@azure/msal-common 4.2.1 → 4.5.1

package/dist/authority/Authority.js

@@ -0,0 +1,574 @@
+/*! @azure/msal-common v4.5.1 2021-08-02 */
+'use strict';
+import { __awaiter, __generator, __assign } from '../_virtual/_tslib.js';
+import { AuthorityType } from './AuthorityType.js';
+import { isOpenIdConfigResponse } from './OpenIdConfigResponse.js';
+import { UrlString } from '../url/UrlString.js';
+import { ClientAuthError } from '../error/ClientAuthError.js';
+import { Constants, AuthorityMetadataSource, RegionDiscoveryOutcomes } from '../utils/Constants.js';
+import { ClientConfigurationError } from '../error/ClientConfigurationError.js';
+import { ProtocolMode } from './ProtocolMode.js';
+import { AuthorityMetadataEntity } from '../cache/entities/AuthorityMetadataEntity.js';
+import { isCloudInstanceDiscoveryResponse } from './CloudInstanceDiscoveryResponse.js';
+import { RegionDiscovery } from './RegionDiscovery.js';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * The authority class validates the authority URIs used by the user, and retrieves the OpenID Configuration Data from the
+ * endpoint. It will store the pertinent config data in this object for use during token calls.
+ */
+var Authority = /** @class */ (function () {
+    function Authority(authority, networkInterface, cacheManager, authorityOptions) {
+        this.canonicalAuthority = authority;
+        this._canonicalAuthority.validateAsUri();
+        this.networkInterface = networkInterface;
+        this.cacheManager = cacheManager;
+        this.authorityOptions = authorityOptions;
+        this.regionDiscovery = new RegionDiscovery(networkInterface);
+        this.regionDiscoveryMetadata = { region_used: undefined, region_source: undefined, region_outcome: undefined };
+    }
+    Object.defineProperty(Authority.prototype, "authorityType", {
+        // See above for AuthorityType
+        get: function () {
+            var pathSegments = this.canonicalAuthorityUrlComponents.PathSegments;
+            if (pathSegments.length && pathSegments[0].toLowerCase() === Constants.ADFS) {
+                return AuthorityType.Adfs;
+            }
+            return AuthorityType.Default;
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "protocolMode", {
+        /**
+         * ProtocolMode enum representing the way endpoints are constructed.
+         */
+        get: function () {
+            return this.authorityOptions.protocolMode;
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "options", {
+        /**
+         * Returns authorityOptions which can be used to reinstantiate a new authority instance
+         */
+        get: function () {
+            return this.authorityOptions;
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "canonicalAuthority", {
+        /**
+         * A URL that is the authority set by the developer
+         */
+        get: function () {
+            return this._canonicalAuthority.urlString;
+        },
+        /**
+         * Sets canonical authority.
+         */
+        set: function (url) {
+            this._canonicalAuthority = new UrlString(url);
+            this._canonicalAuthority.validateAsUri();
+            this._canonicalAuthorityUrlComponents = null;
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "canonicalAuthorityUrlComponents", {
+        /**
+         * Get authority components.
+         */
+        get: function () {
+            if (!this._canonicalAuthorityUrlComponents) {
+                this._canonicalAuthorityUrlComponents = this._canonicalAuthority.getUrlComponents();
+            }
+            return this._canonicalAuthorityUrlComponents;
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "hostnameAndPort", {
+        /**
+         * Get hostname and port i.e. login.microsoftonline.com
+         */
+        get: function () {
+            return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase();
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "tenant", {
+        /**
+         * Get tenant for authority.
+         */
+        get: function () {
+            return this.canonicalAuthorityUrlComponents.PathSegments[0];
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "authorizationEndpoint", {
+        /**
+         * OAuth /authorize endpoint for requests
+         */
+        get: function () {
+            if (this.discoveryComplete()) {
+                var endpoint = this.replacePath(this.metadata.authorization_endpoint);
+                return this.replaceTenant(endpoint);
+            }
+            else {
+                throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            }
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "tokenEndpoint", {
+        /**
+         * OAuth /token endpoint for requests
+         */
+        get: function () {
+            if (this.discoveryComplete()) {
+                var endpoint = this.replacePath(this.metadata.token_endpoint);
+                return this.replaceTenant(endpoint);
+            }
+            else {
+                throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            }
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "deviceCodeEndpoint", {
+        get: function () {
+            if (this.discoveryComplete()) {
+                var endpoint = this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
+                return this.replaceTenant(endpoint);
+            }
+            else {
+                throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            }
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "endSessionEndpoint", {
+        /**
+         * OAuth logout endpoint for requests
+         */
+        get: function () {
+            if (this.discoveryComplete()) {
+                var endpoint = this.replacePath(this.metadata.end_session_endpoint);
+                return this.replaceTenant(endpoint);
+            }
+            else {
+                throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            }
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(Authority.prototype, "selfSignedJwtAudience", {
+        /**
+         * OAuth issuer for requests
+         */
+        get: function () {
+            if (this.discoveryComplete()) {
+                var endpoint = this.replacePath(this.metadata.issuer);
+                return this.replaceTenant(endpoint);
+            }
+            else {
+                throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+            }
+        },
+        enumerable: false,
+        configurable: true
+    });
+    /**
+     * Replaces tenant in url path with current tenant. Defaults to common.
+     * @param urlString
+     */
+    Authority.prototype.replaceTenant = function (urlString) {
+        return urlString.replace(/{tenant}|{tenantid}/g, this.tenant);
+    };
+    /**
+     * Replaces path such as tenant or policy with the current tenant or policy.
+     * @param urlString
+     */
+    Authority.prototype.replacePath = function (urlString) {
+        var endpoint = urlString;
+        var cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
+        var cachedAuthorityParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
+        var currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
+        currentAuthorityParts.forEach(function (currentPart, index) {
+            var cachedPart = cachedAuthorityParts[index];
+            if (currentPart !== cachedPart) {
+                endpoint = endpoint.replace("/" + cachedPart + "/", "/" + currentPart + "/");
+            }
+        });
+        return endpoint;
+    };
+    Object.defineProperty(Authority.prototype, "defaultOpenIdConfigurationEndpoint", {
+        /**
+         * The default open id configuration endpoint for any canonical authority.
+         */
+        get: function () {
+            if (this.authorityType === AuthorityType.Adfs || this.protocolMode === ProtocolMode.OIDC) {
+                return this.canonicalAuthority + ".well-known/openid-configuration";
+            }
+            return this.canonicalAuthority + "v2.0/.well-known/openid-configuration";
+        },
+        enumerable: false,
+        configurable: true
+    });
+    /**
+     * Boolean that returns whethr or not tenant discovery has been completed.
+     */
+    Authority.prototype.discoveryComplete = function () {
+        return !!this.metadata;
+    };
+    /**
+     * Perform endpoint discovery to discover aliases, preferred_cache, preferred_network
+     * and the /authorize, /token and logout endpoints.
