plugin-data-source-mssql 2.0.3 → 2.0.4

package/dist/tedious/node_modules/@azure/msal-common/src/request/CommonSilentFlowRequest.ts

@@ -8,23 +8,22 @@ import { BaseAuthRequest } from "./BaseAuthRequest.js";
 
 /**
  * SilentFlow parameters passed by the user to retrieve credentials silently
- * - scopes                 - Array of scopes the application is requesting access to.
- * - claims                 - A stringified claims request which will be added to all /authorize and /token calls. When included on a silent request, cache lookup will be skipped and token will be refreshed.
- * - authority              - Url of the authority which the application acquires tokens from.
- * - correlationId          - Unique GUID set per request to trace a request end-to-end for telemetry purposes.
- * - account                - Account entity to lookup the credentials.
- * - forceRefresh           - Forces silent requests to make network calls if true.
- * - resourceRequestMethod  - HTTP Request type used to request data from the resource (i.e. "GET", "POST", etc.).  Used for proof-of-possession flows.
- * - resourceRequestUri     - URI that token will be used for. Used for proof-of-possession flows.
- * - tokenQueryParameters   - String to string map of custom query parameters added to the /token call
  */
 export type CommonSilentFlowRequest = BaseAuthRequest & {
-    /** Account object to lookup the credentials */
+    /**
+     * Account object to lookup the credentials
+     */
     account: AccountInfo;
-    /** Skip cache lookup and forces network call(s) to get fresh tokens */
+    /**
+     * Skip cache lookup and forces network call(s) to get fresh tokens
+     */
     forceRefresh: boolean;
-    /** RedirectUri registered on the app registration - only required in brokering scenarios */
+    /**
+     * RedirectUri registered on the app registration - only required in brokering scenarios
+     */
     redirectUri?: string;
-    /** If refresh token will expire within the configured value, consider it already expired. Used to pre-emptively invoke interaction when cached refresh token is close to expiry. */
+    /**
+     * If refresh token will expire within the configured value, consider it already expired. Used to pre-emptively invoke interaction when cached refresh token is close to expiry.
+     */
     refreshTokenExpirationOffsetSeconds?: number;
 };

package/dist/tedious/node_modules/@azure/msal-common/src/request/NativeRequest.ts

@@ -18,6 +18,7 @@ export type NativeRequest = {
     shrNonce?: string;
     accountId?: string;
     forceRefresh?: boolean;
+    resource?: string;
     extraParameters?: StringDict;
     extraScopesToConsent?: Array<string>;
     loginHint?: string;

package/dist/tedious/node_modules/@azure/msal-common/src/request/RequestParameterBuilder.ts

@@ -3,17 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import {
-    ResponseMode,
-    CLIENT_INFO,
-    AuthenticationScheme,
-    ClaimsRequestKeys,
-    PasswordGrantConstants,
-    OIDC_DEFAULT_SCOPES,
-    ThrottlingConstants,
-    HeaderNames,
-    OAuthResponseType,
-} from "../utils/Constants.js";
+import * as Constants from "../utils/Constants.js";
 import * as AADServerParamKeys from "../constants/AADServerParamKeys.js";
 import { ScopeSet } from "./ScopeSet.js";
 import {
@@ -59,7 +49,7 @@ export function instrumentBrokerParams(
  */
 export function addResponseType(
     parameters: Map<string, string>,
-    responseType: OAuthResponseType
+    responseType: Constants.OAuthResponseType
 ): void {
     parameters.set(AADServerParamKeys.RESPONSE_TYPE, responseType);
 }
@@ -70,11 +60,11 @@ export function addResponseType(
  */
 export function addResponseMode(
     parameters: Map<string, string>,
-    responseMode?: ResponseMode
+    responseMode?: Constants.ResponseMode
 ): void {
     parameters.set(
         AADServerParamKeys.RESPONSE_MODE,
-        responseMode ? responseMode : ResponseMode.QUERY
+        responseMode ? responseMode : Constants.ResponseMode.QUERY
     );
 }
 
