@descope/web-js-sdk 1.51.1 → 1.51.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -3
- package/dist/cjs/index.cjs.js +1 -1
- package/dist/cjs/index.cjs.js.map +1 -1
- package/dist/index.esm.js +1 -1
- package/dist/index.esm.js.map +1 -1
- package/dist/index.umd.js +2 -2
- package/dist/index.umd.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -222,7 +222,7 @@ This is useful when Descope's session inactivity feature is enabled, ensuring re
|
|
|
222
222
|
|
|
223
223
|
### Custom Storage
|
|
224
224
|
|
|
225
|
-
By default the SDK reads and writes to `window.localStorage` for state that needs to outlive a single page load (last-authenticated user,
|
|
225
|
+
By default the SDK reads and writes to `window.localStorage` for state that needs to outlive a single page load (last-authenticated user, tokens when they aren't stored in cookies, etc.). If `localStorage` is unavailable or you want to back these keys with something else — `sessionStorage`, an in-memory store, an encrypted wrapper, a cross-frame bridge — pass a `customStorage` object to the SDK.
|
|
226
226
|
|
|
227
227
|
```js
|
|
228
228
|
const inMemoryStorage = (() => {
|
|
@@ -254,11 +254,13 @@ type CustomStorage = {
|
|
|
254
254
|
};
|
|
255
255
|
```
|
|
256
256
|
|
|
257
|
-
> **Note:**
|
|
257
|
+
> **Note:** `customStorage` backs the keys the SDK persists on your behalf (tokens, last-authenticated user). Make sure your implementation round-trips these keys cleanly — `getItem(key)` should return the same string that was last passed to `setItem(key, value)`. If your storage drops, filters, or namespaces keys so that they don't survive a round-trip, the features that rely on them may degrade.
|
|
258
|
+
>
|
|
259
|
+
> The internal, non-PII markers for the client-side session-refresh optimization (`DSLI` / `DSLI_DISABLED`) are the exception: the SDK always keeps them in real `window.localStorage`, independent of `customStorage`. This is what makes the optimization behave correctly even when you back the other keys with `sessionStorage` or an in-memory store.
|
|
258
260
|
|
|
259
261
|
### Last Login Indicator
|
|
260
262
|
|
|
261
|
-
The SDK maintains a `DSLI` (Descope Session Login Indicator) entry in `localStorage` that tracks whether this browser has previously had an active authenticated session. On every successful authentication, `DSLI` is written. On logout or an invalid-session response, it is cleared.
|
|
263
|
+
The SDK maintains a `DSLI` (Descope Session Login Indicator) entry in real `window.localStorage` — always, even when a `customStorage` is provided — that tracks whether this browser has previously had an active authenticated session. On every successful authentication, `DSLI` is written. On logout or an invalid-session response, it is cleared.
|
|
262
264
|
|
|
263
265
|
When `sdk.refresh()` is called in "try-refresh" mode (i.e. on SDK initialization, to restore a prior session), the SDK skips the network call entirely if neither `DSLI` nor the last-user key (`dls_last_user_login_id`) is present. This eliminates a redundant `/v1/auth/try-refresh` round-trip for anonymous visitors who have never logged in.
|
|
264
266
|
|
package/dist/cjs/index.cjs.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("tslib"),t=require("jwt-decode"),n=require("@descope/core-js-sdk"),o=require("js-cookie"),i=require("@fingerprintjs/fingerprintjs-pro");function r(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var s=r(n),a=r(o);const l="3.2.0",c="undefined"!=typeof window,u=Math.pow(2,31)-1,d=`https://descopecdn.com/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`,p=`https://cdn.jsdelivr.net/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`;const f=["/v1/auth/refresh","/v1/auth/try-refresh","/v1/auth/me","/v1/auth/me/tenants","/v1/auth/me/history"];let g;const v=e=>{try{return t.jwtDecode(e).exp}catch(e){return null}},h=e=>{const{refresh_expire_in:t,refresh_token:n}=e;return t?Math.floor(Date.now()/1e3)+t:v(n)},w=e=>{const{expires_in:t,expires_at:n,access_token:o}=e;return n||(t?Math.floor(Date.now()/1e3)+t:o?v(o):void 0)},m=t=>{const{access_token:n,id_token:o,refresh_token:i,refresh_expire_in:r}=t,s=e.__rest(t,["access_token","id_token","refresh_token","refresh_expire_in"]);return Object.assign({sessionJwt:t.sessionJwt||n,idToken:o,refreshJwt:t.refreshJwt||i,sessionExpiration:t.sessionExpiration||w(t),cookieExpiration:t.cookieExpiration||h(t)},s)},y=(e,t)=>{var n;return["beforeRequest","afterRequest"].reduce(((n,o)=>{var i;return n[o]=[].concat((null===(i=e.hooks)||void 0===i?void 0:i[o])||[]).concat((null==t?void 0:t[o])||[]),n}),null!==(n=e.hooks)&&void 0!==n?n:e.hooks={}),e},b=async e=>{if(!(null==e?void 0:e.ok))return{};const t=await(null==e?void 0:e.clone().json()),n=(null==t?void 0:t.authInfo)||t||{};return m(n)},k=()=>c&&!!window.descopeBridge,S=(e,t)=>{if(!((null==t?void 0:t.status)>=400&&(null==t?void 0:t.status)<500))return!1;const n=(null==e?void 0:e.path)||"";return f.includes(n)},_=void 0!==g||c&&void 0!==window.localStorage,I=(e,t)=>{var n,o;return null===(o=null===(n=g||c&&window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o?void 0:o.call(n,e,t)},O=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e)},x=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n?void 0:n.call(t,e)},j=e=>{var t,n,o,i,r;return null!==(r=null!==(n=null===(t=null==g?void 0:g.key)||void 0===t?void 0:t.call(g,e))&&void 0!==n?n:c&&(null===(i=null===(o=window.localStorage)||void 0===o?void 0:o.key)||void 0===i?void 0:i.call(o,e)))&&void 0!==r?r:null},D=(...e)=>{console.debug(...e)},T=(...e)=>{console.warn(...e)},U=(e,t)=>{let n;var o;return t>0?(n=1e3*t,D(`Using provided nextRefreshSeconds: ${t}s`)):n=((o=e)?o.getTime()-(new Date).getTime():0)-2e4,n>u&&(D(`Timeout is too large (${n}ms), setting it to ${u}ms`),n=u),n},C="DS",A="DSR",E="DSI",R="DSRCN";function $(e,t,n){if(t){const{cookieDomain:o,cookiePath:i,cookieSameSite:r,cookieExpiration:s,cookieSecure:l}=n,c=new Date(1e3*s),u=N(o);a.default.set(e,t,{path:i,domain:u?o:void 0,expires:c,sameSite:r,secure:l})}}function N(e){const t=window.location.hostname.split("."),n=null==e?void 0:e.split(".");return t.slice(-(null==n?void 0:n.length)).join(".")