@api-client/core 0.9.25 → 0.10.0

package/build/cjs/src/authorization/OAuth2Authorization.js

@@ -0,0 +1,992 @@
+"use strict";
+/* eslint-disable no-param-reassign */
+/* eslint-disable class-methods-use-this */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2Authorization = exports.grantResponseMapping = exports.tokenInfoFromParams = exports.codeVerifierValue = exports.handleTokenCodeError = exports.createErrorParams = exports.authorizeTokenNonInteractive = exports.authorizePopup = exports.reportOAuthError = exports.frameTimeoutHandler = exports.codeValue = exports.computeExpires = exports.computeTokenInfoScopes = exports.handleTokenInfo = exports.processPopupRawData = exports.iframeValue = exports.messageHandler = exports.tokenResponse = exports.popupUnloadHandler = exports.popupValue = exports.authorizeJwt = exports.authorizeDeviceCode = exports.authorizeCustomGrant = exports.authorizePassword = exports.authorizeClientCredentials = exports.authorizeImplicitCode = exports.stateValue = exports.authorize = exports.prepareOptions = exports.prepareSettings = exports.optionsValue = exports.settingsValue = exports.rejectFunction = exports.resolveFunction = void 0;
+const Utils_js_1 = require("./Utils.js");
+const CustomParameters_js_1 = require("./CustomParameters.js");
+const AuthorizationError_js_1 = require("./AuthorizationError.js");
+const IframeAuthorization_js_1 = require("./lib/IframeAuthorization.js");
+const PopupAuthorization_js_1 = require("./lib/PopupAuthorization.js");
+const KnownGrants = __importStar(require("./lib/KnownGrants.js"));
+exports.resolveFunction = Symbol('resolveFunction');
+exports.rejectFunction = Symbol('rejectFunction');
+exports.settingsValue = Symbol('settingsValue');
+exports.optionsValue = Symbol('optionsValue');
+exports.prepareSettings = Symbol('prepareSettings');
+exports.prepareOptions = Symbol('prepareOptions');
+exports.authorize = Symbol('authorize');
+exports.stateValue = Symbol('stateValue');
+exports.authorizeImplicitCode = Symbol('authorizeImplicitCode');
+exports.authorizeClientCredentials = Symbol('authorizeClientCredentials');
+exports.authorizePassword = Symbol('authorizePassword');
+exports.authorizeCustomGrant = Symbol('authorizeCustomGrant');
+exports.authorizeDeviceCode = Symbol('authorizeDeviceCode');
+exports.authorizeJwt = Symbol('authorizeJwt');
+exports.popupValue = Symbol('popupValue');
+exports.popupUnloadHandler = Symbol('popupUnloadHandler');
+exports.tokenResponse = Symbol('tokenResponse');
+exports.messageHandler = Symbol('messageHandler');
+exports.iframeValue = Symbol('iframeValue');
+exports.processPopupRawData = Symbol('processPopupRawData');
+exports.handleTokenInfo = Symbol('handleTokenInfo');
+exports.computeTokenInfoScopes = Symbol('computeTokenInfoScopes');
+exports.computeExpires = Symbol('computeExpires');
+exports.codeValue = Symbol('codeValue');
+exports.frameTimeoutHandler = Symbol('frameTimeoutHandler');
+exports.reportOAuthError = Symbol('reportOAuthError');
+exports.authorizePopup = Symbol('authorizePopup');
+exports.authorizeTokenNonInteractive = Symbol('authorizeTokenNonInteractive');
+exports.createErrorParams = Symbol('createErrorParams');
+exports.handleTokenCodeError = Symbol('handleTokenCodeError');
+exports.codeVerifierValue = Symbol('codeVerifierValue');
+exports.tokenInfoFromParams = Symbol('tokenInfoFromParams');
+exports.grantResponseMapping = {
+    implicit: 'token',
+    authorization_code: 'code',
+};
+/**
+ * A library that performs OAuth 2 authorization.
+ *
+ * It is build for API components ecosystem and the configuration is defined in `@advanced-rest-client/events`
+ * so all components use the same configuration.
+ */
+class OAuth2Authorization {
+    [exports.settingsValue];
+    /**
+     * @returns The authorization settings used to initialize this class.
+     */
+    get settings() {
+        return this[exports.settingsValue];
+    }
+    [exports.optionsValue];
+    /**
+     * @returns The processing options used to initialize this object.
