@globus/sdk 4.3.1 → 5.0.0-rc.1

package/dist/cjs/core/authorization/AuthorizationManager.js

@@ -0,0 +1,361 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _AuthorizationManager_instances, _AuthorizationManager_transport, _AuthorizationManager_authenticated, _AuthorizationManager_checkAuthorizationState, _AuthorizationManager_emitAuthenticatedState, _AuthorizationManager_withOfflineAccess, _AuthorizationManager_buildTransport, _AuthorizationManager_revokeToken;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationManager = void 0;
+const jwt_decode_1 = require("jwt-decode");
+const index_js_1 = require("../../services/auth/index.js");
+const index_js_2 = require("../storage/index.js");
+const logger_js_1 = require("../logger.js");
+const Event_js_1 = require("./Event.js");
+const RedirectTransport_js_1 = require("./RedirectTransport.js");
+const TokenLookup_js_1 = require("./TokenLookup.js");
+const errors_js_1 = require("../errors.js");
+const DEFAULT_CONFIGURATION = {
+    useRefreshTokens: false,
+    defaultScopes: 'openid profile email',
+};
+const DEFAULT_HANDLE_ERROR_OPTIONS = {
+    execute: true,
+    additionalParams: undefined,
+};
+/**
+ * Provides management of Globus authorization context for your application.
+ * - Handles the OAuth protcol flow (via PKCE)
+ * - Token lifecycle management
+ * - Common errors (e.g., `ConsentRequired`, `authorization_requirements`)
+ *
+ * Once you configure your instance, you can determine the authenticated state using `manager.authenticated`.
+ *
+ * To prompt a user to authenticate, call `manager.login()` on user interaction – this will initiate the OAuth protocol flow with your configured client and scopes, resulting in an initial redirect to Globus Auth.
+ *
+ * Once the user authenticates with Globus Auth, they will be redirected to your application using the configured `redirect` URL. On this URL, you will need to call `manager.handleCodeRedirect` (using a manager instance configured in the same manner that initiated the `manager.login()` call) to complete the PKCE flow, exchanging the provided code for a valid token, or tokens.
+ *
+ * All tokens managed by the `AuthorizationManager` instance can be found on `manager.token`.
+ *
+ * ### Registering your Globus Application
+ *
+ * The `AuthorizationManager` expects your Globus Application to be registered as an OAuth public client.
+ * In this Globus Web Application, this option is referenced as "_Register a thick client or script that will be installed and run by users on their devices_".
+ *
+ * @example <caption>Creating an AuthorizationManager instance.</caption>
+ * import { authorization } from "globus/sdk";
+ *
+ * const manager = authorization.create({
+ *  // Your registered Globus Application client ID.
+ *  client: '...',
+ *  // The redirect URL for your application; Where you will call `manager.handleCodeRedirect()`
+ *  redirect: 'https://example.com/callback',
+ *  // Known scopes required by your application.
+ *  scopes: 'urn:globus:auth:scope:transfer.api.globus.org:all',
+ * });
+ */
+class AuthorizationManager {
+    /**
+     * The `AuthorizationManager` is considered `authenticated` if it has a valid Globus Auth token.
+     * It does not necessarily mean that it has a valid token for a specific resource server.
+     */
+    get authenticated() {
+        return __classPrivateFieldGet(this, _AuthorizationManager_authenticated, "f");
+    }
+    /**
+     * Set the authenticated state and emit the `authenticated` event.
+     */
+    set authenticated(value) {
+        /**
+         * Avoid emitting the event if the value hasn't changed.
+         */
+        if (value === __classPrivateFieldGet(this, _AuthorizationManager_authenticated, "f")) {
+            return;
+        }
+        __classPrivateFieldSet(this, _AuthorizationManager_authenticated, value, "f");
+        __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_emitAuthenticatedState).call(this);
+    }
+    constructor(configuration) {
+        var _a;
+        _AuthorizationManager_instances.add(this);
+        _AuthorizationManager_transport.set(this, void 0);
+        _AuthorizationManager_authenticated.set(this, false);
+        this.events = {
+            /**
+             * Emitted when the authenticated state changes.
+             * @event AuthorizationManager.events#authenticated
+             * @type {object}
+             * @property {boolean} isAuthenticated - Whether the `AuthorizationManager` is authenticated.
+             * @property {TokenResponse} [token] - The token response if the `AuthorizationManager` is authenticated.
+             */
+            authenticated: new Event_js_1.Event('authenticated'),
+            /**
+             * Emitted when the user revokes their authentication.
+             * @event AuthorizationManager.events#revoke
+             */
+            revoke: new Event_js_1.Event('revoke'),
+        };
+        /**
+         * Add a Globus Auth token response to storage, if `other_tokens` are present they are also added.
+         * This method is mostly used internally by the `AuthorizationManager`, but can be used by downstream
+         * consumers to add tokens to storage if necessary.
+         */
+        this.addTokenResponse = (token) => {
+            var _a;
+            (0, index_js_2.getStorage)().set(`${this.configuration.client}:${token.resource_server}`, token);
+            if ('other_tokens' in token) {
+                (_a = token.other_tokens) === null || _a === void 0 ? void 0 : _a.forEach(this.addTokenResponse);
+            }
+            __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_checkAuthorizationState).call(this);
+        };
+        /**
+         * @todo Add support for passing in an alternative storage mechanism.
+         */
+        (0, index_js_2.createStorage)('localStorage');
+        if (!configuration.client) {
+            throw new Error('You must provide a `client` for your application.');
+        }
+        /**
+         * Inject the `openid`, `profile`, `email`, and `offline_access` scopes by default unless
+         * explicitly opted out of.
+         */
