@civic/auth 0.3.2-beta.1 → 0.3.2-beta.3

package/dist/src/services/AuthenticationService.js

@@ -1,322 +0,0 @@
-// Proposals for revised versions of the SessionService AKA AuthSessionService
-import { BrowserPublicClientPKCEProducer, ConfidentialClientPKCEConsumer, } from "@/services/PKCE.js";
-import { clearTokens, clearUser, exchangeTokens, generateOauthLoginUrl, generateOauthLogoutUrl, getEndpointsWithOverrides, retrieveTokens, storeTokens, validateOauth2Tokens, } from "@/shared/lib/util.js";
-import { displayModeFromState, generateState } from "@/lib/oauth.js";
-import { OAuth2Client } from "oslo/oauth2";
-import { LocalStorageAdapter } from "@/browser/storage.js";
-import { PopupError } from "@/services/types.js";
-import { removeParamsWithoutReload } from "@/lib/windowUtil.js";
-import { DEFAULT_OAUTH_GET_PARAMS } from "@/constants.js";
-import { validateLoginAppPostMessage } from "@/lib/postMessage.js";
-import { getUser } from "@/shared/lib/session.js";
-import { GenericUserSession } from "@/shared/lib/UserSession.js";
-/**
- * An authentication initiator that works on a browser. Since this is just triggering
- * login and logout, session data is not stored here.
- * An associated AuthenticationResolver would be needed to get the session data.
- * Storage is needed for the code verifier, this is the domain of the PKCEConsumer
- * The storage used by the PKCEConsumer should be available to the AuthenticationResolver.
- *
- * Example usage:
- *
- * 1) Client-only SPA -eg a react app with no server:
- * new BrowserAuthenticationInitiator({
- *   pkceConsumer: new BrowserPublicClientPKCEProducer(), // generate and retrieve the challenge client-side
- *   ... other config
- * })
- *
- * 2) Client-side of a client/server app - eg a react app with a backend:
- * new BrowserAuthenticationInitiator({
- *  pkceConsumer: new ConfidentialClientPKCEConsumer("https://myserver.com/pkce"), // get the challenge from the server
- *  ... other config
- * })
- */
-export class BrowserAuthenticationInitiator {
-    postMessageHandler = null;
-    config;
-    setDisplayMode(displayMode) {
-        this.config.displayMode = displayMode;
-    }
-    get displayMode() {
-        return this.config.displayMode;
-    }
-    get isServerTokenExchange() {
-        return this.config.pkceConsumer instanceof ConfidentialClientPKCEConsumer;
-    }
-    get state() {
-        return generateState(this.config.displayMode, this.isServerTokenExchange);
-    }
-    constructor(config) {
-        this.config = config;
-    }
-    async handleLoginAppPopupFailed(redirectUrl) {
-        console.warn("Login app popup failed open a popup, using redirect mode instead...", redirectUrl);
-        window.location.href = redirectUrl;
-    }
-    // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url
-    // and then use the display mode to decide how to send the user there
-    async signIn(iframeRef) {
-        const url = await generateOauthLoginUrl({
-            ...this.config,
-            state: this.state,
-        });
-        this.postMessageHandler = (event) => {
-            const thisURL = new URL(window.location.href);
-            if (event.origin.endsWith("civic.com") ||
-                thisURL.hostname === "localhost") {
-                if (!validateLoginAppPostMessage(event.data, this.config.clientId)) {
-                    return;
-                }
-                const loginMessage = event.data;
-                this.handleLoginAppPopupFailed(loginMessage.data.url);
-            }
-        };
-        window.addEventListener("message", this.postMessageHandler);
-        if (this.config.displayMode === "iframe") {
-            if (!iframeRef)
-                throw new Error("iframeRef is required for displayMode 'iframe'");
-            iframeRef.setAttribute("src", url.toString());
-        }
-        if (this.config.displayMode === "redirect") {
-            window.location.href = url.toString();
-        }
-        if (this.config.displayMode === "new_tab") {
-            try {
-                const popupWindow = window.open(url.toString(), "_blank");
-                if (!popupWindow) {
-                    throw new PopupError("Failed to open popup window");
-                }
-            }
-            catch (error) {
-                console.error("popupWindow", error);
-                throw new PopupError("window.open has thrown: Failed to open popup window");
-            }
-        }
-        return url;
-    }
-    handleIframeUrlChange(iframe, expectedUrl) {
-        return new Promise((resolve, reject) => {
-            const checkIframe = () => {
-                try {
-                    // Try to access iframe URL - this will throw if cross-origin
-                    const currentUrl = iframe.contentWindow?.location.href;
-                    if (currentUrl?.includes(expectedUrl)) {
-                        clearInterval(interval);
-                        resolve();
-                    }
-                }
-                catch (e) {
-                    // Ignore cross-origin errors
-                    console.log("Cross-origin error", e);
-                }
-            };
-            const interval = setInterval(checkIframe, 100);
-            // Timeout after 10 seconds
-            setTimeout(() => {
-                clearInterval(interval);
-                reject(new Error("Timeout waiting for iframe URL change"));
-            }, 10000);
-        });
-    }
-    async signOut(idToken, iframeRef) {
-        let url;
-        const state = this.state;
-        if (this.isServerTokenExchange) {
-            if (!this.config.logoutUrl) {
-                throw new Error("logoutUrl is required for server token exchange");
-            }
-            url = new URL(this.config.logoutUrl, window.location.origin);
-            url.searchParams.append("state", state);
-        }
-        else {
-            if (!idToken) {
-                throw new Error("idToken is required for non-server token exchange");
-            }
-            url = await generateOauthLogoutUrl({
-                ...this.config,
-                idToken,
-                state,
-                redirectUrl: this.config.logoutRedirectUrl,
-            });
-        }
-        if (this.config.displayMode === "iframe") {
-            if (!iframeRef) {
-                throw new Error("iframeRef is required for displayMode 'iframe'");
-            }
-            iframeRef.setAttribute("src", url.toString());
-            try {
-                await this.handleIframeUrlChange(iframeRef, this.config.logoutRedirectUrl);
-                // Clear storage after successful detection
-                if (!this.isServerTokenExchange) {
-                    const localStorage = new LocalStorageAdapter();
-                    await clearTokens(localStorage);
-                    await clearUser(localStorage);
