@muze-nl/metro-oidc 0.3.2 → 0.3.3

package/dist/browser.min.js

@@ -1,2 +1,2 @@
-(()=>{var $e=Object.defineProperty;var ie=(e,r)=>{for(var t in r)$e(e,t,{get:r[t],enumerable:!0})};var $={};ie($,{client:()=>N,formdata:()=>xe,metroError:()=>S,request:()=>D,response:()=>J,trace:()=>Qe,url:()=>E});var W="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var I=class e{#e={url:typeof window<"u"?window.location:"https://localhost"};#t=["get","post","put","delete","patch","head","options","query"];static tracers={};constructor(...r){for(let t of r)if(typeof t=="string"||t instanceof String)this.#e.url=""+t;else if(t instanceof e)Object.assign(this.#e,t.#e);else if(t instanceof Function)this.#r([t]);else if(t&&typeof t=="object")for(let n in t)n=="middlewares"?this.#r(t[n]):typeof t[n]=="function"?this.#e[n]=t[n](this.#e[n],this.#e):this.#e[n]=t[n];this.#e.verbs&&(this.#t=this.#e.verbs,delete this.#e.verbs);for(let t of this.#t)this[t]=async function(...n){return this.fetch(D(this.#e,...n,{method:t.toUpperCase()}))};Object.freeze(this)}#r(r){typeof r=="function"&&(r=[r]);let t=r.findIndex(n=>typeof n!="function");if(t>=0)throw S("metro.client: middlewares must be a function or an array of functions "+W+"client/invalid-middlewares-value/",r[t]);Array.isArray(this.#e.middlewares)||(this.#e.middlewares=[]),this.#e.middlewares=this.#e.middlewares.concat(r)}fetch(r,t){if(r=D(r,t),!r.url)throw S("metro.client."+r.method.toLowerCase()+": Missing url parameter "+W+"client/missing-url-param/",r);if(t||(t={}),typeof t!="object"||Array.isArray(t)||t instanceof String)throw S("metro.client.fetch: Options is not an object");let o=[async function(s){s[Symbol.metroProxy]&&(s=s[Symbol.metroSource]);let d=await fetch(s);return J(d)}].concat(this.#e?.middlewares?.slice()||[]);t=Object.assign({},this.#e,t);let i;for(let u of o)i=function(s,d){return async function(g){let c,f=Object.values(e.tracers);for(let l of f)l.request&&l.request.call(l,g,d);c=await d(g,s);for(let l of f)l.response&&l.response.call(l,c,d);return c}}(i,u);return i(r)}with(...r){return new e(this,...r)}};function N(...e){return new I(...e)}function Ze(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let n of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let o=e[n];if(!(typeof o>"u"||o==null))if(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function")t[n]=o(t[n],t);else if(n=="url")t.url=E(t.url,o);else if(n=="headers"){t.headers=new Headers(r.headers),o instanceof Headers||(o=new Headers(e.headers));for(let[i,u]of o.entries())t.headers.set(i,u)}else t[n]=o}return e instanceof Request&&e.data&&(t.body=e.data),t}function D(...e){let r={url:typeof window<"u"?window.location:"https://localhost/",duplex:"half"};for(let o of e)typeof o=="string"||o instanceof URL||o instanceof URLSearchParams?r.url=E(r.url,o):o&&(o instanceof FormData||o instanceof ReadableStream||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView)?r.body=o:o&&typeof o=="object"&&Object.assign(r,Ze(o,r));let t=r.body;t&&typeof t=="object"&&!(t instanceof String)&&!(t instanceof ReadableStream)&&!(t instanceof Blob)&&!(t instanceof ArrayBuffer)&&!(t instanceof DataView)&&!(t instanceof FormData)&&!(t instanceof URLSearchParams)&&(typeof TypedArray>"u"||!(t instanceof TypedArray))&&(r.body=JSON.stringify(t));let n=new Request(r.url,r);return Object.freeze(n),new Proxy(n,{get(o,i,u){switch(i){case Symbol.metroSource:return o;case Symbol.metroProxy:return!0;case"with":return function(...s){return t&&s.unshift({body:t}),D(o,...s)};case"body":break;case"data":return t}return o[i]instanceof Function?o[i].bind(o):o[i]}})}function Se(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let n of["status","statusText","headers","body","url","type","redirected"]){let o=e[n];typeof o>"u"||o==null||(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function"?t[n]=o(t[n],t):n=="url"?t.url=new URL(o,t.url||"https://localhost/"):t[n]=o)}return e instanceof Response&&e.data&&(t.body=e.data),t}function J(...e){let r={};for(let o of e)typeof o=="string"?r.body=o:o instanceof Response?Object.assign(r,Se(o,r)):o&&typeof o=="object"&&(o instanceof FormData||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView||o instanceof ReadableStream||o instanceof URLSearchParams||o instanceof String||typeof TypedArray<"u"&&o instanceof TypedArray?r.body=o:Object.assign(r,Se(o,r)));let t;r.body&&(t=r.body);let n=new Response(r.body,r);return Object.freeze(n),new Proxy(n,{get(o,i,u){switch(i){case Symbol.metroProxy:return!0;case Symbol.metroSource:return o;case"with":return function(...s){return J(o,...s)};case"data":return t;case"ok":return o.status>=200&&o.status<400}return typeof o[i]=="function"?o[i].bind(o):o[i]}})}function ve(e,r){typeof r=="function"?r(e.searchParams,e):(r=new URLSearchParams(r),r.forEach((t,n)=>{e.searchParams.append(n,t)}))}function E(...e){let r=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let n of e)if(typeof n=="string"||n instanceof String)t=new URL(n,t);else if(n instanceof URL||typeof Location<"u"&&n instanceof Location)t=new URL(n);else if(n instanceof URLSearchParams)ve(t,n);else if(n&&typeof n=="object")for(let o in n)if(o=="search")typeof n.search=="function"?n.search(t.search,t):t.search=new URLSearchParams(n.search);else if(o=="searchParams")ve(t,n.searchParams);else{if(!r.includes(o))throw S("metro.url: unknown url parameter "+W+"url/unknown-param-name/",o);if(typeof n[o]=="function")n[o](t[o],t);else if(typeof n[o]=="string"||n[o]instanceof String||typeof n[o]=="number"||n[o]instanceof Number||typeof n[o]=="boolean"||n[o]instanceof Boolean)t[o]=""+n[o];else if(typeof n[o]=="object"&&n[o].toString)t[o]=n[o].toString();else throw S("metro.url: unsupported value for "+o+" "+W+"url/unsupported-param-value/",e[o])}else throw S("metro.url: unsupported option value "+W+"url/unsupported-option-value/",n);return Object.freeze(t),new Proxy(t,{get(n,o,i){switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return n;case"with":return function(...u){return E(n,...u)}}return n[o]instanceof Function?n[o].bind(n):n[o]}})}function xe(...e){var r=new FormData;for(let t of e)if(t instanceof FormData)for(let n of t.entries())r.append(n[0],n[1]);else if(t&&typeof t=="object")for(let n of Object.entries(t))if(Array.isArray(n[1]))for(let o of n[1])r.append(n[0],o);else r.append(n[0],n[1]);else throw new S("metro.formdata: unknown option type, only FormData or Object supported",t);return Object.freeze(r),new Proxy(r,{get:(t,n,o)=>{switch(n){case Symbol.metroProxy:return!0;case Symbol.metroSource:return t;case"with":return function(...i){return xe(t,...i)}}return t[n]instanceof Function?t[n].bind(t):t[n]}})}var V={error:(e,...r)=>{console.error("\u24C2\uFE0F  ",e,...r)},info:(e,...r)=>{console.info("\u24C2\uFE0F  ",e,...r)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function S(e,...r){return V.error(e,...r),new Error(e,...r)}var Qe={add(e,r){I.tracers[e]=r},delete(e){delete I.tracers[e]},clear(){I.tracers={}},group(){let e=0;return{request:(r,t)=>{e++,V.group(e),V.info(r?.url,r,t)},response:(r,t)=>{V.info(r?.body?r.body[Symbol.metroSource]:null,r,t),V.groupEnd(e),e--}}}};function K(e){return e=Object.assign({mimetype:"application/json",reviver:null,replacer:null,space:""},e),async(r,t)=>{de(r.headers.get("Accept"))||(r=r.with({headers:{Accept:e.mimetype}})),["POST","PUT","PATCH","QUERY"].includes(r.method)&&r.data&&typeof r.data=="object"&&!(r.data instanceof ReadableStream)&&(de(r.headers.get("content-type"))||(r=r.with({headers:{"Content-Type":e.mimetype}})),r=r.with({body:JSON.stringify(r.data,e.replacer,e.space)}));let n=await t(r);if(de(n.headers.get("content-type"))){let i=await n.clone().text();try{let u=JSON.parse(i,e.reviver);return n.with({body:u})}catch{}}return n}}var Ye=/^application\/([a-zA-Z0-9\-_]+\+)?json\b/;function de(e){return Ye.exec(e)}function H(e){return async(r,t)=>{let n=await t(r);if(!n.ok)if(e&&typeof e[n.status]=="function")n=e[n.status].apply(n,r);else throw new Error(n.status+": "+n.statusText,{cause:n});return n}}var Re=Object.assign({},$,{mw:{jsonmw:K,thrower:H}});globalThis.metro||(globalThis.metro=Re);var h=Re;var ae={};ie(ae,{authorizePopup:()=>ze,base64url_encode:()=>me,createState:()=>Te,default:()=>M,generateCodeChallenge:()=>Ee,generateCodeVerifier:()=>je,getExpires:()=>he,isExpired:()=>Oe,isRedirected:()=>_e});globalThis.assertEnabled=!1;var O=(e,r)=>{if(globalThis.assertEnabled){let t=R(e,r);if(t)throw new pe("Assertions failed",t,e)}},w=e=>r=>r==null||typeof r>"u"?!1:R(r,e),x=e=>r=>R(r,e),Ae=e=>r=>r==null||typeof r>"u"?