@okta/okta-auth-js 7.14.0 → 8.0.0

package/cjs/oidc/mixin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["mixinOAuth","Base","TransactionManagerConstructor","WithOriginalUri","provideOriginalUri","OktaAuthOAuth","constructor","args","transactionManager","Object","assign","storageManager","options","pkce","DEFAULT_CODE_CHALLENGE_METHOD","PKCE","generateVerifier","computeChallenge","_pending","handleLogin","_tokenQueue","PromiseQueue","token","createTokenAPI","tokenManager","TokenManager","endpoints","createEndpoints","clearStorage","clear","isAuthenticated","autoRenew","autoRemove","getOptions","shouldRenew","onExpiredToken","shouldRemove","accessToken","getTokensSync","hasExpired","undefined","renew","remove","idToken","signInWithRedirect","opts","originalUri","additionalParams","setOriginalUri","params","scopes","getWithRedirect","getUser","getUserInfo","getIdToken","getAccessToken","getRefreshToken","refreshToken","getOrRenewAccessToken","key","getStorageKeyByType","err","emitter","emit","storeTokensFromRedirect","tokens","responseType","parseFromUrl","setTokens","isLoginRedirect","isPKCE","hasResponseType","isAuthorizationCodeFlow","invokeApiMethod","getTokens","httpRequest","revokeAccessToken","accessTokenKey","dpop","clearDPoPKeyPairAfterRevoke","Promise","resolve","revoke","revokeRefreshToken","refreshTokenKey","getSignOutRedirectUrl","postLogoutRedirectUri","state","logoutUrl","getOAuthUrls","idTokenHint","logoutUri","encodeURIComponent","signOut","defaultUri","window","location","origin","currentUri","href","dpopPairId","clearDPoPKeyPair","sessionClosed","closeSession","redirectUri","URL","searchParams","append","clearTokensBeforeRedirect","addPendingRemoveFlags","getDPoPAuthorizationHeaders","AuthSdkError","keyPair","findKeyPair","proof","generateDPoPProof","Authorization","Dpop","clearDPoPStorage","clearAll","clearAllDPoPKeyPairs","parseUseDPoPNonceError","headers","wwwAuth","WWWAuthError","getWWWAuthenticateHeader","wwwErr","parseHeader","isDPoPNonceError","nonce","isFunction","get","crypto"],"sources":["../../../../lib/oidc/mixin/index.ts"],"sourcesContent":["import { httpRequest, RequestOptions } from '../../http';\nimport { OktaAuthConstructor } from '../../base/types';\nimport { \n  PromiseQueue,\n  isFunction\n} from '../../util';\nimport { CryptoAPI } from '../../crypto/types';\nimport * as crypto from '../../crypto';\nimport {\n  AccessToken,\n  CustomUserClaims,\n  IDToken,\n  IsAuthenticatedOptions,\n  OAuthResponseType,\n  OAuthStorageManagerInterface,\n  OAuthTransactionMeta,\n  OktaAuthOAuthInterface,\n  OktaAuthOAuthOptions,\n  PkceAPI,\n  PKCETransactionMeta,\n  RefreshToken,\n  SigninWithRedirectOptions,\n  SignoutOptions,\n  SignoutRedirectUrlOptions,\n  TokenAPI,\n  TransactionManagerInterface,\n  TransactionManagerConstructor,\n  UserClaims,\n  Endpoints,\n  DPoPRequest,\n  DPoPHeaders\n} from '../types';\nimport PKCE from '../util/pkce';\nimport { createEndpoints, createTokenAPI } from '../factory/api';\nimport { TokenManager } from '../TokenManager';\nimport { getOAuthUrls, isLoginRedirect, hasResponseType } from '../util';\nimport { \n  generateDPoPProof,\n  clearDPoPKeyPair,\n  clearAllDPoPKeyPairs,\n  clearDPoPKeyPairAfterRevoke,\n  findKeyPair,\n  isDPoPNonceError\n} from '../dpop';\nimport { AuthSdkError, WWWAuthError } from '../../errors';\n\nimport { OktaAuthSessionInterface } from '../../session/types';\nimport { provideOriginalUri } from './node';\nexport function mixinOAuth\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TM extends TransactionManagerInterface = TransactionManagerInterface,\n  TBase extends OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n    = OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n>\n(\n  Base: TBase,\n  TransactionManagerConstructor: TransactionManagerConstructor<TM>,\n): TBase & OktaAuthConstructor<OktaAuthOAuthInterface<M, S, O, TM>>\n{\n  const WithOriginalUri = provideOriginalUri(Base);\n  return class OktaAuthOAuth extends WithOriginalUri\n  implements OktaAuthOAuthInterface<M, S, O, TM>\n  {\n    static crypto: CryptoAPI = crypto;\n    token: TokenAPI;\n    tokenManager: TokenManager;\n    transactionManager: TM;\n    pkce: PkceAPI;\n    endpoints: Endpoints;\n\n    _pending: { handleLogin: boolean };\n    _tokenQueue: PromiseQueue;\n    \n    constructor(...args: any[]) {\n      super(...args);\n\n      this.transactionManager = new TransactionManagerConstructor(Object.assign({\n        storageManager: this.storageManager,\n      }, this.options.transactionManager));\n  \n      this.pkce = {\n        DEFAULT_CODE_CHALLENGE_METHOD: PKCE.DEFAULT_CODE_CHALLENGE_METHOD,\n        generateVerifier: PKCE.generateVerifier,\n        computeChallenge: PKCE.computeChallenge\n      };\n  \n      this._pending = { handleLogin: false };\n\n      this._tokenQueue = new PromiseQueue();\n\n      this.token = createTokenAPI(this, this._tokenQueue);\n\n      // TokenManager\n      this.tokenManager = new TokenManager(this, this.options.tokenManager);\n\n      this.endpoints = createEndpoints(this);\n    }\n\n    // inherited from subclass\n    clearStorage(): void {\n      super.clearStorage();\n      \n      // Clear all local tokens\n      this.tokenManager.clear();\n    }\n\n    // Returns true if both accessToken and idToken are not expired\n    // If `autoRenew` option is set, will attempt to renew expired tokens before returning.\n    // eslint-disable-next-line complexity\n    async isAuthenticated(options: IsAuthenticatedOptions = {}): Promise<boolean> {\n      // TODO: remove dependency on tokenManager options in next major version - OKTA-473815\n      const { autoRenew, autoRemove } = this.tokenManager.getOptions();\n\n      const shouldRenew = options.onExpiredToken ? options.onExpiredToken === 'renew' : autoRenew;\n      const shouldRemove = options.onExpiredToken ? options.onExpiredToken === 'remove' : autoRemove;\n\n      let { accessToken } = this.tokenManager.getTokensSync();\n      if (accessToken && this.tokenManager.hasExpired(accessToken)) {\n        accessToken = undefined;\n        if (shouldRenew) {\n          try {\n            accessToken = await this.tokenManager.renew('accessToken') as AccessToken;\n          } catch {\n            // Renew errors will emit an \"error\" event \n          }\n        } else if (shouldRemove) {\n          this.tokenManager.remove('accessToken');\n        }\n      }\n\n      let { idToken } = this.tokenManager.getTokensSync();\n      if (idToken && this.tokenManager.hasExpired(idToken)) {\n        idToken = undefined;\n        if (shouldRenew) {\n          try {\n            idToken = await this.tokenManager.renew('idToken') as IDToken;\n          } catch {\n            // Renew errors will emit an \"error\" event \n          }\n        } else if (shouldRemove) {\n          this.tokenManager.remove('idToken');\n        }\n      }\n\n      return !!(accessToken && idToken);\n    }\n\n\n    async signInWithRedirect(opts: SigninWithRedirectOptions = {}) {\n      const { originalUri, ...additionalParams } = opts;\n      if(this._pending.handleLogin) { \n        // Don't trigger second round\n        return;\n      }\n\n      this._pending.handleLogin = true;\n      try {\n        // Trigger default signIn redirect flow\n        if (originalUri) {\n          this.setOriginalUri(originalUri);\n        }\n        const params = Object.assign({\n          // TODO: remove this line when default scopes are changed OKTA-343294\n          scopes: this.options.scopes || ['openid', 'email', 'profile']\n        }, additionalParams);\n        await this.token.getWithRedirect(params);\n      } finally {\n        this._pending.handleLogin = false;\n      }\n    }\n\n    async getUser<T extends CustomUserClaims = CustomUserClaims>(): Promise<UserClaims<T>> {\n      const { idToken, accessToken } = this.tokenManager.getTokensSync();\n      return this.token.getUserInfo(accessToken, idToken);\n    }\n  \n    getIdToken(): string | undefined {\n      const { idToken } = this.tokenManager.getTokensSync();\n      return idToken ? idToken.idToken : undefined;\n    }\n  \n    getAccessToken(): string | undefined {\n      const { accessToken } = this.tokenManager.getTokensSync();\n      return accessToken ? accessToken.accessToken : undefined;\n    }\n  \n    getRefreshToken(): string | undefined {\n      const { refreshToken } = this.tokenManager.getTokensSync();\n      return refreshToken ? refreshToken.refreshToken : undefined;\n    }\n\n    async getOrRenewAccessToken(): Promise<string | null> {\n      const { accessToken } = this.tokenManager.getTokensSync();\n      if (accessToken && !this.tokenManager.hasExpired(accessToken)) {\n        return accessToken.accessToken;\n      }\n      try {\n        const key = this.tokenManager.getStorageKeyByType('accessToken');\n        const token = await this.tokenManager.renew(key ?? 'accessToken');\n        return (token as AccessToken)?.accessToken ?? null;\n      }\n      catch (err) {\n        this.emitter.emit('error', err);\n        return null;\n      }\n    }\n  \n    /**\n     * Store parsed tokens from redirect url\n     */\n    async storeTokensFromRedirect(): Promise<void> {\n      const { tokens, responseType } = await this.token.parseFromUrl();\n      if (responseType !== 'none') {\n        this.tokenManager.setTokens(tokens);\n      }\n    }\n  \n    isLoginRedirect(): boolean {\n      return isLoginRedirect(this);\n    }\n\n    isPKCE(): boolean {\n      return !!this.options.pkce;\n    }\n\n    hasResponseType(responseType: OAuthResponseType): boolean {\n      return hasResponseType(responseType, this.options);\n    }\n  \n    isAuthorizationCodeFlow(): boolean {\n      return this.hasResponseType('code');\n    }\n\n    // Escape hatch method to make arbitrary OKTA API call\n    async invokeApiMethod(options: RequestOptions): Promise<unknown> {\n      if (!options.accessToken) {\n        const accessToken = (await this.tokenManager.getTokens()).accessToken as AccessToken;\n        options.accessToken = accessToken?.accessToken;\n      }\n      return httpRequest(this, options);\n    }\n    \n    // Revokes the access token for the application session\n    async revokeAccessToken(accessToken?: AccessToken): Promise<unknown> {\n      if (!accessToken) {\n        const tokens = await this.tokenManager.getTokens();\n        accessToken = tokens.accessToken;\n        const accessTokenKey = this.tokenManager.getStorageKeyByType('accessToken');\n        this.tokenManager.remove(accessTokenKey);\n\n        if (this.options.dpop) {\n          await clearDPoPKeyPairAfterRevoke('access', tokens);\n        }\n      }\n      // Access token may have been removed. In this case, we will silently succeed.\n      if (!accessToken) {\n        return Promise.resolve(null);\n      }\n      return this.token.revoke(accessToken);\n    }\n\n    // Revokes the refresh token for the application session\n    async revokeRefreshToken(refreshToken?: RefreshToken): Promise<unknown> {\n      if (!refreshToken) {\n        const tokens = await this.tokenManager.getTokens();\n        refreshToken = tokens.refreshToken;\n        const refreshTokenKey = this.tokenManager.getStorageKeyByType('refreshToken');\n        this.tokenManager.remove(refreshTokenKey);\n\n        if (this.options.dpop) {\n          await clearDPoPKeyPairAfterRevoke('refresh', tokens);\n        }\n      }\n      // Refresh token may have been removed. In this case, we will silently succeed.\n      if (!refreshToken) {\n        return Promise.resolve(null);\n      }\n      return this.token.revoke(refreshToken);\n    }\n\n    getSignOutRedirectUrl(options: SignoutRedirectUrlOptions = {}) {\n      let {\n        idToken,\n        postLogoutRedirectUri,\n        state,\n      } = options;\n      if (!idToken) {\n        idToken = this.tokenManager.getTokensSync().idToken as IDToken;\n      }\n      if (!idToken) {\n        return '';\n      }\n      if (postLogoutRedirectUri === undefined) {\n        postLogoutRedirectUri = this.options.postLogoutRedirectUri;\n      }\n\n      const logoutUrl = getOAuthUrls(this).logoutUrl;\n      const idTokenHint = idToken.idToken; // a string\n      let logoutUri = logoutUrl + '?id_token_hint=' + encodeURIComponent(idTokenHint);\n      if (postLogoutRedirectUri) {\n        logoutUri += '&post_logout_redirect_uri=' + encodeURIComponent(postLogoutRedirectUri);\n      } \n      // State allows option parameters to be passed to logout redirect uri\n      if (state) {\n        logoutUri += '&state=' + encodeURIComponent(state);\n      }\n\n      return logoutUri;\n    }\n\n    // Revokes refreshToken or accessToken, clears all local tokens, then redirects to Okta to end the SSO session.\n    // eslint-disable-next-line complexity, max-statements\n    async signOut(options?: SignoutOptions): Promise<boolean> {\n      options = Object.assign({}, options);\n    \n      // postLogoutRedirectUri must be whitelisted in Okta Admin UI\n      const defaultUri = window.location.origin;\n      const currentUri = window.location.href;\n      // Fix for issue/1410 - allow for no postLogoutRedirectUri to be passed, resulting in /logout default behavior\n      //    \"If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the\n      //    Okta sign-in page or the post_logout_redirect_uri (if specified).\"\n      // - https://developer.okta.com/docs/reference/api/oidc/#logout\n      const postLogoutRedirectUri = options.postLogoutRedirectUri === null ? null :\n        (options.postLogoutRedirectUri\n        || this.options.postLogoutRedirectUri\n        || defaultUri);\n      const state = options?.state;\n      \n    \n      let accessToken = options.accessToken;\n      let refreshToken = options.refreshToken;\n      const revokeAccessToken = options.revokeAccessToken !== false;\n      const revokeRefreshToken = options.revokeRefreshToken !== false;\n    \n      if (revokeRefreshToken && typeof refreshToken === 'undefined') {\n        refreshToken = this.tokenManager.getTokensSync().refreshToken as RefreshToken;\n      }\n\n      if (revokeAccessToken && typeof accessToken === 'undefined') {\n        accessToken = this.tokenManager.getTokensSync().accessToken as AccessToken;\n      }\n    \n      if (!options.idToken) {\n        options.idToken = this.tokenManager.getTokensSync().idToken as IDToken;\n      }\n\n      if (revokeRefreshToken && refreshToken) {\n        await this.revokeRefreshToken(refreshToken);\n      }\n\n      if (revokeAccessToken && accessToken) {\n        await this.revokeAccessToken(accessToken);\n      }\n\n      const dpopPairId = accessToken?.dpopPairId ?? refreshToken?.dpopPairId;\n      if (this.options.dpop && dpopPairId) {\n        await clearDPoPKeyPair(dpopPairId);\n      }\n\n      const logoutUri = this.getSignOutRedirectUrl({ ...options, postLogoutRedirectUri });\n      // No logoutUri? This can happen if the storage was cleared.\n      // Fallback to XHR signOut, then simulate a redirect to the post logout uri\n      if (!logoutUri) {\n        // local tokens are cleared once session is closed\n        const sessionClosed = await this.closeSession();   // can throw if the user cannot be signed out\n        const redirectUri = new URL(postLogoutRedirectUri || defaultUri); // during fallback, redirectUri cannot be null\n        if (state) {\n          redirectUri.searchParams.append('state', state);\n        }\n        if (postLogoutRedirectUri === currentUri) {\n          // window.location.reload(); // force a hard reload if URI is not changing\n          window.location.href = redirectUri.href;\n        } else {\n          window.location.assign(redirectUri.href);\n        }\n        return sessionClosed;\n      } else {\n        if (options.clearTokensBeforeRedirect) {\n          // Clear all local tokens\n          this.tokenManager.clear();\n        } else {\n          this.tokenManager.addPendingRemoveFlags();\n        }\n        // Flow ends with logout redirect\n        window.location.assign(logoutUri);\n        return true;\n      }\n    }\n\n    async getDPoPAuthorizationHeaders (params: DPoPRequest): Promise<DPoPHeaders> {\n      if (!this.options.dpop) {\n        throw new AuthSdkError('DPoP is not configured for this client instance');\n      }\n\n      let { accessToken } = params;\n      if (!accessToken) {\n        accessToken = (this.tokenManager.getTokensSync()).accessToken;\n      }\n\n      if (!accessToken) {\n        throw new AuthSdkError('AccessToken is required to generate a DPoP Proof');\n      }\n\n      const keyPair = await findKeyPair(accessToken?.dpopPairId);\n      const proof = await generateDPoPProof({...params, keyPair, accessToken: accessToken.accessToken});\n      return {\n        Authorization: `DPoP ${accessToken.accessToken}`,\n        Dpop: proof\n      };\n    }\n\n    async clearDPoPStorage (clearAll=false): Promise<void> {\n      if (clearAll) {\n        return clearAllDPoPKeyPairs();\n      }\n\n      const tokens = await this.tokenManager.getTokens();\n      const keyPair = tokens.accessToken?.dpopPairId || tokens.refreshToken?.dpopPairId;\n\n      if (keyPair) {\n        await clearDPoPKeyPair(keyPair);\n      }\n    }\n\n    parseUseDPoPNonceError (headers: HeadersInit): string | null {\n      const wwwAuth = WWWAuthError.getWWWAuthenticateHeader(headers);\n      const wwwErr = WWWAuthError.parseHeader(wwwAuth ?? '');\n      if (isDPoPNonceError(wwwErr)) {\n        let nonce: string | null = null;\n        if (isFunction((headers as Headers)?.get)) {\n          nonce = (headers as Headers).get('DPoP-Nonce');\n        }\n        nonce = nonce ?? headers['dpop-nonce'] ?? headers['DPoP-Nonce'];\n        return nonce;\n      }\n\n      return null;\n    }\n  };\n\n}\n"],"mappings":";;;;;AAAA;AAEA;AAKA;AAyBA;AACA;AACA;AACA;AACA;AAQA;AAGA;AAA4C;AAAA;AACrC,SAASA,UAAU,CAUxBC,IAAW,EACXC,6BAAgE,EAElE;EAAA;EACE,MAAMC,eAAe,GAAG,IAAAC,wBAAkB,EAACH,IAAI,CAAC;EAChD,gBAAO,MAAMI,aAAa,SAASF,eAAe,CAElD;IAWEG,WAAW,CAAC,GAAGC,IAAW,EAAE;MAC1B,KAAK,CAAC,GAAGA,IAAI,CAAC;MAEd,IAAI,CAACC,kBAAkB,GAAG,IAAIN,6BAA6B,CAACO,MAAM,CAACC,MAAM,CAAC;QACxEC,cAAc,EAAE,IAAI,CAACA;MACvB,CAAC,EAAE,IAAI,CAACC,OAAO,CAACJ,kBAAkB,CAAC,CAAC;MAEpC,IAAI,CAACK,IAAI,GAAG;QACVC,6BAA6B,EAAEC,aAAI,CAACD,6BAA6B;QACjEE,gBAAgB,EAAED,aAAI,CAACC,gBAAgB;QACvCC,gBAAgB,EAAEF,aAAI,CAACE;MACzB,CAAC;MAED,IAAI,CAACC,QAAQ,GAAG;QAAEC,WAAW,EAAE;MAAM,CAAC;MAEtC,IAAI,CAACC,WAAW,GAAG,IAAIC,kBAAY,EAAE;MAErC,IAAI,CAACC,KAAK,GAAG,IAAAC,mBAAc,EAAC,IAAI,EAAE,IAAI,CAACH,WAAW,CAAC;;MAEnD;MACA,IAAI,CAACI,YAAY,GAAG,IAAIC,0BAAY,CAAC,IAAI,EAAE,IAAI,CAACb,OAAO,CAACY,YAAY,CAAC;MAErE,IAAI,CAACE,SAAS,GAAG,IAAAC,oBAAe,EAAC,IAAI,CAAC;IACxC;;IAEA;IACAC,YAAY,GAAS;MACnB,KAAK,CAACA,YAAY,EAAE;;MAEpB;MACA,IAAI,CAACJ,YAAY,CAACK,KAAK,EAAE;IAC3B;;IAEA;IACA;IACA;IACA,MAAMC,eAAe,CAAClB,OAA+B,GAAG,CAAC,CAAC,EAAoB;MAC5E;MACA,MAAM;QAAEmB,SAAS;QAAEC;MAAW,CAAC,GAAG,IAAI,CAACR,YAAY,CAACS,UAAU,EAAE;MAEhE,MAAMC,WAAW,GAAGtB,OAAO,CAACuB,cAAc,GAAGvB,OAAO,CAACuB,cAAc,KAAK,OAAO,GAAGJ,SAAS;MAC3F,MAAMK,YAAY,GAAGxB,OAAO,CAACuB,cAAc,GAAGvB,OAAO,CAACuB,cAAc,KAAK,QAAQ,GAAGH,UAAU;MAE9F,IAAI;QAAEK;MAAY,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,EAAE;MACvD,IAAID,WAAW,IAAI,IAAI,CAACb,YAAY,CAACe,UAAU,CAACF,WAAW,CAAC,EAAE;QAC5DA,WAAW,GAAGG,SAAS;QACvB,IAAIN,WAAW,EAAE;UACf,IAAI;YACFG,WAAW,GAAG,MAAM,IAAI,CAACb,YAAY,CAACiB,KAAK,CAAC,aAAa,CAAgB;UAC3E,CAAC,CAAC,MAAM;YACN;UACF;QACF,CAAC,MAAM,IAAIL,YAAY,EAAE;UACvB,IAAI,CAACZ,YAAY,CAACkB,MAAM,CAAC,aAAa,CAAC;QACzC;MACF;MAEA,IAAI;QAAEC;MAAQ,CAAC,GAAG,IAAI,CAACnB,YAAY,CAACc,aAAa,EAAE;MACnD,IAAIK,OAAO,IAAI,IAAI,CAACnB,YAAY,CAACe,UAAU,CAACI,OAAO,CAAC,EAAE;QACpDA,OAAO,GAAGH,SAAS;QACnB,IAAIN,WAAW,EAAE;UACf,IAAI;YACFS,OAAO,GAAG,MAAM,IAAI,CAACnB,YAAY,CAACiB,KAAK,CAAC,SAAS,CAAY;UAC/D,CAAC,CAAC,MAAM;YACN;UACF;QACF,CAAC,MAAM,IAAIL,YAAY,EAAE;UACvB,IAAI,CAACZ,YAAY,CAACkB,MAAM,CAAC,SAAS,CAAC;QACrC;MACF;MAEA,OAAO,CAAC,EAAEL,WAAW,IAAIM,OAAO,CAAC;IACnC;IAGA,MAAMC,kBAAkB,CAACC,IAA+B,GAAG,CAAC,CAAC,EAAE;MAC7D,MAAM;QAAEC,WAAW;QAAE,GAAGC;MAAiB,CAAC,GAAGF,IAAI;MACjD,IAAG,IAAI,CAAC3B,QAAQ,CAACC,WAAW,EAAE;QAC5B;QACA;MACF;MAEA,IAAI,CAACD,QAAQ,CAACC,WAAW,GAAG,IAAI;MAChC,IAAI;QACF;QACA,IAAI2B,WAAW,EAAE;UACf,IAAI,CAACE,cAAc,CAACF,WAAW,CAAC;QAClC;QACA,MAAMG,MAAM,GAAGxC,MAAM,CAACC,MAAM,CAAC;UAC3B;UACAwC,MAAM,EAAE,IAAI,CAACtC,OAAO,CAACsC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS;QAC9D,CAAC,EAAEH,gBAAgB,CAAC;QACpB,MAAM,IAAI,CAACzB,KAAK,CAAC6B,eAAe,CAACF,MAAM,CAAC;MAC1C,CAAC,SAAS;QACR,IAAI,CAAC/B,QAAQ,CAACC,WAAW,GAAG,KAAK;MACnC;IACF;IAEA,MAAMiC,OAAO,GAA0E;MACrF,MAAM;QAAET,OAAO;QAAEN;MAAY,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,EAAE;MAClE,OAAO,IAAI,CAAChB,KAAK,CAAC+B,WAAW,CAAChB,WAAW,EAAEM,OAAO,CAAC;IACrD;IAEAW,UAAU,GAAuB;MAC/B,MAAM;QAAEX;MAAQ,CAAC,GAAG,IAAI,CAACnB,YAAY,CAACc,aAAa,EAAE;MACrD,OAAOK,OAAO,GAAGA,OAAO,CAACA,OAAO,GAAGH,SAAS;IAC9C;IAEAe,cAAc,GAAuB;MACnC,MAAM;QAAElB;MAAY,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,EAAE;MACzD,OAAOD,WAAW,GAAGA,WAAW,CAACA,WAAW,GAAGG,SAAS;IAC1D;IAEAgB,eAAe,GAAuB;MACpC,MAAM;QAAEC;MAAa,CAAC,GAAG,IAAI,CAACjC,YAAY,CAACc,aAAa,EAAE;MAC1D,OAAOmB,YAAY,GAAGA,YAAY,CAACA,YAAY,GAAGjB,SAAS;IAC7D;IAEA,MAAMkB,qBAAqB,GAA2B;MACpD,MAAM;QAAErB;MAAY,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,EAAE;MACzD,IAAID,WAAW,IAAI,CAAC,IAAI,CAACb,YAAY,CAACe,UAAU,CAACF,WAAW,CAAC,EAAE;QAC7D,OAAOA,WAAW,CAACA,WAAW;MAChC;MACA,IAAI;QACF,MAAMsB,GAAG,GAAG,IAAI,CAACnC,YAAY,CAACoC,mBAAmB,CAAC,aAAa,CAAC;QAChE,MAAMtC,KAAK,GAAG,MAAM,IAAI,CAACE,YAAY,CAACiB,KAAK,CAACkB,GAAG,IAAI,aAAa,CAAC;QACjE,OAAQrC,KAAK,EAAkBe,WAAW,IAAI,IAAI;MACpD,CAAC,CACD,OAAOwB,GAAG,EAAE;QACV,IAAI,CAACC,OAAO,CAACC,IAAI,CAAC,OAAO,EAAEF,GAAG,CAAC;QAC/B,OAAO,IAAI;MACb;IACF;;IAEA;AACJ;AACA;IACI,MAAMG,uBAAuB,GAAkB;MAC7C,MAAM;QAAEC,MAAM;QAAEC;MAAa,CAAC,GAAG,MAAM,IAAI,CAAC5C,KAAK,CAAC6C,YAAY,EAAE;MAChE,IAAID,YAAY,KAAK,MAAM,EAAE;QAC3B,IAAI,CAAC1C,YAAY,CAAC4C,SAAS,CAACH,MAAM,CAAC;MACrC;IACF;IAEAI,eAAe,GAAY;MACzB,OAAO,IAAAA,sBAAe,EAAC,IAAI,CAAC;IAC9B;IAEAC,MAAM,GAAY;MAChB,OAAO,CAAC,CAAC,IAAI,CAAC1D,OAAO,CAACC,IAAI;IAC5B;IAEA0D,eAAe,CAACL,YAA+B,EAAW;MACxD,OAAO,IAAAK,sBAAe,EAACL,YAAY,EAAE,IAAI,CAACtD,OAAO,CAAC;IACpD;IAEA4D,uBAAuB,GAAY;MACjC,OAAO,IAAI,CAACD,eAAe,CAAC,MAAM,CAAC;IACrC;;IAEA;IACA,MAAME,eAAe,CAAC7D,OAAuB,EAAoB;MAC/D,IAAI,CAACA,OAAO,CAACyB,WAAW,EAAE;QACxB,MAAMA,WAAW,GAAG,CAAC,MAAM,IAAI,CAACb,YAAY,CAACkD,SAAS,EAAE,EAAErC,WAA0B;QACpFzB,OAAO,CAACyB,WAAW,GAAGA,WAAW,EAAEA,WAAW;MAChD;MACA,OAAO,IAAAsC,iBAAW,EAAC,IAAI,EAAE/D,OAAO,CAAC;IACnC;;IAEA;IACA,MAAMgE,iBAAiB,CAACvC,WAAyB,EAAoB;MACnE,IAAI,CAACA,WAAW,EAAE;QAChB,MAAM4B,MAAM,GAAG,MAAM,IAAI,CAACzC,YAAY,CAACkD,SAAS,EAAE;QAClDrC,WAAW,GAAG4B,MAAM,CAAC5B,WAAW;QAChC,MAAMwC,cAAc,GAAG,IAAI,CAACrD,YAAY,CAACoC,mBAAmB,CAAC,aAAa,CAAC;QAC3E,IAAI,CAACpC,YAAY,CAACkB,MAAM,CAACmC,cAAc,CAAC;QAExC,IAAI,IAAI,CAACjE,OAAO,CAACkE,IAAI,EAAE;UACrB,MAAM,IAAAC,iCAA2B,EAAC,QAAQ,EAAEd,MAAM,CAAC;QACrD;MACF;MACA;MACA,IAAI,CAAC5B,WAAW,EAAE;QAChB,OAAO2C,OAAO,CAACC,OAAO,CAAC,IAAI,CAAC;MAC9B;MACA,OAAO,IAAI,CAAC3D,KAAK,CAAC4D,MAAM,CAAC7C,WAAW,CAAC;IACvC;;IAEA;IACA,MAAM8C,kBAAkB,CAAC1B,YAA2B,EAAoB;MACtE,IAAI,CAACA,YAAY,EAAE;QACjB,MAAMQ,MAAM,GAAG,MAAM,IAAI,CAACzC,YAAY,CAACkD,SAAS,EAAE;QAClDjB,YAAY,GAAGQ,MAAM,CAACR,YAAY;QAClC,MAAM2B,eAAe,GAAG,IAAI,CAAC5D,YAAY,CAACoC,mBAAmB,CAAC,cAAc,CAAC;QAC7E,IAAI,CAACpC,YAAY,CAACkB,MAAM,CAAC0C,eAAe,CAAC;QAEzC,IAAI,IAAI,CAACxE,OAAO,CAACkE,IAAI,EAAE;UACrB,MAAM,IAAAC,iCAA2B,EAAC,SAAS,EAAEd,MAAM,CAAC;QACtD;MACF;MACA;MACA,IAAI,CAACR,YAAY,EAAE;QACjB,OAAOuB,OAAO,CAACC,OAAO,CAAC,IAAI,CAAC;MAC9B;MACA,OAAO,IAAI,CAAC3D,KAAK,CAAC4D,MAAM,CAACzB,YAAY,CAAC;IACxC;IAEA4B,qBAAqB,CAACzE,OAAkC,GAAG,CAAC,CAAC,EAAE;MAC7D,IAAI;QACF+B,OAAO;QACP2C,qBAAqB;QACrBC;MACF,CAAC,GAAG3E,OAAO;MACX,IAAI,CAAC+B,OAAO,EAAE;QACZA,OAAO,GAAG,IAAI,CAACnB,YAAY,CAACc,aAAa,EAAE,CAACK,OAAkB;MAChE;MACA,IAAI,CAACA,OAAO,EAAE;QACZ,OAAO,EAAE;MACX;MACA,IAAI2C,qBAAqB,KAAK9C,SAAS,EAAE;QACvC8C,qBAAqB,GAAG,IAAI,CAAC1E,OAAO,CAAC0E,qBAAqB;MAC5D;MAEA,MAAME,SAAS,GAAG,IAAAC,mBAAY,EAAC,IAAI,CAAC,CAACD,SAAS;MAC9C,MAAME,WAAW,GAAG/C,OAAO,CAACA,OAAO,CAAC,CAAC;MACrC,IAAIgD,SAAS,GAAGH,SAAS,GAAG,iBAAiB,GAAGI,kBAAkB,CAACF,WAAW,CAAC;MAC/E,IAAIJ,qBAAqB,EAAE;QACzBK,SAAS,IAAI,4BAA4B,GAAGC,kBAAkB,CAACN,qBAAqB,CAAC;MACvF;MACA;MACA,IAAIC,KAAK,EAAE;QACTI,SAAS,IAAI,SAAS,GAAGC,kBAAkB,CAACL,KAAK,CAAC;MACpD;MAEA,OAAOI,SAAS;IAClB;;IAEA;IACA;IACA,MAAME,OAAO,CAACjF,OAAwB,EAAoB;MACxDA,OAAO,GAAGH,MAAM,CAACC,MAAM,CAAC,CAAC,CAAC,EAAEE,OAAO,CAAC;;MAEpC;MACA,MAAMkF,UAAU,GAAGC,MAAM,CAACC,QAAQ,CAACC,MAAM;MACzC,MAAMC,UAAU,GAAGH,MAAM,CAACC,QAAQ,CAACG,IAAI;MACvC;MACA;MACA;MACA;MACA,MAAMb,qBAAqB,GAAG1E,OAAO,CAAC0E,qBAAqB,KAAK,IAAI,GAAG,IAAI,GACxE1E,OAAO,CAAC0E,qBAAqB,IAC3B,IAAI,CAAC1E,OAAO,CAAC0E,qBAAqB,IAClCQ,UAAW;MAChB,MAAMP,KAAK,GAAG3E,OAAO,EAAE2E,KAAK;MAG5B,IAAIlD,WAAW,GAAGzB,OAAO,CAACyB,WAAW;MACrC,IAAIoB,YAAY,GAAG7C,OAAO,CAAC6C,YAAY;MACvC,MAAMmB,iBAAiB,GAAGhE,OAAO,CAACgE,iBAAiB,KAAK,KAAK;MAC7D,MAAMO,kBAAkB,GAAGvE,OAAO,CAACuE,kBAAkB,KAAK,KAAK;MAE/D,IAAIA,kBAAkB,IAAI,OAAO1B,YAAY,KAAK,WAAW,EAAE;QAC7DA,YAAY,GAAG,IAAI,CAACjC,YAAY,CAACc,aAAa,EAAE,CAACmB,YAA4B;MAC/E;MAEA,IAAImB,iBAAiB,IAAI,OAAOvC,WAAW,KAAK,WAAW,EAAE;QAC3DA,WAAW,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,EAAE,CAACD,WAA0B;MAC5E;MAEA,IAAI,CAACzB,OAAO,CAAC+B,OAAO,EAAE;QACpB/B,OAAO,CAAC+B,OAAO,GAAG,IAAI,CAACnB,YAAY,CAACc,aAAa,EAAE,CAACK,OAAkB;MACxE;MAEA,IAAIwC,kBAAkB,IAAI1B,YAAY,EAAE;QACtC,MAAM,IAAI,CAAC0B,kBAAkB,CAAC1B,YAAY,CAAC;MAC7C;MAEA,IAAImB,iBAAiB,IAAIvC,WAAW,EAAE;QACpC,MAAM,IAAI,CAACuC,iBAAiB,CAACvC,WAAW,CAAC;MAC3C;MAEA,MAAM+D,UAAU,GAAG/D,WAAW,EAAE+D,UAAU,IAAI3C,YAAY,EAAE2C,UAAU;MACtE,IAAI,IAAI,CAACxF,OAAO,CAACkE,IAAI,IAAIsB,UAAU,EAAE;QACnC,MAAM,IAAAC,sBAAgB,EAACD,UAAU,CAAC;MACpC;MAEA,MAAMT,SAAS,GAAG,IAAI,CAACN,qBAAqB,CAAC;QAAE,GAAGzE,OAAO;QAAE0E;MAAsB,CAAC,CAAC;MACnF;MACA;MACA,IAAI,CAACK,SAAS,EAAE;QACd;QACA,MAAMW,aAAa,GAAG,MAAM,IAAI,CAACC,YAAY,EAAE,CAAC,CAAG;QACnD,MAAMC,WAAW,GAAG,IAAIC,GAAG,CAACnB,qBAAqB,IAAIQ,UAAU,CAAC,CAAC,CAAC;QAClE,IAAIP,KAAK,EAAE;UACTiB,WAAW,CAACE,YAAY,CAACC,MAAM,CAAC,OAAO,EAAEpB,KAAK,CAAC;QACjD;QACA,IAAID,qBAAqB,KAAKY,UAAU,EAAE;UACxC;UACAH,MAAM,CAACC,QAAQ,CAACG,IAAI,GAAGK,WAAW,CAACL,IAAI;QACzC,CAAC,MAAM;UACLJ,MAAM,CAACC,QAAQ,CAACtF,MAAM,CAAC8F,WAAW,CAACL,IAAI,CAAC;QAC1C;QACA,OAAOG,aAAa;MACtB,CAAC,MAAM;QACL,IAAI1F,OAAO,CAACgG,yBAAyB,EAAE;UACrC;UACA,IAAI,CAACpF,YAAY,CAACK,KAAK,EAAE;QAC3B,CAAC,MAAM;UACL,IAAI,CAACL,YAAY,CAACqF,qBAAqB,EAAE;QAC3C;QACA;QACAd,MAAM,CAACC,QAAQ,CAACtF,MAAM,CAACiF,SAAS,CAAC;QACjC,OAAO,IAAI;MACb;IACF;IAEA,MAAMmB,2BAA2B,CAAE7D,MAAmB,EAAwB;MAC5E,IAAI,CAAC,IAAI,CAACrC,OAAO,CAACkE,IAAI,EAAE;QACtB,MAAM,IAAIiC,oBAAY,CAAC,iDAAiD,CAAC;MAC3E;MAEA,IAAI;QAAE1E;MAAY,CAAC,GAAGY,MAAM;MAC5B,IAAI,CAACZ,WAAW,EAAE;QAChBA,WAAW,GAAI,IAAI,CAACb,YAAY,CAACc,aAAa,EAAE,CAAED,WAAW;MAC/D;MAEA,IAAI,CAACA,WAAW,EAAE;QAChB,MAAM,IAAI0E,oBAAY,CAAC,kDAAkD,CAAC;MAC5E;MAEA,MAAMC,OAAO,GAAG,MAAM,IAAAC,iBAAW,EAAC5E,WAAW,EAAE+D,UAAU,CAAC;MAC1D,MAAMc,KAAK,GAAG,MAAM,IAAAC,uBAAiB,EAAC;QAAC,GAAGlE,MAAM;QAAE+D,OAAO;QAAE3E,WAAW,EAAEA,WAAW,CAACA;MAAW,CAAC,CAAC;MACjG,OAAO;QACL+E,aAAa,EAAG,QAAO/E,WAAW,CAACA,WAAY,EAAC;QAChDgF,IAAI,EAAEH;MACR,CAAC;IACH;IAEA,MAAMI,gBAAgB,CAAEC,QAAQ,GAAC,KAAK,EAAiB;MACrD,IAAIA,QAAQ,EAAE;QACZ,OAAO,IAAAC,0BAAoB,GAAE;MAC/B;MAEA,MAAMvD,MAAM,GAAG,MAAM,IAAI,CAACzC,YAAY,CAACkD,SAAS,EAAE;MAClD,MAAMsC,OAAO,GAAG/C,MAAM,CAAC5B,WAAW,EAAE+D,UAAU,IAAInC,MAAM,CAACR,YAAY,EAAE2C,UAAU;MAEjF,IAAIY,OAAO,EAAE;QACX,MAAM,IAAAX,sBAAgB,EAACW,OAAO,CAAC;MACjC;IACF;IAEAS,sBAAsB,CAAEC,OAAoB,EAAiB;MAC3D,MAAMC,OAAO,GAAGC,oBAAY,CAACC,wBAAwB,CAACH,OAAO,CAAC;MAC9D,MAAMI,MAAM,GAAGF,oBAAY,CAACG,WAAW,CAACJ,OAAO,IAAI,EAAE,CAAC;MACtD,IAAI,IAAAK,sBAAgB,EAACF,MAAM,CAAC,EAAE;QAC5B,IAAIG,KAAoB,GAAG,IAAI;QAC/B,IAAI,IAAAC,gBAAU,EAAER,OAAO,EAAcS,GAAG,CAAC,EAAE;UACzCF,KAAK,GAAIP,OAAO,CAAaS,GAAG,CAAC,YAAY,CAAC;QAChD;QACAF,KAAK,GAAGA,KAAK,IAAIP,OAAO,CAAC,YAAY,CAAC,IAAIA,OAAO,CAAC,YAAY,CAAC;QAC/D,OAAOO,KAAK;MACd;MAEA,OAAO,IAAI;IACb;EACF,CAAC,kDAvX4BG,MAAM;AAyXrC"}
+{"version":3,"file":"index.js","names":["_http","require","_util","crypto","_interopRequireWildcard","_pkce","_interopRequireDefault","_api","_TokenManager","_util2","_dpop","_errors","_node","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","mixinOAuth","Base","TransactionManagerConstructor","WithOriginalUri","provideOriginalUri","OktaAuthOAuth","constructor","args","transactionManager","assign","storageManager","options","pkce","DEFAULT_CODE_CHALLENGE_METHOD","PKCE","generateVerifier","computeChallenge","_pending","handleLogin","_tokenQueue","PromiseQueue","token","createTokenAPI","tokenManager","TokenManager","endpoints","createEndpoints","clearStorage","clear","isAuthenticated","autoRenew","autoRemove","getOptions","shouldRenew","onExpiredToken","shouldRemove","accessToken","getTokensSync","hasExpired","undefined","renew","remove","idToken","signInWithRedirect","opts","originalUri","additionalParams","setOriginalUri","params","scopes","getWithRedirect","getUser","getUserInfo","getIdToken","getAccessToken","getRefreshToken","refreshToken","getOrRenewAccessToken","key","getStorageKeyByType","err","emitter","emit","storeTokensFromRedirect","tokens","responseType","parseFromUrl","setTokens","isLoginRedirect","isPKCE","hasResponseType","isAuthorizationCodeFlow","invokeApiMethod","getTokens","httpRequest","revokeAccessToken","accessTokenKey","dpop","clearDPoPKeyPairAfterRevoke","Promise","resolve","revoke","revokeRefreshToken","refreshTokenKey","getSignOutRedirectUrl","postLogoutRedirectUri","state","logoutUrl","getOAuthUrls","idTokenHint","logoutUri","encodeURIComponent","signOut","defaultUri","window","location","origin","currentUri","href","dpopPairId","clearDPoPKeyPair","sessionClosed","closeSession","redirectUri","URL","searchParams","append","clearTokensBeforeRedirect","addPendingRemoveFlags","getDPoPAuthorizationHeaders","AuthSdkError","keyPair","findKeyPair","proof","generateDPoPProof","Authorization","Dpop","clearDPoPStorage","clearAll","clearAllDPoPKeyPairs","parseUseDPoPNonceError","headers","wwwAuth","WWWAuthError","getWWWAuthenticateHeader","wwwErr","parseHeader","isDPoPNonceError","nonce","isFunction"],"sources":["../../../../lib/oidc/mixin/index.ts"],"sourcesContent":["import { httpRequest, RequestOptions } from '../../http';\nimport { OktaAuthConstructor } from '../../base/types';\nimport { \n  PromiseQueue,\n  isFunction\n} from '../../util';\nimport { CryptoAPI } from '../../crypto/types';\nimport * as crypto from '../../crypto';\nimport {\n  AccessToken,\n  CustomUserClaims,\n  IDToken,\n  IsAuthenticatedOptions,\n  OAuthResponseType,\n  OAuthStorageManagerInterface,\n  OAuthTransactionMeta,\n  OktaAuthOAuthInterface,\n  OktaAuthOAuthOptions,\n  PkceAPI,\n  PKCETransactionMeta,\n  RefreshToken,\n  SigninWithRedirectOptions,\n  SignoutOptions,\n  SignoutRedirectUrlOptions,\n  TokenAPI,\n  TransactionManagerInterface,\n  TransactionManagerConstructor,\n  UserClaims,\n  Endpoints,\n  DPoPRequest,\n  DPoPHeaders\n} from '../types';\nimport PKCE from '../util/pkce';\nimport { createEndpoints, createTokenAPI } from '../factory/api';\nimport { TokenManager } from '../TokenManager';\nimport { getOAuthUrls, isLoginRedirect, hasResponseType } from '../util';\nimport { \n  generateDPoPProof,\n  clearDPoPKeyPair,\n  clearAllDPoPKeyPairs,\n  clearDPoPKeyPairAfterRevoke,\n  findKeyPair,\n  isDPoPNonceError\n} from '../dpop';\nimport { AuthSdkError, WWWAuthError } from '../../errors';\n\nimport { OktaAuthSessionInterface } from '../../session/types';\nimport { provideOriginalUri } from './node';\nexport function mixinOAuth\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TM extends TransactionManagerInterface = TransactionManagerInterface,\n  TBase extends OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n    = OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n>\n(\n  Base: TBase,\n  TransactionManagerConstructor: TransactionManagerConstructor<TM>,\n): TBase & OktaAuthConstructor<OktaAuthOAuthInterface<M, S, O, TM>>\n{\n  const WithOriginalUri = provideOriginalUri(Base);\n  return class OktaAuthOAuth extends WithOriginalUri\n  implements OktaAuthOAuthInterface<M, S, O, TM>\n  {\n    static crypto: CryptoAPI = crypto;\n    token: TokenAPI;\n    tokenManager: TokenManager;\n    transactionManager: TM;\n    pkce: PkceAPI;\n    endpoints: Endpoints;\n\n    _pending: { handleLogin: boolean };\n    _tokenQueue: PromiseQueue;\n    \n    constructor(...args: any[]) {\n      super(...args);\n\n      this.transactionManager = new TransactionManagerConstructor(Object.assign({\n        storageManager: this.storageManager,\n      }, this.options.transactionManager));\n  \n      this.pkce = {\n        DEFAULT_CODE_CHALLENGE_METHOD: PKCE.DEFAULT_CODE_CHALLENGE_METHOD,\n        generateVerifier: PKCE.generateVerifier,\n        computeChallenge: PKCE.computeChallenge\n      };\n  \n      this._pending = { handleLogin: false };\n\n      this._tokenQueue = new PromiseQueue();\n\n      this.token = createTokenAPI(this, this._tokenQueue);\n\n      // TokenManager\n      this.tokenManager = new TokenManager(this, this.options.tokenManager);\n\n      this.endpoints = createEndpoints(this);\n    }\n\n    // inherited from subclass\n    clearStorage(): void {\n      super.clearStorage();\n      \n      // Clear all local tokens\n      this.tokenManager.clear();\n    }\n\n    // Returns true if both accessToken and idToken are not expired\n    // If `autoRenew` option is set, will attempt to renew expired tokens before returning.\n    // eslint-disable-next-line complexity\n    async isAuthenticated(options: IsAuthenticatedOptions = {}): Promise<boolean> {\n      // TODO: remove dependency on tokenManager options in next major version - OKTA-473815\n      const { autoRenew, autoRemove } = this.tokenManager.getOptions();\n\n      const shouldRenew = options.onExpiredToken ? options.onExpiredToken === 'renew' : autoRenew;\n      const shouldRemove = options.onExpiredToken ? options.onExpiredToken === 'remove' : autoRemove;\n\n      let { accessToken } = this.tokenManager.getTokensSync();\n      if (accessToken && this.tokenManager.hasExpired(accessToken)) {\n        accessToken = undefined;\n        if (shouldRenew) {\n          try {\n            accessToken = await this.tokenManager.renew('accessToken') as AccessToken;\n          } catch {\n            // Renew errors will emit an \"error\" event \n          }\n        } else if (shouldRemove) {\n          this.tokenManager.remove('accessToken');\n        }\n      }\n\n      let { idToken } = this.tokenManager.getTokensSync();\n      if (idToken && this.tokenManager.hasExpired(idToken)) {\n        idToken = undefined;\n        if (shouldRenew) {\n          try {\n            idToken = await this.tokenManager.renew('idToken') as IDToken;\n          } catch {\n            // Renew errors will emit an \"error\" event \n          }\n        } else if (shouldRemove) {\n          this.tokenManager.remove('idToken');\n        }\n      }\n\n      return !!(accessToken && idToken);\n    }\n\n\n    async signInWithRedirect(opts: SigninWithRedirectOptions = {}) {\n      const { originalUri, ...additionalParams } = opts;\n      if(this._pending.handleLogin) { \n        // Don't trigger second round\n        return;\n      }\n\n      this._pending.handleLogin = true;\n      try {\n        // Trigger default signIn redirect flow\n        if (originalUri) {\n          this.setOriginalUri(originalUri);\n        }\n        const params = Object.assign({\n          // TODO: remove this line when default scopes are changed OKTA-343294\n          scopes: this.options.scopes || ['openid', 'email', 'profile']\n        }, additionalParams);\n        await this.token.getWithRedirect(params);\n      } finally {\n        this._pending.handleLogin = false;\n      }\n    }\n\n    async getUser<T extends CustomUserClaims = CustomUserClaims>(): Promise<UserClaims<T>> {\n      const { idToken, accessToken } = this.tokenManager.getTokensSync();\n      return this.token.getUserInfo(accessToken, idToken);\n    }\n  \n    getIdToken(): string | undefined {\n      const { idToken } = this.tokenManager.getTokensSync();\n      return idToken ? idToken.idToken : undefined;\n    }\n  \n    getAccessToken(): string | undefined {\n      const { accessToken } = this.tokenManager.getTokensSync();\n      return accessToken ? accessToken.accessToken : undefined;\n    }\n  \n    getRefreshToken(): string | undefined {\n      const { refreshToken } = this.tokenManager.getTokensSync();\n      return refreshToken ? refreshToken.refreshToken : undefined;\n    }\n\n    async getOrRenewAccessToken(): Promise<string | null> {\n      const { accessToken } = this.tokenManager.getTokensSync();\n      if (accessToken && !this.tokenManager.hasExpired(accessToken)) {\n        return accessToken.accessToken;\n      }\n      try {\n        const key = this.tokenManager.getStorageKeyByType('accessToken');\n        const token = await this.tokenManager.renew(key ?? 'accessToken');\n        return (token as AccessToken)?.accessToken ?? null;\n      }\n      catch (err) {\n        this.emitter.emit('error', err);\n        return null;\n      }\n    }\n  \n    /**\n     * Store parsed tokens from redirect url\n     */\n    async storeTokensFromRedirect(): Promise<void> {\n      const { tokens, responseType } = await this.token.parseFromUrl();\n      if (responseType !