npm - @nihplod/sso-sdk - Versions diffs - 1.0.0 - Mend

@nihplod/sso-sdk 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/dist/react/index.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../../src/react/SsoProvider.tsx","../../src/core/errors.ts","../../src/core/pkce.ts","../../src/core/storage.ts","../../src/core/SsoClient.ts","../../src/react/RequireAuth.tsx","../../src/react/CallbackPage.tsx"],"sourcesContent":["/**\r\n * SsoProvider - React Context Provider\r\n *\r\n * 包裹子项目根组件，提供全局 SSO 认证状态管理：\r\n * - 自动管理 token 刷新定时器（过期前 60s 静默刷新）\r\n * - 监听 storage 事件实现跨 Tab 同步\r\n * - 提供 useSso() hook\r\n */\r\n\r\n\"use client\";\r\n\r\nimport React, {\r\n createContext,\r\n useContext,\r\n useState,\r\n useEffect,\r\n useCallback,\r\n useRef,\r\n type ReactNode,\r\n} from \"react\";\r\nimport { SsoClient } from \"../core/SsoClient\";\r\nimport { getTokenData, removeTokenData } from \"../core/storage\";\r\nimport type { SsoClientConfig, SsoUser } from \"../core/SsoClient\";\r\n\r\n// ============================================\r\n// Context 类型\r\n// ============================================\r\n\r\nexport interface SsoContextValue {\r\n /** 当前用户信息 */\r\n user: SsoUser | null;\r\n\r\n /** 是否已认证 */\r\n isAuthenticated: boolean;\r\n\r\n /** 是否正在加载（初始化/刷新中） */\r\n isLoading: boolean;\r\n\r\n /** 发起登录 */\r\n login: (returnUrl?: string) => Promise<void>;\r\n\r\n /** 登出 */\r\n logout: (redirectToSso?: boolean) => Promise<void>;\r\n\r\n /** 刷新用户信息 */\r\n refreshUser: () => Promise<void>;\r\n\r\n /** 获取 access_token（自动刷新过期 token） */\r\n getAccessToken: () => Promise<string | null>;\r\n\r\n /** SsoClient 实例（高级用法） */\r\n client: SsoClient;\r\n}\r\n\r\nconst SsoContext = createContext<SsoContextValue | null>(null);\r\n\r\n// ============================================\r\n// Provider Props\r\n// ============================================\r\n\r\nexport interface SsoProviderProps {\r\n /** SSO 客户端配置 */\r\n config: SsoClientConfig;\r\n\r\n /** 子组件 */\r\n children: ReactNode;\r\n\r\n /**\r\n * 自动刷新阈值（秒）\r\n * access_token 过期前多少秒触发静默刷新。\r\n * 默认 60 秒。\r\n */\r\n refreshThreshold?: number;\r\n\r\n /**\r\n * API 请求函数（可选）\r\n * 用于在 token 刷新后自动重试失败的 API 请求。\r\n */\r\n onTokenRefreshed?: (token: string) => void;\r\n}\r\n\r\n// 跨 Tab 刷新锁（基于 localStorage + 时间戳，避免多 Tab 同时刷新导致旧 RT 被撤销）\r\nconst REFRESH_LOCK_PREFIX = \"nihplod_sso_refresh_lock:\";\r\nconst LOCK_TTL_MS = 5000;\r\n\r\nfunction lockKey(clientId: string): string {\r\n return REFRESH_LOCK_PREFIX + clientId;\r\n}\r\n\r\nfunction acquireRefreshLock(clientId: string): boolean {\r\n if (typeof localStorage === \"undefined\") return true;\r\n const key = lockKey(clientId);\r\n const now = Date.now();\r\n const raw = localStorage.getItem(key);\r\n if (raw) {\r\n const ts = parseInt(raw, 10);\r\n if (!isNaN(ts) && now - ts < LOCK_TTL_MS) {\r\n return false;\r\n }\r\n }\r\n localStorage.setItem(key, String(now));\r\n return true;\r\n}\r\n\r\nfunction releaseRefreshLock(clientId: string): void {\r\n if (typeof localStorage === \"undefined\") return;\r\n localStorage.removeItem(lockKey(clientId));\r\n}\r\n\r\n// ============================================\r\n// Provider 实现\r\n// ============================================\r\n\r\nexport function SsoProvider({\r\n config,\r\n children,\r\n refreshThreshold = 60,\r\n onTokenRefreshed,\r\n}: SsoProviderProps) {\r\n const [user, setUser] = useState<SsoUser | null>(null);\r\n const [isLoading, setIsLoading] = useState(true);\r\n const [isAuthenticated, setIsAuthenticated] = useState(false);\r\n const clientRef = useRef(new SsoClient(config));\r\n const refreshTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);\r\n const loadedRef = useRef(false);\r\n\r\n const client = clientRef.current;\r\n\r\n // 加载用户信息\r\n const loadUser = useCallback(async () => {\r\n if (!client.isAuthenticated()) {\r\n setUser(null);\r\n setIsAuthenticated(false);\r\n setIsLoading(false);\r\n return;\r\n }\r\n\r\n try {\r\n const u = await client.getUserInfo();\r\n setUser(u);\r\n setIsAuthenticated(true);\r\n } catch {\r\n setUser(null);\r\n setIsAuthenticated(false);\r\n removeTokenData(client.config.clientId);\r\n } finally {\r\n setIsLoading(false);\r\n }\r\n }, [client]);\r\n\r\n // 初始化\r\n useEffect(() => {\r\n if (loadedRef.current) return;\r\n loadedRef.current = true;\r\n\r\n // 检查是否有有效的 token（不发起网络请求）\r\n if (client.isAuthenticated()) {\r\n loadUser();\r\n } else {\r\n setIsLoading(false);\r\n }\r\n }, [client, loadUser]);\r\n\r\n // Token 自动刷新定时器（setTimeout 递归调度，避免 setInterval 堆积）\r\n useEffect(() => {\r\n let active = true;\r\n\r\n const scheduleNextRefresh = () => {\r\n if (!active) return;\r\n\r\n // 清除已有定时器\r\n if (refreshTimerRef.current) {\r\n clearTimeout(refreshTimerRef.current);\r\n refreshTimerRef.current = null;\r\n }\r\n\r\n const tokenData = getTokenData(client.config.clientId);\r\n if (!tokenData) return;\r\n\r\n // 计算距离过期还有多少秒\r\n const remainingSec = (tokenData.expires_at - Date.now()) / 1000;\r\n\r\n if (remainingSec <= 0) {\r\n // 已过期，立即刷新（带锁，避免多 Tab 并发）\r\n if (!acquireRefreshLock(client.config.clientId)) return;\r\n client\r\n .refreshToken()\r\n .then((td) => {\r\n onTokenRefreshed?.(td.access_token);\r\n loadUser();\r\n })\r\n .catch(() => {\r\n // 刷新失败可能是其他 Tab 已刷新；短暂后重新加载本地 token\r\n setTimeout(() => loadUser(), 500);\r\n })\r\n .finally(() => releaseRefreshLock(client.config.clientId));\r\n return;\r\n }\r\n\r\n if (remainingSec <= refreshThreshold) {\r\n // 即将过期，立即刷新（带锁）\r\n if (!acquireRefreshLock(client.config.clientId)) return;\r\n client\r\n .refreshToken()\r\n .then((td) => {\r\n onTokenRefreshed?.(td.access_token);\r\n loadUser();\r\n })\r\n .catch(() => {\r\n setTimeout(() => loadUser(), 500);\r\n })\r\n .finally(() => releaseRefreshLock(client.config.clientId));\r\n return;\r\n }\r\n\r\n // 在过期前 refreshThreshold 秒触发刷新\r\n const delayMs = (remainingSec - refreshThreshold) * 1000;\r\n\r\n refreshTimerRef.current = setTimeout(() => {\r\n const td = getTokenData(client.config.clientId);\r\n if (!td) return;\r\n\r\n const secLeft = (td.expires_at - Date.now()) / 1000;\r\n if (secLeft <= refreshThreshold) {\r\n if (!acquireRefreshLock(client.config.clientId)) {\r\n // 其他 Tab 正在刷新，等待 storage 事件同步即可\r\n return;\r\n }\r\n client\r\n .refreshToken()\r\n .then((newTd) => {\r\n onTokenRefreshed?.(newTd.access_token);\r\n loadUser();\r\n })\r\n .catch(() => {\r\n setTimeout(() => loadUser(), 500);\r\n })\r\n .finally(() => releaseRefreshLock(client.config.clientId));\r\n // 刷新后重新调度下一次\r\n scheduleNextRefresh();\r\n }\r\n }, Math.max(delayMs, 1000));\r\n };\r\n\r\n scheduleNextRefresh();\r\n\r\n return () => {\r\n active = false;\r\n if (refreshTimerRef.current) {\r\n clearTimeout(refreshTimerRef.current);\r\n refreshTimerRef.current = null;\r\n }\r\n };\r\n }, [client, loadUser, refreshThreshold, onTokenRefreshed]);\r\n\r\n // 监听 storage 事件实现跨 Tab 同步\r\n useEffect(() => {\r\n const handleStorageChange = (e: StorageEvent) => {\r\n if (\r\n e.key &&\r\n e.key.startsWith(\"nihplod_sso_\") &&\r\n !e.key.startsWith(REFRESH_LOCK_PREFIX)\r\n ) {\r\n loadUser();\r\n }\r\n };\r\n\r\n window.addEventListener(\"storage\", handleStorageChange);\r\n return () => window.removeEventListener(\"storage\", handleStorageChange);\r\n }, [loadUser]);\r\n\r\n // 登录\r\n const login = useCallback(\r\n async (returnUrl?: string) => {\r\n await client.login(returnUrl);\r\n },\r\n [client]\r\n );\r\n\r\n // 登出\r\n const logout = useCallback(\r\n async (redirectToSso: boolean = false) => {\r\n await client.logout(redirectToSso);\r\n setUser(null);\r\n setIsAuthenticated(false);\r\n },\r\n [client]\r\n );\r\n\r\n // 刷新用户信息\r\n const refreshUser = useCallback(async () => {\r\n await loadUser();\r\n }, [loadUser]);\r\n\r\n // 获取 access_token\r\n const getAccessToken = useCallback(async (): Promise<string | null> => {\r\n return client.getAccessToken();\r\n }, [client]);\r\n\r\n const value: SsoContextValue = {\r\n user,\r\n isAuthenticated,\r\n isLoading,\r\n login,\r\n logout,\r\n refreshUser,\r\n getAccessToken,\r\n client,\r\n };\r\n\r\n return React.createElement(SsoContext.Provider, { value }, children);\r\n}\r\n\r\n// ============================================\r\n// Hook\r\n// ============================================\r\n\r\n/**\r\n * useSso Hook\r\n *\r\n * 在 SsoProvider 内部使用，获取 SSO 认证状态和操作方法。