+     */
+    get options() {
+        return this[exports.optionsValue];
+    }
+    [exports.stateValue];
+    /**
+     * @returns The request state parameter. If the state is not passed with the configuration one is generated.
+     */
+    get state() {
+        if (!this[exports.stateValue]) {
+            this[exports.stateValue] = this.settings.state || (0, Utils_js_1.randomString)();
+        }
+        return this[exports.stateValue];
+    }
+    /**
+     * @type The main resolve function
+     */
+    [exports.resolveFunction];
+    /**
+     * @type The main reject function
+     */
+    [exports.rejectFunction];
+    [exports.codeVerifierValue];
+    [exports.popupValue];
+    [exports.iframeValue];
+    [exports.tokenResponse];
+    [exports.codeValue];
+    /**
+     * @param {OAuth2Settings} settings The authorization configuration.
+     * @param {OauthProcessingOptions=} options Additional processing options to configure the behavior of this library.
+     */
+    constructor(settings, options = {}) {
+        if (!settings) {
+            throw new TypeError('Expected one argument.');
+        }
+        this[exports.settingsValue] = this[exports.prepareSettings](settings);
+        this[exports.optionsValue] = this[exports.prepareOptions](options);
+        this[exports.messageHandler] = this[exports.messageHandler].bind(this);
+        this[exports.frameTimeoutHandler] = this[exports.frameTimeoutHandler].bind(this);
+        this[exports.popupUnloadHandler] = this[exports.popupUnloadHandler].bind(this);
+    }
+    /**
+     * @param settings
+     * @returns Processed settings
+     */
+    [exports.prepareSettings](settings) {
+        const copy = { ...settings };
+        Object.freeze(copy);
+        return copy;
+    }
+    /**
+     * @param options
+     * @returns Processed options
+     */
+    [exports.prepareOptions](options) {
+        const copy = {
+            popupPullTimeout: 50,
+            messageTarget: window,
+            ...options,
+        };
+        Object.freeze(copy);
+        return copy;
+    }
+    /**
+     * A function that should be called before the authorization.
+     * It checks configuration integrity, and performs some sanity checks
+     * like proper values of the request URIs.
+     */
+    checkConfig() {
+        // @todo(pawel): perform settings integrity tests.
+        (0, Utils_js_1.sanityCheck)(this.settings);
+    }
+    /**
+     * Performs the authorization.
+     * @returns Promise resolved to the token info.
+     */
+    authorize() {
+        return new Promise((resolve, reject) => {
+            this[exports.resolveFunction] = resolve;
+            this[exports.rejectFunction] = reject;
+            this[exports.authorize]();
+        });
+    }
+    /**
+     * Reports authorization error back to the application.
+     *
+     * This operation clears the promise object.
+     *
+     * @param message The message to report
+     * @param code Error code
+     */
+    [exports.reportOAuthError](message, code) {
+        this.clearObservers();
+        if (!this[exports.rejectFunction]) {
+            return;
+        }
+        const interactive = typeof this.settings.interactive === 'boolean' ? this.settings.interactive : true;
+        const e = new AuthorizationError_js_1.AuthorizationError(message, code, this.state, interactive);
+        this[exports.rejectFunction](e);
+        this[exports.rejectFunction] = undefined;
+        this[exports.resolveFunction] = undefined;
+    }
+    /**
+     * Starts the authorization process.
+     */
+    // eslint-disable-next-line @typescript-eslint/adjacent-overload-signatures
+    [exports.authorize]() {
+        const { settings } = this;
+        switch (settings.grantType) {
+            case KnownGrants.implicit:
+            case KnownGrants.code:
+                this[exports.authorizeImplicitCode]();
+                break;
+            case KnownGrants.clientCredentials:
+                this[exports.authorizeClientCredentials]();
+                break;
+            case KnownGrants.password:
+                this[exports.authorizePassword]();
+                break;
+            case KnownGrants.deviceCode:
+                this[exports.authorizeDeviceCode]();
+                break;
+            case KnownGrants.jwtBearer:
+                this[exports.authorizeJwt]();
+                break;
+            default:
+                this[exports.authorizeCustomGrant]();
+        }
+    }
+    /**
+     * Starts the authorization flow for the `implicit` and `authorization_code` flows.
+     * If the `interactive` flag is configured it  then it chooses between showing the UI (popup)
+     * or non-interactive iframe.