+        const scopes = configuration.defaultScopes === false
+            ? ''
+            : ((_a = configuration.defaultScopes) !== null && _a !== void 0 ? _a : DEFAULT_CONFIGURATION.defaultScopes);
+        this.configuration = Object.assign(Object.assign(Object.assign({}, DEFAULT_CONFIGURATION), configuration), { scopes: [configuration.scopes ? configuration.scopes : '', scopes]
+                .filter((s) => s.length)
+                .join(' ') });
+        /**
+         * If an `events` object is provided, add the listeners to the instance before
+         * any event might be dispatched.
+         */
+        if (this.configuration.events) {
+            Object.entries(this.configuration.events).forEach(([name, callback]) => {
+                if (name in this.events) {
+                    this.events[name].addListener(callback);
+                }
+            });
+        }
+        this.tokens = new TokenLookup_js_1.TokenLookup({
+            manager: this,
+        });
+        __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_checkAuthorizationState).call(this);
+    }
+    get storageKeyPrefix() {
+        return `${this.configuration.client}:`;
+    }
+    /**
+     * The user information decoded from the `id_token` (JWT) of the current Globus Auth token.
+     * This method can be used instead of `auth.oauth2.userinfo` to get the user information without an additional request.
+     *
+     * **IMPORTANT**: The `id_token` can only be processed if the `openid` scope is requested during the authorization process.
+     *
+     * Additionally, the `profile` and `email` scopes are required to get the full user information.
+     *
+     * @see {@link https://docs.globus.org/api/auth/reference/#oidc_userinfo_endpoint}
+     */
+    get user() {
+        const token = this.getGlobusAuthToken();
+        return token && token.id_token ? (0, jwt_decode_1.jwtDecode)(token.id_token) : null;
+    }
+    /**
+     * Attempt to refresh all of the tokens managed by the instance.
+     * This method will only attempt to refresh tokens that have a `refresh_token` attribute.
+     */
+    refreshTokens() {
+        return __awaiter(this, void 0, void 0, function* () {
+            (0, logger_js_1.log)('debug', 'AuthorizationManager.refreshTokens');
+            const tokens = yield Promise.allSettled(this.tokens.getAll().map((token) => {
+                if ((0, index_js_1.isRefreshToken)(token)) {
+                    return this.refreshToken(token);
+                }
+                return Promise.resolve(null);
+            }));
+            __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_checkAuthorizationState).call(this);
+            return tokens;
+        });
+    }
+    /**
+     * Use the `refresh_token` attribute of a token to obtain a new access token.
+     * @param token The well-formed token with a `refresh_token` attribute.
+     */
+    refreshToken(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            (0, logger_js_1.log)('debug', `AuthorizationManager.refreshToken | resource_server=${token.resource_server}`);
+            try {
+                const response = yield (yield index_js_1.oauth2.token.refresh({
+                    payload: {
+                        client_id: this.configuration.client,
+                        refresh_token: token.refresh_token,
+                        grant_type: 'refresh_token',
+                    },
+                })).json();
+                if ((0, index_js_1.isGlobusAuthTokenResponse)(response)) {
+                    this.addTokenResponse(response);
+                    return response;
+                }
+            }
+            catch (error) {
+                (0, logger_js_1.log)('error', `AuthorizationManager.refreshToken | resource_server=${token.resource_server}`);
+            }
+            return null;
+        });
+    }
+    /**
+     * Whether or not the instance has a reference to a Globus Auth token.
+     */
+    hasGlobusAuthToken() {
+        return this.getGlobusAuthToken() !== null;
+    }
+    /**
+     * Retrieve the Globus Auth token managed by the instance.
+     */
+    getGlobusAuthToken() {
+        const entry = (0, index_js_2.getStorage)().get(`${this.storageKeyPrefix}auth.globus.org`);
+        return entry ? JSON.parse(entry) : null;
+    }
+    /**
+     * Reset the authenticated state and clear all tokens from storage.
+     * This method **does not** emit the `revoke` event. If you need to emit the `revoke` event, use the `AuthorizationManager.revoke` method.
+     */
+    reset() {
+        (0, index_js_2.getStorage)()
+            .keys()
+            .forEach((key) => {
+            if (key.startsWith(this.storageKeyPrefix)) {
+                (0, index_js_2.getStorage)().remove(key);
+            }
+        });
+        this.authenticated = false;
+    }
+    /**
+     * Initiate the login process by redirecting to the Globus Auth login page.
+     */
+    login(options = { additionalParams: {} }) {
+        (0, logger_js_1.log)('debug', 'AuthorizationManager.login');
+        this.reset();
+        /**
+         * In the future, it's possible that we may want to support different types of transports.
+         */
+        const transport = __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_buildTransport).call(this, { params: options === null || options === void 0 ? void 0 : options.additionalParams });
+        transport.send();
+    }
+    /**
+     * This method will attempt to complete the PKCE protocol flow.
+     */
+    handleCodeRedirect() {
+        return __awaiter(this, arguments, void 0, function* (options = { shouldReplace: true, additionalParams: {} }) {
+            (0, logger_js_1.log)('debug', 'AuthorizationManager.handleCodeRedirect');
+            const response = yield __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_buildTransport).call(this, { params: options === null || options === void 0 ? void 0 : options.additionalParams }).getToken({
+                shouldReplace: options === null || options === void 0 ? void 0 : options.shouldReplace,
+            });
