@itwin/map-layers-auth 4.3.0-dev.9 → 4.4.0-dev.1

package/CHANGELOG.md

@@ -1,6 +1,33 @@
 # Change Log - @itwin/map-layers-auth
 
-This log was last generated on Mon, 16 Oct 2023 12:52:11 GMT and should not be manually modified.
+This log was last generated on Thu, 30 Nov 2023 17:07:27 GMT and should not be manually modified.
+
+## 4.2.4
+Mon, 20 Nov 2023 16:14:45 GMT
+
+_Version update only_
+
+## 4.2.3
+Mon, 06 Nov 2023 14:01:52 GMT
+
+_Version update only_
+
+## 4.2.2
+Thu, 02 Nov 2023 15:36:21 GMT
+
+### Updates
+
+- Fix legacy token flow for ArcGIS services not supporting Oauth2.
+
+## 4.2.1
+Tue, 24 Oct 2023 15:09:13 GMT
+
+_Version update only_
+
+## 4.2.0
+Tue, 17 Oct 2023 15:14:32 GMT
+
+_Version update only_
 
 ## 4.1.9
 Tue, 10 Oct 2023 18:48:12 GMT
@@ -98,6 +125,11 @@ Mon, 22 May 2023 15:34:14 GMT
 - Update to eslint@8
 - Upgrade TypeScript compile target to es2021.
 
+## 3.7.17
+Mon, 20 Nov 2023 18:24:23 GMT
+
+_Version update only_
+
 ## 3.7.16
 Mon, 16 Oct 2023 12:49:08 GMT
 

package/lib/cjs/ArcGis/ArcGisAccessClient.d.ts

@@ -35,6 +35,8 @@ export declare class ArcGisAccessClient implements MapLayerAccessClient {
     private initOauthCallbackFunction;
     unInitialize(): void;
     getAccessToken(params: MapLayerAccessTokenParams): Promise<MapLayerAccessToken | undefined>;
+    /** @internal */
+    static validateOAuth2Endpoint(endpointUrl: string): Promise<boolean>;
     getTokenServiceEndPoint(mapLayerUrl: string): Promise<MapLayerTokenEndpoint | undefined>;
     invalidateToken(token: MapLayerAccessToken): boolean;
     get redirectUri(): string | undefined;
@@ -47,8 +49,7 @@ export declare class ArcGisAccessClient implements MapLayerAccessClient {
     removeEnterpriseClientId(clientId: ArcGisEnterpriseClientId): void;
     /** @internal */
     private getOAuthTokenForMapLayerUrl;
-    private _oauthAuthorizeEndPointsCache;
-    private _oauthTokenEndPointsCache;
+    private _endPointsCache;
     /**
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal
@@ -64,6 +65,7 @@ export declare class ArcGisAccessClient implements MapLayerAccessClient {
     * @internal
     */
     private isArcGisHostValid;
+    private validateEndpointUrl;
     /**
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal

package/lib/cjs/ArcGis/ArcGisAccessClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ArcGisAccessClient.d.ts","sourceRoot":"","sources":["../../../src/ArcGis/ArcGisAccessClient.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,OAAO,EAAU,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAMnI,YAAY;AACZ,MAAM,WAAW,wBAAwB;IAGvC,cAAc,EAAE,MAAM,CAAC;IAGvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,YAAY;AACZ,MAAM,WAAW,oBAAoB;IAEnC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,mBAAmB,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAClD;AAED;;;;EAIE;AACF,MAAM,WAAW,iBAAiB;IAIhC,WAAW,EAAE,MAAM,CAAC;IAGpB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,SAAS,EAAE,oBAAoB,CAAC;CACjC;AAED,YAAY;AACZ,qBAAa,kBAAmB,YAAW,oBAAoB;IAC7D,SAAgB,iBAAiB,kDAAiB;IAClD,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,UAAU,CAAmC;IAGrD,OAAO,CAAC,iBAAiB,CAAS;;IAK3B,UAAU,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,OAAO;IAW3D,OAAO,CAAC,yBAAyB;IAoC1B,YAAY;IAMN,cAAc,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAgB3F,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAkB9F,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO;IAQ3D,IAAW,WAAW,uBAErB;IAEM,6BAA6B,CAAC,GAAG,EAAE,MAAM;IA0BhD,IAAW,UAAU,uBAEpB;IAED,IAAW,oBAAoB,IAIW,MAAM,GAAG,SAAS,CAF3D;IAED,IAAW,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAK3D;IAED,IAAW,yBAAyB,2CAEnC;IAEM,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAiB9D,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB;IASlE,gBAAgB;YACF,2BAA2B;IAczC,OAAO,CAAC,6BAA6B,CAA0B;IAC/D,OAAO,CAAC,yBAAyB,CAA0B;IAE3D;;;KAGC;IACD,OAAO,CAAC,aAAa;IAQrB;;;KAGC;YACa,cAAc;IAO5B;;;MAGE;IACF,OAAO,CAAC,iBAAiB;IAQzB;;;KAGC;YACa,iBAAiB;IAmD/B;;;KAGC;IACD,OAAO,CAAC,iBAAiB;CA8B1B"}
+{"version":3,"file":"ArcGisAccessClient.d.ts","sourceRoot":"","sources":["../../../src/ArcGis/ArcGisAccessClient.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,OAAO,EAAU,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAMnI,YAAY;AACZ,MAAM,WAAW,wBAAwB;IAGvC,cAAc,EAAE,MAAM,CAAC;IAGvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,YAAY;AACZ,MAAM,WAAW,oBAAoB;IAEnC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,mBAAmB,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAClD;AAED;;;;EAIE;AACF,MAAM,WAAW,iBAAiB;IAIhC,WAAW,EAAE,MAAM,CAAC;IAGpB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,SAAS,EAAE,oBAAoB,CAAC;CACjC;AASD,YAAY;AACZ,qBAAa,kBAAmB,YAAW,oBAAoB;IAC7D,SAAgB,iBAAiB,kDAAiB;IAClD,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,UAAU,CAAmC;IAGrD,OAAO,CAAC,iBAAiB,CAAS;;IAK3B,UAAU,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,OAAO;IAW3D,OAAO,CAAC,yBAAyB;IAoC1B,YAAY;IAMN,cAAc,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAgBxG,gBAAgB;WACI,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpE,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAQ9F,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO;IAQ3D,IAAW,WAAW,uBAErB;IAEM,6BAA6B,CAAC,GAAG,EAAE,MAAM;IA0BhD,IAAW,UAAU,uBAEpB;IAED,IAAW,oBAAoB,IAIW,MAAM,GAAG,SAAS,CAF3D;IAED,IAAW,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAK3D;IAED,IAAW,yBAAyB,2CAEnC;IAEM,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAiB9D,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB;IASlE,gBAAgB;YACF,2BAA2B;IAezC,OAAO,CAAC,eAAe,CAA+C;IAEtE;;;KAGC;IACD,OAAO,CAAC,aAAa;IAKrB;;;KAGC;YACa,cAAc;IAO5B;;;MAGE;IACF,OAAO,CAAC,iBAAiB;YAQX,mBAAmB;IAYjC;;;KAGC;YACa,iBAAiB;IA8D/B;;;KAGC;IACD,OAAO,CAAC,iBAAiB;CA8B1B"}

package/lib/cjs/ArcGis/ArcGisAccessClient.js

@@ -19,11 +19,10 @@ class ArcGisAccessClient {
         this.onOAuthProcessEnd = new core_bentley_1.BeEvent();
         // Should be kept to 'false'. Debugging purposes only.
         this._forceLegacyToken = false;
-        // Derive the Oauth URL from a typical MapLayerURL
+        // Mapping between a map-layer URL and its corresponding Oauth endpoint
         // i.e. 	  https://hostname/server/rest/services/NewYork/NewYork3857/MapServer
         //      =>  https://hostname/portal/sharing/oauth2/authorize
-        this._oauthAuthorizeEndPointsCache = new Map();
-        this._oauthTokenEndPointsCache = new Map();
+        this._endPointsCache = new Map();
     }
     initialize(oAuthConfig) {
         if (oAuthConfig) {
@@ -84,20 +83,16 @@ class ArcGisAccessClient {
         }
         return undefined;
     }
+    /** @internal */
+    static async validateOAuth2Endpoint(endpointUrl) {
+        const data = await fetch(endpointUrl, { method: "GET" });
+        return data.status === 400; // Oauth2 API returns 400 (Bad Request) when there are missing parameters
+    }
     async getTokenServiceEndPoint(mapLayerUrl) {
-        let tokenEndpoint;
         if (!this._forceLegacyToken) {
-            // Note: we used to validate the endpoint by making a request, but because of CORS isssues with some servers
-            // we could not make a reliable validation.
-            try {
-                tokenEndpoint = await this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2Endpoint_1.ArcGisOAuth2EndpointType.Authorize);
-                if (tokenEndpoint) {
-                }
-            }
-            catch {
-            }
+            return this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2Endpoint_1.ArcGisOAuth2EndpointType.Authorize);
         }
-        return tokenEndpoint;
+        return undefined;
     }
     invalidateToken(token) {
         let found = ArcGisTokenManager_1.ArcGisTokenManager.invalidateToken(token);
@@ -187,22 +182,18 @@ class ArcGisAccessClient {
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal
    */
-    cacheEndpoint(url, endpoint, obj) {
-        if (endpoint === ArcGisOAuth2Endpoint_1.ArcGisOAuth2EndpointType.Authorize) {
-            this._oauthAuthorizeEndPointsCache.set(url, obj);
-        }
-        else {
-            this._oauthTokenEndPointsCache.set(url, obj);
-        }
+    cacheEndpoint(url, endpointType, endPoint) {
+        const entry = endpointType === ArcGisOAuth2Endpoint_1.ArcGisOAuth2EndpointType.Authorize ? { authorizeEndpoint: endPoint } : { tokenEndpoint: endPoint };
+        this._endPointsCache.set(url, entry);
     }
     /**
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal
    */
-    async createEndpoint(url, endpoint) {
+    async createEndpoint(mapLayerUrl, oauthEndpointUrl, endpointType) {
         // Validate the URL we just composed
-        const oauthEndpoint = new ArcGisOAuth2Endpoint_1.ArcGisOAuth2Endpoint(url, this.constructLoginUrl(url, false), false);
-        this.cacheEndpoint(url, endpoint, oauthEndpoint);
+        const oauthEndpoint = new ArcGisOAuth2Endpoint_1.ArcGisOAuth2Endpoint(oauthEndpointUrl, this.constructLoginUrl(oauthEndpointUrl, false), false);
+        this.cacheEndpoint(mapLayerUrl, endpointType, oauthEndpoint);
         return oauthEndpoint;
     }
     /**
@@ -215,18 +206,30 @@ class ArcGisAccessClient {
         ];
         return allowedHosts.some((host) => url.hostname.toLowerCase().endsWith(host));
     }
+    async validateEndpointUrl(url) {
+        let valid;
+        try {
+            valid = await ArcGisAccessClient.validateOAuth2Endpoint(url.toString());
+        }
+        catch {
+            // If we reach here, this means we could not validate properly the endpoint;
+            // we cannot conclude the endpoint is invalid though; it might happen endpoint doesn't support CORS requests,
+            // but still valid for Oauth process.
+        }
+        return valid;
+    }
     /**
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal
    */
-    async getOAuth2Endpoint(url, endpointType) {
+    async getOAuth2Endpoint(mapLayerUrl, endpointType) {
         // Return from cache if available
-        const cachedEndpoint = (endpointType === ArcGisOAuth2Endpoint_1.ArcGisOAuth2EndpointType.Authorize ? this._oauthAuthorizeEndPointsCache.get(url) : this._oauthTokenEndPointsCache.get(url));
+        const cachedEndpoint = this._endPointsCache.get(mapLayerUrl);
         if (cachedEndpoint !== undefined) {
-            return cachedEndpoint;
+            return (endpointType === ArcGisOAuth2Endpoint_1.ArcGisOAuth2EndpointType.Authorize ? cachedEndpoint.authorizeEndpoint : cachedEndpoint.authorizeEndpoint);
         }
         const endpointStr = (endpointType === ArcGisOAuth2Endpoint_1.ArcGisOAuth2EndpointType.Authorize ? "authorize" : "token");
-        const urlObj = new URL(url);
+        const urlObj = new URL(mapLayerUrl);
         if (this.isArcGisHostValid(urlObj)) {
             // ArcGIS Online (fixed)
             // Doc: https://developers.arcgis.com/documentation/mapping-apis-and-services/security/oauth-2.0/
@@ -243,24 +246,34 @@ class ArcGisAccessClient {
                 if (restUrlFromTokenService === undefined) {
                     // We could not derive the token endpoint from 'tokenServicesUrl'.
                     // ArcGIS Enterprise Format https://<host>:<port>/<subdirectory>/sharing/rest/oauth2/authorize
-                    const regExMatch = url.match(new RegExp(/([^&\/]+)\/rest\/services\/.*/, "i"));
+                    const regExMatch = mapLayerUrl.match(new RegExp(/([^&\/]+)\/rest\/services\/.*/, "i"));
                     if (regExMatch !== null && regExMatch.length >= 2) {
                         const subdirectory = regExMatch[1];
                         const port = (urlObj.port !== "80" && urlObj.port !== "443") ? `:${urlObj.port}` : "";
                         const newUrlObj = new URL(`${urlObj.protocol}//${urlObj.hostname}${port}/${subdirectory}/sharing/rest/oauth2/${endpointStr}`);
                         // Check again the URL we just composed
-                        return await this.createEndpoint(newUrlObj.toString(), endpointType);
+                        const isValidUrl = await this.validateEndpointUrl(newUrlObj.toString());
+                        if (isValidUrl === undefined || isValidUrl) {
+                            const endpoint = await this.createEndpoint(mapLayerUrl, newUrlObj.toString(), endpointType);
+                            if (endpoint)
+                                return endpoint;
+                        }
                     }
                 }
                 else {
-                    const endpoint = await this.createEndpoint(`${restUrlFromTokenService.toString()}oauth2/${endpointStr}`, endpointType);
-                    if (endpoint)
-                        return endpoint;
+                    const isValidUrl = await this.validateEndpointUrl(restUrlFromTokenService.toString());
+                    if (isValidUrl === undefined || isValidUrl) {
+                        const endpoint = await this.createEndpoint(mapLayerUrl, `${restUrlFromTokenService.toString()}oauth2/${endpointStr}`, endpointType);
+                        if (endpoint)
+                            return endpoint;
+                    }
                 }
             }
             catch {
             }
         }
+        // If we reach here, we were not successful creating an endpoint
+        this._endPointsCache.set(mapLayerUrl, {}); // Cache an empty entry, and avoid making repeated failing requests.
         return undefined; // we could not find any valid oauth2 endpoint
     }
     /**