== 'none') {\n        this.tokenManager.setTokens(tokens);\n      }\n    }\n  \n    isLoginRedirect(): boolean {\n      return isLoginRedirect(this);\n    }\n\n    isPKCE(): boolean {\n      return !!this.options.pkce;\n    }\n\n    hasResponseType(responseType: OAuthResponseType): boolean {\n      return hasResponseType(responseType, this.options);\n    }\n  \n    isAuthorizationCodeFlow(): boolean {\n      return this.hasResponseType('code');\n    }\n\n    // Escape hatch method to make arbitrary OKTA API call\n    async invokeApiMethod(options: RequestOptions): Promise<unknown> {\n      if (!options.accessToken) {\n        const accessToken = (await this.tokenManager.getTokens()).accessToken as AccessToken;\n        options.accessToken = accessToken?.accessToken;\n      }\n      return httpRequest(this, options);\n    }\n    \n    // Revokes the access token for the application session\n    async revokeAccessToken(accessToken?: AccessToken): Promise<unknown> {\n      if (!accessToken) {\n        const tokens = await this.tokenManager.getTokens();\n        accessToken = tokens.accessToken;\n        const accessTokenKey = this.tokenManager.getStorageKeyByType('accessToken');\n        this.tokenManager.remove(accessTokenKey);\n\n        if (this.options.dpop) {\n          await clearDPoPKeyPairAfterRevoke('access', tokens);\n        }\n      }\n      // Access token may have been removed. In this case, we will silently succeed.\n      if (!accessToken) {\n        return Promise.resolve(null);\n      }\n      return this.token.revoke(accessToken);\n    }\n\n    // Revokes the refresh token for the application session\n    async revokeRefreshToken(refreshToken?: RefreshToken): Promise<unknown> {\n      if (!refreshToken) {\n        const tokens = await this.tokenManager.getTokens();\n        refreshToken = tokens.refreshToken;\n        const refreshTokenKey = this.tokenManager.getStorageKeyByType('refreshToken');\n        this.tokenManager.remove(refreshTokenKey);\n\n        if (this.options.dpop) {\n          await clearDPoPKeyPairAfterRevoke('refresh', tokens);\n        }\n      }\n      // Refresh token may have been removed. In this case, we will silently succeed.\n      if (!refreshToken) {\n        return Promise.resolve(null);\n      }\n      return this.token.revoke(refreshToken);\n    }\n\n    getSignOutRedirectUrl(options: SignoutRedirectUrlOptions = {}) {\n      let {\n        idToken,\n        postLogoutRedirectUri,\n        state,\n      } = options;\n      if (!idToken) {\n        idToken = this.tokenManager.getTokensSync().idToken as IDToken;\n      }\n      if (!idToken) {\n        return '';\n      }\n      if (postLogoutRedirectUri === undefined) {\n        postLogoutRedirectUri = this.options.postLogoutRedirectUri;\n      }\n\n      const logoutUrl = getOAuthUrls(this).logoutUrl;\n      const idTokenHint = idToken.idToken; // a string\n      let logoutUri = logoutUrl + '?id_token_hint=' + encodeURIComponent(idTokenHint);\n      if (postLogoutRedirectUri) {\n        logoutUri += '&post_logout_redirect_uri=' + encodeURIComponent(postLogoutRedirectUri);\n      } \n      // State allows option parameters to be passed to logout redirect uri\n      if (state) {\n        logoutUri += '&state=' + encodeURIComponent(state);\n      }\n\n      return logoutUri;\n    }\n\n    // Revokes refreshToken or accessToken, clears all local tokens, then redirects to Okta to end the SSO session.\n    // eslint-disable-next-line complexity, max-statements\n    async signOut(options?: SignoutOptions): Promise<boolean> {\n      options = Object.assign({}, options);\n    \n      // postLogoutRedirectUri must be whitelisted in Okta Admin UI\n      const defaultUri = window.location.origin;\n      const currentUri = window.location.href;\n      // Fix for issue/1410 - allow for no postLogoutRedirectUri to be passed, resulting in /logout default behavior\n      //    \"If no Okta session exists, this endpoint has no effect and the browser is redirected immediately to the\n      //    Okta sign-in page or the post_logout_redirect_uri (if specified).\"\n      // - https://developer.okta.com/docs/reference/api/oidc/#logout\n      const postLogoutRedirectUri = options.postLogoutRedirectUri === null ? null :\n        (options.postLogoutRedirectUri\n        || this.options.postLogoutRedirectUri\n        || defaultUri);\n      const state = options?.state;\n      \n    \n      let accessToken = options.accessToken;\n      let refreshToken = options.refreshToken;\n      const revokeAccessToken = options.revokeAccessToken !== false;\n      const revokeRefreshToken = options.revokeRefreshToken !== false;\n    \n      if (revokeRefreshToken && typeof refreshToken === 'undefined') {\n        refreshToken = this.tokenManager.getTokensSync().refreshToken as RefreshToken;\n      }\n\n      if (revokeAccessToken && typeof accessToken === 'undefined') {\n        accessToken = this.tokenManager.getTokensSync().accessToken as AccessToken;\n      }\n    \n      if (!options.idToken) {\n        options.idToken = this.tokenManager.getTokensSync().idToken as IDToken;\n      }\n\n      if (revokeRefreshToken && refreshToken) {\n        await this.revokeRefreshToken(refreshToken);\n      }\n\n      if (revokeAccessToken && accessToken) {\n        await this.revokeAccessToken(accessToken);\n      }\n\n      const dpopPairId = accessToken?.dpopPairId ?? refreshToken?.dpopPairId;\n      if (this.options.dpop && dpopPairId) {\n        await clearDPoPKeyPair(dpopPairId);\n      }\n\n      const logoutUri = this.getSignOutRedirectUrl({ ...options, postLogoutRedirectUri });\n      // No logoutUri? This can happen if the storage was cleared.\n      // Fallback to XHR signOut, then simulate a redirect to the post logout uri\n      if (!logoutUri) {\n        // local tokens are cleared once session is closed\n        const sessionClosed = await this.closeSession();   // can throw if the user cannot be signed out\n        const redirectUri = new URL(postLogoutRedirectUri || defaultUri); // during fallback, redirectUri cannot be null\n        if (state) {\n          redirectUri.searchParams.append('state', state);\n        }\n        if (postLogoutRedirectUri === currentUri) {\n          // window.location.reload(); // force a hard reload if URI is not changing\n          window.location.href = redirectUri.href;\n        } else {\n          window.location.assign(redirectUri.href);\n        }\n        return sessionClosed;\n      } else {\n        if (options.clearTokensBeforeRedirect) {\n          // Clear all local tokens\n          this.tokenManager.clear();\n        } else {\n          this.tokenManager.addPendingRemoveFlags();\n        }\n        // Flow ends with logout redirect\n        window.location.assign(logoutUri);\n        return true;\n      }\n    }\n\n    async getDPoPAuthorizationHeaders (params: DPoPRequest): Promise<DPoPHeaders> {\n      if (!this.options.dpop) {\n        throw new AuthSdkError('DPoP is not configured for this client instance');\n      }\n\n      let { accessToken } = params;\n      if (!accessToken) {\n        accessToken = (this.tokenManager.getTokensSync()).accessToken;\n      }\n\n      if (!accessToken) {\n        throw new AuthSdkError('AccessToken is required to generate a DPoP Proof');\n      }\n\n      const keyPair = await findKeyPair(accessToken?.dpopPairId);\n      const proof = await generateDPoPProof({...params, keyPair, accessToken: accessToken.accessToken});\n      return {\n        Authorization: `DPoP ${accessToken.accessToken}`,\n        Dpop: proof\n      };\n    }\n\n    async clearDPoPStorage (clearAll=false): Promise<void> {\n      if (clearAll) {\n        return clearAllDPoPKeyPairs();\n      }\n\n      const tokens = await this.tokenManager.getTokens();\n      const keyPair = tokens.accessToken?.dpopPairId || tokens.refreshToken?.dpopPairId;\n\n      if (keyPair) {\n        await clearDPoPKeyPair(keyPair);\n      }\n    }\n\n    parseUseDPoPNonceError (headers: HeadersInit): string | null {\n      const wwwAuth = WWWAuthError.getWWWAuthenticateHeader(headers);\n      const wwwErr = WWWAuthError.parseHeader(wwwAuth ?? '');\n      if (isDPoPNonceError(wwwErr)) {\n        let nonce: string | null = null;\n        if (isFunction((headers as Headers)?.get)) {\n          nonce = (headers as Headers).get('DPoP-Nonce');\n        }\n        nonce = nonce ?? headers['dpop-nonce'] ?? headers['DPoP-Nonce'];\n        return nonce;\n      }\n\n      return null;\n    }\n  };\n\n}\n"],"mappings":";;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAKA,IAAAE,MAAA,GAAAC,uBAAA,CAAAH,OAAA;AAyBA,IAAAI,KAAA,GAAAC,sBAAA,CAAAL,OAAA;AACA,IAAAM,IAAA,GAAAN,OAAA;AACA,IAAAO,aAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,KAAA,GAAAT,OAAA;AAQA,IAAAU,OAAA,GAAAV,OAAA;AAGA,IAAAW,KAAA,GAAAX,OAAA;AAA4C,SAAAG,wBAAAS,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAX,uBAAA,YAAAA,CAAAS,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA;AACrC,SAASkB,UAAUA,CAUxBC,IAAW,EACXC,6BAAgE,EAElE;EACE,MAAMC,eAAe,GAAG,IAAAC,wBAAkB,EAACH,IAAI,CAAC;EAChD,OAAO,MAAMI,aAAa,SAASF,eAAe,CAElD;IACE,OAAOhC,MAAM,GAAcA,MAAM;IAUjCmC,WAAWA,CAAC,GAAGC,IAAW,EAAE;MAC1B,KAAK,CAAC,GAAGA,IAAI,CAAC;MAEd,IAAI,CAACC,kBAAkB,GAAG,IAAIN,6BAA6B,CAACL,MAAM,CAACY,MAAM,CAAC;QACxEC,cAAc,EAAE,IAAI,CAACA;MACvB,CAAC,EAAE,IAAI,CAACC,OAAO,CAACH,kBAAkB,CAAC,CAAC;MAEpC,IAAI,CAACI,IAAI,GAAG;QACVC,6BAA6B,EAAEC,aAAI,CAACD,6BAA6B;QACjEE,gBAAgB,EAAED,aAAI,CAACC,gBAAgB;QACvCC,gBAAgB,EAAEF,aAAI,CAACE;MACzB,CAAC;MAED,IAAI,CAACC,QAAQ,GAAG;QAAEC,WAAW,EAAE;MAAM,CAAC;MAEtC,IAAI,CAACC,WAAW,GAAG,IAAIC,kBAAY,CAAC,CAAC;MAErC,IAAI,CAACC,KAAK,GAAG,IAAAC,mBAAc,EAAC,IAAI,EAAE,IAAI,CAACH,WAAW,CAAC;;MAEnD;MACA,IAAI,CAACI,YAAY,GAAG,IAAIC,0BAAY,CAAC,IAAI,EAAE,IAAI,CAACb,OAAO,CAACY,YAAY,CAAC;MAErE,IAAI,CAACE,SAAS,GAAG,IAAAC,oBAAe,EAAC,IAAI,CAAC;IACxC;;IAEA;IACAC,YAAYA,CAAA,EAAS;MACnB,KAAK,CAACA,YAAY,CAAC,CAAC;;MAEpB;MACA,IAAI,CAACJ,YAAY,CAACK,KAAK,CAAC,CAAC;IAC3B;;IAEA;IACA;IACA;IACA,MAAMC,eAAeA,CAAClB,OAA+B,GAAG,CAAC,CAAC,EAAoB;MAC5E;MACA,MAAM;QAAEmB,SAAS;QAAEC;MAAW,CAAC,GAAG,IAAI,CAACR,YAAY,CAACS,UAAU,CAAC,CAAC;MAEhE,MAAMC,WAAW,GAAGtB,OAAO,CAACuB,cAAc,GAAGvB,OAAO,CAACuB,cAAc,KAAK,OAAO,GAAGJ,SAAS;MAC3F,MAAMK,YAAY,GAAGxB,OAAO,CAACuB,cAAc,GAAGvB,OAAO,CAACuB,cAAc,KAAK,QAAQ,GAAGH,UAAU;MAE9F,IAAI;QAAEK;MAAY,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,CAAC,CAAC;MACvD,IAAID,WAAW,IAAI,IAAI,CAACb,YAAY,CAACe,UAAU,CAACF,WAAW,CAAC,EAAE;QAC5DA,WAAW,GAAGG,SAAS;QACvB,IAAIN,WAAW,EAAE;UACf,IAAI;YACFG,WAAW,GAAG,MAAM,IAAI,CAACb,YAAY,CAACiB,KAAK,CAAC,aAAa,CAAgB;UAC3E,CAAC,CAAC,MAAM;YACN;UAAA;QAEJ,CAAC,MAAM,IAAIL,YAAY,EAAE;UACvB,IAAI,CAACZ,YAAY,CAACkB,MAAM,CAAC,aAAa,CAAC;QACzC;MACF;MAEA,IAAI;QAAEC;MAAQ,CAAC,GAAG,IAAI,CAACnB,YAAY,CAACc,aAAa,CAAC,CAAC;MACnD,IAAIK,OAAO,IAAI,IAAI,CAACnB,YAAY,CAACe,UAAU,CAACI,OAAO,CAAC,EAAE;QACpDA,OAAO,GAAGH,SAAS;QACnB,IAAIN,WAAW,EAAE;UACf,IAAI;YACFS,OAAO,GAAG,MAAM,IAAI,CAACnB,YAAY,CAACiB,KAAK,CAAC,SAAS,CAAY;UAC/D,CAAC,CAAC,MAAM;YACN;UAAA;QAEJ,CAAC,MAAM,IAAIL,YAAY,EAAE;UACvB,IAAI,CAACZ,YAAY,CAACkB,MAAM,CAAC,SAAS,CAAC;QACrC;MACF;MAEA,OAAO,CAAC,EAAEL,WAAW,IAAIM,OAAO,CAAC;IACnC;IAGA,MAAMC,kBAAkBA,CAACC,IAA+B,GAAG,CAAC,CAAC,EAAE;MAC7D,MAAM;QAAEC,WAAW;QAAE,GAAGC;MAAiB,CAAC,GAAGF,IAAI;MACjD,IAAG,IAAI,CAAC3B,QAAQ,CAACC,WAAW,EAAE;QAC5B;QACA;MACF;MAEA,IAAI,CAACD,QAAQ,CAACC,WAAW,GAAG,IAAI;MAChC,IAAI;QACF;QACA,IAAI2B,WAAW,EAAE;UACf,IAAI,CAACE,cAAc,CAACF,WAAW,CAAC;QAClC;QACA,MAAMG,MAAM,GAAGnD,MAAM,CAACY,MAAM,CAAC;UAC3B;UACAwC,MAAM,EAAE,IAAI,CAACtC,OAAO,CAACsC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS;QAC9D,CAAC,EAAEH,gBAAgB,CAAC;QACpB,MAAM,IAAI,CAACzB,KAAK,CAAC6B,eAAe,CAACF,MAAM,CAAC;MAC1C,CAAC,SAAS;QACR,IAAI,CAAC/B,QAAQ,CAACC,WAAW,GAAG,KAAK;MACnC;IACF;IAEA,MAAMiC,OAAOA,CAAA,EAA0E;MACrF,MAAM;QAAET,OAAO;QAAEN;MAAY,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,CAAC,CAAC;MAClE,OAAO,IAAI,CAAChB,KAAK,CAAC+B,WAAW,CAAChB,WAAW,EAAEM,OAAO,CAAC;IACrD;IAEAW,UAAUA,CAAA,EAAuB;MAC/B,MAAM;QAAEX;MAAQ,CAAC,GAAG,IAAI,CAACnB,YAAY,CAACc,aAAa,CAAC,CAAC;MACrD,OAAOK,OAAO,GAAGA,OAAO,CAACA,OAAO,GAAGH,SAAS;IAC9C;IAEAe,cAAcA,CAAA,EAAuB;MACnC,MAAM;QAAElB;MAAY,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,CAAC,CAAC;MACzD,OAAOD,WAAW,GAAGA,WAAW,CAACA,WAAW,GAAGG,SAAS;IAC1D;IAEAgB,eAAeA,CAAA,EAAuB;MACpC,MAAM;QAAEC;MAAa,CAAC,GAAG,IAAI,CAACjC,YAAY,CAACc,aAAa,CAAC,CAAC;MAC1D,OAAOmB,YAAY,GAAGA,YAAY,CAACA,YAAY,GAAGjB,SAAS;IAC7D;IAEA,MAAMkB,qBAAqBA,CAAA,EAA2B;MACpD,MAAM;QAAErB;MAAY,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,CAAC,CAAC;MACzD,IAAID,WAAW,IAAI,CAAC,IAAI,CAACb,YAAY,CAACe,UAAU,CAACF,WAAW,CAAC,EAAE;QAC7D,OAAOA,WAAW,CAACA,WAAW;MAChC;MACA,IAAI;QACF,MAAMsB,GAAG,GAAG,IAAI,CAACnC,YAAY,CAACoC,mBAAmB,CAAC,aAAa,CAAC;QAChE,MAAMtC,KAAK,GAAG,MAAM,IAAI,CAACE,YAAY,CAACiB,KAAK,CAACkB,GAAG,IAAI,aAAa,CAAC;QACjE,OAAQrC,KAAK,EAAkBe,WAAW,IAAI,IAAI;MACpD,CAAC,CACD,OAAOwB,GAAG,EAAE;QACV,IAAI,CAACC,OAAO,CAACC,IAAI,CAAC,OAAO,EAAEF,GAAG,CAAC;QAC/B,OAAO,IAAI;MACb;IACF;;IAEA;AACJ;AACA;IACI,MAAMG,uBAAuBA,CAAA,EAAkB;MAC7C,MAAM;QAAEC,MAAM;QAAEC;MAAa,CAAC,GAAG,MAAM,IAAI,CAAC5C,KAAK,CAAC6C,YAAY,CAAC,CAAC;MAChE,IAAID,YAAY,KAAK,MAAM,EAAE;QAC3B,IAAI,CAAC1C,YAAY,CAAC4C,SAAS,CAACH,MAAM,CAAC;MACrC;IACF;IAEAI,eAAeA,CAAA,EAAY;MACzB,OAAO,IAAAA,sBAAe,EAAC,IAAI,CAAC;IAC9B;IAEAC,MAAMA,CAAA,EAAY;MAChB,OAAO,CAAC,CAAC,IAAI,CAAC1D,OAAO,CAACC,IAAI;IAC5B;IAEA0D,eAAeA,CAACL,YAA+B,EAAW;MACxD,OAAO,IAAAK,sBAAe,EAACL,YAAY,EAAE,IAAI,CAACtD,OAAO,CAAC;IACpD;IAEA4D,uBAAuBA,CAAA,EAAY;MACjC,OAAO,IAAI,CAACD,eAAe,CAAC,MAAM,CAAC;IACrC;;IAEA;IACA,MAAME,eAAeA,CAAC7D,OAAuB,EAAoB;MAC/D,IAAI,CAACA,OAAO,CAACyB,WAAW,EAAE;QACxB,MAAMA,WAAW,GAAG,CAAC,MAAM,IAAI,CAACb,YAAY,CAACkD,SAAS,CAAC,CAAC,EAAErC,WAA0B;QACpFzB,OAAO,CAACyB,WAAW,GAAGA,WAAW,EAAEA,WAAW;MAChD;MACA,OAAO,IAAAsC,iBAAW,EAAC,IAAI,EAAE/D,OAAO,CAAC;IACnC;;IAEA;IACA,MAAMgE,iBAAiBA,CAACvC,WAAyB,EAAoB;MACnE,IAAI,CAACA,WAAW,EAAE;QAChB,MAAM4B,MAAM,GAAG,MAAM,IAAI,CAACzC,YAAY,CAACkD,SAAS,CAAC,CAAC;QAClDrC,WAAW,GAAG4B,MAAM,CAAC5B,WAAW;QAChC,MAAMwC,cAAc,GAAG,IAAI,CAACrD,YAAY,CAACoC,mBAAmB,CAAC,aAAa,CAAC;QAC3E,IAAI,CAACpC,YAAY,CAACkB,MAAM,CAACmC,cAAc,CAAC;QAExC,IAAI,IAAI,CAACjE,OAAO,CAACkE,IAAI,EAAE;UACrB,MAAM,IAAAC,iCAA2B,EAAC,QAAQ,EAAEd,MAAM,CAAC;QACrD;MACF;MACA;MACA,IAAI,CAAC5B,WAAW,EAAE;QAChB,OAAO2C,OAAO,CAACC,OAAO,CAAC,IAAI,CAAC;MAC9B;MACA,OAAO,IAAI,CAAC3D,KAAK,CAAC4D,MAAM,CAAC7C,WAAW,CAAC;IACvC;;IAEA;IACA,MAAM8C,kBAAkBA,CAAC1B,YAA2B,EAAoB;MACtE,IAAI,CAACA,YAAY,EAAE;QACjB,MAAMQ,MAAM,GAAG,MAAM,IAAI,CAACzC,YAAY,CAACkD,SAAS,CAAC,CAAC;QAClDjB,YAAY,GAAGQ,MAAM,CAACR,YAAY;QAClC,MAAM2B,eAAe,GAAG,IAAI,CAAC5D,YAAY,CAACoC,mBAAmB,CAAC,cAAc,CAAC;QAC7E,IAAI,CAACpC,YAAY,CAACkB,MAAM,CAAC0C,eAAe,CAAC;QAEzC,IAAI,IAAI,CAACxE,OAAO,CAACkE,IAAI,EAAE;UACrB,MAAM,IAAAC,iCAA2B,EAAC,SAAS,EAAEd,MAAM,CAAC;QACtD;MACF;MACA;MACA,IAAI,CAACR,YAAY,EAAE;QACjB,OAAOuB,OAAO,CAACC,OAAO,CAAC,IAAI,CAAC;MAC9B;MACA,OAAO,IAAI,CAAC3D,KAAK,CAAC4D,MAAM,CAACzB,YAAY,CAAC;IACxC;IAEA4B,qBAAqBA,CAACzE,OAAkC,GAAG,CAAC,CAAC,EAAE;MAC7D,IAAI;QACF+B,OAAO;QACP2C,qBAAqB;QACrBC;MACF,CAAC,GAAG3E,OAAO;MACX,IAAI,CAAC+B,OAAO,EAAE;QACZA,OAAO,GAAG,IAAI,CAACnB,YAAY,CAACc,aAAa,CAAC,CAAC,CAACK,OAAkB;MAChE;MACA,IAAI,CAACA,OAAO,EAAE;QACZ,OAAO,EAAE;MACX;MACA,IAAI2C,qBAAqB,KAAK9C,SAAS,EAAE;QACvC8C,qBAAqB,GAAG,IAAI,CAAC1E,OAAO,CAAC0E,qBAAqB;MAC5D;MAEA,MAAME,SAAS,GAAG,IAAAC,mBAAY,EAAC,IAAI,CAAC,CAACD,SAAS;MAC9C,MAAME,WAAW,GAAG/C,OAAO,CAACA,OAAO,CAAC,CAAC;MACrC,IAAIgD,SAAS,GAAGH,SAAS,GAAG,iBAAiB,GAAGI,kBAAkB,CAACF,WAAW,CAAC;MAC/E,IAAIJ,qBAAqB,EAAE;QACzBK,SAAS,IAAI,4BAA4B,GAAGC,kBAAkB,CAACN,qBAAqB,CAAC;MACvF;MACA;MACA,IAAIC,KAAK,EAAE;QACTI,SAAS,IAAI,SAAS,GAAGC,kBAAkB,CAACL,KAAK,CAAC;MACpD;MAEA,OAAOI,SAAS;IAClB;;IAEA;IACA;IACA,MAAME,OAAOA,CAACjF,OAAwB,EAAoB;MACxDA,OAAO,GAAGd,MAAM,CAACY,MAAM,CAAC,CAAC,CAAC,EAAEE,OAAO,CAAC;;MAEpC;MACA,MAAMkF,UAAU,GAAGC,MAAM,CAACC,QAAQ,CAACC,MAAM;MACzC,MAAMC,UAAU,GAAGH,MAAM,CAACC,QAAQ,CAACG,IAAI;MACvC;MACA;MACA;MACA;MACA,MAAMb,qBAAqB,GAAG1E,OAAO,CAAC0E,qBAAqB,KAAK,IAAI,GAAG,IAAI,GACxE1E,OAAO,CAAC0E,qBAAqB,IAC3B,IAAI,CAAC1E,OAAO,CAAC0E,qBAAqB,IAClCQ,UAAW;MAChB,MAAMP,KAAK,GAAG3E,OAAO,EAAE2E,KAAK;MAG5B,IAAIlD,WAAW,GAAGzB,OAAO,CAACyB,WAAW;MACrC,IAAIoB,YAAY,GAAG7C,OAAO,CAAC6C,YAAY;MACvC,MAAMmB,iBAAiB,GAAGhE,OAAO,CAACgE,iBAAiB,KAAK,KAAK;MAC7D,MAAMO,kBAAkB,GAAGvE,OAAO,CAACuE,kBAAkB,KAAK,KAAK;MAE/D,IAAIA,kBAAkB,IAAI,OAAO1B,YAAY,KAAK,WAAW,EAAE;QAC7DA,YAAY,GAAG,IAAI,CAACjC,YAAY,CAACc,aAAa,CAAC,CAAC,CAACmB,YAA4B;MAC/E;MAEA,IAAImB,iBAAiB,IAAI,OAAOvC,WAAW,KAAK,WAAW,EAAE;QAC3DA,WAAW,GAAG,IAAI,CAACb,YAAY,CAACc,aAAa,CAAC,CAAC,CAACD,WAA0B;MAC5E;MAEA,IAAI,CAACzB,OAAO,CAAC+B,OAAO,EAAE;QACpB/B,OAAO,CAAC+B,OAAO,GAAG,IAAI,CAACnB,YAAY,CAACc,aAAa,CAAC,CAAC,CAACK,OAAkB;MACxE;MAEA,IAAIwC,kBAAkB,IAAI1B,YAAY,EAAE;QACtC,MAAM,IAAI,CAAC0B,kBAAkB,CAAC1B,YAAY,CAAC;MAC7C;MAEA,IAAImB,iBAAiB,IAAIvC,WAAW,EAAE;QACpC,MAAM,IAAI,CAACuC,iBAAiB,CAACvC,WAAW,CAAC;MAC3C;MAEA,MAAM+D,UAAU,GAAG/D,WAAW,EAAE+D,UAAU,IAAI3C,YAAY,EAAE2C,UAAU;MACtE,IAAI,IAAI,CAACxF,OAAO,CAACkE,IAAI,IAAIsB,UAAU,EAAE;QACnC,MAAM,IAAAC,sBAAgB,EAACD,UAAU,CAAC;MACpC;MAEA,MAAMT,SAAS,GAAG,IAAI,CAACN,qBAAqB,CAAC;QAAE,GAAGzE,OAAO;QAAE0E;MAAsB,CAAC,CAAC;MACnF;MACA;MACA,IAAI,CAACK,SAAS,EAAE;QACd;QACA,MAAMW,aAAa,GAAG,MAAM,IAAI,CAACC,YAAY,CAAC,CAAC,CAAC,CAAG;QACnD,MAAMC,WAAW,GAAG,IAAIC,GAAG,CAACnB,qBAAqB,IAAIQ,UAAU,CAAC,CAAC,CAAC;QAClE,IAAIP,KAAK,EAAE;UACTiB,WAAW,CAACE,YAAY,CAACC,MAAM,CAAC,OAAO,EAAEpB,KAAK,CAAC;QACjD;QACA,IAAID,qBAAqB,KAAKY,UAAU,EAAE;UACxC;UACAH,MAAM,CAACC,QAAQ,CAACG,IAAI,GAAGK,WAAW,CAACL,IAAI;QACzC,CAAC,MAAM;UACLJ,MAAM,CAACC,QAAQ,CAACtF,MAAM,CAAC8F,WAAW,CAACL,IAAI,CAAC;QAC1C;QACA,OAAOG,aAAa;MACtB,CAAC,MAAM;QACL,IAAI1F,OAAO,CAACgG,yBAAyB,EAAE;UACrC;UACA,IAAI,CAACpF,YAAY,CAACK,KAAK,CAAC,CAAC;QAC3B,CAAC,MAAM;UACL,IAAI,CAACL,YAAY,CAACqF,qBAAqB,CAAC,CAAC;QAC3C;QACA;QACAd,MAAM,CAACC,QAAQ,CAACtF,MAAM,CAACiF,SAAS,CAAC;QACjC,OAAO,IAAI;MACb;IACF;IAEA,MAAMmB,2BAA2BA,CAAE7D,MAAmB,EAAwB;MAC5E,IAAI,CAAC,IAAI,CAACrC,OAAO,CAACkE,IAAI,EAAE;QACtB,MAAM,IAAIiC,oBAAY,CAAC,iDAAiD,CAAC;MAC3E;MAEA,IAAI;QAAE1E;MAAY,CAAC,GAAGY,MAAM;MAC5B,IAAI,CAACZ,WAAW,EAAE;QAChBA,WAAW,GAAI,IAAI,CAACb,YAAY,CAACc,aAAa,CAAC,CAAC,CAAED,WAAW;MAC/D;MAEA,IAAI,CAACA,WAAW,EAAE;QAChB,MAAM,IAAI0E,oBAAY,CAAC,kDAAkD,CAAC;MAC5E;MAEA,MAAMC,OAAO,GAAG,MAAM,IAAAC,iBAAW,EAAC5E,WAAW,EAAE+D,UAAU,CAAC;MAC1D,MAAMc,KAAK,GAAG,MAAM,IAAAC,uBAAiB,EAAC;QAAC,GAAGlE,MAAM;QAAE+D,OAAO;QAAE3E,WAAW,EAAEA,WAAW,CAACA;MAAW,CAAC,CAAC;MACjG,OAAO;QACL+E,aAAa,EAAE,QAAQ/E,WAAW,CAACA,WAAW,EAAE;QAChDgF,IAAI,EAAEH;MACR,CAAC;IACH;IAEA,MAAMI,gBAAgBA,CAAEC,QAAQ,GAAC,KAAK,EAAiB;MACrD,IAAIA,QAAQ,EAAE;QACZ,OAAO,IAAAC,0BAAoB,EAAC,CAAC;MAC/B;MAEA,MAAMvD,MAAM,GAAG,MAAM,IAAI,CAACzC,YAAY,CAACkD,SAAS,CAAC,CAAC;MAClD,MAAMsC,OAAO,GAAG/C,MAAM,CAAC5B,WAAW,EAAE+D,UAAU,IAAInC,MAAM,CAACR,YAAY,EAAE2C,UAAU;MAEjF,IAAIY,OAAO,EAAE;QACX,MAAM,IAAAX,sBAAgB,EAACW,OAAO,CAAC;MACjC;IACF;IAEAS,sBAAsBA,CAAEC,OAAoB,EAAiB;MAC3D,MAAMC,OAAO,GAAGC,oBAAY,CAACC,wBAAwB,CAACH,OAAO,CAAC;MAC9D,MAAMI,MAAM,GAAGF,oBAAY,CAACG,WAAW,CAACJ,OAAO,IAAI,EAAE,CAAC;MACtD,IAAI,IAAAK,sBAAgB,EAACF,MAAM,CAAC,EAAE;QAC5B,IAAIG,KAAoB,GAAG,IAAI;QAC/B,IAAI,IAAAC,gBAAU,EAAER,OAAO,EAAchI,GAAG,CAAC,EAAE;UACzCuI,KAAK,GAAIP,OAAO,CAAahI,GAAG,CAAC,YAAY,CAAC;QAChD;QACAuI,KAAK,GAAGA,KAAK,IAAIP,OAAO,CAAC,YAAY,CAAC,IAAIA,OAAO,CAAC,YAAY,CAAC;QAC/D,OAAOO,KAAK;MACd;MAEA,OAAO,IAAI;IACb;EACF,CAAC;AAEH","ignoreList":[]}

