@descope/web-js-sdk 1.51.2 → 1.51.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +5 -3
  2. package/dist/cjs/index.cjs.js +1 -1
  3. package/dist/cjs/index.cjs.js.map +1 -1
  4. package/dist/index.esm.js +1 -1
  5. package/dist/index.esm.js.map +1 -1
  6. package/dist/index.umd.js +2 -2
  7. package/dist/index.umd.js.map +1 -1
  8. package/package.json +2 -2
package/README.md CHANGED
@@ -222,7 +222,7 @@ This is useful when Descope's session inactivity feature is enabled, ensuring re
222
222
 
223
223
  ### Custom Storage
224
224
 
225
- By default the SDK reads and writes to `window.localStorage` for state that needs to outlive a single page load (last-authenticated user, client-side session-refresh optimization markers, etc.). If `localStorage` is unavailable or you want to back these keys with something else — `sessionStorage`, an in-memory store, an encrypted wrapper, a cross-frame bridge — pass a `customStorage` object to the SDK.
225
+ By default the SDK reads and writes to `window.localStorage` for state that needs to outlive a single page load (last-authenticated user, tokens when they aren't stored in cookies, etc.). If `localStorage` is unavailable or you want to back these keys with something else — `sessionStorage`, an in-memory store, an encrypted wrapper, a cross-frame bridge — pass a `customStorage` object to the SDK.
226
226
 
227
227
  ```js
228
228
  const inMemoryStorage = (() => {
@@ -254,11 +254,13 @@ type CustomStorage = {
254
254
  };
255
255
  ```
256
256
 
257
- > **Note:** The SDK writes a small set of internal keys (e.g. for the last-authenticated user feature and client-side session-refresh optimizations). Make sure your implementation round-trips these keys cleanly — `getItem(key)` should return the same string that was last passed to `setItem(key, value)`. If your storage drops, filters, or namespaces keys so that they don't survive a round-trip, some optimizations may degrade — for example, an extra `/v1/auth/try-refresh` round-trip may be made on every page load even for anonymous visitors.
257
+ > **Note:** `customStorage` backs the keys the SDK persists on your behalf (tokens, last-authenticated user). Make sure your implementation round-trips these keys cleanly — `getItem(key)` should return the same string that was last passed to `setItem(key, value)`. If your storage drops, filters, or namespaces keys so that they don't survive a round-trip, the features that rely on them may degrade.
258
+ >
259
+ > The internal, non-PII markers for the client-side session-refresh optimization (`DSLI` / `DSLI_DISABLED`) are the exception: the SDK always keeps them in real `window.localStorage`, independent of `customStorage`. This is what makes the optimization behave correctly even when you back the other keys with `sessionStorage` or an in-memory store.
258
260
 
259
261
  ### Last Login Indicator
260
262
 
261
- The SDK maintains a `DSLI` (Descope Session Login Indicator) entry in `localStorage` that tracks whether this browser has previously had an active authenticated session. On every successful authentication, `DSLI` is written. On logout or an invalid-session response, it is cleared.
263
+ The SDK maintains a `DSLI` (Descope Session Login Indicator) entry in real `window.localStorage` — always, even when a `customStorage` is provided — that tracks whether this browser has previously had an active authenticated session. On every successful authentication, `DSLI` is written. On logout or an invalid-session response, it is cleared.
262
264
 
263
265
  When `sdk.refresh()` is called in "try-refresh" mode (i.e. on SDK initialization, to restore a prior session), the SDK skips the network call entirely if neither `DSLI` nor the last-user key (`dls_last_user_login_id`) is present. This eliminates a redundant `/v1/auth/try-refresh` round-trip for anonymous visitors who have never logged in.
264
266
 
package/dist/cjs/index.cjs.js CHANGED
@@ -1,2 +1,2 @@
1
- "use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("tslib"),t=require("jwt-decode"),n=require("@descope/core-js-sdk"),o=require("js-cookie"),i=require("@fingerprintjs/fingerprintjs-pro");function r(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var s=r(n),a=r(o);const l="3.2.0",c="undefined"!=typeof window,u=Math.pow(2,31)-1,d=`https://descopecdn.com/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`,p=`https://cdn.jsdelivr.net/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`;const f=["/v1/auth/refresh","/v1/auth/try-refresh","/v1/auth/me","/v1/auth/me/tenants","/v1/auth/me/history"];let g;const v=e=>{try{return t.jwtDecode(e).exp}catch(e){return null}},h=e=>{const{refresh_expire_in:t,refresh_token:n}=e;return t?Math.floor(Date.now()/1e3)+t:v(n)},w=e=>{const{expires_in:t,expires_at:n,access_token:o}=e;return n||(t?Math.floor(Date.now()/1e3)+t:o?v(o):void 0)},m=t=>{const{access_token:n,id_token:o,refresh_token:i,refresh_expire_in:r}=t,s=e.__rest(t,["access_token","id_token","refresh_token","refresh_expire_in"]);return Object.assign({sessionJwt:t.sessionJwt||n,idToken:o,refreshJwt:t.refreshJwt||i,sessionExpiration:t.sessionExpiration||w(t),cookieExpiration:t.cookieExpiration||h(t)},s)},y=(e,t)=>{var n;return["beforeRequest","afterRequest"].reduce(((n,o)=>{var i;return n[o]=[].concat((null===(i=e.hooks)||void 0===i?void 0:i[o])||[]).concat((null==t?void 0:t[o])||[]),n}),null!==(n=e.hooks)&&void 0!==n?n:e.hooks={}),e},b=async e=>{if(!(null==e?void 0:e.ok))return{};const t=await(null==e?void 0:e.clone().json()),n=(null==t?void 0:t.authInfo)||t||{};return m(n)},k=()=>c&&!!window.descopeBridge,S=(e,t)=>{if(!((null==t?void 0:t.status)>=400&&(null==t?void 0:t.status)<500))return!1;const n=(null==e?void 0:e.path)||"";return f.includes(n)},_=void 0!==g||c&&void 0!==window.localStorage,I=(e,t)=>{var n,o;return null===(o=null===(n=g||c&&window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o?void 0:o.call(n,e,t)},O=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e)},x=e=>{var t,n;return null===(n=null===(t=g||c&&window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n?void 0:n.call(t,e)},j=e=>{var t,n,o,i,r;return null!==(r=null!==(n=null===(t=null==g?void 0:g.key)||void 0===t?void 0:t.call(g,e))&&void 0!==n?n:c&&(null===(i=null===(o=window.localStorage)||void 0===o?void 0:o.key)||void 0===i?void 0:i.call(o,e)))&&void 0!==r?r:null},D=(...e)=>{console.debug(...e)},T=(...e)=>{console.warn(...e)},U=(e,t)=>{let n;var o;return t>0?(n=1e3*t,D(`Using provided nextRefreshSeconds: ${t}s`)):n=((o=e)?o.getTime()-(new Date).getTime():0)-2e4,n>u&&(D(`Timeout is too large (${n}ms), setting it to ${u}ms`),n=u),n},C="DS",A="DSR",E="DSI",R="DSRCN";function $(e,t,n){if(t){const{cookieDomain:o,cookiePath:i,cookieSameSite:r,cookieExpiration:s,cookieSecure:l}=n,c=new Date(1e3*s),u=N(o);a.default.set(e,t,{path:i,domain:u?o:void 0,expires:c,sameSite:r,secure:l})}}function N(e){const t=window.location.hostname.split("."),n=null==e?void 0:e.split(".");return t.slice(-(null==n?void 0:n.length)).join(".")