+     */
+    async [exports.authorizeImplicitCode]() {
+        const { settings } = this;
+        const url = await this.constructPopupUrl();
+        try {
+            if (!url) {
+                throw new Error(`Unable to construct the authorization URL.`);
+            }
+            if (settings.interactive === false) {
+                this[exports.authorizeTokenNonInteractive](url);
+            }
+            else {
+                this[exports.authorizePopup](url);
+            }
+            this.options.messageTarget?.addEventListener('message', this[exports.messageHandler]);
+        }
+        catch (e) {
+            this[exports.rejectFunction](e);
+            this[exports.rejectFunction] = undefined;
+            this[exports.resolveFunction] = undefined;
+        }
+    }
+    /**
+     * Constructs the popup/iframe URL for the `implicit` or `authorization_code` grant types.
+     * @return Full URL for the endpoint.
+     */
+    async constructPopupUrl() {
+        const url = await this.buildPopupUrlParams();
+        if (!url) {
+            return null;
+        }
+        return url.toString();
+    }
+    /**
+     * @returns The parameters to build popup URL.
+     */
+    async buildPopupUrlParams() {
+        const { settings } = this;
+        const type = (settings.responseType || exports.grantResponseMapping[settings.grantType]);
+        if (!type) {
+            return null;
+        }
+        const url = new URL(settings.authorizationUri);
+        url.searchParams.set('response_type', type);
+        url.searchParams.set('client_id', settings.clientId);
+        // Client secret cannot be ever exposed to the client (browser)!
+        // if (settings.clientSecret) {
+        //   url.searchParams.set('client_secret', settings.clientSecret);
+        // }
+        url.searchParams.set('state', this.state);
+        if (settings.redirectUri) {
+            url.searchParams.set('redirect_uri', settings.redirectUri);
+        }
+        const { scopes } = settings;
+        if (Array.isArray(scopes) && scopes.length) {
+            url.searchParams.set('scope', scopes.join(' '));
+        }
+        if (settings.includeGrantedScopes) {
+            // this is Google specific
+            url.searchParams.set('include_granted_scopes', 'true');
+        }
+        if (settings.loginHint) {
+            // this is Google specific
+            url.searchParams.set('login_hint', settings.loginHint);
+        }
+        if (settings.interactive === false) {
+            // this is Google specific
+            url.searchParams.set('prompt', 'none');
+        }
+        if (settings.pkce && String(type).includes('code')) {
+            this[exports.codeVerifierValue] = (0, Utils_js_1.randomString)();
+            const challenge = await (0, Utils_js_1.generateCodeChallenge)(this[exports.codeVerifierValue]);
+            url.searchParams.set('code_challenge', challenge);
+            url.searchParams.set('code_challenge_method', 'S256');
+        }
+        // custom query parameters from the `api-authorization-method` component
+        if (settings.customData) {
+            const cs = settings.customData.auth;
+            if (cs) {
+                (0, CustomParameters_js_1.applyCustomSettingsQuery)(url, cs);
+            }
+        }
+        return url;
+    }
+    /**
+     * Opens a popup to request authorization from the user.
+     * @param url The URL to open.
+     */
+    [exports.authorizePopup](url) {
+        const popup = new PopupAuthorization_js_1.PopupAuthorization(this.options.popupPullTimeout);
+        try {
+            popup.load(url);
+        }
+        catch (e) {
+            const cause = e;
+            throw new AuthorizationError_js_1.AuthorizationError(cause.message, 'popup_blocked', this.state, this.settings.interactive || false);
+        }
+        popup.addEventListener('close', this[exports.popupUnloadHandler]);
+        this[exports.popupValue] = popup;
+    }
+    /**
+     * Tries to authorize the user in a non interactive way (iframe rather than a popup).
+     *
+     * This method always result in a success response. When there's an error or
+     * user is not logged in then the response won't contain auth token info.
+     *
+     * @param url Complete authorization url
+     */
+    [exports.authorizeTokenNonInteractive](url) {
+        const iframe = new IframeAuthorization_js_1.IframeAuthorization(this.options.iframeTimeout);
+        iframe.addEventListener('timeout', this[exports.frameTimeoutHandler]);
+        iframe.load(url);
+        this[exports.iframeValue] = iframe;
+    }
+    /**
+     * Event handler for the the iframe timeout event.
+     * If there's the reject function then it is called with the error details.