package/cjs/oidc/mixin/minimal.js.map

@@ -1 +1 @@
-{"version":3,"file":"minimal.js","names":["mixinMinimalOAuth","Base","TransactionManagerConstructor","OktaAuthOAuth","constructor","args","transactionManager","Object","assign","storageManager","options","token","createBaseTokenAPI","isLoginRedirect","isPKCE","pkce","hasResponseType","responseType","isAuthorizationCodeFlow"],"sources":["../../../../lib/oidc/mixin/minimal.ts"],"sourcesContent":["\nimport { OktaAuthConstructor } from '../../base/types';\nimport {\n  OAuthResponseType,\n  OAuthStorageManagerInterface,\n  OAuthTransactionMeta,\n  MinimalOktaOAuthInterface,\n  OktaAuthOAuthOptions,\n  PKCETransactionMeta,\n  BaseTokenAPI,\n  TransactionManagerInterface,\n  TransactionManagerConstructor,\n} from '../types';\nimport { createBaseTokenAPI } from '../factory/baseApi';\nimport { isLoginRedirect, hasResponseType } from '../util';\n\nimport { OktaAuthSessionInterface } from '../../session/types';\nexport function mixinMinimalOAuth\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TM extends TransactionManagerInterface = TransactionManagerInterface,\n  TBase extends OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n    = OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n>\n(\n  Base: TBase,\n  TransactionManagerConstructor: TransactionManagerConstructor<TM>,\n): TBase & OktaAuthConstructor<MinimalOktaOAuthInterface<M, S, O, TM>>\n{\n  return class OktaAuthOAuth extends Base implements MinimalOktaOAuthInterface<M, S, O, TM>\n  {\n    token: BaseTokenAPI;\n    transactionManager: TM;\n    \n    constructor(...args: any[]) {\n      super(...args);\n\n      this.transactionManager = new TransactionManagerConstructor(Object.assign({\n        storageManager: this.storageManager,\n      }, this.options.transactionManager));\n  \n      this.token = createBaseTokenAPI(this as any);\n    }\n\n    isLoginRedirect(): boolean {\n      return isLoginRedirect(this as any);\n    }\n\n    isPKCE(): boolean {\n      return !!this.options.pkce;\n    }\n\n    hasResponseType(responseType: OAuthResponseType): boolean {\n      return hasResponseType(responseType, this.options);\n    }\n\n    isAuthorizationCodeFlow(): boolean {\n      return this.hasResponseType('code');\n    }\n\n  };\n\n}\n"],"mappings":";;;AAaA;AACA;AAGO,SAASA,iBAAiB,CAU/BC,IAAW,EACXC,6BAAgE,EAElE;EACE,OAAO,MAAMC,aAAa,SAASF,IAAI,CACvC;IAIEG,WAAW,CAAC,GAAGC,IAAW,EAAE;MAC1B,KAAK,CAAC,GAAGA,IAAI,CAAC;MAEd,IAAI,CAACC,kBAAkB,GAAG,IAAIJ,6BAA6B,CAACK,MAAM,CAACC,MAAM,CAAC;QACxEC,cAAc,EAAE,IAAI,CAACA;MACvB,CAAC,EAAE,IAAI,CAACC,OAAO,CAACJ,kBAAkB,CAAC,CAAC;MAEpC,IAAI,CAACK,KAAK,GAAG,IAAAC,2BAAkB,EAAC,IAAI,CAAQ;IAC9C;IAEAC,eAAe,GAAY;MACzB,OAAO,IAAAA,qBAAe,EAAC,IAAI,CAAQ;IACrC;IAEAC,MAAM,GAAY;MAChB,OAAO,CAAC,CAAC,IAAI,CAACJ,OAAO,CAACK,IAAI;IAC5B;IAEAC,eAAe,CAACC,YAA+B,EAAW;MACxD,OAAO,IAAAD,qBAAe,EAACC,YAAY,EAAE,IAAI,CAACP,OAAO,CAAC;IACpD;IAEAQ,uBAAuB,GAAY;MACjC,OAAO,IAAI,CAACF,eAAe,CAAC,MAAM,CAAC;IACrC;EAEF,CAAC;AAEH"}
+{"version":3,"file":"minimal.js","names":["_baseApi","require","_util","mixinMinimalOAuth","Base","TransactionManagerConstructor","OktaAuthOAuth","constructor","args","transactionManager","Object","assign","storageManager","options","token","createBaseTokenAPI","isLoginRedirect","isPKCE","pkce","hasResponseType","responseType","isAuthorizationCodeFlow"],"sources":["../../../../lib/oidc/mixin/minimal.ts"],"sourcesContent":["\nimport { OktaAuthConstructor } from '../../base/types';\nimport {\n  OAuthResponseType,\n  OAuthStorageManagerInterface,\n  OAuthTransactionMeta,\n  MinimalOktaOAuthInterface,\n  OktaAuthOAuthOptions,\n  PKCETransactionMeta,\n  BaseTokenAPI,\n  TransactionManagerInterface,\n  TransactionManagerConstructor,\n} from '../types';\nimport { createBaseTokenAPI } from '../factory/baseApi';\nimport { isLoginRedirect, hasResponseType } from '../util';\n\nimport { OktaAuthSessionInterface } from '../../session/types';\nexport function mixinMinimalOAuth\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TM extends TransactionManagerInterface = TransactionManagerInterface,\n  TBase extends OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n    = OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n>\n(\n  Base: TBase,\n  TransactionManagerConstructor: TransactionManagerConstructor<TM>,\n): TBase & OktaAuthConstructor<MinimalOktaOAuthInterface<M, S, O, TM>>\n{\n  return class OktaAuthOAuth extends Base implements MinimalOktaOAuthInterface<M, S, O, TM>\n  {\n    token: BaseTokenAPI;\n    transactionManager: TM;\n    \n    constructor(...args: any[]) {\n      super(...args);\n\n      this.transactionManager = new TransactionManagerConstructor(Object.assign({\n        storageManager: this.storageManager,\n      }, this.options.transactionManager));\n  \n      this.token = createBaseTokenAPI(this as any);\n    }\n\n    isLoginRedirect(): boolean {\n      return isLoginRedirect(this as any);\n    }\n\n    isPKCE(): boolean {\n      return !!this.options.pkce;\n    }\n\n    hasResponseType(responseType: OAuthResponseType): boolean {\n      return hasResponseType(responseType, this.options);\n    }\n\n    isAuthorizationCodeFlow(): boolean {\n      return this.hasResponseType('code');\n    }\n\n  };\n\n}\n"],"mappings":";;;AAaA,IAAAA,QAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AAGO,SAASE,iBAAiBA,CAU/BC,IAAW,EACXC,6BAAgE,EAElE;EACE,OAAO,MAAMC,aAAa,SAASF,IAAI,CACvC;IAIEG,WAAWA,CAAC,GAAGC,IAAW,EAAE;MAC1B,KAAK,CAAC,GAAGA,IAAI,CAAC;MAEd,IAAI,CAACC,kBAAkB,GAAG,IAAIJ,6BAA6B,CAACK,MAAM,CAACC,MAAM,CAAC;QACxEC,cAAc,EAAE,IAAI,CAACA;MACvB,CAAC,EAAE,IAAI,CAACC,OAAO,CAACJ,kBAAkB,CAAC,CAAC;MAEpC,IAAI,CAACK,KAAK,GAAG,IAAAC,2BAAkB,EAAC,IAAW,CAAC;IAC9C;IAEAC,eAAeA,CAAA,EAAY;MACzB,OAAO,IAAAA,qBAAe,EAAC,IAAW,CAAC;IACrC;IAEAC,MAAMA,CAAA,EAAY;MAChB,OAAO,CAAC,CAAC,IAAI,CAACJ,OAAO,CAACK,IAAI;IAC5B;IAEAC,eAAeA,CAACC,YAA+B,EAAW;MACxD,OAAO,IAAAD,qBAAe,EAACC,YAAY,EAAE,IAAI,CAACP,OAAO,CAAC;IACpD;IAEAQ,uBAAuBA,CAAA,EAAY;MACjC,OAAO,IAAI,CAACF,eAAe,CAAC,MAAM,CAAC;IACrC;EAEF,CAAC;AAEH","ignoreList":[]}