+     */
+    Authority.prototype.resolveEndpointsAsync = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var metadataEntity, cloudDiscoverySource, endpointSource, cacheKey;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        metadataEntity = this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort);
+                        if (!metadataEntity) {
+                            metadataEntity = new AuthorityMetadataEntity();
+                            metadataEntity.updateCanonicalAuthority(this.canonicalAuthority);
+                        }
+                        return [4 /*yield*/, this.updateCloudDiscoveryMetadata(metadataEntity)];
+                    case 1:
+                        cloudDiscoverySource = _a.sent();
+                        this.canonicalAuthority = this.canonicalAuthority.replace(this.hostnameAndPort, metadataEntity.preferred_network);
+                        return [4 /*yield*/, this.updateEndpointMetadata(metadataEntity)];
+                    case 2:
+                        endpointSource = _a.sent();
+                        if (cloudDiscoverySource !== AuthorityMetadataSource.CACHE && endpointSource !== AuthorityMetadataSource.CACHE) {
+                            // Reset the expiration time unless both values came from a successful cache lookup
+                            metadataEntity.resetExpiresAt();
+                            metadataEntity.updateCanonicalAuthority(this.canonicalAuthority);
+                        }
+                        cacheKey = this.cacheManager.generateAuthorityMetadataCacheKey(metadataEntity.preferred_cache);
+                        this.cacheManager.setAuthorityMetadata(cacheKey, metadataEntity);
+                        this.metadata = metadataEntity;
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Update AuthorityMetadataEntity with new endpoints and return where the information came from
+     * @param metadataEntity
+     */
+    Authority.prototype.updateEndpointMetadata = function (metadataEntity) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var metadata, autodetectedRegionName, azureRegion;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        metadata = this.getEndpointMetadataFromConfig();
+                        if (metadata) {
+                            metadataEntity.updateEndpointMetadata(metadata, false);
+                            return [2 /*return*/, AuthorityMetadataSource.CONFIG];
+                        }
+                        if (this.isAuthoritySameType(metadataEntity) && metadataEntity.endpointsFromNetwork && !metadataEntity.isExpired()) {
+                            // No need to update
+                            return [2 /*return*/, AuthorityMetadataSource.CACHE];
+                        }
+                        return [4 /*yield*/, this.getEndpointMetadataFromNetwork()];
+                    case 1:
+                        metadata = _b.sent();
+                        if (!metadata) return [3 /*break*/, 4];
+                        if (!((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.azureRegion)) return [3 /*break*/, 3];
+                        return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata)];
+                    case 2:
+                        autodetectedRegionName = _b.sent();
+                        azureRegion = this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
+                            ? autodetectedRegionName
+                            : this.authorityOptions.azureRegionConfiguration.azureRegion;
+                        if (this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {
+                            this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName ?
+                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL :
+                                RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
+                        }
+                        else {
+                            if (autodetectedRegionName) {
+                                this.regionDiscoveryMetadata.region_outcome = (this.authorityOptions.azureRegionConfiguration.azureRegion === autodetectedRegionName) ?
+                                    RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED :
+                                    RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;
+                            }
+                            else {
+                                this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
+                            }
+                        }
+                        if (azureRegion) {
+                            this.regionDiscoveryMetadata.region_used = azureRegion;
+                            metadata = Authority.replaceWithRegionalInformation(metadata, azureRegion);
+                        }
+                        _b.label = 3;
+                    case 3:
+                        metadataEntity.updateEndpointMetadata(metadata, true);
+                        return [2 /*return*/, AuthorityMetadataSource.NETWORK];
+                    case 4: throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);
+                }
+            });
+        });
+    };
+    /**
+     * Compares the number of url components after the domain to determine if the cached authority metadata can be used for the requested authority
+     * Protects against same domain different authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
+     * @param metadataEntity
+     */
+    Authority.prototype.isAuthoritySameType = function (metadataEntity) {
+        var cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority);
+        var cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
+        return cachedParts.length === this.canonicalAuthorityUrlComponents.PathSegments.length;
+    };
+    /**
+     * Parse authorityMetadata config option
+     */
+    Authority.prototype.getEndpointMetadataFromConfig = function () {
+        if (this.authorityOptions.authorityMetadata) {
+            try {
+                return JSON.parse(this.authorityOptions.authorityMetadata);
+            }
+            catch (e) {
+                throw ClientConfigurationError.createInvalidAuthorityMetadataError();
+            }
+        }
+        return null;
+    };
+    /**
+     * Gets OAuth endpoints from the given OpenID configuration endpoint.
+     */
+    Authority.prototype.getEndpointMetadataFromNetwork = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        _a.trys.push([0, 2, , 3]);
+                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint)];
+                    case 1:
+                        response = _a.sent();
+                        return [2 /*return*/, isOpenIdConfigResponse(response.body) ? response.body : null];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/, null];
