@globus/sdk 3.9.0 → 4.0.0-rc.2

package/dist/esm/core/authorization/AuthorizationManager.js

@@ -0,0 +1,376 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _AuthorizationManager_instances, _AuthorizationManager_transport, _AuthorizationManager_authenticated, _AuthorizationManager_checkAuthorizationState, _AuthorizationManager_emitAuthenticatedState, _AuthorizationManager_withOfflineAccess, _AuthorizationManager_buildTransport, _AuthorizationManager_revokeToken;
+import { jwtDecode } from 'jwt-decode';
+import { isGlobusAuthTokenResponse, isRefreshToken, oauth2 } from '../../services/auth/index.js';
+import { createStorage, getStorage } from '../storage/index.js';
+import { log } from '../logger.js';
+import { Event } from './Event.js';
+import { RedirectTransport, } from './RedirectTransport.js';
+import { TokenLookup } from './TokenLookup.js';
+import { isConsentRequiredError, isAuthorizationRequirementsError, toAuthorizationQueryParams, } from '../errors.js';
+const DEFAULT_CONFIGURATION = {
+    useRefreshTokens: false,
+    defaultScopes: 'openid profile email',
+};
+const DEFAULT_HANDLE_ERROR_OPTIONS = {
+    execute: true,
+    additionalParams: undefined,
+};
+/**
+ * Provides management of Globus authorization context for your application.
+ * - Handles the OAuth protcol flow (via PKCE)
+ * - Token lifecycle management
+ * - Common errors (e.g., `ConsentRequired`, `authorization_requirements`)
+ *
+ * Once you configure your instance, you can determine the authenticated state using `manager.authenticated`.
+ *
+ * To prompt a user to authenticate, call `manager.login()` on user interaction – this will initiate the OAuth protocol flow with your configured client and scopes, resulting in an initial redirect to Globus Auth.
+ *
+ * Once the user authenticates with Globus Auth, they will be redirected to your application using the configured `redirect` URL. On this URL, you will need to call `manager.handleCodeRedirect` (using a manager instance configured in the same manner that initiated the `manager.login()` call) to complete the PKCE flow, exchanging the provided code for a valid token, or tokens.
+ *
+ * All tokens managed by the `AuthorizationManager` instance can be found on `manager.token`.
+ *
+ * ### Registering your Globus Application
+ *
+ * The `AuthorizationManager` expects your Globus Application to be registered as an OAuth public client.
+ * In this Globus Web Application, this option is referenced as "_Register a thick client or script that will be installed and run by users on their devices_".
+ *
+ * @example <caption>Creating an AuthorizationManager instance.</caption>
+ * import { authorization } from "globus/sdk";
+ *
+ * const manager = authorization.create({
+ *  // Your registered Globus Application client ID.
+ *  client: '...',
+ *  // The redirect URL for your application; Where you will call `manager.handleCodeRedirect()`
+ *  redirect: 'https://example.com/callback',
+ *  // Known scopes required by your application.
+ *  scopes: 'urn:globus:auth:scope:transfer.api.globus.org:all',
+ * });
+ */
+export class AuthorizationManager {
+    /**
+     * The `AuthorizationManager` is considered `authenticated` if it has a valid Globus Auth token.
+     * It does not necessarily mean that it has a valid token for a specific resource server.
+     */
+    get authenticated() {
+        return __classPrivateFieldGet(this, _AuthorizationManager_authenticated, "f");
+    }
+    /**
+     * Set the authenticated state and emit the `authenticated` event.
+     */
+    set authenticated(value) {
+        /**
+         * Avoid emitting the event if the value hasn't changed.
+         */
+        if (value === __classPrivateFieldGet(this, _AuthorizationManager_authenticated, "f")) {
+            return;
+        }
+        __classPrivateFieldSet(this, _AuthorizationManager_authenticated, value, "f");
+        __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_emitAuthenticatedState).call(this);
+    }
+    constructor(configuration) {
+        var _a;
+        _AuthorizationManager_instances.add(this);
+        _AuthorizationManager_transport.set(this, void 0);
+        _AuthorizationManager_authenticated.set(this, false);
+        this.events = {
+            /**
+             * Emitted when the authenticated state changes.
+             * @event AuthorizationManager.events#authenticated
+             * @type {object}
+             * @property {boolean} isAuthenticated - Whether the `AuthorizationManager` is authenticated.
+             * @property {TokenResponse} [token] - The token response if the `AuthorizationManager` is authenticated.
+             */
+            authenticated: new Event('authenticated'),
+            /**
+             * Emitted when the user revokes their authentication.
+             * @event AuthorizationManager.events#revoke
+             */
+            revoke: new Event('revoke'),
+        };
+        /**
+         * Add a Globus Auth token response to storage, if `other_tokens` are present they are also added.
+         * This method is mostly used internally by the `AuthorizationManager`, but can be used by downstream
+         * consumers to add tokens to storage if necessary.
+         */
+        this.addTokenResponse = (token) => {
+            var _a;
+            getStorage().set(`${this.configuration.client}:${token.resource_server}`, token);
+            if ('other_tokens' in token) {
+                (_a = token.other_tokens) === null || _a === void 0 ? void 0 : _a.forEach(this.addTokenResponse);
+            }
+            __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_checkAuthorizationState).call(this);
+        };
+        /**
+         * @todo Add support for passing in an alternative storage mechanism.