===e}const P=e=>(null==e?void 0:e.cookieName)||C,J=e=>(null==e?void 0:e.cookieName)||A;function L(e="",t){return a.default.get(J(t))||O(`${e}${A}`)||""}function q(e="",t){return a.default.get(P(t))||O(`${e}${C}`)||""}function K(e=""){return O(`${e}${E}`)||""}function V(e="",t,n,o){x(`${e}${A}`),x(`${e}${C}`),x(`${e}${E}`),x(`${e}${R}`);const i=P(t);a.default.remove(i,null==o?void 0:o.session);const r=J(n);a.default.remove(r,null==o?void 0:o.refresh)}const F=(e,t,n)=>o=>{const i=Object.assign(o,{token:o.token||L(e,t)});if(!n){const t=function(e=""){return O(`${e}${R}`)}(e);t&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-refresh-cookie-name":t}))}const r=function(e=""){return O(`${e}DTD`)||""}(e);return r&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-trusted-device-token":r})),i},M=c&&(null===localStorage||void 0===localStorage?void 0:localStorage.getItem("fingerprint.endpoint.url"))||"https://api.descope.com",W="vsid",H="vrid",B="fp",z=(e=!1)=>{const t=O(B);if(!t)return null;const n=JSON.parse(t);return(new Date).getTime()>n.expiry&&!e?null:n.value},G=async(e,t=M)=>{try{if(z())return;const n=(Date.now().toString(36)+Math.random().toString(36).substring(2)+Math.random().toString(36).substring(2)).substring(0,27),o=new URL(t);o.pathname="/fXj8gt3x8VulJBna/x96Emn69oZwcd7I6";const r=new URL(t);r.pathname="/fXj8gt3x8VulJBna/w78aRZnnDZ3Aqw0I";const s=r.toString()+"?apiKey=<apiKey>&version=<version>&loaderVersion=<loaderVersion>",a=i.load({apiKey:e,endpoint:[o.toString(),i.defaultEndpoint],scriptUrlPattern:[s,i.defaultScriptUrlPattern]}),l=await a,{requestId:c}=await l.get({linkedId:n}),u=((e,t)=>({[W]:e,[H]:t}))(n,c);(e=>{const t={value:e,expiry:(new Date).getTime()+864e5};I(B,JSON.stringify(t))})(u)}catch(e){console.warn("Could not load fingerprint",e)}},X=e=>{const t=z(!0);return t&&e.body&&(e.body.fpData=t),e},Z="descopeFlowNonce",Y="X-Descope-Flow-Nonce",Q="/v1/flow/start",ee="/v1/flow/next",te=(e,t=Z)=>`${t}${e}`,ne=(e,t=Z)=>{try{const n=te(e,t);x(n)}catch(e){console.error("Error removing flow nonce:",e)}},oe=e=>{var t;return(null===(t=/.*\|#\|(.*)/.exec(e))||void 0===t?void 0:t[1])||null},ie=e=>{var t;return e.path===ee&&(null===(t=e.body)||void 0===t?void 0:t.executionId)?oe(e.body.executionId):null},re="dls_last_user_login_id",se="dls_last_user_display_name",ae=e=>I(re,e),le=()=>O(re),ce=()=>O(se),ue=e=>async(...t)=>{var n;t[1]=t[1]||{};const[,o={}]=t,i=le(),r=ce();i&&(null!==(n=o.lastAuth)&&void 0!==n||(o.lastAuth={}),o.lastAuth.loginId=i,o.lastAuth.name=r);return await e(...t)},de=e=>t=>async(...n)=>{const o=await t(...n);return e||(x(re),x(se)),o},pe="DSLI",fe=e=>async(...t)=>{const n=await e(...t);return x(pe),n};function ge(){const e=[];return{pub:t=>{e.forEach((e=>e(t)))},sub:t=>{const n=e.push(t)-1;return()=>e.splice(n,1)}}}const ve=(e,t,n,o)=>i=>async(...r)=>{const s=await i(...r);return V(e,t,n,null==o?void 0:o()),s};async function he(e){const t=function(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=_e(n.publicKey.challenge),n.publicKey.user.id=_e(n.publicKey.user.id),null===(t=n.publicKey.excludeCredentials)||void 0===t||t.forEach((e=>{e.id=_e(e.id)})),n}(e);try{const e=await navigator.credentials.create(t);return n=e,JSON.stringify({id:n.id,rawId:Ie(n.rawId),type:n.type,response:{attestationObject:Ie(n.response.attestationObject),clientDataJSON:Ie(n.response.clientDataJSON)}})}catch(e){throw await ye(e,t,!0)}var n}async function we(e){const t=ke(e);try{return Se(await navigator.credentials.get(t))}catch(e){throw await ye(e,t,!1)}}async function me(e,t){const n=ke(e);n.signal=t.signal,n.mediation="conditional";try{return Se(await navigator.credentials.get(n))}catch(e){throw await ye(e,n,!1)}}async function ye(e,t,n){if(e&&"object"==typeof e)try{e.reason=await async function(e,t,n){var o,i;const r=null==e?void 0:e.name;if("AbortError"===r&&(null==t?void 0:t.signal)instanceof AbortSignal)return"aborted";if("InvalidStateError"===r&&n)return"authenticator_already_registered";if("NotSupportedError"===r)return"no_supported_algorithm";if("ConstraintError"===r)return"authenticator_constraints_unsupported";if("SecurityError"===r){const e=window.location.hostname;return"localhost"===e||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)?"invalid_rpid":"invalid_domain"}if(!await be())return"webauthn_unsupported";const s="platform"===(null===(i=null===(o=null==t?void 0:t.publicKey)||void 0===o?void 0:o.authenticatorSelection)||void 0===i?void 0:i.authenticatorAttachment);return n&&s&&!await be(!0)?"platform_authenticator_unsupported":"NotAllowedError"===r?"not_allowed":"unknown"}(e,t,n)}catch(e){}return e}async function be(e=!1){var t,n;if(!c)return Promise.resolve(!1);if(k()){const e=null===(n=null===(t=window.descopeBridge)||void 0===t?void 0:t.hostInfo)||void 0===n?void 0:n.webauthn;if("boolean"==typeof e)return e}const o=!!(window.PublicKeyCredential&&navigator.credentials&&navigator.credentials.create&&navigator.credentials.get);return o&&e&&PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():o}function ke(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=_e(n.publicKey.challenge),null===(t=n.publicKey.allowCredentials)||void 0===t||t.forEach((e=>{e.id=_e(e.id)})),n}function Se(e){return JSON.stringify({id:e.id,rawId:Ie(e.rawId),type:e.type,response:{authenticatorData:Ie(e.response.authenticatorData),clientDataJSON:Ie(e.response.clientDataJSON),signature:Ie(e.response.signature),userHandle:e.response.userHandle?Ie(e.response.userHandle):void 0}})}function _e(e){const t=e.replace(/_/g,"/").replace(/-/g,"+");return Uint8Array.from(atob(t),(e=>e.charCodeAt(0))).buffer}function Ie(e){return btoa(String.fromCharCode.apply(null,new Uint8Array(e))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}var Oe,xe=(Oe=e=>({async signUp(t,n,o){const i=await e.webauthn.signUp.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await he(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,r)},async signIn(t,n){const o=await e.webauthn.signIn.start(t,window.location.origin,void 0,void 0,n);if(!o.ok)return o;const i=await we(o.data.options);return await e.webauthn.signIn.finish(o.data.transactionId,i)},async signUpOrIn(t,n){var o;const i=await e.webauthn.signUpOrIn.start(t,window.location.origin,n);if(!i.ok)return i;if(null===(o=i.data)||void 0===o?void 0:o.create){const t=await he(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,t)}{const t=await we(i.data.options);return await e.webauthn.signIn.finish(i.data.transactionId,t)}},async update(t,n,o){const i=await e.webauthn.update.