@inrupt/solid-client-authn-browser 1.11.8-alpha.1 → 1.11.8-alpha.2

package/dist/index.es.js

@@ -0,0 +1,1693 @@
+import { StorageUtility, determineSigningAlg, PREFERRED_SIGNING_ALG, getWebidFromTokenPayload, createDpopHeader, OidcProviderError, InvalidResponseError, generateDpopKeyPair, EVENTS, ConfigurationError, handleRegistration, isSupportedTokenType, loadOidcContextFromStorage, buildAuthenticatedFetch, AggregateHandler, InMemoryStorage, SOLID_CLIENT_AUTHN_KEY_PREFIX } from '@inrupt/solid-client-authn-core';
+export { ConfigurationError, InMemoryStorage, NotImplementedError } from '@inrupt/solid-client-authn-core';
+import { OidcClient, WebStorageStateStore } from '@inrupt/oidc-client';
+
+var domain;
+
+// This constructor is used to store event handlers. Instantiating this is
+// faster than explicitly calling `Object.create(null)` to get a "clean" empty
+// object (tested with v8 v4.9).
+function EventHandlers() {}
+EventHandlers.prototype = Object.create(null);
+
+function EventEmitter() {
+  EventEmitter.init.call(this);
+}
+
+// nodejs oddity
+// require('events') === require('events').EventEmitter
+EventEmitter.EventEmitter = EventEmitter;
+
+EventEmitter.usingDomains = false;
+
+EventEmitter.prototype.domain = undefined;
+EventEmitter.prototype._events = undefined;
+EventEmitter.prototype._maxListeners = undefined;
+
+// By default EventEmitters will print a warning if more than 10 listeners are
+// added to it. This is a useful default which helps finding memory leaks.
+EventEmitter.defaultMaxListeners = 10;
+
+EventEmitter.init = function() {
+  this.domain = null;
+  if (EventEmitter.usingDomains) {
+    // if there is an active domain, then attach to it.
+    if (domain.active ) ;
+  }
+
+  if (!this._events || this._events === Object.getPrototypeOf(this)._events) {
+    this._events = new EventHandlers();
+    this._eventsCount = 0;
+  }
+
+  this._maxListeners = this._maxListeners || undefined;
+};
+
+// Obviously not all Emitters should be limited to 10. This function allows
+// that to be increased. Set to zero for unlimited.
+EventEmitter.prototype.setMaxListeners = function setMaxListeners(n) {
+  if (typeof n !== 'number' || n < 0 || isNaN(n))
+    throw new TypeError('"n" argument must be a positive number');
+  this._maxListeners = n;
+  return this;
+};
+
+function $getMaxListeners(that) {
+  if (that._maxListeners === undefined)
+    return EventEmitter.defaultMaxListeners;
+  return that._maxListeners;
+}
+
+EventEmitter.prototype.getMaxListeners = function getMaxListeners() {
+  return $getMaxListeners(this);
+};
+
+// These standalone emit* functions are used to optimize calling of event
+// handlers for fast cases because emit() itself often has a variable number of
+// arguments and can be deoptimized because of that. These functions always have
+// the same number of arguments and thus do not get deoptimized, so the code
+// inside them can execute faster.
+function emitNone(handler, isFn, self) {
+  if (isFn)
+    handler.call(self);
+  else {
+    var len = handler.length;
+    var listeners = arrayClone(handler, len);
+    for (var i = 0; i < len; ++i)
+      listeners[i].call(self);
+  }
+}
+function emitOne(handler, isFn, self, arg1) {
+  if (isFn)
+    handler.call(self, arg1);
+  else {
+    var len = handler.length;
+    var listeners = arrayClone(handler, len);
+    for (var i = 0; i < len; ++i)
+      listeners[i].call(self, arg1);
+  }
+}
+function emitTwo(handler, isFn, self, arg1, arg2) {
+  if (isFn)
+    handler.call(self, arg1, arg2);
+  else {
+    var len = handler.length;
+    var listeners = arrayClone(handler, len);
+    for (var i = 0; i < len; ++i)
+      listeners[i].call(self, arg1, arg2);
+  }
+}
+function emitThree(handler, isFn, self, arg1, arg2, arg3) {
+  if (isFn)
+    handler.call(self, arg1, arg2, arg3);
+  else {
+    var len = handler.length;
+    var listeners = arrayClone(handler, len);
+    for (var i = 0; i < len; ++i)
+      listeners[i].call(self, arg1, arg2, arg3);
+  }
+}
+
+function emitMany(handler, isFn, self, args) {
+  if (isFn)
+    handler.apply(self, args);
+  else {
+    var len = handler.length;
+    var listeners = arrayClone(handler, len);
+    for (var i = 0; i < len; ++i)
+      listeners[i].apply(self, args);
+  }
+}
+
+EventEmitter.prototype.emit = function emit(type) {
+  var er, handler, len, args, i, events, domain;
+  var doError = (type === 'error');
+
+  events = this._events;
+  if (events)
+    doError = (doError && events.error == null);
+  else if (!doError)
+    return false;
+
+  domain = this.domain;
+
+  // If there is no 'error' event listener then throw.
+  if (doError) {
+    er = arguments[1];
+    if (domain) {
+      if (!er)
+        er = new Error('Uncaught, unspecified "error" event');
+      er.domainEmitter = this;
+      er.domain = domain;
+      er.domainThrown = false;
+      domain.emit('error', er);
+    } else if (er instanceof Error) {
+      throw er; // Unhandled 'error' event
+    } else {
+      // At least give some kind of context to the user
+      var err = new Error('Uncaught, unspecified "error" event. (' + er + ')');
+      err.context = er;
+      throw err;
+    }
+    return false;
+  }
+
+  handler = events[type];
+
+  if (!handler)
+    return false;
+
+  var isFn = typeof handler === 'function';
+  len = arguments.length;
+  switch (len) {
+    // fast cases
+    case 1:
+      emitNone(handler, isFn, this);
+      break;
+    case 2:
+      emitOne(handler, isFn, this, arguments[1]);
+      break;
+    case 3:
+      emitTwo(handler, isFn, this, arguments[1], arguments[2]);
+      break;
+    case 4:
+      emitThree(handler, isFn, this, arguments[1], arguments[2], arguments[3]);
+      break;
+    // slower
+    default:
+      args = new Array(len - 1);
+      for (i = 1; i < len; i++)
+        args[i - 1] = arguments[i];
+      emitMany(handler, isFn, this, args);
+  }
+
+  return true;
+};
+
+function _addListener(target, type, listener, prepend) {
+  var m;
+  var events;
+  var existing;
+
+  if (typeof listener !== 'function')
+    throw new TypeError('"listener" argument must be a function');
+
+  events = target._events;
+  if (!events) {
+    events = target._events = new EventHandlers();
+    target._eventsCount = 0;
+  } else {
+    // To avoid recursion in the case that type === "newListener"! Before
+    // adding it to the listeners, first emit "newListener".
+    if (events.newListener) {
+      target.emit('newListener', type,
+                  listener.listener ? listener.listener : listener);
+
+      // Re-assign `events` because a newListener handler could have caused the
+      // this._events to be assigned to a new object
+      events = target._events;
+    }
+    existing = events[type];
+  }
+
+  if (!existing) {
+    // Optimize the case of one listener. Don't need the extra array object.
+    existing = events[type] = listener;
+    ++target._eventsCount;
+  } else {
+    if (typeof existing === 'function') {
+      // Adding the second element, need to change to array.
+      existing = events[type] = prepend ? [listener, existing] :
+                                          [existing, listener];
+    } else {
+      // If we've already got an array, just append.
