@inrupt/solid-client-authn-browser 1.11.9-alpha.1 → 1.11.9-alpha.2

package/dist/index.es.js

@@ -1,6 +1,7 @@
-import { StorageUtility, determineSigningAlg, PREFERRED_SIGNING_ALG, getWebidFromTokenPayload, createDpopHeader, OidcProviderError, InvalidResponseError, generateDpopKeyPair, EVENTS, ConfigurationError, handleRegistration, isSupportedTokenType, loadOidcContextFromStorage, buildAuthenticatedFetch, AggregateHandler, InMemoryStorage, SOLID_CLIENT_AUTHN_KEY_PREFIX } from '@inrupt/solid-client-authn-core';
+import { StorageUtility, EVENTS, ConfigurationError, handleRegistration, isSupportedTokenType, loadOidcContextFromStorage, buildAuthenticatedFetch, AggregateHandler, InMemoryStorage, SOLID_CLIENT_AUTHN_KEY_PREFIX } from '@inrupt/solid-client-authn-core';
 export { ConfigurationError, InMemoryStorage, NotImplementedError } from '@inrupt/solid-client-authn-core';
-import { OidcClient, WebStorageStateStore } from '@inrupt/oidc-client';
+import { v4 } from 'uuid';
+import { removeOidcQueryParam, OidcClient, clearOidcPersistentStorage, getDpopToken, getBearerToken, registerClient, refresh } from '@inrupt/oidc-client-ext';
 
 var domain;
 
@@ -474,362 +475,12 @@ function unwrapListeners(arr) {
   return ret;
 }
 
-// Unique ID creation requires a high quality random # generator. In the browser we therefore
-// require the crypto API and do not support built-in fallback to lower quality random number
-// generators (like Math.random()).
-var getRandomValues;
-var rnds8 = new Uint8Array(16);
-function rng() {
-  // lazy load so that environments that need to polyfill have a chance to do so
-  if (!getRandomValues) {
-    // getRandomValues needs to be invoked in a context where "this" is a Crypto implementation. Also,
-    // find the complete implementation of crypto (msCrypto) on IE11.
-    getRandomValues = typeof crypto !== 'undefined' && crypto.getRandomValues && crypto.getRandomValues.bind(crypto) || typeof msCrypto !== 'undefined' && typeof msCrypto.getRandomValues === 'function' && msCrypto.getRandomValues.bind(msCrypto);
-
-    if (!getRandomValues) {
-      throw new Error('crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported');
-    }
-  }
-
-  return getRandomValues(rnds8);
-}
-
-var REGEX = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000)$/i;
-
-function validate(uuid) {
-  return typeof uuid === 'string' && REGEX.test(uuid);
-}
-
-/**
- * Convert array of 16 byte values to UUID string format of the form:
- * XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
- */
-
-var byteToHex = [];
-
-for (var i = 0; i < 256; ++i) {
-  byteToHex.push((i + 0x100).toString(16).substr(1));
-}
-
-function stringify(arr) {
-  var offset = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;
-  // Note: Be careful editing this code!  It's been tuned for performance
-  // and works in ways you may not expect. See https://github.com/uuidjs/uuid/pull/434
-  var uuid = (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + '-' + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + '-' + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + '-' + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + '-' + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); // Consistency check for valid UUID.  If this throws, it's likely due to one
-  // of the following:
-  // - One or more input array values don't map to a hex octet (leading to
-  // "undefined" in the uuid)
-  // - Invalid input values for the RFC `version` or `variant` fields
-
-  if (!validate(uuid)) {
-    throw TypeError('Stringified UUID is invalid');
-  }
-
-  return uuid;
-}
-
-function v4(options, buf, offset) {
-  options = options || {};
-  var rnds = options.random || (options.rng || rng)(); // Per 4.4, set bits for version and `clock_seq_hi_and_reserved`
-
-  rnds[6] = rnds[6] & 0x0f | 0x40;
-  rnds[8] = rnds[8] & 0x3f | 0x80; // Copy bytes to buffer, if provided
-
-  if (buf) {
-    offset = offset || 0;
-
-    for (var i = 0; i < 16; ++i) {
-      buf[offset + i] = rnds[i];
-    }
-
-    return buf;
-  }
-
-  return stringify(rnds);
-}
-
 class StorageUtilityBrowser extends StorageUtility {
     constructor(secureStorage, insecureStorage) {
         super(secureStorage, insecureStorage);
     }
 }
 
