@muze-nl/metro-oidc 0.3.5 → 0.4.0

package/dist/browser.min.js

@@ -1,2 +1,2 @@
-(()=>{var Ke=Object.defineProperty;var X=(e,r)=>{for(var t in r)Ke(e,t,{get:r[t],enumerable:!0})};var N={};X(N,{client:()=>D,formdata:()=>_e,metroError:()=>k,request:()=>T,response:()=>K,trace:()=>Ie,url:()=>x});var E="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var C=class e{#e={url:typeof window<"u"?window.location:"https://localhost"};#t=["get","post","put","delete","patch","head","options","query"];static tracers={};constructor(...r){for(let t of r)if(typeof t=="string"||t instanceof String)this.#e.url=""+t;else if(t instanceof e)Object.assign(this.#e,t.#e);else if(t instanceof Function)this.#r([t]);else if(t&&typeof t=="object")for(let o in t)o=="middlewares"?this.#r(t[o]):typeof t[o]=="function"?this.#e[o]=t[o](this.#e[o],this.#e):this.#e[o]=t[o];this.#e.verbs&&(this.#t=this.#e.verbs,delete this.#e.verbs);for(let t of this.#t)this[t]=async function(...o){return this.fetch(T(this.#e,...o,{method:t.toUpperCase()}))};Object.freeze(this)}#r(r){typeof r=="function"&&(r=[r]);let t=r.findIndex(o=>typeof o!="function");if(t>=0)throw k("metro.client: middlewares must be a function or an array of functions "+E+"client/invalid-middlewares/",r[t]);Array.isArray(this.#e.middlewares)||(this.#e.middlewares=[]),this.#e.middlewares=this.#e.middlewares.concat(r)}fetch(r,t){if(r=T(r,t),!r.url)throw k("metro.client."+r.method.toLowerCase()+": Missing url parameter "+E+"client/fetch-missing-url/",r);if(t||(t={}),typeof t!="object"||t instanceof String)throw k("metro.client.fetch: Invalid options parameter "+E+"client/fetch-invalid-options/",t);let n=[async function(a){a[Symbol.metroProxy]&&(a=a[Symbol.metroSource]);let h=await fetch(a);return K(h)}].concat(this.#e?.middlewares?.slice()||[]);t=Object.assign({},this.#e,t);let i;for(let l of n)i=function(a,h){return async function(g){let c,d=Object.values(e.tracers);for(let u of d)u.request&&u.request.call(u,g,h);c=await h(g,a);for(let u of d)u.response&&u.response.call(u,c,h);return c}}(i,l);return i(r)}with(...r){return new e(this,...r)}};function D(...e){return new C(...e)}function He(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let o of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let n=e[o];if(!(typeof n>"u"||n==null))if(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function")t[o]=n(t[o],t);else if(o=="url")t.url=x(t.url,n);else if(o=="headers"){t.headers=new Headers(r.headers),n instanceof Headers||(n=new Headers(e.headers));for(let[i,l]of n.entries())t.headers.set(i,l)}else t[o]=n}return e instanceof Request&&e.data&&(t.body=e.data),t}function T(...e){let r={url:typeof window<"u"?window.location:"https://localhost/",duplex:"half"};for(let n of e)typeof n=="string"||n instanceof URL||n instanceof URLSearchParams?r.url=x(r.url,n):n&&(n instanceof FormData||n instanceof ReadableStream||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView)?r.body=n:n&&typeof n=="object"&&Object.assign(r,He(n,r));let t=new Request(r.url,r),o=r.body;return o&&typeof o=="object"&&!(o instanceof String)&&!(o instanceof ReadableStream)&&!(o instanceof Blob)&&!(o instanceof ArrayBuffer)&&!(o instanceof DataView)&&!(o instanceof FormData)&&!(o instanceof URLSearchParams)&&(typeof TypedArray>"u"||!(o instanceof TypedArray))&&typeof o.toString=="function"&&(r.body=o.toString({headers:t.headers}),t=new Request(r.url,r)),Object.freeze(t),new Proxy(t,{get(n,i,l){switch(i){case Symbol.metroSource:return n;case Symbol.metroProxy:return!0;case"with":return function(...a){return o&&a.unshift({body:o}),T(n,...a)};case"data":return o}return n[i]instanceof Function?n[i].bind(n):n[i]}})}function he(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let o of["status","statusText","headers","body","url","type","redirected"]){let n=e[o];typeof n>"u"||n==null||(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function"?t[o]=n(t[o],t):o=="url"?t.url=new URL(n,t.url||"https://localhost/"):t[o]=n)}return e instanceof Response&&e.data&&(t.body=e.data),t}function K(...e){let r={};for(let n of e)typeof n=="string"?r.body=n:n instanceof Response?Object.assign(r,he(n,r)):n&&typeof n=="object"&&(n instanceof FormData||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView||n instanceof ReadableStream||n instanceof URLSearchParams||n instanceof String||typeof TypedArray<"u"&&n instanceof TypedArray?r.body=n:Object.assign(r,he(n,r)));let t;r.body&&(t=r.body),[101,204,205,304].includes(r.status)&&(r.body=null);let o=new Response(r.body,r);return Object.freeze(o),new Proxy(o,{get(n,i,l){switch(i){case Symbol.metroProxy:return!0;case Symbol.metroSource:return n;case"with":return function(...a){return K(n,...a)};case"data":return t;case"ok":return n.status>=200&&n.status<400}return typeof n[i]=="function"?n[i].bind(n):n[i]}})}function me(e,r){typeof r=="function"?r(e.searchParams,e):(r=new URLSearchParams(r),r.forEach((t,o)=>{e.searchParams.append(o,t)}))}function x(...e){let r=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let o of e)if(typeof o=="string"||o instanceof String)t=new URL(o,t);else if(o instanceof URL||typeof Location<"u"&&o instanceof Location)t=new URL(o);else if(o instanceof URLSearchParams)me(t,o);else if(o&&typeof o=="object")for(let n in o)switch(n){case"search":typeof o.search=="function"?o.search(t.search,t):t.search=new URLSearchParams(o.search);break;case"searchParams":me(t,o.searchParams);break;default:if(!r.includes(n))throw k("metro.url: unknown url parameter "+E+"url/unknown-param-name/",n);if(typeof o[n]=="function")o[n](t[n],t);else if(typeof o[n]=="string"||o[n]instanceof String||typeof o[n]=="number"||o[n]instanceof Number||typeof o[n]=="boolean"||o[n]instanceof Boolean)t[n]=""+o[n];else if(typeof o[n]=="object"&&o[n].toString)t[n]=o[n].toString();else throw k("metro.url: unsupported value for "+n+" "+E+"url/unsupported-param-value/",e[n]);break}else throw k("metro.url: unsupported option value "+E+"url/unsupported-option-value/",o);return Object.freeze(t),new Proxy(t,{get(o,n,i){switch(n){case Symbol.metroProxy:return!0;case Symbol.metroSource:return o;case"with":return function(...l){return x(o,...l)};case"filename":return o.pathname.split("/").pop();case"folderpath":return o.pathname.substring(0,o.pathname.lastIndexOf("\\")+1)}return o[n]instanceof Function?o[n].bind(o):o[n]}})}function _e(...e){var r=new FormData;for(let t of e)if(t instanceof HTMLFormElement&&(t=new FormData(t)),t instanceof FormData)for(let o of t.entries())r.append(o[0],o[1]);else if(t&&typeof t=="object")for(let o of Object.entries(t))if(Array.isArray(o[1]))for(let n of o[1])r.append(o[0],n);else r.append(o[0],o[1]);else throw new k("metro.formdata: unknown option type "+E+"formdata/unknown-option-value/",t);return Object.freeze(r),new Proxy(r,{get:(t,o,n)=>{switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return t;case"with":return function(...i){return _e(t,...i)}}return t[o]instanceof Function?t[o].bind(t):t[o]}})}var M={error:(e,...r)=>{console.error("\u24C2\uFE0F  ",e,...r)},info:(e,...r)=>{console.info("\u24C2\uFE0F  ",e,...r)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function k(e,...r){return M.error(e,...r),new Error(e,...r)}var Ie={add(e,r){C.tracers[e]=r},delete(e){delete C.tracers[e]},clear(){C.tracers={}},group(){let e=0;return{request:(r,t)=>{e++,M.group(e),M.info(r?.url,r,t)},response:(r,t)=>{M.info(r?.body?r.body[Symbol.metroSource]:null,r,t),M.groupEnd(e),e--}}}};function z(e){return e=Object.assign({mimetype:"application/json",reviver:null,replacer:null,space:""},e),async(r,t)=>{ie(r.headers.get("Accept"))||(r=r.with({headers:{Accept:e.mimetype}})),["POST","PUT","PATCH","QUERY"].includes(r.method)&&r.data&&typeof r.data=="object"&&!(r.data instanceof ReadableStream)&&(ie(r.headers.get("content-type"))||(r=r.with({headers:{"Content-Type":e.mimetype}})),r=r.with({body:JSON.stringify(r.data,e.replacer,e.space)}));let o=await t(r);if(ie(o.headers.get("content-type"))){let i=await o.clone().text();try{let l=JSON.parse(i,e.reviver);return o.with({body:l})}catch{}}return o}}var Me=/^application\/([a-zA-Z0-9\-_]+\+)?json\b/;function ie(e){return Me.exec(e)}function L(e){return async(r,t)=>{let o=await t(r);if(!o.ok)if(e&&typeof e[o.status]=="function")o=e[o.status].apply(o,r);else throw new Error(o.status+": "+o.statusText,{cause:o});return o}}var ye=Object.assign({},N,{mw:{jsonmw:z,thrower:L}});globalThis.metro||(globalThis.metro=ye);var m=ye;var q={};X(q,{base64url_encode:()=>ce,createState:()=>Se,default:()=>I,generateCodeChallenge:()=>ke,generateCodeVerifier:()=>be,getExpires:()=>se,isAuthorized:()=>Je,isExpired:()=>ae,isRedirected:()=>ue});globalThis.assertEnabled=!1;function w(e,r){if(globalThis.assertEnabled){let t=S(e,r);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function s(e){return function(t,o,n){if(typeof t<"u"&&t!