@arcgis/core 4.34.0-next.35 → 4.34.0-next.37

package/graphic/MapNotesGraphicOrigin.d.ts

@@ -0,0 +1,4 @@
+import "../interfaces";
+
+import MapNotesGraphicOrigin = __esri.MapNotesGraphicOrigin;
+export default MapNotesGraphicOrigin;

package/graphic/MapNotesGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+import s from"./GraphicOrigin.js";import{isMapNotesGraphicOriginSymbol as t}from"./isMapNotesGraphicOrigin.js";var r;class i extends s{static{r=t}constructor(s,t){super(),this[r]=!0,this.type="map-notes",this.layer=s,this.sublayer=t}}export{i as default};

package/graphic/OrientedImageryGraphicOrigin.d.ts

@@ -0,0 +1,4 @@
+import "../interfaces";
+
+import OrientedImageryGraphicOrigin = __esri.OrientedImageryGraphicOrigin;
+export default OrientedImageryGraphicOrigin;

package/graphic/OrientedImageryGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+import r from"./GraphicOrigin.js";import{isOrientedImageryGraphicOriginSymbol as i}from"./isOrientedImageryGraphicOrigin.js";var t;class e extends r{static{t=i}constructor(r){super(),this[t]=!0,this.type="oriented-imagery",this.layer=r}}export{e as default};

package/graphic/ParquetGraphicOrigin.d.ts

@@ -0,0 +1,4 @@
+import "../interfaces";
+
+import ParquetGraphicOrigin = __esri.ParquetGraphicOrigin;
+export default ParquetGraphicOrigin;

package/graphic/ParquetGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+import r from"./GraphicOrigin.js";import{isParquetGraphicOriginSymbol as t}from"./isParquetGraphicOrigin.js";var i;class s extends r{static{i=t}constructor(r){super(),this[i]=!0,this.type="parquet",this.layer=r}}export{s as default};

package/graphic/SubtypeGroupGraphicOrigin.d.ts

@@ -0,0 +1,4 @@
+import "../interfaces";
+
+import SubtypeGroupGraphicOrigin = __esri.SubtypeGroupGraphicOrigin;
+export default SubtypeGroupGraphicOrigin;

package/graphic/SubtypeGroupGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+import r from"./GraphicOrigin.js";import{isSubtypeGroupGraphicOriginSymbol as t}from"./isSubtypeGroupGraphicOrigin.js";var s;class e extends r{static{s=t}constructor(r){super(),this[s]=!0,this.type="subtype-group",this.sublayer=r}get layer(){return this.sublayer.parent}}export{e as default};

package/graphic/TileGraphicOrigin.d.ts

@@ -0,0 +1,4 @@
+import "../interfaces";
+
+import TileGraphicOrigin = __esri.TileGraphicOrigin;
+export default TileGraphicOrigin;

package/graphic/TileGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+import i from"./GraphicOrigin.js";import{isTileGraphicOriginSymbol as r}from"./isTileGraphicOrigin.js";var s;class t extends i{static{s=r}constructor(i,r){super(),this[s]=!0,this.type="tile",this.layer=i,this.sublayer=r}}export{t as default};

package/graphic/graphicOrigins.d.ts

@@ -4,11 +4,19 @@ export const isBuildingGraphicOrigin: __esri.graphicOrigins["isBuildingGraphicOr
 export const isCSVGraphicOrigin: __esri.graphicOrigins["isCSVGraphicOrigin"];
 export const isFeatureGraphicOrigin: __esri.graphicOrigins["isFeatureGraphicOrigin"];
 export const isGeoJSONGraphicOrigin: __esri.graphicOrigins["isGeoJSONGraphicOrigin"];
+export const isGeoRSSGraphicOrigin: __esri.graphicOrigins["isGeoRSSGraphicOrigin"];
 export const isIntegratedMesh3DTilesGraphicOrigin: __esri.graphicOrigins["isIntegratedMesh3DTilesGraphicOrigin"];
 export const isIntegratedMeshGraphicOrigin: __esri.graphicOrigins["isIntegratedMeshGraphicOrigin"];
+export const isKnowledgeGraphGraphicOrigin: __esri.graphicOrigins["isKnowledgeGraphGraphicOrigin"];
+export const isMapImageGraphicOrigin: __esri.graphicOrigins["isMapImageGraphicOrigin"];
+export const isMapNotesGraphicOrigin: __esri.graphicOrigins["isMapNotesGraphicOrigin"];
 export const isOGCFeatureGraphicOrigin: __esri.graphicOrigins["isOGCFeatureGraphicOrigin"];
+export const isOrientedImageryGraphicOrigin: __esri.graphicOrigins["isOrientedImageryGraphicOrigin"];
+export const isParquetGraphicOrigin: __esri.graphicOrigins["isParquetGraphicOrigin"];
 export const isPointCloudGraphicOrigin: __esri.graphicOrigins["isPointCloudGraphicOrigin"];
 export const isSceneGraphicOrigin: __esri.graphicOrigins["isSceneGraphicOrigin"];
 export const isStreamGraphicOrigin: __esri.graphicOrigins["isStreamGraphicOrigin"];
+export const isSubtypeGroupGraphicOrigin: __esri.graphicOrigins["isSubtypeGroupGraphicOrigin"];
+export const isTileGraphicOrigin: __esri.graphicOrigins["isTileGraphicOrigin"];
 export const isVectorTileGraphicOrigin: __esri.graphicOrigins["isVectorTileGraphicOrigin"];
 export const isWFSGraphicOrigin: __esri.graphicOrigins["isWFSGraphicOrigin"];

package/graphic/graphicOrigins.js

@@ -2,4 +2,4 @@
 All material copyright ESRI, All Rights Reserved, unless otherwise specified.
 See https://js.arcgis.com/4.34/esri/copyright.txt for details.
 */
-export{isBuildingGraphicOrigin}from"./isBuildingGraphicOrigin.js";export{isCatalogGraphicOrigin}from"./isCatalogGraphicOrigin.js";export{isCSVGraphicOrigin}from"./isCSVGraphicOrigin.js";export{isFeatureGraphicOrigin}from"./isFeatureGraphicOrigin.js";export{isGeoJSONGraphicOrigin}from"./isGeoJSONGraphicOrigin.js";export{isIntegratedMesh3DTilesGraphicOrigin}from"./isIntegratedMesh3DTilesGraphicOrigin.js";export{isIntegratedMeshGraphicOrigin}from"./isIntegratedMeshGraphicOrigin.js";export{isOGCFeatureGraphicOrigin}from"./isOGCFeatureGraphicOrigin.js";export{isPointCloudGraphicOrigin}from"./isPointCloudGraphicOrigin.js";export{isSceneGraphicOrigin}from"./isSceneGraphicOrigin.js";export{isStreamGraphicOrigin}from"./isStreamGraphicOrigin.js";export{isVectorTileGraphicOrigin}from"./isVectorTileGraphicOrigin.js";export{isVoxelGraphicOrigin}from"./isVoxelGraphicOrigin.js";export{isWFSGraphicOrigin}from"./isWFSGraphicOrigin.js";
+export{isBuildingGraphicOrigin}from"./isBuildingGraphicOrigin.js";export{isCatalogGraphicOrigin}from"./isCatalogGraphicOrigin.js";export{isCSVGraphicOrigin}from"./isCSVGraphicOrigin.js";export{isFeatureGraphicOrigin}from"./isFeatureGraphicOrigin.js";export{isGeoJSONGraphicOrigin}from"./isGeoJSONGraphicOrigin.js";export{isGeoRSSGraphicOrigin}from"./isGeoRSSGraphicOrigin.js";export{isIntegratedMesh3DTilesGraphicOrigin}from"./isIntegratedMesh3DTilesGraphicOrigin.js";export{isIntegratedMeshGraphicOrigin}from"./isIntegratedMeshGraphicOrigin.js";export{isKnowledgeGraphGraphicOrigin}from"./isKnowledgeGraphGraphicOrigin.js";export{isMapImageGraphicOrigin}from"./isMapImageGraphicOrigin.js";export{isMapNotesGraphicOrigin}from"./isMapNotesGraphicOrigin.js";export{isOGCFeatureGraphicOrigin}from"./isOGCFeatureGraphicOrigin.js";export{isOrientedImageryGraphicOrigin}from"./isOrientedImageryGraphicOrigin.js";export{isParquetGraphicOrigin}from"./isParquetGraphicOrigin.js";export{isPointCloudGraphicOrigin}from"./isPointCloudGraphicOrigin.js";export{isSceneGraphicOrigin}from"./isSceneGraphicOrigin.js";export{isStreamGraphicOrigin}from"./isStreamGraphicOrigin.js";export{isSubtypeGroupGraphicOrigin}from"./isSubtypeGroupGraphicOrigin.js";export{isTileGraphicOrigin}from"./isTileGraphicOrigin.js";export{isVectorTileGraphicOrigin}from"./isVectorTileGraphicOrigin.js";export{isVoxelGraphicOrigin}from"./isVoxelGraphicOrigin.js";export{isWFSGraphicOrigin}from"./isWFSGraphicOrigin.js";

package/{views/3d/terrain/RenderOrder.js → graphic/isGeoRSSGraphicOrigin.js}

@@ -2,3 +2,4 @@
 All material copyright ESRI, All Rights Reserved, unless otherwise specified.
 See https://js.arcgis.com/4.34/esri/copyright.txt for details.
 */
+const i=Symbol("isGeoRSSGraphicOrigin");function n(n){return!!n&&i in n}export{n as isGeoRSSGraphicOrigin,i as isGeoRSSGraphicOriginSymbol};

package/graphic/isKnowledgeGraphGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+const n=Symbol("isKnowledgeGraphGraphicOriginSymbol");function i(i){return!!i&&n in i}export{i as isKnowledgeGraphGraphicOrigin,n as isKnowledgeGraphGraphicOriginSymbol};

package/graphic/isMapImageGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+const i=Symbol("isMapImageGraphicOriginSymbol");function n(n){return!!n&&i in n}export{n as isMapImageGraphicOrigin,i as isMapImageGraphicOriginSymbol};

package/graphic/isMapNotesGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+const i=Symbol("isMapNotesGraphicOriginSymbol");function n(n){return!!n&&i in n}export{n as isMapNotesGraphicOrigin,i as isMapNotesGraphicOriginSymbol};

package/graphic/isOrientedImageryGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+const i=Symbol("isOrientedImageryGraphicOrigin");function n(n){return!!n&&i in n}export{n as isOrientedImageryGraphicOrigin,i as isOrientedImageryGraphicOriginSymbol};

package/graphic/isParquetGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+const i=Symbol("isParquetGraphicOrigin");function n(n){return!!n&&i in n}export{n as isParquetGraphicOrigin,i as isParquetGraphicOriginSymbol};

package/graphic/isSubtypeGroupGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+const i=Symbol("isSubtypeGroupGraphicOriginSymbol");function n(n){return!!n&&i in n}export{n as isSubtypeGroupGraphicOrigin,i as isSubtypeGroupGraphicOriginSymbol};

package/graphic/isTileGraphicOrigin.js

@@ -0,0 +1,5 @@
+/*
+All material copyright ESRI, All Rights Reserved, unless otherwise specified.
+See https://js.arcgis.com/4.34/esri/copyright.txt for details.
+*/
+const i=Symbol("isTileGraphicOriginSymbol");function n(n){return!!n&&i in n}export{n as isTileGraphicOrigin,i as isTileGraphicOriginSymbol};