-                    LocalStorageAdapter.emitter.emit("signOut");
-                }
-            }
-            catch (error) {
-                console.error("Failed to detect logout URL in iframe:", error);
-            }
-        }
-        if (this.config.displayMode === "redirect") {
-            const localStorage = new LocalStorageAdapter();
-            localStorage.set("logout_state", state);
-            window.location.href = url.toString();
-        }
-        if (this.config.displayMode === "new_tab") {
-            try {
-                const popupWindow = window.open(url.toString(), "_blank");
-                if (!popupWindow) {
-                    throw new PopupError("Failed to open popup window");
-                }
-            }
-            catch (error) {
-                console.error("popupWindow", error);
-                throw new PopupError("window.open has thrown: Failed to open popup window");
-            }
-        }
-        return url;
-    }
-    cleanup() {
-        if (this.postMessageHandler) {
-            window.removeEventListener("message", this.postMessageHandler);
-        }
-    }
-}
-/** A general-purpose authentication initiator, that just generates urls, but lets
- * the caller decide how to use them. This is useful for server-side applications
- * that may serve this URL to their front-ends or just call them directly
- */
-export class GenericAuthenticationInitiator {
-    config;
-    constructor(config) {
-        this.config = config;
-    }
-    // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url
-    // and simply return the url
-    async signIn() {
-        return generateOauthLoginUrl(this.config);
-    }
-    async signOut(idToken) {
-        return generateOauthLogoutUrl({
-            ...this.config,
-            idToken,
-        });
-    }
-}
-/**
- * An authentication resolver that can run on the browser (i.e. a public client)
- * It uses PKCE for security. PKCE and Session data are stored in local storage
- */
-export class BrowserAuthenticationService extends BrowserAuthenticationInitiator {
-    pkceProducer;
-    oauth2client;
-    endpoints;
-    // TODO WIP - perhaps we want to keep resolver and initiator separate here
-    constructor(config, 
-    // Since we are running fully on the client, we produce as well as consume the PKCE challenge
-    pkceProducer = new BrowserPublicClientPKCEProducer()) {
-        super({
-            ...config,
-            // Store and retrieve the PKCE challenge in local storage
-            pkceConsumer: pkceProducer,
-        });
-        this.pkceProducer = pkceProducer;
-    }
-    // TODO too much code duplication here between the browser and the server variant.
-    // Suggestion for refactor: Standardise the config for AuthenticationResolvers and create a one-shot
-    // function for generating an oauth2client from it
-    async init() {
-        // resolve oauth config
-        this.endpoints = await getEndpointsWithOverrides(this.config.oauthServer, this.config.endpointOverrides);
-        this.oauth2client = new OAuth2Client(this.config.clientId, this.endpoints.auth, this.endpoints.token, {
-            redirectURI: this.config.redirectUrl,
-        });
-        return this;
-    }
-    // Two responsibilities:
-    // 1. resolve the auth code to get the tokens (should use library code)
-    // 2. store the tokens in local storage
-    async tokenExchange(code, state) {
-        if (!this.oauth2client)
-            await this.init();
-        const codeVerifier = await this.pkceProducer.getCodeVerifier();
-        if (!codeVerifier)
-            throw new Error("Code verifier not found in storage");
-        // exchange auth code for tokens
-        const tokens = await exchangeTokens(code, state, this.pkceProducer, this.oauth2client, // clean up types here to avoid the ! operator
-        this.config.oauthServer, this.endpoints);
-        const clientStorage = new LocalStorageAdapter();
-        await storeTokens(clientStorage, tokens);
-        const user = await getUser(clientStorage);
-        if (!user) {
-            throw new Error("Failed to get user info");
-        }
-        const userSession = new GenericUserSession(clientStorage);
-        await userSession.set(user);
-        LocalStorageAdapter.emitter.emit("signIn");
-        // cleanup the browser window if needed
-        const parsedDisplayMode = displayModeFromState(state, this.config.displayMode);
-        if (parsedDisplayMode === "new_tab") {
-            // Close the popup window
-            window.addEventListener("beforeunload", () => {
-                window?.opener?.focus();
-            });
-            window.close();
-        }
-        // these are the default oAuth params that get added to the URL in redirect which we want to remove if present
-        removeParamsWithoutReload(DEFAULT_OAUTH_GET_PARAMS);
-        return tokens;
-    }
-    // Get the session data from local storage
-    async getSessionData() {
-        const storageData = await retrieveTokens(new LocalStorageAdapter());
-        if (!storageData)
-            return null;
-        return {
-            authenticated: !!storageData.id_token,
-            idToken: storageData.id_token,
-            accessToken: storageData.access_token,
-            refreshToken: storageData.refresh_token,
-        };
-    }
-    async validateExistingSession() {
-        try {
-            const sessionData = await this.getSessionData();
-            if (!sessionData?.idToken || !sessionData.accessToken) {
-                const unAuthenticatedSession = { ...sessionData, authenticated: false };
-                // await clearTokens(new LocalStorageAdapter());
-                return unAuthenticatedSession;
-            }
-            if (!this.endpoints || !this.oauth2client)
-                await this.init();
-            // this function will throw if any of the tokens are invalid
-            await validateOauth2Tokens({
-                access_token: sessionData.accessToken,
-                id_token: sessionData.idToken,
-                refresh_token: sessionData.refreshToken,
-            }, this.endpoints, this.oauth2client, this.config.oauthServer);
-            return sessionData;
-        }
-        catch (error) {
-            console.warn("Failed to validate existing tokens", error);
-            const unAuthenticatedSession = {
-                authenticated: false,
-            };
-            await clearTokens(new LocalStorageAdapter());
-            return unAuthenticatedSession;
-        }
-    }
-    async getEndSessionEndpoint() {
-        if (!this.endpoints) {
-            return null;
-        }
-        return this.endpoints?.endsession;
-    }
-    static async build(config) {
-        const resolver = new BrowserAuthenticationService(config);
-        await resolver.init();
-        return resolver;
-    }
-}
-//# sourceMappingURL=AuthenticationService.js.map