+            if ((0, index_js_1.isGlobusAuthTokenResponse)(response)) {
+                (0, logger_js_1.log)('debug', `AuthorizationManager.handleCodeRedirect | response=${JSON.stringify(response)}`);
+                this.addTokenResponse(response);
+            }
+        });
+    }
+    handleErrorResponse(response, options) {
+        const opts = typeof options === 'boolean'
+            ? Object.assign(Object.assign({}, DEFAULT_HANDLE_ERROR_OPTIONS), { execute: options }) : Object.assign(Object.assign({}, DEFAULT_HANDLE_ERROR_OPTIONS), options);
+        (0, logger_js_1.log)('debug', `AuthorizationManager.handleErrorResponse | response=${JSON.stringify(response)} execute=${opts.execute}`);
+        let handler = () => { };
+        if ((0, errors_js_1.isAuthorizationRequirementsError)(response)) {
+            (0, logger_js_1.log)('debug', 'AuthorizationManager.handleErrorResponse | error=AuthorizationRequirementsError');
+            handler = () => this.handleAuthorizationRequirementsError(response, {
+                additionalParams: opts.additionalParams,
+            });
+        }
+        if ((0, errors_js_1.isConsentRequiredError)(response)) {
+            (0, logger_js_1.log)('debug', 'AuthorizationManager.handleErrorResponse | error=ConsentRequiredError');
+            handler = () => this.handleConsentRequiredError(response, { additionalParams: opts.additionalParams });
+        }
+        if ('code' in response && response['code'] === 'AuthenticationFailed') {
+            (0, logger_js_1.log)('debug', 'AuthorizationManager.handleErrorResponse | error=AuthenticationFailed');
+            handler = () => this.revoke();
+        }
+        return opts.execute === true ? handler() : handler;
+    }
+    /**
+     * Process a well-formed Authorization Requirements error response from a Globus service
+     * and redirect the user to the Globus Auth login page with the necessary parameters.
+     */
+    handleAuthorizationRequirementsError(response, options) {
+        __classPrivateFieldSet(this, _AuthorizationManager_transport, __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_buildTransport).call(this, {
+            params: Object.assign(Object.assign({ prompt: 'login' }, (0, errors_js_1.toAuthorizationQueryParams)(response)), options === null || options === void 0 ? void 0 : options.additionalParams),
+        }), "f");
+        __classPrivateFieldGet(this, _AuthorizationManager_transport, "f").send();
+    }
+    /**
+     * Process a well-formed `ConsentRequired` error response from a Globus service
+     * and redirect the user to the Globus Auth login page with the necessary parameters.
+     */
+    handleConsentRequiredError(response, options) {
+        __classPrivateFieldSet(this, _AuthorizationManager_transport, __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_buildTransport).call(this, {
+            requested_scopes: __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_withOfflineAccess).call(this, response.required_scopes.join(' ')),
+            params: Object.assign({}, options === null || options === void 0 ? void 0 : options.additionalParams),
+        }), "f");
+        __classPrivateFieldGet(this, _AuthorizationManager_transport, "f").send();
+    }
+    /**
+     * Call `AuthroizationManager.reset`, revoke all of the available tokns, and emit the `revoke` event.
+     * @emits AuthorizationManager.events#revoke
+     * @see AuthorizationManager.reset
+     */
+    revoke() {
+        return __awaiter(this, void 0, void 0, function* () {
+            (0, logger_js_1.log)('debug', 'AuthorizationManager.revoke');
+            const revocation = Promise.all(this.tokens.getAll().map(__classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_revokeToken).bind(this)));
+            this.reset();
+            yield revocation;
+            yield this.events.revoke.dispatch();
+        });
+    }
+}
+exports.AuthorizationManager = AuthorizationManager;
+_AuthorizationManager_transport = new WeakMap(), _AuthorizationManager_authenticated = new WeakMap(), _AuthorizationManager_instances = new WeakSet(), _AuthorizationManager_checkAuthorizationState = function _AuthorizationManager_checkAuthorizationState() {
+    (0, logger_js_1.log)('debug', 'AuthorizationManager.#checkAuthorizationState');
+    if (this.hasGlobusAuthToken()) {
+        this.authenticated = true;
+    }
+}, _AuthorizationManager_emitAuthenticatedState = function _AuthorizationManager_emitAuthenticatedState() {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const isAuthenticated = this.authenticated;
+        const token = (_a = this.getGlobusAuthToken()) !== null && _a !== void 0 ? _a : undefined;
+        yield this.events.authenticated.dispatch({
+            isAuthenticated,
+            token,
+        });
+    });
+}, _AuthorizationManager_withOfflineAccess = function _AuthorizationManager_withOfflineAccess(scopes) {
+    return `${scopes}${this.configuration.useRefreshTokens ? ' offline_access' : ''}`;
+}, _AuthorizationManager_buildTransport = function _AuthorizationManager_buildTransport(overrides) {
+    var _a;
+    const scopes = __classPrivateFieldGet(this, _AuthorizationManager_instances, "m", _AuthorizationManager_withOfflineAccess).call(this, (_a = overrides === null || overrides === void 0 ? void 0 : overrides.requested_scopes) !== null && _a !== void 0 ? _a : (this.configuration.scopes || ''));
+    return new RedirectTransport_js_1.RedirectTransport(Object.assign({ client_id: this.configuration.client, authorization_endpoint: (0, index_js_1.getAuthorizationEndpoint)(), token_endpoint: (0, index_js_1.getTokenEndpoint)(), redirect_uri: this.configuration.redirect, requested_scopes: scopes }, overrides));
+}, _AuthorizationManager_revokeToken = function _AuthorizationManager_revokeToken(token) {
+    (0, logger_js_1.log)('debug', `AuthorizationManager.revokeToken | resource_server=${token.resource_server}`);
+    return index_js_1.oauth2.token.revoke({
+        payload: {
+            client_id: this.configuration.client,
+            token: token.access_token,
+        },
+    });
+};
+//# sourceMappingURL=AuthorizationManager.js.map