@@ -94,7 +84,7 @@ export function addScopes(
     parameters: Map<string, string>,
     scopes: string[],
     addOidcScopes: boolean = true,
-    defaultScopes: Array<string> = OIDC_DEFAULT_SCOPES
+    defaultScopes: Array<string> = Constants.OIDC_DEFAULT_SCOPES
 ): void {
     // Always add openid to the scopes when adding OIDC scopes
     if (
@@ -185,7 +175,7 @@ export function addCcsUpn(
     parameters: Map<string, string>,
     loginHint: string
 ): void {
-    parameters.set(HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
+    parameters.set(Constants.HeaderNames.CCS_HEADER, `UPN:${loginHint}`);
 }
 
 /**
@@ -197,7 +187,7 @@ export function addCcsOid(
     clientInfo: ClientInfo
 ): void {
     parameters.set(
-        HeaderNames.CCS_HEADER,
+        Constants.HeaderNames.CCS_HEADER,
         `Oid:${clientInfo.uid}@${clientInfo.utid}`
     );
 }
@@ -455,7 +445,14 @@ export function addGrantType(
  *
  */
 export function addClientInfo(parameters: Map<string, string>): void {
-    parameters.set(CLIENT_INFO, "1");
+    parameters.set(Constants.CLIENT_INFO, "1");
+}
+
+/**
+ * add clidata=1 to request to indicate client data support
+ */
+export function addCliData(parameters: Map<string, string>): void {
+    parameters.set(AADServerParamKeys.CLI_DATA, "1");
 }
 
 export function addInstanceAware(parameters: Map<string, string>): void {
@@ -465,14 +462,14 @@ export function addInstanceAware(parameters: Map<string, string>): void {
 }
 
 /**
- * add extraQueryParams
- * @param eQParams
+ * Add extraParameters
+ * @param extraParams - String dictionary containing extra parameters to be added.
  */
-export function addExtraQueryParameters(
+export function addExtraParameters(
     parameters: Map<string, string>,
-    eQParams: StringDict
+    extraParams: StringDict
 ): void {
-    Object.entries(eQParams).forEach(([key, value]) => {
+    Object.entries(extraParams).forEach(([key, value]) => {
         if (!parameters.has(key) && value) {
             parameters.set(key, value);
         }
@@ -499,16 +496,21 @@ export function addClientCapabilitiesToClaims(
     }
 
     if (clientCapabilities && clientCapabilities.length > 0) {
-        if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+        if (
+            !mergedClaims.hasOwnProperty(
+                Constants.ClaimsRequestKeys.ACCESS_TOKEN
+            )
+        ) {
             // Add access_token key to claims object
-            mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
+            mergedClaims[Constants.ClaimsRequestKeys.ACCESS_TOKEN] = {};
         }
 
         // Add xms_cc claim with provided clientCapabilities to access_token key
-        mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN][ClaimsRequestKeys.XMS_CC] =
-            {
-                values: clientCapabilities,
-            };
+        mergedClaims[Constants.ClaimsRequestKeys.ACCESS_TOKEN][
+            Constants.ClaimsRequestKeys.XMS_CC
+        ] = {
+            values: clientCapabilities,
+        };
     }
 
     return JSON.stringify(mergedClaims);
@@ -522,7 +524,7 @@ export function addUsername(
     parameters: Map<string, string>,
     username: string
 ): void {
-    parameters.set(PasswordGrantConstants.username, username);
+    parameters.set(Constants.PasswordGrantConstants.username, username);
 }
 
 /**
@@ -533,7 +535,7 @@ export function addPassword(
     parameters: Map<string, string>,
     password: string
 ): void {
-    parameters.set(PasswordGrantConstants.password, password);
+    parameters.set(Constants.PasswordGrantConstants.password, password);
 }
 
 /**
@@ -545,7 +547,10 @@ export function addPopToken(
     cnfString: string
 ): void {
     if (cnfString) {
-        parameters.set(AADServerParamKeys.TOKEN_TYPE, AuthenticationScheme.POP);
+        parameters.set(
+            AADServerParamKeys.TOKEN_TYPE,
+            Constants.AuthenticationScheme.POP
+        );
         parameters.set(AADServerParamKeys.REQ_CNF, cnfString);
     }
 }
@@ -558,7 +563,10 @@ export function addSshJwk(
     sshJwkString: string
 ): void {
     if (sshJwkString) {
-        parameters.set(AADServerParamKeys.TOKEN_TYPE, AuthenticationScheme.SSH);
+        parameters.set(
+            AADServerParamKeys.TOKEN_TYPE,
+            Constants.AuthenticationScheme.SSH
+        );
         parameters.set(AADServerParamKeys.REQ_CNF, sshJwkString);
     }
 }
@@ -587,7 +595,7 @@ export function addServerTelemetry(
 export function addThrottling(parameters: Map<string, string>): void {
     parameters.set(
         AADServerParamKeys.X_MS_LIB_CAPABILITY,
-        ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE
+        Constants.X_MS_LIB_CAPABILITY_VALUE
     );
 }
 
