@buerli.io/backend 0.0.0-stage → 2.0.0-beta.20261016111859

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @buerli.io/backend
+
+## 2.0.0-beta.20261016111859
+
+### Minor Changes
+
+- The backend's client is published to npm as `@buerli.io/backend`, released with buerli's packages in their version, in place of the Nexus registry. It works with React 18 and 19, and a page bundles only what it imports (`sideEffects: false`).

package/README.md

@@ -1,3 +1,27 @@
-# Temporary Holding Version
+# @buerli.io/backend
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The client of ClassCAD's account backend, for web pages: sign-in (email and password, Google, GitHub), the
+account, plans and checkout, and the engine keys an account's plan allows. classcad.ch and buerligons.io are
+built with it.
+
+```sh
+npm install @buerli.io/backend
+```
+
+```jsx
+import { AuthForm, useBackend, fetchEngineKey } from '@buerli.io/backend'
+
+function Account() {
+  const isSignedIn = useBackend(b => b.user.isSignedIn)
+  return isSignedIn ? <p>Signed in.</p> : <AuthForm />
+}
+
+// once signed in: a key for ClassCAD in this page, as the account's plan allows
+const { key } = await fetchEngineKey({ appType: 'wasm', client: 'my-page' })
+```
+
+It talks to the backend of the address it is served on: the live one, or the develop backend on localhost and
+the staging sites. React 18 or 19.
+
+It is developed in [buerli](https://github.com/awv-informatik/buerli) (`packages/backend`) and released with
+buerli's packages, in their version.

package/build/backend.d.ts

@@ -0,0 +1,55 @@
+import { StoreApi } from 'zustand';
+import { ClassfileInfo, User, UserInfo } from './types';
+export type DeepReadonly<T> = {
+    readonly [P in keyof T]: DeepReadonly<T[P]>;
+};
+type StateApi = Readonly<ReturnType<typeof api>>;
+type StateData = DeepReadonly<{
+    user: User;
+    classfiles: {
+        free: ClassfileInfo[];
+        enterprise: ClassfileInfo[];
+    };
+    status: {
+        inProgress: {
+            downloadCCApp?: boolean;
+            fetchFreeClassfilesList?: boolean;
+        };
+    };
+}>;
+type State = StateData & Readonly<{
+    api: StateApi;
+}>;
+declare const api: (set: StoreApi<State>["setState"], get: StoreApi<State>["getState"]) => {
+    /**
+     * Sets the user information.
+     *
+     * @param user The partial user information.
+     */
+    setUser: (user: Partial<UserInfo> | null) => void;
+    fetchFreeClassfilesList: () => Promise<void>;
+    /** @deprecated .ccapp packages (class files with the user's ccApp token): see ClassfileList. */
+    downloadCCApp: (item: ClassfileInfo) => Promise<void>;
+    setInProgress: (inProgress: Partial<StateData["status"]["inProgress"]>) => void;
+    firebaseApp: import("@firebase/app").FirebaseApp;
+    firebaseAuth: import("@firebase/auth").Auth;
+    firebaseStorage: import("@firebase/storage").FirebaseStorage;
+    firebaseFunctionsUrl: string;
+    fetchFile: (path: string, type?: "" | "arraybuffer" | "blob" | "document" | "json" | "text") => Promise<any>;
+    listAllFiles: (path: string) => Promise<import("./types").FileInfo[]>;
+    getIdToken: (forceRefresh?: boolean) => Promise<string | undefined>;
+    signOut: () => Promise<boolean>;
+    signIn: (email: string, password: string) => Promise<boolean | undefined>;
+    createUser: (email: string, password: string) => Promise<boolean>;
+    sendVerifyEmail: () => Promise<boolean>;
+    validateEmail: (email: string) => Promise<boolean>;
+    resetPassword: (email: string) => Promise<boolean>;
+    fetchCCApp: (classfile: ClassfileInfo) => Promise<ArrayBuffer>;
+    getRole: () => Promise<string | undefined | null>;
+    getAppKey: (options?: {
+        appType?: "native" | "wasm";
+        allowedOrigins?: string[];
+    }) => Promise<string>;
+};
+declare const useBackend: import("zustand").UseBoundStore<StoreApi<State>>;
+export { useBackend };