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await he(i.data.options);return await e.webauthn.update.finish(i.data.transactionId,r)},helpers:{create:he,get:we,isSupported:be,conditional:me}}),(...e)=>{const t=Oe(...e);return Object.assign(t.signUp,e[0].webauthn.signUp),Object.assign(t.signIn,e[0].webauthn.signIn),Object.assign(t.signUpOrIn,e[0].webauthn.signUpOrIn),Object.assign(t.update,e[0].webauthn.update),t});const je={config:"/fedcm/config"},De=()=>{if(window.crypto&&window.crypto.getRandomValues){const e=new Uint8Array(16);return window.crypto.getRandomValues(e),Array.from(e,(e=>e.toString(16).padStart(2,"0"))).join("")}return Math.random().toString(36).substring(2)};async function Te(e,t){var n;try{await Ue(e,t)}catch(e){null===(n=null==t?void 0:t.onFailed)||void 0===n||n.call(t,e)}}async function Ue(e,t){var n,o;const i=await async function(e,t="google",n,o,i){const r=De(),s=await async function(){return new Promise(((e,t)=>{if(window.google)return void e(window.google.accounts.id);let n=document.getElementById("google-gsi-client-script");n||(n=document.createElement("script"),document.head.appendChild(n),n.async=!0,n.defer=!0,n.id="google-gsi-client-script",n.src="https://accounts.google.com/gsi/client"),n.onload=function(){window.google?e(window.google.accounts.id):t("Failed to load Google GSI client script - not loaded properly")},n.onerror=function(){t("Failed to load Google GSI client script - failed to load")}}))}(),a=await e.oauth.getOneTapClientId(t);if(!a.ok)throw new Error("Failed to get OneTap client ID for provider "+t);const l=a.data.clientId;return new Promise((e=>{var a,c;const u=n=>{e({provider:t,nonce:r,credential:null==n?void 0:n.credential})};s.initialize(Object.assign(Object.assign({},n),{itp_support:null===(a=null==n?void 0:n.itp_support)||void 0===a||a,use_fedcm_for_prompt:null===(c=null==n?void 0:n.use_fedcm_for_prompt)||void 0===c||c,client_id:l,callback:u,nonce:r})),s.prompt((e=>{var t,n;if(i&&(null==e?void 0:e.isDismissedMoment())){const n=null===(t=e.getDismissedReason)||void 0===t?void 0:t.call(e);return null==i||i(n),void u()}if(o&&(null==e?void 0:e.isSkippedMoment())){const t=null===(n=e.getSkippedReason)||void 0===n?void 0:n.call(e);return null==o||o(t),void u()}}))}))}(e,t.provider,t.oneTapConfig,t.onSkipped,t.onDismissed);if(!i.credential)return null;if(null==t?void 0:t.onCodeReceived){const o=await e.oauth.verifyOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!o.ok||!o.data)throw new Error("Failed to verify OneTap client ID for provider "+i.provider);null===(n=null==t?void 0:t.onCodeReceived)||void 0===n||n.call(t,o.data.code)}else{const n=await e.oauth.exchangeOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!n.ok||!n.data)throw new Error("Failed to exchange OneTap client ID for provider "+i.provider);null===(o=null==t?void 0:t.onAuthenticated)||void 0===o||o.call(t,n.data)}}var Ce=e=>Object.assign(Object.assign({},e.flow),{start:async(...t)=>{const n=await be(),o=Object.assign(Object.assign({location:window.location.href},t[1]),{deviceInfo:{webAuthnSupport:n},startOptionsVersion:1});return t[1]=o,e.flow.start(...t)}});const Ae=()=>window.location.search.includes("code")&&window.location.search.includes("state");let Ee;const Re=(e,t)=>new Promise(((n,o)=>{if(!e.length)return o(new Error("No URLs provided to loadScriptWithFallback"));const i=t();if(i)return n(i);const r=e.shift(),s=document.createElement("script");s.src=r,s.id=(e=>{let t=0;for(let n=0;n<e.length;n++)t=(t<<5)-t+e.charCodeAt(n),t|=0;return Math.abs(t).toString(16)})(r),s.onload=()=>{const e=t();if(e)return n(e);throw new Error("Could not get entry after loading script from URL")},s.addEventListener("error",(()=>{Re(e,t),s.setAttribute("data-error","true")})),document.body.appendChild(s)}));const $e=async(e,t,n)=>{Ee||(Ee=(async()=>{try{return require("oidc-client-ts")}catch(e){return Re([d,p],(()=>window.oidc))}})());const{OidcClient:o,WebStorageStateStore:i}=await Ee;if(!o)throw new Error("oidc-client-ts is not installed. Please install it by running `npm install oidc-client-ts`");const r=(null==n?void 0:n.redirectUri)||window.location.href;let s,a,l,c;if(null==n?void 0:n.issuer){if(!n.clientId)throw new Error("clientId is required when providing a custom issuer/authority");s=n.issuer,a=n.clientId,l=`${a}_user`,c="openid"}else(null==n?void 0:n.applicationId)?(s=e.httpClient.buildUrl(t),s=`${s}/${n.applicationId}`,a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access"):(s=e.httpClient.buildUrl(t),a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access");const u={authority:s,client_id:a,redirect_uri:r,response_type:"code",scope:(null==n?void 0:n.scope)||c,stateStore:new i({store:window.localStorage,prefix:a}),loadUserInfo:!0,fetchRequestCredentials:"same-origin"};return(null==n?void 0:n.redirectUri)&&(u.redirect_uri=n.redirectUri),{client:new o(u),stateUserKey:l}},Ne=(e,t,n)=>{const o=async()=>{let o,i;return o&&i||({client:o,stateUserKey:i}=await $e(e,t,n)),{client:o,stateUserKey:i}},i=async(t="")=>{var n;const{client:i,stateUserKey:r}=await o(),s=await i.processSigninResponse(t||window.location.href);var a;return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(s)))),I(r,JSON.stringify({id_token:(a=s).id_token,session_state:a.session_state,profile:a.profile})),(()=>{const e=new URL(window.location.href);e.searchParams.delete("code"),e.searchParams.delete("state"),window.history.replaceState({},document.title,e.toString())})(),s};return{loginWithRedirect:async(t={},n=!1)=>{var i;const{client:r}=await o(),s=await r.createSigninRequest(t),{url:a}=s;return n||(await(null===(i=e.httpClient.hooks)||void 0===i?void 0:i.afterRequest({},new Response(JSON.stringify(s)))),window.location.href=a),{ok:!0,data:s}},finishLogin:i,finishLoginIfNeed:async(e="")=>{if(Ae())return await i(e)},refreshToken:async t=>{var n;const{client:i,stateUserKey:r}=await o(),s=(e=>{const t=O(e);return t?JSON.parse(t):null})(r);if(!s)throw new Error("User not found in storage to refresh token");let a=t;if(!a){const t={};e.httpClient.hooks.beforeRequest(t),a=t.token}const l=await i.useRefreshToken({state:{refresh_token:a,session_state:s.session_state,profile:s.profile}});return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(l)))),l},logout:async(e,t=!1)=>{const{client:n,stateUserKey:i}=await o();e||(e={}),e.id_token_hint=e.id_token_hint||K(),e.post_logout_redirect_uri=e.post_logout_redirect_uri||window.location.href;const r=await n.createSignoutRequest(e),{url:s}=r;return x(i),t||window.location.replace(s),r}}},Pe=function(...e){return t=>e.reduce(((e,t)=>t(e)),t)}((e=>t=>{var n;return n=t.customStorage,g=n,e(t)}),(t=>n=>{var{fpKey:o,fpLoad:i}=n,r=e.__rest(n,["fpKey","fpLoad"]);return c?(o&&i&&G(o).catch((()=>null)),t(y(r,{beforeRequest:X}))):t(r)}),(e=>t=>e(Object.assign(Object.assign({},t),{baseHeaders:Object.assign({"x-descope-sdk-name":"web-js","x-descope-sdk-version":"1.51.2"},t.baseHeaders)}))),(e=>t=>{const o=ge(),i=ge(),r=ge(),s=ge(),a=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, notifying subscribers with empty values"),i.pub(null),r.pub(null),o.pub(null),s.pub(null);else{const e=await(async e=>{const t=await b(e);return(null==t?void 0:t.user)||((null==t?void 0:t.hasOwnProperty("userId"))?t:void 0)})(t);e&&r.pub(e);const{sessionJwt:n,sessionExpiration:a,claims:l}=await b(t);n&&i.pub(n),l&&s.pub(l),(a||n)&&o.pub(a||42)}}})),l=n.wrapWith(a,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return i.pub(null),r.pub(null),o.pub(null),s.pub(null),n}));return Object.assign(l,{onSessionTokenChange:i.sub,onUserChange:r.sub,onClaimsChange:s.sub,onIsAuthenticatedChange:e=>o.sub((t=>{e(!!t)}))})}),(t=>n=>{var o;const{enableFlowNonce:i=!0,nonceStoragePrefix:r=Z}=n,s=e.__rest(n,["enableFlowNonce","nonceStoragePrefix"]);if(!i)return t(s);((e=Z)=>{try{if(!_)return;for(let i=0;i<(t=void 0,n=void 0,o=void 0,null!==(o=null!==(t=null==g?void 0:g.length)&&void 0!==t?t:c&&(null===(n=window.localStorage)||void 0===n?void 0:n.length))&&void 0!==o?o:0);i++){const t=j(i);if(t&&t.startsWith(e)){const e=O(t);if(e)try{JSON.parse(e).expiry<Date.now()&&x(t)}catch(e){x(t)}}}}catch(e){console.error("Error cleaning up expired nonces:",e)}var t,n,o})(r);const a=t(y(s,{afterRequest:async(e,t)=>{if(e.path!