===e}const P=e=>(null==e?void 0:e.cookieName)||C,J=e=>(null==e?void 0:e.cookieName)||A;function L(e="",t){return a.default.get(J(t))||O(`${e}${A}`)||""}function q(e="",t){return a.default.get(P(t))||O(`${e}${C}`)||""}function K(e=""){return O(`${e}${E}`)||""}function V(e="",t,n,o){x(`${e}${A}`),x(`${e}${C}`),x(`${e}${E}`),x(`${e}${R}`);const i=P(t);a.default.remove(i,null==o?void 0:o.session);const r=J(n);a.default.remove(r,null==o?void 0:o.refresh)}const F=(e,t,n)=>o=>{const i=Object.assign(o,{token:o.token||L(e,t)});if(!n){const t=function(e=""){return O(`${e}${R}`)}(e);t&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-refresh-cookie-name":t}))}const r=function(e=""){return O(`${e}DTD`)||""}(e);return r&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-trusted-device-token":r})),i},M=c&&(null===localStorage||void 0===localStorage?void 0:localStorage.getItem("fingerprint.endpoint.url"))||"https://api.descope.com",W="vsid",H="vrid",B="fp",z=(e=!1)=>{const t=O(B);if(!t)return null;const n=JSON.parse(t);return(new Date).getTime()>n.expiry&&!e?null:n.value},G=async(e,t=M)=>{try{if(z())return;const n=(Date.now().toString(36)+Math.random().toString(36).substring(2)+Math.random().toString(36).substring(2)).substring(0,27),o=new URL(t);o.pathname="/fXj8gt3x8VulJBna/x96Emn69oZwcd7I6";const r=new URL(t);r.pathname="/fXj8gt3x8VulJBna/w78aRZnnDZ3Aqw0I";const s=r.toString()+"?apiKey=<apiKey>&version=<version>&loaderVersion=<loaderVersion>",a=i.load({apiKey:e,endpoint:[o.toString(),i.defaultEndpoint],scriptUrlPattern:[s,i.defaultScriptUrlPattern]}),l=await a,{requestId:c}=await l.get({linkedId:n}),u=((e,t)=>({[W]:e,[H]:t}))(n,c);(e=>{const t={value:e,expiry:(new Date).getTime()+864e5};I(B,JSON.stringify(t))})(u)}catch(e){console.warn("Could not load fingerprint",e)}},X=e=>{const t=z(!0);return t&&e.body&&(e.body.fpData=t),e},Z="descopeFlowNonce",Y="X-Descope-Flow-Nonce",Q="/v1/flow/start",ee="/v1/flow/next",te=(e,t=Z)=>`${t}${e}`,ne=(e,t=Z)=>{try{const n=te(e,t);x(n)}catch(e){console.error("Error removing flow nonce:",e)}},oe=e=>{var t;return(null===(t=/.*\|#\|(.*)/.exec(e))||void 0===t?void 0:t[1])||null},ie=e=>{var t;return e.path===ee&&(null===(t=e.body)||void 0===t?void 0:t.executionId)?oe(e.body.executionId):null},re="dls_last_user_login_id",se="dls_last_user_display_name",ae=e=>I(re,e),le=()=>O(re),ce=()=>O(se),ue=e=>async(...t)=>{var n;t[1]=t[1]||{};const[,o={}]=t,i=le(),r=ce();i&&(null!==(n=o.lastAuth)&&void 0!==n||(o.lastAuth={}),o.lastAuth.loginId=i,o.lastAuth.name=r);return await e(...t)},de=e=>t=>async(...n)=>{const o=await t(...n);return e||(x(re),x(se)),o},pe="DSLI",fe=e=>async(...t)=>{const n=await e(...t);return x(pe),n};function ge(){const e=[];return{pub:t=>{e.forEach((e=>e(t)))},sub:t=>{const n=e.push(t)-1;return()=>e.splice(n,1)}}}const ve=(e,t,n,o)=>i=>async(...r)=>{const s=await i(...r);return V(e,t,n,null==o?void 0:o()),s};async function he(e){const t=function(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=_e(n.publicKey.challenge),n.publicKey.user.id=_e(n.publicKey.user.id),null===(t=n.publicKey.excludeCredentials)||void 0===t||t.forEach((e=>{e.id=_e(e.id)})),n}(e);try{const e=await navigator.credentials.create(t);return n=e,JSON.stringify({id:n.id,rawId:Ie(n.rawId),type:n.type,response:{attestationObject:Ie(n.response.attestationObject),clientDataJSON:Ie(n.response.clientDataJSON)}})}catch(e){throw await ye(e,t,!0)}var n}async function we(e){const t=ke(e);try{return Se(await navigator.credentials.get(t))}catch(e){throw await ye(e,t,!1)}}async function me(e,t){const n=ke(e);n.signal=t.signal,n.mediation="conditional";try{return Se(await navigator.credentials.get(n))}catch(e){throw await ye(e,n,!1)}}async function ye(e,t,n){if(e&&"object"==typeof e)try{e.reason=await async function(e,t,n){var o,i;const r=null==e?void 0:e.name;if("AbortError"===r&&(null==t?void 0:t.signal)instanceof AbortSignal)return"aborted";if("InvalidStateError"===r&&n)return"authenticator_already_registered";if("NotSupportedError"===r)return"no_supported_algorithm";if("ConstraintError"===r)return"authenticator_constraints_unsupported";if("SecurityError"===r){const e=window.location.hostname;return"localhost"===e||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)?"invalid_rpid":"invalid_domain"}if(!await be())return"webauthn_unsupported";const s="platform"===(null===(i=null===(o=null==t?void 0:t.publicKey)||void 0===o?void 0:o.authenticatorSelection)||void 0===i?void 0:i.authenticatorAttachment);return n&&s&&!await be(!0)?"platform_authenticator_unsupported":"NotAllowedError"===r?"not_allowed":"unknown"}(e,t,n)}catch(e){}return e}async function be(e=!1){var t,n;if(!c)return Promise.resolve(!1);if(k()){const e=null===(n=null===(t=window.descopeBridge)||void 0===t?void 0:t.hostInfo)||void 0===n?void 0:n.webauthn;if("boolean"==typeof e)return e}const o=!!(window.PublicKeyCredential&&navigator.credentials&&navigator.credentials.create&&navigator.credentials.get);return o&&e&&PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():o}function ke(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=_e(n.publicKey.challenge),null===(t=n.publicKey.allowCredentials)||void 0===t||t.forEach((e=>{e.id=_e(e.id)})),n}function Se(e){return JSON.stringify({id:e.id,rawId:Ie(e.rawId),type:e.type,response:{authenticatorData:Ie(e.response.authenticatorData),clientDataJSON:Ie(e.response.clientDataJSON),signature:Ie(e.response.signature),userHandle:e.response.userHandle?Ie(e.response.userHandle):void 0}})}function _e(e){const t=e.replace(/_/g,"/").replace(/-/g,"+");return Uint8Array.from(atob(t),(e=>e.charCodeAt(0))).buffer}function Ie(e){return btoa(String.fromCharCode.apply(null,new Uint8Array(e))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}var Oe,xe=(Oe=e=>({async signUp(t,n,o){const i=await e.webauthn.signUp.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await he(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,r)},async signIn(t,n){const o=await e.webauthn.signIn.start(t,window.location.origin,void 0,void 0,n);if(!o.ok)return o;const i=await we(o.data.options);return await e.webauthn.signIn.finish(o.data.transactionId,i)},async signUpOrIn(t,n){var o;const i=await e.webauthn.signUpOrIn.start(t,window.location.origin,n);if(!i.ok)return i;if(null===(o=i.data)||void 0===o?void 0:o.create){const t=await he(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,t)}{const t=await we(i.data.options);return await e.webauthn.signIn.finish(i.data.transactionId,t)}},async update(t,n,o){const i=await e.webauthn.update.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await he(i.data.options);return await e.webauthn.update.finish(i.data.transactionId,r)},helpers:{create:he,get:we,isSupported:be,conditional:me}}),(...e)=>{const t=Oe(...e);return Object.assign(t.signUp,e[0].webauthn.signUp),Object.assign(t.signIn,e[0].webauthn.signIn),Object.assign(t.signUpOrIn,e[0].webauthn.signUpOrIn),Object.assign(t.update,e[0].webauthn.update),t});const je={config:"/fedcm/config"},De=()=>{if(window.crypto&&window.crypto.getRandomValues){const e=new Uint8Array(16);return window.crypto.getRandomValues(e),Array.from(e,(e=>e.toString(16).padStart(2,"0"))).join("")}return Math.random().toString(36).substring(2)};async function Te(e,t){var n;try{await Ue(e,t)}catch(e){null===(n=null==t?void 0:t.onFailed)||void 0===n||n.call(t,e)}}async function Ue(e,t){var n,o;const i=await async function(e,t="google",n,o,i){const r=De(),s=await async function(){return new Promise(((e,t)=>{if(window.google)return void e(window.google.accounts.id);let n=document.getElementById("google-gsi-client-script");n||(n=document.createElement("script"),document.head.appendChild(n),n.async=!0,n.defer=!0,n.id="google-gsi-client-script",n.src="https://accounts.google.com/gsi/client"),n.onload=function(){window.google?e(window.google.accounts.id):t("Failed to load Google GSI client