-function processErrorResponse(responseBody, options) {
-    var _a, _b, _c, _d;
-    if (responseBody.error === "invalid_redirect_uri") {
-        throw new Error(`Dynamic client registration failed: the provided redirect uri [${(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()}] is invalid - ${(_b = responseBody.error_description) !== null && _b !== void 0 ? _b : ""}`);
-    }
-    if (responseBody.error === "invalid_client_metadata") {
-        throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${(_c = responseBody.error_description) !== null && _c !== void 0 ? _c : ""}`);
-    }
-    throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${(_d = responseBody.error_description) !== null && _d !== void 0 ? _d : ""}`);
-}
-function validateRegistrationResponse(responseBody, options) {
-    if (responseBody.client_id === undefined) {
-        throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(responseBody)}`);
-    }
-    if (options.redirectUrl &&
-        (responseBody.redirect_uris === undefined ||
-            responseBody.redirect_uris[0] !== options.redirectUrl.toString())) {
-        throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(responseBody.redirect_uris)} don't match the provided ${JSON.stringify([
-            options.redirectUrl.toString(),
-        ])}`);
-    }
-}
-async function registerClient(options, issuerConfig) {
-    var _a;
-    if (!issuerConfig.registrationEndpoint) {
-        throw new Error("Dynamic Registration could not be completed because the issuer has no registration endpoint.");
-    }
-    if (!Array.isArray(issuerConfig.idTokenSigningAlgValuesSupported)) {
-        throw new Error("The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.");
-    }
-    const signingAlg = determineSigningAlg(issuerConfig.idTokenSigningAlgValuesSupported, PREFERRED_SIGNING_ALG);
-    const config = {
-        client_name: options.clientName,
-        application_type: "web",
-        redirect_uris: [(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()],
-        subject_type: "public",
-        token_endpoint_auth_method: "client_secret_basic",
-        id_token_signed_response_alg: signingAlg,
-        grant_types: ["authorization_code", "refresh_token"],
-    };
-    const headers = {
-        "Content-Type": "application/json",
-    };
-    if (options.registrationAccessToken) {
-        headers.Authorization = `Bearer ${options.registrationAccessToken}`;
-    }
-    const registerResponse = await fetch(issuerConfig.registrationEndpoint.toString(), {
-        method: "POST",
-        headers,
-        body: JSON.stringify(config),
-    });
-    if (registerResponse.ok) {
-        const responseBody = await registerResponse.json();
-        validateRegistrationResponse(responseBody, options);
-        return {
-            clientId: responseBody.client_id,
-            clientSecret: responseBody.client_secret,
-            idTokenSignedResponseAlg: responseBody.id_token_signed_response_alg,
-            clientType: "dynamic",
-        };
-    }
-    if (registerResponse.status === 400) {
-        processErrorResponse(await registerResponse.json(), options);
-    }
-    throw new Error(`Dynamic client registration failed: the server returned ${registerResponse.status} ${registerResponse.statusText} - ${await registerResponse.text()}`);
-}
-
-function hasError(value) {
-    return value.error !== undefined && typeof value.error === "string";
-}
-function hasErrorDescription(value) {
-    return (value.error_description !== undefined &&
-        typeof value.error_description === "string");
-}
-function hasErrorUri(value) {
-    return value.error_uri !== undefined && typeof value.error_uri === "string";
-}
-function hasAccessToken(value) {
-    return (value.access_token !== undefined && typeof value.access_token === "string");
-}
-function hasIdToken(value) {
-    return value.id_token !== undefined && typeof value.id_token === "string";
-}
-function hasRefreshToken(value) {
-    return (value.refresh_token !== undefined && typeof value.refresh_token === "string");
-}
-function hasTokenType(value) {
-    return value.token_type !== undefined && typeof value.token_type === "string";
-}
-function hasExpiresIn(value) {
-    return value.expires_in === undefined || typeof value.expires_in === "number";
-}
-function validatePreconditions(issuer, data) {
-    if (data.grantType &&
-        (!issuer.grantTypesSupported ||
-            !issuer.grantTypesSupported.includes(data.grantType))) {
-        throw new Error(`The issuer [${issuer.issuer}] does not support the [${data.grantType}] grant`);
-    }
-    if (!issuer.tokenEndpoint) {
-        throw new Error(`This issuer [${issuer.issuer}] does not have a token endpoint`);
-    }
-}
-function validateTokenEndpointResponse(tokenResponse, dpop) {
-    if (hasError(tokenResponse)) {
-        throw new OidcProviderError(`Token endpoint returned error [${tokenResponse.error}]${hasErrorDescription(tokenResponse)
-            ? `: ${tokenResponse.error_description}`
-            : ""}${hasErrorUri(tokenResponse) ? ` (see ${tokenResponse.error_uri})` : ""}`, tokenResponse.error, hasErrorDescription(tokenResponse)
-            ? tokenResponse.error_description
-            : undefined);
-    }
-    if (!hasAccessToken(tokenResponse)) {
-        throw new InvalidResponseError(["access_token"]);
-    }
-    if (!hasIdToken(tokenResponse)) {
-        throw new InvalidResponseError(["id_token"]);
-    }
-    if (!hasTokenType(tokenResponse)) {
-        throw new InvalidResponseError(["token_type"]);
-    }
-    if (!hasExpiresIn(tokenResponse)) {
-        throw new InvalidResponseError(["expires_in"]);
-    }
-    if (!dpop && tokenResponse.token_type.toLowerCase() !== "bearer") {
-        throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${tokenResponse.token_type}].`);
-    }
-    return tokenResponse;
-}
-async function getTokens(issuer, client, data, dpop) {
-    validatePreconditions(issuer, data);
-    const headers = {
-        "content-type": "application/x-www-form-urlencoded",
-    };
-    let dpopKey;
-    if (dpop) {
-        dpopKey = await generateDpopKeyPair();
-        headers.DPoP = await createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey);
-    }
-    if (client.clientSecret) {
-        headers.Authorization = `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`;
-    }
-    const requestBody = {
-        grant_type: data.grantType,
-        redirect_uri: data.redirectUrl,
-        code: data.code,
-        code_verifier: data.codeVerifier,
-        client_id: client.clientId,
-    };
-    const tokenRequestInit = {
-        method: "POST",
-        headers,
-        body: new URLSearchParams(requestBody).toString(),
-    };
-    const rawTokenResponse = await await fetch(issuer.tokenEndpoint, tokenRequestInit);
-    const jsonTokenResponse = (await rawTokenResponse.json());
-    const tokenResponse = validateTokenEndpointResponse(jsonTokenResponse, dpop);
-    const webId = await getWebidFromTokenPayload(tokenResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-    return {
-        accessToken: tokenResponse.access_token,
-        idToken: tokenResponse.id_token,
-        refreshToken: hasRefreshToken(tokenResponse)
-            ? tokenResponse.refresh_token
-            : undefined,
-        webId,
-        dpopKey,
-        expiresIn: tokenResponse.expires_in,
-    };
-}
-async function getBearerToken(redirectUrl) {
-    let signinResponse;
-    try {
-        const client = new OidcClient({
-            response_mode: "query",
-            loadUserInfo: false,
-        });
-        signinResponse = await client.processSigninResponse(redirectUrl);
-        if (client.settings.metadata === undefined) {
-            throw new Error("Cannot retrieve issuer metadata from client information in storage.");
-        }
-        if (client.settings.metadata.jwks_uri === undefined) {
-            throw new Error("Missing some issuer metadata from client information in storage: 'jwks_uri' is undefined");
-        }
-        if (client.settings.metadata.issuer === undefined) {
-            throw new Error("Missing some issuer metadata from client information in storage: 'issuer' is undefined");
-        }
-        if (client.settings.client_id === undefined) {
-            throw new Error("Missing some client information in storage: 'client_id' is undefined");
-        }
-        const webId = await getWebidFromTokenPayload(signinResponse.id_token, client.settings.metadata.jwks_uri, client.settings.metadata.issuer, client.settings.client_id);
-        return {
-            accessToken: signinResponse.access_token,
-            idToken: signinResponse.id_token,
-            webId,
-            refreshToken: signinResponse.refresh_token,
-        };
-    }
-    catch (err) {
-        throw new Error(`Problem handling Auth Code Grant (Flow) redirect - URL [${redirectUrl}]: ${err}`);
-    }
-}
-async function getDpopToken(issuer, client, data) {
-    return getTokens(issuer, client, data, true);
-}
-
-async function refresh(refreshToken, issuer, client, dpopKey) {
-    const requestBody = {
-        grant_type: "refresh_token",
-        refresh_token: refreshToken,
-        scope: "openid offline_access",
-    };
-    let dpopHeader = {};
-    if (dpopKey !== undefined) {
-        dpopHeader = {
-            DPoP: await createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey),
-        };
-    }
-    let authHeader = {};
-    if (client.clientSecret !== undefined) {
-        authHeader = {
-            Authorization: `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`,
-        };
-    }
-    const rawResponse = await fetch(issuer.tokenEndpoint, {
-        method: "POST",
-        body: new URLSearchParams(requestBody).toString(),
-        headers: {
-            ...dpopHeader,
-            ...authHeader,
-            "Content-Type": "application/x-www-form-urlencoded",
-        },
-    });
-    let response;
-    try {
-        response = await rawResponse.json();
-    }
-    catch (e) {
-        throw new Error(`The token endpoint of issuer ${issuer.issuer} returned a malformed response.`);
-    }
-    const validatedResponse = validateTokenEndpointResponse(response, dpopKey !== undefined);
-    const webId = await getWebidFromTokenPayload(validatedResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-    return {
-        accessToken: validatedResponse.access_token,
-        idToken: validatedResponse.id_token,
-        refreshToken: typeof validatedResponse.refresh_token === "string"
-            ? validatedResponse.refresh_token
-            : undefined,
-        webId,
-        dpopKey,
-        expiresIn: validatedResponse.expires_in,
-    };
-}
-
-function removeOidcQueryParam(redirectUrl) {
-    const cleanedUrl = new URL(redirectUrl);
-    cleanedUrl.searchParams.delete("code");
-    cleanedUrl.searchParams.delete("state");
-    cleanedUrl.hash = "";
-    return cleanedUrl.toString();
-}
-async function clearOidcPersistentStorage() {
-    const client = new OidcClient({
-        response_mode: "query",
-    });
-    await client.clearStaleState(new WebStorageStateStore({}));
-    const myStorage = window.localStorage;
-    const itemsToRemove = [];
-    for (let i = 0; i <= myStorage.length; i += 1) {
-        const key = myStorage.key(i);
-        if (key &&
-            (key.match(/^oidc\..+$/) ||
-                key.match(/^solidClientAuthenticationUser:.+$/))) {
-            itemsToRemove.push(key);
-        }
-    }
-    itemsToRemove.forEach((key) => myStorage.removeItem(key));
-}
-
 const globalFetch = (request, init) => window.fetch(request, init);
 class ClientAuthentication {
     constructor(loginHandler, redirectHandler, logoutHandler, sessionInfoManager, issuerConfigFetcher) {