package/dist/src/services/AuthenticationService.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthenticationService.js","sourceRoot":"","sources":["../../../src/services/AuthenticationService.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAS9E,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,WAAW,EACX,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAwBjE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,8BAA8B;IACjC,kBAAkB,GAA2C,IAAI,CAAC;IAEhE,MAAM,CAAuC;IAEhD,cAAc,CAAC,WAAwB;QAC5C,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;IACxC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,YAAY,8BAA8B,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK;QACP,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC5E,CAAC;IACD,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,WAAmB;QACjD,OAAO,CAAC,IAAI,CACV,qEAAqE,EACrE,WAAW,CACZ,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,uGAAuG;IACvG,qEAAqE;IACrE,KAAK,CAAC,MAAM,CAAC,SAAmC;QAC9C,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;YACtC,GAAG,IAAI,CAAC,MAAM;YACd,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,GAAG,CAAC,KAAmB,EAAE,EAAE;YAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9C,IACE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAClC,OAAO,CAAC,QAAQ,KAAK,WAAW,EAChC,CAAC;gBACD,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnE,OAAO;gBACT,CAAC;gBACD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAwB,CAAC;gBACpD,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAE5D,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,UAAU,CAAC,6BAA6B,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACpC,MAAM,IAAI,UAAU,CAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAES,qBAAqB,CAC7B,MAAyB,EACzB,WAAmB;QAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,WAAW,GAAG,GAAG,EAAE;gBACvB,IAAI,CAAC;oBACH,6DAA6D;oBAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACvD,IAAI,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;wBACtC,aAAa,CAAC,QAAQ,CAAC,CAAC;wBACxB,OAAO,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,6BAA6B;oBAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC/C,2BAA2B;YAC3B,UAAU,CAAC,GAAG,EAAE;gBACd,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAC7D,CAAC,EAAE,KAAK,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAA2B,EAC3B,SAAmC;QAEnC,IAAI,GAAG,CAAC;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7D,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,GAAG,MAAM,sBAAsB,CAAC;gBACjC,GAAG,IAAI,CAAC,MAAM;gBACd,OAAO;gBACP,KAAK;gBACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAE9C,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,qBAAqB,CAC9B,SAAS,EACT,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC9B,CAAC;gBAEF,2CAA2C;gBAC3C,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAChC,MAAM,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;oBAC/C,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;oBAChC,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;oBAC9B,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,UAAU,CAAC,6BAA6B,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACpC,MAAM,IAAI,UAAU,CAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA8B;IAC/B,MAAM,CAAuC;IAEvD,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,uGAAuG;IACvG,4BAA4B;IAC5B,KAAK,CAAC,MAAM;QACV,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,OAAO,sBAAsB,CAAC;YAC5B,GAAG,IAAI,CAAC,MAAM;YACd,OAAO;SACR,CAAC,CAAC;IACL,CAAC;CACF;AAaD;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,8BAA8B;IAQlE;IAPJ,YAAY,CAA2B;IACvC,SAAS,CAAwB;IAEzC,0EAA0E;IAC1E,YACE,MAAmC;IACnC,6FAA6F;IACnF,eAAe,IAAI,+BAA+B,EAAE;QAE9D,KAAK,CAAC;YACJ,GAAG,MAAM;YACT,yDAAyD;YACzD,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;QANO,iBAAY,GAAZ,YAAY,CAAwC;IAOhE,CAAC;IAED,kFAAkF;IAClF,oGAAoG;IACpG,kDAAkD;IAClD,KAAK,CAAC,IAAI;QACR,uBAAuB;QACvB,IAAI,CAAC,SAAS,GAAG,MAAM,yBAAyB,CAC9C,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC9B,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EACpB;YACE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACrC,CACF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB;IACxB,uEAAuE;IACvE,uCAAuC;IACvC,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;QAC/D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAEzE,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,KAAK,EACL,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAa,EAAE,8CAA8C;QAClE,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,IAAI,CAAC,SAAU,CAChB,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAChD,MAAM,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,oBAAoB,CAC5C,KAAK,EACL,IAAI,CAAC,MAAM,CAAC,WAAW,CACxB,CAAC;QAEF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,yBAAyB;YACzB,MAAM,CAAC,gBAAgB,CAAC,cAAc,EAAE,GAAG,EAAE;gBAC3C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QACD,8GAA8G;QAC9G,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,cAAc;QAClB,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ;YACrC,OAAO,EAAE,WAAW,CAAC,QAAQ;YAC7B,WAAW,EAAE,WAAW,CAAC,YAAY;YACrC,YAAY,EAAE,WAAW,CAAC,aAAa;SACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBACtD,MAAM,sBAAsB,GAAG,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;gBACxE,gDAAgD;gBAChD,OAAO,sBAAsB,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAE7D,4DAA4D;YAC5D,MAAM,oBAAoB,CACxB;gBACE,YAAY,EAAE,WAAW,CAAC,WAAW;gBACrC,QAAQ,EAAE,WAAW,CAAC,OAAO;gBAC7B,aAAa,EAAE,WAAW,CAAC,YAAY;aACxC,EACD,IAAI,CAAC,SAAU,EACf,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,MAAM,CAAC,WAAW,CACxB,CAAC;YACF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,sBAAsB,GAAG;gBAC7B,aAAa,EAAE,KAAK;aACrB,CAAC;YACF,MAAM,WAAW,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;YAC7C,OAAO,sBAAsB,CAAC;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,MAAmC;QAEnC,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEtB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF","sourcesContent":["// Proposals for revised versions of the SessionService AKA AuthSessionService\n\nimport type {\n  DisplayMode,\n  Endpoints,\n  LoginPostMessage,\n  OIDCTokenResponseBody,\n  SessionData,\n} from \"@/types.js\";\nimport {\n  BrowserPublicClientPKCEProducer,\n  ConfidentialClientPKCEConsumer,\n} from \"@/services/PKCE.js\";\nimport {\n  clearTokens,\n  clearUser,\n  exchangeTokens,\n  generateOauthLoginUrl,\n  generateOauthLogoutUrl,\n  getEndpointsWithOverrides,\n  retrieveTokens,\n  storeTokens,\n  validateOauth2Tokens,\n} from \"@/shared/lib/util.js\";\nimport { displayModeFromState, generateState } from \"@/lib/oauth.js\";\nimport { OAuth2Client } from \"oslo/oauth2\";\nimport { LocalStorageAdapter } from \"@/browser/storage.js\";\nimport type {\n  AuthenticationInitiator,\n  AuthenticationResolver,\n  PKCEConsumer,\n} from \"@/services/types.js\";\nimport { PopupError } from \"@/services/types.js\";\nimport { removeParamsWithoutReload } from \"@/lib/windowUtil.js\";\nimport { DEFAULT_OAUTH_GET_PARAMS } from \"@/constants.js\";\nimport { validateLoginAppPostMessage } from \"@/lib/postMessage.js\";\nimport { getUser } from \"@/shared/lib/session.js\";\nimport { GenericUserSession } from \"@/shared/lib/UserSession.js\";\n\nexport type GenericAuthenticationInitiatorConfig = {\n  clientId: string;\n  redirectUrl: string;\n  state: string;\n  scopes: string[];\n  oauthServer: string;\n  nonce?: string;\n  // the endpoints to use for the login (if not obtained from the auth server)\n  endpointOverrides?: Partial<Endpoints>;\n  // used to get the PKCE challenge\n  pkceConsumer: PKCEConsumer;\n};\n\nexport type BrowserAuthenticationInitiatorConfig = Omit<\n  GenericAuthenticationInitiatorConfig,\n  \"state\"\n> & {\n  logoutUrl?: string;\n  logoutRedirectUrl: string;\n  // determines whether to trigger the login/logout in an iframe, a new browser window, or redirect the current one.