        // A client ID is required to build the default scope used for the auth code exchange
         if (!clientId) {
           throw new Error('Client ID is required for auth code exchange');
         }
@@ -248,6 +257,7 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
       // Priority 1: Check if returning from redirect-based authentication
       // This handles cases where user just completed a login/acquireToken via redirect
       const handleRedirectResult = await this.handleRedirect();
+      // A returned account means the user just completed a redirect-based login
       if (handleRedirectResult?.account) {
         // Successfully authenticated via redirect - set as active account
         // This means the user was redirected to Microsoft and came back authenticated
@@ -263,6 +273,7 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
         // Note: Using default scopes here as we don't know what scopes the app needs yet
         // App should call acquireToken with actual scopes after initialization
         const loginResult = await this.login({ request: { scopes: this.defaultScopes } });
+        // Only set the active account when the automatic login actually returned one
         if (loginResult?.account) {
           // Automatic login successful - set as active account
           this.#client.setActiveAccount(loginResult.account);
@@ -315,6 +326,8 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
    * @remark Empty scopes are currently tracked as telemetry exceptions but execution continues for monitoring purposes.
    * This behavior will be changed to throw exceptions once sufficient metrics are collected.
    *
+   * @throws {Error} Re-throws any error encountered during token acquisition after tracking it via telemetry.
+   *
    * @example
    * ```typescript
    * // Modern API format
@@ -371,6 +384,7 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
 
     // Handle empty scopes - currently monitoring for telemetry, will throw in future
     if (candidateScopes.length === 0) {
+      // Fall back to the client-id-derived default scope when one is available
       if (defaultScopes.length > 0) {
         this._trackEvent('acquireToken.missing-scope.defaulted', TelemetryLevel.Warning, {
           properties: { ...telemetryProperties, defaultScopes },
@@ -383,7 +397,7 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
           exception,
           properties: telemetryProperties,
         });
-        // TODO: throw exception when sufficient metrics are collected
+        // TODO(#5113): throw exception when sufficient metrics are collected
         // This allows us to monitor how often empty scopes are provided before enforcing validation
       }
     }
@@ -521,6 +535,7 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
       }
     }
 
+    // Perform interactive authentication based on specified behavior
     switch (behavior) {
       case 'popup':
         return await this.#client.loginPopup(request);
@@ -606,6 +621,7 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
   async handleRedirect(): Promise<AuthenticationResult | null> {
     // Process any pending redirect from authentication flow
     const result = await this.client.handleRedirectPromise();
+    // Only track/log when a redirect result is actually returned
     if (result) {
       // Track successful redirect completion for monitoring
       this._trackEvent('handleRedirect.success', TelemetryLevel.Information, {
@@ -632,6 +648,9 @@ export class MsalProvider extends BaseModuleProvider<MsalConfig> implements IMsa
    * - Version compatibility is tracked via telemetry
    * - Throws error if unsupported version is requested
    *
+   * @template T - The provider interface type expected by the target version.
+   * @throws {Error} If the requested version cannot be resolved or the proxy fails to create.
+   *
    * @example
    * ```typescript
    * // Create v2-compatible proxy

package/src/__tests__/MsalConfigurator.test.ts

@@ -20,6 +20,23 @@ const createInitialConfig = (): Pick<MsalConfig, 'telemetry'> => ({
 });
 
 describe('MsalConfigurator', () => {
+  it('enriches a copy, leaving the declared client configuration untouched', async () => {
+    // A caller may reuse or assert on the object it passed, and the defaults
+    // applied here are derived — rewriting it behind their back is not ours to do
+    const declared = { auth: { clientId: 'my-app', tenantId: 'my-tenant' } };
+    const configurator = new MsalConfigurator();
+
+    configurator.setClientConfig(declared);
+
+    const config = await configurator.createConfigAsync(
+      createConfigCallbackArgs(),
+      createInitialConfig(),
+    );
+
+    expect(declared).toEqual({ auth: { clientId: 'my-app', tenantId: 'my-tenant' } });
+    expect(config.client?.tenantId).toBe('my-tenant');
+  });
+
   it('setAuthCode should normalize surrounding whitespace', async () => {
     const configurator = new MsalConfigurator();
 
@@ -74,6 +91,95 @@ describe('MsalConfigurator', () => {
     expect(config.client).toBeUndefined();
   });
 
+  describe('_createClient', () => {
+    it('builds from the same resolved client config the real client would get', async () => {
+      // The mock relies on this: substituting the client must not also mean
+      // re-implementing authority, cache and telemetry resolution
+      const received: unknown[] = [];
+      class CustomConfigurator extends MsalConfigurator {
+        protected override async _createClient(config: MsalConfig): Promise<IMsalClient> {
+          received.push(this._createClientConfig(config));
+          return createClient();
+        }
+      }
+
+      const configurator = new CustomConfigurator();
+      configurator.setClientConfig({ auth: { clientId: 'client-id', tenantId: 'tenant-id' } });
+
+      await configurator.createConfigAsync(createConfigCallbackArgs(), createInitialConfig());
+
+      expect(received).toEqual([
+        expect.objectContaining({
+          auth: expect.objectContaining({
+            clientId: 'client-id',
+            // derived by the configurator, not by the caller
+            authority: 'https://login.microsoftonline.com/tenant-id',
+          }),
+          cache: { cacheLocation: 'localStorage' },
+        }),
+      ]);
+    });
+
+    it('supplies the client when none was set', async () => {
+      const client = createClient();
+      class CustomConfigurator extends MsalConfigurator {
+        protected override async _createClient(): Promise<IMsalClient> {
+          return client;
+        }
+      }
+
+      const config = await new CustomConfigurator().createConfigAsync(
+        createConfigCallbackArgs(),
+        createInitialConfig(),
+      );
+
+      expect(config.client).toBe(client);
+    });
+
+    it('is not consulted when a client was set, so setClient always wins', async () => {
+      const own = createClient();
+      const createOther = vi.fn().mockResolvedValue(createClient());
+      class CustomConfigurator extends MsalConfigurator {
+        protected override _createClient(): Promise<IMsalClient> {
+          return createOther();
+        }
+      }
+
+      const configurator = new CustomConfigurator();
+      configurator.setClient(own);
+
+      const config = await configurator.createConfigAsync(
+        createConfigCallbackArgs(),
+        createInitialConfig(),
+      );
+
+      expect(config.client).toBe(own);
+      expect(createOther).not.toHaveBeenCalled();
+    });
+
+    it('is not consulted when hoisted, so a host provider is never shadowed', async () => {
+      // A hoisted module authenticates through the host's provider, so anything
+      // built here would be discarded — or worse, shadow the host's user
+      const createOther = vi.fn().mockResolvedValue(createClient());
+      class CustomConfigurator extends MsalConfigurator {
+        protected override _createClient(): Promise<IMsalClient> {
+          return createOther();
+        }
+      }
+
+      const configurator = new CustomConfigurator();
+      configurator.setClientConfig({ auth: { clientId: 'client-id', tenantId: 'tenant-id' } });
+
+      const config = await configurator.createConfigAsync(
+        { ...createConfigCallbackArgs(), ref: { auth: {} } },
+        createInitialConfig(),
+      );
+
+      expect(config.client).toBeUndefined();
+      expect(createOther).not.toHaveBeenCalled();
+    });
+  });
+
   describe('cacheLookupPolicy', () => {
     it('defaults to CacheLookupPolicy.AccessTokenAndRefreshToken', async () => {
       const configurator = new MsalConfigurator();