+      if (prepend) {
+        existing.unshift(listener);
+      } else {
+        existing.push(listener);
+      }
+    }
+
+    // Check for listener leak
+    if (!existing.warned) {
+      m = $getMaxListeners(target);
+      if (m && m > 0 && existing.length > m) {
+        existing.warned = true;
+        var w = new Error('Possible EventEmitter memory leak detected. ' +
+                            existing.length + ' ' + type + ' listeners added. ' +
+                            'Use emitter.setMaxListeners() to increase limit');
+        w.name = 'MaxListenersExceededWarning';
+        w.emitter = target;
+        w.type = type;
+        w.count = existing.length;
+        emitWarning(w);
+      }
+    }
+  }
+
+  return target;
+}
+function emitWarning(e) {
+  typeof console.warn === 'function' ? console.warn(e) : console.log(e);
+}
+EventEmitter.prototype.addListener = function addListener(type, listener) {
+  return _addListener(this, type, listener, false);
+};
+
+EventEmitter.prototype.on = EventEmitter.prototype.addListener;
+
+EventEmitter.prototype.prependListener =
+    function prependListener(type, listener) {
+      return _addListener(this, type, listener, true);
+    };
+
+function _onceWrap(target, type, listener) {
+  var fired = false;
+  function g() {
+    target.removeListener(type, g);
+    if (!fired) {
+      fired = true;
+      listener.apply(target, arguments);
+    }
+  }
+  g.listener = listener;
+  return g;
+}
+
+EventEmitter.prototype.once = function once(type, listener) {
+  if (typeof listener !== 'function')
+    throw new TypeError('"listener" argument must be a function');
+  this.on(type, _onceWrap(this, type, listener));
+  return this;
+};
+
+EventEmitter.prototype.prependOnceListener =
+    function prependOnceListener(type, listener) {
+      if (typeof listener !== 'function')
+        throw new TypeError('"listener" argument must be a function');
+      this.prependListener(type, _onceWrap(this, type, listener));
+      return this;
+    };
+
+// emits a 'removeListener' event iff the listener was removed
+EventEmitter.prototype.removeListener =
+    function removeListener(type, listener) {
+      var list, events, position, i, originalListener;
+
+      if (typeof listener !== 'function')
+        throw new TypeError('"listener" argument must be a function');
+
+      events = this._events;
+      if (!events)
+        return this;
+
+      list = events[type];
+      if (!list)
+        return this;
+
+      if (list === listener || (list.listener && list.listener === listener)) {
+        if (--this._eventsCount === 0)
+          this._events = new EventHandlers();
+        else {
+          delete events[type];
+          if (events.removeListener)
+            this.emit('removeListener', type, list.listener || listener);
+        }
+      } else if (typeof list !== 'function') {
+        position = -1;
+
+        for (i = list.length; i-- > 0;) {
+          if (list[i] === listener ||
+              (list[i].listener && list[i].listener === listener)) {
+            originalListener = list[i].listener;
+            position = i;
+            break;
+          }
+        }
+
+        if (position < 0)
+          return this;
+
+        if (list.length === 1) {
+          list[0] = undefined;
+          if (--this._eventsCount === 0) {
+            this._events = new EventHandlers();
+            return this;
+          } else {
+            delete events[type];
+          }
+        } else {
+          spliceOne(list, position);
+        }
+
+        if (events.removeListener)
+          this.emit('removeListener', type, originalListener || listener);
+      }
+
+      return this;
+    };
+    
+// Alias for removeListener added in NodeJS 10.0
+// https://nodejs.org/api/events.html#events_emitter_off_eventname_listener
+EventEmitter.prototype.off = function(type, listener){
+    return this.removeListener(type, listener);
+};
+
+EventEmitter.prototype.removeAllListeners =
+    function removeAllListeners(type) {
+      var listeners, events;
+
+      events = this._events;
+      if (!events)
+        return this;
+
+      // not listening for removeListener, no need to emit
+      if (!events.removeListener) {
+        if (arguments.length === 0) {
+          this._events = new EventHandlers();
+          this._eventsCount = 0;
+        } else if (events[type]) {
+          if (--this._eventsCount === 0)
+            this._events = new EventHandlers();
+          else
+            delete events[type];
+        }
+        return this;
+      }
+
+      // emit removeListener for all listeners on all events
+      if (arguments.length === 0) {
+        var keys = Object.keys(events);
+        for (var i = 0, key; i < keys.length; ++i) {
+          key = keys[i];
+          if (key === 'removeListener') continue;
+          this.removeAllListeners(key);
+        }
+        this.removeAllListeners('removeListener');
+        this._events = new EventHandlers();
+        this._eventsCount = 0;
+        return this;
+      }
+
+      listeners = events[type];
+
+      if (typeof listeners === 'function') {
+        this.removeListener(type, listeners);
+      } else if (listeners) {
+        // LIFO order
+        do {
+          this.removeListener(type, listeners[listeners.length - 1]);
+        } while (listeners[0]);
+      }
+
+      return this;
+    };
+
+EventEmitter.prototype.listeners = function listeners(type) {
+  var evlistener;
+  var ret;
+  var events = this._events;
+
+  if (!events)
+    ret = [];
+  else {
+    evlistener = events[type];
+    if (!evlistener)
+      ret = [];
+    else if (typeof evlistener === 'function')
+      ret = [evlistener.listener || evlistener];
+    else
+      ret = unwrapListeners(evlistener);
+  }
+
+  return ret;
+};
+
+EventEmitter.listenerCount = function(emitter, type) {
+  if (typeof emitter.listenerCount === 'function') {
+    return emitter.listenerCount(type);
+  } else {
+    return listenerCount.call(emitter, type);
+  }
+};
+
+EventEmitter.prototype.listenerCount = listenerCount;
+function listenerCount(type) {
+  var events = this._events;
+
+  if (events) {
+    var evlistener = events[type];
+
+    if (typeof evlistener === 'function') {
+      return 1;
+    } else if (evlistener) {
+      return evlistener.length;
+    }
+  }
+
+  return 0;
+}
+
+EventEmitter.prototype.eventNames = function eventNames() {
+  return this._eventsCount > 0 ? Reflect.ownKeys(this._events) : [];
+};
+
+// About 1.5x faster than the two-arg version of Array#splice().
+function spliceOne(list, index) {
+  for (var i = index, k = i + 1, n = list.length; k < n; i += 1, k += 1)
+    list[i] = list[k];
+  list.pop();
+}
+
+function arrayClone(arr, i) {
+  var copy = new Array(i);
+  while (i--)
+    copy[i] = arr[i];
+  return copy;
+}
+
+function unwrapListeners(arr) {
+  var ret = new Array(arr.length);
+  for (var i = 0; i < ret.length; ++i) {
+    ret[i] = arr[i].listener || arr[i];
+  }
+  return ret;
+}
+
+// Unique ID creation requires a high quality random # generator. In the browser we therefore
+// require the crypto API and do not support built-in fallback to lower quality random number
+// generators (like Math.random()).
+var getRandomValues;
+var rnds8 = new Uint8Array(16);
+function rng() {
+  // lazy load so that environments that need to polyfill have a chance to do so
+  if (!getRandomValues) {
+    // getRandomValues needs to be invoked in a context where "this" is a Crypto implementation. Also,
+    // find the complete implementation of crypto (msCrypto) on IE11.
