feature/msal-angular/msal-guard-stricter: adding feature enable check…

… for token expiration

lib/msal-angular/src/msal.guard.config.ts

@@ -8,6 +8,7 @@ import {
   PopupRequest,
   RedirectRequest,
   InteractionType,
+  SilentRequest,
 } from "@azure/msal-browser";
 import { MsalService } from "./msal.service";
 
@@ -24,4 +25,9 @@ export type MsalGuardConfiguration = {
         state: RouterStateSnapshot
       ) => MsalGuardAuthRequest);
   loginFailedRoute?: string;
+  enableCheckForExpiredToken?: boolean;
+  minimumSecondsBeforeTokenExpiration?: number;
+  silentAuthRequest?:
+    | SilentRequest
+    | ((authService: MsalService, state: RouterStateSnapshot) => SilentRequest);
 };

lib/msal-angular/src/msal.guard.spec.ts

@@ -4,6 +4,8 @@ import { UrlTree } from "@angular/router";
 import { RouterTestingModule } from "@angular/router/testing";
 import { Location } from "@angular/common";
 import {
+  AccountInfo,
+  AuthenticationResult,
   BrowserSystemOptions,
   InteractionType,
   IPublicClientApplication,
@@ -28,6 +30,9 @@ let testInteractionType: InteractionType;
 let testLoginFailedRoute: string;
 let testConfiguration: Partial<MsalGuardConfiguration>;
 let browserSystemOptions: BrowserSystemOptions;
+let enableCheckForExpiredToken: boolean | undefined;
+let minimumSecondsBeforeTokenExpiration: number | undefined;
+let silentAuthRequest: any;
 
 function MSALInstanceFactory(): IPublicClientApplication {
   return new PublicClientApplication({
@@ -53,6 +58,20 @@ function MSALGuardConfigFactory(): MsalGuardConfiguration {
     interactionType: testInteractionType,
     loginFailedRoute: testLoginFailedRoute,
     authRequest: testConfiguration?.authRequest,
+    ...(enableCheckForExpiredToken === undefined
+      ? {} // when enableCheckForExpiredToken is undefined we do not change the returned config object. Important to test backward compatibility when property is not present
+      : { enableCheckForExpiredToken: enableCheckForExpiredToken }),
+    ...(minimumSecondsBeforeTokenExpiration === undefined
+      ? {} // when minimumSecondsBeforeTokenExpiration is undefined we do not change the returned config object. Important to test backward compatibility when property is not present
+      : {
+          minimumSecondsBeforeTokenExpiration:
+            minimumSecondsBeforeTokenExpiration,
+        }),
+    ...(silentAuthRequest === undefined
+      ? {} // when minimumSecondsBeforeTokenExpiration is undefined we do not change the returned config object. Important to test backward compatibility when property is not present
+      : {
+          silentAuthRequest: silentAuthRequest,
+        }),
   };
 }
 
@@ -80,6 +99,8 @@ describe("MsalGuard", () => {
     testLoginFailedRoute = undefined;
     testConfiguration = {};
     browserSystemOptions = {};
+    enableCheckForExpiredToken = undefined;
+    minimumSecondsBeforeTokenExpiration = undefined;
     routeStateMock = { snapshot: {}, url: "/" };
     initializeMsal();
   });
@@ -365,6 +386,126 @@ describe("MsalGuard", () => {
     });
   });
 