=null&&typeof e<"u")return S(t,e,o,n)}}function p(e){return function(t,o,n){return t==null||typeof t>"u"?y("data is required",t,e||"any value",n):typeof e<"u"?S(t,e,o,n):!1}}function U(e){return function(t,o,n){return t==null||typeof t>"u"?(console.warn("data does not contain recommended value",t,e,n),!1):S(t,e,o,n)}}function b(...e){return function(t,o,n){for(let i of e)if(!S(t,i,o,n))return!1;return y("data does not match oneOf patterns",t,e,n)}}function P(...e){return function(t,o,n){if(!Array.isArray(t))return y("data is not an array",t,"anyOf",n);for(let i of t)if(b(...e)(i))return y("data does not match anyOf patterns",i,e,n);return!1}}function ge(...e){return function(t,o,n){let i=[];for(let l of e)i=i.concat(S(t,l,o,n));if(i=i.filter(Boolean),i.length)return y("data does not match all given patterns",t,e,n,i)}}function f(e,r,t){try{e instanceof URL&&(e=e.href);let o=new URL(e);if(o.href!=e&&!(o.href+"/"==e||o.href==e+"/"))return y("data is not a valid url",e,"validURL",t)}catch{return y("data is not a valid url",e,"validURL",t)}}function we(e,r,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return y("data is not a valid email",e,"validEmail",t)}function H(e){return function(t,o,n){if(!(t instanceof e))return y("data is not an instanceof pattern",t,e,n)}}function J(e){return function(t,o,n){if(!S(t,e,o,n))return y("data matches pattern, when required not to",t,e,n)}}function S(e,r,t,o=""){t||(t=e);let n=[];if(r===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&n.push(y("data is not a boolean",e,r,o));else if(r===Number)typeof e!="number"&&!(e instanceof Number)&&n.push(y("data is not a number",e,r,o));else if(r===String)typeof e!="string"&&!(e instanceof String)&&n.push(y("data is not a string",e,r,o)),e==""&&n.push(y("data is an empty string, which is not allowed",e,r,o));else if(r instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((l,a)=>S(l,r,t,o+"["+a+"]"));i>-1&&n.push(y("data["+i+"] does not match pattern",e[i],r,o+"["+i+"]"))}else typeof e>"u"?n.push(y("data is undefined, should match pattern",e,r,o)):r.test(e)||n.push(y("data does not match pattern",e,r,o));else if(r instanceof Function){let i=r(e,t,o);i&&(Array.isArray(i)?n=n.concat(i):n.push(i))}else if(Array.isArray(r)){Array.isArray(e)||n.push(y("data is not an array",e,[],o));for(let i of r)for(let l of e.keys()){let a=S(e[l],i,t,o+"["+l+"]");Array.isArray(a)?n=n.concat(a):a&&n.push(a)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let i=e.findIndex((l,a)=>S(l,r,t,o+"["+a+"]"));i>-1&&n.push(y("data["+i+"] does not match pattern",e[i],r,o+"["+i+"]"))}else if(!e||typeof e!="object")n.push(y("data is not an object, pattern is",e,r,o));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),r instanceof Function){let i=S(e,r,t,o);i&&(n=n.concat(i))}else for(let[i,l]of Object.entries(r)){let a=S(e[i],l,t,o+"."+i);a&&(n=n.concat(a))}else r!=e&&n.push(y("data and pattern are not equal",e,r,o));return n.length?n:!1}function y(e,r,t,o,n){let i={message:e,found:r,expected:t,path:o};return n&&(i.problems=n),i}function B(e){let r,t;if(typeof localStorage<"u")r={get:()=>localStorage.getItem("metro/state:"+e),set:o=>localStorage.setItem("metro/state:"+e,o),has:()=>localStorage.getItem("metro/state:"+e)!==null},t={get:o=>JSON.parse(localStorage.getItem(e+":"+o)),set:(o,n)=>localStorage.setItem(e+":"+o,JSON.stringify(n)),has:o=>localStorage.getItem(e+":"+o)!==null};else{let o=new Map;r={get:()=>o.get("metro/state:"+e),set:n=>o.set("metro/state:"+e,n),has:()=>o.has("metro/state:"+e)},t=new Map}return{state:r,tokens:t}}function I(e){let r={client:D(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:be(64)},authorize_callback:async c=>(window.location.href!=c.href&&window.location.replace(c.href),!1)};w(e,{});let t=Object.assign({},r.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},r,e),e.oauth2_configuration=t;let o=B(e.site);e.tokens||(e.tokens=o.tokens),e.state||(e.state=o.state),w(e,{oauth2_configuration:{client_id:p(/.+/),grant_type:"authorization_code",authorization_endpoint:p(f),token_endpoint:p(f),redirect_uri:p(f)}});for(let c in t)switch(c){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(c,t[c]);break}return async function(c,d){if(e.force_authorization)return n(c,d);let u;try{if(u=await d(c),u.ok)return u}catch(_){switch(u.status){case 400:case 401:return n(c,d)}throw _}if(!u.ok)switch(u.status){case 400:case 401:return n(c,d)}return u};async function n(c,d){i();let u=e.tokens.get("access_token");if(u)if(ae(u)){try{if(!await a())return K("false")}catch(_){throw _}return n(c,d)}else return c=T(c,{headers:{Authorization:u.type+" "+u.value}}),d(c);else{try{if(!await l())return K("false")}catch(_){throw _}return n(c,d)}}function i(){if(typeof window<"u"&&window?.location){let c=x(window.location),d,u,_;if(c.searchParams.has("code"))_=c.searchParams,c=c.with({search:""}),history.pushState({},"",c.href);else if(c.hash){let R=c.hash.substr(1);_=new URLSearchParams("?"+R),c=c.with({hash:""}),history.pushState({},"",c.href)}if(_){d=_.get("code"),u=_.get("state");let R=e.state.get("metro/state");if(!u||u!==R)return;d&&e.tokens.set("authorization_code",d)}}}async function l(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let _=await h();if(!e.authorize_callback||typeof e.authorize_callback!="function")throw k("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.authorize_callback");let R=await e.authorize_callback(_);if(R)e.tokens.set("authorization_code",R);else return!1}let c=g(),d=await e.client.post(c);if(!d.ok){let _=await d.text();throw k("OAuth2mw: fetch access_token: "+d.status+": "+d.statusText,{cause:c})}let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:se(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let _={value:u.refresh_token};e.tokens.set("refresh_token",_)}return u}async function a(){let c=g("refresh_token"),d=await e.client.post(c);if(!d.ok)throw k("OAuth2mw: refresh access_token: "+d.status+": "+d.statusText,{cause:c});let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:se(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let _={value:u.refresh_token};e.tokens.set("refresh_token",_)}else return!1;return u}async function h(){if(!t.authorization_endpoint)throw k("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let c=x(t.authorization_endpoint,{hash:""});w(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let d={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||Se(40)};return t.response_type&&(d.response_type=t.response_type),t.response_mode&&(d.response_mode=t.response_mode),e.state.set(d.state),t.client_secret&&(d.client_secret=t.client_secret),t.code_verifier&&(d.code_challenge=await ke(t.code_verifier),d.code_challenge_method="S256"),t.scope&&(d.scope=t.scope),t.prompt&&(d.prompt=t.prompt),x(c,{search:d})}function g(c=null){if(w(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw k("oauth2mw: Missing options.endpoints.token url");let d=x(t.token_endpoint,{hash:""}),u={grant_type:c||t.grant_type,client_id:t.client_id};switch(t.code_verifier&&(u.code_verifier=t.code_verifier),t.client_secret&&(u.client_secret=t.client_secret),t.scope&&(u.scope=t.scope),t.grant_type){case"authorization_code":u.redirect_uri=t.redirect_uri,u.code=e.tokens.get("authorization_code");break;case"client_credentials":break;case"refresh_token":u.refresh_token=t.refresh_token;break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return T(d,{method:"POST",body:new URLSearchParams(u)})}}function ae(e){if(!e)return!0;let r=new Date(e.expires);return new Date().getTime()>r.getTime()}function se(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let r=new Date;return r.setSeconds(r.getSeconds()+e),r}throw new TypeError("Unknown expires type "+e)}function be(e=64){let r=new Uint8Array(e);return globalThis.crypto.getRandomValues(r),ce(r)}async function ke(e){let t=new TextEncoder().encode(e),o=await globalThis.crypto.subtle.digest("SHA-256",t);return ce(o)}function ce(e){let r=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Se(e){let r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",o=0;for(;o<e;)t+=r.charAt(Math.floor(Math.random()*r.length)),o++;return t}function ue(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let r=e.hash.substr(1);if(params=new URLSearchParams("?"