@@ -633,18 +641,11 @@ export function addEARParameters(
     parameters.set(AADServerParamKeys.EAR_JWE_CRYPTO, jweCryptoB64Encoded);
 }
 
-/**
- * Adds authorize body parameters to the request parameters
- * @param parameters
- * @param bodyParameters
- */
-export function addPostBodyParameters(
+export function addResource(
     parameters: Map<string, string>,
-    bodyParameters: StringDict
+    resource?: string
 ): void {
-    Object.entries(bodyParameters).forEach(([key, value]) => {
-        if (value) {
-            parameters.set(key, value);
-        }
-    });
+    if (resource) {
+        parameters.set(AADServerParamKeys.RESOURCE, resource);
+    }
 }

package/dist/tedious/node_modules/@azure/msal-common/src/request/ScopeSet.ts

@@ -13,9 +13,9 @@ import {
     createClientAuthError,
 } from "../error/ClientAuthError.js";
 import {
-    Constants,
     OIDC_SCOPES,
     OIDC_DEFAULT_SCOPES,
+    OFFLINE_ACCESS_SCOPE,
 } from "../utils/Constants.js";
 
 /**
@@ -54,7 +54,7 @@ export class ScopeSet {
      * @param scopesRequired
      */
     static fromString(inputScopeString: string): ScopeSet {
-        const scopeString = inputScopeString || Constants.EMPTY_STRING;
+        const scopeString = inputScopeString || "";
         const inputScopes: Array<string> = scopeString.split(" ");
         return new ScopeSet(inputScopes);
     }
@@ -75,7 +75,7 @@ export class ScopeSet {
         if (!scopeSet.containsOnlyOIDCScopes()) {
             scopeSet.removeOIDCScopes();
         } else {
-            scopeSet.removeScope(Constants.OFFLINE_ACCESS_SCOPE);
+            scopeSet.removeScope(OFFLINE_ACCESS_SCOPE);
         }
 
         return scopeSet;
@@ -234,7 +234,7 @@ export class ScopeSet {
             const scopeArr = this.asArray();
             return scopeArr.join(" ");
         }
-        return Constants.EMPTY_STRING;
+        return "";
     }
 
     /**

package/dist/tedious/node_modules/@azure/msal-common/src/response/AuthenticationResult.ts

@@ -43,5 +43,6 @@ export type AuthenticationResult = {
     cloudGraphHostName?: string;
     msGraphHost?: string;
     code?: string;
-    fromNativeBroker?: boolean;
+    fromPlatformBroker?: boolean;
+    resource?: string;
 };

package/dist/tedious/node_modules/@azure/msal-common/src/response/AuthorizeResponse.ts

@@ -77,4 +77,11 @@ export type AuthorizeResponse = {
      * AccountId for the user, returned when platform broker is available to use
      */
     accountId?: string;
+    /**
+     * Client data returned by the server when clidata=1 is sent on the request.
+     * On the wire, this is sent as a URL-encoded string in the format:
+     *   account_type|error|sub_error|cloud_instance|caller_data_boundary
+     * In this parsed AuthorizeResponse object, the value is already URL-decoded.
+     */
+    clientdata?: string;
 };

package/dist/tedious/node_modules/@azure/msal-common/src/response/ResponseHandler.ts