(console.warning("data does not contain recommended value",r,e),!1):R(r,e),Z=(...e)=>r=>{for(let t of e)if(!R(r,t))return!1;return v("data does not match oneOf patterns",r,e)},Pe=(...e)=>r=>{if(!Array.isArray(r))return v("data is not an array",r,"anyOf");for(let t of r)if(Z(...e)(t))return v("data does not match anyOf patterns",t,e);return!1};function b(e){try{if(e instanceof URL&&(e=e.href),new URL(e).href!=e)return v("data is not a valid url",e,"validURL")}catch{return v("data is not a valid url",e,"validURL")}return!1}function R(e,r,t){t||(t=e);let n=[];if(r===Boolean)typeof e!="boolean"&&n.push(v("data is not a boolean",e,r));else if(r===Number)typeof e!="number"&&n.push(v("data is not a number",e,r));else if(r instanceof RegExp)if(Array.isArray(e)){let o=e.findIndex(i=>R(i,r,t));o>-1&&n.push(v("data["+o+"] does not match pattern",e[o],r))}else r.test(e)||n.push(v("data does not match pattern",e,r));else if(r instanceof Function)r(e,t)&&n.push(v("data does not match function",e,r));else if(Array.isArray(r)){Array.isArray(e)||n.push(v("data is not an array",e,[]));for(p of r){let o=R(e,p,t);Array.isArray(o)?n.concat(o):o&&n.push(o)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let o=e.findIndex(i=>R(i,r,t));o>-1&&n.push(v("data["+o+"] does not match pattern",e[o],r))}else if(!e||typeof e!="object")n.push(v("data is not an object, pattern is",e,r));else{e instanceof URLSearchParams&&(e=Object.fromEntries(e));let o=n[n.length-1];for(let[i,u]of Object.entries(r)){let s=R(e[i],u,t);s&&((!o||typeof o=="string")&&(o={},n.push(v(o,e[i],u))),o[i]=s.problems)}}else r!=e&&n.push(v("data and pattern are not equal",e,r));return n.length?n:!1}var pe=class extends Error{constructor(r,t,...n){super(r),this.problems=t,this.details=n}};function v(e,r,t){return{message:e,found:r,expected:t}}function se(e){let r,t;if(typeof localStorage<"u")r={get:()=>localStorage.getItem("metro/state:"+e),set:n=>localStorage.setItem("metro/state:"+e,n),has:()=>localStorage.getItem("metro/state:"+e)!==null},t={get:n=>JSON.parse(localStorage.getItem(e+":"+n)),set:(n,o)=>localStorage.setItem(e+":"+n,JSON.stringify(o)),has:n=>localStorage.getItem(e+":"+n)!==null};else{let n=new Map;r={get:()=>n.get("metro/state:"+e),set:o=>n.set("metro/state:"+e,o),has:()=>n.has("metro/state:"+e)},t=new Map}return{state:r,tokens:t}}function M(e){let r={client:N(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:je(64)},authorize_callback:async c=>(window.location.href!=c.href&&window.location.replace(c.href),!1)};O(e,{});let t=Object.assign({},r.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},r,e),e.oauth2_configuration=t;let n=se(e.site);e.tokens||(e.tokens=n.tokens),e.state||(e.state=n.state),O(e,{oauth2_configuration:{client_id:x(/.+/),grant_type:"authorization_code",authorization_endpoint:x(b),token_endpoint:x(b),redirect_uri:x(b)}});for(let c in t)switch(c){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(c,t[c]);break}return async function(c,f){if(e.force_authorization)return o(c,f);let l;try{if(l=await f(c),l.ok)return l}catch(m){switch(l.status){case 400:case 401:return o(c,f)}throw m}if(!l.ok)switch(l.status){case 400:case 401:return o(c,f)}return l};async function o(c,f){i();let l=e.tokens.get("access_token");if(l)if(Oe(l)){try{if(!await s())return J("false")}catch(m){throw m}return o(c,f)}else return c=D(c,{headers:{Authorization:l.type+" "+l.value}}),f(c);else{try{if(!await u())return J("false")}catch(m){throw m}return o(c,f)}}function i(){if(typeof window<"u"&&window?.location){let c=E(window.location),f,l,m;if(c.searchParams.has("code"))m=c.searchParams,c=c.with({search:""}),history.pushState({},"",c.href);else if(c.hash){let z=c.hash.substr(1);m=new URLSearchParams("?"+z),c=c.with({hash:""}),history.pushState({},"",c.href)}if(m){f=m.get("code"),l=m.get("state");let z=e.state.get("metro/state");if(!l||l!==z)return;f&&e.tokens.set("authorization_code",f)}}}async function u(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let m=await d();if(!e.authorize_callback||typeof e.authorize_callback!="function")throw S("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.authorize_callback");let z=await e.authorize_callback(m);if(z)e.tokens.set("authorization_code",z);else return!1}let c=g(),f=await e.client.post(c);if(!f.ok){let m=await f.text();throw S("OAuth2mw: fetch access_token: "+f.status+": "+f.statusText,{cause:c})}let l=await f.json();if(e.tokens.set("access_token",{value:l.access_token,expires:he(l.expires_in),type:l.token_type,scope:l.scope}),l.refresh_token){let m={value:l.refresh_token};e.tokens.set("refresh_token",m)}return l}async function s(){let c=g("refresh_token"),f=await e.client.post(c);if(!f.ok)throw S("OAuth2mw: refresh access_token: "+f.status+": "+f.statusText,{cause:c});let l=await f.json();if(e.tokens.set("access_token",{value:l.access_token,expires:he(l.expires_in),type:l.token_type,scope:l.scope}),l.refresh_token){let m={value:l.refresh_token};e.tokens.set("refresh_token",m)}else return!1;return l}async function d(){if(!t.authorization_endpoint)throw S("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let c=E(t.authorization_endpoint,{hash:""});O(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let f={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||Te(40)};return t.response_type&&(f.response_type=t.response_type),t.response_mode&&(f.response_mode=t.response_mode),e.state.set(f.state),t.client_secret&&(f.client_secret=t.client_secret),t.code_verifier&&(f.code_challenge=await Ee(t.code_verifier),f.code_challenge_method="S256"),t.scope&&(f.scope=t.scope),t.prompt&&(f.prompt=t.prompt),E(c,{search:f})}function g(c=null){if(O(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw S("oauth2mw: Missing options.endpoints.token url");let f=E(t.token_endpoint,{hash:""}),l={grant_type:c||t.grant_type,client_id:t.client_id};switch(t.code_verifier&&(l.code_verifier=t.code_verifier),t.client_secret&&(l.client_secret=t.client_secret),t.scope&&(l.scope=t.scope),t.grant_type){case"authorization_code":l.redirect_uri=t.redirect_uri,l.code=e.tokens.get("authorization_code");break;case"client_credentials":break;case"refresh_token":l.refresh_token=t.refresh_token;break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return D(f,{method:"POST",body:new URLSearchParams(l)})}}function Oe(e){if(!e)return!0;let r=new Date(e.expires);return new Date().getTime()>r.getTime()}function he(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let r=new Date;return r.setSeconds(r.getSeconds()+e),r}throw new TypeError("Unknown expires type "+e)}function je(e=64){let r=new Uint8Array(e);return globalThis.crypto.getRandomValues(r),me(r)}async function Ee(e){let t=new TextEncoder().encode(e),n=await globalThis.crypto.subtle.digest("SHA-256",t);return me(n)}function me(e){let r=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Te(e){let r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",n=0;for(;n<e;)t+=r.charAt(Math.floor(Math.random()*r.length)),n++;return t}function _e(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let r=e.hash.substr(1);if(params=new URLSearchParams("?"+r),params.has("code"))return!0}return!1}return!0}async function ze(e){return new Promise((r,t)=>{addEventListener("oauth2authorized",n=>{r(event.authorization_code)},{once:!0}),window.open(e)})}var ye={};ie(ye,{default:()=>Ue});var ce={status:200,statusText:"OK",headers:{"Content-Type":"application/json"}},Q=e=>({status:400,statusText:"Bad Request",headers:{"Content-Type":"application/json"},body:JSON.stringify({error:"invalid_request",error_description:e})}),L,Le={};function Ue(e={}){return e=Object.assign({},{PKCE:!1,DPoP:!1},e),async(t,n)=>{let o=h.url(t.url);switch(o.pathname){case"/authorize/":if(L=R(o.searchParams,{response_type:"code",client_id:"mockClientId",state:w(/.*/)}))return h.response(Q(L));if(o.searchParams.has("code_challenge")){if(!o.searchParams.has("code_challenge_method"))return h.response(Q("missing code_challenge_method"));Le.code_challenge=o.searchParams.get("code_challenge"),Le.code_challenge_method=o.searchParams.get("code_challenge_method")}return h.response(ce,{body:JSON.stringify({code:"mockAuthorizeToken",state:o.searchParams.get("state")})});case"/token/":if(t.data instanceof URLSearchParams){let d={};t.data.forEach((g,c)=>d[c]=g),t=t.with({body:d})}if(L=R(t,{method:"POST",data:{grant_type:Z("refresh_token","authorization_code")}}))return h.response(Q(L));switch(t.data.grant_type){case"refresh_token":if(L=R(t.data,Z({refresh_token:"mockRefreshToken",client_id:"mockClientId",client_secret:"mockClientSecret"},{refresh_token:"mockRefreshToken",client_id:"mockClientId",code_verifier:/.