+         */
+        createStorage('localStorage');
+        if (!configuration.client) {
+            throw new Error('You must provide a `client` for your application.');
+        }
+        /**
+         * Inject the `openid`, `profile`, `email`, and `offline_access` scopes by default unless
+         * explicitly opted out of.
+         */
+        const scopes = configuration.defaultScopes === false
+            ? ''
+            : ((_a = configuration.defaultScopes) !== null && _a !== void 0 ? _a : DEFAULT_CONFIGURATION.defaultScopes);
+        this.configuration = Object.assign(Object.assign(Object.assign({}, DEFAULT_CONFIGURATION), configuration), { scopes: [configuration.scopes ? configuration.scopes : '', scopes]
+                .filter((s) => s.length)
+                .join(' ') });
+        /**
+         * If an `events` object is provided, add the listeners to the instance before
+         * any event might be dispatched.
+         */
+        if (this.configuration.events) {
+            Object.entries(this.configuration.events).forEach(([name, callback]) => {
+                if (name in this.events) {
+                    this.events[name].addListener(callback);
+                }
+            });
+        }
+        this.tokens = new TokenLookup({
+            manager: this,
+        });
+        __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_checkAuthorizationState).call(this);
+    }
+    get storageKeyPrefix() {
+        return `${this.configuration.client}:`;
+    }
+    /**
+     * The user information decoded from the `id_token` (JWT) of the current Globus Auth token.
+     * This method can be used instead of `auth.oauth2.userinfo` to get the user information without an additional request.
+     *
+     * **IMPORTANT**: The `id_token` can only be processed if the `openid` scope is requested during the authorization process.
+     *
+     * Additionally, the `profile` and `email` scopes are required to get the full user information.
+     *
+     * @see {@link https://docs.globus.org/api/auth/reference/#oidc_userinfo_endpoint}
+     */
+    get user() {
+        const token = this.getGlobusAuthToken();
+        return token && token.id_token ? jwtDecode(token.id_token) : null;
+    }
+    /**
+     * Attempt to refresh all of the tokens managed by the instance.
+     * This method will only attempt to refresh tokens that have a `refresh_token` attribute.
+     */
+    refreshTokens() {
+        return __awaiter(this, void 0, void 0, function* () {
+            log('debug', 'AuthorizationManager.refreshTokens');
+            const tokens = yield Promise.allSettled(this.tokens.getAll().map((token) => {
+                if (isRefreshToken(token)) {
+                    return this.refreshToken(token);
+                }
+                return Promise.resolve(null);
+            }));
+            __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_checkAuthorizationState).call(this);
+            return tokens;
+        });
+    }
+    /**
+     * Use the `refresh_token` attribute of a token to obtain a new access token.
+     * @param token The well-formed token with a `refresh_token` attribute.
+     */
+    refreshToken(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            log('debug', `AuthorizationManager.refreshToken | resource_server=${token.resource_server}`);
+            try {
+                const response = yield (yield oauth2.token.refresh({
+                    payload: {
+                        client_id: this.configuration.client,
+                        refresh_token: token.refresh_token,
+                        grant_type: 'refresh_token',
+                    },
+                })).json();
+                if (isGlobusAuthTokenResponse(response)) {
+                    this.addTokenResponse(response);
+                    return response;
+                }
+            }
+            catch (error) {
+                log('error', `AuthorizationManager.refreshToken | resource_server=${token.resource_server}`);
+            }
+            return null;
+        });
+    }
+    /**
+     * Whether or not the instance has a reference to a Globus Auth token.
+     */
+    hasGlobusAuthToken() {
+        return this.getGlobusAuthToken() !== null;
+    }
+    /**
+     * Retrieve the Globus Auth token managed by the instance.
+     */
+    getGlobusAuthToken() {
+        const entry = getStorage().get(`${this.storageKeyPrefix}auth.globus.org`);
+        return entry ? JSON.parse(entry) : null;
+    }
+    /**
+     * Reset the authenticated state and clear all tokens from storage.
+     * This method **does not** emit the `revoke` event. If you need to emit the `revoke` event, use the `AuthorizationManager.revoke` method.
+     */
+    reset() {
+        getStorage()
+            .keys()
+            .forEach((key) => {
+            if (key.startsWith(this.storageKeyPrefix)) {
+                getStorage().remove(key);
+            }
+        });
+        this.authenticated = false;
+    }
+    /**
+     * Initiate the login process by redirecting to the Globus Auth login page.
+     */
+    login() {
+        return __awaiter(this, arguments, void 0, function* (options = { additionalParams: {} }) {
+            log('debug', 'AuthorizationManager.login');
+            this.reset();
+            /**
+             * In the future, it's possible that we may want to support different types of transports.
+             */
+            const transport = __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_buildTransport).call(this, { params: options === null || options === void 0 ? void 0 : options.additionalParams });
+            yield transport.send();
+        });
+    }
+    /**
+     * This method will attempt to complete the PKCE protocol flow.