package/lib/cjs/ArcGis/ArcGisAccessClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"ArcGisAccessClient.js","sourceRoot":"","sources":["../../../src/ArcGis/ArcGisAccessClient.ts"],"names":[],"mappings":";AAAA;;;+FAG+F;AAC/F;;GAEG;;;AAEH,sDAAsD;AAEtD,iEAAkF;AAClF,iEAAwF;AACxF,6DAA0D;AAC1D,2CAAwC;AAuCxC,YAAY;AACZ,MAAa,kBAAkB;IAS7B;QARgB,sBAAiB,GAAG,IAAI,sBAAO,EAAE,CAAC;QAKlD,sDAAsD;QAC9C,sBAAiB,GAAG,KAAK,CAAC;QA2LlC,kDAAkD;QAClD,8EAA8E;QAC9E,4DAA4D;QACpD,kCAA6B,GAAG,IAAI,GAAG,EAAe,CAAC;QACvD,8BAAyB,GAAG,IAAI,GAAG,EAAe,CAAC;IA5L3D,CAAC;IAEM,UAAU,CAAC,WAA+B;QAC/C,IAAI,WAAW,EAAE;YACf,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,eAAe,CAAC;YAC/C,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC;YAExC,IAAI,CAAC,yBAAyB,EAAE,CAAC;SAClC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,yBAAyB;QAC9B,MAAc,CAAC,oBAAoB,GAAG,CAAC,gBAA2B,EAAE,EAAE;YACrE,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,SAAS,CAAC;YAEd,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;gBACxD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC;gBAC3C,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;gBAC1D,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;gBAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;gBACzD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;gBAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;gBACtD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;gBACrD,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE;oBAC9H,IAAI,cAAc,CAAC;oBACnB,IAAI;wBACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBACnC,SAAS,GAAG,KAAK,EAAE,UAAU,CAAC;wBAC9B,cAAc,GAAG,KAAK,EAAE,cAAc,CAAC;qBAExC;oBAAC,MAAM;qBACP;oBACD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;oBACvC,MAAM,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAG,6EAA6E;oBACrI,IAAI,cAAc,KAAK,SAAS,EAAE;wBAChC,uCAAkB,CAAC,cAAc,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;wBAChG,YAAY,GAAG,IAAI,CAAC;qBACrB;iBAEF;aACF;YACD,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC,CAAC;IACJ,CAAC;IAEM,YAAY;QACjB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC5B,MAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,MAAiC;QAC3D,+FAA+F;QAE/F,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1F,IAAI,WAAW;gBACb,OAAO,WAAW,CAAC;SACtB;QAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE;YACtC,OAAO,uCAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,4CAAqB,CAAC,OAAO,EAAE,CAAC,CAAC;SAChJ;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAAC,WAAmB;QACtD,IAAI,aAA+C,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC3B,4GAA4G;YAC5G,2CAA2C;YAC3C,IAAI;gBACF,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,+CAAwB,CAAC,SAAS,CAAC,CAAC;gBAC9F,IAAI,aAAa,EAAE;iBAElB;aACF;YAAC,MAAM;aAEP;SACF;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAEM,eAAe,CAAC,KAA0B;QAC/C,IAAI,KAAK,GAAG,uCAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE;YACV,KAAK,GAAG,uCAAkB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;SACzD;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEM,6BAA6B,CAAC,GAAW;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE;YACd,OAAO,SAAS,CAAC;SAClB;QAED,IAAI,QAA4B,CAAC;QACjC,IAAI,eAAmC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE;YAC7B,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,EAAE;gBAC/B,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC;aAClC;iBAAM;gBACL,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;oBACtD,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;iBAC3B;aACF;SACF;QAED,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE;YAC3D,QAAQ,GAAG,eAAe,CAAC;SAC5B;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAW,oBAAoB;QAC7B,OAAO,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC/C,CAAC;IAED,IAAW,oBAAoB,CAAC,QAA4B;QAC1D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;YACjC,IAAI,CAAC,UAAU,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;SACtD;QACD,IAAI,CAAC,UAAU,CAAC,oBAAoB,GAAG,QAAQ,CAAC;IAClD,CAAC;IAED,IAAW,yBAAyB;QAClC,OAAO,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAC9C,CAAC;IAEM,qBAAqB,CAAC,cAAsB,EAAE,QAAgB;QAEnE,IAAI,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc,CAAC,CAAC;YACnH,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE;gBACnB,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;aACnE;iBAAM;gBACL,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;aACxE;SACF;aAAM;YACL,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;gBACjC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;aACtB;YACD,IAAI,CAAC,UAAU,CAAC,mBAAmB,GAAG,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;SACtE;IACH,CAAC;IAEM,wBAAwB,CAAC,QAAkC;QAEhE,IAAI,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE;YACxC,IAAI,CAAC,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAAC,CAAC;SAC/I;IAEH,CAAC;IAED,cAAc;IACd,gBAAgB;IACR,KAAK,CAAC,2BAA2B,CAAC,WAAmB;QAC3D,IAAI;YACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,+CAAwB,CAAC,SAAS,CAAC,CAAC;YACpG,IAAI,aAAa,KAAK,SAAS,EAAE;gBAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzD,OAAO,uCAAkB,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;aACnE;SACF;QAAC,MAAM,GAAG;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAQD;;;KAGC;IACO,aAAa,CAAC,GAAW,EAAE,QAAkC,EAAE,GAAyB;QAC9F,IAAI,QAAQ,KAAK,+CAAwB,CAAC,SAAS,EAAE;YACnD,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;SAClD;aAAM;YACL,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;SAC9C;IACH,CAAC;IAED;;;KAGC;IACO,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,QAAkC;QAC1E,oCAAoC;QACpC,MAAM,aAAa,GAAG,IAAI,2CAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/F,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACjD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;MAGE;IACM,iBAAiB,CAAC,GAAQ;QAChC,MAAM,YAAY,GAAG;YACnB,YAAY;SACb,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAED;;;KAGC;IACO,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,YAAsC;QACjF,iCAAiC;QACjC,MAAM,cAAc,GAAG,CAAC,YAAY,KAAK,+CAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrK,IAAI,cAAc,KAAK,SAAS,EAAE;YAChC,OAAO,cAAc,CAAC;SACvB;QAED,MAAM,WAAW,GAAG,CAAC,YAAY,KAAK,+CAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAElG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;YAClC,wBAAwB;YACxB,iGAAiG;YAEjG,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE;gBAC3C,OAAO,SAAS,CAAC;aAClB;YAED,MAAM,SAAS,GAAG,8CAA8C,WAAW,EAAE,CAAC;YAC9E,OAAO,IAAI,2CAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;SAC3F;aAAM;YAEL,wGAAwG;YACxG,IAAI;gBACF,MAAM,uBAAuB,GAAG,MAAM,qBAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;gBACvF,IAAI,uBAAuB,KAAK,SAAS,EAAE;oBACzC,kEAAkE;oBAClE,8FAA8F;oBAC9F,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC/E,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE;wBACjD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBACnC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,GAAG,IAAI,IAAI,YAAY,wBAAwB,WAAW,EAAE,CAAC,CAAC;wBAE9H,uCAAuC;wBACvC,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;qBACtE;iBACF;qBAAM;oBACL,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;oBACvH,IAAI,QAAQ;wBACV,OAAO,QAAQ,CAAC;iBACnB;aACF;YAAC,MAAM;aAEP;SAEF;QACD,OAAO,SAAS,CAAC,CAAG,8CAA8C;IACpE,CAAC;IAED;;;KAGC;IACO,iBAAiB,CAAC,GAAW,EAAE,cAAuB;QAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,oBAAoB;QACpB,IAAI,cAAc,EAAE;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;YAC3C,IAAA,qBAAM,EAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE;gBAC1B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;aAChD;SAEF;aAAM;YACL,MAAM,QAAQ,GAAG,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;YACzD,IAAA,qBAAM,EAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE;gBAC1B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;aAChD;SACF;QAED,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;YACjC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;SAC7D;QAED,IAAI,IAAI,CAAC,WAAW;YAClB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAE5D,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;CAEF;AApUD,gDAoUC","sourcesContent":["/*---------------------------------------------------------------------------------------------\r\n* Copyright (c) Bentley Systems, Incorporated. All rights reserved.\r\n* See LICENSE.md in the project root for license terms and full copyright notice.\r\n*--------------------------------------------------------------------------------------------*/\r\n/** @packageDocumentation\r\n * @module Tiles\r\n */\r\n\r\nimport { assert, BeEvent } from \"@itwin/core-bentley\";\r\nimport { MapLayerAccessClient, MapLayerAccessToken, MapLayerAccessTokenParams, MapLayerTokenEndpoint } from \"@itwin/core-frontend\";\r\nimport { ArcGisOAuth2Token, ArcGisTokenClientType } from \"./ArcGisTokenGenerator\";\r\nimport { ArcGisOAuth2Endpoint, ArcGisOAuth2EndpointType } from \"./ArcGisOAuth2Endpoint\";\r\nimport { ArcGisTokenManager } from \"./ArcGisTokenManager\";\r\nimport { ArcGisUrl } from \"./ArcGisUrl\";\r\n\r\n/** @beta */\r\nexport interface ArcGisEnterpriseClientId {\r\n  /* Oauth API endpoint base URL (i.e. https://hostname/portal/sharing/oauth2/authorize)\r\n  used to identify uniquely each enterprise server. */\r\n  serviceBaseUrl: string;\r\n\r\n  /* Application's clientId for this enterprise server.*/\r\n  clientId: string;\r\n}\r\n\r\n/** @beta */\r\nexport interface ArcGisOAuthClientIds {\r\n  /* Application's OAuth clientId in ArcGIS online */\r\n  arcgisOnlineClientId?: string;\r\n\r\n  /* Application's OAuth clientId for each enterprise server used. */\r\n  enterpriseClientIds?: ArcGisEnterpriseClientId[];\r\n}\r\n\r\n/** @beta\r\n * ArcGIS OAuth configurations parameters.\r\n * See https://developers.arcgis.com/documentation/mapping-apis-and-services/security/arcgis-identity/serverless-web-apps/\r\n * more details.\r\n*/\r\nexport interface ArcGisOAuthConfig {\r\n  /* URL to which a user is sent once they complete sign in authorization.\r\n    Must match a URI you define in the developer dashboard, otherwise, the authorization will be rejected.\r\n  */\r\n  redirectUri: string;\r\n\r\n  /* Optional expiration after which the token will expire. Defined in minutes with a maximum of two weeks (20160 minutes)*/\r\n  tokenExpiration?: number;\r\n\r\n  /* Application client Ids */\r\n  clientIds: ArcGisOAuthClientIds;\r\n}\r\n\r\n/** @beta */\r\nexport class ArcGisAccessClient implements MapLayerAccessClient {\r\n  public readonly onOAuthProcessEnd = new BeEvent();\r\n  private _redirectUri: string | undefined;\r\n  private _expiration: number | undefined;\r\n  private _clientIds: ArcGisOAuthClientIds | undefined;\r\n\r\n  // Should be kept to 'false'. Debugging purposes only.\r\n  private _forceLegacyToken = false;\r\n\r\n  public constructor() {\r\n  }\r\n\r\n  public initialize(oAuthConfig?: ArcGisOAuthConfig): boolean {\r\n    if (oAuthConfig) {\r\n      this._redirectUri = oAuthConfig.redirectUri;\r\n      this._expiration = oAuthConfig.tokenExpiration;\r\n      this._clientIds = oAuthConfig.clientIds;\r\n\r\n      this.initOauthCallbackFunction();\r\n    }\r\n    return true;\r\n  }\r\n\r\n  private initOauthCallbackFunction() {\r\n    (window as any).arcGisOAuth2Callback = (redirectLocation?: Location) => {\r\n      let eventSuccess = false;\r\n      let stateData;\r\n\r\n      if (redirectLocation && redirectLocation.hash.length > 0) {\r\n        const locationHash = redirectLocation.hash;\r\n        const hashParams = new URLSearchParams(locationHash.substring(1));\r\n        const token = hashParams.get(\"access_token\") ?? undefined;\r\n        const expiresInStr = hashParams.get(\"expires_in\") ?? undefined;\r\n        const userName = hashParams.get(\"username\") ?? undefined;\r\n        const ssl = hashParams.get(\"ssl\") === \"true\";\r\n        const stateStr = hashParams.get(\"state\") ?? undefined;\r\n        const persist = hashParams.get(\"persist\") === \"true\";\r\n        if (token !== undefined && expiresInStr !== undefined && userName !== undefined && ssl !== undefined && stateStr !== undefined) {\r\n          let endpointOrigin;\r\n          try {\r\n            const state = JSON.parse(stateStr);\r\n            stateData = state?.customData;\r\n            endpointOrigin = state?.endpointOrigin;\r\n\r\n          } catch {\r\n          }\r\n          const expiresIn = Number(expiresInStr);\r\n          const expiresAt = (expiresIn * 1000) + (+new Date());   // Converts the token expiration delay (seconds) into a timestamp (UNIX time)\r\n          if (endpointOrigin !== undefined) {\r\n            ArcGisTokenManager.setOAuth2Token(endpointOrigin, { token, expiresAt, ssl, userName, persist });\r\n            eventSuccess = true;\r\n          }\r\n\r\n        }\r\n      }\r\n      this.onOAuthProcessEnd.raiseEvent(eventSuccess, stateData);\r\n    };\r\n  }\r\n\r\n  public unInitialize() {\r\n    this._redirectUri = undefined;\r\n    this._expiration = undefined;\r\n    (window as any).arcGisOAuth2Callback = undefined;\r\n  }\r\n\r\n  public async getAccessToken(params: MapLayerAccessTokenParams): Promise<MapLayerAccessToken | undefined> {\r\n    // First lookup Oauth2 tokens, otherwise check try \"legacy tokens\" if credentials were provided\r\n\r\n    if (!this._forceLegacyToken) {\r\n      const oauth2Token = await this.getOAuthTokenForMapLayerUrl(params.mapLayerUrl.toString());\r\n      if (oauth2Token)\r\n        return oauth2Token;\r\n    }\r\n\r\n    if (params.userName && params.password) {\r\n      return ArcGisTokenManager.getToken(params.mapLayerUrl.toString(), params.userName, params.password, { client: ArcGisTokenClientType.referer });\r\n    }\r\n\r\n    return undefined;\r\n  }\r\n\r\n  public async getTokenServiceEndPoint(mapLayerUrl: string): Promise<MapLayerTokenEndpoint | undefined> {\r\n    let tokenEndpoint: ArcGisOAuth2Endpoint | undefined;\r\n    if (!this._forceLegacyToken) {\r\n      // Note: we used to validate the endpoint by making a request, but because of CORS isssues with some servers\r\n      // we could not make a reliable validation.\r\n      try {\r\n        tokenEndpoint = await this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);\r\n        if (tokenEndpoint) {\r\n\r\n        }\r\n      } catch {\r\n\r\n      }\r\n    }\r\n\r\n    return tokenEndpoint;\r\n  }\r\n\r\n  public invalidateToken(token: MapLayerAccessToken): boolean {\r\n    let found = ArcGisTokenManager.invalidateToken(token);\r\n    if (!found) {\r\n      found = ArcGisTokenManager.invalidateOAuth2Token(token);\r\n    }\r\n    return found;\r\n  }\r\n\r\n  public get redirectUri() {\r\n    return this._redirectUri;\r\n  }\r\n\r\n  public getMatchingEnterpriseClientId(url: string) {\r\n    const clientIds = this.arcGisEnterpriseClientIds;\r\n    if (!clientIds) {\r\n      return undefined;\r\n    }\r\n\r\n    let clientId: string | undefined;\r\n    let defaultClientId: string | undefined;\r\n    for (const entry of clientIds) {\r\n      if (entry.serviceBaseUrl === \"\") {\r\n        defaultClientId = entry.clientId;\r\n      } else {\r\n        if (url.toLowerCase().startsWith(entry.serviceBaseUrl)) {\r\n          clientId = entry.clientId;\r\n        }\r\n      }\r\n    }\r\n\r\n    // If we could not find a match with serviceBaseUrl, and a default clientId\r\n    // was specified (i.e empty url), then use default clientId\r\n    if (clientId === undefined && defaultClientId !== undefined) {\r\n      clientId = defaultClientId;\r\n    }\r\n    return clientId;\r\n  }\r\n\r\n  public get expiration() {\r\n    return this._expiration;\r\n  }\r\n\r\n  public get arcGisOnlineClientId() {\r\n    return this._clientIds?.arcgisOnlineClientId;\r\n  }\r\n\r\n  public set arcGisOnlineClientId(clientId: string | undefined) {\r\n    if (this._clientIds === undefined) {\r\n      this._clientIds = { arcgisOnlineClientId: clientId };\r\n    }\r\n    this._clientIds.arcgisOnlineClientId = clientId;\r\n  }\r\n\r\n  public get arcGisEnterpriseClientIds() {\r\n    return this._clientIds?.enterpriseClientIds;\r\n  }\r\n\r\n  public setEnterpriseClientId(serviceBaseUrl: string, clientId: string) {\r\n\r\n    if (this._clientIds?.enterpriseClientIds) {\r\n      const foundIdx = this._clientIds.enterpriseClientIds.findIndex((entry) => entry.serviceBaseUrl === serviceBaseUrl);\r\n      if (foundIdx !== -1) {\r\n        this._clientIds.enterpriseClientIds[foundIdx].clientId = clientId;\r\n      } else {\r\n        this._clientIds.enterpriseClientIds.push({ serviceBaseUrl, clientId });\r\n      }\r\n    } else {\r\n      if (this._clientIds === undefined) {\r\n        this._clientIds = {};\r\n      }\r\n      this._clientIds.enterpriseClientIds = [{ serviceBaseUrl, clientId }];\r\n    }\r\n  }\r\n\r\n  public removeEnterpriseClientId(clientId: ArcGisEnterpriseClientId) {\r\n\r\n    if (this._clientIds?.enterpriseClientIds) {\r\n      this._clientIds.enterpriseClientIds = this._clientIds?.enterpriseClientIds?.filter((item) => item.serviceBaseUrl !== clientId.serviceBaseUrl);\r\n    }\r\n\r\n  }\r\n\r\n  /// //////////\r\n  /** @internal */\r\n  private async getOAuthTokenForMapLayerUrl(mapLayerUrl: string): Promise<ArcGisOAuth2Token | undefined> {\r\n    try {\r\n      const oauthEndpoint = await this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);\r\n      if (oauthEndpoint !== undefined) {\r\n        const oauthEndpointUrl = new URL(oauthEndpoint.getUrl());\r\n        return ArcGisTokenManager.getOAuth2Token(oauthEndpointUrl.origin);\r\n      }\r\n    } catch { }\r\n    return undefined;\r\n  }\r\n\r\n  // Derive the Oauth URL from a typical MapLayerURL\r\n  // i.e. \t  https://hostname/server/rest/services/NewYork/NewYork3857/MapServer\r\n  //      =>  https://hostname/portal/sharing/oauth2/authorize\r\n  private _oauthAuthorizeEndPointsCache = new Map<string, any>();\r\n  private _oauthTokenEndPointsCache = new Map<string, any>();\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private cacheEndpoint(url: string, endpoint: ArcGisOAuth2EndpointType, obj: ArcGisOAuth2Endpoint) {\r\n    if (endpoint === ArcGisOAuth2EndpointType.Authorize) {\r\n      this._oauthAuthorizeEndPointsCache.set(url, obj);\r\n    } else {\r\n      this._oauthTokenEndPointsCache.set(url, obj);\r\n    }\r\n  }\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private async createEndpoint(url: string, endpoint: ArcGisOAuth2EndpointType): Promise<ArcGisOAuth2Endpoint | undefined> {\r\n    // Validate the URL we just composed\r\n    const oauthEndpoint = new ArcGisOAuth2Endpoint(url, this.constructLoginUrl(url, false), false);\r\n    this.cacheEndpoint(url, endpoint, oauthEndpoint);\r\n    return oauthEndpoint;\r\n  }\r\n\r\n  /**\r\n  * Returns whether the ArcGis host is valid\r\n  * @internal\r\n  */\r\n  private isArcGisHostValid(url: URL): boolean {\r\n    const allowedHosts = [\r\n      \"arcgis.com\",\r\n    ];\r\n\r\n    return allowedHosts.some((host: string) => url.hostname.toLowerCase().endsWith(host));\r\n  }\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private async getOAuth2Endpoint(url: string, endpointType: ArcGisOAuth2EndpointType): Promise<ArcGisOAuth2Endpoint | undefined> {\r\n    // Return from cache if available\r\n    const cachedEndpoint = (endpointType === ArcGisOAuth2EndpointType.Authorize ? this._oauthAuthorizeEndPointsCache.get(url) : this._oauthTokenEndPointsCache.get(url));\r\n    if (cachedEndpoint !== undefined) {\r\n      return cachedEndpoint;\r\n    }\r\n\r\n    const endpointStr = (endpointType === ArcGisOAuth2EndpointType.Authorize ? \"authorize\" : \"token\");\r\n\r\n    const urlObj = new URL(url);\r\n\r\n    if (this.isArcGisHostValid(urlObj)) {\r\n      // ArcGIS Online (fixed)\r\n      // Doc: https://developers.arcgis.com/documentation/mapping-apis-and-services/security/oauth-2.0/\r\n\r\n      if (this.arcGisOnlineClientId === undefined) {\r\n        return undefined;\r\n      }\r\n\r\n      const oauth2Url = `https://www.arcgis.com/sharing/rest/oauth2/${endpointStr}`;\r\n      return new ArcGisOAuth2Endpoint(oauth2Url, this.constructLoginUrl(oauth2Url, true), true);\r\n    } else {\r\n\r\n      // First attempt: derive the Oauth2 token URL from the 'tokenServicesUrl', exposed by the 'info request'\r\n      try {\r\n        const restUrlFromTokenService = await ArcGisUrl.getRestUrlFromGenerateTokenUrl(urlObj);\r\n        if (restUrlFromTokenService === undefined) {\r\n          // We could not derive the token endpoint from 'tokenServicesUrl'.\r\n          // ArcGIS Enterprise Format https://<host>:<port>/<subdirectory>/sharing/rest/oauth2/authorize\r\n          const regExMatch = url.match(new RegExp(/([^&\\/]+)\\/rest\\/services\\/.*/, \"i\"));\r\n          if (regExMatch !== null && regExMatch.length >= 2) {\r\n            const subdirectory = regExMatch[1];\r\n            const port = (urlObj.port !== \"80\" && urlObj.port !== \"443\") ? `:${urlObj.port}` : \"\";\r\n            const newUrlObj = new URL(`${urlObj.protocol}//${urlObj.hostname}${port}/${subdirectory}/sharing/rest/oauth2/${endpointStr}`);\r\n\r\n            // Check again the URL we just composed\r\n            return await this.createEndpoint(newUrlObj.toString(), endpointType);\r\n          }\r\n        } else {\r\n          const endpoint = await this.createEndpoint(`${restUrlFromTokenService.toString()}oauth2/${endpointStr}`, endpointType);\r\n          if (endpoint)\r\n            return endpoint;\r\n        }\r\n      } catch {\r\n\r\n      }\r\n\r\n    }\r\n    return undefined;   // we could not find any valid oauth2 endpoint\r\n  }\r\n\r\n  /**\r\n * Construct the complete Authorize url to starts the Oauth process\r\n * @internal\r\n */\r\n  private constructLoginUrl(url: string, isArcgisOnline: boolean) {\r\n    const urlObj = new URL(url);\r\n\r\n    // Set the client id\r\n    if (isArcgisOnline) {\r\n      const clientId = this.arcGisOnlineClientId;\r\n      assert(clientId !== undefined);\r\n      if (clientId !== undefined) {\r\n        urlObj.searchParams.set(\"client_id\", clientId);\r\n      }\r\n\r\n    } else {\r\n      const clientId = this.getMatchingEnterpriseClientId(url);\r\n      assert(clientId !== undefined);\r\n      if (undefined !== clientId) {\r\n        urlObj.searchParams.set(\"client_id\", clientId);\r\n      }\r\n    }\r\n\r\n    urlObj.searchParams.set(\"response_type\", \"token\");\r\n    if (this.expiration !== undefined) {\r\n      urlObj.searchParams.set(\"expiration\", `${this.expiration}`);\r\n    }\r\n\r\n    if (this.redirectUri)\r\n      urlObj.searchParams.set(\"redirect_uri\", this.redirectUri);\r\n\r\n    return urlObj.toString();\r\n  }\r\n\r\n}\r\n"]}