package/build/backend.js

@@ -0,0 +1,112 @@
+import { produce } from 'immer';
+import { create } from 'zustand';
+import { firebaseAPI } from './firebase/firebase';
+import { getClassfileInfo } from './firebase/utils';
+////////////////////////////////////////////////////
+// API
+////////////////////////////////////////////////////
+const _set = (fn) => {
+    useBackend.setState(produce(fn));
+};
+const api = (set, get) => ({
+    ...firebaseAPI,
+    /**
+     * Sets the user information.
+     *
+     * @param user The partial user information.
+     */
+    setUser: (user) => {
+        // Cleanup state if user has logged out
+        if (!user) {
+            _set(state => void (state.classfiles = { free: [], enterprise: [] }));
+        }
+        // Set user
+        _set(state => {
+            state.user.info = user ? { ...state.user?.info, ...user } : null;
+        });
+        // Set additional user information
+        _set(state => {
+            const userInfo = get().user.info;
+            // There is no need to verify the email if the login provider is for example Github or Google
+            const canVerifyEmail = userInfo?.providerData?.map(provider => provider?.providerId).includes('password');
+            state.user.hasValidEmail = userInfo?.emailVerified || !canVerifyEmail;
+            state.user.isSignedIn = userInfo?.uid ? true : false;
+        });
+        // Force an update of the user token.
+        // This is a workaround to have a valid token on
+        // the firebase server after email verification.
+        _set(state => {
+            firebaseAPI.getIdToken(true).catch(() => {
+                // Token refresh failed, but we continue anyway
+            });
+            state.user.lastTokenUpdate = Date.now();
+        });
+    },
+    fetchFreeClassfilesList: async () => {
+        try {
+            get().api.setInProgress({ fetchFreeClassfilesList: true });
+            _set(state => {
+                state.classfiles.free = [];
+                state.classfiles.enterprise = [];
+            });
+            const files = await firebaseAPI.listAllFiles('classfiles/free/');
+            const free = getClassfileInfo(files);
+            let ent = [];
+            try {
+                const rs = ['enterprise', 'admin'];
+                const r = await firebaseAPI.getRole();
+                if (rs.includes(r || '')) {
+                    const files1 = await firebaseAPI.listAllFiles('classfiles/enterprise');
+                    ent = getClassfileInfo(files1);
+                }
+            }
+            catch (error) { }
+            _set(state => {
+                state.classfiles.free = free.sort((a, b) => b.version.code.localeCompare(a.version.code));
+                state.classfiles.enterprise = ent.sort((a, b) => b.version.code.localeCompare(a.version.code));
+            });
+        }
+        catch (error) {
+            _set(state => {
+                state.classfiles.free = [];
+                state.classfiles.enterprise = [];
+            });
+            console.error(error);
+        }
+        finally {
+            get().api.setInProgress({ fetchFreeClassfilesList: false });
+        }
+    },
+    /** @deprecated .ccapp packages (class files with the user's ccApp token): see ClassfileList. */
+    downloadCCApp: async (item) => {
+        try {
+            get().api.setInProgress({ downloadCCApp: true });
+            const data = await firebaseAPI.fetchCCApp(item);
+            const file = item.fullPath.substring(item.fullPath.lastIndexOf('/') + 1);
+            const ext = file.substring(file.lastIndexOf('.'));
+            const name = file.replace(ext, '.ccapp');
+            const link = document.createElement('a');
+            link.href = window.URL.createObjectURL(new Blob([data], { type: 'application/octet-stream' }));
+            link.download = name;
+            link.click();
+        }
+        finally {
+            get().api.setInProgress({ downloadCCApp: false });
+        }
+    },
+    setInProgress: (inProgress) => {
+        _set(state => {
+            state.status.inProgress = { ...state.status.inProgress, ...inProgress }; //deepmerge.all<StateData['status']>([state.status, status])
+        });
+    },
+});
+////////////////////////////////////////////////////
+// DATA AND HOOKS
+////////////////////////////////////////////////////
+const useBackend = create((set, get) => ({
+    user: {},
+    classfiles: { free: [], enterprise: [] },
+    api: api(set, get),
+    status: { inProgress: {} },
+}));
+export { useBackend };