+/})))return h.response(Q(L));break;case"access_token":if(L=R(t.data,Z({client_id:"mockClientId",client_secret:"mockClientSecret"},{client_id:"mockClientId",code_challenge:/.*/,code_challenge_method:"S256"})))return h.response(Q(L));break}return h.response(ce,{body:JSON.stringify({access_token:"mockAccessToken",token_type:"mockExample",expires_in:3600,refresh_token:"mockRefreshToken",example_parameter:"mockExampleValue"})});case"/protected/":let i=t.headers.get("Authorization"),[u,s]=i?i.split(" "):[];return!s||s!=="mockAccessToken"?h.response({status:401,statusText:"Forbidden",body:"401 Forbidden"}):h.response(ce,{body:JSON.stringify({result:"Success"})});case"/public/":return h.response(ce,{body:JSON.stringify({result:"Success"})});default:return h.response({status:404,statusText:"not found",body:"404 Not Found "+o})}}}var ge={};ie(ge,{default:()=>Ke});var Ce=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],De=["client_secret_post","client_secret_base","client_secret_jwt","private_key_jwt"],Xe={issuer:x(b),authorization_endpoint:x(b),token_endpoint:x(b),jwks_uri:w(b),registration_endpoint:w(b),scopes_supported:Ae([]),response_types_supported:x(Pe("code","token")),response_modes_supported:w([]),grant_types_supported:w([]),token_endpoint_auth_methods_supported:w([]),token_endpoint_auth_signing_alg_values_supported:w([]),service_documentation:w(b),ui_locales_supported:w([]),op_policy_uri:w(b),op_tos_uri:w(b),revocation_endpoint:w(b),revocation_endpoint_auth_methods_supported:w(De),revocation_endpoint_auth_signing_alg_values_supported:w(Ce),introspection_endpoint:w(b),introspection_endpoint_auth_methods_supported:w(De),introspection_endpoint_auth_signing_alg_values_supported:w(Ce),code_challendge_methods_supported:w([])};function Ke(e={}){let r={client:h.client()};e=Object.assign({},r,e),O(e,{issuer:x(b)});let t=qe(e.issuer),n=e.client.with(e.issuer)}async function qe(e,r){let t=r.get(h.url(e,".wellknown/oauth_authorization_server"));if(t.ok){O(t.headers.get("Content-Type"),/application\/json.*/);let n=await t.json();return O(n,Xe),n}throw h.metroError("metro.oidcmw: Error while fetching "+e+".wellknown/oauth_authorization_server",t)}function Y(){return new Promise((e,r)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=n=>{r(n)},t.onsuccess=n=>{let o=n.target.result;e({set:function(i,u){return new Promise((s,d)=>{let g=o.transaction("keyPairs","readwrite",{durability:"strict"}),c=g.objectStore("keyPairs");g.oncomplete=()=>{s()},g.onerror=d,c.put(i,u)})},get:function(i){return new Promise((u,s)=>{let d=o.transaction("keyPairs","readonly"),c=d.objectStore("keyPairs").get(i);c.onsuccess=()=>{u(c.result)},c.onerror=s,d.onerror=s})},clear:function(){return new Promise((i,u)=>{let s=o.transaction("keyPairs","readwrite"),g=s.objectStore("keyPairs").clear();g.onsuccess=()=>{i()},g.onerror=u,s.onerror=u})}})}})}var et=new TextEncoder,tt=new TextDecoder;function ue(e){return typeof e=="string"?et.encode(e):tt.decode(e)}function He(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new we(`${e.name} modulusLength must be at least 2048 bits`)}function rt(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return He(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return He(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new U}async function ot(e,r,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let n=`${G(ue(JSON.stringify(e)))}.${G(ue(JSON.stringify(r)))}`,o=G(await crypto.subtle.sign(rt(t),t,ue(n)));return`${n}.${o}`}var Ie=32768;function nt(e){e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let t=0;t<e.byteLength;t+=Ie)r.push(String.fromCharCode.apply(null,e.subarray(t,t+Ie)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function G(e){return nt(e)}function it(){return G(crypto.getRandomValues(new Uint8Array(32)))}var U=class extends Error{constructor(r){super(r??"operation not supported"),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},we=class extends Error{constructor(r){super(r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}};function st(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";default:throw new U("unsupported RsaHashedKeyAlgorithm hash name")}}function at(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";default:throw new U("unsupported RsaHashedKeyAlgorithm hash name")}}function ct(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";default:throw new U("unsupported EcKeyAlgorithm namedCurve")}}function ut(e){switch(e.algorithm.name){case"RSA-PSS":return st(e);case"RSASSA-PKCS1-v1_5":return at(e);case"ECDSA":return ct(e);case"Ed25519":return"EdDSA";default:throw new U("unsupported CryptoKey algorithm name")}}function Ne(e){return e instanceof CryptoKey}function lt(e){return Ne(e)&&e.type==="private"}function ft(e){return Ne(e)&&e.type==="public"}function dt(){return Math.floor(Date.now()/1e3)}async function le(e,r,t,n,o,i){let u=e?.privateKey,s=e?.publicKey;if(!lt(u))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!ft(s))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(s.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof r!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(n!==void 0&&typeof n!="string")throw new TypeError('"nonce" must be a string or undefined');if(o!==void 0&&typeof o!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return ot({alg:ut(u),typ:"dpop+jwt",jwk:await pt(s)},{...i,iat:dt(),jti:it(),htm:t,nonce:n,htu:r,ath:o?G(await crypto.subtle.digest("SHA-256",ue(o))):void 0},u)}async function pt(e){let{kty:r,e:t,n,x:o,y:i,crv:u}=await crypto.subtle.exportKey("jwk",e);return{kty:r,crv:u,e:t,n,x:o,y:i}}async function Je(e,r){let t;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":t={name:"RSA-PSS",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":t={name:"ECDSA",namedCurve:"P-256"};break;case"EdDSA":t={name:"Ed25519"};break;default:throw new U}return crypto.subtle.generateKey(t,r?.extractable??!1,["sign","verify"])}function X(e){return O(e,{site:x(b),authorization_endpoint:x(b),token_endpoint:x(b),dpop_signing_alg_values_supported:w([])}),async(r,t)=>{let n=await Y(),o=await n.get(e.site);if(!o){let s=await Je("ES256");o={domain:e.site,keyPair:s},await n.set(o)}let i=h.url(r.url);if(r.url.startsWith(e.authorization_endpoint)){let s=r.body;s instanceof URLSearchParams||s instanceof FormData?s.set("dpop_jkt",o.keyPair.publicKey):s.dpop_jkt=o.keyPair.publicKey}else if(r.url.startsWith(e.token_endpoint)){let s=await le(o.keyPair,r.url,r.method);r=r.with({headers:{DPoP:s}})}else if(r.headers.has("Authorization")){let s=localStorage.getItem(i.host+":nonce")||void 0,d=r.headers.get("Authorization").split(" ")[1],g=await le(o.keyPair,r.url,r.method,s,d);r=r.with({headers:{Authorization:"DPoP "+d,DPoP:g}})}let u=await t(r);return u.headers.get("DPoP-Nonce")&&localStorage.setItem(i.host+":nonce",u.headers.get("DPoP-Nonce")),u}}var ht=Object.assign(ae,{oauth2mw:M,mockserver:ye,discover:ge,tokenstore:se,dpopmw:X,keysstore:Y});globalThis.metro.oauth2||(globalThis.metro.oauth2=ht);globalThis.assertEnabled=!1;function T(e,r){if(globalThis.assertEnabled){let t=P(e,r);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function a(e){return function(t,n,o){if(typeof t<"u"&&t!=null&&typeof e<"u")return P(t,e,n,o)}}function k(e){return function(t,n,o){return t==null||typeof t>"u"?y("data is required",t,e||"any value",o):typeof e<"u"?P(t,e,n,o):!1}}function q(e){return function(t,n,o){return t==null||typeof t>"u"?(console.warn("data does not contain recommended value",t,e,o),!1):P(t,e,n,o)}}function A(...e){return function(t,n,o){for(let i of e)if(!P(t,i,n,o))return!1;return y("data does not match oneOf patterns",t,e,o)}}function B(...e){return function(t,n,o){if(!Array.isArray(t))return y("data is not an array",t,"anyOf",o);for(let i of t)if(A(...e)(i))return y("data does not match anyOf patterns",i,e,o);return!1}}function Me(...e){return function(t,n,o){let i=[];for(let u of e)i=i.concat(P(t,u,n,o));if(i=i.filter(Boolean),i.length)return y("data does not match all given patterns",t,e,o,i)}}function _(e,r,t){try{e instanceof URL&&(e=e.href);let n=new URL(e);if(n.href!