@globus/sdk 3.9.0 → 4.0.0-rc.2

package/dist/cjs/core/authorization/index.js

@@ -0,0 +1,1170 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core/authorization/index.ts
+var authorization_exports = {};
+__export(authorization_exports, {
+  AuthorizationManager: () => AuthorizationManager,
+  create: () => create
+});
+module.exports = __toCommonJS(authorization_exports);
+
+// src/core/authorization/AuthorizationManager.ts
+var import_jwt_decode = require("jwt-decode");
+
+// src/services/auth/config.ts
+var config_exports = {};
+__export(config_exports, {
+  HOSTS: () => HOSTS7,
+  ID: () => ID7,
+  RESOURCE_SERVERS: () => RESOURCE_SERVERS,
+  SCOPES: () => SCOPES
+});
+
+// src/services/transfer/config.ts
+var ID = "TRANSFER";
+var HOSTS = {
+  sandbox: "transfer.api.sandbox.globuscs.info",
+  production: "transfer.api.globusonline.org",
+  staging: "transfer.api.staging.globuscs.info",
+  integration: "transfer.api.integration.globuscs.info",
+  test: "transfer.api.test.globuscs.info",
+  preview: "transfer.api.preview.globus.org"
+};
+
+// src/services/flows/config.ts
+var ID2 = "FLOWS";
+var HOSTS2 = {
+  sandbox: "sandbox.flows.automate.globus.org",
+  production: "flows.globus.org",
+  staging: "staging.flows.automate.globus.org",
+  integration: "integration.flows.automate.globus.org",
+  test: "test.flows.automate.globus.org",
+  preview: "preview.flows.automate.globus.org"
+};
+
+// src/services/timer/config.ts
+var ID3 = "TIMER";
+var HOSTS3 = {
+  sandbox: "sandbox.timer.automate.globus.org",
+  production: "timer.automate.globus.org",
+  staging: "staging.timer.automate.globus.org",
+  integration: "integration.timer.automate.globus.org",
+  test: "test.timer.automate.globus.org",
+  preview: "preview.timer.automate.globus.org"
+};
+
+// src/services/groups/config.ts
+var ID4 = "GROUPS";
+var HOSTS4 = {
+  sandbox: "groups.api.sandbox.globuscs.info",
+  production: "groups.api.globus.org",
+  staging: "groups.api.staging.globuscs.info",
+  integration: "groups.api.integration.globuscs.info",
+  test: "groups.api.test.globuscs.info",
+  preview: "groups.api.preview.globuscs.info"
+};
+
+// src/services/search/config.ts
+var ID5 = "SEARCH";
+var HOSTS5 = {
+  sandbox: "search.api.sandbox.globuscs.info",
+  production: "search.api.globus.org",
+  staging: "search.api.staging.globuscs.info",
+  integration: "search.api.integration.globuscs.info",
+  test: "search.api.test.globuscs.info",
+  preview: "search.api.preview.globus.org"
+};
+
+// src/services/compute/config.ts
+var ID6 = "COMPUTE";
+var HOSTS6 = {
+  sandbox: "compute.api.sandbox.globuscs.info",
+  production: "compute.api.globus.org",
+  staging: "compute.api.staging.globuscs.info",
+  integration: "compute.api.integration.globuscs.info",
+  test: "compute.api.test.globuscs.info",
+  preview: "compute.api.preview.globus.org"
+};
+
+// src/services/auth/config.ts
+var ID7 = "AUTH";
+var HOSTS7 = {
+  integration: "auth.integration.globuscs.info",
+  sandbox: "auth.sandbox.globuscs.info",
+  production: "auth.globus.org",
+  test: "auth.test.globuscs.info",
+  staging: "auth.staging.globuscs.info",
+  preview: "auth.preview.globus.org"
+};
+var SCOPES = {
+  VIEW_IDENTITIES: "urn:globus:auth:scope:auth.globus.org:view_identities"
+};
+var RESOURCE_SERVERS = {
+  [ID7]: "auth.globus.org",
+  [ID]: "transfer.api.globus.org",
+  [ID2]: "flows.api.globus.org",
+  [ID4]: "groups.api.globus.org",
+  [ID5]: "search.api.globus.org",
+  [ID3]: "524230d7-ea86-4a52-8312-86065a9e0417",
+  [ID6]: "funcx_service"
+};
+
+// src/core/errors.ts
+var EnvironmentConfigurationError = class extends Error {
+  name = "EnvironmentConfigurationError";
+  constructor(variable, value) {
+    super();
+    this.message = `Invalid configuration value provided for ${variable} (${value}).`;
+  }
+};
+function isErrorWellFormed(test) {
+  return typeof test === "object" && test !== null && "code" in test && "message" in test;
+}
+function isConsentRequiredError(test) {
