@golocalinteractive/golocal-cloud-wrapper 1.0.56 → 1.0.57

package/dist/golocal-cloud-wrapper.es144.js

@@ -1,650 +0,0 @@
-import { s as serverExports } from "./golocal-cloud-wrapper.es82.js";
-import { generateRandomCodeVerifier, calculatePKCECodeChallenge, generateRandomState, generateRandomNonce, validateAuthResponse, authorizationCodeGrantRequest, allowInsecureRequests, customFetch, processAuthorizationCodeResponse, getValidatedIdTokenClaims, refreshTokenGrantRequest, processRefreshTokenResponse, discoveryRequest, processDiscoveryResponse, pushedAuthorizationRequest, processPushedAuthorizationResponse, PrivateKeyJwt, ClientSecretPost, genericTokenEndpointRequest, processGenericTokenEndpointResponse } from "./golocal-cloud-wrapper.es149.js";
-import packageJson from "./golocal-cloud-wrapper.es150.js";
-import { MissingStateError, InvalidStateError, AuthorizationError, OAuth2Error, AuthorizationCodeGrantRequestError, AuthorizationCodeGrantError, AccessTokenErrorCode, AccessTokenError, DiscoveryError, BackchannelLogoutError, AccessTokenForConnectionError, AccessTokenForConnectionErrorCode } from "./golocal-cloud-wrapper.es19.js";
-import { removeTrailingSlash, ensureNoLeadingSlash, normalizeWithBasePath, ensureTrailingSlash } from "./golocal-cloud-wrapper.es60.js";
-import { toSafeRedirect } from "./golocal-cloud-wrapper.es151.js";
-import { addCacheControlHeadersForSession } from "./golocal-cloud-wrapper.es152.js";
-import { filterDefaultIdTokenClaims } from "./golocal-cloud-wrapper.es153.js";
-import { createRemoteJWKSet, jwksCache } from "./golocal-cloud-wrapper.es154.js";
-import { jwtVerify } from "./golocal-cloud-wrapper.es155.js";
-import { importPKCS8 } from "./golocal-cloud-wrapper.es156.js";
-const INTERNAL_AUTHORIZE_PARAMS = [
-  "client_id",
-  "redirect_uri",
-  "response_type",
-  "code_challenge",
-  "code_challenge_method",
-  "state",
-  "nonce"
-];
-const DEFAULT_SCOPES = ["openid", "profile", "email", "offline_access"].join(" ");
-const GRANT_TYPE_FEDERATED_CONNECTION_ACCESS_TOKEN = "urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token";
-const SUBJECT_TYPE_REFRESH_TOKEN = "urn:ietf:params:oauth:token-type:refresh_token";
-const REQUESTED_TOKEN_TYPE_FEDERATED_CONNECTION_ACCESS_TOKEN = "http://auth0.com/oauth/token-type/federated-connection-access-token";
-function createRouteUrl(path, baseUrl) {
-  return new URL(ensureNoLeadingSlash(normalizeWithBasePath(path)), ensureTrailingSlash(baseUrl));
-}
-class AuthClient {
-  constructor(options) {
-    this.fetch = options.fetch || fetch;
-    this.jwksCache = options.jwksCache || {};
-    this.allowInsecureRequests = options.allowInsecureRequests ?? false;
-    this.httpOptions = () => {
-      const headers = new Headers();
-      const enableTelemetry = options.enableTelemetry ?? true;
-      const timeout = options.httpTimeout ?? 5e3;
-      if (enableTelemetry) {
-        const name = "nextjs-auth0";
-        const version = packageJson.version;
-        headers.set("User-Agent", `${name}/${version}`);
-        headers.set("Auth0-Client", encodeBase64(JSON.stringify({
-          name,
-          version
-        })));
-      }
-      return {
-        signal: AbortSignal.timeout(timeout),
-        headers
-      };
-    };
-    if (this.allowInsecureRequests && process.env.NODE_ENV === "production") {
-      console.warn("allowInsecureRequests is enabled in a production environment. This is not recommended.");
-    }
-    this.transactionStore = options.transactionStore;
-    this.sessionStore = options.sessionStore;
-    this.domain = options.domain;
-    this.clientMetadata = { client_id: options.clientId };
-    this.clientSecret = options.clientSecret;
-    this.authorizationParameters = options.authorizationParameters || {
-      scope: DEFAULT_SCOPES
-    };
-    this.pushedAuthorizationRequests = options.pushedAuthorizationRequests ?? false;
-    this.clientAssertionSigningKey = options.clientAssertionSigningKey;
-    this.clientAssertionSigningAlg = options.clientAssertionSigningAlg || "RS256";
-    if (!this.authorizationParameters.scope) {
-      this.authorizationParameters.scope = DEFAULT_SCOPES;
-    }
-    const scope = this.authorizationParameters.scope.split(" ").map((s) => s.trim());
-    if (!scope.includes("openid")) {
-      throw new Error("The 'openid' scope must be included in the set of scopes. See https://auth0.com/docs");