+r),params.has("code"))return!0}return!1}return!0}function Je(e){typeof e=="string"&&(e=B(e).tokens);let r=e.get("access_token");return!!(r&&!ae(r)||e.get("refresh_token"))}var le={};X(le,{default:()=>xe});var ee={status:200,statusText:"OK",headers:{"Content-Type":"application/json"}},F=e=>({status:400,statusText:"Bad Request",headers:{"Content-Type":"application/json"},body:JSON.stringify({error:"invalid_request",error_description:e})}),A,ve={};function xe(e={}){return e=Object.assign({},{PKCE:!1,DPoP:!1},e),async(t,o)=>{let n=m.url(t.url);switch(n.pathname){case"/authorize/":if(A=S(n.searchParams,{response_type:"code",client_id:"mockClientId",state:s(/.*/)}))return m.response(F(A));if(n.searchParams.has("code_challenge")){if(!n.searchParams.has("code_challenge_method"))return m.response(F("missing code_challenge_method"));ve.code_challenge=n.searchParams.get("code_challenge"),ve.code_challenge_method=n.searchParams.get("code_challenge_method")}return m.response(ee,{body:JSON.stringify({code:"mockAuthorizeToken",state:n.searchParams.get("state")})});case"/token/":if(t.data instanceof URLSearchParams){let h={};t.data.forEach((g,c)=>h[c]=g),t=t.with({body:h})}if(A=S(t,{method:"POST",data:{grant_type:b("refresh_token","authorization_code")}}))return m.response(F(A));switch(t.data.grant_type){case"refresh_token":if(A=S(t.data,b({refresh_token:"mockRefreshToken",client_id:"mockClientId",client_secret:"mockClientSecret"},{refresh_token:"mockRefreshToken",client_id:"mockClientId",code_verifier:/.+/})))return m.response(F(A));break;case"access_token":if(A=S(t.data,b({client_id:"mockClientId",client_secret:"mockClientSecret"},{client_id:"mockClientId",code_challenge:/.*/,code_challenge_method:"S256"})))return m.response(F(A));break}return m.response(ee,{body:JSON.stringify({access_token:"mockAccessToken",token_type:"mockExample",expires_in:3600,refresh_token:"mockRefreshToken",example_parameter:"mockExampleValue"})});case"/protected/":let i=t.headers.get("Authorization"),[l,a]=i?i.split(" "):[];return!a||a!=="mockAccessToken"?m.response({status:401,statusText:"Forbidden",body:"401 Forbidden"}):m.response(ee,{body:JSON.stringify({result:"Success"})});case"/public/":return m.response(ee,{body:JSON.stringify({result:"Success"})});default:return m.response({status:404,statusText:"not found",body:"404 Not Found "+n})}}}var fe={};X(fe,{default:()=>Ae});var Re=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],Pe=["client_secret_post","client_secret_base","client_secret_jwt","private_key_jwt"],Be={issuer:p(f),authorization_endpoint:p(f),token_endpoint:p(f),jwks_uri:s(f),registration_endpoint:s(f),scopes_supported:U([]),response_types_supported:p(P("code","token")),response_modes_supported:s([]),grant_types_supported:s([]),token_endpoint_auth_methods_supported:s([]),token_endpoint_auth_signing_alg_values_supported:s([]),service_documentation:s(f),ui_locales_supported:s([]),op_policy_uri:s(f),op_tos_uri:s(f),revocation_endpoint:s(f),revocation_endpoint_auth_methods_supported:s(Pe),revocation_endpoint_auth_signing_alg_values_supported:s(Re),introspection_endpoint:s(f),introspection_endpoint_auth_methods_supported:s(Pe),introspection_endpoint_auth_signing_alg_values_supported:s(Re),code_challendge_methods_supported:s([])};function Ae(e={}){let r={client:m.client()};e=Object.assign({},r,e),w(e,{issuer:p(f)});let t=Fe(e.issuer),o=e.client.with(e.issuer)}async function Fe(e,r){let t=r.get(m.url(e,".wellknown/oauth_authorization_server"));if(t.ok){w(t.headers.get("Content-Type"),/application\/json.*/);let o=await t.json();return w(o,Be),o}throw m.metroError("metro.oidcmw: Error while fetching "+e+".wellknown/oauth_authorization_server",t)}function Oe(){let e=new URLSearchParams(window.location.search);if(!e.has("code")&&window.location.hash){let t=window.location.hash.substr(1);e=new URLSearchParams("?"+t)}let r=window.parent?window.parent:window.opener;e.has("code")?r.postMessage({authorization_code:e.get("code")},window.location.origin):e.has("error")?r.postMessage({error},window.location.origin):r.postMessage({error:"Could not find an authorization_code"},window.location.origin)}function je(e){return new Promise((r,t)=>{addEventListener("message",o=>{event.data.authorization_code?r(event.data.authorization_code):event.data.error?t(event.data.error):t("Unknown authorization error")},{once:!0}),window.open(e)})}function W(){return new Promise((e,r)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=o=>{r(o)},t.onsuccess=o=>{let n=o.target.result;e({set:function(i,l){return new Promise((a,h)=>{let g=n.transaction("keyPairs","readwrite",{durability:"strict"}),c=g.objectStore("keyPairs");g.oncomplete=()=>{a()},g.onerror=h,c.put(i,l)})},get:function(i){return new Promise((l,a)=>{let h=n.transaction("keyPairs","readonly"),c=h.objectStore("keyPairs").get(i);c.onsuccess=()=>{l(c.result)},c.onerror=a,h.onerror=a})},clear:function(){return new Promise((i,l)=>{let a=n.transaction("keyPairs","readwrite"),g=a.objectStore("keyPairs").clear();g.onsuccess=()=>{i()},g.onerror=l,a.onerror=l})}})}})}var We=new TextEncoder,Ve=new TextDecoder;function te(e){return typeof e=="string"?We.encode(e):Ve.decode(e)}function Ee(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new de(`${e.name} modulusLength must be at least 2048 bits`)}function $e(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return Ee(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return Ee(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new O}async function Ze(e,r,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let o=`${V(te(JSON.stringify(e)))}.${V(te(JSON.stringify(r)))}`,n=V(await crypto.subtle.sign($e(t),t,te(o)));return`${o}.${n}`}var Te=32768;function Qe(e){e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let t=0;t<e.byteLength;t+=Te)r.push(String.fromCharCode.apply(null,e.subarray(t,t+Te)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function V(e){return Qe(e)}function Ye(){return V(crypto.getRandomValues(new Uint8Array(32)))}var O=class extends Error{constructor(r){super(r??"operation not supported"),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},de=class extends Error{constructor(r){super(r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}};function Ge(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";default:throw new O("unsupported RsaHashedKeyAlgorithm hash name")}}function Xe(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";default:throw new O("unsupported RsaHashedKeyAlgorithm hash name")}}function qe(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";default:throw new O("unsupported EcKeyAlgorithm namedCurve")}}function et(e){switch(e.algorithm.name){case"RSA-PSS":return Ge(e);case"RSASSA-PKCS1-v1_5":return Xe(e);case"ECDSA":return qe(e);case"Ed25519":return"EdDSA";default:throw new O("unsupported CryptoKey algorithm name")}}function ze(e){return e instanceof CryptoKey}function tt(e){return ze(e)&&e.type==="private"}function rt(e){return ze(e)&&e.type==="public"}function ot(){return Math.floor(Date.now()/1e3)}async function re(e,r,t,o,n,i){let l=e?.privateKey,a=e?.publicKey;if(!tt(l))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!rt(a))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(a.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof r!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(o!==void 0&&typeof o!="string")throw new TypeError('"nonce" must be a string or undefined');if(n!==void 0&&typeof n!