\r\n *\r\n * @example\r\n * ```tsx\r\n * function MyComponent() {\r\n * const { user, isAuthenticated, login, logout } = useSso();\r\n * if (!isAuthenticated) return <button onClick={() => login()}>登录</button>;\r\n * return <div>欢迎, {user?.nickname}</div>;\r\n * }\r\n * ```\r\n */\r\nexport function useSso(): SsoContextValue {\r\n const ctx = useContext(SsoContext);\r\n if (!ctx) {\r\n throw new Error(\"useSso() 必须在 <SsoProvider> 内部使用\");\r\n }\r\n return ctx;\r\n}\r\n","/**\r\n * SSO SDK 错误类型\r\n */\r\n\r\n/** SSO 错误码 */\r\nexport type SsoErrorCode =\r\n | \"invalid_config\"\r\n | \"state_mismatch\"\r\n | \"pkce_required\"\r\n | \"token_request_failed\"\r\n | \"session_expired\"\r\n | \"no_refresh_token\"\r\n | \"userinfo_failed\"\r\n | \"not_authenticated\"\r\n | \"sso_server_error\"\r\n | \"network_error\"\r\n | \"id_token_invalid\"\r\n | \"id_token_unsupported_alg\"\r\n | \"id_token_missing_secret\"\r\n | \"id_token_invalid_signature\"\r\n | \"id_token_issuer_mismatch\"\r\n | \"id_token_audience_mismatch\"\r\n | \"id_token_expired\"\r\n | \"id_token_missing_sub\"\r\n | \"id_token_at_hash_mismatch\";\r\n\r\n/** OAuth 2.0 标准错误码 */\r\nexport type OAuthErrorCode =\r\n | \"invalid_request\"\r\n | \"invalid_client\"\r\n | \"invalid_grant\"\r\n | \"unauthorized_client\"\r\n | \"unsupported_grant_type\"\r\n | \"invalid_scope\"\r\n | \"access_denied\"\r\n | \"server_error\"\r\n | \"rate_limited\";\r\n\r\n/**\r\n * SSO SDK 自定义错误\r\n */\r\nexport class SsoError extends Error {\r\n public readonly code: SsoErrorCode;\r\n public readonly description: string;\r\n public readonly cause?: unknown;\r\n\r\n constructor(code: SsoErrorCode, description: string, cause?: unknown) {\r\n super(`[SSO SDK] ${code}: ${description}`);\r\n this.name = \"SsoError\";\r\n this.code = code;\r\n this.description = description;\r\n this.cause = cause;\r\n }\r\n}\r\n\r\n/**\r\n * OAuth 2.0 服务端返回的错误\r\n */\r\nexport class OAuthError extends Error {\r\n public readonly code: OAuthErrorCode;\r\n public readonly description: string;\r\n public readonly uri?: string;\r\n\r\n constructor(\r\n code: OAuthErrorCode,\r\n description: string,\r\n uri?: string\r\n ) {\r\n super(`[OAuth] ${code}: ${description}`);\r\n this.name = \"OAuthError\";\r\n this.code = code;\r\n this.description = description;\r\n this.uri = uri;\r\n }\r\n}\r\n","/**\r\n * PKCE (Proof Key for Code Exchange) 工具函数\r\n *\r\n * 实现 RFC 7636 规范：\r\n * - code_verifier: 43-128 字符的随机字符串\r\n * - code_challenge: SHA-256(code_verifier) 的 base64url 编码\r\n *\r\n * 仅支持 S256 模式，不提供 plain 模式。\r\n */\r\n\r\nconst VALID_CHARS =\r\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~\";\r\n\r\n/**\r\n * 生成密码学安全随机字符串\r\n *\r\n * 使用拒绝采样法（rejection sampling）避免取模非均匀分布。\r\n * VALID_CHARS 有 66 个字符，Uint8(0-255) 取模会偏向前 58 个字符。\r\n * 丢弃 >=198 的字节值使分布完全均匀（198 = floor(256/66) * 66）。\r\n */\r\nfunction generateRandomString(length: number): string {\r\n const mask = 198; // 66 * 3，最大均匀取值\r\n let result = \"\";\r\n\r\n while (result.length < length) {\r\n // 一次生成分块避免过小 array 的循环开销\r\n const chunkSize = Math.min(length * 2, 256);\r\n const array = new Uint8Array(chunkSize);\r\n crypto.getRandomValues(array);\r\n\r\n for (let i = 0; i < chunkSize && result.length < length; i++) {\r\n if (array[i] >= mask) continue; // 拒绝采样：丢弃 >=198 的字节\r\n result += VALID_CHARS[array[i] % VALID_CHARS.length];\r\n }\r\n }\r\n\r\n return result;\r\n}\r\n\r\n/**\r\n * 生成 code_verifier\r\n *\r\n * 生成 43-128 字符之间的安全随机字符串，\r\n * 使用 `crypto.getRandomValues` 保证密码学安全性。\r\n *\r\n * @param length - 长度（默认 64），范围 43-128\r\n */\r\nexport function generateCodeVerifier(length: number = 64): string {\r\n if (length < 43 || length > 128) {\r\n throw new Error(\"code_verifier length must be between 43 and 128\");\r\n }\r\n return generateRandomString(length);\r\n}\r\n\r\n/**\r\n * 计算 code_challenge (S256)\r\n *\r\n * 对 code_verifier 进行 SHA-256 哈希，然后进行 base64url 编码。\r\n *\r\n * @param codeVerifier - PKCE code_verifier\r\n */\r\nexport async function generateCodeChallenge(\r\n codeVerifier: string\r\n): Promise<string> {\r\n const encoder = new TextEncoder();\r\n const data = encoder.encode(codeVerifier);\r\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\r\n\r\n // 转为 base64url（无 padding）\r\n const bytes = new Uint8Array(hash);\r\n let binary = \"\";\r\n for (let i = 0; i < bytes.byteLength; i++) {\r\n binary += String.fromCharCode(bytes[i]);\r\n }\r\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/**\r\n * 生成 state 参数\r\n *\r\n * 32 字节 hex 随机字符串，用于 CSRF 防护。\r\n */\r\nexport function generateState(): string {\r\n const array = new Uint8Array(32);\r\n crypto.getRandomValues(array);\r\n return Array.from(array, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\r\n}\r\n","/**\n * Token 存储抽象层\n *\n * 默认使用 localStorage，以支持多 Tab 间自动同步 token 并避免并发刷新。\n * 对 XSS 敏感的子项目可通过 setTokenStorage() 注入更安全的自定义实现\n *（如内存存储、Service Worker 封装、或带加密的 storage）。\n *\n * 多 client 隔离：\n * - token / state / return_url 均支持按 clientId 隔离 key\n * - 不传 clientId 时使用全局 key，保持向后兼容\n */\n\n/** Token 数据 */\nexport interface TokenData {\n access_token: string;\n token_type: string;\n expires_in: number;\n refresh_token: string;\n id_token?: string;\n\n /** Token 签发时间（epoch ms），用于计算过期 */\n issued_at: number;\n\n /** 访问令牌实际过期时间（epoch ms）= issued_at + expires_in * 1000 */\n expires_at: number;\n}\n\n/** 存储接口 */\nexport interface TokenStorage {\n get(key: string): string | null;\n set(key: string, value: string): void;\n remove(key: string): void;\n}\n\n/** 默认 localStorage/sessionStorage key 前缀 */\nconst STORAGE_PREFIX = \"nihplod_sso_\";\n\n/** 常量 key 名称 */\nconst TOKEN_KEY = \"token\";\nconst VERIFIER_KEY_PREFIX = \"pkce_verifier_\";\nconst STATE_KEY = \"oauth_state\";\nconst RETURN_URL_KEY = \"return_url\";\n\nfunction buildKey(base: string, clientId?: string): string {\n return clientId ? `${base}:${clientId}` : base;\n}\n\n/**\n * 内存存储适配器（Public Client 浏览器默认）\n *\n * 安全优势：\n * - refresh_token 不落盘，XSS 无法窃取长期凭证。\n * - 页面刷新后用户需重新授权，符合纯前端 Public Client 的安全模型。\n *\n * 代价：多 Tab 间不会自动同步 token；SDK 内部已用锁机制避免并发刷新。\n */\nfunction createMemoryStorageAdapter(): TokenStorage {\n const store = new Map<string, string>();\n return {\n get(key: string) {\n return store.get(key) ?? null;\n },\n set(key: string, value: string) {\n store.set(key, value);\n },\n remove(key: string) {\n store.delete(key);\n },\n };\n}\n\nconst memoryStorageAdapter = createMemoryStorageAdapter();\n\n/**\n * 浏览器 localStorage 实现\n *\n * 适用于：\n * - Next.js BFF / Confidential Client（refresh_token 不直接暴露给浏览器）。\n * - 需要多 Tab 共享 token 的场景。\n *\n * 注意：Public Client 在浏览器中直接存储 refresh_token 会增加 XSS 风险，\n * 建议改用内存存储或 Service Worker 封装。\n */\nconst localStorageAdapter: TokenStorage = {\n get(key: string) {\n if (typeof localStorage === \"undefined\") return null;\n return localStorage.getItem(STORAGE_PREFIX + key);\n },\n set(key: string, value: string) {\n if (typeof localStorage === \"undefined\") return;\n localStorage.setItem(STORAGE_PREFIX + key, value);\n },\n remove(key: string) {\n if (typeof localStorage === \"undefined\") return;\n localStorage.removeItem(STORAGE_PREFIX + key);\n },\n};\n\n/**\n * 创建安全存储实现\n *\n * @param options.persist 是否持久化到 localStorage。默认 false（内存存储）。\n * - Confidential/BFF 子项目可设为 true。\n * - Public Client 在浏览器中建议保持 false。