+    getRandomValues = typeof crypto !== 'undefined' && crypto.getRandomValues && crypto.getRandomValues.bind(crypto) || typeof msCrypto !== 'undefined' && typeof msCrypto.getRandomValues === 'function' && msCrypto.getRandomValues.bind(msCrypto);
+
+    if (!getRandomValues) {
+      throw new Error('crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported');
+    }
+  }
+
+  return getRandomValues(rnds8);
+}
+
+var REGEX = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000)$/i;
+
+function validate(uuid) {
+  return typeof uuid === 'string' && REGEX.test(uuid);
+}
+
+/**
+ * Convert array of 16 byte values to UUID string format of the form:
+ * XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
+ */
+
+var byteToHex = [];
+
+for (var i = 0; i < 256; ++i) {
+  byteToHex.push((i + 0x100).toString(16).substr(1));
+}
+
+function stringify(arr) {
+  var offset = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;
+  // Note: Be careful editing this code!  It's been tuned for performance
+  // and works in ways you may not expect. See https://github.com/uuidjs/uuid/pull/434
+  var uuid = (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + '-' + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + '-' + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + '-' + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + '-' + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); // Consistency check for valid UUID.  If this throws, it's likely due to one
+  // of the following:
+  // - One or more input array values don't map to a hex octet (leading to
+  // "undefined" in the uuid)
+  // - Invalid input values for the RFC `version` or `variant` fields
+
+  if (!validate(uuid)) {
+    throw TypeError('Stringified UUID is invalid');
+  }
+
+  return uuid;
+}
+
+function v4(options, buf, offset) {
+  options = options || {};
+  var rnds = options.random || (options.rng || rng)(); // Per 4.4, set bits for version and `clock_seq_hi_and_reserved`
+
+  rnds[6] = rnds[6] & 0x0f | 0x40;
+  rnds[8] = rnds[8] & 0x3f | 0x80; // Copy bytes to buffer, if provided
+
+  if (buf) {
+    offset = offset || 0;
+
+    for (var i = 0; i < 16; ++i) {
+      buf[offset + i] = rnds[i];
+    }
+
+    return buf;
+  }
+
+  return stringify(rnds);
+}
+
+class StorageUtilityBrowser extends StorageUtility {
+    constructor(secureStorage, insecureStorage) {
+        super(secureStorage, insecureStorage);
+    }
+}
+
+function processErrorResponse(responseBody, options) {
+    var _a, _b, _c, _d;
+    if (responseBody.error === "invalid_redirect_uri") {
+        throw new Error(`Dynamic client registration failed: the provided redirect uri [${(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()}] is invalid - ${(_b = responseBody.error_description) !== null && _b !== void 0 ? _b : ""}`);
+    }
+    if (responseBody.error === "invalid_client_metadata") {
+        throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${(_c = responseBody.error_description) !== null && _c !== void 0 ? _c : ""}`);
+    }
+    throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${(_d = responseBody.error_description) !== null && _d !== void 0 ? _d : ""}`);
+}
+function validateRegistrationResponse(responseBody, options) {
+    if (responseBody.client_id === undefined) {
+        throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(responseBody)}`);
+    }
+    if (options.redirectUrl &&
+        (responseBody.redirect_uris === undefined ||
+            responseBody.redirect_uris[0] !== options.redirectUrl.toString())) {
+        throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(responseBody.redirect_uris)} don't match the provided ${JSON.stringify([
+            options.redirectUrl.toString(),
+        ])}`);
+    }
+}
+async function registerClient(options, issuerConfig) {
+    var _a;
+    if (!issuerConfig.registrationEndpoint) {
+        throw new Error("Dynamic Registration could not be completed because the issuer has no registration endpoint.");
+    }
+    if (!Array.isArray(issuerConfig.idTokenSigningAlgValuesSupported)) {
+        throw new Error("The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.");
+    }
+    const signingAlg = determineSigningAlg(issuerConfig.idTokenSigningAlgValuesSupported, PREFERRED_SIGNING_ALG);
+    const config = {
+        client_name: options.clientName,
+        application_type: "web",
+        redirect_uris: [(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()],
+        subject_type: "public",
+        token_endpoint_auth_method: "client_secret_basic",
+        id_token_signed_response_alg: signingAlg,
+        grant_types: ["authorization_code", "refresh_token"],
+    };
+    const headers = {
+        "Content-Type": "application/json",
+    };
+    if (options.registrationAccessToken) {
+        headers.Authorization = `Bearer ${options.registrationAccessToken}`;
+    }
+    const registerResponse = await fetch(issuerConfig.registrationEndpoint.toString(), {
+        method: "POST",
+        headers,
+        body: JSON.stringify(config),
+    });
+    if (registerResponse.ok) {
+        const responseBody = await registerResponse.json();
+        validateRegistrationResponse(responseBody, options);
+        return {
+            clientId: responseBody.client_id,
+            clientSecret: responseBody.client_secret,
+            idTokenSignedResponseAlg: responseBody.id_token_signed_response_alg,
+            clientType: "dynamic",
+        };
+    }
+    if (registerResponse.status === 400) {
+        processErrorResponse(await registerResponse.json(), options);
+    }
+    throw new Error(`Dynamic client registration failed: the server returned ${registerResponse.status} ${registerResponse.statusText} - ${await registerResponse.text()}`);
+}
+
+function hasError(value) {
+    return value.error !== undefined && typeof value.error === "string";
+}
+function hasErrorDescription(value) {
+    return (value.error_description !== undefined &&
+        typeof value.error_description === "string");
+}
+function hasErrorUri(value) {
+    return value.error_uri !== undefined && typeof value.error_uri === "string";
+}
+function hasAccessToken(value) {
+    return (value.access_token !== undefined && typeof value.access_token === "string");
+}
+function hasIdToken(value) {
+    return value.id_token !== undefined && typeof value.id_token === "string";
+}
+function hasRefreshToken(value) {
+    return (value.refresh_token !== undefined && typeof value.refresh_token === "string");
+}
+function hasTokenType(value) {
+    return value.token_type !== undefined && typeof value.token_type === "string";
+}
+function hasExpiresIn(value) {
+    return value.expires_in === undefined || typeof value.expires_in === "number";
+}
+function validatePreconditions(issuer, data) {
+    if (data.grantType &&
+        (!issuer.grantTypesSupported ||
+            !issuer.grantTypesSupported.includes(data.grantType))) {
+        throw new Error(`The issuer [${issuer.issuer}] does not support the [${data.grantType}] grant`);
+    }
+    if (!issuer.tokenEndpoint) {
+        throw new Error(`This issuer [${issuer.issuer}] does not have a token endpoint`);
+    }
+}
+function validateTokenEndpointResponse(tokenResponse, dpop) {
+    if (hasError(tokenResponse)) {
+        throw new OidcProviderError(`Token endpoint returned error [${tokenResponse.error}]${hasErrorDescription(tokenResponse)
+            ? `: ${tokenResponse.error_description}`
+            : ""}${hasErrorUri(tokenResponse) ? ` (see ${tokenResponse.error_uri})` : ""}`, tokenResponse.error, hasErrorDescription(tokenResponse)
+            ? tokenResponse.error_description
+            : undefined);
+    }
+    if (!hasAccessToken(tokenResponse)) {
+        throw new InvalidResponseError(["access_token"]);
+    }
+    if (!hasIdToken(tokenResponse)) {
+        throw new InvalidResponseError(["id_token"]);
+    }
+    if (!hasTokenType(tokenResponse)) {
+        throw new InvalidResponseError(["token_type"]);
+    }
+    if (!hasExpiresIn(tokenResponse)) {