package/identity/IdentityManagerBase.js

@@ -2,4 +2,4 @@
 All material copyright ESRI, All Rights Reserved, unless otherwise specified.
 See https://js.arcgis.com/4.34/esri/copyright.txt for details.
 */
-import{__decorate as e}from"tslib";import t from"../config.js";import{id as r}from"../kernel.js";import s from"../request.js";import i from"../core/Error.js";import o from"../core/Evented.js";import{on as n}from"../core/events.js";import{fixJson as a}from"../core/lang.js";import{getDeepValue as h}from"../core/object.js";import{createResolver as l,onAbort as c,isAborted as d}from"../core/promiseUtils.js";import{urlToObject as u,hasSameOrigin as p,Url as _,queryToObject as f,base64UrlEncode as g,objectToQuery as m,normalize as v,getProxyRule as S,makeAbsolute as w,addQueryParameters as I}from"../core/urlUtils.js";import{property as A}from"../core/accessorSupport/decorators/property.js";import"../core/has.js";import"../core/Logger.js";import{subclass as k}from"../core/accessorSupport/decorators/subclass.js";import y from"./IdentityModal.js";import U from"./OAuthCredential.js";import T from"./OAuthInfo.js";import x from"./ServerInfo.js";import{isSecureProxyService as O,normalizeArcGISOnlineOrgDomain as P}from"../portal/support/urlUtils.js";const R={},C=e=>{const t=new _(e.owningSystemUrl).host,r=new _(e.server).host,s=/.+\.arcgis\.com$/i;return s.test(t)&&s.test(r)},D=(e,t)=>!!(C(e)&&t&&t.some(t=>t.test(e.server)));let b=null,q=null;try{b=window.localStorage,q=window.sessionStorage}catch{}class j extends o{constructor(){super(),this._portalConfig=globalThis.esriGeowConfig,this.serverInfos=[],this.oAuthInfos=[],this.credentials=[],this._soReqs=[],this._xoReqs=[],this._portals=[],this._defaultOAuthInfo=null,this._defaultTokenValidity=60,this.dialog=null,this.tokenValidity=null,this.normalizeWebTierAuth=!1,this._appOrigin="null"!==window.origin?window.origin:window.location.origin,this._appUrlObj=u(window.location.href),this._busy=null,this._rejectOnPersistedPageShow=!1,this._oAuthLocationParams=null,this._gwTokenUrl="/sharing/rest/generateToken",this._agsRest="/rest/services",this._agsPortal=/\/sharing(\/|$)/i,this._agsAdmin=/(https?:\/\/[^/]+\/[^/]+)\/admin\/?(\/.*)?$/i,this._adminSvcs=/\/rest\/admin\/services(\/|$)/i,this._gwDomains=[{regex:/^https?:\/\/www\.arcgis\.com/i,customBaseUrl:"maps.arcgis.com",tokenServiceUrl:"https://www.arcgis.com/sharing/rest/generateToken"},{regex:/^https?:\/\/(?:dev|[a-z\d-]+\.mapsdev)\.arcgis\.com/i,customBaseUrl:"mapsdev.arcgis.com",tokenServiceUrl:"https://dev.arcgis.com/sharing/rest/generateToken"},{regex:/^https?:\/\/(?:devext|[a-z\d-]+\.mapsdevext)\.arcgis\.com/i,customBaseUrl:"mapsdevext.arcgis.com",tokenServiceUrl:"https://devext.arcgis.com/sharing/rest/generateToken"},{regex:/^https?:\/\/(?:qaext|[a-z\d-]+\.mapsqa)\.arcgis\.com/i,customBaseUrl:"mapsqa.arcgis.com",tokenServiceUrl:"https://qaext.arcgis.com/sharing/rest/generateToken"},{regex:/^https?:\/\/[a-z\d-]+\.maps\.arcgis\.com/i,customBaseUrl:"maps.arcgis.com",tokenServiceUrl:"https://www.arcgis.com/sharing/rest/generateToken"}],this._legacyFed=[],this._regexSDirUrl=/http.+\/rest\/services\/?/gi,this._regexServerType=/(\/(FeatureServer|GPServer|GeoDataServer|GeocodeServer|GeoenrichmentServer|GeometryServer|GlobeServer|ImageServer|KnowledgeGraphServer|MapServer|MissionServer|MobileServer|NAServer|NetworkDiagramServer|OGCFeatureServer|ParcelFabricServer|RelationalCatalogServer|SceneServer|StreamServer|UtilityNetworkServer|ValidationServer|VectorTileServer|VersionManagementServer|VideoServer)).*/gi,this._gwUser=/http.+\/users\/([^/]+).*/i,this._gwItem=/http.+\/items\/([^/]+).*/i,this._gwGroup=/http.+\/groups\/([^/]+).*/i,this._rePortalTokenSvc=/\/sharing(\/rest)?\/generatetoken/i,this._createDefaultOAuthInfo=!0,this._hasTestedIfAppIsOnPortal=!1,this._getPlatformSelfError=null,this._getOAuthLocationParams(),window.addEventListener("pageshow",e=>{this._pageShowHandler(e)})}registerServers(e){const t=this.serverInfos;t?(e=e.filter(e=>!this.findServerInfo(e.server)),this.serverInfos=t.concat(e)):this.serverInfos=e,e.forEach(e=>{e.owningSystemUrl&&this._portals.push(e.owningSystemUrl),e.hasPortal&&this._portals.push(e.server)})}registerOAuthInfos(e){const t=this.oAuthInfos;if(t){for(const r of e){const e=this.findOAuthInfo(r.portalUrl);e&&t.splice(t.indexOf(e),1)}this.oAuthInfos=t.concat(e)}else this.oAuthInfos=e}registerToken(e){e={...e};const t=this._sanitizeUrl(e.server),r=this._isServerRsrc(t);let s,i=this.findServerInfo(t),o=!0;i||(i=new x,i.server=this._getServerInstanceRoot(t),r?i.hasServer=!0:(i.tokenServiceUrl=this._getTokenSvcUrl(t),i.hasPortal=!0),this.registerServers([i])),s=this._findCredential(t),s?(delete e.server,Object.assign(s,e),o=!1):(s=new E({userId:e.userId,server:i.server??void 0,token:e.token,expires:e.expires,ssl:e.ssl,scope:r?"server":"portal"}),s.resources=[t],this.credentials.push(s)),s.emitTokenChange(!1),o||s.refreshServerTokens()}toJSON(){return a({serverInfos:this.serverInfos.map(e=>e.toJSON()),oAuthInfos:this.oAuthInfos.map(e=>e.toJSON()),credentials:this.credentials.map(e=>e.toJSON())})}initialize(e){if(!e)return;"string"==typeof e&&(e=JSON.parse(e));const t=e.serverInfos,r=e.oAuthInfos,s=e.credentials;if(t){const e=[];t.forEach(t=>{t.server&&t.tokenServiceUrl&&e.push(t.declaredClass?t:new x(t))}),e.length&&this.registerServers(e)}if(r){const e=[];r.forEach(t=>{t.appId&&e.push(t.declaredClass?t:new T(t))}),e.length&&this.registerOAuthInfos(e)}s&&s.forEach(e=>{e.server&&e.token&&e.expires&&e.expires>Date.now()&&((e=e.declaredClass?e:new E(e)).emitTokenChange(),this.credentials.push(e))})}findServerInfo(e){let t;e=this._sanitizeUrl(e);for(const r of this.serverInfos)if(this._hasSameServerInstance(r.server,e)){t=r;break}return t}findOAuthInfo(e){let t;e=this._sanitizeUrl(e);for(const r of this.oAuthInfos)if(this._hasSameServerInstance(r.portalUrl,e)){t=r;break}return t}findCredential(e,t){if(!e)return;let r;e=this._sanitizeUrl(e);const s=this._isServerRsrc(e)?"server":"portal";if(t){for(const i of this.credentials)if(this._hasSameServerInstance(i.server,e)&&t===i.userId&&i.scope===s){r=i;break}}else for(const i of this.credentials)if(this._hasSameServerInstance(i.server,e)&&-1!==this._getIdenticalSvcIdx(e,i)&&i.scope===s){r=i;break}return r}getCredential(e,t){let r,s=!1,o=!0;t&&(s=!(!t.token&&!t.credential),r=t.error,o=!1!==t.prompt),t={...t},e=this._sanitizeUrl(e);const n=new AbortController,a=l();if(t.signal&&c(t.signal,()=>{n.abort()}),c(n,()=>{a.reject(new i("identity-manager:user-aborted","ABORTED"))}),d(n))return a.promise;t.signal=n.signal;const h=this._isAdminResource(e),u=s?this.findCredential(e):null;let _;if(u&&498===r?.details?.httpStatus)u.destroy();else if(u)return _=new i("identity-manager:not-authorized","You are currently signed in as: '"+u.userId+"'. You do not have access to this resource: "+e,{error:r}),a.reject(_),a.promise;const f=this._findCredential(e,t);if(f)return a.resolve(f),a.promise;let g=this.findServerInfo(e);if(g)!g.hasPortal&&g.server&&g.owningSystemUrl&&this._hasSameServerInstance(g.server,g.owningSystemUrl)&&(g.hasPortal=!0),!g.hasServer&&this._isServerRsrc(e)&&(g._restInfoPms=this._getTokenSvcUrl(e),g.hasServer=!0);else{const t=this._getTokenSvcUrl(e);if(!t)return _=new i("identity-manager:unknown-resource","Unknown resource - could not find token service endpoint."),a.reject(_),a.promise;g=new x,g.server=this._getServerInstanceRoot(e),"string"==typeof t?(g.tokenServiceUrl=t,g.hasPortal=!0):(g._restInfoPms=t,g.hasServer=!0),this.registerServers([g])}return g.hasPortal&&void 0===g._selfReq&&(o||p(g.tokenServiceUrl,this._appOrigin)||this._gwDomains.some(e=>e.tokenServiceUrl===g.tokenServiceUrl))&&(g._selfReq={owningTenant:t?.owningTenant,selfDfd:this._getPortalSelf(g.tokenServiceUrl.replace(this._rePortalTokenSvc,"/sharing/rest/portals/self"),e)}),this._enqueue(e,g,t,a,h)}getResourceName(e){return this._isRESTService(e)?e.replace(this._regexSDirUrl,"").replace(this._regexServerType,"")||"":this._gwUser.test(e)&&e.replace(this._gwUser,"$1")||this._gwItem.test(e)&&e.replace(this._gwItem,"$1")||this._gwGroup.test(e)&&e.replace(this._gwGroup,"$1")||""}generateToken(e,t,r){const o=this._rePortalTokenSvc.test(e.tokenServiceUrl),n=new _(this._appOrigin),a=e.shortLivedTokenValidity;let h,l,c,d,u,f,g,m;t&&(m=this.tokenValidity||a||this._defaultTokenValidity,m>a&&a>0&&(m=a)),r&&(h=r.isAdmin,l=r.serverUrl,c=r.token,f=r.signal,g=r.ssl,e.customParameters=r.customParameters),h?d=e.adminTokenServiceUrl:(d=e.tokenServiceUrl,u=new _(d.toLowerCase()),e.webTierAuth&&r?.serverUrl&&!g&&"http"===n.scheme&&(p(n.uri,d,!0)||"https"===u.scheme&&n.host===u.host&&"7080"===n.port&&"7443"===u.port)&&(d=d.replace(/^https:/i,"http:").replace(/:7443/i,":7080")));const v={query:{request:"getToken",username:t?.username,password:t?.password,serverUrl:l,token:c,expiration:m,referer:h||o?this._appOrigin:null,client:h?"referer":null,f:"json",...e.customParameters},method:"post",authMode:"anonymous",useProxy:this._useProxy(e,r),signal:f,...r?.ioArgs};o||(v.withCredentials=!1);return s(d,v).then(r=>{const s=r.data;if(!s?.token)return new i("identity-manager:authentication-failed","Unable to generate token");const o=e.server;return R[o]||(R[o]={}),t&&(R[o][t.username]=t.password),s.validity=m,s})}isBusy(){return!!this._busy}async checkSignInStatus(e){return(await this.checkAppAccess(e,"")).credential}checkAppAccess(e,t,r){let o=!1;return this.getCredential(e,{prompt:!1}).then(n=>{let a;const h={f:"json"};if("portal"===n.scope)if(t&&(this._doPortalSignIn(e)||r?.force))a=n.server+"/sharing/rest/oauth2/validateAppAccess",h.client_id=t;else{if(!n.token)return{credential:n};a=n.server+"/sharing/rest"}else{if(!n.token)return{credential:n};a=n.server+"/rest/services"}return n.token&&(h.token=n.token),s(a,{query:h,authMode:"anonymous"}).then(e=>{if(!1===e.data.valid)throw new i("identity-manager:not-authorized",`You are currently signed in as: '${n.userId}'.