script - not loaded properly")},n.onerror=function(){t("Failed to load Google GSI client script - failed to load")}}))}(),a=await e.oauth.getOneTapClientId(t);if(!a.ok)throw new Error("Failed to get OneTap client ID for provider "+t);const l=a.data.clientId;return new Promise((e=>{var a,c;const u=n=>{e({provider:t,nonce:r,credential:null==n?void 0:n.credential})};s.initialize(Object.assign(Object.assign({},n),{itp_support:null===(a=null==n?void 0:n.itp_support)||void 0===a||a,use_fedcm_for_prompt:null===(c=null==n?void 0:n.use_fedcm_for_prompt)||void 0===c||c,client_id:l,callback:u,nonce:r})),s.prompt((e=>{var t,n;if(i&&(null==e?void 0:e.isDismissedMoment())){const n=null===(t=e.getDismissedReason)||void 0===t?void 0:t.call(e);return null==i||i(n),void u()}if(o&&(null==e?void 0:e.isSkippedMoment())){const t=null===(n=e.getSkippedReason)||void 0===n?void 0:n.call(e);return null==o||o(t),void u()}}))}))}(e,t.provider,t.oneTapConfig,t.onSkipped,t.onDismissed);if(!i.credential)return null;if(null==t?void 0:t.onCodeReceived){const o=await e.oauth.verifyOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!o.ok||!o.data)throw new Error("Failed to verify OneTap client ID for provider "+i.provider);null===(n=null==t?void 0:t.onCodeReceived)||void 0===n||n.call(t,o.data.code)}else{const n=await e.oauth.exchangeOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!n.ok||!n.data)throw new Error("Failed to exchange OneTap client ID for provider "+i.provider);null===(o=null==t?void 0:t.onAuthenticated)||void 0===o||o.call(t,n.data)}}var Ce=e=>Object.assign(Object.assign({},e.flow),{start:async(...t)=>{const n=await be(),o=Object.assign(Object.assign({location:window.location.href},t[1]),{deviceInfo:{webAuthnSupport:n},startOptionsVersion:1});return t[1]=o,e.flow.start(...t)}});const Ae=()=>window.location.search.includes("code")&&window.location.search.includes("state");let Ee;const Re=(e,t)=>new Promise(((n,o)=>{if(!e.length)return o(new Error("No URLs provided to loadScriptWithFallback"));const i=t();if(i)return n(i);const r=e.shift(),s=document.createElement("script");s.src=r,s.id=(e=>{let t=0;for(let n=0;n<e.length;n++)t=(t<<5)-t+e.charCodeAt(n),t|=0;return Math.abs(t).toString(16)})(r),s.onload=()=>{const e=t();if(e)return n(e);throw new Error("Could not get entry after loading script from URL")},s.addEventListener("error",(()=>{Re(e,t),s.setAttribute("data-error","true")})),document.body.appendChild(s)}));const $e=async(e,t,n)=>{Ee||(Ee=(async()=>{try{return require("oidc-client-ts")}catch(e){return Re([d,p],(()=>window.oidc))}})());const{OidcClient:o,WebStorageStateStore:i}=await Ee;if(!o)throw new Error("oidc-client-ts is not installed. Please install it by running `npm install oidc-client-ts`");const r=(null==n?void 0:n.redirectUri)||window.location.href;let s,a,l,c;if(null==n?void 0:n.issuer){if(!n.clientId)throw new Error("clientId is required when providing a custom issuer/authority");s=n.issuer,a=n.clientId,l=`${a}_user`,c="openid"}else(null==n?void 0:n.applicationId)?(s=e.httpClient.buildUrl(t),s=`${s}/${n.applicationId}`,a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access"):(s=e.httpClient.buildUrl(t),a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access");const u={authority:s,client_id:a,redirect_uri:r,response_type:"code",scope:(null==n?void 0:n.scope)||c,stateStore:new i({store:window.localStorage,prefix:a}),loadUserInfo:!0,fetchRequestCredentials:"same-origin"};return(null==n?void 0:n.redirectUri)&&(u.redirect_uri=n.redirectUri),{client:new o(u),stateUserKey:l}},Ne=(e,t,n)=>{const o=async()=>{let o,i;return o&&i||({client:o,stateUserKey:i}=await $e(e,t,n)),{client:o,stateUserKey:i}},i=async(t="")=>{var n;const{client:i,stateUserKey:r}=await o(),s=await i.processSigninResponse(t||window.location.href);var a;return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(s)))),I(r,JSON.stringify({id_token:(a=s).id_token,session_state:a.session_state,profile:a.profile})),(()=>{const e=new URL(window.location.href);e.searchParams.delete("code"),e.searchParams.delete("state"),window.history.replaceState({},document.title,e.toString())})(),s};return{loginWithRedirect:async(t={},n=!1)=>{var i;const{client:r}=await o(),s=await r.createSigninRequest(t),{url:a}=s;return n||(await(null===(i=e.httpClient.hooks)||void 0===i?void 0:i.afterRequest({},new Response(JSON.stringify(s)))),window.location.href=a),{ok:!0,data:s}},finishLogin:i,finishLoginIfNeed:async(e="")=>{if(Ae())return await i(e)},refreshToken:async t=>{var n;const{client:i,stateUserKey:r}=await o(),s=(e=>{const t=O(e);return t?JSON.parse(t):null})(r);if(!s)throw new Error("User not found in storage to refresh token");let a=t;if(!a){const t={};e.httpClient.hooks.beforeRequest(t),a=t.token}const l=await i.useRefreshToken({state:{refresh_token:a,session_state:s.session_state,profile:s.profile}});return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(l)))),l},logout:async(e,t=!1)=>{const{client:n,stateUserKey:i}=await o();e||(e={}),e.id_token_hint=e.id_token_hint||K(),e.post_logout_redirect_uri=e.post_logout_redirect_uri||window.location.href;const r=await n.createSignoutRequest(e),{url:s}=r;return x(i),t||window.location.replace(s),r}}},Pe=function(...e){return t=>e.reduce(((e,t)=>t(e)),t)}((e=>t=>{var n;return n=t.customStorage,g=n,e(t)}),(t=>n=>{var{fpKey:o,fpLoad:i}=n,r=e.__rest(n,["fpKey","fpLoad"]);return c?(o&&i&&G(o).catch((()=>null)),t(y(r,{beforeRequest:X}))):t(r)}),(e=>t=>e(Object.assign(Object.assign({},t),{baseHeaders:Object.assign({"x-descope-sdk-name":"web-js","x-descope-sdk-version":"1.51.1"},t.baseHeaders)}))),(e=>t=>{const o=ge(),i=ge(),r=ge(),s=ge(),a=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, notifying subscribers with empty values"),i.pub(null),r.pub(null),o.pub(null),s.pub(null);else{const e=await(async e=>{const t=await b(e);return(null==t?void 0:t.user)||((null==t?void 0:t.hasOwnProperty("userId"))?t:void 0)})(t);e&&r.pub(e);const{sessionJwt:n,sessionExpiration:a,claims:l}=await b(t);n&&i.pub(n),l&&s.pub(l),(a||n)&&o.pub(a||42)}}})),l=n.wrapWith(a,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return i.pub(null),r.pub(null),o.pub(null),s.pub(null),n}));return Object.assign(l,{onSessionTokenChange:i.sub,onUserChange:r.sub,onClaimsChange:s.sub,onIsAuthenticatedChange:e=>o.sub((t=>{e(!!t)}))})}),(t=>n=>{var o;const{enableFlowNonce:i=!0,nonceStoragePrefix:r=Z}=n,s=e.__rest(n,["enableFlowNonce","nonceStoragePrefix"]);if(!i)return t(s);((e=Z)=>{try{if(!_)return;for(let i=0;i<(t=void 0,n=void 0,o=void 0,null!==(o=null!==(t=null==g?void 0:g.length)&&void 0!==t?t:c&&(null===(n=window.localStorage)||void 0===n?void 0:n.length))&&void 0!==o?o:0);i++){const t=j(i);if(t&&t.startsWith(e)){const e=O(t);if(e)try{JSON.parse(e).expiry<Date.now()&&x(t)}catch(e){x(t)}}}}catch(e){console.error("Error cleaning up expired nonces:",e)}var t,n,o})(r);const a=t(y(s,{afterRequest:async(e,t)=>{if(e.path!==Q&&e.path!