+  return isErrorWellFormed(test) && test.code === "ConsentRequired" && "required_scopes" in test && Array.isArray(test.required_scopes);
+}
+var NO_OP_KEYS = ["required_scopes"];
+function toAuthorizationQueryParams(error) {
+  return Object.entries(error.authorization_parameters).reduce((acc, [key, v]) => {
+    if (NO_OP_KEYS.includes(key) || v === void 0 || v === null) {
+      return acc;
+    }
+    let value = v;
+    if (Array.isArray(value)) {
+      value = value.join(",");
+    } else if (typeof v === "boolean") {
+      value = value ? "true" : "false";
+    }
+    return { ...acc, [key]: value };
+  }, {});
+}
+function isAuthorizationRequirementsError(test) {
+  return typeof test === "object" && test !== null && "authorization_parameters" in test && typeof test.authorization_parameters === "object" && test.authorization_parameters !== null;
+}
+
+// src/core/logger.ts
+var LOG_LEVELS = ["debug", "info", "warn", "error"];
+var logger;
+var level = LOG_LEVELS.indexOf("error");
+function log(severity, ...args) {
+  if (!logger) return;
+  if (LOG_LEVELS.indexOf(severity) < level) {
+    return;
+  }
+  const handler = logger[severity] ?? logger.log;
+  handler(...args);
+}
+
+// src/core/global.ts
+function getRuntime() {
+  return typeof window !== "undefined" ? window : process;
+}
+function isBrowser(runtime) {
+  return typeof window === typeof runtime;
+}
+function env(key, fallback) {
+  const runtime = getRuntime();
+  let envConfiguration;
+  if (isBrowser(runtime)) {
+    envConfiguration = runtime;
+  } else {
+    envConfiguration = runtime.env;
+  }
+  if (key in envConfiguration) {
+    return envConfiguration[key];
+  }
+  return fallback;
+}
+var ENVIRONMENTS = {
+  PRODUCTION: "production",
+  PREVIEW: "preview",
+  STAGING: "staging",
+  SANDBOX: "sandbox",
+  INTEGRATION: "integration",
+  TEST: "test"
+};
+var SERVICES = {
+  [ID7]: ID7,
+  [ID]: ID,
+  [ID2]: ID2,
+  [ID4]: ID4,
+  [ID5]: ID5,
+  [ID3]: ID3,
+  [ID6]: ID6
+};
+var SERVICE_HOSTS = {
+  [ID7]: HOSTS7,
+  [ID]: HOSTS,
+  [ID2]: HOSTS2,
+  [ID4]: HOSTS4,
+  [ID5]: HOSTS5,
+  [ID3]: HOSTS3,
+  [ID6]: HOSTS6
+};
+function getSDKOptions(options) {
+  let globalOptions = env("GLOBUS_SDK_OPTIONS", {});
+  if (typeof globalOptions === "string") {
+    globalOptions = JSON.parse(globalOptions);
+  }
+  return {
+    ...globalOptions,
+    ...options,
+    fetch: {
+      ...globalOptions?.fetch,
+      ...options?.fetch,
+      options: {
+        ...globalOptions?.fetch?.options,
+        ...options?.fetch?.options,
+        headers: {
+          ...globalOptions?.fetch?.options?.headers,
+          ...options?.fetch?.options?.headers
+        }
+      }
+    }
+  };
+}
+function getEnvironment() {
+  const globalOptions = getSDKOptions();
+  const environment = env(
+    "GLOBUS_SDK_ENVIRONMENT",
+    globalOptions?.environment ?? ENVIRONMENTS.PRODUCTION
+  );
+  if (globalOptions?.environment && environment !== globalOptions.environment) {
+    log(
+      "debug",
+      "GLOBUS_SDK_ENVIRONMENT and GLOBUS_SDK_OPTIONS.environment are set to different values. GLOBUS_SDK_ENVIRONMENT will take precedence"
+    );
+  }
+  if (!environment || !Object.values(ENVIRONMENTS).includes(environment)) {
+    throw new EnvironmentConfigurationError("GLOBUS_SDK_ENVIRONMENT", environment);
+  }
+  return environment;
+}
+function getServiceHost(service, environment = getEnvironment()) {
+  return SERVICE_HOSTS[service][environment];
+}
+function getServiceBaseUrl(service, environment = getEnvironment()) {
+  const host = getServiceHost(service, environment);
+  return env(`GLOBUS_SDK_SERVICE_URL_${service}`, host ? `https://${host}` : void 0);
+}
+
+// src/core/url.ts
+function stringifyParameters(parameters) {
+  const search = new URLSearchParams();
+  Array.from(Object.entries(parameters)).forEach(([key, value]) => {
+    if (Array.isArray(value)) {
+      search.set(key, value.join(","));
+    } else if (value !== void 0) {
+      search.set(key, String(value));