`,e.data);return o=!!e.data.viewOnlyUserTypeApp,{credential:n}}).catch(e=>{if("identity-manager:not-authorized"===e.name)throw e;const t=e.details?.httpStatus;if(498===t)throw n.destroy(),new i("identity-manager:not-authenticated","User is not signed in.");if(400===t)throw new i("identity-manager:invalid-request","Bad request");return{credential:n}})}).then(e=>({credential:e.credential,viewOnly:o}))}setOAuthResponseHash(e){e&&("#"===e.charAt(0)&&(e=e.slice(1)),this._processOAuthPopupParams(f(e)))}setOAuthRedirectionHandler(e){this._oAuthRedirectFunc=e}setProtocolErrorHandler(e){this._protocolFunc=e}signIn(e,t,r={}){const s=l(),o=()=>{h?.remove(),d?.remove(),this.dialog?.destroy(),this.dialog=h=d=null},n=()=>{o(),this._oAuthDfd=null,s.reject(new i("identity-manager:user-aborted","ABORTED"))};r.signal&&c(r.signal,()=>{n()});const a=new y({open:!0,resource:this.getResourceName(e),server:t.server});this.dialog=a,this.emit("dialog-create");let h=a.on("cancel",n),d=a.on("submit",e=>{this.generateToken(t,e,{isAdmin:r.isAdmin,signal:r.signal}).then(i=>{o();const n=new E({userId:e.username,server:t.server??void 0,token:i.token,expires:null!=i.expires?Number(i.expires):null,ssl:!!i.ssl,isAdmin:r.isAdmin,validity:i.validity});s.resolve(n)}).catch(e=>{a.error=e,a.signingIn=!1})});return s.promise}oAuthSignIn(e,t,r,s){this._oAuthDfd=l();const o=this._oAuthDfd;let n;s?.signal&&c(s.signal,()=>{const e=this._oAuthDfd&&this._oAuthDfd.oAuthWin_;e&&!e.closed?e.close():this.dialog&&u()}),o.resUrl_=e,o.sinfo_=t,o.oinfo_=r;const a=r._oAuthCred;if(a.storage&&("authorization-code"===r.flowType||"auto"===r.flowType&&t.currentVersion>=8.4)){let e=crypto.getRandomValues(new Uint8Array(32));n=g(e),a.codeVerifier=n,e=crypto.getRandomValues(new Uint8Array(32)),a.stateUID=g(e),a.save()||(a.codeVerifier=n=null)}else a.codeVerifier=null;let h,d;this._getCodeChallenge(n).then(i=>{const o=!s||!1!==s.oAuthPopupConfirmation;if(!r.popup||!o)return void this._doOAuthSignIn(e,t,r,i);const n=new y({oAuthPrompt:!0,server:t.server,open:!0});this.dialog=n,this.emit("dialog-create"),h=n.on("cancel",u),d=n.on("submit",()=>{p(),this._doOAuthSignIn(e,t,r,i)})});const u=()=>{p(),this._oAuthDfd=null,o.reject(new i("identity-manager:user-aborted","ABORTED"))},p=()=>{h?.remove(),d?.remove(),this.dialog?.destroy(),this.dialog=null};return o.promise}destroyCredentials(){if(this.credentials){this.credentials.slice().forEach(e=>{e.destroy()})}this.emit("credentials-destroy")}enablePostMessageAuth(e="https://www.arcgis.com/sharing/rest"){this._postMessageAuthHandle&&this._postMessageAuthHandle.remove(),this._postMessageAuthHandle=n(window,"message",t=>{if((t.origin===this._appOrigin||t.origin.endsWith(".arcgis.com"))&&"arcgis:auth:requestCredential"===t.data?.type){const r=t.source;this.getCredential(e).then(e=>{r.postMessage({type:"arcgis:auth:credential",credential:{expires:e.expires,server:e.server,ssl:e.ssl,token:e.token,userId:e.userId}},t.origin)}).catch(e=>{r.postMessage({type:"arcgis:auth:error",error:{name:e.name,message:e.message}},t.origin)})}})}disablePostMessageAuth(){this._postMessageAuthHandle&&(this._postMessageAuthHandle.remove(),this._postMessageAuthHandle=null)}_getOAuthLocationParams(){let e=window.location.hash;if(e){"#"===e.charAt(0)&&(e=e.slice(1));const t=f(e);let r=!1;if(t.access_token&&t.expires_in&&t.state&&t.hasOwnProperty("username"))try{t.state=JSON.parse(t.state),t.state.portalUrl&&(this._oAuthLocationParams=t,r=!0)}catch{}else if(t.error&&t.error_description&&(console.log("IdentityManager OAuth Error: ",t.error," - ",t.error_description),"access_denied"===t.error&&(r=!0,t.state)))try{t.state=JSON.parse(t.state)}catch{}r&&(window.location.hash=t.state?.hash||"")}let t=window.location.search;if(t){"?"===t.charAt(0)&&(t=t.slice(1));const e=f(t);let r=!1;if(e.code&&e.state)try{e.state=JSON.parse(e.state),e.state.portalUrl&&e.state.uid&&(this._oAuthLocationParams=e,r=!0)}catch{}else if(e.error&&e.error_description&&(console.log("IdentityManager OAuth Error: ",e.error," - ",e.error_description),"access_denied"===e.error&&(r=!0,e.state)))try{e.state=JSON.parse(e.state)}catch{}if(r){const t={...e};["code","error","error_description","message_code","persist","state"].forEach(e=>{delete t[e]});const r=m(t),s=window.location.pathname+(r?`?${r}`:"")+(e.state?.hash||"");window.history.replaceState(window.history.state,"",s)}}}_getOAuthToken(e,t,r,i,o){return e=e.replace(/^http:/i,"https:"),s(`${e}/sharing/rest/oauth2/token`,{authMode:"anonymous",method:"post",query:i&&o?{grant_type:"authorization_code",code:t,redirect_uri:i,client_id:r,code_verifier:o}:{grant_type:"refresh_token",refresh_token:t,client_id:r}}).then(e=>e.data)}async _getCodeChallenge(e){if(e&&globalThis.isSecureContext){const t=(new TextEncoder).encode(e),r=await crypto.subtle.digest("SHA-256",t);return g(new Uint8Array(r))}return null}_pageShowHandler(e){if(e.persisted&&this.isBusy()&&this._rejectOnPersistedPageShow){const e=new i("identity-manager:user-aborted","ABORTED");this._errbackFunc(e)}}_findCredential(e,t){let r,s,i,o,n=-1;const a=t?.token,h=t?.resource,l=this._isServerRsrc(e)?"server":"portal",c=this.credentials.filter(t=>this._hasSameServerInstance(t.server,e)&&t.scope===l);if(e=h||e,c.length)if(1===c.length){if(r=c[0],i=this.findServerInfo(r.server),s=i?.owningSystemUrl,o=s?this.findCredential(s,r.userId):void 0,n=this._getIdenticalSvcIdx(e,r),!a)return-1===n&&r.resources.push(e),this._addResource(e,o),r;-1!==n&&(r.resources.splice(n,1),this._removeResource(e,o))}else{let t,r;if(c.some(a=>(r=this._getIdenticalSvcIdx(e,a),-1!==r&&(t=a,i=this.findServerInfo(t.server),s=i?.owningSystemUrl,o=s?this.findCredential(s,t.userId):void 0,n=r,!0))),a)t&&(t.resources.splice(n,1),this._removeResource(e,o));else if(t)return this._addResource(e,o),t}}_findOAuthInfo(e){let t=this.findOAuthInfo(e);if(!t)for(const r of this.oAuthInfos)if(this._isIdProvider(r.portalUrl,e)){t=r;break}return t}_addResource(e,t){t&&-1===this._getIdenticalSvcIdx(e,t)&&t.resources.push(e)}_removeResource(e,t){let r=-1;t&&(r=this._getIdenticalSvcIdx(e,t),r>-1&&t.resources.splice(r,1))}_useProxy(e,t){return t?.isAdmin&&!p(e.adminTokenServiceUrl,this._appOrigin)||!this._isPortalDomain(e.tokenServiceUrl)&&"10.1"===String(e.currentVersion)&&!p(e.tokenServiceUrl,this._appOrigin)}_getOrigin(e){const t=new _(e);return t.scheme+"://"+t.host+(null!=t.port?":"+t.port:"")}_getServerInstanceRoot(e){const t=e.toLowerCase();let r=t.indexOf(this._agsRest);return-1===r&&this._isAdminResource(e)&&(r=this._agsAdmin.test(e)?e.replace(this._agsAdmin,"$1").length:e.search(this._adminSvcs)),-1!==r||O(t)||(r=t.indexOf("/sharing")),-1===r&&t.endsWith("/")&&(r=t.length-1),r>-1?e.slice(0,r):e}_hasSameServerInstance(e,t){return e.endsWith("/")&&(e=e.slice(0,-1)),e=e.toLowerCase(),t=this._getServerInstanceRoot(t).toLowerCase(),e=P(e),t=P(t),(e=e.slice(Math.max(0,e.indexOf(":"))))===(t=t.slice(Math.max(0,t.indexOf(":"))))}_sanitizeUrl(e){const r=(t.request.proxyUrl||"").toLowerCase(),s=r?e.toLowerCase().indexOf(r+"?"):-1;return-1!==s&&(e=e.slice(s+r.length+1)),e=v(e),u(e).path}_isRESTService(e){return e.includes(this._agsRest)}_isAdminResource(e){return this._agsAdmin.test(e)||this._adminSvcs.test(e)}_isServerRsrc(e){return this._isRESTService(e)||this._isAdminResource(e)}_isIdenticalService(e,t){let r=!1;if(this._isRESTService(e)&&this._isRESTService(t)){const s=this._getSuffix(e).toLowerCase(),i=this._getSuffix(t).toLowerCase();if(r=s===i,!r){const e=/(.*)\/(MapServer|FeatureServer|UtilityNetworkServer).*/gi;r=s.replaceAll(e,"$1")===i.replaceAll(e,"$1")}}else this._isAdminResource(e)&&this._isAdminResource(t)?r=!0:this._isServerRsrc(e)||this._isServerRsrc(t)||!this._isPortalDomain(e)||(r=!0);return r}_isPortalDomain(e){const r=new _(e.toLowerCase()),s=this._portalConfig;let i=this._gwDomains.some(e=>e.regex.test(r.uri));return!i&&s&&(i=this._hasSameServerInstance(this._getServerInstanceRoot(s.restBaseUrl),r.uri)),i||t.portalUrl&&(i=p(r,t.portalUrl,!0)),i||(i=this._portals.some(e=>this._hasSameServerInstance(e,r.uri))),i=i||this._agsPortal.test(r.path),i}_isIdProvider(e,t){let r=-1,s=-1;this._gwDomains.forEach((i,o)=>{-1===r&&i.regex.test(e)&&(r=o),-1===s&&i.regex.test(t)&&(s=o)});let i=!1;if(r>-1&&s>-1&&(0===r||4===r?0!==s&&4!==s||(i=!0):1===r?1!==s&&2!==s||(i=!0):2===r?2===s&&(i=!0):3===r&&3===s&&(i=!0)),!i){const r=this.findServerInfo(t),s=r?.owningSystemUrl;s&&C(r)&&this._isPortalDomain(s)&&this._isIdProvider(e,s)&&(i=!0)}return i}_getIdenticalSvcIdx(e,t){let r=-1;for(let s=0;s<t.resources.length;s++){const i=t.resources[s];if(this._isIdenticalService(e,i)){r=s;break}}return r}_getSuffix(e){return e.replace(this._regexSDirUrl,"").replace(this._regexServerType,"$1")}_getTokenSvcUrl(e){let t,r,i;if(this._isRESTService(e)||this._isAdminResource(e)){const i=this._getServerInstanceRoot(e);return t=i+"/admin/generateToken",r=s(e=i+"/rest/info",{query:{f:"json"}}).then(e=>e.data),{adminUrl:t,promise:r}}if(this._isPortalDomain(e)){let t="";if(this._gwDomains.some(r=>(r.regex.test(e)&&(t=r.tokenServiceUrl),!!t)),t||this._portals.some(r=>(this._hasSameServerInstance(r,e)&&(t=r+this._gwTokenUrl),!!t)),t||(i=e.toLowerCase().indexOf("/sharing"),-1!==i&&(t=e.slice(0,i)+this._gwTokenUrl)),t||(t=this._getOrigin(e)+this._gwTokenUrl),t){const r=new _(e).port;/^http:\/\//i.test(e)&&"7080"===r&&(t=t.replace(/:7080/i,":7443")),t=t.replace(/http:/i,"https:")}return t}}_processOAuthResponseParams(e,t,r){const s=t._oAuthCred;if(e.code){const i=s.codeVerifier;return s.codeVerifier=null,s.stateUID=null,s.save(),this._getOAuthToken(r.server,e.code,t.appId,this._getRedirectURI(t,!0),i).then(i=>{const o=new E({userId:i.username,server:r.server??void 0,token:i.access_token,expires:Date.now()+1e3*i.expires_in,ssl:i.ssl,oAuthState:e.state,_oAuthCred:s});return t.userId=o.userId,s.storage=i.persist?b:q,s.refreshToken=i.refresh_token,s.token=null,s.expires=i.refresh_token_expires_in?Date.now()+1e3*i.refresh_token_expires_in:null,s.userId=o.userId,s.ssl=o.ssl,s.save(),o})}const i=new E({userId:e.username,server:r.server??void 0,token:e.access_token,expires:Date.now()+1e3*Number(e.expires_in),ssl:"true"===e.ssl,oAuthState:e.state,_oAuthCred:s});return t.userId=i.userId,s.storage=e.persist?b:q,s.refreshToken=null,s.token=i.token,s.expires=i.expires,s.userId=i.userId,s.ssl=i.ssl,s.save(),Promise.resolve(i)}_processOAuthPopupParams(e){const t=this._oAuthDfd;if(this._oAuthDfd=null,t)if(clearInterval(this._oAuthIntervalId),this._oAuthOnPopupHandle?.remove(),e.error){const r="access_denied"===e.error,s=new i(r?"identity-manager:user-aborted":"identity-manager:authentication-failed",r?"ABORTED":"OAuth: "+e.error+" - "+e.error_description);t.reject(s)}else this._processOAuthResponseParams(e,t.oinfo_,t.sinfo_).then(e=>{t.resolve(e)}).catch(e=>{t.reject(e)})}_setOAuthResponseQueryString(e){e&&("?"