@genation/sdk 0.2.10 → 0.2.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -0
- package/dist/genation.cjs.js +1 -1
- package/dist/genation.cjs.js.map +1 -1
- package/dist/genation.es.js +273 -262
- package/dist/genation.es.js.map +1 -1
- package/dist/genation.umd.js +1 -1
- package/dist/genation.umd.js.map +1 -1
- package/dist/index.d.ts +4 -1
- package/package.json +1 -1
package/dist/genation.es.js
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
|
-
class
|
|
1
|
+
class L extends Error {
|
|
2
2
|
code;
|
|
3
3
|
cause;
|
|
4
4
|
constructor(e, r, n) {
|
|
5
5
|
super(e), this.name = "GenationError", this.code = r, this.cause = n;
|
|
6
6
|
}
|
|
7
7
|
}
|
|
8
|
-
class g extends
|
|
8
|
+
class g extends L {
|
|
9
9
|
constructor(e, r, n) {
|
|
10
10
|
super(e, r, n), this.name = "AuthError";
|
|
11
11
|
}
|
|
@@ -25,7 +25,7 @@ class g extends N {
|
|
|
25
25
|
return new g(e, "pkce_verification_failed");
|
|
26
26
|
}
|
|
27
27
|
}
|
|
28
|
-
class S extends
|
|
28
|
+
class S extends L {
|
|
29
29
|
status;
|
|
30
30
|
constructor(e, r, n) {
|
|
31
31
|
super(e, "network_error", n), this.name = "NetworkError", this.status = r;
|
|
@@ -37,7 +37,7 @@ class S extends N {
|
|
|
37
37
|
);
|
|
38
38
|
}
|
|
39
39
|
}
|
|
40
|
-
class v extends
|
|
40
|
+
class v extends L {
|
|
41
41
|
constructor(e) {
|
|
42
42
|
super(e, "config_error"), this.name = "ConfigError";
|
|
43
43
|
}
|
|
@@ -45,7 +45,7 @@ class v extends N {
|
|
|
45
45
|
return new v(`Missing required config field: ${e}`);
|
|
46
46
|
}
|
|
47
47
|
}
|
|
48
|
-
class
|
|
48
|
+
class U {
|
|
49
49
|
baseUrl;
|
|
50
50
|
timeout;
|
|
51
51
|
constructor(e) {
|
|
@@ -61,7 +61,7 @@ class D {
|
|
|
61
61
|
const o = new URLSearchParams(i);
|
|
62
62
|
c += `?${o.toString()}`;
|
|
63
63
|
}
|
|
64
|
-
const
|
|
64
|
+
const h = new AbortController(), u = setTimeout(() => h.abort(), this.timeout);
|
|
65
65
|
try {
|
|
66
66
|
const o = await fetch(c, {
|
|
67
67
|
method: n,
|
|
@@ -70,13 +70,13 @@ class D {
|
|
|
70
70
|
...s
|
|
71
71
|
},
|
|
72
72
|
body: a ? JSON.stringify(a) : void 0,
|
|
73
|
-
signal:
|
|
73
|
+
signal: h.signal
|
|
74
74
|
});
|
|
75
|
-
if (clearTimeout(
|
|
75
|
+
if (clearTimeout(u), !o.ok)
|
|
76
76
|
throw S.fromResponse(o);
|
|
77
77
|
return await o.json();
|
|
78
78
|
} catch (o) {
|
|
79
|
-
throw clearTimeout(
|
|
79
|
+
throw clearTimeout(u), o instanceof S ? o : o instanceof Error && o.name === "AbortError" ? new S("Request timeout", void 0, o) : new S("Network request failed", void 0, o);
|
|
80
80
|
}
|
|
81
81
|
}
|
|
82
82
|
/**
|
|
@@ -105,28 +105,28 @@ class D {
|
|
|
105
105
|
function $(t) {
|
|
106
106
|
return btoa(String.fromCharCode(...t)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
|
|
107
107
|
}
|
|
108
|
-
function
|
|
108
|
+
function fe() {
|
|
109
109
|
const t = new Uint8Array(32);
|
|
110
110
|
return crypto.getRandomValues(t), $(t);
|
|
111
111
|
}
|
|
112
|
-
async function
|
|
112
|
+
async function de(t) {
|
|
113
113
|
const r = new TextEncoder().encode(t), n = await crypto.subtle.digest("SHA-256", r);
|
|
114
114
|
return $(new Uint8Array(n));
|
|
115
115
|
}
|
|
116
|
-
async function
|
|
117
|
-
const t =
|
|
116
|
+
async function le() {
|
|
117
|
+
const t = fe(), e = await de(t);
|
|
118
118
|
return {
|
|
119
119
|
codeVerifier: t,
|
|
120
120
|
codeChallenge: e,
|
|
121
121
|
codeChallengeMethod: "S256"
|
|
122
122
|
};
|
|
123
123
|
}
|
|
124
|
-
function
|
|
124
|
+
function pe() {
|
|
125
125
|
const t = new Uint8Array(16);
|
|
126
126
|
return crypto.getRandomValues(t), $(t);
|
|
127
127
|
}
|
|
128
|
-
const
|
|
129
|
-
class
|
|
128
|
+
const k = "tokens", I = "pkce", J = "state";
|
|
129
|
+
class ye {
|
|
130
130
|
storage;
|
|
131
131
|
constructor(e) {
|
|
132
132
|
this.storage = e;
|
|
@@ -135,13 +135,13 @@ class le {
|
|
|
135
135
|
* Store token set
|
|
136
136
|
*/
|
|
137
137
|
async setTokens(e) {
|
|
138
|
-
await this.storage.set(
|
|
138
|
+
await this.storage.set(k, JSON.stringify(e));
|
|
139
139
|
}
|
|
140
140
|
/**
|
|
141
141
|
* Get stored tokens
|
|
142
142
|
*/
|
|
143
143
|
async getTokens() {
|
|
144
|
-
const e = await this.storage.get(
|
|
144
|
+
const e = await this.storage.get(k);
|
|
145
145
|
if (!e) return null;
|
|
146
146
|
try {
|
|
147
147
|
return JSON.parse(e);
|
|
@@ -153,7 +153,7 @@ class le {
|
|
|
153
153
|
* Clear stored tokens
|
|
154
154
|
*/
|
|
155
155
|
async clearTokens() {
|
|
156
|
-
await this.storage.remove(
|
|
156
|
+
await this.storage.remove(k);
|
|
157
157
|
}
|
|
158
158
|
/**
|
|
159
159
|
* Check if access token is expired
|
|
@@ -168,27 +168,27 @@ class le {
|
|
|
168
168
|
* Store PKCE verifier for later validation
|
|
169
169
|
*/
|
|
170
170
|
async setPKCE(e) {
|
|
171
|
-
await this.storage.set(
|
|
171
|
+
await this.storage.set(I, e);
|
|
172
172
|
}
|
|
173
173
|
/**
|
|
174
174
|
* Get and clear stored PKCE verifier
|
|
175
175
|
*/
|
|
176
176
|
async consumePKCE() {
|
|
177
|
-
const e = await this.storage.get(
|
|
178
|
-
return e && await this.storage.remove(
|
|
177
|
+
const e = await this.storage.get(I);
|
|
178
|
+
return e && await this.storage.remove(I), e;
|
|
179
179
|
}
|
|
180
180
|
/**
|
|
181
181
|
* Store state for CSRF validation
|
|
182
182
|
*/
|
|
183
183
|
async setState(e) {
|
|
184
|
-
await this.storage.set(
|
|
184
|
+
await this.storage.set(J, e);
|
|
185
185
|
}
|
|
186
186
|
/**
|
|
187
187
|
* Get and clear stored state
|
|
188
188
|
*/
|
|
189
189
|
async consumeState() {
|
|
190
|
-
const e = await this.storage.get(
|
|
191
|
-
return e && await this.storage.remove(
|
|
190
|
+
const e = await this.storage.get(J);
|
|
191
|
+
return e && await this.storage.remove(J), e;
|
|
192
192
|
}
|
|
193
193
|
/**
|
|
194
194
|
* Clear all auth-related data
|
|
@@ -197,8 +197,8 @@ class le {
|
|
|
197
197
|
await this.storage.clear();
|
|
198
198
|
}
|
|
199
199
|
}
|
|
200
|
-
const
|
|
201
|
-
class
|
|
200
|
+
const F = "https://mnnoheowoowbtpuoguul.supabase.co/auth/v1";
|
|
201
|
+
class me {
|
|
202
202
|
config;
|
|
203
203
|
http;
|
|
204
204
|
tokenManager;
|
|
@@ -208,15 +208,15 @@ class ye {
|
|
|
208
208
|
clientSecret: e.clientSecret,
|
|
209
209
|
redirectUri: e.redirectUri,
|
|
210
210
|
scopes: e.scopes,
|
|
211
|
-
authUrl: e.authUrl ??