package/build/firebase/config.d.ts

@@ -0,0 +1,12 @@
+import type { FirebaseApp } from 'firebase/app';
+export type BackendName = 'production' | 'develop' | 'emulator';
+export declare const backendName: BackendName;
+export declare const firebaseApp: FirebaseApp;
+export declare const firebaseFunctionsUrl: string;
+export declare const apiBaseUrl: string;
+export declare const googleClientId: string;
+export declare const googleRedirectOrigins: string[];
+export declare const firebaseAuth: import("@firebase/auth").Auth;
+export declare const firebaseStorage: import("@firebase/storage").FirebaseStorage;
+export declare const firebaseDb: import("@firebase/firestore").Firestore;
+export declare const firebaseFunctions: import("@firebase/functions").Functions;

package/build/firebase/config.js

@@ -0,0 +1,76 @@
+import { initializeApp, getApps, getApp } from 'firebase/app';
+import { connectAuthEmulator, getAuth } from 'firebase/auth';
+import { connectFirestoreEmulator, getFirestore } from 'firebase/firestore';
+import { getStorage } from 'firebase/storage';
+import { getAnalytics } from 'firebase/analytics';
+import { getFunctions } from 'firebase/functions';
+const LIVE = 'develop';
+const chooseBackend = () => {
+    if (typeof window === 'undefined')
+        return LIVE;
+    try {
+        const chosen = window.localStorage.getItem('classcad.backend');
+        if (chosen === 'production' || chosen === 'develop' || chosen === 'emulator')
+            return chosen;
+    }
+    catch (error) { }
+    const host = window.location.hostname;
+    return ['localhost', '127.0.0.1', '[::1]'].includes(host) || host.startsWith('staging01.') ? 'develop' : LIVE;
+};
+export const backendName = chooseBackend();
+const production = JSON.parse(atob('eyJhcGlLZXkiOiJBSXphU3lDektoVk9YSk93THRtSzlTakNvRUVJa1o2TjdpbFNwOUUiLCJhdXRoRG9tYWluIjoiYnVlcmxpLmZpcmViYXNlYXBwLmNvbSIsImRhdGFiYXNlVVJMIjoiaHR0cHM6Ly9idWVybGkuZmlyZWJhc2Vpby5jb20iLCJwcm9qZWN0SWQiOiJidWVybGkiLCJzdG9yYWdlQnVja2V0IjoiYnVlcmxpLmFwcHNwb3QuY29tIiwibWVzc2FnaW5nU2VuZGVySWQiOiI3NDM5NzkxMDM3NTIiLCJhcHBJZCI6IjE6NzQzOTc5MTAzNzUyOndlYjpmN2ZhMmVlZTBiYzZmZjhlYmM0M2JkIiwibWVhc3VyZW1lbnRJZCI6IkctV1ZOQzdKTFdYNCJ9'));
+const develop = {
+    apiKey: 'AIzaSyA3emzV1j-4WrUduiQ9JJuRGhrR1MNWiqY',
+    authDomain: 'classcad-app.firebaseapp.com',
+    projectId: 'classcad-app',
+    storageBucket: 'classcad-app.firebasestorage.app',
+    messagingSenderId: '919811296885',
+    appId: '1:919811296885:web:629ab4ee369208314eb23c',
+};
+const emulator = { ...develop, apiKey: 'emulator', projectId: 'demo-classcad', authDomain: 'localhost' };
+const backends = {
+    production: { config: production, funcUrl: 'https://backend.buerli.io' },
+    develop: { config: develop, funcUrl: 'https://europe-west1-classcad-app.cloudfunctions.net' },
+    emulator: { config: emulator, funcUrl: 'http://127.0.0.1:5001/demo-classcad/europe-west1' },
+};
+// The OAuth clients behind Firebase's Google provider, and the origins that client lists
+// under "Authorized redirect URIs" as "<origin>/". Only those can sign in by redirect
+// (see googleRedirect.ts); every other origin keeps the popup.
+let googleClient = '743979103752-br1vnls884ictnh5cpnrua23rjiaj5dh.apps.googleusercontent.com';
+let googleRedirects = [
+    'https://classcad.ch',
+    'https://www.classcad.ch',
+    'https://staging01.classcad.ch',
+    'http://localhost:9090',
+];
+if (backendName !== 'production') {
+    googleClient = '';
+    googleRedirects = [];
+}
+const { config: firebaseConfig, funcUrl } = backends[backendName];
+const FIREBASE_APP_NAME = '___buerli-backend___';
+let rootApp;
+let fresh = false;
+if (getApps().some(app => app.name === FIREBASE_APP_NAME)) {
+    rootApp = getApp(FIREBASE_APP_NAME);
+}
+else {
+    rootApp = initializeApp(firebaseConfig, FIREBASE_APP_NAME);
+    fresh = true;
+}
+export const firebaseApp = rootApp;
+export const firebaseFunctionsUrl = funcUrl;
+// The backend's API; the function URL and the custom domain both serve it under /api/v1
+export const apiBaseUrl = `${funcUrl}/api/v1`;
+export const googleClientId = googleClient;
+export const googleRedirectOrigins = googleRedirects;
+export const firebaseAuth = getAuth(firebaseApp);
+export const firebaseStorage = getStorage(firebaseApp);
+export const firebaseDb = getFirestore(firebaseApp);
+export const firebaseFunctions = getFunctions(firebaseApp);
+if (backendName === 'emulator' && fresh) {
+    connectAuthEmulator(firebaseAuth, 'http://127.0.0.1:9099', { disableWarnings: true });
+    connectFirestoreEmulator(firebaseDb, '127.0.0.1', 8080);
+}
+if (backendName === 'production' && typeof window !== 'undefined')
+    getAnalytics(firebaseApp);