===e.charAt(0)&&(e=e.slice(1)),this._processOAuthPopupParams(f(e)))}async _exchangeToken(e,t,r){return(await s(`${e}/sharing/rest/oauth2/exchangeToken`,{authMode:"anonymous",method:"post",query:{f:"json",client_id:t,token:r}})).data.token}async _getPlatformSelf(e,t){if(this._getPlatformSelfError&&Date.now()-this._getPlatformSelfError[1]<1e3)throw this._getPlatformSelfError[0];e=e.replace(/^http:/i,"https:");try{const r=await s(`${e}/sharing/rest/oauth2/platformSelf`,{authMode:"anonymous",headers:{"X-Esri-Auth-Client-Id":t,"X-Esri-Auth-Redirect-Uri":window.location.href.replace(/#.*$/,"")},method:"post",query:{f:"json",expiration:30},withCredentials:!0});return this._getPlatformSelfError=null,r.data}catch(r){throw"OAUTH_0066"===r.details?.messageCode&&(this._getPlatformSelfError=[r,Date.now()]),r}}_getPortalSelf(e,t){let r;if(this._gwDomains.some(t=>(t.regex.test(e)&&(r=t.customBaseUrl),!!r)),r)return Promise.resolve({allSSL:!0,currentVersion:"8.4",customBaseUrl:r,portalMode:"multitenant",supportsOAuth:!0});this._appOrigin.startsWith("https:")?e=e.replace(/^http:/i,"https:").replace(/:7080/i,":7443"):/^http:/i.test(t)&&(e=e.replace(/^https:/i,"http:").replace(/:7443/i,":7080"));return s(e,{query:{f:"json"},authMode:"anonymous",withCredentials:!0}).then(e=>e.data)}_doPortalSignIn(e){const t=this._portalConfig,r=window.location.href,s=this.findServerInfo(e);return!(!t&&!this._isPortalDomain(r)||!(s?s.hasPortal||s.owningSystemUrl&&this._isPortalDomain(s.owningSystemUrl):this._isPortalDomain(e))||!(this._isIdProvider(r,e)||t&&(this._hasSameServerInstance(this._getServerInstanceRoot(t.restBaseUrl),e)||this._isIdProvider(t.restBaseUrl,e))||p(r,e,!0)))}_checkProtocol(e,t,r,s){let o=!0;const n=s?t.adminTokenServiceUrl:t.tokenServiceUrl;if(n.trim().toLowerCase().startsWith("https:")&&!this._appOrigin.startsWith("https:")&&S(n)&&(o=!!this._protocolFunc&&!!this._protocolFunc({resourceUrl:e,serverInfo:t}),!o)){r(new i("identity-manager:aborted","Aborted the Sign-In process to avoid sending password over insecure connection."))}return o}_enqueue(e,t,r,s,i,o){return s||(s=l()),s.resUrl_=e,s.sinfo_=t,s.options_=r,s.admin_=i,s.refresh_=o,this._busy?this._hasSameServerInstance(this._getServerInstanceRoot(e),this._busy.resUrl_)?(this._oAuthDfd&&this._oAuthDfd.oAuthWin_&&this._oAuthDfd.oAuthWin_.focus(),this._soReqs.push(s)):this._xoReqs.push(s):this._doSignIn(s),s.promise}_doSignIn(e){this._busy=e,this._rejectOnPersistedPageShow=!1;const t=t=>{const r=e.options_?.resource,s=e.resUrl_,i=e.refresh_;let o=!1;this.credentials.includes(t)||(i&&this.credentials.includes(i)?(i.userId=t.userId,i.token=t.token,i.expires=t.expires,i.validity=t.validity,i.ssl=t.ssl,i.creationTime=t.creationTime,o=!0,t=i):this.credentials.push(t)),t.resources||(t.resources=[]),t.resources.includes(r||s)||t.resources.push(r||s),t.scope=this._isServerRsrc(s)?"server":"portal",t.emitTokenChange();const n=this._soReqs,a={};this._soReqs=[],n.forEach(e=>{if(!this._isIdenticalService(s,e.resUrl_)){const r=this._getSuffix(e.resUrl_);a[r]||(a[r]=!0,t.resources.push(e.resUrl_))}}),e.resolve(t),n.forEach(e=>{this._hasSameServerInstance(this._getServerInstanceRoot(s),e.resUrl_)?e.resolve(t):this._soReqs.push(e)}),this._busy=e.resUrl_=e.sinfo_=e.refresh_=null,o||this.emit("credential-create",{credential:t}),this._soReqs.length?this._doSignIn(this._soReqs.shift()):this._xoReqs.length&&this._doSignIn(this._xoReqs.shift())},r=t=>{e.reject(t),this._busy=e.resUrl_=e.sinfo_=e.refresh_=null,this._soReqs.length?this._doSignIn(this._soReqs.shift()):this._xoReqs.length&&this._doSignIn(this._xoReqs.shift())},s=(o,a,h,l)=>{const d=e.sinfo_,u=!e.options_||!1!==e.options_.prompt,_=d.hasPortal&&this._findOAuthInfo(e.resUrl_);let f,g;if(o)t(new E({userId:o,server:d.server??void 0,token:h??void 0,expires:null!=l?Number(l):null,ssl:!!a}));else if(window!==window.parent&&this._appUrlObj.query?.["arcgis-auth-origin"]&&this._appUrlObj.query?.["arcgis-auth-portal"]&&this._hasSameServerInstance(this._getServerInstanceRoot(this._appUrlObj.query["arcgis-auth-portal"]),e.resUrl_)){window.parent.postMessage({type:"arcgis:auth:requestCredential"},this._appUrlObj.query["arcgis-auth-origin"]);const s=n(window,"message",e=>{e.source===window.parent&&e.data&&("arcgis:auth:credential"===e.data.type?(s.remove(),e.data.credential.expires<Date.now()?r(new i("identity-manager:credential-request-failed","Parent application's token has expired.")):t(new E(e.data.credential))):"arcgis:auth:error"===e.data.type&&(s.remove(),"tokenExpiredError"===e.data.error.name?r(new i("identity-manager:credential-request-failed","Parent application's token has expired.")):r(i.fromJSON(e.data.error))))});c(e.options_?.signal,()=>{s.remove()})}else if(_){let o=_._oAuthCred;if(!o){const e=new U(_,b),t=new U(_,q);e.isValid()&&t.isValid()?e.expires>t.expires?(o=e,t.destroy()):(o=t,e.destroy()):o=e.isValid()?e:t,_._oAuthCred=o}if(o.isValid()){f=new E({userId:o.userId??void 0,server:d.server??void 0,token:o.token??void 0,expires:o.expires,ssl:o.ssl??void 0,_oAuthCred:o});const i=_.appId!==o.appId&&this._doPortalSignIn(e.resUrl_);i||o.refreshToken?(e._pendingDfd=o.refreshToken?this._getOAuthToken(d.server,o.refreshToken,o.appId).then(e=>(f.expires=Date.now()+1e3*e.expires_in,f.token=e.access_token,f)):Promise.resolve(f),e._pendingDfd.then(e=>i?this._exchangeToken(e.server,_.appId,e.token).then(t=>(e.token=t,e)).catch(()=>e):e).then(e=>{t(e)}).catch(e=>{const t=e.details?.httpStatus;t>0&&404!==t?(o.destroy(),s()):r(e)})):t(f)}else if(this._oAuthLocationParams&&this._hasSameServerInstance(_.portalUrl,this._oAuthLocationParams.state.portalUrl)&&(this._oAuthLocationParams.access_token||this._oAuthLocationParams.code&&this._oAuthLocationParams.state.uid===o.stateUID&&o.codeVerifier)){const s=this._oAuthLocationParams;this._oAuthLocationParams=null,e._pendingDfd=this._processOAuthResponseParams(s,_,d).then(e=>{t(e)}).catch(r)}else{const s=()=>{u?e._pendingDfd=this.oAuthSignIn(e.resUrl_,d,_,e.options_).then(t,r):(g=new i("identity-manager:not-authenticated","User is not signed in."),r(g))};this._doPortalSignIn(e.resUrl_)?e._pendingDfd=this._getPlatformSelf(d.server,_.appId).then(e=>{p(e.portalUrl,this._appOrigin,!0)?(f=new E({userId:e.username,server:d.server??void 0,expires:Date.now()+1e3*e.expires_in,token:e.token}),t(f)):s()}).catch(s):s()}}else if(u){if(this._checkProtocol(e.resUrl_,d,r,e.admin_)){let s=e.options_;e.admin_&&(s=s||{},s.isAdmin=!0),e._pendingDfd=this.signIn(e.resUrl_,d,s).then(t,r)}}else g=new i("identity-manager:not-authenticated","User is not signed in."),r(g)},o=()=>{const s=e.sinfo_,i=s.owningSystemUrl,o=e.options_;let n,a,h,l;if(o&&(n=o.token,a=o.error,h=o.prompt),l=this._findCredential(i,{token:n,resource:e.resUrl_}),!l)for(const e of this.credentials)if(this._isIdProvider(i,e.server)){l=e;break}if(l){const i=this.findCredential(e.resUrl_,l.userId);if(i)t(i);else if(D(s,this._legacyFed)){const e=l.toJSON();e.server=s.server,e.resources=null,t(new E(e))}else{(e._pendingDfd=this.generateToken(this.findServerInfo(l.server),null,{serverUrl:e.resUrl_,token:l.token,signal:e.options_.signal,ssl:l.ssl})).then(r=>{t(new E({userId:l?.userId,server:s.server??void 0,token:r.token,expires:null!=r.expires?Number(r.expires):null,ssl:!!r.ssl,isAdmin:e.admin_,validity:r.validity}))},r)}}else{this._busy=null,n&&(e.options_.token=null);(e._pendingDfd=this.getCredential(i.replace(/\/?$/,"/sharing"),{resource:e.resUrl_,owningTenant:s.owningTenant,signal:e.options_.signal,token:n,error:a,prompt:h})).then(()=>{this._enqueue(e.resUrl_,e.sinfo_,e.options_,e,e.admin_)},t=>{e.resUrl_=e.sinfo_=e.refresh_=null,e.reject(t)})}};this._errbackFunc=r;const a=e.sinfo_.owningSystemUrl,l=this._isServerRsrc(e.resUrl_),d=e.sinfo_._restInfoPms;d?d.promise.then(t=>{const r=e.sinfo_;if(r._restInfoPms){r.adminTokenServiceUrl=r._restInfoPms.adminUrl,r._restInfoPms=null,r.tokenServiceUrl=(h("authInfo.tokenServicesUrl",t)||h("authInfo.tokenServiceUrl",t)||h("tokenServiceUrl",t))??null,r.shortLivedTokenValidity=h("authInfo.shortLivedTokenValidity",t)??null,r.currentVersion=t.currentVersion,r.owningTenant=t.owningTenant;const e=r.owningSystemUrl=t.owningSystemUrl;e&&this._portals.push(e)}l&&r.owningSystemUrl?o():s()},()=>{e.sinfo_._restInfoPms=null;const t=new i("identity-manager:server-identification-failed","Unknown resource - could not find token service endpoint.");r(t)}):l&&a?o():e.sinfo_._selfReq?e.sinfo_._selfReq.selfDfd.then(t=>{const r={};let s,i,o,n;return t&&(s=t.user?.username,r.username=s,r.allSSL=t.allSSL,i=t.supportsOAuth,n=parseFloat(t.currentVersion),"multitenant"===t.portalMode&&(o=t.customBaseUrl),e.sinfo_.currentVersion=n),e.sinfo_.webTierAuth=!!s,s&&this.normalizeWebTierAuth?this.generateToken(e.sinfo_,null,{ssl:r.allSSL}).catch(()=>null).then(e=>(r.portalToken=e?.token,r.tokenExpiration=e?.expires,r)):!s&&i&&n>=4.4&&!this._findOAuthInfo(e.resUrl_)?this._generateOAuthInfo({portalUrl:e.sinfo_.server,customBaseUrl:o,owningTenant:e.sinfo_._selfReq.owningTenant}).catch(()=>null).then(()=>r):r}).catch(()=>null).then(t=>{e.sinfo_._selfReq=null,t?s(t.username,t.allSSL,t.portalToken,t.tokenExpiration):s()}):s()}_generateOAuthInfo(e){let t,r=null,i=e.portalUrl;const o=e.customBaseUrl,n=e.owningTenant,a=!this._defaultOAuthInfo&&this._createDefaultOAuthInfo&&!this._hasTestedIfAppIsOnPortal;if(a){r=this._appUrlObj.path;const e=r.search(/\/(apps|home)\//);r=e>-1?r.slice(0,e):null}return a&&r?(this._hasTestedIfAppIsOnPortal=!0,t=s(r+"/sharing/rest",{query:{f:"json"}}).then(()=>{this._defaultOAuthInfo=new T({appId:"arcgisonline",popupCallbackUrl:r+"/home/oauth-callback.html"})})):t=Promise.resolve(),t.then(()=>{if(this._defaultOAuthInfo)return i=i.replace(/^http:/i,"https:"),s(i+"/sharing/rest/oauth2/validateRedirectUri",{query:{accountId:n,client_id:this._defaultOAuthInfo.appId,redirect_uri:w(this._defaultOAuthInfo.popupCallbackUrl),f:"json"}}).then(e=>{if(e.data.valid){const t=this._defaultOAuthInfo.clone();e.data.urlKey&&o?t.portalUrl="https://"+e.data.urlKey.toLowerCase()+"."+o:t.portalUrl=i,t.popup=window!==window.top||!