@azure/msal-common 4.2.1 → 4.5.1

package/dist/request/ScopeSet.js

@@ -0,0 +1,192 @@
+/*! @azure/msal-common v4.5.1 2021-08-02 */
+'use strict';
+import { __spreadArrays } from '../_virtual/_tslib.js';
+import { ClientConfigurationError } from '../error/ClientConfigurationError.js';
+import { StringUtils } from '../utils/StringUtils.js';
+import { ClientAuthError } from '../error/ClientAuthError.js';
+import { OIDC_SCOPES } from '../utils/Constants.js';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
+ * the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions
+ * to ensure uniqueness of strings.
+ */
+var ScopeSet = /** @class */ (function () {
+    function ScopeSet(inputScopes) {
+        var _this = this;
+        // Filter empty string and null/undefined array items
+        var scopeArr = inputScopes ? StringUtils.trimArrayEntries(__spreadArrays(inputScopes)) : [];
+        var filteredInput = scopeArr ? StringUtils.removeEmptyStringsFromArray(scopeArr) : [];
+        // Validate and filter scopes (validate function throws if validation fails)
+        this.validateInputScopes(filteredInput);
+        this.scopes = new Set(); // Iterator in constructor not supported by IE11
+        filteredInput.forEach(function (scope) { return _this.scopes.add(scope); });
+    }
+    /**
+     * Factory method to create ScopeSet from space-delimited string
+     * @param inputScopeString
+     * @param appClientId
+     * @param scopesRequired
+     */
+    ScopeSet.fromString = function (inputScopeString) {
+        var scopeString = inputScopeString || "";
+        var inputScopes = scopeString.split(" ");
+        return new ScopeSet(inputScopes);
+    };
+    /**
+     * Used to validate the scopes input parameter requested  by the developer.
+     * @param {Array<string>} inputScopes - Developer requested permissions. Not all scopes are guaranteed to be included in the access token returned.
+     * @param {boolean} scopesRequired - Boolean indicating whether the scopes array is required or not
+     */
+    ScopeSet.prototype.validateInputScopes = function (inputScopes) {
+        // Check if scopes are required but not given or is an empty array
+        if (!inputScopes || inputScopes.length < 1) {
+            throw ClientConfigurationError.createEmptyScopesArrayError();
+        }
+    };
+    /**
+     * Check if a given scope is present in this set of scopes.
+     * @param scope
+     */
+    ScopeSet.prototype.containsScope = function (scope) {
+        var lowerCaseScopes = this.printScopesLowerCase().split(" ");
+        var lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
+        // compare lowercase scopes
+        return !StringUtils.isEmpty(scope) ? lowerCaseScopesSet.scopes.has(scope.toLowerCase()) : false;
+    };
+    /**
+     * Check if a set of scopes is present in this set of scopes.
+     * @param scopeSet
+     */
+    ScopeSet.prototype.containsScopeSet = function (scopeSet) {
+        var _this = this;
+        if (!scopeSet || scopeSet.scopes.size <= 0) {
+            return false;
+        }
+        return (this.scopes.size >= scopeSet.scopes.size && scopeSet.asArray().every(function (scope) { return _this.containsScope(scope); }));
+    };
+    /**
+     * Check if set of scopes contains only the defaults
+     */
+    ScopeSet.prototype.containsOnlyOIDCScopes = function () {
+        var _this = this;
+        var defaultScopeCount = 0;
+        OIDC_SCOPES.forEach(function (defaultScope) {
+            if (_this.containsScope(defaultScope)) {
+                defaultScopeCount += 1;
+            }
+        });
+        return this.scopes.size === defaultScopeCount;
+    };
+    /**
+     * Appends single scope if passed
+     * @param newScope
+     */
+    ScopeSet.prototype.appendScope = function (newScope) {
+        if (!StringUtils.isEmpty(newScope)) {
+            this.scopes.add(newScope.trim());
+        }
+    };
+    /**
+     * Appends multiple scopes if passed
+     * @param newScopes
+     */
+    ScopeSet.prototype.appendScopes = function (newScopes) {
+        var _this = this;
+        try {
+            newScopes.forEach(function (newScope) { return _this.appendScope(newScope); });
+        }
+        catch (e) {
+            throw ClientAuthError.createAppendScopeSetError(e);
+        }
+    };
+    /**
+     * Removes element from set of scopes.
+     * @param scope
+     */
+    ScopeSet.prototype.removeScope = function (scope) {
+        if (StringUtils.isEmpty(scope)) {
+            throw ClientAuthError.createRemoveEmptyScopeFromSetError(scope);
+        }
+        this.scopes.delete(scope.trim());
+    };
+    /**
+     * Removes default scopes from set of scopes
+     * Primarily used to prevent cache misses if the default scopes are not returned from the server
+     */
+    ScopeSet.prototype.removeOIDCScopes = function () {
+        var _this = this;
+        OIDC_SCOPES.forEach(function (defaultScope) {
+            _this.scopes.delete(defaultScope);
+        });
+    };
+    /**
+     * Combines an array of scopes with the current set of scopes.
+     * @param otherScopes
+     */
+    ScopeSet.prototype.unionScopeSets = function (otherScopes) {
+        if (!otherScopes) {
+            throw ClientAuthError.createEmptyInputScopeSetError();
+        }
+        var unionScopes = new Set(); // Iterator in constructor not supported in IE11
+        otherScopes.scopes.forEach(function (scope) { return unionScopes.add(scope.toLowerCase()); });
+        this.scopes.forEach(function (scope) { return unionScopes.add(scope.toLowerCase()); });
+        return unionScopes;
+    };
+    /**
+     * Check if scopes intersect between this set and another.
+     * @param otherScopes
+     */
+    ScopeSet.prototype.intersectingScopeSets = function (otherScopes) {
+        if (!otherScopes) {
+            throw ClientAuthError.createEmptyInputScopeSetError();
+        }
+        // Do not allow OIDC scopes to be the only intersecting scopes
+        if (!otherScopes.containsOnlyOIDCScopes()) {
+            otherScopes.removeOIDCScopes();
+        }
+        var unionScopes = this.unionScopeSets(otherScopes);
+        var sizeOtherScopes = otherScopes.getScopeCount();
+        var sizeThisScopes = this.getScopeCount();
+        var sizeUnionScopes = unionScopes.size;
+        return sizeUnionScopes < (sizeThisScopes + sizeOtherScopes);
+    };
+    /**
+     * Returns size of set of scopes.
+     */
+    ScopeSet.prototype.getScopeCount = function () {
+        return this.scopes.size;
+    };
+    /**
+     * Returns the scopes as an array of string values
+     */
+    ScopeSet.prototype.asArray = function () {
+        var array = [];
+        this.scopes.forEach(function (val) { return array.push(val); });
+        return array;
+    };
+    /**
+     * Prints scopes into a space-delimited string
+     */
+    ScopeSet.prototype.printScopes = function () {
+        if (this.scopes) {
+            var scopeArr = this.asArray();
+            return scopeArr.join(" ");
+        }
+        return "";
+    };
+    /**
+     * Prints scopes into a space-delimited lower-case string (used for caching)
+     */
+    ScopeSet.prototype.printScopesLowerCase = function () {
+        return this.printScopes().toLowerCase();
+    };
+    return ScopeSet;
+}());
+
+export { ScopeSet };
+//# sourceMappingURL=ScopeSet.js.map