+     */
+    handleCodeRedirect() {
+        return __awaiter(this, arguments, void 0, function* (options = { shouldReplace: true, additionalParams: {} }) {
+            log('debug', 'AuthorizationManager.handleCodeRedirect');
+            const response = yield __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_buildTransport).call(this, { params: options === null || options === void 0 ? void 0 : options.additionalParams }).getToken({
+                shouldReplace: options === null || options === void 0 ? void 0 : options.shouldReplace,
+            });
+            if (isGlobusAuthTokenResponse(response)) {
+                log('debug', `AuthorizationManager.handleCodeRedirect | response=${JSON.stringify(response)}`);
+                this.addTokenResponse(response);
+            }
+        });
+    }
+    handleErrorResponse(response, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const opts = typeof options === 'boolean'
+                ? Object.assign(Object.assign({}, DEFAULT_HANDLE_ERROR_OPTIONS), { execute: options }) : Object.assign(Object.assign({}, DEFAULT_HANDLE_ERROR_OPTIONS), options);
+            log('debug', `AuthorizationManager.handleErrorResponse | response=${JSON.stringify(response)} execute=${opts.execute}`);
+            let handler = () => __awaiter(this, void 0, void 0, function* () { });
+            if (isAuthorizationRequirementsError(response)) {
+                log('debug', 'AuthorizationManager.handleErrorResponse | error=AuthorizationRequirementsError');
+                handler = () => __awaiter(this, void 0, void 0, function* () {
+                    yield this.handleAuthorizationRequirementsError(response, {
+                        additionalParams: opts.additionalParams,
+                    });
+                });
+            }
+            if (isConsentRequiredError(response)) {
+                log('debug', 'AuthorizationManager.handleErrorResponse | error=ConsentRequiredError');
+                handler = () => __awaiter(this, void 0, void 0, function* () {
+                    yield this.handleConsentRequiredError(response, {
+                        additionalParams: opts.additionalParams,
+                    });
+                });
+            }
+            if ('code' in response && response['code'] === 'AuthenticationFailed') {
+                log('debug', 'AuthorizationManager.handleErrorResponse | error=AuthenticationFailed');
+                handler = () => __awaiter(this, void 0, void 0, function* () {
+                    yield this.revoke();
+                });
+            }
+            const returnValue = opts.execute === true ? yield handler() : handler;
+            return returnValue;
+        });
+    }
+    /**
+     * Process a well-formed Authorization Requirements error response from a Globus service
+     * and redirect the user to the Globus Auth login page with the necessary parameters.
+     */
+    handleAuthorizationRequirementsError(response, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            __classPrivateFieldSet(this, _AuthorizationManager_transport, __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_buildTransport).call(this, {
+                params: Object.assign(Object.assign({ prompt: 'login' }, toAuthorizationQueryParams(response)), options === null || options === void 0 ? void 0 : options.additionalParams),
+            }), "f");
+            yield __classPrivateFieldGet(this, _AuthorizationManager_transport, "f").send();
+        });
+    }
+    /**
+     * Process a well-formed `ConsentRequired` error response from a Globus service
+     * and redirect the user to the Globus Auth login page with the necessary parameters.
+     */
+    handleConsentRequiredError(response, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            __classPrivateFieldSet(this, _AuthorizationManager_transport, __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_buildTransport).call(this, {
+                scopes: __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_withOfflineAccess).call(this, response.required_scopes.join(' ')),
+                params: Object.assign({}, options === null || options === void 0 ? void 0 : options.additionalParams),
+            }), "f");
+            yield __classPrivateFieldGet(this, _AuthorizationManager_transport, "f").send();
+        });
+    }
+    /**
+     * Call `AuthroizationManager.reset`, revoke all of the available tokns, and emit the `revoke` event.
+     * @emits AuthorizationManager.events#revoke
+     * @see AuthorizationManager.reset
+     */
+    revoke() {
+        return __awaiter(this, void 0, void 0, function* () {
+            log('debug', 'AuthorizationManager.revoke');
+            const revocation = Promise.all(this.tokens.getAll().map(__classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_revokeToken).bind(this)));
+            this.reset();
+            yield revocation;
+            yield this.events.revoke.dispatch();
+        });
+    }
+}
+_AuthorizationManager_transport = new WeakMap(), _AuthorizationManager_authenticated = new WeakMap(), _AuthorizationManager_instances = new WeakSet(), _AuthorizationManager_checkAuthorizationState = function _AuthorizationManager_checkAuthorizationState() {
+    log('debug', 'AuthorizationManager.#checkAuthorizationState');
+    if (this.hasGlobusAuthToken()) {
+        this.authenticated = true;
+    }
+}, _AuthorizationManager_emitAuthenticatedState = function _AuthorizationManager_emitAuthenticatedState() {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const isAuthenticated = this.authenticated;
+        const token = (_a = this.getGlobusAuthToken()) !== null && _a !== void 0 ? _a : undefined;
+        yield this.events.authenticated.dispatch({
+            isAuthenticated,
+            token,
+        });
+    });
+}, _AuthorizationManager_withOfflineAccess = function _AuthorizationManager_withOfflineAccess(scopes) {
+    return `${scopes}${this.configuration.useRefreshTokens ? ' offline_access' : ''}`;
+}, _AuthorizationManager_buildTransport = function _AuthorizationManager_buildTransport(overrides) {
+    var _a;
+    const scopes = __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_withOfflineAccess).call(this, (_a = overrides === null || overrides === void 0 ? void 0 : overrides.scopes) !== null && _a !== void 0 ? _a : (this.configuration.scopes || ''));
+    return new RedirectTransport(Object.assign(Object.assign({ client: this.configuration.client, redirect: this.configuration.redirect, scopes }, overrides), { 
+        // @todo Decide if we want to include the `include_consented_scopes` parameter by default.