=e&&!(n.href+"/"==e||n.href==e+"/"))return y("data is not a valid url",e,"validURL",t)}catch{return y("data is not a valid url",e,"validURL",t)}}function Be(e,r,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return y("data is not a valid email",e,"validEmail",t)}function F(e){return function(t,n,o){if(!(t instanceof e))return y("data is not an instanceof pattern",t,e,o)}}function ee(e){return function(t,n,o){if(!P(t,e,n,o))return y("data matches pattern, when required not to",t,e,o)}}function P(e,r,t,n=""){t||(t=e);let o=[];if(r===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&o.push(y("data is not a boolean",e,r,n));else if(r===Number)typeof e!="number"&&!(e instanceof Number)&&o.push(y("data is not a number",e,r,n));else if(r===String)typeof e!="string"&&!(e instanceof String)&&o.push(y("data is not a string",e,r,n)),e==""&&o.push(y("data is an empty string, which is not allowed",e,r,n));else if(r instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((u,s)=>P(u,r,t,n+"["+s+"]"));i>-1&&o.push(y("data["+i+"] does not match pattern",e[i],r,n+"["+i+"]"))}else typeof e>"u"?o.push(y("data is undefined, should match pattern",e,r,n)):r.test(e)||o.push(y("data does not match pattern",e,r,n));else if(r instanceof Function){let i=r(e,t,n);i&&(Array.isArray(i)?o=o.concat(i):o.push(i))}else if(Array.isArray(r)){Array.isArray(e)||o.push(y("data is not an array",e,[],n));for(let i of r)for(let u of e.keys()){let s=P(e[u],i,t,n+"["+u+"]");Array.isArray(s)?o=o.concat(s):s&&o.push(s)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let i=e.findIndex((u,s)=>P(u,r,t,n+"["+s+"]"));i>-1&&o.push(y("data["+i+"] does not match pattern",e[i],r,n+"["+i+"]"))}else if(!e||typeof e!="object")o.push(y("data is not an object, pattern is",e,r,n));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),r instanceof Function){let i=P(e,r,t,n);i&&(o=o.concat(i))}else for(let[i,u]of Object.entries(r)){let s=P(e[i],u,t,n+"."+i);s&&(o=o.concat(s))}else r!=e&&o.push(y("data and pattern are not equal",e,r,n));return o.length?o:!1}function y(e,r,t,n,o){let i={message:e,found:r,expected:t,path:n};return o&&(i.problems=o),i}var te=(...e)=>(r,t)=>e.filter(n=>t.hasOwnKey(n)).length>0?!1:y("root data must have all of",t,e),C=(...e)=>r=>Array.isArray(r)&&e.filter(t=>!r.includes(t)).length==0?!1:y("data must be an array which includes",r,e);var j=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],fe=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function re(e={}){T(e,{client:a(F(h.client().constructor)),issuer:k(_)});let r={client:h.client().with(H()).with(K()),requireDynamicRegistration:!1};e=Object.assign({},r,e);let t=!1;function n(d){return t}let o={issuer:k(Me(e.issuer,n)),authorization_endpoint:k(_),token_endpoint:k(_),userinfo_endpoint:q(_),jwks_uri:k(_),registration_endpoint:e.requireDynamicRegistration?k(_):q(_),scopes_supported:q(C("openid")),response_types_supported:e.requireDynamicRegistration?k(C("code","id_token","id_token token")):k([]),response_modes_supported:a([]),grant_types_supported:e.requireDynamicRegistration?a(C("authorization_code")):a([]),acr_values_supported:a([]),subject_types_supported:k([]),id_token_signing_alg_values_supported:k(C("RS256")),id_token_encryption_alg_values_supported:a([]),id_token_encryption_enc_values_supported:a([]),userinfo_signing_alg_values_supported:a([]),userinfo_encryption_alg_values_supported:a([]),userinfo_encryption_enc_values_supported:a([]),request_object_signing_alg_values_supported:a(C("RS256")),request_object_encryption_alg_values_supported:a([]),request_object_encryption_enc_values_supported:a([]),token_endpoint_auth_methods_supported:a(B(...fe)),token_endpoint_auth_signing_alg_values_supported:a(C("RS256"),ee(C("none"))),display_values_supported:a(B("page","popup","touch","wap")),claim_types_supported:a(B("normal","aggregated","distributed")),claims_supported:q([]),service_documentation:a(_),claims_locales_supported:a([]),ui_locales_supported:a([]),claims_parameter_supported:a(Boolean),request_parameter_supported:a(Boolean),request_uri_parameter_supported:a(Boolean),op_policy_uri:a(_),op_tos_uri:a(_)},i=h.url(e.issuer,".well-known/openid-configuration"),s=(await e.client.get(i)).data;return T(s,o),T(s.issuer,e.issuer),s}async function oe(e){let r={redirect_uris:k([_]),response_types:a([]),grant_types:a(B("authorization_code","refresh_token")),application_type:a(A("native","web")),contacts:a([Be]),client_name:a(String),logo_uri:a(_),client_uri:a(_),policy_uri:a(_),tos_uri:a(_),jwks_uri:a(_,ee(te("jwks"))),jwks:a(_,ee(te("jwks_uri"))),sector_identifier_uri:a(_),subject_type:a(String),id_token_signed_response_alg:a(A(...j)),id_token_encrypted_response_alg:a(A(...j)),id_token_encrypted_response_enc:a(A(...j),te("id_token_encrypted_response_alg")),userinfo_signed_response_alg:a(A(...j)),userinfo_encrypted_response_alg:a(A(...j)),userinfo_encrypted_response_enc:a(A(...j),te("userinfo_encrypted_response_alg")),request_object_signing_alg:a(A(...j)),request_object_encryption_alg:a(A(...j)),request_object_encryption_enc:a(A(...j)),token_endpoint_auth_method:a(A(...fe)),token_endpoint_auth_signing_alg:a(A(...j)),default_max_age:a(Number),require_auth_time:a(Boolean),default_acr_values:a([String]),initiate_login_uri:a([_]),request_uris:a([_])};T(e,{client:a(F(h.client().constructor)),registration_endpoint:_,client_info:r});let t={client:h.client().with(H()).with(K())};e=Object.assign({},t,e);let n=await e.client.post(e.registration_endpoint,{body:e.client_info}),o=n.data;if(!o.client_id||!o.client_secret)throw h.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",n);return e.client_info=Object.assign(e.client_info,o),e.client_info}function be(e){let r;if(typeof localStorage<"u")r={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,n)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(n)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;r={get:n=>JSON.parse(t.get("metro/oidc:"+e+":"+n)||null),set:(n,o)=>t.set("metro/oidc:"+e+":"+n,JSON.stringify(o)),has:n=>t.has("metro/oidc:"+e+":"+n)}}return r}function ke(e={}){let r={client:N(),force_authorization:!1,use_dpop:!0,authorize_callback:async t=>(window.location.href!=t.href&&window.location.replace(t.href),!1)};return e=Object.assign({},r,e),T(e,{client:k(F(N().constructor)),client_info:k(),issuer:k(_),oauth2:a({}),openid_configuration:a()}),e.store||(e.store=be(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,n)=>{let o;if(!e.force_authorization){try{o=await n(t)}catch(g){if(o.status!=401&&o.status!=403)throw g}if(o.ok||o.status!=401&&o.status!=403)return o}if(e.openid_configuration||(e.openid_configuration=await re({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(T(e.client_info?.client_name,k()),!e.openid_configuration.registration_endpoint)throw S("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await oe({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=e.scope||"openid",u=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,authorize_callback:e.authorize_callback,oauth2_configuration:{client_id:e.client_info.client_id,client_secret:e.client_info.client_secret,grant_type:"authorization_code",response_type:"code",response_mode:"query",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:i,redirect_uri:e.client_info.redirect_uris[0]}}),s=async(g,c)=>{let f=await c(g);if(f.headers.get("content-type")?.startsWith("application/json")){let m=f.data?.id_token;if(!m){let z=f.clone();try{let ne=await z.json();ne&&ne.id_token&&(m=ne.id_token)}catch{}}m&&e.store.set("id_token",m)}return f},d=e.client.with(e.issuer).with(s);if(e.use_dpop){let g={site:e.issuer,authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported};d=d.with(X(g)),u.client=d}return d=d.with(M(u)),o=await d.fetch(t),o}}function Fe(){return _e()}function Ve(e){return e.store.get("id_token")}var We={oidcmw:ke,discover:re,register:oe,isRedirected:Fe,idToken:Ve};globalThis.metro.oidc||(globalThis.metro.oidc=We);var kr=We;})();