==Q&&e.path!==ee)return;const{nonce:n,executionId:o}=await(async(e,t)=>{try{const n=t.headers.get(Y);let o=await t.clone().json().then((e=>(null==e?void 0:e.executionId)||null)).catch((()=>null));return o||(o=ie(e)),{nonce:n,executionId:oe(o)}}catch(e){return{nonce:null,executionId:null}}})(e,t);if(n&&o){((e,t,n,o=Z)=>{try{const i=te(e,o),r=n?172800:10800,s={value:t,expiry:Date.now()+1e3*r,isStart:n};I(i,JSON.stringify(s))}catch(e){console.error("Error setting flow nonce:",e)}})(o,n,e.path===Q,r)}},beforeRequest:e=>{if(e.path===ee){const t=ie(e);if(t){const n=((e,t=Z)=>{try{const n=te(e,t),o=O(n);if(!o)return null;const i=JSON.parse(o);return i.expiry<Date.now()?(ne(e,t),null):i.value}catch(e){return console.error("Error getting flow nonce:",e),null}})(t,r);n&&(e.headers=e.headers||{},e.headers[Y]=n)}}return e}}));if(null===(o=a.flow)||void 0===o?void 0:o.next){let e=Promise.resolve();const t=a.flow.next.bind(a.flow);a.flow.next=async(...n)=>{const o=e;let i;e=new Promise((e=>{i=e})),await o;try{return await t(...n)}finally{i()}}}return a}),(e=>t=>{const o=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))return void x(pe);const n=await b(t);(null==n?void 0:n.sessionExpiration)&&I(pe,String(n.sessionExpiration))}}));return n.wrapWith(o,["logout","logoutAll","oidc.logout"],fe)}),(o=>i=>{var{autoRefresh:r}=i,s=e.__rest(i,["autoRefresh"]);const a=!!r,l="object"==typeof r&&(null==r?void 0:r.customActivityTracking);if(!a||k())return Object.assign(o(s),{markUserActive:()=>{T("markUserActive() called but has no effect")}});const{clearAllTimers:u,setTimer:d}=(()=>{const e=[];return{clearAllTimers:()=>{for(;e.length;)clearTimeout(e.pop())},setTimer:(t,n)=>{e.push(setTimeout(t,n))}}})();let p,f,g=null,v=!1,h=!1;l&&(D("Activity-based refresh enabled"),g=(()=>{let e=!0;return{hadActivity:()=>e,reset:()=>{e=!1},markActive:()=>{e=!0}}})()),c&&document.addEventListener("visibilitychange",(()=>{"visible"===document.visibilityState&&p&&new Date>p&&(D("Expiration time passed, refreshing session"),w.refresh(L()||f))}));const w=o(y(s,{afterRequest:async(e,n)=>{const{sessionJwt:o,refreshJwt:i,sessionExpiration:r,nextRefreshSeconds:s}=await b(n);if(S(e,n))D("Session invalidated, canceling all timers"),u();else if(o||r){if(p=((e,n)=>{if(n)return new Date(1e3*n);D("Could not extract expiration time from session token, trying to decode the token");try{const n=t.jwtDecode(e);if(n.exp)return new Date(1e3*n.exp)}catch(e){return null}})(o,r),!p)return void D("Could not extract expiration time from session token");f=i,v=s>0;const e=U(p,s);if(u(),e<=2e4)return void D("Session is too close to expiration, not setting refresh timer");const n=new Date(Date.now()+e).toLocaleTimeString("en-US",{hour12:!1});D(`Setting refresh timer for ${n}. (${e}ms)`),g&&(g.reset(),h=!1),d((()=>{if(c&&"hidden"===document.visibilityState)D("Skipping refresh due to timer - document is hidden");else{if(g&&v&&!g.hadActivity())return D("Skipping refresh due to timer - user is idle"),void(h=!0);D("Refreshing session due to timer"),w.refresh(L()||i)}}),e)}}}));return Object.assign(n.wrapWith(w,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return D("Clearing all timers"),u(),n})),{markUserActive:g?()=>{D("markUserActive() called"),v||D("markUserActive() called but server does not have inactivity timeout configured (no nextRefreshSeconds)"),g.markActive(),h&&(D("User became active after skipped refresh, triggering refresh"),h=!1,u(),w.refresh(L()||f))}:()=>{T("markUserActive() called but customActivityTracking is not enabled — this call has no effect")}})}),(t=>o=>{var{storeLastAuthenticatedUser:i=!0,keepLastAuthenticatedUserAfterLogout:r=!1}=o,s=e.__rest(o,["storeLastAuthenticatedUser","keepLastAuthenticatedUserAfterLogout"]);if(!i)return Object.assign(t(s),{getLastUserLoginId:le,getLastUserDisplayName:ce});const a=t(y(s,{afterRequest:async(e,t)=>{var n;const{userInfo:o,lastAuth:i}=await(async e=>{if(!(null==e?void 0:e.ok))return{userInfo:void 0,lastAuth:void 0};const t=await(null==e?void 0:e.clone().json()),n=m((null==t?void 0:t.authInfo)||t||{});return{userInfo:(null==n?void 0:n.user)||((null==n?void 0:n.hasOwnProperty("userId"))?n:void 0),lastAuth:t.lastAuth}})(t),r=null===(n=null==o?void 0:o.loginIds)||void 0===n?void 0:n[0],s=null==o?void 0:o.name;r?(ae(r),(e=>{I(se,e)})(s)):(null==i?void 0:i.loginId)&&ae(i.loginId)}}));let l=n.wrapWith(a,["flow.start"],ue);return l=n.wrapWith(l,["logout","logoutAll"],de(r)),Object.assign(l,{getLastUserLoginId:le,getLastUserDisplayName:ce})}),(t=>o=>{var{persistTokens:i,sessionTokenViaCookie:r,refreshTokenViaCookie:s,storagePrefix:l,refreshCookieName:u}=o,d=e.__rest(o,["persistTokens","sessionTokenViaCookie","refreshTokenViaCookie","storagePrefix","refreshCookieName"]);if(!i||!c)return t(Object.assign({refreshCookieName:u},d));let p;const f=t(y(Object.assign({refreshCookieName:u},d),{beforeRequest:F(l,s,u),afterRequest:async(e,t)=>{if(S(e,t))D("Session invalidated, clearing persisted tokens"),V(l,r,s,p);else{const e=await b(t);e.cookieName?I(`${l||""}${R}`,e.cookieName):e.refreshJwt&&x(`${l||""}${R}`);const n=((e={},t=!1,n="",o=!1)=>{var i,r,s,l;const{sessionJwt:c,refreshJwt:u,trustedDeviceJwt:d}=e;let p;if(u)if(o){x(`${n}${A}`);const t=o.sameSite||"Strict",s=null===(i=o.secure)||void 0===i||i,a=null!==(r=o.domain)&&void 0!==r?r:e.cookieDomain,l=J(o);s&&"https:"!==window.location.protocol&&T("Refresh token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass refreshTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const c=Object.assign(Object.assign({},e),{cookieSameSite:t,cookieSecure:s,cookieDomain:a});$(l,u,c);const d=N(a);p=Object.assign(Object.assign({},p),{refresh:{path:c.cookiePath,domain:d?a:void 0}})}else{const e=J(o);a.default.remove(e),I(`${n}${A}`,u)}if(c)if(t){const n=t.sameSite||"Strict",o=null===(s=t.secure)||void 0===s||s,i=null!==(l=t.domain)&&void 0!==l?l:e.cookieDomain,r=P(t);o&&"https:"!==window.location.protocol&&T("Session token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass sessionTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const a=Object.assign(Object.assign({},e),{cookieSameSite:n,cookieSecure:o,cookieDomain:i});$(r,c,a);const u=N(i);p=Object.assign(Object.assign({},p),{session:{path:a.cookiePath,domain:u?i:void 0}})}else I(`${n}${C}`,c);return e.idToken&&I(`${n}${E}`,e.idToken),d&&I(`${n}DTD`,d),p})(e,r,l,s);n&&(p=n)}}})),g=n.wrapWith(f,["logout","logoutAll","oidc.logout"],ve(l,r,s,(()=>p)));return Object.assign(g,{getRefreshToken:()=>L(l,s),getSessionToken:()=>q(l,r),getIdToken:()=>K(l)})}))((e=>{const t=s.default(e),n=Ne(t,e.projectId,e.oidcConfig);return Object.assign(Object.assign({},t),{refresh:async(o,i)=>{var r;if(k())return D(`Refresh called in native flow: ${(new Error).stack}`),Promise.resolve({ok:!1,error:{errorCode:"J171000",errorDescription:"Refresh is not supported in native flows via the web SDK"}});if(e.oidcConfig)try{return await n.refreshToken(o),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161001",errorDescription:e.toString()}})}if(i&&!O(pe)&&!O(re)&&!O("DSLI_DISABLED"))return Promise.resolve({ok:!0});const s=q(),a=L();let l="";if(e.getExternalToken)try{l=await(null===(r=e.getExternalToken)||void 