[v5] Add skipBrokerClaims parameter for brokered authentication flows

[Copilot]

Migrates PR #8409 from v4-lts to dev. Adds skipBrokerClaims request parameter to exclude broker's clientCapabilities from claims in brokered authentication flows—embedded apps should not inherit parent app capabilities.

Changes

• BaseAuthRequest: Add skipBrokerClaims?: boolean property
• RequestParameterBuilder.addClaims(): Extended with optional skipBrokerClaims parameter to skip clientCapabilities only when both skipBrokerClaims=true AND BROKER_CLIENT_ID is present
• Authorize.ts, AuthorizationCodeClient.ts, RefreshTokenClient.ts: Move claims handling after broker params are set; pass skipBrokerClaims to addClaims() function
• Tests: 18 new test cases (12 across the three caller files + 6 for the addClaims skipBrokerClaims behavior) covering all behavior combinations
• Docs: Update request-response-object.md with parameter documentation

Usage

const request = {
    scopes: ["User.Read"],
    embeddedClientId: "child-app-client-id",
    skipBrokerClaims: true, // Excludes broker's clientCapabilities from claims
};

const response = await msalInstance.acquireTokenSilent(request);

Behavior Matrix

skipBrokerClaims	embeddedClientId set	clientCapabilities in claims
false/unset	Yes	✅ Included
false/unset	No	✅ Included
true	No	✅ Included
true	Yes	❌ Excluded

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Adds a new skipBrokerClaims request flag to support embedded/brokered scenarios where the child app should not inherit the broker (parent) app’s configured clientCapabilities in outgoing claims.

Changes:

• Add skipBrokerClaims?: boolean to BaseAuthRequest and update the API review file.
• Update /authorize and /token request-building logic to conditionally omit config-driven clientCapabilities from claims when broker params are present.
• Add unit tests covering the 4 combinations of {skipBrokerClaims} x {brokered flow} and document the new request parameter in msal-browser docs.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
package-lock.json	Large lockfile regeneration/churn included alongside the feature work.
lib/msal-common/test/protocol/Authorize.spec.ts	Adds tests validating claims behavior for brokered vs non-brokered authorize requests.
lib/msal-common/test/client/RefreshTokenClient.spec.ts	Adds tests validating token request body claims behavior for refresh token flow.
lib/msal-common/test/client/AuthorizationCodeClient.spec.ts	Adds tests validating token request body claims behavior for auth code flow.
lib/msal-common/src/request/BaseAuthRequest.ts	Introduces skipBrokerClaims on the common request shape.
lib/msal-common/src/protocol/Authorize.ts	Moves/adjusts claims building to happen after broker params are applied and conditionally omits config capabilities.
lib/msal-common/src/client/RefreshTokenClient.ts	Adjusts token request parameter construction to conditionally omit config capabilities in brokered flows.
lib/msal-common/src/client/AuthorizationCodeClient.ts	Adjusts token request parameter construction to conditionally omit config capabilities in brokered flows.
lib/msal-common/apiReview/msal-common.api.md	Updates the public API surface snapshot to include skipBrokerClaims.
lib/msal-browser/docs/request-response-object.md	Documents skipBrokerClaims and its behavior matrix for brokered requests.
change/@azure-msal-common-1773335883.json	Adds the Beachball changefile for the msal-common change.

[Copilot]

This PR’s changefile comment does not follow the repo’s Beachball template (Markdown link to the PR, e.g. ... [#XXXX](https://github.com/.../pull/XXXX)). Please update the comment field to use the standard format so changelogs are consistent.

[sameerag]

@copilot apply changes based on this feedback

[Copilot]

Updated the changefile comment to follow the standard Beachball template format with the PR link at the end: Add skipBrokerClaims parameter for brokered authentication flows [#8419](...) (4f2e1bf)

[sameerag]

@copilot update apiExtractor for msal-common

[Copilot]

@copilot update apiExtractor for msal-common

Updated the msal-common API review file with the new addClaims signature that includes the skipBrokerClaims parameter. (01d7abf)

[sameerag]

@copilot format check is failing for msal-common, Can you please fix it? Please also run unit tests before checking in.

[Copilot]

@copilot format check is failing for msal-common, Can you please fix it? Please also run unit tests before checking in.

Fixed the formatting issue in RequestParameterBuilder.spec.ts and verified all 944 unit tests pass. (e59fc82)