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return Ze({alg:et(l),typ:"dpop+jwt",jwk:await nt(a)},{...i,iat:ot(),jti:Ye(),htm:t,nonce:o,htu:r,ath:n?V(await crypto.subtle.digest("SHA-256",te(n))):void 0},l)}async function nt(e){let{kty:r,e:t,n:o,x:n,y:i,crv:l}=await crypto.subtle.exportKey("jwk",e);return{kty:r,crv:l,e:t,n:o,x:n,y:i}}async function Le(e,r){let t;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":t={name:"RSA-PSS",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":t={name:"ECDSA",namedCurve:"P-256"};break;case"EdDSA":t={name:"Ed25519"};break;default:throw new O}return crypto.subtle.generateKey(t,r?.extractable??!1,["sign","verify"])}function $(e){return w(e,{site:p(f),authorization_endpoint:p(f),token_endpoint:p(f),dpop_signing_alg_values_supported:s([])}),async(r,t)=>{let o=await W(),n=await o.get(e.site);if(!n){let a=await Le("ES256");n={domain:e.site,keyPair:a},await o.set(n)}let i=m.url(r.url);if(r.url.startsWith(e.authorization_endpoint)){let a=r.body;a instanceof URLSearchParams||a instanceof FormData?a.set("dpop_jkt",n.keyPair.publicKey):a.dpop_jkt=n.keyPair.publicKey}else if(r.url.startsWith(e.token_endpoint)){let a=await re(n.keyPair,r.url,r.method);r=r.with({headers:{DPoP:a}})}else if(r.headers.has("Authorization")){let a=localStorage.getItem(i.host+":nonce")||void 0,h=r.headers.get("Authorization").split(" ")[1],g=await re(n.keyPair,r.url,r.method,a,h);r=r.with({headers:{Authorization:"DPoP "+h,DPoP:g}})}let l=await t(r);return l.headers.get("DPoP-Nonce")&&localStorage.setItem(i.host+":nonce",l.headers.get("DPoP-Nonce")),l}}var it=Object.assign({},q,{oauth2mw:I,mockserver:le,discover:fe,tokenstore:B,dpopmw:$,keysstore:W,authorizePopup:je,popupHandleRedirect:Oe});globalThis.metro.oauth2||(globalThis.metro.oauth2=it);var Z=(...e)=>(r,t)=>e.filter(o=>t.hasOwnKey(o)).length>0?!1:y("root data must have all of",t,e),j=(...e)=>r=>Array.isArray(r)&&e.filter(t=>!r.includes(t)).length==0?!1:y("data must be an array which includes",r,e);var v=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],oe=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function Q(e={}){w(e,{client:s(H(m.client().constructor)),issuer:p(f)});let r={client:m.client().with(L()).with(z()),requireDynamicRegistration:!1};e=Object.assign({},r,e);let t=!1;function o(h){return t}let n={issuer:p(ge(e.issuer,o)),authorization_endpoint:p(f),token_endpoint:p(f),userinfo_endpoint:U(f),jwks_uri:p(f),registration_endpoint:e.requireDynamicRegistration?p(f):U(f),scopes_supported:U(j("openid")),response_types_supported:e.requireDynamicRegistration?p(j("code","id_token","id_token token")):p([]),response_modes_supported:s([]),grant_types_supported:e.requireDynamicRegistration?s(j("authorization_code")):s([]),acr_values_supported:s([]),subject_types_supported:p([]),id_token_signing_alg_values_supported:p(j("RS256")),id_token_encryption_alg_values_supported:s([]),id_token_encryption_enc_values_supported:s([]),userinfo_signing_alg_values_supported:s([]),userinfo_encryption_alg_values_supported:s([]),userinfo_encryption_enc_values_supported:s([]),request_object_signing_alg_values_supported:s(j("RS256")),request_object_encryption_alg_values_supported:s([]),request_object_encryption_enc_values_supported:s([]),token_endpoint_auth_methods_supported:s(P(...oe)),token_endpoint_auth_signing_alg_values_supported:s(j("RS256"),J(j("none"))),display_values_supported:s(P("page","popup","touch","wap")),claim_types_supported:s(P("normal","aggregated","distributed")),claims_supported:U([]),service_documentation:s(f),claims_locales_supported:s([]),ui_locales_supported:s([]),claims_parameter_supported:s(Boolean),request_parameter_supported:s(Boolean),request_uri_parameter_supported:s(Boolean),op_policy_uri:s(f),op_tos_uri:s(f)},i=m.url(e.issuer,".well-known/openid-configuration"),a=(await e.client.get(i)).data;return w(a,n),w(a.issuer,e.issuer),a}async function Y(e){let r={redirect_uris:p([f]),response_types:s([]),grant_types:s(P("authorization_code","refresh_token")),application_type:s(b("native","web")),contacts:s([we]),client_name:s(String),logo_uri:s(f),client_uri:s(f),policy_uri:s(f),tos_uri:s(f),jwks_uri:s(f,J(Z("jwks"))),jwks:s(f,J(Z("jwks_uri"))),sector_identifier_uri:s(f),subject_type:s(String),id_token_signed_response_alg:s(b(...v)),id_token_encrypted_response_alg:s(b(...v)),id_token_encrypted_response_enc:s(b(...v),Z("id_token_encrypted_response_alg")),userinfo_signed_response_alg:s(b(...v)),userinfo_encrypted_response_alg:s(b(...v)),userinfo_encrypted_response_enc:s(b(...v),Z("userinfo_encrypted_response_alg")),request_object_signing_alg:s(b(...v)),request_object_encryption_alg:s(b(...v)),request_object_encryption_enc:s(b(...v)),token_endpoint_auth_method:s(b(...oe)),token_endpoint_auth_signing_alg:s(b(...v)),default_max_age:s(Number),require_auth_time:s(Boolean),default_acr_values:s([String]),initiate_login_uri:s([f]),request_uris:s([f])};w(e,{client:s(H(m.client().constructor)),registration_endpoint:f,client_info:r});let t={client:m.client().with(L()).with(z())};e=Object.assign({},t,e);let o=await e.client.post(e.registration_endpoint,{body:e.client_info}),n=o.data;if(!n.client_id||!n.client_secret)throw m.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",o);return e.client_info=Object.assign(e.client_info,n),e.client_info}function ne(e){let r;if(typeof localStorage<"u")r={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,o)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(o)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;r={get:o=>JSON.parse(t.get("metro/oidc:"+e+":"+o)||null),set:(o,n)=>t.set("metro/oidc:"+e+":"+o,JSON.stringify(n)),has:o=>t.has("metro/oidc:"+e+":"+o)}}return r}function pe(e={}){let r={client:D(),force_authorization:!1,use_dpop:!0,authorize_callback:async t=>(window.location.href!=t.href&&window.location.replace(t.href),!1)};return e=Object.assign({},r,e),w(e,{client:p(H(D().constructor)),client_info:p(),issuer:p(f),oauth2:s({}),openid_configuration:s()}),e.store||(e.store=ne(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,o)=>{let n;if(!e.force_authorization){try{n=await o(t)}catch(g){if(n.status!=401&&n.status!=403)throw g}if(n.ok||n.status!=401&&n.status!=403)return n}if(e.openid_configuration||(e.openid_configuration=await Q({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(w(e.client_info?.client_name,p()),!e.openid_configuration.registration_endpoint)throw k("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await Y({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=e.scope||"openid",l=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,authorize_callback:e.authorize_callback,oauth2_configuration:{client_id:e.client_info.client_id,client_secret:e.client_info.client_secret,grant_type:"authorization_code",response_type:"code",response_mode:"query",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:i,redirect_uri:e.client_info.redirect_uris[0]}}),a=async(g,c)=>{let d=await c(g);if(d.headers.get("content-type")?.startsWith("application/json")){let _=d.data?.id_token;if(!_){let R=d.clone();try{let G=await R.json();G&&G.id_token&&(_=G.id_token)}catch{}}_&&e.store.set("id_token",_)}return d},h=e.client.with(e.issuer).with(a);if(e.use_dpop){let g={site:e.issuer,authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported};h=h.with($(g)),l.client=h}return h=h.with(I(l)),n=await h.fetch(t),n}}function Ue(){return ue()}function Ce(e){if(!e.store){if(!e.issuer)throw k("Must supply options.issuer or options.store to get the id_token");e.store=ne(e.issuer)}return e.store.get("id_token")}var De={oidcmw:pe,discover:Q,register:Y,isRedirected:Ue,idToken:Ce};globalThis.metro.oidc||(globalThis.metro.oidc=De);var pr=De;})();
+(()=>{var Ke=Object.defineProperty;var X=(e,r)=>{for(var t in r)Ke(e,t,{get:r[t],enumerable:!0})};var N={};X(N,{client:()=>D,formdata:()=>me,metroError:()=>k,request:()=>T,response:()=>K,trace:()=>Me,url:()=>x});var E="https://metro.muze.nl/details/";Symbol.metroProxy||(Symbol.metroProxy=Symbol("isProxy"));Symbol.metroSource||(Symbol.metroSource=Symbol("source"));var C=class e{#e={url:typeof window<"u"?window.location:"https://localhost"};#t=["get","post","put","delete","patch","head","options","query"];static tracers={};constructor(...r){for(let t of r)if(typeof t=="string"||t instanceof String)this.#e.url=""+t;else if(t instanceof e)Object.assign(this.#e,t.#e);else if(t instanceof Function)this.#r([t]);else if(t&&typeof t=="object")for(let o in t)o=="middlewares"?this.#r(t[o]):typeof t[o]=="function"?this.#e[o]=t[o](this.#e[o],this.#e):this.#e[o]=t[o];this.#e.verbs&&(this.#t=this.#e.verbs,delete this.#e.verbs);for(let t of this.#t)this[t]=async function(...o){return this.fetch(T(this.#e,...o,{method:t.toUpperCase()}))};Object.freeze(this)}#r(r){typeof r=="function"&&(r=[r]);let t=r.findIndex(o=>typeof o!="function");if(t>=0)throw k("metro.client: middlewares must be a function or an array of functions "+E+"client/invalid-middlewares/",r[t]);Array.isArray(this.