+    }
+  });
+  return search.toString();
+}
+function getServiceURL(service, path = "", environment = getEnvironment()) {
+  const base = getServiceBaseUrl(service, environment);
+  return new URL(path, base);
+}
+function build(serviceOrConfiguration, path, options, sdkOptions) {
+  let url;
+  if (typeof serviceOrConfiguration === "object") {
+    url = new URL(path, serviceOrConfiguration.host);
+  } else {
+    url = getServiceURL(serviceOrConfiguration, path, sdkOptions?.environment);
+  }
+  if (options && options.search) {
+    url.search = stringifyParameters(options.search);
+  }
+  return url.toString();
+}
+
+// src/services/shared.ts
+var import_cross_fetch = __toESM(require("cross-fetch"));
+
+// src/core/info/private.ts
+var CLIENT_INFO_HEADER = `X-Globus-Client-Info`;
+var ENABLED = true;
+function isEnabled() {
+  return ENABLED;
+}
+var INFOS_SEPERATOR = ";";
+var INFO_ITEM_SEPARATOR = ",";
+function toString(info) {
+  const infos = Array.isArray(info) ? info : [info];
+  return infos.map(
+    (i) => Object.entries(i).map(([key, value]) => `${key}=${value}`).join(INFO_ITEM_SEPARATOR)
+  ).join(INFOS_SEPERATOR);
+}
+
+// src/core/info/version.ts
+var VERSION = "3.9.0";
+
+// src/core/info/index.ts
+var VERSION2 = VERSION;
+var CLIENT_INFO = {
+  product: "javascript-sdk",
+  version: VERSION2
+};
+var INFOS = [CLIENT_INFO];
+function getClientInfo() {
+  return toString(INFOS);
+}
+function getClientInfoRequestHeaders() {
+  if (!isEnabled()) {
+    return {};
+  }
+  return {
+    [CLIENT_INFO_HEADER]: getClientInfo()
+  };
+}
+
+// src/services/shared.ts
+async function serviceRequest(config, options, passedSdkOptions) {
+  const sdkOptions = getSDKOptions(passedSdkOptions);
+  const injectedFetchOptions = sdkOptions?.fetch?.options || {};
+  const headers = {
+    ...getClientInfoRequestHeaders(),
+    ...options?.headers,
+    /**
+     * Key/value pairs found in the `fetch` options override those found in the
+     * service method options.
+     */
+    ...injectedFetchOptions.headers
+  };
+  const manager = sdkOptions?.manager;
+  let token2;
+  if (config.resource_server && manager) {
+    token2 = manager.tokens.getByResourceServer(config.resource_server);
+    if (token2) {
+      headers["Authorization"] = `Bearer ${token2.access_token}`;
+    }
+  }
+  if (config.scope && manager) {
+    const resourceServer = typeof config.service === "string" ? RESOURCE_SERVERS[config.service] : (
+      // For `GCSConfiguration` objects, the `endpoint_id` is the resource server.
+      config.service.endpoint_id
+    );
+    token2 = manager.tokens.getByResourceServer(resourceServer);
+    if (token2) {
+      headers["Authorization"] = `Bearer ${token2.access_token}`;
+    }
+  }
+  let body = options?.body;
+  if (!body && options?.payload) {
+    body = JSON.stringify(options.payload);
+  }
+  if (!headers?.["Content-Type"] && body) {
+    headers["Content-Type"] = "application/json";
+  }
+  const url = build(
+    config.service,
+    config.path,
+    {
+      search: options?.query
+    },
+    sdkOptions
+  );
+  const init = {
+    method: config.method,
+    body,
+    ...injectedFetchOptions,
+    /**
+     * Merge the headers from the options and SDK options.
+     */
+    headers
+  };
+  let handler = import_cross_fetch.default;
+  if (injectedFetchOptions?.__callable) {
+    handler = injectedFetchOptions.__callable.bind(this);
+    delete init.__callable;
+  }
+  if (config.preventRetry || !manager || !token2 || !isRefreshToken(token2)) {
+    return handler(url, init);
+  }
+  const initialResponse = await handler(url, init);
+  if (initialResponse.ok) {
+    return initialResponse;
+  }
+  let hasAuthorizationRequirements;
+  try {
+    hasAuthorizationRequirements = isAuthorizationRequirementsError(
+      /**
+       * It is important to clone the response before calling `json` avoid
+       * `body used already for [...]` errors when the initial response is
+       * returned.