|
|
212
|
-
}, this.http = new
|
|
211
|
+
authUrl: e.authUrl ?? F
|
|
212
|
+
}, this.http = new U({ baseUrl: this.config.authUrl }), this.tokenManager = r;
|
|
213
213
|
}
|
|
214
214
|
/**
|
|
215
215
|
* Generate authorization URL for OAuth flow
|
|
216
216
|
* Stores PKCE verifier and state for later validation
|
|
217
217
|
*/
|
|
218
218
|
async getAuthorizationUrl() {
|
|
219
|
-
const e = await
|
|
219
|
+
const e = await le(), r = pe();
|
|
220
220
|
await this.tokenManager.setPKCE(e.codeVerifier), await this.tokenManager.setState(r);
|
|
221
221
|
const n = new URLSearchParams({
|
|
222
222
|
response_type: "code",
|
|
@@ -299,15 +299,15 @@ class ye {
|
|
|
299
299
|
};
|
|
300
300
|
}
|
|
301
301
|
}
|
|
302
|
-
const
|
|
303
|
-
function
|
|
302
|
+
const B = new TextEncoder(), _ = new TextDecoder();
|
|
303
|
+
function we(...t) {
|
|
304
304
|
const e = t.reduce((s, { length: a }) => s + a, 0), r = new Uint8Array(e);
|
|
305
305
|
let n = 0;
|
|
306
306
|
for (const s of t)
|
|
307
307
|
r.set(s, n), n += s.length;
|
|
308
308
|
return r;
|
|
309
309
|
}
|
|
310
|
-
function
|
|
310
|
+
function x(t) {
|
|
311
311
|
const e = new Uint8Array(t.length);
|
|
312
312
|
for (let r = 0; r < t.length; r++) {
|
|
313
313
|
const n = t.charCodeAt(r);
|
|
@@ -317,7 +317,7 @@ function J(t) {
|
|
|
317
317
|
}
|
|
318
318
|
return e;
|
|
319
319
|
}
|
|
320
|
-
function
|
|
320
|
+
function Se(t) {
|
|
321
321
|
if (Uint8Array.fromBase64)
|
|
322
322
|
return Uint8Array.fromBase64(t);
|
|
323
323
|
const e = atob(t), r = new Uint8Array(e.length);
|
|
@@ -333,19 +333,19 @@ function C(t) {
|
|
|
333
333
|
let e = t;
|
|
334
334
|
e instanceof Uint8Array && (e = _.decode(e)), e = e.replace(/-/g, "+").replace(/_/g, "/");
|
|
335
335
|
try {
|
|
336
|
-
return
|
|
336
|
+
return Se(e);
|
|
337
337
|
} catch {
|
|
338
338
|
throw new TypeError("The input to be decoded is not correctly encoded.");
|
|
339
339
|
}
|
|
340
340
|
}
|
|
341
|
-
class
|
|
341
|
+
class d extends Error {
|
|
342
342
|
static code = "ERR_JOSE_GENERIC";
|
|
343
343
|
code = "ERR_JOSE_GENERIC";
|
|
344
344
|
constructor(e, r) {
|
|
345
345
|
super(e, r), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
|
|
346
346
|
}
|
|
347
347
|
}
|
|
348
|
-
class y extends
|
|
348
|
+
class y extends d {
|
|
349
349
|
static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
|
|
350
350
|
code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
|
|
351
351
|
claim;
|
|
@@ -355,7 +355,7 @@ class y extends l {
|
|
|
355
355
|
super(e, { cause: { claim: n, reason: s, payload: r } }), this.claim = n, this.reason = s, this.payload = r;
|
|
356
356
|
}
|
|
357
357
|
}
|
|
358
|
-
class z extends
|
|
358
|
+
class z extends d {
|
|
359
359
|
static code = "ERR_JWT_EXPIRED";
|
|
360
360
|
code = "ERR_JWT_EXPIRED";
|
|
361
361
|
claim;
|
|
@@ -365,30 +365,34 @@ class z extends l {
|
|
|
365
365
|
super(e, { cause: { claim: n, reason: s, payload: r } }), this.claim = n, this.reason = s, this.payload = r;
|
|
366
366
|
}
|
|
367
367
|
}
|
|
368
|
-
class
|
|
368
|
+
class ge extends d {
|
|
369
|
+
static code = "ERR_JOSE_ALG_NOT_ALLOWED";
|
|
370
|
+
code = "ERR_JOSE_ALG_NOT_ALLOWED";
|
|
371
|
+
}
|
|
372
|
+
class w extends d {
|
|
369
373
|
static code = "ERR_JOSE_NOT_SUPPORTED";
|
|
370
374
|
code = "ERR_JOSE_NOT_SUPPORTED";
|
|
371
375
|
}
|
|
372
|
-
class f extends
|
|
376
|
+
class f extends d {
|
|
373
377
|
static code = "ERR_JWS_INVALID";
|
|
374
378
|
code = "ERR_JWS_INVALID";
|
|
375
379
|
}
|
|
376
|
-
class
|
|
380
|
+
class ee extends d {
|
|
377
381
|
static code = "ERR_JWT_INVALID";
|
|
378
382
|
code = "ERR_JWT_INVALID";
|
|
379
383
|
}
|
|
380
|
-
class
|
|
384
|
+
class te extends d {
|
|
381
385
|
static code = "ERR_JWKS_INVALID";
|
|
382
386
|
code = "ERR_JWKS_INVALID";
|
|
383
387
|
}
|
|
384
|
-
class
|
|
388
|
+
class re extends d {
|
|
385
389
|
static code = "ERR_JWKS_NO_MATCHING_KEY";
|
|
386
390
|
code = "ERR_JWKS_NO_MATCHING_KEY";
|
|
387
391
|
constructor(e = "no applicable key found in the JSON Web Key Set", r) {
|
|
388
392
|
super(e, r);
|
|
389
393
|
}
|
|
390
394
|
}
|
|
391
|
-
class
|
|
395
|
+
class be extends d {
|
|
392
396
|
[Symbol.asyncIterator];
|
|
393
397
|
static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
|
|
394
398
|
code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
|
|
@@ -396,14 +400,14 @@ class Se extends l {
|
|
|
396
400
|
super(e, r);
|
|
397
401
|
}
|
|
398
402
|
}
|
|
399
|
-
class
|
|
403
|
+
class Ee extends d {
|
|
400
404
|
static code = "ERR_JWKS_TIMEOUT";
|
|
401
405
|
code = "ERR_JWKS_TIMEOUT";
|
|
402
406
|
constructor(e = "request timed out", r) {
|
|
403
407
|
super(e, r);
|
|
404
408
|
}
|
|
405
409
|
}
|
|
406
|
-
class
|
|
410
|
+
class Ae extends d {
|
|
407
411
|
static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
|
|
408
412
|
code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
|
|
409
413
|
constructor(e = "signature verification failed", r) {
|
|
@@ -411,10 +415,10 @@ class be extends l {
|
|
|
411
415
|
}
|
|
412
416
|
}
|
|
413
417
|
const m = (t, e = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`), A = (t, e) => t.name === e;
|
|
414
|
-
function