#e.middlewares)||(this.#e.middlewares=[]),this.#e.middlewares=this.#e.middlewares.concat(r)}fetch(r,t){if(r=T(r,t),!r.url)throw k("metro.client."+r.method.toLowerCase()+": Missing url parameter "+E+"client/fetch-missing-url/",r);if(t||(t={}),typeof t!="object"||t instanceof String)throw k("metro.client.fetch: Invalid options parameter "+E+"client/fetch-invalid-options/",t);let n=[async function(a){a[Symbol.metroProxy]&&(a=a[Symbol.metroSource]);let m=await fetch(a);return K(m)}].concat(this.#e?.middlewares?.slice()||[]);t=Object.assign({},this.#e,t);let i;for(let l of n)i=function(a,m){return async function(g){let c,d=Object.values(e.tracers);for(let u of d)u.request&&u.request.call(u,g,m);c=await m(g,a);for(let u of d)u.response&&u.response.call(u,c,m);return c}}(i,l);return i(r)}with(...r){return new e(this,...r)}};function D(...e){return new C(...e)}function He(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let o of["method","headers","body","mode","credentials","cache","redirect","referrer","referrerPolicy","integrity","keepalive","signal","priority","url"]){let n=e[o];if(!(typeof n>"u"||n==null))if(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function")t[o]=n(t[o],t);else if(o=="url")t.url=x(t.url,n);else if(o=="headers"){t.headers=new Headers(r.headers),n instanceof Headers||(n=new Headers(e.headers));for(let[i,l]of n.entries())t.headers.set(i,l)}else t[o]=n}return e instanceof Request&&e.data&&(t.body=e.data),t}function T(...e){let r={url:typeof window<"u"?window.location:"https://localhost/",duplex:"half"};for(let n of e)typeof n=="string"||n instanceof URL||n instanceof URLSearchParams?r.url=x(r.url,n):n&&(n instanceof FormData||n instanceof ReadableStream||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView)?r.body=n:n&&typeof n=="object"&&Object.assign(r,He(n,r));let t=new Request(r.url,r),o=r.body;return o&&typeof o=="object"&&!(o instanceof String)&&!(o instanceof ReadableStream)&&!(o instanceof Blob)&&!(o instanceof ArrayBuffer)&&!(o instanceof DataView)&&!(o instanceof FormData)&&!(o instanceof URLSearchParams)&&(typeof TypedArray>"u"||!(o instanceof TypedArray))&&typeof o.toString=="function"&&(r.body=o.toString({headers:t.headers}),t=new Request(r.url,r)),Object.freeze(t),new Proxy(t,{get(n,i,l){switch(i){case Symbol.metroSource:return n;case Symbol.metroProxy:return!0;case"with":return function(...a){return o&&a.unshift({body:o}),T(n,...a)};case"data":return o}return n[i]instanceof Function?n[i].bind(n):n[i]}})}function pe(e,r){let t=r||{};!t.url&&r.url&&(t.url=r.url);for(let o of["status","statusText","headers","body","url","type","redirected"]){let n=e[o];typeof n>"u"||n==null||(n?.[Symbol.metroProxy]&&(n=n[Symbol.metroSource]),typeof n=="function"?t[o]=n(t[o],t):o=="url"?t.url=new URL(n,t.url||"https://localhost/"):t[o]=n)}return e instanceof Response&&e.data&&(t.body=e.data),t}function K(...e){let r={};for(let n of e)typeof n=="string"?r.body=n:n instanceof Response?Object.assign(r,pe(n,r)):n&&typeof n=="object"&&(n instanceof FormData||n instanceof Blob||n instanceof ArrayBuffer||n instanceof DataView||n instanceof ReadableStream||n instanceof URLSearchParams||n instanceof String||typeof TypedArray<"u"&&n instanceof TypedArray?r.body=n:Object.assign(r,pe(n,r)));let t;r.body&&(t=r.body),[101,204,205,304].includes(r.status)&&(r.body=null);let o=new Response(r.body,r);return Object.freeze(o),new Proxy(o,{get(n,i,l){switch(i){case Symbol.metroProxy:return!0;case Symbol.metroSource:return n;case"with":return function(...a){return K(n,...a)};case"data":return t;case"ok":return n.status>=200&&n.status<400}return typeof n[i]=="function"?n[i].bind(n):n[i]}})}function he(e,r){typeof r=="function"?r(e.searchParams,e):(r=new URLSearchParams(r),r.forEach((t,o)=>{e.searchParams.append(o,t)}))}function x(...e){let r=["hash","host","hostname","href","password","pathname","port","protocol","username","search","searchParams"],t=new URL("https://localhost/");for(let o of e)if(typeof o=="string"||o instanceof String)t=new URL(o,t);else if(o instanceof URL||typeof Location<"u"&&o instanceof Location)t=new URL(o);else if(o instanceof URLSearchParams)he(t,o);else if(o&&typeof o=="object")for(let n in o)switch(n){case"search":typeof o.search=="function"?o.search(t.search,t):t.search=new URLSearchParams(o.search);break;case"searchParams":he(t,o.searchParams);break;default:if(!r.includes(n))throw k("metro.url: unknown url parameter "+E+"url/unknown-param-name/",n);if(typeof o[n]=="function")o[n](t[n],t);else if(typeof o[n]=="string"||o[n]instanceof String||typeof o[n]=="number"||o[n]instanceof Number||typeof o[n]=="boolean"||o[n]instanceof Boolean)t[n]=""+o[n];else if(typeof o[n]=="object"&&o[n].toString)t[n]=o[n].toString();else throw k("metro.url: unsupported value for "+n+" "+E+"url/unsupported-param-value/",e[n]);break}else throw k("metro.url: unsupported option value "+E+"url/unsupported-option-value/",o);return Object.freeze(t),new Proxy(t,{get(o,n,i){switch(n){case Symbol.metroProxy:return!0;case Symbol.metroSource:return o;case"with":return function(...l){return x(o,...l)};case"filename":return o.pathname.split("/").pop();case"folderpath":return o.pathname.substring(0,o.pathname.lastIndexOf("\\")+1)}return o[n]instanceof Function?o[n].bind(o):o[n]}})}function me(...e){var r=new FormData;for(let t of e)if(t instanceof HTMLFormElement&&(t=new FormData(t)),t instanceof FormData)for(let o of t.entries())r.append(o[0],o[1]);else if(t&&typeof t=="object")for(let o of Object.entries(t))if(Array.isArray(o[1]))for(let n of o[1])r.append(o[0],n);else r.append(o[0],o[1]);else throw new k("metro.formdata: unknown option type "+E+"formdata/unknown-option-value/",t);return Object.freeze(r),new Proxy(r,{get:(t,o,n)=>{switch(o){case Symbol.metroProxy:return!0;case Symbol.metroSource:return t;case"with":return function(...i){return me(t,...i)}}return t[o]instanceof Function?t[o].bind(t):t[o]}})}var I={error:(e,...r)=>{console.error("\u24C2\uFE0F  ",e,...r)},info:(e,...r)=>{console.info("\u24C2\uFE0F  ",e,...r)},group:e=>{console.group("\u24C2\uFE0F  "+e)},groupEnd:e=>{console.groupEnd("\u24C2\uFE0F  "+e)}};function k(e,...r){return I.error(e,...r),new Error(e,...r)}var Me={add(e,r){C.tracers[e]=r},delete(e){delete C.tracers[e]},clear(){C.tracers={}},group(){let e=0;return{request:(r,t)=>{e++,I.group(e),I.info(r?.url,r,t)},response:(r,t)=>{I.info(r?.body?r.body[Symbol.metroSource]:null,r,t),I.groupEnd(e),e--}}}};function z(e){return e=Object.assign({mimetype:"application/json",reviver:null,replacer:null,space:""},e),async(r,t)=>{ie(r.headers.get("Accept"))||(r=r.with({headers:{Accept:e.mimetype}})),["POST","PUT","PATCH","QUERY"].includes(r.method)&&r.data&&typeof r.data=="object"&&!(r.data instanceof ReadableStream)&&(ie(r.headers.get("content-type"))||(r=r.with({headers:{"Content-Type":e.mimetype}})),r=r.with({body:JSON.stringify(r.data,e.replacer,e.space)}));let o=await t(r);if(ie(o.headers.get("content-type"))){let i=await o.clone().text();try{let l=JSON.parse(i,e.reviver);return o.with({body:l})}catch{}}return o}}var Ie=/^application\/([a-zA-Z0-9\-_]+\+)?json\b/;function ie(e){return Ie.exec(e)}function L(e){return async(r,t)=>{let o=await t(r);if(!o.ok)if(e&&typeof e[o.status]=="function")o=e[o.status].apply(o,r);else throw new Error(o.status+": "+o.statusText,{cause:o});return o}}var _e=Object.assign({},N,{mw:{jsonmw:z,thrower:L}});globalThis.metro||(globalThis.metro=_e);var _=_e;var q={};X(q,{base64url_encode:()=>ke,createState:()=>Se,default:()=>M,generateCodeChallenge:()=>be,generateCodeVerifier:()=>we,getExpires:()=>se,isAuthorized:()=>Je,isExpired:()=>ae,isRedirected:()=>ce});globalThis.assertEnabled=!1;function w(e,r){if(globalThis.assertEnabled){let t=S(e,r);if(t)throw console.error("\u{1F170}\uFE0F  Assertions failed because of:",t,"in this source:",e),new Error("Assertions failed",{cause:{problems:t,source:e}})}}function s(e){return function(t,o,n){if(typeof t<"u"&&t!=null&&typeof e<"u")return S(t,e,o,n)}}function p(e){return function(t,o,n){return t==null||typeof t>"u"?y("data is required",t,e||"any value",n):typeof e<"u"?S(t,e,o,n):!1}}function U(e){return function(t,o,n){return t==null||typeof t>"u"?