+       */
+      await initialResponse.clone().json()
+    );
+  } catch (_e) {
+    hasAuthorizationRequirements = false;
+  }
+  const shouldAttemptTokenRefresh = initialResponse.status === 401 && !hasAuthorizationRequirements;
+  if (shouldAttemptTokenRefresh) {
+    const newToken = await manager.refreshToken(token2);
+    if (!newToken) {
+      return initialResponse;
+    }
+    return handler(url, {
+      ...init,
+      headers: {
+        ...init.headers,
+        Authorization: `Bearer ${newToken.access_token}`
+      }
+    });
+  }
+  return initialResponse;
+}
+
+// src/services/auth/service/oauth2/index.ts
+var oauth2_exports = {};
+__export(oauth2_exports, {
+  token: () => token_exports,
+  userinfo: () => userinfo
+});
+
+// src/services/auth/service/oauth2/token.ts
+var token_exports = {};
+__export(token_exports, {
+  exchange: () => exchange,
+  introspect: () => introspect,
+  refresh: () => refresh,
+  revoke: () => revoke,
+  token: () => token,
+  validate: () => validate
+});
+function serialize(payload) {
+  return new URLSearchParams(payload);
+}
+function injectServiceOptions(options) {
+  return {
+    ...options,
+    /**
+     * The `token` service methods always expect a form-encoded body. We still allow
+     * end-consumers to pass a raw body, but if `payload` is provided it is serialized.
+     */
+    body: options.payload ? serialize(options.payload) : void 0,
+    headers: {
+      ...options?.headers || {},
+      Accept: "application/json",
+      /**
+       * Force the `Content-Type` header to be `application/x-www-form-urlencoded` and `charset=UTF-8`.
+       */
+      "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"
+    }
+  };
+}
+var token = function(options = {}, sdkOptions) {
+  return serviceRequest(
+    {
+      service: ID7,
+      scope: void 0,
+      path: `/v2/oauth2/token`,
+      method: "POST" /* POST */,
+      preventRetry: true
+    },
+    injectServiceOptions(options),
+    sdkOptions
+  );
+};
+var exchange = token;
+var introspect = function(options, sdkOptions) {
+  if (!options?.payload) {
+    throw new Error(`'payload' is required for introspect`);
+  }
+  return serviceRequest(
+    {
+      service: ID7,
+      scope: void 0,
+      path: `/v2/oauth2/token/introspect`,
+      method: "POST" /* POST */,
+      preventRetry: true
+    },
+    injectServiceOptions(options),
+    sdkOptions
+  );
+};
+var revoke = function(options, sdkOptions) {
+  if (!options?.payload) {
+    throw new Error(`'payload' is required for revoke`);
+  }
+  return serviceRequest(
+    {
+      service: ID7,
+      scope: void 0,
+      path: `/v2/oauth2/token/revoke`,
+      method: "POST" /* POST */,
+      preventRetry: true
+    },
+    injectServiceOptions(options),
+    sdkOptions
+  );
+};
+var refresh = function(options, sdkOptions) {
+  if (!options?.payload) {
+    throw new Error(`'payload' is required for revoke`);
+  }
+  return serviceRequest(
+    {
+      service: ID7,
+      scope: void 0,
+      path: `/v2/oauth2/token`,
+      method: "POST" /* POST */,
+      preventRetry: true
+    },
+    injectServiceOptions(options),
+    sdkOptions
+  );
+};
+var validate = function(options, sdkOptions) {
+  if (!options?.payload) {
+    throw new Error(`'payload' is required for validate`);
+  }
+  return serviceRequest(
+    {
+      service: ID7,
+      scope: void 0,
+      path: `/v2/oauth2/token/validate`,
+      method: "POST" /* POST */,
+      preventRetry: true
+    },
+    injectServiceOptions(options),
+    sdkOptions
+  );
+};
+
+// src/services/auth/service/oauth2/index.ts
+var userinfo = function(options, sdkOptions) {
+  return serviceRequest(
+    {
+      service: ID7,
+      scope: void 0,
+      path: `/v2/oauth2/userinfo`,
+      method: "GET" /* GET */
+    },
+    options,
+    sdkOptions
+  );
+};
+
+// src/services/auth/index.ts
+var CONFIG = config_exports;
+function getAuthorizationEndpoint() {
+  return build(ID7, "/v2/oauth2/authorize");
+}
+function isToken(check) {
+  return typeof check === "object" && check !== null && "access_token" in check;
+}
+function isRefreshToken(check) {
+  return isToken(check) && check !== null && "refresh_token" in check;
+}
+function isGlobusAuthTokenResponse(check) {
+  return isToken(check) && check !== null && "resource_server" in check;
+}
+
+// src/core/storage/memory.ts
+var MemoryStorage = class {
+  #storage = {};
+  get(key) {
+    return this.#storage[key] !== void 0 ? this.#storage[key] : null;
+  }
+  set(key, value) {
+    this.#storage[key] = typeof value !== "string" ? JSON.stringify(value) : value;
+  }
+  remove(key) {
