Jennyf/merge from master

src/Microsoft.Identity.Web.UI/Areas/MicrosoftIdentity/Controllers/AccountController.cs

@@ -66,7 +66,7 @@ public IActionResult Challenge(
             string claims)
         {
             string scheme = OpenIdConnectDefaults.AuthenticationScheme;
-            Dictionary<string, string> properties = new Dictionary<string, string>
+            Dictionary<string, string?> properties = new Dictionary<string, string?>
             {
                 { Constants.Scope, scope },
                 { Constants.LoginHint, loginHint },

src/Microsoft.Identity.Web/Constants/IDWebErrorMessage.cs

@@ -8,8 +8,8 @@ namespace Microsoft.Identity.Web
     /// </summary>
     internal static class IDWebErrorMessage
     {
-        // General
-        // public const string IDW10000 = "IDW10000:";
+        // General IDW10000 = "IDW10000:"
+        public const string HttpContextIsNull = "IDW10000: HttpContext is null. ";
 
         // Configuration IDW10100 = "IDW10100:"
         public const string ProvideEitherScopeKeySectionOrScopes = "IDW10101: Either provide the '{0}' or the '{1}' to the 'AuthorizeForScopes'. ";

src/Microsoft.Identity.Web/MicrosoftIdentityCircuitHandler.cs

@@ -15,12 +15,12 @@
 namespace Microsoft.Identity.Web
 {
     /// <summary>
-    /// Extensions for IServiceCollection for startup initialization of web APIs.
+    /// Extensions for IServerSideBlazorBuilder for startup initialization of web APIs.
     /// </summary>
     public static class MicrosoftIdentityBlazorServiceCollectionExtensions
     {
         /// <summary>
-        /// Add the incremental consent and conditional access handler for blazor
+        /// Add the incremental consent and conditional access handler for Blazor
         /// server side pages.
         /// </summary>
         /// <param name="builder">Service side blazor builder.</param>
@@ -55,10 +55,10 @@ public class MicrosoftIdentityConsentAndConditionalAccessHandler
         /// <summary>
         /// Current user.
         /// </summary>
-        public ClaimsPrincipal User { get; internal set; }
+        public ClaimsPrincipal User { get; internal set; } = null!;
 
         /// <summary>
-        /// Base uri to use in forming the redirect.
+        /// Base URI to use in forming the redirect.
         /// </summary>
         public string? BaseUri { get; internal set; }
 
@@ -88,13 +88,13 @@ public void HandleException(Exception exception)
                     User);
 
                 string redirectUri = NavigationManager.Uri;
-                List<string> scope = properties.Parameters.ContainsKey(Constants.Scope) ? (List<string>)properties.Parameters[Constants.Scope] : new List<string>();
-                string loginHint = properties.Parameters.ContainsKey(Constants.LoginHint) ? (string)properties.Parameters[Constants.LoginHint] : string.Empty;
-                string domainHint = properties.Parameters.ContainsKey(Constants.DomainHint) ? (string)properties.Parameters[Constants.DomainHint] : string.Empty;
-                string claims = properties.Parameters.ContainsKey(Constants.Claims) ? (string)properties.Parameters[Constants.Claims] : string.Empty;
+                List<string> scope = properties.Parameters.ContainsKey(Constants.Scope) ? (List<string>)properties.Parameters[Constants.Scope]! : new List<string>();
+                string loginHint = properties.Parameters.ContainsKey(Constants.LoginHint) ? (string)properties.Parameters[Constants.LoginHint]! : string.Empty;
+                string domainHint = properties.Parameters.ContainsKey(Constants.DomainHint) ? (string)properties.Parameters[Constants.DomainHint]! : string.Empty;
+                string claims = properties.Parameters.ContainsKey(Constants.Claims) ? (string)properties.Parameters[Constants.Claims]! : string.Empty;
                 string url = $"{NavigationManager.BaseUri}{Constants.BlazorChallengeUri}{redirectUri}"
-                + $"&{Constants.Scope}={string.Join(" ", scope)}&{Constants.LoginHint}={loginHint}"
-                + $"&{Constants.DomainHint}={domainHint}&{Constants.Claims}={claims}";
+                    + $"&{Constants.Scope}={string.Join(" ", scope!)}&{Constants.LoginHint}={loginHint}"
+                    + $"&{Constants.DomainHint}={domainHint}&{Constants.Claims}={claims}";
 
                 NavigationManager.NavigateTo(url, true);
             }
@@ -104,9 +104,7 @@ public void HandleException(Exception exception)
             }
         }
 
-#pragma warning disable CS8618 // Non-nullable field is uninitialized. Consider declaring as nullable.
-        internal NavigationManager NavigationManager { get; set; }
-#pragma warning restore CS8618 // Non-nullable field is uninitialized. Consider declaring as nullable.
+        internal NavigationManager NavigationManager { get; set; } = null!;
     }
 