+(()=>{var Ze=Object.defineProperty;var se=(e,r)=>{for(var t in r)Ze(e,t,{get:r[t],enumerable:!0})};var $={};se($,{client:()=>N,formdata:()=>Re,metroError:()=>S,request:()=>D,response:()=>M,trace:()=>Ye,url:()=>E});var W="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var I=class e{#e={url:typeof window<"u"?window.location:"https://localhost"};#t=["get","post","put","delete","patch","head","options","query"];static tracers={};constructor(...r){for(let t of r)if(typeof t=="string"||t instanceof String)this.#e.url=""+t;else if(t instanceof e)Object.assign(this.#e,t.#e);else if(t instanceof Function)this.#r([t]);else if(t&&typeof t=="object")for(let n in t)n=="middlewares"?this.#r(t[n]):typeof t[n]=="function"?this.#e[n]=t[n](this.#e[n],this.#e):this.#e[n]=t[n];this.#e.verbs&&(this.#t=this.#e.verbs,delete this.#e.verbs);for(let t of this.#t)this[t]=async function(...n){return this.fetch(D(this.#e,...n,{method:t.toUpperCase()}))};Object.freeze(this)}#r(r){typeof r=="function"&&(r=[r]);let t=r.findIndex(n=>typeof n!="function");if(t>=0)throw S("metro.client: middlewares must be a function or an array of functions "+W+"client/invalid-middlewares-value/",r[t]);Array.isArray(this.#e.middlewares)||(this.#e.middlewares=[]),this.#e.middlewares=this.#e.middlewares.concat(r)}fetch(r,t){if(r=D(r,t),!r.url)throw S("metro.client."+r.method.toLowerCase()+": Missing url parameter "+W+"client/missing-url-param/",r);if(t||(t={}),typeof t!="object"||Array.isArray(t)||t instanceof String)throw S("metro.client.fetch: Options is not an object");let o=[async function(s){s[Symbol.metroProxy]&&(s=s[Symbol.metroSource]);let d=await fetch(s);return M(d)}].concat(this.#e?.middlewares?.slice()||[]);t=Object.assign({},this.#e,t);let i;for(let u of o)i=function(s,d){return async function(g){let c,f=Object.values(e.tracers);for(let l of f)l.request&&l.request.call(l,g,d);c=await d(g,s);for(let l of f)l.response&&l.response.call(l,c,d);return c}}(i,u);return i(r)}with(...r){return new e(this,...r)}};function N(...e){return new I(...e)}function Qe(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let n of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let o=e[n];if(!(typeof o>"u"||o==null))if(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function")t[n]=o(t[n],t);else if(n=="url")t.url=E(t.url,o);else if(n=="headers"){t.headers=new Headers(r.headers),o instanceof Headers||(o=new Headers(e.headers));for(let[i,u]of o.entries())t.headers.set(i,u)}else t[n]=o}return e instanceof Request&&e.data&&(t.body=e.data),t}function D(...e){let r={url:typeof window<"u"?window.location:"https://localhost/",duplex:"half"};for(let o of e)typeof o=="string"||o instanceof URL||o instanceof URLSearchParams?r.url=E(r.url,o):o&&(o instanceof FormData||o instanceof ReadableStream||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView)?r.body=o:o&&typeof o=="object"&&Object.assign(r,Qe(o,r));let t=r.body;t&&typeof t=="object"&&!(t instanceof String)&&!(t instanceof ReadableStream)&&!(t instanceof Blob)&&!(t instanceof ArrayBuffer)&&!(t instanceof DataView)&&!(t instanceof FormData)&&!(t instanceof URLSearchParams)&&(typeof TypedArray>"u"||!(t instanceof TypedArray))&&(r.body=JSON.stringify(t));let n=new Request(r.url,r);return Object.freeze(n),new Proxy(n,{get(o,i,u){switch(i){case Symbol.metroSource:return o;case Symbol.metroProxy:return!0;case"with":return function(...s){return t&&s.unshift({body:t}),D(o,...s)};case"body":break;case"data":return t}return o[i]instanceof Function?o[i].bind(o):o[i]}})}function ve(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let n of["status","statusText","headers","body","url","type","redirected"]){let o=e[n];typeof o>"u"||o==null||(o?.[Symbol.metroProxy]&&(o=o[Symbol.metroSource]),typeof o=="function"?t[n]=o(t[n],t):n=="url"?t.url=new URL(o,t.url||"https://localhost/"):t[n]=o)}return e instanceof Response&&e.data&&(t.body=e.data),t}function M(...e){let r={};for(let o of e)typeof o=="string"?r.body=o:o instanceof Response?Object.assign(r,ve(o,r)):o&&typeof o=="object"&&(o instanceof FormData||o instanceof Blob||o instanceof ArrayBuffer||o instanceof DataView||o instanceof ReadableStream||o instanceof URLSearchParams||o instanceof String||typeof TypedArray<"u"&&o instanceof TypedArray?r.body=o:Object.assign(r,ve(o,r)));let t;r.body&&(t=r.body);let n=new Response(r.body,r);return Object.freeze(n),new Proxy(n,{get(o,i,u){switch(i){case Symbol.metroProxy:return!0;case Symbol.metroSource:return o;case"with":return function(...s){return M(o,...s)};case"data":return t;case"ok":return o.status>=200&&o.status<400}return typeof o[i]=="function"?o[i].bind(o):o[i]}})}function xe(e,r){typeof r=="function"?r(e.searchParams,e):(r=new URLSearchParams(r),r.forEach((t,n)=>{e.searchParams.append(n,t)}))}function E(...e){let r=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let n of e)if(typeof n=="string"||n instanceof String)t=new URL(n,t);else if(n instanceof URL||typeof Location<"u"&&n instanceof Location)t=new URL(n);else if(n instanceof URLSearchParams)xe(t,n);else if(n&&typeof n=="object")for(let o in n)if(o=="search")typeof n.search=="function"?n.search(t.search,t):t.search=new URLSearchParams(n.search);else if(o=="searchParams")xe(t,n.searchParams);else{if(!r.includes(o))throw S("metro.url: unknown url parameter "+W+"url/unknown-param-name/",o);if(typeof n[o]=="function")n[o](t[o],t);else if(typeof n[o]=="string"||n[o]instanceof String||typeof n[o]=="number"||n[o]instanceof Number||typeof n[o]=="boolean"||n[o]instanceof Boolean)t[o]=""+n[o];else if(typeof n[o]=="object"&&n[o].toString)t[o]=n[o].toString();else throw S("metro.url: unsupported value for "+o+" "+W+"url/unsupported-param-value/",e[o])}else throw S("metro.url: unsupported option value "+W+"url/unsupported-option-value/",n);return Object.freeze(t),new Proxy(t,{get(n,o,i){switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return n;case"with":return function(...u){return E(n,...u)}}return n[o]instanceof Function?n[o].bind(n):n[o]}})}function Re(...e){var r=new FormData;for(let t of e)if(t instanceof FormData)for(let n of t.entries())r.append(n[0],n[1]);else if(t&&typeof t=="object")for(let n of Object.entries(t))if(Array.isArray(n[1]))for(let o of n[1])r.append(n[0],o);else r.append(n[0],n[1]);else throw new S("metro.formdata: unknown option type, only FormData or Object supported",t);return Object.freeze(r),new Proxy(r,{get:(t,n,o)=>{switch(n){case Symbol.metroProxy:return!0;case Symbol.metroSource:return t;case"with":return function(...i){return Re(t,...i)}}return t[n]instanceof Function?t[n].bind(t):t[n]}})}var V={error:(e,...r)=>{console.error("\u24C2\uFE0F  ",e,...r)},info:(e,...r)=>{console.info("\u24C2\uFE0F  ",e,...r)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function S(e,...r){return V.error(e,...r),new Error(e,...r)}var Ye={add(e,r){I.tracers[e]=r},delete(e){delete I.tracers[e]},clear(){I.tracers={}},group(){let e=0;return{request:(r,t)=>{e++,V.group(e),V.info(r?.url,r,t)},response:(r,t)=>{V.info(r?.body?r.body[Symbol.metroSource]:null,r,t),V.groupEnd(e),e--}}}};function K(e){return e=Object.assign({mimetype:"application/json",reviver:null,replacer:null,space:""},e),async(r,t)=>{de(r.headers.get("Accept"))||(r=r.with({headers:{Accept:e.mimetype}})),["POST","PUT","PATCH","QUERY"].includes(r.method)&&r.data&&typeof r.data=="object"&&!(r.data instanceof ReadableStream)&&(de(r.headers.get("content-type"))||(r=r.with({headers:{"Content-Type":e.mimetype}})),r=r.with({body:JSON.stringify(r.data,e.replacer,e.space)}));let n=await t(r);if(de(n.headers.get("content-type"))){let i=await n.clone().text();try{let u=JSON.parse(i,e.reviver);return n.with({body:u})}catch{}}return n}}var Ge=/^application\/([a-zA-Z0-9\-_]+\+)?json\b/;function de(e){return Ge.exec(e)}function H(e){return async(r,t)=>{let n=await t(r);if(!n.ok)if(e&&typeof e[n.status]=="function")n=e[n.status].apply(n,r);else throw new Error(n.status+": "+n.statusText,{cause:n});return n}}var Ae=Object.assign({},$,{mw:{jsonmw:K,thrower:H}});globalThis.metro||(globalThis.metro=Ae);var h=Ae;var ae={};se(ae,{base64url_encode:()=>_e,createState:()=>Te,default:()=>J,generateCodeChallenge:()=>Ee,generateCodeVerifier:()=>je,getExpires:()=>he,isAuthorized:()=>qe,isExpired:()=>me,isRedirected:()=>ye});globalThis.assertEnabled=!1;var O=(e,r)=>{if(globalThis.assertEnabled){let t=R(e,r);if(t)throw new pe("Assertions failed",t,e)}},w=e=>r=>r==null||typeof r>"u"?!1:R(r,e),x=e=>r=>R(r,e),Pe=e=>r=>r==null||typeof r>"u"?(console.warning("data does not contain recommended value",r,e),!1):R(r,e),Z=(...e)=>r=>{for(let t of e)if(!R(r,t))return!1;return v("data does not match oneOf patterns",r,e)},Oe=(...e)=>r=>{if(!Array.isArray(r))return v("data is not an array",r,"anyOf");for(let t of r)if(Z(...e)(t))return v("data does not match anyOf patterns",t,e);return!1};function b(e){try{if(e instanceof URL&&(e=e.href),new URL(e).href!