-    }
-    this.appBaseUrl = options.appBaseUrl;
-    this.signInReturnToPath = options.signInReturnToPath || "/";
-    this.beforeSessionSaved = options.beforeSessionSaved;
-    this.onCallback = options.onCallback || this.defaultOnCallback;
-    this.routes = {
-      login: "/auth/login",
-      logout: "/auth/logout",
-      callback: "/auth/callback",
-      backChannelLogout: "/auth/backchannel-logout",
-      profile: process.env.NEXT_PUBLIC_PROFILE_ROUTE || "/auth/profile",
-      accessToken: process.env.NEXT_PUBLIC_ACCESS_TOKEN_ROUTE || "/auth/access-token",
-      ...options.routes
-    };
-    this.enableAccessTokenEndpoint = options.enableAccessTokenEndpoint ?? true;
-    this.noContentProfileResponseWhenUnauthenticated = options.noContentProfileResponseWhenUnauthenticated ?? false;
-  }
-  async handler(req) {
-    const { pathname } = req.nextUrl;
-    const sanitizedPathname = removeTrailingSlash(pathname);
-    const method = req.method;
-    if (method === "GET" && sanitizedPathname === this.routes.login) {
-      return this.handleLogin(req);
-    } else if (method === "GET" && sanitizedPathname === this.routes.logout) {
-      return this.handleLogout(req);
-    } else if (method === "GET" && sanitizedPathname === this.routes.callback) {
-      return this.handleCallback(req);
-    } else if (method === "GET" && sanitizedPathname === this.routes.profile) {
-      return this.handleProfile(req);
-    } else if (method === "GET" && sanitizedPathname === this.routes.accessToken && this.enableAccessTokenEndpoint) {
-      return this.handleAccessToken(req);
-    } else if (method === "POST" && sanitizedPathname === this.routes.backChannelLogout) {
-      return this.handleBackChannelLogout(req);
-    } else {
-      const res = serverExports.NextResponse.next();
-      const session = await this.sessionStore.get(req.cookies);
-      if (session) {
-        await this.sessionStore.set(req.cookies, res.cookies, {
-          ...session
-        });
-        addCacheControlHeadersForSession(res);
-      }
-      return res;
-    }
-  }
-  async startInteractiveLogin(options = {}) {
-    const redirectUri = createRouteUrl(this.routes.callback, this.appBaseUrl);
-    let returnTo = this.signInReturnToPath;
-    if (options.returnTo) {
-      const safeBaseUrl = new URL(this.authorizationParameters.redirect_uri || this.appBaseUrl);
-      const sanitizedReturnTo = toSafeRedirect(options.returnTo, safeBaseUrl);
-      if (sanitizedReturnTo) {
-        returnTo = sanitizedReturnTo.pathname + sanitizedReturnTo.search + sanitizedReturnTo.hash;
-      }
-    }
-    const codeChallengeMethod = "S256";
-    const codeVerifier = generateRandomCodeVerifier();
-    const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
-    const state = generateRandomState();
-    const nonce = generateRandomNonce();
-    const authorizationParams = new URLSearchParams();
-    authorizationParams.set("client_id", this.clientMetadata.client_id);
-    authorizationParams.set("redirect_uri", redirectUri.toString());
-    authorizationParams.set("response_type", "code");
-    authorizationParams.set("code_challenge", codeChallenge);
-    authorizationParams.set("code_challenge_method", codeChallengeMethod);
-    authorizationParams.set("state", state);
-    authorizationParams.set("nonce", nonce);
-    const mergedAuthorizationParams = {
-      // any custom params to forward to /authorize defined as configuration
-      ...this.authorizationParameters,
-      // custom parameters passed in via the query params to ensure only the confidential client can set them
-      ...options.authorizationParameters
-    };
-    Object.entries(mergedAuthorizationParams).forEach(([key, val]) => {
-      if (!INTERNAL_AUTHORIZE_PARAMS.includes(key) && val != null) {
-        authorizationParams.set(key, String(val));
-      }
-    });
-    const transactionState = {
-      nonce,
-      maxAge: this.authorizationParameters.max_age,
-      codeVerifier,
-      responseType: "code",
-      state,
-      returnTo
-    };
-    const [error, authorizationUrl] = await this.authorizationUrl(authorizationParams);
-    if (error) {
-      return new serverExports.NextResponse("An error occured while trying to initiate the login request.", {
-        status: 500
-      });
-    }
-    const res = serverExports.NextResponse.redirect(authorizationUrl.toString());