+     */
+    [exports.frameTimeoutHandler]() {
+        if (!this[exports.rejectFunction]) {
+            return;
+        }
+        const e = new AuthorizationError_js_1.AuthorizationError('Non-interactive authorization failed.', 'iframe_load_error', this.state, false);
+        this[exports.rejectFunction](e);
+        this[exports.rejectFunction] = undefined;
+        this[exports.resolveFunction] = undefined;
+    }
+    /**
+     * Clears all registered observers:
+     * - popup/iframe message listeners
+     * - popup info pull interval
+     */
+    clearObservers() {
+        this.options.messageTarget?.removeEventListener('message', this[exports.messageHandler]);
+        if (this[exports.popupValue]) {
+            this[exports.popupValue].cleanUp();
+            this[exports.popupValue] = undefined;
+        }
+        if (this[exports.iframeValue]) {
+            this[exports.iframeValue].cancel();
+            this[exports.iframeValue].cleanUp();
+            this[exports.iframeValue] = undefined;
+        }
+    }
+    /**
+     * This is called when the popup info pull interval detects that the window was closed.
+     * It checks whether the token info has been set by the redirect page and if not then it reports an error.
+     */
+    [exports.popupUnloadHandler]() {
+        if (this[exports.tokenResponse] || (this.settings.grantType === 'authorization_code' && this[exports.codeValue])) {
+            // everything seems to be ok.
+            return;
+        }
+        if (!this[exports.rejectFunction]) {
+            // someone already called it.
+            return;
+        }
+        this[exports.reportOAuthError]('No response has been recorded.', 'no_response');
+    }
+    /**
+     * A handler for the `message` event registered when performing authorization that involves the popup
+     * of the iframe.
+     */
+    [exports.messageHandler](e) {
+        const popup = this[exports.popupValue];
+        const iframe = this[exports.iframeValue];
+        if (!popup && !iframe) {
+            return;
+        }
+        this[exports.processPopupRawData](e.data);
+    }
+    /**
+     * @param {any} raw The data from the `MessageEvent`. Might not be the data returned by the auth popup/iframe.
+     */
+    [exports.processPopupRawData](raw) {
+        if (!raw) {
+            return;
+        }
+        let params;
+        try {
+            params = new URLSearchParams(raw);
+        }
+        catch (e) {
+            this[exports.reportOAuthError]('Invalid response from the redirect page', 'invalid_redirect');
+            return;
+        }
+        if (this.validateTokenResponse(params)) {
+            this.processTokenResponse(params);
+        }
+        else {
+            // eslint-disable-next-line no-console
+            console.warn('Unprocessable authorization response', raw);
+        }
+    }
+    /**
+     * @param {URLSearchParams} params The instance of search params with the response from the auth dialog.
+     * @returns {boolean} true when the params qualify as an authorization popup redirect response.
+     */
+    validateTokenResponse(params) {
+        const oauthParams = [
+            'state',
+            'error',
+            'access_token',
+            'code',
+        ];
+        return oauthParams.some(name => params.has(name));
+    }
+    /**
+     * Processes the response returned by the popup or the iframe.
+     */
+    async processTokenResponse(oauthParams) {
+        this.clearObservers();
+        const state = oauthParams.get('state');
+        if (!state) {
+            this[exports.reportOAuthError]('Server did not return the state parameter.', 'no_state');
+            return;
+        }
+        if (state !== this.state) {
+            // The authorization class (this) is created per token request so this can only have one state.
+            // When the app requests for more tokens at the same time is should create multiple instances of this.
+            this[exports.reportOAuthError]('The state value returned by the authorization server is invalid.', 'invalid_state');
+            return;
+        }
+        if (oauthParams.has('error')) {
+            const args = this.createTokenResponseError(oauthParams);
+            this[exports.reportOAuthError](...args);
+            return;
+        }
+        const { grantType, responseType } = this.settings;
+        if (grantType === 'implicit' || responseType === 'id_token') {
+            this[exports.handleTokenInfo](this[exports.tokenInfoFromParams](oauthParams));
+            return;
+        }
+        if (grantType === 'authorization_code') {
+            const code = oauthParams.get('code');
+            if (!code) {
+                this[exports.reportOAuthError]('The authorization server did not returned the authorization code.', 'no_code');
+                return;
+            }
+            this[exports.codeValue] = code;
+            let tokenInfo;
+            try {
+                tokenInfo = await this.exchangeCode(code);
+            }
+            catch (e) {
+                this[exports.handleTokenCodeError](e);
+                return;
+            }
+            this[exports.handleTokenInfo](tokenInfo);
+            return;
+        }
+        this[exports.reportOAuthError]('The authorization process has an invalid state. This should never happen.', 'unknown_state');
+    }
+    /**
+     * Processes the response returned by the popup or the iframe.