package/cjs/oidc/mixin/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","names":["provideOriginalUri","BaseClass","NodeOriginalUri","setOriginalUri","originalUri","state","options","sharedStorage","storageManager","getOriginalUriStorage","setItem","getOriginalUri","getItem","removeOriginalUri","removeItem"],"sources":["../../../../lib/oidc/mixin/node.ts"],"sourcesContent":["\nimport { OktaAuthStorageInterface } from '../../storage';\nimport { OktaAuthConstructor } from '../../base';\nimport {\n  OAuthStorageManagerInterface,\n  OAuthTransactionMeta,\n  OktaAuthOAuthOptions,\n  OriginalUriApi,\n  PKCETransactionMeta,\n} from '../types';\n\nexport function provideOriginalUri\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TBase extends OktaAuthConstructor<OktaAuthStorageInterface<S, O>>\n    = OktaAuthConstructor<OktaAuthStorageInterface<S, O>> \n>\n(BaseClass: TBase) //: TBase & OktaAuthConstructor<O, I & OriginalUriApi>\n{\n  return class NodeOriginalUri extends BaseClass implements OriginalUriApi {\n    setOriginalUri(originalUri: string, state?: string): void {\n      // to support multi-tab flows, set a state in constructor or pass as param\n      state = state || this.options.state;\n      if (state) {\n        const sharedStorage = this.storageManager.getOriginalUriStorage();\n        sharedStorage.setItem(state, originalUri);\n      }\n    }\n  \n    getOriginalUri(state?: string): string | undefined {\n      // Prefer shared storage (if state is available)\n      state = state || this.options.state;\n      if (state) {\n        const sharedStorage = this.storageManager.getOriginalUriStorage();\n        const originalUri = sharedStorage.getItem(state);\n        if (originalUri) {\n          return originalUri;\n        }\n      }\n    }\n  \n    removeOriginalUri(state?: string): void {\n      // remove from shared storage\n      state = state || this.options.state;\n      if (state) {\n        const sharedStorage = this.storageManager.getOriginalUriStorage();\n        sharedStorage.removeItem && sharedStorage.removeItem(state);\n      }\n    }\n  };\n}\n"],"mappings":";;;AAWO,SAASA,kBAAkB,CAQjCC,SAAgB;AAAE;AACnB;EACE,OAAO,MAAMC,eAAe,SAASD,SAAS,CAA2B;IACvEE,cAAc,CAACC,WAAmB,EAAEC,KAAc,EAAQ;MACxD;MACAA,KAAK,GAAGA,KAAK,IAAI,IAAI,CAACC,OAAO,CAACD,KAAK;MACnC,IAAIA,KAAK,EAAE;QACT,MAAME,aAAa,GAAG,IAAI,CAACC,cAAc,CAACC,qBAAqB,EAAE;QACjEF,aAAa,CAACG,OAAO,CAACL,KAAK,EAAED,WAAW,CAAC;MAC3C;IACF;IAEAO,cAAc,CAACN,KAAc,EAAsB;MACjD;MACAA,KAAK,GAAGA,KAAK,IAAI,IAAI,CAACC,OAAO,CAACD,KAAK;MACnC,IAAIA,KAAK,EAAE;QACT,MAAME,aAAa,GAAG,IAAI,CAACC,cAAc,CAACC,qBAAqB,EAAE;QACjE,MAAML,WAAW,GAAGG,aAAa,CAACK,OAAO,CAACP,KAAK,CAAC;QAChD,IAAID,WAAW,EAAE;UACf,OAAOA,WAAW;QACpB;MACF;IACF;IAEAS,iBAAiB,CAACR,KAAc,EAAQ;MACtC;MACAA,KAAK,GAAGA,KAAK,IAAI,IAAI,CAACC,OAAO,CAACD,KAAK;MACnC,IAAIA,KAAK,EAAE;QACT,MAAME,aAAa,GAAG,IAAI,CAACC,cAAc,CAACC,qBAAqB,EAAE;QACjEF,aAAa,CAACO,UAAU,IAAIP,aAAa,CAACO,UAAU,CAACT,KAAK,CAAC;MAC7D;IACF;EACF,CAAC;AACH"}
+{"version":3,"file":"node.js","names":["provideOriginalUri","BaseClass","NodeOriginalUri","setOriginalUri","originalUri","state","options","sharedStorage","storageManager","getOriginalUriStorage","setItem","getOriginalUri","getItem","removeOriginalUri","removeItem"],"sources":["../../../../lib/oidc/mixin/node.ts"],"sourcesContent":["\nimport { OktaAuthStorageInterface } from '../../storage';\nimport { OktaAuthConstructor } from '../../base';\nimport {\n  OAuthStorageManagerInterface,\n  OAuthTransactionMeta,\n  OktaAuthOAuthOptions,\n  OriginalUriApi,\n  PKCETransactionMeta,\n} from '../types';\n\nexport function provideOriginalUri\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TBase extends OktaAuthConstructor<OktaAuthStorageInterface<S, O>>\n    = OktaAuthConstructor<OktaAuthStorageInterface<S, O>> \n>\n(BaseClass: TBase) //: TBase & OktaAuthConstructor<O, I & OriginalUriApi>\n{\n  return class NodeOriginalUri extends BaseClass implements OriginalUriApi {\n    setOriginalUri(originalUri: string, state?: string): void {\n      // to support multi-tab flows, set a state in constructor or pass as param\n      state = state || this.options.state;\n      if (state) {\n        const sharedStorage = this.storageManager.getOriginalUriStorage();\n        sharedStorage.setItem(state, originalUri);\n      }\n    }\n  \n    getOriginalUri(state?: string): string | undefined {\n      // Prefer shared storage (if state is available)\n      state = state || this.options.state;\n      if (state) {\n        const sharedStorage = this.storageManager.getOriginalUriStorage();\n        const originalUri = sharedStorage.getItem(state);\n        if (originalUri) {\n          return originalUri;\n        }\n      }\n    }\n  \n    removeOriginalUri(state?: string): void {\n      // remove from shared storage\n      state = state || this.options.state;\n      if (state) {\n        const sharedStorage = this.storageManager.getOriginalUriStorage();\n        sharedStorage.removeItem && sharedStorage.removeItem(state);\n      }\n    }\n  };\n}\n"],"mappings":";;;AAWO,SAASA,kBAAkBA,CAQjCC,SAAgB;AAAE;AACnB;EACE,OAAO,MAAMC,eAAe,SAASD,SAAS,CAA2B;IACvEE,cAAcA,CAACC,WAAmB,EAAEC,KAAc,EAAQ;MACxD;MACAA,KAAK,GAAGA,KAAK,IAAI,IAAI,CAACC,OAAO,CAACD,KAAK;MACnC,IAAIA,KAAK,EAAE;QACT,MAAME,aAAa,GAAG,IAAI,CAACC,cAAc,CAACC,qBAAqB,CAAC,CAAC;QACjEF,aAAa,CAACG,OAAO,CAACL,KAAK,EAAED,WAAW,CAAC;MAC3C;IACF;IAEAO,cAAcA,CAACN,KAAc,EAAsB;MACjD;MACAA,KAAK,GAAGA,KAAK,IAAI,IAAI,CAACC,OAAO,CAACD,KAAK;MACnC,IAAIA,KAAK,EAAE;QACT,MAAME,aAAa,GAAG,IAAI,CAACC,cAAc,CAACC,qBAAqB,CAAC,CAAC;QACjE,MAAML,WAAW,GAAGG,aAAa,CAACK,OAAO,CAACP,KAAK,CAAC;QAChD,IAAID,WAAW,EAAE;UACf,OAAOA,WAAW;QACpB;MACF;IACF;IAEAS,iBAAiBA,CAACR,KAAc,EAAQ;MACtC;MACAA,KAAK,GAAGA,KAAK,IAAI,IAAI,CAACC,OAAO,CAACD,KAAK;MACnC,IAAIA,KAAK,EAAE;QACT,MAAME,aAAa,GAAG,IAAI,CAACC,cAAc,CAACC,qBAAqB,CAAC,CAAC;QACjEF,aAAa,CAACO,UAAU,IAAIP,aAAa,CAACO,UAAU,CAACT,KAAK,CAAC;MAC7D;IACF;EACF,CAAC;AACH","ignoreList":[]}

package/cjs/oidc/options/OAuthOptionsConstructor.js

@@ -69,7 +69,6 @@ function createOAuthOptionsConstructor() {
       if ((0, _features.isBrowser)()) {
         this.redirectUri = (0, _url.toAbsoluteUrl)(options.redirectUri, window.location.origin); // allow relative URIs
       }
-
       this.responseType = options.responseType;
       this.responseMode = options.responseMode;
       this.state = options.state;
@@ -85,6 +84,10 @@ function createOAuthOptionsConstructor() {
         allowBearerTokens: false,
         ...options.dpopOptions
       };
+
+      // backwards compatibility option - not recommended
+      this.decodeAccessTokens = options.decodeAccessTokens === true; // defaults to false
+
       this.tokenManager = options.tokenManager;
       this.postLogoutRedirectUri = options.postLogoutRedirectUri;
       this.restoreOriginalUri = options.restoreOriginalUri;

package/cjs/oidc/options/OAuthOptionsConstructor.js.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthOptionsConstructor.js","names":["assertValidConfig","args","scopes","Array","isArray","AuthSdkError","issuer","isUrlRegex","RegExp","test","indexOf","createOAuthOptionsConstructor","HttpOptionsConstructor","createHttpOptionsConstructor","OAuthOptionsConstructor","constructor","options","removeTrailingSlash","tokenUrl","authorizeUrl","userinfoUrl","revokeUrl","logoutUrl","pkce","clientId","redirectUri","isBrowser","toAbsoluteUrl","window","location","origin","responseType","responseMode","state","ignoreSignature","codeChallenge","codeChallengeMethod","acrValues","maxAge","dpop","dpopOptions","allowBearerTokens","tokenManager","postLogoutRedirectUri","restoreOriginalUri","transactionManager","enableSharedStorage","clientSecret","setLocation","ignoreLifetime","maxClockSkew","DEFAULT_MAX_CLOCK_SKEW"],"sources":["../../../../lib/oidc/options/OAuthOptionsConstructor.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { DEFAULT_MAX_CLOCK_SKEW } from '../../constants';\nimport { removeTrailingSlash, toAbsoluteUrl } from '../../util/url';\nimport { isBrowser } from '../../features';\nimport { createHttpOptionsConstructor } from '../../http/options';\nimport {\n  OAuthResponseMode,\n  OAuthResponseType,\n  OktaAuthOAuthInterface,\n  OktaAuthOAuthOptions,\n  SetLocationFunction,\n  TokenManagerOptions,\n  TransactionManagerOptions,\n  DPoPOptions\n} from '../types';\nimport { enableSharedStorage } from './node';\nimport AuthSdkError from '../../errors/AuthSdkError';\n\nfunction assertValidConfig(args) {\n  args = args || {};\n\n  var scopes = args.scopes;\n  if (scopes && !Array.isArray(scopes)) {\n    throw new AuthSdkError('scopes must be a array of strings. ' +\n      'Required usage: new OktaAuth({scopes: [\"openid\", \"email\"]})');\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  var issuer = args.issuer!;\n  if (!issuer) {\n    throw new AuthSdkError('No issuer passed to constructor. ' + \n      'Required usage: new OktaAuth({issuer: \"https://{yourOktaDomain}.com/oauth2/{authServerId}\"})');\n  }\n\n  var isUrlRegex = new RegExp('^http?s?://.+');\n  if (!isUrlRegex.test(issuer)) {\n    throw new AuthSdkError('Issuer must be a valid URL. ' + \n      'Required usage: new OktaAuth({issuer: \"https://{yourOktaDomain}.com/oauth2/{authServerId}\"})');\n  }\n\n  if (issuer.indexOf('-admin.okta') !== -1) {\n    throw new AuthSdkError('Issuer URL passed to constructor contains \"-admin\" in subdomain. ' +\n      'Required usage: new OktaAuth({issuer: \"https://{yourOktaDomain}.com})');\n  }\n}\n\nexport function createOAuthOptionsConstructor() {\n  const HttpOptionsConstructor = createHttpOptionsConstructor();\n  return class OAuthOptionsConstructor\n    extends HttpOptionsConstructor\n    implements Required<OktaAuthOAuthOptions>\n  {\n    // CustomUrls\n    issuer: string;\n    authorizeUrl: string;\n    userinfoUrl: string;\n    tokenUrl: string;\n    revokeUrl: string;\n    logoutUrl: string;\n    \n    // TokenParams\n    pkce: boolean;\n    clientId: string;\n    redirectUri: string;\n    responseType: OAuthResponseType | OAuthResponseType[];\n    responseMode: OAuthResponseMode;\n    state: string;\n    scopes: string[];\n    ignoreSignature: boolean;\n    codeChallenge: string;\n    codeChallengeMethod: string;\n    acrValues: string;\n    maxAge: string | number;\n    dpop: boolean;\n    dpopOptions: DPoPOptions;\n\n    // Additional options\n    tokenManager: TokenManagerOptions;\n    postLogoutRedirectUri: string;\n    restoreOriginalUri: (oktaAuth: OktaAuthOAuthInterface, originalUri?: string) => Promise<void>;\n    transactionManager: TransactionManagerOptions;\n\n    // For server-side web applications ONLY!\n    clientSecret: string;\n    setLocation: SetLocationFunction;\n\n    // Workaround for bad client time/clock\n    ignoreLifetime: boolean;\n    maxClockSkew: number;\n\n\n    // eslint-disable-next-line max-statements\n    constructor(options: any) {\n      super(options);\n      \n      assertValidConfig(options);\n      \n      this.issuer = removeTrailingSlash(options.issuer);\n      this.tokenUrl = removeTrailingSlash(options.tokenUrl);\n      this.authorizeUrl = removeTrailingSlash(options.authorizeUrl);\n      this.userinfoUrl = removeTrailingSlash(options.userinfoUrl);\n      this.revokeUrl = removeTrailingSlash(options.revokeUrl);\n      this.logoutUrl = removeTrailingSlash(options.logoutUrl);\n\n      this.pkce = options.pkce === false ? false : true; // PKCE defaults to true\n      this.clientId = options.clientId;\n      this.redirectUri = options.redirectUri;\n      if (isBrowser()) {\n        this.redirectUri = toAbsoluteUrl(options.redirectUri, window.location.origin); // allow relative URIs\n      }\n      this.responseType = options.responseType;\n      this.responseMode = options.responseMode;\n      this.state = options.state;\n      this.scopes = options.scopes;\n      // Give the developer the ability to disable token signature validation.\n      this.ignoreSignature = !!options.ignoreSignature;\n      this.codeChallenge = options.codeChallenge;\n      this.codeChallengeMethod = options.codeChallengeMethod;\n      this.acrValues = options.acrValues;\n      this.maxAge = options.maxAge;\n      this.dpop = options.dpop === true; // dpop defaults to false\n      this.dpopOptions = {\n        allowBearerTokens: false,\n        ...options.dpopOptions,\n      };\n\n      this.tokenManager = options.tokenManager;\n      this.postLogoutRedirectUri = options.postLogoutRedirectUri;\n      this.restoreOriginalUri = options.restoreOriginalUri;\n      this.transactionManager = { enableSharedStorage, ...options.transactionManager };\n      \n      this.clientSecret = options.clientSecret;\n      this.setLocation = options.setLocation;\n      \n      // As some end user's devices can have their date \n      // and time incorrectly set, allow for the disabling\n      // of the jwt liftetime validation\n      this.ignoreLifetime = !!options.ignoreLifetime;\n\n      // Digital clocks will drift over time, so the server\n      // can misalign with the time reported by the browser.\n      // The maxClockSkew allows relaxing the time-based\n      // validation of tokens (in seconds, not milliseconds).\n      // It currently defaults to 300, because 5 min is the\n      // default maximum tolerance allowed by Kerberos.\n      // (https://technet.microsoft.com/en-us/library/cc976357.aspx)\n      if (!options.maxClockSkew && options.maxClockSkew !== 0) {\n        this.maxClockSkew = DEFAULT_MAX_CLOCK_SKEW;\n      } else {\n        this.maxClockSkew = options.maxClockSkew;\n      }\n\n    }\n  };\n}\n"],"mappings":";;;;AAYA;AACA;AACA;AACA;AAWA;AACA;AA3BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAmBA,SAASA,iBAAiB,CAACC,IAAI,EAAE;EAC/BA,IAAI,GAAGA,IAAI,IAAI,CAAC,CAAC;EAEjB,IAAIC,MAAM,GAAGD,IAAI,CAACC,MAAM;EACxB,IAAIA,MAAM,IAAI,CAACC,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;IACpC,MAAM,IAAIG,qBAAY,CAAC,qCAAqC,GAC1D,6DAA6D,CAAC;EAClE;;EAEA;EACA,IAAIC,MAAM,GAAGL,IAAI,CAACK,MAAO;EACzB,IAAI,CAACA,MAAM,EAAE;IACX,MAAM,IAAID,qBAAY,CAAC,mCAAmC,GACxD,8FAA8F,CAAC;EACnG;EAEA,IAAIE,UAAU,GAAG,IAAIC,MAAM,CAAC,eAAe,CAAC;EAC5C,IAAI,CAACD,UAAU,CAACE,IAAI,CAACH,MAAM,CAAC,EAAE;IAC5B,MAAM,IAAID,qBAAY,CAAC,8BAA8B,GACnD,8FAA8F,CAAC;EACnG;EAEA,IAAIC,MAAM,CAACI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE;IACxC,MAAM,IAAIL,qBAAY,CAAC,mEAAmE,GACxF,uEAAuE,CAAC;EAC5E;AACF;AAEO,SAASM,6BAA6B,GAAG;EAC9C,MAAMC,sBAAsB,GAAG,IAAAC,qCAA4B,GAAE;EAC7D,OAAO,MAAMC,uBAAuB,SAC1BF,sBAAsB,CAEhC;IACE;;IAQA;;IAgBA;;IAMA;;IAIA;;IAKA;IACAG,WAAW,CAACC,OAAY,EAAE;MACxB,KAAK,CAACA,OAAO,CAAC;MAEdhB,iBAAiB,CAACgB,OAAO,CAAC;MAE1B,IAAI,CAACV,MAAM,GAAG,IAAAW,wBAAmB,EAACD,OAAO,CAACV,MAAM,CAAC;MACjD,IAAI,CAACY,QAAQ,GAAG,IAAAD,wBAAmB,EAACD,OAAO,CAACE,QAAQ,CAAC;MACrD,IAAI,CAACC,YAAY,GAAG,IAAAF,wBAAmB,EAACD,OAAO,CAACG,YAAY,CAAC;MAC7D,IAAI,CAACC,WAAW,GAAG,IAAAH,wBAAmB,EAACD,OAAO,CAACI,WAAW,CAAC;MAC3D,IAAI,CAACC,SAAS,GAAG,IAAAJ,wBAAmB,EAACD,OAAO,CAACK,SAAS,CAAC;MACvD,IAAI,CAACC,SAAS,GAAG,IAAAL,wBAAmB,EAACD,OAAO,CAACM,SAAS,CAAC;MAEvD,IAAI,CAACC,IAAI,GAAGP,OAAO,CAACO,IAAI,KAAK,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;MACnD,IAAI,CAACC,QAAQ,GAAGR,OAAO,CAACQ,QAAQ;MAChC,IAAI,CAACC,WAAW,GAAGT,OAAO,CAACS,WAAW;MACtC,IAAI,IAAAC,mBAAS,GAAE,EAAE;QACf,IAAI,CAACD,WAAW,GAAG,IAAAE,kBAAa,EAACX,OAAO,CAACS,WAAW,EAAEG,MAAM,CAACC,QAAQ,CAACC,MAAM,CAAC,CAAC,CAAC;MACjF;;MACA,IAAI,CAACC,YAAY,GAAGf,OAAO,CAACe,YAAY;MACxC,IAAI,CAACC,YAAY,GAAGhB,OAAO,CAACgB,YAAY;MACxC,IAAI,CAACC,KAAK,GAAGjB,OAAO,CAACiB,KAAK;MAC1B,IAAI,CAAC/B,MAAM,GAAGc,OAAO,CAACd,MAAM;MAC5B;MACA,IAAI,CAACgC,eAAe,GAAG,CAAC,CAAClB,OAAO,CAACkB,eAAe;MAChD,IAAI,CAACC,aAAa,GAAGnB,OAAO,CAACmB,aAAa;MAC1C,IAAI,CAACC,mBAAmB,GAAGpB,OAAO,CAACoB,mBAAmB;MACtD,IAAI,CAACC,SAAS,GAAGrB,OAAO,CAACqB,SAAS;MAClC,IAAI,CAACC,MAAM,GAAGtB,OAAO,CAACsB,MAAM;MAC5B,IAAI,CAACC,IAAI,GAAGvB,OAAO,CAACuB,IAAI,KAAK,IAAI,CAAC,CAAC;MACnC,IAAI,CAACC,WAAW,GAAG;QACjBC,iBAAiB,EAAE,KAAK;QACxB,GAAGzB,OAAO,CAACwB;MACb,CAAC;MAED,IAAI,CAACE,YAAY,GAAG1B,OAAO,CAAC0B,YAAY;MACxC,IAAI,CAACC,qBAAqB,GAAG3B,OAAO,CAAC2B,qBAAqB;MAC1D,IAAI,CAACC,kBAAkB,GAAG5B,OAAO,CAAC4B,kBAAkB;MACpD,IAAI,CAACC,kBAAkB,GAAG;QAAEC,mBAAmB,EAAnBA,yBAAmB;QAAE,GAAG9B,OAAO,CAAC6B;MAAmB,CAAC;MAEhF,IAAI,CAACE,YAAY,GAAG/B,OAAO,CAAC+B,YAAY;MACxC,IAAI,CAACC,WAAW,GAAGhC,OAAO,CAACgC,WAAW;;MAEtC;MACA;MACA;MACA,IAAI,CAACC,cAAc,GAAG,CAAC,CAACjC,OAAO,CAACiC,cAAc;;MAE9C;MACA;MACA;MACA;MACA;MACA;MACA;MACA,IAAI,CAACjC,OAAO,CAACkC,YAAY,IAAIlC,OAAO,CAACkC,YAAY,KAAK,CAAC,EAAE;QACvD,IAAI,CAACA,YAAY,GAAGC,iCAAsB;MAC5C,CAAC,MAAM;QACL,IAAI,CAACD,YAAY,GAAGlC,OAAO,CAACkC,YAAY;MAC1C;IAEF;EACF,CAAC;AACH"}
+{"version":3,"file":"OAuthOptionsConstructor.js","names":["_constants","require","_url","_features","_options","_node","_AuthSdkError","_interopRequireDefault","assertValidConfig","args","scopes","Array","isArray","AuthSdkError","issuer","isUrlRegex","RegExp","test","indexOf","createOAuthOptionsConstructor","HttpOptionsConstructor","createHttpOptionsConstructor","OAuthOptionsConstructor","constructor","options","removeTrailingSlash","tokenUrl","authorizeUrl","userinfoUrl","revokeUrl","logoutUrl","pkce","clientId","redirectUri","isBrowser","toAbsoluteUrl","window","location","origin","responseType","responseMode","state","ignoreSignature","codeChallenge","codeChallengeMethod","acrValues","maxAge","dpop","dpopOptions","allowBearerTokens","decodeAccessTokens","tokenManager","postLogoutRedirectUri","restoreOriginalUri","transactionManager","enableSharedStorage","clientSecret","setLocation","ignoreLifetime","maxClockSkew","DEFAULT_MAX_CLOCK_SKEW"],"sources":["../../../../lib/oidc/options/OAuthOptionsConstructor.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { DEFAULT_MAX_CLOCK_SKEW } from '../../constants';\nimport { removeTrailingSlash, toAbsoluteUrl } from '../../util/url';\nimport { isBrowser } from '../../features';\nimport { createHttpOptionsConstructor } from '../../http/options';\nimport {\n  OAuthResponseMode,\n  OAuthResponseType,\n  OktaAuthOAuthInterface,\n  OktaAuthOAuthOptions,\n  SetLocationFunction,\n  TokenManagerOptions,\n  TransactionManagerOptions,\n  DPoPOptions\n} from '../types';\nimport { enableSharedStorage } from './node';\nimport AuthSdkError from '../../errors/AuthSdkError';\n\nfunction assertValidConfig(args) {\n  args = args || {};\n\n  var scopes = args.scopes;\n  if (scopes && !Array.isArray(scopes)) {\n    throw new AuthSdkError('scopes must be a array of strings. ' +\n      'Required usage: new OktaAuth({scopes: [\"openid\", \"email\"]})');\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  var issuer = args.issuer!;\n  if (!issuer) {\n    throw new AuthSdkError('No issuer passed to constructor. ' + \n      'Required usage: new OktaAuth({issuer: \"https://{yourOktaDomain}.com/oauth2/{authServerId}\"})');\n  }\n\n  var isUrlRegex = new RegExp('^http?s?://.+');\n  if (!isUrlRegex.test(issuer)) {\n    throw new AuthSdkError('Issuer must be a valid URL. ' + \n      'Required usage: new OktaAuth({issuer: \"https://{yourOktaDomain}.com/oauth2/{authServerId}\"})');\n  }\n\n  if (issuer.indexOf('-admin.okta') !== -1) {\n    throw new AuthSdkError('Issuer URL passed to constructor contains \"-admin\" in subdomain. ' +\n      'Required usage: new OktaAuth({issuer: \"https://{yourOktaDomain}.com})');\n  }\n}\n\nexport function createOAuthOptionsConstructor() {\n  const HttpOptionsConstructor = createHttpOptionsConstructor();\n  return class OAuthOptionsConstructor\n    extends HttpOptionsConstructor\n    implements Required<OktaAuthOAuthOptions>\n  {\n    // CustomUrls\n    issuer: string;\n    authorizeUrl: string;\n    userinfoUrl: string;\n    tokenUrl: string;\n    revokeUrl: string;\n    logoutUrl: string;\n    \n    // TokenParams\n    pkce: boolean;\n    clientId: string;\n    redirectUri: string;\n    responseType: OAuthResponseType | OAuthResponseType[];\n    responseMode: OAuthResponseMode;\n    state: string;\n    scopes: string[];\n    ignoreSignature: boolean;\n    codeChallenge: string;\n    codeChallengeMethod: string;\n    acrValues: string;\n    maxAge: string | number;\n    dpop: boolean;\n    dpopOptions: DPoPOptions;\n\n    decodeAccessTokens: boolean;\n\n    // Additional options\n    tokenManager: TokenManagerOptions;\n    postLogoutRedirectUri: string;\n    restoreOriginalUri: (oktaAuth: OktaAuthOAuthInterface, originalUri?: string) => Promise<void>;\n    transactionManager: TransactionManagerOptions;\n\n    // For server-side web applications ONLY!\n    clientSecret: string;\n    setLocation: SetLocationFunction;\n\n    // Workaround for bad client time/clock\n    ignoreLifetime: boolean;\n    maxClockSkew: number;\n\n\n    // eslint-disable-next-line max-statements\n    constructor(options: any) {\n      super(options);\n      \n      assertValidConfig(options);\n      \n      this.issuer = removeTrailingSlash(options.issuer);\n      this.tokenUrl = removeTrailingSlash(options.tokenUrl);\n      this.authorizeUrl = removeTrailingSlash(options.authorizeUrl);\n      this.userinfoUrl = removeTrailingSlash(options.userinfoUrl);\n      this.revokeUrl = removeTrailingSlash(options.revokeUrl);\n      this.logoutUrl = removeTrailingSlash(options.logoutUrl);\n\n      this.pkce = options.pkce === false ? false : true; // PKCE defaults to true\n      this.clientId = options.clientId;\n      this.redirectUri = options.redirectUri;\n      if (isBrowser()) {\n        this.redirectUri = toAbsoluteUrl(options.redirectUri, window.location.origin); // allow relative URIs\n      }\n      this.responseType = options.responseType;\n      this.responseMode = options.responseMode;\n      this.state = options.state;\n      this.scopes = options.scopes;\n      // Give the developer the ability to disable token signature validation.\n      this.ignoreSignature = !!options.ignoreSignature;\n      this.codeChallenge = options.codeChallenge;\n      this.codeChallengeMethod = options.codeChallengeMethod;\n      this.acrValues = options.acrValues;\n      this.maxAge = options.maxAge;\n      this.dpop = options.dpop === true; // dpop defaults to false\n      this.dpopOptions = {\n        allowBearerTokens: false,\n        ...options.dpopOptions,\n      };\n\n      // backwards compatibility option - not recommended\n      this.decodeAccessTokens = options.decodeAccessTokens === true;   // defaults to false\n\n      this.tokenManager = options.tokenManager;\n      this.postLogoutRedirectUri = options.postLogoutRedirectUri;\n      this.restoreOriginalUri = options.restoreOriginalUri;\n      this.transactionManager = { enableSharedStorage, ...options.transactionManager };\n      \n      this.clientSecret = options.clientSecret;\n      this.setLocation = options.setLocation;\n      \n      // As some end user's devices can have their date \n      // and time incorrectly set, allow for the disabling\n      // of the jwt liftetime validation\n      this.ignoreLifetime = !!options.ignoreLifetime;\n\n      // Digital clocks will drift over time, so the server\n      // can misalign with the time reported by the browser.\n      // The maxClockSkew allows relaxing the time-based\n      // validation of tokens (in seconds, not milliseconds).\n      // It currently defaults to 300, because 5 min is the\n      // default maximum tolerance allowed by Kerberos.\n      // (https://technet.microsoft.com/en-us/library/cc976357.aspx)\n      if (!options.maxClockSkew && options.maxClockSkew !== 0) {\n        this.maxClockSkew = DEFAULT_MAX_CLOCK_SKEW;\n      } else {\n        this.maxClockSkew = options.maxClockSkew;\n      }\n\n    }\n  };\n}\n"],"mappings":";;;;AAYA,IAAAA,UAAA,GAAAC,OAAA;AACA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,SAAA,GAAAF,OAAA;AACA,IAAAG,QAAA,GAAAH,OAAA;AAWA,IAAAI,KAAA,GAAAJ,OAAA;AACA,IAAAK,aAAA,GAAAC,sBAAA,CAAAN,OAAA;AA3BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAmBA,SAASO,iBAAiBA,CAACC,IAAI,EAAE;EAC/BA,IAAI,GAAGA,IAAI,IAAI,CAAC,CAAC;EAEjB,IAAIC,MAAM,GAAGD,IAAI,CAACC,MAAM;EACxB,IAAIA,MAAM,IAAI,CAACC,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;IACpC,MAAM,IAAIG,qBAAY,CAAC,qCAAqC,GAC1D,6DAA6D,CAAC;EAClE;;EAEA;EACA,IAAIC,MAAM,GAAGL,IAAI,CAACK,MAAO;EACzB,IAAI,CAACA,MAAM,EAAE;IACX,MAAM,IAAID,qBAAY,CAAC,mCAAmC,GACxD,8FAA8F,CAAC;EACnG;EAEA,IAAIE,UAAU,GAAG,IAAIC,MAAM,CAAC,eAAe,CAAC;EAC5C,IAAI,CAACD,UAAU,CAACE,IAAI,CAACH,MAAM,CAAC,EAAE;IAC5B,MAAM,IAAID,qBAAY,CAAC,8BAA8B,GACnD,8FAA8F,CAAC;EACnG;EAEA,IAAIC,MAAM,CAACI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE;IACxC,MAAM,IAAIL,qBAAY,CAAC,mEAAmE,GACxF,uEAAuE,CAAC;EAC5E;AACF;AAEO,SAASM,6BAA6BA,CAAA,EAAG;EAC9C,MAAMC,sBAAsB,GAAG,IAAAC,qCAA4B,EAAC,CAAC;EAC7D,OAAO,MAAMC,uBAAuB,SAC1BF,sBAAsB,CAEhC;IACE;;IAQA;;IAkBA;;IAMA;;IAIA;;IAKA;IACAG,WAAWA,CAACC,OAAY,EAAE;MACxB,KAAK,CAACA,OAAO,CAAC;MAEdhB,iBAAiB,CAACgB,OAAO,CAAC;MAE1B,IAAI,CAACV,MAAM,GAAG,IAAAW,wBAAmB,EAACD,OAAO,CAACV,MAAM,CAAC;MACjD,IAAI,CAACY,QAAQ,GAAG,IAAAD,wBAAmB,EAACD,OAAO,CAACE,QAAQ,CAAC;MACrD,IAAI,CAACC,YAAY,GAAG,IAAAF,wBAAmB,EAACD,OAAO,CAACG,YAAY,CAAC;MAC7D,IAAI,CAACC,WAAW,GAAG,IAAAH,wBAAmB,EAACD,OAAO,CAACI,WAAW,CAAC;MAC3D,IAAI,CAACC,SAAS,GAAG,IAAAJ,wBAAmB,EAACD,OAAO,CAACK,SAAS,CAAC;MACvD,IAAI,CAACC,SAAS,GAAG,IAAAL,wBAAmB,EAACD,OAAO,CAACM,SAAS,CAAC;MAEvD,IAAI,CAACC,IAAI,GAAGP,OAAO,CAACO,IAAI,KAAK,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;MACnD,IAAI,CAACC,QAAQ,GAAGR,OAAO,CAACQ,QAAQ;MAChC,IAAI,CAACC,WAAW,GAAGT,OAAO,CAACS,WAAW;MACtC,IAAI,IAAAC,mBAAS,EAAC,CAAC,EAAE;QACf,IAAI,CAACD,WAAW,GAAG,IAAAE,kBAAa,EAACX,OAAO,CAACS,WAAW,EAAEG,MAAM,CAACC,QAAQ,CAACC,MAAM,CAAC,CAAC,CAAC;MACjF;MACA,IAAI,CAACC,YAAY,GAAGf,OAAO,CAACe,YAAY;MACxC,IAAI,CAACC,YAAY,GAAGhB,OAAO,CAACgB,YAAY;MACxC,IAAI,CAACC,KAAK,GAAGjB,OAAO,CAACiB,KAAK;MAC1B,IAAI,CAAC/B,MAAM,GAAGc,OAAO,CAACd,MAAM;MAC5B;MACA,IAAI,CAACgC,eAAe,GAAG,CAAC,CAAClB,OAAO,CAACkB,eAAe;MAChD,IAAI,CAACC,aAAa,GAAGnB,OAAO,CAACmB,aAAa;MAC1C,IAAI,CAACC,mBAAmB,GAAGpB,OAAO,CAACoB,mBAAmB;MACtD,IAAI,CAACC,SAAS,GAAGrB,OAAO,CAACqB,SAAS;MAClC,IAAI,CAACC,MAAM,GAAGtB,OAAO,CAACsB,MAAM;MAC5B,IAAI,CAACC,IAAI,GAAGvB,OAAO,CAACuB,IAAI,KAAK,IAAI,CAAC,CAAC;MACnC,IAAI,CAACC,WAAW,GAAG;QACjBC,iBAAiB,EAAE,KAAK;QACxB,GAAGzB,OAAO,CAACwB;MACb,CAAC;;MAED;MACA,IAAI,CAACE,kBAAkB,GAAG1B,OAAO,CAAC0B,kBAAkB,KAAK,IAAI,CAAC,CAAG;;MAEjE,IAAI,CAACC,YAAY,GAAG3B,OAAO,CAAC2B,YAAY;MACxC,IAAI,CAACC,qBAAqB,GAAG5B,OAAO,CAAC4B,qBAAqB;MAC1D,IAAI,CAACC,kBAAkB,GAAG7B,OAAO,CAAC6B,kBAAkB;MACpD,IAAI,CAACC,kBAAkB,GAAG;QAAEC,mBAAmB,EAAnBA,yBAAmB;QAAE,GAAG/B,OAAO,CAAC8B;MAAmB,CAAC;MAEhF,IAAI,CAACE,YAAY,GAAGhC,OAAO,CAACgC,YAAY;MACxC,IAAI,CAACC,WAAW,GAAGjC,OAAO,CAACiC,WAAW;;MAEtC;MACA;MACA;MACA,IAAI,CAACC,cAAc,GAAG,CAAC,CAAClC,OAAO,CAACkC,cAAc;;MAE9C;MACA;MACA;MACA;MACA;MACA;MACA;MACA,IAAI,CAAClC,OAAO,CAACmC,YAAY,IAAInC,OAAO,CAACmC,YAAY,KAAK,CAAC,EAAE;QACvD,IAAI,CAACA,YAAY,GAAGC,iCAAsB;MAC5C,CAAC,MAAM;QACL,IAAI,CAACD,YAAY,GAAGnC,OAAO,CAACmC,YAAY;MAC1C;IAEF;EACF,CAAC;AACH","ignoreList":[]}