-    await this.transactionStore.save(res.cookies, transactionState);
-    return res;
-  }
-  async handleLogin(req) {
-    const searchParams = Object.fromEntries(req.nextUrl.searchParams.entries());
-    const options = {
-      // SECURITY CRITICAL: Only forward query params when PAR is disabled
-      authorizationParameters: !this.pushedAuthorizationRequests ? searchParams : {},
-      returnTo: searchParams.returnTo
-    };
-    return this.startInteractiveLogin(options);
-  }
-  async handleLogout(req) {
-    const session = await this.sessionStore.get(req.cookies);
-    const [discoveryError, authorizationServerMetadata] = await this.discoverAuthorizationServerMetadata();
-    if (discoveryError) {
-      return new serverExports.NextResponse("An error occured while trying to initiate the logout request.", {
-        status: 500
-      });
-    }
-    const returnTo = req.nextUrl.searchParams.get("returnTo") || this.appBaseUrl;
-    if (!authorizationServerMetadata.end_session_endpoint) {
-      console.warn("The Auth0 client does not have RP-initiated logout enabled, the user will be redirected to the `/v2/logout` endpoint instead. Learn how to enable it here: https://auth0.com/docs/authenticate/login/logout/log-users-out-of-auth0#enable-endpoint-discovery");
-      const url2 = new URL("/v2/logout", this.issuer);
-      url2.searchParams.set("returnTo", returnTo);
-      url2.searchParams.set("client_id", this.clientMetadata.client_id);
-      const res2 = serverExports.NextResponse.redirect(url2);
-      await this.sessionStore.delete(req.cookies, res2.cookies);
-      await this.transactionStore.deleteAll(req.cookies, res2.cookies);
-      return res2;
-    }
-    const url = new URL(authorizationServerMetadata.end_session_endpoint);
-    url.searchParams.set("client_id", this.clientMetadata.client_id);
-    url.searchParams.set("post_logout_redirect_uri", returnTo);
-    if (session == null ? void 0 : session.internal.sid) {
-      url.searchParams.set("logout_hint", session.internal.sid);
-    }
-    if (session == null ? void 0 : session.tokenSet.idToken) {
-      url.searchParams.set("id_token_hint", session == null ? void 0 : session.tokenSet.idToken);
-    }
-    const res = serverExports.NextResponse.redirect(url);
-    await this.sessionStore.delete(req.cookies, res.cookies);
-    addCacheControlHeadersForSession(res);
-    await this.transactionStore.deleteAll(req.cookies, res.cookies);
-    return res;
-  }
-  async handleCallback(req) {
-    const state = req.nextUrl.searchParams.get("state");
-    if (!state) {
-      return this.onCallback(new MissingStateError(), {}, null);
-    }
-    const transactionStateCookie = await this.transactionStore.get(req.cookies, state);
-    if (!transactionStateCookie) {
-      return this.onCallback(new InvalidStateError(), {}, null);
-    }
-    const transactionState = transactionStateCookie.payload;
-    const onCallbackCtx = {
-      returnTo: transactionState.returnTo
-    };
-    const [discoveryError, authorizationServerMetadata] = await this.discoverAuthorizationServerMetadata();
-    if (discoveryError) {
-      return this.onCallback(discoveryError, onCallbackCtx, null);
-    }
-    let codeGrantParams;
-    try {
-      codeGrantParams = validateAuthResponse(authorizationServerMetadata, this.clientMetadata, req.nextUrl.searchParams, transactionState.state);
-    } catch (e) {
-      return this.onCallback(new AuthorizationError({
-        cause: new OAuth2Error({
-          code: e.error,
-          message: e.error_description
-        })
-      }), onCallbackCtx, null);
-    }
-    let codeGrantResponse;
-    try {
-      const redirectUri = createRouteUrl(this.routes.callback, this.appBaseUrl);
-      codeGrantResponse = await authorizationCodeGrantRequest(authorizationServerMetadata, this.clientMetadata, await this.getClientAuth(), codeGrantParams, redirectUri.toString(), transactionState.codeVerifier, {
-        ...this.httpOptions(),
-        [customFetch]: this.fetch,
-        [allowInsecureRequests]: this.allowInsecureRequests
-      });
-    } catch (e) {
-      return this.onCallback(new AuthorizationCodeGrantRequestError(e.message), onCallbackCtx, null);
-    }
-    let oidcRes;
-    try {
-      oidcRes = await processAuthorizationCodeResponse(authorizationServerMetadata, this.clientMetadata, codeGrantResponse, {