+     * @returns Parameters for the [reportOAuthError]() function
+     */
+    createTokenResponseError(oauthParams) {
+        const code = oauthParams.get('error');
+        const message = oauthParams.get('error_description');
+        return this[exports.createErrorParams](code, message);
+    }
+    /**
+     * Creates arguments for the error function from error response
+     * @param code Returned from the authorization server error code
+     * @param description Returned from the authorization server error description
+     * @returns Parameters for the [reportOAuthError]() function
+     */
+    [exports.createErrorParams](code, description) {
+        let message;
+        if (description) {
+            message = description;
+        }
+        else {
+            switch (code) {
+                case 'interaction_required':
+                    message = 'The request requires user interaction.';
+                    break;
+                case 'invalid_request':
+                    message = 'The request is missing a required parameter.';
+                    break;
+                case 'invalid_client':
+                    message = 'Client authentication failed.';
+                    break;
+                case 'invalid_grant':
+                    message = 'The provided authorization grant or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.';
+                    break;
+                case 'unauthorized_client':
+                    message = 'The authenticated client is not authorized to use this authorization grant type.';
+                    break;
+                case 'unsupported_grant_type':
+                    message = 'The authorization grant type is not supported by the authorization server.';
+                    break;
+                case 'invalid_scope':
+                    message = 'The requested scope is invalid, unknown, malformed, or exceeds the scope granted by the resource owner.';
+                    break;
+                default:
+                    message = 'Unknown error';
+            }
+        }
+        return [message, code];
+    }
+    /**
+     * Creates a token info object from query parameters
+     */
+    [exports.tokenInfoFromParams](oauthParams) {
+        const accessToken = oauthParams.get('access_token');
+        const idToken = oauthParams.get('id_token');
+        const refreshToken = oauthParams.get('refresh_token');
+        const tokenType = oauthParams.get('token_type');
+        const expiresIn = Number(oauthParams.get('expires_in'));
+        const scope = this[exports.computeTokenInfoScopes](oauthParams.get('scope'));
+        const tokenInfo = {
+            accessToken,
+            // FIXME: This should be set in the OIDC class.
+            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+            // @ts-ignore
+            idToken,
+            refreshToken,
+            tokenType,
+            expiresIn,
+            state: oauthParams.get('state'),
+            scope,
+            expiresAt: 0,
+            expiresAssumed: false,
+        };
+        return this[exports.computeExpires](tokenInfo);
+    }
+    /**
+     * Processes token info object when it's ready.
+     *
+     * @param info Token info returned from the server.
+     */
+    [exports.handleTokenInfo](info) {
+        this[exports.tokenResponse] = info;
+        if (this[exports.resolveFunction]) {
+            this[exports.resolveFunction](info);
+        }
+        this[exports.rejectFunction] = undefined;
+        this[exports.resolveFunction] = undefined;
+    }
+    /**
+     * Computes token expiration time.
+     * It sets `expires_at` property on the token info object which is the time
+     * in the future when when the token expires.
+     *
+     * @param tokenInfo Token info object
+     * @returns A copy with updated properties.
+     */
+    [exports.computeExpires](tokenInfo) {
+        const copy = { ...tokenInfo };
+        let { expiresIn } = copy;
+        if (!expiresIn || Number.isNaN(expiresIn)) {
+            expiresIn = 3600;
+            copy.expiresAssumed = true;
+        }
+        copy.expiresIn = expiresIn;
+        const expiresAt = Date.now() + (expiresIn * 1000);
+        copy.expiresAt = expiresAt;
+        return copy;
+    }
+    /**
+     * Computes the final list of granted scopes.
+     * It is a list of scopes received in the response or the list of requested scopes.
+     * Because the user may change the list of scopes during the authorization process
+     * the received list of scopes can be different than the one requested by the user.
+     *
+     * @param scope The `scope` parameter received with the response. It's null safe.
+     * @returns The list of scopes for the token.
+     */
+    [exports.computeTokenInfoScopes](scope) {
+        const requestedScopes = this.settings.scopes;
+        if (!scope && requestedScopes) {
+            return requestedScopes;
+        }
+        let listScopes = [];
+        if (scope) {
+            listScopes = scope.split(' ');
+        }
+        return listScopes;
+    }
+    /**
+     * Exchanges the authorization code for authorization token.