+    delete this.#storage[key];
+  }
+  keys() {
+    return Object.keys(this.#storage);
+  }
+  clear() {
+    this.#storage = {};
+  }
+};
+
+// src/core/storage/local-storage.ts
+var LocalStorage = class {
+  #storage = globalThis.localStorage;
+  get(key) {
+    return this.#storage.getItem(key);
+  }
+  set(key, value) {
+    this.#storage.setItem(key, typeof value !== "string" ? JSON.stringify(value) : value);
+  }
+  keys() {
+    return Object.keys(this.#storage);
+  }
+  remove(key) {
+    this.#storage.removeItem(key);
+  }
+  clear() {
+    this.#storage.clear();
+  }
+};
+
+// src/core/storage/index.ts
+var storage;
+function createStorage(storageType = "memory") {
+  if (!storage) {
+    let Factory;
+    if (storageType === "localStorage") {
+      Factory = LocalStorage;
+    } else if (storageType === "memory") {
+      Factory = MemoryStorage;
+    } else {
+      Factory = storageType;
+    }
+    storage = new Factory();
+  }
+  return storage;
+}
+var getStorage = createStorage;
+
+// src/core/authorization/Event.ts
+var Event = class {
+  constructor(name) {
+    this.name = name;
+  }
+  #callbacks = [];
+  addListener(callback) {
+    this.#callbacks.push(callback);
+    return () => this.removeListener(callback);
+  }
+  removeListener(callback) {
+    this.#callbacks = this.#callbacks.filter((cb) => cb !== callback);
+  }
+  clearListeners() {
+    this.#callbacks = [];
+  }
+  async dispatch(payload) {
+    await Promise.all(this.#callbacks.map((callback) => callback(payload)));
+  }
+};
+
+// src/core/authorization/pkce.ts
+function isSupported() {
+  return "crypto" in globalThis;
+}
+function getCrypto() {
+  return "webcrypto" in globalThis.crypto ? globalThis.crypto.webcrypto : globalThis.crypto;
+}
+var encode = (value) => btoa(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function sha256(input) {
+  const hashBuffer = await getCrypto().subtle.digest("SHA-256", new TextEncoder().encode(input));
+  return String.fromCharCode(...new Uint8Array(hashBuffer));
+}
+var CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+var PKCE_SAFE_CHARSET = `${CHARSET}-._~`;
+function generateCodeVerifier() {
+  return Array.from(getCrypto().getRandomValues(new Uint8Array(43))).map((v) => PKCE_SAFE_CHARSET[v % PKCE_SAFE_CHARSET.length]).join("");
+}
+async function generateCodeChallenge(verifier) {
+  const hashed = await sha256(verifier);
+  return encode(hashed);
+}
+function generateState() {
+  return Array.from(getCrypto().getRandomValues(new Uint8Array(16))).map((v) => CHARSET[v % CHARSET.length]).join("");
+}
+
+// src/core/authorization/RedirectTransport.ts
+var KEYS = {
+  PKCE_STATE: "pkce_state",
+  PKCE_CODE_VERIFIER: "pkce_code_verifier"
+};
+function resetPKCE() {
+  sessionStorage.removeItem(KEYS.PKCE_STATE);
+  sessionStorage.removeItem(KEYS.PKCE_CODE_VERIFIER);
+}
+var RedirectTransport = class _RedirectTransport {
+  #options;
+  constructor(options) {
+    this.#options = options;
+    if (_RedirectTransport.supported === false) {
+      throw new Error("RedirectTransport is not supported in this environment.");
+    }
+  }
+  static supported = isSupported();
+  /**
+   * For the redirect transport, sending the request will redirect the user to the authorization endpoint, initiating the OAuth flow.
+   */
+  async send() {
+    const verifier = generateCodeVerifier();
+    const challenge = await generateCodeChallenge(verifier);
+    const state = generateState();
+    sessionStorage.setItem(KEYS.PKCE_CODE_VERIFIER, verifier);
+    sessionStorage.setItem(KEYS.PKCE_STATE, state);
+    const params = {
+      response_type: "code",
+      client_id: this.#options.client,
+      scope: this.#options.scopes || "",
+      redirect_uri: this.#options.redirect,
+      state,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      ...this.#options.params || {}
+    };
+    const url = new URL(getAuthorizationEndpoint());
+    url.search = new URLSearchParams(params).toString();
+    window.location.assign(url.toString());
+  }
+  /**
+   * Parse the current URL for the authorization code (`?code=...`) and exchange it for an access token when available.
+   * - When the URL is processed and exchanged for an access token, the page is redirected to the current URL without the `?code=...&state=...` parameters.
+   */
+  async getToken(options = { shouldReplace: true }) {
+    const url = new URL(window.location.href);
+    const params = new URLSearchParams(url.search);
+    if (params.get("error")) {
+      throw new Error(
+        params.get("error_description") || "An error occurred during the authorization process."