(console.warn("data does not contain recommended value",t,e,n),!1):S(t,e,o,n)}}function b(...e){return function(t,o,n){for(let i of e)if(!S(t,i,o,n))return!1;return y("data does not match oneOf patterns",t,e,n)}}function P(...e){return function(t,o,n){if(!Array.isArray(t))return y("data is not an array",t,"anyOf",n);for(let i of t)if(b(...e)(i))return y("data does not match anyOf patterns",i,e,n);return!1}}function ye(...e){return function(t,o,n){let i=[];for(let l of e)i=i.concat(S(t,l,o,n));if(i=i.filter(Boolean),i.length)return y("data does not match all given patterns",t,e,n,i)}}function f(e,r,t){try{e instanceof URL&&(e=e.href);let o=new URL(e);if(o.href!=e&&!(o.href+"/"==e||o.href==e+"/"))return y("data is not a valid url",e,"validURL",t)}catch{return y("data is not a valid url",e,"validURL",t)}}function ge(e,r,t){if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))return y("data is not a valid email",e,"validEmail",t)}function H(e){return function(t,o,n){if(!(t instanceof e))return y("data is not an instanceof pattern",t,e,n)}}function J(e){return function(t,o,n){if(!S(t,e,o,n))return y("data matches pattern, when required not to",t,e,n)}}function S(e,r,t,o=""){t||(t=e);let n=[];if(r===Boolean)typeof e!="boolean"&&!(e instanceof Boolean)&&n.push(y("data is not a boolean",e,r,o));else if(r===Number)typeof e!="number"&&!(e instanceof Number)&&n.push(y("data is not a number",e,r,o));else if(r===String)typeof e!="string"&&!(e instanceof String)&&n.push(y("data is not a string",e,r,o)),e==""&&n.push(y("data is an empty string, which is not allowed",e,r,o));else if(r instanceof RegExp)if(Array.isArray(e)){let i=e.findIndex((l,a)=>S(l,r,t,o+"["+a+"]"));i>-1&&n.push(y("data["+i+"] does not match pattern",e[i],r,o+"["+i+"]"))}else typeof e>"u"?n.push(y("data is undefined, should match pattern",e,r,o)):r.test(e)||n.push(y("data does not match pattern",e,r,o));else if(r instanceof Function){let i=r(e,t,o);i&&(Array.isArray(i)?n=n.concat(i):n.push(i))}else if(Array.isArray(r)){Array.isArray(e)||n.push(y("data is not an array",e,[],o));for(let i of r)for(let l of e.keys()){let a=S(e[l],i,t,o+"["+l+"]");Array.isArray(a)?n=n.concat(a):a&&n.push(a)}}else if(r&&typeof r=="object")if(Array.isArray(e)){let i=e.findIndex((l,a)=>S(l,r,t,o+"["+a+"]"));i>-1&&n.push(y("data["+i+"] does not match pattern",e[i],r,o+"["+i+"]"))}else if(!e||typeof e!="object")n.push(y("data is not an object, pattern is",e,r,o));else if(e instanceof URLSearchParams&&(e=Object.fromEntries(e)),r instanceof Function){let i=S(e,r,t,o);i&&(n=n.concat(i))}else for(let[i,l]of Object.entries(r)){let a=S(e[i],l,t,o+"."+i);a&&(n=n.concat(a))}else r!=e&&n.push(y("data and pattern are not equal",e,r,o));return n.length?n:!1}function y(e,r,t,o,n){let i={message:e,found:r,expected:t,path:o};return n&&(i.problems=n),i}function B(e){let r,t;if(typeof localStorage<"u")r={get:()=>localStorage.getItem("metro/state:"+e),set:o=>localStorage.setItem("metro/state:"+e,o),has:()=>localStorage.getItem("metro/state:"+e)!==null},t={get:o=>JSON.parse(localStorage.getItem(e+":"+o)),set:(o,n)=>localStorage.setItem(e+":"+o,JSON.stringify(n)),has:o=>localStorage.getItem(e+":"+o)!==null};else{let o=new Map;r={get:()=>o.get("metro/state:"+e),set:n=>o.set("metro/state:"+e,n),has:()=>o.has("metro/state:"+e)},t=new Map}return{state:r,tokens:t}}function M(e){let r={client:D(),force_authorization:!1,site:"default",oauth2_configuration:{authorization_endpoint:"/authorize",token_endpoint:"/token",redirect_uri:globalThis.document?.location.href,grant_type:"authorization_code",code_verifier:we(64)},authorize_callback:async c=>(window.location.href!=c.href&&window.location.replace(c.href),!1)};w(e,{});let t=Object.assign({},r.oauth2_configuration,e?.oauth2_configuration);e=Object.assign({},r,e),e.oauth2_configuration=t;let o=B(e.site);e.tokens||(e.tokens=o.tokens),e.state||(e.state=o.state),w(e,{oauth2_configuration:{client_id:p(/.+/),grant_type:"authorization_code",authorization_endpoint:p(f),token_endpoint:p(f),redirect_uri:p(f)}});for(let c in t)switch(c){case"access_token":case"authorization_code":case"refresh_token":e.tokens.set(c,t[c]);break}return async function(c,d){if(e.force_authorization)return n(c,d);let u;try{if(u=await d(c),u.ok)return u}catch(h){switch(u.status){case 400:case 401:return n(c,d)}throw h}if(!u.ok)switch(u.status){case 400:case 401:return n(c,d)}return u};async function n(c,d){i();let u=e.tokens.get("access_token");if(u)if(ae(u)){try{if(!await a())return K("false")}catch(h){throw h}return n(c,d)}else return c=T(c,{headers:{Authorization:u.type+" "+u.value}}),d(c);else{try{if(!await l())return K("false")}catch(h){throw h}return n(c,d)}}function i(){if(typeof window<"u"&&window?.location){let c=x(window.location),d,u,h;if(c.searchParams.has("code"))h=c.searchParams,c=c.with({search:""}),history.pushState({},"",c.href);else if(c.hash){let R=c.hash.substr(1);h=new URLSearchParams("?"+R),c=c.with({hash:""}),history.pushState({},"",c.href)}if(h){d=h.get("code"),u=h.get("state");let R=e.state.get("metro/state");if(!u||u!==R)return;d&&e.tokens.set("authorization_code",d)}}}async function l(){if(t.grant_type==="authorization_code"&&!e.tokens.has("authorization_code")){let h=await m();if(!e.authorize_callback||typeof e.authorize_callback!="function")throw k("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.authorize_callback");let R=await e.authorize_callback(h);if(R)e.tokens.set("authorization_code",R);else return!1}let c=g(),d=await e.client.post(c);if(!d.ok){let h=await d.text();throw k("OAuth2mw: fetch access_token: "+d.status+": "+d.statusText,{cause:c})}let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:se(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let h={value:u.refresh_token};e.tokens.set("refresh_token",h)}return u}async function a(){let c=g("refresh_token"),d=await e.client.post(c);if(!d.ok)throw k("OAuth2mw: refresh access_token: "+d.status+": "+d.statusText,{cause:c});let u=await d.json();if(e.tokens.set("access_token",{value:u.access_token,expires:se(u.expires_in),type:u.token_type,scope:u.scope}),u.refresh_token){let h={value:u.refresh_token};e.tokens.set("refresh_token",h)}else return!1;return u}async function m(){if(!t.authorization_endpoint)throw k("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");let c=x(t.authorization_endpoint,{hash:""});w(t,{client_id:/.+/,redirect_uri:/.+/,scope:/.*/});let d={response_type:"code",client_id:t.client_id,redirect_uri:t.redirect_uri,state:t.state||Se(40)};return t.response_type&&(d.response_type=t.response_type),t.response_mode&&(d.response_mode=t.response_mode),e.state.set(d.state),t.code_verifier&&(e.tokens.set("code_verifier",t.code_verifier),d.code_challenge=await be(t.code_verifier),d.code_challenge_method="S256"),t.client_secret&&(d.client_secret=t.client_secret),t.scope&&(d.scope=t.scope),t.prompt&&(d.prompt=t.prompt),x(c,{search:d})}function g(c=null){if(w(t,{client_id:/.+/,redirect_uri:/.+/}),!t.token_endpoint)throw k("oauth2mw: Missing options.endpoints.token url");let d=x(t.token_endpoint,{hash:""}),u={grant_type:c||t.grant_type,client_id:t.client_id},h=e.tokens.get("code_verifier");switch(h&&(u.code_verifier=h),t.client_secret&&(u.client_secret=t.client_secret),t.scope&&(u.scope=t.scope),t.grant_type){case"authorization_code":u.redirect_uri=t.redirect_uri,u.code=e.tokens.get("authorization_code");break;case"client_credentials":break;case"refresh_token":u.refresh_token=t.refresh_token;break;default:throw new Error("Unknown grant_type: ".oauth2.grant_type)}return T(d,{method:"POST",body:new URLSearchParams(u)})}}function ae(e){if(!e)return!0;let r=new Date(e.expires);return new Date().getTime()>r.getTime()}function se(e){if(e instanceof Date)return new Date(e.getTime());if(typeof e=="number"){let r=new Date;return r.setSeconds(r.getSeconds()+e),r}throw new TypeError("Unknown expires type "+e)}function we(e=64){e=Math.min(43,Math.max(128,e));let r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~",t=new Uint8Array(e);return globalThis.crypto.getRandomValues(t),Array.from(t).map(n=>r[n%r.length]).join("")}async function be(e){let t=new TextEncoder().encode(e),o=await globalThis.crypto.subtle.digest("SHA-256",t);return ke(o)}function ke(e){let r=Array.from(new Uint8Array(e),t=>String.fromCharCode(t)).join("");return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Se(e){let r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",t="",o=0;for(;o<e;)t+=r.charAt(Math.floor(Math.random()*r.length)),o++;return t}function ce(){let e=new URL(document.location.href);if(!e.searchParams.has("code")){if(e.hash){let r=e.hash.substr(1);if(params=new URLSearchParams("?"