package/build/firebase/firebase.d.ts

@@ -0,0 +1,30 @@
+import { ClassfileInfo, FileInfo } from '../types';
+declare const firebaseAPI: {
+    firebaseApp: import("@firebase/app").FirebaseApp;
+    firebaseAuth: import("@firebase/auth").Auth;
+    firebaseStorage: import("@firebase/storage").FirebaseStorage;
+    firebaseFunctionsUrl: string;
+    fetchFile: (path: string, type?: "" | "arraybuffer" | "blob" | "document" | "json" | "text") => Promise<any>;
+    listAllFiles: (path: string) => Promise<FileInfo[]>;
+    getIdToken: (forceRefresh?: boolean) => Promise<string | undefined>;
+    signOut: () => Promise<boolean>;
+    signIn: (email: string, password: string) => Promise<boolean | undefined>;
+    createUser: (email: string, password: string) => Promise<boolean>;
+    sendVerifyEmail: () => Promise<boolean>;
+    validateEmail: (email: string) => Promise<boolean>;
+    resetPassword: (email: string) => Promise<boolean>;
+    /** @deprecated .ccapp packages (class files with the user's ccApp token): see ClassfileList. */
+    fetchCCApp: (classfile: ClassfileInfo) => Promise<ArrayBuffer>;
+    getRole: () => Promise<string | undefined | null>;
+    getAppKey: (options?: {
+        appType?: "native" | "wasm";
+        allowedOrigins?: string[];
+    }) => Promise<string>;
+};
+export { firebaseAPI };
+export type Plan = {
+    name: string;
+    price: number | string;
+    pricingInterval: string;
+    __id: string;
+};