+        throw new InvalidResponseError(["expires_in"]);
+    }
+    if (!dpop && tokenResponse.token_type.toLowerCase() !== "bearer") {
+        throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${tokenResponse.token_type}].`);
+    }
+    return tokenResponse;
+}
+async function getTokens(issuer, client, data, dpop) {
+    validatePreconditions(issuer, data);
+    const headers = {
+        "content-type": "application/x-www-form-urlencoded",
+    };
+    let dpopKey;
+    if (dpop) {
+        dpopKey = await generateDpopKeyPair();
+        headers.DPoP = await createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey);
+    }
+    if (client.clientSecret) {
+        headers.Authorization = `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`;
+    }
+    const requestBody = {
+        grant_type: data.grantType,
+        redirect_uri: data.redirectUrl,
+        code: data.code,
+        code_verifier: data.codeVerifier,
+        client_id: client.clientId,
+    };
+    const tokenRequestInit = {
+        method: "POST",
+        headers,
+        body: new URLSearchParams(requestBody).toString(),
+    };
+    const rawTokenResponse = await await fetch(issuer.tokenEndpoint, tokenRequestInit);
+    const jsonTokenResponse = (await rawTokenResponse.json());
+    const tokenResponse = validateTokenEndpointResponse(jsonTokenResponse, dpop);
+    const webId = await getWebidFromTokenPayload(tokenResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
+    return {
+        accessToken: tokenResponse.access_token,
+        idToken: tokenResponse.id_token,
+        refreshToken: hasRefreshToken(tokenResponse)
+            ? tokenResponse.refresh_token
+            : undefined,
+        webId,
+        dpopKey,
+        expiresIn: tokenResponse.expires_in,
+    };
+}
+async function getBearerToken(redirectUrl) {
+    let signinResponse;
+    try {
+        const client = new OidcClient({
+            response_mode: "query",
+            loadUserInfo: false,
+        });
+        signinResponse = await client.processSigninResponse(redirectUrl);
+        if (client.settings.metadata === undefined) {
+            throw new Error("Cannot retrieve issuer metadata from client information in storage.");
+        }
+        if (client.settings.metadata.jwks_uri === undefined) {
+            throw new Error("Missing some issuer metadata from client information in storage: 'jwks_uri' is undefined");
+        }
+        if (client.settings.metadata.issuer === undefined) {
+            throw new Error("Missing some issuer metadata from client information in storage: 'issuer' is undefined");
+        }
+        if (client.settings.client_id === undefined) {
+            throw new Error("Missing some client information in storage: 'client_id' is undefined");
+        }
+        const webId = await getWebidFromTokenPayload(signinResponse.id_token, client.settings.metadata.jwks_uri, client.settings.metadata.issuer, client.settings.client_id);
+        return {
+            accessToken: signinResponse.access_token,
+            idToken: signinResponse.id_token,
+            webId,
+            refreshToken: signinResponse.refresh_token,
+        };
+    }
+    catch (err) {
+        throw new Error(`Problem handling Auth Code Grant (Flow) redirect - URL [${redirectUrl}]: ${err}`);
+    }
+}
+async function getDpopToken(issuer, client, data) {
+    return getTokens(issuer, client, data, true);
+}
+
+async function refresh(refreshToken, issuer, client, dpopKey) {
+    const requestBody = {
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        scope: "openid offline_access",
+    };
+    let dpopHeader = {};
+    if (dpopKey !== undefined) {
+        dpopHeader = {
+            DPoP: await createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey),
+        };
+    }
+    let authHeader = {};
+    if (client.clientSecret !== undefined) {
+        authHeader = {
+            Authorization: `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`,
+        };
+    }
+    const rawResponse = await fetch(issuer.tokenEndpoint, {
+        method: "POST",
+        body: new URLSearchParams(requestBody).toString(),
+        headers: {
+            ...dpopHeader,
+            ...authHeader,
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+    });
+    let response;
+    try {
+        response = await rawResponse.json();
+    }
+    catch (e) {
+        throw new Error(`The token endpoint of issuer ${issuer.issuer} returned a malformed response.`);
+    }
+    const validatedResponse = validateTokenEndpointResponse(response, dpopKey !== undefined);
+    const webId = await getWebidFromTokenPayload(validatedResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
+    return {
+        accessToken: validatedResponse.access_token,
+        idToken: validatedResponse.id_token,
+        refreshToken: typeof validatedResponse.refresh_token === "string"
+            ? validatedResponse.refresh_token
+            : undefined,
+        webId,
+        dpopKey,
+        expiresIn: validatedResponse.expires_in,
+    };
+}
+
+function removeOidcQueryParam(redirectUrl) {
+    const cleanedUrl = new URL(redirectUrl);
+    cleanedUrl.searchParams.delete("code");
+    cleanedUrl.searchParams.delete("state");
+    cleanedUrl.hash = "";
+    return cleanedUrl.toString();
+}
+async function clearOidcPersistentStorage() {
+    const client = new OidcClient({
+        response_mode: "query",
+    });
+    await client.clearStaleState(new WebStorageStateStore({}));
+    const myStorage = window.localStorage;
+    const itemsToRemove = [];
+    for (let i = 0; i <= myStorage.length; i += 1) {
+        const key = myStorage.key(i);
+        if (key &&
+            (key.match(/^oidc\..+$/) ||
+                key.match(/^solidClientAuthenticationUser:.+$/))) {
+            itemsToRemove.push(key);
+        }
+    }
+    itemsToRemove.forEach((key) => myStorage.removeItem(key));
+}
+
+const globalFetch = (request, init) => window.fetch(request, init);
+class ClientAuthentication {
+    constructor(loginHandler, redirectHandler, logoutHandler, sessionInfoManager, issuerConfigFetcher) {
+        this.loginHandler = loginHandler;
+        this.redirectHandler = redirectHandler;
+        this.logoutHandler = logoutHandler;
+        this.sessionInfoManager = sessionInfoManager;
+        this.issuerConfigFetcher = issuerConfigFetcher;
+        this.login = async (options, eventEmitter) => {
+            var _a, _b;
+            await this.sessionInfoManager.clear(options.sessionId);
+            const redirectUrl = removeOidcQueryParam((_a = options.redirectUrl) !== null && _a !== void 0 ? _a : window.location.href);
+            await this.loginHandler.handle({
+                ...options,
+                redirectUrl,
+                clientName: (_b = options.clientName) !== null && _b !== void 0 ? _b : options.clientId,
+                eventEmitter,
+            });
+        };
+        this.fetch = globalFetch;
+        this.logout = async (sessionId) => {
+            await this.logoutHandler.handle(sessionId);
+            this.fetch = globalFetch;
+        };
+        this.getSessionInfo = async (sessionId) => {
+            return this.sessionInfoManager.get(sessionId);
+        };
+        this.getAllSessionInfo = async () => {
+            return this.sessionInfoManager.getAll();
+        };
+        this.validateCurrentSession = async (currentSessionId) => {
+            const sessionInfo = await this.sessionInfoManager.get(currentSessionId);
+            if (sessionInfo === undefined ||
+                sessionInfo.clientAppId === undefined ||
+                sessionInfo.issuer === undefined) {
+                return null;
+            }
+            return sessionInfo;
+        };
+        this.handleIncomingRedirect = async (url, eventEmitter) => {
+            try {
+                const redirectInfo = await this.redirectHandler.handle(url, eventEmitter);
+                this.fetch = redirectInfo.fetch.bind(window);