+      );
+    }
+    const code = params.get("code");
+    if (!code) return void 0;
+    const state = sessionStorage.getItem(KEYS.PKCE_STATE);
+    const verifier = sessionStorage.getItem(KEYS.PKCE_CODE_VERIFIER);
+    resetPKCE();
+    if (params.get("state") !== state) {
+      throw new Error("Invalid State");
+    }
+    if (!verifier) {
+      throw new Error("Invalid Code Verifier");
+    }
+    const payload = {
+      code,
+      client_id: this.#options.client,
+      /**
+       * Retrieve the code verifier from session storage.
+       */
+      code_verifier: verifier,
+      redirect_uri: this.#options.redirect,
+      grant_type: "authorization_code"
+    };
+    const response = await (await oauth2_exports.token.exchange({
+      payload
+    })).json();
+    if (options.shouldReplace) {
+      params.delete("code");
+      params.delete("state");
+      url.search = params.toString();
+      window.location.replace(url);
+    }
+    return response;
+  }
+};
+
+// src/core/authorization/TokenLookup.ts
+function getTokenFromStorage(key) {
+  const raw = getStorage().get(key) || "null";
+  let token2 = null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (isToken(parsed)) {
+      token2 = parsed;
+    }
+  } catch (e) {
+  }
+  return token2;
+}
+var TokenLookup = class {
+  #manager;
+  constructor(options) {
+    this.#manager = options.manager;
+  }
+  #getClientStorageEntry(identifier) {
+    return getTokenFromStorage(`${this.#manager.storageKeyPrefix}${identifier}`);
+  }
+  #getTokenForService(service) {
+    const resourceServer = CONFIG.RESOURCE_SERVERS?.[service];
+    return this.#getClientStorageEntry(resourceServer);
+  }
+  get auth() {
+    return this.#getTokenForService(SERVICES.AUTH);
+  }
+  get transfer() {
+    return this.#getTokenForService(SERVICES.TRANSFER);
+  }
+  get flows() {
+    return this.#getTokenForService(SERVICES.FLOWS);
+  }
+  get groups() {
+    return this.#getTokenForService(SERVICES.GROUPS);
+  }
+  get search() {
+    return this.#getTokenForService(SERVICES.SEARCH);
+  }
+  get timer() {
+    return this.#getTokenForService(SERVICES.TIMER);
+  }
+  get compute() {
+    return this.#getTokenForService(SERVICES.COMPUTE);
+  }
+  gcs(endpoint) {
+    return this.getByResourceServer(endpoint);
+  }
+  getByResourceServer(resourceServer) {
+    return this.#getClientStorageEntry(resourceServer);
+  }
+  getAll() {
+    const entries = getStorage().keys().reduce((acc, key) => {
+      if (key.startsWith(this.#manager.storageKeyPrefix)) {
+        acc.push(getTokenFromStorage(key));
+      }
+      return acc;
+    }, []);
+    return entries.filter(isToken);
+  }
+};
+
+// src/core/authorization/AuthorizationManager.ts
+var DEFAULT_CONFIGURATION = {
+  useRefreshTokens: false,
+  defaultScopes: "openid profile email"
+};
+var DEFAULT_HANDLE_ERROR_OPTIONS = {
+  execute: true,
+  additionalParams: void 0
+};
+var AuthorizationManager = class {
+  #transport;
+  configuration;
+  #authenticated = false;
+  /**
+   * The `AuthorizationManager` is considered `authenticated` if it has a valid Globus Auth token.
+   * It does not necessarily mean that it has a valid token for a specific resource server.
+   */
+  get authenticated() {
+    return this.#authenticated;
+  }
+  /**
+   * Set the authenticated state and emit the `authenticated` event.
+   */
+  set authenticated(value) {
+    if (value === this.#authenticated) {
+      return;
+    }
+    this.#authenticated = value;
+    this.#emitAuthenticatedState();
+  }
+  tokens;
+  events = {
+    /**
+     * Emitted when the authenticated state changes.
+     * @event AuthorizationManager.events#authenticated
+     * @type {object}
+     * @property {boolean} isAuthenticated - Whether the `AuthorizationManager` is authenticated.
+     * @property {TokenResponse} [token] - The token response if the `AuthorizationManager` is authenticated.
+     */
+    authenticated: new Event("authenticated"),
+    /**
+     * Emitted when the user revokes their authentication.
+     * @event AuthorizationManager.events#revoke
+     */
+    revoke: new Event("revoke")
+  };
+  constructor(configuration) {
+    createStorage("localStorage");
+    if (!configuration.client) {
+      throw new Error("You must provide a `client` for your application.");
+    }
+    const scopes = configuration.defaultScopes === false ? "" : configuration.defaultScopes ?? DEFAULT_CONFIGURATION.defaultScopes;
+    this.configuration = {
+      ...DEFAULT_CONFIGURATION,
+      ...configuration,
+      scopes: [configuration.scopes ? configuration.scopes : "", scopes].filter((s) => s.length).join(" ")
+    };
+    if (this.configuration.events) {
+      Object.entries(this.configuration.events).forEach(([name, callback]) => {
+        if (name in this.events) {
+          this.events[name].addListener(callback);
+        }
+      });
+    }
+    this.tokens = new TokenLookup({
+      manager: this
+    });
+    this.#checkAuthorizationState();
+  }
+  get storageKeyPrefix() {
+    return `${this.configuration.client}:`;
+  }
+  /**
+   * The user information decoded from the `id_token` (JWT) of the current Globus Auth token.