+     *
+     * @param code Returned code from the authorization endpoint.
+     * @returns The response from the server.
+     */
+    async getCodeInfo(code) {
+        const body = this.getCodeRequestBody(code);
+        const url = this.settings.accessTokenUri;
+        return this.requestTokenInfo(url, body);
+    }
+    /**
+     * Requests for token from the authorization server for `code`, `password`, `client_credentials` and custom grant types.
+     *
+     * @param url Base URI of the endpoint. Custom properties will be applied to the final URL.
+     * @param body Generated body for given type. Custom properties will be applied to the final body.
+     * @param optHeaders Optional headers to add to the request. Applied after custom data.
+     * @returns Promise resolved to the response string.
+     */
+    async requestTokenInfo(url, body, optHeaders) {
+        const urlInstance = new URL(url);
+        const { settings, options } = this;
+        let headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+        };
+        if (settings.customData) {
+            if (settings.customData.token) {
+                (0, CustomParameters_js_1.applyCustomSettingsQuery)(urlInstance, settings.customData.token);
+            }
+            body = (0, CustomParameters_js_1.applyCustomSettingsBody)(body, settings.customData);
+            headers = (0, CustomParameters_js_1.applyCustomSettingsHeaders)(headers, settings.customData);
+        }
+        if (optHeaders) {
+            headers = { ...headers, ...optHeaders };
+        }
+        const init = {
+            headers,
+            body,
+            method: 'POST',
+            cache: 'no-cache',
+        };
+        let authTokenUrl = urlInstance.toString();
+        if (options.tokenProxy) {
+            const suffix = options.tokenProxyEncode ? encodeURIComponent(authTokenUrl) : authTokenUrl;
+            authTokenUrl = `${options.tokenProxy}${suffix}`;
+        }
+        const response = await fetch(authTokenUrl, init);
+        const { status } = response;
+        if (status === 404) {
+            throw new Error('Authorization URI is invalid. Received status 404.');
+        }
+        if (status >= 500) {
+            throw new Error(`Authorization server error. Response code is: ${status}`);
+        }
+        let responseBody;
+        try {
+            responseBody = await response.text();
+        }
+        catch (e) {
+            responseBody = 'No response has been recorded';
+        }
+        if (!responseBody) {
+            throw new Error('Code response body is empty.');
+        }
+        if (status >= 400 && status < 500) {
+            throw new Error(`Client error: ${responseBody}`);
+        }
+        const mime = response.headers.get('content-type') || '';
+        return this.processCodeResponse(responseBody, mime);
+    }
+    /**
+     * Processes body of the code exchange to a map of key value pairs.
+     */
+    processCodeResponse(body, mime = '') {
+        let tokenInfo = {};
+        if (mime.includes('json')) {
+            const info = JSON.parse(body);
+            Object.keys(info).forEach((key) => {
+                let name = key;
+                if (name.includes('_') || name.includes('-')) {
+                    name = (0, Utils_js_1.camel)(name);
+                }
+                if (name) {
+                    tokenInfo[name] = info[key];
+                }
+            });
+        }
+        else {
+            tokenInfo = {};
+            const params = new URLSearchParams(body);
+            params.forEach((value, key) => {
+                let name = key;
+                if (key.includes('_') || key.includes('-')) {
+                    name = (0, Utils_js_1.camel)(key);
+                }
+                if (name) {
+                    tokenInfo[name] = value;
+                }
+            });
+        }
+        return tokenInfo;
+    }
+    /**
+     * @returns The token info when the request was a success.
+     */
+    mapCodeResponse(info) {
+        if (info.error) {
+            throw new AuthorizationError_js_1.CodeError(info.errorDescription, info.error);
+        }
+        const expiresIn = Number(info.expiresIn);
+        const scope = this[exports.computeTokenInfoScopes](info.scope);
+        const result = {
+            ...info,
+            expiresIn,
+            scope,
+            expiresAt: 0,
+            expiresAssumed: false,
+        };
+        return this[exports.computeExpires](result);
+    }
+    /**
+     * Exchanges the authorization code for authorization token.
+     *
+     * @param code Returned code from the authorization endpoint.
+     * @returns The token info when the request was a success.
+     */
+    async exchangeCode(code) {
+        const info = await this.getCodeInfo(code);
+        return this.mapCodeResponse(info);
+    }
+    /**
+     * Returns a body value for the code exchange request.
+     * @param code Authorization code value returned by the authorization server.
+     * @return Request body.