0===r?void 0:r.call(e))}catch(e){D("Error getting external token while refreshing",e)}return t.refresh(o,{dcs:s?"t":"f",dcr:a?"t":"f"},l,i)},logout:async o=>{if(e.oidcConfig)try{return await n.logout({id_token_hint:o}),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161000",errorDescription:e.toString()}})}return t.logout(o)},flow:Ce(t),webauthn:xe(t),fedcm:(o=t,i=e.projectId,{onetap:{requestExchangeCode(e){Te(o,e)},requestAuthentication(e){Te(o,e)}},async oneTap(e,t,n,i,r){await Ue(o,{provider:e,oneTapConfig:t,loginOptions:n,onSkipped:i,onDismissed:r})},async launch(e){var t;const n={identity:{context:e||"signin",providers:[{configURL:o.httpClient.buildUrl(i+je.config),clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(n));return o.refresh(r.token)},isSupported:()=>c&&"IdentityCredential"in window,async isLoggedIn(e){var t;const n=o.httpClient.buildUrl(i+je.config);try{const o={identity:{context:e||"signin",providers:[{configURL:n,clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(o));return!!r&&!!r.token}catch(e){return!1}}}),oidc:n});var o,i}));exports.REFRESH_TOKEN_KEY=A,exports.SESSION_TOKEN_KEY=C,exports.clearFingerprintData=()=>{x(B)},exports.createSdk=Pe,exports.default=Pe,exports.ensureFingerprintIds=G,exports.getSessionToken=q,exports.hasOidcParamsInUrl=Ae;
1
+ "use strict";Object.defineProperty(exports,"__esModule",{value:!0});var e=require("tslib"),t=require("jwt-decode"),n=require("@descope/core-js-sdk"),o=require("js-cookie"),i=require("@fingerprintjs/fingerprintjs-pro");function r(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var s=r(n),a=r(o);const l="3.2.0",c="undefined"!=typeof window,d=Math.pow(2,31)-1,u=`https://descopecdn.com/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`,p=`https://cdn.jsdelivr.net/npm/oidc-client-ts@${l}/dist/browser/oidc-client-ts.min.js`;const f=["/v1/auth/refresh","/v1/auth/try-refresh","/v1/auth/me","/v1/auth/me/tenants","/v1/auth/me/history"];let v;const g=e=>{try{return t.jwtDecode(e).exp}catch(e){return null}},w=e=>{const{refresh_expire_in:t,refresh_token:n}=e;return t?Math.floor(Date.now()/1e3)+t:g(n)},h=e=>{const{expires_in:t,expires_at:n,access_token:o}=e;return n||(t?Math.floor(Date.now()/1e3)+t:o?g(o):void 0)},m=t=>{const{access_token:n,id_token:o,refresh_token:i,refresh_expire_in:r}=t,s=e.__rest(t,["access_token","id_token","refresh_token","refresh_expire_in"]);return Object.assign({sessionJwt:t.sessionJwt||n,idToken:o,refreshJwt:t.refreshJwt||i,sessionExpiration:t.sessionExpiration||h(t),cookieExpiration:t.cookieExpiration||w(t)},s)},y=(e,t)=>{var n;return["beforeRequest","afterRequest"].reduce(((n,o)=>{var i;return n[o]=[].concat((null===(i=e.hooks)||void 0===i?void 0:i[o])||[]).concat((null==t?void 0:t[o])||[]),n}),null!==(n=e.hooks)&&void 0!==n?n:e.hooks={}),e},b=async e=>{if(!(null==e?void 0:e.ok))return{};const t=await(null==e?void 0:e.clone().json()),n=(null==t?void 0:t.authInfo)||t||{};return m(n)},k=()=>c&&!!window.descopeBridge,S=(e,t)=>{if(!((null==t?void 0:t.status)>=400&&(null==t?void 0:t.status)<500))return!1;const n=(null==e?void 0:e.path)||"";return f.includes(n)},_=void 0!==v||c&&void 0!==window.localStorage,I=(e,t)=>{var n,o;return null===(o=null===(n=v||c&&window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o?void 0:o.call(n,e,t)},O=e=>{var t,n;return null===(n=null===(t=v||c&&window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e)},x=e=>{var t,n;return null===(n=null===(t=v||c&&window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n?void 0:n.call(t,e)},j=e=>{var t,n,o,i,r;return null!==(r=null!==(n=null===(t=null==v?void 0:v.key)||void 0===t?void 0:t.call(v,e))&&void 0!==n?n:c&&(null===(i=null===(o=window.localStorage)||void 0===o?void 0:o.key)||void 0===i?void 0:i.call(o,e)))&&void 0!==r?r:null},D=e=>{var t,n;return c&&(null===(n=null===(t=window.localStorage)||void 0===t?void 0:t.getItem)||void 0===n?void 0:n.call(t,e))||null},T=e=>{var t,n;try{c&&(null===(n=null===(t=window.localStorage)||void 0===t?void 0:t.removeItem)||void 0===n||n.call(t,e))}catch(e){}},U=(...e)=>{console.debug(...e)},C=(...e)=>{console.warn(...e)},A=(e,t)=>{let n;var o;return t>0?(n=1e3*t,U(`Using provided nextRefreshSeconds: ${t}s`)):n=((o=e)?o.getTime()-(new Date).getTime():0)-2e4,n>d&&(U(`Timeout is too large (${n}ms), setting it to ${d}ms`),n=d),n},E="DS",R="DSR",$="DSI",N="DSRCN";function q(e,t,n){if(t){const{cookieDomain:o,cookiePath:i,cookieSameSite:r,cookieExpiration:s,cookieSecure:l}=n,c=new Date(1e3*s),d=P(o);a.default.set(e,t,{path:i,domain:d?o:void 0,expires:c,sameSite:r,secure:l})}}function P(e){const t=window.location.hostname.split("."),n=null==e?void 0:e.split(".");return t.slice(-(null==n?void 0:n.length)).join(".")===e}const J=e=>(null==e?void 0:e.cookieName)||E,L=e=>(null==e?void 0:e.cookieName)||R;function K(e="",t){return a.default.get(L(t))||O(`${e}${R}`)||""}function V(e="",t){return a.default.get(J(t))||O(`${e}${E}`)||""}function F(e=""){return O(`${e}${$}`)||""}function M(e="",t,n,o){x(`${e}${R}`),x(`${e}${E}`),x(`${e}${$}`),x(`${e}${N}`);const i=J(t);a.default.remove(i,null==o?void 0:o.session);const r=L(n);a.default.remove(r,null==o?void 0:o.refresh)}const W=(e,t,n)=>o=>{const i=Object.assign(o,{token:o.token||K(e,t)});if(!n){const t=function(e=""){return O(`${e}${N}`)}(e);t&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-refresh-cookie-name":t}))}const r=function(e=""){return O(`${e}DTD`)||""}(e);return r&&(i.headers=Object.assign(Object.assign({},i.headers||{}),{"x-descope-trusted-device-token":r})),i},H=c&&(null===localStorage||void 0===localStorage?void 0:localStorage.getItem("fingerprint.endpoint.url"))||"https://api.descope.com",B="vsid",z="vrid",G="fp",X=(e=!1)=>{const t=O(G);if(!t)return null;const n=JSON.parse(t);return(new Date).getTime()>n.expiry&&!e?null:n.value},Z=async(e,t=H)=>{try{if(X())return;const n=(Date.now().toString(36)+Math.random().toString(36).substring(2)+Math.random().toString(36).substring(2)).substring(0,27),o=new URL(t);o.pathname="/fXj8gt3x8VulJBna/x96Emn69oZwcd7I6";const r=new URL(t);r.pathname="/fXj8gt3x8VulJBna/w78aRZnnDZ3Aqw0I";const s=r.toString()+"?apiKey=<apiKey>&version=<version>&loaderVersion=<loaderVersion>",a=i.load({apiKey:e,endpoint:[o.toString(),i.defaultEndpoint],scriptUrlPattern:[s,i.defaultScriptUrlPattern]}),l=await a,{requestId:c}=await l.get({linkedId:n}),d=((e,t)=>({[B]:e,[z]:t}))(n,c);(e=>{const t={value:e,expiry:(new Date).getTime()+864e5};I(G,JSON.stringify(t))})(d)}catch(e){console.warn("Could not load fingerprint",e)}},Y=e=>{const t=X(!0);return t&&e.body&&(e.body.fpData=t),e},Q="descopeFlowNonce",ee="X-Descope-Flow-Nonce",te="/v1/flow/start",ne="/v1/flow/next",oe=(e,t=Q)=>`${t}${e}`,ie=(e,t=Q)=>{try{const n=oe(e,t),o=O(n);if(!o)return null;const i=JSON.parse(o);return i.expiry<Date.now()?(re(e,t),null):{value:i.value,seq:i.seq}}catch(e){return console.error("Error getting flow nonce:",e),null}},re=(e,t=Q)=>{try{const n=oe(e,t);x(n)}catch(e){console.error("Error removing flow nonce:",e)}},se=e=>{var t;return(null===(t=/.*\|#\|(.*)/.exec(e))||void 0===t?void 0:t[1])||null},ae=async(e,t)=>{try{const n=t.headers.get(ee),o=null===n?void 0:(e=>{const t=e.indexOf(".");if(t<=0)return;const n=e.slice(0,t);if(!