package/build/firebase/firebase.js

@@ -0,0 +1,182 @@
+import { ref as storageRef, getDownloadURL, listAll, getMetadata } from 'firebase/storage';
+import { isValidEmail } from '../utils/isValidEmail';
+import { apiBaseUrl, firebaseApp, firebaseAuth, firebaseStorage, firebaseFunctionsUrl } from './config';
+import { signIn, signOut } from './signInOut';
+const BASE_URL = apiBaseUrl;
+const firebaseAPI = {
+    firebaseApp,
+    firebaseAuth,
+    firebaseStorage,
+    firebaseFunctionsUrl,
+    fetchFile: async (path, type = 'arraybuffer') => {
+        const url = await getDownloadURL(storageRef(firebaseStorage, path));
+        return await fetch(url).then(res => {
+            if (type === 'arraybuffer')
+                return res.arrayBuffer();
+            if (type === 'blob')
+                return res.blob();
+            if (type === 'json')
+                return res.json();
+            if (type === 'text')
+                return res.text();
+            return res;
+        });
+    },
+    listAllFiles: async (path) => {
+        const base64ToHex = (str) => {
+            const raw = atob(str);
+            let result = '';
+            for (let i = 0; i < raw.length; i++) {
+                const hex = raw.charCodeAt(i).toString(16);
+                result += hex.length === 2 ? hex : '0' + hex;
+            }
+            return result;
+        };
+        const modelsRef = storageRef(firebaseStorage, path);
+        const references = (await listAll(modelsRef)).items;
+        const files = [];
+        for (const refItem of references) {
+            const url = await getDownloadURL(refItem);
+            const meta = await getMetadata(refItem);
+            const md5Hash = meta.md5Hash ? base64ToHex(meta.md5Hash) : '';
+            files.push({ fullPath: refItem.fullPath, name: refItem.name, downloadUrl: url, meta: { md5Hash } });
+        }
+        return files;
+    },
+    getIdToken: async (forceRefresh) => {
+        if (!firebaseAuth.currentUser)
+            return undefined;
+        const { getIdToken } = await import('firebase/auth');
+        return getIdToken(firebaseAuth.currentUser, forceRefresh);
+    },
+    signOut: async () => {
+        return signOut();
+    },
+    signIn: async (email, password) => {
+        return signIn(email, password);
+    },
+    createUser: async (email, password) => {
+        try {
+            if (!isValidEmail(email))
+                throw new Error('Bad email!');
+            if (!password || password.length < 8)
+                throw new Error('Bad password!');
+            const isValid = await firebaseAPI.validateEmail(email);
+            if (!isValid)
+                throw new Error('Email address is not supported!');
+            const { createUserWithEmailAndPassword } = await import('firebase/auth');
+            await createUserWithEmailAndPassword(firebaseAuth, email, password);
+            firebaseAPI.sendVerifyEmail();
+            // firebaseAPI.signOut();
+            return true;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            alert(message);
+            console.error({ type: 'error', title: 'Creating the user has failed!', message });
+            return false;
+        }
+    },
+    sendVerifyEmail: async () => {
+        try {
+            if (firebaseAuth.currentUser) {
+                const { sendEmailVerification } = await import('firebase/auth');
+                await sendEmailVerification(firebaseAuth.currentUser);
+            }
+            console.info({ type: 'info', title: 'Verification email has been sent!' });
+            return true;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            console.error({ type: 'error', title: 'Sending the verification email has failed!', message });
+            return false;
+        }
+    },
+    validateEmail: async (email) => {
+        return new Promise((resolve, reject) => {
+            const url = `${BASE_URL}/validate/email/${email}`;
+            const xhr = new XMLHttpRequest();
+            xhr.responseType = 'json';
+            xhr.onload = () => {
+                resolve(xhr.response.valid);
+            };
+            xhr.onerror = () => {
+                reject(new Error('Network request failed'));
+            };
+            xhr.open('GET', url);
+            xhr.send();
+        });
+    },
+    resetPassword: async (email) => {
+        try {
+            if (!isValidEmail(email))
+                throw new Error('Bad email!');
+            const isValid = await firebaseAPI.validateEmail(email);
+            if (!isValid)
+                throw new Error('Not a valid email address!');
+            const { sendPasswordResetEmail } = await import('firebase/auth');
+            await sendPasswordResetEmail(firebaseAuth, email);
+            return true;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            console.error({ type: 'error', title: `Password reset failed! ${message}`, message });
+            return false;
+        }
+    },
+    /** @deprecated .ccapp packages (class files with the user's ccApp token): see ClassfileList. */
+    fetchCCApp: async (classfile) => {
+        return new Promise(async (resolve, reject) => {
+            try {
+                const url = `${BASE_URL}/user/ccapp`;
+                const xhr = new XMLHttpRequest();
+                xhr.responseType = 'arraybuffer';
+                xhr.onload = () => {
+                    resolve(xhr.response);
+                };
+                xhr.onerror = e => {
+                    reject(e);
+                };
+                xhr.open('POST', url);
+                xhr.setRequestHeader('Content-Type', 'application/json');
+                xhr.setRequestHeader('Authorization', 'Bearer ' + (await firebaseAPI.getIdToken(true)));
+                xhr.send(JSON.stringify({ fileUrl: classfile.fullPath }));
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+    },
+    getRole: async () => {
+        if (!firebaseAuth.currentUser)
+            return null;
+        const { getIdTokenResult } = await import('firebase/auth');
+        const user = await getIdTokenResult(firebaseAuth.currentUser);
+        return typeof user.claims?.role === 'string' ? user.claims.role : null;
+    },
+    getAppKey: async (options) => {
+        return new Promise(async (resolve, reject) => {
+            try {
+                const { appType = 'native', allowedOrigins = [] } = options || {};
+                const aO = allowedOrigins.join(',');
+                const url = `${BASE_URL}/appkey?appType=${appType}&allowedOrigins=${aO}`;
+                const xhr = new XMLHttpRequest();
+                xhr.responseType = 'text';
+                xhr.onload = () => {
+                    resolve(xhr.response);
+                };
+                xhr.onerror = e => {
+                    reject(e);
+                };
+                xhr.open('GET', url);
+                xhr.setRequestHeader('Content-Type', 'application/json');
+                xhr.setRequestHeader('Authorization', 'Bearer ' + (await firebaseAPI.getIdToken(true)));
+                xhr.send();
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+    },
+};
+export { firebaseAPI };