+     */
+    getCodeRequestBody(code) {
+        const { settings } = this;
+        const params = new URLSearchParams();
+        params.set('grant_type', 'authorization_code');
+        params.set('client_id', settings.clientId);
+        if (settings.redirectUri) {
+            params.set('redirect_uri', settings.redirectUri);
+        }
+        params.set('code', code);
+        if (settings.clientSecret) {
+            params.set('client_secret', settings.clientSecret);
+        }
+        else {
+            params.set('client_secret', '');
+        }
+        if (settings.pkce) {
+            params.set('code_verifier', this[exports.codeVerifierValue]);
+        }
+        return params.toString();
+    }
+    /**
+     * A handler for the error that happened during code exchange.
+     */
+    [exports.handleTokenCodeError](e) {
+        if (e instanceof AuthorizationError_js_1.CodeError) {
+            const params = this[exports.createErrorParams](e.code, e.message);
+            this[exports.reportOAuthError](...params);
+        }
+        else {
+            this[exports.reportOAuthError](`Couldn't connect to the server. ${e.message}`, 'request_error');
+        }
+    }
+    /**
+     * Requests a token for `client_credentials` request type.
+     *
+     * This method resolves the main promise set by the `authorize()` function.
+     *
+     * @return Promise resolved to a token info object.
+     */
+    async [exports.authorizeClientCredentials]() {
+        const { settings } = this;
+        const { accessTokenUri, deliveryMethod = 'body', deliveryName = 'authorization' } = settings;
+        const body = this.getClientCredentialsBody();
+        let headers = undefined;
+        const headerTransport = deliveryMethod === 'header';
+        if (headerTransport) {
+            headers = {
+                [deliveryName]: this.getClientCredentialsHeader(settings),
+            };
+        }
+        try {
+            const info = await this.requestTokenInfo(accessTokenUri, body, headers);
+            const tokenInfo = this.mapCodeResponse(info);
+            this[exports.handleTokenInfo](tokenInfo);
+        }
+        catch (cause) {
+            this[exports.handleTokenCodeError](cause);
+        }
+    }
+    /**
+     * Generates a payload message for client credentials.
+     *
+     * @return Message body as defined in OAuth2 spec.
+     */
+    getClientCredentialsBody() {
+        const { settings } = this;
+        const headerTransport = settings.deliveryMethod === 'header';
+        const params = new URLSearchParams();
+        params.set('grant_type', 'client_credentials');
+        if (!headerTransport && settings.clientId) {
+            params.set('client_id', settings.clientId);
+        }
+        if (!headerTransport && settings.clientSecret) {
+            params.set('client_secret', settings.clientSecret);
+        }
+        if (Array.isArray(settings.scopes) && settings.scopes.length) {
+            params.set('scope', settings.scopes.join(' '));
+        }
+        return params.toString();
+    }
+    /**
+     * Builds the authorization header for Client Credentials grant type.
+     * According to the spec the authorization header for this grant type
+     * is the Base64 of `clientId` + `:` + `clientSecret`.
+     *
+     * @param settings The OAuth 2 settings to use
+     */
+    getClientCredentialsHeader(settings) {
+        const { clientId = '', clientSecret = '' } = settings;
+        const hash = btoa(`${clientId}:${clientSecret}`);
+        return `Basic ${hash}`;
+    }
+    /**
+     * Requests a token for `client_credentials` request type.
+     *
+     * This method resolves the main promise set by the `authorize()` function.
+     *
+     * @return Promise resolved to a token info object.
+     */
+    async [exports.authorizePassword]() {
+        const { settings } = this;
+        const url = settings.accessTokenUri;
+        const body = this.getPasswordBody();
+        try {
+            const info = await this.requestTokenInfo(url, body);
+            const tokenInfo = this.mapCodeResponse(info);
+            this[exports.handleTokenInfo](tokenInfo);
+        }
+        catch (cause) {
+            this[exports.handleTokenCodeError](cause);
+        }
+    }
+    /**
+     * Generates a payload message for password authorization.
+     *
+     * @return Message body as defined in OAuth2 spec.
+     */
+    getPasswordBody() {
+        const { settings } = this;
+        const params = new URLSearchParams();
+        params.set('grant_type', 'password');
+        params.set('username', settings.username || '');
+        params.set('password', settings.password || '');
+        if (settings.clientId) {
+            params.set('client_id', settings.clientId);
+        }
+        if (settings.clientSecret) {
+            params.set('client_secret', settings.clientSecret);
+        }
+        if (Array.isArray(settings.scopes) && settings.scopes.length) {
+            params.set('scope', settings.scopes.join(' '));
+        }
+        return params.toString();
+    }
+    /**
+     * Performs authorization on custom grant type.
