loadExternalTokens bug fixes

[tnorling]

This pull request introduces several important improvements and bug fixes to token caching and authority handling in the browser library. The main changes include more robust handling of authority discovery and preferred cache environments, correct calculation and caching of refresh token expiration, and enhanced test coverage for these scenarios. Additionally, the AccountEntity conversion now ensures tenant profiles are always present, and telemetry fields have been updated to capture new metrics.

Authority and Token Caching Improvements:

• The TokenCache now uses AuthorityFactory.createDiscoveredInstance to resolve the authority and its preferred cache environment, ensuring tokens are always cached under the correct environment. This fixes issues with mismatched environments when using authorities like login.microsoftonline.com, which should use login.windows.net for caching. (lib/msal-browser/src/cache/TokenCache.ts, [1] [2]
• Updated the logic so that when caching tokens, the environment is always taken from the authority's preferred cache, not directly from the request or account. (lib/msal-browser/src/cache/BrowserCacheManager.ts, [1] [2]

Refresh Token Expiration Handling:

• Added logic to calculate and cache the refresh token expiration (expiresOn) based on refresh_token_expires_in from the token response. This value is now passed to the credential and recorded in telemetry. (lib/msal-browser/src/cache/TokenCache.ts, [1] [2]; lib/msal-common/apiReview/msal-common.api.md, [3]

Account Entity Conversion Robustness:

• The AccountEntity.getAccountInfo method now ensures that at least the home tenant profile is present when converting to AccountInfo, preventing missing tenant profile issues. (lib/msal-common/src/cache/entities/AccountEntity.ts, [1] [2]

Test Coverage and Reliability Enhancements:

• Added and updated tests to verify correct refresh token expiration handling, preferred cache environment usage, and tenant profile population. Also removed obsolete tests that no longer match the new authority handling logic. (lib/msal-browser/test/cache/TokenCache.spec.ts, [1] [2] [3]; lib/msal-browser/test/custom_auth/test_resources/TestConstants.ts, [4]
• Improved test setup for account retrieval and coverage of multiple account scenarios. (lib/msal-browser/test/interaction_client/SilentRefreshClient.spec.ts, lib/msal-browser/test/interaction_client/SilentRefreshClient.spec.tsR235-R238)

Telemetry and Miscellaneous:

• Added new telemetry field extRtExpiresOnSeconds to record external refresh token expiration in performance events. (lib/msal-common/apiReview/msal-common.api.md, lib/msal-common/apiReview/msal-common.api.mdR3517)
• Updated TSDoc references and error messages for clarity and accuracy. (lib/msal-common/apiReview/msal-common.api.md, lib/msal-common/apiReview/msal-common.api.mdL4740-R4743)

These changes collectively improve the reliability, correctness, and observability of token caching and authority resolution in the browser library.

[tnorling]

@copilot Please generate changefiles for this PR

[Copilot]

@tnorling I've opened a new pull request, #8243, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

Pull request overview

This PR fixes critical bugs in token caching and authority handling, particularly addressing environment mismatches when using authority aliases (e.g., login.microsoftonline.com vs login.windows.net). The changes ensure tokens are always cached under the correct preferred cache environment and properly handle refresh token expiration.

Changes:

• Authority resolution now uses AuthorityFactory.createDiscoveredInstance to determine the preferred cache environment before caching tokens
• Refresh token expiration is now calculated from refresh_token_expires_in and stored with the credential, with telemetry support via new extRtExpiresOnSeconds field
• AccountEntity conversion ensures home tenant profiles are always present to prevent missing tenant profile issues
• Account lookup in ResponseHandler uses getAllAccounts to find accounts across authority aliases

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
lib/msal-browser/src/cache/TokenCache.ts	Uses AuthorityFactory.createDiscoveredInstance for authority resolution and preferred cache environment; calculates refresh token expiration from response
lib/msal-browser/src/cache/BrowserCacheManager.ts	Removes optional chaining on result.account properties (now guaranteed non-null)
lib/msal-common/src/response/ResponseHandler.ts	Changes account lookup from getAccount to getAllAccounts to find accounts across authority aliases
lib/msal-common/src/cache/entities/AccountEntity.ts	Ensures home tenant profile exists in both getAccountInfo and createFromAccountInfo methods
lib/msal-common/src/telemetry/performance/PerformanceEvent.ts	Adds extRtExpiresOnSeconds telemetry field
lib/msal-browser/test/cache/TokenCache.spec.ts	Adds tests for refresh token expiration, preferred cache environment, and removes obsolete test
lib/msal-common/test/cache/entities/AccountEntity.spec.ts	Updates test to verify home tenant profile creation
lib/msal-common/test/response/ResponseHandler.spec.ts	Adds tests for account lookup with authority aliases
lib/msal-browser/test/interaction_client/SilentRefreshClient.spec.ts	Adds mock for getAllAccounts
lib/msal-browser/test/custom_auth/test_resources/TestConstants.ts	Fixes test account IDs to match CLIENT_INFO
lib/msal-common/apiReview/msal-common.api.md	Updates API surface with new telemetry field and TSDoc line numbers

Comments suppressed due to low confidence (1)

lib/msal-common/test/response/ResponseHandler.spec.ts:1

• The test manually creates a tenant profile array but doesn't verify that AccountEntity.getAccountInfo correctly creates this profile when it's missing. Consider adding a test case where the account entity has no tenant profiles to ensure the new logic in getAccountInfo is tested.

import { ServerAuthorizationTokenResponse } from "../../src/response/ServerAuthorizationTokenResponse.js";