\n */\nexport function createSecureStorage(options: { persist?: boolean } = {}): TokenStorage {\n return options.persist ? localStorageAdapter : memoryStorageAdapter;\n}\n\nlet _storage: TokenStorage = memoryStorageAdapter;\n\n/**\n * 设置自定义存储实现\n */\nexport function setTokenStorage(storage: TokenStorage): void {\n _storage = storage;\n}\n\n/**\n * 获取当前存储实现\n */\nexport function getTokenStorage(): TokenStorage {\n return _storage;\n}\n\n// ============================================\n// Token 存取\n// ============================================\n\nexport function saveTokenData(data: TokenData, clientId?: string): void {\n _storage.set(buildKey(TOKEN_KEY, clientId), JSON.stringify(data));\n}\n\nexport function getTokenData(clientId?: string): TokenData | null {\n const raw = _storage.get(buildKey(TOKEN_KEY, clientId));\n if (!raw) return null;\n try {\n return JSON.parse(raw) as TokenData;\n } catch {\n return null;\n }\n}\n\nexport function removeTokenData(clientId?: string): void {\n _storage.remove(buildKey(TOKEN_KEY, clientId));\n}\n\n// ============================================\n// PKCE 临时数据存取\n// ============================================\n\nexport function savePkceVerifier(clientId: string, verifier: string): void {\n _storage.set(VERIFIER_KEY_PREFIX + clientId, verifier);\n}\n\nexport function getPkceVerifier(clientId: string): string | null {\n return _storage.get(VERIFIER_KEY_PREFIX + clientId);\n}\n\nexport function removePkceVerifier(clientId: string): void {\n _storage.remove(VERIFIER_KEY_PREFIX + clientId);\n}\n\n// ============================================\n// State 参数存取\n// ============================================\n\nexport function saveOAuthState(state: string, clientId?: string): void {\n _storage.set(buildKey(STATE_KEY, clientId), state);\n}\n\nexport function getOAuthState(clientId?: string): string | null {\n return _storage.get(buildKey(STATE_KEY, clientId));\n}\n\nexport function removeOAuthState(clientId?: string): void {\n _storage.remove(buildKey(STATE_KEY, clientId));\n}\n\n// ============================================\n// 返回 URL 存取\n// ============================================\n\nexport function saveReturnUrl(url: string, clientId?: string): void {\n _storage.set(buildKey(RETURN_URL_KEY, clientId), url);\n}\n\nexport function getReturnUrl(clientId?: string): string | null {\n return _storage.get(buildKey(RETURN_URL_KEY, clientId));\n}\n\nexport function removeReturnUrl(clientId?: string): void {\n _storage.remove(buildKey(RETURN_URL_KEY, clientId));\n}\n\n// ============================================\n// 清理所有 SSO 数据\n// ============================================\n\nexport function clearAllSsoData(clientId?: string): void {\n if (clientId) {\n removeTokenData(clientId);\n removeOAuthState(clientId);\n removeReturnUrl(clientId);\n removePkceVerifier(clientId);\n return;\n }\n\n removeTokenData();\n removeOAuthState();\n removeReturnUrl();\n\n // 清理所有 PKCE verifier（遍历已知前缀，localStorage key 可枚举）\n if (typeof localStorage !== \"undefined\") {\n const prefix = STORAGE_PREFIX + VERIFIER_KEY_PREFIX;\n for (let i = 0; i < localStorage.length; i++) {\n const key = localStorage.key(i);\n if (key?.startsWith(prefix)) {\n _storage.remove(key.slice(STORAGE_PREFIX.length));\n }\n }\n }\n}\n\n/**\n * 清理指定 clientId 列表的 PKCE verifier\n *\n * 适用于非浏览器环境或已知 clientId 场景。\n */\nexport function clearVerifiersForClients(clientIds: string[]): void {\n for (const clientId of clientIds) {\n _storage.remove(VERIFIER_KEY_PREFIX + clientId);\n }\n}\n","/**\r\n * SSO Client 核心类\r\n *\r\n * 封装完整的 OAuth 2.0 授权码 + PKCE S256 流程：\r\n * - login(): 发起授权请求\r\n * - handleCallback(): 处理回调，交换 token\r\n * - refreshToken(): 刷新 access token（原子轮换）\r\n * - getUserInfo(): 获取用户信息\r\n * - logout(): 登出\r\n * - isAuthenticated(): 检查认证状态\r\n */\r\n\r\nimport { SsoError } from \"./errors\";\r\nimport {\r\n generateCodeVerifier,\r\n generateCodeChallenge,\r\n generateState,\r\n} from \"./pkce\";\r\nimport {\r\n saveTokenData,\r\n getTokenData,\r\n removeTokenData,\r\n savePkceVerifier,\r\n getPkceVerifier,\r\n removePkceVerifier,\r\n saveOAuthState,\r\n getOAuthState,\r\n removeOAuthState,\r\n saveReturnUrl,\r\n getReturnUrl,\r\n removeReturnUrl,\r\n clearAllSsoData,\r\n type TokenData,\r\n} from \"./storage\";\r\n\r\n// ============================================\r\n// ID Token 验证辅助函数（浏览器原生 Web Crypto）\r\n// ============================================\r\n\r\nfunction base64UrlDecode(input: string): Uint8Array {\r\n const base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\r\n const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\r\n const binary = atob(padded);\r\n const bytes = new Uint8Array(binary.length);\r\n for (let i = 0; i < binary.length; i++) {\r\n bytes[i] = binary.charCodeAt(i);\r\n }\r\n return bytes;\r\n}\r\n\r\n/** 解码 JWT payload（不验证签名） */\r\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\r\n try {\r\n const parts = token.split(\".\");\r\n if (parts.length !== 3) return null;\r\n const json = new TextDecoder().decode(base64UrlDecode(parts[1]));\r\n return JSON.parse(json) as Record<string, unknown>;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/** 解码 JWT header */\r\nfunction decodeJwtHeader(token: string): Record<string, unknown> | null {\r\n try {\r\n const parts = token.split(\".\");\r\n if (parts.length !== 3) return null;\r\n const json = new TextDecoder().decode(base64UrlDecode(parts[0]));\r\n return JSON.parse(json) as Record<string, unknown>;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/** 标准化 issuer/base URL，去除末尾斜杠 */\r\nfunction normalizeIssuer(url: string): string {\r\n return url.replace(/\\/+$/, \"\");\r\n}\r\n\r\ninterface JwksKey {\r\n kty: string;\r\n kid?: string;\r\n alg?: string;\r\n use?: string;\r\n n?: string;\r\n e?: string;\r\n x5c?: string[];\r\n}\r\n\r\ninterface Jwks {\r\n keys: JwksKey[];\r\n}\r\n\r\nlet cachedJwks: { baseUrl: string; jwks: Jwks; fetchedAt: number } | null = null;\r\nconst JWKS_CACHE_TTL_MS = 5 * 60 * 1000;\r\n\r\n/** 从 SSO 中心拉取 JWKS */\r\nasync function fetchJwks(baseUrl: string): Promise<Jwks | null> {\r\n const now = Date.now();\r\n if (cachedJwks && cachedJwks.baseUrl === baseUrl && now - cachedJwks.fetchedAt < JWKS_CACHE_TTL_MS) {\r\n return cachedJwks.jwks;\r\n }\r\n\r\n try {\r\n const res = await fetch(`${baseUrl}/api/oauth/jwks`);\r\n if (!res.ok) return null;\r\n const jwks = (await res.json()) as Jwks;\r\n cachedJwks = { baseUrl, jwks, fetchedAt: now };\r\n return jwks;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/** 计算 OIDC at_hash（access_token SHA-256 前 128bit base64url） */\r\nasync function computeAtHash(accessToken: string): Promise<string> {\r\n const hash = await crypto.subtle.digest(\r\n \"SHA-256\",\r\n new TextEncoder().encode(accessToken)\r\n );\r\n const bytes = new Uint8Array(hash);\r\n const half = bytes.slice(0, bytes.length / 2);\r\n let binary = \"\";\r\n for (const b of half) {\r\n binary += String.fromCharCode(b);\r\n }\r\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/** 使用 RS256 公钥验证 ID Token 签名 */\r\nasync function verifyRs256(token: string, jwk: JwksKey): Promise<boolean> {\r\n try {\r\n const [headerB64, payloadB64, signature] = token.split(\".\");\r\n if (!signature || !jwk.n || !jwk.e) return false;\r\n\r\n const cryptoKey = await crypto.subtle.importKey(\r\n \"jwk\",\r\n { kty: \"RSA\", n: jwk.n, e: jwk.e, alg: \"RS256\", ext: false },\r\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\r\n false,\r\n [\"verify\"]\r\n );\r\n\r\n const signatureBytes = base64UrlDecode(signature);\r\n const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\r\n return await crypto.subtle.verify(\r\n \"RSASSA-PKCS1-v1_5\",\r\n cryptoKey,\r\n signatureBytes as unknown as BufferSource,\r\n data as unknown as BufferSource\r\n );\r\n } catch {\r\n return false;\r\n }\r\n}\r\n\r\n/** 验证 ID Token（iss、aud、exp、sub、签名、at_hash） */\r\nasync function validateIdToken(\r\n idToken: string,\r\n expectedIssuer: string,\r\n expectedClientId: string,\r\n accessToken: string\r\n) {\r\n const header = decodeJwtHeader(idToken);\r\n if (!header) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token 格式错误\");\r\n }\r\n\r\n const alg = header.alg;\r\n if (typeof alg !== \"string\" || (alg !== \"RS256\" && alg !== \"HS256\")) {\r\n throw new SsoError(\"id_token_unsupported_alg\", `不支持的 ID Token 签名算法: ${alg}`);\r\n }\r\n\r\n // RS256：通过 JWKS 验证签名\r\n if (alg === \"RS256\") {\r\n const jwks = await fetchJwks(normalizeIssuer(expectedIssuer));\r\n if (!jwks) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"无法获取 JWKS 验证 ID Token 签名\");\r\n }\r\n const kid = typeof header.kid === \"string\" ? header.kid : undefined;\r\n const key = jwks.keys.find(\r\n (k) =>\r\n k.kty === \"RSA\" &&\r\n k.alg === \"RS256\" &&\r\n k.use === \"sig\" &&\r\n (kid ? k.kid === kid : true)\r\n );\r\n if (!key) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"JWKS 中未找到匹配的 RS256 公钥\");\r\n }\r\n const validSig = await verifyRs256(idToken, key);\r\n if (!validSig) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"ID Token 签名验证失败\");\r\n }\r\n }\r\n\r\n // HS256：对称密钥无法安全分发给 Public Client，因此仅校验声明、不校验签名。