=e)return v("data is not a valid url",e,"validURL")}catch{return v("data is not a valid url",e,"validURL")}return!1}function R(e,r,t){t||(t=e);let n=[];if(r===Boolean)typeof e!="boolean"&&n.push(v("data is not a boolean",e,r));else if(r===Number)typeof e!="number"&&n.push(v("data is not a number",e,r));else if(r instanceof RegExp)if(Array.isArray(e)){let o=e.findIndex(i=>R(i,r,t));o>-1&&n.push(v("data["+o+"] does not match pattern",e[o],r))}else r.test(e)||n.push(v("data does not match pattern",e,r));else if(r instanceof Function)r(e,t)&&n.push(v("data does not match function",e,r));else if(Array.isArray(r)){Array.isArray(e)||n.push(v("data is not an array",e,[]));for(p of r){let o=R(e,p,t);Array.isArray(o)?n.concat(o):o&&n.push(o)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let o=e.findIndex(i=>R(i,r,t));o>-1&&n.push(v("data["+o+"] does not match pattern",e[o],r))}else if(!e||typeof e!="object")n.push(v("data is not an object, pattern is",e,r));else{e instanceof URLSearchParams&&(e=Object.fromEntries(e));let o=n[n.length-1];for(let[i,u]of Object.entries(r)){let s=R(e[i],u,t);s&&((!o||typeof o=="string")&&(o={},n.push(v(o,e[i],u))),o[i]=s.problems)}}else r!=e&&n.push(v("data and pattern are not equal",e,r));return n.length?n:!1}var pe=class extends Error{constructor(r,t,...n){super(r),this.problems=t,this.details=n}};function v(e,r,t){return{message:e,found:r,expected:t}}function Q(e){let r,t;if(typeof localStorage<"u")r={get:()=>localStorage.getItem("metro/state:"+e),set:n=>localStorage.setItem("metro/state:"+e,n),has:()=>localStorage.getItem("metro/state:"+e)!==null},t={get:n=>JSON.parse(localStorage.getItem(e+":"+n)),set:(n,o)=>localStorage.setItem(e+":"+n,JSON.stringify(o)),has:n=>localStorage.getItem(e+":"+n)!==null};else{let n=new Map;r={get:()=>n.get("metro/state:"+e),set:o=>n.set("metro/state:"+e,o),has:()=>n.has("metro/state:"+e)},t=new Map}return{state:r,tokens:t}}function J(e){let r={client:N(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:je(64)},authorize_callback:async c=>(window.location.href!=c.href&&window.location.replace(c.href),!1)};O(e,{});let t=Object.assign({},r.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},r,e),e.oauth2_configuration=t;let n=Q(e.site);e.tokens||(e.tokens=n.tokens),e.state||(e.state=n.state),O(e,{oauth2_configuration:{client_id:x(/.+/),grant_type:"authorization_code",authorization_endpoint:x(b),token_endpoint:x(b),redirect_uri:x(b)}});for(let c in t)switch(c){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(c,t[c]);break}return async function(c,f){if(e.force_authorization)return o(c,f);let l;try{if(l=await f(c),l.ok)return l}catch(m){switch(l.status){case 400:case 401:return o(c,f)}throw m}if(!l.ok)switch(l.status){case 400:case 401:return o(c,f)}return l};async function o(c,f){i();let l=e.tokens.get("access_token");if(l)if(me(l)){try{if(!await s())return M("false")}catch(m){throw m}return o(c,f)}else return c=D(c,{headers:{Authorization:l.type+" "+l.value}}),f(c);else{try{if(!await u())return M("false")}catch(m){throw m}return o(c,f)}}function i(){if(typeof window<"u"&&window?.location){let c=E(window.location),f,l,m;if(c.searchParams.has("code"))m=c.searchParams,c=c.with({search:""}),history.pushState({},"",c.href);else if(c.hash){let z=c.hash.substr(1);m=new URLSearchParams("?"+z),c=c.with({hash:""}),history.pushState({},"",c.href)}if(m){f=m.get("code"),l=m.get("state");let z=e.state.get("metro/state");if(!l||l!==z)return;f&&e.tokens.set("authorization_code",f)}}}async function u(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let m=await d();if(!e.authorize_callback||typeof e.authorize_callback!="function")throw S("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.authorize_callback");let z=await e.authorize_callback(m);if(z)e.tokens.set("authorization_code",z);else return!1}let c=g(),f=await e.client.post(c);if(!f.ok){let m=await f.text();throw S("OAuth2mw: fetch access_token: "+f.status+": "+f.statusText,{cause:c})}let l=await f.json();if(e.tokens.set("access_token",{value:l.access_token,expires:he(l.expires_in),type:l.token_type,scope:l.scope}),l.refresh_token){let m={value:l.refresh_token};e.tokens.set("refresh_token",m)}return l}async function s(){let c=g("refresh_token"),f=await e.client.post(c);if(!f.ok)throw S("OAuth2mw: refresh access_token: "+f.status+": "+f.statusText,{cause:c});let l=await f.json();if(e.tokens.set("access_token",{value:l.access_token,expires:he(l.expires_in),type:l.token_type,scope:l.scope}),l.refresh_token){let m={value:l.refresh_token};e.tokens.set("refresh_token",m)}else return!1;return l}async function d(){if(!t.authorization_endpoint)throw S("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let c=E(t.authorization_endpoint,{hash:""});O(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let f={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||Te(40)};return t.response_type&&(f.response_type=t.response_type),t.response_mode&&(f.response_mode=t.response_mode),e.state.set(f.state),t.client_secret&&(f.client_secret=t.client_secret),t.code_verifier&&(f.code_challenge=await Ee(t.code_verifier),f.code_challenge_method="S256"),t.scope&&(f.scope=t.scope),t.prompt&&(f.prompt=t.prompt),E(c,{search:f})}function g(c=null){if(O(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw S("oauth2mw: Missing options.endpoints.token url");let f=E(t.token_endpoint,{hash:""}),l={grant_type:c||t.grant_type,client_id:t.client_id};switch(t.code_verifier&&(l.code_verifier=t.code_verifier),t.client_secret&&(l.client_secret=t.client_secret),t.scope&&(l.scope=t.scope),t.grant_type){case"authorization_code":l.redirect_uri=t.redirect_uri,l.code=e.tokens.get("authorization_code");break;case"client_credentials":break;case"refresh_token":l.refresh_token=t.refresh_token;break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return D(f,{method:"POST",body:new URLSearchParams(l)})}}function me(e){if(!e)return!0;let r=new Date(e.expires);return new Date().getTime()>r.getTime()}function he(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let r=new Date;return r.setSeconds(r.getSeconds()+e),r}throw new TypeError("Unknown expires type "+e)}function je(e=64){let r=new Uint8Array(e);return globalThis.crypto.getRandomValues(r),_e(r)}async function Ee(e){let t=new TextEncoder().encode(e),n=await globalThis.crypto.subtle.digest("SHA-256",t);return _e(n)}function _e(e){let r=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Te(e){let r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",n=0;for(;n<e;)t+=r.charAt(Math.floor(Math.random()*r.length)),n++;return t}function ye(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let r=e.hash.substr(1);if(params=new URLSearchParams("?"+r),params.has("code"))return!0}return!1}return!0}function qe(e){typeof e=="string"&&(e=Q(e).tokens);let r=e.get("access_token");return!!(r&&!me(r)||e.get("refresh_token"))}var ge={};se(ge,{default:()=>Le});var ce={status:200,statusText:"OK",headers:{"Content-Type":"application/json"}},Y=e=>({status:400,statusText:"Bad Request",headers:{"Content-Type":"application/json"},body:JSON.stringify({error:"invalid_request",error_description:e})}),L,ze={};function Le(e={}){return e=Object.assign({},{PKCE:!1,DPoP:!1},e),async(t,n)=>{let o=h.url(t.url);switch(o.pathname){case"/authorize/":if(L=R(o.searchParams,{response_type:"code",client_id:"mockClientId",state:w(/.*/)}))return h.response(Y(L));if(o.searchParams.has("code_challenge")){if(!o.searchParams.has("code_challenge_method"))return h.response(Y("missing code_challenge_method"));ze.code_challenge=o.searchParams.get("code_challenge"),ze.code_challenge_method=o.searchParams.get("code_challenge_method")}return h.response(ce,{body:JSON.stringify({code:"mockAuthorizeToken",state:o.searchParams.get("state")})});case"/token/":if(t.data instanceof URLSearchParams){let d={};t.data.forEach((g,c)=>d[c]=g),t=t.with({body:d})}if(L=R(t,{method:"POST",data:{grant_type:Z("refresh_token","authorization_code")}}))return h.response(Y(L));switch(t.data.grant_type){case"refresh_token":if(L=R(t.data,Z({refresh_token:"mockRefreshToken",client_id:"mockClientId",client_secret:"mockClientSecret"},{refresh_token:"mockRefreshToken",client_id:"mockClientId",code_verifier:/.