package/dist/request/ScopeSet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopeSet.js","sources":["../../src/request/ScopeSet.ts"],"sourcesContent":["/*\n * Copyright (c) Microsoft Corporation. All rights reserved.\n * Licensed under the MIT License.\n */\n\nimport { ClientConfigurationError } from \"../error/ClientConfigurationError\";\nimport { StringUtils } from \"../utils/StringUtils\";\nimport { ClientAuthError } from \"../error/ClientAuthError\";\nimport { OIDC_SCOPES } from \"../utils/Constants\";\n\n/**\n * The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes\n * the most sense to implement for this class. All scopes are trimmed and converted to lower case strings in intersection and union functions\n * to ensure uniqueness of strings.\n */\nexport class ScopeSet {\n    // Scopes as a Set of strings\n    private scopes: Set<string>;\n\n    constructor(inputScopes: Array<string>) {\n        // Filter empty string and null/undefined array items\n        const scopeArr = inputScopes ? StringUtils.trimArrayEntries([...inputScopes]) : [];\n        const filteredInput = scopeArr ? StringUtils.removeEmptyStringsFromArray(scopeArr) : [];\n\n        // Validate and filter scopes (validate function throws if validation fails)\n        this.validateInputScopes(filteredInput);\n\n        this.scopes = new Set<string>(); // Iterator in constructor not supported by IE11\n        filteredInput.forEach(scope => this.scopes.add(scope));\n    }\n\n    /**\n     * Factory method to create ScopeSet from space-delimited string\n     * @param inputScopeString\n     * @param appClientId\n     * @param scopesRequired\n     */\n    static fromString(inputScopeString: string): ScopeSet {\n        const scopeString = inputScopeString || \"\";\n        const inputScopes: Array<string> = scopeString.split(\" \");\n        return new ScopeSet(inputScopes);\n    }\n\n    /**\n     * Used to validate the scopes input parameter requested  by the developer.\n     * @param {Array<string>} inputScopes - Developer requested permissions. Not all scopes are guaranteed to be included in the access token returned.\n     * @param {boolean} scopesRequired - Boolean indicating whether the scopes array is required or not\n     */\n    private validateInputScopes(inputScopes: Array<string>): void {\n        // Check if scopes are required but not given or is an empty array\n        if (!inputScopes || inputScopes.length < 1) {\n            throw ClientConfigurationError.createEmptyScopesArrayError();\n        }\n    }\n\n    /**\n     * Check if a given scope is present in this set of scopes.\n     * @param scope\n     */\n    containsScope(scope: string): boolean {\n        const lowerCaseScopes = this.printScopesLowerCase().split(\" \");\n        const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);\n        // compare lowercase scopes\n        return !StringUtils.isEmpty(scope) ? lowerCaseScopesSet.scopes.has(scope.toLowerCase()) : false;\n    }\n\n    /**\n     * Check if a set of scopes is present in this set of scopes.\n     * @param scopeSet\n     */\n    containsScopeSet(scopeSet: ScopeSet): boolean {\n        if (!scopeSet || scopeSet.scopes.size <= 0) {\n            return false;\n        }\n\n        return (this.scopes.size >= scopeSet.scopes.size && scopeSet.asArray().every(scope => this.containsScope(scope)));\n    }\n\n    /**\n     * Check if set of scopes contains only the defaults\n     */\n    containsOnlyOIDCScopes(): boolean {\n        let defaultScopeCount = 0;\n        OIDC_SCOPES.forEach((defaultScope: string) => {\n            if (this.containsScope(defaultScope)) {\n                defaultScopeCount += 1;\n            }\n        });\n\n        return this.scopes.size === defaultScopeCount;\n    }\n\n    /**\n     * Appends single scope if passed\n     * @param newScope\n     */\n    appendScope(newScope: string): void {\n        if (!StringUtils.isEmpty(newScope)) {\n            this.scopes.add(newScope.trim());\n        }\n    }\n\n    /**\n     * Appends multiple scopes if passed\n     * @param newScopes\n     */\n    appendScopes(newScopes: Array<string>): void {\n        try {\n            newScopes.forEach(newScope => this.appendScope(newScope));\n        } catch (e) {\n            throw ClientAuthError.createAppendScopeSetError(e);\n        }\n    }\n\n    /**\n     * Removes element from set of scopes.\n     * @param scope\n     */\n    removeScope(scope: string): void {\n        if (StringUtils.isEmpty(scope)) {\n            throw ClientAuthError.createRemoveEmptyScopeFromSetError(scope);\n        }\n        this.scopes.delete(scope.trim());\n    }\n\n    /**\n     * Removes default scopes from set of scopes\n     * Primarily used to prevent cache misses if the default scopes are not returned from the server\n     */\n    removeOIDCScopes(): void {\n        OIDC_SCOPES.forEach((defaultScope: string) => {\n            this.scopes.delete(defaultScope);\n        });\n    }\n\n    /**\n     * Combines an array of scopes with the current set of scopes.\n     * @param otherScopes\n     */\n    unionScopeSets(otherScopes: ScopeSet): Set<string> {\n        if (!otherScopes) {\n            throw ClientAuthError.createEmptyInputScopeSetError();\n        }\n        const unionScopes = new Set<string>(); // Iterator in constructor not supported in IE11\n        otherScopes.scopes.forEach(scope => unionScopes.add(scope.toLowerCase()));\n        this.scopes.forEach(scope => unionScopes.add(scope.toLowerCase()));\n        return unionScopes;\n    }\n\n    /**\n     * Check if scopes intersect between this set and another.\n     * @param otherScopes\n     */\n    intersectingScopeSets(otherScopes: ScopeSet): boolean {\n        if (!otherScopes) {\n            throw ClientAuthError.createEmptyInputScopeSetError();\n        }\n        \n        // Do not allow OIDC scopes to be the only intersecting scopes\n        if (!otherScopes.containsOnlyOIDCScopes()) {\n            otherScopes.removeOIDCScopes();\n        }\n        const unionScopes = this.unionScopeSets(otherScopes);\n        const sizeOtherScopes = otherScopes.getScopeCount();\n        const sizeThisScopes = this.getScopeCount();\n        const sizeUnionScopes = unionScopes.size;\n        return sizeUnionScopes < (sizeThisScopes + sizeOtherScopes);\n    }\n\n    /**\n     * Returns size of set of scopes.\n     */\n    getScopeCount(): number {\n        return this.scopes.size;\n    }\n\n    /**\n     * Returns the scopes as an array of string values\n     */\n    asArray(): Array<string> {\n        const array: Array<string> = [];\n        this.scopes.forEach(val => array.push(val));\n        return array;\n    }\n\n    /**\n     * Prints scopes into a space-delimited string\n     */\n    printScopes(): string {\n        if (this.scopes) {\n            const scopeArr = this.asArray();\n            return scopeArr.join(\" \");\n        }\n        return \"\";\n    }\n\n    /**\n     * Prints scopes into a space-delimited lower-case string (used for caching)\n     */\n    printScopesLowerCase(): string {\n        return this.printScopes().toLowerCase();\n    }\n}\n"],"names":[],"mappings":";;;;;;;;AAAA;;;;AAUA;;;;;;IASI,kBAAY,WAA0B;QAAtC,iBAUC;;QARG,IAAM,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC,gBAAgB,gBAAK,WAAW,EAAE,GAAG,EAAE,CAAC;QACnF,IAAM,aAAa,GAAG,QAAQ,GAAG,WAAW,CAAC,2BAA2B,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;;QAGxF,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;QAExC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,aAAa,CAAC,OAAO,CAAC,UAAA,KAAK,IAAI,OAAA,KAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAA,CAAC,CAAC;KAC1D;;;;;;;IAQM,mBAAU,GAAjB,UAAkB,gBAAwB;QACtC,IAAM,WAAW,GAAG,gBAAgB,IAAI,EAAE,CAAC;QAC3C,IAAM,WAAW,GAAkB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;KACpC;;;;;;IAOO,sCAAmB,GAA3B,UAA4B,WAA0B;;QAElD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE;YACxC,MAAM,wBAAwB,CAAC,2BAA2B,EAAE,CAAC;SAChE;KACJ;;;;;IAMD,gCAAa,GAAb,UAAc,KAAa;QACvB,IAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAM,kBAAkB,GAAG,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;;QAEzD,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;KACnG;;;;;IAMD,mCAAgB,GAAhB,UAAiB,QAAkB;QAAnC,iBAMC;QALG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE;YACxC,OAAO,KAAK,CAAC;SAChB;QAED,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAA,KAAK,IAAI,OAAA,KAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAA,CAAC,EAAE;KACrH;;;;IAKD,yCAAsB,GAAtB;QAAA,iBASC;QARG,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,WAAW,CAAC,OAAO,CAAC,UAAC,YAAoB;YACrC,IAAI,KAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE;gBAClC,iBAAiB,IAAI,CAAC,CAAC;aAC1B;SACJ,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,CAAC;KACjD;;;;;IAMD,8BAAW,GAAX,UAAY,QAAgB;QACxB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;SACpC;KACJ;;;;;IAMD,+BAAY,GAAZ,UAAa,SAAwB;QAArC,iBAMC;QALG,IAAI;YACA,SAAS,CAAC,OAAO,CAAC,UAAA,QAAQ,IAAI,OAAA,KAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAA,CAAC,CAAC;SAC7D;QAAC,OAAO,CAAC,EAAE;YACR,MAAM,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;SACtD;KACJ;;;;;IAMD,8BAAW,GAAX,UAAY,KAAa;QACrB,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YAC5B,MAAM,eAAe,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC;SACnE;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;KACpC;;;;;IAMD,mCAAgB,GAAhB;QAAA,iBAIC;QAHG,WAAW,CAAC,OAAO,CAAC,UAAC,YAAoB;YACrC,KAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;SACpC,CAAC,CAAC;KACN;;;;;IAMD,iCAAc,GAAd,UAAe,WAAqB;QAChC,IAAI,CAAC,WAAW,EAAE;YACd,MAAM,eAAe,CAAC,6BAA6B,EAAE,CAAC;SACzD;QACD,IAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAA,KAAK,IAAI,OAAA,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAA,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAA,KAAK,IAAI,OAAA,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAA,CAAC,CAAC;QACnE,OAAO,WAAW,CAAC;KACtB;;;;;IAMD,wCAAqB,GAArB,UAAsB,WAAqB;QACvC,IAAI,CAAC,WAAW,EAAE;YACd,MAAM,eAAe,CAAC,6BAA6B,EAAE,CAAC;SACzD;;QAGD,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,EAAE;YACvC,WAAW,CAAC,gBAAgB,EAAE,CAAC;SAClC;QACD,IAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACrD,IAAM,eAAe,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;QACpD,IAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,IAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC;QACzC,OAAO,eAAe,IAAI,cAAc,GAAG,eAAe,CAAC,CAAC;KAC/D;;;;IAKD,gCAAa,GAAb;QACI,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;KAC3B;;;;IAKD,0BAAO,GAAP;QACI,IAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAA,GAAG,IAAI,OAAA,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAA,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;KAChB;;;;IAKD,8BAAW,GAAX;QACI,IAAI,IAAI,CAAC,MAAM,EAAE;YACb,IAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC7B;QACD,OAAO,EAAE,CAAC;KACb;;;;IAKD,uCAAoB,GAApB;QACI,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;KAC3C;IACL,eAAC;AAAD,CAAC;;;;"}