+   * This method can be used instead of `auth.oauth2.userinfo` to get the user information without an additional request.
+   *
+   * **IMPORTANT**: The `id_token` can only be processed if the `openid` scope is requested during the authorization process.
+   *
+   * Additionally, the `profile` and `email` scopes are required to get the full user information.
+   *
+   * @see {@link https://docs.globus.org/api/auth/reference/#oidc_userinfo_endpoint}
+   */
+  get user() {
+    const token2 = this.getGlobusAuthToken();
+    return token2 && token2.id_token ? (0, import_jwt_decode.jwtDecode)(token2.id_token) : null;
+  }
+  /**
+   * Attempt to refresh all of the tokens managed by the instance.
+   * This method will only attempt to refresh tokens that have a `refresh_token` attribute.
+   */
+  async refreshTokens() {
+    log("debug", "AuthorizationManager.refreshTokens");
+    const tokens = await Promise.allSettled(
+      this.tokens.getAll().map((token2) => {
+        if (isRefreshToken(token2)) {
+          return this.refreshToken(token2);
+        }
+        return Promise.resolve(null);
+      })
+    );
+    this.#checkAuthorizationState();
+    return tokens;
+  }
+  /**
+   * Use the `refresh_token` attribute of a token to obtain a new access token.
+   * @param token The well-formed token with a `refresh_token` attribute.
+   */
+  async refreshToken(token2) {
+    log("debug", `AuthorizationManager.refreshToken | resource_server=${token2.resource_server}`);
+    try {
+      const response = await (await oauth2_exports.token.refresh({
+        payload: {
+          client_id: this.configuration.client,
+          refresh_token: token2.refresh_token,
+          grant_type: "refresh_token"
+        }
+      })).json();
+      if (isGlobusAuthTokenResponse(response)) {
+        this.addTokenResponse(response);
+        return response;
+      }
+    } catch (error) {
+      log("error", `AuthorizationManager.refreshToken | resource_server=${token2.resource_server}`);
+    }
+    return null;
+  }
+  /**
+   * Whether or not the instance has a reference to a Globus Auth token.
+   */
+  hasGlobusAuthToken() {
+    return this.getGlobusAuthToken() !== null;
+  }
+  /**
+   * Retrieve the Globus Auth token managed by the instance.
+   */
+  getGlobusAuthToken() {
+    const entry = getStorage().get(`${this.storageKeyPrefix}auth.globus.org`);
+    return entry ? JSON.parse(entry) : null;
+  }
+  #checkAuthorizationState() {
+    log("debug", "AuthorizationManager.#checkAuthorizationState");
+    if (this.hasGlobusAuthToken()) {
+      this.authenticated = true;
+    }
+  }
+  async #emitAuthenticatedState() {
+    const isAuthenticated = this.authenticated;
+    const token2 = this.getGlobusAuthToken() ?? void 0;
+    await this.events.authenticated.dispatch({
+      isAuthenticated,
+      token: token2
+    });
+  }
+  /**
+   * Reset the authenticated state and clear all tokens from storage.
+   * This method **does not** emit the `revoke` event. If you need to emit the `revoke` event, use the `AuthorizationManager.revoke` method.
+   */
+  reset() {
+    getStorage().keys().forEach((key) => {
+      if (key.startsWith(this.storageKeyPrefix)) {
+        getStorage().remove(key);
+      }
+    });
+    this.authenticated = false;
+  }
+  /**
+   * A private utility method to add the `offline_access` scope to a scope string if the `useRefreshTokens` configuration is set to `true`.
+   * @param scopes The scope string to modify.
+   */
+  #withOfflineAccess(scopes) {
+    return `${scopes}${this.configuration.useRefreshTokens ? " offline_access" : ""}`;
+  }
+  #buildTransport(overrides) {
+    const scopes = this.#withOfflineAccess(overrides?.scopes ?? (this.configuration.scopes || ""));
+    return new RedirectTransport({
+      client: this.configuration.client,
+      redirect: this.configuration.redirect,
+      scopes,
+      ...overrides,
+      // @todo Decide if we want to include the `include_consented_scopes` parameter by default.
+      params: {
+        // include_consented_scopes: true,
+        ...overrides?.params
+      }
+    });
+  }
+  /**
+   * Initiate the login process by redirecting to the Globus Auth login page.