+                this.cleanUrlAfterRedirect(url);
+                return {
+                    isLoggedIn: redirectInfo.isLoggedIn,
+                    webId: redirectInfo.webId,
+                    sessionId: redirectInfo.sessionId,
+                    expirationDate: redirectInfo.expirationDate,
+                };
+            }
+            catch (err) {
+                this.cleanUrlAfterRedirect(url);
+                eventEmitter.emit(EVENTS.ERROR, "redirect", err);
+            }
+        };
+    }
+    cleanUrlAfterRedirect(url) {
+        const cleanedUpUrl = new URL(url);
+        cleanedUpUrl.searchParams.delete("state");
+        cleanedUpUrl.searchParams.delete("code");
+        cleanedUpUrl.searchParams.delete("id_token");
+        cleanedUpUrl.searchParams.delete("access_token");
+        cleanedUpUrl.searchParams.delete("error");
+        cleanedUpUrl.searchParams.delete("error_description");
+        window.history.replaceState(null, "", cleanedUpUrl.toString());
+    }
+}
+
+function hasIssuer(options) {
+    return typeof options.oidcIssuer === "string";
+}
+function hasRedirectUrl(options) {
+    return typeof options.redirectUrl === "string";
+}
+class OidcLoginHandler {
+    constructor(storageUtility, oidcHandler, issuerConfigFetcher, clientRegistrar) {
+        this.storageUtility = storageUtility;
+        this.oidcHandler = oidcHandler;
+        this.issuerConfigFetcher = issuerConfigFetcher;
+        this.clientRegistrar = clientRegistrar;
+    }
+    async canHandle(options) {
+        return hasIssuer(options) && hasRedirectUrl(options);
+    }
+    async handle(options) {
+        if (!hasIssuer(options)) {
+            throw new ConfigurationError(`OidcLoginHandler requires an OIDC issuer: missing property 'oidcIssuer' in ${JSON.stringify(options)}`);
+        }
+        if (!hasRedirectUrl(options)) {
+            throw new ConfigurationError(`OidcLoginHandler requires a redirect URL: missing property 'redirectUrl' in ${JSON.stringify(options)}`);
+        }
+        const issuerConfig = await this.issuerConfigFetcher.fetchConfig(options.oidcIssuer);
+        const clientRegistration = await handleRegistration(options, issuerConfig, this.storageUtility, this.clientRegistrar);
+        const OidcOptions = {
+            issuer: issuerConfig.issuer,
+            dpop: options.tokenType.toLowerCase() === "dpop",
+            ...options,
+            issuerConfiguration: issuerConfig,
+            client: clientRegistration,
+        };
+        return this.oidcHandler.handle(OidcOptions);
+    }
+}
+
+class AuthorizationCodeWithPkceOidcHandler {
+    constructor(storageUtility, redirector) {
+        this.storageUtility = storageUtility;
+        this.redirector = redirector;
+    }
+    async canHandle(oidcLoginOptions) {
+        return !!(oidcLoginOptions.issuerConfiguration.grantTypesSupported &&
+            oidcLoginOptions.issuerConfiguration.grantTypesSupported.indexOf("authorization_code") > -1);
+    }
+    async handle(oidcLoginOptions) {
+        var _a;
+        const oidcOptions = {
+            authority: oidcLoginOptions.issuer.toString(),
+            client_id: oidcLoginOptions.client.clientId,
+            client_secret: oidcLoginOptions.client.clientSecret,
+            redirect_uri: oidcLoginOptions.redirectUrl.toString(),
+            post_logout_redirect_uri: oidcLoginOptions.redirectUrl.toString(),
+            response_type: "code",
+            scope: "openid offline_access webid",
+            filterProtocolClaims: true,
+            loadUserInfo: false,
+            code_verifier: true,
+            prompt: (_a = oidcLoginOptions.prompt) !== null && _a !== void 0 ? _a : "consent",
+        };
+        const oidcClientLibrary = new OidcClient(oidcOptions);
+        const { redirector } = this;
+        const storage = this.storageUtility;
+        try {
+            const signingRequest = await oidcClientLibrary.createSigninRequest();
+            await Promise.all([
+                storage.setForUser(signingRequest.state._id, {
+                    sessionId: oidcLoginOptions.sessionId,
+                }),
+                storage.setForUser(oidcLoginOptions.sessionId, {
+                    codeVerifier: signingRequest.state._code_verifier,
+                    issuer: oidcLoginOptions.issuer.toString(),
+                    redirectUrl: oidcLoginOptions.redirectUrl,
+                    dpop: oidcLoginOptions.dpop ? "true" : "false",
+                }),
+            ]);
+            redirector.redirect(signingRequest.url.toString(), {
+                handleRedirect: oidcLoginOptions.handleRedirect,
+                redirectInIframe: oidcLoginOptions.inIframe,
+            });
+        }
+        catch (err) {
+            console.error(err);
+        }
+        return undefined;
+    }
+}
+
+function appendToUrlPathname(url, append) {
+    const parsedUrl = new URL(url);
+    const path = parsedUrl.pathname;
+    parsedUrl.pathname = `${path}${path.endsWith("/") ? "" : "/"}${append.startsWith("/") ? append.substring(1) : append}`;
+    return parsedUrl.toString();
+}
+
+const WELL_KNOWN_OPENID_CONFIG = ".well-known/openid-configuration";
+const issuerConfigKeyMap = {
+    issuer: {
+        toKey: "issuer",
+        convertToUrl: true,
+    },
+    authorization_endpoint: {
+        toKey: "authorizationEndpoint",
+        convertToUrl: true,
+    },
+    token_endpoint: {
+        toKey: "tokenEndpoint",
+        convertToUrl: true,
+    },
+    userinfo_endpoint: {
+        toKey: "userinfoEndpoint",
+        convertToUrl: true,
+    },
+    jwks_uri: {
+        toKey: "jwksUri",
+        convertToUrl: true,
+    },
+    registration_endpoint: {
+        toKey: "registrationEndpoint",
+        convertToUrl: true,
+    },
+    scopes_supported: { toKey: "scopesSupported" },
+    response_types_supported: { toKey: "responseTypesSupported" },
+    response_modes_supported: { toKey: "responseModesSupported" },
+    grant_types_supported: { toKey: "grantTypesSupported" },
+    acr_values_supported: { toKey: "acrValuesSupported" },
+    subject_types_supported: { toKey: "subjectTypesSupported" },
+    id_token_signing_alg_values_supported: {
+        toKey: "idTokenSigningAlgValuesSupported",
+    },
+    id_token_encryption_alg_values_supported: {
+        toKey: "idTokenEncryptionAlgValuesSupported",
+    },
+    id_token_encryption_enc_values_supported: {
+        toKey: "idTokenEncryptionEncValuesSupported",
+    },
+    userinfo_signing_alg_values_supported: {
+        toKey: "userinfoSigningAlgValuesSupported",
+    },
+    userinfo_encryption_alg_values_supported: {
+        toKey: "userinfoEncryptionAlgValuesSupported",
+    },
+    userinfo_encryption_enc_values_supported: {
+        toKey: "userinfoEncryptionEncValuesSupported",
+    },
+    request_object_signing_alg_values_supported: {
+        toKey: "requestObjectSigningAlgValuesSupported",
+    },
+    request_object_encryption_alg_values_supported: {
+        toKey: "requestObjectEncryptionAlgValuesSupported",
+    },
+    request_object_encryption_enc_values_supported: {
+        toKey: "requestObjectEncryptionEncValuesSupported",
+    },
+    token_endpoint_auth_methods_supported: {
+        toKey: "tokenEndpointAuthMethodsSupported",
+    },
+    token_endpoint_auth_signing_alg_values_supported: {
+        toKey: "tokenEndpointAuthSigningAlgValuesSupported",
+    },
+    display_values_supported: { toKey: "displayValuesSupported" },
+    claim_types_supported: { toKey: "claimTypesSupported" },
+    claims_supported: { toKey: "claimsSupported" },
+    service_documentation: { toKey: "serviceDocumentation" },
+    claims_locales_supported: { toKey: "claimsLocalesSupported" },
+    ui_locales_supported: { toKey: "uiLocalesSupported" },
+    claims_parameter_supported: { toKey: "claimsParameterSupported" },
+    request_parameter_supported: { toKey: "requestParameterSupported" },
+    request_uri_parameter_supported: { toKey: "requestUriParameterSupported" },
+    require_request_uri_registration: { toKey: "requireRequestUriRegistration" },