+{"version":3,"file":"ArcGisAccessClient.js","sourceRoot":"","sources":["../../../src/ArcGis/ArcGisAccessClient.ts"],"names":[],"mappings":";AAAA;;;+FAG+F;AAC/F;;GAEG;;;AAEH,sDAAsD;AAEtD,iEAAkF;AAClF,iEAAwF;AACxF,6DAA0D;AAC1D,2CAAwC;AA8CxC,YAAY;AACZ,MAAa,kBAAkB;IAS7B;QARgB,sBAAiB,GAAG,IAAI,sBAAO,EAAE,CAAC;QAKlD,sDAAsD;QAC9C,sBAAiB,GAAG,KAAK,CAAC;QAuLlC,uEAAuE;QACvE,8EAA8E;QAC9E,4DAA4D;QAEpD,oBAAe,GAAG,IAAI,GAAG,EAAoC,CAAC;IAxLtE,CAAC;IAEM,UAAU,CAAC,WAA+B;QAC/C,IAAI,WAAW,EAAE;YACf,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,eAAe,CAAC;YAC/C,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC;YAExC,IAAI,CAAC,yBAAyB,EAAE,CAAC;SAClC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,yBAAyB;QAC9B,MAAc,CAAC,oBAAoB,GAAG,CAAC,gBAA2B,EAAE,EAAE;YACrE,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,SAAS,CAAC;YAEd,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;gBACxD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC;gBAC3C,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;gBAC1D,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;gBAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;gBACzD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;gBAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;gBACtD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;gBACrD,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE;oBAC9H,IAAI,cAAc,CAAC;oBACnB,IAAI;wBACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBACnC,SAAS,GAAG,KAAK,EAAE,UAAU,CAAC;wBAC9B,cAAc,GAAG,KAAK,EAAE,cAAc,CAAC;qBAExC;oBAAC,MAAM;qBACP;oBACD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;oBACvC,MAAM,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAG,6EAA6E;oBACrI,IAAI,cAAc,KAAK,SAAS,EAAE;wBAChC,uCAAkB,CAAC,cAAc,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;wBAChG,YAAY,GAAG,IAAI,CAAC;qBACrB;iBAEF;aACF;YACD,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC,CAAC;IACJ,CAAC;IAEM,YAAY;QACjB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC5B,MAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,MAAiC;QAC3D,+FAA+F;QAE/F,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1F,IAAI,WAAW;gBACb,OAAO,WAAW,CAAC;SACtB;QAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE;YACtC,OAAO,uCAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,4CAAqB,CAAC,OAAO,EAAE,CAAC,CAAC;SAChJ;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,gBAAgB;IACT,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,WAAmB;QAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAI,yEAAyE;IAC1G,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAAC,WAAmB;QACtD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC3B,OAAO,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,+CAAwB,CAAC,SAAS,CAAC,CAAC;SAChF;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,eAAe,CAAC,KAA0B;QAC/C,IAAI,KAAK,GAAG,uCAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE;YACV,KAAK,GAAG,uCAAkB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;SACzD;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEM,6BAA6B,CAAC,GAAW;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE;YACd,OAAO,SAAS,CAAC;SAClB;QAED,IAAI,QAA4B,CAAC;QACjC,IAAI,eAAmC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE;YAC7B,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,EAAE;gBAC/B,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC;aAClC;iBAAM;gBACL,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;oBACtD,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;iBAC3B;aACF;SACF;QAED,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE;YAC3D,QAAQ,GAAG,eAAe,CAAC;SAC5B;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAW,oBAAoB;QAC7B,OAAO,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC/C,CAAC;IAED,IAAW,oBAAoB,CAAC,QAA4B;QAC1D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;YACjC,IAAI,CAAC,UAAU,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;SACtD;QACD,IAAI,CAAC,UAAU,CAAC,oBAAoB,GAAG,QAAQ,CAAC;IAClD,CAAC;IAED,IAAW,yBAAyB;QAClC,OAAO,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAC9C,CAAC;IAEM,qBAAqB,CAAC,cAAsB,EAAE,QAAgB;QAEnE,IAAI,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc,CAAC,CAAC;YACnH,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE;gBACnB,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;aACnE;iBAAM;gBACL,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;aACxE;SACF;aAAM;YACL,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;gBACjC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;aACtB;YACD,IAAI,CAAC,UAAU,CAAC,mBAAmB,GAAG,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;SACtE;IACH,CAAC;IAEM,wBAAwB,CAAC,QAAkC;QAEhE,IAAI,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE;YACxC,IAAI,CAAC,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAAC,CAAC;SAC/I;IAEH,CAAC;IAED,cAAc;IACd,gBAAgB;IACR,KAAK,CAAC,2BAA2B,CAAC,WAAmB;QAC3D,IAAI;YACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,+CAAwB,CAAC,SAAS,CAAC,CAAC;YACpG,IAAI,aAAa,KAAK,SAAS,EAAE;gBAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzD,OAAO,uCAAkB,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;aACnE;SACF;QAAC,MAAM,GAAG;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAQD;;;KAGC;IACO,aAAa,CAAC,GAAgB,EAAE,YAAsC,EAAE,QAA8B;QAC5G,MAAM,KAAK,GAAG,YAAY,KAAK,+CAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,iBAAiB,EAAE,QAAQ,EAAC,CAAC,CAAC,CAAC,EAAC,aAAa,EAAE,QAAQ,EAAC,CAAC;QAC9H,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;KAGC;IACO,KAAK,CAAC,cAAc,CAAC,WAAwB,EAAE,gBAAwB,EAAE,YAAsC;QACrH,oCAAoC;QACpC,MAAM,aAAa,GAAG,IAAI,2CAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACzH,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QAC7D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;MAGE;IACM,iBAAiB,CAAC,GAAQ;QAChC,MAAM,YAAY,GAAG;YACnB,YAAY;SACb,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAW;QAC3C,IAAI,KAAwB,CAAC;QAC7B,IAAI;YACF,KAAK,GAAG,MAAM,kBAAkB,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;SACzE;QAAC,MAAM;YACN,4EAA4E;YAC5E,6GAA6G;YAC7G,qCAAqC;SACtC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;KAGC;IACO,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,YAAsC;QACzF,iCAAiC;QACjC,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7D,IAAI,cAAc,KAAK,SAAS,EAAE;YAChC,OAAO,CAAC,YAAY,KAAK,+CAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;SACpI;QAED,MAAM,WAAW,GAAG,CAAC,YAAY,KAAK,+CAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAElG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEpC,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;YAClC,wBAAwB;YACxB,iGAAiG;YAEjG,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE;gBAC3C,OAAO,SAAS,CAAC;aAClB;YAED,MAAM,SAAS,GAAG,8CAA8C,WAAW,EAAE,CAAC;YAC9E,OAAO,IAAI,2CAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;SAC3F;aAAM;YAEL,wGAAwG;YACxG,IAAI;gBACF,MAAM,uBAAuB,GAAG,MAAM,qBAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;gBAEvF,IAAI,uBAAuB,KAAK,SAAS,EAAE;oBACzC,kEAAkE;oBAClE,8FAA8F;oBAC9F,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,CAAC;oBACvF,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE;wBACjD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBACnC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,GAAG,IAAI,IAAI,YAAY,wBAAwB,WAAW,EAAE,CAAC,CAAC;wBAE9H,uCAAuC;wBACvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACxE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,EAAG;4BAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;4BAC5F,IAAI,QAAQ;gCACV,OAAO,QAAQ,CAAC;yBACnB;qBACF;iBACF;qBAAM;oBACL,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACtF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,EAAG;wBAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;wBACpI,IAAI,QAAQ;4BACV,OAAO,QAAQ,CAAC;qBACnB;iBACF;aACF;YAAC,MAAM;aACP;SACF;QAED,gEAAgE;QAChE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAE,oEAAoE;QAEhH,OAAO,SAAS,CAAC,CAAG,8CAA8C;IACpE,CAAC;IAED;;;KAGC;IACO,iBAAiB,CAAC,GAAW,EAAE,cAAuB;QAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,oBAAoB;QACpB,IAAI,cAAc,EAAE;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;YAC3C,IAAA,qBAAM,EAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE;gBAC1B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;aAChD;SAEF;aAAM;YACL,MAAM,QAAQ,GAAG,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;YACzD,IAAA,qBAAM,EAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE;gBAC1B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;aAChD;SACF;QAED,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;YACjC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;SAC7D;QAED,IAAI,IAAI,CAAC,WAAW;YAClB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAE5D,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;CAEF;AApVD,gDAoVC","sourcesContent":["/*---------------------------------------------------------------------------------------------\r\n* Copyright (c) Bentley Systems, Incorporated. All rights reserved.\r\n* See LICENSE.md in the project root for license terms and full copyright notice.\r\n*--------------------------------------------------------------------------------------------*/\r\n/** @packageDocumentation\r\n * @module Tiles\r\n */\r\n\r\nimport { assert, BeEvent } from \"@itwin/core-bentley\";\r\nimport { MapLayerAccessClient, MapLayerAccessToken, MapLayerAccessTokenParams, MapLayerTokenEndpoint } from \"@itwin/core-frontend\";\r\nimport { ArcGisOAuth2Token, ArcGisTokenClientType } from \"./ArcGisTokenGenerator\";\r\nimport { ArcGisOAuth2Endpoint, ArcGisOAuth2EndpointType } from \"./ArcGisOAuth2Endpoint\";\r\nimport { ArcGisTokenManager } from \"./ArcGisTokenManager\";\r\nimport { ArcGisUrl } from \"./ArcGisUrl\";\r\n\r\n/** @beta */\r\nexport interface ArcGisEnterpriseClientId {\r\n  /* Oauth API endpoint base URL (i.e. https://hostname/portal/sharing/oauth2/authorize)\r\n  used to identify uniquely each enterprise server. */\r\n  serviceBaseUrl: string;\r\n\r\n  /* Application's clientId for this enterprise server.*/\r\n  clientId: string;\r\n}\r\n\r\n/** @beta */\r\nexport interface ArcGisOAuthClientIds {\r\n  /* Application's OAuth clientId in ArcGIS online */\r\n  arcgisOnlineClientId?: string;\r\n\r\n  /* Application's OAuth clientId for each enterprise server used. */\r\n  enterpriseClientIds?: ArcGisEnterpriseClientId[];\r\n}\r\n\r\n/** @beta\r\n * ArcGIS OAuth configurations parameters.\r\n * See https://developers.arcgis.com/documentation/mapping-apis-and-services/security/arcgis-identity/serverless-web-apps/\r\n * more details.\r\n*/\r\nexport interface ArcGisOAuthConfig {\r\n  /* URL to which a user is sent once they complete sign in authorization.\r\n    Must match a URI you define in the developer dashboard, otherwise, the authorization will be rejected.\r\n  */\r\n  redirectUri: string;\r\n\r\n  /* Optional expiration after which the token will expire. Defined in minutes with a maximum of two weeks (20160 minutes)*/\r\n  tokenExpiration?: number;\r\n\r\n  /* Application client Ids */\r\n  clientIds: ArcGisOAuthClientIds;\r\n}\r\n\r\ninterface EndPointsCacheEntry {\r\n  authorizeEndpoint?: ArcGisOAuth2Endpoint;\r\n  tokenEndpoint?: ArcGisOAuth2Endpoint;\r\n}\r\n\r\ntype MapLayerUrl = string;\r\n\r\n/** @beta */\r\nexport class ArcGisAccessClient implements MapLayerAccessClient {\r\n  public readonly onOAuthProcessEnd = new BeEvent();\r\n  private _redirectUri: string | undefined;\r\n  private _expiration: number | undefined;\r\n  private _clientIds: ArcGisOAuthClientIds | undefined;\r\n\r\n  // Should be kept to 'false'. Debugging purposes only.\r\n  private _forceLegacyToken = false;\r\n\r\n  public constructor() {\r\n  }\r\n\r\n  public initialize(oAuthConfig?: ArcGisOAuthConfig): boolean {\r\n    if (oAuthConfig) {\r\n      this._redirectUri = oAuthConfig.redirectUri;\r\n      this._expiration = oAuthConfig.tokenExpiration;\r\n      this._clientIds = oAuthConfig.clientIds;\r\n\r\n      this.initOauthCallbackFunction();\r\n    }\r\n    return true;\r\n  }\r\n\r\n  private initOauthCallbackFunction() {\r\n    (window as any).arcGisOAuth2Callback = (redirectLocation?: Location) => {\r\n      let eventSuccess = false;\r\n      let stateData;\r\n\r\n      if (redirectLocation && redirectLocation.hash.length > 0) {\r\n        const locationHash = redirectLocation.hash;\r\n        const hashParams = new URLSearchParams(locationHash.substring(1));\r\n        const token = hashParams.get(\"access_token\") ?? undefined;\r\n        const expiresInStr = hashParams.get(\"expires_in\") ?? undefined;\r\n        const userName = hashParams.get(\"username\") ?? undefined;\r\n        const ssl = hashParams.get(\"ssl\") === \"true\";\r\n        const stateStr = hashParams.get(\"state\") ?? undefined;\r\n        const persist = hashParams.get(\"persist\") === \"true\";\r\n        if (token !== undefined && expiresInStr !== undefined && userName !== undefined && ssl !== undefined && stateStr !== undefined) {\r\n          let endpointOrigin;\r\n          try {\r\n            const state = JSON.parse(stateStr);\r\n            stateData = state?.customData;\r\n            endpointOrigin = state?.endpointOrigin;\r\n\r\n          } catch {\r\n          }\r\n          const expiresIn = Number(expiresInStr);\r\n          const expiresAt = (expiresIn * 1000) + (+new Date());   // Converts the token expiration delay (seconds) into a timestamp (UNIX time)\r\n          if (endpointOrigin !== undefined) {\r\n            ArcGisTokenManager.setOAuth2Token(endpointOrigin, { token, expiresAt, ssl, userName, persist });\r\n            eventSuccess = true;\r\n          }\r\n\r\n        }\r\n      }\r\n      this.onOAuthProcessEnd.raiseEvent(eventSuccess, stateData);\r\n    };\r\n  }\r\n\r\n  public unInitialize() {\r\n    this._redirectUri = undefined;\r\n    this._expiration = undefined;\r\n    (window as any).arcGisOAuth2Callback = undefined;\r\n  }\r\n\r\n  public async getAccessToken(params: MapLayerAccessTokenParams): Promise<MapLayerAccessToken | undefined> {\r\n    // First lookup Oauth2 tokens, otherwise check try \"legacy tokens\" if credentials were provided\r\n\r\n    if (!this._forceLegacyToken) {\r\n      const oauth2Token = await this.getOAuthTokenForMapLayerUrl(params.mapLayerUrl.toString());\r\n      if (oauth2Token)\r\n        return oauth2Token;\r\n    }\r\n\r\n    if (params.userName && params.password) {\r\n      return ArcGisTokenManager.getToken(params.mapLayerUrl.toString(), params.userName, params.password, { client: ArcGisTokenClientType.referer });\r\n    }\r\n\r\n    return undefined;\r\n  }\r\n\r\n  /** @internal */\r\n  public static async validateOAuth2Endpoint(endpointUrl: string): Promise<boolean> {\r\n    const data = await fetch(endpointUrl, { method: \"GET\" });\r\n    return data.status === 400;    // Oauth2 API returns 400 (Bad Request) when there are missing parameters\r\n  }\r\n\r\n  public async getTokenServiceEndPoint(mapLayerUrl: string): Promise<MapLayerTokenEndpoint | undefined> {\r\n    if (!this._forceLegacyToken) {\r\n      return this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);\r\n    }\r\n\r\n    return undefined;\r\n  }\r\n\r\n  public invalidateToken(token: MapLayerAccessToken): boolean {\r\n    let found = ArcGisTokenManager.invalidateToken(token);\r\n    if (!found) {\r\n      found = ArcGisTokenManager.invalidateOAuth2Token(token);\r\n    }\r\n    return found;\r\n  }\r\n\r\n  public get redirectUri() {\r\n    return this._redirectUri;\r\n  }\r\n\r\n  public getMatchingEnterpriseClientId(url: string) {\r\n    const clientIds = this.arcGisEnterpriseClientIds;\r\n    if (!clientIds) {\r\n      return undefined;\r\n    }\r\n\r\n    let clientId: string | undefined;\r\n    let defaultClientId: string | undefined;\r\n    for (const entry of clientIds) {\r\n      if (entry.serviceBaseUrl === \"\") {\r\n        defaultClientId = entry.clientId;\r\n      } else {\r\n        if (url.toLowerCase().startsWith(entry.serviceBaseUrl)) {\r\n          clientId = entry.clientId;\r\n        }\r\n      }\r\n    }\r\n\r\n    // If we could not find a match with serviceBaseUrl, and a default clientId\r\n    // was specified (i.e empty url), then use default clientId\r\n    if (clientId === undefined && defaultClientId !== undefined) {\r\n      clientId = defaultClientId;\r\n    }\r\n    return clientId;\r\n  }\r\n\r\n  public get expiration() {\r\n    return this._expiration;\r\n  }\r\n\r\n  public get arcGisOnlineClientId() {\r\n    return this._clientIds?.arcgisOnlineClientId;\r\n  }\r\n\r\n  public set arcGisOnlineClientId(clientId: string | undefined) {\r\n    if (this._clientIds === undefined) {\r\n      this._clientIds = { arcgisOnlineClientId: clientId };\r\n    }\r\n    this._clientIds.arcgisOnlineClientId = clientId;\r\n  }\r\n\r\n  public get arcGisEnterpriseClientIds() {\r\n    return this._clientIds?.enterpriseClientIds;\r\n  }\r\n\r\n  public setEnterpriseClientId(serviceBaseUrl: string, clientId: string) {\r\n\r\n    if (this._clientIds?.enterpriseClientIds) {\r\n      const foundIdx = this._clientIds.enterpriseClientIds.findIndex((entry) => entry.serviceBaseUrl === serviceBaseUrl);\r\n      if (foundIdx !== -1) {\r\n        this._clientIds.enterpriseClientIds[foundIdx].clientId = clientId;\r\n      } else {\r\n        this._clientIds.enterpriseClientIds.push({ serviceBaseUrl, clientId });\r\n      }\r\n    } else {\r\n      if (this._clientIds === undefined) {\r\n        this._clientIds = {};\r\n      }\r\n      this._clientIds.enterpriseClientIds = [{ serviceBaseUrl, clientId }];\r\n    }\r\n  }\r\n\r\n  public removeEnterpriseClientId(clientId: ArcGisEnterpriseClientId) {\r\n\r\n    if (this._clientIds?.enterpriseClientIds) {\r\n      this._clientIds.enterpriseClientIds = this._clientIds?.enterpriseClientIds?.filter((item) => item.serviceBaseUrl !== clientId.serviceBaseUrl);\r\n    }\r\n\r\n  }\r\n\r\n  /// //////////\r\n  /** @internal */\r\n  private async getOAuthTokenForMapLayerUrl(mapLayerUrl: string): Promise<ArcGisOAuth2Token | undefined> {\r\n    try {\r\n      const oauthEndpoint = await this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);\r\n      if (oauthEndpoint !== undefined) {\r\n        const oauthEndpointUrl = new URL(oauthEndpoint.getUrl());\r\n        return ArcGisTokenManager.getOAuth2Token(oauthEndpointUrl.origin);\r\n      }\r\n    } catch { }\r\n    return undefined;\r\n  }\r\n\r\n  // Mapping between a map-layer URL and its corresponding Oauth endpoint\r\n  // i.e. \t  https://hostname/server/rest/services/NewYork/NewYork3857/MapServer\r\n  //      =>  https://hostname/portal/sharing/oauth2/authorize\r\n\r\n  private _endPointsCache = new Map<MapLayerUrl, EndPointsCacheEntry>();\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private cacheEndpoint(url: MapLayerUrl, endpointType: ArcGisOAuth2EndpointType, endPoint: ArcGisOAuth2Endpoint) {\r\n    const entry = endpointType === ArcGisOAuth2EndpointType.Authorize ? {authorizeEndpoint: endPoint} : {tokenEndpoint: endPoint};\r\n    this._endPointsCache.set(url, entry);\r\n  }\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private async createEndpoint(mapLayerUrl: MapLayerUrl, oauthEndpointUrl: string, endpointType: ArcGisOAuth2EndpointType): Promise<ArcGisOAuth2Endpoint | undefined> {\r\n    // Validate the URL we just composed\r\n    const oauthEndpoint = new ArcGisOAuth2Endpoint(oauthEndpointUrl, this.constructLoginUrl(oauthEndpointUrl, false), false);\r\n    this.cacheEndpoint(mapLayerUrl, endpointType, oauthEndpoint);\r\n    return oauthEndpoint;\r\n  }\r\n\r\n  /**\r\n  * Returns whether the ArcGis host is valid\r\n  * @internal\r\n  */\r\n  private isArcGisHostValid(url: URL): boolean {\r\n    const allowedHosts = [\r\n      \"arcgis.com\",\r\n    ];\r\n\r\n    return allowedHosts.some((host: string) => url.hostname.toLowerCase().endsWith(host));\r\n  }\r\n\r\n  private async validateEndpointUrl(url: string) {\r\n    let valid: boolean|undefined;\r\n    try {\r\n      valid = await ArcGisAccessClient.validateOAuth2Endpoint(url.toString());\r\n    } catch {\r\n      // If we reach here, this means we could not validate properly the endpoint;\r\n      // we cannot conclude the endpoint is invalid though; it might happen endpoint doesn't support CORS requests,\r\n      // but still valid for Oauth process.\r\n    }\r\n    return valid;\r\n  }\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private async getOAuth2Endpoint(mapLayerUrl: string, endpointType: ArcGisOAuth2EndpointType): Promise<ArcGisOAuth2Endpoint | undefined> {\r\n    // Return from cache if available\r\n    const cachedEndpoint = this._endPointsCache.get(mapLayerUrl);\r\n    if (cachedEndpoint !== undefined) {\r\n      return (endpointType === ArcGisOAuth2EndpointType.Authorize ? cachedEndpoint.authorizeEndpoint : cachedEndpoint.authorizeEndpoint);\r\n    }\r\n\r\n    const endpointStr = (endpointType === ArcGisOAuth2EndpointType.Authorize ? \"authorize\" : \"token\");\r\n\r\n    const urlObj = new URL(mapLayerUrl);\r\n\r\n    if (this.isArcGisHostValid(urlObj)) {\r\n      // ArcGIS Online (fixed)\r\n      // Doc: https://developers.arcgis.com/documentation/mapping-apis-and-services/security/oauth-2.0/\r\n\r\n      if (this.arcGisOnlineClientId === undefined) {\r\n        return undefined;\r\n      }\r\n\r\n      const oauth2Url = `https://www.arcgis.com/sharing/rest/oauth2/${endpointStr}`;\r\n      return new ArcGisOAuth2Endpoint(oauth2Url, this.constructLoginUrl(oauth2Url, true), true);\r\n    } else {\r\n\r\n      // First attempt: derive the Oauth2 token URL from the 'tokenServicesUrl', exposed by the 'info request'\r\n      try {\r\n        const restUrlFromTokenService = await ArcGisUrl.getRestUrlFromGenerateTokenUrl(urlObj);\r\n\r\n        if (restUrlFromTokenService === undefined) {\r\n          // We could not derive the token endpoint from 'tokenServicesUrl'.\r\n          // ArcGIS Enterprise Format https://<host>:<port>/<subdirectory>/sharing/rest/oauth2/authorize\r\n          const regExMatch = mapLayerUrl.match(new RegExp(/([^&\\/]+)\\/rest\\/services\\/.*/, \"i\"));\r\n          if (regExMatch !== null && regExMatch.length >= 2) {\r\n            const subdirectory = regExMatch[1];\r\n            const port = (urlObj.port !== \"80\" && urlObj.port !== \"443\") ? `:${urlObj.port}` : \"\";\r\n            const newUrlObj = new URL(`${urlObj.protocol}//${urlObj.hostname}${port}/${subdirectory}/sharing/rest/oauth2/${endpointStr}`);\r\n\r\n            // Check again the URL we just composed\r\n            const isValidUrl = await this.validateEndpointUrl(newUrlObj.toString());\r\n            if (isValidUrl === undefined || isValidUrl ) {\r\n              const endpoint = await this.createEndpoint(mapLayerUrl, newUrlObj.toString(), endpointType);\r\n              if (endpoint)\r\n                return endpoint;\r\n            }\r\n          }\r\n        } else {\r\n          const isValidUrl = await this.validateEndpointUrl(restUrlFromTokenService.toString());\r\n          if (isValidUrl === undefined || isValidUrl ) {\r\n            const endpoint = await this.createEndpoint(mapLayerUrl, `${restUrlFromTokenService.toString()}oauth2/${endpointStr}`, endpointType);\r\n            if (endpoint)\r\n              return endpoint;\r\n          }\r\n        }\r\n      } catch {\r\n      }\r\n    }\r\n\r\n    // If we reach here, we were not successful creating an endpoint\r\n    this._endPointsCache.set(mapLayerUrl, {});  // Cache an empty entry, and avoid making repeated failing requests.\r\n\r\n    return undefined;   // we could not find any valid oauth2 endpoint\r\n  }\r\n\r\n  /**\r\n * Construct the complete Authorize url to starts the Oauth process\r\n * @internal\r\n */\r\n  private constructLoginUrl(url: string, isArcgisOnline: boolean) {\r\n    const urlObj = new URL(url);\r\n\r\n    // Set the client id\r\n    if (isArcgisOnline) {\r\n      const clientId = this.arcGisOnlineClientId;\r\n      assert(clientId !== undefined);\r\n      if (clientId !== undefined) {\r\n        urlObj.searchParams.set(\"client_id\", clientId);\r\n      }\r\n\r\n    } else {\r\n      const clientId = this.getMatchingEnterpriseClientId(url);\r\n      assert(clientId !== undefined);\r\n      if (undefined !== clientId) {\r\n        urlObj.searchParams.set(\"client_id\", clientId);\r\n      }\r\n    }\r\n\r\n    urlObj.searchParams.set(\"response_type\", \"token\");\r\n    if (this.expiration !== undefined) {\r\n      urlObj.searchParams.set(\"expiration\", `${this.expiration}`);\r\n    }\r\n\r\n    if (this.redirectUri)\r\n      urlObj.searchParams.set(\"redirect_uri\", this.redirectUri);\r\n\r\n    return urlObj.toString();\r\n  }\r\n\r\n}\r\n"]}