(p(i,this._appOrigin)||this._gwDomains.some(e=>e.regex.test(i)&&e.regex.test(this._appOrigin))),this.oAuthInfos.push(t)}})})}_doOAuthSignIn(e,t,r,s){const o=r._oAuthCred,a={portalUrl:r.portalUrl};!r.popup&&r.preserveUrlHash&&window.location.hash&&(a.hash=window.location.hash),o.stateUID&&(a.uid=o.stateUID);const h={client_id:r.appId,response_type:o.codeVerifier?"code":"token",state:JSON.stringify(a),expiration:r.expiration,locale:r.locale,redirect_uri:this._getRedirectURI(r,!!o.codeVerifier)};r.forceLogin&&(h.force_login=!0),r.forceUserId&&r.userId&&(h.prepopulatedusername=r.userId),!r.popup&&this._doPortalSignIn(e)&&(h.redirectToUserOrgUrl=!0),o.codeVerifier&&(h.code_challenge=s||o.codeVerifier,h.code_challenge_method=s?"S256":"plain");const l=r.portalUrl.replace(/^http:/i,"https:")+"/sharing/oauth2/authorize",c=l+"?"+m(h);if(r.popup){const e=window.open(c,"esriJSAPIOAuth",r.popupWindowFeatures);if(e)e.focus(),this._oAuthDfd.oAuthWin_=e,this._oAuthIntervalId=setInterval(()=>{if(e.closed){clearInterval(this._oAuthIntervalId),this._oAuthOnPopupHandle.remove();const e=this._oAuthDfd;if(e){const t=new i("identity-manager:user-aborted","ABORTED");e.reject(t)}}},500),this._oAuthOnPopupHandle=n(window,["arcgis:auth:hash","arcgis:auth:location:search"],e=>{"arcgis:auth:hash"===e.type?this.setOAuthResponseHash(e.detail):this._setOAuthResponseQueryString(e.detail)});else{const e=new i("identity-manager:popup-blocked","ABORTED");this._oAuthDfd.reject(e)}}else this._rejectOnPersistedPageShow=!0,this._oAuthRedirectFunc?this._oAuthRedirectFunc({authorizeParams:h,authorizeUrl:l,resourceUrl:e,serverInfo:t,oAuthInfo:r}):window.location.href=c}_getRedirectURI(e,t){const r=window.location.href.replace(/#.*$/,"");if(e.popup)return w(e.popupCallbackUrl);if(t){const e=u(r);return e.query&&["code","error","error_description","message_code","persist","state"].forEach(t=>{delete e.query[t]}),I(e.path,e.query)}return r}}j.prototype.declaredClass="esri.identity.IdentityManagerBase";let E=class extends o.EventedAccessor{constructor(e){super(e),this._oAuthCred=null,this.tokenRefreshBuffer=2,e?._oAuthCred&&(this._oAuthCred=e._oAuthCred)}initialize(){this.resources=this.resources||[],null==this.creationTime&&(this.creationTime=Date.now())}refreshToken(){const e=r,t=e.findServerInfo(this.server),s=t?.owningSystemUrl,i=!!s&&"server"===this.scope,o=i&&D(t,e._legacyFed),n=t.webTierAuth,a=n&&e.normalizeWebTierAuth,h=R[this.server],l=h?.[this.userId];let c,d=this.resources&&this.resources[0],u=i?e.findServerInfo(s):null,p={username:this.userId,password:l};if(n&&!a)return;i&&!u&&e.serverInfos.some(t=>(e._isIdProvider(s,t.server)&&(u=t),!!u));const _=u?e.findCredential(u.server,this.userId):null;if(!i||_){if(!o){if(i)c={serverUrl:d,token:_?.token,ssl:_?.ssl};else if(a)p=null,c={ssl:this.ssl};else{if(!l){let r;return d&&(d=e._sanitizeUrl(d),this._enqueued=1,r=e._enqueue(d,t,null,null,this.isAdmin,this),r.then(()=>{this._enqueued=0,this.refreshServerTokens()}).catch(()=>{this._enqueued=0})),r}this.isAdmin&&(c={isAdmin:!0})}return e.generateToken(i?u:t,i?null:p,c).then(e=>{this.token=e.token,this.expires=null!=e.expires?Number(e.expires):null,this.creationTime=Date.now(),this.validity=e.validity,this.emitTokenChange(),this.refreshServerTokens()}).catch(()=>{})}_?.refreshToken()}}refreshServerTokens(){if("portal"===this.scope){const e=r;e.credentials.forEach(t=>{const r=e.findServerInfo(t.server),s=r?.owningSystemUrl;t!==this&&t.userId===this.userId&&s&&"server"===t.scope&&(e._hasSameServerInstance(this.server,s)||e._isIdProvider(s,this.server))&&(D(r,e._legacyFed)?(t.token=this.token,t.expires=this.expires,t.creationTime=this.creationTime,t.validity=this.validity,t.emitTokenChange()):t.refreshToken())})}}emitTokenChange(e){clearTimeout(this._refreshTimer);const t=r,s=this.server?t.findServerInfo(this.server):null,i=s?.owningSystemUrl,o=i?t.findServerInfo(i):null;!1===e||i&&"portal"!==this.scope&&(!o?.webTierAuth||t.normalizeWebTierAuth)||null==this.expires&&null==this.validity||this._startRefreshTimer(),this.emit("token-change")}destroy(){this.userId=this.server=this.token=this.expires=this.validity=this.resources=this.creationTime=null,this._oAuthCred&&(this._oAuthCred.destroy(),this._oAuthCred=null);const e=r,t=e.credentials.indexOf(this);t>-1&&e.credentials.splice(t,1),this.emitTokenChange(),this.emit("destroy")}toJSON(){const e=a({userId:this.userId,server:this.server,token:this.token,expires:this.expires,validity:this.validity,ssl:this.ssl,isAdmin:this.isAdmin,creationTime:this.creationTime,scope:this.scope}),t=this.resources;return t&&t.length>0&&(e.resources=t.slice()),e}_startRefreshTimer(){clearTimeout(this._refreshTimer);const e=6e4*this.tokenRefreshBuffer,t=2**31-1;let r=(this.validity?this.creationTime+6e4*this.validity:this.expires)-Date.now();r<0?r=0:r>t&&(r=t),this._refreshTimer=setTimeout(this.refreshToken.bind(this),r>e?r-e:r)}};e([A()],E.prototype,"creationTime",void 0),e([A()],E.prototype,"expires",void 0),e([A()],E.prototype,"isAdmin",void 0),e([A()],E.prototype,"oAuthState",void 0),e([A()],E.prototype,"resources",void 0),e([A()],E.prototype,"scope",void 0),e([A()],E.prototype,"server",void 0),e([A()],E.prototype,"ssl",void 0),e([A()],E.prototype,"token",void 0),e([A()],E.prototype,"tokenRefreshBuffer",void 0),e([A()],E.prototype,"userId",void 0),e([A()],E.prototype,"validity",void 0),E=e([k("esri.identity.Credential")],E);export{E as Credential,j as IdentityManagerBase};
+import{__decorate as e}from"tslib";import t from"../config.js";import{id as r}from"../kernel.js";import s from"../request.js";import i from"../core/Error.js";import{EventedAccessor as o,Evented as n}from"../core/Evented.js";import{on as a}from"../core/events.js";import{fixJson as h}from"../core/lang.js";import{getDeepValue as l}from"../core/object.js";import{createResolver as c,onAbort as d,isAborted as u}from"../core/promiseUtils.js";import{Url as p,urlToObject as _,hasSameOrigin as f,queryToObject as g,base64UrlEncode as m,objectToQuery as v,normalize as S,getProxyRule as w,makeAbsolute as I,addQueryParameters as A}from"../core/urlUtils.js";import{property as k}from"../core/accessorSupport/decorators/property.js";import"../core/has.js";import"../core/Logger.js";import{subclass as y}from"../core/accessorSupport/decorators/subclass.js";import U from"./IdentityModal.js";import T from"./OAuthCredential.js";import x from"./OAuthInfo.js";import O from"./ServerInfo.js";import{isSecureProxyService as P,normalizeArcGISOnlineOrgDomain as R}from"../portal/support/urlUtils.js";const C={},D=e=>{const t=new p(e.owningSystemUrl).host,r=new p(e.server).host,s=/.+\.arcgis\.com$/i;return s.test(t)&&s.test(r)},b=(e,t)=>!!(D(e)&&t&&t.some(t=>t.test(e.server)));let q=null,j=null;try{q=window.localStorage,j=window.sessionStorage}catch{}class E extends n{constructor(){super(),this._portalConfig=globalThis.esriGeowConfig,this.serverInfos=[],this.oAuthInfos=[],this.credentials=[],this._soReqs=[],this._xoReqs=[],this._portals=[],this._defaultOAuthInfo=null,this._defaultTokenValidity=60,this.dialog=null,this.tokenValidity=null,this.normalizeWebTierAuth=!1,this._appOrigin="null"!==window.origin?window.origin:window.location.origin,this._appUrlObj=_(window.location.href),this._busy=null,this._rejectOnPersistedPageShow=!1,this._oAuthLocationParams=null,this._gwTokenUrl="/sharing/rest/generateToken",this._agsRest="/rest/services",this._agsPortal=/\/sharing(\/|$)/i,this._agsAdmin=/(https?:\/\/[^/]+\/[^/]+)\/admin\/?(\/.*)?$/i,this._adminSvcs=/\/rest\/admin\/services(\/|$)/i,this._gwDomains=[{regex:/^https?:\/\/www\.arcgis\.com/i,customBaseUrl:"maps.arcgis.com",tokenServiceUrl:"https://www.arcgis.com/sharing/rest/generateToken"},{regex:/^https?:\/\/(?:dev|[a-z\d-]+\.mapsdev)\.arcgis\.com/i,customBaseUrl:"mapsdev.arcgis.com",tokenServiceUrl:"https://dev.arcgis.com/sharing/rest/generateToken"},{regex:/^https?:\/\/(?:devext|[a-z\d-]+\.mapsdevext)\.arcgis\.com/i,customBaseUrl:"mapsdevext.arcgis.com",tokenServiceUrl:"https://devext.arcgis.com/sharing/rest/generateToken"},{regex:/^https?:\/\/(?:qaext|[a-z\d-]+\.mapsqa)\.arcgis\.com/i,customBaseUrl:"mapsqa.arcgis.com",tokenServiceUrl:"https://qaext.arcgis.com/sharing/rest/generateToken"},{regex:/^https?:\/\/[a-z\d-]+\.maps\.arcgis\.com/i,customBaseUrl:"maps.arcgis.com",tokenServiceUrl:"https://www.arcgis.com/sharing/rest/generateToken"}],this._legacyFed=[],this._regexSDirUrl=/http.+\/rest\/services\/?/gi,this._regexServerType=/(\/(FeatureServer|GPServer|GeoDataServer|GeocodeServer|GeoenrichmentServer|GeometryServer|GlobeServer|ImageServer|KnowledgeGraphServer|MapServer|MissionServer|MobileServer|NAServer|NetworkDiagramServer|OGCFeatureServer|ParcelFabricServer|RelationalCatalogServer|SceneServer|StreamServer|UtilityNetworkServer|ValidationServer|VectorTileServer|VersionManagementServer|VideoServer)).*/gi,this._gwUser=/http.+\/users\/([^/]+).*/i,this._gwItem=/http.+\/items\/([^/]+).*/i,this._gwGroup=/http.+\/groups\/([^/]+).*/i,this._rePortalTokenSvc=/\/sharing(\/rest)?\/generatetoken/i,this._createDefaultOAuthInfo=!0,this._hasTestedIfAppIsOnPortal=!1,this._getPlatformSelfError=null,this._getOAuthLocationParams(),window.addEventListener("pageshow",e=>{this._pageShowHandler(e)})}registerServers(e){const t=this.serverInfos;t?(e=e.filter(e=>!this.findServerInfo(e.server)),this.serverInfos=t.concat(e)):this.serverInfos=e,e.forEach(e=>{e.owningSystemUrl&&this._portals.push(e.owningSystemUrl),e.hasPortal&&this._portals.push(e.server)})}registerOAuthInfos(e){const t=this.oAuthInfos;if(t){for(const r of e){const e=this.findOAuthInfo(r.portalUrl);e&&t.splice(t.indexOf(e),1)}this.oAuthInfos=t.concat(e)}else this.oAuthInfos=e}registerToken(e){e={...e};const t=this._sanitizeUrl(e.server),r=this._isServerRsrc(t);let s,i=this.findServerInfo(t),o=!0;i||(i=new O,i.server=this._getServerInstanceRoot(t),r?i.hasServer=!0:(i.tokenServiceUrl=this._getTokenSvcUrl(t),i.hasPortal=!0),this.registerServers([i])),s=this._findCredential(t),s?