\r\n // Confidential Client 如确需验证签名，应迁移到 RS256。\r\n if (alg === \"HS256\") {\r\n // eslint-disable-next-line no-console\r\n console.warn(\r\n \"[SSO SDK] ID Token 使用 HS256 签名，Public Client 无法安全验证签名。\" +\r\n \"建议主站配置 JWT_ID_TOKEN_PRIVATE_KEY / JWT_ID_TOKEN_PUBLIC_KEY 启用 RS256。\"\r\n );\r\n }\r\n\r\n const payload = decodeJwtPayload(idToken);\r\n if (!payload) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token payload 解析失败\");\r\n }\r\n\r\n const normalizedExpectedIssuer = normalizeIssuer(expectedIssuer);\r\n const tokenIssuer = typeof payload.iss === \"string\" ? normalizeIssuer(payload.iss) : \"\";\r\n if (tokenIssuer !== normalizedExpectedIssuer) {\r\n throw new SsoError(\"id_token_issuer_mismatch\", \"ID Token issuer 不匹配\");\r\n }\r\n if (\r\n payload.aud !== expectedClientId &&\r\n !((payload.aud as string[] | undefined)?.includes(expectedClientId))\r\n ) {\r\n throw new SsoError(\"id_token_audience_mismatch\", \"ID Token audience 不匹配\");\r\n }\r\n if (typeof payload.exp === \"number\" && Date.now() >= payload.exp * 1000) {\r\n throw new SsoError(\"id_token_expired\", \"ID Token 已过期\");\r\n }\r\n if (typeof payload.sub !== \"string\" || !payload.sub) {\r\n throw new SsoError(\"id_token_missing_sub\", \"ID Token 缺少 sub\");\r\n }\r\n\r\n // 校验 at_hash：确保 ID Token 与当前 access_token 绑定\r\n if (typeof payload.at_hash === \"string\" && payload.at_hash) {\r\n const actual = await computeAtHash(accessToken);\r\n if (actual !== payload.at_hash) {\r\n throw new SsoError(\"id_token_at_hash_mismatch\", \"ID Token at_hash 不匹配\");\r\n }\r\n }\r\n\r\n return { sub: payload.sub };\r\n}\r\n\r\n// ============================================\r\n// 类型定义\r\n// ============================================\r\n\r\n/** SSO 客户端配置 */\r\nexport interface SsoClientConfig {\r\n /** OAuth Client ID（从管理后台获取） */\r\n clientId: string;\r\n\r\n /** OAuth Client Secret（从管理后台获取）\r\n *\r\n * ⚠️ 安全提醒：client_secret 不应暴露在前端代码中。\r\n * 对于浏览器端 SPA（Public Client），应省略此字段；SDK 会使用 PKCE 完成授权，\r\n * 且 token 端点不会发送 client_secret。\r\n * 对于 BFF/Next.js 等 Confidential Client，可传入 client_secret。\r\n */\r\n clientSecret?: string;\r\n\r\n /** 回调 URL（必须与注册的 redirect_uri 完全一致） */\r\n redirectUri: string;\r\n\r\n /** SSO 中心地址，如 \"https://nihplod.cn\" */\r\n ssoBaseUrl: string;\r\n\r\n /** 请求的 scope（空格分隔），如 \"openid profile phone\" */\r\n scopes?: string;\r\n}\r\n\r\n/** 用户信息 */\r\nexport interface SsoUser {\r\n sub: string;\r\n nickname?: string;\r\n avatar?: string;\r\n phone?: string;\r\n membership_level?: string;\r\n total_points?: number;\r\n}\r\n\r\n/** Token 响应 */\r\nexport interface TokenResponse {\r\n access_token: string;\r\n token_type: string;\r\n expires_in: number;\r\n refresh_token: string;\r\n id_token?: string;\r\n}\r\n\r\n/** OIDC Discovery 文档 */\r\nexport interface OidcDiscovery {\r\n issuer: string;\r\n authorization_endpoint: string;\r\n token_endpoint: string;\r\n userinfo_endpoint: string;\r\n jwks_uri: string;\r\n introspection_endpoint: string;\r\n revocation_endpoint?: string;\r\n end_session_endpoint?: string;\r\n scopes_supported: string[];\r\n response_types_supported: string[];\r\n grant_types_supported: string[];\r\n code_challenge_methods_supported: string[];\r\n}\r\n\r\n// ============================================\r\n// SsoClient\r\n// ============================================\r\n\r\nexport class SsoClient {\r\n public readonly config: SsoClientConfig;\r\n private _discovery: OidcDiscovery | null = null;\r\n private _discoveryFetchedAt: number = 0;\r\n private _refreshLock: Promise<TokenData> | null = null;\r\n\r\n /** Discovery 文档缓存 TTL（5 分钟） */\r\n private static readonly DISCOVERY_TTL_MS = 5 * 60 * 1000;\r\n\r\n /** Discovery fetch 超时（10 秒） */\r\n private static readonly DISCOVERY_TIMEOUT_MS = 10000;\r\n\r\n constructor(config: SsoClientConfig) {\r\n if (!config.clientId) throw new SsoError(\"invalid_config\", \"clientId 不能为空\");\r\n if (!config.redirectUri) throw new SsoError(\"invalid_config\", \"redirectUri 不能为空\");\r\n if (!config.ssoBaseUrl) throw new SsoError(\"invalid_config\", \"ssoBaseUrl 不能为空\");\r\n\r\n // 规范化 ssoBaseUrl：移除末尾斜杠\r\n const base = config.ssoBaseUrl.replace(/\\/+$/, \"\");\r\n this.config = { ...config, ssoBaseUrl: base };\r\n }\r\n\r\n // ============================================\r\n // 内部方法\r\n // ============================================\r\n\r\n /**\r\n * 获取 OIDC Discovery 文档（带缓存 + 超时）\r\n *\r\n * 缓存 5 分钟，超时 10 秒。\r\n * 失败时返回 null（上层调用方回退到硬编码默认端点）。\r\n */\r\n private async _getDiscovery(): Promise<OidcDiscovery | null> {\r\n const now = Date.now();\r\n\r\n // 命中缓存且未过期\r\n if (\r\n this._discovery &&\r\n now - this._discoveryFetchedAt < SsoClient.DISCOVERY_TTL_MS\r\n ) {\r\n return this._discovery;\r\n }\r\n\r\n const url = `${this.config.ssoBaseUrl}/api/oauth/.well-known/openid-configuration`;\r\n\r\n try {\r\n const controller = new AbortController();\r\n const timeoutId = setTimeout(\r\n () => controller.abort(),\r\n SsoClient.DISCOVERY_TIMEOUT_MS\r\n );\r\n\r\n const res = await fetch(url, { signal: controller.signal });\r\n clearTimeout(timeoutId);\r\n\r\n if (!res.ok) {\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 请求失败: HTTP ${res.status}, 回退到默认端点`\r\n );\r\n return null;\r\n }\r\n\r\n this._discovery = (await res.json()) as OidcDiscovery;\r\n this._discoveryFetchedAt = now;\r\n return this._discovery;\r\n } catch (err) {\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 请求异常: ${err instanceof Error ? err.message : String(err)}, 回退到默认端点`\r\n );\r\n // 不清空已有缓存（即使过期也优于无数据）\r\n return this._discovery || null;\r\n }\r\n }\r\n\r\n /** 获取 authorize 端点 URL（优先 Discovery，回退默认） */\r\n private async _getAuthorizeEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.authorization_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/authorize`;\r\n }\r\n\r\n /** 获取 token 端点 URL（优先 Discovery，回退默认） */\r\n private async _getTokenEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.token_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/token`;\r\n }\r\n\r\n /** 获取 userinfo 端点 URL（优先 Discovery，回退默认） */\r\n private async _getUserinfoEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.userinfo_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/userinfo`;\r\n }\r\n\r\n // ============================================\r\n // 公共 API\r\n // ============================================\r\n\r\n /**\r\n * 发起 SSO 登录\r\n *\r\n * 生成 PKCE code_verifier/code_challenge 和 state 参数，\r\n * 构建 authorize URL，通过 302 跳转到 SSO 登录页。\r\n *\r\n * @param returnUrl - 登录成功后的返回地址（可选，保存到 sessionStorage）\r\n */\r\n async login(returnUrl?: string): Promise<void> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n\r\n // 保存 PKCE verifier 和 state 到 sessionStorage\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n\r\n if (returnUrl) {\r\n saveReturnUrl(returnUrl);\r\n }\r\n\r\n // 构建 authorize URL\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes || \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n\r\n // 跳转\r\n window.location.href = `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /**\r\n * 构建登录 URL（不跳转，返回 URL 字符串）\r\n *\r\n * 适用于需要手动处理跳转的场景。\r\n */\r\n async getLoginUrl(returnUrl?: string): Promise<string> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n // 统一使用全局 returnUrl key，与 login() / CallbackPage 保持一致\r\n if (returnUrl) saveReturnUrl(returnUrl);\r\n\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes || \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n\r\n return `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /**\r\n * 处理 OAuth 回调\r\n *\r\n * 解析回调 URL，校验 state 参数，用授权码交换 token。\r\n * 成功后 token 自动保存到 sessionStorage。\r\n *\r\n * @param callbackUrl - 完整的回调 URL（window.location.href）\r\n * @returns TokenData 或 null\r\n */\r\n async handleCallback(\r\n callbackUrl: string\r\n ): Promise<TokenData> {\r\n const url = new URL(callbackUrl);\r\n const params = url.searchParams;\r\n\r\n // 检查错误\r\n const error = params.get(\"error\");\r\n if (error) {\r\n const desc = params.get(\"error_description\") || error;\r\n throw new SsoError(\"token_request_failed\", `授权失败: ${desc}`);\r\n }\r\n\r\n const code = params.get(\"code\");\r\n const returnedState = params.get(\"state\");\r\n\r\n if (!code) {\r\n throw new SsoError(\"token_request_failed\", \"回调 URL 中缺少 authorization code\");\r\n }\r\n\r\n // 校验 state 参数（CSRF 防护）\r\n const savedState = getOAuthState(this.config.clientId);\r\n if (!savedState || savedState !