|
|
418
|
+
function O(t) {
|
|
415
419
|
return parseInt(t.name.slice(4), 10);
|
|
416
420
|
}
|
|
417
|
-
function
|
|
421
|
+
function Te(t) {
|
|
418
422
|
switch (t) {
|
|
419
423
|
case "ES256":
|
|
420
424
|
return "P-256";
|
|
@@ -426,11 +430,11 @@ function Ee(t) {
|
|
|
426
430
|
throw new Error("unreachable");
|
|
427
431
|
}
|
|
428
432
|
}
|
|
429
|
-
function
|
|
433
|
+
function Ke(t, e) {
|
|
430
434
|
if (!t.usages.includes(e))
|
|
431
435
|
throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`);
|
|
432
436
|
}
|
|
433
|
-
function
|
|
437
|
+
function ve(t, e, r) {
|
|
434
438
|
switch (e) {
|
|
435
439
|
case "HS256":
|
|
436
440
|
case "HS384":
|
|
@@ -438,7 +442,7 @@ function Ke(t, e, r) {
|
|
|
438
442
|
if (!A(t.algorithm, "HMAC"))
|
|
439
443
|
throw m("HMAC");
|
|
440
444
|
const n = parseInt(e.slice(2), 10);
|
|
441
|
-
if (
|
|
445
|
+
if (O(t.algorithm.hash) !== n)
|
|
442
446
|
throw m(`SHA-${n}`, "algorithm.hash");
|
|
443
447
|
break;
|
|
444
448
|
}
|
|
@@ -448,7 +452,7 @@ function Ke(t, e, r) {
|
|
|
448
452
|
if (!A(t.algorithm, "RSASSA-PKCS1-v1_5"))
|
|
449
453
|
throw m("RSASSA-PKCS1-v1_5");
|
|
450
454
|
const n = parseInt(e.slice(2), 10);
|
|
451
|
-
if (
|
|
455
|
+
if (O(t.algorithm.hash) !== n)
|
|
452
456
|
throw m(`SHA-${n}`, "algorithm.hash");
|
|
453
457
|
break;
|
|
454
458
|
}
|
|
@@ -458,7 +462,7 @@ function Ke(t, e, r) {
|
|
|
458
462
|
if (!A(t.algorithm, "RSA-PSS"))
|
|
459
463
|
throw m("RSA-PSS");
|
|
460
464
|
const n = parseInt(e.slice(2), 10);
|
|
461
|
-
if (
|
|
465
|
+
if (O(t.algorithm.hash) !== n)
|
|
462
466
|
throw m(`SHA-${n}`, "algorithm.hash");
|
|
463
467
|
break;
|
|
464
468
|
}
|
|
@@ -480,7 +484,7 @@ function Ke(t, e, r) {
|
|
|
480
484
|
case "ES512": {
|
|
481
485
|
if (!A(t.algorithm, "ECDSA"))
|
|
482
486
|
throw m("ECDSA");
|
|
483
|
-
const n =
|
|
487
|
+
const n = Te(e);
|
|
484
488
|
if (t.algorithm.namedCurve !== n)
|
|
485
489
|
throw m(n, "algorithm.namedCurve");
|
|
486
490
|
break;
|
|
@@ -488,16 +492,16 @@ function Ke(t, e, r) {
|
|
|
488
492
|
default:
|
|
489
493
|
throw new TypeError("CryptoKey does not support this operation");
|
|
490
494
|
}
|
|
491
|
-
|
|
495
|
+
Ke(t, r);
|
|
492
496
|
}
|
|
493
|
-
function
|
|
497
|
+
function ne(t, e, ...r) {
|
|
494
498
|
if (r = r.filter(Boolean), r.length > 2) {
|
|
495
499
|
const n = r.pop();
|
|
496
500
|
t += `one of type ${r.join(", ")}, or ${n}.`;
|
|
497
501
|
} else r.length === 2 ? t += `one of type ${r[0]} or ${r[1]}.` : t += `of type ${r[0]}.`;
|
|
498
502
|
return e == null ? t += ` Received ${e}` : typeof e == "function" && e.name ? t += ` Received function ${e.name}` : typeof e == "object" && e != null && e.constructor?.name && (t += ` Received an instance of ${e.constructor.name}`), t;
|
|
499
503
|
}
|
|
500
|
-
const
|
|
504
|
+
const Ce = (t, ...e) => ne("Key must be ", t, ...e), se = (t, e, ...r) => ne(`Key for the ${t} algorithm must be `, e, ...r), ae = (t) => {
|
|
501
505
|
if (t?.[Symbol.toStringTag] === "CryptoKey")
|
|
502
506
|
return !0;
|
|
503
507
|
try {
|
|
@@ -505,8 +509,8 @@ const Te = (t, ...e) => re("Key must be ", t, ...e), ne = (t, e, ...r) => re(`Ke
|
|
|
505
509
|
} catch {
|
|
506
510
|
return !1;
|
|
507
511
|
}
|
|
508
|
-
},
|
|
509
|
-
function
|
|
512
|
+
}, ie = (t) => t?.[Symbol.toStringTag] === "KeyObject", oe = (t) => ae(t) || ie(t);
|
|
513
|
+
function _e(...t) {
|
|
510
514
|
const e = t.filter(Boolean);
|
|
511
515
|
if (e.length === 0 || e.length === 1)
|
|
512
516
|
return !0;
|
|
@@ -525,9 +529,9 @@ function ve(...t) {
|
|
|
525
529
|
}
|
|
526
530
|
return !0;
|
|
527
531
|
}
|
|
528
|
-
const
|
|
529
|
-
function
|
|
530
|
-
if (!
|
|
532
|
+
const Re = (t) => typeof t == "object" && t !== null;
|
|
533
|
+
function b(t) {
|
|
534
|
+
if (!Re(t) || Object.prototype.toString.call(t) !== "[object Object]")
|
|
531
535
|
return !1;
|
|
532
536
|
if (Object.getPrototypeOf(t) === null)
|
|
533
537
|
return !0;
|
|
@@ -536,14 +540,14 @@ function E(t) {
|
|
|
536
540
|
e = Object.getPrototypeOf(e);
|
|
537
541
|
return Object.getPrototypeOf(t) === e;
|
|
538
542
|
}
|
|
539
|
-
function
|
|
543
|
+
function Pe(t, e) {
|
|
540
544
|
if (t.startsWith("RS") || t.startsWith("PS")) {
|
|
541
545
|
const { modulusLength: r } = e.algorithm;
|
|
542
546
|
if (typeof r != "number" || r < 2048)
|
|
543
547
|
throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`);
|
|
544
548
|
}
|
|
545
549
|
}
|
|
546
|
-
function
|
|
550
|
+
function We(t) {
|
|
547
551
|
let e, r;
|
|
548
552
|
switch (t.kty) {
|
|
549
553
|
case "AKP": {
|
|
@@ -628,14 +632,14 @@ function Re(t) {
|
|
|
628
632
|
}
|
|
629
633
|
return { algorithm: e, keyUsages: r };
|
|
630
634
|
}
|
|
631
|
-
async function
|
|
635
|
+
async function W(t) {
|
|
632
636
|
if (!t.alg)
|
|
633
637
|
throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
|
|
634
|
-
const { algorithm: e, keyUsages: r } =
|
|
638
|
+
const { algorithm: e, keyUsages: r } = We(t), n = { ...t };
|
|
635
639
|
return n.kty !== "AKP" && delete n.alg, delete n.use, crypto.subtle.importKey("jwk", n, e, t.ext ?? !(t.d || t.priv), t.key_ops ?? r);
|
|
636
640
|
}
|
|
637
|
-
async function
|
|
638
|
-
if (!