+r),params.has("code"))return!0}return!1}return!0}function Je(e){typeof e=="string"&&(e=B(e).tokens);let r=e.get("access_token");return!!(r&&!ae(r)||e.get("refresh_token"))}var ue={};X(ue,{default:()=>xe});var ee={status:200,statusText:"OK",headers:{"Content-Type":"application/json"}},F=e=>({status:400,statusText:"Bad Request",headers:{"Content-Type":"application/json"},body:JSON.stringify({error:"invalid_request",error_description:e})}),A,ve={};function xe(e={}){return e=Object.assign({},{PKCE:!1,DPoP:!1},e),async(t,o)=>{let n=_.url(t.url);switch(n.pathname){case"/authorize/":if(A=S(n.searchParams,{response_type:"code",client_id:"mockClientId",state:s(/.*/)}))return _.response(F(A));if(n.searchParams.has("code_challenge")){if(!n.searchParams.has("code_challenge_method"))return _.response(F("missing code_challenge_method"));ve.code_challenge=n.searchParams.get("code_challenge"),ve.code_challenge_method=n.searchParams.get("code_challenge_method")}return _.response(ee,{body:JSON.stringify({code:"mockAuthorizeToken",state:n.searchParams.get("state")})});case"/token/":if(t.data instanceof URLSearchParams){let m={};t.data.forEach((g,c)=>m[c]=g),t=t.with({body:m})}if(A=S(t,{method:"POST",data:{grant_type:b("refresh_token","authorization_code")}}))return _.response(F(A));switch(t.data.grant_type){case"refresh_token":if(A=S(t.data,b({refresh_token:"mockRefreshToken",client_id:"mockClientId",client_secret:"mockClientSecret"},{refresh_token:"mockRefreshToken",client_id:"mockClientId",code_verifier:/.+/})))return _.response(F(A));break;case"access_token":if(A=S(t.data,b({client_id:"mockClientId",client_secret:"mockClientSecret"},{client_id:"mockClientId",code_challenge:/.*/,code_challenge_method:"S256"})))return _.response(F(A));break}return _.response(ee,{body:JSON.stringify({access_token:"mockAccessToken",token_type:"mockExample",expires_in:3600,refresh_token:"mockRefreshToken",example_parameter:"mockExampleValue"})});case"/protected/":let i=t.headers.get("Authorization"),[l,a]=i?i.split(" "):[];return!a||a!=="mockAccessToken"?_.response({status:401,statusText:"Forbidden",body:"401 Forbidden"}):_.response(ee,{body:JSON.stringify({result:"Success"})});case"/public/":return _.response(ee,{body:JSON.stringify({result:"Success"})});default:return _.response({status:404,statusText:"not found",body:"404 Not Found "+n})}}}var le={};X(le,{default:()=>Ae});var Re=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],Pe=["client_secret_post","client_secret_base","client_secret_jwt","private_key_jwt"],Be={issuer:p(f),authorization_endpoint:p(f),token_endpoint:p(f),jwks_uri:s(f),registration_endpoint:s(f),scopes_supported:U([]),response_types_supported:p(P("code","token")),response_modes_supported:s([]),grant_types_supported:s([]),token_endpoint_auth_methods_supported:s([]),token_endpoint_auth_signing_alg_values_supported:s([]),service_documentation:s(f),ui_locales_supported:s([]),op_policy_uri:s(f),op_tos_uri:s(f),revocation_endpoint:s(f),revocation_endpoint_auth_methods_supported:s(Pe),revocation_endpoint_auth_signing_alg_values_supported:s(Re),introspection_endpoint:s(f),introspection_endpoint_auth_methods_supported:s(Pe),introspection_endpoint_auth_signing_alg_values_supported:s(Re),code_challendge_methods_supported:s([])};function Ae(e={}){let r={client:_.client()};e=Object.assign({},r,e),w(e,{issuer:p(f)});let t=Fe(e.issuer),o=e.client.with(e.issuer)}async function Fe(e,r){let t=r.get(_.url(e,".wellknown/oauth_authorization_server"));if(t.ok){w(t.headers.get("Content-Type"),/application\/json.*/);let o=await t.json();return w(o,Be),o}throw _.metroError("metro.oidcmw: Error while fetching "+e+".wellknown/oauth_authorization_server",t)}function je(){let e=new URLSearchParams(window.location.search);if(!e.has("code")&&window.location.hash){let t=window.location.hash.substr(1);e=new URLSearchParams("?"+t)}let r=window.parent?window.parent:window.opener;e.has("code")?r.postMessage({authorization_code:e.get("code")},window.location.origin):e.has("error")?r.postMessage({error},window.location.origin):r.postMessage({error:"Could not find an authorization_code"},window.location.origin)}function Oe(e){return new Promise((r,t)=>{addEventListener("message",o=>{event.data.authorization_code?r(event.data.authorization_code):event.data.error?t(event.data.error):t("Unknown authorization error")},{once:!0}),window.open(e)})}function W(){return new Promise((e,r)=>{let t=globalThis.indexedDB.open("metro",1);t.onupgradeneeded=()=>t.result.createObjectStore("keyPairs",{keyPath:"domain"}),t.onerror=o=>{r(o)},t.onsuccess=o=>{let n=o.target.result;e({set:function(i,l){return new Promise((a,m)=>{let g=n.transaction("keyPairs","readwrite",{durability:"strict"}),c=g.objectStore("keyPairs");g.oncomplete=()=>{a()},g.onerror=m,c.put(i,l)})},get:function(i){return new Promise((l,a)=>{let m=n.transaction("keyPairs","readonly"),c=m.objectStore("keyPairs").get(i);c.onsuccess=()=>{l(c.result)},c.onerror=a,m.onerror=a})},clear:function(){return new Promise((i,l)=>{let a=n.transaction("keyPairs","readwrite"),g=a.objectStore("keyPairs").clear();g.onsuccess=()=>{i()},g.onerror=l,a.onerror=l})}})}})}var We=new TextEncoder,Ve=new TextDecoder;function te(e){return typeof e=="string"?We.encode(e):Ve.decode(e)}function Ee(e){if(typeof e.modulusLength!="number"||e.modulusLength<2048)throw new fe(`${e.name} modulusLength must be at least 2048 bits`)}function $e(e){switch(e.algorithm.name){case"ECDSA":return{name:e.algorithm.name,hash:"SHA-256"};case"RSA-PSS":return Ee(e.algorithm),{name:e.algorithm.name,saltLength:32};case"RSASSA-PKCS1-v1_5":return Ee(e.algorithm),{name:e.algorithm.name};case"Ed25519":return{name:e.algorithm.name}}throw new j}async function Ze(e,r,t){if(t.usages.includes("sign")===!1)throw new TypeError('private CryptoKey instances used for signing assertions must include "sign" in their "usages"');let o=`${V(te(JSON.stringify(e)))}.${V(te(JSON.stringify(r)))}`,n=V(await crypto.subtle.sign($e(t),t,te(o)));return`${o}.${n}`}var Te=32768;function Qe(e){e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let t=0;t<e.byteLength;t+=Te)r.push(String.fromCharCode.apply(null,e.subarray(t,t+Te)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function V(e){return Qe(e)}function Ye(){return V(crypto.getRandomValues(new Uint8Array(32)))}var j=class extends Error{constructor(r){super(r??"operation not supported"),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},fe=class extends Error{constructor(r){super(r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}};function Ge(e){switch(e.algorithm.hash.name){case"SHA-256":return"PS256";default:throw new j("unsupported RsaHashedKeyAlgorithm hash name")}}function Xe(e){switch(e.algorithm.hash.name){case"SHA-256":return"RS256";default:throw new j("unsupported RsaHashedKeyAlgorithm hash name")}}function qe(e){switch(e.algorithm.namedCurve){case"P-256":return"ES256";default:throw new j("unsupported EcKeyAlgorithm namedCurve")}}function et(e){switch(e.algorithm.name){case"RSA-PSS":return Ge(e);case"RSASSA-PKCS1-v1_5":return Xe(e);case"ECDSA":return qe(e);case"Ed25519":return"EdDSA";default:throw new j("unsupported CryptoKey algorithm name")}}function ze(e){return e instanceof CryptoKey}function tt(e){return ze(e)&&e.type==="private"}function rt(e){return ze(e)&&e.type==="public"}function ot(){return Math.floor(Date.now()/1e3)}async function re(e,r,t,o,n,i){let l=e?.privateKey,a=e?.publicKey;if(!tt(l))throw new TypeError('"keypair.privateKey" must be a private CryptoKey');if(!rt(a))throw new TypeError('"keypair.publicKey" must be a public CryptoKey');if(a.extractable!==!0)throw new TypeError('"keypair.publicKey.extractable" must be true');if(typeof r!="string")throw new TypeError('"htu" must be a string');if(typeof t!="string")throw new TypeError('"htm" must be a string');if(o!==void 0&&typeof o!="string")throw new TypeError('"nonce" must be a string or undefined');if(n!==void 0&&typeof n!="string")throw new TypeError('"accessToken" must be a string or undefined');if(i!==void 0&&(typeof i!="object"||i===null||Array.isArray(i)))throw new TypeError('"additional" must be an object');return Ze({alg:et(l),typ:"dpop+jwt",jwk:await nt(a)},{...i,iat:ot(),jti:Ye(),htm:t,nonce:o,htu:r,ath:n?V(await crypto.subtle.digest("SHA-256",te(n))):void 0},l)}async function nt(e){let{kty:r,e:t,n:o,x:n,y:i,crv:l}=await crypto.subtle.exportKey("jwk",e);return{kty:r,crv:l,e:t,n:o,x:n,y:i}}async function Le(e,r){let t;if(typeof e!