== returnedState) {\r\n removeOAuthState(this.config.clientId);\r\n throw new SsoError(\r\n \"state_mismatch\",\r\n \"State 参数不匹配，可能存在 CSRF 攻击\"\r\n );\r\n }\r\n removeOAuthState(this.config.clientId);\r\n\r\n // 获取 code_verifier\r\n const verifier = getPkceVerifier(this.config.clientId);\r\n if (!verifier) {\r\n throw new SsoError(\r\n \"pkce_required\",\r\n \"code_verifier 不存在（可能已过期或来自其他标签页）\"\r\n );\r\n }\r\n removePkceVerifier(this.config.clientId);\r\n\r\n // 交换 token\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"authorization_code\");\r\n body.set(\"code\", code);\r\n body.set(\"code_verifier\", verifier);\r\n body.set(\"client_id\", this.config.clientId);\r\n body.set(\"redirect_uri\", this.config.redirectUri);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response;\r\n try {\r\n res = await fetch(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n let errData: Record<string, unknown> = {};\r\n try { errData = await res.json(); } catch { /* ignore */ }\r\n throw new SsoError(\r\n \"token_request_failed\",\r\n (errData.error_description as string) || `Token 请求失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n const data: TokenResponse = await res.json();\r\n\r\n // OIDC：验证 ID Token 签名、基本声明及 at_hash\r\n if (data.id_token) {\r\n try {\r\n await validateIdToken(\r\n data.id_token,\r\n this.config.ssoBaseUrl,\r\n this.config.clientId,\r\n data.access_token\r\n );\r\n } catch (err) {\r\n // 验证失败：不保存任何 token，防止伪造 ID Token\r\n removeTokenData(this.config.clientId);\r\n throw err;\r\n }\r\n }\r\n\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n refresh_token: data.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in * 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n return tokenData;\r\n }\r\n\r\n /**\r\n * 刷新 Access Token\r\n *\r\n * 使用 refresh_token 换取新的 access_token。\r\n * 采用互斥锁防止并发刷新。\r\n * 支持 Refresh Token 原子轮换。\r\n */\r\n async refreshToken(): Promise<TokenData> {\r\n // 互斥锁：避免并发刷新\r\n if (this._refreshLock) return this._refreshLock;\r\n\r\n this._refreshLock = this._doRefreshToken();\r\n try {\r\n return await this._refreshLock;\r\n } finally {\r\n this._refreshLock = null;\r\n }\r\n }\r\n\r\n private async _doRefreshToken(): Promise<TokenData> {\r\n const current = getTokenData(this.config.clientId);\r\n if (!current?.refresh_token) {\r\n throw new SsoError(\"no_refresh_token\", \"没有可用的 refresh_token\");\r\n }\r\n\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"refresh_token\");\r\n body.set(\"refresh_token\", current.refresh_token);\r\n body.set(\"client_id\", this.config.clientId);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response;\r\n try {\r\n res = await fetch(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"刷新 Token 网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n let errData: Record<string, unknown> = {};\r\n try { errData = await res.json(); } catch { /* ignore */ }\r\n const errorCode = (errData.error as string) || \"\";\r\n // invalid_grant 表示 refresh_token 已被撤销或过期，应清除本地登录态\r\n if (errorCode === \"invalid_grant\" || res.status === 401) {\r\n removeTokenData(this.config.clientId);\r\n }\r\n throw new SsoError(\r\n errorCode === \"invalid_grant\" ? \"session_expired\" : \"token_request_failed\",\r\n (errData.error_description as string) || `刷新 Token 失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n const data: TokenResponse = await res.json();\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n refresh_token: data.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in * 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n return tokenData;\r\n }\r\n\r\n /**\r\n * 获取用户信息\r\n *\r\n * 若 access_token 已过期则自动刷新后再请求。\r\n */\r\n async getUserInfo(): Promise<SsoUser> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n\r\n if (!tokenData) {\r\n throw new SsoError(\"not_authenticated\", \"未登录\");\r\n }\r\n\r\n // 若已过期，先刷新\r\n if (Date.now() >= tokenData.expires_at) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n const userinfoEndpoint = await this._getUserinfoEndpoint();\r\n\r\n let res: Response;\r\n try {\r\n res = await fetch(userinfoEndpoint, {\r\n headers: {\r\n Authorization: `Bearer ${tokenData.access_token}`,\r\n },\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"获取用户信息网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n if (res.status === 401) {\r\n removeTokenData(this.config.clientId);\r\n throw new SsoError(\"not_authenticated\", \"Token 已失效\");\r\n }\r\n throw new SsoError(\r\n \"userinfo_failed\",\r\n `获取用户信息失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n return (await res.json()) as SsoUser;\r\n }\r\n\r\n /**\r\n * 获取当前 access_token\r\n *\r\n * 若已过期则自动刷新。用于子项目自行发起 API 请求时获取 Bearer token。\r\n * 若无 token 返回 null；若刷新失败则抛出错误（与 getUserInfo 行为一致）。\r\n */\r\n async getAccessToken(): Promise<string | null> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return null;\r\n\r\n if (Date.now() >= tokenData.expires_at) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n return tokenData.access_token;\r\n }\r\n\r\n /**\r\n * 检查是否已认证（不发起网络请求）\r\n *\r\n * 仅检查本地是否存在未过期的 access_token。\r\n */\r\n isAuthenticated(): boolean {\r\n const tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return false;\r\n return Date.now() < tokenData.expires_at;\r\n }\r\n\r\n /**\r\n * 登出\r\n *\r\n * 清除本地所有 token 和临时数据，并尝试撤销服务端 refresh_token。\r\n * @param redirectToSso - 是否重定向到 SSO 登出页（默认 false）\r\n */\r\n async logout(redirectToSso: boolean = false): Promise<void> {\r\n // 获取 refresh_token 用于服务端撤销（需在 clearAllSsoData 之前）\r\n const tokenData = getTokenData(this.config.clientId);\r\n const refreshToken = tokenData?.refresh_token;\r\n const idTokenHint = tokenData?.id_token;\r\n\r\n clearAllSsoData(this.config.clientId);\r\n\r\n // 尝试调用服务端 token revocation 端点（best-effort）\r\n // 仅 Confidential Client 携带 client_secret；Public Client 不传 secret。\r\n if (refreshToken && this.config.clientId) {\r\n try {\r\n const discovery = await this._getDiscovery();\r\n const revokeUrl =\r\n discovery?.revocation_endpoint ||\r\n `${this.config.ssoBaseUrl}/api/oauth/revoke`;\r\n const revokeBody = new URLSearchParams({\r\n token: refreshToken,\r\n token_type_hint: \"refresh_token\",\r\n client_id: this.config.clientId,\r\n });\r\n if (this.config.clientSecret) {\r\n revokeBody.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n await fetch(revokeUrl, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: revokeBody.toString(),\r\n });\r\n } catch {\r\n // 撤销失败不影响本地登出（best-effort）\r\n }\r\n }\r\n\r\n if (redirectToSso) {\r\n // OIDC RP-Initiated Logout：携带 client_id / post_logout_redirect_uri / id_token_hint / state\r\n const discovery = await this._getDiscovery();\r\n const endSessionEndpoint =\r\n discovery?.end_session_endpoint || `${this.config.ssoBaseUrl}/logout`;\r\n const logoutUrl = new URL(endSessionEndpoint);\r\n logoutUrl.searchParams.set(\"client_id\", this.config.clientId);\r\n if (this.config.redirectUri) {\r\n logoutUrl.searchParams.set(\r\n \"post_logout_redirect_uri\",\r\n this.config.redirectUri\r\n );\r\n }\r\n if (idTokenHint) {\r\n logoutUrl.searchParams.set(\"id_token_hint\", idTokenHint);\r\n }\r\n const state = generateState();\r\n logoutUrl.searchParams.set(\"state\", state);\r\n window.location.href = logoutUrl.toString();\r\n }\r\n }\r\n\r\n /**\r\n * 获取 OIDC Discovery 文档\r\n *\r\n * 用于调试和获取 SSO 中心完整配置。\r\n * 可能返回 null（当 Discovery 端点不可达且无缓存时）。\r\n */\r\n async getDiscovery(): Promise<OidcDiscovery | null> {\r\n return this._getDiscovery();\r\n }\r\n}\r\n","/**\r\n * RequireAuth / withAuth — 路由保护组件\r\n *\r\n * 用法：\r\n * - <RequireAuth> 包裹需要登录才能访问的路由\r\n * - withAuth(Component) HOC 包装单个页面组件\r\n */\r\n\r\n\"use client\";\r\n\r\nimport React, { useEffect, useRef, type ComponentType } from \"react\";\r\nimport { useSso } from \"./SsoProvider\";\r\n\r\n// ============================================\r\n// RequireAuth 组件\r\n// ============================================\r\n\r\nexport interface RequireAuthProps {\r\n /** 子组件（受保护的内容） */\r\n children: React.ReactNode;\r\n\r\n /** 未登录时的回退内容（默认显示加载中） */\r\n fallback?: React.ReactNode;\r\n\r\n /** 是否在检测到未登录时自动发起登录跳转 */\r\n autoLogin?: boolean;\r\n}\r\n\r\n/**\r\n * 路由保护组件\r\n *\r\n * 未登录时自动触发登录跳转或显示回退内容。