\n  displayMode: DisplayMode;\n};\n/**\n * An authentication initiator that works on a browser. Since this is just triggering\n * login and logout, session data is not stored here.\n * An associated AuthenticationResolver would be needed to get the session data.\n * Storage is needed for the code verifier, this is the domain of the PKCEConsumer\n * The storage used by the PKCEConsumer should be available to the AuthenticationResolver.\n *\n * Example usage:\n *\n * 1) Client-only SPA -eg a react app with no server:\n * new BrowserAuthenticationInitiator({\n *   pkceConsumer: new BrowserPublicClientPKCEProducer(), // generate and retrieve the challenge client-side\n *   ... other config\n * })\n *\n * 2) Client-side of a client/server app - eg a react app with a backend:\n * new BrowserAuthenticationInitiator({\n *  pkceConsumer: new ConfidentialClientPKCEConsumer(\"https://myserver.com/pkce\"), // get the challenge from the server\n *  ... other config\n * })\n */\nexport class BrowserAuthenticationInitiator implements AuthenticationInitiator {\n  private postMessageHandler: null | ((event: MessageEvent) => void) = null;\n\n  protected config: BrowserAuthenticationInitiatorConfig;\n\n  public setDisplayMode(displayMode: DisplayMode) {\n    this.config.displayMode = displayMode;\n  }\n\n  get displayMode() {\n    return this.config.displayMode;\n  }\n\n  get isServerTokenExchange() {\n    return this.config.pkceConsumer instanceof ConfidentialClientPKCEConsumer;\n  }\n  get state() {\n    return generateState(this.config.displayMode, this.isServerTokenExchange);\n  }\n  constructor(config: typeof this.config) {\n    this.config = config;\n  }\n\n  async handleLoginAppPopupFailed(redirectUrl: string) {\n    console.warn(\n      \"Login app popup failed open a popup, using redirect mode instead...\",\n      redirectUrl,\n    );\n    window.location.href = redirectUrl;\n  }\n\n  // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url\n  // and then use the display mode to decide how to send the user there\n  async signIn(iframeRef: HTMLIFrameElement | null): Promise<URL> {\n    const url = await generateOauthLoginUrl({\n      ...this.config,\n      state: this.state,\n    });\n\n    this.postMessageHandler = (event: MessageEvent) => {\n      const thisURL = new URL(window.location.href);\n      if (\n        event.origin.endsWith(\"civic.com\") ||\n        thisURL.hostname === \"localhost\"\n      ) {\n        if (!validateLoginAppPostMessage(event.data, this.config.clientId)) {\n          return;\n        }\n        const loginMessage = event.data as LoginPostMessage;\n        this.handleLoginAppPopupFailed(loginMessage.data.url);\n      }\n    };\n\n    window.addEventListener(\"message\", this.postMessageHandler);\n\n    if (this.config.displayMode === \"iframe\") {\n      if (!iframeRef)\n        throw new Error(\"iframeRef is required for displayMode 'iframe'\");\n      iframeRef.setAttribute(\"src\", url.toString());\n    }\n\n    if (this.config.displayMode === \"redirect\") {\n      window.location.href = url.toString();\n    }\n\n    if (this.config.displayMode === \"new_tab\") {\n      try {\n        const popupWindow = window.open(url.toString(), \"_blank\");\n        if (!popupWindow) {\n          throw new PopupError(\"Failed to open popup window\");\n        }\n      } catch (error) {\n        console.error(\"popupWindow\", error);\n        throw new PopupError(\n          \"window.open has thrown: Failed to open popup window\",\n        );\n      }\n    }\n\n    return url;\n  }\n\n  protected handleIframeUrlChange(\n    iframe: HTMLIFrameElement,\n    expectedUrl: string,\n  ): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const checkIframe = () => {\n        try {\n          // Try to access iframe URL - this will throw if cross-origin\n          const currentUrl = iframe.contentWindow?.location.href;\n          if (currentUrl?.includes(expectedUrl)) {\n            clearInterval(interval);\n            resolve();\n          }\n        } catch (e) {\n          // Ignore cross-origin errors\n          console.log(\"Cross-origin error\", e);\n        }\n      };\n\n      const interval = setInterval(checkIframe, 100);\n      // Timeout after 10 seconds\n      setTimeout(() => {\n        clearInterval(interval);\n        reject(new Error(\"Timeout waiting for iframe URL change\"));\n      }, 10000);\n    });\n  }\n\n  async signOut(\n    idToken: string | undefined,\n    iframeRef: HTMLIFrameElement | null,\n  ): Promise<URL> {\n    let url;\n    const state = this.state;\n    if (this.isServerTokenExchange) {\n      if (!this.config.logoutUrl) {\n        throw new Error(\"logoutUrl is required for server token exchange\");\n      }\n      url = new URL(this.config.logoutUrl, window.location.origin);\n      url.searchParams.append(\"state\", state);\n    } else {\n      if (!idToken) {\n        throw new Error(\"idToken is required for non-server token exchange\");\n      }\n      url = await generateOauthLogoutUrl({\n        ...this.config,\n        idToken,\n        state,\n        redirectUrl: this.config.logoutRedirectUrl,\n      });\n    }\n\n    if (this.config.displayMode === \"iframe\") {\n      if (!iframeRef) {\n        throw new Error(\"iframeRef is required for displayMode 'iframe'\");\n      }\n      iframeRef.setAttribute(\"src\", url.toString());\n\n      try {\n        await this.handleIframeUrlChange(\n          iframeRef,\n          this.config.logoutRedirectUrl,\n        );\n\n        // Clear storage after successful detection\n        if (!this.isServerTokenExchange) {\n          const localStorage = new LocalStorageAdapter();\n          await clearTokens(localStorage);\n          await clearUser(localStorage);\n          LocalStorageAdapter.emitter.emit(\"signOut\");\n        }\n      } catch (error) {\n        console.error(\"Failed to detect logout URL in iframe:\", error);\n      }\n    }\n\n    if (this.config.displayMode === \"redirect\") {\n      const localStorage = new