package/dist/cjs/core/authorization/AuthorizationManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationManager.js","sourceRoot":"","sources":["../../../../src/core/authorization/AuthorizationManager.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuC;AAIvC,2DAMsC;AAEtC,kDAAgE;AAChE,4CAAmC;AAEnC,yCAAmC;AACnC,iEAIgC;AAChC,qDAA+C;AAE/C,4CAMsB;AAmCtB,MAAM,qBAAqB,GAAG;IAC5B,gBAAgB,EAAE,KAAK;IACvB,aAAa,EAAE,sBAAsB;CACtC,CAAC;AAEF,MAAM,4BAA4B,GAAG;IACnC,OAAO,EAAE,IAAI;IACb,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAa,oBAAoB;IAO/B;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,uBAAA,IAAI,2CAAe,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,aAAa,CAAC,KAAc;QAC9B;;WAEG;QACH,IAAI,KAAK,KAAK,uBAAA,IAAI,2CAAe,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,uBAAA,IAAI,uCAAkB,KAAK,MAAA,CAAC;QAC5B,uBAAA,IAAI,qFAAwB,MAA5B,IAAI,CAA0B,CAAC;IACjC,CAAC;IA8BD,YAAY,aAAgD;;;QAxD5D,kDAA+B;QAI/B,8CAAiB,KAAK,EAAC;QA0BvB,WAAM,GAAG;YACP;;;;;;eAMG;YACH,aAAa,EAAE,IAAI,gBAAK,CAUtB,eAAe,CAAC;YAClB;;;eAGG;YACH,MAAM,EAAE,IAAI,gBAAK,CAAC,QAAQ,CAAC;SAC5B,CAAC;QAuTF;;;;WAIG;QACH,qBAAgB,GAAG,CAAC,KAA4B,EAAE,EAAE;;YAClD,IAAA,qBAAU,GAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC;YACjF,IAAI,cAAc,IAAI,KAAK,EAAE,CAAC;gBAC5B,MAAA,KAAK,CAAC,YAAY,0CAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACrD,CAAC;YACD,uBAAA,IAAI,sFAAyB,MAA7B,IAAI,CAA2B,CAAC;QAClC,CAAC,CAAC;QA/TA;;WAEG;QACH,IAAA,wBAAa,EAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD;;;WAGG;QACH,MAAM,MAAM,GACV,aAAa,CAAC,aAAa,KAAK,KAAK;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,MAAA,aAAa,CAAC,aAAa,mCAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAE3E,IAAI,CAAC,aAAa,iDACb,qBAAqB,GACrB,aAAa,KAChB,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC;iBAC/D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;iBACvB,IAAI,CAAC,GAAG,CAAC,GACb,CAAC;QACF;;;WAGG;QACH,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;gBACrE,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACxB,IAAI,CAAC,MAAM,CAAC,IAA4C,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,4BAAW,CAAC;YAC5B,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,uBAAA,IAAI,sFAAyB,MAA7B,IAAI,CAA2B,CAAC;IAClC,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;IACzC,CAAC;IAED;;;;;;;;;OASG;IACH,IAAI,IAAI;QACN,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxC,OAAO,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,sBAAS,EAAc,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,CAAC;IAED;;;OAGG;IACG,aAAa;;YACjB,IAAA,eAAG,EAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CACrC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACjC,IAAI,IAAA,yBAAc,EAAC,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAClC,CAAC;gBACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC,CAAC,CACH,CAAC;YACF,uBAAA,IAAI,sFAAyB,MAA7B,IAAI,CAA2B,CAAC;YAChC,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAED;;;OAGG;IACG,YAAY,CAAC,KAAuB;;YACxC,IAAA,eAAG,EAAC,OAAO,EAAE,uDAAuD,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CACrB,MAAM,iBAAM,CAAC,KAAK,CAAC,OAAO,CAAC;oBACzB,OAAO,EAAE;wBACP,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;wBACpC,aAAa,EAAE,KAAK,CAAC,aAAa;wBAClC,UAAU,EAAE,eAAe;qBAC5B;iBACF,CAAC,CACH,CAAC,IAAI,EAAE,CAAC;gBACT,IAAI,IAAA,oCAAyB,EAAC,QAAQ,CAAC,EAAE,CAAC;oBACxC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;oBAChC,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,eAAG,EAAC,OAAO,EAAE,uDAAuD,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,kBAAkB,EAAE,KAAK,IAAI,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,MAAM,KAAK,GAAG,IAAA,qBAAU,GAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,iBAAiB,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAkBD;;;OAGG;IACH,KAAK;QACH,IAAA,qBAAU,GAAE;aACT,IAAI,EAAE;aACN,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC1C,IAAA,qBAAU,GAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IA8BD;;OAEG;IACH,KAAK,CAAC,OAAO,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE;QACtC,IAAA,eAAG,EAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb;;WAEG;QACH,MAAM,SAAS,GAAG,uBAAA,IAAI,6EAAgB,MAApB,IAAI,EAAiB,EAAE,MAAM,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9E,SAAS,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;IAED;;OAEG;IACG,kBAAkB;6DACtB,UAGI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE;YAEjD,IAAA,eAAG,EAAC,OAAO,EAAE,yCAAyC,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,6EAAgB,MAApB,IAAI,EAAiB,EAAE,MAAM,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC;gBAC1F,aAAa,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;aACtC,CAAC,CAAC;YACH,IAAI,IAAA,oCAAyB,EAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,IAAA,eAAG,EACD,OAAO,EACP,sDAAsD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CACjF,CAAC;gBACF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;KAAA;IAmBD,mBAAmB,CACjB,QAAiC,EACjC,OAEW;QAEX,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,iCACM,4BAA4B,KAC/B,OAAO,EAAE,OAAO,IAEpB,CAAC,iCACM,4BAA4B,GAC5B,OAAO,CACX,CAAC;QACR,IAAA,eAAG,EACD,OAAO,EACP,uDAAuD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAC1G,CAAC;QACF,IAAI,OAAO,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QACvB,IAAI,IAAA,4CAAgC,EAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,IAAA,eAAG,EACD,OAAO,EACP,iFAAiF,CAClF,CAAC;YACF,OAAO,GAAG,GAAG,EAAE,CACb,IAAI,CAAC,oCAAoC,CAAC,QAAQ,EAAE;gBAClD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;aACxC,CAAC,CAAC;QACP,CAAC;QACD,IAAI,IAAA,kCAAsB,EAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,IAAA,eAAG,EAAC,OAAO,EAAE,uEAAuE,CAAC,CAAC;YACtF,OAAO,GAAG,GAAG,EAAE,CACb,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,MAAM,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,sBAAsB,EAAE,CAAC;YACtE,IAAA,eAAG,EAAC,OAAO,EAAE,uEAAuE,CAAC,CAAC;YACtF,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,oCAAoC,CAClC,QAAwC,EACxC,OAAmE;QAEnE,uBAAA,IAAI,mCAAc,uBAAA,IAAI,6EAAgB,MAApB,IAAI,EAAiB;YACrC,MAAM,gCACJ,MAAM,EAAE,OAAO,IACZ,IAAA,sCAA0B,EAAC,QAAQ,CAAC,GACpC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,CAC7B;SACF,CAAC,MAAA,CAAC;QACH,uBAAA,IAAI,uCAAW,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,0BAA0B,CACxB,QAA8B,EAC9B,OAAmE;QAEnE,uBAAA,IAAI,mCAAc,uBAAA,IAAI,6EAAgB,MAApB,IAAI,EAAiB;YACrC,gBAAgB,EAAE,uBAAA,IAAI,gFAAmB,MAAvB,IAAI,EAAoB,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7E,MAAM,oBACD,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,CAC7B;SACF,CAAC,MAAA,CAAC;QACH,uBAAA,IAAI,uCAAW,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAeD;;;;OAIG;IACG,MAAM;;YACV,IAAA,eAAG,EAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAA,IAAI,0EAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,UAAU,CAAC;YACjB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,CAAC;KAAA;CAcF;AApZD,oDAoZC;;IAlOG,IAAA,eAAG,EAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC;;;QAGC,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,kBAAkB,EAAE,mCAAI,SAAS,CAAC;QACrD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;YACvC,eAAe;YACf,KAAK;SACN,CAAC,CAAC;IACL,CAAC;8FAqBkB,MAAc;IAC/B,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACpF,CAAC,uFAEe,SAAuE;;IACrF,MAAM,MAAM,GAAG,uBAAA,IAAI,gFAAmB,MAAvB,IAAI,EACjB,MAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,gBAAgB,mCAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,EAAE,CAAC,CACjE,CAAC;IAEF,OAAO,IAAI,wCAAiB,iBAC1B,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EACpC,sBAAsB,EAAE,IAAA,mCAAwB,GAAE,EAClD,cAAc,EAAE,IAAA,2BAAgB,GAAE,EAClC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,EACzC,gBAAgB,EAAE,MAAM,IACrB,SAAS,EAMZ,CAAC;AACL,CAAC,iFAiKY,KAAY;IACvB,IAAA,eAAG,EAAC,OAAO,EAAE,sDAAsD,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;IAC5F,OAAO,iBAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE;YACP,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;YACpC,KAAK,EAAE,KAAK,CAAC,YAAY;SAC1B;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/core/authorization/Event.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @todo It would be nice to not `| any` here, but ideally callers do not need to
+ * fully type the payload to attach listeners.
+ */
+type ListenerCallback<P> = (payload?: P | any) => Promise<void> | void;
+export declare class Event<EventName extends string, Payload extends unknown> {
+    #private;
+    readonly name: EventName;
+    constructor(name: EventName);
+    addListener(callback: ListenerCallback<Payload>): () => void;
+    removeListener(callback: ListenerCallback<Payload>): void;
+    clearListeners(): void;
+    dispatch(payload?: Payload): Promise<void>;
+}
+export {};
+//# sourceMappingURL=Event.d.ts.map