+/})))return h.response(Y(L));break;case"access_token":if(L=R(t.data,Z({client_id:"mockClientId",client_secret:"mockClientSecret"},{client_id:"mockClientId",code_challenge:/.*/,code_challenge_method:"S256"})))return h.response(Y(L));break}return h.response(ce,{body:JSON.stringify({access_token:"mockAccessToken",token_type:"mockExample",expires_in:3600,refresh_token:"mockRefreshToken",example_parameter:"mockExampleValue"})});case"/protected/":let i=t.headers.get("Authorization"),[u,s]=i?i.split(" "):[];return!s||s!=="mockAccessToken"?h.response({status:401,statusText:"Forbidden",body:"401 Forbidden"}):h.response(ce,{body:JSON.stringify({result:"Success"})});case"/public/":return h.response(ce,{body:JSON.stringify({result:"Success"})});default:return h.response({status:404,statusText:"not found",body:"404 Not Found "+o})}}}var we={};se(we,{default:()=>De});var Ue=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],Ce=["client_secret_post","client_secret_base","client_secret_jwt","private_key_jwt"],et={issuer:x(b),authorization_endpoint:x(b),token_endpoint:x(b),jwks_uri:w(b),registration_endpoint:w(b),scopes_supported:Pe([]),response_types_supported:x(Oe("code","token")),response_modes_supported:w([]),grant_types_supported:w([]),token_endpoint_auth_methods_supported:w([]),token_endpoint_auth_signing_alg_values_supported:w([]),service_documentation:w(b),ui_locales_supported:w([]),op_policy_uri:w(b),op_tos_uri:w(b),revocation_endpoint:w(b),revocation_endpoint_auth_methods_supported:w(Ce),revocation_endpoint_auth_signing_alg_values_supported:w(Ue),introspection_endpoint:w(b),introspection_endpoint_auth_methods_supported:w(Ce),introspection_endpoint_auth_signing_alg_values_supported:w(Ue),code_challendge_methods_supported:w([])};function De(e={}){let r={client:h.client()};e=Object.assign({},r,e),O(e,{issuer:x(b)});let t=tt(e.issuer),n=e.client.with(e.issuer)}async function tt(e,r){let t=r.get(h.url(e,".wellknown/oauth_authorization_server"));if(t.ok){O(t.headers.get("Content-Type"),/application\/json.*/);let n=await t.json();return O(n,et),n}throw h.metroError("metro.oidcmw: Error while fetching "+e+".wellknown/oauth_authorization_server",t)}function Ke(){let e=new URLSearchParams(window.location.search);if(!e.has("code")&&window.location.hash){let t=window.location.hash.substr(1);e=new URLSearchParams("?"+t)}let r=window.parent?window.parent:window.opener;e.has("code")?r.postMessage({authorization_code:e.get("code")},window.location.origin):e.has("error")?r.postMessage({error},window.location.origin):r.postMessage({error:"Could not find an authorization_code"},window.location.origin)}function He(e){return new Promise((r,t)=>{addEventListener("message",n=>{event.data.authorization_code?r(event.data.authorization_code):event.data.error?t(event.data.error):t("Unknown authorization error")},{once:!0}),window.open(e)})}function G(){return new Promise((e,r)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=n=>{r(n)},t.onsuccess=n=>{let o=n.target.result;e({set:function(i,u){return new Promise((s,d)=>{let g=o.transaction("keyPairs","readwrite",{durability:"strict"}),c=g.objectStore("keyPairs");g.oncomplete=()=>{s()},g.onerror=d,c.put(i,u)})},get:function(i){return new Promise((u,s)=>{let d=o.transaction("keyPairs","readonly"),c=d.objectStore("keyPairs").get(i);c.onsuccess=()=>{u(c.result)},c.onerror=s,d.onerror=s})},clear:function(){return new Promise((i,u)=>{let s=o.transaction("keyPairs","readwrite"),g=s.objectStore("keyPairs").clear();g.onsuccess=()=>{i()},g.onerror=u,s.onerror=u})}})}})}var rt=new TextEncoder,ot=new TextDecoder;function ue(e){return typeof e=="string"?rt.encode(e):ot.decode(e)}function Ie(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new be(`${e.name} modulusLength must be at least 2048 bits`)}function nt(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return Ie(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return Ie(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new U}async function it(e,r,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let n=`${X(ue(JSON.stringify(e)))}.${X(ue(JSON.stringify(r)))}`,o=X(await crypto.subtle.sign(nt(t),t,ue(n)));return`${n}.${o}`}var Ne=32768;function st(e){e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let t=0;t<e.byteLength;t+=Ne)r.push(String.fromCharCode.apply(null,e.subarray(t,t+Ne)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function X(e){return st(e)}function at(){return X(crypto.getRandomValues(new Uint8Array(32)))}var U=class extends Error{constructor(r){super(r??"operation not supported"),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},be=class extends Error{constructor(r){super(r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}};function ct(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";default:throw new U("unsupported RsaHashedKeyAlgorithm hash name")}}function ut(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";default:throw new U("unsupported RsaHashedKeyAlgorithm hash name")}}function lt(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";default:throw new U("unsupported EcKeyAlgorithm namedCurve")}}function ft(e){switch(e.algorithm.name){case"RSA-PSS":return ct(e);case"RSASSA-PKCS1-v1_5":return ut(e);case"ECDSA":return lt(e);case"Ed25519":return"EdDSA";default:throw new U("unsupported CryptoKey algorithm name")}}function Me(e){return e instanceof CryptoKey}function dt(e){return Me(e)&&e.type==="private"}function pt(e){return Me(e)&&e.type==="public"}function ht(){return Math.floor(Date.now()/1e3)}async function le(e,r,t,n,o,i){let u=e?.privateKey,s=e?.publicKey;if(!dt(u))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!pt(s))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(s.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof r!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(n!==void 0&&typeof n!="string")throw new TypeError('"nonce" must be a string or undefined');if(o!==void 0&&typeof o!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return it({alg:ft(u),typ:"dpop+jwt",jwk:await mt(s)},{...i,iat:ht(),jti:at(),htm:t,nonce:n,htu:r,ath:o?X(await crypto.subtle.digest("SHA-256",ue(o))):void 0},u)}async function mt(e){let{kty:r,e:t,n,x:o,y:i,crv:u}=await crypto.subtle.exportKey("jwk",e);return{kty:r,crv:u,e:t,n,x:o,y:i}}async function Je(e,r){let t;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":t={name:"RSA-PSS",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":t={name:"ECDSA",namedCurve:"P-256"};break;case"EdDSA":t={name:"Ed25519"};break;default:throw new U}return crypto.subtle.generateKey(t,r?.extractable??!1,["sign","verify"])}function q(e){return O(e,{site:x(b),authorization_endpoint:x(b),token_endpoint:x(b),dpop_signing_alg_values_supported:w([])}),async(r,t)=>{let n=await G(),o=await n.get(e.site);if(!o){let s=await Je("ES256");o={domain:e.site,keyPair:s},await n.set(o)}let i=h.url(r.url);if(r.url.startsWith(e.authorization_endpoint)){let s=r.body;s instanceof URLSearchParams||s instanceof FormData?s.set("dpop_jkt",o.keyPair.publicKey):s.dpop_jkt=o.keyPair.publicKey}else if(r.url.startsWith(e.token_endpoint)){let s=await le(o.keyPair,r.url,r.method);r=r.with({headers:{DPoP:s}})}else if(r.headers.has("Authorization")){let s=localStorage.getItem(i.host+":nonce")||void 0,d=r.headers.get("Authorization").split(" ")[1],g=await le(o.keyPair,r.url,r.method,s,d);r=r.with({headers:{Authorization:"DPoP "+d,DPoP:g}})}let u=await t(r);return u.headers.get("DPoP-Nonce")&&localStorage.setItem(i.host+":nonce",u.headers.get("DPoP-Nonce")),u}}var _t=Object.assign(ae,{oauth2mw:J,mockserver:ge,discover:we,tokenstore:Q,dpopmw:q,keysstore:G,authorizePopup:He,popupHandleRedirect:Ke});globalThis.metro.oauth2||(globalThis.metro.oauth2=_t);globalThis.assertEnabled=!1;function T(e,r){if(globalThis.assertEnabled){let t=P(e,r);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function a(e){return function(t,n,o){if(typeof t<"u"&&t!=null&&typeof e<"u")return P(t,e,n,o)}}function k(e){return function(t,n,o){return t==null||typeof t>"u"?y("data is required",t,e||"any value",o):typeof e<"u"?P(t,e,n,o):!1}}function ee(e){return function(t,n,o){return t==null||typeof t>"u"?