\r\n *\r\n * @example\r\n * ```tsx\r\n * <RequireAuth>\r\n * <Dashboard />\r\n * </RequireAuth>\r\n * ```\r\n */\r\nexport function RequireAuth({\r\n children,\r\n fallback,\r\n autoLogin = true,\r\n}: RequireAuthProps) {\r\n const { isAuthenticated, isLoading, login } = useSso();\r\n const loginTriggeredRef = useRef(false);\r\n\r\n useEffect(() => {\r\n if (!isLoading && !isAuthenticated && autoLogin && !loginTriggeredRef.current) {\r\n loginTriggeredRef.current = true;\r\n const currentPath = window.location.pathname + window.location.search;\r\n login(currentPath);\r\n }\r\n }, [isLoading, isAuthenticated, autoLogin, login]);\r\n\r\n if (isLoading) {\r\n return (\r\n fallback || React.createElement(\"div\", null, \"正在验证登录状态...\")\r\n );\r\n }\r\n\r\n if (!isAuthenticated) {\r\n if (fallback) return React.createElement(React.Fragment, null, fallback);\r\n return React.createElement(\"div\", null, \"请先登录\");\r\n }\r\n\r\n return React.createElement(React.Fragment, null, children);\r\n}\r\n\r\n// ============================================\r\n// withAuth HOC\r\n// ============================================\r\n\r\n/**\r\n * 高阶组件：包装页面组件，要求认证后才能访问\r\n *\r\n * @example\r\n * ```tsx\r\n * function DashboardPage() { return <div>Dashboard</div>; }\r\n * export default withAuth(DashboardPage);\r\n * ```\r\n */\r\nexport function withAuth<P extends object>(\r\n Component: ComponentType<P>\r\n): ComponentType<P> {\r\n const displayName =\r\n Component.displayName || Component.name || \"Component\";\r\n\r\n function WrappedComponent(props: P) {\r\n return React.createElement(\r\n RequireAuth,\r\n null,\r\n React.createElement(Component, props)\r\n );\r\n }\r\n\r\n WrappedComponent.displayName = `withAuth(${displayName})`;\r\n return WrappedComponent;\r\n}\r\n","/**\r\n * CallbackPage — 通用 OAuth 回调页面组件\r\n *\r\n * 子项目只需在回调路由渲染此组件即可完成 code → token 交换。\r\n * 交换成功后自动跳转到 returnUrl 或首页。\r\n *\r\n * @example\r\n * ```tsx\r\n * // 在回调页面路由中：\r\n * import { CallbackPage } from \"@nihplod/sso-sdk/react\";\r\n * export default function AuthCallback() {\r\n * return <CallbackPage />;\r\n * }\r\n * ```\r\n */\r\n\r\n\"use client\";\r\n\r\nimport React, { useEffect, useState } from \"react\";\r\nimport { useSso } from \"./SsoProvider\";\r\nimport { getReturnUrl, removeReturnUrl } from \"../core/storage\";\r\nimport { SsoError } from \"../core/errors\";\r\n\r\nexport function CallbackPage() {\r\n const { client, refreshUser } = useSso();\r\n const [error, setError] = useState<string | null>(null);\r\n const [processing, setProcessing] = useState(true);\r\n\r\n useEffect(() => {\r\n let cancelled = false;\r\n\r\n async function handleCallback() {\r\n try {\r\n await client.handleCallback(window.location.href);\r\n\r\n if (cancelled) return;\r\n\r\n // 刷新用户信息\r\n await refreshUser();\r\n\r\n // 跳转到 returnUrl 或首页\r\n const returnUrl = getReturnUrl();\r\n removeReturnUrl();\r\n window.location.href = returnUrl || \"/\";\r\n } catch (err) {\r\n if (cancelled) return;\r\n if (err instanceof SsoError) {\r\n // SsoError 携带 code + description，可直接展示\r\n setError(err.description || `SSO 错误 (${err.code})`);\r\n } else if (err instanceof TypeError && err.message.includes(\"fetch\")) {\r\n // 网络错误：断网、DNS 失败、CORS 等\r\n setError(\"网络连接失败，请检查网络后重试\");\r\n } else if (err instanceof Error) {\r\n setError(`登录回调处理失败: ${err.message}`);\r\n } else {\r\n setError(\"登录回调处理失败，请重试\");\r\n }\r\n setProcessing(false);\r\n }\r\n }\r\n\r\n handleCallback();\r\n\r\n return () => { cancelled = true; };\r\n }, [client, refreshUser]);\r\n\r\n if (error) {\r\n return React.createElement(\r\n \"div\",\r\n {\r\n style: {\r\n display: \"flex\",\r\n flexDirection: \"column\",\r\n alignItems: \"center\",\r\n justifyContent: \"center\",\r\n minHeight: \"100vh\",\r\n fontFamily: \"system-ui, sans-serif\",\r\n },\r\n },\r\n React.createElement(\r\n \"p\",\r\n { style: { color: \"#dc2626\", marginBottom: \"1rem\" } },\r\n error\r\n ),\r\n React.createElement(\r\n \"a\",\r\n { href: \"/\", style: { color: \"#2563eb\", textDecoration: \"underline\" } },\r\n \"返回首页\"\r\n )\r\n );\r\n }\r\n\r\n if (processing) {\r\n return React.createElement(\r\n \"div\",\r\n {\r\n style: {\r\n display: \"flex\",\r\n alignItems: \"center\",\r\n justifyContent: \"center\",\r\n minHeight: \"100vh\",\r\n fontFamily: \"system-ui, sans-serif\",\r\n },\r\n },\r\n React.createElement(\"p\", null, \"正在处理登录回调...\")\r\n );\r\n }\r\n\r\n return null;\r\n}\r\n"],"mappings":";AAWA,OAAO;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;ACsBA,IAAM,WAAN,cAAuB,MAAM;AAAA,EAKlC,YAAY,MAAoB,aAAqB,OAAiB;AACpE,UAAM,aAAa,IAAI,KAAK,WAAW,EAAE;AACzC,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,cAAc;AACnB,SAAK,QAAQ;AAAA,EACf;AACF;;;AC3CA,IAAM,cACJ;AASF,SAAS,qBAAqB,QAAwB;AACpD,QAAM,OAAO;AACb,MAAI,SAAS;AAEb,SAAO,OAAO,SAAS,QAAQ;AAE7B,UAAM,YAAY,KAAK,IAAI,SAAS,GAAG,GAAG;AAC1C,UAAM,QAAQ,IAAI,WAAW,SAAS;AACtC,WAAO,gBAAgB,KAAK;AAE5B,aAAS,IAAI,GAAG,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;AAC5D,UAAI,MAAM,CAAC,KAAK,KAAM;AACtB,gBAAU,YAAY,MAAM,CAAC,IAAI,YAAY,MAAM;AAAA,IACrD;AAAA,EACF;AAEA,SAAO;AACT;AAUO,SAAS,qBAAqB,SAAiB,IAAY;AAChE,MAAI,SAAS,MAAM,SAAS,KAAK;AAC/B,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,qBAAqB,MAAM;AACpC;AASA,eAAsB,sBACpB,cACiB;AACjB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,YAAY;AACxC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAGvD,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK;AACzC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAOO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;;;ACnDA,IAAM,iBAAiB;AAGvB,IAAM,YAAY;AAClB,IAAM,sBAAsB;AAC5B,IAAM,YAAY;AAClB,IAAM,iBAAiB;AAEvB,SAAS,SAAS,MAAc,UAA2B;AACzD,SAAO,WAAW,GAAG,IAAI,IAAI,QAAQ,KAAK;AAC5C;AAWA,SAAS,6BAA2C;AAClD,QAAM,QAAQ,oBAAI,IAAoB;AACtC,SAAO;AAAA,IACL,IAAI,KAAa;AACf,aAAO,MAAM,IAAI,GAAG,KAAK;AAAA,IAC3B;AAAA,IACA,IAAI,KAAa,OAAe;AAC9B,YAAM,IAAI,KAAK,KAAK;AAAA,IACtB;AAAA,IACA,OAAO,KAAa;AAClB,YAAM,OAAO,GAAG;AAAA,IAClB;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB,2BAA2B;AAsCxD,IAAI,WAAyB;AAoBtB,SAAS,cAAc,MAAiB,UAAyB;AACtE,WAAS,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK,UAAU,IAAI,CAAC;AAClE;AAEO,SAAS,aAAa,UAAqC;AAChE,QAAM,MAAM,SAAS,IAAI,SAAS,WAAW,QAAQ,CAAC;AACtD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,UAAyB;AACvD,WAAS,OAAO,SAAS,WAAW,QAAQ,CAAC;AAC/C;AAMO,SAAS,iBAAiB,UAAkB,UAAwB;AACzE,WAAS,IAAI,sBAAsB,UAAU,QAAQ;AACvD;AAEO,SAAS,gBAAgB,UAAiC;AAC/D,SAAO,SAAS,IAAI,sBAAsB,QAAQ;AACpD;AAEO,SAAS,mBAAmB,UAAwB;AACzD,WAAS,OAAO,sBAAsB,QAAQ;AAChD;AAMO,SAAS,eAAe,OAAe,UAAyB;AACrE,WAAS,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK;AACnD;AAEO,SAAS,cAAc,UAAkC;AAC9D,SAAO,SAAS,IAAI,SAAS,WAAW,QAAQ,CAAC;AACnD;AAEO,SAAS,iBAAiB,UAAyB;AACxD,WAAS,OAAO,SAAS,WAAW,QAAQ,CAAC;AAC/C;AAMO,SAAS,cAAc,KAAa,UAAyB;AAClE,WAAS,IAAI,SAAS,gBAAgB,QAAQ,GAAG,GAAG;AACtD;AAEO,SAAS,aAAa,UAAkC;AAC7D,SAAO,SAAS,IAAI,SAAS,gBAAgB,QAAQ,CAAC;AACxD;AAEO,SAAS,gBAAgB,UAAyB;AACvD,WAAS,OAAO,SAAS,gBAAgB,QAAQ,CAAC;AACpD;AAMO,SAAS,gBAAgB,UAAyB;AACvD,MAAI,UAAU;AACZ,oBAAgB,QAAQ;AACxB,qBAAiB,QAAQ;AACzB,oBAAgB,QAAQ;AACxB,uBAAmB,QAAQ;AAC3B;AAAA,EACF;AAEA,kBAAgB;AAChB,mBAAiB;AACjB,kBAAgB;AAGhB,MAAI,OAAO,iBAAiB,aAAa;AACvC,UAAM,SAAS,iBAAiB;AAChC,aAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK;AAC5C,YAAM,MAAM,aAAa,IAAI,CAAC;AAC9B,UAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,iBAAS,OAAO,IAAI,MAAM,eAAe,MAAM,CAAC;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AACF;;;ACvLA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACzD,QAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;AACjF,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAGA,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,gBAAgB,OAA+C;AACtE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,gBAAgB,KAAqB;AAC5C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAgBA,IAAI,aAAwE;AAC5E,IAAM,oBAAoB,IAAI,KAAK;AAGnC,eAAe,UAAU,SAAuC;AAC9D,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,cAAc,WAAW,YAAY,WAAW,MAAM,WAAW,YAAY,mBAAmB;AAClG,WAAO,WAAW;AAAA,EACpB;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,OAAO,iBAAiB;AACnD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