package/dist/cjs/core/authorization/Event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Event.d.ts","sourceRoot":"","sources":["../../../../src/core/authorization/Event.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,KAAK,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAEvE,qBAAa,KAAK,CAAC,SAAS,SAAS,MAAM,EAAE,OAAO,SAAS,OAAO;;IAGtD,QAAQ,CAAC,IAAI,EAAE,SAAS;gBAAf,IAAI,EAAE,SAAS;IAEpC,WAAW,CAAC,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC;IAK/C,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC;IAIlD,cAAc;IAIR,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO;CAGjC"}

package/dist/cjs/core/authorization/Event.js

@@ -0,0 +1,48 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _Event_callbacks;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Event = void 0;
+class Event {
+    constructor(name) {
+        this.name = name;
+        _Event_callbacks.set(this, []);
+    }
+    addListener(callback) {
+        __classPrivateFieldGet(this, _Event_callbacks, "f").push(callback);
+        return () => this.removeListener(callback);
+    }
+    removeListener(callback) {
+        __classPrivateFieldSet(this, _Event_callbacks, __classPrivateFieldGet(this, _Event_callbacks, "f").filter((cb) => cb !== callback), "f");
+    }
+    clearListeners() {
+        __classPrivateFieldSet(this, _Event_callbacks, [], "f");
+    }
+    dispatch(payload) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield Promise.all(__classPrivateFieldGet(this, _Event_callbacks, "f").map((callback) => callback(payload)));
+        });
+    }
+}
+exports.Event = Event;
+_Event_callbacks = new WeakMap();
+//# sourceMappingURL=Event.js.map