LocalStorageAdapter();\n      localStorage.set(\"logout_state\", state);\n      window.location.href = url.toString();\n    }\n\n    if (this.config.displayMode === \"new_tab\") {\n      try {\n        const popupWindow = window.open(url.toString(), \"_blank\");\n        if (!popupWindow) {\n          throw new PopupError(\"Failed to open popup window\");\n        }\n      } catch (error) {\n        console.error(\"popupWindow\", error);\n        throw new PopupError(\n          \"window.open has thrown: Failed to open popup window\",\n        );\n      }\n    }\n\n    return url;\n  }\n\n  cleanup() {\n    if (this.postMessageHandler) {\n      window.removeEventListener(\"message\", this.postMessageHandler);\n    }\n  }\n}\n\n/** A general-purpose authentication initiator, that just generates urls, but lets\n * the caller decide how to use them. This is useful for server-side applications\n * that may serve this URL to their front-ends or just call them directly\n */\nexport class GenericAuthenticationInitiator implements AuthenticationInitiator {\n  protected config: GenericAuthenticationInitiatorConfig;\n\n  constructor(config: typeof this.config) {\n    this.config = config;\n  }\n\n  // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url\n  // and simply return the url\n  async signIn(): Promise<URL> {\n    return generateOauthLoginUrl(this.config);\n  }\n\n  async signOut(idToken: string): Promise<URL> {\n    return generateOauthLogoutUrl({\n      ...this.config,\n      idToken,\n    });\n  }\n}\n\ntype BrowserAuthenticationConfig = {\n  clientId: string;\n  redirectUrl: string;\n  logoutUrl?: string;\n  logoutRedirectUrl: string;\n  scopes: string[];\n  oauthServer: string;\n  endpointOverrides?: Partial<Endpoints>;\n  displayMode: DisplayMode;\n};\n\n/**\n * An authentication resolver that can run on the browser (i.e. a public client)\n * It uses PKCE for security. PKCE and Session data are stored in local storage\n */\nexport class BrowserAuthenticationService extends BrowserAuthenticationInitiator {\n  private oauth2client: OAuth2Client | undefined;\n  private endpoints: Endpoints | undefined;\n\n  // TODO WIP - perhaps we want to keep resolver and initiator separate here\n  constructor(\n    config: BrowserAuthenticationConfig,\n    // Since we are running fully on the client, we produce as well as consume the PKCE challenge\n    protected pkceProducer = new BrowserPublicClientPKCEProducer(),\n  ) {\n    super({\n      ...config,\n      // Store and retrieve the PKCE challenge in local storage\n      pkceConsumer: pkceProducer,\n    });\n  }\n\n  // TODO too much code duplication here between the browser and the server variant.\n  // Suggestion for refactor: Standardise the config for AuthenticationResolvers and create a one-shot\n  // function for generating an oauth2client from it\n  async init(): Promise<this> {\n    // resolve oauth config\n    this.endpoints = await getEndpointsWithOverrides(\n      this.config.oauthServer,\n      this.config.endpointOverrides,\n    );\n    this.oauth2client = new OAuth2Client(\n      this.config.clientId,\n      this.endpoints.auth,\n      this.endpoints.token,\n      {\n        redirectURI: this.config.redirectUrl,\n      },\n    );\n\n    return this;\n  }\n\n  // Two responsibilities:\n  // 1. resolve the auth code to get the tokens (should use library code)\n  // 2. store the tokens in local storage\n  async tokenExchange(\n    code: string,\n    state: string,\n  ): Promise<OIDCTokenResponseBody> {\n    if (!this.oauth2client) await this.init();\n    const codeVerifier = await this.pkceProducer.getCodeVerifier();\n    if (!codeVerifier) throw new Error(\"Code verifier not found in storage\");\n\n    // exchange auth code for tokens\n    const tokens = await exchangeTokens(\n      code,\n      state,\n      this.pkceProducer,\n      this.oauth2client!, // clean up types here to avoid the ! operator\n      this.config.oauthServer,\n      this.endpoints!, // clean up types here to avoid the ! operator\n    );\n    const clientStorage = new LocalStorageAdapter();\n    await storeTokens(clientStorage, tokens);\n    const user = await getUser(clientStorage);\n    if (!user) {\n      throw new Error(\"Failed to get user info\");\n    }\n    const userSession = new GenericUserSession(clientStorage);\n    await userSession.set(user);\n    LocalStorageAdapter.emitter.emit(\"signIn\");\n    // cleanup the browser window if needed\n    const parsedDisplayMode = displayModeFromState(\n      state,\n      this.config.displayMode,\n    );\n\n    if (parsedDisplayMode === \"new_tab\") {\n      // Close the popup window\n      window.addEventListener(\"beforeunload\", () => {\n        window?.opener?.focus();\n      });\n      window.close();\n    }\n    // these are the default oAuth params that get added to the URL in redirect which we want to remove if present\n    removeParamsWithoutReload(DEFAULT_OAUTH_GET_PARAMS);\n    return tokens;\n  }\n\n  // Get the session data from local storage\n  async getSessionData(): Promise<SessionData | null> {\n    const storageData = await retrieveTokens(new LocalStorageAdapter());\n\n    if (!storageData) return null;\n\n    return {\n      authenticated: !!storageData.id_token,\n      idToken: storageData.id_token,\n      accessToken: storageData.access_token,\n      refreshToken: storageData.refresh_token,\n    };\n  }\n\n  async validateExistingSession(): Promise<SessionData> {\n    try {\n      const sessionData = await this.getSessionData();\n      if (!sessionData?.idToken || !sessionData.accessToken) {\n        const unAuthenticatedSession = { ...sessionData, authenticated: false };\n        // await clearTokens(new LocalStorageAdapter());\n        return unAuthenticatedSession;\n      }\n      if (!this.endpoints || !this.oauth2client) await this.init();\n\n      // this function will throw if any of the tokens are invalid\n      await validateOauth2Tokens(\n        {\n          access_token: sessionData.accessToken,\n          id_token: sessionData.idToken,\n          refresh_token: sessionData.refreshToken,\n        },\n        this.endpoints!,\n        this.oauth2client!,\n        this.config.oauthServer,\n      );\n      return sessionData;\n    } catch (error) {\n      console.warn(\"Failed to validate existing tokens\", error);\n      const unAuthenticatedSession = {\n        authenticated: false,\n      };\n      await clearTokens(new LocalStorageAdapter());\n      return unAuthenticatedSession;\n    }\n  }\n\n  async getEndSessionEndpoint(): Promise<string | null> {\n    if (!this.endpoints) {\n      return null;\n    }\n    return this.endpoints?.endsession;\n  }\n\n  static async build(\n    config: BrowserAuthenticationConfig,\n  ): Promise<AuthenticationResolver> {\n    const resolver = new BrowserAuthenticationService(config);\n    await resolver.init();\n\n    return resolver;\n  }\n}\n"]}