==ee)return;const{nonce:n,executionId:o}=await(async(e,t)=>{try{const n=t.headers.get(Y);let o=await t.clone().json().then((e=>(null==e?void 0:e.executionId)||null)).catch((()=>null));return o||(o=ie(e)),{nonce:n,executionId:oe(o)}}catch(e){return{nonce:null,executionId:null}}})(e,t);if(n&&o){((e,t,n,o=Z)=>{try{const i=te(e,o),r=n?172800:10800,s={value:t,expiry:Date.now()+1e3*r,isStart:n};I(i,JSON.stringify(s))}catch(e){console.error("Error setting flow nonce:",e)}})(o,n,e.path===Q,r)}},beforeRequest:e=>{if(e.path===ee){const t=ie(e);if(t){const n=((e,t=Z)=>{try{const n=te(e,t),o=O(n);if(!o)return null;const i=JSON.parse(o);return i.expiry<Date.now()?(ne(e,t),null):i.value}catch(e){return console.error("Error getting flow nonce:",e),null}})(t,r);n&&(e.headers=e.headers||{},e.headers[Y]=n)}}return e}}));if(null===(o=a.flow)||void 0===o?void 0:o.next){let e=Promise.resolve();const t=a.flow.next.bind(a.flow);a.flow.next=async(...n)=>{const o=e;let i;e=new Promise((e=>{i=e})),await o;try{return await t(...n)}finally{i()}}}return a}),(e=>t=>{const o=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))return void x(pe);const n=await b(t);(null==n?void 0:n.sessionExpiration)&&I(pe,String(n.sessionExpiration))}}));return n.wrapWith(o,["logout","logoutAll","oidc.logout"],fe)}),(o=>i=>{var{autoRefresh:r}=i,s=e.__rest(i,["autoRefresh"]);const a=!!r,l="object"==typeof r&&(null==r?void 0:r.customActivityTracking);if(!a||k())return Object.assign(o(s),{markUserActive:()=>{T("markUserActive() called but has no effect")}});const{clearAllTimers:u,setTimer:d}=(()=>{const e=[];return{clearAllTimers:()=>{for(;e.length;)clearTimeout(e.pop())},setTimer:(t,n)=>{e.push(setTimeout(t,n))}}})();let p,f,g=null,v=!1,h=!1;l&&(D("Activity-based refresh enabled"),g=(()=>{let e=!0;return{hadActivity:()=>e,reset:()=>{e=!1},markActive:()=>{e=!0}}})()),c&&document.addEventListener("visibilitychange",(()=>{"visible"===document.visibilityState&&p&&new Date>p&&(D("Expiration time passed, refreshing session"),w.refresh(L()||f))}));const w=o(y(s,{afterRequest:async(e,n)=>{const{sessionJwt:o,refreshJwt:i,sessionExpiration:r,nextRefreshSeconds:s}=await b(n);if(S(e,n))D("Session invalidated, canceling all timers"),u();else if(o||r){if(p=((e,n)=>{if(n)return new Date(1e3*n);D("Could not extract expiration time from session token, trying to decode the token");try{const n=t.jwtDecode(e);if(n.exp)return new Date(1e3*n.exp)}catch(e){return null}})(o,r),!p)return void D("Could not extract expiration time from session token");f=i,v=s>0;const e=U(p,s);if(u(),e<=2e4)return void D("Session is too close to expiration, not setting refresh timer");const n=new Date(Date.now()+e).toLocaleTimeString("en-US",{hour12:!1});D(`Setting refresh timer for ${n}. (${e}ms)`),g&&(g.reset(),h=!1),d((()=>{if(c&&"hidden"===document.visibilityState)D("Skipping refresh due to timer - document is hidden");else{if(g&&v&&!g.hadActivity())return D("Skipping refresh due to timer - user is idle"),void(h=!0);D("Refreshing session due to timer"),w.refresh(L()||i)}}),e)}}}));return Object.assign(n.wrapWith(w,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return D("Clearing all timers"),u(),n})),{markUserActive:g?()=>{D("markUserActive() called"),v||D("markUserActive() called but server does not have inactivity timeout configured (no nextRefreshSeconds)"),g.markActive(),h&&(D("User became active after skipped refresh, triggering refresh"),h=!1,u(),w.refresh(L()||f))}:()=>{T("markUserActive() called but customActivityTracking is not enabled — this call has no effect")}})}),(t=>o=>{var{storeLastAuthenticatedUser:i=!0,keepLastAuthenticatedUserAfterLogout:r=!1}=o,s=e.__rest(o,["storeLastAuthenticatedUser","keepLastAuthenticatedUserAfterLogout"]);if(!i)return Object.assign(t(s),{getLastUserLoginId:le,getLastUserDisplayName:ce});const a=t(y(s,{afterRequest:async(e,t)=>{var n;const{userInfo:o,lastAuth:i}=await(async e=>{if(!(null==e?void 0:e.ok))return{userInfo:void 0,lastAuth:void 0};const t=await(null==e?void 0:e.clone().json()),n=m((null==t?void 0:t.authInfo)||t||{});return{userInfo:(null==n?void 0:n.user)||((null==n?void 0:n.hasOwnProperty("userId"))?n:void 0),lastAuth:t.lastAuth}})(t),r=null===(n=null==o?void 0:o.loginIds)||void 0===n?void 0:n[0],s=null==o?void 0:o.name;r?(ae(r),(e=>{I(se,e)})(s)):(null==i?void 0:i.loginId)&&ae(i.loginId)}}));let l=n.wrapWith(a,["flow.start"],ue);return l=n.wrapWith(l,["logout","logoutAll"],de(r)),Object.assign(l,{getLastUserLoginId:le,getLastUserDisplayName:ce})}),(t=>o=>{var{persistTokens:i,sessionTokenViaCookie:r,refreshTokenViaCookie:s,storagePrefix:l,refreshCookieName:u}=o,d=e.__rest(o,["persistTokens","sessionTokenViaCookie","refreshTokenViaCookie","storagePrefix","refreshCookieName"]);if(!i||!c)return t(Object.assign({refreshCookieName:u},d));let p;const f=t(y(Object.assign({refreshCookieName:u},d),{beforeRequest:F(l,s,u),afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, clearing persisted tokens"),V(l,r,s,p);else{const e=await b(t);e.cookieName?I(`${l||""}${R}`,e.cookieName):e.refreshJwt&&x(`${l||""}${R}`);const n=((e={},t=!1,n="",o=!1)=>{var i,r,s,l;const{sessionJwt:c,refreshJwt:u,trustedDeviceJwt:d}=e;let p;if(u)if(o){x(`${n}${A}`);const t=o.sameSite||"Strict",s=null===(i=o.secure)||void 0===i||i,a=null!==(r=o.domain)&&void 0!==r?r:e.cookieDomain,l=J(o);s&&"https:"!==window.location.protocol&&T("Refresh token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass refreshTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const c=Object.assign(Object.assign({},e),{cookieSameSite:t,cookieSecure:s,cookieDomain:a});$(l,u,c);const d=N(a);p=Object.assign(Object.assign({},p),{refresh:{path:c.cookiePath,domain:d?a:void 0}})}else{const e=J(o);a.default.remove(e),I(`${n}${A}`,u)}if(c)if(t){const n=t.sameSite||"Strict",o=null===(s=t.secure)||void 0===s||s,i=null!==(l=t.domain)&&void 0!==l?l:e.cookieDomain,r=P(t);o&&"https:"!==window.location.protocol&&T("Session token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass sessionTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const a=Object.assign(Object.assign({},e),{cookieSameSite:n,cookieSecure:o,cookieDomain:i});$(r,c,a);const u=N(i);p=Object.assign(Object.assign({},p),{session:{path:a.cookiePath,domain:u?i:void 0}})}else I(`${n}${C}`,c);return e.idToken&&I(`${n}${E}`,e.idToken),d&&I(`${n}DTD`,d),p})(e,r,l,s);n&&(p=n)}}})),g=n.wrapWith(f,["logout","logoutAll","oidc.logout"],ve(l,r,s,(()=>p)));return Object.assign(g,{getRefreshToken:()=>L(l,s),getSessionToken:()=>q(l,r),getIdToken:()=>K(l)})}))((e=>{const t=s.default(e),n=Ne(t,e.projectId,e.oidcConfig);return Object.assign(Object.assign({},t),{refresh:async(o,i)=>{var r;if(k())return D(`Refresh called in native flow: ${(new Error).stack}`),Promise.resolve({ok:!1,error:{errorCode:"J171000",errorDescription:"Refresh is not supported in native flows via the web SDK"}});if(e.oidcConfig)try{return await n.refreshToken(o),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161001",errorDescription:e.toString()}})}if(i&&!O(pe)&&!O(re)&&!O("DSLI_DISABLED"))return Promise.resolve({ok:!0});const s=q(),a=L();let