|
|
641
|
+
async function ke(t, e, r) {
|
|
642
|
+
if (!b(t))
|
|
639
643
|
throw new TypeError("JWK must be an object");
|
|
640
644
|
let n;
|
|
641
645
|
switch (e ??= t.alg, n ??= t.ext, t.kty) {
|
|
@@ -646,22 +650,22 @@ async function Pe(t, e, r) {
|
|
|
646
650
|
case "RSA":
|
|
647
651
|
if ("oth" in t && t.oth !== void 0)
|
|
648
652
|
throw new w('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
|
|
649
|
-
return
|
|
653
|
+
return W({ ...t, alg: e, ext: n });
|
|
650
654
|
case "AKP": {
|
|
651
655
|
if (typeof t.alg != "string" || !t.alg)
|
|
652
656
|
throw new TypeError('missing "alg" (Algorithm) Parameter value');
|
|
653
657
|
if (e !== void 0 && e !== t.alg)
|
|
654
658
|
throw new TypeError("JWK alg and alg option value mismatch");
|
|
655
|
-
return
|
|
659
|
+
return W({ ...t, ext: n });
|
|
656
660
|
}
|
|
657
661
|
case "EC":
|
|
658
662
|
case "OKP":
|
|
659
|
-
return
|
|
663
|
+
return W({ ...t, alg: e, ext: n });
|
|
660
664
|
default:
|
|
661
665
|
throw new w('Unsupported "kty" (Key Type) Parameter value');
|
|
662
666
|
}
|
|
663
667
|
}
|
|
664
|
-
function
|
|
668
|
+
function Ie(t, e, r, n, s) {
|
|
665
669
|
if (s.crit !== void 0 && n?.crit === void 0)
|
|
666
670
|
throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');
|
|
667
671
|
if (!n || n.crit === void 0)
|
|
@@ -669,7 +673,7 @@ function We(t, e, r, n, s) {
|
|
|
669
673
|
if (!Array.isArray(n.crit) || n.crit.length === 0 || n.crit.some((i) => typeof i != "string" || i.length === 0))
|
|
670
674
|
throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
|
|
671
675
|
let a;
|
|
672
|
-
a = e;
|
|
676
|
+
r !== void 0 ? a = new Map([...Object.entries(r), ...e.entries()]) : a = e;
|
|
673
677
|
for (const i of n.crit) {
|
|
674
678
|
if (!a.has(i))
|
|
675
679
|
throw new w(`Extension Header Parameter "${i}" is not recognized`);
|
|
@@ -680,18 +684,24 @@ function We(t, e, r, n, s) {
|
|
|
680
684
|
}
|
|
681
685
|
return new Set(n.crit);
|
|
682
686
|
}
|
|
683
|
-
|
|
684
|
-
|
|
685
|
-
|
|
686
|
-
|
|
687
|
-
|
|
687
|
+
function Je(t, e) {
|
|
688
|
+
if (e !== void 0 && (!Array.isArray(e) || e.some((r) => typeof r != "string")))
|
|
689
|
+
throw new TypeError(`"${t}" option must be an array of strings`);
|
|
690
|
+
if (e)
|
|
691
|
+
return new Set(e);
|
|
692
|
+
}
|
|
693
|
+
const V = (t) => b(t) && typeof t.kty == "string", xe = (t) => t.kty !== "oct" && (t.kty === "AKP" && typeof t.priv == "string" || typeof t.d == "string"), Oe = (t) => t.kty !== "oct" && t.d === void 0 && t.priv === void 0, De = (t) => t.kty === "oct" && typeof t.k == "string";
|
|
694
|
+
let K;
|
|
695
|
+
const q = async (t, e, r, n = !1) => {
|
|
696
|
+
K ||= /* @__PURE__ */ new WeakMap();
|
|
697
|
+
let s = K.get(t);
|
|
688
698
|
if (s?.[r])
|
|
689
699
|
return s[r];
|
|
690
|
-
const a = await
|
|
691
|
-
return n && Object.freeze(t), s ? s[r] = a :
|
|
700
|
+
const a = await W({ ...e, alg: r });
|
|
701
|
+
return n && Object.freeze(t), s ? s[r] = a : K.set(t, { [r]: a }), a;
|
|
692
702
|
}, Ue = (t, e) => {
|
|
693
|
-
|
|
694
|
-
let r =
|
|
703
|
+
K ||= /* @__PURE__ */ new WeakMap();
|
|
704
|
+
let r = K.get(t);
|
|
695
705
|
if (r?.[e])
|
|
696
706
|
return r[e];
|
|
697
707
|
const n = t.type === "public", s = !!n;
|
|
@@ -784,12 +794,12 @@ const B = async (t, e, r, n = !1) => {
|
|
|
784
794
|
}
|
|
785
795
|
if (!a)
|
|
786
796
|
throw new TypeError("given KeyObject instance cannot be used for this algorithm");
|
|
787
|
-
return r ? r[e] = a :
|
|
797
|
+
return r ? r[e] = a : K.set(t, { [e]: a }), a;
|
|
788
798
|
};
|
|
789
|
-
async function
|
|
790
|
-
if (t instanceof Uint8Array ||
|
|
799
|
+
async function Me(t, e) {
|
|
800
|
+
if (t instanceof Uint8Array || ae(t))
|
|
791
801
|
return t;
|
|
792
|
-
if (
|
|
802
|
+
if (ie(t)) {
|
|
793
803
|
if (t.type === "secret")
|
|
794
804
|
return t.export();
|
|
795
805
|
if ("toCryptoKey" in t && typeof t.toCryptoKey == "function")
|
|
@@ -800,13 +810,13 @@ async function xe(t, e) {
|
|
|
800
810
|
throw n;
|
|
801
811
|
}
|
|
802
812
|
let r = t.export({ format: "jwk" });
|
|
803
|
-
return
|
|
813
|
+
return q(t, r, e);
|
|
804
814
|
}
|
|
805
|
-
if (
|
|
806
|
-
return t.k ? C(t.k) :
|
|
815
|
+
if (V(t))
|
|
816
|
+
return t.k ? C(t.k) : q(t, t, e, !0);
|
|
807
817
|
throw new Error("unreachable");
|
|
808
818
|
}
|
|
809
|
-
const
|
|
819
|
+
const T = (t) => t?.[Symbol.toStringTag], M = (t, e, r) => {
|
|
810
820
|
if (e.use !== void 0) {
|
|
811
821
|
let n;
|
|
812
822
|
switch (r) {
|
|
@@ -849,65 +859,65 @@ const K = (t) => t?.[Symbol.toStringTag], O = (t, e, r) => {
|
|
|
849
859
|
throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`);
|
|
850
860
|
}
|
|
851
861
|
return !0;
|
|
852
|
-
},
|
|
862
|
+
}, He = (t, e, r) => {
|
|
853
863
|
if (!(e instanceof Uint8Array)) {
|
|
854
|
-
if (
|
|
855
|
-
if (
|
|
864
|
+
if (V(e)) {
|
|
865
|
+
if (De(e) && M(t, e, r))
|
|
856
866
|
return;
|
|
857
867
|
throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present');
|
|
858
868
|
}
|
|
859
|
-
if (!
|
|
860
|
-
throw new TypeError(
|
|
869
|
+
if (!oe(e))
|
|
870
|
+
throw new TypeError(se(t, e, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
|
|
861
871
|
if (e.type !== "secret")
|
|
862
|
-
throw new TypeError(`${
|
|
872
|
+
throw new TypeError(`${T(e)} instances for symmetric algorithms must be of type "secret"`);
|
|
863
873
|
}
|
|
864
|
-
},
|
|
865
|
-
if (
|
|
874
|
+
}, Ne = (t, e, r) => {
|
|
875
|
+
if (V(e))
|
|
866
876
|
switch (r) {
|
|
867
877
|
case "decrypt":
|
|
868
878
|
case "sign":
|
|
869
|
-
if (
|
|
879
|
+
if (xe(e) && M(t, e, r))
|
|
870
880
|
return;
|
|
871
881
|
throw new TypeError("JSON Web Key for this operation must be a private JWK");
|
|
872
882
|
case "encrypt":
|
|
873
883
|
case "verify":
|
|
874
|
-
if (
|
|
884
|
+
if (Oe(e) && M(t, e, r))
|
|
875
885
|
return;
|
|
876
886
|
throw new TypeError("JSON Web Key for this operation must be a public JWK");
|
|
877
887
|
}
|
|
878
|
-
if (!
|
|
879
|
-
throw new TypeError(
|
|
888
|
+
if (!oe(e))
|
|
889
|
+
throw new TypeError(se(t, e, "CryptoKey", "KeyObject", "JSON Web Key"));
|
|
880
890
|
if (e.type === "secret")
|
|
881
|
-
throw new TypeError(`${
|
|
891
|
+
throw new TypeError(`${T(e)} instances for asymmetric algorithms must not be of type "secret"`);
|
|
882
892
|
if (e.type === "public")
|
|
883
893
|
switch (r) {
|
|
884
894
|
case "sign":
|
|
885
|
-
throw new TypeError(`${
|
|
895
|
+
throw new TypeError(`${T(e)} instances for asymmetric algorithm signing must be of type "private"`);
|
|
886
896
|
case "decrypt":
|
|
887
|
-
throw new TypeError(`${
|
|
897
|
+
throw new TypeError(`${T(e)} instances for asymmetric algorithm decryption must be of type "private"`);
|
|
888
898
|
}
|
|
889
899
|
if (e.type === "private")
|
|
890
900
|
switch (r) {
|
|
891
901
|
case "verify":
|
|
892
|
-
throw new TypeError(`${
|
|
902
|
+
throw new TypeError(`${T(e)} instances for asymmetric algorithm verifying must be of type "public"`);
|
|
893
903
|
case "encrypt":
|
|
894
|
-
throw new TypeError(`${
|
|
904
|
+
throw new TypeError(`${T(e)} instances for asymmetric algorithm encryption must be of type "public"`);
|
|
895
905
|
}
|
|
896
906
|
};
|
|
897
|
-
function
|
|
907
|
+
function Le(t, e, r) {
|
|
898
908
|
switch (t.substring(0, 2)) {
|
|
899
909
|
case "A1":
|
|
900
910
|
case "A2":
|
|
901
911
|
case "di":
|
|
902
912
|
case "HS":
|
|
903
913
|
case "PB":
|
|
904
|
-
|
|
914
|
+
He(t, e, r);
|
|
905
915
|
break;
|
|
906
916
|
default:
|
|
907
|
-
|
|
917
|
+
Ne(t, e, r);
|
|
908
918
|
}
|
|
909
919
|
}
|
|
910
|
-
function
|
|
920
|
+
function $e(t, e) {
|
|
911
921
|
const r = `SHA-${t.slice(-3)}`;
|
|
912
922
|
switch (t) {
|
|
913
923
|
case "HS256":
|
|
@@ -937,26 +947,26 @@ function He(t, e) {
|
|
|
937
947
|
throw new w(`alg ${t} is not supported either by JOSE or your javascript runtime`);
|
|
938
948
|
}
|
|
939
949
|
}
|
|
940
|
-
async function
|
|
950
|
+
async function Fe(t, e, r) {
|
|
941
951
|
if (e instanceof Uint8Array) {
|
|
942
952
|
if (!t.startsWith("HS"))
|
|
943
|
-
throw new TypeError(
|
|
953
|
+
throw new TypeError(Ce(e, "CryptoKey", "KeyObject", "JSON Web Key"));
|
|
944
954
|
return crypto.subtle.importKey("raw", e, { hash: `SHA-${t.slice(-3)}`, name: "HMAC" }, !1, [r]);
|
|
945
955
|
}
|
|
946
|
-
return
|
|
956
|
+
return ve(e, t, r), e;
|
|
947
957
|
}
|
|
948
|
-
async function
|
|
949
|
-
const s = await
|
|
950
|
-
|
|
951
|
-
const a =
|
|
958
|
+
async function Ve(t, e, r, n) {
|
|
959
|
+
const s = await Fe(t, e, "verify");
|
|
960
|
+
Pe(t, s);
|
|
961
|
+
const a = $e(t, s.algorithm);
|
|
952
962
|
try {
|
|
953
963
|
return await crypto.subtle.verify(a, s, r, n);
|
|
954
964
|
} catch {
|
|
955
965
|
return !1;
|
|
956
966
|
}
|
|
957
967
|
}
|
|
958
|
-
async function
|
|
959
|
-
if (!