+        params: Object.assign({}, overrides === null || overrides === void 0 ? void 0 : overrides.params) }));
+}, _AuthorizationManager_revokeToken = function _AuthorizationManager_revokeToken(token) {
+    log('debug', `AuthorizationManager.revokeToken | resource_server=${token.resource_server}`);
+    return oauth2.token.revoke({
+        payload: {
+            client_id: this.configuration.client,
+            token: token.access_token,
+        },
+    });
+};
+//# sourceMappingURL=AuthorizationManager.js.map

package/dist/esm/core/authorization/AuthorizationManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationManager.js","sourceRoot":"","sources":["../../../../src/core/authorization/AuthorizationManager.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAEjG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAGL,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAGhC,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AAmCtB,MAAM,qBAAqB,GAAG;IAC5B,gBAAgB,EAAE,KAAK;IACvB,aAAa,EAAE,sBAAsB;CACtC,CAAC;AAEF,MAAM,4BAA4B,GAAG;IACnC,OAAO,EAAE,IAAI;IACb,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,OAAO,oBAAoB;IAO/B;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,uBAAA,IAAI,2CAAe,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,aAAa,CAAC,KAAc;QAC9B;;WAEG;QACH,IAAI,KAAK,KAAK,uBAAA,IAAI,2CAAe,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,uBAAA,IAAI,uCAAkB,KAAK,MAAA,CAAC;QAC5B,uBAAA,IAAI,qFAAwB,MAA5B,IAAI,CAA0B,CAAC;IACjC,CAAC;IA8BD,YAAY,aAAgD;;;QAxD5D,kDAA+B;QAI/B,8CAAiB,KAAK,EAAC;QA0BvB,WAAM,GAAG;YACP;;;;;;eAMG;YACH,aAAa,EAAE,IAAI,KAAK,CAUtB,eAAe,CAAC;YAClB;;;eAGG;YACH,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC;SAC5B,CAAC;QA2TF;;;;WAIG;QACH,qBAAgB,GAAG,CAAC,KAA4B,EAAE,EAAE;;YAClD,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC;YACjF,IAAI,cAAc,IAAI,KAAK,EAAE,CAAC;gBAC5B,MAAA,KAAK,CAAC,YAAY,0CAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACrD,CAAC;YACD,uBAAA,IAAI,sFAAyB,MAA7B,IAAI,CAA2B,CAAC;QAClC,CAAC,CAAC;QAnUA;;WAEG;QACH,aAAa,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD;;;WAGG;QACH,MAAM,MAAM,GACV,aAAa,CAAC,aAAa,KAAK,KAAK;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,MAAA,aAAa,CAAC,aAAa,mCAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAE3E,IAAI,CAAC,aAAa,iDACb,qBAAqB,GACrB,aAAa,KAChB,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC;iBAC/D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;iBACvB,IAAI,CAAC,GAAG,CAAC,GACb,CAAC;QACF;;;WAGG;QACH,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;gBACrE,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACxB,IAAI,CAAC,MAAM,CAAC,IAA4C,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC;YAC5B,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,uBAAA,IAAI,sFAAyB,MAA7B,IAAI,CAA2B,CAAC;IAClC,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;IACzC,CAAC;IAED;;;;;;;;;OASG;IACH,IAAI,IAAI;QACN,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxC,OAAO,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAc,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,CAAC;IAED;;;OAGG;IACG,aAAa;;YACjB,GAAG,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CACrC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACjC,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAClC,CAAC;gBACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC,CAAC,CACH,CAAC;YACF,uBAAA,IAAI,sFAAyB,MAA7B,IAAI,CAA2B,CAAC;YAChC,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAED;;;OAGG;IACG,YAAY,CAAC,KAAuB;;YACxC,GAAG,CAAC,OAAO,EAAE,uDAAuD,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CACrB,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;oBACzB,OAAO,EAAE;wBACP,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;wBACpC,aAAa,EAAE,KAAK,CAAC,aAAa;wBAClC,UAAU,EAAE,eAAe;qBAC5B;iBACF,CAAC,CACH,CAAC,IAAI,EAAE,CAAC;gBACT,IAAI,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;oBAChC,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,OAAO,EAAE,uDAAuD,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,kBAAkB,EAAE,KAAK,IAAI,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,iBAAiB,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAkBD;;;OAGG;IACH,KAAK;QACH,UAAU,EAAE;aACT,IAAI,EAAE;aACN,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC1C,UAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IA0BD;;OAEG;IACG,KAAK;6DAAC,OAAO,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE;YAC5C,GAAG,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACb;;eAEG;YACH,MAAM,SAAS,GAAG,uBAAA,IAAI,6EAAgB,MAApB,IAAI,EAAiB,EAAE,MAAM,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,EAAE,CAAC,CAAC;YAC9E,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;KAAA;IAED;;OAEG;IACG,kBAAkB;6DACtB,UAGI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE;YAEjD,GAAG,CAAC,OAAO,EAAE,yCAAyC,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,6EAAgB,MAApB,IAAI,EAAiB,EAAE,MAAM,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC;gBAC1F,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;aACtC,CAAC,CAAC;YACH,IAAI