package/cjs/oidc/options/browser.js

@@ -1,6 +1,5 @@
 "use strict";
 
 exports.enableSharedStorage = void 0;
-const enableSharedStorage = true;
-exports.enableSharedStorage = enableSharedStorage;
+const enableSharedStorage = exports.enableSharedStorage = true;
 //# sourceMappingURL=browser.js.map

package/cjs/oidc/options/browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser.js","names":["enableSharedStorage"],"sources":["../../../../lib/oidc/options/browser.ts"],"sourcesContent":["export const enableSharedStorage = true;\n"],"mappings":";;;AAAO,MAAMA,mBAAmB,GAAG,IAAI;AAAC"}
+{"version":3,"file":"browser.js","names":["enableSharedStorage","exports"],"sources":["../../../../lib/oidc/options/browser.ts"],"sourcesContent":["export const enableSharedStorage = true;\n"],"mappings":";;;AAAO,MAAMA,mBAAmB,GAAAC,OAAA,CAAAD,mBAAA,GAAG,IAAI","ignoreList":[]}

package/cjs/oidc/options/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../lib/oidc/options/index.ts"],"sourcesContent":["export * from './OAuthOptionsConstructor';\n"],"mappings":";;AAAA;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}
+{"version":3,"file":"index.js","names":["_OAuthOptionsConstructor","require","Object","keys","forEach","key","exports","defineProperty","enumerable","get"],"sources":["../../../../lib/oidc/options/index.ts"],"sourcesContent":["export * from './OAuthOptionsConstructor';\n"],"mappings":";;AAAA,IAAAA,wBAAA,GAAAC,OAAA;AAAAC,MAAA,CAAAC,IAAA,CAAAH,wBAAA,EAAAI,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAL,wBAAA,CAAAK,GAAA;EAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA;IAAAG,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAT,wBAAA,CAAAK,GAAA;IAAA;EAAA;AAAA","ignoreList":[]}

package/cjs/oidc/options/node.js

@@ -1,6 +1,5 @@
 "use strict";
 
 exports.enableSharedStorage = void 0;
-const enableSharedStorage = false;
-exports.enableSharedStorage = enableSharedStorage;
+const enableSharedStorage = exports.enableSharedStorage = false;
 //# sourceMappingURL=node.js.map

package/cjs/oidc/options/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","names":["enableSharedStorage"],"sources":["../../../../lib/oidc/options/node.ts"],"sourcesContent":["\nexport const enableSharedStorage = false;\n"],"mappings":";;;AACO,MAAMA,mBAAmB,GAAG,KAAK;AAAC"}
+{"version":3,"file":"node.js","names":["enableSharedStorage","exports"],"sources":["../../../../lib/oidc/options/node.ts"],"sourcesContent":["\nexport const enableSharedStorage = false;\n"],"mappings":";;;AACO,MAAMA,mBAAmB,GAAAC,OAAA,CAAAD,mBAAA,GAAG,KAAK","ignoreList":[]}