+    op_policy_uri: {
+        toKey: "opPolicyUri",
+        convertToUrl: true,
+    },
+    op_tos_uri: {
+        toKey: "opTosUri",
+        convertToUrl: true,
+    },
+};
+function processConfig(config) {
+    const parsedConfig = {};
+    Object.keys(config).forEach((key) => {
+        if (issuerConfigKeyMap[key]) {
+            parsedConfig[issuerConfigKeyMap[key].toKey] = config[key];
+        }
+    });
+    if (!Array.isArray(parsedConfig.scopesSupported)) {
+        parsedConfig.scopesSupported = ["openid"];
+    }
+    return parsedConfig;
+}
+class IssuerConfigFetcher {
+    constructor(storageUtility) {
+        this.storageUtility = storageUtility;
+    }
+    static getLocalStorageKey(issuer) {
+        return `issuerConfig:${issuer}`;
+    }
+    async fetchConfig(issuer) {
+        let issuerConfig;
+        const openIdConfigUrl = appendToUrlPathname(issuer, WELL_KNOWN_OPENID_CONFIG);
+        const issuerConfigRequestBody = await window.fetch(openIdConfigUrl);
+        try {
+            issuerConfig = processConfig(await issuerConfigRequestBody.json());
+        }
+        catch (err) {
+            throw new ConfigurationError(`[${issuer.toString()}] has an invalid configuration: ${err.message}`);
+        }
+        await this.storageUtility.set(IssuerConfigFetcher.getLocalStorageKey(issuer), JSON.stringify(issuerConfig));
+        return issuerConfig;
+    }
+}
+
+function getUnauthenticatedSession() {
+    return {
+        isLoggedIn: false,
+        sessionId: v4(),
+        fetch,
+    };
+}
+async function clear(sessionId, storage) {
+    await Promise.all([
+        storage.deleteAllUserData(sessionId, { secure: false }),
+        storage.deleteAllUserData(sessionId, { secure: true }),
+        storage.delete("clientKey", { secure: false }),
+    ]);
+    await clearOidcPersistentStorage();
+}
+class SessionInfoManager {
+    constructor(storageUtility) {
+        this.storageUtility = storageUtility;
+    }
+    update(_sessionId, _options) {
+        throw new Error("Not Implemented");
+    }
+    async get(sessionId) {
+        var _a;
+        const isLoggedIn = await this.storageUtility.getForUser(sessionId, "isLoggedIn", {
+            secure: true,
+        });
+        const webId = await this.storageUtility.getForUser(sessionId, "webId", {
+            secure: true,
+        });
+        const clientId = await this.storageUtility.getForUser(sessionId, "clientId", {
+            secure: false,
+        });
+        const clientSecret = await this.storageUtility.getForUser(sessionId, "clientSecret", {
+            secure: false,
+        });
+        const redirectUrl = await this.storageUtility.getForUser(sessionId, "redirectUrl", {
+            secure: false,
+        });
+        const refreshToken = await this.storageUtility.getForUser(sessionId, "refreshToken", {
+            secure: true,
+        });
+        const issuer = await this.storageUtility.getForUser(sessionId, "issuer", {
+            secure: false,
+        });
+        const tokenType = (_a = (await this.storageUtility.getForUser(sessionId, "tokenType", {
+            secure: false,
+        }))) !== null && _a !== void 0 ? _a : "DPoP";
+        if (!isSupportedTokenType(tokenType)) {
+            throw new Error(`Tokens of type [${tokenType}] are not supported.`);
+        }
+        if (clientId === undefined &&
+            isLoggedIn === undefined &&
+            webId === undefined &&
+            refreshToken === undefined) {
+            return undefined;
+        }
+        return {
+            sessionId,
+            webId,
+            isLoggedIn: isLoggedIn === "true",
+            redirectUrl,
+            refreshToken,
+            issuer,
+            clientAppId: clientId,
+            clientAppSecret: clientSecret,
+            tokenType,
+        };
+    }
+    async getAll() {
+        throw new Error("Not implemented");
+    }
+    async clear(sessionId) {
+        return clear(sessionId, this.storageUtility);
+    }
+    async register(_sessionId) {
+        throw new Error("Not implemented");
+    }
+    async getRegisteredSessionIdAll() {
+        throw new Error("Not implemented");
+    }
+    async clearAll() {
+        throw new Error("Not implemented");
+    }
+}
+
+class FallbackRedirectHandler {
+    async canHandle(redirectUrl) {
+        try {
+            new URL(redirectUrl);
+            return true;
+        }
+        catch (e) {
+            throw new Error(`[${redirectUrl}] is not a valid URL, and cannot be used as a redirect URL: ${e}`);
+        }
+    }
+    async handle(_redirectUrl) {
+        return getUnauthenticatedSession();
+    }
+}
+
+class GeneralLogoutHandler {
+    constructor(sessionInfoManager) {
+        this.sessionInfoManager = sessionInfoManager;
+    }
+    async canHandle() {
+        return true;
+    }
+    async handle(userId) {
+        await this.sessionInfoManager.clear(userId);
+    }
+}
+
+class AuthCodeRedirectHandler {
+    constructor(storageUtility, sessionInfoManager, issuerConfigFetcher, clientRegistrar, tokerRefresher) {
+        this.storageUtility = storageUtility;
+        this.sessionInfoManager = sessionInfoManager;
+        this.issuerConfigFetcher = issuerConfigFetcher;
+        this.clientRegistrar = clientRegistrar;
+        this.tokerRefresher = tokerRefresher;
+    }
+    async canHandle(redirectUrl) {
+        try {
+            const myUrl = new URL(redirectUrl);
+            return (myUrl.searchParams.get("code") !== null &&
+                myUrl.searchParams.get("state") !== null);
+        }
+        catch (e) {
+            throw new Error(`[${redirectUrl}] is not a valid URL, and cannot be used as a redirect URL: ${e}`);
+        }
+    }
+    async handle(redirectUrl, eventEmitter) {
+        if (!(await this.canHandle(redirectUrl))) {
+            throw new Error(`AuthCodeRedirectHandler cannot handle [${redirectUrl}]: it is missing one of [code, state].`);
+        }
+        const url = new URL(redirectUrl);
+        const oauthState = url.searchParams.get("state");
+        const storedSessionId = (await this.storageUtility.getForUser(oauthState, "sessionId", {
+            errorIfNull: true,
+        }));
+        const { issuerConfig, codeVerifier, redirectUrl: storedRedirectIri, dpop: isDpop, } = await loadOidcContextFromStorage(storedSessionId, this.storageUtility, this.issuerConfigFetcher);
+        if (codeVerifier === undefined) {
+            throw new Error(`The code verifier for session ${storedSessionId} is missing from storage.`);
+        }
+        if (storedRedirectIri === undefined) {
+            throw new Error(`The redirect URL for session ${storedSessionId} is missing from storage.`);
+        }
+        const client = await this.clientRegistrar.getClient({ sessionId: storedSessionId }, issuerConfig);
+        let tokens;
+        const tokenCreatedAt = Date.now();
+        if (isDpop) {
+            tokens = await getDpopToken(issuerConfig, client, {
+                grantType: "authorization_code",
+                code: url.searchParams.get("code"),
+                codeVerifier,
+                redirectUrl: storedRedirectIri,
+            });
+            window.localStorage.removeItem(`oidc.${oauthState}`);
+        }
+        else {
+            tokens = await getBearerToken(url.toString());
+        }
+        let refreshOptions;
+        if (tokens.refreshToken !== undefined) {
+            refreshOptions = {
+                sessionId: storedSessionId,
+                refreshToken: tokens.refreshToken,
+                tokenRefresher: this.tokerRefresher,
+            };
+        }
+        const authFetch = await buildAuthenticatedFetch(fetch, tokens.accessToken, {
+            dpopKey: tokens.dpopKey,
+            refreshOptions,
+            eventEmitter,
+            expiresIn: tokens.expiresIn,
+        });
+        await this.storageUtility.setForUser(storedSessionId, {
+            webId: tokens.webId,
+            isLoggedIn: "true",
+        }, { secure: true });