package/lib/esm/ArcGis/ArcGisAccessClient.d.ts

@@ -35,6 +35,8 @@ export declare class ArcGisAccessClient implements MapLayerAccessClient {
     private initOauthCallbackFunction;
     unInitialize(): void;
     getAccessToken(params: MapLayerAccessTokenParams): Promise<MapLayerAccessToken | undefined>;
+    /** @internal */
+    static validateOAuth2Endpoint(endpointUrl: string): Promise<boolean>;
     getTokenServiceEndPoint(mapLayerUrl: string): Promise<MapLayerTokenEndpoint | undefined>;
     invalidateToken(token: MapLayerAccessToken): boolean;
     get redirectUri(): string | undefined;
@@ -47,8 +49,7 @@ export declare class ArcGisAccessClient implements MapLayerAccessClient {
     removeEnterpriseClientId(clientId: ArcGisEnterpriseClientId): void;
     /** @internal */
     private getOAuthTokenForMapLayerUrl;
-    private _oauthAuthorizeEndPointsCache;
-    private _oauthTokenEndPointsCache;
+    private _endPointsCache;
     /**
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal
@@ -64,6 +65,7 @@ export declare class ArcGisAccessClient implements MapLayerAccessClient {
     * @internal
     */
     private isArcGisHostValid;
+    private validateEndpointUrl;
     /**
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal

package/lib/esm/ArcGis/ArcGisAccessClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ArcGisAccessClient.d.ts","sourceRoot":"","sources":["../../../src/ArcGis/ArcGisAccessClient.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,OAAO,EAAU,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAMnI,YAAY;AACZ,MAAM,WAAW,wBAAwB;IAGvC,cAAc,EAAE,MAAM,CAAC;IAGvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,YAAY;AACZ,MAAM,WAAW,oBAAoB;IAEnC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,mBAAmB,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAClD;AAED;;;;EAIE;AACF,MAAM,WAAW,iBAAiB;IAIhC,WAAW,EAAE,MAAM,CAAC;IAGpB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,SAAS,EAAE,oBAAoB,CAAC;CACjC;AAED,YAAY;AACZ,qBAAa,kBAAmB,YAAW,oBAAoB;IAC7D,SAAgB,iBAAiB,kDAAiB;IAClD,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,UAAU,CAAmC;IAGrD,OAAO,CAAC,iBAAiB,CAAS;;IAK3B,UAAU,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,OAAO;IAW3D,OAAO,CAAC,yBAAyB;IAoC1B,YAAY;IAMN,cAAc,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAgB3F,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAkB9F,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO;IAQ3D,IAAW,WAAW,uBAErB;IAEM,6BAA6B,CAAC,GAAG,EAAE,MAAM;IA0BhD,IAAW,UAAU,uBAEpB;IAED,IAAW,oBAAoB,IAIW,MAAM,GAAG,SAAS,CAF3D;IAED,IAAW,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAK3D;IAED,IAAW,yBAAyB,2CAEnC;IAEM,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAiB9D,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB;IASlE,gBAAgB;YACF,2BAA2B;IAczC,OAAO,CAAC,6BAA6B,CAA0B;IAC/D,OAAO,CAAC,yBAAyB,CAA0B;IAE3D;;;KAGC;IACD,OAAO,CAAC,aAAa;IAQrB;;;KAGC;YACa,cAAc;IAO5B;;;MAGE;IACF,OAAO,CAAC,iBAAiB;IAQzB;;;KAGC;YACa,iBAAiB;IAmD/B;;;KAGC;IACD,OAAO,CAAC,iBAAiB;CA8B1B"}
+{"version":3,"file":"ArcGisAccessClient.d.ts","sourceRoot":"","sources":["../../../src/ArcGis/ArcGisAccessClient.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,OAAO,EAAU,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAMnI,YAAY;AACZ,MAAM,WAAW,wBAAwB;IAGvC,cAAc,EAAE,MAAM,CAAC;IAGvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,YAAY;AACZ,MAAM,WAAW,oBAAoB;IAEnC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,mBAAmB,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAClD;AAED;;;;EAIE;AACF,MAAM,WAAW,iBAAiB;IAIhC,WAAW,EAAE,MAAM,CAAC;IAGpB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,SAAS,EAAE,oBAAoB,CAAC;CACjC;AASD,YAAY;AACZ,qBAAa,kBAAmB,YAAW,oBAAoB;IAC7D,SAAgB,iBAAiB,kDAAiB;IAClD,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,UAAU,CAAmC;IAGrD,OAAO,CAAC,iBAAiB,CAAS;;IAK3B,UAAU,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,OAAO;IAW3D,OAAO,CAAC,yBAAyB;IAoC1B,YAAY;IAMN,cAAc,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAgBxG,gBAAgB;WACI,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpE,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAQ9F,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO;IAQ3D,IAAW,WAAW,uBAErB;IAEM,6BAA6B,CAAC,GAAG,EAAE,MAAM;IA0BhD,IAAW,UAAU,uBAEpB;IAED,IAAW,oBAAoB,IAIW,MAAM,GAAG,SAAS,CAF3D;IAED,IAAW,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAK3D;IAED,IAAW,yBAAyB,2CAEnC;IAEM,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAiB9D,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB;IASlE,gBAAgB;YACF,2BAA2B;IAezC,OAAO,CAAC,eAAe,CAA+C;IAEtE;;;KAGC;IACD,OAAO,CAAC,aAAa;IAKrB;;;KAGC;YACa,cAAc;IAO5B;;;MAGE;IACF,OAAO,CAAC,iBAAiB;YAQX,mBAAmB;IAYjC;;;KAGC;YACa,iBAAiB;IA8D/B;;;KAGC;IACD,OAAO,CAAC,iBAAiB;CA8B1B"}

package/lib/esm/ArcGis/ArcGisAccessClient.js

@@ -16,11 +16,10 @@ export class ArcGisAccessClient {
         this.onOAuthProcessEnd = new BeEvent();
         // Should be kept to 'false'. Debugging purposes only.
         this._forceLegacyToken = false;
-        // Derive the Oauth URL from a typical MapLayerURL
+        // Mapping between a map-layer URL and its corresponding Oauth endpoint
         // i.e. 	  https://hostname/server/rest/services/NewYork/NewYork3857/MapServer
         //      =>  https://hostname/portal/sharing/oauth2/authorize
-        this._oauthAuthorizeEndPointsCache = new Map();
-        this._oauthTokenEndPointsCache = new Map();
+        this._endPointsCache = new Map();
     }
     initialize(oAuthConfig) {
         if (oAuthConfig) {
@@ -81,20 +80,16 @@ export class ArcGisAccessClient {
         }
         return undefined;
     }
+    /** @internal */
+    static async validateOAuth2Endpoint(endpointUrl) {
+        const data = await fetch(endpointUrl, { method: "GET" });
+        return data.status === 400; // Oauth2 API returns 400 (Bad Request) when there are missing parameters
+    }
     async getTokenServiceEndPoint(mapLayerUrl) {
-        let tokenEndpoint;
         if (!this._forceLegacyToken) {
-            // Note: we used to validate the endpoint by making a request, but because of CORS isssues with some servers
-            // we could not make a reliable validation.
-            try {
-                tokenEndpoint = await this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);
-                if (tokenEndpoint) {
-                }
-            }
-            catch {
-            }
+            return this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);
         }
-        return tokenEndpoint;
+        return undefined;
     }
     invalidateToken(token) {
         let found = ArcGisTokenManager.invalidateToken(token);
@@ -184,22 +179,18 @@ export class ArcGisAccessClient {
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal
    */
-    cacheEndpoint(url, endpoint, obj) {
-        if (endpoint === ArcGisOAuth2EndpointType.Authorize) {
-            this._oauthAuthorizeEndPointsCache.set(url, obj);
-        }
-        else {
-            this._oauthTokenEndPointsCache.set(url, obj);
-        }
+    cacheEndpoint(url, endpointType, endPoint) {
+        const entry = endpointType === ArcGisOAuth2EndpointType.Authorize ? { authorizeEndpoint: endPoint } : { tokenEndpoint: endPoint };
+        this._endPointsCache.set(url, entry);
     }
     /**
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal
    */
-    async createEndpoint(url, endpoint) {
+    async createEndpoint(mapLayerUrl, oauthEndpointUrl, endpointType) {
         // Validate the URL we just composed
-        const oauthEndpoint = new ArcGisOAuth2Endpoint(url, this.constructLoginUrl(url, false), false);
-        this.cacheEndpoint(url, endpoint, oauthEndpoint);
+        const oauthEndpoint = new ArcGisOAuth2Endpoint(oauthEndpointUrl, this.constructLoginUrl(oauthEndpointUrl, false), false);
+        this.cacheEndpoint(mapLayerUrl, endpointType, oauthEndpoint);
         return oauthEndpoint;
     }
     /**
@@ -212,18 +203,30 @@ export class ArcGisAccessClient {
         ];
         return allowedHosts.some((host) => url.hostname.toLowerCase().endsWith(host));
     }
+    async validateEndpointUrl(url) {
+        let valid;
+        try {
+            valid = await ArcGisAccessClient.validateOAuth2Endpoint(url.toString());
+        }
+        catch {
+            // If we reach here, this means we could not validate properly the endpoint;
+            // we cannot conclude the endpoint is invalid though; it might happen endpoint doesn't support CORS requests,
+            // but still valid for Oauth process.
+        }
+        return valid;
+    }
     /**
    * Get OAuth2 endpoint that must be cause to get the Oauth2 token
    * @internal
    */
-    async getOAuth2Endpoint(url, endpointType) {
+    async getOAuth2Endpoint(mapLayerUrl, endpointType) {
         // Return from cache if available
-        const cachedEndpoint = (endpointType === ArcGisOAuth2EndpointType.Authorize ? this._oauthAuthorizeEndPointsCache.get(url) : this._oauthTokenEndPointsCache.get(url));
+        const cachedEndpoint = this._endPointsCache.get(mapLayerUrl);
         if (cachedEndpoint !== undefined) {
-            return cachedEndpoint;
+            return (endpointType === ArcGisOAuth2EndpointType.Authorize ? cachedEndpoint.authorizeEndpoint : cachedEndpoint.authorizeEndpoint);
         }
         const endpointStr = (endpointType === ArcGisOAuth2EndpointType.Authorize ? "authorize" : "token");
-        const urlObj = new URL(url);
+        const urlObj = new URL(mapLayerUrl);
         if (this.isArcGisHostValid(urlObj)) {
             // ArcGIS Online (fixed)
             // Doc: https://developers.arcgis.com/documentation/mapping-apis-and-services/security/oauth-2.0/
@@ -240,24 +243,34 @@ export class ArcGisAccessClient {
                 if (restUrlFromTokenService === undefined) {
                     // We could not derive the token endpoint from 'tokenServicesUrl'.
                     // ArcGIS Enterprise Format https://<host>:<port>/<subdirectory>/sharing/rest/oauth2/authorize
-                    const regExMatch = url.match(new RegExp(/([^&\/]+)\/rest\/services\/.*/, "i"));
+                    const regExMatch = mapLayerUrl.match(new RegExp(/([^&\/]+)\/rest\/services\/.*/, "i"));
                     if (regExMatch !== null && regExMatch.length >= 2) {
                         const subdirectory = regExMatch[1];
                         const port = (urlObj.port !== "80" && urlObj.port !== "443") ? `:${urlObj.port}` : "";
                         const newUrlObj = new URL(`${urlObj.protocol}//${urlObj.hostname}${port}/${subdirectory}/sharing/rest/oauth2/${endpointStr}`);
                         // Check again the URL we just composed
-                        return await this.createEndpoint(newUrlObj.toString(), endpointType);
+                        const isValidUrl = await this.validateEndpointUrl(newUrlObj.toString());
+                        if (isValidUrl === undefined || isValidUrl) {
+                            const endpoint = await this.createEndpoint(mapLayerUrl, newUrlObj.toString(), endpointType);
+                            if (endpoint)
+                                return endpoint;
+                        }
                     }
                 }
                 else {
-                    const endpoint = await this.createEndpoint(`${restUrlFromTokenService.toString()}oauth2/${endpointStr}`, endpointType);
-                    if (endpoint)
-                        return endpoint;
+                    const isValidUrl = await this.validateEndpointUrl(restUrlFromTokenService.toString());
+                    if (isValidUrl === undefined || isValidUrl) {
+                        const endpoint = await this.createEndpoint(mapLayerUrl, `${restUrlFromTokenService.toString()}oauth2/${endpointStr}`, endpointType);
+                        if (endpoint)
+                            return endpoint;
+                    }
                 }
             }
             catch {
             }
         }
+        // If we reach here, we were not successful creating an endpoint
+        this._endPointsCache.set(mapLayerUrl, {}); // Cache an empty entry, and avoid making repeated failing requests.
         return undefined; // we could not find any valid oauth2 endpoint
     }
     /**