l="";if(e.getExternalToken)try{l=await(null===(r=e.getExternalToken)||void 0===r?void 0:r.call(e))}catch(e){D("Error getting external token while refreshing",e)}return t.refresh(o,{dcs:s?"t":"f",dcr:a?"t":"f"},l,i)},logout:async o=>{if(e.oidcConfig)try{return await n.logout({id_token_hint:o}),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161000",errorDescription:e.toString()}})}return t.logout(o)},flow:Ce(t),webauthn:xe(t),fedcm:(o=t,i=e.projectId,{onetap:{requestExchangeCode(e){Te(o,e)},requestAuthentication(e){Te(o,e)}},async oneTap(e,t,n,i,r){await Ue(o,{provider:e,oneTapConfig:t,loginOptions:n,onSkipped:i,onDismissed:r})},async launch(e){var t;const n={identity:{context:e||"signin",providers:[{configURL:o.httpClient.buildUrl(i+je.config),clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(n));return o.refresh(r.token)},isSupported:()=>c&&"IdentityCredential"in window,async isLoggedIn(e){var t;const n=o.httpClient.buildUrl(i+je.config);try{const o={identity:{context:e||"signin",providers:[{configURL:n,clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(o));return!!r&&!!r.token}catch(e){return!1}}}),oidc:n});var o,i}));exports.REFRESH_TOKEN_KEY=A,exports.SESSION_TOKEN_KEY=C,exports.clearFingerprintData=()=>{x(B)},exports.createSdk=Pe,exports.default=Pe,exports.ensureFingerprintIds=G,exports.getSessionToken=q,exports.hasOidcParamsInUrl=Ae;
|
|
1
|
+
"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("tslib"),t=require("jwt-decode"),n=require("@descope/core-js-sdk"),o=require("js-cookie"),i=require("@fingerprintjs/fingerprintjs-pro");function r(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var s=r(n),a=r(o);const l="3.2.0",c="undefined"!=typeof window,d=Math.pow(2,31)-1,u=`https://descopecdn.com/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`,p=`https://cdn.jsdelivr.net/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`;const f=["/v1/auth/refresh","/v1/auth/try-refresh","/v1/auth/me","/v1/auth/me/tenants","/v1/auth/me/history"];let g;const v=e=>{try{return t.jwtDecode(e).exp}catch(e){return null}},w=e=>{const{refresh_expire_in:t,refresh_token:n}=e;return t?Math.floor(Date.now()/1e3)+t:v(n)},h=e=>{const{expires_in:t,expires_at:n,access_token:o}=e;return n||(t?Math.floor(Date.now()/1e3)+t:o?v(o):void 0)},m=t=>{const{access_token:n,id_token:o,refresh_token:i,refresh_expire_in:r}=t,s=e.__rest(t,["access_token","id_token","refresh_token","refresh_expire_in"]);return Object.assign({sessionJwt:t.sessionJwt||n,idToken:o,refreshJwt:t.refreshJwt||i,sessionExpiration:t.sessionExpiration||h(t),cookieExpiration:t.cookieExpiration||w(t)},s)},y=(e,t)=>{var n;return["beforeRequest","afterRequest"].reduce(((n,o)=>{var i;return n[o]=[].concat((null===(i=e.hooks)||void 0===i?void 0:i[o])||[]).concat((null==t?void 0:t[o])||[]),n}),null!==(n=e.hooks)&&void 0!==n?n:e.hooks={}),e},b=async e=>{if(!(null==e?void 0:e.ok))return{};const t=await(null==e?void 0:e.clone().json()),n=(null==t?void 0:t.authInfo)||t||{};return m(n)},k=()=>c&&!!window.descopeBridge,S=(e,t)=>{if(!((null==t?void 0:t.status)>=400&&(null==t?void 0:t.status)<500))return!1;const n=(null==e?void 0:e.path)||"";return f.includes(n)},_=void 0!==g||c&&void 0!==window.localStorage,I=(e,t)=>{var n,o;return null===(o=null===(n=g||c&&window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o?void 0:o.call(n,e,t)},O=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e)},x=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n?void 0:n.call(t,e)},j=e=>{var t,n,o,i,r;return null!==(r=null!==(n=null===(t=null==g?void 0:g.key)||void 0===t?void 0:t.call(g,e))&&void 0!==n?n:c&&(null===(i=null===(o=window.localStorage)||void 0===o?void 0:o.key)||void 0===i?void 0:i.call(o,e)))&&void 0!==r?r:null},D=e=>{var t,n;return c&&(null===(n=null===(t=window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e))||null},T=e=>{var t,n;try{c&&(null===(n=null===(t=window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n||n.call(t,e))}catch(e){}},U=(...e)=>{console.debug(...e)},C=(...e)=>{console.warn(...e)},A=(e,t)=>{let n;var o;return t>0?(n=1e3*t,U(`Using provided nextRefreshSeconds: ${t}s`)):n=((o=e)?o.getTime()-(new Date).getTime():0)-2e4,n>d&&(U(`Timeout is too large (${n}ms), setting it to ${d}ms`),n=d),n},E="DS",R="DSR",$="DSI",N="DSRCN";function P(e,t,n){if(t){const{cookieDomain:o,cookiePath:i,cookieSameSite:r,cookieExpiration:s,cookieSecure:l}=n,c=new Date(1e3*s),d=J(o);a.default.set(e,t,{path:i,domain:d?o:void 0,expires:c,sameSite:r,secure:l})}}function J(e){const t=window.location.hostname.split("."),n=null==e?void 0:e.split(".");return t.slice(-(null==n?void 0:n.length)).join(".")===e}const L=e=>(null==e?void 0:e.cookieName)||E,q=e=>(null==e?void 0:e.cookieName)||R;function K(e="",t){return a.default.get(q(t))||O(`${e}${R}`)||""}function V(e="",t){return a.default.get(L(t))||O(`${e}${E}`)||""}function F(e=""){return O(`${e}${$}`)||""}function M(e="",t,n,o){x(`${e}${R}`),x(`${e}${E}`),x(`${e}${$}`),x(`${e}${N}`);const i=L(t);a.default.remove(i,null==o?void 0:o.session);const r=q(n);a.default.remove(r,null==o?void 0:o.refresh)}const W=(e,t,n)=>o=>{const i=Object.assign(o,{token:o.token||K(e,t)});if(!n){const t=function(e=""){return O(`${e}${N}`)}(e);t&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-refresh-cookie-name":t}))}const r=function(e=""){return O(`${e}DTD`)||""}(e);return r&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-trusted-device-token":r})),i},H=c&&(null===localStorage||void 0===localStorage?void 0:localStorage.getItem("fingerprint.endpoint.url"))||"https://api.descope.com",B="vsid",z="vrid",G="fp",X=(e=!1)=>{const t=O(G);if(!t)return null;const n=JSON.parse(t);return(new Date).getTime()>n.expiry&&!e?null:n.value},Z=async(e,t=H)=>{try{if(X())return;const n=(Date.now().toString(36)+Math.random().toString(36).substring(2)+Math.random().toString(36).substring(2)).substring(0,27),o=new URL(t);o.pathname="/fXj8gt3x8VulJBna/x96Emn69oZwcd7I6";const r=new URL(t);r.pathname="/fXj8gt3x8VulJBna/w78aRZnnDZ3Aqw0I";const s=r.toString()+"?apiKey=<apiKey>&version=<version>&loaderVersion=<loaderVersion>",a=i.load({apiKey:e,endpoint:[o.toString(),i.defaultEndpoint],scriptUrlPattern:[s,i.defaultScriptUrlPattern]}),l=await a,{requestId:c}=await l.get({linkedId:n}),d=((e,t)=>({[B]:e,[z]:t}))(n,c);(e=>{const t={value:e,expiry:(new Date).getTime()+864e5};I(G,JSON.stringify(t))})(d)}catch(e){console.warn("Could not load fingerprint",e)}},Y=e=>{const t=X(!0);return t&&e.body&&(e.body.fpData=t),e},Q="descopeFlowNonce",ee="X-Descope-Flow-Nonce",te="/v1/flow/start",ne="/v1/flow/next",oe=(e,t=Q)=>`${t}${e}`,ie=(e,t=Q)=>{try{const n=oe(e,t);x(n)}catch(e){console.error("Error removing flow nonce:",e)}},re=e=>{var t;return(null===(t=/.*\|#\|(.*)/.exec(e))||void 0===t?void 0:t[1])||null},se=e=>{var t;return e.path===ne&&(null===(t=e.body)||void 0===t?void 0:t.executionId)?re(e.body.executionId):null},ae="dls_last_user_login_id",le="dls_last_user_display_name",ce=e=>I(ae,e),de=()=>O(ae),ue=()=>O(le),pe=e=>async(...t)=>{var n;t[1]=t[1]||{};const[,o={}]=t,i=de(),r=ue();i&&(null!