package/dist/response/AuthenticationResult.d.ts

@@ -24,7 +24,7 @@ export declare type AuthenticationResult = {
     idTokenClaims: object;
     accessToken: string;
     fromCache: boolean;
-    expiresOn: Date;
+    expiresOn: Date | null;
     tokenType: string;
     extExpiresOn?: Date;
     state?: string;

package/dist/response/AuthenticationResult.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationResult.d.ts","sourceRoot":"","sources":["../../src/response/AuthenticationResult.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,oBAAY,oBAAoB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}
+{"version":3,"file":"AuthenticationResult.d.ts","sourceRoot":"","sources":["../../src/response/AuthenticationResult.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,oBAAY,oBAAoB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}

package/dist/response/AuthorizationCodePayload.d.ts

@@ -9,5 +9,6 @@ export declare type AuthorizationCodePayload = {
     msgraph_host?: string;
     state?: string;
     nonce?: string;
+    client_info?: string;
 };
 //# sourceMappingURL=AuthorizationCodePayload.d.ts.map

package/dist/response/AuthorizationCodePayload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationCodePayload.d.ts","sourceRoot":"","sources":["../../src/response/AuthorizationCodePayload.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,oBAAY,wBAAwB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAC"}
+{"version":3,"file":"AuthorizationCodePayload.d.ts","sourceRoot":"","sources":["../../src/response/AuthorizationCodePayload.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,oBAAY,wBAAwB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}

package/dist/response/IMDSBadResponse.d.ts

@@ -0,0 +1,5 @@
+export declare type IMDSBadResponse = {
+    error: string;
+    "newest-versions": Array<string>;
+};
+//# sourceMappingURL=IMDSBadResponse.d.ts.map

package/dist/response/IMDSBadResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IMDSBadResponse.d.ts","sourceRoot":"","sources":["../../src/response/IMDSBadResponse.ts"],"names":[],"mappings":"AAKA,oBAAY,eAAe,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACpC,CAAC"}

package/dist/response/ResponseHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResponseHandler.d.ts","sourceRoot":"","sources":["../../src/response/ResponseHandler.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAEtF,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAMnD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAiB,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAI3E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D;;GAEG;AACH,qBAAa,eAAe;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,iBAAiB,CAAiC;IAC1D,OAAO,CAAC,iBAAiB,CAAsB;gBAEnC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,GAAG,IAAI,EAAE,iBAAiB,EAAE,YAAY,GAAG,IAAI;IASvL;;;;;OAKG;IACH,uCAAuC,CAAC,kBAAkB,EAAE,+BAA+B,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IAwB3I;;;OAGG;IACH,qBAAqB,CAAC,cAAc,EAAE,gCAAgC,GAAG,IAAI;IAY7E;;;;OAIG;IACG,yBAAyB,CAC3B,mBAAmB,EAAE,gCAAgC,EACrD,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,EACxB,eAAe,CAAC,EAAE,wBAAwB,EAC1C,YAAY,CAAC,EAAE,MAAM,EACrB,4BAA4B,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAuD1E;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAqF3B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAqB7B;;;;;;;;;OASG;WACU,4BAA4B,CACrC,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,EACvB,OAAO,EAAE,eAAe,EACxB,UAAU,CAAC,EAAE,SAAS,EACtB,YAAY,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CA6CxE"}
+{"version":3,"file":"ResponseHandler.d.ts","sourceRoot":"","sources":["../../src/response/ResponseHandler.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAEtF,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAMnD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAiB,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAI3E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D;;GAEG;AACH,qBAAa,eAAe;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,iBAAiB,CAAiC;IAC1D,OAAO,CAAC,iBAAiB,CAAsB;gBAEnC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,GAAG,IAAI,EAAE,iBAAiB,EAAE,YAAY,GAAG,IAAI;IASvL;;;;;OAKG;IACH,uCAAuC,CAAC,kBAAkB,EAAE,+BAA+B,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IAwB3I;;;OAGG;IACH,qBAAqB,CAAC,cAAc,EAAE,gCAAgC,GAAG,IAAI;IAY7E;;;;OAIG;IACG,yBAAyB,CAC3B,mBAAmB,EAAE,gCAAgC,EACrD,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,EACxB,eAAe,CAAC,EAAE,wBAAwB,EAC1C,YAAY,CAAC,EAAE,MAAM,EACrB,4BAA4B,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAuD1E;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAqF3B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAqB7B;;;;;;;;;OASG;WACU,4BAA4B,CACrC,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,EACvB,OAAO,EAAE,eAAe,EACxB,UAAU,CAAC,EAAE,SAAS,EACtB,YAAY,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CA4CxE"}