package/dist/cjs/core/authorization/Event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Event.js","sourceRoot":"","sources":["../../../../src/core/authorization/Event.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMA,MAAa,KAAK;IAGhB,YAAqB,IAAe;QAAf,SAAI,GAAJ,IAAI,CAAW;QAFpC,2BAA0C,EAAE,EAAC;IAEN,CAAC;IAExC,WAAW,CAAC,QAAmC;QAC7C,uBAAA,IAAI,wBAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,cAAc,CAAC,QAAmC;QAChD,uBAAA,IAAI,oBAAc,uBAAA,IAAI,wBAAW,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAA,CAAC;IACpE,CAAC;IAED,cAAc;QACZ,uBAAA,IAAI,oBAAc,EAAE,MAAA,CAAC;IACvB,CAAC;IAEK,QAAQ,CAAC,OAAiB;;YAC9B,MAAM,OAAO,CAAC,GAAG,CAAC,uBAAA,IAAI,wBAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;KAAA;CACF;AArBD,sBAqBC"}

package/dist/cjs/core/authorization/RedirectTransport.d.ts

@@ -0,0 +1,26 @@
+import type IConfig from 'js-pkce/dist/IConfig';
+import type IObject from 'js-pkce/dist/IObject';
+export type GetTokenOptions = {
+    /**
+     * Whether or not the URL should be replaced after processing the token.
+     * @default true
+     */
+    shouldReplace?: boolean;
+};
+export type RedirectTransportOptions = IConfig & {
+    /**
+     * Additional parameters to be included in the query string of the authorization request.
+     */
+    params?: IObject;
+};
+export declare class RedirectTransport {
+    #private;
+    constructor(options: RedirectTransportOptions);
+    send(): void;
+    /**
+     * Parse the current URL for the authorization code (`?code=...`) and exchange it for an access token when available.
+     * - When the URL is processed and exchanged for an access token, the page is redirected to the current URL without the `?code=...&state=...` parameters.
+     */
+    getToken(options?: GetTokenOptions): Promise<import("js-pkce/dist/ITokenResponse").default | undefined>;
+}
+//# sourceMappingURL=RedirectTransport.d.ts.map

package/dist/cjs/core/authorization/RedirectTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedirectTransport.d.ts","sourceRoot":"","sources":["../../../../src/core/authorization/RedirectTransport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAC;AAChD,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAC;AAEhD,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAWF,qBAAa,iBAAiB;;gBAKhB,OAAO,EAAE,wBAAwB;IAU7C,IAAI;IASJ;;;OAGG;IACG,QAAQ,CAAC,OAAO,GAAE,eAAyC;CA0BlE"}