,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,GAAG,CACD,OAAO,EACP,sDAAsD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CACjF,CAAC;gBACF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;KAAA;IAmBK,mBAAmB,CACvB,QAAiC,EACjC,OAEW;;YAEX,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,SAAS;gBAC1B,CAAC,iCACM,4BAA4B,KAC/B,OAAO,EAAE,OAAO,IAEpB,CAAC,iCACM,4BAA4B,GAC5B,OAAO,CACX,CAAC;YACR,GAAG,CACD,OAAO,EACP,uDAAuD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAC1G,CAAC;YACF,IAAI,OAAO,GAAG,GAAS,EAAE,gDAAE,CAAC,CAAA,CAAC;YAC7B,IAAI,gCAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/C,GAAG,CACD,OAAO,EACP,iFAAiF,CAClF,CAAC;gBACF,OAAO,GAAG,GAAS,EAAE;oBACnB,MAAM,IAAI,CAAC,oCAAoC,CAAC,QAAQ,EAAE;wBACxD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;qBACxC,CAAC,CAAC;gBACL,CAAC,CAAA,CAAC;YACJ,CAAC;YACD,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,OAAO,EAAE,uEAAuE,CAAC,CAAC;gBACtF,OAAO,GAAG,GAAS,EAAE;oBACnB,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE;wBAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;qBACxC,CAAC,CAAC;gBACL,CAAC,CAAA,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,sBAAsB,EAAE,CAAC;gBACtE,GAAG,CAAC,OAAO,EAAE,uEAAuE,CAAC,CAAC;gBACtF,OAAO,GAAG,GAAS,EAAE;oBACnB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBACtB,CAAC,CAAA,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACtE,OAAO,WAAW,CAAC;QACrB,CAAC;KAAA;IAED;;;OAGG;IACG,oCAAoC,CACxC,QAAwC,EACxC,OAAmE;;YAEnE,uBAAA,IAAI,mCAAc,uBAAA,IAAI,6EAAgB,MAApB,IAAI,EAAiB;gBACrC,MAAM,gCACJ,MAAM,EAAE,OAAO,IACZ,0BAA0B,CAAC,QAAQ,CAAC,GACpC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,CAC7B;aACF,CAAC,MAAA,CAAC;YACH,MAAM,uBAAA,IAAI,uCAAW,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;KAAA;IAED;;;OAGG;IACG,0BAA0B,CAC9B,QAA8B,EAC9B,OAAmE;;YAEnE,uBAAA,IAAI,mCAAc,uBAAA,IAAI,6EAAgB,MAApB,IAAI,EAAiB;gBACrC,MAAM,EAAE,uBAAA,IAAI,gFAAmB,MAAvB,IAAI,EAAoB,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnE,MAAM,oBACD,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,CAC7B;aACF,CAAC,MAAA,CAAC;YACH,MAAM,uBAAA,IAAI,uCAAW,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;KAAA;IAeD;;;;OAIG;IACG,MAAM;;YACV,GAAG,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAA,IAAI,0EAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,UAAU,CAAC;YACjB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,CAAC;KAAA;CAcF;;IAtOG,GAAG,CAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC;;;QAGC,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,kBAAkB,EAAE,mCAAI,SAAS,CAAC;QACrD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;YACvC,eAAe;YACf,KAAK;SACN,CAAC,CAAC;IACL,CAAC;8FAqBkB,MAAc;IAC/B,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACpF,CAAC,uFAEe,SAA6C;;IAC3D,MAAM,MAAM,GAAG,uBAAA,IAAI,gFAAmB,MAAvB,IAAI,EAAoB,MAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,MAAM,mCAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAE/F,OAAO,IAAI,iBAAiB,+BAC1B,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EACjC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,EACrC,MAAM,IACH,SAAS;QACZ,0FAA0F;QAC1F,MAAM,oBAED,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,MAAM,KAEtB,CAAC;AACL,CAAC,iFAyKY,KAAY;IACvB,GAAG,CAAC,OAAO,EAAE,sDAAsD,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE;YACP,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;YACpC,KAAK,EAAE,KAAK,CAAC,YAAY;SAC1B;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/core/authorization/Event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Event.d.ts","sourceRoot":"","sources":["../../../../src/core/authorization/Event.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,KAAK,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAEvE,qBAAa,KAAK,CAAC,SAAS,SAAS,MAAM,EAAE,OAAO,SAAS,OAAO;;IAGtD,QAAQ,CAAC,IAAI,EAAE,SAAS;gBAAf,IAAI,EAAE,SAAS;IAEpC,WAAW,CAAC,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC;IAK/C,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC;IAIlD,cAAc;IAIR,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO;CAGjC"}

package/dist/esm/core/authorization/Event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Event.js","sourceRoot":"","sources":["../../../../src/core/authorization/Event.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMA,MAAM,OAAO,KAAK;IAGhB,YAAqB,IAAe;QAAf,SAAI,GAAJ,IAAI,CAAW;QAFpC,2BAA0C,EAAE,EAAC;IAEN,CAAC;IAExC,WAAW,CAAC,QAAmC;QAC7C,uBAAA,IAAI,wBAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,cAAc,CAAC,QAAmC;QAChD,uBAAA,IAAI,oBAAc,uBAAA,IAAI,wBAAW,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAA,CAAC;IACpE,CAAC;IAED,cAAc;QACZ,uBAAA,IAAI,oBAAc,EAAE,MAAA,CAAC;IACvB,CAAC;IAEK,QAAQ,CAAC,OAAiB;;YAC9B,MAAM,OAAO,CAAC,GAAG,CAAC,uBAAA,IAAI,wBAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;KAAA;CACF"}

package/dist/esm/core/authorization/RedirectTransport.d.ts

@@ -0,0 +1,41 @@
+import type { AuthorizationManagerConfiguration } from './AuthorizationManager';
+export type GetTokenOptions = {
+    /**
+     * Whether or not the URL should be replaced after processing the token.