package/cjs/oidc/parseFromUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"parseFromUrl.js","names":["removeHash","sdk","nativeHistory","token","parseFromUrl","_getHistory","nativeDoc","_getDocument","nativeLoc","_getLocation","replaceState","title","pathname","search","hash","removeSearch","getResponseMode","defaultResponseMode","options","pkce","responseMode","parseOAuthResponseFromUrl","isString","url","paramStr","substring","indexOf","AuthSdkError","urlParamsToObject","cleanOAuthResponseFromUrl","res","state","oauthParams","transactionManager","load","undefined","urls","handleOAuthResponse","catch","err","isInteractionRequiredError","clear","then"],"sources":["../../../lib/oidc/parseFromUrl.ts"],"sourcesContent":["/* eslint-disable complexity */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { isInteractionRequiredError, urlParamsToObject } from './util';\nimport {\n  ParseFromUrlOptions,\n  TokenResponse,\n  CustomUrls,\n  TransactionMeta,\n  OAuthResponse\n} from './types';\nimport { isString } from '../util';\nimport { handleOAuthResponse } from './handleOAuthResponse';\n\nfunction removeHash(sdk) {\n  var nativeHistory = sdk.token.parseFromUrl._getHistory();\n  var nativeDoc = sdk.token.parseFromUrl._getDocument();\n  var nativeLoc = sdk.token.parseFromUrl._getLocation();\n  if (nativeHistory && nativeHistory.replaceState) {\n    nativeHistory.replaceState(null, nativeDoc.title, nativeLoc.pathname + nativeLoc.search);\n  } else {\n    nativeLoc.hash = '';\n  }\n}\n\nfunction removeSearch(sdk) {\n  var nativeHistory = sdk.token.parseFromUrl._getHistory();\n  var nativeDoc = sdk.token.parseFromUrl._getDocument();\n  var nativeLoc = sdk.token.parseFromUrl._getLocation();\n  if (nativeHistory && nativeHistory.replaceState) {\n    nativeHistory.replaceState(null, nativeDoc.title, nativeLoc.pathname + nativeLoc.hash);\n  } else {\n    nativeLoc.search = '';\n  }\n}\n\nexport function getResponseMode(sdk): 'query' | 'fragment' {\n  // https://openid.net/specs/openid-connect-core-1_0.html#Authentication\n  var defaultResponseMode = sdk.options.pkce ? 'query' : 'fragment';\n  var responseMode = sdk.options.responseMode || defaultResponseMode;\n  return responseMode;\n}\n\nexport function parseOAuthResponseFromUrl(sdk, options: string | ParseFromUrlOptions): OAuthResponse {\n  options = options || {};\n  if (isString(options)) {\n    options = { url: options } as ParseFromUrlOptions;\n  } else {\n    options = options as ParseFromUrlOptions;\n  }\n\n  var url = options.url;\n  var responseMode = options.responseMode || getResponseMode(sdk);\n  var nativeLoc = sdk.token.parseFromUrl._getLocation();\n  var paramStr;\n\n  if (responseMode === 'query') {\n    paramStr = url ? url.substring(url.indexOf('?')) : nativeLoc.search;\n  } else {\n    paramStr = url ? url.substring(url.indexOf('#')) : nativeLoc.hash;\n  }\n\n  if (!paramStr) {\n    throw new AuthSdkError('Unable to parse a token from the url');\n  }\n\n  return urlParamsToObject(paramStr);\n}\n\nexport function cleanOAuthResponseFromUrl(sdk, options: ParseFromUrlOptions) {\n  // Clean hash or search from the url\n  const responseMode = options.responseMode || getResponseMode(sdk);\n  responseMode === 'query' ? removeSearch(sdk) : removeHash(sdk);\n}\n\nexport async function parseFromUrl(sdk, options?: string | ParseFromUrlOptions): Promise<TokenResponse> {\n  options = options || {};\n  if (isString(options)) {\n    options = { url: options } as ParseFromUrlOptions;\n  } else {\n    options = options as ParseFromUrlOptions;\n  }\n\n  const res: OAuthResponse = parseOAuthResponseFromUrl(sdk, options);\n  const state = res.state;\n  const oauthParams: TransactionMeta = sdk.transactionManager.load({\n    state\n  });\n  if (!oauthParams) {\n    if (sdk.options.pkce) {\n      // eslint-disable-next-line max-len\n      throw new AuthSdkError('Could not load PKCE codeVerifier from storage. This may indicate the auth flow has already completed or multiple auth flows are executing concurrently.', undefined);\n    }\n    throw new AuthSdkError('Unable to retrieve OAuth redirect params from storage');\n  }\n  const urls: CustomUrls = oauthParams.urls as CustomUrls;\n  delete oauthParams.urls;\n\n  if (!options.url) {\n    // Clean hash or search from the url\n    cleanOAuthResponseFromUrl(sdk, options);\n  }\n\n  return handleOAuthResponse(sdk, oauthParams, res, urls)\n    .catch(err => {\n      if (!isInteractionRequiredError(err)) {\n        sdk.transactionManager.clear({\n          state\n        });\n      }\n      throw err;\n    })\n    .then(res => {\n      sdk.transactionManager.clear({\n        state\n      });\n      return res;\n    });\n\n}\n"],"mappings":";;;;;;AAaA;AACA;AAQA;AACA;AAvBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAaA,SAASA,UAAU,CAACC,GAAG,EAAE;EACvB,IAAIC,aAAa,GAAGD,GAAG,CAACE,KAAK,CAACC,YAAY,CAACC,WAAW,EAAE;EACxD,IAAIC,SAAS,GAAGL,GAAG,CAACE,KAAK,CAACC,YAAY,CAACG,YAAY,EAAE;EACrD,IAAIC,SAAS,GAAGP,GAAG,CAACE,KAAK,CAACC,YAAY,CAACK,YAAY,EAAE;EACrD,IAAIP,aAAa,IAAIA,aAAa,CAACQ,YAAY,EAAE;IAC/CR,aAAa,CAACQ,YAAY,CAAC,IAAI,EAAEJ,SAAS,CAACK,KAAK,EAAEH,SAAS,CAACI,QAAQ,GAAGJ,SAAS,CAACK,MAAM,CAAC;EAC1F,CAAC,MAAM;IACLL,SAAS,CAACM,IAAI,GAAG,EAAE;EACrB;AACF;AAEA,SAASC,YAAY,CAACd,GAAG,EAAE;EACzB,IAAIC,aAAa,GAAGD,GAAG,CAACE,KAAK,CAACC,YAAY,CAACC,WAAW,EAAE;EACxD,IAAIC,SAAS,GAAGL,GAAG,CAACE,KAAK,CAACC,YAAY,CAACG,YAAY,EAAE;EACrD,IAAIC,SAAS,GAAGP,GAAG,CAACE,KAAK,CAACC,YAAY,CAACK,YAAY,EAAE;EACrD,IAAIP,aAAa,IAAIA,aAAa,CAACQ,YAAY,EAAE;IAC/CR,aAAa,CAACQ,YAAY,CAAC,IAAI,EAAEJ,SAAS,CAACK,KAAK,EAAEH,SAAS,CAACI,QAAQ,GAAGJ,SAAS,CAACM,IAAI,CAAC;EACxF,CAAC,MAAM;IACLN,SAAS,CAACK,MAAM,GAAG,EAAE;EACvB;AACF;AAEO,SAASG,eAAe,CAACf,GAAG,EAAwB;EACzD;EACA,IAAIgB,mBAAmB,GAAGhB,GAAG,CAACiB,OAAO,CAACC,IAAI,GAAG,OAAO,GAAG,UAAU;EACjE,IAAIC,YAAY,GAAGnB,GAAG,CAACiB,OAAO,CAACE,YAAY,IAAIH,mBAAmB;EAClE,OAAOG,YAAY;AACrB;AAEO,SAASC,yBAAyB,CAACpB,GAAG,EAAEiB,OAAqC,EAAiB;EACnGA,OAAO,GAAGA,OAAO,IAAI,CAAC,CAAC;EACvB,IAAI,IAAAI,eAAQ,EAACJ,OAAO,CAAC,EAAE;IACrBA,OAAO,GAAG;MAAEK,GAAG,EAAEL;IAAQ,CAAwB;EACnD,CAAC,MAAM;IACLA,OAAO,GAAGA,OAA8B;EAC1C;EAEA,IAAIK,GAAG,GAAGL,OAAO,CAACK,GAAG;EACrB,IAAIH,YAAY,GAAGF,OAAO,CAACE,YAAY,IAAIJ,eAAe,CAACf,GAAG,CAAC;EAC/D,IAAIO,SAAS,GAAGP,GAAG,CAACE,KAAK,CAACC,YAAY,CAACK,YAAY,EAAE;EACrD,IAAIe,QAAQ;EAEZ,IAAIJ,YAAY,KAAK,OAAO,EAAE;IAC5BI,QAAQ,GAAGD,GAAG,GAAGA,GAAG,CAACE,SAAS,CAACF,GAAG,CAACG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAGlB,SAAS,CAACK,MAAM;EACrE,CAAC,MAAM;IACLW,QAAQ,GAAGD,GAAG,GAAGA,GAAG,CAACE,SAAS,CAACF,GAAG,CAACG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAGlB,SAAS,CAACM,IAAI;EACnE;EAEA,IAAI,CAACU,QAAQ,EAAE;IACb,MAAM,IAAIG,oBAAY,CAAC,sCAAsC,CAAC;EAChE;EAEA,OAAO,IAAAC,uBAAiB,EAACJ,QAAQ,CAAC;AACpC;AAEO,SAASK,yBAAyB,CAAC5B,GAAG,EAAEiB,OAA4B,EAAE;EAC3E;EACA,MAAME,YAAY,GAAGF,OAAO,CAACE,YAAY,IAAIJ,eAAe,CAACf,GAAG,CAAC;EACjEmB,YAAY,KAAK,OAAO,GAAGL,YAAY,CAACd,GAAG,CAAC,GAAGD,UAAU,CAACC,GAAG,CAAC;AAChE;AAEO,eAAeG,YAAY,CAACH,GAAG,EAAEiB,OAAsC,EAA0B;EACtGA,OAAO,GAAGA,OAAO,IAAI,CAAC,CAAC;EACvB,IAAI,IAAAI,eAAQ,EAACJ,OAAO,CAAC,EAAE;IACrBA,OAAO,GAAG;MAAEK,GAAG,EAAEL;IAAQ,CAAwB;EACnD,CAAC,MAAM;IACLA,OAAO,GAAGA,OAA8B;EAC1C;EAEA,MAAMY,GAAkB,GAAGT,yBAAyB,CAACpB,GAAG,EAAEiB,OAAO,CAAC;EAClE,MAAMa,KAAK,GAAGD,GAAG,CAACC,KAAK;EACvB,MAAMC,WAA4B,GAAG/B,GAAG,CAACgC,kBAAkB,CAACC,IAAI,CAAC;IAC/DH;EACF,CAAC,CAAC;EACF,IAAI,CAACC,WAAW,EAAE;IAChB,IAAI/B,GAAG,CAACiB,OAAO,CAACC,IAAI,EAAE;MACpB;MACA,MAAM,IAAIQ,oBAAY,CAAC,yJAAyJ,EAAEQ,SAAS,CAAC;IAC9L;IACA,MAAM,IAAIR,oBAAY,CAAC,uDAAuD,CAAC;EACjF;EACA,MAAMS,IAAgB,GAAGJ,WAAW,CAACI,IAAkB;EACvD,OAAOJ,WAAW,CAACI,IAAI;EAEvB,IAAI,CAAClB,OAAO,CAACK,GAAG,EAAE;IAChB;IACAM,yBAAyB,CAAC5B,GAAG,EAAEiB,OAAO,CAAC;EACzC;EAEA,OAAO,IAAAmB,wCAAmB,EAACpC,GAAG,EAAE+B,WAAW,EAAEF,GAAG,EAAEM,IAAI,CAAC,CACpDE,KAAK,CAACC,GAAG,IAAI;IACZ,IAAI,CAAC,IAAAC,gCAA0B,EAACD,GAAG,CAAC,EAAE;MACpCtC,GAAG,CAACgC,kBAAkB,CAACQ,KAAK,CAAC;QAC3BV;MACF,CAAC,CAAC;IACJ;IACA,MAAMQ,GAAG;EACX,CAAC,CAAC,CACDG,IAAI,CAACZ,GAAG,IAAI;IACX7B,GAAG,CAACgC,kBAAkB,CAACQ,KAAK,CAAC;MAC3BV;IACF,CAAC,CAAC;IACF,OAAOD,GAAG;EACZ,CAAC,CAAC;AAEN"}
+{"version":3,"file":"parseFromUrl.js","names":["_errors","require","_util","_util2","_handleOAuthResponse","removeHash","sdk","nativeHistory","token","parseFromUrl","_getHistory","nativeDoc","_getDocument","nativeLoc","_getLocation","replaceState","title","pathname","search","hash","removeSearch","getResponseMode","defaultResponseMode","options","pkce","responseMode","parseOAuthResponseFromUrl","isString","url","paramStr","substring","indexOf","AuthSdkError","urlParamsToObject","cleanOAuthResponseFromUrl","res","state","oauthParams","transactionManager","load","undefined","urls","handleOAuthResponse","catch","err","isInteractionRequiredError","clear","then"],"sources":["../../../lib/oidc/parseFromUrl.ts"],"sourcesContent":["/* eslint-disable complexity */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { isInteractionRequiredError, urlParamsToObject } from './util';\nimport {\n  ParseFromUrlOptions,\n  TokenResponse,\n  CustomUrls,\n  TransactionMeta,\n  OAuthResponse\n} from './types';\nimport { isString } from '../util';\nimport { handleOAuthResponse } from './handleOAuthResponse';\n\nfunction removeHash(sdk) {\n  var nativeHistory = sdk.token.parseFromUrl._getHistory();\n  var nativeDoc = sdk.token.parseFromUrl._getDocument();\n  var nativeLoc = sdk.token.parseFromUrl._getLocation();\n  if (nativeHistory && nativeHistory.replaceState) {\n    nativeHistory.replaceState(null, nativeDoc.title, nativeLoc.pathname + nativeLoc.search);\n  } else {\n    nativeLoc.hash = '';\n  }\n}\n\nfunction removeSearch(sdk) {\n  var nativeHistory = sdk.token.parseFromUrl._getHistory();\n  var nativeDoc = sdk.token.parseFromUrl._getDocument();\n  var nativeLoc = sdk.token.parseFromUrl._getLocation();\n  if (nativeHistory && nativeHistory.replaceState) {\n    nativeHistory.replaceState(null, nativeDoc.title, nativeLoc.pathname + nativeLoc.hash);\n  } else {\n    nativeLoc.search = '';\n  }\n}\n\nexport function getResponseMode(sdk): 'query' | 'fragment' {\n  // https://openid.net/specs/openid-connect-core-1_0.html#Authentication\n  var defaultResponseMode = sdk.options.pkce ? 'query' : 'fragment';\n  var responseMode = sdk.options.responseMode || defaultResponseMode;\n  return responseMode;\n}\n\nexport function parseOAuthResponseFromUrl(sdk, options: string | ParseFromUrlOptions): OAuthResponse {\n  options = options || {};\n  if (isString(options)) {\n    options = { url: options } as ParseFromUrlOptions;\n  } else {\n    options = options as ParseFromUrlOptions;\n  }\n\n  var url = options.url;\n  var responseMode = options.responseMode || getResponseMode(sdk);\n  var nativeLoc = sdk.token.parseFromUrl._getLocation();\n  var paramStr;\n\n  if (responseMode === 'query') {\n    paramStr = url ? url.substring(url.indexOf('?')) : nativeLoc.search;\n  } else {\n    paramStr = url ? url.substring(url.indexOf('#')) : nativeLoc.hash;\n  }\n\n  if (!paramStr) {\n    throw new AuthSdkError('Unable to parse a token from the url');\n  }\n\n  return urlParamsToObject(paramStr);\n}\n\nexport function cleanOAuthResponseFromUrl(sdk, options: ParseFromUrlOptions) {\n  // Clean hash or search from the url\n  const responseMode = options.responseMode || getResponseMode(sdk);\n  responseMode === 'query' ? removeSearch(sdk) : removeHash(sdk);\n}\n\nexport async function parseFromUrl(sdk, options?: string | ParseFromUrlOptions): Promise<TokenResponse> {\n  options = options || {};\n  if (isString(options)) {\n    options = { url: options } as ParseFromUrlOptions;\n  } else {\n    options = options as ParseFromUrlOptions;\n  }\n\n  const res: OAuthResponse = parseOAuthResponseFromUrl(sdk, options);\n  const state = res.state;\n  const oauthParams: TransactionMeta = sdk.transactionManager.load({\n    state\n  });\n  if (!oauthParams) {\n    if (sdk.options.pkce) {\n      // eslint-disable-next-line max-len\n      throw new AuthSdkError('Could not load PKCE codeVerifier from storage. This may indicate the auth flow has already completed or multiple auth flows are executing concurrently.', undefined);\n    }\n    throw new AuthSdkError('Unable to retrieve OAuth redirect params from storage');\n  }\n  const urls: CustomUrls = oauthParams.urls as CustomUrls;\n  delete oauthParams.urls;\n\n  if (!options.url) {\n    // Clean hash or search from the url\n    cleanOAuthResponseFromUrl(sdk, options);\n  }\n\n  return handleOAuthResponse(sdk, oauthParams, res, urls)\n    .catch(err => {\n      if (!isInteractionRequiredError(err)) {\n        sdk.transactionManager.clear({\n          state\n        });\n      }\n      throw err;\n    })\n    .then(res => {\n      sdk.transactionManager.clear({\n        state\n      });\n      return res;\n    });\n\n}\n"],"mappings":";;;;;;AAaA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AAQA,IAAAE,MAAA,GAAAF,OAAA;AACA,IAAAG,oBAAA,GAAAH,OAAA;AAvBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAaA,SAASI,UAAUA,CAACC,GAAG,EAAE;EACvB,IAAIC,aAAa,GAAGD,GAAG,CAACE,KAAK,CAACC,YAAY,CAACC,WAAW,CAAC,CAAC;EACxD,IAAIC,SAAS,GAAGL,GAAG,CAACE,KAAK,CAACC,YAAY,CAACG,YAAY,CAAC,CAAC;EACrD,IAAIC,SAAS,GAAGP,GAAG,CAACE,KAAK,CAACC,YAAY,CAACK,YAAY,CAAC,CAAC;EACrD,IAAIP,aAAa,IAAIA,aAAa,CAACQ,YAAY,EAAE;IAC/CR,aAAa,CAACQ,YAAY,CAAC,IAAI,EAAEJ,SAAS,CAACK,KAAK,EAAEH,SAAS,CAACI,QAAQ,GAAGJ,SAAS,CAACK,MAAM,CAAC;EAC1F,CAAC,MAAM;IACLL,SAAS,CAACM,IAAI,GAAG,EAAE;EACrB;AACF;AAEA,SAASC,YAAYA,CAACd,GAAG,EAAE;EACzB,IAAIC,aAAa,GAAGD,GAAG,CAACE,KAAK,CAACC,YAAY,CAACC,WAAW,CAAC,CAAC;EACxD,IAAIC,SAAS,GAAGL,GAAG,CAACE,KAAK,CAACC,YAAY,CAACG,YAAY,CAAC,CAAC;EACrD,IAAIC,SAAS,GAAGP,GAAG,CAACE,KAAK,CAACC,YAAY,CAACK,YAAY,CAAC,CAAC;EACrD,IAAIP,aAAa,IAAIA,aAAa,CAACQ,YAAY,EAAE;IAC/CR,aAAa,CAACQ,YAAY,CAAC,IAAI,EAAEJ,SAAS,CAACK,KAAK,EAAEH,SAAS,CAACI,QAAQ,GAAGJ,SAAS,CAACM,IAAI,CAAC;EACxF,CAAC,MAAM;IACLN,SAAS,CAACK,MAAM,GAAG,EAAE;EACvB;AACF;AAEO,SAASG,eAAeA,CAACf,GAAG,EAAwB;EACzD;EACA,IAAIgB,mBAAmB,GAAGhB,GAAG,CAACiB,OAAO,CAACC,IAAI,GAAG,OAAO,GAAG,UAAU;EACjE,IAAIC,YAAY,GAAGnB,GAAG,CAACiB,OAAO,CAACE,YAAY,IAAIH,mBAAmB;EAClE,OAAOG,YAAY;AACrB;AAEO,SAASC,yBAAyBA,CAACpB,GAAG,EAAEiB,OAAqC,EAAiB;EACnGA,OAAO,GAAGA,OAAO,IAAI,CAAC,CAAC;EACvB,IAAI,IAAAI,eAAQ,EAACJ,OAAO,CAAC,EAAE;IACrBA,OAAO,GAAG;MAAEK,GAAG,EAAEL;IAAQ,CAAwB;EACnD,CAAC,MAAM;IACLA,OAAO,GAAGA,OAA8B;EAC1C;EAEA,IAAIK,GAAG,GAAGL,OAAO,CAACK,GAAG;EACrB,IAAIH,YAAY,GAAGF,OAAO,CAACE,YAAY,IAAIJ,eAAe,CAACf,GAAG,CAAC;EAC/D,IAAIO,SAAS,GAAGP,GAAG,CAACE,KAAK,CAACC,YAAY,CAACK,YAAY,CAAC,CAAC;EACrD,IAAIe,QAAQ;EAEZ,IAAIJ,YAAY,KAAK,OAAO,EAAE;IAC5BI,QAAQ,GAAGD,GAAG,GAAGA,GAAG,CAACE,SAAS,CAACF,GAAG,CAACG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAGlB,SAAS,CAACK,MAAM;EACrE,CAAC,MAAM;IACLW,QAAQ,GAAGD,GAAG,GAAGA,GAAG,CAACE,SAAS,CAACF,GAAG,CAACG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAGlB,SAAS,CAACM,IAAI;EACnE;EAEA,IAAI,CAACU,QAAQ,EAAE;IACb,MAAM,IAAIG,oBAAY,CAAC,sCAAsC,CAAC;EAChE;EAEA,OAAO,IAAAC,uBAAiB,EAACJ,QAAQ,CAAC;AACpC;AAEO,SAASK,yBAAyBA,CAAC5B,GAAG,EAAEiB,OAA4B,EAAE;EAC3E;EACA,MAAME,YAAY,GAAGF,OAAO,CAACE,YAAY,IAAIJ,eAAe,CAACf,GAAG,CAAC;EACjEmB,YAAY,KAAK,OAAO,GAAGL,YAAY,CAACd,GAAG,CAAC,GAAGD,UAAU,CAACC,GAAG,CAAC;AAChE;AAEO,eAAeG,YAAYA,CAACH,GAAG,EAAEiB,OAAsC,EAA0B;EACtGA,OAAO,GAAGA,OAAO,IAAI,CAAC,CAAC;EACvB,IAAI,IAAAI,eAAQ,EAACJ,OAAO,CAAC,EAAE;IACrBA,OAAO,GAAG;MAAEK,GAAG,EAAEL;IAAQ,CAAwB;EACnD,CAAC,MAAM;IACLA,OAAO,GAAGA,OAA8B;EAC1C;EAEA,MAAMY,GAAkB,GAAGT,yBAAyB,CAACpB,GAAG,EAAEiB,OAAO,CAAC;EAClE,MAAMa,KAAK,GAAGD,GAAG,CAACC,KAAK;EACvB,MAAMC,WAA4B,GAAG/B,GAAG,CAACgC,kBAAkB,CAACC,IAAI,CAAC;IAC/DH;EACF,CAAC,CAAC;EACF,IAAI,CAACC,WAAW,EAAE;IAChB,IAAI/B,GAAG,CAACiB,OAAO,CAACC,IAAI,EAAE;MACpB;MACA,MAAM,IAAIQ,oBAAY,CAAC,yJAAyJ,EAAEQ,SAAS,CAAC;IAC9L;IACA,MAAM,IAAIR,oBAAY,CAAC,uDAAuD,CAAC;EACjF;EACA,MAAMS,IAAgB,GAAGJ,WAAW,CAACI,IAAkB;EACvD,OAAOJ,WAAW,CAACI,IAAI;EAEvB,IAAI,CAAClB,OAAO,CAACK,GAAG,EAAE;IAChB;IACAM,yBAAyB,CAAC5B,GAAG,EAAEiB,OAAO,CAAC;EACzC;EAEA,OAAO,IAAAmB,wCAAmB,EAACpC,GAAG,EAAE+B,WAAW,EAAEF,GAAG,EAAEM,IAAI,CAAC,CACpDE,KAAK,CAACC,GAAG,IAAI;IACZ,IAAI,CAAC,IAAAC,gCAA0B,EAACD,GAAG,CAAC,EAAE;MACpCtC,GAAG,CAACgC,kBAAkB,CAACQ,KAAK,CAAC;QAC3BV;MACF,CAAC,CAAC;IACJ;IACA,MAAMQ,GAAG;EACX,CAAC,CAAC,CACDG,IAAI,CAACZ,GAAG,IAAI;IACX7B,GAAG,CAACgC,kBAAkB,CAACQ,KAAK,CAAC;MAC3BV;IACF,CAAC,CAAC;IACF,OAAOD,GAAG;EACZ,CAAC,CAAC;AAEN","ignoreList":[]}

package/cjs/oidc/renewToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"renewToken.js","names":["throwInvalidTokenError","AuthSdkError","getSingleToken","originalToken","tokens","isIDToken","idToken","isAccessToken","accessToken","renewToken","sdk","token","tokenManager","getTokensSync","refreshToken","renewTokensWithRefresh","scopes","responseType","options","pkce","authorizeUrl","userinfoUrl","issuer","dpopPairId","extraParams","getWithoutPrompt","then","res"],"sources":["../../../lib/oidc/renewToken.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { OktaAuthOAuthInterface, Token, Tokens, isAccessToken, AccessToken, IDToken, isIDToken } from './types';\nimport { getWithoutPrompt } from './getWithoutPrompt';\nimport { renewTokensWithRefresh } from './renewTokensWithRefresh';\n\nfunction throwInvalidTokenError() {\n  throw new AuthSdkError(\n    'Renew must be passed a token with an array of scopes and an accessToken or idToken'\n  );\n}\n\n// Multiple tokens may have come back. Return only the token which was requested.\nfunction getSingleToken(originalToken: Token, tokens: Tokens) {\n  if (isIDToken(originalToken)) {\n    return tokens.idToken;\n  }\n  if (isAccessToken(originalToken)) {\n    return tokens.accessToken;\n  }\n  throwInvalidTokenError();\n}\n\n// If we have a refresh token, renew using that, otherwise getWithoutPrompt\nexport async function renewToken(sdk: OktaAuthOAuthInterface, token: Token): Promise<Token | undefined> {\n  if (!isIDToken(token) && !isAccessToken(token)) {\n    throwInvalidTokenError();\n  }\n\n  let tokens = sdk.tokenManager.getTokensSync();\n  if (tokens.refreshToken) {\n    tokens = await renewTokensWithRefresh(sdk, {\n      scopes: token.scopes,\n    }, tokens.refreshToken);\n    return getSingleToken(token, tokens);\n  }\n\n  var responseType;\n  if (sdk.options.pkce) {\n    responseType = 'code';\n  } else if (isAccessToken(token)) {\n    responseType = 'token';\n  } else {\n    responseType = 'id_token';\n  }\n\n  const { scopes, authorizeUrl, userinfoUrl, issuer, dpopPairId, extraParams } = token as (AccessToken & IDToken);\n  return getWithoutPrompt(sdk, {\n    responseType,\n    scopes,\n    authorizeUrl,\n    userinfoUrl,\n    issuer,\n    dpopPairId,\n    extraParams\n  })\n    .then(function (res) {\n      return getSingleToken(token, res.tokens);\n    });\n}\n"],"mappings":";;;AAYA;AACA;AACA;AACA;AAfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA,SAASA,sBAAsB,GAAG;EAChC,MAAM,IAAIC,oBAAY,CACpB,oFAAoF,CACrF;AACH;;AAEA;AACA,SAASC,cAAc,CAACC,aAAoB,EAAEC,MAAc,EAAE;EAC5D,IAAI,IAAAC,gBAAS,EAACF,aAAa,CAAC,EAAE;IAC5B,OAAOC,MAAM,CAACE,OAAO;EACvB;EACA,IAAI,IAAAC,oBAAa,EAACJ,aAAa,CAAC,EAAE;IAChC,OAAOC,MAAM,CAACI,WAAW;EAC3B;EACAR,sBAAsB,EAAE;AAC1B;;AAEA;AACO,eAAeS,UAAU,CAACC,GAA2B,EAAEC,KAAY,EAA8B;EACtG,IAAI,CAAC,IAAAN,gBAAS,EAACM,KAAK,CAAC,IAAI,CAAC,IAAAJ,oBAAa,EAACI,KAAK,CAAC,EAAE;IAC9CX,sBAAsB,EAAE;EAC1B;EAEA,IAAII,MAAM,GAAGM,GAAG,CAACE,YAAY,CAACC,aAAa,EAAE;EAC7C,IAAIT,MAAM,CAACU,YAAY,EAAE;IACvBV,MAAM,GAAG,MAAM,IAAAW,8CAAsB,EAACL,GAAG,EAAE;MACzCM,MAAM,EAAEL,KAAK,CAACK;IAChB,CAAC,EAAEZ,MAAM,CAACU,YAAY,CAAC;IACvB,OAAOZ,cAAc,CAACS,KAAK,EAAEP,MAAM,CAAC;EACtC;EAEA,IAAIa,YAAY;EAChB,IAAIP,GAAG,CAACQ,OAAO,CAACC,IAAI,EAAE;IACpBF,YAAY,GAAG,MAAM;EACvB,CAAC,MAAM,IAAI,IAAAV,oBAAa,EAACI,KAAK,CAAC,EAAE;IAC/BM,YAAY,GAAG,OAAO;EACxB,CAAC,MAAM;IACLA,YAAY,GAAG,UAAU;EAC3B;EAEA,MAAM;IAAED,MAAM;IAAEI,YAAY;IAAEC,WAAW;IAAEC,MAAM;IAAEC,UAAU;IAAEC;EAAY,CAAC,GAAGb,KAAgC;EAC/G,OAAO,IAAAc,kCAAgB,EAACf,GAAG,EAAE;IAC3BO,YAAY;IACZD,MAAM;IACNI,YAAY;IACZC,WAAW;IACXC,MAAM;IACNC,UAAU;IACVC;EACF,CAAC,CAAC,CACCE,IAAI,CAAC,UAAUC,GAAG,EAAE;IACnB,OAAOzB,cAAc,CAACS,KAAK,EAAEgB,GAAG,CAACvB,MAAM,CAAC;EAC1C,CAAC,CAAC;AACN"}
+{"version":3,"file":"renewToken.js","names":["_errors","require","_types","_getWithoutPrompt","_renewTokensWithRefresh","throwInvalidTokenError","AuthSdkError","getSingleToken","originalToken","tokens","isIDToken","idToken","isAccessToken","accessToken","renewToken","sdk","token","tokenManager","getTokensSync","refreshToken","renewTokensWithRefresh","scopes","responseType","options","pkce","authorizeUrl","userinfoUrl","issuer","dpopPairId","extraParams","getWithoutPrompt","then","res"],"sources":["../../../lib/oidc/renewToken.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { OktaAuthOAuthInterface, Token, Tokens, isAccessToken, AccessToken, IDToken, isIDToken } from './types';\nimport { getWithoutPrompt } from './getWithoutPrompt';\nimport { renewTokensWithRefresh } from './renewTokensWithRefresh';\n\nfunction throwInvalidTokenError() {\n  throw new AuthSdkError(\n    'Renew must be passed a token with an array of scopes and an accessToken or idToken'\n  );\n}\n\n// Multiple tokens may have come back. Return only the token which was requested.\nfunction getSingleToken(originalToken: Token, tokens: Tokens) {\n  if (isIDToken(originalToken)) {\n    return tokens.idToken;\n  }\n  if (isAccessToken(originalToken)) {\n    return tokens.accessToken;\n  }\n  throwInvalidTokenError();\n}\n\n// If we have a refresh token, renew using that, otherwise getWithoutPrompt\nexport async function renewToken(sdk: OktaAuthOAuthInterface, token: Token): Promise<Token | undefined> {\n  if (!isIDToken(token) && !isAccessToken(token)) {\n    throwInvalidTokenError();\n  }\n\n  let tokens = sdk.tokenManager.getTokensSync();\n  if (tokens.refreshToken) {\n    tokens = await renewTokensWithRefresh(sdk, {\n      scopes: token.scopes,\n    }, tokens.refreshToken);\n    return getSingleToken(token, tokens);\n  }\n\n  var responseType;\n  if (sdk.options.pkce) {\n    responseType = 'code';\n  } else if (isAccessToken(token)) {\n    responseType = 'token';\n  } else {\n    responseType = 'id_token';\n  }\n\n  const { scopes, authorizeUrl, userinfoUrl, issuer, dpopPairId, extraParams } = token as (AccessToken & IDToken);\n  return getWithoutPrompt(sdk, {\n    responseType,\n    scopes,\n    authorizeUrl,\n    userinfoUrl,\n    issuer,\n    dpopPairId,\n    extraParams\n  })\n    .then(function (res) {\n      return getSingleToken(token, res.tokens);\n    });\n}\n"],"mappings":";;;AAYA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AACA,IAAAE,iBAAA,GAAAF,OAAA;AACA,IAAAG,uBAAA,GAAAH,OAAA;AAfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA,SAASI,sBAAsBA,CAAA,EAAG;EAChC,MAAM,IAAIC,oBAAY,CACpB,oFACF,CAAC;AACH;;AAEA;AACA,SAASC,cAAcA,CAACC,aAAoB,EAAEC,MAAc,EAAE;EAC5D,IAAI,IAAAC,gBAAS,EAACF,aAAa,CAAC,EAAE;IAC5B,OAAOC,MAAM,CAACE,OAAO;EACvB;EACA,IAAI,IAAAC,oBAAa,EAACJ,aAAa,CAAC,EAAE;IAChC,OAAOC,MAAM,CAACI,WAAW;EAC3B;EACAR,sBAAsB,CAAC,CAAC;AAC1B;;AAEA;AACO,eAAeS,UAAUA,CAACC,GAA2B,EAAEC,KAAY,EAA8B;EACtG,IAAI,CAAC,IAAAN,gBAAS,EAACM,KAAK,CAAC,IAAI,CAAC,IAAAJ,oBAAa,EAACI,KAAK,CAAC,EAAE;IAC9CX,sBAAsB,CAAC,CAAC;EAC1B;EAEA,IAAII,MAAM,GAAGM,GAAG,CAACE,YAAY,CAACC,aAAa,CAAC,CAAC;EAC7C,IAAIT,MAAM,CAACU,YAAY,EAAE;IACvBV,MAAM,GAAG,MAAM,IAAAW,8CAAsB,EAACL,GAAG,EAAE;MACzCM,MAAM,EAAEL,KAAK,CAACK;IAChB,CAAC,EAAEZ,MAAM,CAACU,YAAY,CAAC;IACvB,OAAOZ,cAAc,CAACS,KAAK,EAAEP,MAAM,CAAC;EACtC;EAEA,IAAIa,YAAY;EAChB,IAAIP,GAAG,CAACQ,OAAO,CAACC,IAAI,EAAE;IACpBF,YAAY,GAAG,MAAM;EACvB,CAAC,MAAM,IAAI,IAAAV,oBAAa,EAACI,KAAK,CAAC,EAAE;IAC/BM,YAAY,GAAG,OAAO;EACxB,CAAC,MAAM;IACLA,YAAY,GAAG,UAAU;EAC3B;EAEA,MAAM;IAAED,MAAM;IAAEI,YAAY;IAAEC,WAAW;IAAEC,MAAM;IAAEC,UAAU;IAAEC;EAAY,CAAC,GAAGb,KAAgC;EAC/G,OAAO,IAAAc,kCAAgB,EAACf,GAAG,EAAE;IAC3BO,YAAY;IACZD,MAAM;IACNI,YAAY;IACZC,WAAW;IACXC,MAAM;IACNC,UAAU;IACVC;EACF,CAAC,CAAC,CACCE,IAAI,CAAC,UAAUC,GAAG,EAAE;IACnB,OAAOzB,cAAc,CAACS,KAAK,EAAEgB,GAAG,CAACvB,MAAM,CAAC;EAC1C,CAAC,CAAC;AACN","ignoreList":[]}