package/lib/esm/ArcGis/ArcGisAccessClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"ArcGisAccessClient.js","sourceRoot":"","sources":["../../../src/ArcGis/ArcGisAccessClient.ts"],"names":[],"mappings":"AAAA;;;+FAG+F;AAC/F;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAqB,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAuCxC,YAAY;AACZ,MAAM,OAAO,kBAAkB;IAS7B;QARgB,sBAAiB,GAAG,IAAI,OAAO,EAAE,CAAC;QAKlD,sDAAsD;QAC9C,sBAAiB,GAAG,KAAK,CAAC;QA2LlC,kDAAkD;QAClD,8EAA8E;QAC9E,4DAA4D;QACpD,kCAA6B,GAAG,IAAI,GAAG,EAAe,CAAC;QACvD,8BAAyB,GAAG,IAAI,GAAG,EAAe,CAAC;IA5L3D,CAAC;IAEM,UAAU,CAAC,WAA+B;QAC/C,IAAI,WAAW,EAAE;YACf,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,eAAe,CAAC;YAC/C,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC;YAExC,IAAI,CAAC,yBAAyB,EAAE,CAAC;SAClC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,yBAAyB;QAC9B,MAAc,CAAC,oBAAoB,GAAG,CAAC,gBAA2B,EAAE,EAAE;YACrE,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,SAAS,CAAC;YAEd,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;gBACxD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC;gBAC3C,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;gBAC1D,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;gBAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;gBACzD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;gBAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;gBACtD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;gBACrD,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE;oBAC9H,IAAI,cAAc,CAAC;oBACnB,IAAI;wBACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBACnC,SAAS,GAAG,KAAK,EAAE,UAAU,CAAC;wBAC9B,cAAc,GAAG,KAAK,EAAE,cAAc,CAAC;qBAExC;oBAAC,MAAM;qBACP;oBACD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;oBACvC,MAAM,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAG,6EAA6E;oBACrI,IAAI,cAAc,KAAK,SAAS,EAAE;wBAChC,kBAAkB,CAAC,cAAc,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;wBAChG,YAAY,GAAG,IAAI,CAAC;qBACrB;iBAEF;aACF;YACD,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC,CAAC;IACJ,CAAC;IAEM,YAAY;QACjB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC5B,MAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,MAAiC;QAC3D,+FAA+F;QAE/F,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1F,IAAI,WAAW;gBACb,OAAO,WAAW,CAAC;SACtB;QAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE;YACtC,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC;SAChJ;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAAC,WAAmB;QACtD,IAAI,aAA+C,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC3B,4GAA4G;YAC5G,2CAA2C;YAC3C,IAAI;gBACF,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;gBAC9F,IAAI,aAAa,EAAE;iBAElB;aACF;YAAC,MAAM;aAEP;SACF;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAEM,eAAe,CAAC,KAA0B;QAC/C,IAAI,KAAK,GAAG,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE;YACV,KAAK,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;SACzD;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEM,6BAA6B,CAAC,GAAW;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE;YACd,OAAO,SAAS,CAAC;SAClB;QAED,IAAI,QAA4B,CAAC;QACjC,IAAI,eAAmC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE;YAC7B,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,EAAE;gBAC/B,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC;aAClC;iBAAM;gBACL,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;oBACtD,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;iBAC3B;aACF;SACF;QAED,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE;YAC3D,QAAQ,GAAG,eAAe,CAAC;SAC5B;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAW,oBAAoB;QAC7B,OAAO,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC/C,CAAC;IAED,IAAW,oBAAoB,CAAC,QAA4B;QAC1D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;YACjC,IAAI,CAAC,UAAU,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;SACtD;QACD,IAAI,CAAC,UAAU,CAAC,oBAAoB,GAAG,QAAQ,CAAC;IAClD,CAAC;IAED,IAAW,yBAAyB;QAClC,OAAO,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAC9C,CAAC;IAEM,qBAAqB,CAAC,cAAsB,EAAE,QAAgB;QAEnE,IAAI,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc,CAAC,CAAC;YACnH,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE;gBACnB,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;aACnE;iBAAM;gBACL,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;aACxE;SACF;aAAM;YACL,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;gBACjC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;aACtB;YACD,IAAI,CAAC,UAAU,CAAC,mBAAmB,GAAG,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;SACtE;IACH,CAAC;IAEM,wBAAwB,CAAC,QAAkC;QAEhE,IAAI,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE;YACxC,IAAI,CAAC,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAAC,CAAC;SAC/I;IAEH,CAAC;IAED,cAAc;IACd,gBAAgB;IACR,KAAK,CAAC,2BAA2B,CAAC,WAAmB;QAC3D,IAAI;YACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACpG,IAAI,aAAa,KAAK,SAAS,EAAE;gBAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzD,OAAO,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;aACnE;SACF;QAAC,MAAM,GAAG;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAQD;;;KAGC;IACO,aAAa,CAAC,GAAW,EAAE,QAAkC,EAAE,GAAyB;QAC9F,IAAI,QAAQ,KAAK,wBAAwB,CAAC,SAAS,EAAE;YACnD,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;SAClD;aAAM;YACL,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;SAC9C;IACH,CAAC;IAED;;;KAGC;IACO,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,QAAkC;QAC1E,oCAAoC;QACpC,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/F,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACjD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;MAGE;IACM,iBAAiB,CAAC,GAAQ;QAChC,MAAM,YAAY,GAAG;YACnB,YAAY;SACb,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAED;;;KAGC;IACO,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,YAAsC;QACjF,iCAAiC;QACjC,MAAM,cAAc,GAAG,CAAC,YAAY,KAAK,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrK,IAAI,cAAc,KAAK,SAAS,EAAE;YAChC,OAAO,cAAc,CAAC;SACvB;QAED,MAAM,WAAW,GAAG,CAAC,YAAY,KAAK,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAElG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;YAClC,wBAAwB;YACxB,iGAAiG;YAEjG,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE;gBAC3C,OAAO,SAAS,CAAC;aAClB;YAED,MAAM,SAAS,GAAG,8CAA8C,WAAW,EAAE,CAAC;YAC9E,OAAO,IAAI,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;SAC3F;aAAM;YAEL,wGAAwG;YACxG,IAAI;gBACF,MAAM,uBAAuB,GAAG,MAAM,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;gBACvF,IAAI,uBAAuB,KAAK,SAAS,EAAE;oBACzC,kEAAkE;oBAClE,8FAA8F;oBAC9F,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC/E,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE;wBACjD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBACnC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,GAAG,IAAI,IAAI,YAAY,wBAAwB,WAAW,EAAE,CAAC,CAAC;wBAE9H,uCAAuC;wBACvC,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;qBACtE;iBACF;qBAAM;oBACL,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;oBACvH,IAAI,QAAQ;wBACV,OAAO,QAAQ,CAAC;iBACnB;aACF;YAAC,MAAM;aAEP;SAEF;QACD,OAAO,SAAS,CAAC,CAAG,8CAA8C;IACpE,CAAC;IAED;;;KAGC;IACO,iBAAiB,CAAC,GAAW,EAAE,cAAuB;QAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,oBAAoB;QACpB,IAAI,cAAc,EAAE;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;YAC3C,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE;gBAC1B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;aAChD;SAEF;aAAM;YACL,MAAM,QAAQ,GAAG,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE;gBAC1B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;aAChD;SACF;QAED,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;YACjC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;SAC7D;QAED,IAAI,IAAI,CAAC,WAAW;YAClB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAE5D,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;CAEF","sourcesContent":["/*---------------------------------------------------------------------------------------------\r\n* Copyright (c) Bentley Systems, Incorporated. All rights reserved.\r\n* See LICENSE.md in the project root for license terms and full copyright notice.\r\n*--------------------------------------------------------------------------------------------*/\r\n/** @packageDocumentation\r\n * @module Tiles\r\n */\r\n\r\nimport { assert, BeEvent } from \"@itwin/core-bentley\";\r\nimport { MapLayerAccessClient, MapLayerAccessToken, MapLayerAccessTokenParams, MapLayerTokenEndpoint } from \"@itwin/core-frontend\";\r\nimport { ArcGisOAuth2Token, ArcGisTokenClientType } from \"./ArcGisTokenGenerator\";\r\nimport { ArcGisOAuth2Endpoint, ArcGisOAuth2EndpointType } from \"./ArcGisOAuth2Endpoint\";\r\nimport { ArcGisTokenManager } from \"./ArcGisTokenManager\";\r\nimport { ArcGisUrl } from \"./ArcGisUrl\";\r\n\r\n/** @beta */\r\nexport interface ArcGisEnterpriseClientId {\r\n  /* Oauth API endpoint base URL (i.e. https://hostname/portal/sharing/oauth2/authorize)\r\n  used to identify uniquely each enterprise server. */\r\n  serviceBaseUrl: string;\r\n\r\n  /* Application's clientId for this enterprise server.*/\r\n  clientId: string;\r\n}\r\n\r\n/** @beta */\r\nexport interface ArcGisOAuthClientIds {\r\n  /* Application's OAuth clientId in ArcGIS online */\r\n  arcgisOnlineClientId?: string;\r\n\r\n  /* Application's OAuth clientId for each enterprise server used. */\r\n  enterpriseClientIds?: ArcGisEnterpriseClientId[];\r\n}\r\n\r\n/** @beta\r\n * ArcGIS OAuth configurations parameters.\r\n * See https://developers.arcgis.com/documentation/mapping-apis-and-services/security/arcgis-identity/serverless-web-apps/\r\n * more details.\r\n*/\r\nexport interface ArcGisOAuthConfig {\r\n  /* URL to which a user is sent once they complete sign in authorization.\r\n    Must match a URI you define in the developer dashboard, otherwise, the authorization will be rejected.\r\n  */\r\n  redirectUri: string;\r\n\r\n  /* Optional expiration after which the token will expire. Defined in minutes with a maximum of two weeks (20160 minutes)*/\r\n  tokenExpiration?: number;\r\n\r\n  /* Application client Ids */\r\n  clientIds: ArcGisOAuthClientIds;\r\n}\r\n\r\n/** @beta */\r\nexport class ArcGisAccessClient implements MapLayerAccessClient {\r\n  public readonly onOAuthProcessEnd = new BeEvent();\r\n  private _redirectUri: string | undefined;\r\n  private _expiration: number | undefined;\r\n  private _clientIds: ArcGisOAuthClientIds | undefined;\r\n\r\n  // Should be kept to 'false'. Debugging purposes only.\r\n  private _forceLegacyToken = false;\r\n\r\n  public constructor() {\r\n  }\r\n\r\n  public initialize(oAuthConfig?: ArcGisOAuthConfig): boolean {\r\n    if (oAuthConfig) {\r\n      this._redirectUri = oAuthConfig.redirectUri;\r\n      this._expiration = oAuthConfig.tokenExpiration;\r\n      this._clientIds = oAuthConfig.clientIds;\r\n\r\n      this.initOauthCallbackFunction();\r\n    }\r\n    return true;\r\n  }\r\n\r\n  private initOauthCallbackFunction() {\r\n    (window as any).arcGisOAuth2Callback = (redirectLocation?: Location) => {\r\n      let eventSuccess = false;\r\n      let stateData;\r\n\r\n      if (redirectLocation && redirectLocation.hash.length > 0) {\r\n        const locationHash = redirectLocation.hash;\r\n        const hashParams = new URLSearchParams(locationHash.substring(1));\r\n        const token = hashParams.get(\"access_token\") ?? undefined;\r\n        const expiresInStr = hashParams.get(\"expires_in\") ?? undefined;\r\n        const userName = hashParams.get(\"username\") ?? undefined;\r\n        const ssl = hashParams.get(\"ssl\") === \"true\";\r\n        const stateStr = hashParams.get(\"state\") ?? undefined;\r\n        const persist = hashParams.get(\"persist\") === \"true\";\r\n        if (token !== undefined && expiresInStr !== undefined && userName !== undefined && ssl !== undefined && stateStr !== undefined) {\r\n          let endpointOrigin;\r\n          try {\r\n            const state = JSON.parse(stateStr);\r\n            stateData = state?.customData;\r\n            endpointOrigin = state?.endpointOrigin;\r\n\r\n          } catch {\r\n          }\r\n          const expiresIn = Number(expiresInStr);\r\n          const expiresAt = (expiresIn * 1000) + (+new Date());   // Converts the token expiration delay (seconds) into a timestamp (UNIX time)\r\n          if (endpointOrigin !== undefined) {\r\n            ArcGisTokenManager.setOAuth2Token(endpointOrigin, { token, expiresAt, ssl, userName, persist });\r\n            eventSuccess = true;\r\n          }\r\n\r\n        }\r\n      }\r\n      this.onOAuthProcessEnd.raiseEvent(eventSuccess, stateData);\r\n    };\r\n  }\r\n\r\n  public unInitialize() {\r\n    this._redirectUri = undefined;\r\n    this._expiration = undefined;\r\n    (window as any).arcGisOAuth2Callback = undefined;\r\n  }\r\n\r\n  public async getAccessToken(params: MapLayerAccessTokenParams): Promise<MapLayerAccessToken | undefined> {\r\n    // First lookup Oauth2 tokens, otherwise check try \"legacy tokens\" if credentials were provided\r\n\r\n    if (!this._forceLegacyToken) {\r\n      const oauth2Token = await this.getOAuthTokenForMapLayerUrl(params.mapLayerUrl.toString());\r\n      if (oauth2Token)\r\n        return oauth2Token;\r\n    }\r\n\r\n    if (params.userName && params.password) {\r\n      return ArcGisTokenManager.getToken(params.mapLayerUrl.toString(), params.userName, params.password, { client: ArcGisTokenClientType.referer });\r\n    }\r\n\r\n    return undefined;\r\n  }\r\n\r\n  public async getTokenServiceEndPoint(mapLayerUrl: string): Promise<MapLayerTokenEndpoint | undefined> {\r\n    let tokenEndpoint: ArcGisOAuth2Endpoint | undefined;\r\n    if (!this._forceLegacyToken) {\r\n      // Note: we used to validate the endpoint by making a request, but because of CORS isssues with some servers\r\n      // we could not make a reliable validation.\r\n      try {\r\n        tokenEndpoint = await this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);\r\n        if (tokenEndpoint) {\r\n\r\n        }\r\n      } catch {\r\n\r\n      }\r\n    }\r\n\r\n    return tokenEndpoint;\r\n  }\r\n\r\n  public invalidateToken(token: MapLayerAccessToken): boolean {\r\n    let found = ArcGisTokenManager.invalidateToken(token);\r\n    if (!found) {\r\n      found = ArcGisTokenManager.invalidateOAuth2Token(token);\r\n    }\r\n    return found;\r\n  }\r\n\r\n  public get redirectUri() {\r\n    return this._redirectUri;\r\n  }\r\n\r\n  public getMatchingEnterpriseClientId(url: string) {\r\n    const clientIds = this.arcGisEnterpriseClientIds;\r\n    if (!clientIds) {\r\n      return undefined;\r\n    }\r\n\r\n    let clientId: string | undefined;\r\n    let defaultClientId: string | undefined;\r\n    for (const entry of clientIds) {\r\n      if (entry.serviceBaseUrl === \"\") {\r\n        defaultClientId = entry.clientId;\r\n      } else {\r\n        if (url.toLowerCase().startsWith(entry.serviceBaseUrl)) {\r\n          clientId = entry.clientId;\r\n        }\r\n      }\r\n    }\r\n\r\n    // If we could not find a match with serviceBaseUrl, and a default clientId\r\n    // was specified (i.e empty url), then use default clientId\r\n    if (clientId === undefined && defaultClientId !== undefined) {\r\n      clientId = defaultClientId;\r\n    }\r\n    return clientId;\r\n  }\r\n\r\n  public get expiration() {\r\n    return this._expiration;\r\n  }\r\n\r\n  public get arcGisOnlineClientId() {\r\n    return this._clientIds?.arcgisOnlineClientId;\r\n  }\r\n\r\n  public set arcGisOnlineClientId(clientId: string | undefined) {\r\n    if (this._clientIds === undefined) {\r\n      this._clientIds = { arcgisOnlineClientId: clientId };\r\n    }\r\n    this._clientIds.arcgisOnlineClientId = clientId;\r\n  }\r\n\r\n  public get arcGisEnterpriseClientIds() {\r\n    return this._clientIds?.enterpriseClientIds;\r\n  }\r\n\r\n  public setEnterpriseClientId(serviceBaseUrl: string, clientId: string) {\r\n\r\n    if (this._clientIds?.enterpriseClientIds) {\r\n      const foundIdx = this._clientIds.enterpriseClientIds.findIndex((entry) => entry.serviceBaseUrl === serviceBaseUrl);\r\n      if (foundIdx !