@azure/msal-common/src/cache/utils/AccountEntityUtils.ts

Microsoft Authentication Library for js

/*
 * Copyright (c) Microsoft Corporation. All rights reserved.
 * Licensed under the MIT License.
 */

import * as Constants from "../../utils/Constants.js";
import { Authority } from "../../authority/Authority.js";
import { ICrypto } from "../../crypto/ICrypto.js";
import { ClientInfo, buildClientInfo } from "../../account/ClientInfo.js";
import {
    AccountInfo,
    TenantProfile,
    buildTenantProfile,
    DataBoundary,
} from "../../account/AccountInfo.js";
import {
    createClientAuthError,
    ClientAuthErrorCodes,
} from "../../error/ClientAuthError.js";
import { AuthorityType } from "../../authority/AuthorityType.js";
import { Logger } from "../../logger/Logger.js";
import {
    TokenClaims,
    getTenantIdFromIdTokenClaims,
} from "../../account/TokenClaims.js";
import { ProtocolMode } from "../../authority/ProtocolMode.js";
import { AccountEntity } from "../entities/AccountEntity.js";

/**
 * Generate Account Id key component as per the schema: <home_account_id>-<environment>
 */
export function generateAccountId(accountEntity: AccountEntity): string {
    const accountId: Array<string> = [
        accountEntity.homeAccountId,
        accountEntity.environment,
    ];
    return accountId.join(Constants.CACHE_KEY_SEPARATOR).toLowerCase();
}

/**
 * Returns the AccountInfo interface for this account.
 */
export function getAccountInfo(accountEntity: AccountEntity): AccountInfo {
    const tenantProfiles = accountEntity.tenantProfiles || [];
    // Ensure at least the home tenant profile exists
    if (
        tenantProfiles.length === 0 &&
        accountEntity.realm &&
        accountEntity.localAccountId
    ) {
        tenantProfiles.push(
            buildTenantProfile(
                accountEntity.homeAccountId,
                accountEntity.localAccountId,
                accountEntity.realm
            )
        );
    }
    return {
        homeAccountId: accountEntity.homeAccountId,
        environment: accountEntity.environment,
        tenantId: accountEntity.realm,
        username: accountEntity.username,
        localAccountId: accountEntity.localAccountId,
        loginHint: accountEntity.loginHint,
        name: accountEntity.name,
        nativeAccountId: accountEntity.nativeAccountId,
        authorityType: accountEntity.authorityType,
        // Deserialize tenant profiles array into a Map
        tenantProfiles: new Map(
            tenantProfiles.map((tenantProfile) => {
                return [tenantProfile.tenantId, tenantProfile];
            })
        ),
        dataBoundary: accountEntity.dataBoundary,
    };
}

/**
 * Returns true if the account entity is in single tenant format (outdated), false otherwise
 */
export function isSingleTenant(accountEntity: AccountEntity): boolean {
    return !accountEntity.tenantProfiles;
}

/**
 * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
 * @param accountDetails
 */
export function createAccountEntity(
    accountDetails: {
        homeAccountId: string;
        idTokenClaims?: TokenClaims;
        clientInfo?: string;
        cloudGraphHostName?: string;
        msGraphHost?: string;
        environment?: string;
        nativeAccountId?: string;
        tenantProfiles?: Array<TenantProfile>;
    },
    authority: Authority,
    base64Decode?: (input: string) => string
): AccountEntity {
    let authorityType;
    if (authority.authorityType === AuthorityType.Adfs) {
        authorityType = Constants.CACHE_ACCOUNT_TYPE_ADFS;
    } else if (authority.protocolMode === ProtocolMode.OIDC) {
        authorityType = Constants.CACHE_ACCOUNT_TYPE_GENERIC;
    } else {
        authorityType = Constants.CACHE_ACCOUNT_TYPE_MSSTS;
    }

    let clientInfo: ClientInfo | undefined;
    let dataBoundary: DataBoundary | undefined;

    if (accountDetails.clientInfo && base64Decode) {
        clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
        if (clientInfo.xms_tdbr) {
            dataBoundary = clientInfo.xms_tdbr === "EU" ? "EU" : "None";
        }
    }

    const env =
        accountDetails.environment ||
        (authority && authority.getPreferredCache());

    if (!env) {
        throw createClientAuthError(
            ClientAuthErrorCodes.invalidCacheEnvironment
        );
    }