+   */
+  async login(options = { additionalParams: {} }) {
+    log("debug", "AuthorizationManager.login");
+    this.reset();
+    const transport = this.#buildTransport({ params: options?.additionalParams });
+    await transport.send();
+  }
+  /**
+   * This method will attempt to complete the PKCE protocol flow.
+   */
+  async handleCodeRedirect(options = { shouldReplace: true, additionalParams: {} }) {
+    log("debug", "AuthorizationManager.handleCodeRedirect");
+    const response = await this.#buildTransport({ params: options?.additionalParams }).getToken({
+      shouldReplace: options?.shouldReplace
+    });
+    if (isGlobusAuthTokenResponse(response)) {
+      log(
+        "debug",
+        `AuthorizationManager.handleCodeRedirect | response=${JSON.stringify(response)}`
+      );
+      this.addTokenResponse(response);
+    }
+  }
+  async handleErrorResponse(response, options) {
+    const opts = typeof options === "boolean" ? {
+      ...DEFAULT_HANDLE_ERROR_OPTIONS,
+      execute: options
+    } : {
+      ...DEFAULT_HANDLE_ERROR_OPTIONS,
+      ...options
+    };
+    log(
+      "debug",
+      `AuthorizationManager.handleErrorResponse | response=${JSON.stringify(response)} execute=${opts.execute}`
+    );
+    let handler = async () => {
+    };
+    if (isAuthorizationRequirementsError(response)) {
+      log(
+        "debug",
+        "AuthorizationManager.handleErrorResponse | error=AuthorizationRequirementsError"
+      );
+      handler = async () => {
+        await this.handleAuthorizationRequirementsError(response, {
+          additionalParams: opts.additionalParams
+        });
+      };
+    }
+    if (isConsentRequiredError(response)) {
+      log("debug", "AuthorizationManager.handleErrorResponse | error=ConsentRequiredError");
+      handler = async () => {
+        await this.handleConsentRequiredError(response, {
+          additionalParams: opts.additionalParams
+        });
+      };
+    }
+    if ("code" in response && response["code"] === "AuthenticationFailed") {
+      log("debug", "AuthorizationManager.handleErrorResponse | error=AuthenticationFailed");
+      handler = async () => {
+        await this.revoke();
+      };
+    }
+    const returnValue = opts.execute === true ? await handler() : handler;
+    return returnValue;
+  }
+  /**
+   * Process a well-formed Authorization Requirements error response from a Globus service
+   * and redirect the user to the Globus Auth login page with the necessary parameters.
+   */
+  async handleAuthorizationRequirementsError(response, options) {
+    this.#transport = this.#buildTransport({
+      params: {
+        prompt: "login",
+        ...toAuthorizationQueryParams(response),
+        ...options?.additionalParams
+      }
+    });
+    await this.#transport.send();
+  }
+  /**
+   * Process a well-formed `ConsentRequired` error response from a Globus service
+   * and redirect the user to the Globus Auth login page with the necessary parameters.
+   */
+  async handleConsentRequiredError(response, options) {
+    this.#transport = this.#buildTransport({
+      scopes: this.#withOfflineAccess(response.required_scopes.join(" ")),
+      params: {
+        ...options?.additionalParams
+      }
+    });
+    await this.#transport.send();
+  }
+  /**
+   * Add a Globus Auth token response to storage, if `other_tokens` are present they are also added.
+   * This method is mostly used internally by the `AuthorizationManager`, but can be used by downstream
+   * consumers to add tokens to storage if necessary.
+   */
+  addTokenResponse = (token2) => {
+    getStorage().set(`${this.configuration.client}:${token2.resource_server}`, token2);
+    if ("other_tokens" in token2) {
+      token2.other_tokens?.forEach(this.addTokenResponse);
+    }
+    this.#checkAuthorizationState();
+  };
+  /**
+   * Call `AuthroizationManager.reset`, revoke all of the available tokns, and emit the `revoke` event.
+   * @emits AuthorizationManager.events#revoke
+   * @see AuthorizationManager.reset
+   */
+  async revoke() {
+    log("debug", "AuthorizationManager.revoke");
+    const revocation = Promise.all(this.tokens.getAll().map(this.#revokeToken.bind(this)));
+    this.reset();
+    await revocation;
+    await this.events.revoke.dispatch();
+  }
+  /**
+   * Revoke a token from a resource server.
+   */
+  #revokeToken(token2) {
+    log("debug", `AuthorizationManager.revokeToken | resource_server=${token2.resource_server}`);
+    return oauth2_exports.token.revoke({
+      payload: {
+        client_id: this.configuration.client,
+        token: token2.access_token
+      }
+    });
+  }
+};
+
+// src/core/authorization/index.ts
+function create(configuration) {
+  return new AuthorizationManager(configuration);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthorizationManager,
+  create
+});
+//# sourceMappingURL=index.js.map