@@ -24,13 +24,8 @@ import {
 } from "../error/InteractionRequiredAuthError.js";
 import { CacheRecord } from "../cache/entities/CacheRecord.js";
 import { CacheManager } from "../cache/CacheManager.js";
-import { ProtocolUtils, RequestStateObject } from "../utils/ProtocolUtils.js";
-import {
-    AuthenticationScheme,
-    Constants,
-    THE_FAMILY_ID,
-    HttpStatus,
-} from "../utils/Constants.js";
+import * as ProtocolUtils from "../utils/ProtocolUtils.js";
+import * as Constants from "../utils/Constants.js";
 import { PopTokenGenerator } from "../crypto/PopTokenGenerator.js";
 import { AppMetadataEntity } from "../cache/entities/AppMetadataEntity.js";
 import { ICachePlugin } from "../cache/interface/ICachePlugin.js";
@@ -38,8 +33,6 @@ import { TokenCacheContext } from "../cache/persistence/TokenCacheContext.js";
 import { ISerializableTokenCache } from "../cache/interface/ISerializableTokenCache.js";
 import { AuthorizationCodePayload } from "./AuthorizationCodePayload.js";
 import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
-import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
-import { PerformanceEvents } from "../telemetry/performance/PerformanceEvent.js";
 import {
     checkMaxAge,
     extractTokenClaims,
@@ -56,6 +49,9 @@ import {
 } from "../account/AccountInfo.js";
 import * as CacheHelpers from "../cache/utils/CacheHelpers.js";
 import * as TimeUtils from "../utils/TimeUtils.js";
+import * as AccountEntityUtils from "../cache/utils/AccountEntityUtils.js";
+import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
+import { RequestStateObject } from "../utils/StateTypes.js";
 
 /**
  * Class that handles response parsing.
@@ -67,35 +63,37 @@ export class ResponseHandler {
     private cryptoObj: ICrypto;
     private logger: Logger;
     private homeAccountIdentifier: string;
+    private performanceClient: IPerformanceClient;
     private serializableCache: ISerializableTokenCache | null;
     private persistencePlugin: ICachePlugin | null;
-    private performanceClient?: IPerformanceClient;
 
     constructor(
         clientId: string,
         cacheStorage: CacheManager,
         cryptoObj: ICrypto,
         logger: Logger,
+        performanceClient: IPerformanceClient,
         serializableCache: ISerializableTokenCache | null,
-        persistencePlugin: ICachePlugin | null,
-        performanceClient?: IPerformanceClient
+        persistencePlugin: ICachePlugin | null
     ) {
         this.clientId = clientId;
         this.cacheStorage = cacheStorage;
         this.cryptoObj = cryptoObj;
         this.logger = logger;
+        this.performanceClient = performanceClient;
         this.serializableCache = serializableCache;
         this.persistencePlugin = persistencePlugin;
-        this.performanceClient = performanceClient;
     }
 
     /**
      * Function which validates server authorization token response.
      * @param serverResponse
+     * @param correlationId
      * @param refreshAccessToken
      */
     validateTokenResponse(
         serverResponse: ServerAuthorizationTokenResponse,
+        correlationId: string,
         refreshAccessToken?: boolean
     ): void {
         // Check for error
@@ -130,11 +128,13 @@ export class ResponseHandler {
             if (
                 refreshAccessToken &&
                 serverResponse.status &&
-                serverResponse.status >= HttpStatus.SERVER_ERROR_RANGE_START &&
-                serverResponse.status <= HttpStatus.SERVER_ERROR_RANGE_END
+                serverResponse.status >=
+                    Constants.HTTP_SERVER_ERROR_RANGE_START &&
+                serverResponse.status <= Constants.HTTP_SERVER_ERROR_RANGE_END
             ) {
                 this.logger.warning(
-                    `executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed.\n${serverError}`
+                    `executeTokenRequest:validateTokenResponse - AAD is currently unavailable and the access token is unable to be refreshed.\n${serverError}`,
+                    correlationId
                 );
 
                 // don't throw an exception, but alert the user via a log that the token was unable to be refreshed
@@ -143,11 +143,13 @@ export class ResponseHandler {
             } else if (
                 refreshAccessToken &&
                 serverResponse.status &&
-                serverResponse.status >= HttpStatus.CLIENT_ERROR_RANGE_START &&
-                serverResponse.status <= HttpStatus.CLIENT_ERROR_RANGE_END
+                serverResponse.status >=
+                    Constants.HTTP_CLIENT_ERROR_RANGE_START &&
+                serverResponse.status <= Constants.HTTP_CLIENT_ERROR_RANGE_END
             ) {
                 this.logger.warning(
-                    `executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token.\n${serverError}`
+                    `executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token.\n${serverError}`,
+                    correlationId
                 );
 