(delete e.server,Object.assign(s,e),o=!1):(s=new L({userId:e.userId,server:i.server??void 0,token:e.token,expires:e.expires,ssl:e.ssl,scope:r?"server":"portal"}),s.resources=[t],this.credentials.push(s)),s.emitTokenChange(!1),o||s.refreshServerTokens()}toJSON(){return h({serverInfos:this.serverInfos.map(e=>e.toJSON()),oAuthInfos:this.oAuthInfos.map(e=>e.toJSON()),credentials:this.credentials.map(e=>e.toJSON())})}initialize(e){if(!e)return;"string"==typeof e&&(e=JSON.parse(e));const t=e.serverInfos,r=e.oAuthInfos,s=e.credentials;if(t){const e=[];t.forEach(t=>{t.server&&t.tokenServiceUrl&&e.push(t.declaredClass?t:new O(t))}),e.length&&this.registerServers(e)}if(r){const e=[];r.forEach(t=>{t.appId&&e.push(t.declaredClass?t:new x(t))}),e.length&&this.registerOAuthInfos(e)}s&&s.forEach(e=>{e.server&&e.token&&e.expires&&e.expires>Date.now()&&((e=e.declaredClass?e:new L(e)).emitTokenChange(),this.credentials.push(e))})}findServerInfo(e){let t;e=this._sanitizeUrl(e);for(const r of this.serverInfos)if(this._hasSameServerInstance(r.server,e)){t=r;break}return t}findOAuthInfo(e){let t;e=this._sanitizeUrl(e);for(const r of this.oAuthInfos)if(this._hasSameServerInstance(r.portalUrl,e)){t=r;break}return t}findCredential(e,t){if(!e)return;let r;e=this._sanitizeUrl(e);const s=this._isServerRsrc(e)?"server":"portal";if(t){for(const i of this.credentials)if(this._hasSameServerInstance(i.server,e)&&t===i.userId&&i.scope===s){r=i;break}}else for(const i of this.credentials)if(this._hasSameServerInstance(i.server,e)&&-1!==this._getIdenticalSvcIdx(e,i)&&i.scope===s){r=i;break}return r}getCredential(e,t){let r,s=!1,o=!0;t&&(s=!(!t.token&&!t.credential),r=t.error,o=!1!==t.prompt),t={...t},e=this._sanitizeUrl(e);const n=new AbortController,a=c();if(t.signal&&d(t.signal,()=>{n.abort()}),d(n,()=>{a.reject(new i("identity-manager:user-aborted","ABORTED"))}),u(n))return a.promise;t.signal=n.signal;const h=this._isAdminResource(e),l=s?this.findCredential(e):null;let p;if(l&&498===r?.details?.httpStatus)l.destroy();else if(l)return p=new i("identity-manager:not-authorized","You are currently signed in as: '"+l.userId+"'. You do not have access to this resource: "+e,{error:r}),a.reject(p),a.promise;const _=this._findCredential(e,t);if(_)return a.resolve(_),a.promise;let g=this.findServerInfo(e);if(g)!g.hasPortal&&g.server&&g.owningSystemUrl&&this._hasSameServerInstance(g.server,g.owningSystemUrl)&&(g.hasPortal=!0),!g.hasServer&&this._isServerRsrc(e)&&(g._restInfoPms=this._getTokenSvcUrl(e),g.hasServer=!0);else{const t=this._getTokenSvcUrl(e);if(!t)return p=new i("identity-manager:unknown-resource","Unknown resource - could not find token service endpoint."),a.reject(p),a.promise;g=new O,g.server=this._getServerInstanceRoot(e),"string"==typeof t?(g.tokenServiceUrl=t,g.hasPortal=!0):(g._restInfoPms=t,g.hasServer=!0),this.registerServers([g])}return g.hasPortal&&void 0===g._selfReq&&(o||f(g.tokenServiceUrl,this._appOrigin)||this._gwDomains.some(e=>e.tokenServiceUrl===g.tokenServiceUrl))&&(g._selfReq={owningTenant:t?.owningTenant,selfDfd:this._getPortalSelf(g.tokenServiceUrl.replace(this._rePortalTokenSvc,"/sharing/rest/portals/self"),e)}),this._enqueue(e,g,t,a,h)}getResourceName(e){return this._isRESTService(e)?e.replace(this._regexSDirUrl,"").replace(this._regexServerType,"")||"":this._gwUser.test(e)&&e.replace(this._gwUser,"$1")||this._gwItem.test(e)&&e.replace(this._gwItem,"$1")||this._gwGroup.test(e)&&e.replace(this._gwGroup,"$1")||""}generateToken(e,t,r){const o=this._rePortalTokenSvc.test(e.tokenServiceUrl),n=new p(this._appOrigin),a=e.shortLivedTokenValidity;let h,l,c,d,u,_,g,m;t&&(m=this.tokenValidity||a||this._defaultTokenValidity,m>a&&a>0&&(m=a)),r&&(h=r.isAdmin,l=r.serverUrl,c=r.token,_=r.signal,g=r.ssl,e.customParameters=r.customParameters),h?d=e.adminTokenServiceUrl:(d=e.tokenServiceUrl,u=new p(d.toLowerCase()),e.webTierAuth&&r?.serverUrl&&!g&&"http"===n.scheme&&(f(n.uri,d,!0)||"https"===u.scheme&&n.host===u.host&&"7080"===n.port&&"7443"===u.port)&&(d=d.replace(/^https:/i,"http:").replace(/:7443/i,":7080")));const v={query:{request:"getToken",username:t?.username,password:t?.password,serverUrl:l,token:c,expiration:m,referer:h||o?this._appOrigin:null,client:h?"referer":null,f:"json",...e.customParameters},method:"post",authMode:"anonymous",useProxy:this._useProxy(e,r),signal:_,...r?.ioArgs};o||(v.withCredentials=!1);return s(d,v).then(r=>{const s=r.data;if(!s?.token)return new i("identity-manager:authentication-failed","Unable to generate token");const o=e.server;return C[o]||(C[o]={}),t&&(C[o][t.username]=t.password),s.validity=m,s})}isBusy(){return!!this._busy}async checkSignInStatus(e){return(await this.checkAppAccess(e,"")).credential}checkAppAccess(e,t,r){let o=!1;return this.getCredential(e,{prompt:!1}).then(n=>{let a;const h={f:"json"};if("portal"===n.scope)if(t&&(this._doPortalSignIn(e)||r?.force))a=n.server+"/sharing/rest/oauth2/validateAppAccess",h.client_id=t;else{if(!n.token)return{credential:n};a=n.server+"/sharing/rest"}else{if(!n.token)return{credential:n};a=n.server+"/rest/services"}return n.token&&(h.token=n.token),s(a,{query:h,authMode:"anonymous"}).then(e=>{if(!1===e.data.valid)throw new i("identity-manager:not-authorized",`You are currently signed in as: '${n.userId}'.`,e.data);return o=!!e.data.viewOnlyUserTypeApp,{credential:n}}).catch(e=>{if("identity-manager:not-authorized"===e.name)throw e;const t=e.details?.httpStatus;if(498===t)throw n.destroy(),new i("identity-manager:not-authenticated","User is not signed in.");if(400===t)throw new i("identity-manager:invalid-request","Bad request");return{credential:n}})}).then(e=>({credential:e.credential,viewOnly:o}))}setOAuthResponseHash(e){e&&("#"===e.charAt(0)&&(e=e.slice(1)),this._processOAuthPopupParams(g(e)))}setOAuthRedirectionHandler(e){this._oAuthRedirectFunc=e}setProtocolErrorHandler(e){this._protocolFunc=e}signIn(e,t,r={}){const s=c(),o=()=>{h?.remove(),l?.remove(),this.dialog?.destroy(),this.dialog=h=l=null},n=()=>{o(),this._oAuthDfd=null,s.reject(new i("identity-manager:user-aborted","ABORTED"))};r.signal&&d(r.signal,()=>{n()});const a=new U({open:!0,resource:this.getResourceName(e),server:t.server});this.dialog=a,this.emit("dialog-create");let h=a.on("cancel",n),l=a.on("submit",e=>{this.generateToken(t,e,{isAdmin:r.isAdmin,signal:r.signal}).then(i=>{o();const n=new L({userId:e.username,server:t.server??void 0,token:i.token,expires:null!=i.expires?Number(i.expires):null,ssl:!!i.ssl,isAdmin:r.isAdmin,validity:i.validity});s.resolve(n)}).catch(e=>{a.error=e,a.signingIn=!1})});return s.promise}oAuthSignIn(e,t,r,s){this._oAuthDfd=c();const o=this._oAuthDfd;let n;s?.signal&&d(s.signal,()=>{const e=this._oAuthDfd&&this._oAuthDfd.oAuthWin_;e&&!e.closed?e.close():this.dialog&&u()}),o.resUrl_=e,o.sinfo_=t,o.oinfo_=r;const a=r._oAuthCred;if(a.storage&&("authorization-code"===r.flowType||"auto"===r.flowType&&t.currentVersion>=8.4)){let e=crypto.getRandomValues(new Uint8Array(32));n=m(e),a.codeVerifier=n,e=crypto.getRandomValues(new Uint8Array(32)),a.stateUID=m(e),a.save()||(a.codeVerifier=n=null)}else a.codeVerifier=null;let h,l;this._getCodeChallenge(n).then(i=>{const o=!s||!1!==s.oAuthPopupConfirmation;if(!r.popup||!o)return void this._doOAuthSignIn(e,t,r,i);const n=new U({oAuthPrompt:!0,server:t.server,open:!0});this.dialog=n,this.emit("dialog-create"),h=n.on("cancel",u),l=n.on("submit",()=>{p(),this._doOAuthSignIn(e,t,r,i)})});const u=()=>{p(),this._oAuthDfd=null,o.reject(new i("identity-manager:user-aborted","ABORTED"))},p=()=>{h?.remove(),l?.remove(),this.dialog?.destroy(),this.dialog=null};return o.promise}destroyCredentials(){if(this.credentials){this.credentials.slice().forEach(e=>{e.destroy()})}this.emit("credentials-destroy")}enablePostMessageAuth(e="https://www.arcgis.com/sharing/rest"){this._postMessageAuthHandle&&this._postMessageAuthHandle.remove(),this._postMessageAuthHandle=a(window,"message",t=>{if((t.origin===this._appOrigin||t.origin.endsWith(".arcgis.com"))&&"arcgis:auth:requestCredential"===t.data?.type){const r=t.source;this.getCredential(e).then(e=>{r.postMessage({type:"arcgis:auth:credential",credential:{expires:e.expires,server:e.server,ssl:e.ssl,token:e.token,userId:e.userId}},t.origin)}).catch(e=>{r.postMessage({type:"arcgis:auth:error",error:{name:e.name,message:e.message}},t.origin)})}})}disablePostMessageAuth(){this._postMessageAuthHandle&&(this._postMessageAuthHandle.remove(),this._postMessageAuthHandle=null)}_getOAuthLocationParams(){let e=window.location.hash;if(e){"#"===e.charAt(0)&&(e=e.slice(1));const t=g(e);let r=!1;if(t.access_token&&t.expires_in&&t.state&&t.hasOwnProperty("username"))try{t.state=JSON.parse(t.state),t.state.portalUrl&&(this._oAuthLocationParams=t,r=!0)}catch{}else if(t.error&&t.error_description&&(console.log("IdentityManager OAuth Error: ",t.error," - ",t.error_description),"access_denied"===t.error&&(r=!0,t.state)))try{t.state=JSON.parse(t.state)}catch{}r&&(window.location.hash=t.state?.hash||"")}let t=window.location.search;if(t){"?"===t.charAt(0)&&(t=t.slice(1));const e=g(t);let r=!1;if(e.code&&e.state)try{e.state=JSON.parse(e.state),e.state.portalUrl&&e.state.uid&&(this._oAuthLocationParams=e,r=!0)}catch{}else if(e.error&&e.error_description&&(console.log("IdentityManager OAuth Error: ",e.error," - ",e.error_description),"access_denied"===e.error&&(r=!0,e.state)))try{e.state=JSON.parse(e.state)}catch{}if(r){const t={...e};["code","error","error_description","message_code","persist","state"].forEach(e=>{delete t[e]});const r=v(t),s=window.location.pathname+(r?`?${r}`:"")+(e.state?.hash||"");window.history.replaceState(window.history.state,"",s)}}}_getOAuthToken(e,t,r,i,o){return e=e.replace(/^http:/i,"https:"),s(`${e}/sharing/rest/oauth2/token`,{authMode:"anonymous",method:"post",query:i&&o?{grant_type:"authorization_code",code:t,redirect_uri:i,client_id:r,code_verifier:o}:{grant_type:"refresh_token",refresh_token:t,client_id:r}}).then(e=>e.data)}async _getCodeChallenge(e){if(e&&globalThis.isSecureContext){const t=(new TextEncoder).encode(e),r=await crypto.subtle.digest("SHA-256",t);return m(new Uint8Array(r))}return null}_pageShowHandler(e){if(e.persisted&&this.isBusy()&&this._rejectOnPersistedPageShow){const e=new i("identity-manager:user-aborted","ABORTED");this._errbackFunc(e)}}_findCredential(e,t){let r,s,i,o,n=-1;const a=t?.token,h=t?.resource,l=this._isServerRsrc(e)?"server":"portal",c=this.credentials.filter(t=>this._hasSameServerInstance(t.server,e)&&t.scope===l);if(e=h||e,c.length)if(1===c.length){if(r=c[0],i=this.findServerInfo(r.server),s=i?.owningSystemUrl,o=s?this.findCredential(s,r.userId):void 0,n=this._getIdenticalSvcIdx(e,r),!a)return-1===n&&r.resources.push(e),this._addResource(e,o),r;-1!==n&&(r.resources.splice(n,1),this._removeResource(e,o))}else{let t,r;if(c.some(a=>(r=this._getIdenticalSvcIdx(e,a),-1!