==(n=o.lastAuth)&&void 0!==n||(o.lastAuth={}),o.lastAuth.loginId=i,o.lastAuth.name=r);return await e(...t)},fe=e=>t=>async(...n)=>{const o=await t(...n);return e||(x(ae),x(le)),o},ge="DSLI",ve=e=>async(...t)=>{const n=await e(...t);return T(ge),n};function we(){const e=[];return{pub:t=>{e.forEach((e=>e(t)))},sub:t=>{const n=e.push(t)-1;return()=>e.splice(n,1)}}}const he=(e,t,n,o)=>i=>async(...r)=>{const s=await i(...r);return M(e,t,n,null==o?void 0:o()),s};async function me(e){const t=function(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=Oe(n.publicKey.challenge),n.publicKey.user.id=Oe(n.publicKey.user.id),null===(t=n.publicKey.excludeCredentials)||void 0===t||t.forEach((e=>{e.id=Oe(e.id)})),n}(e);try{const e=await navigator.credentials.create(t);return n=e,JSON.stringify({id:n.id,rawId:xe(n.rawId),type:n.type,response:{attestationObject:xe(n.response.attestationObject),clientDataJSON:xe(n.response.clientDataJSON)}})}catch(e){throw await ke(e,t,!0)}var n}async function ye(e){const t=_e(e);try{return Ie(await navigator.credentials.get(t))}catch(e){throw await ke(e,t,!1)}}async function be(e,t){const n=_e(e);n.signal=t.signal,n.mediation="conditional";try{return Ie(await navigator.credentials.get(n))}catch(e){throw await ke(e,n,!1)}}async function ke(e,t,n){if(e&&"object"==typeof e)try{e.reason=await async function(e,t,n){var o,i;const r=null==e?void 0:e.name;if("AbortError"===r&&(null==t?void 0:t.signal)instanceof AbortSignal)return"aborted";if("InvalidStateError"===r&&n)return"authenticator_already_registered";if("NotSupportedError"===r)return"no_supported_algorithm";if("ConstraintError"===r)return"authenticator_constraints_unsupported";if("SecurityError"===r){const e=window.location.hostname;return"localhost"===e||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)?"invalid_rpid":"invalid_domain"}if(!await Se())return"webauthn_unsupported";const s="platform"===(null===(i=null===(o=null==t?void 0:t.publicKey)||void 0===o?void 0:o.authenticatorSelection)||void 0===i?void 0:i.authenticatorAttachment);return n&&s&&!await Se(!0)?"platform_authenticator_unsupported":"NotAllowedError"===r?"not_allowed":"unknown"}(e,t,n)}catch(e){}return e}async function Se(e=!1){var t,n;if(!c)return Promise.resolve(!1);if(k()){const e=null===(n=null===(t=window.descopeBridge)||void 0===t?void 0:t.hostInfo)||void 0===n?void 0:n.webauthn;if("boolean"==typeof e)return e}const o=!!(window.PublicKeyCredential&&navigator.credentials&&navigator.credentials.create&&navigator.credentials.get);return o&&e&&PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():o}function _e(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=Oe(n.publicKey.challenge),null===(t=n.publicKey.allowCredentials)||void 0===t||t.forEach((e=>{e.id=Oe(e.id)})),n}function Ie(e){return JSON.stringify({id:e.id,rawId:xe(e.rawId),type:e.type,response:{authenticatorData:xe(e.response.authenticatorData),clientDataJSON:xe(e.response.clientDataJSON),signature:xe(e.response.signature),userHandle:e.response.userHandle?xe(e.response.userHandle):void 0}})}function Oe(e){const t=e.replace(/_/g,"/").replace(/-/g,"+");return Uint8Array.from(atob(t),(e=>e.charCodeAt(0))).buffer}function xe(e){return btoa(String.fromCharCode.apply(null,new Uint8Array(e))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}var je,De=(je=e=>({async signUp(t,n,o){const i=await e.webauthn.signUp.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await me(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,r)},async signIn(t,n){const o=await e.webauthn.signIn.start(t,window.location.origin,void 0,void 0,n);if(!o.ok)return o;const i=await ye(o.data.options);return await e.webauthn.signIn.finish(o.data.transactionId,i)},async signUpOrIn(t,n){var o;const i=await e.webauthn.signUpOrIn.start(t,window.location.origin,n);if(!i.ok)return i;if(null===(o=i.data)||void 0===o?void 0:o.create){const t=await me(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,t)}{const t=await ye(i.data.options);return await e.webauthn.signIn.finish(i.data.transactionId,t)}},async update(t,n,o){const i=await e.webauthn.update.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await me(i.data.options);return await e.webauthn.update.finish(i.data.transactionId,r)},helpers:{create:me,get:ye,isSupported:Se,conditional:be}}),(...e)=>{const t=je(...e);return Object.assign(t.signUp,e[0].webauthn.signUp),Object.assign(t.signIn,e[0].webauthn.signIn),Object.assign(t.signUpOrIn,e[0].webauthn.signUpOrIn),Object.assign(t.update,e[0].webauthn.update),t});const Te={config:"/fedcm/config"},Ue=()=>{if(window.crypto&&window.crypto.getRandomValues){const e=new Uint8Array(16);return window.crypto.getRandomValues(e),Array.from(e,(e=>e.toString(16).padStart(2,"0"))).join("")}return Math.random().toString(36).substring(2)};async function Ce(e,t){var n;try{await Ae(e,t)}catch(e){null===(n=null==t?void 0:t.onFailed)||void 0===n||n.call(t,e)}}async function Ae(e,t){var n,o;const i=await async function(e,t="google",n,o,i){const r=Ue(),s=await async function(){return new Promise(((e,t)=>{if(window.google)return void e(window.google.accounts.id);let n=document.getElementById("google-gsi-client-script");n||(n=document.createElement("script"),document.head.appendChild(n),n.async=!0,n.defer=!0,n.id="google-gsi-client-script",n.src="https://accounts.google.com/gsi/client"),n.onload=function(){window.google?e(window.google.accounts.id):t("Failed to load Google GSI client script - not loaded properly")},n.onerror=function(){t("Failed to load Google GSI client script - failed to load")}}))}(),a=await e.oauth.getOneTapClientId(t);if(!a.ok)throw new Error("Failed to get OneTap client ID for provider "+t);const l=a.data.clientId;return new Promise((e=>{var a,c;const d=n=>{e({provider:t,nonce:r,credential:null==n?void 0:n.credential})};s.initialize(Object.assign(Object.assign({},n),{itp_support:null===(a=null==n?void 0:n.itp_support)||void 0===a||a,use_fedcm_for_prompt:null===(c=null==n?void 0:n.use_fedcm_for_prompt)||void 0===c||c,client_id:l,callback:d,nonce:r})),s.prompt((e=>{var t,n;if(i&&(null==e?void 0:e.isDismissedMoment())){const n=null===(t=e.getDismissedReason)||void 0===t?void 0:t.call(e);return null==i||i(n),void d()}if(o&&(null==e?void 0:e.isSkippedMoment())){const t=null===(n=e.getSkippedReason)||void 0===n?void 0:n.call(e);return null==o||o(t),void d()}}))}))}(e,t.provider,t.oneTapConfig,t.onSkipped,t.onDismissed);if(!i.credential)return null;if(null==t?void 0:t.onCodeReceived){const o=await e.oauth.verifyOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!o.ok||!o.data)throw new Error("Failed to verify OneTap client ID for provider "+i.provider);null===(n=null==t?void 0:t.onCodeReceived)||void 0===n||n.call(t,o.data.code)}else{const n=await e.oauth.exchangeOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!n.ok||!n.data)throw new Error("Failed to exchange OneTap client ID for provider "+i.provider);null===(o=null==t?void 0:t.onAuthenticated)||void 0===o||o.call(t,n.data)}}var Ee=e=>Object.assign(Object.assign({},e.flow),{start:async(...t)=>{const