== -1) {\r\n        this._clientIds.enterpriseClientIds[foundIdx].clientId = clientId;\r\n      } else {\r\n        this._clientIds.enterpriseClientIds.push({ serviceBaseUrl, clientId });\r\n      }\r\n    } else {\r\n      if (this._clientIds === undefined) {\r\n        this._clientIds = {};\r\n      }\r\n      this._clientIds.enterpriseClientIds = [{ serviceBaseUrl, clientId }];\r\n    }\r\n  }\r\n\r\n  public removeEnterpriseClientId(clientId: ArcGisEnterpriseClientId) {\r\n\r\n    if (this._clientIds?.enterpriseClientIds) {\r\n      this._clientIds.enterpriseClientIds = this._clientIds?.enterpriseClientIds?.filter((item) => item.serviceBaseUrl !== clientId.serviceBaseUrl);\r\n    }\r\n\r\n  }\r\n\r\n  /// //////////\r\n  /** @internal */\r\n  private async getOAuthTokenForMapLayerUrl(mapLayerUrl: string): Promise<ArcGisOAuth2Token | undefined> {\r\n    try {\r\n      const oauthEndpoint = await this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);\r\n      if (oauthEndpoint !== undefined) {\r\n        const oauthEndpointUrl = new URL(oauthEndpoint.getUrl());\r\n        return ArcGisTokenManager.getOAuth2Token(oauthEndpointUrl.origin);\r\n      }\r\n    } catch { }\r\n    return undefined;\r\n  }\r\n\r\n  // Derive the Oauth URL from a typical MapLayerURL\r\n  // i.e. \t  https://hostname/server/rest/services/NewYork/NewYork3857/MapServer\r\n  //      =>  https://hostname/portal/sharing/oauth2/authorize\r\n  private _oauthAuthorizeEndPointsCache = new Map<string, any>();\r\n  private _oauthTokenEndPointsCache = new Map<string, any>();\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private cacheEndpoint(url: string, endpoint: ArcGisOAuth2EndpointType, obj: ArcGisOAuth2Endpoint) {\r\n    if (endpoint === ArcGisOAuth2EndpointType.Authorize) {\r\n      this._oauthAuthorizeEndPointsCache.set(url, obj);\r\n    } else {\r\n      this._oauthTokenEndPointsCache.set(url, obj);\r\n    }\r\n  }\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private async createEndpoint(url: string, endpoint: ArcGisOAuth2EndpointType): Promise<ArcGisOAuth2Endpoint | undefined> {\r\n    // Validate the URL we just composed\r\n    const oauthEndpoint = new ArcGisOAuth2Endpoint(url, this.constructLoginUrl(url, false), false);\r\n    this.cacheEndpoint(url, endpoint, oauthEndpoint);\r\n    return oauthEndpoint;\r\n  }\r\n\r\n  /**\r\n  * Returns whether the ArcGis host is valid\r\n  * @internal\r\n  */\r\n  private isArcGisHostValid(url: URL): boolean {\r\n    const allowedHosts = [\r\n      \"arcgis.com\",\r\n    ];\r\n\r\n    return allowedHosts.some((host: string) => url.hostname.toLowerCase().endsWith(host));\r\n  }\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private async getOAuth2Endpoint(url: string, endpointType: ArcGisOAuth2EndpointType): Promise<ArcGisOAuth2Endpoint | undefined> {\r\n    // Return from cache if available\r\n    const cachedEndpoint = (endpointType === ArcGisOAuth2EndpointType.Authorize ? this._oauthAuthorizeEndPointsCache.get(url) : this._oauthTokenEndPointsCache.get(url));\r\n    if (cachedEndpoint !== undefined) {\r\n      return cachedEndpoint;\r\n    }\r\n\r\n    const endpointStr = (endpointType === ArcGisOAuth2EndpointType.Authorize ? \"authorize\" : \"token\");\r\n\r\n    const urlObj = new URL(url);\r\n\r\n    if (this.isArcGisHostValid(urlObj)) {\r\n      // ArcGIS Online (fixed)\r\n      // Doc: https://developers.arcgis.com/documentation/mapping-apis-and-services/security/oauth-2.0/\r\n\r\n      if (this.arcGisOnlineClientId === undefined) {\r\n        return undefined;\r\n      }\r\n\r\n      const oauth2Url = `https://www.arcgis.com/sharing/rest/oauth2/${endpointStr}`;\r\n      return new ArcGisOAuth2Endpoint(oauth2Url, this.constructLoginUrl(oauth2Url, true), true);\r\n    } else {\r\n\r\n      // First attempt: derive the Oauth2 token URL from the 'tokenServicesUrl', exposed by the 'info request'\r\n      try {\r\n        const restUrlFromTokenService = await ArcGisUrl.getRestUrlFromGenerateTokenUrl(urlObj);\r\n        if (restUrlFromTokenService === undefined) {\r\n          // We could not derive the token endpoint from 'tokenServicesUrl'.\r\n          // ArcGIS Enterprise Format https://<host>:<port>/<subdirectory>/sharing/rest/oauth2/authorize\r\n          const regExMatch = url.match(new RegExp(/([^&\\/]+)\\/rest\\/services\\/.*/, \"i\"));\r\n          if (regExMatch !== null && regExMatch.length >= 2) {\r\n            const subdirectory = regExMatch[1];\r\n            const port = (urlObj.port !== \"80\" && urlObj.port !== \"443\") ? `:${urlObj.port}` : \"\";\r\n            const newUrlObj = new URL(`${urlObj.protocol}//${urlObj.hostname}${port}/${subdirectory}/sharing/rest/oauth2/${endpointStr}`);\r\n\r\n            // Check again the URL we just composed\r\n            return await this.createEndpoint(newUrlObj.toString(), endpointType);\r\n          }\r\n        } else {\r\n          const endpoint = await this.createEndpoint(`${restUrlFromTokenService.toString()}oauth2/${endpointStr}`, endpointType);\r\n          if (endpoint)\r\n            return endpoint;\r\n        }\r\n      } catch {\r\n\r\n      }\r\n\r\n    }\r\n    return undefined;   // we could not find any valid oauth2 endpoint\r\n  }\r\n\r\n  /**\r\n * Construct the complete Authorize url to starts the Oauth process\r\n * @internal\r\n */\r\n  private constructLoginUrl(url: string, isArcgisOnline: boolean) {\r\n    const urlObj = new URL(url);\r\n\r\n    // Set the client id\r\n    if (isArcgisOnline) {\r\n      const clientId = this.arcGisOnlineClientId;\r\n      assert(clientId !== undefined);\r\n      if (clientId !== undefined) {\r\n        urlObj.searchParams.set(\"client_id\", clientId);\r\n      }\r\n\r\n    } else {\r\n      const clientId = this.getMatchingEnterpriseClientId(url);\r\n      assert(clientId !== undefined);\r\n      if (undefined !== clientId) {\r\n        urlObj.searchParams.set(\"client_id\", clientId);\r\n      }\r\n    }\r\n\r\n    urlObj.searchParams.set(\"response_type\", \"token\");\r\n    if (this.expiration !== undefined) {\r\n      urlObj.searchParams.set(\"expiration\", `${this.expiration}`);\r\n    }\r\n\r\n    if (this.redirectUri)\r\n      urlObj.searchParams.set(\"redirect_uri\", this.redirectUri);\r\n\r\n    return urlObj.toString();\r\n  }\r\n\r\n}\r\n"]}
+{"version":3,"file":"ArcGisAccessClient.js","sourceRoot":"","sources":["../../../src/ArcGis/ArcGisAccessClient.ts"],"names":[],"mappings":"AAAA;;;+FAG+F;AAC/F;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAqB,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AA8CxC,YAAY;AACZ,MAAM,OAAO,kBAAkB;IAS7B;QARgB,sBAAiB,GAAG,IAAI,OAAO,EAAE,CAAC;QAKlD,sDAAsD;QAC9C,sBAAiB,GAAG,KAAK,CAAC;QAuLlC,uEAAuE;QACvE,8EAA8E;QAC9E,4DAA4D;QAEpD,oBAAe,GAAG,IAAI,GAAG,EAAoC,CAAC;IAxLtE,CAAC;IAEM,UAAU,CAAC,WAA+B;QAC/C,IAAI,WAAW,EAAE;YACf,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,eAAe,CAAC;YAC/C,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC;YAExC,IAAI,CAAC,yBAAyB,EAAE,CAAC;SAClC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,yBAAyB;QAC9B,MAAc,CAAC,oBAAoB,GAAG,CAAC,gBAA2B,EAAE,EAAE;YACrE,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,SAAS,CAAC;YAEd,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;gBACxD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC;gBAC3C,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;gBAC1D,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;gBAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;gBACzD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;gBAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;gBACtD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;gBACrD,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE;oBAC9H,IAAI,cAAc,CAAC;oBACnB,IAAI;wBACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBACnC,SAAS,GAAG,KAAK,EAAE,UAAU,CAAC;wBAC9B,cAAc,GAAG,KAAK,EAAE,cAAc,CAAC;qBAExC;oBAAC,MAAM;qBACP;oBACD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;oBACvC,MAAM,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAG,6EAA6E;oBACrI,IAAI,cAAc,KAAK,SAAS,EAAE;wBAChC,kBAAkB,CAAC,cAAc,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;wBAChG,YAAY,GAAG,IAAI,CAAC;qBACrB;iBAEF;aACF;YACD,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC,CAAC;IACJ,CAAC;IAEM,YAAY;QACjB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC5B,MAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,MAAiC;QAC3D,+FAA+F;QAE/F,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1F,IAAI,WAAW;gBACb,OAAO,WAAW,CAAC;SACtB;QAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE;YACtC,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC;SAChJ;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,gBAAgB;IACT,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,WAAmB;QAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAI,yEAAyE;IAC1G,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAAC,WAAmB;QACtD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC3B,OAAO,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;SAChF;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,eAAe,CAAC,KAA0B;QAC/C,IAAI,KAAK,GAAG,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE;YACV,KAAK,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;SACzD;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEM,6BAA6B,CAAC,GAAW;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE;YACd,OAAO,SAAS,CAAC;SAClB;QAED,IAAI,QAA4B,CAAC;QACjC,IAAI,eAAmC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE;YAC7B,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,EAAE;gBAC/B,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC;aAClC;iBAAM;gBACL,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;oBACtD,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;iBAC3B;aACF;SACF;QAED,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE;YAC3D,QAAQ,GAAG,eAAe,CAAC;SAC5B;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAW,oBAAoB;QAC7B,OAAO,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC/C,CAAC;IAED,IAAW,oBAAoB,CAAC,QAA4B;QAC1D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;YACjC,IAAI,CAAC,UAAU,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;SACtD;QACD,IAAI,CAAC,UAAU,CAAC,oBAAoB,GAAG,QAAQ,CAAC;IAClD,CAAC;IAED,IAAW,yBAAyB;QAClC,OAAO,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAC9C,CAAC;IAEM,qBAAqB,CAAC,cAAsB,EAAE,QAAgB;QAEnE,IAAI,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,cAAc,CAAC,CAAC;YACnH,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE;gBACnB,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;aACnE;iBAAM;gBACL,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;aACxE;SACF;aAAM;YACL,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;gBACjC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;aACtB;YACD,IAAI,CAAC,UAAU,CAAC,mBAAmB,GAAG,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;SACtE;IACH,CAAC;IAEM,wBAAwB,CAAC,QAAkC;QAEhE,IAAI,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE;YACxC,IAAI,CAAC,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAAC,CAAC;SAC/I;IAEH,CAAC;IAED,cAAc;IACd,gBAAgB;IACR,KAAK,CAAC,2BAA2B,CAAC,WAAmB;QAC3D,IAAI;YACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACpG,IAAI,aAAa,KAAK,SAAS,EAAE;gBAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzD,OAAO,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;aACnE;SACF;QAAC,MAAM,GAAG;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAQD;;;KAGC;IACO,aAAa,CAAC,GAAgB,EAAE,YAAsC,EAAE,QAA8B;QAC5G,MAAM,KAAK,GAAG,YAAY,KAAK,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,iBAAiB,EAAE,QAAQ,EAAC,CAAC,CAAC,CAAC,EAAC,aAAa,EAAE,QAAQ,EAAC,CAAC;QAC9H,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;KAGC;IACO,KAAK,CAAC,cAAc,CAAC,WAAwB,EAAE,gBAAwB,EAAE,YAAsC;QACrH,oCAAoC;QACpC,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACzH,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;QAC7D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;MAGE;IACM,iBAAiB,CAAC,GAAQ;QAChC,MAAM,YAAY,GAAG;YACnB,YAAY;SACb,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAW;QAC3C,IAAI,KAAwB,CAAC;QAC7B,IAAI;YACF,KAAK,GAAG,MAAM,kBAAkB,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;SACzE;QAAC,MAAM;YACN,4EAA4E;YAC5E,6GAA6G;YAC7G,qCAAqC;SACtC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;KAGC;IACO,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,YAAsC;QACzF,iCAAiC;QACjC,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7D,IAAI,cAAc,KAAK,SAAS,EAAE;YAChC,OAAO,CAAC,YAAY,KAAK,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;SACpI;QAED,MAAM,WAAW,GAAG,CAAC,YAAY,KAAK,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAElG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEpC,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;YAClC,wBAAwB;YACxB,iGAAiG;YAEjG,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE;gBAC3C,OAAO,SAAS,CAAC;aAClB;YAED,MAAM,SAAS,GAAG,8CAA8C,WAAW,EAAE,CAAC;YAC9E,OAAO,IAAI,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;SAC3F;aAAM;YAEL,wGAAwG;YACxG,IAAI;gBACF,MAAM,uBAAuB,GAAG,MAAM,SAAS,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;gBAEvF,IAAI,uBAAuB,KAAK,SAAS,EAAE;oBACzC,kEAAkE;oBAClE,8FAA8F;oBAC9F,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,CAAC;oBACvF,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE;wBACjD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBACnC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,GAAG,IAAI,IAAI,YAAY,wBAAwB,WAAW,EAAE,CAAC,CAAC;wBAE9H,uCAAuC;wBACvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACxE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,EAAG;4BAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;4BAC5F,IAAI,QAAQ;gCACV,OAAO,QAAQ,CAAC;yBACnB;qBACF;iBACF;qBAAM;oBACL,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACtF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,EAAG;wBAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,WAAW,EAAE,EAAE,YAAY,CAAC,CAAC;wBACpI,IAAI,QAAQ;4BACV,OAAO,QAAQ,CAAC;qBACnB;iBACF;aACF;YAAC,MAAM;aACP;SACF;QAED,gEAAgE;QAChE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAE,oEAAoE;QAEhH,OAAO,SAAS,CAAC,CAAG,8CAA8C;IACpE,CAAC;IAED;;;KAGC;IACO,iBAAiB,CAAC,GAAW,EAAE,cAAuB;QAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,oBAAoB;QACpB,IAAI,cAAc,EAAE;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;YAC3C,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE;gBAC1B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;aAChD;SAEF;aAAM;YACL,MAAM,QAAQ,GAAG,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE;gBAC1B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;aAChD;SACF;QAED,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE;YACjC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;SAC7D;QAED,IAAI,IAAI,CAAC,WAAW;YAClB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAE5D,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;CAEF","sourcesContent":["/*---------------------------------------------------------------------------------------------\r\n* Copyright (c) Bentley Systems, Incorporated. All rights reserved.\r\n* See LICENSE.md in the project root for license terms and full copyright notice.\r\n*--------------------------------------------------------------------------------------------*/\r\n/** @packageDocumentation\r\n * @module Tiles\r\n */\r\n\r\nimport { assert, BeEvent } from \"@itwin/core-bentley\";\r\nimport { MapLayerAccessClient, MapLayerAccessToken, MapLayerAccessTokenParams, MapLayerTokenEndpoint } from \"@itwin/core-frontend\";\r\nimport { ArcGisOAuth2Token, ArcGisTokenClientType } from \"./ArcGisTokenGenerator\";\r\nimport { ArcGisOAuth2Endpoint, ArcGisOAuth2EndpointType } from \"./ArcGisOAuth2Endpoint\";\r\nimport { ArcGisTokenManager } from \"./ArcGisTokenManager\";\r\nimport { ArcGisUrl } from \"./ArcGisUrl\";\r\n\r\n/** @beta */\r\nexport interface ArcGisEnterpriseClientId {\r\n  /* Oauth API endpoint base URL (i.e. https://hostname/portal/sharing/oauth2/authorize)\r\n  used to identify uniquely each enterprise server. */\r\n  serviceBaseUrl: string;\r\n\r\n  /* Application's clientId for this enterprise server.