package/dist/index.js

@@ -3,7 +3,8 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var solidClientAuthnCore = require('@inrupt/solid-client-authn-core');
-var oidcClient = require('@inrupt/oidc-client');
+var uuid = require('uuid');
+var oidcClientExt = require('@inrupt/oidc-client-ext');
 
 var domain;
 
@@ -477,362 +478,12 @@ function unwrapListeners(arr) {
   return ret;
 }
 
-// Unique ID creation requires a high quality random # generator. In the browser we therefore
-// require the crypto API and do not support built-in fallback to lower quality random number
-// generators (like Math.random()).
-var getRandomValues;
-var rnds8 = new Uint8Array(16);
-function rng() {
-  // lazy load so that environments that need to polyfill have a chance to do so
-  if (!getRandomValues) {
-    // getRandomValues needs to be invoked in a context where "this" is a Crypto implementation. Also,
-    // find the complete implementation of crypto (msCrypto) on IE11.
-    getRandomValues = typeof crypto !== 'undefined' && crypto.getRandomValues && crypto.getRandomValues.bind(crypto) || typeof msCrypto !== 'undefined' && typeof msCrypto.getRandomValues === 'function' && msCrypto.getRandomValues.bind(msCrypto);
-
-    if (!getRandomValues) {
-      throw new Error('crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported');
-    }
-  }
-
-  return getRandomValues(rnds8);
-}
-
-var REGEX = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000)$/i;
-
-function validate(uuid) {
-  return typeof uuid === 'string' && REGEX.test(uuid);
-}
-
-/**
- * Convert array of 16 byte values to UUID string format of the form:
- * XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
- */
-
-var byteToHex = [];
-
-for (var i = 0; i < 256; ++i) {
-  byteToHex.push((i + 0x100).toString(16).substr(1));
-}
-
-function stringify(arr) {
-  var offset = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;
-  // Note: Be careful editing this code!  It's been tuned for performance
-  // and works in ways you may not expect. See https://github.com/uuidjs/uuid/pull/434
-  var uuid = (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + '-' + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + '-' + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + '-' + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + '-' + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); // Consistency check for valid UUID.  If this throws, it's likely due to one
-  // of the following:
-  // - One or more input array values don't map to a hex octet (leading to
-  // "undefined" in the uuid)
-  // - Invalid input values for the RFC `version` or `variant` fields
-
-  if (!validate(uuid)) {
-    throw TypeError('Stringified UUID is invalid');
-  }
-
-  return uuid;
-}
-
-function v4(options, buf, offset) {
-  options = options || {};
-  var rnds = options.random || (options.rng || rng)(); // Per 4.4, set bits for version and `clock_seq_hi_and_reserved`
-
-  rnds[6] = rnds[6] & 0x0f | 0x40;
-  rnds[8] = rnds[8] & 0x3f | 0x80; // Copy bytes to buffer, if provided
-
-  if (buf) {
-    offset = offset || 0;
-
-    for (var i = 0; i < 16; ++i) {
-      buf[offset + i] = rnds[i];
-    }
-
-    return buf;
-  }
-
-  return stringify(rnds);
-}
-
 class StorageUtilityBrowser extends solidClientAuthnCore.StorageUtility {
     constructor(secureStorage, insecureStorage) {
         super(secureStorage, insecureStorage);
     }
 }
 