+     * This extension is described in OAuth 2.0 spec.
+     *
+     * This method resolves the main promise set by the `authorize()` function.
+     *
+     * @return Promise resolved when the request finish.
+     */
+    async [exports.authorizeCustomGrant]() {
+        const { settings } = this;
+        const url = settings.accessTokenUri;
+        const body = this.getCustomGrantBody();
+        try {
+            const info = await this.requestTokenInfo(url, body);
+            const tokenInfo = this.mapCodeResponse(info);
+            this[exports.handleTokenInfo](tokenInfo);
+        }
+        catch (cause) {
+            this[exports.handleTokenCodeError](cause);
+        }
+    }
+    /**
+     * Generates a payload message for the custom grant.
+     *
+     * @returns Message body as defined in OAuth2 spec.
+     */
+    getCustomGrantBody() {
+        const { settings } = this;
+        const params = new URLSearchParams();
+        params.set('grant_type', settings.grantType);
+        if (settings.clientId) {
+            params.set('client_id', settings.clientId);
+        }
+        if (settings.clientSecret) {
+            params.set('client_secret', settings.clientSecret);
+        }
+        if (Array.isArray(settings.scopes) && settings.scopes.length) {
+            params.set('scope', settings.scopes.join(' '));
+        }
+        if (settings.redirectUri) {
+            params.set('redirect_uri', settings.redirectUri);
+        }
+        if (settings.username) {
+            params.set('username', settings.username);
+        }
+        if (settings.password) {
+            params.set('password', settings.password);
+        }
+        return params.toString();
+    }
+    /**
+     * Requests a token for the `urn:ietf:params:oauth:grant-type:device_code` response type.
+     *
+     * @returns Promise resolved to a token info object.
+     */
+    async [exports.authorizeDeviceCode]() {
+        const { settings } = this;
+        const url = settings.accessTokenUri;
+        const body = this.getDeviceCodeBody();
+        try {
+            const info = await this.requestTokenInfo(url, body);
+            const tokenInfo = this.mapCodeResponse(info);
+            this[exports.handleTokenInfo](tokenInfo);
+        }
+        catch (cause) {
+            this[exports.handleTokenCodeError](cause);
+        }
+    }
+    /**
+     * Generates a payload message for the `urn:ietf:params:oauth:grant-type:device_code` authorization.
+     *
+     * @returns Message body as defined in OAuth2 spec.
+     */
+    getDeviceCodeBody() {
+        const { settings } = this;
+        const params = new URLSearchParams();
+        params.set('grant_type', KnownGrants.deviceCode);
+        params.set('device_code', settings.deviceCode || '');
+        if (settings.clientId) {
+            params.set('client_id', settings.clientId);
+        }
+        if (settings.clientSecret) {
+            params.set('client_secret', settings.clientSecret);
+        }
+        return params.toString();
+    }
+    /**
+     * Requests a token for the `urn:ietf:params:oauth:grant-type:jwt-bearer` response type.
+     *
+     * @return Promise resolved to a token info object.
+     */
+    async [exports.authorizeJwt]() {
+        const { settings } = this;
+        const url = settings.accessTokenUri;
+        const body = this.getJwtBody();
+        try {
+            const info = await this.requestTokenInfo(url, body);
+            const tokenInfo = this.mapCodeResponse(info);
+            this[exports.handleTokenInfo](tokenInfo);
+        }
+        catch (cause) {
+            this[exports.handleTokenCodeError](cause);
+        }
+    }
+    /**
+     * Generates a payload message for the `urn:ietf:params:oauth:grant-type:jwt-bearer` authorization.
+     *
+     * @return {string} Message body as defined in OAuth2 spec.
+     */
+    getJwtBody() {
+        const { settings } = this;
+        const params = new URLSearchParams();
+        params.set('grant_type', KnownGrants.jwtBearer);
+        params.set('assertion', settings.assertion || '');
+        if (Array.isArray(settings.scopes) && settings.scopes.length) {
+            params.set('scope', settings.scopes.join(' '));
+        }
+        return params.toString();
+    }
+}
+exports.OAuth2Authorization = OAuth2Authorization;
+//# sourceMappingURL=OAuth2Authorization.js.map