package/dist/response/ResponseHandler.js

@@ -0,0 +1,281 @@
+/*! @azure/msal-common v4.5.1 2021-08-02 */
+'use strict';
+import { __awaiter, __generator } from '../_virtual/_tslib.js';
+import { buildClientInfo } from '../account/ClientInfo.js';
+import { ClientAuthError } from '../error/ClientAuthError.js';
+import { StringUtils } from '../utils/StringUtils.js';
+import { ServerError } from '../error/ServerError.js';
+import { AuthToken } from '../account/AuthToken.js';
+import { ScopeSet } from '../request/ScopeSet.js';
+import { AccountEntity } from '../cache/entities/AccountEntity.js';
+import { AuthorityType } from '../authority/AuthorityType.js';
+import { IdTokenEntity } from '../cache/entities/IdTokenEntity.js';
+import { AccessTokenEntity } from '../cache/entities/AccessTokenEntity.js';
+import { RefreshTokenEntity } from '../cache/entities/RefreshTokenEntity.js';
+import { InteractionRequiredAuthError } from '../error/InteractionRequiredAuthError.js';
+import { CacheRecord } from '../cache/entities/CacheRecord.js';
+import { ProtocolUtils } from '../utils/ProtocolUtils.js';
+import { Constants, AuthenticationScheme, THE_FAMILY_ID } from '../utils/Constants.js';
+import { PopTokenGenerator } from '../crypto/PopTokenGenerator.js';
+import { AppMetadataEntity } from '../cache/entities/AppMetadataEntity.js';
+import { TokenCacheContext } from '../cache/persistence/TokenCacheContext.js';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Class that handles response parsing.
+ */
+var ResponseHandler = /** @class */ (function () {
+    function ResponseHandler(clientId, cacheStorage, cryptoObj, logger, serializableCache, persistencePlugin) {
+        this.clientId = clientId;
+        this.cacheStorage = cacheStorage;
+        this.cryptoObj = cryptoObj;
+        this.logger = logger;
+        this.serializableCache = serializableCache;
+        this.persistencePlugin = persistencePlugin;
+    }
+    /**
+     * Function which validates server authorization code response.
+     * @param serverResponseHash
+     * @param cachedState
+     * @param cryptoObj
+     */
+    ResponseHandler.prototype.validateServerAuthorizationCodeResponse = function (serverResponseHash, cachedState, cryptoObj) {
+        if (!serverResponseHash.state || !cachedState) {
+            throw !serverResponseHash.state ? ClientAuthError.createStateNotFoundError("Server State") : ClientAuthError.createStateNotFoundError("Cached State");
+        }
+        if (decodeURIComponent(serverResponseHash.state) !== decodeURIComponent(cachedState)) {
+            throw ClientAuthError.createStateMismatchError();
+        }
+        // Check for error
+        if (serverResponseHash.error || serverResponseHash.error_description || serverResponseHash.suberror) {
+            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponseHash.error, serverResponseHash.error_description, serverResponseHash.suberror)) {
+                throw new InteractionRequiredAuthError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror);
+            }
+            throw new ServerError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror);
+        }
+        if (serverResponseHash.client_info) {
+            buildClientInfo(serverResponseHash.client_info, cryptoObj);
+        }
+    };
+    /**
+     * Function which validates server authorization token response.
+     * @param serverResponse
+     */
+    ResponseHandler.prototype.validateTokenResponse = function (serverResponse) {
+        // Check for error
+        if (serverResponse.error || serverResponse.error_description || serverResponse.suberror) {
+            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
+                throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror);
+            }
+            var errString = serverResponse.error_codes + " - [" + serverResponse.timestamp + "]: " + serverResponse.error_description + " - Correlation ID: " + serverResponse.correlation_id + " - Trace ID: " + serverResponse.trace_id;
+            throw new ServerError(serverResponse.error, errString, serverResponse.suberror);
+        }
+    };
+    /**
+     * Returns a constructed token response based on given string. Also manages the cache updates and cleanups.
+     * @param serverTokenResponse
+     * @param authority
+     */
+    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, oboAssertion, handlingRefreshTokenResponse) {
+        return __awaiter(this, void 0, void 0, function () {
+            var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (serverTokenResponse.id_token) {
+                            idTokenObj = new AuthToken(serverTokenResponse.id_token || Constants.EMPTY_STRING, this.cryptoObj);
+                            // token nonce check (TODO: Add a warning if no nonce is given?)
+                            if (authCodePayload && !StringUtils.isEmpty(authCodePayload.nonce)) {
+                                if (idTokenObj.claims.nonce !== authCodePayload.nonce) {
+                                    throw ClientAuthError.createNonceMismatchError();
+                                }
+                            }
+                        }
+                        // generate homeAccountId
+                        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
+                        if (!!authCodePayload && !!authCodePayload.state) {
+                            requestStateObj = ProtocolUtils.parseRequestState(this.cryptoObj, authCodePayload.state);
+                        }
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, , 4, 7]);
+                        if (!(this.persistencePlugin && this.serializableCache)) return [3 /*break*/, 3];
+                        this.logger.verbose("Persistence enabled, calling beforeCacheAccess");
+                        cacheContext = new TokenCacheContext(this.serializableCache, true);
+                        return [4 /*yield*/, this.persistencePlugin.beforeCacheAccess(cacheContext)];
+                    case 2:
+                        _a.sent();
+                        _a.label = 3;
+                    case 3:
+                        /*
+                         * When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.
+                         * If not present, we should return null, as it's the case that another application called removeAccount in between
+                         * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal.
+                         */
+                        if (handlingRefreshTokenResponse && cacheRecord.account) {
+                            key = cacheRecord.account.generateAccountKey();
+                            account = this.cacheStorage.getAccount(key);
+                            if (!account) {
+                                this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
+                                return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                            }
+                        }
+                        this.cacheStorage.saveCacheRecord(cacheRecord);
+                        return [3 /*break*/, 7];
+                    case 4:
+                        if (!(this.persistencePlugin && this.serializableCache && cacheContext)) return [3 /*break*/, 6];
+                        this.logger.verbose("Persistence enabled, calling afterCacheAccess");
+                        return [4 /*yield*/, this.persistencePlugin.afterCacheAccess(cacheContext)];
+                    case 5:
+                        _a.sent();
+                        _a.label = 6;
+                    case 6: return [7 /*endfinally*/];
+                    case 7: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj)];