+     * @default true
+     */
+    shouldReplace?: boolean;
+};
+export type RedirectTransportOptions = Pick<AuthorizationManagerConfiguration, 'client' | 'redirect' | 'scopes'> & {
+    /**
+     * Query parameters to include in the authorization request.
+     *
+     * The `RedirectTransport` will include all parameters required for a default OAuth PKCE flow, but
+     * these parameters can be overridden or extended with this option.
+     */
+    params?: {
+        [key: string]: string;
+    };
+};
+/**
+ * @private
+ */
+export declare const KEYS: {
+    PKCE_STATE: string;
+    PKCE_CODE_VERIFIER: string;
+};
+export declare class RedirectTransport {
+    #private;
+    constructor(options: RedirectTransportOptions);
+    static supported: boolean;
+    /**
+     * For the redirect transport, sending the request will redirect the user to the authorization endpoint, initiating the OAuth flow.
+     */
+    send(): Promise<void>;
+    /**
+     * Parse the current URL for the authorization code (`?code=...`) and exchange it for an access token when available.
+     * - When the URL is processed and exchanged for an access token, the page is redirected to the current URL without the `?code=...&state=...` parameters.
+     */
+    getToken(options?: GetTokenOptions): Promise<any>;
+}
+//# sourceMappingURL=RedirectTransport.d.ts.map

package/dist/esm/core/authorization/RedirectTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedirectTransport.d.ts","sourceRoot":"","sources":["../../../../src/core/authorization/RedirectTransport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAC;AAUhF,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,IAAI,CACzC,iCAAiC,EACjC,QAAQ,GAAG,UAAU,GAAG,QAAQ,CACjC,GAAG;IACF;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;KACvB,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,IAAI;;;CAGhB,CAAC;AAOF,qBAAa,iBAAiB;;gBAGhB,OAAO,EAAE,wBAAwB;IAO7C,MAAM,CAAC,SAAS,UAAiB;IAEjC;;OAEG;IACG,IAAI;IAgCV;;;OAGG;IACG,QAAQ,CAAC,OAAO,GAAE,eAAyC;CAgFlE"}

package/dist/esm/core/authorization/RedirectTransport.js

@@ -0,0 +1,146 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _RedirectTransport_options;
+import { getAuthorizationEndpoint, oauth2 } from '../../services/auth';
+import { generateCodeChallenge, generateCodeVerifier, generateState, isSupported, } from './pkce';
+/**
+ * @private
+ */
+export const KEYS = {
+    PKCE_STATE: 'pkce_state',
+    PKCE_CODE_VERIFIER: 'pkce_code_verifier',
+};
+function resetPKCE() {
+    sessionStorage.removeItem(KEYS.PKCE_STATE);
+    sessionStorage.removeItem(KEYS.PKCE_CODE_VERIFIER);
+}
+export class RedirectTransport {
+    constructor(options) {
+        _RedirectTransport_options.set(this, void 0);
+        __classPrivateFieldSet(this, _RedirectTransport_options, options, "f");
+        if (RedirectTransport.supported === false) {
+            throw new Error('RedirectTransport is not supported in this environment.');
+        }
+    }
+    /**
+     * For the redirect transport, sending the request will redirect the user to the authorization endpoint, initiating the OAuth flow.
+     */
+    send() {
+        return __awaiter(this, void 0, void 0, function* () {
+            /**
+             * Since we'll be using PKCE, we need to generate a code verifier and challenge
+             * for the OAuth handshake.
+             */
+            const verifier = generateCodeVerifier();
+            const challenge = yield generateCodeChallenge(verifier);
+            const state = generateState();
+            /**
+             * The verifier and state are stored in session storage so that we can validate
+             * the response when we receive it.
+             */
+            sessionStorage.setItem(KEYS.PKCE_CODE_VERIFIER, verifier);
+            sessionStorage.setItem(KEYS.PKCE_STATE, state);
+            const params = Object.assign({ response_type: 'code', client_id: __classPrivateFieldGet(this, _RedirectTransport_options, "f").client, scope: __classPrivateFieldGet(this, _RedirectTransport_options, "f").scopes || '', redirect_uri: __classPrivateFieldGet(this, _RedirectTransport_options, "f").redirect, state, code_challenge: challenge, code_challenge_method: 'S256' }, (__classPrivateFieldGet(this, _RedirectTransport_options, "f").params || {}));
+            const url = new URL(getAuthorizationEndpoint());
+            url.search = new URLSearchParams(params).toString();
+            window.location.assign(url.toString());
+        });
+    }
+    /**
+     * Parse the current URL for the authorization code (`?code=...`) and exchange it for an access token when available.