-        expectedNonce: transactionState.nonce,
-        maxAge: transactionState.maxAge,
-        requireIdToken: true
-      });
-    } catch (e) {
-      return this.onCallback(new AuthorizationCodeGrantError({
-        cause: new OAuth2Error({
-          code: e.error,
-          message: e.error_description
-        })
-      }), onCallbackCtx, null);
-    }
-    const idTokenClaims = getValidatedIdTokenClaims(oidcRes);
-    let session = {
-      user: idTokenClaims,
-      tokenSet: {
-        accessToken: oidcRes.access_token,
-        idToken: oidcRes.id_token,
-        scope: oidcRes.scope,
-        refreshToken: oidcRes.refresh_token,
-        expiresAt: Math.floor(Date.now() / 1e3) + Number(oidcRes.expires_in)
-      },
-      internal: {
-        sid: idTokenClaims.sid,
-        createdAt: Math.floor(Date.now() / 1e3)
-      }
-    };
-    const res = await this.onCallback(null, onCallbackCtx, session);
-    if (this.beforeSessionSaved) {
-      const updatedSession = await this.beforeSessionSaved(session, oidcRes.id_token ?? null);
-      session = {
-        ...updatedSession,
-        internal: session.internal
-      };
-    } else {
-      session.user = filterDefaultIdTokenClaims(idTokenClaims);
-    }
-    await this.sessionStore.set(req.cookies, res.cookies, session, true);
-    addCacheControlHeadersForSession(res);
-    await this.transactionStore.delete(res.cookies, state);
-    return res;
-  }
-  async handleProfile(req) {
-    const session = await this.sessionStore.get(req.cookies);
-    if (!session) {
-      if (this.noContentProfileResponseWhenUnauthenticated) {
-        return new serverExports.NextResponse(null, {
-          status: 204
-        });
-      }
-      return new serverExports.NextResponse(null, {
-        status: 401
-      });
-    }
-    const res = serverExports.NextResponse.json(session == null ? void 0 : session.user);
-    addCacheControlHeadersForSession(res);
-    return res;
-  }
-  async handleAccessToken(req) {
-    const session = await this.sessionStore.get(req.cookies);
-    if (!session) {
-      return serverExports.NextResponse.json({
-        error: {
-          message: "The user does not have an active session.",
-          code: AccessTokenErrorCode.MISSING_SESSION
-        }
-      }, {
-        status: 401
-      });
-    }
-    const [error, updatedTokenSet] = await this.getTokenSet(session.tokenSet);
-    if (error) {
-      return serverExports.NextResponse.json({
-        error: {
-          message: error.message,
-          code: error.code
-        }
-      }, {
-        status: 401
-      });
-    }
-    const res = serverExports.NextResponse.json({
-      token: updatedTokenSet.accessToken,
-      scope: updatedTokenSet.scope,
-      expires_at: updatedTokenSet.expiresAt
-    });
-    if (updatedTokenSet.accessToken !== session.tokenSet.accessToken || updatedTokenSet.refreshToken !== session.tokenSet.refreshToken || updatedTokenSet.expiresAt !== session.tokenSet.expiresAt) {
-      await this.sessionStore.set(req.cookies, res.cookies, {
-        ...session,
-        tokenSet: updatedTokenSet
-      });
-      addCacheControlHeadersForSession(res);
-    }
-    return res;
-  }
-  async handleBackChannelLogout(req) {
-    if (!this.sessionStore.store) {
-      return new serverExports.NextResponse("A session data store is not configured.", {
-        status: 500
-      });
-    }
-    if (!this.sessionStore.store.deleteByLogoutToken) {
-      return new serverExports.NextResponse("Back-channel logout is not supported by the session data store.", {
-        status: 500
-      });
-    }
-    const body = new URLSearchParams(await req.text());
-    const logoutToken = body.get("logout_token");
-    if (!logoutToken) {
-      return new serverExports.NextResponse("Missing `logout_token` in the request body.", {
-        status: 400
-      });
-    }
-    const [error, logoutTokenClaims] = await this.verifyLogoutToken(logoutToken);
-    if (error) {
-      return new serverExports.NextResponse(error.message, {
-        status: 400
-      });
-    }
-    await this.sessionStore.store.deleteByLogoutToken(logoutTokenClaims);
-    return new serverExports.NextResponse(null, {
-      status: 204
-    });
-  }
-  /**
-   * getTokenSet returns a valid token set. If the access token has expired, it will attempt to
-   * refresh it using the refresh token, if available.