,iBAAa,EAAE,SAAS,MAAM,WAAW,IAAI;AAC7C,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,cAAc,aAAsC;AACjE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,WAAW;AAAA,EACtC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,QAAM,OAAO,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;AAC5C,MAAI,SAAS;AACb,aAAW,KAAK,MAAM;AACpB,cAAU,OAAO,aAAa,CAAC;AAAA,EACjC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAGA,eAAe,YAAY,OAAe,KAAgC;AACxE,MAAI;AACF,UAAM,CAAC,WAAW,YAAY,SAAS,IAAI,MAAM,MAAM,GAAG;AAC1D,QAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,EAAG,QAAO;AAE3C,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3D,EAAE,MAAM,qBAAqB,MAAM,UAAU;AAAA,MAC7C;AAAA,MACA,CAAC,QAAQ;AAAA,IACX;AAEA,UAAM,iBAAiB,gBAAgB,SAAS;AAChD,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE;AAClE,WAAO,MAAM,OAAO,OAAO;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,gBACb,SACA,gBACA,kBACA,aACA;AACA,QAAM,SAAS,gBAAgB,OAAO;AACtC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,SAAS,oBAAoB,mCAAe;AAAA,EACxD;AAEA,QAAM,MAAM,OAAO;AACnB,MAAI,OAAO,QAAQ,YAAa,QAAQ,WAAW,QAAQ,SAAU;AACnE,UAAM,IAAI,SAAS,4BAA4B,+DAAuB,GAAG,EAAE;AAAA,EAC7E;AAGA,MAAI,QAAQ,SAAS;AACnB,UAAM,OAAO,MAAM,UAAU,gBAAgB,cAAc,CAAC;AAC5D,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,SAAS,8BAA8B,kEAA0B;AAAA,IAC7E;AACA,UAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAC1D,UAAM,MAAM,KAAK,KAAK;AAAA,MACpB,CAAC,MACC,EAAE,QAAQ,SACV,EAAE,QAAQ,WACV,EAAE,QAAQ,UACT,MAAM,EAAE,QAAQ,MAAM;AAAA,IAC3B;AACA,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,SAAS,8BAA8B,oEAAuB;AAAA,IAC1E;AACA,UAAM,WAAW,MAAM,YAAY,SAAS,GAAG;AAC/C,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,SAAS,8BAA8B,+CAAiB;AAAA,IACpE;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS;AAEnB,YAAQ;AAAA,MACN;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,UAAU,iBAAiB,OAAO;AACxC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,SAAS,oBAAoB,2CAAuB;AAAA,EAChE;AAEA,QAAM,2BAA2B,gBAAgB,cAAc;AAC/D,QAAM,cAAc,OAAO,QAAQ,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,IAAI;AACrF,MAAI,gBAAgB,0BAA0B;AAC5C,UAAM,IAAI,SAAS,4BAA4B,oCAAqB;AAAA,EACtE;AACA,MACE,QAAQ,QAAQ,oBAChB,CAAG,QAAQ,KAA8B,SAAS,gBAAgB,GAClE;AACA,UAAM,IAAI,SAAS,8BAA8B,sCAAuB;AAAA,EAC1E;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,KAAK,IAAI,KAAK,QAAQ,MAAM,KAAM;AACvE,UAAM,IAAI,SAAS,oBAAoB,6BAAc;AAAA,EACvD;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,SAAS,wBAAwB,2BAAiB;AAAA,EAC9D;AAGA,MAAI,OAAO,QAAQ,YAAY,YAAY,QAAQ,SAAS;AAC1D,UAAM,SAAS,MAAM,cAAc,WAAW;AAC9C,QAAI,WAAW,QAAQ,SAAS;AAC9B,YAAM,IAAI,SAAS,6BAA6B,qCAAsB;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,QAAQ,IAAI;AAC5B;AAqEO,IAAM,aAAN,MAAM,WAAU;AAAA,EAYrB,YAAY,QAAyB;AAVrC,SAAQ,aAAmC;AAC3C,SAAQ,sBAA8B;AACtC,SAAQ,eAA0C;AAShD,QAAI,CAAC,OAAO,SAAU,OAAM,IAAI,SAAS,kBAAkB,mCAAe;AAC1E,QAAI,CAAC,OAAO,YAAa,OAAM,IAAI,SAAS,kBAAkB,sCAAkB;AAChF,QAAI,CAAC,OAAO,WAAY,OAAM,IAAI,SAAS,kBAAkB,qCAAiB;AAG9E,UAAM,OAAO,OAAO,WAAW,QAAQ,QAAQ,EAAE;AACjD,SAAK,SAAS,EAAE,GAAG,QAAQ,YAAY,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,gBAA+C;AAC3D,UAAM,MAAM,KAAK,IAAI;AAGrB,QACE,KAAK,cACL,MAAM,KAAK,sBAAsB,WAAU,kBAC3C;AACA,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAM,GAAG,KAAK,OAAO,UAAU;AAErC,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY;AAAA,QAChB,MAAM,WAAW,MAAM;AAAA,QACvB,WAAU;AAAA,MACZ;AAEA,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AAC1D,mBAAa,SAAS;AAEtB,UAAI,CAAC,IAAI,IAAI;AACX,gBAAQ;AAAA,UACN,2DAAuC,IAAI,MAAM;AAAA,QACnD;AACA,eAAO;AAAA,MACT;AAEA,WAAK,aAAc,MAAM,IAAI,KAAK;AAClC,WAAK,sBAAsB;AAC3B,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,sDAAkC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACpF;AAEA,aAAO,KAAK,cAAc;AAAA,IAC5B;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,wBAAyC;AACrD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,oBAAqC;AACjD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,uBAAwC;AACpD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,MAAM,WAAmC;AAC7C,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAG5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,WAAW;AACb,oBAAc,SAAS;AAAA,IACzB;AAGA,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAG1C,WAAO,SAAS,OAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAAY,WAAqC;AACrD,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAE5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,UAAW,eAAc,SAAS;AAEtC,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAE1C,WAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,eACJ,aACoB;AACpB,UAAM,MAAM,IAAI,IAAI,WAAW;AAC/B,UAAM,SAAS,IAAI;AAGnB,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAI,OAAO;AACT,YAAM,OAAO,OAAO,IAAI,mBAAmB,KAAK;AAChD,YAAM,IAAI,SAAS,wBAAwB,6BAAS,IAAI,EAAE;AAAA,IAC5D;AAEA,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,gBAAgB,OAAO,IAAI,OAAO;AAExC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,SAAS,wBAAwB,wDAA+B;AAAA,IAC5E;AAGA,UAAM,aAAa,cAAc,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,cAAc,eAAe,eAAe;AAC/C,uBAAiB,KAAK,OAAO,QAAQ;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,qBAAiB,KAAK,OAAO,QAAQ;AAGrC,UAAM,WAAW,gBAAgB,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,uBAAmB,KAAK,OAAO,QAAQ;AAGvC,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,oBAAoB;AAC3C,SAAK,IAAI,QAAQ,IAAI;AACrB,SAAK,IAAI,iBAAiB,QAAQ;AAClC,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,SAAK,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAChD,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,eAAe;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,wCAAU,GAAG;AAAA,IACnD;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AAAE,kBAAU,MAAM,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,QACC,QAAQ,qBAAgC,wCAAoB,IAAI,MAAM;AAAA,MACzE;AAAA,IACF;AAEA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAG3C,QAAI,KAAK,UAAU;AACjB,UAAI;AACF,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,KAAK,OAAO;AAAA,UACZ,KAAK,OAAO;AAAA,UACZ,KAAK;AAAA,QACP;AAAA,MACF,SAAS,KAAK;AAEZ,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAmC;AAEvC,QAAI,KAAK,aAAc,QAAO,KAAK;AAEnC,SAAK,eAAe,KAAK,gBAAgB;AACzC,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAc,kBAAsC;AAClD,UAAM,UAAU,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI,SAAS,oBAAoB,8CAAqB;AAAA,IAC9D;AAEA,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,eAAe;AACtC,SAAK,IAAI,iBAAiB,QAAQ,aAAa;AAC/C,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,eAAe;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,2DAAmB,GAAG;AAAA,IAC5D;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AAAE,kBAAU,MAAM,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AACzD,YAAM,YAAa,QAAQ,SAAoB;AAE/C,UAAI,cAAc,mBAAmB,IAAI,WAAW,KAAK;AACvD,wBAAgB,KAAK,OAAO,QAAQ;AAAA,MACtC;AACA,YAAM,IAAI;AAAA,QACR,cAAc,kBAAkB,oBAAoB;AAAA,QACnD,QAAQ,qBAAgC,yCAAqB,IAAI,MAAM;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAC3C,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAgC;AACpC,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AAEjD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,SAAS,qBAAqB,oBAAK;AAAA,IAC/C;AAGA,QAAI,KAAK,IAAI,KAAK,UAAU,YAAY;AACtC,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,UAAM,mBAAmB,MAAM,KAAK,qBAAqB;AAEzD,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,kBAAkB;AAAA,QAClC,SAAS;AAAA,UACP,eAAe,UAAU,UAAU,YAAY;AAAA,QACjD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,4EAAgB,GAAG;AAAA,IACzD;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,IAAI,WAAW,KAAK;AACtB,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM,IAAI,SAAS,qBAAqB,0BAAW;AAAA,MACrD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,0DAAkB,IAAI,MAAM;AAAA,MAC9B;AAAA,IACF;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBAAyC;AAC7C,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,UAAW,QAAO;AAEvB,QAAI,KAAK,IAAI,KAAK,UAAU,YAAY;AACtC,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAA2B;AACzB,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,QAAI,CAAC,UAAW,QAAO;AACvB,WAAO,KAAK,IAAI,IAAI,UAAU;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,gBAAyB,OAAsB;AAE1D,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,UAAM,eAAe,WAAW;AAChC,UAAM,cAAc,WAAW;AAE/B,oBAAgB,KAAK,OAAO,QAAQ;AAIpC,QAAI,gBAAgB,KAAK,OAAO,UAAU;AACxC,UAAI;AACF,cAAM,YAAY,MAAM,KAAK,cAAc;AAC3C,cAAM,YACJ,WAAW,uBACX,GAAG,KAAK,OAAO,UAAU;AAC3B,cAAM,aAAa,IAAI,gBAAgB;AAAA,UACrC,OAAO;AAAA,UACP,iBAAiB;AAAA,UACjB,WAAW,KAAK,OAAO;AAAA,QACzB,CAAC;AACD,YAAI,KAAK,OAAO,cAAc;AAC5B,qBAAW,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,QAC1D;AACA,cAAM,MAAM,WAAW;AAAA,UACrB,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,UAC/D,MAAM,WAAW,SAAS;AAAA,QAC5B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,eAAe;AAEjB,YAAM,YAAY,MAAM,KAAK,cAAc;AAC3C,YAAM,qBACJ,WAAW,wBAAwB,GAAG,KAAK,OAAO,UAAU;AAC9D,YAAM,YAAY,IAAI,IAAI,kBAAkB;AAC5C,gBAAU,aAAa,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5D,UAAI,KAAK,OAAO,aAAa;AAC3B,kBAAU,aAAa;AAAA,UACrB;AAAA,UACA,KAAK,OAAO;AAAA,QACd;AAAA,MACF;AACA,UAAI,aAAa;AACf,kBAAU,aAAa,IAAI,iBAAiB,WAAW;AAAA,MACzD;AACA,YAAM,QAAQ,cAAc;AAC5B,gBAAU,aAAa,IAAI,SAAS,KAAK;AACzC,aAAO,SAAS,OAAO,UAAU,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,eAA8C;AAClD,WAAO,KAAK,cAAc;AAAA,EAC5B;AACF;AAAA;AAhfa,WAOa,mBAAmB,IAAI,KAAK;AAAA;AAPzC,WAUa,uBAAuB;AAV1C,IAAM,YAAN;;;AJ7PP,IAAM,aAAa,cAAsC,IAAI;AA4B7D,IAAM,sBAAsB;AAC5B,IAAM,cAAc;AAEpB,SAAS,QAAQ,UAA0B;AACzC,SAAO,sBAAsB;AAC/B;AAEA,SAAS,mBAAmB,UAA2B;AACrD,MAAI,OAAO,iBAAiB,YAAa,QAAO;AAChD,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,MAAM,aAAa,QAAQ,GAAG;AACpC,MAAI,KAAK;AACP,UAAM,KAAK,SAAS,KAAK,EAAE;AAC3B,QAAI,CAAC,MAAM,EAAE,KAAK,MAAM,KAAK,aAAa;AACxC,aAAO;AAAA,IACT;AAAA,EACF;AACA,eAAa,QAAQ,KAAK,OAAO,GAAG,CAAC;AACrC,SAAO;AACT;AAEA,SAAS,mBAAmB,UAAwB;AAClD,MAAI,OAAO,iBAAiB,YAAa;AACzC,eAAa,WAAW,QAAQ,QAAQ,CAAC;AAC3C;AAMO,SAAS,YAAY;AAAA,EAC1B;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB;AACF,GAAqB;AACnB,QAAM,CAAC,MAAM,OAAO,IAAI,SAAyB,IAAI;AACrD,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,SAAS,KAAK;AAC5D,QAAM,YAAY,OAAO,IAAI,UAAU,MAAM,CAAC;AAC9C,QAAM,kBAAkB,OAA6C,IAAI;AACzE,QAAM,YAAY,OAAO,KAAK;AAE9B,QAAM,SAAS,UAAU;AAGzB,QAAM,WAAW,YAAY,YAAY;AACvC,QAAI,CAAC,OAAO,gBAAgB,GAAG;AAC7B,cAAQ,IAAI;AACZ,yBAAmB,KAAK;AACxB,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,QAAI;AACF,YAAM,IAAI,MAAM,OAAO,YAAY;AACnC,cAAQ,CAAC;AACT,yBAAmB,IAAI;AAAA,IACzB,QAAQ;AACN,cAAQ,IAAI;AACZ,yBAAmB,KAAK;AACxB,sBAAgB,OAAO,OAAO,QAAQ;AAAA,IACxC,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAGX,YAAU,MAAM;AACd,QAAI,UAAU,QAAS;AACvB,cAAU,UAAU;AAGpB,QAAI,OAAO,gBAAgB,GAAG;AAC5B,eAAS;AAAA,IACX,OAAO;AACL,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAGrB,YAAU,MAAM;AACd,QAAI,SAAS;AAEb,UAAM,sBAAsB,MAAM;AAChC,UAAI,CAAC,OAAQ;AAGb,UAAI,gBAAgB,SAAS;AAC3B,qBAAa,gBAAgB,OAAO;AACpC,wBAAgB,UAAU;AAAA,MAC5B;AAEA,YAAM,YAAY,aAAa,OAAO,OAAO,QAAQ;AACrD,UAAI,CAAC,UAAW;AAGhB,YAAM,gBAAgB,UAAU,aAAa,KAAK,IAAI,KAAK;AAE3D,UAAI,gBAAgB,GAAG;AAErB,YAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,EAAG;AACjD,eACG,aAAa,EACb,KAAK,CAAC,OAAO;AACZ,6BAAmB,GAAG,YAAY;AAClC,mBAAS;AAAA,QACX,CAAC,EACA,MAAM,MAAM;AAEX,qBAAW,MAAM,SAAS,GAAG,GAAG;AAAA,QAClC,CAAC,EACA,QAAQ,MAAM,mBAAmB,OAAO,OAAO,QAAQ,CAAC;AAC3D;AAAA,MACF;AAEA,UAAI,gBAAgB,kBAAkB;AAEpC,YAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,EAAG;AACjD,eACG,aAAa,EACb,KAAK,CAAC,OAAO;AACZ,6BAAmB,GAAG,YAAY;AAClC,mBAAS;AAAA,QACX,CAAC,EACA,MAAM,MAAM;AACX,qBAAW,MAAM,SAAS,GAAG,GAAG;AAAA,QAClC,CAAC,EACA,QAAQ,MAAM,mBAAmB,OAAO,OAAO,QAAQ,CAAC;AAC3D;AAAA,MACF;AAGA,YAAM,WAAW,eAAe,oBAAoB;AAEpD,sBAAgB,UAAU,WAAW,MAAM;AACzC,cAAM,KAAK,aAAa,OAAO,OAAO,QAAQ;AAC9C,YAAI,CAAC,GAAI;AAET,cAAM,WAAW,GAAG,aAAa,KAAK,IAAI,KAAK;AAC/C,YAAI,WAAW,kBAAkB;AAC/B,cAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,GAAG;AAE/C;AAAA,UACF;AACA,iBACG,aAAa,EACb,KAAK,CAAC,UAAU;AACf,+BAAmB,MAAM,YAAY;AACrC,qBAAS;AAAA,UACX,CAAC,EACA,MAAM,MAAM;AACX,uBAAW,MAAM,SAAS,GAAG,GAAG;AAAA,UAClC,CAAC,EACA,QAAQ,MAAM,mBAAmB,OAAO,OAAO,QAAQ,CAAC;AAE3D,8BAAoB;AAAA,QACtB;AAAA,MACF,GAAG,KAAK,IAAI,SAAS,GAAI,CAAC;AAAA,IAC5B;AAEA,wBAAoB;AAEpB,WAAO,MAAM;AACX,eAAS;AACT,UAAI,gBAAgB,SAAS;AAC3B,qBAAa,gBAAgB,OAAO;AACpC,wBAAgB,UAAU;AAAA,MAC5B;AAAA,IACF;AAAA,EACF,GAAG,CAAC,QAAQ,UAAU,kBAAkB,gBAAgB,CAAC;AAGzD,YAAU,MAAM;AACd,UAAM,sBAAsB,CAAC,MAAoB;AAC/C,UACE,EAAE,OACF,EAAE,IAAI,WAAW,cAAc,KAC/B,CAAC,EAAE,IAAI,WAAW,mBAAmB,GACrC;AACA,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,iBAAiB,WAAW,mBAAmB;AACtD,WAAO,MAAM,OAAO,oBAAoB,WAAW,mBAAmB;AAAA,EACxE,GAAG,CAAC,QAAQ,CAAC;AAGb,QAAM,QAAQ;AAAA,IACZ,OAAO,cAAuB;AAC5B,YAAM,OAAO,MAAM,SAAS;AAAA,IAC9B;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,SAAS;AAAA,IACb,OAAO,gBAAyB,UAAU;AACxC,YAAM,OAAO,OAAO,aAAa;AACjC,cAAQ,IAAI;AACZ,yBAAmB,KAAK;AAAA,IAC1B;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,cAAc,YAAY,YAAY;AAC1C,UAAM,SAAS;AAAA,EACjB,GAAG,CAAC,QAAQ,CAAC;AAGb,QAAM,iBAAiB,YAAY,YAAoC;AACrE,WAAO,OAAO,eAAe;AAAA,EAC/B,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,QAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,SAAO,MAAM,cAAc,WAAW,UAAU,EAAE,MAAM,GAAG,QAAQ;AACrE;AAoBO,SAAS,SAA0B;AACxC,QAAM,MAAM,WAAW,UAAU;AACjC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,oEAAiC;AAAA,EACnD;AACA,SAAO;AACT;;;AKvUA,OAAOA,UAAS,aAAAC,YAAW,UAAAC,eAAkC;AA8BtD,SAAS,YAAY;AAAA,EAC1B;AAAA,EACA;AAAA,EACA,YAAY;AACd,GAAqB;AACnB,QAAM,EAAE,iBAAiB,WAAW,MAAM,IAAI,OAAO;AACrD,QAAM,oBAAoBC,QAAO,KAAK;AAEtC,EAAAC,WAAU,MAAM;AACd,QAAI,CAAC,aAAa,CAAC,mBAAmB,aAAa,CAAC,kBAAkB,SAAS;AAC7E,wBAAkB,UAAU;AAC5B,YAAM,cAAc,OAAO,SAAS,WAAW,OAAO,SAAS;AAC/D,YAAM,WAAW;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,WAAW,iBAAiB,WAAW,KAAK,CAAC;AAEjD,MAAI,WAAW;AACb,WACE,YAAYC,OAAM,cAAc,OAAO,MAAM,qDAAa;AAAA,EAE9D;AAEA,MAAI,CAAC,iBAAiB;AACpB,QAAI,SAAU,QAAOA,OAAM,cAAcA,OAAM,UAAU,MAAM,QAAQ;AACvE,WAAOA,OAAM,cAAc,OAAO,MAAM,0BAAM;AAAA,EAChD;AAEA,SAAOA,OAAM,cAAcA,OAAM,UAAU,MAAM,QAAQ;AAC3D;AAeO,SAAS,SACd,WACkB;AAClB,QAAM,cACJ,UAAU,eAAe,UAAU,QAAQ;AAE7C,WAAS,iBAAiB,OAAU;AAClC,WAAOA,OAAM;AAAA,MACX;AAAA,MACA;AAAA,MACAA,OAAM,cAAc,WAAW,KAAK;AAAA,IACtC;AAAA,EACF;AAEA,mBAAiB,cAAc,YAAY,WAAW;AACtD,SAAO;AACT;;;ACjFA,OAAOC,UAAS,aAAAC,YAAW,YAAAC,iBAAgB;AAKpC,SAAS,eAAe;AAC7B,QAAM,EAAE,QAAQ,YAAY,IAAI,OAAO;AACvC,QAAM,CAAC,OAAO,QAAQ,IAAIC,UAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAIA,UAAS,IAAI;AAEjD,EAAAC,WAAU,MAAM;AACd,QAAI,YAAY;AAEhB,mBAAe,iBAAiB;AAC9B,UAAI;AACF,cAAM,OAAO,eAAe,OAAO,SAAS,IAAI;AAEhD,YAAI,UAAW;AAGf,cAAM,YAAY;AAGlB,cAAM,YAAY,aAAa;AAC/B,wBAAgB;AAChB,eAAO,SAAS,OAAO,aAAa;AAAA,MACtC,SAAS,KAAK;AACZ,YAAI,UAAW;AACf,YAAI,eAAe,UAAU;AAE3B,mBAAS,IAAI,eAAe,qBAAW,IAAI,IAAI,GAAG;AAAA,QACpD,WAAW,eAAe,aAAa,IAAI,QAAQ,SAAS,OAAO,GAAG;AAEpE,mBAAS,4FAAiB;AAAA,QAC5B,WAAW,eAAe,OAAO;AAC/B,mBAAS,qDAAa,IAAI,OAAO,EAAE;AAAA,QACrC,OAAO;AACL,mBAAS,0EAAc;AAAA,QACzB;AACA,sBAAc,KAAK;AAAA,MACrB;AAAA,IACF;AAEA,mBAAe;AAEf,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAM;AAAA,EACnC,GAAG,CAAC,QAAQ,WAAW,CAAC;AAExB,MAAI,OAAO;AACT,WAAOC,OAAM;AAAA,MACX;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,SAAS;AAAA,UACT,eAAe;AAAA,UACf,YAAY;AAAA,UACZ,gBAAgB;AAAA,UAChB,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF;AAAA,MACAA,OAAM;AAAA,QACJ;AAAA,QACA,EAAE,OAAO,EAAE,OAAO,WAAW,cAAc,OAAO,EAAE;AAAA,QACpD;AAAA,MACF;AAAA,MACAA,OAAM;AAAA,QACJ;AAAA,QACA,EAAE,MAAM,KAAK,OAAO,EAAE,OAAO,WAAW,gBAAgB,YAAY,EAAE;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAAY;AACd,WAAOA,OAAM;AAAA,MACX;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,gBAAgB;AAAA,UAChB,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF;AAAA,MACAA,OAAM,cAAc,KAAK,MAAM,qDAAa;AAAA,IAC9C;AAAA,EACF;AAEA,SAAO;AACT;","names":["React","useEffect","useRef","useRef","useEffect","React","React","useEffect","useState","useState","useEffect","React"]}

package/package.json ADDED Viewed

@@ -0,0 +1,62 @@
+{
+  "name": "@nihplod/sso-sdk",
+  "version": "1.0.0",
+  "description": "NIHPLOD SSO 子项目接入 SDK — OAuth 2.0 授权码 + PKCE 客户端封装",
+  "license": "UNLICENSED",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.mjs",
+      "require": "./dist/react/index.js"
+    },
+    "./next": {
+      "types": "./dist/next/index.d.ts",
+      "import": "./dist/next/index.mjs",
+      "require": "./dist/next/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "clean": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\"",
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "next": ">=14",
+    "react": ">=18.0.0"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/react": "^19",
+    "tsup": "^8",
+    "typescript": "^5"
+  },
+  "keywords": [
+    "sso",
+    "oauth2",
+    "pkce",
+    "oidc",
+    "single-sign-on",
+    "react"
+  ]
+}