+     * - When the URL is processed and exchanged for an access token, the page is redirected to the current URL without the `?code=...&state=...` parameters.
+     */
+    getToken() {
+        return __awaiter(this, arguments, void 0, function* (options = { shouldReplace: true }) {
+            const url = new URL(window.location.href);
+            const params = new URLSearchParams(url.search);
+            /**
+             * Check for an error in the OAuth flow.
+             * @see https://www.oauth.com/oauth2-servers/pkce/authorization-request/
+             */
+            if (params.get('error')) {
+                throw new Error(params.get('error_description') || 'An error occurred during the authorization process.');
+            }
+            const code = params.get('code');
+            /**
+             * If we don't have a `code` parameter, we can't exchange it for an access token.
+             */
+            if (!code)
+                return undefined;
+            /**
+             * Grab the PKCE information from session storage.
+             */
+            const state = sessionStorage.getItem(KEYS.PKCE_STATE);
+            const verifier = sessionStorage.getItem(KEYS.PKCE_CODE_VERIFIER);
+            /**
+             * Now that we have the values in memory, we can remove them from session storage.
+             */
+            resetPKCE();
+            /**
+             * Validate the `state` parameter matches the preserved state (to prevent CSRF attacks).
+             */
+            if (params.get('state') !== state) {
+                throw new Error('Invalid State');
+            }
+            /**
+             * Ensure we have a valid code verifier.
+             */
+            if (!verifier) {
+                throw new Error('Invalid Code Verifier');
+            }
+            /**
+             * Prepare the payload for the PKCE token exchange.
+             */
+            const payload = {
+                code,
+                client_id: __classPrivateFieldGet(this, _RedirectTransport_options, "f").client,
+                /**
+                 * Retrieve the code verifier from session storage.
+                 */
+                code_verifier: verifier,
+                redirect_uri: __classPrivateFieldGet(this, _RedirectTransport_options, "f").redirect,
+                grant_type: 'authorization_code',
+            };
+            const response = yield (yield oauth2.token.exchange({
+                payload,
+            })).json();
+            if (options.shouldReplace) {
+                /**
+                 * Remove the `code` and `state` parameters from the URL.
+                 */
+                params.delete('code');
+                params.delete('state');
+                /**
+                 * Update the URL with the new query string.
+                 */
+                url.search = params.toString();
+                /**
+                 * Redirect the page to the new URL (without the `code` and `state` parameters)/
+                 */
+                window.location.replace(url);
+            }
+            return response;
+        });
+    }
+}
+_RedirectTransport_options = new WeakMap();
+RedirectTransport.supported = isSupported();
+//# sourceMappingURL=RedirectTransport.js.map

package/dist/esm/core/authorization/RedirectTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedirectTransport.js","sourceRoot":"","sources":["../../../../src/core/authorization/RedirectTransport.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,EAGb,WAAW,GACZ,MAAM,QAAQ,CAAC;AAyBhB;;GAEG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,UAAU,EAAE,YAAY;IACxB,kBAAkB,EAAE,oBAAoB;CACzC,CAAC;AAEF,SAAS,SAAS;IAChB,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,iBAAiB;IAG5B,YAAY,OAAiC;QAF7C,6CAAmC;QAGjC,uBAAA,IAAI,8BAAY,OAAO,MAAA,CAAC;QACxB,IAAI,iBAAiB,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAID;;OAEG;IACG,IAAI;;YACR;;;eAGG;YACH,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;YAC9B;;;eAGG;YACH,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC1D,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE/C,MAAM,MAAM,mBACV,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,uBAAA,IAAI,kCAAS,CAAC,MAAM,EAC/B,KAAK,EAAE,uBAAA,IAAI,kCAAS,CAAC,MAAM,IAAI,EAAE,EACjC,YAAY,EAAE,uBAAA,IAAI,kCAAS,CAAC,QAAQ,EACpC,KAAK,EACL,cAAc,EAAE,SAAS,EACzB,qBAAqB,EAAE,MAAM,IAC1B,CAAC,uBAAA,IAAI,kCAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAChC,CAAC;YAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEpD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzC,CAAC;KAAA;IAED;;;OAGG;IACG,QAAQ;6DAAC,UAA2B,EAAE,aAAa,EAAE,IAAI,EAAE;YAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C;;;eAGG;YACH,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