+                    case 3: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /**
+     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from
+     * @param cachedMetadata
+     * @param newMetadata
+     */
+    Authority.prototype.updateCloudDiscoveryMetadata = function (metadataEntity) {
+        return __awaiter(this, void 0, void 0, function () {
+            var metadata;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        metadata = this.getCloudDiscoveryMetadataFromConfig();
+                        if (metadata) {
+                            metadataEntity.updateCloudDiscoveryMetadata(metadata, false);
+                            return [2 /*return*/, AuthorityMetadataSource.CONFIG];
+                        }
+                        // If The cached metadata came from config but that config was not passed to this instance, we must go to the network
+                        if (this.isAuthoritySameType(metadataEntity) && metadataEntity.aliasesFromNetwork && !metadataEntity.isExpired()) {
+                            // No need to update
+                            return [2 /*return*/, AuthorityMetadataSource.CACHE];
+                        }
+                        return [4 /*yield*/, this.getCloudDiscoveryMetadataFromNetwork()];
+                    case 1:
+                        metadata = _a.sent();
+                        if (metadata) {
+                            metadataEntity.updateCloudDiscoveryMetadata(metadata, true);
+                            return [2 /*return*/, AuthorityMetadataSource.NETWORK];
+                        }
+                        else {
+                            // Metadata could not be obtained from config, cache or network
+                            throw ClientConfigurationError.createUntrustedAuthorityError();
+                        }
+                }
+            });
+        });
+    };
+    /**
+     * Parse cloudDiscoveryMetadata config or check knownAuthorities
+     */
+    Authority.prototype.getCloudDiscoveryMetadataFromConfig = function () {
+        // Check if network response was provided in config
+        if (this.authorityOptions.cloudDiscoveryMetadata) {
+            try {
+                var parsedResponse = JSON.parse(this.authorityOptions.cloudDiscoveryMetadata);
+                var metadata = Authority.getCloudDiscoveryMetadataFromNetworkResponse(parsedResponse.metadata, this.hostnameAndPort);
+                if (metadata) {
+                    return metadata;
+                }
+            }
+            catch (e) {
+                throw ClientConfigurationError.createInvalidCloudDiscoveryMetadataError();
+            }
+        }
+        // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
+        if (this.isInKnownAuthorities()) {
+            return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
+        }
+        return null;
+    };
+    /**
+     * Called to get metadata from network if CloudDiscoveryMetadata was not populated by config
+     * @param networkInterface
+     */
+    Authority.prototype.getCloudDiscoveryMetadataFromNetwork = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var instanceDiscoveryEndpoint, match, response, metadata;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        instanceDiscoveryEndpoint = "" + Constants.AAD_INSTANCE_DISCOVERY_ENDPT + this.canonicalAuthority + "oauth2/v2.0/authorize";
+                        match = null;
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint)];
+                    case 2:
+                        response = _a.sent();
+                        metadata = isCloudInstanceDiscoveryResponse(response.body) ? response.body.metadata : [];
+                        if (metadata.length === 0) {
+                            // If no metadata is returned, authority is untrusted
+                            return [2 /*return*/, null];
+                        }
+                        match = Authority.getCloudDiscoveryMetadataFromNetworkResponse(metadata, this.hostnameAndPort);
+                        return [3 /*break*/, 4];
+                    case 3:
+                        _a.sent();
+                        return [2 /*return*/, null];
+                    case 4:
+                        if (!match) {
+                            // Custom Domain scenario, host is trusted because Instance Discovery call succeeded 
+                            match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
+                        }
+                        return [2 /*return*/, match];
+                }
+            });
+        });
+    };
+    /**
+     * Helper function to determine if this host is included in the knownAuthorities config option
+     */
+    Authority.prototype.isInKnownAuthorities = function () {
+        var _this = this;
+        var matches = this.authorityOptions.knownAuthorities.filter(function (authority) {
+            return UrlString.getDomainFromUrl(authority).toLowerCase() === _this.hostnameAndPort;
+        });
+        return matches.length > 0;
+    };
+    /**
+     * Creates cloud discovery metadata object from a given host
+     * @param host
+     */
+    Authority.createCloudDiscoveryMetadataFromHost = function (host) {
+        return {
+            preferred_network: host,
+            preferred_cache: host,
+            aliases: [host]
+        };
+    };
+    /**
+     * Searches instance discovery network response for the entry that contains the host in the aliases list
+     * @param response
+     * @param authority
+     */
+    Authority.getCloudDiscoveryMetadataFromNetworkResponse = function (response, authority) {
+        for (var i = 0; i < response.length; i++) {
+            var metadata = response[i];
+            if (metadata.aliases.indexOf(authority) > -1) {
+                return metadata;
+            }
+        }
+        return null;
+    };
+    /**
+     * helper function to generate environment from authority object
+     */
+    Authority.prototype.getPreferredCache = function () {
+        if (this.discoveryComplete()) {
+            return this.metadata.preferred_cache;
+        }
+        else {
+            throw ClientAuthError.createEndpointDiscoveryIncompleteError("Discovery incomplete.");
+        }
+    };
+    /**
+     * Returns whether or not the provided host is an alias of this authority instance
+     * @param host
+     */
+    Authority.prototype.isAlias = function (host) {
+        return this.metadata.aliases.indexOf(host) > -1;
+    };
+    /**
+     * Checks whether the provided host is that of a public cloud authority
+     *
+     * @param authority string
+     * @returns bool
+     */
+    Authority.isPublicCloudAuthority = function (host) {
+        return Constants.KNOWN_PUBLIC_CLOUDS.indexOf(host) >= 0;
+    };
+    /**
+     * Rebuild the authority string with the region
+     *
+     * @param host string
+     * @param region string
+     */