-function processErrorResponse(responseBody, options) {
-    var _a, _b, _c, _d;
-    if (responseBody.error === "invalid_redirect_uri") {
-        throw new Error(`Dynamic client registration failed: the provided redirect uri [${(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()}] is invalid - ${(_b = responseBody.error_description) !== null && _b !== void 0 ? _b : ""}`);
-    }
-    if (responseBody.error === "invalid_client_metadata") {
-        throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${(_c = responseBody.error_description) !== null && _c !== void 0 ? _c : ""}`);
-    }
-    throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${(_d = responseBody.error_description) !== null && _d !== void 0 ? _d : ""}`);
-}
-function validateRegistrationResponse(responseBody, options) {
-    if (responseBody.client_id === undefined) {
-        throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(responseBody)}`);
-    }
-    if (options.redirectUrl &&
-        (responseBody.redirect_uris === undefined ||
-            responseBody.redirect_uris[0] !== options.redirectUrl.toString())) {
-        throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(responseBody.redirect_uris)} don't match the provided ${JSON.stringify([
-            options.redirectUrl.toString(),
-        ])}`);
-    }
-}
-async function registerClient(options, issuerConfig) {
-    var _a;
-    if (!issuerConfig.registrationEndpoint) {
-        throw new Error("Dynamic Registration could not be completed because the issuer has no registration endpoint.");
-    }
-    if (!Array.isArray(issuerConfig.idTokenSigningAlgValuesSupported)) {
-        throw new Error("The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.");
-    }
-    const signingAlg = solidClientAuthnCore.determineSigningAlg(issuerConfig.idTokenSigningAlgValuesSupported, solidClientAuthnCore.PREFERRED_SIGNING_ALG);
-    const config = {
-        client_name: options.clientName,
-        application_type: "web",
-        redirect_uris: [(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()],
-        subject_type: "public",
-        token_endpoint_auth_method: "client_secret_basic",
-        id_token_signed_response_alg: signingAlg,
-        grant_types: ["authorization_code", "refresh_token"],
-    };
-    const headers = {
-        "Content-Type": "application/json",
-    };
-    if (options.registrationAccessToken) {
-        headers.Authorization = `Bearer ${options.registrationAccessToken}`;
-    }
-    const registerResponse = await fetch(issuerConfig.registrationEndpoint.toString(), {
-        method: "POST",
-        headers,
-        body: JSON.stringify(config),
-    });
-    if (registerResponse.ok) {
-        const responseBody = await registerResponse.json();
-        validateRegistrationResponse(responseBody, options);
-        return {
-            clientId: responseBody.client_id,
-            clientSecret: responseBody.client_secret,
-            idTokenSignedResponseAlg: responseBody.id_token_signed_response_alg,
-            clientType: "dynamic",
-        };
-    }
-    if (registerResponse.status === 400) {
-        processErrorResponse(await registerResponse.json(), options);
-    }
-    throw new Error(`Dynamic client registration failed: the server returned ${registerResponse.status} ${registerResponse.statusText} - ${await registerResponse.text()}`);
-}
-
-function hasError(value) {
-    return value.error !== undefined && typeof value.error === "string";
-}
-function hasErrorDescription(value) {
-    return (value.error_description !== undefined &&
-        typeof value.error_description === "string");
-}
-function hasErrorUri(value) {
-    return value.error_uri !== undefined && typeof value.error_uri === "string";
-}
-function hasAccessToken(value) {
-    return (value.access_token !== undefined && typeof value.access_token === "string");
-}
-function hasIdToken(value) {
-    return value.id_token !== undefined && typeof value.id_token === "string";
-}
-function hasRefreshToken(value) {
-    return (value.refresh_token !== undefined && typeof value.refresh_token === "string");
-}
-function hasTokenType(value) {
-    return value.token_type !== undefined && typeof value.token_type === "string";
-}
-function hasExpiresIn(value) {
-    return value.expires_in === undefined || typeof value.expires_in === "number";
-}
-function validatePreconditions(issuer, data) {
-    if (data.grantType &&
-        (!issuer.grantTypesSupported ||
-            !issuer.grantTypesSupported.includes(data.grantType))) {
-        throw new Error(`The issuer [${issuer.issuer}] does not support the [${data.grantType}] grant`);
-    }
-    if (!issuer.tokenEndpoint) {
-        throw new Error(`This issuer [${issuer.issuer}] does not have a token endpoint`);
-    }
-}
-function validateTokenEndpointResponse(tokenResponse, dpop) {
-    if (hasError(tokenResponse)) {
-        throw new solidClientAuthnCore.OidcProviderError(`Token endpoint returned error [${tokenResponse.error}]${hasErrorDescription(tokenResponse)
-            ? `: ${tokenResponse.error_description}`
-            : ""}${hasErrorUri(tokenResponse) ? ` (see ${tokenResponse.error_uri})` : ""}`, tokenResponse.error, hasErrorDescription(tokenResponse)
-            ? tokenResponse.error_description
-            : undefined);
-    }
-    if (!hasAccessToken(tokenResponse)) {
-        throw new solidClientAuthnCore.InvalidResponseError(["access_token"]);
-    }
-    if (!hasIdToken(tokenResponse)) {
-        throw new solidClientAuthnCore.InvalidResponseError(["id_token"]);
-    }
-    if (!hasTokenType(tokenResponse)) {
-        throw new solidClientAuthnCore.InvalidResponseError(["token_type"]);
-    }
-    if (!hasExpiresIn(tokenResponse)) {
-        throw new solidClientAuthnCore.InvalidResponseError(["expires_in"]);
-    }
-    if (!dpop && tokenResponse.token_type.toLowerCase() !== "bearer") {
-        throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${tokenResponse.token_type}].`);
-    }
-    return tokenResponse;
-}
-async function getTokens(issuer, client, data, dpop) {
-    validatePreconditions(issuer, data);
-    const headers = {
-        "content-type": "application/x-www-form-urlencoded",
-    };
-    let dpopKey;
-    if (dpop) {
-        dpopKey = await solidClientAuthnCore.generateDpopKeyPair();
-        headers.DPoP = await solidClientAuthnCore.createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey);
-    }
-    if (client.clientSecret) {
-        headers.Authorization = `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`;
-    }
-    const requestBody = {
-        grant_type: data.grantType,
-        redirect_uri: data.redirectUrl,
-        code: data.code,
-        code_verifier: data.codeVerifier,
-        client_id: client.clientId,
-    };
-    const tokenRequestInit = {
-        method: "POST",
-        headers,
-        body: new URLSearchParams(requestBody).toString(),
-    };
-    const rawTokenResponse = await await fetch(issuer.tokenEndpoint, tokenRequestInit);
-    const jsonTokenResponse = (await rawTokenResponse.json());
-    const tokenResponse = validateTokenEndpointResponse(jsonTokenResponse, dpop);
-    const webId = await solidClientAuthnCore.getWebidFromTokenPayload(tokenResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-    return {
-        accessToken: tokenResponse.access_token,
-        idToken: tokenResponse.id_token,
-        refreshToken: hasRefreshToken(tokenResponse)
-            ? tokenResponse.refresh_token
-            : undefined,
-        webId,
-        dpopKey,
-        expiresIn: tokenResponse.expires_in,
-    };
-}
-async function getBearerToken(redirectUrl) {
-    let signinResponse;
-    try {
-        const client = new oidcClient.OidcClient({
-            response_mode: "query",
-            loadUserInfo: false,
-        });
-        signinResponse = await client.processSigninResponse(redirectUrl);
-        if (client.settings.metadata === undefined) {
-            throw new Error("Cannot retrieve issuer metadata from client information in storage.");
-        }