*/\r\n  clientId: string;\r\n}\r\n\r\n/** @beta */\r\nexport interface ArcGisOAuthClientIds {\r\n  /* Application's OAuth clientId in ArcGIS online */\r\n  arcgisOnlineClientId?: string;\r\n\r\n  /* Application's OAuth clientId for each enterprise server used. */\r\n  enterpriseClientIds?: ArcGisEnterpriseClientId[];\r\n}\r\n\r\n/** @beta\r\n * ArcGIS OAuth configurations parameters.\r\n * See https://developers.arcgis.com/documentation/mapping-apis-and-services/security/arcgis-identity/serverless-web-apps/\r\n * more details.\r\n*/\r\nexport interface ArcGisOAuthConfig {\r\n  /* URL to which a user is sent once they complete sign in authorization.\r\n    Must match a URI you define in the developer dashboard, otherwise, the authorization will be rejected.\r\n  */\r\n  redirectUri: string;\r\n\r\n  /* Optional expiration after which the token will expire. Defined in minutes with a maximum of two weeks (20160 minutes)*/\r\n  tokenExpiration?: number;\r\n\r\n  /* Application client Ids */\r\n  clientIds: ArcGisOAuthClientIds;\r\n}\r\n\r\ninterface EndPointsCacheEntry {\r\n  authorizeEndpoint?: ArcGisOAuth2Endpoint;\r\n  tokenEndpoint?: ArcGisOAuth2Endpoint;\r\n}\r\n\r\ntype MapLayerUrl = string;\r\n\r\n/** @beta */\r\nexport class ArcGisAccessClient implements MapLayerAccessClient {\r\n  public readonly onOAuthProcessEnd = new BeEvent();\r\n  private _redirectUri: string | undefined;\r\n  private _expiration: number | undefined;\r\n  private _clientIds: ArcGisOAuthClientIds | undefined;\r\n\r\n  // Should be kept to 'false'. Debugging purposes only.\r\n  private _forceLegacyToken = false;\r\n\r\n  public constructor() {\r\n  }\r\n\r\n  public initialize(oAuthConfig?: ArcGisOAuthConfig): boolean {\r\n    if (oAuthConfig) {\r\n      this._redirectUri = oAuthConfig.redirectUri;\r\n      this._expiration = oAuthConfig.tokenExpiration;\r\n      this._clientIds = oAuthConfig.clientIds;\r\n\r\n      this.initOauthCallbackFunction();\r\n    }\r\n    return true;\r\n  }\r\n\r\n  private initOauthCallbackFunction() {\r\n    (window as any).arcGisOAuth2Callback = (redirectLocation?: Location) => {\r\n      let eventSuccess = false;\r\n      let stateData;\r\n\r\n      if (redirectLocation && redirectLocation.hash.length > 0) {\r\n        const locationHash = redirectLocation.hash;\r\n        const hashParams = new URLSearchParams(locationHash.substring(1));\r\n        const token = hashParams.get(\"access_token\") ?? undefined;\r\n        const expiresInStr = hashParams.get(\"expires_in\") ?? undefined;\r\n        const userName = hashParams.get(\"username\") ?? undefined;\r\n        const ssl = hashParams.get(\"ssl\") === \"true\";\r\n        const stateStr = hashParams.get(\"state\") ?? undefined;\r\n        const persist = hashParams.get(\"persist\") === \"true\";\r\n        if (token !== undefined && expiresInStr !== undefined && userName !== undefined && ssl !== undefined && stateStr !== undefined) {\r\n          let endpointOrigin;\r\n          try {\r\n            const state = JSON.parse(stateStr);\r\n            stateData = state?.customData;\r\n            endpointOrigin = state?.endpointOrigin;\r\n\r\n          } catch {\r\n          }\r\n          const expiresIn = Number(expiresInStr);\r\n          const expiresAt = (expiresIn * 1000) + (+new Date());   // Converts the token expiration delay (seconds) into a timestamp (UNIX time)\r\n          if (endpointOrigin !== undefined) {\r\n            ArcGisTokenManager.setOAuth2Token(endpointOrigin, { token, expiresAt, ssl, userName, persist });\r\n            eventSuccess = true;\r\n          }\r\n\r\n        }\r\n      }\r\n      this.onOAuthProcessEnd.raiseEvent(eventSuccess, stateData);\r\n    };\r\n  }\r\n\r\n  public unInitialize() {\r\n    this._redirectUri = undefined;\r\n    this._expiration = undefined;\r\n    (window as any).arcGisOAuth2Callback = undefined;\r\n  }\r\n\r\n  public async getAccessToken(params: MapLayerAccessTokenParams): Promise<MapLayerAccessToken | undefined> {\r\n    // First lookup Oauth2 tokens, otherwise check try \"legacy tokens\" if credentials were provided\r\n\r\n    if (!this._forceLegacyToken) {\r\n      const oauth2Token = await this.getOAuthTokenForMapLayerUrl(params.mapLayerUrl.toString());\r\n      if (oauth2Token)\r\n        return oauth2Token;\r\n    }\r\n\r\n    if (params.userName && params.password) {\r\n      return ArcGisTokenManager.getToken(params.mapLayerUrl.toString(), params.userName, params.password, { client: ArcGisTokenClientType.referer });\r\n    }\r\n\r\n    return undefined;\r\n  }\r\n\r\n  /** @internal */\r\n  public static async validateOAuth2Endpoint(endpointUrl: string): Promise<boolean> {\r\n    const data = await fetch(endpointUrl, { method: \"GET\" });\r\n    return data.status === 400;    // Oauth2 API returns 400 (Bad Request) when there are missing parameters\r\n  }\r\n\r\n  public async getTokenServiceEndPoint(mapLayerUrl: string): Promise<MapLayerTokenEndpoint | undefined> {\r\n    if (!this._forceLegacyToken) {\r\n      return this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);\r\n    }\r\n\r\n    return undefined;\r\n  }\r\n\r\n  public invalidateToken(token: MapLayerAccessToken): boolean {\r\n    let found = ArcGisTokenManager.invalidateToken(token);\r\n    if (!found) {\r\n      found = ArcGisTokenManager.invalidateOAuth2Token(token);\r\n    }\r\n    return found;\r\n  }\r\n\r\n  public get redirectUri() {\r\n    return this._redirectUri;\r\n  }\r\n\r\n  public getMatchingEnterpriseClientId(url: string) {\r\n    const clientIds = this.arcGisEnterpriseClientIds;\r\n    if (!clientIds) {\r\n      return undefined;\r\n    }\r\n\r\n    let clientId: string | undefined;\r\n    let defaultClientId: string | undefined;\r\n    for (const entry of clientIds) {\r\n      if (entry.serviceBaseUrl === \"\") {\r\n        defaultClientId = entry.clientId;\r\n      } else {\r\n        if (url.toLowerCase().startsWith(entry.serviceBaseUrl)) {\r\n          clientId = entry.clientId;\r\n        }\r\n      }\r\n    }\r\n\r\n    // If we could not find a match with serviceBaseUrl, and a default clientId\r\n    // was specified (i.e empty url), then use default clientId\r\n    if (clientId === undefined && defaultClientId !== undefined) {\r\n      clientId = defaultClientId;\r\n    }\r\n    return clientId;\r\n  }\r\n\r\n  public get expiration() {\r\n    return this._expiration;\r\n  }\r\n\r\n  public get arcGisOnlineClientId() {\r\n    return this._clientIds?.arcgisOnlineClientId;\r\n  }\r\n\r\n  public set arcGisOnlineClientId(clientId: string | undefined) {\r\n    if (this._clientIds === undefined) {\r\n      this._clientIds = { arcgisOnlineClientId: clientId };\r\n    }\r\n    this._clientIds.arcgisOnlineClientId = clientId;\r\n  }\r\n\r\n  public get arcGisEnterpriseClientIds() {\r\n    return this._clientIds?.enterpriseClientIds;\r\n  }\r\n\r\n  public setEnterpriseClientId(serviceBaseUrl: string, clientId: string) {\r\n\r\n    if (this._clientIds?.enterpriseClientIds) {\r\n      const foundIdx = this._clientIds.enterpriseClientIds.findIndex((entry) => entry.serviceBaseUrl === serviceBaseUrl);\r\n      if (foundIdx !== -1) {\r\n        this._clientIds.enterpriseClientIds[foundIdx].clientId = clientId;\r\n      } else {\r\n        this._clientIds.enterpriseClientIds.push({ serviceBaseUrl, clientId });\r\n      }\r\n    } else {\r\n      if (this._clientIds === undefined) {\r\n        this._clientIds = {};\r\n      }\r\n      this._clientIds.enterpriseClientIds = [{ serviceBaseUrl, clientId }];\r\n    }\r\n  }\r\n\r\n  public removeEnterpriseClientId(clientId: ArcGisEnterpriseClientId) {\r\n\r\n    if (this._clientIds?.enterpriseClientIds) {\r\n      this._clientIds.enterpriseClientIds = this._clientIds?.enterpriseClientIds?.filter((item) => item.serviceBaseUrl !== clientId.serviceBaseUrl);\r\n    }\r\n\r\n  }\r\n\r\n  /// //////////\r\n  /** @internal */\r\n  private async getOAuthTokenForMapLayerUrl(mapLayerUrl: string): Promise<ArcGisOAuth2Token | undefined> {\r\n    try {\r\n      const oauthEndpoint = await this.getOAuth2Endpoint(mapLayerUrl, ArcGisOAuth2EndpointType.Authorize);\r\n      if (oauthEndpoint !== undefined) {\r\n        const oauthEndpointUrl = new URL(oauthEndpoint.getUrl());\r\n        return ArcGisTokenManager.getOAuth2Token(oauthEndpointUrl.origin);\r\n      }\r\n    } catch { }\r\n    return undefined;\r\n  }\r\n\r\n  // Mapping between a map-layer URL and its corresponding Oauth endpoint\r\n  // i.e. \t  https://hostname/server/rest/services/NewYork/NewYork3857/MapServer\r\n  //      =>  https://hostname/portal/sharing/oauth2/authorize\r\n\r\n  private _endPointsCache = new Map<MapLayerUrl, EndPointsCacheEntry>();\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private cacheEndpoint(url: MapLayerUrl, endpointType: ArcGisOAuth2EndpointType, endPoint: ArcGisOAuth2Endpoint) {\r\n    const entry = endpointType === ArcGisOAuth2EndpointType.Authorize ? {authorizeEndpoint: endPoint} : {tokenEndpoint: endPoint};\r\n    this._endPointsCache.set(url, entry);\r\n  }\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private async createEndpoint(mapLayerUrl: MapLayerUrl, oauthEndpointUrl: string, endpointType: ArcGisOAuth2EndpointType): Promise<ArcGisOAuth2Endpoint | undefined> {\r\n    // Validate the URL we just composed\r\n    const oauthEndpoint = new ArcGisOAuth2Endpoint(oauthEndpointUrl, this.constructLoginUrl(oauthEndpointUrl, false), false);\r\n    this.cacheEndpoint(mapLayerUrl, endpointType, oauthEndpoint);\r\n    return oauthEndpoint;\r\n  }\r\n\r\n  /**\r\n  * Returns whether the ArcGis host is valid\r\n  * @internal\r\n  */\r\n  private isArcGisHostValid(url: URL): boolean {\r\n    const allowedHosts = [\r\n      \"arcgis.com\",\r\n    ];\r\n\r\n    return allowedHosts.some((host: string) => url.hostname.toLowerCase().endsWith(host));\r\n  }\r\n\r\n  private async validateEndpointUrl(url: string) {\r\n    let valid: boolean|undefined;\r\n    try {\r\n      valid = await ArcGisAccessClient.validateOAuth2Endpoint(url.toString());\r\n    } catch {\r\n      // If we reach here, this means we could not validate properly the endpoint;\r\n      // we cannot conclude the endpoint is invalid though; it might happen endpoint doesn't support CORS requests,\r\n      // but still valid for Oauth process.\r\n    }\r\n    return valid;\r\n  }\r\n\r\n  /**\r\n * Get OAuth2 endpoint that must be cause to get the Oauth2 token\r\n * @internal\r\n */\r\n  private async getOAuth2Endpoint(mapLayerUrl: string, endpointType: ArcGisOAuth2EndpointType): Promise<ArcGisOAuth2Endpoint | undefined> {\r\n    // Return from cache if available\r\n    const cachedEndpoint = this._endPointsCache.get(mapLayerUrl);\r\n    if (cachedEndpoint !== undefined) {\r\n      return (endpointType === ArcGisOAuth2EndpointType.Authorize ? cachedEndpoint.authorizeEndpoint : cachedEndpoint.authorizeEndpoint);\r\n    }\r\n\r\n    const endpointStr = (endpointType === ArcGisOAuth2EndpointType.Authorize ? \"authorize\" : \"token\");\r\n\r\n    const urlObj = new URL(mapLayerUrl);\r\n\r\n    if (this.isArcGisHostValid(urlObj)) {\r\n      // ArcGIS Online (fixed)\r\n      // Doc: https://developers.arcgis.com/documentation/mapping-apis-and-services/security/oauth-2.0/\r\n\r\n      if (this.arcGisOnlineClientId === undefined) {\r\n        return undefined;\r\n      }\r\n\r\n      const oauth2Url = `https://www.arcgis.com/sharing/rest/oauth2/${endpointStr}`;\r\n      return new ArcGisOAuth2Endpoint(oauth2Url, this.constructLoginUrl(oauth2Url, true), true);\r\n    } else {\r\n\r\n      // First attempt: derive the Oauth2 token URL from the 'tokenServicesUrl', exposed by the 'info request'\r\n      try {\r\n        const restUrlFromTokenService = await ArcGisUrl.getRestUrlFromGenerateTokenUrl(urlObj);\r\n\r\n        if (restUrlFromTokenService === undefined) {\r\n          // We could not derive the token endpoint from 'tokenServicesUrl'.\r\n          // ArcGIS Enterprise Format https://<host>:<port>/<subdirectory>/sharing/rest/oauth2/authorize\r\n          const regExMatch = mapLayerUrl.match(new RegExp(/([^&\\/]+)\\/rest\\/services\\/.*/, \"i\"));\r\n          if (regExMatch !== null && regExMatch.length >= 2) {\r\n            const subdirectory = regExMatch[1];\r\n            const port = (urlObj.port !== \"80\" && urlObj.port !== \"443\") ? `:${urlObj.port}` : \"\";\r\n            const newUrlObj = new URL(`${urlObj.protocol}//${urlObj.hostname}${port}/${subdirectory}/sharing/rest/oauth2/${endpointStr}`);\r\n\r\n            // Check again the URL we just composed\r\n            const isValidUrl = await this.validateEndpointUrl(newUrlObj.toString());\r\n            if (isValidUrl === undefined || isValidUrl ) {\r\n              const endpoint = await this.createEndpoint(mapLayerUrl, newUrlObj.toString(), endpointType);\r\n              if (endpoint)\r\n                return endpoint;\r\n            }\r\n          }\r\n        } else {\r\n          const isValidUrl = await this.validateEndpointUrl(restUrlFromTokenService.toString());\r\n          if (isValidUrl === undefined || isValidUrl ) {\r\n            const endpoint = await this.createEndpoint(mapLayerUrl, `${restUrlFromTokenService.toString()}oauth2/${endpointStr}`, endpointType);\r\n            if (endpoint)\r\n              return endpoint;\r\n          }\r\n        }\r\n      } catch {\r\n      }\r\n    }\r\n\r\n    // If we reach here, we were not successful creating an endpoint\r\n    this._endPointsCache.set(mapLayerUrl, {});  // Cache an empty entry, and avoid making repeated failing requests.\r\n\r\n    return undefined;   // we could not find any valid oauth2 endpoint\r\n  }\r\n\r\n  /**\r\n * Construct the complete Authorize url to starts the Oauth process\r\n * @internal\r\n */\r\n  private constructLoginUrl(url: string, isArcgisOnline: boolean) {\r\n    const urlObj = new URL(url);\r\n\r\n    // Set the client id\r\n    if (isArcgisOnline) {\r\n      const clientId = this.arcGisOnlineClientId;\r\n      assert(clientId !== undefined);\r\n      if (clientId !== undefined) {\r\n        urlObj.searchParams.set(\"client_id\", clientId);\r\n      }\r\n\r\n    } else {\r\n      const clientId = this.getMatchingEnterpriseClientId(url);\r\n      assert(clientId !== undefined);\r\n      if (undefined !== clientId) {\r\n        urlObj.searchParams.set(\"client_id\", clientId);\r\n      }\r\n    }\r\n\r\n    urlObj.searchParams.set(\"response_type\", \"token\");\r\n    if (this.expiration !== undefined) {\r\n      urlObj.searchParams.set(\"expiration\", `${this.expiration}`);\r\n    }\r\n\r\n    if (this.redirectUri)\r\n      urlObj.searchParams.set(\"redirect_uri\", this.redirectUri);\r\n\r\n    return urlObj.toString();\r\n  }\r\n\r\n}\r\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itwin/map-layers-auth",
-  "version": "4.3.0-dev.9",
+  "version": "4.4.0-dev.1",
   "description": "Extension that adds a Map Layers Widget",
   "main": "lib/cjs/map-layers-auth.js",
   "module": "lib/esm/map-layers-auth.js",
@@ -39,13 +39,13 @@
     "sinon-chai": "^3.2.0",
     "source-map-support": "^0.5.6",
     "typescript": "~5.0.2",
-    "@itwin/build-tools": "4.3.0-dev.9",
-    "@itwin/core-bentley": "4.3.0-dev.9",
-    "@itwin/core-common": "4.3.0-dev.9",
-    "@itwin/core-frontend": "4.3.0-dev.9"
+    "@itwin/core-frontend": "4.4.0-dev.1",
+    "@itwin/build-tools": "4.4.0-dev.1",
+    "@itwin/core-bentley": "4.4.0-dev.1",
+    "@itwin/core-common": "4.4.0-dev.1"
   },
   "peerDependencies": {
-    "@itwin/core-bentley": "4.3.0-dev.9"
+    "@itwin/core-bentley": "4.4.0-dev.1"
   },
   "nyc": {
     "extends": "./node_modules/@itwin/build-tools/.nycrc",