/*! @azure/msal-common v16.5.0 2026-04-16 */
|
'use strict';
|
import { addClientId, addRedirectUri, addScopes, addResource, addAuthorizationCode, addLibraryInfo, addApplicationTelemetry, addThrottling, addServerTelemetry, addCodeVerifier, addClientSecret, addClientAssertion, addClientAssertionType, addGrantType, addClientInfo, addPopToken, addSshJwk, addCcsUpn, addCcsOid, addBrokerParameters, addExtraParameters, instrumentBrokerParams, addClaims, addPostLogoutRedirectUri, addCorrelationId, addIdTokenHint, addState, addLogoutHint, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
|
import { mapToQueryString } from '../utils/UrlUtils.mjs';
|
import { CLIENT_INFO_SEPARATOR, AuthenticationScheme, HeaderNames, GrantType } from '../utils/Constants.mjs';
|
import { RETURN_SPA_CODE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';
|
import { buildClientConfiguration, isOidcProtocolMode } from '../config/ClientConfiguration.mjs';
|
import { ResponseHandler } from '../response/ResponseHandler.mjs';
|
import { createClientAuthError } from '../error/ClientAuthError.mjs';
|
import { UrlString } from '../url/UrlString.mjs';
|
import { PopTokenGenerator } from '../crypto/PopTokenGenerator.mjs';
|
import { nowSeconds } from '../utils/TimeUtils.mjs';
|
import { buildClientInfo, buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';
|
import { CcsCredentialType } from '../account/CcsCredential.mjs';
|
import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
|
import { UpdateTokenEndpointAuthority, AuthClientExecuteTokenRequest, HandleServerTokenResponse, AuthClientCreateTokenRequestBody, AuthorizationCodeClientExecutePostToTokenEndpoint, PopTokenGenerateCnf } from '../telemetry/performance/PerformanceEvents.mjs';
|
import { invokeAsync } from '../utils/FunctionWrappers.mjs';
|
import { getClientAssertion } from '../utils/ClientAssertionUtils.mjs';
|
import { getRequestThumbprint } from '../network/RequestThumbprint.mjs';
|
import { createTokenQueryParameters, createTokenRequestHeaders, executePostToTokenEndpoint } from '../protocol/Token.mjs';
|
import { createDiscoveredInstance } from '../authority/AuthorityFactory.mjs';
|
import { Logger } from '../logger/Logger.mjs';
|
import { name, version } from '../packageMetadata.mjs';
|
import { requestCannotBeMade } from '../error/ClientAuthErrorCodes.mjs';
|
import { logoutRequestEmpty, redirectUriEmpty, missingSshJwk } from '../error/ClientConfigurationErrorCodes.mjs';
|
|
/*
|
* Copyright (c) Microsoft Corporation. All rights reserved.
|
* Licensed under the MIT License.
|
*/
|
/**
|
* Oauth2.0 Authorization Code client
|
* @internal
|
*/
|
class AuthorizationCodeClient {
|
constructor(configuration, performanceClient) {
|
// Flag to indicate if client is for hybrid spa auth code redemption
|
this.includeRedirectUri = true;
|
// Set the configuration
|
this.config = buildClientConfiguration(configuration);
|
// Initialize the logger
|
this.logger = new Logger(this.config.loggerOptions, name, version);
|
// Initialize crypto
|
this.cryptoUtils = this.config.cryptoInterface;
|
// Initialize storage interface
|
this.cacheManager = this.config.storageInterface;
|
// Set the network interface
|
this.networkClient = this.config.networkInterface;
|
// Set TelemetryManager
|
this.serverTelemetryManager = this.config.serverTelemetryManager;
|
// set Authority
|
this.authority = this.config.authOptions.authority;
|
// set performance telemetry client
|
this.performanceClient = performanceClient;
|
this.oidcDefaultScopes =
|
this.config.authOptions.authority.options.OIDCOptions?.defaultScopes;
|
}
|
/**
|
* API to acquire a token in exchange of 'authorization_code` acquired by the user in the first leg of the
|
* authorization_code_grant
|
* @param request
|
*/
|
async acquireToken(request, apiId, authCodePayload) {
|
if (!request.code) {
|
throw createClientAuthError(requestCannotBeMade);
|
}
|
// Check for new cloud instance
|
if (authCodePayload && authCodePayload.cloud_instance_host_name) {
|
await invokeAsync(this.updateTokenEndpointAuthority.bind(this), UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodePayload.cloud_instance_host_name, request.correlationId);
|
}
|
const reqTimestamp = nowSeconds();
|
const response = await invokeAsync(this.executeTokenRequest.bind(this), AuthClientExecuteTokenRequest, this.logger, this.performanceClient, request.correlationId)(this.authority, request, this.serverTelemetryManager);
|
// Retrieve requestId from response headers
|
const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
|
const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.performanceClient, this.config.serializableCache, this.config.persistencePlugin);
|
// Validate response. This function throws a server error if an error is returned by the server.