+        url.searchParams.delete("code");
+        await this.storageUtility.setForUser(storedSessionId, {
+            redirectUrl: url.toString(),
+        }, {
+            secure: false,
+        });
+        const sessionInfo = await this.sessionInfoManager.get(storedSessionId);
+        if (!sessionInfo) {
+            throw new Error(`Could not retrieve session: [${storedSessionId}].`);
+        }
+        return Object.assign(sessionInfo, {
+            fetch: authFetch,
+            expirationDate: typeof tokens.expiresIn === "number"
+                ? tokenCreatedAt + tokens.expiresIn * 1000
+                : null,
+        });
+    }
+}
+
+class AggregateRedirectHandler extends AggregateHandler {
+    constructor(redirectHandlers) {
+        super(redirectHandlers);
+    }
+}
+
+class BrowserStorage {
+    get storage() {
+        return window.localStorage;
+    }
+    async get(key) {
+        return this.storage.getItem(key) || undefined;
+    }
+    async set(key, value) {
+        this.storage.setItem(key, value);
+    }
+    async delete(key) {
+        this.storage.removeItem(key);
+    }
+}
+
+let redirectIframe;
+function getRedirectIframe() {
+    if (typeof redirectIframe === "undefined") {
+        redirectIframe = window.document.createElement("iframe");
+        redirectIframe.setAttribute("hidden", "true");
+        redirectIframe.setAttribute("sandbox", "allow-scripts allow-same-origin");
+    }
+    return redirectIframe;
+}
+function redirectInIframe(redirectUrl) {
+    const iframe = getRedirectIframe();
+    window.document.body.appendChild(iframe);
+    iframe.src = redirectUrl;
+}
+function setupIframeListener(handleIframeRedirect) {
+    if (typeof window === "undefined") {
+        return;
+    }
+    window.addEventListener("message", async (evt) => {
+        const iframe = getRedirectIframe();
+        if (evt.origin === window.location.origin &&
+            evt.source === iframe.contentWindow) {
+            if (typeof evt.data.redirectUrl === "string") {
+                await handleIframeRedirect(evt.data.redirectUrl);
+            }
+        }
+        if (window.document.body.contains(iframe)) {
+            window.document.body.removeChild(iframe);
+        }
+    });
+}
+function postRedirectUrlToParent(redirectUrl) {
+    window.top.postMessage({
+        redirectUrl,
+    }, window.location.origin);
+}
+
+class Redirector {
+    redirect(redirectUrl, options) {
+        if (options && options.handleRedirect) {
+            options.handleRedirect(redirectUrl);
+        }
+        else if (options && options.redirectByReplacingState) {
+            window.history.replaceState({}, "", redirectUrl);
+        }
+        else if (options === null || options === void 0 ? void 0 : options.redirectInIframe) {
+            redirectInIframe(redirectUrl);
+        }
+        else {
+            window.location.href = redirectUrl;
+        }
+    }
+}
+
+class ClientRegistrar {
+    constructor(storageUtility) {
+        this.storageUtility = storageUtility;
+    }
+    async getClient(options, issuerConfig) {
+        var _a;
+        const [storedClientId, storedClientSecret,] = await Promise.all([
+            this.storageUtility.getForUser(options.sessionId, "clientId", {
+                secure: false,
+            }),
+            this.storageUtility.getForUser(options.sessionId, "clientSecret", {
+                secure: false,
+            }),
+        ]);
+        if (storedClientId) {
+            return {
+                clientId: storedClientId,
+                clientSecret: storedClientSecret,
+                clientType: "dynamic",
+            };
+        }
+        const extendedOptions = { ...options };
+        extendedOptions.registrationAccessToken =
+            (_a = extendedOptions.registrationAccessToken) !== null && _a !== void 0 ? _a : (await this.storageUtility.getForUser(options.sessionId, "registrationAccessToken"));
+        try {
+            const registeredClient = await registerClient(extendedOptions, issuerConfig);
+            const infoToSave = {
+                clientId: registeredClient.clientId,
+            };
+            if (registeredClient.clientSecret) {
+                infoToSave.clientSecret = registeredClient.clientSecret;
+            }
+            if (registeredClient.idTokenSignedResponseAlg) {
+                infoToSave.idTokenSignedResponseAlg =
+                    registeredClient.idTokenSignedResponseAlg;
+            }
+            await this.storageUtility.setForUser(extendedOptions.sessionId, infoToSave, {
+                secure: false,
+            });
+            return registeredClient;
+        }
+        catch (error) {
+            throw new Error(`Client registration failed: [${error}]`);
+        }
+    }
+}
+
+class ErrorOidcHandler {
+    async canHandle(redirectUrl) {
+        try {
+            return new URL(redirectUrl).searchParams.has("error");
+        }
+        catch (e) {
+            throw new Error(`[${redirectUrl}] is not a valid URL, and cannot be used as a redirect URL: ${e}`);
+        }
+    }
+    async handle(redirectUrl, eventEmitter) {
+        if (eventEmitter !== undefined) {
+            const url = new URL(redirectUrl);
+            const errorUrl = url.searchParams.get("error");
+            const errorDescriptionUrl = url.searchParams.get("error_description");
+            eventEmitter.emit(EVENTS.ERROR, errorUrl, errorDescriptionUrl);
+        }
+        return getUnauthenticatedSession();
+    }
+}
+
+class TokenRefresher {
+    constructor(storageUtility, issuerConfigFetcher, clientRegistrar) {
+        this.storageUtility = storageUtility;
+        this.issuerConfigFetcher = issuerConfigFetcher;
+        this.clientRegistrar = clientRegistrar;
+    }
+    async refresh(sessionId, refreshToken, dpopKey, eventEmitter) {
+        const oidcContext = await loadOidcContextFromStorage(sessionId, this.storageUtility, this.issuerConfigFetcher);
+        const clientInfo = await this.clientRegistrar.getClient({ sessionId }, oidcContext.issuerConfig);
+        if (refreshToken === undefined) {
+            throw new Error(`Session [${sessionId}] has no refresh token to allow it to refresh its access token.`);
+        }
+        if (oidcContext.dpop && dpopKey === undefined) {
+            throw new Error(`For session [${sessionId}], the key bound to the DPoP access token must be provided to refresh said access token.`);
+        }
+        const tokenSet = await refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
+        if (tokenSet.refreshToken !== undefined) {
+            eventEmitter === null || eventEmitter === void 0 ? void 0 : eventEmitter.emit(EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
+            await this.storageUtility.setForUser(sessionId, {
+                refreshToken: tokenSet.refreshToken,
+            });
+        }
+        return tokenSet;
+    }
+}
+
+function getClientAuthenticationWithDependencies(dependencies) {
+    const inMemoryStorage = new InMemoryStorage();
+    const secureStorage = dependencies.secureStorage || inMemoryStorage;
+    const insecureStorage = dependencies.insecureStorage || new BrowserStorage();
+    const storageUtility = new StorageUtilityBrowser(secureStorage, insecureStorage);
+    const issuerConfigFetcher = new IssuerConfigFetcher(storageUtility);
+    const clientRegistrar = new ClientRegistrar(storageUtility);
+    const sessionInfoManager = new SessionInfoManager(storageUtility);
+    const tokenRefresher = new TokenRefresher(storageUtility, issuerConfigFetcher, clientRegistrar);
+    const loginHandler = new OidcLoginHandler(storageUtility, new AuthorizationCodeWithPkceOidcHandler(storageUtility, new Redirector()), issuerConfigFetcher, clientRegistrar);
+    const redirectHandler = new AggregateRedirectHandler([
+        new ErrorOidcHandler(),
+        new AuthCodeRedirectHandler(storageUtility, sessionInfoManager, issuerConfigFetcher, clientRegistrar, tokenRefresher),
+        new FallbackRedirectHandler(),