package/build/firebase/googleRedirect.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Whether the Google sign-in should leave the page instead of opening a popup:
+ * on phones and tablets, where this origin is registered for it.
+ */
+export declare const shouldRedirectToGoogle: () => boolean;
+/**
+ * Sends the page to Google. The reader comes back to "<origin>/", where completeGoogleRedirect
+ * signs them in and returns them to the page they started on.
+ */
+export declare const redirectToGoogle: () => Promise<void>;

package/build/firebase/googleRedirect.js

@@ -0,0 +1,139 @@
+import { GoogleAuthProvider, signInWithCredential } from 'firebase/auth';
+import { firebaseAuth, googleClientId, googleRedirectOrigins } from './config';
+// Google sign-in without Firebase's hosted handler page.
+//
+// signInWithPopup sends the reader through <authDomain>/__/auth/handler, which keeps its state in
+// sessionStorage while they are at Google. On phones, in-app browsers above all, that state is
+// often gone on the way back: "Unable to process request due to missing initial state".
+//
+// Here the page itself goes to Google, and Google comes straight back to "<origin>/" with an ID
+// token in the URL fragment, which Firebase takes as a credential. No window is opened, and
+// nothing has to survive in another site's storage.
+const PENDING = 'buerli-google-signin';
+// How long the reader may spend at Google, in seconds
+const MAX_AGE = 10 * 60;
+const hex = (bytes) => Array.prototype.map.call(bytes, (byte) => ('0' + byte.toString(16)).slice(-2)).join('');
+const sha256 = async (text) => hex(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text))));
+// Kept in localStorage and in a cookie: whichever is still there on the way back is enough.
+const save = (pending) => {
+    const value = JSON.stringify(pending);
+    try {
+        window.localStorage.setItem(PENDING, value);
+    }
+    catch (error) { }
+    const secure = window.location.protocol === 'https:' ? '; Secure' : '';
+    document.cookie = `${PENDING}=${encodeURIComponent(value)}; Max-Age=${MAX_AGE}; Path=/; SameSite=Lax${secure}`;
+};
+const load = () => {
+    let value = null;
+    try {
+        value = window.localStorage.getItem(PENDING);
+    }
+    catch (error) { }
+    if (!value) {
+        const cookie = document.cookie.split('; ').filter(entry => entry.indexOf(`${PENDING}=`) === 0)[0];
+        if (cookie)
+            value = decodeURIComponent(cookie.slice(PENDING.length + 1));
+    }
+    try {
+        const pending = value ? JSON.parse(value) : null;
+        return pending && typeof pending.raw === 'string' && typeof pending.returnTo === 'string' ? pending : null;
+    }
+    catch (error) {
+        return null;
+    }
+};
+const clear = () => {
+    try {
+        window.localStorage.removeItem(PENDING);
+    }
+    catch (error) { }
+    document.cookie = `${PENDING}=; Max-Age=0; Path=/; SameSite=Lax`;
+};
+// The nonce Google wrote into the ID token (the token itself is verified by Firebase)
+const nonceOf = (idToken) => {
+    try {
+        const payload = idToken.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        return JSON.parse(atob(payload)).nonce;
+    }
+    catch (error) {
+        return undefined;
+    }
+};
+// A path on this site, never another host
+const isLocalPath = (path) => path.charAt(0) === '/' && path.charAt(1) !== '/' && path.charAt(1) !== '\\';