n=await Se(),o=Object.assign(Object.assign({location:window.location.href},t[1]),{deviceInfo:{webAuthnSupport:n},startOptionsVersion:1});return t[1]=o,e.flow.start(...t)}});const Re=()=>window.location.search.includes("code")&&window.location.search.includes("state");let $e;const Ne=(e,t)=>new Promise(((n,o)=>{if(!e.length)return o(new Error("No URLs provided to loadScriptWithFallback"));const i=t();if(i)return n(i);const r=e.shift(),s=document.createElement("script");s.src=r,s.id=(e=>{let t=0;for(let n=0;n<e.length;n++)t=(t<<5)-t+e.charCodeAt(n),t|=0;return Math.abs(t).toString(16)})(r),s.onload=()=>{const e=t();if(e)return n(e);throw new Error("Could not get entry after loading script from URL")},s.addEventListener("error",(()=>{Ne(e,t),s.setAttribute("data-error","true")})),document.body.appendChild(s)}));const Pe=async(e,t,n)=>{$e||($e=(async()=>{try{return require("oidc-client-ts")}catch(e){return Ne([u,p],(()=>window.oidc))}})());const{OidcClient:o,WebStorageStateStore:i}=await $e;if(!o)throw new Error("oidc-client-ts is not installed. Please install it by running `npm install oidc-client-ts`");const r=(null==n?void 0:n.redirectUri)||window.location.href;let s,a,l,c;if(null==n?void 0:n.issuer){if(!n.clientId)throw new Error("clientId is required when providing a custom issuer/authority");s=n.issuer,a=n.clientId,l=`${a}_user`,c="openid"}else(null==n?void 0:n.applicationId)?(s=e.httpClient.buildUrl(t),s=`${s}/${n.applicationId}`,a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access"):(s=e.httpClient.buildUrl(t),a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access");const d={authority:s,client_id:a,redirect_uri:r,response_type:"code",scope:(null==n?void 0:n.scope)||c,stateStore:new i({store:window.localStorage,prefix:a}),loadUserInfo:!0,fetchRequestCredentials:"same-origin"};return(null==n?void 0:n.redirectUri)&&(d.redirect_uri=n.redirectUri),{client:new o(d),stateUserKey:l}},Je=(e,t,n)=>{const o=async()=>{let o,i;return o&&i||({client:o,stateUserKey:i}=await Pe(e,t,n)),{client:o,stateUserKey:i}},i=async(t="")=>{var n;const{client:i,stateUserKey:r}=await o(),s=await i.processSigninResponse(t||window.location.href);var a;return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(s)))),I(r,JSON.stringify({id_token:(a=s).id_token,session_state:a.session_state,profile:a.profile})),(()=>{const e=new URL(window.location.href);e.searchParams.delete("code"),e.searchParams.delete("state"),window.history.replaceState({},document.title,e.toString())})(),s};return{loginWithRedirect:async(t={},n=!1)=>{var i;const{client:r}=await o(),s=await r.createSigninRequest(t),{url:a}=s;return n||(await(null===(i=e.httpClient.hooks)||void 0===i?void 0:i.afterRequest({},new Response(JSON.stringify(s)))),window.location.href=a),{ok:!0,data:s}},finishLogin:i,finishLoginIfNeed:async(e="")=>{if(Re())return await i(e)},refreshToken:async t=>{var n;const{client:i,stateUserKey:r}=await o(),s=(e=>{const t=O(e);return t?JSON.parse(t):null})(r);if(!s)throw new Error("User not found in storage to refresh token");let a=t;if(!a){const t={};e.httpClient.hooks.beforeRequest(t),a=t.token}const l=await i.useRefreshToken({state:{refresh_token:a,session_state:s.session_state,profile:s.profile}});return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(l)))),l},logout:async(e,t=!1)=>{const{client:n,stateUserKey:i}=await o();e||(e={}),e.id_token_hint=e.id_token_hint||F(),e.post_logout_redirect_uri=e.post_logout_redirect_uri||window.location.href;const r=await n.createSignoutRequest(e),{url:s}=r;return x(i),t||window.location.replace(s),r}}},Le=function(...e){return t=>e.reduce(((e,t)=>t(e)),t)}((e=>t=>{var n;return n=t.customStorage,g=n,e(t)}),(t=>n=>{var{fpKey:o,fpLoad:i}=n,r=e.__rest(n,["fpKey","fpLoad"]);return c?(o&&i&&Z(o).catch((()=>null)),t(y(r,{beforeRequest:Y}))):t(r)}),(e=>t=>e(Object.assign(Object.assign({},t),{baseHeaders:Object.assign({"x-descope-sdk-name":"web-js","x-descope-sdk-version":"1.51.3"},t.baseHeaders)}))),(e=>t=>{const o=we(),i=we(),r=we(),s=we(),a=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))U("Session invalidated, notifying subscribers with empty values"),i.pub(null),r.pub(null),o.pub(null),s.pub(null);else{const e=await(async e=>{const t=await b(e);return(null==t?void 0:t.user)||((null==t?void 0:t.hasOwnProperty("userId"))?t:void 0)})(t);e&&r.pub(e);const{sessionJwt:n,sessionExpiration:a,claims:l}=await b(t);n&&i.pub(n),l&&s.pub(l),(a||n)&&o.pub(a||42)}}})),l=n.wrapWith(a,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return i.pub(null),r.pub(null),o.pub(null),s.pub(null),n}));return Object.assign(l,{onSessionTokenChange:i.sub,onUserChange:r.sub,onClaimsChange:s.sub,onIsAuthenticatedChange:e=>o.sub((t=>{e(!!t)}))})}),(t=>n=>{var o;const{enableFlowNonce:i=!0,nonceStoragePrefix:r=Q}=n,s=e.__rest(n,["enableFlowNonce","nonceStoragePrefix"]);if(!i)return t(s);((e=Q)=>{try{if(!_)return;for(let i=0;i<(t=void 0,n=void 0,o=void 0,null!==(o=null!==(t=null==g?void 0:g.length)&&void 0!==t?t:c&&(null===(n=window.localStorage)||void 0===n?void 0:n.length))&&void 0!==o?o:0);i++){const t=j(i);if(t&&t.startsWith(e)){const e=O(t);if(e)try{JSON.parse(e).expiry<Date.now()&&x(t)}catch(e){x(t)}}}}catch(e){console.error("Error cleaning up expired nonces:",e)}var t,n,o})(r);const a=t(y(s,{afterRequest:async(e,t)=>{if(e.path!==te&&e.path!==ne)return;const{nonce:n,executionId:o}=await(async(e,t)=>{try{const n=t.headers.get(ee);let o=await t.clone().json().then((e=>(null==e?void 0:e.executionId)||null)).catch((()=>null));return o||(o=se(e)),{nonce:n,executionId:re(o)}}catch(e){return{nonce:null,executionId:null}}})(e,t);if(n&&o){((e,t,n,o=Q)=>{try{const i=oe(e,o),r=n?172800:10800,s={value:t,expiry:Date.now()+1e3*r,isStart:n};I(i,JSON.stringify(s))}catch(e){console.error("Error setting flow nonce:",e)}})(o,n,e.path===te,r)}},beforeRequest:e=>{if(e.path===ne){const t=se(e);if(t){const n=((e,t=Q)=>{try{const n=oe(e,t),o=O(n);if(!o)return null;const i=JSON.parse(o);return i.expiry<Date.now()?(ie(e,t),null):i.value}catch(e){return console.error("Error getting flow nonce:",e),null}})(t,r);n&&(e.headers=e.headers||{},e.headers[ee]=n)}}return e}}));if(null===(o=a.flow)||void 0===o?void 0:o.next){let e=Promise.resolve();const t=a.flow.next.bind(a.flow);a.flow.next=async(...n)=>{const o=e;let i;e=new Promise((e=>{i=e})),await o;try{return await t(...n)}finally{i()}}}return a}),(e=>t=>{const o=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))return void T(ge);const n=await b(t);(null==n?void 0:n.sessionExpiration)&&((e,t)=>{var n,o;try{c&&(null===(o=null===(n=window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o||o.call(n,e,t))}catch(e){}})(ge,String(n.sessionExpiration))}}));return n.wrapWith(o,["logout","logoutAll","oidc.logout"],ve)}),(o=>i=>{var{autoRefresh:r}=i,s=e.