-        if (client.settings.metadata.jwks_uri === undefined) {
-            throw new Error("Missing some issuer metadata from client information in storage: 'jwks_uri' is undefined");
-        }
-        if (client.settings.metadata.issuer === undefined) {
-            throw new Error("Missing some issuer metadata from client information in storage: 'issuer' is undefined");
-        }
-        if (client.settings.client_id === undefined) {
-            throw new Error("Missing some client information in storage: 'client_id' is undefined");
-        }
-        const webId = await solidClientAuthnCore.getWebidFromTokenPayload(signinResponse.id_token, client.settings.metadata.jwks_uri, client.settings.metadata.issuer, client.settings.client_id);
-        return {
-            accessToken: signinResponse.access_token,
-            idToken: signinResponse.id_token,
-            webId,
-            refreshToken: signinResponse.refresh_token,
-        };
-    }
-    catch (err) {
-        throw new Error(`Problem handling Auth Code Grant (Flow) redirect - URL [${redirectUrl}]: ${err}`);
-    }
-}
-async function getDpopToken(issuer, client, data) {
-    return getTokens(issuer, client, data, true);
-}
-
-async function refresh(refreshToken, issuer, client, dpopKey) {
-    const requestBody = {
-        grant_type: "refresh_token",
-        refresh_token: refreshToken,
-        scope: "openid offline_access",
-    };
-    let dpopHeader = {};
-    if (dpopKey !== undefined) {
-        dpopHeader = {
-            DPoP: await solidClientAuthnCore.createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey),
-        };
-    }
-    let authHeader = {};
-    if (client.clientSecret !== undefined) {
-        authHeader = {
-            Authorization: `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`,
-        };
-    }
-    const rawResponse = await fetch(issuer.tokenEndpoint, {
-        method: "POST",
-        body: new URLSearchParams(requestBody).toString(),
-        headers: {
-            ...dpopHeader,
-            ...authHeader,
-            "Content-Type": "application/x-www-form-urlencoded",
-        },
-    });
-    let response;
-    try {
-        response = await rawResponse.json();
-    }
-    catch (e) {
-        throw new Error(`The token endpoint of issuer ${issuer.issuer} returned a malformed response.`);
-    }
-    const validatedResponse = validateTokenEndpointResponse(response, dpopKey !== undefined);
-    const webId = await solidClientAuthnCore.getWebidFromTokenPayload(validatedResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-    return {
-        accessToken: validatedResponse.access_token,
-        idToken: validatedResponse.id_token,
-        refreshToken: typeof validatedResponse.refresh_token === "string"
-            ? validatedResponse.refresh_token
-            : undefined,
-        webId,
-        dpopKey,
-        expiresIn: validatedResponse.expires_in,
-    };
-}
-
-function removeOidcQueryParam(redirectUrl) {
-    const cleanedUrl = new URL(redirectUrl);
-    cleanedUrl.searchParams.delete("code");
-    cleanedUrl.searchParams.delete("state");
-    cleanedUrl.hash = "";
-    return cleanedUrl.toString();
-}
-async function clearOidcPersistentStorage() {
-    const client = new oidcClient.OidcClient({
-        response_mode: "query",
-    });
-    await client.clearStaleState(new oidcClient.WebStorageStateStore({}));
-    const myStorage = window.localStorage;
-    const itemsToRemove = [];
-    for (let i = 0; i <= myStorage.length; i += 1) {
-        const key = myStorage.key(i);
-        if (key &&
-            (key.match(/^oidc\..+$/) ||
-                key.match(/^solidClientAuthenticationUser:.+$/))) {
-            itemsToRemove.push(key);
-        }
-    }
-    itemsToRemove.forEach((key) => myStorage.removeItem(key));
-}
-
 const globalFetch = (request, init) => window.fetch(request, init);
 class ClientAuthentication {
     constructor(loginHandler, redirectHandler, logoutHandler, sessionInfoManager, issuerConfigFetcher) {
@@ -844,7 +495,7 @@ class ClientAuthentication {
         this.login = async (options, eventEmitter) => {
             var _a, _b;
             await this.sessionInfoManager.clear(options.sessionId);
-            const redirectUrl = removeOidcQueryParam((_a = options.redirectUrl) !== null && _a !== void 0 ? _a : window.location.href);
+            const redirectUrl = oidcClientExt.removeOidcQueryParam((_a = options.redirectUrl) !== null && _a !== void 0 ? _a : window.location.href);
             await this.loginHandler.handle({
                 ...options,
                 redirectUrl,
@@ -962,7 +613,7 @@ class AuthorizationCodeWithPkceOidcHandler {
             code_verifier: true,
             prompt: (_a = oidcLoginOptions.prompt) !== null && _a !== void 0 ? _a : "consent",
         };
-        const oidcClientLibrary = new oidcClient.OidcClient(oidcOptions);
+        const oidcClientLibrary = new oidcClientExt.OidcClient(oidcOptions);
         const { redirector } = this;
         const storage = this.storageUtility;
         try {
@@ -1118,7 +769,7 @@ class IssuerConfigFetcher {
 function getUnauthenticatedSession() {
     return {
         isLoggedIn: false,
-        sessionId: v4(),
+        sessionId: uuid.v4(),
         fetch,
     };
 }
@@ -1128,7 +779,7 @@ async function clear(sessionId, storage) {
         storage.deleteAllUserData(sessionId, { secure: true }),
         storage.delete("clientKey", { secure: false }),
     ]);
-    await clearOidcPersistentStorage();
+    await oidcClientExt.clearOidcPersistentStorage();
 }
 class SessionInfoManager {
     constructor(storageUtility) {
@@ -1266,7 +917,7 @@ class AuthCodeRedirectHandler {
         let tokens;
         const tokenCreatedAt = Date.now();
         if (isDpop) {
-            tokens = await getDpopToken(issuerConfig, client, {
+            tokens = await oidcClientExt.getDpopToken(issuerConfig, client, {
                 grantType: "authorization_code",
                 code: url.searchParams.get("code"),
                 codeVerifier,
@@ -1275,7 +926,7 @@ class AuthCodeRedirectHandler {
             window.localStorage.removeItem(`oidc.${oauthState}`);
         }
         else {
-            tokens = await getBearerToken(url.toString());
+            tokens = await oidcClientExt.getBearerToken(url.toString());
         }
         let refreshOptions;
         if (tokens.refreshToken !== undefined) {
@@ -1414,7 +1065,7 @@ class ClientRegistrar {
         extendedOptions.registrationAccessToken =
             (_a = extendedOptions.registrationAccessToken) !== null && _a !== void 0 ? _a : (await this.storageUtility.getForUser(options.sessionId, "registrationAccessToken"));
         try {
-            const registeredClient = await registerClient(extendedOptions, issuerConfig);
+            const registeredClient = await oidcClientExt.registerClient(extendedOptions, issuerConfig);
             const infoToSave = {
                 clientId: registeredClient.clientId,
             };
@@ -1471,7 +1122,7 @@ class TokenRefresher {
         if (oidcContext.dpop && dpopKey === undefined) {
             throw new Error(`For session [${sessionId}], the key bound to the DPoP access token must be provided to refresh said access token.`);
         }
-        const tokenSet = await refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
+        const tokenSet = await oidcClientExt.refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
         if (tokenSet.refreshToken !== undefined) {
             eventEmitter === null || eventEmitter === void 0 ? void 0 : eventEmitter.emit(solidClientAuthnCore.EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
             await this.storageUtility.setForUser(sessionId, {
@@ -1612,7 +1263,7 @@ class Session extends EventEmitter {
         }
         else {
             this.info = {
-                sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : v4(),
+                sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : uuid.v4(),
                 isLoggedIn: false,
             };
         }