+  it("returns false for option enableCheckForExpiredToken is true and token is expired and silentRefresh fails", (done) => {
+    enableCheckForExpiredToken = true;
+    initializeMsal();
+
+    authService.handleRedirectObservable().subscribe();
+
+    spyOn(MsalService.prototype, "handleRedirectObservable").and.returnValue(
+      //@ts-ignore
+      of("test")
+    );
+
+    spyOn(
+      PublicClientApplication.prototype,
+      "getActiveAccount"
+    ).and.returnValue({
+      idTokenClaims: {
+        exp: Math.round(Date.now() / 1000) - 10, // set expiration claim to now + 10 secs
+      },
+    } as AccountInfo);
+
+    spyOn(MsalService.prototype, "acquireTokenSilent").and.returnValue(
+      of({ accessToken: undefined } as AuthenticationResult)
+    );
+
+    guard.canActivate(routeMock, routeStateMock).subscribe((result) => {
+      expect(result).toBeFalse();
+      done();
+    });
+  });
+
+  it("returns false for option enableCheckForExpiredToken is true and token is not expired but not within minimumSecondsBeforeTokenExpiration and silentRefresh fails", (done) => {
+    enableCheckForExpiredToken = true;
+    minimumSecondsBeforeTokenExpiration = 60;
+    initializeMsal();
+
+    authService.handleRedirectObservable().subscribe();
+
+    spyOn(MsalService.prototype, "handleRedirectObservable").and.returnValue(
+      //@ts-ignore
+      of("test")
+    );
+
+    spyOn(
+      PublicClientApplication.prototype,
+      "getActiveAccount"
+    ).and.returnValue({
+      idTokenClaims: {
+        exp: Math.round(Date.now() / 1000) + 30, // set expiration claim to now + 30 secs
+      },
+    } as AccountInfo);
+
+    spyOn(MsalService.prototype, "acquireTokenSilent").and.returnValue(
+      of({ accessToken: undefined } as AuthenticationResult)
+    );
+
+    guard.canActivate(routeMock, routeStateMock).subscribe((result) => {
+      expect(result).toBeFalse();
+      done();
+    });
+  });
+
+  it("returns true for option enableCheckForExpiredToken is true and token is expired and silentRefresh succeeds", (done) => {
+    enableCheckForExpiredToken = true;
+    silentAuthRequest = {}; // set silentauth request or it will not be tried
+    initializeMsal();
+
+    authService.handleRedirectObservable().subscribe();
+
+    spyOn(MsalService.prototype, "handleRedirectObservable").and.returnValue(
+      //@ts-ignore
+      of("test")
+    );
+
+    spyOn(
+      PublicClientApplication.prototype,
+      "getActiveAccount"
+    ).and.returnValue({
+      idTokenClaims: {
+        exp: Math.round(Date.now() / 1000) - 10, // set expiration claim to now + 10 secs
+      },
+    } as AccountInfo);
+
+    spyOn(MsalService.prototype, "acquireTokenSilent").and.returnValue(
+      of({ accessToken: "validToken" } as AuthenticationResult)
+    );
+
+    guard.canActivate(routeMock, routeStateMock).subscribe((result) => {
+      expect(result).toBeTrue();
+      done();
+    });
+  });
+
+  it("returns true for option enableCheckForExpiredToken is true and token is not expired", (done) => {
+    enableCheckForExpiredToken = true;
+    initializeMsal();
+
+    spyOn(MsalService.prototype, "handleRedirectObservable").and.returnValue(
+      //@ts-ignore
+      of("test")
+    );
+
+    spyOn(
+      PublicClientApplication.prototype,
+      "getActiveAccount"
+    ).and.returnValue({
+      idTokenClaims: {
+        exp: Math.round(Date.now() / 1000) + 60, // set expiration claim to now + 10 secs
+      },
+    } as AccountInfo);
+
+    // spyOn(MsalService.prototype, "acquireTokenSilent").and.returnValue(
+    //   of({ accessToken: "validToken" } as AuthenticationResult)
+    // );
+
+    guard.canActivate(routeMock, routeStateMock).subscribe((result) => {
+      expect(result).toBeTrue();
+      done();
+    });
+  });
+
   it("should return true after logging in with popup", (done) => {
     testConfiguration = {
       authRequest: (authService, state) => {