    /*
     * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
     * In most cases it will contain a single email. This field should not be relied upon if a custom
     * policy is configured to return more than 1 email.
     */
    const preferredUsername =
        accountDetails.idTokenClaims?.preferred_username ||
        accountDetails.idTokenClaims?.upn;
    const email = accountDetails.idTokenClaims?.emails
        ? accountDetails.idTokenClaims.emails[0]
        : null;

    const username = preferredUsername || email || "";

    const loginHint = accountDetails.idTokenClaims?.login_hint;

    const realm =
        clientInfo?.utid ||
        getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
        ""; // non-AAD scenarios can have empty realm
    // How do you account for MSA CID here?
    const localAccountId =
        clientInfo?.uid ||
        accountDetails.idTokenClaims?.oid ||
        accountDetails.idTokenClaims?.sub ||
        "";
    let tenantProfiles;
    if (accountDetails.tenantProfiles) {
        tenantProfiles = accountDetails.tenantProfiles;
    } else {
        const tenantProfile = buildTenantProfile(
            accountDetails.homeAccountId,
            localAccountId,
            realm,
            accountDetails.idTokenClaims
        );
        tenantProfiles = [tenantProfile];
    }

    return {
        homeAccountId: accountDetails.homeAccountId,
        environment: env,
        realm: realm,
        localAccountId: localAccountId,
        username: username,
        authorityType: authorityType,
        loginHint: loginHint,
        clientInfo: accountDetails.clientInfo,
        name: accountDetails.idTokenClaims?.name || "",
        lastModificationTime: undefined,
        lastModificationApp: undefined,
        cloudGraphHostName: accountDetails.cloudGraphHostName,
        msGraphHost: accountDetails.msGraphHost,
        nativeAccountId: accountDetails.nativeAccountId,
        tenantProfiles: tenantProfiles,
        dataBoundary,
    } as AccountEntity;
}

/**
 * Creates an AccountEntity object from AccountInfo
 * @param accountInfo
 * @param cloudGraphHostName
 * @param msGraphHost
 * @returns
 */
export function createAccountEntityFromAccountInfo(
    accountInfo: AccountInfo,
    cloudGraphHostName?: string,
    msGraphHost?: string
): AccountEntity {
    // Serialize tenant profiles map into an array
    const tenantProfiles = Array.from(
        accountInfo.tenantProfiles?.values() || []
    );
    // Ensure at least the home tenant profile exists
    if (
        tenantProfiles.length === 0 &&
        accountInfo.tenantId &&
        accountInfo.localAccountId
    ) {
        tenantProfiles.push(
            buildTenantProfile(
                accountInfo.homeAccountId,
                accountInfo.localAccountId,
                accountInfo.tenantId,
                accountInfo.idTokenClaims
            )
        );
    }
    return {
        authorityType:
            accountInfo.authorityType || Constants.CACHE_ACCOUNT_TYPE_GENERIC,
        homeAccountId: accountInfo.homeAccountId,
        localAccountId: accountInfo.localAccountId,
        nativeAccountId: accountInfo.nativeAccountId,
        realm: accountInfo.tenantId,
        environment: accountInfo.environment,
        username: accountInfo.username,
        loginHint: accountInfo.loginHint,
        name: accountInfo.name,
        cloudGraphHostName: cloudGraphHostName,
        msGraphHost: msGraphHost,
        tenantProfiles: tenantProfiles,
        dataBoundary: accountInfo.dataBoundary,
    } as AccountEntity;
}

/**
 * Generate HomeAccountId from server response
 * @param serverClientInfo
 * @param authType
 */
export function generateHomeAccountId(
    serverClientInfo: string,
    authType: AuthorityType,
    logger: Logger,
    cryptoObj: ICrypto,
    correlationId: string,
    idTokenClaims?: TokenClaims
): string {
    // since ADFS/DSTS do not have tid and does not set client_info
    if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
        // for cases where there is clientInfo
        if (serverClientInfo) {
            try {
                const clientInfo = buildClientInfo(
                    serverClientInfo,
                    cryptoObj.base64Decode
                );
                if (clientInfo.uid && clientInfo.utid) {
                    return `${clientInfo.uid}.${clientInfo.utid}`;
                }
            } catch (e) {}
        }
        logger.warning("No client info in response", correlationId);
    }

    // default to "sub" claim
    return idTokenClaims?.sub || "";
}

/**
 * Validates an entity: checks for all expected params
 * @param entity
 */
export function isAccountEntity(entity: object): entity is AccountEntity {
    if (!entity) {
        return false;
    }

    return (
        entity.hasOwnProperty("homeAccountId") &&
        entity.hasOwnProperty("environment") &&
        entity.hasOwnProperty("realm") &&
        entity.hasOwnProperty("localAccountId") &&
        entity.hasOwnProperty("username") &&
        entity.hasOwnProperty("authorityType")
    );
}