/^\d+$/.test(n))return;const o=Number(n);return Number.isSafeInteger(o)?o:void 0})(n);let i=await t.clone().json().then((e=>(null==e?void 0:e.executionId)||null)).catch((()=>null));return i||(i=le(e)),{nonce:n,seq:o,executionId:se(i)}}catch(e){return{nonce:null,seq:void 0,executionId:null}}},le=e=>{var t;return e.path===ne&&(null===(t=e.body)||void 0===t?void 0:t.executionId)?se(e.body.executionId):null},ce="dls_last_user_login_id",de="dls_last_user_display_name",ue=e=>I(ce,e),pe=()=>O(ce),fe=()=>O(de),ve=e=>async(...t)=>{var n;t[1]=t[1]||{};const[,o={}]=t,i=pe(),r=fe();i&&(null!==(n=o.lastAuth)&&void 0!==n||(o.lastAuth={}),o.lastAuth.loginId=i,o.lastAuth.name=r);return await e(...t)},ge=e=>t=>async(...n)=>{const o=await t(...n);return e||(x(ce),x(de)),o},we="DSLI",he=e=>async(...t)=>{const n=await e(...t);return T(we),n};function me(){const e=[];return{pub:t=>{e.forEach((e=>e(t)))},sub:t=>{const n=e.push(t)-1;return()=>e.splice(n,1)}}}const ye=(e,t,n,o)=>i=>async(...r)=>{const s=await i(...r);return M(e,t,n,null==o?void 0:o()),s};async function be(e){const t=function(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=je(n.publicKey.challenge),n.publicKey.user.id=je(n.publicKey.user.id),null===(t=n.publicKey.excludeCredentials)||void 0===t||t.forEach((e=>{e.id=je(e.id)})),n}(e);try{const e=await navigator.credentials.create(t);return n=e,JSON.stringify({id:n.id,rawId:De(n.rawId),type:n.type,response:{attestationObject:De(n.response.attestationObject),clientDataJSON:De(n.response.clientDataJSON)}})}catch(e){throw await _e(e,t,!0)}var n}async function ke(e){const t=Oe(e);try{return xe(await navigator.credentials.get(t))}catch(e){throw await _e(e,t,!1)}}async function Se(e,t){const n=Oe(e);n.signal=t.signal,n.mediation="conditional";try{return xe(await navigator.credentials.get(n))}catch(e){throw await _e(e,n,!1)}}async function _e(e,t,n){if(e&&"object"==typeof e)try{e.reason=await async function(e,t,n){var o,i;const r=null==e?void 0:e.name;if("AbortError"===r&&(null==t?void 0:t.signal)instanceof AbortSignal)return"aborted";if("InvalidStateError"===r&&n)return"authenticator_already_registered";if("NotSupportedError"===r)return"no_supported_algorithm";if("ConstraintError"===r)return"authenticator_constraints_unsupported";if("SecurityError"===r){const e=window.location.hostname;return"localhost"===e||/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e)?"invalid_rpid":"invalid_domain"}if(!await Ie())return"webauthn_unsupported";const s="platform"===(null===(i=null===(o=null==t?void 0:t.publicKey)||void 0===o?void 0:o.authenticatorSelection)||void 0===i?void 0:i.authenticatorAttachment);return n&&s&&!await Ie(!0)?"platform_authenticator_unsupported":"NotAllowedError"===r?"not_allowed":"unknown"}(e,t,n)}catch(e){}return e}async function Ie(e=!1){var t,n;if(!c)return Promise.resolve(!1);if(k()){const e=null===(n=null===(t=window.descopeBridge)||void 0===t?void 0:t.hostInfo)||void 0===n?void 0:n.webauthn;if("boolean"==typeof e)return e}const o=!!(window.PublicKeyCredential&&navigator.credentials&&navigator.credentials.create&&navigator.credentials.get);return o&&e&&PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable():o}function Oe(e){var t;const n=JSON.parse(e);return n.publicKey.challenge=je(n.publicKey.challenge),null===(t=n.publicKey.allowCredentials)||void 0===t||t.forEach((e=>{e.id=je(e.id)})),n}function xe(e){return JSON.stringify({id:e.id,rawId:De(e.rawId),type:e.type,response:{authenticatorData:De(e.response.authenticatorData),clientDataJSON:De(e.response.clientDataJSON),signature:De(e.response.signature),userHandle:e.response.userHandle?De(e.response.userHandle):void 0}})}function je(e){const t=e.replace(/_/g,"/").replace(/-/g,"+");return Uint8Array.from(atob(t),(e=>e.charCodeAt(0))).buffer}function De(e){return btoa(String.fromCharCode.apply(null,new Uint8Array(e))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}var Te,Ue=(Te=e=>({async signUp(t,n,o){const i=await e.webauthn.signUp.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await be(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,r)},async signIn(t,n){const o=await e.webauthn.signIn.start(t,window.location.origin,void 0,void 0,n);if(!o.ok)return o;const i=await ke(o.data.options);return await e.webauthn.signIn.finish(o.data.transactionId,i)},async signUpOrIn(t,n){var o;const i=await e.webauthn.signUpOrIn.start(t,window.location.origin,n);if(!i.ok)return i;if(null===(o=i.data)||void 0===o?void 0:o.create){const t=await be(i.data.options);return await e.webauthn.signUp.finish(i.data.transactionId,t)}{const t=await ke(i.data.options);return await e.webauthn.signIn.finish(i.data.transactionId,t)}},async update(t,n,o){const i=await e.webauthn.update.start(t,window.location.origin,n,o);if(!i.ok)return i;const r=await be(i.data.options);return await e.webauthn.update.finish(i.data.transactionId,r)},helpers:{create:be,get:ke,isSupported:Ie,conditional:Se}}),(...e)=>{const t=Te(...e);return Object.assign(t.signUp,e[0].webauthn.signUp),Object.assign(t.signIn,e[0].webauthn.signIn),Object.assign(t.signUpOrIn,e[0].webauthn.signUpOrIn),Object.assign(t.update,e[0].webauthn.update),t});const Ce={config:"/fedcm/config"},Ae=()=>{if(window.crypto&&window.crypto.getRandomValues){const e=new Uint8Array(16);return window.crypto.getRandomValues(e),Array.from(e,(e=>e.toString(16).padStart(2,"0"))).join("")}return Math.random().toString(36).substring(2)};async function Ee(e,t){var n;try{await Re(e,t)}catch(e){null===(n=null==t?void 0:t.onFailed)||void 0===n||n.call(t,e)}}async function Re(e,t){var n,o;const i=await async function(e,t="google",n,o,i){const r=Ae(),s=await async function(){return new Promise(((e,t)=>{if(window.google)return void e(window.google.accounts.id);let n=document.getElementById("google-gsi-client-script");n||(n=document.createElement("script"),document.head.appendChild(n),n.async=!0,n.defer=!0,n.id="google-gsi-client-script",n.src="https://accounts.google.com/gsi/client"),n.onload=function(){window.google?e(window.google.accounts.id):t("Failed to load Google GSI client script - not loaded properly")},n.onerror=function(){t("Failed to load Google GSI client script - failed to load")}}))}(),a=await e.oauth.getOneTapClientId(t);if(!a.ok)throw new Error("Failed to get OneTap client ID for provider "+t);const l=a.data.clientId;return new Promise((e=>{var a,c;const d=n=>{e({provider:t,nonce:r,credential:null==n?void 0:n.credential})};s.initialize(Object.assign(Object.assign({},n),{itp_support:null===(a=null==n?void 0:n.itp_support)||void 0===a||a,use_fedcm_for_prompt:null===(c=null==n?void 0:n.use_fedcm_for_prompt)||void 0===c||c,client_id:l,callback:d,nonce:r})),s.prompt((e=>{var t,n;if(i&&(null==e?void 0:e.isDismissedMoment())){const n=null===(t=e.getDismissedReason)||void 0===t?void 0:t.call(e);return null==i||i(n),void d()}if(o&&(null==e?void 0:e.isSkippedMoment())){const t=null===(n=e.getSkippedReason)||void 0===n?void 0:n.call(e);return null==o||o(t),void d()}}))}))}(e,t.provider,t.oneTapConfig,t.onSkipped,t.onDismissed);if(!i.credential)return null;if(null==t?void 0:t.onCodeReceived){const o=await e.oauth.verifyOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!o.ok||!o.data)throw new Error("Failed to verify OneTap client ID for provider "+i.provider);null===(n=null==t?void 