package/dist/src/services/PKCE.d.ts

@@ -1,20 +0,0 @@
-import type { PKCEConsumer, PKCEProducer } from "@/services/types.js";
-import type { AuthStorage } from "@/types.js";
-/** A PKCE consumer that retrieves the challenge from a server endpoint */
-export declare class ConfidentialClientPKCEConsumer implements PKCEConsumer {
-    private pkceChallengeEndpoint;
-    constructor(pkceChallengeEndpoint: string);
-    getCodeChallenge(): Promise<string>;
-}
-/** A PKCE Producer that can generate and store a code verifier, but is agnostic as to the storage location */
-export declare class GenericPublicClientPKCEProducer implements PKCEProducer {
-    private storage;
-    constructor(storage: AuthStorage);
-    getCodeChallenge(): Promise<string>;
-    getCodeVerifier(): Promise<string | null>;
-}
-/** A PKCE Producer that is expected to run on a browser, and does not need a backend */
-export declare class BrowserPublicClientPKCEProducer extends GenericPublicClientPKCEProducer {
-    constructor();
-}
-//# sourceMappingURL=PKCE.d.ts.map

package/dist/src/services/PKCE.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PKCE.d.ts","sourceRoot":"","sources":["../../../src/services/PKCE.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,0EAA0E;AAC1E,qBAAa,8BAA+B,YAAW,YAAY;IACrD,OAAO,CAAC,qBAAqB;gBAArB,qBAAqB,EAAE,MAAM;IAC3C,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAO1C;AAED,8GAA8G;AAC9G,qBAAa,+BAAgC,YAAW,YAAY;IACtD,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,WAAW;IAIlC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IASnC,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGhD;AAED,wFAAwF;AACxF,qBAAa,+BAAgC,SAAQ,+BAA+B;;CAInF"}

package/dist/src/services/PKCE.js

@@ -1,44 +0,0 @@
-import { deriveCodeChallenge } from "@/shared/lib/util.js";
-import { generateCodeVerifier } from "oslo/oauth2";
-import { LocalStorageAdapter } from "@/browser/storage.js";
-import { CodeVerifier } from "@/shared/lib/types.js";
-/** A PKCE consumer that retrieves the challenge from a server endpoint */
-export class ConfidentialClientPKCEConsumer {
-    pkceChallengeEndpoint;
-    constructor(pkceChallengeEndpoint) {
-        this.pkceChallengeEndpoint = pkceChallengeEndpoint;
-    }
-    async getCodeChallenge() {
-        const response = await fetch(`${this.pkceChallengeEndpoint}?appUrl=${window.location.origin}`);
-        const data = (await response.json());
-        return data.challenge;
-    }
-}
-/** A PKCE Producer that can generate and store a code verifier, but is agnostic as to the storage location */
-export class GenericPublicClientPKCEProducer {
-    storage;
-    constructor(storage) {
-        this.storage = storage;
-    }
-    // if there is already a verifier, return it,
-    // If not, create a new one and store it
-    async getCodeChallenge() {
-        // let verifier = await this.getCodeVerifier();
-        // if (!verifier) {
-        const verifier = generateCodeVerifier();
-        this.storage.set(CodeVerifier.COOKIE_NAME, verifier);
-        // }
-        return deriveCodeChallenge(verifier);
-    }
-    // if there is already a verifier, return it,
-    async getCodeVerifier() {
-        return this.storage.get(CodeVerifier.COOKIE_NAME);
-    }
-}
-/** A PKCE Producer that is expected to run on a browser, and does not need a backend */
-export class BrowserPublicClientPKCEProducer extends GenericPublicClientPKCEProducer {
-    constructor() {
-        super(new LocalStorageAdapter());
-    }
-}
-//# sourceMappingURL=PKCE.js.map

package/dist/src/services/PKCE.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PKCE.js","sourceRoot":"","sources":["../../../src/services/PKCE.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,0EAA0E;AAC1E,MAAM,OAAO,8BAA8B;IACrB;IAApB,YAAoB,qBAA6B;QAA7B,0BAAqB,GAArB,qBAAqB,CAAQ;IAAG,CAAC;IACrD,KAAK,CAAC,gBAAgB;QACpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,IAAI,CAAC,qBAAqB,WAAW,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC9D,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF;AAED,8GAA8G;AAC9G,MAAM,OAAO,+BAA+B;IACtB;IAApB,YAAoB,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;IAAG,CAAC;IAE5C,6CAA6C;IAC7C,wCAAwC;IACxC,KAAK,CAAC,gBAAgB;QACpB,+CAA+C;QAC/C,mBAAmB;QACnB,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI;QACJ,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,6CAA6C;IAC7C,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;CACF;AAED,wFAAwF;AACxF,MAAM,OAAO,+BAAgC,SAAQ,+BAA+B;IAClF;QACE,KAAK,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;IACnC,CAAC;CACF","sourcesContent":["import { deriveCodeChallenge } from \"@/shared/lib/util.js\";\nimport { generateCodeVerifier } from \"oslo/oauth2\";\nimport { LocalStorageAdapter } from \"@/browser/storage.js\";\nimport type { PKCEConsumer, PKCEProducer } from \"@/services/types.js\";\nimport type { AuthStorage } from \"@/types.js\";\nimport { CodeVerifier } from \"@/shared/lib/types.js\";\n\n/** A PKCE consumer that retrieves the challenge from a server endpoint */\nexport class ConfidentialClientPKCEConsumer implements PKCEConsumer {\n  constructor(private pkceChallengeEndpoint: string) {}\n  async getCodeChallenge(): Promise<string> {\n    const response = await fetch(\n      `${this.pkceChallengeEndpoint}?appUrl=${window.location.origin}`,\n    );\n    const data = (await response.json()) as { challenge: string };\n    return data.challenge;\n  }\n}\n\n/** A PKCE Producer that can generate and store a code verifier, but is agnostic as to the storage location */\nexport class GenericPublicClientPKCEProducer implements PKCEProducer {\n  constructor(private storage: AuthStorage) {}\n\n  // if there is already a verifier, return it,\n  // If not, create a new one and store it\n  async getCodeChallenge(): Promise<string> {\n    // let verifier = await this.getCodeVerifier();\n    // if (!verifier) {\n    const verifier = generateCodeVerifier();\n    this.storage.set(CodeVerifier.COOKIE_NAME, verifier);\n    // }\n    return deriveCodeChallenge(verifier);\n  }\n  // if there is already a verifier, return it,\n  async getCodeVerifier(): Promise<string | null> {\n    return this.storage.get(CodeVerifier.COOKIE_NAME);\n  }\n}\n\n/** A PKCE Producer that is expected to run on a browser, and does not need a backend */\nexport class BrowserPublicClientPKCEProducer extends GenericPublicClientPKCEProducer {\n  constructor() {\n    super(new LocalStorageAdapter());\n  }\n}\n"]}