package/dist/solid-client-authn.bundle.js

@@ -1,8 +1,8 @@
 (function (global, factory) {
-  typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('@inrupt/solid-client-authn-core'), require('@inrupt/oidc-client')) :
-  typeof define === 'function' && define.amd ? define(['exports', '@inrupt/solid-client-authn-core', '@inrupt/oidc-client'], factory) :
-  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.solidClientAuthentication = {}, global.solidClientAuthnCore, global.oidcClient));
-})(this, (function (exports, solidClientAuthnCore, oidcClient) { 'use strict';
+  typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('@inrupt/solid-client-authn-core'), require('uuid'), require('@inrupt/oidc-client-ext')) :
+  typeof define === 'function' && define.amd ? define(['exports', '@inrupt/solid-client-authn-core', 'uuid', '@inrupt/oidc-client-ext'], factory) :
+  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.solidClientAuthentication = {}, global.solidClientAuthnCore, global.uuid, global.oidcClientExt));
+})(this, (function (exports, solidClientAuthnCore, uuid, oidcClientExt) { 'use strict';
 
   var domain;
 
@@ -476,362 +476,12 @@
     return ret;
   }
 
-  // Unique ID creation requires a high quality random # generator. In the browser we therefore
-  // require the crypto API and do not support built-in fallback to lower quality random number
-  // generators (like Math.random()).
-  var getRandomValues;
-  var rnds8 = new Uint8Array(16);
-  function rng() {
-    // lazy load so that environments that need to polyfill have a chance to do so
-    if (!getRandomValues) {
-      // getRandomValues needs to be invoked in a context where "this" is a Crypto implementation. Also,
-      // find the complete implementation of crypto (msCrypto) on IE11.
-      getRandomValues = typeof crypto !== 'undefined' && crypto.getRandomValues && crypto.getRandomValues.bind(crypto) || typeof msCrypto !== 'undefined' && typeof msCrypto.getRandomValues === 'function' && msCrypto.getRandomValues.bind(msCrypto);
-
-      if (!getRandomValues) {
-        throw new Error('crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported');
-      }
-    }
-
-    return getRandomValues(rnds8);
-  }
-
-  var REGEX = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000)$/i;
-
-  function validate(uuid) {
-    return typeof uuid === 'string' && REGEX.test(uuid);
-  }
-
-  /**
-   * Convert array of 16 byte values to UUID string format of the form:
-   * XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
-   */
-
-  var byteToHex = [];
-
-  for (var i = 0; i < 256; ++i) {
-    byteToHex.push((i + 0x100).toString(16).substr(1));
-  }
-
-  function stringify(arr) {
-    var offset = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;
-    // Note: Be careful editing this code!  It's been tuned for performance
-    // and works in ways you may not expect. See https://github.com/uuidjs/uuid/pull/434
-    var uuid = (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + '-' + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + '-' + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + '-' + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + '-' + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); // Consistency check for valid UUID.  If this throws, it's likely due to one
-    // of the following:
-    // - One or more input array values don't map to a hex octet (leading to
-    // "undefined" in the uuid)
-    // - Invalid input values for the RFC `version` or `variant` fields
-
-    if (!validate(uuid)) {
-      throw TypeError('Stringified UUID is invalid');
-    }
-
-    return uuid;
-  }
-
-  function v4(options, buf, offset) {
-    options = options || {};
-    var rnds = options.random || (options.rng || rng)(); // Per 4.4, set bits for version and `clock_seq_hi_and_reserved`
-
-    rnds[6] = rnds[6] & 0x0f | 0x40;
-    rnds[8] = rnds[8] & 0x3f | 0x80; // Copy bytes to buffer, if provided
-
-    if (buf) {
-      offset = offset || 0;
-
-      for (var i = 0; i < 16; ++i) {
-        buf[offset + i] = rnds[i];
-      }
-
-      return buf;
-    }
-
-    return stringify(rnds);
-  }
-
   class StorageUtilityBrowser extends solidClientAuthnCore.StorageUtility {
       constructor(secureStorage, insecureStorage) {
           super(secureStorage, insecureStorage);
       }
   }
 
