Decide to enable/disable single frt based on string flight to allow 3 states:

- On
- Off
- Ignore, keep as is

Author: juan-arias

IdentityCore/src/MSIDConstants.h

@@ -197,6 +197,9 @@ typedef NS_ENUM(NSInteger, MSIDIsFRTEnabledStatus)
     MSIDIsFRTEnabledStatusDisabledByKeychainItem
 };
 
+extern NSString * _Nonnull const MSID_FRT_STATUS_ENABLED;
+extern NSString * _Nonnull const MSID_FRT_STATUS_DISABLED;
+
 extern NSString * _Nonnull const MSID_BROWSER_RESPONSE_SWITCH_BROWSER;
 extern NSString * _Nonnull const MSID_BROWSER_RESPONSE_SWITCH_BROWSER_RESUME;
 

IdentityCore/src/MSIDConstants.m

@@ -64,6 +64,8 @@
 
 NSString *const MSID_USE_SINGLE_FRT_KEYCHAIN          = @"useSingleFRT";
 NSString *const MSID_USE_SINGLE_FRT_KEY               = @"use_single_frt";
+NSString *const MSID_FRT_STATUS_ENABLED               = @"on";
+NSString *const MSID_FRT_STATUS_DISABLED              = @"off";
 
 NSString *const MSID_SHARED_MODE_CURRENT_ACCOUNT_CHANGED_NOTIFICATION_KEY = @"SHARED_MODE_CURRENT_ACCOUNT_CHANGED";
 

IdentityCore/src/cache/accessor/MSIDAccountCredentialCache.m

@@ -568,11 +568,20 @@ - (MSIDIsFRTEnabledStatus)checkFRTEnabled:(nullable id<MSIDRequestContext>)conte
     MSIDIsFRTEnabledStatus (^checkFeatureFlagsAndReturn)(MSIDIsFRTEnabledStatus) = ^MSIDIsFRTEnabledStatus(MSIDIsFRTEnabledStatus status)
     {
 
-        // Check if FRT is enabled by feature flight
+        // Check if FRT is enabled by feature flight, possible values:
+        // - MSID_FRT_STATUS_ENABLED => "on": FRT will be enabled
+        // - MSID_FRT_STATUS_DISABLED => "off": FRT will be disabled
+        // - nil, empty or any other value: no change to FRT
         MSIDFlightManager *flightManager = [MSIDFlightManager sharedInstance];
-        BOOL flagEnableFRT = [flightManager boolForKey:@"enable_client_sfrt_by_tenant_id"];// || YES; // TODO: Replace this by the constant from the other branch, and remove the hardcoded YES
-        BOOL flagDisableAllFRT = [flightManager boolForKey:@"disable_client_sfrt_for_all"];
-        BOOL shouldEnableFRT = flagEnableFRT && !flagDisableAllFRT;
+        NSString *flagEnableFRT = [flightManager stringForKey:MSID_FLIGHT_CLIENT_SFRT_STATUS];
+        BOOL shouldEnableFRT = [MSID_FRT_STATUS_ENABLED isEqualToString:flagEnableFRT];
+        BOOL shouldDisableFRT = [MSID_FRT_STATUS_DISABLED isEqualToString:flagEnableFRT];
+        
+        if ([NSString msidIsStringNilOrBlank:flagEnableFRT] || (!shouldEnableFRT && !shouldDisableFRT))
+        {
+            MSID_LOG_WITH_CTX(MSIDLogLevelError, context, @"FRT flight set to keep current status: %ld", (long)status);
+            return status;
+        }
         MSIDIsFRTEnabledStatus newStatus = status;
         NSError *updateError = nil;
 
@@ -594,7 +603,7 @@ - (MSIDIsFRTEnabledStatus)checkFRTEnabled:(nullable id<MSIDRequestContext>)conte
                     [self updateFRTSettings:YES context:context error:&updateError];
                     newStatus = MSIDIsFRTEnabledStatusEnabled;
                 }
-                else if (flagDisableAllFRT)
+                else if (shouldDisableFRT)
                 {
                     [self updateFRTSettings:NO context:context error:&updateError];
                     newStatus = MSIDIsFRTEnabledStatusDisabledByKeychainItem;
@@ -603,7 +612,7 @@ - (MSIDIsFRTEnabledStatus)checkFRTEnabled:(nullable id<MSIDRequestContext>)conte
 