lib/msal-angular/src/msal.guard.ts

@@ -19,9 +19,10 @@ import {
   PopupRequest,
   RedirectRequest,
   AuthenticationResult,
+  InteractionStatus,
 } from "@azure/msal-browser";
 import { Observable, of } from "rxjs";
-import { concatMap, catchError, map } from "rxjs/operators";
+import { concatMap, catchError, map, filter, take } from "rxjs/operators";
 import { MsalService } from "./msal.service";
 import { MsalGuardConfiguration } from "./msal.guard.config";
 import { MsalBroadcastService } from "./msal.broadcast.service";
@@ -177,7 +178,16 @@ export class MsalGuard {
         return this.authService.handleRedirectObservable();
       }),
       concatMap(() => {
-        if (!this.authService.instance.getAllAccounts().length) {
+        if (!this.msalGuardConfig.enableCheckForExpiredToken) {
+          return of(!this.authService.instance.getAllAccounts().length);
+        } else {
+          return this.isTokenStillValidForActiveAccountRefreshIfPossible(
+            state
+          ).pipe(map((validToken) => !validToken));
+        }
+      }),
+      concatMap((requireLogin) => {
+        if (requireLogin) {
           if (state) {
             this.authService
               .getLogger()
@@ -192,9 +202,19 @@ export class MsalGuard {
           return of(false);
         }
 
-        this.authService
-          .getLogger()
-          .verbose("Guard - at least 1 account exists, can activate or load");
+        if (!this.msalGuardConfig.enableCheckForExpiredToken) {
+          this.authService
+            .getLogger()
+            .verbose("Guard - at least 1 account exists, can activate or load");
+        }
+
+        if (!!this.msalGuardConfig.enableCheckForExpiredToken) {
+          this.authService
+            .getLogger()
+            .verbose(
+              "Guard - active account has a valid token, can activate or load"
+            );
+        }
 
         // Prevent navigating the app to /#code= or /code=
         if (state) {
@@ -287,4 +307,66 @@ export class MsalGuard {
     this.authService.getLogger().verbose("Guard - canLoad");
     return this.activateHelper();
   }
+
+  /*
+   * will return false if no active account or token expired and silent refresh failed
+   * will return true if we have a non expired token
+   */
+  isTokenStillValidForActiveAccountRefreshIfPossible(
+    state: RouterStateSnapshot
+  ): Observable<boolean> {
+    const activeAccount = this.authService.instance.getActiveAccount();
+
+    if (!activeAccount) {
+      return of(false);
+    }
+
+    const now = Math.round(Date.now() / 1000);
+    const expiration = <number>activeAccount.idTokenClaims?.["exp"];
+
+    const expired =
+      now + (this.msalGuardConfig.minimumSecondsBeforeTokenExpiration ?? 0) >
+      expiration;
+
+    if (!expired) {
+      return of(true);
+    } else {
+      if (!this.msalGuardConfig.silentAuthRequest) {
+        return of(false);
+      }
+      this.authService
+        .getLogger()
+        .info(
+          "Guard - token for active account is expired. Initiating silent refresh"
+        );
+      const silentRequest =
+        typeof this.msalGuardConfig.silentAuthRequest === "function"
+          ? this.msalGuardConfig.silentAuthRequest(this.authService, state)
+          : { ...this.msalGuardConfig.silentAuthRequest };
+
+      return this.msalBroadcastService.inProgress$.pipe(
+        filter(
+          (status: InteractionStatus) => status === InteractionStatus.None
+        ),
+        take(1),
+        concatMap(() => {
+          return this.authService.acquireTokenSilent(silentRequest);
+        }),
+        map((authResult) => {
+          this.authService.getLogger().info("Guard - silent refresh succeeded");
+          return !!authResult.accessToken;
+        }),
+        catchError((err) => {
+          this.authService
+            .getLogger()
+            .warning(
+              `Guard - silent refresh failed. Reporting no valid token. error: ${JSON.stringify(
+                err
+              )}`
+            );
+          return of(false);
+        })
+      );
+    }
+  }
 }