+    Authority.buildRegionalAuthorityString = function (host, region, queryString) {
+        // Create and validate a Url string object with the initial authority string
+        var authorityUrlInstance = new UrlString(host);
+        authorityUrlInstance.validateAsUri();
+        var authorityUrlParts = authorityUrlInstance.getUrlComponents();
+        var hostNameAndPort = region + "." + authorityUrlParts.HostNameAndPort;
+        if (this.isPublicCloudAuthority(authorityUrlParts.HostNameAndPort)) {
+            hostNameAndPort = region + "." + Constants.REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX;
+        }
+        // Include the query string portion of the url
+        var url = UrlString.constructAuthorityUriFromObject(__assign(__assign({}, authorityUrlInstance.getUrlComponents()), { HostNameAndPort: hostNameAndPort })).urlString;
+        // Add the query string if a query string was provided
+        if (queryString)
+            return url + "?" + queryString;
+        return url;
+    };
+    /**
+     * Replace the endpoints in the metadata object with their regional equivalents.
+     *
+     * @param metadata OpenIdConfigResponse
+     * @param azureRegion string
+     */
+    Authority.replaceWithRegionalInformation = function (metadata, azureRegion) {
+        metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
+        // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
+        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
+        metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+        return metadata;
+    };
+    return Authority;
+}());
+
+export { Authority };
+//# sourceMappingURL=Authority.js.map

package/dist/authority/Authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authority.js","sources":["../../src/authority/Authority.ts"],"sourcesContent":["/*\n * Copyright (c) Microsoft Corporation. All rights reserved.\n * Licensed under the MIT License.\n */\n\nimport { AuthorityType } from \"./AuthorityType\";\nimport { isOpenIdConfigResponse, OpenIdConfigResponse } from \"./OpenIdConfigResponse\";\nimport { UrlString } from \"../url/UrlString\";\nimport { IUri } from \"../url/IUri\";\nimport { ClientAuthError } from \"../error/ClientAuthError\";\nimport { INetworkModule } from \"../network/INetworkModule\";\nimport { AuthorityMetadataSource, Constants, RegionDiscoveryOutcomes } from \"../utils/Constants\";\nimport { ClientConfigurationError } from \"../error/ClientConfigurationError\";\nimport { ProtocolMode } from \"./ProtocolMode\";\nimport { ICacheManager } from \"../cache/interface/ICacheManager\";\nimport { AuthorityMetadataEntity } from \"../cache/entities/AuthorityMetadataEntity\";\nimport { AuthorityOptions } from \"./AuthorityOptions\";\nimport { CloudInstanceDiscoveryResponse, isCloudInstanceDiscoveryResponse } from \"./CloudInstanceDiscoveryResponse\";\nimport { CloudDiscoveryMetadata } from \"./CloudDiscoveryMetadata\";\nimport { RegionDiscovery } from \"./RegionDiscovery\";\nimport { RegionDiscoveryMetadata } from \"./RegionDiscoveryMetadata\";\n\n/**\n * The authority class validates the authority URIs used by the user, and retrieves the OpenID Configuration Data from the\n * endpoint. It will store the pertinent config data in this object for use during token calls.\n */\nexport class Authority {\n\n    // Canonical authority url string\n    private _canonicalAuthority: UrlString;\n    // Canonicaly authority url components\n    private _canonicalAuthorityUrlComponents: IUri | null;\n    // Network interface to make requests with.\n    protected networkInterface: INetworkModule;\n    // Cache Manager to cache network responses\n    protected cacheManager: ICacheManager;\n    // Protocol mode to construct endpoints\n    private authorityOptions: AuthorityOptions;\n    // Authority metadata\n    private metadata: AuthorityMetadataEntity;\n    // Region discovery service\n    private regionDiscovery: RegionDiscovery;\n    // Region discovery metadata\n    public regionDiscoveryMetadata: RegionDiscoveryMetadata;\n\n    constructor(authority: string, networkInterface: INetworkModule, cacheManager: ICacheManager, authorityOptions: AuthorityOptions) {\n        this.canonicalAuthority = authority;\n        this._canonicalAuthority.validateAsUri();\n        this.networkInterface = networkInterface;\n        this.cacheManager = cacheManager;\n        this.authorityOptions = authorityOptions;\n        this.regionDiscovery = new RegionDiscovery(networkInterface);\n        this.regionDiscoveryMetadata = { region_used: undefined, region_source: undefined, region_outcome: undefined };\n    }\n\n    // See above for AuthorityType\n    public get authorityType(): AuthorityType {\n        const pathSegments = this.canonicalAuthorityUrlComponents.PathSegments;\n\n        if (pathSegments.length && pathSegments[0].toLowerCase() === Constants.ADFS) {\n            return AuthorityType.Adfs;\n        }\n\n        return AuthorityType.Default;\n    }\n\n    /**\n     * ProtocolMode enum representing the way endpoints are constructed.\n     */\n    public get protocolMode(): ProtocolMode {\n        return this.authorityOptions.protocolMode;\n    }\n\n    /**\n     * Returns authorityOptions which can be used to reinstantiate a new authority instance\n     */\n    public get options(): AuthorityOptions {\n        return this.authorityOptions;\n    }\n\n    /**\n     * A URL that is the authority set by the developer\n     */\n    public get canonicalAuthority(): string {\n        return this._canonicalAuthority.urlString;\n    }\n\n    /**\n     * Sets canonical authority.\n     */\n    public set canonicalAuthority(url: string) {\n        this._canonicalAuthority = new UrlString(url);\n        this._canonicalAuthority.validateAsUri();\n        this._canonicalAuthorityUrlComponents = null;\n    }\n\n    /**\n     * Get authority components.\n     */\n    public get canonicalAuthorityUrlComponents(): IUri {\n        if (!this._canonicalAuthorityUrlComponents) {\n            this._canonicalAuthorityUrlComponents = this._canonicalAuthority.getUrlComponents();\n        }\n\n        return this._canonicalAuthorityUrlComponents;\n    }\n\n    /**\n     * Get hostname and port i.e. login.microsoftonline.com\n     */\n    public get hostnameAndPort(): string {\n        return this.canonicalAuthorityUrlComponents.HostNameAndPort.toLowerCase();\n    }\n\n    /**\n     * Get tenant for authority.\n     */\n    public get tenant(): string {\n        return this.canonicalAuthorityUrlComponents.PathSegments[0];\n    }\n\n    /**\n     * OAuth /authorize endpoint for requests\n     */\n    public get authorizationEndpoint(): string {\n        if(this.discoveryComplete()) {\n            const endpoint = this.replacePath(this.metadata.authorization_endpoint);\n            return this.replaceTenant(endpoint);\n        } else {\n            throw ClientAuthError.createEndpointDiscoveryIncompleteError(\"Discovery incomplete.