package/dist/src/services/types.d.ts

@@ -1,24 +0,0 @@
-import type { OIDCTokenResponseBody, SessionData } from "@/types.js";
-export interface PKCEConsumer {
-    getCodeChallenge(): Promise<string>;
-}
-export interface PKCEProducer extends PKCEConsumer {
-    getCodeVerifier(): Promise<string | null>;
-}
-export interface AuthenticationInitiator {
-    signIn(iframeRef: HTMLIFrameElement | null): Promise<URL>;
-    signOut(idToken: string, iframeRef: HTMLIFrameElement | null): Promise<URL>;
-}
-export interface AuthenticationResolver {
-    tokenExchange(code: string, state: string): Promise<OIDCTokenResponseBody>;
-    getSessionData(): Promise<SessionData | null>;
-    getEndSessionEndpoint(): Promise<string | null>;
-    validateExistingSession(): Promise<SessionData>;
-}
-export interface AuthenticationRefresher {
-    refreshTokens: () => Promise<OIDCTokenResponseBody>;
-}
-export declare class PopupError extends Error {
-    constructor(message: string);
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/src/services/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,MAAM,WAAW,YAAY;IAE3B,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACrC;AAGD,MAAM,WAAW,YAAa,SAAQ,YAAY;IAEhD,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3C;AAGD,MAAM,WAAW,uBAAuB;IAEtC,MAAM,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAG1D,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAC7E;AAGD,MAAM,WAAW,sBAAsB;IAKrC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAG3E,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE9C,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEhD,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrD;AAED,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B"}

package/dist/src/services/types.js

@@ -1,7 +0,0 @@
-export class PopupError extends Error {
-    constructor(message) {
-        super(message);
-        Object.setPrototypeOf(this, PopupError.prototype);
-    }
-}
-//# sourceMappingURL=types.js.map

package/dist/src/services/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/types.ts"],"names":[],"mappings":"AAiDA,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF","sourcesContent":["import type { OIDCTokenResponseBody, SessionData } from \"@/types.js\";\n\n// A PKCEConsumer can get a code challenge to use in the login process\n// A PKCEProducer can also generate and store verifiers. The producer must also be a consumer in order to get the challenge from an existing flow\n// Examples:\n// - Client-only SPA: The SPA generates the code challenge and verifier, stores the verifier in state and returns the code challenge\n// Note - The SPA should use PKCEProducer instead to do both\n// - Client-side of a client/server app: The client calls the backend to get the challenge.\n// - Server-side: The server should generate a new stored verifier and derive the challenge from it.\nexport interface PKCEConsumer {\n  // Retrieve a new PKCE challenge\n  getCodeChallenge(): Promise<string>;\n}\n\n// All producers are consumers, because the producer can get its own challenge\nexport interface PKCEProducer extends PKCEConsumer {\n  // Retrieve the PKCE challenge from the session if one exists\n  getCodeVerifier(): Promise<string | null>;\n}\n\n// A service that can initiate requests to login or log out\nexport interface AuthenticationInitiator {\n  // trigger a new login\n  signIn(iframeRef: HTMLIFrameElement | null): Promise<URL>;\n\n  // trigger a new logout\n  signOut(idToken: string, iframeRef: HTMLIFrameElement | null): Promise<URL>;\n}\n\n// A service that can resolve an authentication request according to the OAuth Auth Code grant types\nexport interface AuthenticationResolver {\n  // Given an auth code, get the tokens from the auth server and store them. works in PKCE and non-PKCE environments\n  // Note, if we choose later to implement other grants, this method would move into a subinterface specifically\n  // for the authorization code grant type.\n  // The return type is just for convenience and can be ignored, as the same data would be provided by getSessionData\n  tokenExchange(code: string, state: string): Promise<OIDCTokenResponseBody>;\n\n  // If the tokens have already been retrieved, return them\n  getSessionData(): Promise<SessionData | null>;\n\n  getEndSessionEndpoint(): Promise<string | null>;\n  // If an existing session is found, validate it and return the session data\n  validateExistingSession(): Promise<SessionData>;\n}\n\nexport interface AuthenticationRefresher {\n  refreshTokens: () => Promise<OIDCTokenResponseBody>;\n}\n\nexport class PopupError extends Error {\n  constructor(message: string) {\n    super(message);\n    Object.setPrototypeOf(this, PopupError.prototype);\n  }\n}\n"]}

package/dist/src/shared/components/BlockDisplay.d.ts

@@ -1,7 +0,0 @@
-import type { ReactNode } from "react";
-import React from "react";
-declare const BlockDisplay: ({ children }: {
-    children: ReactNode;
-}) => React.JSX.Element;
-export { BlockDisplay };
-//# sourceMappingURL=BlockDisplay.d.ts.map

package/dist/src/shared/components/BlockDisplay.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"BlockDisplay.d.ts","sourceRoot":"","sources":["../../../../src/shared/components/BlockDisplay.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,QAAA,MAAM,YAAY,iBAAkB;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,sBAgC1D,CAAC;AACF,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/src/shared/components/BlockDisplay.js