__rest(i,["autoRefresh"]);const a=!!r,l="object"==typeof r&&(null==r?void 0:r.customActivityTracking);if(!a||k())return Object.assign(o(s),{markUserActive:()=>{C("markUserActive() called but has no effect")}});const{clearAllTimers:d,setTimer:u}=(()=>{const e=[];return{clearAllTimers:()=>{for(;e.length;)clearTimeout(e.pop())},setTimer:(t,n)=>{e.push(setTimeout(t,n))}}})();let p,f,g=null,v=!1,w=!1;l&&(U("Activity-based refresh enabled"),g=(()=>{let e=!0;return{hadActivity:()=>e,reset:()=>{e=!1},markActive:()=>{e=!0}}})()),c&&document.addEventListener("visibilitychange",(()=>{"visible"===document.visibilityState&&p&&new Date>p&&(U("Expiration time passed, refreshing session"),h.refresh(K()||f))}));const h=o(y(s,{afterRequest:async(e,n)=>{const{sessionJwt:o,refreshJwt:i,sessionExpiration:r,nextRefreshSeconds:s}=await b(n);if(S(e,n))U("Session invalidated, canceling all timers"),d();else if(o||r){if(p=((e,n)=>{if(n)return new Date(1e3*n);U("Could not extract expiration time from session token, trying to decode the token");try{const n=t.jwtDecode(e);if(n.exp)return new Date(1e3*n.exp)}catch(e){return null}})(o,r),!p)return void U("Could not extract expiration time from session token");f=i,v=s>0;const e=A(p,s);if(d(),e<=2e4)return void U("Session is too close to expiration, not setting refresh timer");const n=new Date(Date.now()+e).toLocaleTimeString("en-US",{hour12:!1});U(`Setting refresh timer for ${n}. (${e}ms)`),g&&(g.reset(),w=!1),u((()=>{if(c&&"hidden"===document.visibilityState)U("Skipping refresh due to timer - document is hidden");else{if(g&&v&&!g.hadActivity())return U("Skipping refresh due to timer - user is idle"),void(w=!0);U("Refreshing session due to timer"),h.refresh(K()||i)}}),e)}}}));return Object.assign(n.wrapWith(h,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return U("Clearing all timers"),d(),n})),{markUserActive:g?()=>{U("markUserActive() called"),v||U("markUserActive() called but server does not have inactivity timeout configured (no nextRefreshSeconds)"),g.markActive(),w&&(U("User became active after skipped refresh, triggering refresh"),w=!1,d(),h.refresh(K()||f))}:()=>{C("markUserActive() called but customActivityTracking is not enabled — this call has no effect")}})}),(t=>o=>{var{storeLastAuthenticatedUser:i=!0,keepLastAuthenticatedUserAfterLogout:r=!1}=o,s=e.__rest(o,["storeLastAuthenticatedUser","keepLastAuthenticatedUserAfterLogout"]);if(!i)return Object.assign(t(s),{getLastUserLoginId:de,getLastUserDisplayName:ue});const a=t(y(s,{afterRequest:async(e,t)=>{var n;const{userInfo:o,lastAuth:i}=await(async e=>{if(!(null==e?void 0:e.ok))return{userInfo:void 0,lastAuth:void 0};const t=await(null==e?void 0:e.clone().json()),n=m((null==t?void 0:t.authInfo)||t||{});return{userInfo:(null==n?void 0:n.user)||((null==n?void 0:n.hasOwnProperty("userId"))?n:void 0),lastAuth:t.lastAuth}})(t),r=null===(n=null==o?void 0:o.loginIds)||void 0===n?void 0:n[0],s=null==o?void 0:o.name;r?(ce(r),(e=>{I(le,e)})(s)):(null==i?void 0:i.loginId)&&ce(i.loginId)}}));let l=n.wrapWith(a,["flow.start"],pe);return l=n.wrapWith(l,["logout","logoutAll"],fe(r)),Object.assign(l,{getLastUserLoginId:de,getLastUserDisplayName:ue})}),(t=>o=>{var{persistTokens:i,sessionTokenViaCookie:r,refreshTokenViaCookie:s,storagePrefix:l,refreshCookieName:d}=o,u=e.__rest(o,["persistTokens","sessionTokenViaCookie","refreshTokenViaCookie","storagePrefix","refreshCookieName"]);if(!i||!c)return t(Object.assign({refreshCookieName:d},u));let p;const f=t(y(Object.assign({refreshCookieName:d},u),{beforeRequest:W(l,s,d),afterRequest:async(e,t)=>{if(S(e,t))U("Session invalidated, clearing persisted tokens"),M(l,r,s,p);else{const e=await b(t);e.cookieName?I(`${l||""}${N}`,e.cookieName):e.refreshJwt&&x(`${l||""}${N}`);const n=((e={},t=!1,n="",o=!1)=>{var i,r,s,l;const{sessionJwt:c,refreshJwt:d,trustedDeviceJwt:u}=e;let p;if(d)if(o){x(`${n}${R}`);const t=o.sameSite||"Strict",s=null===(i=o.secure)||void 0===i||i,a=null!==(r=o.domain)&&void 0!==r?r:e.cookieDomain,l=q(o);s&&"https:"!==window.location.protocol&&C("Refresh token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass refreshTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const c=Object.assign(Object.assign({},e),{cookieSameSite:t,cookieSecure:s,cookieDomain:a});P(l,d,c);const u=J(a);p=Object.assign(Object.assign({},p),{refresh:{path:c.cookiePath,domain:u?a:void 0}})}else{const e=q(o);a.default.remove(e),I(`${n}${R}`,d)}if(c)if(t){const n=t.sameSite||"Strict",o=null===(s=t.secure)||void 0===s||s,i=null!==(l=t.domain)&&void 0!==l?l:e.cookieDomain,r=L(t);o&&"https:"!==window.location.protocol&&C("Session token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass sessionTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const a=Object.assign(Object.assign({},e),{cookieSameSite:n,cookieSecure:o,cookieDomain:i});P(r,c,a);const d=J(i);p=Object.assign(Object.assign({},p),{session:{path:a.cookiePath,domain:d?i:void 0}})}else I(`${n}${E}`,c);return e.idToken&&I(`${n}${$}`,e.idToken),u&&I(`${n}DTD`,u),p})(e,r,l,s);n&&(p=n)}}})),g=n.wrapWith(f,["logout","logoutAll","oidc.logout"],he(l,r,s,(()=>p)));return Object.assign(g,{getRefreshToken:()=>K(l,s),getSessionToken:()=>V(l,r),getIdToken:()=>F(l)})}))((e=>{const t=s.default(e),n=Je(t,e.projectId,e.oidcConfig);return Object.assign(Object.assign({},t),{refresh:async(o,i)=>{var r;if(k())return U(`Refresh called in native flow: ${(new Error).stack}`),Promise.resolve({ok:!1,error:{errorCode:"J171000",errorDescription:"Refresh is not supported in native flows via the web SDK"}});if(e.oidcConfig)try{return await n.refreshToken(o),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161001",errorDescription:e.toString()}})}if(i&&c&&void 0!==window.localStorage&&!D(ge)&&!O(ae)&&!D("DSLI_DISABLED"))return Promise.resolve({ok:!0});const s=V(),a=K();let l="";if(e.getExternalToken)try{l=await(null===(r=e.getExternalToken)||void 0===r?void 0:r.call(e))}catch(e){U("Error getting external token while refreshing",e)}return t.refresh(o,{dcs:s?"t":"f",dcr:a?"t":"f"},l,i)},logout:async o=>{if(e.oidcConfig)try{return await n.logout({id_token_hint:o}),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161000",errorDescription:e.toString()}})}return t.logout(o)},flow:Ee(t),webauthn:De(t),fedcm:(o=t,i=e.projectId,{onetap:{requestExchangeCode(e){Ce(o,e)},requestAuthentication(e){Ce(o,e)}},async oneTap(e,t,n,i,r){await Ae(o,{provider:e,oneTapConfig:t,loginOptions:n,onSkipped:i,onDismissed:r})},async launch(e){var t;const n={identity:{context:e||"signin",providers:[{configURL:o.httpClient.buildUrl(i+Te.config),clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(n));return o.refresh(r.token)},isSupported:()=>c&&"IdentityCredential"in window,async isLoggedIn(e){var t;const n=o.httpClient.buildUrl(i+Te.config);try{const o={identity:{context:e||"signin",providers:[{configURL:n,clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(o));return!!r&&!!r.token}catch(e){return!1}}}),oidc:n});var o,i}));exports.REFRESH_TOKEN_KEY=R,exports.SESSION_TOKEN_KEY=E,exports.clearFingerprintData=()=>{x(G)},exports.createSdk=Le,exports.default=Le,exports.ensureFingerprintIds=Z,exports.getSessionToken=V,exports.hasOidcParamsInUrl=Re;
|
|
2
2
|
//# sourceMappingURL=index.cjs.js.map
|