|
|
968
|
+
async function Ge(t, e, r) {
|
|
969
|
+
if (!b(t))
|
|
960
970
|
throw new f("Flattened JWS must be an object");
|
|
961
971
|
if (t.protected === void 0 && t.header === void 0)
|
|
962
972
|
throw new f('Flattened JWS must have either of the "protected" or "header" members');
|
|
@@ -966,68 +976,71 @@ async function Le(t, e, r) {
|
|
|
966
976
|
throw new f("JWS Payload missing");
|
|
967
977
|
if (typeof t.signature != "string")
|
|
968
978
|
throw new f("JWS Signature missing or incorrect type");
|
|
969
|
-
if (t.header !== void 0 && !
|
|
979
|
+
if (t.header !== void 0 && !b(t.header))
|
|
970
980
|
throw new f("JWS Unprotected Header incorrect type");
|
|
971
981
|
let n = {};
|
|
972
982
|
if (t.protected)
|
|
973
983
|
try {
|
|
974
|
-
const
|
|
975
|
-
n = JSON.parse(_.decode(
|
|
984
|
+
const he = C(t.protected);
|
|
985
|
+
n = JSON.parse(_.decode(he));
|
|
976
986
|
} catch {
|
|
977
987
|
throw new f("JWS Protected Header is invalid");
|
|
978
988
|
}
|
|
979
|
-
if (!
|
|
989
|
+
if (!_e(n, t.header))
|
|
980
990
|
throw new f("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
|
|
981
991
|
const s = {
|
|
982
992
|
...n,
|
|
983
993
|
...t.header
|
|
984
|
-
}, a =
|
|
994
|
+
}, a = Ie(f, /* @__PURE__ */ new Map([["b64", !0]]), r?.crit, n, s);
|
|
985
995
|
let i = !0;
|
|
986
996
|
if (a.has("b64") && (i = n.b64, typeof i != "boolean"))
|
|
987
997
|
throw new f('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
|
|
988
998
|
const { alg: c } = s;
|
|
989
999
|
if (typeof c != "string" || !c)
|
|
990
1000
|
throw new f('JWS "alg" (Algorithm) Header Parameter missing or invalid');
|
|
1001
|
+
const h = r && Je("algorithms", r.algorithms);
|
|
1002
|
+
if (h && !h.has(c))
|
|
1003
|
+
throw new ge('"alg" (Algorithm) Header Parameter value not allowed');
|
|
991
1004
|
if (i) {
|
|
992
1005
|
if (typeof t.payload != "string")
|
|
993
1006
|
throw new f("JWS Payload must be a string");
|
|
994
1007
|
} else if (typeof t.payload != "string" && !(t.payload instanceof Uint8Array))
|
|
995
1008
|
throw new f("JWS Payload must be a string or an Uint8Array instance");
|
|
996
1009
|
let u = !1;
|
|
997
|
-
typeof e == "function" && (e = await e(n, t), u = !0),
|
|
998
|
-
const
|
|
999
|
-
let
|
|
1010
|
+
typeof e == "function" && (e = await e(n, t), u = !0), Le(c, e, "verify");
|
|
1011
|
+
const o = we(t.protected !== void 0 ? x(t.protected) : new Uint8Array(), x("."), typeof t.payload == "string" ? i ? x(t.payload) : B.encode(t.payload) : t.payload);
|
|
1012
|
+
let l;
|
|
1000
1013
|
try {
|
|
1001
|
-
|
|
1014
|
+
l = C(t.signature);
|
|
1002
1015
|
} catch {
|
|
1003
1016
|
throw new f("Failed to base64url decode the signature");
|
|
1004
1017
|
}
|
|
1005
|
-
const
|
|
1006
|
-
if (!await
|
|
1007
|
-
throw new
|
|
1008
|
-
let
|
|
1018
|
+
const R = await Me(e, c);
|
|
1019
|
+
if (!await Ve(c, R, l, o))
|
|
1020
|
+
throw new Ae();
|
|
1021
|
+
let p;
|
|
1009
1022
|
if (i)
|
|
1010
1023
|
try {
|
|
1011
|
-
|
|
1024
|
+
p = C(t.payload);
|
|
1012
1025
|
} catch {
|
|
1013
1026
|
throw new f("Failed to base64url decode the payload");
|
|
1014
1027
|
}
|
|
1015
|
-
else typeof t.payload == "string" ?
|
|
1016
|
-
const
|
|
1017
|
-
return t.protected !== void 0 && (
|
|
1028
|
+
else typeof t.payload == "string" ? p = B.encode(t.payload) : p = t.payload;
|
|
1029
|
+
const E = { payload: p };
|
|
1030
|
+
return t.protected !== void 0 && (E.protectedHeader = n), t.header !== void 0 && (E.unprotectedHeader = t.header), u ? { ...E, key: R } : E;
|
|
1018
1031
|
}
|
|
1019
|
-
async function
|
|
1032
|
+
async function Be(t, e, r) {
|
|
1020
1033
|
if (t instanceof Uint8Array && (t = _.decode(t)), typeof t != "string")
|
|
1021
1034
|
throw new f("Compact JWS must be a string or Uint8Array");
|
|
1022
1035
|
const { 0: n, 1: s, 2: a, length: i } = t.split(".");
|
|
1023
1036
|
if (i !== 3)
|
|
1024
1037
|
throw new f("Invalid Compact JWS");
|
|
1025
|
-
const c = await
|
|
1026
|
-
return typeof e == "function" ? { ...
|
|
1038
|
+
const c = await Ge({ payload: s, protected: n, signature: a }, e, r), h = { payload: c.payload, protectedHeader: c.protectedHeader };
|
|
1039
|
+
return typeof e == "function" ? { ...h, key: c.key } : h;
|
|
1027
1040
|
}
|
|
1028
|
-
const
|
|
1029
|
-
function
|
|
1030
|
-
const e =
|
|
1041
|
+
const ze = (t) => Math.floor(t.getTime() / 1e3), ce = 60, ue = ce * 60, G = ue * 24, qe = G * 7, Ye = G * 365.25, Xe = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
|
|
1042
|
+
function Y(t) {
|
|
1043
|
+
const e = Xe.exec(t);
|
|
1031
1044
|
if (!e || e[4] && e[1])
|
|
1032
1045
|
throw new TypeError("Invalid time period format");
|
|
1033
1046
|
const r = parseFloat(e[2]), n = e[3].toLowerCase();
|
|
@@ -1045,45 +1058,45 @@ function q(t) {
|
|
|
1045
1058
|
case "min":
|
|
1046
1059
|
case "mins":
|
|
1047
1060
|
case "m":
|
|
1048
|
-
s = Math.round(r *
|
|
1061
|
+
s = Math.round(r * ce);
|
|
1049
1062
|
break;
|
|
1050
1063
|
case "hour":
|
|
1051
1064
|
case "hours":
|
|
1052
1065
|
case "hr":
|
|
1053
1066
|
case "hrs":
|
|
1054
1067
|
case "h":
|
|
1055
|
-
s = Math.round(r *
|
|
1068
|
+
s = Math.round(r * ue);
|
|
1056
1069
|
break;
|
|
1057
1070
|
case "day":
|
|
1058
1071
|
case "days":
|
|
1059
1072
|
case "d":
|
|
1060
|
-
s = Math.round(r *
|
|
1073
|
+
s = Math.round(r * G);
|
|
1061
1074
|
break;
|
|
1062
1075
|
case "week":
|
|
1063
1076
|
case "weeks":
|
|
1064
1077
|
case "w":
|
|
1065
|
-
s = Math.round(r *
|
|
1078
|
+
s = Math.round(r * qe);
|
|
1066
1079
|
break;
|
|
1067
1080
|
default:
|
|
1068
|
-
s = Math.round(r *
|
|
1081
|
+
s = Math.round(r * Ye);
|
|
1069
1082
|
break;
|
|
1070
1083
|
}
|
|
1071
1084
|
return e[1] === "-" || e[4] === "ago" ? -s : s;
|
|
1072
1085
|
}
|
|
1073
|
-
const
|
|
1074
|
-
function
|
|
1086
|
+
const X = (t) => t.includes("/") ? t.toLowerCase() : `application/${t.toLowerCase()}`, Qe = (t, e) => typeof t == "string" ? e.includes(t) : Array.isArray(t) ? e.some(Set.prototype.has.bind(new Set(t))) : !1;
|
|
1087
|
+
function Ze(t, e, r = {}) {
|
|
1075
1088
|
let n;
|
|
1076
1089
|
try {
|
|
1077
1090
|
n = JSON.parse(_.decode(e));
|
|
1078
1091
|
} catch {
|
|
1079
1092
|
}
|
|
1080
|
-
if (!