==r&&(t=a,i=this.findServerInfo(t.server),s=i?.owningSystemUrl,o=s?this.findCredential(s,t.userId):void 0,n=r,!0))),a)t&&(t.resources.splice(n,1),this._removeResource(e,o));else if(t)return this._addResource(e,o),t}}_findOAuthInfo(e){let t=this.findOAuthInfo(e);if(!t)for(const r of this.oAuthInfos)if(this._isIdProvider(r.portalUrl,e)){t=r;break}return t}_addResource(e,t){t&&-1===this._getIdenticalSvcIdx(e,t)&&t.resources.push(e)}_removeResource(e,t){let r=-1;t&&(r=this._getIdenticalSvcIdx(e,t),r>-1&&t.resources.splice(r,1))}_useProxy(e,t){return t?.isAdmin&&!f(e.adminTokenServiceUrl,this._appOrigin)||!this._isPortalDomain(e.tokenServiceUrl)&&"10.1"===String(e.currentVersion)&&!f(e.tokenServiceUrl,this._appOrigin)}_getOrigin(e){const t=new p(e);return t.scheme+"://"+t.host+(null!=t.port?":"+t.port:"")}_getServerInstanceRoot(e){const t=e.toLowerCase();let r=t.indexOf(this._agsRest);return-1===r&&this._isAdminResource(e)&&(r=this._agsAdmin.test(e)?e.replace(this._agsAdmin,"$1").length:e.search(this._adminSvcs)),-1!==r||P(t)||(r=t.indexOf("/sharing")),-1===r&&t.endsWith("/")&&(r=t.length-1),r>-1?e.slice(0,r):e}_hasSameServerInstance(e,t){return e.endsWith("/")&&(e=e.slice(0,-1)),e=e.toLowerCase(),t=this._getServerInstanceRoot(t).toLowerCase(),e=R(e),t=R(t),(e=e.slice(Math.max(0,e.indexOf(":"))))===(t=t.slice(Math.max(0,t.indexOf(":"))))}_sanitizeUrl(e){const r=(t.request.proxyUrl||"").toLowerCase(),s=r?e.toLowerCase().indexOf(r+"?"):-1;return-1!==s&&(e=e.slice(s+r.length+1)),e=S(e),_(e).path}_isRESTService(e){return e.includes(this._agsRest)}_isAdminResource(e){return this._agsAdmin.test(e)||this._adminSvcs.test(e)}_isServerRsrc(e){return this._isRESTService(e)||this._isAdminResource(e)}_isIdenticalService(e,t){let r=!1;if(this._isRESTService(e)&&this._isRESTService(t)){const s=this._getSuffix(e).toLowerCase(),i=this._getSuffix(t).toLowerCase();if(r=s===i,!r){const e=/(.*)\/(MapServer|FeatureServer|UtilityNetworkServer).*/gi;r=s.replaceAll(e,"$1")===i.replaceAll(e,"$1")}}else this._isAdminResource(e)&&this._isAdminResource(t)?r=!0:this._isServerRsrc(e)||this._isServerRsrc(t)||!this._isPortalDomain(e)||(r=!0);return r}_isPortalDomain(e){const r=new p(e.toLowerCase()),s=this._portalConfig;let i=this._gwDomains.some(e=>e.regex.test(r.uri));return!i&&s&&(i=this._hasSameServerInstance(this._getServerInstanceRoot(s.restBaseUrl),r.uri)),i||t.portalUrl&&(i=f(r,t.portalUrl,!0)),i||(i=this._portals.some(e=>this._hasSameServerInstance(e,r.uri))),i=i||this._agsPortal.test(r.path),i}_isIdProvider(e,t){let r=-1,s=-1;this._gwDomains.forEach((i,o)=>{-1===r&&i.regex.test(e)&&(r=o),-1===s&&i.regex.test(t)&&(s=o)});let i=!1;if(r>-1&&s>-1&&(0===r||4===r?0!==s&&4!==s||(i=!0):1===r?1!==s&&2!==s||(i=!0):2===r?2===s&&(i=!0):3===r&&3===s&&(i=!0)),!i){const r=this.findServerInfo(t),s=r?.owningSystemUrl;s&&D(r)&&this._isPortalDomain(s)&&this._isIdProvider(e,s)&&(i=!0)}return i}_getIdenticalSvcIdx(e,t){let r=-1;for(let s=0;s<t.resources.length;s++){const i=t.resources[s];if(this._isIdenticalService(e,i)){r=s;break}}return r}_getSuffix(e){return e.replace(this._regexSDirUrl,"").replace(this._regexServerType,"$1")}_getTokenSvcUrl(e){let t,r,i;if(this._isRESTService(e)||this._isAdminResource(e)){const i=this._getServerInstanceRoot(e);return t=i+"/admin/generateToken",r=s(e=i+"/rest/info",{query:{f:"json"}}).then(e=>e.data),{adminUrl:t,promise:r}}if(this._isPortalDomain(e)){let t="";if(this._gwDomains.some(r=>(r.regex.test(e)&&(t=r.tokenServiceUrl),!!t)),t||this._portals.some(r=>(this._hasSameServerInstance(r,e)&&(t=r+this._gwTokenUrl),!!t)),t||(i=e.toLowerCase().indexOf("/sharing"),-1!==i&&(t=e.slice(0,i)+this._gwTokenUrl)),t||(t=this._getOrigin(e)+this._gwTokenUrl),t){const r=new p(e).port;/^http:\/\//i.test(e)&&"7080"===r&&(t=t.replace(/:7080/i,":7443")),t=t.replace(/http:/i,"https:")}return t}}_processOAuthResponseParams(e,t,r){const s=t._oAuthCred;if(e.code){const i=s.codeVerifier;return s.codeVerifier=null,s.stateUID=null,s.save(),this._getOAuthToken(r.server,e.code,t.appId,this._getRedirectURI(t,!0),i).then(i=>{const o=new L({userId:i.username,server:r.server??void 0,token:i.access_token,expires:Date.now()+1e3*i.expires_in,ssl:i.ssl,oAuthState:e.state,_oAuthCred:s});return t.userId=o.userId,s.storage=i.persist?q:j,s.refreshToken=i.refresh_token,s.token=null,s.expires=i.refresh_token_expires_in?Date.now()+1e3*i.refresh_token_expires_in:null,s.userId=o.userId,s.ssl=o.ssl,s.save(),o})}const i=new L({userId:e.username,server:r.server??void 0,token:e.access_token,expires:Date.now()+1e3*Number(e.expires_in),ssl:"true"===e.ssl,oAuthState:e.state,_oAuthCred:s});return t.userId=i.userId,s.storage=e.persist?q:j,s.refreshToken=null,s.token=i.token,s.expires=i.expires,s.userId=i.userId,s.ssl=i.ssl,s.save(),Promise.resolve(i)}_processOAuthPopupParams(e){const t=this._oAuthDfd;if(this._oAuthDfd=null,t)if(clearInterval(this._oAuthIntervalId),this._oAuthOnPopupHandle?.remove(),e.error){const r="access_denied"===e.error,s=new i(r?"identity-manager:user-aborted":"identity-manager:authentication-failed",r?"ABORTED":"OAuth: "+e.error+" - "+e.error_description);t.reject(s)}else this._processOAuthResponseParams(e,t.oinfo_,t.sinfo_).then(e=>{t.resolve(e)}).catch(e=>{t.reject(e)})}_setOAuthResponseQueryString(e){e&&("?"===e.charAt(0)&&(e=e.slice(1)),this._processOAuthPopupParams(g(e)))}async _exchangeToken(e,t,r){return(await s(`${e}/sharing/rest/oauth2/exchangeToken`,{authMode:"anonymous",method:"post",query:{f:"json",client_id:t,token:r}})).data.token}async _getPlatformSelf(e,t){if(this._getPlatformSelfError&&Date.now()-this._getPlatformSelfError[1]<1e3)throw this._getPlatformSelfError[0];e=e.replace(/^http:/i,"https:");try{const r=await s(`${e}/sharing/rest/oauth2/platformSelf`,{authMode:"anonymous",headers:{"X-Esri-Auth-Client-Id":t,"X-Esri-Auth-Redirect-Uri":window.location.href.replace(/#.*$/,"")},method:"post",query:{f:"json",expiration:30},withCredentials:!0});return this._getPlatformSelfError=null,r.data}catch(r){throw"OAUTH_0066"===r.details?.messageCode&&(this._getPlatformSelfError=[r,Date.now()]),r}}_getPortalSelf(e,t){let r;if(this._gwDomains.some(t=>(t.regex.test(e)&&(r=t.customBaseUrl),!!r)),r)return Promise.resolve({allSSL:!0,currentVersion:"8.4",customBaseUrl:r,portalMode:"multitenant",supportsOAuth:!0});this._appOrigin.startsWith("https:")?e=e.replace(/^http:/i,"https:").replace(/:7080/i,":7443"):/^http:/i.test(t)&&(e=e.replace(/^https:/i,"http:").replace(/:7443/i,":7080"));return s(e,{query:{f:"json"},authMode:"anonymous",withCredentials:!0}).then(e=>e.data)}_doPortalSignIn(e){const t=this._portalConfig,r=window.location.href,s=this.findServerInfo(e);return!(!t&&!this._isPortalDomain(r)||!(s?s.hasPortal||s.owningSystemUrl&&this._isPortalDomain(s.owningSystemUrl):this._isPortalDomain(e))||!(this._isIdProvider(r,e)||t&&(this._hasSameServerInstance(this._getServerInstanceRoot(t.restBaseUrl),e)||this._isIdProvider(t.restBaseUrl,e))||f(r,e,!0)))}_checkProtocol(e,t,r,s){let o=!0;const n=s?t.adminTokenServiceUrl:t.tokenServiceUrl;if(n.trim().toLowerCase().startsWith("https:")&&!this._appOrigin.startsWith("https:")&&w(n)&&(o=!!this._protocolFunc&&!!this._protocolFunc({resourceUrl:e,serverInfo:t}),!o)){r(new i("identity-manager:aborted","Aborted the Sign-In process to avoid sending password over insecure connection."))}return o}_enqueue(e,t,r,s,i,o){return s||(s=c()),s.resUrl_=e,s.sinfo_=t,s.options_=r,s.admin_=i,s.refresh_=o,this._busy?this._hasSameServerInstance(this._getServerInstanceRoot(e),this._busy.resUrl_)?(this._oAuthDfd&&this._oAuthDfd.oAuthWin_&&this._oAuthDfd.oAuthWin_.focus(),this._soReqs.push(s)):this._xoReqs.push(s):this._doSignIn(s),s.promise}_doSignIn(e){this._busy=e,this._rejectOnPersistedPageShow=!1;const t=t=>{const r=e.options_?.resource,s=e.resUrl_,i=e.refresh_;let o=!1;this.credentials.includes(t)||(i&&this.credentials.includes(i)?(i.userId=t.userId,i.token=t.token,i.expires=t.expires,i.validity=t.validity,i.ssl=t.ssl,i.creationTime=t.creationTime,o=!0,t=i):this.credentials.push(t)),t.resources||(t.resources=[]),t.resources.includes(r||s)||t.resources.push(r||s),t.scope=this._isServerRsrc(s)?"server":"portal",t.emitTokenChange();const n=this._soReqs,a={};this._soReqs=[],n.forEach(e=>{if(!this._isIdenticalService(s,e.resUrl_)){const r=this._getSuffix(e.resUrl_);a[r]||(a[r]=!0,t.resources.push(e.resUrl_))}}),e.resolve(t),n.forEach(e=>{this._hasSameServerInstance(this._getServerInstanceRoot(s),e.resUrl_)?e.resolve(t):this._soReqs.push(e)}),this._busy=e.resUrl_=e.sinfo_=e.refresh_=null,o||this.emit("credential-create",{credential:t}),this._soReqs.length?this._doSignIn(this._soReqs.shift()):this._xoReqs.length&&this._doSignIn(this._xoReqs.shift())},r=t=>{e.reject(t),this._busy=e.resUrl_=e.sinfo_=e.refresh_=null,this._soReqs.length?this._doSignIn(this._soReqs.shift()):this._xoReqs.length&&this._doSignIn(this._xoReqs.shift())},s=(o,n,h,l)=>{const c=e.sinfo_,u=!e.options_||!1!==e.options_.prompt,p=c.hasPortal&&this._findOAuthInfo(e.resUrl_);let _,g;if(o)t(new L({userId:o,server:c.server??void 0,token:h??void 0,expires:null!=l?Number(l):null,ssl:!!n}));else if(window!==window.parent&&this._appUrlObj.query?.["arcgis-auth-origin"]&&this._appUrlObj.query?.["arcgis-auth-portal"]&&this._hasSameServerInstance(this._getServerInstanceRoot(this._appUrlObj.query["arcgis-auth-portal"]),e.resUrl_)){window.parent.postMessage({type:"arcgis:auth:requestCredential"},this._appUrlObj.query["arcgis-auth-origin"]);const s=a(window,"message",e=>{e.source===window.parent&&e.data&&("arcgis:auth:credential"===e.data.type?(s.remove(),e.data.credential.expires<Date.now()?r(new i("identity-manager:credential-request-failed","Parent application's token has expired.")):t(new L(e.data.credential))):"arcgis:auth:error"===e.data.type&&(s.remove(),"tokenExpiredError"===e.data.error.name?r(new i("identity-manager:credential-request-failed","Parent application's token has expired.")):r(i.fromJSON(e.data.error))))});d(e.options_?.signal,()=>{s.remove()})}else if(p){let o=p._oAuthCred;if(!o){const e=new T(p,q),t=new T(p,j);e.isValid()&&t.isValid()?e.expires>t.expires?(o=e,t.destroy()):(o=t,e.destroy()):o=e.isValid()?e:t,p._oAuthCred=o}if(o.isValid()){_=new L({userId:o.userId??void 0,server:c.server??void 0,token:o.token??void 0,expires:o.expires,ssl:o.ssl??void 0,_oAuthCred:o});const i=p.appId!==o.appId&&this._doPortalSignIn(e.resUrl_);i||o.refreshToken?