|
responseHandler.validateTokenResponse(response.body, request.correlationId);
|
return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, apiId, authCodePayload, undefined, undefined, undefined, requestId);
|
}
|
/**
|
* Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
|
* Default behaviour is to redirect the user to `window.location.href`.
|
* @param authorityUri
|
*/
|
getLogoutUri(logoutRequest) {
|
// Throw error if logoutRequest is null/undefined
|
if (!logoutRequest) {
|
throw createClientConfigurationError(logoutRequestEmpty);
|
}
|
const queryString = this.createLogoutUrlQueryString(logoutRequest);
|
// Construct logout URI
|
return UrlString.appendQueryString(this.authority.endSessionEndpoint, queryString);
|
}
|
/**
|
* Executes POST request to token endpoint
|
* @param authority
|
* @param request
|
*/
|
async executeTokenRequest(authority, request, serverTelemetryManager) {
|
const queryParametersString = createTokenQueryParameters(request, this.config.authOptions.clientId, this.config.authOptions.redirectUri, this.performanceClient);
|
const endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParametersString);
|
const requestBody = await invokeAsync(this.createTokenRequestBody.bind(this), AuthClientCreateTokenRequestBody, this.logger, this.performanceClient, request.correlationId)(request);
|
let ccsCredential = undefined;
|
if (request.clientInfo) {
|
try {
|
const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
|
ccsCredential = {
|
credential: `${clientInfo.uid}${CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
|
type: CcsCredentialType.HOME_ACCOUNT_ID,
|
};
|
}
|
catch (e) {
|
this.logger.verbose("0wznt3", request.correlationId);
|
}
|
}
|
const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, ccsCredential || request.ccsCredential);
|
const thumbprint = getRequestThumbprint(this.config.authOptions.clientId, request);
|
return invokeAsync(executePostToTokenEndpoint, AuthorizationCodeClientExecutePostToTokenEndpoint, this.logger, this.performanceClient, request.correlationId)(endpoint, requestBody, headers, thumbprint, request.correlationId, this.cacheManager, this.networkClient, this.logger, this.performanceClient, serverTelemetryManager);
|
}
|
/**
|
* Generates a map for all the params to be sent to the service
|
* @param request
|
*/
|
async createTokenRequestBody(request) {
|
const parameters = new Map();
|
addClientId(parameters, request.embeddedClientId ||
|
request.extraParameters?.[CLIENT_ID] ||
|
this.config.authOptions.clientId);
|
/*
|
* For hybrid spa flow, there will be a code but no verifier
|
* In this scenario, don't include redirect uri as auth code will not be bound to redirect URI
|
*/
|
if (!this.includeRedirectUri) {
|
// Just validate
|
if (!request.redirectUri) {
|
throw createClientConfigurationError(redirectUriEmpty);
|
}
|
}
|
else {
|
// Validate and include redirect uri
|
addRedirectUri(parameters, request.redirectUri);
|
}
|
// Add scope array, parameter builder will add default scopes and dedupe
|
addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
|
addResource(parameters, request.resource);
|
// add code: user set, not validated
|
addAuthorizationCode(parameters, request.code);
|
// Add library metadata
|
addLibraryInfo(parameters, this.config.libraryInfo);
|
addApplicationTelemetry(parameters, this.config.telemetry.application);
|
addThrottling(parameters);
|
if (this.serverTelemetryManager && !isOidcProtocolMode(this.config)) {
|
addServerTelemetry(parameters, this.serverTelemetryManager);
|
}
|
// add code_verifier if passed
|
if (request.codeVerifier) {
|
addCodeVerifier(parameters, request.codeVerifier);
|
}
|
if (this.config.clientCredentials.clientSecret) {
|
addClientSecret(parameters, this.config.clientCredentials.clientSecret);
|
}
|
if (this.config.clientCredentials.clientAssertion) {
|
const clientAssertion = this.config.clientCredentials.clientAssertion;
|