\");\n        }\n    }\n\n    /**\n     * OAuth /token endpoint for requests\n     */\n    public get tokenEndpoint(): string {\n        if(this.discoveryComplete()) {\n            const endpoint = this.replacePath(this.metadata.token_endpoint);\n            return this.replaceTenant(endpoint);\n        } else {\n            throw ClientAuthError.createEndpointDiscoveryIncompleteError(\"Discovery incomplete.\");\n        }\n    }\n\n    public get deviceCodeEndpoint(): string {\n        if(this.discoveryComplete()) {\n            const endpoint = this.replacePath(this.metadata.token_endpoint.replace(\"/token\", \"/devicecode\"));\n            return this.replaceTenant(endpoint);\n        } else {\n            throw ClientAuthError.createEndpointDiscoveryIncompleteError(\"Discovery incomplete.\");\n        }\n    }\n\n    /**\n     * OAuth logout endpoint for requests\n     */\n    public get endSessionEndpoint(): string {\n        if(this.discoveryComplete()) {\n            const endpoint = this.replacePath(this.metadata.end_session_endpoint);\n            return this.replaceTenant(endpoint);\n        } else {\n            throw ClientAuthError.createEndpointDiscoveryIncompleteError(\"Discovery incomplete.\");\n        }\n    }\n\n    /**\n     * OAuth issuer for requests\n     */\n    public get selfSignedJwtAudience(): string {\n        if(this.discoveryComplete()) {\n            const endpoint = this.replacePath(this.metadata.issuer);\n            return this.replaceTenant(endpoint);\n        } else {\n            throw ClientAuthError.createEndpointDiscoveryIncompleteError(\"Discovery incomplete.\");\n        }\n    }\n\n    /**\n     * Replaces tenant in url path with current tenant. Defaults to common.\n     * @param urlString\n     */\n    private replaceTenant(urlString: string): string {\n        return urlString.replace(/{tenant}|{tenantid}/g, this.tenant);\n    }\n\n    /**\n     * Replaces path such as tenant or policy with the current tenant or policy.\n     * @param urlString \n     */\n    private replacePath(urlString: string): string {\n        let endpoint = urlString;\n        const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);\n        const cachedAuthorityParts = cachedAuthorityUrl.getUrlComponents().PathSegments;\n        const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;\n\n        currentAuthorityParts.forEach((currentPart, index) => {\n            const cachedPart = cachedAuthorityParts[index];\n            if (currentPart !== cachedPart) {\n                endpoint = endpoint.replace(`/${cachedPart}/`, `/${currentPart}/`);\n            }\n        });\n\n        return endpoint;\n    }\n\n    /**\n     * The default open id configuration endpoint for any canonical authority.\n     */\n    protected get defaultOpenIdConfigurationEndpoint(): string {\n        if (this.authorityType === AuthorityType.Adfs || this.protocolMode === ProtocolMode.OIDC) {\n            return `${this.canonicalAuthority}.well-known/openid-configuration`;\n        }\n        return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;\n    }\n\n    /**\n     * Boolean that returns whethr or not tenant discovery has been completed.\n     */\n    discoveryComplete(): boolean {\n        return !!this.metadata;\n    }\n\n    /**\n     * Perform endpoint discovery to discover aliases, preferred_cache, preferred_network\n     * and the /authorize, /token and logout endpoints.\n     */\n    public async resolveEndpointsAsync(): Promise<void> {\n        let metadataEntity = this.cacheManager.getAuthorityMetadataByAlias(this.hostnameAndPort);\n        if (!metadataEntity) {\n            metadataEntity = new AuthorityMetadataEntity();\n            metadataEntity.updateCanonicalAuthority(this.canonicalAuthority);\n        }\n\n        const cloudDiscoverySource = await this.updateCloudDiscoveryMetadata(metadataEntity);\n        this.canonicalAuthority = this.canonicalAuthority.replace(this.hostnameAndPort, metadataEntity.preferred_network);\n        const endpointSource = await this.updateEndpointMetadata(metadataEntity);\n\n        if (cloudDiscoverySource !== AuthorityMetadataSource.CACHE && endpointSource !== AuthorityMetadataSource.CACHE) {\n            // Reset the expiration time unless both values came from a successful cache lookup\n            metadataEntity.resetExpiresAt();\n            metadataEntity.updateCanonicalAuthority(this.canonicalAuthority);\n        } \n\n        const cacheKey = this.cacheManager.generateAuthorityMetadataCacheKey(metadataEntity.preferred_cache);\n        this.cacheManager.setAuthorityMetadata(cacheKey, metadataEntity);\n        this.metadata = metadataEntity;\n    }\n\n    /**\n     * Update AuthorityMetadataEntity with new endpoints and return where the information came from\n     * @param metadataEntity \n     */\n    private async updateEndpointMetadata(metadataEntity: AuthorityMetadataEntity): Promise<AuthorityMetadataSource> {\n        let metadata = this.getEndpointMetadataFromConfig();\n        if (metadata) {\n            metadataEntity.updateEndpointMetadata(metadata, false);\n            return AuthorityMetadataSource.CONFIG;\n        }\n\n        if (this.isAuthoritySameType(metadataEntity) && metadataEntity.endpointsFromNetwork && !metadataEntity.isExpired()) {\n            // No need to update\n            return AuthorityMetadataSource.CACHE;\n        }\n\n        metadata = await this.getEndpointMetadataFromNetwork();\n        if (metadata) {\n            // If the user prefers to use an azure region replace the global endpoints with regional information.\n            if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {\n                const autodetectedRegionName = await this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata);\n\n                const azureRegion = this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG \n                    ? autodetectedRegionName \n                    : this.authorityOptions.azureRegionConfiguration.azureRegion;\n\n                if (this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG) {\n                    this.regionDiscoveryMetadata.region_outcome = autodetectedRegionName ?\n                        RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL :\n                        RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;\n                } else {\n                    if (autodetectedRegionName) {\n                        this.regionDiscoveryMetadata.region_outcome = (this.authorityOptions.azureRegionConfiguration.azureRegion === autodetectedRegionName) ?