0:t.onCodeReceived)||void 0===n||n.call(t,o.data.code)}else{const n=await e.oauth.exchangeOneTapIDToken(i.provider,i.credential,i.nonce,null==t?void 0:t.loginOptions);if(!n.ok||!n.data)throw new Error("Failed to exchange OneTap client ID for provider "+i.provider);null===(o=null==t?void 0:t.onAuthenticated)||void 0===o||o.call(t,n.data)}}var $e=e=>Object.assign(Object.assign({},e.flow),{start:async(...t)=>{const n=await Ie(),o=Object.assign(Object.assign({location:window.location.href},t[1]),{deviceInfo:{webAuthnSupport:n},startOptionsVersion:1});return t[1]=o,e.flow.start(...t)}});const Ne=()=>window.location.search.includes("code")&&window.location.search.includes("state");let qe;const Pe=(e,t)=>new Promise(((n,o)=>{if(!e.length)return o(new Error("No URLs provided to loadScriptWithFallback"));const i=t();if(i)return n(i);const r=e.shift(),s=document.createElement("script");s.src=r,s.id=(e=>{let t=0;for(let n=0;n<e.length;n++)t=(t<<5)-t+e.charCodeAt(n),t|=0;return Math.abs(t).toString(16)})(r),s.onload=()=>{const e=t();if(e)return n(e);throw new Error("Could not get entry after loading script from URL")},s.addEventListener("error",(()=>{Pe(e,t),s.setAttribute("data-error","true")})),document.body.appendChild(s)}));const Je=async(e,t,n)=>{qe||(qe=(async()=>{try{return require("oidc-client-ts")}catch(e){return Pe([u,p],(()=>window.oidc))}})());const{OidcClient:o,WebStorageStateStore:i}=await qe;if(!o)throw new Error("oidc-client-ts is not installed. Please install it by running `npm install oidc-client-ts`");const r=(null==n?void 0:n.redirectUri)||window.location.href;let s,a,l,c;if(null==n?void 0:n.issuer){if(!n.clientId)throw new Error("clientId is required when providing a custom issuer/authority");s=n.issuer,a=n.clientId,l=`${a}_user`,c="openid"}else(null==n?void 0:n.applicationId)?(s=e.httpClient.buildUrl(t),s=`${s}/${n.applicationId}`,a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access"):(s=e.httpClient.buildUrl(t),a=t,l=`${a}_user`,c="openid email roles descope.custom_claims offline_access");const d={authority:s,client_id:a,redirect_uri:r,response_type:"code",scope:(null==n?void 0:n.scope)||c,stateStore:new i({store:window.localStorage,prefix:a}),loadUserInfo:!0,fetchRequestCredentials:"same-origin"};return(null==n?void 0:n.redirectUri)&&(d.redirect_uri=n.redirectUri),{client:new o(d),stateUserKey:l}},Le=(e,t,n)=>{const o=async()=>{let o,i;return o&&i||({client:o,stateUserKey:i}=await Je(e,t,n)),{client:o,stateUserKey:i}},i=async(t="")=>{var n;const{client:i,stateUserKey:r}=await o(),s=await i.processSigninResponse(t||window.location.href);var a;return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(s)))),I(r,JSON.stringify({id_token:(a=s).id_token,session_state:a.session_state,profile:a.profile})),(()=>{const e=new URL(window.location.href);e.searchParams.delete("code"),e.searchParams.delete("state"),window.history.replaceState({},document.title,e.toString())})(),s};return{loginWithRedirect:async(t={},n=!1)=>{var i;const{client:r}=await o(),s=await r.createSigninRequest(t),{url:a}=s;return n||(await(null===(i=e.httpClient.hooks)||void 0===i?void 0:i.afterRequest({},new Response(JSON.stringify(s)))),window.location.href=a),{ok:!0,data:s}},finishLogin:i,finishLoginIfNeed:async(e="")=>{if(Ne())return await i(e)},refreshToken:async t=>{var n;const{client:i,stateUserKey:r}=await o(),s=(e=>{const t=O(e);return t?JSON.parse(t):null})(r);if(!s)throw new Error("User not found in storage to refresh token");let a=t;if(!a){const t={};e.httpClient.hooks.beforeRequest(t),a=t.token}const l=await i.useRefreshToken({state:{refresh_token:a,session_state:s.session_state,profile:s.profile}});return await(null===(n=e.httpClient.hooks)||void 0===n?void 0:n.afterRequest({},new Response(JSON.stringify(l)))),l},logout:async(e,t=!1)=>{const{client:n,stateUserKey:i}=await o();e||(e={}),e.id_token_hint=e.id_token_hint||F(),e.post_logout_redirect_uri=e.post_logout_redirect_uri||window.location.href;const r=await n.createSignoutRequest(e),{url:s}=r;return x(i),t||window.location.replace(s),r}}},Ke=function(...e){return t=>e.reduce(((e,t)=>t(e)),t)}((e=>t=>{var n;return n=t.customStorage,v=n,e(t)}),(t=>n=>{var{fpKey:o,fpLoad:i}=n,r=e.__rest(n,["fpKey","fpLoad"]);return c?(o&&i&&Z(o).catch((()=>null)),t(y(r,{beforeRequest:Y}))):t(r)}),(e=>t=>e(Object.assign(Object.assign({},t),{baseHeaders:Object.assign({"x-descope-sdk-name":"web-js","x-descope-sdk-version":"1.51.4"},t.baseHeaders)}))),(e=>t=>{const o=me(),i=me(),r=me(),s=me(),a=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))U("Session invalidated, notifying subscribers with empty values"),i.pub(null),r.pub(null),o.pub(null),s.pub(null);else{const e=await(async e=>{const t=await b(e);return(null==t?void 0:t.user)||((null==t?void 0:t.hasOwnProperty("userId"))?t:void 0)})(t);e&&r.pub(e);const{sessionJwt:n,sessionExpiration:a,claims:l}=await b(t);n&&i.pub(n),l&&s.pub(l),(a||n)&&o.pub(a||42)}}})),l=n.wrapWith(a,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return i.pub(null),r.pub(null),o.pub(null),s.pub(null),n}));return Object.assign(l,{onSessionTokenChange:i.sub,onUserChange:r.sub,onClaimsChange:s.sub,onIsAuthenticatedChange:e=>o.sub((t=>{e(!!t)}))})}),(t=>n=>{var o;const{enableFlowNonce:i=!0,nonceStoragePrefix:r=Q}=n,s=e.__rest(n,["enableFlowNonce","nonceStoragePrefix"]);if(!i)return t(s);((e=Q)=>{try{if(!_)return;for(let i=0;i<(t=void 0,n=void 0,o=void 0,null!==(o=null!==(t=null==v?void 0:v.length)&&void 0!==t?t:c&&(null===(n=window.localStorage)||void 0===n?void 0:n.length))&&void 0!==o?o:0);i++){const t=j(i);if(t&&t.startsWith(e)){const e=O(t);if(e)try{JSON.parse(e).expiry<Date.now()&&x(t)}catch(e){x(t)}}}}catch(e){console.error("Error cleaning up expired nonces:",e)}var t,n,o})(r);const a=t(y(s,{afterRequest:async(e,t)=>{var n;if(e.path!==te&&e.path!==ne)return;const{nonce:o,seq:i,executionId:s}=await ae(e,t);if(!o||!s)return;const a=e.path===te,l=null===(n=ie(s,r))||void 0===n?void 0:n.seq;if(!a&&void 0!==i&&void 0!==l&&i<=l)return;((e,t,n,o=Q,i)=>{try{const r=oe(e,o),s=n?172800:10800,a={value:t,expiry:Date.now()+1e3*s,isStart:n,seq:i};I(r,JSON.stringify(a))}catch(e){console.error("Error setting flow nonce:",e)}})(s,o,a,r,null!=i?i:a?void 0:l)},beforeRequest:e=>{if(e.path===ne){const t=le(e);if(t){const n=((e,t=Q)=>{var n,o;return null!==(o=null===(n=ie(e,t))||void 0===n?void 0:n.value)&&void 0!==o?o:null})(t,r);n&&(e.headers=e.headers||{},e.headers[ee]=n)}}return e}}));if(null===(o=a.flow)||void 0===o?void 0:o.next){let e=Promise.resolve();const t=a.flow.next.bind(a.flow);a.flow.next=async(...n)=>{const o=e;let i;e=new Promise((e=>{i=e})),await o;try{return await t(...n)}finally{i()}}}return a}),(e=>t=>{const o=e(y(t,{afterRequest:async(e,t)=>{if(S(e,t))return void T(we);const n=await b(t);(null==n?void 0:n.sessionExpiration)&&((e,t)=>{var n,o;try{c&&(null===(o=null===(n=window.localStorage)||void 0===n?void 0:n.setItem)||void 0===o||o.call(n,e,t))}catch(e){}})(we,String(n.sessionExpiration))}}));return n.wrapWith(o,["logout","logoutAll","oidc.logout"],he)}),(o=>i=>{var{autoRefresh:r}=i,s=e.