|
|
1081
|
-
throw new
|
|
1093
|
+
if (!b(n))
|
|
1094
|
+
throw new ee("JWT Claims Set must be a top-level JSON object");
|
|
1082
1095
|
const { typ: s } = r;
|
|
1083
|
-
if (s && (typeof t.typ != "string" ||
|
|
1096
|
+
if (s && (typeof t.typ != "string" || X(t.typ) !== X(s)))
|
|
1084
1097
|
throw new y('unexpected "typ" JWT header value', n, "typ", "check_failed");
|
|
1085
|
-
const { requiredClaims: a = [], issuer: i, subject: c, audience:
|
|
1086
|
-
|
|
1098
|
+
const { requiredClaims: a = [], issuer: i, subject: c, audience: h, maxTokenAge: u } = r, o = [...a];
|
|
1099
|
+
u !== void 0 && o.push("iat"), h !== void 0 && o.push("aud"), c !== void 0 && o.push("sub"), i !== void 0 && o.push("iss");
|
|
1087
1100
|
for (const p of new Set(o.reverse()))
|
|
1088
1101
|
if (!(p in n))
|
|
1089
1102
|
throw new y(`missing required "${p}" claim`, n, p, "missing");
|
|
@@ -1091,54 +1104,54 @@ function Ye(t, e, r = {}) {
|
|
|
1091
1104
|
throw new y('unexpected "iss" claim value', n, "iss", "check_failed");
|
|
1092
1105
|
if (c && n.sub !== c)
|
|
1093
1106
|
throw new y('unexpected "sub" claim value', n, "sub", "check_failed");
|
|
1094
|
-
if (
|
|
1107
|
+
if (h && !Qe(n.aud, typeof h == "string" ? [h] : h))
|
|
1095
1108
|
throw new y('unexpected "aud" claim value', n, "aud", "check_failed");
|
|
1096
|
-
let
|
|
1109
|
+
let l;
|
|
1097
1110
|
switch (typeof r.clockTolerance) {
|
|
1098
1111
|
case "string":
|
|
1099
|
-
|
|
1112
|
+
l = Y(r.clockTolerance);
|
|
1100
1113
|
break;
|
|
1101
1114
|
case "number":
|
|
1102
|
-
|
|
1115
|
+
l = r.clockTolerance;
|
|
1103
1116
|
break;
|
|
1104
1117
|
case "undefined":
|
|
1105
|
-
|
|
1118
|
+
l = 0;
|
|
1106
1119
|
break;
|
|
1107
1120
|
default:
|
|
1108
1121
|
throw new TypeError("Invalid clockTolerance option type");
|
|
1109
1122
|
}
|
|
1110
|
-
const { currentDate:
|
|
1111
|
-
if ((n.iat !== void 0 ||
|
|
1123
|
+
const { currentDate: R } = r, P = ze(R || /* @__PURE__ */ new Date());
|
|
1124
|
+
if ((n.iat !== void 0 || u) && typeof n.iat != "number")
|
|
1112
1125
|
throw new y('"iat" claim must be a number', n, "iat", "invalid");
|
|
1113
1126
|
if (n.nbf !== void 0) {
|
|
1114
1127
|
if (typeof n.nbf != "number")
|
|
1115
1128
|
throw new y('"nbf" claim must be a number', n, "nbf", "invalid");
|
|
1116
|
-
if (n.nbf >
|
|
1129
|
+
if (n.nbf > P + l)
|
|
1117
1130
|
throw new y('"nbf" claim timestamp check failed', n, "nbf", "check_failed");
|
|
1118
1131
|
}
|
|
1119
1132
|
if (n.exp !== void 0) {
|
|
1120
1133
|
if (typeof n.exp != "number")
|
|
1121
1134
|
throw new y('"exp" claim must be a number', n, "exp", "invalid");
|
|
1122
|
-
if (n.exp <=
|
|
1135
|
+
if (n.exp <= P - l)
|
|
1123
1136
|
throw new z('"exp" claim timestamp check failed', n, "exp", "check_failed");
|
|
1124
1137
|
}
|
|
1125
|
-
if (
|
|
1126
|
-
const p =
|
|
1127
|
-
if (p -
|
|
1138
|
+
if (u) {
|
|
1139
|
+
const p = P - n.iat, E = typeof u == "number" ? u : Y(u);
|
|
1140
|
+
if (p - l > E)
|
|
1128
1141
|
throw new z('"iat" claim timestamp check failed (too far in the past)', n, "iat", "check_failed");
|
|
1129
|
-
if (p < 0 -
|
|
1142
|
+
if (p < 0 - l)
|
|
1130
1143
|
throw new y('"iat" claim timestamp check failed (it should be in the past)', n, "iat", "check_failed");
|
|
1131
1144
|
}
|
|
1132
1145
|
return n;
|
|
1133
1146
|
}
|
|
1134
|
-
async function
|
|
1135
|
-
const n = await
|
|
1147
|
+
async function je(t, e, r) {
|
|
1148
|
+
const n = await Be(t, e, r);
|
|
1136
1149
|
if (n.protectedHeader.crit?.includes("b64") && n.protectedHeader.b64 === !1)
|
|
1137
|
-
throw new
|
|
1138
|
-
const a = { payload:
|
|
1150
|
+
throw new ee("JWTs MUST NOT use unencoded payload");
|
|
1151
|
+
const a = { payload: Ze(n.protectedHeader, n.payload, r), protectedHeader: n.protectedHeader };
|
|
1139
1152
|
return typeof e == "function" ? { ...a, key: n.key } : a;
|
|
1140
1153
|
}
|
|
1141
|
-
function
|
|
1154
|
+
function et(t) {
|
|
1142
1155
|
switch (typeof t == "string" && t.slice(0, 2)) {
|
|
1143
1156
|
case "RS":
|
|
1144
1157
|
case "PS":
|
|
@@ -1153,71 +1166,71 @@ function Qe(t) {
|
|
|
1153
1166
|
throw new w('Unsupported "alg" value for a JSON Web Key Set');
|
|
1154
1167
|
}
|
|
1155
1168
|
}
|
|
1156
|
-
function
|
|
1157
|
-
return t && typeof t == "object" && Array.isArray(t.keys) && t.keys.every(
|
|
1169
|
+
function tt(t) {
|
|
1170
|
+
return t && typeof t == "object" && Array.isArray(t.keys) && t.keys.every(rt);
|
|
1158
1171
|
}
|
|
1159
|
-
function
|
|
1160
|
-
return
|
|
1172
|
+
function rt(t) {
|
|
1173
|
+
return b(t);
|
|
1161
1174
|
}
|
|
1162
|
-
class
|
|
1175
|
+
class nt {
|
|
1163
1176
|
#r;
|
|
1164
1177
|
#i = /* @__PURE__ */ new WeakMap();
|
|
1165
1178
|
constructor(e) {
|
|
1166
|
-
if (!