                 // don't throw an exception, but alert the user via a log that the token was unable to be refreshed
@@ -165,10 +167,10 @@ export class ResponseHandler {
                     serverResponse.error,
                     serverResponse.error_description,
                     serverResponse.suberror,
-                    serverResponse.timestamp || Constants.EMPTY_STRING,
-                    serverResponse.trace_id || Constants.EMPTY_STRING,
-                    serverResponse.correlation_id || Constants.EMPTY_STRING,
-                    serverResponse.claims || Constants.EMPTY_STRING,
+                    serverResponse.timestamp || "",
+                    serverResponse.trace_id || "",
+                    serverResponse.correlation_id || "",
+                    serverResponse.claims || "",
                     serverErrorNo
                 );
             }
@@ -194,16 +196,11 @@ export class ResponseHandler {
         forceCacheRefreshTokenResponse?: boolean,
         serverRequestId?: string
     ): Promise<AuthenticationResult> {
-        this.performanceClient?.addQueueMeasurement(
-            PerformanceEvents.HandleServerTokenResponse,
-            serverTokenResponse.correlation_id
-        );
-
         // create an idToken object (not entity)
         let idTokenClaims: TokenClaims | undefined;
         if (serverTokenResponse.id_token) {
             idTokenClaims = extractTokenClaims(
-                serverTokenResponse.id_token || Constants.EMPTY_STRING,
+                serverTokenResponse.id_token || "",
                 this.cryptoObj.base64Decode
             );
 
@@ -230,11 +227,12 @@ export class ResponseHandler {
         }
 
         // generate homeAccountId
-        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(
-            serverTokenResponse.client_info || Constants.EMPTY_STRING,
+        this.homeAccountIdentifier = AccountEntityUtils.generateHomeAccountId(
+            serverTokenResponse.client_info || "",
             authority.authorityType,
             this.logger,
             this.cryptoObj,
+            request.correlationId,
             idTokenClaims
         );
 
@@ -242,7 +240,7 @@ export class ResponseHandler {
         let requestStateObj: RequestStateObject | undefined;
         if (!!authCodePayload && !!authCodePayload.state) {
             requestStateObj = ProtocolUtils.parseRequestState(
-                this.cryptoObj,
+                this.cryptoObj.base64Decode,
                 authCodePayload.state
             );
         }
@@ -264,7 +262,8 @@ export class ResponseHandler {
         try {
             if (this.persistencePlugin && this.serializableCache) {
                 this.logger.verbose(
-                    "Persistence enabled, calling beforeCacheAccess"
+                    "Persistence enabled, calling beforeCacheAccess",
+                    request.correlationId
                 );
                 cacheContext = new TokenCacheContext(
                     this.serializableCache,
@@ -293,7 +292,8 @@ export class ResponseHandler {
 
                 if (cachedAccounts.length < 1) {
                     this.logger.warning(
-                        "Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache"
+                        "Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache",
+                        request.correlationId
                     );
                     this.performanceClient?.addFields(
                         {
@@ -307,6 +307,7 @@ export class ResponseHandler {
                         cacheRecord,
                         false,
                         request,
+                        this.performanceClient,
                         idTokenClaims,
                         requestStateObj,
                         undefined,
@@ -328,7 +329,8 @@ export class ResponseHandler {
                 cacheContext
             ) {
                 this.logger.verbose(
-                    "Persistence enabled, calling afterCacheAccess"
+                    "Persistence enabled, calling afterCacheAccess",
+                    request.correlationId
                 );
                 await this.persistencePlugin.afterCacheAccess(cacheContext);
             }
@@ -340,6 +342,7 @@ export class ResponseHandler {
             cacheRecord,
             false,
             request,
+            this.performanceClient,
             idTokenClaims,
             requestStateObj,
             serverTokenResponse,
@@ -445,10 +448,13 @@ export class ResponseHandler {
                 refreshOnSeconds,
                 serverTokenResponse.token_type,
                 userAssertionHash,
-                serverTokenResponse.key_id,
-                request.claims,
-                request.requestedClaimsHash
+                serverTokenResponse.key_id
             );
+            // Set resource (to be used for MCP scenarios)
+            const resource = request.resource || null;
+            if (resource) {
+                cachedAccessToken.resource = resource;
+            }
         }
 