__rest(i,["autoRefresh"]);const a=!!r,l="object"==typeof r&&(null==r?void 0:r.customActivityTracking);if(!a||k())return Object.assign(o(s),{markUserActive:()=>{C("markUserActive() called but has no effect")}});const{clearAllTimers:d,setTimer:u}=(()=>{const e=[];return{clearAllTimers:()=>{for(;e.length;)clearTimeout(e.pop())},setTimer:(t,n)=>{e.push(setTimeout(t,n))}}})();let p,f,v=null,g=!1,w=!1;l&&(U("Activity-based refresh enabled"),v=(()=>{let e=!0;return{hadActivity:()=>e,reset:()=>{e=!1},markActive:()=>{e=!0}}})()),c&&document.addEventListener("visibilitychange",(()=>{"visible"===document.visibilityState&&p&&new Date>p&&(U("Expiration time passed, refreshing session"),h.refresh(K()||f))}));const h=o(y(s,{afterRequest:async(e,n)=>{const{sessionJwt:o,refreshJwt:i,sessionExpiration:r,nextRefreshSeconds:s}=await b(n);if(S(e,n))U("Session invalidated, canceling all timers"),d();else if(o||r){if(p=((e,n)=>{if(n)return new Date(1e3*n);U("Could not extract expiration time from session token, trying to decode the token");try{const n=t.jwtDecode(e);if(n.exp)return new Date(1e3*n.exp)}catch(e){return null}})(o,r),!p)return void U("Could not extract expiration time from session token");f=i,g=s>0;const e=A(p,s);if(d(),e<=2e4)return void U("Session is too close to expiration, not setting refresh timer");const n=new Date(Date.now()+e).toLocaleTimeString("en-US",{hour12:!1});U(`Setting refresh timer for ${n}. (${e}ms)`),v&&(v.reset(),w=!1),u((()=>{if(c&&"hidden"===document.visibilityState)U("Skipping refresh due to timer - document is hidden");else{if(v&&g&&!v.hadActivity())return U("Skipping refresh due to timer - user is idle"),void(w=!0);U("Refreshing session due to timer"),h.refresh(K()||i)}}),e)}}}));return Object.assign(n.wrapWith(h,["logout","logoutAll","oidc.logout"],(e=>async(...t)=>{const n=await e(...t);return U("Clearing all timers"),d(),n})),{markUserActive:v?()=>{U("markUserActive() called"),g||U("markUserActive() called but server does not have inactivity timeout configured (no nextRefreshSeconds)"),v.markActive(),w&&(U("User became active after skipped refresh, triggering refresh"),w=!1,d(),h.refresh(K()||f))}:()=>{C("markUserActive() called but customActivityTracking is not enabled — this call has no effect")}})}),(t=>o=>{var{storeLastAuthenticatedUser:i=!0,keepLastAuthenticatedUserAfterLogout:r=!1}=o,s=e.__rest(o,["storeLastAuthenticatedUser","keepLastAuthenticatedUserAfterLogout"]);if(!i)return Object.assign(t(s),{getLastUserLoginId:pe,getLastUserDisplayName:fe});const a=t(y(s,{afterRequest:async(e,t)=>{var n;const{userInfo:o,lastAuth:i}=await(async e=>{if(!(null==e?void 0:e.ok))return{userInfo:void 0,lastAuth:void 0};const t=await(null==e?void 0:e.clone().json()),n=m((null==t?void 0:t.authInfo)||t||{});return{userInfo:(null==n?void 0:n.user)||((null==n?void 0:n.hasOwnProperty("userId"))?n:void 0),lastAuth:t.lastAuth}})(t),r=null===(n=null==o?void 0:o.loginIds)||void 0===n?void 0:n[0],s=null==o?void 0:o.name;r?(ue(r),(e=>{I(de,e)})(s)):(null==i?void 0:i.loginId)&&ue(i.loginId)}}));let l=n.wrapWith(a,["flow.start"],ve);return l=n.wrapWith(l,["logout","logoutAll"],ge(r)),Object.assign(l,{getLastUserLoginId:pe,getLastUserDisplayName:fe})}),(t=>o=>{var{persistTokens:i,sessionTokenViaCookie:r,refreshTokenViaCookie:s,storagePrefix:l,refreshCookieName:d}=o,u=e.__rest(o,["persistTokens","sessionTokenViaCookie","refreshTokenViaCookie","storagePrefix","refreshCookieName"]);if(!i||!c)return t(Object.assign({refreshCookieName:d},u));let p;const f=t(y(Object.assign({refreshCookieName:d},u),{beforeRequest:W(l,s,d),afterRequest:async(e,t)=>{if(S(e,t))U("Session invalidated, clearing persisted tokens"),M(l,r,s,p);else{const e=await b(t);e.cookieName?I(`${l||""}${N}`,e.cookieName):e.refreshJwt&&x(`${l||""}${N}`);const n=((e={},t=!1,n="",o=!1)=>{var i,r,s,l;const{sessionJwt:c,refreshJwt:d,trustedDeviceJwt:u}=e;let p;if(d)if(o){x(`${n}${R}`);const t=o.sameSite||"Strict",s=null===(i=o.secure)||void 0===i||i,a=null!==(r=o.domain)&&void 0!==r?r:e.cookieDomain,l=L(o);s&&"https:"!==window.location.protocol&&C("Refresh token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass refreshTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const c=Object.assign(Object.assign({},e),{cookieSameSite:t,cookieSecure:s,cookieDomain:a});q(l,d,c);const u=P(a);p=Object.assign(Object.assign({},p),{refresh:{path:c.cookiePath,domain:u?a:void 0}})}else{const e=L(o);a.default.remove(e),I(`${n}${R}`,d)}if(c)if(t){const n=t.sameSite||"Strict",o=null===(s=t.secure)||void 0===s||s,i=null!==(l=t.domain)&&void 0!==l?l:e.cookieDomain,r=J(t);o&&"https:"!==window.location.protocol&&C("Session token cookie is configured with secure=true but the page is not using HTTPS. The cookie will not be set. To fix this, pass sessionTokenViaCookie: { secure: process.env['NODE_ENV'] !== 'development' }");const a=Object.assign(Object.assign({},e),{cookieSameSite:n,cookieSecure:o,cookieDomain:i});q(r,c,a);const d=P(i);p=Object.assign(Object.assign({},p),{session:{path:a.cookiePath,domain:d?i:void 0}})}else I(`${n}${E}`,c);return e.idToken&&I(`${n}${$}`,e.idToken),u&&I(`${n}DTD`,u),p})(e,r,l,s);n&&(p=n)}}})),v=n.wrapWith(f,["logout","logoutAll","oidc.logout"],ye(l,r,s,(()=>p)));return Object.assign(v,{getRefreshToken:()=>K(l,s),getSessionToken:()=>V(l,r),getIdToken:()=>F(l)})}))((e=>{const t=s.default(e),n=Le(t,e.projectId,e.oidcConfig);return Object.assign(Object.assign({},t),{refresh:async(o,i)=>{var r;if(k())return U(`Refresh called in native flow: ${(new Error).stack}`),Promise.resolve({ok:!1,error:{errorCode:"J171000",errorDescription:"Refresh is not supported in native flows via the web SDK"}});if(e.oidcConfig)try{return await n.refreshToken(o),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161001",errorDescription:e.toString()}})}if(i&&c&&void 0!==window.localStorage&&!D(we)&&!O(ce)&&!D("DSLI_DISABLED"))return Promise.resolve({ok:!0});const s=V(),a=K();let l="";if(e.getExternalToken)try{l=await(null===(r=e.getExternalToken)||void 0===r?void 0:r.call(e))}catch(e){U("Error getting external token while refreshing",e)}return t.refresh(o,{dcs:s?"t":"f",dcr:a?"t":"f"},l,i)},logout:async o=>{if(e.oidcConfig)try{return await n.logout({id_token_hint:o}),Promise.resolve({ok:!0})}catch(e){return Promise.resolve({ok:!1,error:{errorCode:"J161000",errorDescription:e.toString()}})}return t.logout(o)},flow:$e(t),webauthn:Ue(t),fedcm:(o=t,i=e.projectId,{onetap:{requestExchangeCode(e){Ee(o,e)},requestAuthentication(e){Ee(o,e)}},async oneTap(e,t,n,i,r){await Re(o,{provider:e,oneTapConfig:t,loginOptions:n,onSkipped:i,onDismissed:r})},async launch(e){var t;const n={identity:{context:e||"signin",providers:[{configURL:o.httpClient.buildUrl(i+Ce.config),clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(n));return o.refresh(r.token)},isSupported:()=>c&&"IdentityCredential"in window,async isLoggedIn(e){var t;const n=o.httpClient.buildUrl(i+Ce.config);try{const o={identity:{context:e||"signin",providers:[{configURL:n,clientId:i}]}},r=await(null===(t=navigator.credentials)||void 0===t?void 0:t.get(o));return!!r&&!!r.token}catch(e){return!1}}}),oidc:n});var o,i}));exports.REFRESH_TOKEN_KEY=R,exports.SESSION_TOKEN_KEY=E,exports.clearFingerprintData=()=>{x(G)},exports.createSdk=Ke,exports.default=Ke,exports.ensureFingerprintIds=Z,exports.getSessionToken=V,exports.hasOidcParamsInUrl=Ne;
2
2
  //# sourceMappingURL=index.cjs.js.map