|
|
1167
|
-
throw new
|
|
1179
|
+
if (!tt(e))
|
|
1180
|
+
throw new te("JSON Web Key Set malformed");
|
|
1168
1181
|
this.#r = structuredClone(e);
|
|
1169
1182
|
}
|
|
1170
1183
|
jwks() {
|
|
1171
1184
|
return this.#r;
|
|
1172
1185
|
}
|
|
1173
1186
|
async getKey(e, r) {
|
|
1174
|
-
const { alg: n, kid: s } = { ...e, ...r?.header }, a =
|
|
1175
|
-
let o = a ===
|
|
1176
|
-
if (o && typeof s == "string" && (o = s ===
|
|
1187
|
+
const { alg: n, kid: s } = { ...e, ...r?.header }, a = et(n), i = this.#r.keys.filter((u) => {
|
|
1188
|
+
let o = a === u.kty;
|
|
1189
|
+
if (o && typeof s == "string" && (o = s === u.kid), o && (typeof u.alg == "string" || a === "AKP") && (o = n === u.alg), o && typeof u.use == "string" && (o = u.use === "sig"), o && Array.isArray(u.key_ops) && (o = u.key_ops.includes("verify")), o)
|
|
1177
1190
|
switch (n) {
|
|
1178
1191
|
case "ES256":
|
|
1179
|
-
o =
|
|
1192
|
+
o = u.crv === "P-256";
|
|
1180
1193
|
break;
|
|
1181
1194
|
case "ES384":
|
|
1182
|
-
o =
|
|
1195
|
+
o = u.crv === "P-384";
|
|
1183
1196
|
break;
|
|
1184
1197
|
case "ES512":
|
|
1185
|
-
o =
|
|
1198
|
+
o = u.crv === "P-521";
|
|
1186
1199
|
break;
|
|
1187
1200
|
case "Ed25519":
|
|
1188
1201
|
case "EdDSA":
|
|
1189
|
-
o =
|
|
1202
|
+
o = u.crv === "Ed25519";
|
|
1190
1203
|
break;
|
|
1191
1204
|
}
|
|
1192
1205
|
return o;
|
|
1193
|
-
}), { 0: c, length:
|
|
1194
|
-
if (
|
|
1195
|
-
throw new
|
|
1196
|
-
if (
|
|
1197
|
-
const
|
|
1198
|
-
throw
|
|
1199
|
-
for (const
|
|
1206
|
+
}), { 0: c, length: h } = i;
|
|
1207
|
+
if (h === 0)
|
|
1208
|
+
throw new re();
|
|
1209
|
+
if (h !== 1) {
|
|
1210
|
+
const u = new be(), o = this.#i;
|
|
1211
|
+
throw u[Symbol.asyncIterator] = async function* () {
|
|
1212
|
+
for (const l of i)
|
|
1200
1213
|
try {
|
|
1201
|
-
yield await
|
|
1214
|
+
yield await Q(o, l, n);
|
|
1202
1215
|
} catch {
|
|
1203
1216
|
}
|
|
1204
|
-
},
|
|
1217
|
+
}, u;
|
|
1205
1218
|
}
|
|
1206
|
-
return
|
|
1219
|
+
return Q(this.#i, c, n);
|
|
1207
1220
|
}
|
|
1208
1221
|
}
|
|
1209
|
-
async function
|
|
1222
|
+
async function Q(t, e, r) {
|
|
1210
1223
|
const n = t.get(e) || t.set(e, {}).get(e);
|
|
1211
1224
|
if (n[r] === void 0) {
|
|
1212
|
-
const s = await
|
|
1225
|
+
const s = await ke({ ...e, ext: !0 }, r);
|
|
1213
1226
|
if (s instanceof Uint8Array || s.type !== "public")
|
|
1214
|
-
throw new
|
|
1227
|
+
throw new te("JSON Web Key Set members must be public keys");
|
|
1215
1228
|
n[r] = s;
|
|
1216
1229
|
}
|
|
1217
1230
|
return n[r];
|
|
1218
1231
|
}
|
|
1219
|
-
function
|
|
1220
|
-
const e = new
|
|
1232
|
+
function Z(t) {
|
|
1233
|
+
const e = new nt(t), r = async (n, s) => e.getKey(n, s);
|
|
1221
1234
|
return Object.defineProperties(r, {
|
|
1222
1235
|
jwks: {
|
|
1223
1236
|
value: () => structuredClone(e.jwks()),
|
|
@@ -1227,34 +1240,34 @@ function Q(t) {
|
|
|
1227
1240
|
}
|
|
1228
1241
|
}), r;
|
|
1229
1242
|
}
|
|
1230
|
-
function
|
|
1243
|
+
function st() {
|
|
1231
1244
|
return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
|
|
1232
1245
|
}
|
|
1233
|
-
let
|
|
1234
|
-
(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (
|
|
1235
|
-
const
|
|
1236
|
-
async function
|
|
1246
|
+
let H;
|
|
1247
|
+
(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (H = "jose/v6.1.3");
|
|
1248
|
+
const at = /* @__PURE__ */ Symbol();
|
|
1249
|
+
async function it(t, e, r, n = fetch) {
|
|
1237
1250
|
const s = await n(t, {
|
|
1238
1251
|
method: "GET",
|
|
1239
1252
|
signal: r,
|
|
1240
1253
|
redirect: "manual",
|
|
1241
1254
|
headers: e
|
|
1242
1255
|
}).catch((a) => {
|
|
1243
|
-
throw a.name === "TimeoutError" ? new
|
|
1256
|
+
throw a.name === "TimeoutError" ? new Ee() : a;
|
|
1244
1257
|
});
|
|
1245
1258
|
if (s.status !== 200)
|
|
1246
|
-
throw new
|
|
1259
|
+
throw new d("Expected 200 OK from the JSON Web Key Set HTTP response");
|
|
1247
1260
|
try {
|
|
1248
1261
|
return await s.json();
|
|
1249
1262
|
} catch {
|
|
1250
|
-
throw new
|
|
1263
|
+
throw new d("Failed to parse the JSON Web Key Set HTTP response as JSON");
|
|
1251
1264
|
}
|
|
1252
1265
|
}
|
|
1253
|
-
const
|
|
1254
|
-
function
|
|
1255
|
-
return !(typeof t != "object" || t === null || !("uat" in t) || typeof t.uat != "number" || Date.now() - t.uat >= e || !("jwks" in t) || !
|
|
1266
|
+
const D = /* @__PURE__ */ Symbol();
|
|
1267
|
+
function ot(t, e) {
|
|
1268
|
+
return !(typeof t != "object" || t === null || !("uat" in t) || typeof t.uat != "number" || Date.now() - t.uat >= e || !("jwks" in t) || !b(t.jwks) || !Array.isArray(t.jwks.keys) || !Array.prototype.every.call(t.jwks.keys, b));
|
|
1256
1269
|
}
|
|
1257
|
-
class
|
|
1270
|
+
class ct {
|
|
1258
1271
|
#r;
|
|
1259
1272
|
#i;
|
|
1260
1273
|
#c;
|
|
@@ -1262,13 +1275,13 @@ class at {
|
|
|
1262
1275
|
#n;
|
|
1263
1276
|
#e;
|
|
1264
1277
|
#t;
|
|
1265
|
-
#
|
|
1278
|
+
#u;
|
|
1266
1279
|
#s;
|
|
1267
1280
|
#a;
|
|
1268
1281
|
constructor(e, r) {
|
|
1269
1282
|
if (!(e instanceof URL))
|
|
1270
1283
|
throw new TypeError("url must be an instance of URL");
|
|
1271
|
-
this.#r = new URL(e.href), this.#i = typeof r?.timeoutDuration == "number" ? r?.timeoutDuration : 5e3, this.#c = typeof r?.cooldownDuration == "number" ? r?.cooldownDuration : 3e4, this.#o = typeof r?.cacheMaxAge == "number" ? r?.cacheMaxAge : 6e5, this.#t = new Headers(r?.headers),
|
|
1284
|
+
this.#r = new URL(e.href), this.#i = typeof r?.timeoutDuration == "number" ? r?.timeoutDuration : 5e3, this.#c = typeof r?.cooldownDuration == "number" ? r?.cooldownDuration : 3e4, this.#o = typeof r?.cacheMaxAge == "number" ? r?.cacheMaxAge : 6e5, this.#t = new Headers(r?.headers), H && !this.#t.has("User-Agent") && this.#t.set("User-Agent", H), this.#t.has("accept") || (this.#t.set("accept", "application/json"), this.#t.append("accept", "application/jwk-set+json")), this.#u = r?.[at], r?.[D] !== void 0 && (this.#a = r?.[D], ot(r?.[D], this.#o) && (this.#n = this.#a.uat, this.#s = Z(this.#a.jwks)));
|
|
1272
1285
|
}
|
|
1273
1286
|
pendingFetch() {