\n                            RegionDiscoveryOutcomes.CONFIGURED_MATCHES_DETECTED :\n                            RegionDiscoveryOutcomes.CONFIGURED_NOT_DETECTED;\n                    } else {\n                        this.regionDiscoveryMetadata.region_outcome = RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;\n                    }\n                }\n\n                if (azureRegion) {\n                    this.regionDiscoveryMetadata.region_used = azureRegion;\n                    metadata = Authority.replaceWithRegionalInformation(metadata, azureRegion);\n                }\n            }\n\n            metadataEntity.updateEndpointMetadata(metadata, true);\n            return AuthorityMetadataSource.NETWORK;\n        } else {\n            throw ClientAuthError.createUnableToGetOpenidConfigError(this.defaultOpenIdConfigurationEndpoint);\n        }\n    }\n\n    /**\n     * Compares the number of url components after the domain to determine if the cached authority metadata can be used for the requested authority\n     * Protects against same domain different authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy\n     * @param metadataEntity\n     */\n    private isAuthoritySameType(metadataEntity: AuthorityMetadataEntity): boolean {\n        const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority);\n        const cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;\n        \n        return cachedParts.length === this.canonicalAuthorityUrlComponents.PathSegments.length;\n    }\n\n    /**\n     * Parse authorityMetadata config option\n     */\n    private getEndpointMetadataFromConfig(): OpenIdConfigResponse | null {\n        if (this.authorityOptions.authorityMetadata) {\n            try {\n                return JSON.parse(this.authorityOptions.authorityMetadata) as OpenIdConfigResponse;\n            } catch (e) {\n                throw ClientConfigurationError.createInvalidAuthorityMetadataError();\n            }\n        }\n\n        return null;\n    }\n\n    /**\n     * Gets OAuth endpoints from the given OpenID configuration endpoint.\n     */\n    private async getEndpointMetadataFromNetwork(): Promise<OpenIdConfigResponse | null> {\n        try {\n            const response = await this.networkInterface.sendGetRequestAsync<OpenIdConfigResponse>(this.defaultOpenIdConfigurationEndpoint);\n            return isOpenIdConfigResponse(response.body) ? response.body : null;\n        } catch (e) {\n            return null;\n        }\n    }\n\n    /**\n     * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from\n     * @param cachedMetadata \n     * @param newMetadata \n     */\n    private async updateCloudDiscoveryMetadata(metadataEntity: AuthorityMetadataEntity): Promise<AuthorityMetadataSource> {\n        let metadata = this.getCloudDiscoveryMetadataFromConfig();\n        if (metadata) {\n            metadataEntity.updateCloudDiscoveryMetadata(metadata, false);\n            return AuthorityMetadataSource.CONFIG;\n        }\n\n        // If The cached metadata came from config but that config was not passed to this instance, we must go to the network\n        if (this.isAuthoritySameType(metadataEntity) && metadataEntity.aliasesFromNetwork && !metadataEntity.isExpired()) {\n            // No need to update\n            return AuthorityMetadataSource.CACHE;\n        }\n\n        metadata = await this.getCloudDiscoveryMetadataFromNetwork();\n        if (metadata) {\n            metadataEntity.updateCloudDiscoveryMetadata(metadata, true);\n            return AuthorityMetadataSource.NETWORK;\n        } else {\n            // Metadata could not be obtained from config, cache or network\n            throw ClientConfigurationError.createUntrustedAuthorityError();\n        }\n    }\n\n    /**\n     * Parse cloudDiscoveryMetadata config or check knownAuthorities\n     */\n    private getCloudDiscoveryMetadataFromConfig(): CloudDiscoveryMetadata | null {\n        // Check if network response was provided in config\n        if (this.authorityOptions.cloudDiscoveryMetadata) {\n            try {\n                const parsedResponse = JSON.parse(this.authorityOptions.cloudDiscoveryMetadata) as CloudInstanceDiscoveryResponse;\n                const metadata = Authority.getCloudDiscoveryMetadataFromNetworkResponse(parsedResponse.metadata, this.hostnameAndPort);\n                if (metadata) {\n                    return metadata;\n                }\n            } catch (e) {\n                throw ClientConfigurationError.createInvalidCloudDiscoveryMetadataError();\n            }\n        }\n\n        // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities\n        if (this.isInKnownAuthorities()) {\n            return Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);\n        }\n\n        return null;\n    }\n\n    /**\n     * Called to get metadata from network if CloudDiscoveryMetadata was not populated by config\n     * @param networkInterface \n     */\n    private async getCloudDiscoveryMetadataFromNetwork(): Promise<CloudDiscoveryMetadata | null> {\n        const instanceDiscoveryEndpoint = `${Constants.AAD_INSTANCE_DISCOVERY_ENDPT}${this.canonicalAuthority}oauth2/v2.0/authorize`;\n        let match = null;\n        try {\n            const response = await this.networkInterface.sendGetRequestAsync<CloudInstanceDiscoveryResponse>(instanceDiscoveryEndpoint);\n            const metadata = isCloudInstanceDiscoveryResponse(response.body) ? response.body.metadata : [];\n            if (metadata.length === 0) {\n                // If no metadata is returned, authority is untrusted\n                return null;\n            }\n            match = Authority.getCloudDiscoveryMetadataFromNetworkResponse(metadata, this.hostnameAndPort);\n        } catch(e) {\n            return null;\n        }\n\n        if (!match) {\n            // Custom Domain scenario, host is trusted because Instance Discovery call succeeded \n            match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);\n        }\n        return match;\n    } \n\n    /**\n     * Helper function to determine if this host is included in the knownAuthorities config option\n     */\n    private isInKnownAuthorities(): boolean {\n        const matches = this.authorityOptions.knownAuthorities.filter((authority) => {\n            return UrlString.getDomainFromUrl(authority).toLowerCase() === this.hostnameAndPort;\n        });\n\n        return matches.length > 0;\n    }\n\n    /**\n     * Creates cloud discovery metadata object from a given host\n     * @param host \n     */\n    static createCloudDiscoveryMetadataFromHost(host: string): CloudDiscoveryMetadata {\n        return {\n            preferred_network: host,\n            preferred_cache: host,\n            aliases: [host]\n        };\n    }\n\n    /**\n     * Searches instance discovery network response for the entry that contains the host in the aliases list\n     * @param response \n     * @param authority \n     */\n    static getCloudDiscoveryMetadataFromNetworkResponse(response: CloudDiscoveryMetadata[], authority: string): CloudDiscoveryMetadata | null {\n        for (let i = 0; i < response.length; i++) {\n            const metadata = response[i];\n            if (metadata.aliases.indexOf(authority) > -1) {\n                return metadata;\n            }\n        }\n\n        return null;\n    }\n\n    /**\n     * helper function to generate environment from authority object\n     */\n    getPreferredCache(): string {\n        if(this.discoveryComplete()) {\n            return this.metadata.preferred_cache;\n        } else {\n            throw ClientAuthError.createEndpointDiscoveryIncompleteError(\"Discovery incomplete.