+const isMobileBrowser = () => {
+    const ua = window.navigator.userAgent;
+    // An iPad reports a Mac; its touch points give it away
+    return /Android|iPhone|iPad|iPod/i.test(ua) || (/Macintosh/.test(ua) && window.navigator.maxTouchPoints > 1);
+};
+/**
+ * Whether the Google sign-in should leave the page instead of opening a popup:
+ * on phones and tablets, where this origin is registered for it.
+ */
+export const shouldRedirectToGoogle = () => typeof window !== 'undefined' &&
+    Boolean(googleClientId) &&
+    googleRedirectOrigins.indexOf(window.location.origin) >= 0 &&
+    Boolean(window.crypto && window.crypto.subtle) &&
+    isMobileBrowser();
+/**
+ * Sends the page to Google. The reader comes back to "<origin>/", where completeGoogleRedirect
+ * signs them in and returns them to the page they started on.
+ */
+export const redirectToGoogle = async () => {
+    const random = new Uint8Array(32);
+    window.crypto.getRandomValues(random);
+    const raw = hex(random);
+    // Google gets the hash, as nonce and as state; the value itself never leaves this browser
+    const nonce = await sha256(raw);
+    save({ raw, returnTo: window.location.pathname + window.location.search, at: Date.now() });
+    const params = new URLSearchParams([
+        ['client_id', googleClientId],
+        ['redirect_uri', `${window.location.origin}/`],
+        ['response_type', 'id_token'],
+        ['scope', 'openid email profile'],
+        ['nonce', nonce],
+        ['state', nonce],
+        ['prompt', 'select_account'],
+    ]);
+    window.location.assign(`https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`);
+};
+const completeGoogleRedirect = async () => {
+    const answer = new URLSearchParams(window.location.hash.slice(1));
+    const idToken = answer.get('id_token');
+    const state = answer.get('state');
+    const refused = answer.get('error');
+    if (!state || (!idToken && !refused))
+        return;
+    const pending = load();
+    // Some other fragment is left alone, but a token never stays in the address bar
+    if (!pending && !idToken)
+        return;
+    window.history.replaceState(window.history.state, '', window.location.pathname + window.location.search);
+    clear();
+    try {
+        if (!pending || Date.now() - pending.at > MAX_AGE * 1000) {
+            throw new Error('The sign-in was not started in this browser, or it took too long.');
+        }
+        const expected = await sha256(pending.raw);
+        if (state !== expected)
+            throw new Error('The answer does not belong to this sign-in.');
+        if (idToken) {
+            if (nonceOf(idToken) !== expected)
+                throw new Error('The answer does not belong to this sign-in.');
+            await signInWithCredential(firebaseAuth, GoogleAuthProvider.credential(idToken));
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        console.error({ type: 'error', title: 'Sign in failed!', message });
+        alert(`Google sign-in could not be completed. ${message} Please try again, or sign in with your email address.`);
+    }
+    const here = window.location.pathname + window.location.search;
+    if (pending && isLocalPath(pending.returnTo) && pending.returnTo !== here) {
+        window.location.replace(pending.returnTo);
+    }
+};
+if (typeof window !== 'undefined') {
+    completeGoogleRedirect().catch(error => console.error(error));
+}