-  function processErrorResponse(responseBody, options) {
-      var _a, _b, _c, _d;
-      if (responseBody.error === "invalid_redirect_uri") {
-          throw new Error(`Dynamic client registration failed: the provided redirect uri [${(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()}] is invalid - ${(_b = responseBody.error_description) !== null && _b !== void 0 ? _b : ""}`);
-      }
-      if (responseBody.error === "invalid_client_metadata") {
-          throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${(_c = responseBody.error_description) !== null && _c !== void 0 ? _c : ""}`);
-      }
-      throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${(_d = responseBody.error_description) !== null && _d !== void 0 ? _d : ""}`);
-  }
-  function validateRegistrationResponse(responseBody, options) {
-      if (responseBody.client_id === undefined) {
-          throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(responseBody)}`);
-      }
-      if (options.redirectUrl &&
-          (responseBody.redirect_uris === undefined ||
-              responseBody.redirect_uris[0] !== options.redirectUrl.toString())) {
-          throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(responseBody.redirect_uris)} don't match the provided ${JSON.stringify([
-            options.redirectUrl.toString(),
-        ])}`);
-      }
-  }
-  async function registerClient(options, issuerConfig) {
-      var _a;
-      if (!issuerConfig.registrationEndpoint) {
-          throw new Error("Dynamic Registration could not be completed because the issuer has no registration endpoint.");
-      }
-      if (!Array.isArray(issuerConfig.idTokenSigningAlgValuesSupported)) {
-          throw new Error("The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.");
-      }
-      const signingAlg = solidClientAuthnCore.determineSigningAlg(issuerConfig.idTokenSigningAlgValuesSupported, solidClientAuthnCore.PREFERRED_SIGNING_ALG);
-      const config = {
-          client_name: options.clientName,
-          application_type: "web",
-          redirect_uris: [(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()],
-          subject_type: "public",
-          token_endpoint_auth_method: "client_secret_basic",
-          id_token_signed_response_alg: signingAlg,
-          grant_types: ["authorization_code", "refresh_token"],
-      };
-      const headers = {
-          "Content-Type": "application/json",
-      };
-      if (options.registrationAccessToken) {
-          headers.Authorization = `Bearer ${options.registrationAccessToken}`;
-      }
-      const registerResponse = await fetch(issuerConfig.registrationEndpoint.toString(), {
-          method: "POST",
-          headers,
-          body: JSON.stringify(config),
-      });
-      if (registerResponse.ok) {
-          const responseBody = await registerResponse.json();
-          validateRegistrationResponse(responseBody, options);
-          return {
-              clientId: responseBody.client_id,
-              clientSecret: responseBody.client_secret,
-              idTokenSignedResponseAlg: responseBody.id_token_signed_response_alg,
-              clientType: "dynamic",
-          };
-      }
-      if (registerResponse.status === 400) {
-          processErrorResponse(await registerResponse.json(), options);
-      }
-      throw new Error(`Dynamic client registration failed: the server returned ${registerResponse.status} ${registerResponse.statusText} - ${await registerResponse.text()}`);
-  }
-
-  function hasError(value) {
-      return value.error !== undefined && typeof value.error === "string";
-  }
-  function hasErrorDescription(value) {
-      return (value.error_description !== undefined &&
-          typeof value.error_description === "string");
-  }
-  function hasErrorUri(value) {
-      return value.error_uri !== undefined && typeof value.error_uri === "string";
-  }
-  function hasAccessToken(value) {
-      return (value.access_token !== undefined && typeof value.access_token === "string");
-  }
-  function hasIdToken(value) {
-      return value.id_token !== undefined && typeof value.id_token === "string";
-  }
-  function hasRefreshToken(value) {
-      return (value.refresh_token !== undefined && typeof value.refresh_token === "string");
-  }
-  function hasTokenType(value) {
-      return value.token_type !== undefined && typeof value.token_type === "string";
-  }
-  function hasExpiresIn(value) {
-      return value.expires_in === undefined || typeof value.expires_in === "number";
-  }
-  function validatePreconditions(issuer, data) {
-      if (data.grantType &&
-          (!issuer.grantTypesSupported ||
-              !issuer.grantTypesSupported.includes(data.grantType))) {
-          throw new Error(`The issuer [${issuer.issuer}] does not support the [${data.grantType}] grant`);
-      }
-      if (!issuer.tokenEndpoint) {
-          throw new Error(`This issuer [${issuer.issuer}] does not have a token endpoint`);
-      }
-  }
-  function validateTokenEndpointResponse(tokenResponse, dpop) {
-      if (hasError(tokenResponse)) {
-          throw new solidClientAuthnCore.OidcProviderError(`Token endpoint returned error [${tokenResponse.error}]${hasErrorDescription(tokenResponse)
-            ? `: ${tokenResponse.error_description}`
-            : ""}${hasErrorUri(tokenResponse) ? ` (see ${tokenResponse.error_uri})` : ""}`, tokenResponse.error, hasErrorDescription(tokenResponse)
-              ? tokenResponse.error_description
-              : undefined);
-      }
-      if (!hasAccessToken(tokenResponse)) {
-          throw new solidClientAuthnCore.InvalidResponseError(["access_token"]);
-      }
-      if (!hasIdToken(tokenResponse)) {
-          throw new solidClientAuthnCore.InvalidResponseError(["id_token"]);
-      }
-      if (!hasTokenType(tokenResponse)) {
-          throw new solidClientAuthnCore.InvalidResponseError(["token_type"]);
-      }
-      if (!hasExpiresIn(tokenResponse)) {
-          throw new solidClientAuthnCore.InvalidResponseError(["expires_in"]);
-      }
-      if (!dpop && tokenResponse.token_type.toLowerCase() !== "bearer") {
-          throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${tokenResponse.token_type}].`);
-      }
-      return tokenResponse;
-  }
-  async function getTokens(issuer, client, data, dpop) {
-      validatePreconditions(issuer, data);
-      const headers = {
-          "content-type": "application/x-www-form-urlencoded",
-      };
-      let dpopKey;
-      if (dpop) {
-          dpopKey = await solidClientAuthnCore.generateDpopKeyPair();
-          headers.DPoP = await solidClientAuthnCore.createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey);
-      }
-      if (client.clientSecret) {
-          headers.Authorization = `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`;
-      }
-      const requestBody = {
-          grant_type: data.grantType,
-          redirect_uri: data.redirectUrl,
-          code: data.code,
-          code_verifier: data.codeVerifier,
-          client_id: client.clientId,
-      };
-      const tokenRequestInit = {
-          method: "POST",
-          headers,
-          body: new URLSearchParams(requestBody).toString(),
-      };
-      const rawTokenResponse = await await fetch(issuer.tokenEndpoint, tokenRequestInit);
-      const jsonTokenResponse = (await rawTokenResponse.json());
-      const tokenResponse = validateTokenEndpointResponse(jsonTokenResponse, dpop);
-      const webId = await solidClientAuthnCore.getWebidFromTokenPayload(tokenResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-      return {
-          accessToken: tokenResponse.access_token,
-          idToken: tokenResponse.id_token,
-          refreshToken: hasRefreshToken(tokenResponse)
-              ? tokenResponse.refresh_token
-              : undefined,
-          webId,
-          dpopKey,
-          expiresIn: tokenResponse.expires_in,
-      };
-  }
-  async function getBearerToken(redirectUrl) {
-      let signinResponse;
-      try {
-          const client = new oidcClient.OidcClient({
-              response_mode: "query",
-              loadUserInfo: false,
-          });
-          signinResponse = await client.processSigninResponse(redirectUrl);
-          if (client.settings.metadata === undefined) {
-              throw new Error("Cannot retrieve issuer metadata from client information in storage.");
-          }
-          if (client.settings.metadata.jwks_uri === undefined) {
-              throw new Error("Missing some issuer metadata from client information in storage: 'jwks_uri' is undefined");
-          }
-          if (client.settings.metadata.issuer === undefined) {
-              throw new Error("Missing some issuer metadata from client information in storage: 'issuer' is undefined");
-          }
-          if (client.settings.client_id === undefined) {
-              throw new Error("Missing some client information in storage: 'client_id' is undefined");
-          }