 #pragma warning disable SA1402 // File may only contain a single type

src/Microsoft.Identity.Web/Resource/AadIssuerValidator.cs

@@ -17,7 +17,7 @@ namespace Microsoft.Identity.Web.Resource
     /// <summary>
     /// Generic class that validates token issuer from the provided Azure AD authority.
     /// </summary>
-    internal class AadIssuerValidator
+    public class AadIssuerValidator
     {
         // TODO: separate AadIssuerValidator creation logic from the validation logic in order to unit test it
         private static readonly IDictionary<string, AadIssuerValidator> s_issuerValidators = new ConcurrentDictionary<string, AadIssuerValidator>();
@@ -70,7 +70,7 @@ public static AadIssuerValidator GetIssuerValidator(string aadAuthority)
         }
 
         /// <summary>
-        /// Validate the issuer for multi-tenant applications of various audience (Work and School account, or Work and School accounts +
+        /// Validate the issuer for multi-tenant applications of various audiences (Work and School accounts, or Work and School accounts +
         /// Personal accounts).
         /// </summary>
         /// <param name="actualIssuer">Issuer to validate (will be tenanted).</param>
@@ -83,7 +83,7 @@ public static AadIssuerValidator GetIssuerValidator(string aadAuthority)
         /// <returns>The <c>issuer</c> if it's valid, or otherwise <c>SecurityTokenInvalidIssuerException</c> is thrown.</returns>
         /// <exception cref="ArgumentNullException"> if <paramref name="securityToken"/> is null.</exception>
         /// <exception cref="ArgumentNullException"> if <paramref name="validationParameters"/> is null.</exception>
-        /// <exception cref="SecurityTokenInvalidIssuerException">if the issuer. </exception>
+        /// <exception cref="SecurityTokenInvalidIssuerException">if the issuer is invalid. </exception>
         public string Validate(string actualIssuer, SecurityToken securityToken, TokenValidationParameters validationParameters)
         {
             if (string.IsNullOrEmpty(actualIssuer))
@@ -169,7 +169,7 @@ private static bool IsValidTidInLocalPath(string tenantId, Uri uri)
 
         /// <summary>Gets the tenant ID from a token.</summary>
         /// <param name="securityToken">A JWT token.</param>
-        /// <returns>A string containing tenant ID, if found or <see cref="string.Empty"/>.</returns>
+        /// <returns>A string containing the tenant ID, if found or <see cref="string.Empty"/>.</returns>
         /// <remarks>Only <see cref="JwtSecurityToken"/> and <see cref="JsonWebToken"/> are acceptable types.</remarks>
         private static string GetTenantIdFromToken(SecurityToken securityToken)
         {

src/Microsoft.Identity.Web/ServiceCollectionExtensions.cs

@@ -61,12 +61,12 @@ public static IServiceCollection AddTokenAcquisition(
             if (isTokenAcquisitionSingleton)
             {
                 services.AddSingleton<ITokenAcquisition, TokenAcquisition>();
-                services.AddSingleton<ITokenAcquisitionInternal>(s => (ITokenAcquisitionInternal)s.GetService<ITokenAcquisition>());
+                services.AddSingleton<ITokenAcquisitionInternal>(s => (ITokenAcquisitionInternal)s.GetRequiredService<ITokenAcquisition>());
             }
             else
             {
                 services.AddScoped<ITokenAcquisition, TokenAcquisition>();
-                services.AddScoped<ITokenAcquisitionInternal>(s => (ITokenAcquisitionInternal)s.GetService<ITokenAcquisition>());
+                services.AddScoped<ITokenAcquisitionInternal>(s => (ITokenAcquisitionInternal)s.GetRequiredService<ITokenAcquisition>());
             }
 
             return services;

src/Microsoft.Identity.Web/TokenAcquisition.cs

@@ -36,7 +36,7 @@ internal class TokenAcquisition : ITokenAcquisition, ITokenAcquisitionInternal
 
         private IConfidentialClientApplication? _application;
         private readonly IHttpContextAccessor _httpContextAccessor;
-        private HttpContext CurrentHttpContext => _httpContextAccessor.HttpContext;
+        private HttpContext? CurrentHttpContext => _httpContextAccessor.HttpContext;
         private readonly IMsalHttpClientFactory _httpClientFactory;
         private readonly ILogger _logger;
         private readonly IServiceProvider _serviceProvider;
@@ -127,7 +127,7 @@ public async Task AddAccountToCacheFromAuthorizationCodeAsync(
 
             try
             {
-                string? userFlow = context.Principal?.Claims?.FirstOrDefault(c => c.Type == ClaimConstants.UserFlow)?.Value;
+                string? userFlow = context.Principal?.GetUserFlowId();
                 _application = await GetOrBuildConfidentialClientApplicationAsync().ConfigureAwait(false);
 
                 // Do not share the access token with ASP.NET Core otherwise ASP.NET will cache it and will not send the OAuth 2.0 request in