-   */
-  async getTokenSet(tokenSet, forceRefresh) {
-    if (!tokenSet.refreshToken && tokenSet.expiresAt <= Date.now() / 1e3) {
-      return [
-        new AccessTokenError(AccessTokenErrorCode.MISSING_REFRESH_TOKEN, "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."),
-        null
-      ];
-    }
-    if (tokenSet.refreshToken) {
-      if (forceRefresh || tokenSet.expiresAt <= Date.now() / 1e3) {
-        const [discoveryError, authorizationServerMetadata] = await this.discoverAuthorizationServerMetadata();
-        if (discoveryError) {
-          return [discoveryError, null];
-        }
-        const refreshTokenRes = await refreshTokenGrantRequest(authorizationServerMetadata, this.clientMetadata, await this.getClientAuth(), tokenSet.refreshToken, {
-          ...this.httpOptions(),
-          [customFetch]: this.fetch,
-          [allowInsecureRequests]: this.allowInsecureRequests
-        });
-        let oauthRes;
-        try {
-          oauthRes = await processRefreshTokenResponse(authorizationServerMetadata, this.clientMetadata, refreshTokenRes);
-        } catch (e) {
-          return [
-            new AccessTokenError(AccessTokenErrorCode.FAILED_TO_REFRESH_TOKEN, "The access token has expired and there was an error while trying to refresh it.", new OAuth2Error({
-              code: e.error,
-              message: e.error_description
-            })),
-            null
-          ];
-        }
-        const accessTokenExpiresAt = Math.floor(Date.now() / 1e3) + Number(oauthRes.expires_in);
-        const updatedTokenSet = {
-          ...tokenSet,
-          // contains the existing `iat` claim to maintain the session lifetime
-          accessToken: oauthRes.access_token,
-          idToken: oauthRes.id_token,
-          expiresAt: accessTokenExpiresAt
-        };
-        if (oauthRes.refresh_token) {
-          updatedTokenSet.refreshToken = oauthRes.refresh_token;
-        } else {
-          updatedTokenSet.refreshToken = tokenSet.refreshToken;
-        }
-        return [null, updatedTokenSet];
-      }
-    }
-    return [null, tokenSet];
-  }
-  async discoverAuthorizationServerMetadata() {
-    if (this.authorizationServerMetadata) {
-      return [null, this.authorizationServerMetadata];
-    }
-    const issuer = new URL(this.issuer);
-    try {
-      const authorizationServerMetadata = await discoveryRequest(issuer, {
-        ...this.httpOptions(),
-        [customFetch]: this.fetch,
-        [allowInsecureRequests]: this.allowInsecureRequests
-      }).then((response) => processDiscoveryResponse(issuer, response));
-      this.authorizationServerMetadata = authorizationServerMetadata;
-      return [null, authorizationServerMetadata];
-    } catch (e) {
-      console.error(`An error occured while performing the discovery request. issuer=${issuer.toString()}, error:`, e);
-      return [
-        new DiscoveryError("Discovery failed for the OpenID Connect configuration."),
-        null
-      ];
-    }
-  }
-  async defaultOnCallback(error, ctx) {
-    if (error) {
-      return new serverExports.NextResponse(error.message, {
-        status: 500
-      });
-    }
-    const res = serverExports.NextResponse.redirect(createRouteUrl(ctx.returnTo || "/", this.appBaseUrl));
-    return res;
-  }
-  async verifyLogoutToken(logoutToken) {
-    const [discoveryError, authorizationServerMetadata] = await this.discoverAuthorizationServerMetadata();
-    if (discoveryError) {
-      return [discoveryError, null];
-    }
-    const ID_TOKEN_SIGNING_ALG = "RS256";
-    const keyInput = createRemoteJWKSet(new URL(authorizationServerMetadata.jwks_uri), {
-      [jwksCache]: this.jwksCache
-    });
-    const { payload } = await jwtVerify(logoutToken, keyInput, {
-      issuer: authorizationServerMetadata.issuer,
-      audience: this.clientMetadata.client_id,
-      algorithms: [ID_TOKEN_SIGNING_ALG],
-      requiredClaims: ["iat"]
-    });
-    if (!("sid" in payload) && !("sub" in payload)) {
-      return [
-        new BackchannelLogoutError('either "sid" or "sub" (or both) claims must be present'),