(e._pendingDfd=o.refreshToken?this._getOAuthToken(c.server,o.refreshToken,o.appId).then(e=>(_.expires=Date.now()+1e3*e.expires_in,_.token=e.access_token,_)):Promise.resolve(_),e._pendingDfd.then(e=>i?this._exchangeToken(e.server,p.appId,e.token).then(t=>(e.token=t,e)).catch(()=>e):e).then(e=>{t(e)}).catch(e=>{const t=e.details?.httpStatus;t>0&&404!==t?(o.destroy(),s()):r(e)})):t(_)}else if(this._oAuthLocationParams&&this._hasSameServerInstance(p.portalUrl,this._oAuthLocationParams.state.portalUrl)&&(this._oAuthLocationParams.access_token||this._oAuthLocationParams.code&&this._oAuthLocationParams.state.uid===o.stateUID&&o.codeVerifier)){const s=this._oAuthLocationParams;this._oAuthLocationParams=null,e._pendingDfd=this._processOAuthResponseParams(s,p,c).then(e=>{t(e)}).catch(r)}else{const s=()=>{u?e._pendingDfd=this.oAuthSignIn(e.resUrl_,c,p,e.options_).then(t,r):(g=new i("identity-manager:not-authenticated","User is not signed in."),r(g))};this._doPortalSignIn(e.resUrl_)?e._pendingDfd=this._getPlatformSelf(c.server,p.appId).then(e=>{f(e.portalUrl,this._appOrigin,!0)?(_=new L({userId:e.username,server:c.server??void 0,expires:Date.now()+1e3*e.expires_in,token:e.token}),t(_)):s()}).catch(s):s()}}else if(u){if(this._checkProtocol(e.resUrl_,c,r,e.admin_)){let s=e.options_;e.admin_&&(s=s||{},s.isAdmin=!0),e._pendingDfd=this.signIn(e.resUrl_,c,s).then(t,r)}}else g=new i("identity-manager:not-authenticated","User is not signed in."),r(g)},o=()=>{const s=e.sinfo_,i=s.owningSystemUrl,o=e.options_;let n,a,h,l;if(o&&(n=o.token,a=o.error,h=o.prompt),l=this._findCredential(i,{token:n,resource:e.resUrl_}),!l)for(const e of this.credentials)if(this._isIdProvider(i,e.server)){l=e;break}if(l){const i=this.findCredential(e.resUrl_,l.userId);if(i)t(i);else if(b(s,this._legacyFed)){const e=l.toJSON();e.server=s.server,e.resources=null,t(new L(e))}else{(e._pendingDfd=this.generateToken(this.findServerInfo(l.server),null,{serverUrl:e.resUrl_,token:l.token,signal:e.options_.signal,ssl:l.ssl})).then(r=>{t(new L({userId:l?.userId,server:s.server??void 0,token:r.token,expires:null!=r.expires?Number(r.expires):null,ssl:!!r.ssl,isAdmin:e.admin_,validity:r.validity}))},r)}}else{this._busy=null,n&&(e.options_.token=null);(e._pendingDfd=this.getCredential(i.replace(/\/?$/,"/sharing"),{resource:e.resUrl_,owningTenant:s.owningTenant,signal:e.options_.signal,token:n,error:a,prompt:h})).then(()=>{this._enqueue(e.resUrl_,e.sinfo_,e.options_,e,e.admin_)},t=>{e.resUrl_=e.sinfo_=e.refresh_=null,e.reject(t)})}};this._errbackFunc=r;const n=e.sinfo_.owningSystemUrl,h=this._isServerRsrc(e.resUrl_),c=e.sinfo_._restInfoPms;c?c.promise.then(t=>{const r=e.sinfo_;if(r._restInfoPms){r.adminTokenServiceUrl=r._restInfoPms.adminUrl,r._restInfoPms=null,r.tokenServiceUrl=(l("authInfo.tokenServicesUrl",t)||l("authInfo.tokenServiceUrl",t)||l("tokenServiceUrl",t))??null,r.shortLivedTokenValidity=l("authInfo.shortLivedTokenValidity",t)??null,r.currentVersion=t.currentVersion,r.owningTenant=t.owningTenant;const e=r.owningSystemUrl=t.owningSystemUrl;e&&this._portals.push(e)}h&&r.owningSystemUrl?o():s()},()=>{e.sinfo_._restInfoPms=null;const t=new i("identity-manager:server-identification-failed","Unknown resource - could not find token service endpoint.");r(t)}):h&&n?o():e.sinfo_._selfReq?e.sinfo_._selfReq.selfDfd.then(t=>{const r={};let s,i,o,n;return t&&(s=t.user?.username,r.username=s,r.allSSL=t.allSSL,i=t.supportsOAuth,n=parseFloat(t.currentVersion),"multitenant"===t.portalMode&&(o=t.customBaseUrl),e.sinfo_.currentVersion=n),e.sinfo_.webTierAuth=!!s,s&&this.normalizeWebTierAuth?this.generateToken(e.sinfo_,null,{ssl:r.allSSL}).catch(()=>null).then(e=>(r.portalToken=e?.token,r.tokenExpiration=e?.expires,r)):!s&&i&&n>=4.4&&!this._findOAuthInfo(e.resUrl_)?this._generateOAuthInfo({portalUrl:e.sinfo_.server,customBaseUrl:o,owningTenant:e.sinfo_._selfReq.owningTenant}).catch(()=>null).then(()=>r):r}).catch(()=>null).then(t=>{e.sinfo_._selfReq=null,t?s(t.username,t.allSSL,t.portalToken,t.tokenExpiration):s()}):s()}_generateOAuthInfo(e){let t,r=null,i=e.portalUrl;const o=e.customBaseUrl,n=e.owningTenant,a=!this._defaultOAuthInfo&&this._createDefaultOAuthInfo&&!this._hasTestedIfAppIsOnPortal;if(a){r=this._appUrlObj.path;const e=r.search(/\/(apps|home)\//);r=e>-1?r.slice(0,e):null}return a&&r?(this._hasTestedIfAppIsOnPortal=!0,t=s(r+"/sharing/rest",{query:{f:"json"}}).then(()=>{this._defaultOAuthInfo=new x({appId:"arcgisonline",popupCallbackUrl:r+"/home/oauth-callback.html"})})):t=Promise.resolve(),t.then(()=>{if(this._defaultOAuthInfo)return i=i.replace(/^http:/i,"https:"),s(i+"/sharing/rest/oauth2/validateRedirectUri",{query:{accountId:n,client_id:this._defaultOAuthInfo.appId,redirect_uri:I(this._defaultOAuthInfo.popupCallbackUrl),f:"json"}}).then(e=>{if(e.data.valid){const t=this._defaultOAuthInfo.clone();e.data.urlKey&&o?t.portalUrl="https://"+e.data.urlKey.toLowerCase()+"."+o:t.portalUrl=i,t.popup=window!==window.top||!(f(i,this._appOrigin)||this._gwDomains.some(e=>e.regex.test(i)&&e.regex.test(this._appOrigin))),this.oAuthInfos.push(t)}})})}_doOAuthSignIn(e,t,r,s){const o=r._oAuthCred,n={portalUrl:r.portalUrl};!r.popup&&r.preserveUrlHash&&window.location.hash&&(n.hash=window.location.hash),o.stateUID&&(n.uid=o.stateUID);const h={client_id:r.appId,response_type:o.codeVerifier?"code":"token",state:JSON.stringify(n),expiration:r.expiration,locale:r.locale,redirect_uri:this._getRedirectURI(r,!!o.codeVerifier)};r.forceLogin&&(h.force_login=!0),r.forceUserId&&r.userId&&(h.prepopulatedusername=r.userId),!r.popup&&this._doPortalSignIn(e)&&(h.redirectToUserOrgUrl=!0),o.codeVerifier&&(h.code_challenge=s||o.codeVerifier,h.code_challenge_method=s?"S256":"plain");const l=r.portalUrl.replace(/^http:/i,"https:")+"/sharing/oauth2/authorize",c=l+"?"+v(h);if(r.popup){const e=window.open(c,"esriJSAPIOAuth",r.popupWindowFeatures);if(e)e.focus(),this._oAuthDfd.oAuthWin_=e,this._oAuthIntervalId=setInterval(()=>{if(e.closed){clearInterval(this._oAuthIntervalId),this._oAuthOnPopupHandle.remove();const e=this._oAuthDfd;if(e){const t=new i("identity-manager:user-aborted","ABORTED");e.reject(t)}}},500),this._oAuthOnPopupHandle=a(window,["arcgis:auth:hash","arcgis:auth:location:search"],e=>{"arcgis:auth:hash"===e.type?this.setOAuthResponseHash(e.detail):this._setOAuthResponseQueryString(e.detail)});else{const e=new i("identity-manager:popup-blocked","ABORTED");this._oAuthDfd.reject(e)}}else this._rejectOnPersistedPageShow=!0,this._oAuthRedirectFunc?this._oAuthRedirectFunc({authorizeParams:h,authorizeUrl:l,resourceUrl:e,serverInfo:t,oAuthInfo:r}):window.location.href=c}_getRedirectURI(e,t){const r=window.location.href.replace(/#.*$/,"");if(e.popup)return I(e.popupCallbackUrl);if(t){const e=_(r);return e.query&&["code","error","error_description","message_code","persist","state"].forEach(t=>{delete e.query[t]}),A(e.path,e.query)}return r}}E.prototype.declaredClass="esri.identity.IdentityManagerBase";let L=class extends o{constructor(e){super(e),this._oAuthCred=null,this.tokenRefreshBuffer=2,e?._oAuthCred&&(this._oAuthCred=e._oAuthCred)}initialize(){this.resources=this.resources||[],null==this.creationTime&&(this.creationTime=Date.now())}refreshToken(){const e=r,t=e.findServerInfo(this.server),s=t?.owningSystemUrl,i=!!s&&"server"===this.scope,o=i&&b(t,e._legacyFed),n=t.webTierAuth,a=n&&e.normalizeWebTierAuth,h=C[this.server],l=h?.[this.userId];let c,d=this.resources&&this.resources[0],u=i?e.findServerInfo(s):null,p={username:this.userId,password:l};if(n&&!a)return;i&&!u&&e.serverInfos.some(t=>(e._isIdProvider(s,t.server)&&(u=t),!!u));const _=u?e.findCredential(u.server,this.userId):null;if(!i||_){if(!o){if(i)c={serverUrl:d,token:_?.token,ssl:_?.ssl};else if(a)p=null,c={ssl:this.ssl};else{if(!l){let r;return d&&(d=e._sanitizeUrl(d),this._enqueued=1,r=e._enqueue(d,t,null,null,this.isAdmin,this),r.then(()=>{this._enqueued=0,this.refreshServerTokens()}).catch(()=>{this._enqueued=0})),r}this.isAdmin&&(c={isAdmin:!0})}return e.generateToken(i?u:t,i?null:p,c).then(e=>{this.token=e.token,this.expires=null!=e.expires?Number(e.expires):null,this.creationTime=Date.now(),this.validity=e.validity,this.emitTokenChange(),this.refreshServerTokens()}).catch(()=>{})}_?.refreshToken()}}refreshServerTokens(){if("portal"===this.scope){const e=r;e.credentials.forEach(t=>{const r=e.findServerInfo(t.server),s=r?.owningSystemUrl;t!==this&&t.userId===this.userId&&s&&"server"===t.scope&&(e._hasSameServerInstance(this.server,s)||e._isIdProvider(s,this.server))&&(b(r,e._legacyFed)?(t.token=this.token,t.expires=this.expires,t.creationTime=this.creationTime,t.validity=this.validity,t.emitTokenChange()):t.refreshToken())})}}emitTokenChange(e){clearTimeout(this._refreshTimer);const t=r,s=this.server?t.findServerInfo(this.server):null,i=s?.owningSystemUrl,o=i?t.findServerInfo(i):null;!1===e||i&&"portal"!==this.scope&&(!o?.webTierAuth||t.normalizeWebTierAuth)||null==this.expires&&null==this.validity||this._startRefreshTimer(),this.emit("token-change")}destroy(){this.userId=this.server=this.token=this.expires=this.validity=this.resources=this.creationTime=null,this._oAuthCred&&(this._oAuthCred.destroy(),this._oAuthCred=null);const e=r,t=e.credentials.indexOf(this);t>-1&&e.credentials.splice(t,1),this.emitTokenChange(),this.emit("destroy")}toJSON(){const e=h({userId:this.userId,server:this.server,token:this.token,expires:this.expires,validity:this.validity,ssl:this.ssl,isAdmin:this.isAdmin,creationTime:this.creationTime,scope:this.scope}),t=this.resources;return t&&t.length>0&&(e.resources=t.slice()),e}_startRefreshTimer(){clearTimeout(this._refreshTimer);const e=6e4*this.tokenRefreshBuffer,t=2**31-1;let r=(this.validity?this.creationTime+6e4*this.validity:this.expires)-Date.now();r<0?r=0:r>t&&(r=t),this._refreshTimer=setTimeout(this.refreshToken.bind(this),r>e?r-e:r)}};e([k()],L.prototype,"creationTime",void 0),e([k()],L.prototype,"expires",void 0),e([k()],L.prototype,"isAdmin",void 0),e([k()],L.prototype,"oAuthState",void 0),e([k()],L.prototype,"resources",void 0),e([k()],L.prototype,"scope",void 0),e([k()],L.prototype,"server",void 0),e([k()],L.prototype,"ssl",void 0),e([k()],L.prototype,"token",void 0),e([k()],L.prototype,"tokenRefreshBuffer",void 0),e([k()],L.prototype,"userId",void 0),e([k()],L.prototype,"validity",void 0),L=e([y("esri.identity.Credential")],L);export{L as Credential,E as IdentityManagerBase};