+                }
+            });
+        });
+    };
+    /**
+     * Generates CacheRecord
+     * @param serverTokenResponse
+     * @param idTokenObj
+     * @param authority
+     */
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, idTokenObj, requestScopes, oboAssertion, authCodePayload) {
+        var env = authority.getPreferredCache();
+        if (StringUtils.isEmpty(env)) {
+            throw ClientAuthError.createInvalidCacheEnvironmentError();
+        }
+        // IdToken: non AAD scenarios can have empty realm
+        var cachedIdToken;
+        var cachedAccount;
+        if (!StringUtils.isEmpty(serverTokenResponse.id_token) && !!idTokenObj) {
+            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING, oboAssertion);
+            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, oboAssertion, authCodePayload);
+        }
+        // AccessToken
+        var cachedAccessToken = null;
+        if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
+            // If scopes not returned in server response, use request scopes
+            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(requestScopes || []);
+            /*
+             * Use timestamp calculated before request
+             * Server may return timestamps as strings, parse to numbers if so.
+             */
+            var expiresIn = (typeof serverTokenResponse.expires_in === "string" ? parseInt(serverTokenResponse.expires_in, 10) : serverTokenResponse.expires_in) || 0;
+            var extExpiresIn = (typeof serverTokenResponse.ext_expires_in === "string" ? parseInt(serverTokenResponse.ext_expires_in, 10) : serverTokenResponse.ext_expires_in) || 0;
+            var refreshIn = (typeof serverTokenResponse.refresh_in === "string" ? parseInt(serverTokenResponse.refresh_in, 10) : serverTokenResponse.refresh_in) || undefined;
+            var tokenExpirationSeconds = reqTimestamp + expiresIn;
+            var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
+            var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
+            // non AAD scenarios can have empty realm
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion);
+        }
+        // refreshToken
+        var cachedRefreshToken = null;
+        if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {
+            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, oboAssertion);
+        }
+        // appMetadata
+        var cachedAppMetadata = null;
+        if (!StringUtils.isEmpty(serverTokenResponse.foci)) {
+            cachedAppMetadata = AppMetadataEntity.createAppMetadataEntity(this.clientId, env, serverTokenResponse.foci);
+        }
+        return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);
+    };
+    /**
+     * Generate Account
+     * @param serverTokenResponse
+     * @param idToken
+     * @param authority
+     */
+    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, oboAssertion, authCodePayload) {
+        var authorityType = authority.authorityType;
+        var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : "";
+        var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : "";
+        // ADFS does not require client_info in the response
+        if (authorityType === AuthorityType.Adfs) {
+            this.logger.verbose("Authority type is ADFS, creating ADFS account");
+            return AccountEntity.createGenericAccount(authority, this.homeAccountIdentifier, idToken, oboAssertion, cloudGraphHostName, msGraphhost);
+        }
+        // This fallback applies to B2C as well as they fall under an AAD account type.
+        if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === "AAD") {
+            throw ClientAuthError.createClientInfoEmptyError();
+        }
+        return serverTokenResponse.client_info ?
+            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, authority, idToken, oboAssertion, cloudGraphHostName, msGraphhost) :
+            AccountEntity.createGenericAccount(authority, this.homeAccountIdentifier, idToken, oboAssertion, cloudGraphHostName, msGraphhost);
+    };
+    /**
+     * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
+     *
+     * Optionally takes a state string that is set as-is in the response.
+     *
+     * @param cacheRecord
+     * @param idTokenObj
+     * @param fromTokenCache
+     * @param stateString
+     */
+    ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function () {
+            var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        accessToken = "";
+                        responseScopes = [];
+                        expiresOn = null;
+                        familyId = Constants.EMPTY_STRING;
+                        if (!cacheRecord.accessToken) return [3 /*break*/, 4];
+                        if (!(cacheRecord.accessToken.tokenType === AuthenticationScheme.POP)) return [3 /*break*/, 2];
+                        popTokenGenerator = new PopTokenGenerator(cryptoObj);
+                        return [4 /*yield*/, popTokenGenerator.signPopToken(cacheRecord.accessToken.secret, request)];
+                    case 1:
+                        accessToken = _d.sent();
+                        return [3 /*break*/, 3];
+                    case 2:
+                        accessToken = cacheRecord.accessToken.secret;
+                        _d.label = 3;
+                    case 3:
+                        responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
+                        expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
+                        extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+                        _d.label = 4;
+                    case 4:
+                        if (cacheRecord.appMetadata) {
+                            familyId = cacheRecord.appMetadata.familyId === THE_FAMILY_ID ? THE_FAMILY_ID : Constants.EMPTY_STRING;
+                        }
+                        uid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.oid) || (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.sub) || Constants.EMPTY_STRING;
+                        tid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.tid) || Constants.EMPTY_STRING;
+                        return [2 /*return*/, {
+                                authority: authority.canonicalAuthority,
+                                uniqueId: uid,
+                                tenantId: tid,
+                                scopes: responseScopes,
+                                account: cacheRecord.account ? cacheRecord.account.getAccountInfo() : null,
+                                idToken: idTokenObj ? idTokenObj.rawToken : Constants.EMPTY_STRING,
+                                idTokenClaims: idTokenObj ? idTokenObj.claims : {},
+                                accessToken: accessToken,
+                                fromCache: fromTokenCache,
+                                expiresOn: expiresOn,
+                                extExpiresOn: extExpiresOn,
+                                familyId: familyId,
+                                tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
+                                state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,
+                                cloudGraphHostName: ((_b = cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
+                                msGraphHost: ((_c = cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING
+                            }];
+                }
+            });
+        });
+    };
+    return ResponseHandler;
+}());
+
+export { ResponseHandler };
+//# sourceMappingURL=ResponseHandler.js.map