@@ -1,25 +0,0 @@
-import React from "react";
-const BlockDisplay = ({ children }) => {
-    return (React.createElement("div", { id: "iframe-block-display-wrapper", style: {
-            position: "relative",
-            left: 0,
-            top: 0,
-            zIndex: 50,
-            display: "flex",
-            height: "100vh",
-            width: "100vw",
-            alignItems: "center",
-            justifyContent: "center",
-            backgroundColor: "white",
-        } },
-        React.createElement("div", { id: "iframe-block-display", style: {
-                position: "absolute",
-                inset: 0,
-                display: "flex",
-                alignItems: "center",
-                justifyContent: "center",
-                backgroundColor: "white",
-            } }, children)));
-};
-export { BlockDisplay };
-//# sourceMappingURL=BlockDisplay.js.map

package/dist/src/shared/components/BlockDisplay.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"BlockDisplay.js","sourceRoot":"","sources":["../../../../src/shared/components/BlockDisplay.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,YAAY,GAAG,CAAC,EAAE,QAAQ,EAA2B,EAAE,EAAE;IAC7D,OAAO,CACL,6BACE,EAAE,EAAC,8BAA8B,EACjC,KAAK,EAAE;YACL,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,CAAC;YACP,GAAG,EAAE,CAAC;YACN,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,OAAO;YACd,UAAU,EAAE,QAAQ;YACpB,cAAc,EAAE,QAAQ;YACxB,eAAe,EAAE,OAAO;SACzB;QAED,6BACE,EAAE,EAAC,sBAAsB,EACzB,KAAK,EAAE;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,QAAQ;gBACpB,cAAc,EAAE,QAAQ;gBACxB,eAAe,EAAE,OAAO;aACzB,IAEA,QAAQ,CACL,CACF,CACP,CAAC;AACJ,CAAC,CAAC;AACF,OAAO,EAAE,YAAY,EAAE,CAAC","sourcesContent":["import type { ReactNode } from \"react\";\nimport React from \"react\";\n\nconst BlockDisplay = ({ children }: { children: ReactNode }) => {\n  return (\n    <div\n      id=\"iframe-block-display-wrapper\"\n      style={{\n        position: \"relative\",\n        left: 0,\n        top: 0,\n        zIndex: 50,\n        display: \"flex\",\n        height: \"100vh\",\n        width: \"100vw\",\n        alignItems: \"center\",\n        justifyContent: \"center\",\n        backgroundColor: \"white\",\n      }}\n    >\n      <div\n        id=\"iframe-block-display\"\n        style={{\n          position: \"absolute\",\n          inset: 0,\n          display: \"flex\",\n          alignItems: \"center\",\n          justifyContent: \"center\",\n          backgroundColor: \"white\",\n        }}\n      >\n        {children}\n      </div>\n    </div>\n  );\n};\nexport { BlockDisplay };\n"]}

package/dist/src/shared/components/CivicAuthIframe.d.ts

@@ -1,9 +0,0 @@
-import React from "react";
-type CivicAuthIframeProps = {
-    onLoad?: () => void;
-    id: string;
-};
-declare const CivicAuthIframe: React.ForwardRefExoticComponent<CivicAuthIframeProps & React.RefAttributes<HTMLIFrameElement>>;
-export type { CivicAuthIframeProps };
-export { CivicAuthIframe };
-//# sourceMappingURL=CivicAuthIframe.d.ts.map

package/dist/src/shared/components/CivicAuthIframe.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CivicAuthIframe.d.ts","sourceRoot":"","sources":["../../../../src/shared/components/CivicAuthIframe.tsx"],"names":[],"mappings":"AACA,OAAO,KAAqB,MAAM,OAAO,CAAC;AAE1C,KAAK,oBAAoB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,QAAA,MAAM,eAAe,gGAWpB,CAAC;AAIF,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAErC,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/src/shared/components/CivicAuthIframe.js

@@ -1,8 +0,0 @@
-"use client";
-import React, { forwardRef } from "react";
-const CivicAuthIframe = forwardRef(({ onLoad, id }, ref) => {
-    return (React.createElement("iframe", { id: id, ref: ref, style: { height: "28rem", width: "100%", border: "none" }, onLoad: onLoad }));
-});
-CivicAuthIframe.displayName = "CivicAuthIframe";
-export { CivicAuthIframe };
-//# sourceMappingURL=CivicAuthIframe.js.map

package/dist/src/shared/components/CivicAuthIframe.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"CivicAuthIframe.js","sourceRoot":"","sources":["../../../../src/shared/components/CivicAuthIframe.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;AACb,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAO1C,MAAM,eAAe,GAAG,UAAU,CAChC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;IACtB,OAAO,CACL,gCACE,EAAE,EAAE,EAAE,EACN,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EACzD,MAAM,EAAE,MAAM,GACd,CACH,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,eAAe,CAAC,WAAW,GAAG,iBAAiB,CAAC;AAIhD,OAAO,EAAE,eAAe,EAAE,CAAC","sourcesContent":["\"use client\";\nimport React, { forwardRef } from \"react\";\n\ntype CivicAuthIframeProps = {\n  onLoad?: () => void;\n  id: string;\n};\n\nconst CivicAuthIframe = forwardRef<HTMLIFrameElement, CivicAuthIframeProps>(\n  ({ onLoad, id }, ref) => {\n    return (\n      <iframe\n        id={id}\n        ref={ref}\n        style={{ height: \"28rem\", width: \"100%\", border: \"none\" }}\n        onLoad={onLoad}\n      />\n    );\n  },\n);\n\nCivicAuthIframe.displayName = \"CivicAuthIframe\";\n\nexport type { CivicAuthIframeProps };\n\nexport { CivicAuthIframe };\n"]}

package/dist/src/shared/components/CivicAuthIframeContainer.d.ts

@@ -1,13 +0,0 @@
-import React from "react";
-type CivicAuthIframeContainerProps = {
-    onClose?: () => void;
-    closeOnRedirect?: boolean;
-};
-export declare function IframeChrome({ children, onClose, }: {
-    children: React.ReactNode;
-    onClose?: () => void;
-}): React.JSX.Element;
-declare const CivicAuthIframeContainer: ({ onClose, closeOnRedirect, }: CivicAuthIframeContainerProps) => React.JSX.Element;
-export type { CivicAuthIframeContainerProps };
-export { CivicAuthIframeContainer };
-//# sourceMappingURL=CivicAuthIframeContainer.d.ts.map

package/dist/src/shared/components/CivicAuthIframeContainer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CivicAuthIframeContainer.d.ts","sourceRoot":"","sources":["../../../../src/shared/components/CivicAuthIframeContainer.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAmD,MAAM,OAAO,CAAC;AAUxE,KAAK,6BAA6B,GAAG;IACnC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAWF,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,OAAO,GACR,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB,qBAsDA;AAED,QAAA,MAAM,wBAAwB,kCAG3B,6BAA6B,sBAiH/B,CAAC;AAEF,YAAY,EAAE,6BAA6B,EAAE,CAAC;AAE9C,OAAO,EAAE,wBAAwB,EAAE,CAAC"}