-        null
-      ];
-    }
-    if ("sid" in payload && typeof payload.sid !== "string") {
-      return [new BackchannelLogoutError('"sid" claim must be a string'), null];
-    }
-    if ("sub" in payload && typeof payload.sub !== "string") {
-      return [new BackchannelLogoutError('"sub" claim must be a string'), null];
-    }
-    if ("nonce" in payload) {
-      return [new BackchannelLogoutError('"nonce" claim is prohibited'), null];
-    }
-    if (!("events" in payload)) {
-      return [new BackchannelLogoutError('"events" claim is missing'), null];
-    }
-    if (typeof payload.events !== "object" || payload.events === null) {
-      return [
-        new BackchannelLogoutError('"events" claim must be an object'),
-        null
-      ];
-    }
-    if (!("http://schemas.openid.net/event/backchannel-logout" in payload.events)) {
-      return [
-        new BackchannelLogoutError('"http://schemas.openid.net/event/backchannel-logout" member is missing in the "events" claim'),
-        null
-      ];
-    }
-    if (typeof payload.events["http://schemas.openid.net/event/backchannel-logout"] !== "object") {
-      return [
-        new BackchannelLogoutError('"http://schemas.openid.net/event/backchannel-logout" member in the "events" claim must be an object'),
-        null
-      ];
-    }
-    return [
-      null,
-      {
-        sid: payload.sid,
-        sub: payload.sub
-      }
-    ];
-  }
-  async authorizationUrl(params) {
-    const [discoveryError, authorizationServerMetadata] = await this.discoverAuthorizationServerMetadata();
-    if (discoveryError) {
-      return [discoveryError, null];
-    }
-    if (this.pushedAuthorizationRequests && !authorizationServerMetadata.pushed_authorization_request_endpoint) {
-      console.error("The Auth0 tenant does not have pushed authorization requests enabled. Learn how to enable it here: https://auth0.com/docs/get-started/applications/configure-par");
-      return [
-        new Error("The authorization server does not support pushed authorization requests."),
-        null
-      ];
-    }
-    const authorizationUrl = new URL(authorizationServerMetadata.authorization_endpoint);
-    if (this.pushedAuthorizationRequests) {
-      const response = await pushedAuthorizationRequest(authorizationServerMetadata, this.clientMetadata, await this.getClientAuth(), params, {
-        ...this.httpOptions(),
-        [customFetch]: this.fetch,
-        [allowInsecureRequests]: this.allowInsecureRequests
-      });
-      let parRes;
-      try {
-        parRes = await processPushedAuthorizationResponse(authorizationServerMetadata, this.clientMetadata, response);
-      } catch (e) {
-        return [
-          new AuthorizationError({
-            cause: new OAuth2Error({
-              code: e.error,
-              message: e.error_description
-            }),
-            message: "An error occured while pushing the authorization request."
-          }),
-          null
-        ];
-      }
-      authorizationUrl.searchParams.set("request_uri", parRes.request_uri);
-      authorizationUrl.searchParams.set("client_id", this.clientMetadata.client_id);
-      return [null, authorizationUrl];
-    }
-    authorizationUrl.search = params.toString();
-    return [null, authorizationUrl];
-  }
-  async getClientAuth() {
-    if (!this.clientSecret && !this.clientAssertionSigningKey) {
-      throw new Error("The client secret or client assertion signing key must be provided.");
-    }
-    let clientPrivateKey = this.clientAssertionSigningKey;
-    if (clientPrivateKey && !(clientPrivateKey instanceof CryptoKey)) {
-      clientPrivateKey = await importPKCS8(clientPrivateKey, this.clientAssertionSigningAlg);
-    }
-    return clientPrivateKey ? PrivateKeyJwt(clientPrivateKey) : ClientSecretPost(this.clientSecret);
-  }
-  get issuer() {
-    return this.domain.startsWith("http://") || this.domain.startsWith("https://") ? this.domain : `https://${this.domain}`;
-  }
-  /**
-   * Exchanges a refresh token for an access token for a connection.