package/dist/cjs/core/authorization/RedirectTransport.js

@@ -0,0 +1,100 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var _RedirectTransport_pkce, _RedirectTransport_params;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedirectTransport = void 0;
+const js_pkce_1 = __importDefault(require("js-pkce"));
+/**
+ * Resets js-pkce state
+ * @see https://github.com/bpedroza/js-pkce/blob/master/src/PKCE.ts
+ */
+function resetPKCE() {
+    sessionStorage.removeItem('pkce_state');
+    sessionStorage.removeItem('pkce_code_verifier');
+}
+class RedirectTransport {
+    constructor(options) {
+        _RedirectTransport_pkce.set(this, void 0);
+        _RedirectTransport_params.set(this, {});
+        const { params } = options, config = __rest(options, ["params"]);
+        __classPrivateFieldSet(this, _RedirectTransport_pkce, new js_pkce_1.default(Object.assign({}, config)), "f");
+        __classPrivateFieldSet(this, _RedirectTransport_params, Object.assign({}, params), "f");
+    }
+    send() {
+        /**
+         * By resetting PKCE before sending, we ensure that a fresh `code_challenge` is generated
+         * when `authorizeUrl` is called.
+         */
+        resetPKCE();
+        window.location.assign(__classPrivateFieldGet(this, _RedirectTransport_pkce, "f").authorizeUrl(__classPrivateFieldGet(this, _RedirectTransport_params, "f")));
+    }
+    /**
+     * Parse the current URL for the authorization code (`?code=...`) and exchange it for an access token when available.
+     * - When the URL is processed and exchanged for an access token, the page is redirected to the current URL without the `?code=...&state=...` parameters.
+     */
+    getToken() {
+        return __awaiter(this, arguments, void 0, function* (options = { shouldReplace: true }) {
+            const url = new URL(window.location.href);
+            const params = new URLSearchParams(url.search);
+            /**
+             * If we don't have a `code` parameter, we can't exchange it for an access token.
+             */
+            if (!params.get('code'))
+                return undefined;
+            const response = yield __classPrivateFieldGet(this, _RedirectTransport_pkce, "f").exchangeForAccessToken(url.toString());
+            resetPKCE();
+            if (options.shouldReplace) {
+                /**
+                 * Remove the `code` and `state` parameters from the URL.
+                 */
+                params.delete('code');
+                params.delete('state');
+                /**
+                 * Update the URL with the new query string.
+                 */
+                url.search = params.toString();
+                /**
+                 * Redirect the page to the new URL (without the `code` and `state` parameters)/
+                 */
+                window.location.replace(url);
+            }
+            return response;
+        });
+    }
+}
+exports.RedirectTransport = RedirectTransport;
+_RedirectTransport_pkce = new WeakMap(), _RedirectTransport_params = new WeakMap();
+//# sourceMappingURL=RedirectTransport.js.map

package/dist/cjs/core/authorization/RedirectTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedirectTransport.js","sourceRoot":"","sources":["../../../../src/core/authorization/RedirectTransport.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,sDAA2B;AAmB3B;;;GAGG;AACH,SAAS,SAAS;IAChB,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,cAAc,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAClD,CAAC;AAED,MAAa,iBAAiB;IAK5B,YAAY,OAAiC;QAJ7C,0CAAY;QAEZ,oCAA8C,EAAE,EAAC;QAG/C,MAAM,EAAE,MAAM,KAAgB,OAAO,EAAlB,MAAM,UAAK,OAAO,EAA/B,UAAqB,CAAU,CAAC;QACtC,uBAAA,IAAI,2BAAS,IAAI,iBAAI,mBAChB,MAAM,EACT,MAAA,CAAC;QACH,uBAAA,IAAI,+CACC,MAAM,OACV,CAAC;IACJ,CAAC;IAED,IAAI;QACF;;;WAGG;QACH,SAAS,EAAE,CAAC;QACZ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,uBAAA,IAAI,+BAAM,CAAC,YAAY,CAAC,uBAAA,IAAI,iCAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACG,QAAQ;6DAAC,UAA2B,EAAE,aAAa,EAAE,IAAI,EAAE;YAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C;;eAEG;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,+BAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzE,SAAS,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B;;mBAEG;gBACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvB;;mBAEG;gBACH,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC/B;;mBAEG;gBACH,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;CACF;AAtDD,8CAsDC"}

package/dist/cjs/core/authorization/TokenLookup.d.ts

@@ -0,0 +1,19 @@
+import { AuthorizationManager } from './AuthorizationManager.js';
+import type { Token } from '../../services/auth/types.js';
+export declare class TokenLookup {
+    #private;
+    constructor(options: {
+        manager: AuthorizationManager;
+    });
+    get auth(): Token | null;
+    get transfer(): Token | null;
+    get flows(): Token | null;
+    get groups(): Token | null;
+    get search(): Token | null;
+    get timer(): Token | null;
+    get compute(): Token | null;
+    gcs(endpoint: string): Token | null;
+    getByResourceServer(resourceServer: string): Token | null;
+    getAll(): Token[];
+}
+//# sourceMappingURL=TokenLookup.d.ts.map

package/dist/cjs/core/authorization/TokenLookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenLookup.d.ts","sourceRoot":"","sources":["../../../../src/core/authorization/TokenLookup.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AAgB1D,qBAAa,WAAW;;gBAGV,OAAO,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE;IAatD,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,CAEvB;IAED,IAAI,QAAQ,IAAI,KAAK,GAAG,IAAI,CAE3B;IAED,IAAI,KAAK,IAAI,KAAK,GAAG,IAAI,CAExB;IAED,IAAI,MAAM,IAAI,KAAK,GAAG,IAAI,CAEzB;IAED,IAAI,MAAM,IAAI,KAAK,GAAG,IAAI,CAEzB;IAED,IAAI,KAAK,IAAI,KAAK,GAAG,IAAI,CAExB;IAED,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,CAE1B;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAInC,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAIzD,MAAM,IAAI,KAAK,EAAE;CAWlB"}