|
|
1274
1287
|
return !!this.#e;
|
|
@@ -1287,21 +1300,21 @@ class at {
|
|
|
1287
1300
|
try {
|
|
1288
1301
|
return await this.#s(e, r);
|
|
1289
1302
|
} catch (n) {
|
|
1290
|
-
if (n instanceof
|
|
1303
|
+
if (n instanceof re && this.coolingDown() === !1)
|
|
1291
1304
|
return await this.reload(), this.#s(e, r);
|
|
1292
1305
|
throw n;
|
|
1293
1306
|
}
|
|
1294
1307
|
}
|
|
1295
1308
|
async reload() {
|
|
1296
|
-
this.#e &&
|
|
1297
|
-
this.#s =
|
|
1309
|
+
this.#e && st() && (this.#e = void 0), this.#e ||= it(this.#r.href, this.#t, AbortSignal.timeout(this.#i), this.#u).then((e) => {
|
|
1310
|
+
this.#s = Z(e), this.#a && (this.#a.uat = Date.now(), this.#a.jwks = e), this.#n = Date.now(), this.#e = void 0;
|
|
1298
1311
|
}).catch((e) => {
|
|
1299
1312
|
throw this.#e = void 0, e;
|
|
1300
1313
|
}), await this.#e;
|
|
1301
1314
|
}
|
|
1302
1315
|
}
|
|
1303
|
-
function
|
|
1304
|
-
const r = new
|
|
1316
|
+
function ut(t, e) {
|
|
1317
|
+
const r = new ct(t, e), n = async (s, a) => r.getKey(s, a);
|
|
1305
1318
|
return Object.defineProperties(n, {
|
|
1306
1319
|
coolingDown: {
|
|
1307
1320
|
get: () => r.coolingDown(),
|
|
@@ -1332,20 +1345,21 @@ function it(t, e) {
|
|
|
1332
1345
|
}
|
|
1333
1346
|
}), n;
|
|
1334
1347
|
}
|
|
1335
|
-
|
|
1336
|
-
|
|
1337
|
-
|
|
1338
|
-
|
|
1339
|
-
|
|
1340
|
-
|
|
1341
|
-
|
|
1342
|
-
|
|
1343
|
-
|
|
1344
|
-
|
|
1345
|
-
|
|
1348
|
+
const ht = ut(
|
|
1349
|
+
new URL(`${F}/.well-known/jwks.json`)
|
|
1350
|
+
);
|
|
1351
|
+
async function ft(t) {
|
|
1352
|
+
try {
|
|
1353
|
+
const { payload: e } = await je(t, ht, {
|
|
1354
|
+
issuer: F,
|
|
1355
|
+
audience: "authenticated"
|
|
1356
|
+
});
|
|
1357
|
+
return e;
|
|
1358
|
+
} catch (e) {
|
|
1359
|
+
return console.error("Token verification failed:", e), null;
|
|
1346
1360
|
}
|
|
1347
1361
|
}
|
|
1348
|
-
class
|
|
1362
|
+
class dt {
|
|
1349
1363
|
store = /* @__PURE__ */ new Map();
|
|
1350
1364
|
async get(e) {
|
|
1351
1365
|
return this.store.get(e) ?? null;
|
|
@@ -1360,7 +1374,7 @@ class ct {
|
|
|
1360
1374
|
this.store.clear();
|
|
1361
1375
|
}
|
|
1362
1376
|
}
|
|
1363
|
-
class
|
|
1377
|
+
class j {
|
|
1364
1378
|
prefix;
|
|
1365
1379
|
constructor(e = "genation") {
|
|
1366
1380
|
this.prefix = e;
|
|
@@ -1384,7 +1398,7 @@ class Z {
|
|
|
1384
1398
|
).forEach((r) => localStorage.removeItem(r));
|
|
1385
1399
|
}
|
|
1386
1400
|
}
|
|
1387
|
-
class
|
|
1401
|
+
class lt {
|
|
1388
1402
|
prefix;
|
|
1389
1403
|
constructor(e = "genation") {
|
|
1390
1404
|
this.prefix = e;
|
|
@@ -1408,42 +1422,39 @@ class ht {
|
|
|
1408
1422
|
).forEach((r) => sessionStorage.removeItem(r));
|
|
1409
1423
|
}
|
|
1410
1424
|
}
|
|
1411
|
-
function
|
|
1425
|
+
function pt(t = "localStorage") {
|
|
1412
1426
|
switch (t) {
|
|
1413
1427
|
case "memory":
|
|
1414
|
-
return new
|
|
1428
|
+
return new dt();
|
|
1415
1429
|
case "localStorage":
|
|
1416
|
-
return new
|
|
1430
|
+
return new j();
|
|
1417
1431
|
case "sessionStorage":
|
|
1418
|
-
return new
|
|
1432
|
+
return new lt();
|
|
1419
1433
|
default:
|
|
1420
|
-
return new
|
|
1434
|
+
return new j();
|
|
1421
1435
|
}
|
|
1422
1436
|
}
|
|
1423
|
-
function
|
|
1424
|
-
return Array.isArray(t) ? t.map(
|
|
1437
|
+
function N(t) {
|
|
1438
|
+
return Array.isArray(t) ? t.map(N) : typeof t == "object" && t !== null ? Object.fromEntries(
|
|
1425
1439
|
Object.entries(t).map(([e, r]) => [
|
|
1426
1440
|
e.replace(/_([a-z])/g, (n, s) => s.toUpperCase()),
|
|
1427
|
-
|
|
1441
|
+
N(r)
|
|
1428
1442
|
])
|
|
1429
1443
|
) : t;
|
|
1430
1444
|
}
|
|
1431
|
-
class
|
|
1445
|
+
class yt {
|
|
1432
1446
|
oauth;
|
|
1433
1447
|
tokenManager;
|
|
1434
|
-
tokenVerifier;
|
|
1435
1448
|
http;
|
|
1436
1449
|
httpServer;
|
|
1437
1450
|
listeners = /* @__PURE__ */ new Set();
|
|
1438
1451
|
initialized = !1;
|
|
1439
1452
|
constructor(e) {
|
|
1440
1453
|
this.validateConfig(e);
|
|
1441
|
-
const r = typeof e.storage == "object" ? e.storage :
|
|
1442
|
-
this.tokenManager = new
|
|
1443
|
-
`${n}/.well-known/jwks.json`
|
|
1444
|
-
), this.http = new D({
|
|
1454
|
+
const r = typeof e.storage == "object" ? e.storage : pt(e.storage), n = e.authUrl ?? "https://mnnoheowoowbtpuoguul.supabase.co/auth/v1";
|
|
1455
|
+
this.tokenManager = new ye(r), this.oauth = new me(e, this.tokenManager), this.http = new U({
|
|
1445
1456
|
baseUrl: n
|
|
1446
|
-
}), this.httpServer = new
|
|
1457
|
+
}), this.httpServer = new U({
|
|
1447
1458
|
baseUrl: "https://ff-api.genation.ai/api/v2/client"
|
|
1448
1459
|
});
|
|
1449
1460
|
}
|
|
@@ -1628,8 +1639,7 @@ class ft {
|
|
|
1628
1639
|
* @throws Error if token is invalid
|
|
1629
1640
|
*/
|
|
1630
1641
|
async verifyToken(e) {
|
|
1631
|
-
|
|
1632
|
-
return r;
|
|
1642
|
+
return await ft(e);
|
|
1633
1643
|
}
|
|
1634
1644
|
/**
|
|
1635
1645
|
* Get licenses
|
|
@@ -1646,7 +1656,7 @@ class ft {
|
|
|
1646
1656
|
headers: { Authorization: `Bearer ${n}` },
|
|
1647
1657
|
params: { expiresAfter: s.toISOString() }
|
|
1648
1658
|
});
|
|
1649
|
-
return a.ok ?
|
|
1659
|
+
return a.ok ? N(a.data) : (console.error("GenationClient: Error fetching licenses:", a.error), null);
|
|
1650
1660
|
}
|
|
1651
1661
|
/**
|
|
1652
1662
|
* Fetch user info from auth server
|
|
@@ -1670,19 +1680,20 @@ class ft {
|
|
|
1670
1680
|
}
|
|
1671
1681
|
}
|
|
1672
1682
|
}
|
|
1673
|
-
function
|
|
1674
|
-
return new
|
|
1683
|
+
function mt(t) {
|
|
1684
|
+
return new yt(t);
|
|
1675
1685
|
}
|
|
1676
1686
|
export {
|
|
1677
1687
|
g as AuthError,
|
|
1678
1688
|
v as ConfigError,
|
|
1679
|
-
|
|
1680
|
-
|
|
1681
|
-
|
|
1682
|
-
|
|
1689
|
+
yt as GenationClient,
|
|
1690
|
+
L as GenationError,
|
|
1691
|
+
j as LocalStorage,
|
|
1692
|
+
dt as MemoryStorage,
|
|
1683
1693
|
S as NetworkError,
|
|
1684
|
-
|
|
1685
|
-
|
|
1686
|
-
|
|
1694
|
+
lt as SessionStorage,
|
|
1695
|
+
mt as createClient,
|
|
1696
|
+
pt as createStorage,
|
|
1697
|
+
ft as verifyToken
|
|
1687
1698
|
};
|
|
1688
1699
|
//# sourceMappingURL=genation.es.js.map
|