                 // FRT is currently enabled, check to see if should be disabled
             case MSIDIsFRTEnabledStatusEnabled:
-                if (flagDisableAllFRT)
+                if (shouldDisableFRT)
                 {
                     [self updateFRTSettings:NO context:context error:&updateError];
                     newStatus = MSIDIsFRTEnabledStatusDisabledByKeychainItem;

IdentityCore/src/cache/accessor/MSIDDefaultTokenCacheAccessor.m

@@ -132,10 +132,12 @@ - (MSIDRefreshToken *)getRefreshTokenWithAccount:(MSIDAccountIdentifier *)accoun
                                          context:(id<MSIDRequestContext>)context
                                            error:(NSError *__autoreleasing *)error
 {
-    MSIDIsFRTEnabledStatus frtStatus = [_accountCredentialCache checkFRTEnabled:context error:error];
+    NSError *frtError = nil;
+    MSIDIsFRTEnabledStatus frtStatus = [_accountCredentialCache checkFRTEnabled:context error:&frtError];
     BOOL frtEnabled = frtStatus == MSIDIsFRTEnabledStatusEnabled;
-    if (error)
+    if (frtError)
     {
+        if (error) *error = frtError;
         MSID_LOG_WITH_CTX(MSIDLogLevelError, context, @"Error checking FRT enabled status, not using new FRT.");
     }
 
@@ -819,9 +821,11 @@ - (BOOL)validateAndRemoveRefreshToken:(MSIDRefreshToken *)token
                               context:(id<MSIDRequestContext>)context
                                 error:(NSError *__autoreleasing*)error
 {
-    BOOL frtEnabled = [_accountCredentialCache checkFRTEnabled:context error:error] == MSIDIsFRTEnabledStatusEnabled;
-    if (error)
+    NSError *frtError = nil;
+    BOOL frtEnabled = [_accountCredentialCache checkFRTEnabled:context error:&frtError] == MSIDIsFRTEnabledStatusEnabled;
+    if (frtError)
     {
+        if (error) *error = frtError;
         MSID_LOG_WITH_CTX(MSIDLogLevelError, context, @"Error checking FRT enabled status, not using new FRT.");
     }
 
@@ -1003,11 +1007,13 @@ - (BOOL)saveRefreshTokenWithConfiguration:(MSIDConfiguration *)configuration
 
     if (![NSString msidIsStringNilOrBlank:refreshToken.familyId])
     {
+        NSError *frtError = nil;
         // Check if FRT is enabled, this will update the configuration object, and then use it to decide if
         // we should save the token as FRT or legacy RT (with familyId, if it contains that value).
-        BOOL frtEnabled = [_accountCredentialCache checkFRTEnabled:context error:error] == MSIDIsFRTEnabledStatusEnabled;
-        if (error)
+        BOOL frtEnabled = [_accountCredentialCache checkFRTEnabled:context error:&frtError] == MSIDIsFRTEnabledStatusEnabled;
+        if (frtError)
         {
+            if (error) *error = frtError;
             MSID_LOG_WITH_CTX(MSIDLogLevelError, context, @"Error checking FRT enabled status, not saving as new FRT.");
         }
 
@@ -1285,9 +1291,11 @@ - (BOOL)saveAccount:(MSIDAccount *)account
                                                   context:(id<MSIDRequestContext>)context
                                                     error:(NSError *__autoreleasing*)error
 {
-    BOOL frtEnabled = [_accountCredentialCache checkFRTEnabled:context error:error] == MSIDIsFRTEnabledStatusEnabled;
-    if (error)
+    NSError *frtError = nil;
+    BOOL frtEnabled = [_accountCredentialCache checkFRTEnabled:context error:&frtError] == MSIDIsFRTEnabledStatusEnabled;
+    if (frtError)
     {
+        if (error) *error = frtError;
         MSID_LOG_WITH_CTX(MSIDLogLevelError, context, @"Error checking FRT enabled status, not using new FRT.");
     }