         // refreshToken
@@ -465,10 +471,9 @@ export class ResponseHandler {
                           )
                         : serverTokenResponse.refresh_token_expires_in;
                 rtExpiresOn = reqTimestamp + rtExpiresIn;
+
                 this.performanceClient?.addFields(
-                    {
-                        ntwkRtExpiresOnSeconds: rtExpiresOn,
-                    },
+                    { ntwkRtExpiresOnSeconds: rtExpiresOn },
                     request.correlationId
                 );
             }
@@ -518,17 +523,18 @@ export class ResponseHandler {
         cacheRecord: CacheRecord,
         fromTokenCache: boolean,
         request: BaseAuthRequest,
+        performanceClient: IPerformanceClient,
         idTokenClaims?: TokenClaims,
         requestState?: RequestStateObject,
         serverTokenResponse?: ServerAuthorizationTokenResponse,
         requestId?: string
     ): Promise<AuthenticationResult> {
-        let accessToken: string = Constants.EMPTY_STRING;
+        let accessToken: string = "";
         let responseScopes: Array<string> = [];
         let expiresOn: Date | null = null;
         let extExpiresOn: Date | undefined;
         let refreshOn: Date | undefined;
-        let familyId: string = Constants.EMPTY_STRING;
+        let familyId: string = "";
 
         if (cacheRecord.accessToken) {
             /*
@@ -537,11 +543,11 @@ export class ResponseHandler {
              */
             if (
                 cacheRecord.accessToken.tokenType ===
-                    AuthenticationScheme.POP &&
+                    Constants.AuthenticationScheme.POP &&
                 !request.popKid
             ) {
                 const popTokenGenerator: PopTokenGenerator =
-                    new PopTokenGenerator(cryptoObj);
+                    new PopTokenGenerator(cryptoObj, performanceClient);
                 const { secret, keyId } = cacheRecord.accessToken;
 
                 if (!keyId) {
@@ -577,8 +583,8 @@ export class ResponseHandler {
 
         if (cacheRecord.appMetadata) {
             familyId =
-                cacheRecord.appMetadata.familyId === THE_FAMILY_ID
-                    ? THE_FAMILY_ID
+                cacheRecord.appMetadata.familyId === Constants.THE_FAMILY_ID
+                    ? Constants.THE_FAMILY_ID
                     : "";
         }
         const uid = idTokenClaims?.oid || idTokenClaims?.sub || "";
@@ -592,7 +598,7 @@ export class ResponseHandler {
 
         const accountInfo: AccountInfo | null = cacheRecord.account
             ? updateAccountTenantProfileData(
-                  AccountEntity.getAccountInfo(cacheRecord.account),
+                  AccountEntityUtils.getAccountInfo(cacheRecord.account),
                   undefined, // tenantProfile optional
                   idTokenClaims,
                   cacheRecord.idToken?.secret
@@ -613,20 +619,14 @@ export class ResponseHandler {
             extExpiresOn: extExpiresOn,
             refreshOn: refreshOn,
             correlationId: request.correlationId,
-            requestId: requestId || Constants.EMPTY_STRING,
+            requestId: requestId || "",
             familyId: familyId,
-            tokenType:
-                cacheRecord.accessToken?.tokenType || Constants.EMPTY_STRING,
-            state: requestState
-                ? requestState.userRequestState
-                : Constants.EMPTY_STRING,
-            cloudGraphHostName:
-                cacheRecord.account?.cloudGraphHostName ||
-                Constants.EMPTY_STRING,
-            msGraphHost:
-                cacheRecord.account?.msGraphHost || Constants.EMPTY_STRING,
+            tokenType: cacheRecord.accessToken?.tokenType || "",
+            state: requestState ? requestState.userRequestState : "",
+            cloudGraphHostName: cacheRecord.account?.cloudGraphHostName || "",
+            msGraphHost: cacheRecord.account?.msGraphHost || "",
             code: serverTokenResponse?.spa_code,
-            fromNativeBroker: false,
+            fromPlatformBroker: false,
         };
     }
 }
@@ -645,7 +645,7 @@ export function buildAccountToCache(
     nativeAccountId?: string,
     logger?: Logger
 ): AccountEntity {
-    logger?.verbose("setCachedAccount called");
+    logger?.verbose("setCachedAccount called", correlationId);
 
     // Check if base account is already cached
     const accountKeys = cacheStorage.getAccountKeys();
@@ -660,7 +660,7 @@ export function buildAccountToCache(
 
     const baseAccount =
         cachedAccount ||
-        AccountEntity.createAccount(
+        AccountEntityUtils.createAccountEntity(
             {
                 homeAccountId,
                 idTokenClaims,