addClientAssertion(parameters, await getClientAssertion(clientAssertion.assertion, this.config.authOptions.clientId, request.resourceRequestUri));
|
addClientAssertionType(parameters, clientAssertion.assertionType);
|
}
|
addGrantType(parameters, GrantType.AUTHORIZATION_CODE_GRANT);
|
addClientInfo(parameters);
|
if (request.authenticationScheme === AuthenticationScheme.POP) {
|
const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
|
let reqCnfData;
|
if (!request.popKid) {
|
const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
|
reqCnfData = generatedReqCnfData.reqCnfString;
|
}
|
else {
|
reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
|
}
|
// SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
|
addPopToken(parameters, reqCnfData);
|
}
|
else if (request.authenticationScheme === AuthenticationScheme.SSH) {
|
if (request.sshJwk) {
|
addSshJwk(parameters, request.sshJwk);
|
}
|
else {
|
throw createClientConfigurationError(missingSshJwk);
|
}
|
}
|
let ccsCred = undefined;
|
if (request.clientInfo) {
|
try {
|
const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
|
ccsCred = {
|
credential: `${clientInfo.uid}${CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
|
type: CcsCredentialType.HOME_ACCOUNT_ID,
|
};
|
}
|
catch (e) {
|
this.logger.verbose("0wznt3", request.correlationId);
|
}
|
}
|
else {
|
ccsCred = request.ccsCredential;
|
}
|
// Adds these as parameters in the request instead of headers to prevent CORS preflight request
|
if (this.config.systemOptions.preventCorsPreflight && ccsCred) {
|
switch (ccsCred.type) {
|
case CcsCredentialType.HOME_ACCOUNT_ID:
|
try {
|
const clientInfo = buildClientInfoFromHomeAccountId(ccsCred.credential);
|
addCcsOid(parameters, clientInfo);
|
}
|
catch (e) {
|
this.logger.verbose("1qhtee", request.correlationId);
|
}
|
break;
|
case CcsCredentialType.UPN:
|
addCcsUpn(parameters, ccsCred.credential);
|
break;
|
}
|
}
|
if (request.embeddedClientId) {
|
addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
|
}
|
if (request.extraParameters) {
|
addExtraParameters(parameters, request.extraParameters);
|
}
|
// Add hybrid spa parameters if not already provided
|
if (request.enableSpaAuthorizationCode &&
|
(!request.extraParameters ||
|
!request.extraParameters[RETURN_SPA_CODE])) {
|
addExtraParameters(parameters, {
|
[RETURN_SPA_CODE]: "1",
|
});
|
}
|
instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
|
addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
|
return mapToQueryString(parameters);
|
}
|
/**
|
* This API validates the `EndSessionRequest` and creates a URL
|
* @param request
|
*/
|
createLogoutUrlQueryString(request) {
|
const parameters = new Map();
|
if (request.postLogoutRedirectUri) {
|
addPostLogoutRedirectUri(parameters, request.postLogoutRedirectUri);
|
}
|
if (request.correlationId) {
|
addCorrelationId(parameters, request.correlationId);
|
}
|
if (request.idTokenHint) {
|
addIdTokenHint(parameters, request.idTokenHint);
|
}
|
if (request.state) {
|
addState(parameters, request.state);
|
}
|
if (request.logoutHint) {
|
addLogoutHint(parameters, request.logoutHint);
|
}
|
if (request.extraQueryParameters) {
|
addExtraParameters(parameters, request.extraQueryParameters);
|
}
|
if (this.config.authOptions.instanceAware) {
|
addInstanceAware(parameters);
|
}
|
return mapToQueryString(parameters);
|
}
|
/**
|
* Updates the authority to the cloud instance provided in the authorization response
|
* @param cloudInstanceHostName - cloud instance host name from authorization code payload
|
* @param correlationId - request correlation id
|
*/
|
async updateTokenEndpointAuthority(cloudInstanceHostName, correlationId) {
|
const cloudInstanceAuthorityUri = `https://${cloudInstanceHostName}/${this.authority.tenant}/`;
|
const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
|
this.authority = cloudInstanceAuthority;
|
}
|
}
|
|
export { AuthorizationCodeClient };
|
//# sourceMappingURL=AuthorizationCodeClient.mjs.map
|