(console.warn("data does not contain recommended value",t,e,o),!1):P(t,e,n,o)}}function A(...e){return function(t,n,o){for(let i of e)if(!P(t,i,n,o))return!1;return y("data does not match oneOf patterns",t,e,o)}}function B(...e){return function(t,n,o){if(!Array.isArray(t))return y("data is not an array",t,"anyOf",o);for(let i of t)if(A(...e)(i))return y("data does not match anyOf patterns",i,e,o);return!1}}function Be(...e){return function(t,n,o){let i=[];for(let u of e)i=i.concat(P(t,u,n,o));if(i=i.filter(Boolean),i.length)return y("data does not match all given patterns",t,e,o,i)}}function _(e,r,t){try{e instanceof URL&&(e=e.href);let n=new URL(e);if(n.href!=e&&!(n.href+"/"==e||n.href==e+"/"))return y("data is not a valid url",e,"validURL",t)}catch{return y("data is not a valid url",e,"validURL",t)}}function Fe(e,r,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return y("data is not a valid email",e,"validEmail",t)}function F(e){return function(t,n,o){if(!(t instanceof e))return y("data is not an instanceof pattern",t,e,o)}}function te(e){return function(t,n,o){if(!P(t,e,n,o))return y("data matches pattern, when required not to",t,e,o)}}function P(e,r,t,n=""){t||(t=e);let o=[];if(r===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&o.push(y("data is not a boolean",e,r,n));else if(r===Number)typeof e!="number"&&!(e instanceof Number)&&o.push(y("data is not a number",e,r,n));else if(r===String)typeof e!="string"&&!(e instanceof String)&&o.push(y("data is not a string",e,r,n)),e==""&&o.push(y("data is an empty string, which is not allowed",e,r,n));else if(r instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((u,s)=>P(u,r,t,n+"["+s+"]"));i>-1&&o.push(y("data["+i+"] does not match pattern",e[i],r,n+"["+i+"]"))}else typeof e>"u"?o.push(y("data is undefined, should match pattern",e,r,n)):r.test(e)||o.push(y("data does not match pattern",e,r,n));else if(r instanceof Function){let i=r(e,t,n);i&&(Array.isArray(i)?o=o.concat(i):o.push(i))}else if(Array.isArray(r)){Array.isArray(e)||o.push(y("data is not an array",e,[],n));for(let i of r)for(let u of e.keys()){let s=P(e[u],i,t,n+"["+u+"]");Array.isArray(s)?o=o.concat(s):s&&o.push(s)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let i=e.findIndex((u,s)=>P(u,r,t,n+"["+s+"]"));i>-1&&o.push(y("data["+i+"] does not match pattern",e[i],r,n+"["+i+"]"))}else if(!e||typeof e!="object")o.push(y("data is not an object, pattern is",e,r,n));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),r instanceof Function){let i=P(e,r,t,n);i&&(o=o.concat(i))}else for(let[i,u]of Object.entries(r)){let s=P(e[i],u,t,n+"."+i);s&&(o=o.concat(s))}else r!=e&&o.push(y("data and pattern are not equal",e,r,n));return o.length?o:!1}function y(e,r,t,n,o){let i={message:e,found:r,expected:t,path:n};return o&&(i.problems=o),i}var re=(...e)=>(r,t)=>e.filter(n=>t.hasOwnKey(n)).length>0?!1:y("root data must have all of",t,e),C=(...e)=>r=>Array.isArray(r)&&e.filter(t=>!r.includes(t)).length==0?!1:y("data must be an array which includes",r,e);var j=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],fe=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function oe(e={}){T(e,{client:a(F(h.client().constructor)),issuer:k(_)});let r={client:h.client().with(H()).with(K()),requireDynamicRegistration:!1};e=Object.assign({},r,e);let t=!1;function n(d){return t}let o={issuer:k(Be(e.issuer,n)),authorization_endpoint:k(_),token_endpoint:k(_),userinfo_endpoint:ee(_),jwks_uri:k(_),registration_endpoint:e.requireDynamicRegistration?k(_):ee(_),scopes_supported:ee(C("openid")),response_types_supported:e.requireDynamicRegistration?k(C("code","id_token","id_token token")):k([]),response_modes_supported:a([]),grant_types_supported:e.requireDynamicRegistration?a(C("authorization_code")):a([]),acr_values_supported:a([]),subject_types_supported:k([]),id_token_signing_alg_values_supported:k(C("RS256")),id_token_encryption_alg_values_supported:a([]),id_token_encryption_enc_values_supported:a([]),userinfo_signing_alg_values_supported:a([]),userinfo_encryption_alg_values_supported:a([]),userinfo_encryption_enc_values_supported:a([]),request_object_signing_alg_values_supported:a(C("RS256")),request_object_encryption_alg_values_supported:a([]),request_object_encryption_enc_values_supported:a([]),token_endpoint_auth_methods_supported:a(B(...fe)),token_endpoint_auth_signing_alg_values_supported:a(C("RS256"),te(C("none"))),display_values_supported:a(B("page","popup","touch","wap")),claim_types_supported:a(B("normal","aggregated","distributed")),claims_supported:ee([]),service_documentation:a(_),claims_locales_supported:a([]),ui_locales_supported:a([]),claims_parameter_supported:a(Boolean),request_parameter_supported:a(Boolean),request_uri_parameter_supported:a(Boolean),op_policy_uri:a(_),op_tos_uri:a(_)},i=h.url(e.issuer,".well-known/openid-configuration"),s=(await e.client.get(i)).data;return T(s,o),T(s.issuer,e.issuer),s}async function ne(e){let r={redirect_uris:k([_]),response_types:a([]),grant_types:a(B("authorization_code","refresh_token")),application_type:a(A("native","web")),contacts:a([Fe]),client_name:a(String),logo_uri:a(_),client_uri:a(_),policy_uri:a(_),tos_uri:a(_),jwks_uri:a(_,te(re("jwks"))),jwks:a(_,te(re("jwks_uri"))),sector_identifier_uri:a(_),subject_type:a(String),id_token_signed_response_alg:a(A(...j)),id_token_encrypted_response_alg:a(A(...j)),id_token_encrypted_response_enc:a(A(...j),re("id_token_encrypted_response_alg")),userinfo_signed_response_alg:a(A(...j)),userinfo_encrypted_response_alg:a(A(...j)),userinfo_encrypted_response_enc:a(A(...j),re("userinfo_encrypted_response_alg")),request_object_signing_alg:a(A(...j)),request_object_encryption_alg:a(A(...j)),request_object_encryption_enc:a(A(...j)),token_endpoint_auth_method:a(A(...fe)),token_endpoint_auth_signing_alg:a(A(...j)),default_max_age:a(Number),require_auth_time:a(Boolean),default_acr_values:a([String]),initiate_login_uri:a([_]),request_uris:a([_])};T(e,{client:a(F(h.client().constructor)),registration_endpoint:_,client_info:r});let t={client:h.client().with(H()).with(K())};e=Object.assign({},t,e);let n=await e.client.post(e.registration_endpoint,{body:e.client_info}),o=n.data;if(!o.client_id||!o.client_secret)throw h.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",n);return e.client_info=Object.assign(e.client_info,o),e.client_info}function ke(e){let r;if(typeof localStorage<"u")r={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,n)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(n)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;r={get:n=>JSON.parse(t.get("metro/oidc:"+e+":"+n)||null),set:(n,o)=>t.set("metro/oidc:"+e+":"+n,JSON.stringify(o)),has:n=>t.has("metro/oidc:"+e+":"+n)}}return r}function Se(e={}){let r={client:N(),force_authorization:!1,use_dpop:!0,authorize_callback:async t=>(window.location.href!=t.href&&window.location.replace(t.href),!1)};return e=Object.assign({},r,e),T(e,{client:k(F(N().constructor)),client_info:k(),issuer:k(_),oauth2:a({}),openid_configuration:a()}),e.store||(e.store=ke(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,n)=>{let o;if(!e.force_authorization){try{o=await n(t)}catch(g){if(o.status!=401&&o.status!=403)throw g}if(o.ok||o.status!=401&&o.status!=403)return o}if(e.openid_configuration||(e.openid_configuration=await oe({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(T(e.client_info?.client_name,k()),!e.openid_configuration.registration_endpoint)throw S("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await ne({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=e.scope||"openid",u=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,authorize_callback:e.authorize_callback,oauth2_configuration:{client_id:e.client_info.client_id,client_secret:e.client_info.client_secret,grant_type:"authorization_code",response_type:"code",response_mode:"query",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:i,redirect_uri:e.client_info.redirect_uris[0]}}),s=async(g,c)=>{let f=await c(g);if(f.headers.get("content-type")?.startsWith("application/json")){let m=f.data?.id_token;if(!m){let z=f.clone();try{let ie=await z.json();ie&&ie.id_token&&(m=ie.id_token)}catch{}}m&&e.store.set("id_token",m)}return f},d=e.client.with(e.issuer).with(s);if(e.use_dpop){let g={site:e.issuer,authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported};d=d.with(q(g)),u.client=d}return d=d.with(J(u)),o=await d.fetch(t),o}}function Ve(){return ye()}function We(e){return e.store.get("id_token")}var $e={oidcmw:Se,discover:oe,register:ne,isRedirected:Ve,idToken:We};globalThis.metro.oidc||(globalThis.metro.oidc=$e);var Rr=$e;})();
 //# sourceMappingURL=browser.min.js.map