package/dist/response/ResponseHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResponseHandler.js","sources":["../../src/response/ResponseHandler.ts"],"sourcesContent":["/*\n * Copyright (c) Microsoft Corporation. All rights reserved.\n * Licensed under the MIT License.\n */\n\nimport { ServerAuthorizationTokenResponse } from \"./ServerAuthorizationTokenResponse\";\nimport { buildClientInfo} from \"../account/ClientInfo\";\nimport { ICrypto } from \"../crypto/ICrypto\";\nimport { ClientAuthError } from \"../error/ClientAuthError\";\nimport { StringUtils } from \"../utils/StringUtils\";\nimport { ServerAuthorizationCodeResponse } from \"./ServerAuthorizationCodeResponse\";\nimport { Logger } from \"../logger/Logger\";\nimport { ServerError } from \"../error/ServerError\";\nimport { AuthToken } from \"../account/AuthToken\";\nimport { ScopeSet } from \"../request/ScopeSet\";\nimport { AuthenticationResult } from \"./AuthenticationResult\";\nimport { AccountEntity } from \"../cache/entities/AccountEntity\";\nimport { Authority } from \"../authority/Authority\";\nimport { AuthorityType } from \"../authority/AuthorityType\";\nimport { IdTokenEntity } from \"../cache/entities/IdTokenEntity\";\nimport { AccessTokenEntity } from \"../cache/entities/AccessTokenEntity\";\nimport { RefreshTokenEntity } from \"../cache/entities/RefreshTokenEntity\";\nimport { InteractionRequiredAuthError } from \"../error/InteractionRequiredAuthError\";\nimport { CacheRecord } from \"../cache/entities/CacheRecord\";\nimport { CacheManager } from \"../cache/CacheManager\";\nimport { ProtocolUtils, RequestStateObject } from \"../utils/ProtocolUtils\";\nimport { AuthenticationScheme, Constants, THE_FAMILY_ID } from \"../utils/Constants\";\nimport { PopTokenGenerator } from \"../crypto/PopTokenGenerator\";\nimport { AppMetadataEntity } from \"../cache/entities/AppMetadataEntity\";\nimport { ICachePlugin } from \"../cache/interface/ICachePlugin\";\nimport { TokenCacheContext } from \"../cache/persistence/TokenCacheContext\";\nimport { ISerializableTokenCache } from \"../cache/interface/ISerializableTokenCache\";\nimport { AuthorizationCodePayload } from \"./AuthorizationCodePayload\";\nimport { BaseAuthRequest } from \"../request/BaseAuthRequest\";\n\n/**\n * Class that handles response parsing.\n */\nexport class ResponseHandler {\n    private clientId: string;\n    private cacheStorage: CacheManager;\n    private cryptoObj: ICrypto;\n    private logger: Logger;\n    private homeAccountIdentifier: string;\n    private serializableCache: ISerializableTokenCache | null;\n    private persistencePlugin: ICachePlugin | null;\n\n    constructor(clientId: string, cacheStorage: CacheManager, cryptoObj: ICrypto, logger: Logger, serializableCache: ISerializableTokenCache | null, persistencePlugin: ICachePlugin | null) {\n        this.clientId = clientId;\n        this.cacheStorage = cacheStorage;\n        this.cryptoObj = cryptoObj;\n        this.logger = logger;\n        this.serializableCache = serializableCache;\n        this.persistencePlugin = persistencePlugin;\n    }\n\n    /**\n     * Function which validates server authorization code response.\n     * @param serverResponseHash\n     * @param cachedState\n     * @param cryptoObj\n     */\n    validateServerAuthorizationCodeResponse(serverResponseHash: ServerAuthorizationCodeResponse, cachedState: string, cryptoObj: ICrypto): void {\n\n        if (!serverResponseHash.state || !cachedState) {\n            throw !serverResponseHash.state ? ClientAuthError.createStateNotFoundError(\"Server State\") : ClientAuthError.createStateNotFoundError(\"Cached State\");\n        }\n\n        if (decodeURIComponent(serverResponseHash.state) !== decodeURIComponent(cachedState)) {\n            throw ClientAuthError.createStateMismatchError();\n        }\n\n        // Check for error\n        if (serverResponseHash.error || serverResponseHash.error_description || serverResponseHash.suberror) {\n            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponseHash.error, serverResponseHash.error_description, serverResponseHash.suberror)) {\n                throw new InteractionRequiredAuthError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror);\n            }\n\n            throw new ServerError(serverResponseHash.error || Constants.EMPTY_STRING, serverResponseHash.error_description, serverResponseHash.suberror);\n        }\n\n        if (serverResponseHash.client_info) {\n            buildClientInfo(serverResponseHash.client_info, cryptoObj);\n        }\n    }\n\n    /**\n     * Function which validates server authorization token response.\n     * @param serverResponse\n     */\n    validateTokenResponse(serverResponse: ServerAuthorizationTokenResponse): void {\n        // Check for error\n        if (serverResponse.error || serverResponse.error_description || serverResponse.suberror) {\n            if (InteractionRequiredAuthError.isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {\n                throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror);\n            }\n\n            const errString = `${serverResponse.error_codes} - [${serverResponse.timestamp}]: ${serverResponse.error_description} - Correlation ID: ${serverResponse.correlation_id} - Trace ID: ${serverResponse.trace_id}`;\n            throw new ServerError(serverResponse.error, errString, serverResponse.suberror);\n        }\n    }\n\n    /**\n     * Returns a constructed token response based on given string. Also manages the cache updates and cleanups.\n     * @param serverTokenResponse\n     * @param authority\n     */\n    async handleServerTokenResponse(\n        serverTokenResponse: ServerAuthorizationTokenResponse,\n        authority: Authority,\n        reqTimestamp: number,\n        request: BaseAuthRequest,\n        authCodePayload?: AuthorizationCodePayload,\n        oboAssertion?: string,\n        handlingRefreshTokenResponse?: boolean): Promise<AuthenticationResult> {\n\n        // create an idToken object (not entity)\n        let idTokenObj: AuthToken | undefined;\n        if (serverTokenResponse.id_token) {\n            idTokenObj = new AuthToken(serverTokenResponse.id_token || Constants.EMPTY_STRING, this.cryptoObj);\n    \n            // token nonce check (TODO: Add a warning if no nonce is given?)\n            if (authCodePayload && !StringUtils.isEmpty(authCodePayload.nonce)) {\n                if (idTokenObj.claims.nonce !== authCodePayload.nonce) {\n                    throw ClientAuthError.createNonceMismatchError();\n                }\n            }\n        }\n\n        // generate homeAccountId\n        this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);\n\n        // save the response tokens\n        let requestStateObj: RequestStateObject | undefined;\n        if (!!authCodePayload && !!authCodePayload.state) {\n            requestStateObj = ProtocolUtils.parseRequestState(this.cryptoObj, authCodePayload.state);\n        }\n\n        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);\n        let cacheContext;\n        try {\n            if (this.persistencePlugin && this.serializableCache) {\n                this.logger.verbose(\"Persistence enabled, calling beforeCacheAccess\");\n                cacheContext = new TokenCacheContext(this.serializableCache, true);\n                await this.persistencePlugin.beforeCacheAccess(cacheContext);\n            }\n            /*\n             * When saving a refreshed tokens to the cache, it is expected that the account that was used is present in the cache.\n             * If not present, we should return null, as it's the case that another application called removeAccount in between\n             * the calls to getAllAccounts and acquireTokenSilent. We should not overwrite that removal.