+    ]);
+    return new ClientAuthentication(loginHandler, redirectHandler, new GeneralLogoutHandler(sessionInfoManager), sessionInfoManager, issuerConfigFetcher);
+}
+
+const KEY_CURRENT_SESSION = `${SOLID_CLIENT_AUTHN_KEY_PREFIX}currentSession`;
+const KEY_CURRENT_URL = `${SOLID_CLIENT_AUTHN_KEY_PREFIX}currentUrl`;
+
+async function silentlyAuthenticate(sessionId, clientAuthn, options = {
+    inIframe: false,
+}, session) {
+    var _a;
+    const storedSessionInfo = await clientAuthn.validateCurrentSession(sessionId);
+    if (storedSessionInfo !== null) {
+        window.localStorage.setItem(KEY_CURRENT_URL, window.location.href);
+        await clientAuthn.login({
+            sessionId,
+            prompt: "none",
+            oidcIssuer: storedSessionInfo.issuer,
+            redirectUrl: storedSessionInfo.redirectUrl,
+            clientId: storedSessionInfo.clientAppId,
+            clientSecret: storedSessionInfo.clientAppSecret,
+            tokenType: (_a = storedSessionInfo.tokenType) !== null && _a !== void 0 ? _a : "DPoP",
+            inIframe: options.inIframe,
+        }, session);
+        return true;
+    }
+    return false;
+}
+function isLoggedIn(sessionInfo) {
+    return !!(sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.isLoggedIn);
+}
+class Session extends EventEmitter {
+    constructor(sessionOptions = {}, sessionId) {
+        super();
+        this.tokenRequestInProgress = false;
+        this.login = async (options) => {
+            var _a;
+            await this.clientAuthentication.login({
+                sessionId: this.info.sessionId,
+                ...options,
+                tokenType: (_a = options.tokenType) !== null && _a !== void 0 ? _a : "DPoP",
+            }, this);
+            return new Promise(() => undefined);
+        };
+        this.fetch = async (url, init) => {
+            return this.clientAuthentication.fetch(url, init);
+        };
+        this.internalLogout = async (emitSignal) => {
+            window.localStorage.removeItem(KEY_CURRENT_SESSION);
+            await this.clientAuthentication.logout(this.info.sessionId);
+            this.info.isLoggedIn = false;
+            if (emitSignal) {
+                this.emit(EVENTS.LOGOUT);
+            }
+        };
+        this.logout = async () => this.internalLogout(true);
+        this.handleIncomingRedirect = async (inputOptions = {}) => {
+            var _a;
+            if (this.info.isLoggedIn) {
+                return this.info;
+            }
+            if (this.tokenRequestInProgress) {
+                return undefined;
+            }
+            const options = typeof inputOptions === "string" ? { url: inputOptions } : inputOptions;
+            const url = (_a = options.url) !== null && _a !== void 0 ? _a : window.location.href;
+            if (window.frameElement !== null) {
+                postRedirectUrlToParent(url);
+                return undefined;
+            }
+            this.tokenRequestInProgress = true;
+            const sessionInfo = await this.clientAuthentication.handleIncomingRedirect(url, this);
+            if (isLoggedIn(sessionInfo)) {
+                this.setSessionInfo(sessionInfo);
+                const currentUrl = window.localStorage.getItem(KEY_CURRENT_URL);
+                if (currentUrl === null) {
+                    this.emit(EVENTS.LOGIN);
+                }
+                else {
+                    window.localStorage.removeItem(KEY_CURRENT_URL);
+                    this.emit(EVENTS.SESSION_RESTORED, currentUrl);
+                }
+            }
+            else if (options.restorePreviousSession === true) {
+                const storedSessionId = window.localStorage.getItem(KEY_CURRENT_SESSION);
+                if (storedSessionId !== null) {
+                    const attemptedSilentAuthentication = await silentlyAuthenticate(storedSessionId, this.clientAuthentication, undefined, this);
+                    if (attemptedSilentAuthentication) {
+                        return new Promise(() => { });
+                    }
+                }
+            }
+            this.tokenRequestInProgress = false;
+            return sessionInfo;
+        };
+        if (sessionOptions.clientAuthentication) {
+            this.clientAuthentication = sessionOptions.clientAuthentication;
+        }
+        else if (sessionOptions.secureStorage && sessionOptions.insecureStorage) {
+            this.clientAuthentication = getClientAuthenticationWithDependencies({
+                secureStorage: sessionOptions.secureStorage,
+                insecureStorage: sessionOptions.insecureStorage,
+            });
+        }
+        else {
+            this.clientAuthentication = getClientAuthenticationWithDependencies({});
+        }
+        if (sessionOptions.sessionInfo) {
+            this.info = {
+                sessionId: sessionOptions.sessionInfo.sessionId,
+                isLoggedIn: false,
+                webId: sessionOptions.sessionInfo.webId,
+            };
+        }
+        else {
+            this.info = {
+                sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : v4(),
+                isLoggedIn: false,
+            };
+        }
+        setupIframeListener(async (redirectUrl) => {
+            const sessionInfo = await this.clientAuthentication.handleIncomingRedirect(redirectUrl, this);
+            if (!isLoggedIn(sessionInfo)) {
+                return;
+            }
+            this.setSessionInfo(sessionInfo);
+        });
+        this.on("tokenRenewal", () => silentlyAuthenticate(this.info.sessionId, this.clientAuthentication, {
+            inIframe: true,
+        }, this));
+        this.on(EVENTS.LOGIN, () => window.localStorage.setItem(KEY_CURRENT_SESSION, this.info.sessionId));
+        this.on(EVENTS.SESSION_EXPIRED, () => this.internalLogout(false));
+        this.on(EVENTS.ERROR, () => this.internalLogout(false));
+        window.localStorage.removeItem("tmp-resource-server-session-enabled");
+    }
+    onLogin(callback) {
+        this.on(EVENTS.LOGIN, callback);
+    }
+    onLogout(callback) {
+        this.on(EVENTS.LOGOUT, callback);
+    }
+    onError(callback) {
+        this.on(EVENTS.ERROR, callback);
+    }
+    onSessionRestore(callback) {
+        this.on(EVENTS.SESSION_RESTORED, callback);
+    }
+    onSessionExpiration(callback) {
+        this.on(EVENTS.SESSION_EXPIRED, callback);
+    }
+    setSessionInfo(sessionInfo) {
+        this.info.isLoggedIn = sessionInfo.isLoggedIn;
+        this.info.webId = sessionInfo.webId;
+        this.info.sessionId = sessionInfo.sessionId;
+        this.info.expirationDate = sessionInfo.expirationDate;
+        this.on(EVENTS.SESSION_EXTENDED, (expiresIn) => {
+            this.info.expirationDate = Date.now() + expiresIn * 1000;
+        });
+    }
+}
+
+let defaultSession;
+function getDefaultSession() {
+    if (typeof defaultSession === "undefined") {
+        defaultSession = new Session();
+    }
+    return defaultSession;
+}
+const fetch$1 = (...args) => {
+    const session = getDefaultSession();
+    return session.fetch(...args);
+};
+const login = (...args) => {
+    const session = getDefaultSession();
+    return session.login(...args);
+};
+const logout = (...args) => {
+    const session = getDefaultSession();
+    return session.logout(...args);
+};
+const handleIncomingRedirect = (...args) => {
+    const session = getDefaultSession();
+    return session.handleIncomingRedirect(...args);
+};
+const onLogin = (...args) => {
+    const session = getDefaultSession();
+    return session.onLogin(...args);
+};
+const onLogout = (...args) => {
+    const session = getDefaultSession();
+    return session.onLogout(...args);
+};
+const onSessionRestore = (...args) => {
+    const session = getDefaultSession();
+    return session.onSessionRestore(...args);
+};
+
+export { Session, fetch$1 as fetch, getClientAuthenticationWithDependencies, getDefaultSession, handleIncomingRedirect, login, logout, onLogin, onLogout, onSessionRestore };