-          const webId = await solidClientAuthnCore.getWebidFromTokenPayload(signinResponse.id_token, client.settings.metadata.jwks_uri, client.settings.metadata.issuer, client.settings.client_id);
-          return {
-              accessToken: signinResponse.access_token,
-              idToken: signinResponse.id_token,
-              webId,
-              refreshToken: signinResponse.refresh_token,
-          };
-      }
-      catch (err) {
-          throw new Error(`Problem handling Auth Code Grant (Flow) redirect - URL [${redirectUrl}]: ${err}`);
-      }
-  }
-  async function getDpopToken(issuer, client, data) {
-      return getTokens(issuer, client, data, true);
-  }
-
-  async function refresh(refreshToken, issuer, client, dpopKey) {
-      const requestBody = {
-          grant_type: "refresh_token",
-          refresh_token: refreshToken,
-          scope: "openid offline_access",
-      };
-      let dpopHeader = {};
-      if (dpopKey !== undefined) {
-          dpopHeader = {
-              DPoP: await solidClientAuthnCore.createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey),
-          };
-      }
-      let authHeader = {};
-      if (client.clientSecret !== undefined) {
-          authHeader = {
-              Authorization: `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`,
-          };
-      }
-      const rawResponse = await fetch(issuer.tokenEndpoint, {
-          method: "POST",
-          body: new URLSearchParams(requestBody).toString(),
-          headers: {
-              ...dpopHeader,
-              ...authHeader,
-              "Content-Type": "application/x-www-form-urlencoded",
-          },
-      });
-      let response;
-      try {
-          response = await rawResponse.json();
-      }
-      catch (e) {
-          throw new Error(`The token endpoint of issuer ${issuer.issuer} returned a malformed response.`);
-      }
-      const validatedResponse = validateTokenEndpointResponse(response, dpopKey !== undefined);
-      const webId = await solidClientAuthnCore.getWebidFromTokenPayload(validatedResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-      return {
-          accessToken: validatedResponse.access_token,
-          idToken: validatedResponse.id_token,
-          refreshToken: typeof validatedResponse.refresh_token === "string"
-              ? validatedResponse.refresh_token
-              : undefined,
-          webId,
-          dpopKey,
-          expiresIn: validatedResponse.expires_in,
-      };
-  }
-
-  function removeOidcQueryParam(redirectUrl) {
-      const cleanedUrl = new URL(redirectUrl);
-      cleanedUrl.searchParams.delete("code");
-      cleanedUrl.searchParams.delete("state");
-      cleanedUrl.hash = "";
-      return cleanedUrl.toString();
-  }
-  async function clearOidcPersistentStorage() {
-      const client = new oidcClient.OidcClient({
-          response_mode: "query",
-      });
-      await client.clearStaleState(new oidcClient.WebStorageStateStore({}));
-      const myStorage = window.localStorage;
-      const itemsToRemove = [];
-      for (let i = 0; i <= myStorage.length; i += 1) {
-          const key = myStorage.key(i);
-          if (key &&
-              (key.match(/^oidc\..+$/) ||
-                  key.match(/^solidClientAuthenticationUser:.+$/))) {
-              itemsToRemove.push(key);
-          }
-      }
-      itemsToRemove.forEach((key) => myStorage.removeItem(key));
-  }
-
   const globalFetch = (request, init) => window.fetch(request, init);
   class ClientAuthentication {
       constructor(loginHandler, redirectHandler, logoutHandler, sessionInfoManager, issuerConfigFetcher) {
@@ -843,7 +493,7 @@
           this.login = async (options, eventEmitter) => {
               var _a, _b;
               await this.sessionInfoManager.clear(options.sessionId);
-              const redirectUrl = removeOidcQueryParam((_a = options.redirectUrl) !== null && _a !== void 0 ? _a : window.location.href);
+              const redirectUrl = oidcClientExt.removeOidcQueryParam((_a = options.redirectUrl) !== null && _a !== void 0 ? _a : window.location.href);
               await this.loginHandler.handle({
                   ...options,
                   redirectUrl,
@@ -961,7 +611,7 @@
               code_verifier: true,
               prompt: (_a = oidcLoginOptions.prompt) !== null && _a !== void 0 ? _a : "consent",
           };
-          const oidcClientLibrary = new oidcClient.OidcClient(oidcOptions);
+          const oidcClientLibrary = new oidcClientExt.OidcClient(oidcOptions);
           const { redirector } = this;
           const storage = this.storageUtility;
           try {
@@ -1117,7 +767,7 @@
   function getUnauthenticatedSession() {
       return {
           isLoggedIn: false,
-          sessionId: v4(),
+          sessionId: uuid.v4(),
           fetch,
       };
   }
@@ -1127,7 +777,7 @@
           storage.deleteAllUserData(sessionId, { secure: true }),
           storage.delete("clientKey", { secure: false }),
       ]);
-      await clearOidcPersistentStorage();
+      await oidcClientExt.clearOidcPersistentStorage();
   }
   class SessionInfoManager {
       constructor(storageUtility) {
@@ -1265,7 +915,7 @@
           let tokens;
           const tokenCreatedAt = Date.now();
           if (isDpop) {
-              tokens = await getDpopToken(issuerConfig, client, {
+              tokens = await oidcClientExt.getDpopToken(issuerConfig, client, {
                   grantType: "authorization_code",
                   code: url.searchParams.get("code"),
                   codeVerifier,
@@ -1274,7 +924,7 @@
               window.localStorage.removeItem(`oidc.${oauthState}`);
           }
           else {
-              tokens = await getBearerToken(url.toString());
+              tokens = await oidcClientExt.getBearerToken(url.toString());
           }
           let refreshOptions;
           if (tokens.refreshToken !== undefined) {
@@ -1413,7 +1063,7 @@
           extendedOptions.registrationAccessToken =
               (_a = extendedOptions.registrationAccessToken) !== null && _a !== void 0 ? _a : (await this.storageUtility.getForUser(options.sessionId, "registrationAccessToken"));
           try {
-              const registeredClient = await registerClient(extendedOptions, issuerConfig);
+              const registeredClient = await oidcClientExt.registerClient(extendedOptions, issuerConfig);
               const infoToSave = {
                   clientId: registeredClient.clientId,
               };
@@ -1470,7 +1120,7 @@
           if (oidcContext.dpop && dpopKey === undefined) {
               throw new Error(`For session [${sessionId}], the key bound to the DPoP access token must be provided to refresh said access token.`);
           }
-          const tokenSet = await refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
+          const tokenSet = await oidcClientExt.refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
           if (tokenSet.refreshToken !== undefined) {
               eventEmitter === null || eventEmitter === void 0 ? void 0 : eventEmitter.emit(solidClientAuthnCore.EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
               await this.storageUtility.setForUser(sessionId, {
@@ -1611,7 +1261,7 @@
           }
           else {
               this.info = {
-                  sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : v4(),
+                  sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : uuid.v4(),
                   isLoggedIn: false,
               };
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inrupt/solid-client-authn-browser",
-  "version": "1.11.9-alpha.1",
+  "version": "1.11.9-alpha.2",
   "license": "MIT",
   "browser": "dist/solid-client-authn.bundle.js",
   "main": "dist/index.js",
@@ -25,8 +25,8 @@
     "build-docs-preview-site": "npm run build-api-docs; cd docs/api; make html"
   },
   "dependencies": {
-    "@inrupt/oidc-client-ext": "^1.11.9-alpha.1",
-    "@inrupt/solid-client-authn-core": "^1.11.9-alpha.1",
+    "@inrupt/oidc-client-ext": "^1.11.9-alpha.2",
+    "@inrupt/solid-client-authn-core": "^1.11.9-alpha.2",
     "@types/lodash.clonedeep": "^4.5.6",
     "@types/node": "^17.0.2",
     "@types/uuid": "^8.3.0",
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "f6eabf0ccb5b5b818afc1015a5d1605bfd61461a"
+  "gitHead": "efdd6c8909e7bfb7360bdf976d7a122259ef0183"
 }

package/rollup.config.js

@@ -34,11 +34,6 @@ export default {
     nodeResolve({
       browser: true,
       preferBuiltins: true,
-      resolveOnly: [
-        "uuid",
-        "@inrupt/solid-client-authn-core",
-        "@inrupt/oidc-client-ext",
-      ],
     }),
     typescript({
       // Use our own version of TypeScript, rather than the one bundled with the plugin:
@@ -50,5 +45,10 @@ export default {
       },
     }),
   ],
-  external: ["@inrupt/solid-client", "@inrupt/solid-client-authn-core"],
+  external: [
+    "@inrupt/solid-client",
+    "@inrupt/solid-client-authn-core",
+    "@inrupt/oidc-client-ext",
+    "uuid",
+  ],
 };