\n             */\n            if (handlingRefreshTokenResponse && cacheRecord.account) {\n                const key = cacheRecord.account.generateAccountKey();\n                const account = this.cacheStorage.getAccount(key);\n                if (!account) {\n                    this.logger.warning(\"Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache\");\n                    return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj);\n                }\n            }\n            this.cacheStorage.saveCacheRecord(cacheRecord);\n        } finally {\n            if (this.persistencePlugin && this.serializableCache && cacheContext) {\n                this.logger.verbose(\"Persistence enabled, calling afterCacheAccess\");\n                await this.persistencePlugin.afterCacheAccess(cacheContext);\n            }\n        }\n        return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj);\n    }\n\n    /**\n     * Generates CacheRecord\n     * @param serverTokenResponse\n     * @param idTokenObj\n     * @param authority\n     */\n    private generateCacheRecord(serverTokenResponse: ServerAuthorizationTokenResponse, authority: Authority, reqTimestamp: number, idTokenObj?: AuthToken, requestScopes?: string[], oboAssertion?: string, authCodePayload?: AuthorizationCodePayload): CacheRecord {\n        const env = authority.getPreferredCache();\n        if (StringUtils.isEmpty(env)) {\n            throw ClientAuthError.createInvalidCacheEnvironmentError();\n        }\n\n        // IdToken: non AAD scenarios can have empty realm\n        let cachedIdToken: IdTokenEntity | undefined;\n        let cachedAccount: AccountEntity | undefined;\n        if (!StringUtils.isEmpty(serverTokenResponse.id_token) && !!idTokenObj) {\n            cachedIdToken = IdTokenEntity.createIdTokenEntity(\n                this.homeAccountIdentifier,\n                env,\n                serverTokenResponse.id_token || Constants.EMPTY_STRING,\n                this.clientId,\n                idTokenObj.claims.tid || Constants.EMPTY_STRING,\n                oboAssertion\n            );\n\n            cachedAccount = this.generateAccountEntity(\n                serverTokenResponse,\n                idTokenObj,\n                authority,\n                oboAssertion,\n                authCodePayload\n            );\n        }\n\n        // AccessToken\n        let cachedAccessToken: AccessTokenEntity | null = null;\n        if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {\n\n            // If scopes not returned in server response, use request scopes\n            const responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(requestScopes || []);\n\n            /*\n             * Use timestamp calculated before request\n             * Server may return timestamps as strings, parse to numbers if so.\n             */\n            const expiresIn: number = (typeof serverTokenResponse.expires_in === \"string\" ? parseInt(serverTokenResponse.expires_in, 10) : serverTokenResponse.expires_in) || 0;\n            const extExpiresIn: number = (typeof serverTokenResponse.ext_expires_in === \"string\" ? parseInt(serverTokenResponse.ext_expires_in, 10) : serverTokenResponse.ext_expires_in) || 0;\n            const refreshIn: number | undefined = (typeof serverTokenResponse.refresh_in === \"string\" ? parseInt(serverTokenResponse.refresh_in, 10) : serverTokenResponse.refresh_in) || undefined;\n            const tokenExpirationSeconds = reqTimestamp + expiresIn;\n            const extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;\n            const refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;\n\n            // non AAD scenarios can have empty realm\n            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(\n                this.homeAccountIdentifier,\n                env,\n                serverTokenResponse.access_token || Constants.EMPTY_STRING,\n                this.clientId,\n                idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant,\n                responseScopes.printScopes(),\n                tokenExpirationSeconds,\n                extendedTokenExpirationSeconds,\n                this.cryptoObj,\n                refreshOnSeconds,\n                serverTokenResponse.token_type,\n                oboAssertion\n            );\n        }\n\n        // refreshToken\n        let cachedRefreshToken: RefreshTokenEntity | null = null;\n        if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {\n            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(\n                this.homeAccountIdentifier,\n                env,\n                serverTokenResponse.refresh_token || Constants.EMPTY_STRING,\n                this.clientId,\n                serverTokenResponse.foci,\n                oboAssertion\n            );\n        }\n\n        // appMetadata\n        let cachedAppMetadata: AppMetadataEntity | null = null;\n        if (!StringUtils.isEmpty(serverTokenResponse.foci)) {\n            cachedAppMetadata = AppMetadataEntity.createAppMetadataEntity(this.clientId, env, serverTokenResponse.foci);\n        }\n\n        return new CacheRecord(cachedAccount, cachedIdToken, cachedAccessToken, cachedRefreshToken, cachedAppMetadata);\n    }\n\n    /**\n     * Generate Account\n     * @param serverTokenResponse\n     * @param idToken\n     * @param authority\n     */\n    private generateAccountEntity(serverTokenResponse: ServerAuthorizationTokenResponse, idToken: AuthToken, authority: Authority, oboAssertion?: string, authCodePayload?: AuthorizationCodePayload): AccountEntity {\n        const authorityType = authority.authorityType;\n        const cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : \"\";\n        const msGraphhost = authCodePayload ? authCodePayload.msgraph_host : \"\";\n\n        // ADFS does not require client_info in the response\n        if (authorityType === AuthorityType.Adfs) {\n            this.logger.verbose(\"Authority type is ADFS, creating ADFS account\");\n            return AccountEntity.createGenericAccount(authority, this.homeAccountIdentifier, idToken, oboAssertion, cloudGraphHostName, msGraphhost);\n        }\n\n        // This fallback applies to B2C as well as they fall under an AAD account type.\n        if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === \"AAD\") {\n            throw ClientAuthError.createClientInfoEmptyError();\n        }\n\n        return serverTokenResponse.client_info ?\n            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, authority, idToken, oboAssertion, cloudGraphHostName, msGraphhost) :\n            AccountEntity.createGenericAccount(authority, this.homeAccountIdentifier, idToken, oboAssertion, cloudGraphHostName, msGraphhost);\n    }\n\n    /**\n     * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.\n     *\n     * Optionally takes a state string that is set as-is in the response.\n     *\n     * @param cacheRecord\n     * @param idTokenObj\n     * @param fromTokenCache\n     * @param stateString\n     */\n    static async generateAuthenticationResult(\n        cryptoObj: ICrypto, \n        authority: Authority,\n        cacheRecord: CacheRecord, \n        fromTokenCache: boolean, \n        request: BaseAuthRequest,\n        idTokenObj?: AuthToken,\n        requestState?: RequestStateObject): Promise<AuthenticationResult> {\n        let accessToken: string = \"\";\n        let responseScopes: Array<string> = [];\n        let expiresOn: Date | null = null;\n        let extExpiresOn: Date | undefined;\n        let familyId: string = Constants.EMPTY_STRING;\n\n        if (cacheRecord.accessToken) {\n            if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP) {\n                const popTokenGenerator: PopTokenGenerator = new PopTokenGenerator(cryptoObj);\n                accessToken = await popTokenGenerator.signPopToken(cacheRecord.accessToken.secret, request);\n            } else {\n                accessToken = cacheRecord.accessToken.secret;\n            }\n            responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();\n            expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);\n            extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);\n        }\n\n        if (cacheRecord.appMetadata) {\n            familyId = cacheRecord.appMetadata.familyId === THE_FAMILY_ID ? THE_FAMILY_ID : Constants.EMPTY_STRING;\n        }\n        const uid = idTokenObj?.claims.oid || idTokenObj?.claims.sub || Constants.EMPTY_STRING;\n        const tid = idTokenObj?.claims.tid || Constants.EMPTY_STRING;\n\n        return {\n            authority: authority.canonicalAuthority,\n            uniqueId: uid,\n            tenantId: tid,\n            scopes: responseScopes,\n            account: cacheRecord.account ? cacheRecord.account.getAccountInfo() : null,\n            idToken: idTokenObj ? idTokenObj.rawToken : Constants.EMPTY_STRING,\n            idTokenClaims: idTokenObj ? idTokenObj.claims : {},\n            accessToken: accessToken,\n            fromCache: fromTokenCache,\n            expiresOn: expiresOn,\n            extExpiresOn: extExpiresOn,\n            familyId: familyId,\n            tokenType: cacheRecord.accessToken?.tokenType || Constants.EMPTY_STRING,\n            state: requestState ? requestState.userRequestState : Constants.EMPTY_STRING,\n            cloudGraphHostName: cacheRecord.account?.cloudGraphHostName || Constants.EMPTY_STRING,\n            msGraphHost: cacheRecord.account?.msGraphHost || Constants.EMPTY_STRING\n        };\n    }\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;;;;AAmCA;;;;IAYI,yBAAY,QAAgB,EAAE,YAA0B,EAAE,SAAkB,EAAE,MAAc,EAAE,iBAAiD,EAAE,iBAAsC;QACnL,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;KAC9C;;;;;;;IAQD,iEAAuC,GAAvC,UAAwC,kBAAmD,EAAE,WAAmB,EAAE,SAAkB;QAEhI,IAAI,CAAC,kBAAkB,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE;YAC3C,MAAM,CAAC,kBAAkB,CAAC,KAAK,GAAG,eAAe,CAAC,wBAAwB,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC;SACzJ;QAED,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,kBAAkB,CAAC,WAAW,CAAC,EAAE;YAClF,MAAM,eAAe,CAAC,wBAAwB,EAAE,CAAC;SACpD;;QAGD,IAAI,kBAAkB,CAAC,KAAK,IAAI,kBAAkB,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,QAAQ,EAAE;YACjG,IAAI,4BAA4B,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE;gBACtJ,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,CAAC,KAAK,IAAI,SAAS,CAAC,YAAY,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;aACjK;YAED,MAAM,IAAI,WAAW,CAAC,kBAAkB,CAAC,KAAK,IAAI,SAAS,CAAC,YAAY,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;SAChJ;QAED,IAAI,kBAAkB,CAAC,WAAW,EAAE;YAChC,eAAe,CAAC,kBAAkB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;SAC9D;KACJ;;;;;IAMD,+CAAqB,GAArB,UAAsB,cAAgD;;QAElE,IAAI,cAAc,CAAC,KAAK,IAAI,cAAc,CAAC,iBAAiB,IAAI,cAAc,CAAC,QAAQ,EAAE;YACrF,IAAI,4BAA4B,CAAC,0BAA0B,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,iBAAiB,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;gBAC1I,MAAM,IAAI,4BAA4B,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,iBAAiB,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;aAC3H;YAED,IAAM,SAAS,GAAM,cAAc,CAAC,WAAW,YAAO,cAAc,CAAC,SAAS,WAAM,cAAc,CAAC,iBAAiB,2BAAsB,cAAc,CAAC,cAAc,qBAAgB,cAAc,CAAC,QAAU,CAAC;YACjN,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;SACnF;KACJ;;;;;;IAOK,mDAAyB,GAA/B,UACI,mBAAqD,EACrD,SAAoB,EACpB,YAAoB,EACpB,OAAwB,EACxB,eAA0C,EAC1C,YAAqB,EACrB,4BAAsC;;;;;;wBAItC,IAAI,mBAAmB,CAAC,QAAQ,EAAE;4BAC9B,UAAU,GAAG,IAAI,SAAS,CAAC,mBAAmB,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;;4BAGnG,IAAI,eAAe,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE;gCAChE,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK,EAAE;oCACnD,MAAM,eAAe,CAAC,wBAAwB,EAAE,CAAC;iCACpD;6BACJ;yBACJ;;wBAGD,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,WAAW,IAAI,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;wBAI9L,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE;4BAC9C,eAAe,GAAG,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;yBAC5F;wBAEK,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;;;;8BAG9I,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,CAAA,EAAhD,wBAAgD;wBAChD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC;wBACtE,YAAY,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;wBACnE,qBAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAA;;wBAA5D,SAA4D,CAAC;;;;;;;;wBAOjE,IAAI,4BAA4B,IAAI,WAAW,CAAC,OAAO,EAAE;4BAC/C,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;4BAC/C,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;4BAClD,IAAI,CAAC,OAAO,EAAE;gCACV,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,qGAAqG,CAAC,CAAC;gCAC3H,sBAAO,eAAe,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAAC;6BAC5I;yBACJ;wBACD,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;;;8BAE3C,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,IAAI,YAAY,CAAA,EAAhE,wBAAgE;wBAChE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;wBACrE,qBAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAA;;wBAA3D,SAA2D,CAAC;;;4BAGpE,sBAAO,eAAe,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAAC;;;;KAC5I;;;;;;;IAQO,6CAAmB,GAA3B,UAA4B,mBAAqD,EAAE,SAAoB,EAAE,YAAoB,EAAE,UAAsB,EAAE,aAAwB,EAAE,YAAqB,EAAE,eAA0C;QAC9O,IAAM,GAAG,GAAG,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAC1C,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YAC1B,MAAM,eAAe,CAAC,kCAAkC,EAAE,CAAC;SAC9D;;QAGD,IAAI,aAAwC,CAAC;QAC7C,IAAI,aAAwC,CAAC;QAC7C,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;YACpE,aAAa,GAAG,aAAa,CAAC,mBAAmB,CAC7C,IAAI,CAAC,qBAAqB,EAC1B,GAAG,EACH,mBAAmB,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EACtD,IAAI,CAAC,QAAQ,EACb,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,YAAY,EAC/C,YAAY,CACf,CAAC;YAEF,aAAa,GAAG,IAAI,CAAC,qBAAqB,CACtC,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,eAAe,CAClB,CAAC;SACL;;QAGD,IAAI,iBAAiB,GAA6B,IAAI,CAAC;QACvD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE;;YAGxD,IAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,IAAI,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;;;;;YAMtI,IAAM,SAAS,GAAW,CAAC,OAAO,mBAAmB,CAAC,UAAU,KAAK,QAAQ,GAAG,QAAQ,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC,UAAU,KAAK,CAAC,CAAC;YACpK,IAAM,YAAY,GAAW,CAAC,OAAO,mBAAmB,CAAC,cAAc,KAAK,QAAQ,GAAG,QAAQ,CAAC,mBAAmB,CAAC,cAAc,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC,cAAc,KAAK,CAAC,CAAC;YACnL,IAAM,SAAS,GAAuB,CAAC,OAAO,mBAAmB,CAAC,UAAU,KAAK,QAAQ,GAAG,QAAQ,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC,UAAU,KAAK,SAAS,CAAC;YACxL,IAAM,sBAAsB,GAAG,YAAY,GAAG,SAAS,CAAC;YACxD,IAAM,8BAA8B,GAAG,sBAAsB,GAAG,YAAY,CAAC;YAC7E,IAAM,gBAAgB,GAAG,SAAS,IAAI,SAAS,GAAG,CAAC,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;;YAG3F,iBAAiB,GAAG,iBAAiB,CAAC,uBAAuB,CACzD,IAAI,CAAC,qBAAqB,EAC1B,GAAG,EACH,mBAAmB,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY,EAC1D,IAAI,CAAC,QAAQ,EACb,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC,MAAM,EAC/E,cAAc,CAAC,WAAW,EAAE,EAC5B,sBAAsB,EACtB,8BAA8B,EAC9B,IAAI,CAAC,SAAS,EACd,gBAAgB,EAChB,mBAAmB,CAAC,UAAU,EAC9B,YAAY,CACf,CAAC;SACL;;QAGD,IAAI,kBAAkB,GAA8B,IAAI,CAAC;QACzD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE;YACzD,kBAAkB,GAAG,kBAAkB,CAAC,wBAAwB,CAC5D,IAAI,CAAC,qBAAqB,EAC1B,GAAG,EACH,mBAAmB,CAAC,aAAa,IAAI,SAAS,CAAC,YAAY,EAC3D,IAAI,CAAC,QAAQ,EACb,mBAAmB,CAAC,IAAI,EACxB,YAAY,CACf,CAAC;SACL;;QAGD,IAAI,iBAAiB,GAA6B,IAAI,CAAC;QACvD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE;YAChD,iBAAiB,GAAG,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;SAC/G;QAED,OAAO,IAAI,WAAW,CAAC,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;KAClH;;;;;;;IAQO,+CAAqB,GAA7B,UAA8B,mBAAqD,EAAE,OAAkB,EAAE,SAAoB,EAAE,YAAqB,EAAE,eAA0C;QAC5L,IAAM,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;QAC9C,IAAM,kBAAkB,GAAG,eAAe,GAAG,eAAe,CAAC,qBAAqB,GAAG,EAAE,CAAC;QACxF,IAAM,WAAW,GAAG,eAAe,GAAG,eAAe,CAAC,YAAY,GAAG,EAAE,CAAC;;QAGxE,IAAI,aAAa,KAAK,aAAa,CAAC,IAAI,EAAE;YACtC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;YACrE,OAAO,aAAa,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;SAC5I;;QAGD,IAAI,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,EAAE;YAC1F,MAAM,eAAe,CAAC,0BAA0B,EAAE,CAAC;SACtD;QAED,OAAO,mBAAmB,CAAC,WAAW;YAClC,aAAa,CAAC,aAAa,CAAC,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,CAAC;YAC3J,aAAa,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;KACzI;;;;;;;;;;;IAYY,4CAA4B,GAAzC,UACI,SAAkB,EAClB,SAAoB,EACpB,WAAwB,EACxB,cAAuB,EACvB,OAAwB,EACxB,UAAsB,EACtB,YAAiC;;;;;;;wBAC7B,WAAW,GAAW,EAAE,CAAC;wBACzB,cAAc,GAAkB,EAAE,CAAC;wBACnC,SAAS,GAAgB,IAAI,CAAC;wBAE9B,QAAQ,GAAW,SAAS,CAAC,YAAY,CAAC;6BAE1C,WAAW,CAAC,WAAW,EAAvB,wBAAuB;8BACnB,WAAW,CAAC,WAAW,CAAC,SAAS,KAAK,oBAAoB,CAAC,GAAG,CAAA,EAA9D,wBAA8D;wBACxD,iBAAiB,GAAsB,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;wBAChE,qBAAM,iBAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EAAA;;wBAA3F,WAAW,GAAG,SAA6E,CAAC;;;wBAE5F,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC;;;wBAEjD,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;wBAC/E,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;wBACvE,YAAY,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,CAAC;;;wBAGtF,IAAI,WAAW,CAAC,WAAW,EAAE;4BACzB,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,QAAQ,KAAK,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC,YAAY,CAAC;yBAC1G;wBACK,GAAG,GAAG,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,MAAM,CAAC,GAAG,MAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,MAAM,CAAC,GAAG,CAAA,IAAI,SAAS,CAAC,YAAY,CAAC;wBACjF,GAAG,GAAG,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,MAAM,CAAC,GAAG,KAAI,SAAS,CAAC,YAAY,CAAC;wBAE7D,sBAAO;gCACH,SAAS,EAAE,SAAS,CAAC,kBAAkB;gCACvC,QAAQ,EAAE,GAAG;gCACb,QAAQ,EAAE,GAAG;gCACb,MAAM,EAAE,cAAc;gCACtB,OAAO,EAAE,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,IAAI;gCAC1E,OAAO,EAAE,UAAU,GAAG,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC,YAAY;gCAClE,aAAa,EAAE,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,EAAE;gCAClD,WAAW,EAAE,WAAW;gCACxB,SAAS,EAAE,cAAc;gCACzB,SAAS,EAAE,SAAS;gCACpB,YAAY,EAAE,YAAY;gCAC1B,QAAQ,EAAE,QAAQ;gCAClB,SAAS,EAAE,OAAA,WAAW,CAAC,WAAW,0CAAE,SAAS,KAAI,SAAS,CAAC,YAAY;gCACvE,KAAK,EAAE,YAAY,GAAG,YAAY,CAAC,gBAAgB,GAAG,SAAS,CAAC,YAAY;gCAC5E,kBAAkB,EAAE,OAAA,WAAW,CAAC,OAAO,0CAAE,kBAAkB,KAAI,SAAS,CAAC,YAAY;gCACrF,WAAW,EAAE,OAAA,WAAW,CAAC,OAAO,0CAAE,WAAW,KAAI,SAAS,CAAC,YAAY;6BAC1E,EAAC;;;;KACL;IACL,sBAAC;AAAD,CAAC;;;;"}