-   *
-   * This method performs a token exchange using the provided refresh token and connection details.
-   * It first checks if the refresh token is present in the `tokenSet`. If not, it returns an error.
-   * Then, it constructs the necessary parameters for the token exchange request and performs
-   * the request to the authorization server's token endpoint.
-   *
-   * @returns {Promise<[AccessTokenForConnectionError, null] | [null, ConnectionTokenSet]>} A promise that resolves to a tuple.
-   *          The first element is either an `AccessTokenForConnectionError` if an error occurred, or `null` if the request was successful.
-   *          The second element is either `null` if an error occurred, or a `ConnectionTokenSet` object
-   *          containing the access token, expiration time, and scope if the request was successful.
-   *
-   * @throws {AccessTokenForConnectionError} If the refresh token is missing or if there is an error during the token exchange process.
-   */
-  async getConnectionTokenSet(tokenSet, connectionTokenSet, options) {
-    if (!tokenSet.refreshToken && (!connectionTokenSet || connectionTokenSet.expiresAt <= Date.now() / 1e3)) {
-      return [
-        new AccessTokenForConnectionError(AccessTokenForConnectionErrorCode.MISSING_REFRESH_TOKEN, "A refresh token was not present, Connection Access Token requires a refresh token. The user needs to re-authenticate."),
-        null
-      ];
-    }
-    if (tokenSet.refreshToken && (!connectionTokenSet || connectionTokenSet.expiresAt <= Date.now() / 1e3)) {
-      const params = new URLSearchParams();
-      params.append("connection", options.connection);
-      params.append("subject_token_type", SUBJECT_TYPE_REFRESH_TOKEN);
-      params.append("subject_token", tokenSet.refreshToken);
-      params.append("requested_token_type", REQUESTED_TOKEN_TYPE_FEDERATED_CONNECTION_ACCESS_TOKEN);
-      if (options.login_hint) {
-        params.append("login_hint", options.login_hint);
-      }
-      const [discoveryError, authorizationServerMetadata] = await this.discoverAuthorizationServerMetadata();
-      if (discoveryError) {
-        return [discoveryError, null];
-      }
-      const httpResponse = await genericTokenEndpointRequest(authorizationServerMetadata, this.clientMetadata, await this.getClientAuth(), GRANT_TYPE_FEDERATED_CONNECTION_ACCESS_TOKEN, params, {
-        [customFetch]: this.fetch,
-        [allowInsecureRequests]: this.allowInsecureRequests
-      });
-      let tokenEndpointResponse;
-      try {
-        tokenEndpointResponse = await processGenericTokenEndpointResponse(authorizationServerMetadata, this.clientMetadata, httpResponse);
-      } catch (err) {
-        return [
-          new AccessTokenForConnectionError(AccessTokenForConnectionErrorCode.FAILED_TO_EXCHANGE, "There was an error trying to exchange the refresh token for a connection access token.", new OAuth2Error({
-            code: err.error,
-            message: err.error_description
-          })),
-          null
-        ];
-      }
-      return [
-        null,
-        {
-          accessToken: tokenEndpointResponse.access_token,
-          expiresAt: Math.floor(Date.now() / 1e3) + Number(tokenEndpointResponse.expires_in),
-          scope: tokenEndpointResponse.scope,
-          connection: options.connection
-        }
-      ];
-    }
-    return [null, connectionTokenSet];
-  }
-}
-const encodeBase64 = (input) => {
-  const unencoded = new TextEncoder().encode(input);
-  const CHUNK_SIZE = 32768;
-  const arr = [];
-  for (let i = 0; i < unencoded.length; i += CHUNK_SIZE) {
-    arr.push(
-      // @ts-expect-error Argument of type 'Uint8Array' is not assignable to parameter of type 'number[]'.
-      String.fromCharCode.apply(null, unencoded.subarray(i, i + CHUNK_SIZE))
-    );
-  }
-  return btoa(arr.join(""));
-};
-export {
-  AuthClient
-};