\");\n        }\n    }\n\n    /**\n     * Returns whether or not the provided host is an alias of this authority instance\n     * @param host \n     */\n    isAlias(host: string): boolean {\n        return this.metadata.aliases.indexOf(host) > -1;\n    }\n\n    /**\n     * Checks whether the provided host is that of a public cloud authority\n     * \n     * @param authority string\n     * @returns bool\n     */\n    static isPublicCloudAuthority(host: string): boolean {\n        return Constants.KNOWN_PUBLIC_CLOUDS.indexOf(host) >= 0;\n    }\n\n    /**\n     * Rebuild the authority string with the region\n     * \n     * @param host string\n     * @param region string \n     */\n    static buildRegionalAuthorityString(host: string, region: string, queryString?: string): string {\n        // Create and validate a Url string object with the initial authority string\n        const authorityUrlInstance = new UrlString(host);\n        authorityUrlInstance.validateAsUri();\n\n        const authorityUrlParts = authorityUrlInstance.getUrlComponents();\n\n        let hostNameAndPort= `${region}.${authorityUrlParts.HostNameAndPort}`;\n\n        if (this.isPublicCloudAuthority(authorityUrlParts.HostNameAndPort)) {\n            hostNameAndPort = `${region}.${Constants.REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX}`;\n        }\n\n        // Include the query string portion of the url\n        const url = UrlString.constructAuthorityUriFromObject({\n            ...authorityUrlInstance.getUrlComponents(),\n            HostNameAndPort: hostNameAndPort\n        }).urlString;\n\n        // Add the query string if a query string was provided\n        if (queryString) return `${url}?${queryString}`;\n\n        return url;\n    }\n\n    /**\n     * Replace the endpoints in the metadata object with their regional equivalents.\n     * \n     * @param metadata OpenIdConfigResponse\n     * @param azureRegion string\n     */\n    static replaceWithRegionalInformation(metadata: OpenIdConfigResponse, azureRegion: string): OpenIdConfigResponse {\n        metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);\n        // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature\n        metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, \"allowestsrnonmsi=true\");\n        metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);\n        \n        return metadata;\n    }\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA;;;;AAsBA;;;;;IAuBI,mBAAY,SAAiB,EAAE,gBAAgC,EAAE,YAA2B,EAAE,gBAAkC;QAC5H,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAC7D,IAAI,CAAC,uBAAuB,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;KAClH;IAGD,sBAAW,oCAAa;;aAAxB;YACI,IAAM,YAAY,GAAG,IAAI,CAAC,+BAA+B,CAAC,YAAY,CAAC;YAEvE,IAAI,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,IAAI,EAAE;gBACzE,OAAO,aAAa,CAAC,IAAI,CAAC;aAC7B;YAED,OAAO,aAAa,CAAC,OAAO,CAAC;SAChC;;;OAAA;IAKD,sBAAW,mCAAY;;;;aAAvB;YACI,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;SAC7C;;;OAAA;IAKD,sBAAW,8BAAO;;;;aAAlB;YACI,OAAO,IAAI,CAAC,gBAAgB,CAAC;SAChC;;;OAAA;IAKD,sBAAW,yCAAkB;;;;aAA7B;YACI,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;SAC7C;;;;aAKD,UAA8B,GAAW;YACrC,IAAI,CAAC,mBAAmB,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,gCAAgC,GAAG,IAAI,CAAC;SAChD;;;OATA;IAcD,sBAAW,sDAA+B;;;;aAA1C;YACI,IAAI,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACxC,IAAI,CAAC,gCAAgC,GAAG,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,CAAC;aACvF;YAED,OAAO,IAAI,CAAC,gCAAgC,CAAC;SAChD;;;OAAA;IAKD,sBAAW,sCAAe;;;;aAA1B;YACI,OAAO,IAAI,CAAC,+BAA+B,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;SAC7E;;;OAAA;IAKD,sBAAW,6BAAM;;;;aAAjB;YACI,OAAO,IAAI,CAAC,+BAA+B,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;SAC/D;;;OAAA;IAKD,sBAAW,4CAAqB;;;;aAAhC;YACI,IAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE;gBACzB,IAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;aACvC;iBAAM;gBACH,MAAM,eAAe,CAAC,sCAAsC,CAAC,uBAAuB,CAAC,CAAC;aACzF;SACJ;;;OAAA;IAKD,sBAAW,oCAAa;;;;aAAxB;YACI,IAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE;gBACzB,IAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;gBAChE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;aACvC;iBAAM;gBACH,MAAM,eAAe,CAAC,sCAAsC,CAAC,uBAAuB,CAAC,CAAC;aACzF;SACJ;;;OAAA;IAED,sBAAW,yCAAkB;aAA7B;YACI,IAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE;gBACzB,IAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;gBACjG,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;aACvC;iBAAM;gBACH,MAAM,eAAe,CAAC,sCAAsC,CAAC,uBAAuB,CAAC,CAAC;aACzF;SACJ;;;OAAA;IAKD,sBAAW,yCAAkB;;;;aAA7B;YACI,IAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE;gBACzB,IAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;aACvC;iBAAM;gBACH,MAAM,eAAe,CAAC,sCAAsC,CAAC,uBAAuB,CAAC,CAAC;aACzF;SACJ;;;OAAA;IAKD,sBAAW,4CAAqB;;;;aAAhC;YACI,IAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE;gBACzB,IAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACxD,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;aACvC;iBAAM;gBACH,MAAM,eAAe,CAAC,sCAAsC,CAAC,uBAAuB,CAAC,CAAC;aACzF;SACJ;;;OAAA;;;;;IAMO,iCAAa,GAArB,UAAsB,SAAiB;QACnC,OAAO,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;KACjE;;;;;IAMO,+BAAW,GAAnB,UAAoB,SAAiB;QACjC,IAAI,QAAQ,GAAG,SAAS,CAAC;QACzB,IAAM,kBAAkB,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC5E,IAAM,oBAAoB,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC;QAChF,IAAM,qBAAqB,GAAG,IAAI,CAAC,+BAA+B,CAAC,YAAY,CAAC;QAEhF,qBAAqB,CAAC,OAAO,CAAC,UAAC,WAAW,EAAE,KAAK;YAC7C,IAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,WAAW,KAAK,UAAU,EAAE;gBAC5B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAI,UAAU,MAAG,EAAE,MAAI,WAAW,MAAG,CAAC,CAAC;aACtE;SACJ,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;KACnB;IAKD,sBAAc,yDAAkC;;;;aAAhD;YACI,IAAI,IAAI,CAAC,aAAa,KAAK,aAAa,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,CAAC,IAAI,EAAE;gBACtF,OAAU,IAAI,CAAC,kBAAkB,qCAAkC,CAAC;aACvE;YACD,OAAU,IAAI,CAAC,kBAAkB,0CAAuC,CAAC;SAC5E;;;OAAA;;;;IAKD,qCAAiB,GAAjB;QACI,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;KAC1B;;;;;IAMY,yCAAqB,GAAlC;;;;;;wBACQ,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBACzF,IAAI,CAAC,cAAc,EAAE;4BACjB,cAAc,GAAG,IAAI,uBAAuB,EAAE,CAAC;4BAC/C,cAAc,CAAC,wBAAwB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;yBACpE;wBAE4B,qBAAM,IAAI,CAAC,4BAA4B,CAAC,cAAc,CAAC,EAAA;;wBAA9E,oBAAoB,GAAG,SAAuD;wBACpF,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,iBAAiB,CAAC,CAAC;wBAC3F,qBAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAA;;wBAAlE,cAAc,GAAG,SAAiD;wBAExE,IAAI,oBAAoB,KAAK,uBAAuB,CAAC,KAAK,IAAI,cAAc,KAAK,uBAAuB,CAAC,KAAK,EAAE;;4BAE5G,cAAc,CAAC,cAAc,EAAE,CAAC;4BAChC,cAAc,CAAC,wBAAwB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;yBACpE;wBAEK,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,iCAAiC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;wBACrG,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;wBACjE,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;;;;;KAClC;;;;;IAMa,0CAAsB,GAApC,UAAqC,cAAuC;;;;;;;wBACpE,QAAQ,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;wBACpD,IAAI,QAAQ,EAAE;4BACV,cAAc,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;4BACvD,sBAAO,uBAAuB,CAAC,MAAM,EAAC;yBACzC;wBAED,IAAI,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,oBAAoB,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE;;4BAEhH,sBAAO,uBAAuB,CAAC,KAAK,EAAC;yBACxC;wBAEU,qBAAM,IAAI,CAAC,8BAA8B,EAAE,EAAA;;wBAAtD,QAAQ,GAAG,SAA2C,CAAC;6BACnD,QAAQ,EAAR,wBAAQ;oCAEJ,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,0CAAE,WAAW;wBAC5B,qBAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,iBAAiB,EAAE,IAAI,CAAC,uBAAuB,CAAC,EAAA;;wBAAhK,sBAAsB,GAAG,SAAuI;wBAEhK,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,WAAW,KAAK,SAAS,CAAC,+BAA+B;8BACtH,sBAAsB;8BACtB,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,WAAW,CAAC;wBAEjE,IAAI,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,WAAW,KAAK,SAAS,CAAC,+BAA+B,EAAE;4BAC1G,IAAI,CAAC,uBAAuB,CAAC,cAAc,GAAG,sBAAsB;gCAChE,uBAAuB,CAAC,mCAAmC;gCAC3D,uBAAuB,CAAC,+BAA+B,CAAC;yBAC/D;6BAAM;4BACH,IAAI,sBAAsB,EAAE;gCACxB,IAAI,CAAC,uBAAuB,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,WAAW,KAAK,sBAAsB;oCAChI,uBAAuB,CAAC,2BAA2B;oCACnD,uBAAuB,CAAC,uBAAuB,CAAC;6BACvD;iCAAM;gCACH,IAAI,CAAC,uBAAuB,CAAC,cAAc,GAAG,uBAAuB,CAAC,4BAA4B,CAAC;6BACtG;yBACJ;wBAED,IAAI,WAAW,EAAE;4BACb,IAAI,CAAC,uBAAuB,CAAC,WAAW,GAAG,WAAW,CAAC;4BACvD,QAAQ,GAAG,SAAS,CAAC,8BAA8B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;yBAC9E;;;wBAGL,cAAc,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;wBACtD,sBAAO,uBAAuB,CAAC,OAAO,EAAC;4BAEvC,MAAM,eAAe,CAAC,kCAAkC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;;;;KAEzG;;;;;;IAOO,uCAAmB,GAA3B,UAA4B,cAAuC;QAC/D,IAAM,kBAAkB,GAAG,IAAI,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC7E,IAAM,WAAW,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC;QAEvE,OAAO,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,+BAA+B,CAAC,YAAY,CAAC,MAAM,CAAC;KAC1F;;;;IAKO,iDAA6B,GAArC;QACI,IAAI,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE;YACzC,IAAI;gBACA,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAyB,CAAC;aACtF;YAAC,OAAO,CAAC,EAAE;gBACR,MAAM,wBAAwB,CAAC,mCAAmC,EAAE,CAAC;aACxE;SACJ;QAED,OAAO,IAAI,CAAC;KACf;;;;IAKa,kDAA8B,GAA5C;;;;;;;wBAEyB,qBAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAuB,IAAI,CAAC,kCAAkC,CAAC,EAAA;;wBAAzH,QAAQ,GAAG,SAA8G;wBAC/H,sBAAO,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,GAAG,IAAI,EAAC;;;wBAEpE,sBAAO,IAAI,EAAC;;;;;KAEnB;;;;;;IAOa,gDAA4B,GAA1C,UAA2C,cAAuC;;;;;;wBAC1E,QAAQ,GAAG,IAAI,CAAC,mCAAmC,EAAE,CAAC;wBAC1D,IAAI,QAAQ,EAAE;4BACV,cAAc,CAAC,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;4BAC7D,sBAAO,uBAAuB,CAAC,MAAM,EAAC;yBACzC;;wBAGD,IAAI,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,kBAAkB,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE;;4BAE9G,sBAAO,uBAAuB,CAAC,KAAK,EAAC;yBACxC;wBAEU,qBAAM,IAAI,CAAC,oCAAoC,EAAE,EAAA;;wBAA5D,QAAQ,GAAG,SAAiD,CAAC;wBAC7D,IAAI,QAAQ,EAAE;4BACV,cAAc,CAAC,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;4BAC5D,sBAAO,uBAAuB,CAAC,OAAO,EAAC;yBAC1C;6BAAM;;4BAEH,MAAM,wBAAwB,CAAC,6BAA6B,EAAE,CAAC;yBAClE;;;;KACJ;;;;IAKO,uDAAmC,GAA3C;;QAEI,IAAI,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE;YAC9C,IAAI;gBACA,IAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAmC,CAAC;gBAClH,IAAM,QAAQ,GAAG,SAAS,CAAC,4CAA4C,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;gBACvH,IAAI,QAAQ,EAAE;oBACV,OAAO,QAAQ,CAAC;iBACnB;aACJ;YAAC,OAAO,CAAC,EAAE;gBACR,MAAM,wBAAwB,CAAC,wCAAwC,EAAE,CAAC;aAC7E;SACJ;;QAGD,IAAI,IAAI,CAAC,oBAAoB,EAAE,EAAE;YAC7B,OAAO,SAAS,CAAC,oCAAoC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;SAC/E;QAED,OAAO,IAAI,CAAC;KACf;;;;;IAMa,wDAAoC,GAAlD;;;;;;wBACU,yBAAyB,GAAG,KAAG,SAAS,CAAC,4BAA4B,GAAG,IAAI,CAAC,kBAAkB,0BAAuB,CAAC;wBACzH,KAAK,GAAG,IAAI,CAAC;;;;wBAEI,qBAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAiC,yBAAyB,CAAC,EAAA;;wBAArH,QAAQ,GAAG,SAA0G;wBACrH,QAAQ,GAAG,gCAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;wBAC/F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;;4BAEvB,sBAAO,IAAI,EAAC;yBACf;wBACD,KAAK,GAAG,SAAS,CAAC,4CAA4C,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;;;;wBAE/F,sBAAO,IAAI,EAAC;;wBAGhB,IAAI,CAAC,KAAK,EAAE;;4BAER,KAAK,GAAG,SAAS,CAAC,oCAAoC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;yBAChF;wBACD,sBAAO,KAAK,EAAC;;;;KAChB;;;;IAKO,wCAAoB,GAA5B;QAAA,iBAMC;QALG,IAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAC,SAAS;YACpE,OAAO,SAAS,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,KAAI,CAAC,eAAe,CAAC;SACvF,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;KAC7B;;;;;IAMM,8CAAoC,GAA3C,UAA4C,IAAY;QACpD,OAAO;YACH,iBAAiB,EAAE,IAAI;YACvB,eAAe,EAAE,IAAI;YACrB,OAAO,EAAE,CAAC,IAAI,CAAC;SAClB,CAAC;KACL;;;;;;IAOM,sDAA4C,GAAnD,UAAoD,QAAkC,EAAE,SAAiB;QACrG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACtC,IAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE;gBAC1C,OAAO,QAAQ,CAAC;aACnB;SACJ;QAED,OAAO,IAAI,CAAC;KACf;;;;IAKD,qCAAiB,GAAjB;QACI,IAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE;YACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;SACxC;aAAM;YACH,MAAM,eAAe,CAAC,sCAAsC,CAAC,uBAAuB,CAAC,CAAC;SACzF;KACJ;;;;;IAMD,2BAAO,GAAP,UAAQ,IAAY;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;KACnD;;;;;;;IAQM,gCAAsB,GAA7B,UAA8B,IAAY;QACtC,OAAO,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAC3D;;;;;;;IAQM,sCAA4B,GAAnC,UAAoC,IAAY,EAAE,MAAc,EAAE,WAAoB;;QAElF,IAAM,oBAAoB,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,oBAAoB,CAAC,aAAa,EAAE,CAAC;QAErC,IAAM,iBAAiB,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,CAAC;QAElE,IAAI,eAAe,GAAK,MAAM,SAAI,iBAAiB,CAAC,eAAiB,CAAC;QAEtE,IAAI,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE;YAChE,eAAe,GAAM,MAAM,SAAI,SAAS,CAAC,iCAAmC,CAAC;SAChF;;QAGD,IAAM,GAAG,GAAG,SAAS,CAAC,+BAA+B,uBAC9C,oBAAoB,CAAC,gBAAgB,EAAE,KAC1C,eAAe,EAAE,eAAe,IAClC,CAAC,SAAS,CAAC;;QAGb,IAAI,WAAW;YAAE,OAAU,GAAG,SAAI,WAAa,CAAC;QAEhD,OAAO,GAAG,CAAC;KACd;;;;;;;IAQM,wCAA8B,GAArC,UAAsC,QAA8B,EAAE,WAAmB;QACrF,QAAQ,CAAC,sBAAsB,GAAG,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;;QAEvH,QAAQ,CAAC,cAAc,GAAG,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAChI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAEnH,OAAO,QAAQ,CAAC;KACnB;IACL,gBAAC;AAAD,CAAC;;;;"}