,qDAAqD,CACzF,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEhC;;eAEG;YACH,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAE5B;;eAEG;YACH,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACjE;;eAEG;YACH,SAAS,EAAE,CAAC;YAEZ;;eAEG;YACH,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD;;eAEG;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YAED;;eAEG;YACH,MAAM,OAAO,GAAwC;gBACnD,IAAI;gBACJ,SAAS,EAAE,uBAAA,IAAI,kCAAS,CAAC,MAAM;gBAC/B;;mBAEG;gBACH,aAAa,EAAE,QAAQ;gBACvB,YAAY,EAAE,uBAAA,IAAI,kCAAS,CAAC,QAAQ;gBACpC,UAAU,EAAE,oBAAoB;aACjC,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,CACrB,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC1B,OAAO;aACR,CAAC,CACH,CAAC,IAAI,EAAE,CAAC;YAET,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B;;mBAEG;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvB;;mBAEG;gBACH,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC/B;;mBAEG;gBACH,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;;;AAxHM,2BAAS,GAAG,WAAW,EAAE,AAAhB,CAAiB"}

package/dist/esm/core/authorization/TokenLookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenLookup.d.ts","sourceRoot":"","sources":["../../../../src/core/authorization/TokenLookup.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AAgB1D,qBAAa,WAAW;;gBAGV,OAAO,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE;IAatD,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,CAEvB;IAED,IAAI,QAAQ,IAAI,KAAK,GAAG,IAAI,CAE3B;IAED,IAAI,KAAK,IAAI,KAAK,GAAG,IAAI,CAExB;IAED,IAAI,MAAM,IAAI,KAAK,GAAG,IAAI,CAEzB;IAED,IAAI,MAAM,IAAI,KAAK,GAAG,IAAI,CAEzB;IAED,IAAI,KAAK,IAAI,KAAK,GAAG,IAAI,CAExB;IAED,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,CAE1B;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAInC,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAIzD,MAAM,IAAI,KAAK,EAAE;CAWlB"}

package/dist/esm/core/authorization/TokenLookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenLookup.js","sourceRoot":"","sources":["../../../../src/core/authorization/TokenLookup.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,QAAQ,EAAgB,MAAM,cAAc,CAAC;AAKtD,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAC5C,IAAI,KAAK,GAAiB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ;IACV,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,WAAW;IAGtB,YAAY,OAA0C;;QAFtD,uCAA+B;QAG7B,uBAAA,IAAI,wBAAY,OAAO,CAAC,OAAO,MAAA,CAAC;IAClC,CAAC;IAWD,IAAI,IAAI;QACN,OAAO,uBAAA,IAAI,+DAAoB,MAAxB,IAAI,EAAqB,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,uBAAA,IAAI,+DAAoB,MAAxB,IAAI,EAAqB,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,KAAK;QACP,OAAO,uBAAA,IAAI,+DAAoB,MAAxB,IAAI,EAAqB,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,MAAM;QACR,OAAO,uBAAA,IAAI,+DAAoB,MAAxB,IAAI,EAAqB,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,MAAM;QACR,OAAO,uBAAA,IAAI,+DAAoB,MAAxB,IAAI,EAAqB,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK;QACP,OAAO,uBAAA,IAAI,+DAAoB,MAAxB,IAAI,EAAqB,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,OAAO;QACT,OAAO,uBAAA,IAAI,+DAAoB,MAAxB,IAAI,EAAqB,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,GAAG,CAAC,QAAgB;QAClB,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,mBAAmB,CAAC,cAAsB;QACxC,OAAO,uBAAA,IAAI,kEAAuB,MAA3B,IAAI,EAAwB,cAAc,CAAC,CAAC;IACrD,CAAC;IAED,MAAM;QACJ,MAAM,OAAO,GAAG,UAAU,EAAE;aACzB,IAAI,EAAE;aACN,MAAM,CAAC,CAAC,GAAqB,EAAE,GAAG,EAAE,EAAE;YACrC,IAAI,GAAG,CAAC,UAAU,CAAC,uBAAA,IAAI,4BAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAE,CAAC,CAAC;QACT,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;CACF;+JAxDwB,UAAkB;IACvC,OAAO,mBAAmB,CAAC,GAAG,uBAAA,IAAI,4BAAS,CAAC,gBAAgB,GAAG,UAAU,EAAE,CAAC,CAAC;AAC/E,CAAC,6EAEmB,OAAgB;;IAClC,MAAM,cAAc,GAAG,MAAA,MAAM,CAAC,gBAAgB,0CAAG,OAAO,CAAC,CAAC;IAC1D,OAAO,uBAAA,IAAI,kEAAuB,MAA3B,IAAI,EAAwB,cAAc,CAAC,CAAC;AACrD,CAAC"}

package/dist/esm/core/authorization/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @module Authorization
+ * @description Provides modules for interacting with Globus-related authorization contexts in your application.
+ * @example
+ * import { authorization } from "globus/sdk";
+ * const manager = authorization.create(...);
+ */
+import { AuthorizationManager, type AuthorizationManagerConfiguration } from './AuthorizationManager.js';
+/**
+ * Create an instance of the {@link AuthorizationManager}.
+ */
+export declare function create(configuration: AuthorizationManagerConfiguration): AuthorizationManager;
+export { AuthorizationManager, AuthorizationManagerConfiguration };
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/core/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,oBAAoB,EACpB,KAAK,iCAAiC,EACvC,MAAM,2BAA2B,CAAC;AAEnC;;GAEG;AACH,wBAAgB,MAAM,CAAC,aAAa,EAAE,iCAAiC,wBAEtE;AAED,OAAO,EAAE,oBAAoB,EAAE,iCAAiC,EAAE,CAAC"}