="string"||e.length===0)throw new TypeError('"alg" must be a non-empty string');switch(e){case"PS256":t={name:"RSA-PSS",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"RS256":t={name:"RSASSA-PKCS1-v1_5",hash:"SHA-256",modulusLength:r?.modulusLength??2048,publicExponent:new Uint8Array([1,0,1])};break;case"ES256":t={name:"ECDSA",namedCurve:"P-256"};break;case"EdDSA":t={name:"Ed25519"};break;default:throw new j}return crypto.subtle.generateKey(t,r?.extractable??!1,["sign","verify"])}function $(e){return w(e,{site:p(f),authorization_endpoint:p(f),token_endpoint:p(f),dpop_signing_alg_values_supported:s([])}),async(r,t)=>{let o=await W(),n=await o.get(e.site);if(!n){let a=await Le("ES256");n={domain:e.site,keyPair:a},await o.set(n)}let i=_.url(r.url);if(r.url.startsWith(e.authorization_endpoint)){let a=r.body;a instanceof URLSearchParams||a instanceof FormData?a.set("dpop_jkt",n.keyPair.publicKey):a.dpop_jkt=n.keyPair.publicKey}else if(r.url.startsWith(e.token_endpoint)){let a=await re(n.keyPair,r.url,r.method);r=r.with({headers:{DPoP:a}})}else if(r.headers.has("Authorization")){let a=localStorage.getItem(i.host+":nonce")||void 0,m=r.headers.get("Authorization").split(" ")[1],g=await re(n.keyPair,r.url,r.method,a,m);r=r.with({headers:{Authorization:"DPoP "+m,DPoP:g}})}let l=await t(r);return l.headers.get("DPoP-Nonce")&&localStorage.setItem(i.host+":nonce",l.headers.get("DPoP-Nonce")),l}}var it=Object.assign({},q,{oauth2mw:M,mockserver:ue,discover:le,tokenstore:B,dpopmw:$,keysstore:W,authorizePopup:Oe,popupHandleRedirect:je});globalThis.metro.oauth2||(globalThis.metro.oauth2=it);var Z=(...e)=>(r,t)=>e.filter(o=>t.hasOwnKey(o)).length>0?!1:y("root data must have all of",t,e),O=(...e)=>r=>Array.isArray(r)&&e.filter(t=>!r.includes(t)).length==0?!1:y("data must be an array which includes",r,e);var v=["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512"],oe=["client_secret_post","client_secret_basic","client_secret_jwt","private_key_jwt"];async function Q(e={}){w(e,{client:s(H(_.client().constructor)),issuer:p(f)});let r={client:_.client().with(L()).with(z()),requireDynamicRegistration:!1};e=Object.assign({},r,e);let t=!1;function o(m){return t}let n={issuer:p(ye(e.issuer,o)),authorization_endpoint:p(f),token_endpoint:p(f),userinfo_endpoint:U(f),jwks_uri:p(f),registration_endpoint:e.requireDynamicRegistration?p(f):U(f),scopes_supported:U(O("openid")),response_types_supported:e.requireDynamicRegistration?p(O("code","id_token","id_token token")):p([]),response_modes_supported:s([]),grant_types_supported:e.requireDynamicRegistration?s(O("authorization_code")):s([]),acr_values_supported:s([]),subject_types_supported:p([]),id_token_signing_alg_values_supported:p(O("RS256")),id_token_encryption_alg_values_supported:s([]),id_token_encryption_enc_values_supported:s([]),userinfo_signing_alg_values_supported:s([]),userinfo_encryption_alg_values_supported:s([]),userinfo_encryption_enc_values_supported:s([]),request_object_signing_alg_values_supported:s(O("RS256")),request_object_encryption_alg_values_supported:s([]),request_object_encryption_enc_values_supported:s([]),token_endpoint_auth_methods_supported:s(P(...oe)),token_endpoint_auth_signing_alg_values_supported:s(O("RS256"),J(O("none"))),display_values_supported:s(P("page","popup","touch","wap")),claim_types_supported:s(P("normal","aggregated","distributed")),claims_supported:U([]),service_documentation:s(f),claims_locales_supported:s([]),ui_locales_supported:s([]),claims_parameter_supported:s(Boolean),request_parameter_supported:s(Boolean),request_uri_parameter_supported:s(Boolean),op_policy_uri:s(f),op_tos_uri:s(f)},i=_.url(e.issuer,".well-known/openid-configuration"),a=(await e.client.get(i)).data;return w(a,n),w(a.issuer,e.issuer),a}async function Y(e){let r={redirect_uris:p([f]),response_types:s([]),grant_types:s(P("authorization_code","refresh_token")),application_type:s(b("native","web")),contacts:s([ge]),client_name:s(String),logo_uri:s(f),client_uri:s(f),policy_uri:s(f),tos_uri:s(f),jwks_uri:s(f,J(Z("jwks"))),jwks:s(f,J(Z("jwks_uri"))),sector_identifier_uri:s(f),subject_type:s(String),id_token_signed_response_alg:s(b(...v)),id_token_encrypted_response_alg:s(b(...v)),id_token_encrypted_response_enc:s(b(...v),Z("id_token_encrypted_response_alg")),userinfo_signed_response_alg:s(b(...v)),userinfo_encrypted_response_alg:s(b(...v)),userinfo_encrypted_response_enc:s(b(...v),Z("userinfo_encrypted_response_alg")),request_object_signing_alg:s(b(...v)),request_object_encryption_alg:s(b(...v)),request_object_encryption_enc:s(b(...v)),token_endpoint_auth_method:s(b(...oe)),token_endpoint_auth_signing_alg:s(b(...v)),default_max_age:s(Number),require_auth_time:s(Boolean),default_acr_values:s([String]),initiate_login_uri:s([f]),request_uris:s([f])};w(e,{client:s(H(_.client().constructor)),registration_endpoint:f,client_info:r});let t={client:_.client().with(L()).with(z())};e=Object.assign({},t,e);let o=await e.client.post(e.registration_endpoint,{body:e.client_info}),n=o.data;if(!n.client_id||!n.client_secret)throw _.metroError("metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned",o);return e.client_info=Object.assign(e.client_info,n),e.client_info}function ne(e){let r;if(typeof localStorage<"u")r={get:t=>JSON.parse(localStorage.getItem("metro/oidc:"+e+":"+t)),set:(t,o)=>localStorage.setItem("metro/oidc:"+e+":"+t,JSON.stringify(o)),has:t=>localStorage.getItem("metro/oidc:"+e+":"+t)!==null};else{let t=new Map;r={get:o=>JSON.parse(t.get("metro/oidc:"+e+":"+o)||null),set:(o,n)=>t.set("metro/oidc:"+e+":"+o,JSON.stringify(n)),has:o=>t.has("metro/oidc:"+e+":"+o)}}return r}function de(e={}){let r={client:D(),force_authorization:!1,use_dpop:!0,authorize_callback:async t=>(window.location.href!=t.href&&window.location.replace(t.href),!1)};return e=Object.assign({},r,e),w(e,{client:p(H(D().constructor)),client_info:p(),issuer:p(f),oauth2:s({}),openid_configuration:s()}),e.store||(e.store=ne(e.issuer)),!e.openid_configuration&&e.store.has("openid_configuration")&&(e.openid_configuration=e.store.get("openid_configuration")),!e.client_info.client_id&&e.store.has("client_info")&&(e.client_info=e.store.get("client_info")),async(t,o)=>{let n;if(!e.force_authorization){try{n=await o(t)}catch(g){if(n.status!=401&&n.status!=403)throw g}if(n.ok||n.status!=401&&n.status!=403)return n}if(e.openid_configuration||(e.openid_configuration=await Q({issuer:e.issuer}),e.store.set("openid_configuration",e.openid_configuration)),!e.client_info?.client_id){if(w(e.client_info?.client_name,p()),!e.openid_configuration.registration_endpoint)throw k("metro.oidcmw: Error: issuer "+e.issuer+" does not support dynamic client registration, but you haven't specified a client_id");e.client_info=await Y({registration_endpoint:e.openid_configuration.registration_endpoint,client_info:e.client_info}),e.store.set("client_info",e.client_info)}let i=e.scope||"openid",l=Object.assign({site:e.issuer,client:e.client,force_authorization:!0,authorize_callback:e.authorize_callback,oauth2_configuration:{client_id:e.client_info.client_id,client_secret:e.client_info.client_secret,grant_type:"authorization_code",response_type:"code",response_mode:"query",authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,scope:i,redirect_uri:e.client_info.redirect_uris[0]}}),a=async(g,c)=>{let d=await c(g);if(d.headers.get("content-type")?.startsWith("application/json")){let h=d.data?.id_token;if(!h){let R=d.clone();try{let G=await R.json();G&&G.id_token&&(h=G.id_token)}catch{}}h&&e.store.set("id_token",h)}return d},m=e.client.with(e.issuer).with(a);if(e.use_dpop){let g={site:e.issuer,authorization_endpoint:e.openid_configuration.authorization_endpoint,token_endpoint:e.openid_configuration.token_endpoint,dpop_signing_alg_values_supported:e.openid_configuration.dpop_signing_alg_values_supported};m=m.with($(g)),l.client=m}return m=m.with(M(l)),n=await m.fetch(t),n}}function Ue(){return ce()}function Ce(e){if(!e.store){if(!e.issuer)throw k("Must supply options.issuer or options.store to get the id_token");e.store=ne(e.issuer)}return e.store.get("id_token")}var De={oidcmw:de,discover:Q,register:Y,isRedirected:Ue,idToken:Ce};globalThis.metro.oidc||(globalThis.metro.oidc=De);var pr=De;})();
 //# sourceMappingURL=browser.min.js.map