package/cjs/oidc/renewTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"renewTokens.js","names":["renewTokens","sdk","options","tokens","tokenManager","getTokensSync","refreshToken","renewTokensWithRefresh","accessToken","idToken","AuthSdkError","scopes","authorizeUrl","userinfoUrl","issuer","dpopPairId","extraParams","Object","assign","pkce","responseType","getDefaultTokenParams","getWithoutPrompt","then","res"],"sources":["../../../lib/oidc/renewTokens.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { RenewTokensParams, Tokens } from './types';\nimport { getWithoutPrompt } from './getWithoutPrompt';\nimport { renewTokensWithRefresh } from './renewTokensWithRefresh';\nimport { getDefaultTokenParams } from './util';\n\n// If we have a refresh token, renew using that, otherwise getWithoutPrompt\n// eslint-disable-next-line complexity\nexport async function renewTokens(sdk, options?: RenewTokensParams): Promise<Tokens> {\n  const tokens = options?.tokens ?? sdk.tokenManager.getTokensSync();\n  if (tokens.refreshToken) {\n    return renewTokensWithRefresh(sdk, options || {}, tokens.refreshToken);\n  }\n\n  if (!tokens.accessToken && !tokens.idToken) {\n    throw new AuthSdkError('renewTokens() was called but there is no existing token');\n  }\n\n  const accessToken = tokens.accessToken || {};\n  const idToken = tokens.idToken || {};\n  const scopes = accessToken.scopes || idToken.scopes;\n  if (!scopes) {\n    throw new AuthSdkError('renewTokens: invalid tokens: could not read scopes');\n  }\n  const authorizeUrl = accessToken.authorizeUrl || idToken.authorizeUrl;\n  if (!authorizeUrl) {\n    throw new AuthSdkError('renewTokens: invalid tokens: could not read authorizeUrl');\n  }\n  const userinfoUrl = accessToken.userinfoUrl || sdk.options.userinfoUrl;\n  const issuer = idToken.issuer || sdk.options.issuer;\n  const dpopPairId = accessToken?.dpopPairId;\n  const extraParams = accessToken?.extraParams || idToken?.extraParams;\n\n  // Get tokens using the SSO cookie\n  options = Object.assign({\n    scopes,\n    authorizeUrl,\n    userinfoUrl,\n    issuer,\n    dpopPairId,\n    extraParams\n  }, options);\n\n  if (sdk.options.pkce) {\n    options.responseType = 'code';\n  } else {\n    const { responseType } = getDefaultTokenParams(sdk);\n    options.responseType = responseType;\n  }\n\n  return getWithoutPrompt(sdk, options)\n    .then(res => res.tokens);\n    \n}\n"],"mappings":";;;AAYA;AAEA;AACA;AACA;AAhBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;AACA;AACO,eAAeA,WAAW,CAACC,GAAG,EAAEC,OAA2B,EAAmB;EACnF,MAAMC,MAAM,GAAGD,OAAO,EAAEC,MAAM,IAAIF,GAAG,CAACG,YAAY,CAACC,aAAa,EAAE;EAClE,IAAIF,MAAM,CAACG,YAAY,EAAE;IACvB,OAAO,IAAAC,8CAAsB,EAACN,GAAG,EAAEC,OAAO,IAAI,CAAC,CAAC,EAAEC,MAAM,CAACG,YAAY,CAAC;EACxE;EAEA,IAAI,CAACH,MAAM,CAACK,WAAW,IAAI,CAACL,MAAM,CAACM,OAAO,EAAE;IAC1C,MAAM,IAAIC,oBAAY,CAAC,yDAAyD,CAAC;EACnF;EAEA,MAAMF,WAAW,GAAGL,MAAM,CAACK,WAAW,IAAI,CAAC,CAAC;EAC5C,MAAMC,OAAO,GAAGN,MAAM,CAACM,OAAO,IAAI,CAAC,CAAC;EACpC,MAAME,MAAM,GAAGH,WAAW,CAACG,MAAM,IAAIF,OAAO,CAACE,MAAM;EACnD,IAAI,CAACA,MAAM,EAAE;IACX,MAAM,IAAID,oBAAY,CAAC,oDAAoD,CAAC;EAC9E;EACA,MAAME,YAAY,GAAGJ,WAAW,CAACI,YAAY,IAAIH,OAAO,CAACG,YAAY;EACrE,IAAI,CAACA,YAAY,EAAE;IACjB,MAAM,IAAIF,oBAAY,CAAC,0DAA0D,CAAC;EACpF;EACA,MAAMG,WAAW,GAAGL,WAAW,CAACK,WAAW,IAAIZ,GAAG,CAACC,OAAO,CAACW,WAAW;EACtE,MAAMC,MAAM,GAAGL,OAAO,CAACK,MAAM,IAAIb,GAAG,CAACC,OAAO,CAACY,MAAM;EACnD,MAAMC,UAAU,GAAGP,WAAW,EAAEO,UAAU;EAC1C,MAAMC,WAAW,GAAGR,WAAW,EAAEQ,WAAW,IAAIP,OAAO,EAAEO,WAAW;;EAEpE;EACAd,OAAO,GAAGe,MAAM,CAACC,MAAM,CAAC;IACtBP,MAAM;IACNC,YAAY;IACZC,WAAW;IACXC,MAAM;IACNC,UAAU;IACVC;EACF,CAAC,EAAEd,OAAO,CAAC;EAEX,IAAID,GAAG,CAACC,OAAO,CAACiB,IAAI,EAAE;IACpBjB,OAAO,CAACkB,YAAY,GAAG,MAAM;EAC/B,CAAC,MAAM;IACL,MAAM;MAAEA;IAAa,CAAC,GAAG,IAAAC,2BAAqB,EAACpB,GAAG,CAAC;IACnDC,OAAO,CAACkB,YAAY,GAAGA,YAAY;EACrC;EAEA,OAAO,IAAAE,kCAAgB,EAACrB,GAAG,EAAEC,OAAO,CAAC,CAClCqB,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACrB,MAAM,CAAC;AAE5B"}
+{"version":3,"file":"renewTokens.js","names":["_errors","require","_getWithoutPrompt","_renewTokensWithRefresh","_util","renewTokens","sdk","options","tokens","tokenManager","getTokensSync","refreshToken","renewTokensWithRefresh","accessToken","idToken","AuthSdkError","scopes","authorizeUrl","userinfoUrl","issuer","dpopPairId","extraParams","Object","assign","pkce","responseType","getDefaultTokenParams","getWithoutPrompt","then","res"],"sources":["../../../lib/oidc/renewTokens.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { RenewTokensParams, Tokens } from './types';\nimport { getWithoutPrompt } from './getWithoutPrompt';\nimport { renewTokensWithRefresh } from './renewTokensWithRefresh';\nimport { getDefaultTokenParams } from './util';\n\n// If we have a refresh token, renew using that, otherwise getWithoutPrompt\n// eslint-disable-next-line complexity\nexport async function renewTokens(sdk, options?: RenewTokensParams): Promise<Tokens> {\n  const tokens = options?.tokens ?? sdk.tokenManager.getTokensSync();\n  if (tokens.refreshToken) {\n    return renewTokensWithRefresh(sdk, options || {}, tokens.refreshToken);\n  }\n\n  if (!tokens.accessToken && !tokens.idToken) {\n    throw new AuthSdkError('renewTokens() was called but there is no existing token');\n  }\n\n  const accessToken = tokens.accessToken || {};\n  const idToken = tokens.idToken || {};\n  const scopes = accessToken.scopes || idToken.scopes;\n  if (!scopes) {\n    throw new AuthSdkError('renewTokens: invalid tokens: could not read scopes');\n  }\n  const authorizeUrl = accessToken.authorizeUrl || idToken.authorizeUrl;\n  if (!authorizeUrl) {\n    throw new AuthSdkError('renewTokens: invalid tokens: could not read authorizeUrl');\n  }\n  const userinfoUrl = accessToken.userinfoUrl || sdk.options.userinfoUrl;\n  const issuer = idToken.issuer || sdk.options.issuer;\n  const dpopPairId = accessToken?.dpopPairId;\n  const extraParams = accessToken?.extraParams || idToken?.extraParams;\n\n  // Get tokens using the SSO cookie\n  options = Object.assign({\n    scopes,\n    authorizeUrl,\n    userinfoUrl,\n    issuer,\n    dpopPairId,\n    extraParams\n  }, options);\n\n  if (sdk.options.pkce) {\n    options.responseType = 'code';\n  } else {\n    const { responseType } = getDefaultTokenParams(sdk);\n    options.responseType = responseType;\n  }\n\n  return getWithoutPrompt(sdk, options)\n    .then(res => res.tokens);\n    \n}\n"],"mappings":";;;AAYA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,iBAAA,GAAAD,OAAA;AACA,IAAAE,uBAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAhBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;AACA;AACO,eAAeI,WAAWA,CAACC,GAAG,EAAEC,OAA2B,EAAmB;EACnF,MAAMC,MAAM,GAAGD,OAAO,EAAEC,MAAM,IAAIF,GAAG,CAACG,YAAY,CAACC,aAAa,CAAC,CAAC;EAClE,IAAIF,MAAM,CAACG,YAAY,EAAE;IACvB,OAAO,IAAAC,8CAAsB,EAACN,GAAG,EAAEC,OAAO,IAAI,CAAC,CAAC,EAAEC,MAAM,CAACG,YAAY,CAAC;EACxE;EAEA,IAAI,CAACH,MAAM,CAACK,WAAW,IAAI,CAACL,MAAM,CAACM,OAAO,EAAE;IAC1C,MAAM,IAAIC,oBAAY,CAAC,yDAAyD,CAAC;EACnF;EAEA,MAAMF,WAAW,GAAGL,MAAM,CAACK,WAAW,IAAI,CAAC,CAAC;EAC5C,MAAMC,OAAO,GAAGN,MAAM,CAACM,OAAO,IAAI,CAAC,CAAC;EACpC,MAAME,MAAM,GAAGH,WAAW,CAACG,MAAM,IAAIF,OAAO,CAACE,MAAM;EACnD,IAAI,CAACA,MAAM,EAAE;IACX,MAAM,IAAID,oBAAY,CAAC,oDAAoD,CAAC;EAC9E;EACA,MAAME,YAAY,GAAGJ,WAAW,CAACI,YAAY,IAAIH,OAAO,CAACG,YAAY;EACrE,IAAI,CAACA,YAAY,EAAE;IACjB,MAAM,IAAIF,oBAAY,CAAC,0DAA0D,CAAC;EACpF;EACA,MAAMG,WAAW,GAAGL,WAAW,CAACK,WAAW,IAAIZ,GAAG,CAACC,OAAO,CAACW,WAAW;EACtE,MAAMC,MAAM,GAAGL,OAAO,CAACK,MAAM,IAAIb,GAAG,CAACC,OAAO,CAACY,MAAM;EACnD,MAAMC,UAAU,GAAGP,WAAW,EAAEO,UAAU;EAC1C,MAAMC,WAAW,GAAGR,WAAW,EAAEQ,WAAW,IAAIP,OAAO,EAAEO,WAAW;;EAEpE;EACAd,OAAO,GAAGe,MAAM,CAACC,MAAM,CAAC;IACtBP,MAAM;IACNC,YAAY;IACZC,WAAW;IACXC,MAAM;IACNC,UAAU;IACVC;EACF,CAAC,EAAEd,OAAO,CAAC;EAEX,IAAID,GAAG,CAACC,OAAO,CAACiB,IAAI,EAAE;IACpBjB,OAAO,CAACkB,YAAY,GAAG,MAAM;EAC/B,CAAC,MAAM;IACL,MAAM;MAAEA;IAAa,CAAC,GAAG,IAAAC,2BAAqB,EAACpB,GAAG,CAAC;IACnDC,OAAO,CAACkB,YAAY,GAAGA,YAAY;EACrC;EAEA,OAAO,IAAAE,kCAAgB,EAACrB,GAAG,EAAEC,OAAO,CAAC,CAClCqB,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACrB,MAAM,CAAC;AAE5B","ignoreList":[]}

package/cjs/oidc/renewTokensWithRefresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"renewTokensWithRefresh.js","names":["renewTokensWithRefresh","sdk","tokenParams","refreshTokenObject","clientId","dpop","options","AuthSdkError","renewTokenParams","Object","assign","extraParams","endpointParams","keyPair","findKeyPair","dpopPairId","dpopKeyPair","tokenResponse","postRefreshToken","urls","getOAuthUrls","tokens","handleOAuthResponse","refreshToken","isSameRefreshToken","tokenManager","updateRefreshToken","err","isRefreshTokenInvalidError","removeRefreshToken"],"sources":["../../../lib/oidc/renewTokensWithRefresh.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { getOAuthUrls } from './util/oauth';\nimport { isSameRefreshToken } from './util/refreshToken';\nimport { OktaAuthOAuthInterface, TokenParams, RefreshToken, Tokens } from './types';\nimport { handleOAuthResponse } from './handleOAuthResponse';\nimport { TokenEndpointParams, postRefreshToken } from './endpoints/token';\nimport { findKeyPair } from './dpop';\nimport { isRefreshTokenInvalidError } from './util/errors';\n\n/* eslint complexity:[0,8] */\nexport async function renewTokensWithRefresh(\n  sdk: OktaAuthOAuthInterface,\n  tokenParams: TokenParams,\n  refreshTokenObject: RefreshToken\n): Promise<Tokens> {\n  const { clientId, dpop } = sdk.options;\n  if (!clientId) {\n    throw new AuthSdkError('A clientId must be specified in the OktaAuth constructor to renew tokens');\n  }\n\n  try {\n    const renewTokenParams: TokenParams = Object.assign({}, tokenParams, { clientId });\n\n    if (refreshTokenObject.extraParams) {\n      renewTokenParams.extraParams = refreshTokenObject.extraParams;\n    }\n\n    const endpointParams: TokenEndpointParams = {...renewTokenParams};\n\n    if (dpop) {\n      const keyPair = await findKeyPair(refreshTokenObject?.dpopPairId);    // will throw if KP cannot be found\n      endpointParams.dpopKeyPair = keyPair;\n      renewTokenParams.dpop = dpop;\n      renewTokenParams.dpopPairId = refreshTokenObject.dpopPairId;\n    }\n\n    const tokenResponse = await postRefreshToken(sdk, endpointParams, refreshTokenObject);\n    const urls = getOAuthUrls(sdk, tokenParams);\n    const { tokens } = await handleOAuthResponse(sdk, renewTokenParams, tokenResponse, urls);\n\n    // Support rotating refresh tokens\n    const { refreshToken } = tokens;\n    if (refreshToken && !isSameRefreshToken(refreshToken, refreshTokenObject)) {\n      sdk.tokenManager.updateRefreshToken(refreshToken);\n    }\n\n    return tokens;\n  }\n  catch (err) {\n    if (isRefreshTokenInvalidError(err)) {\n      // if the refresh token is invalid, remove it from storage\n      sdk.tokenManager.removeRefreshToken();\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;AAYA;AACA;AACA;AAEA;AACA;AACA;AACA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAUA;AACO,eAAeA,sBAAsB,CAC1CC,GAA2B,EAC3BC,WAAwB,EACxBC,kBAAgC,EACf;EACjB,MAAM;IAAEC,QAAQ;IAAEC;EAAK,CAAC,GAAGJ,GAAG,CAACK,OAAO;EACtC,IAAI,CAACF,QAAQ,EAAE;IACb,MAAM,IAAIG,oBAAY,CAAC,0EAA0E,CAAC;EACpG;EAEA,IAAI;IACF,MAAMC,gBAA6B,GAAGC,MAAM,CAACC,MAAM,CAAC,CAAC,CAAC,EAAER,WAAW,EAAE;MAAEE;IAAS,CAAC,CAAC;IAElF,IAAID,kBAAkB,CAACQ,WAAW,EAAE;MAClCH,gBAAgB,CAACG,WAAW,GAAGR,kBAAkB,CAACQ,WAAW;IAC/D;IAEA,MAAMC,cAAmC,GAAG;MAAC,GAAGJ;IAAgB,CAAC;IAEjE,IAAIH,IAAI,EAAE;MACR,MAAMQ,OAAO,GAAG,MAAM,IAAAC,iBAAW,EAACX,kBAAkB,EAAEY,UAAU,CAAC,CAAC,CAAI;MACtEH,cAAc,CAACI,WAAW,GAAGH,OAAO;MACpCL,gBAAgB,CAACH,IAAI,GAAGA,IAAI;MAC5BG,gBAAgB,CAACO,UAAU,GAAGZ,kBAAkB,CAACY,UAAU;IAC7D;IAEA,MAAME,aAAa,GAAG,MAAM,IAAAC,uBAAgB,EAACjB,GAAG,EAAEW,cAAc,EAAET,kBAAkB,CAAC;IACrF,MAAMgB,IAAI,GAAG,IAAAC,mBAAY,EAACnB,GAAG,EAAEC,WAAW,CAAC;IAC3C,MAAM;MAAEmB;IAAO,CAAC,GAAG,MAAM,IAAAC,wCAAmB,EAACrB,GAAG,EAAEO,gBAAgB,EAAES,aAAa,EAAEE,IAAI,CAAC;;IAExF;IACA,MAAM;MAAEI;IAAa,CAAC,GAAGF,MAAM;IAC/B,IAAIE,YAAY,IAAI,CAAC,IAAAC,gCAAkB,EAACD,YAAY,EAAEpB,kBAAkB,CAAC,EAAE;MACzEF,GAAG,CAACwB,YAAY,CAACC,kBAAkB,CAACH,YAAY,CAAC;IACnD;IAEA,OAAOF,MAAM;EACf,CAAC,CACD,OAAOM,GAAG,EAAE;IACV,IAAI,IAAAC,mCAA0B,EAACD,GAAG,CAAC,EAAE;MACnC;MACA1B,GAAG,CAACwB,YAAY,CAACI,kBAAkB,EAAE;IACvC;IACA,MAAMF,GAAG;EACX;AACF"}
+{"version":3,"file":"renewTokensWithRefresh.js","names":["_errors","require","_oauth","_refreshToken","_handleOAuthResponse","_token","_dpop","_errors2","renewTokensWithRefresh","sdk","tokenParams","refreshTokenObject","clientId","dpop","options","AuthSdkError","renewTokenParams","Object","assign","extraParams","endpointParams","keyPair","findKeyPair","dpopPairId","dpopKeyPair","tokenResponse","postRefreshToken","urls","getOAuthUrls","tokens","handleOAuthResponse","refreshToken","isSameRefreshToken","tokenManager","updateRefreshToken","err","isRefreshTokenInvalidError","removeRefreshToken"],"sources":["../../../lib/oidc/renewTokensWithRefresh.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { getOAuthUrls } from './util/oauth';\nimport { isSameRefreshToken } from './util/refreshToken';\nimport { OktaAuthOAuthInterface, TokenParams, RefreshToken, Tokens } from './types';\nimport { handleOAuthResponse } from './handleOAuthResponse';\nimport { TokenEndpointParams, postRefreshToken } from './endpoints/token';\nimport { findKeyPair } from './dpop';\nimport { isRefreshTokenInvalidError } from './util/errors';\n\n/* eslint complexity:[0,8] */\nexport async function renewTokensWithRefresh(\n  sdk: OktaAuthOAuthInterface,\n  tokenParams: TokenParams,\n  refreshTokenObject: RefreshToken\n): Promise<Tokens> {\n  const { clientId, dpop } = sdk.options;\n  if (!clientId) {\n    throw new AuthSdkError('A clientId must be specified in the OktaAuth constructor to renew tokens');\n  }\n\n  try {\n    const renewTokenParams: TokenParams = Object.assign({}, tokenParams, { clientId });\n\n    if (refreshTokenObject.extraParams) {\n      renewTokenParams.extraParams = refreshTokenObject.extraParams;\n    }\n\n    const endpointParams: TokenEndpointParams = {...renewTokenParams};\n\n    if (dpop) {\n      const keyPair = await findKeyPair(refreshTokenObject?.dpopPairId);    // will throw if KP cannot be found\n      endpointParams.dpopKeyPair = keyPair;\n      renewTokenParams.dpop = dpop;\n      renewTokenParams.dpopPairId = refreshTokenObject.dpopPairId;\n    }\n\n    const tokenResponse = await postRefreshToken(sdk, endpointParams, refreshTokenObject);\n    const urls = getOAuthUrls(sdk, tokenParams);\n    const { tokens } = await handleOAuthResponse(sdk, renewTokenParams, tokenResponse, urls);\n\n    // Support rotating refresh tokens\n    const { refreshToken } = tokens;\n    if (refreshToken && !isSameRefreshToken(refreshToken, refreshTokenObject)) {\n      sdk.tokenManager.updateRefreshToken(refreshToken);\n    }\n\n    return tokens;\n  }\n  catch (err) {\n    if (isRefreshTokenInvalidError(err)) {\n      // if the refresh token is invalid, remove it from storage\n      sdk.tokenManager.removeRefreshToken();\n    }\n    throw err;\n  }\n}\n"],"mappings":";;;AAYA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AAEA,IAAAG,oBAAA,GAAAH,OAAA;AACA,IAAAI,MAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AACA,IAAAM,QAAA,GAAAN,OAAA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAUA;AACO,eAAeO,sBAAsBA,CAC1CC,GAA2B,EAC3BC,WAAwB,EACxBC,kBAAgC,EACf;EACjB,MAAM;IAAEC,QAAQ;IAAEC;EAAK,CAAC,GAAGJ,GAAG,CAACK,OAAO;EACtC,IAAI,CAACF,QAAQ,EAAE;IACb,MAAM,IAAIG,oBAAY,CAAC,0EAA0E,CAAC;EACpG;EAEA,IAAI;IACF,MAAMC,gBAA6B,GAAGC,MAAM,CAACC,MAAM,CAAC,CAAC,CAAC,EAAER,WAAW,EAAE;MAAEE;IAAS,CAAC,CAAC;IAElF,IAAID,kBAAkB,CAACQ,WAAW,EAAE;MAClCH,gBAAgB,CAACG,WAAW,GAAGR,kBAAkB,CAACQ,WAAW;IAC/D;IAEA,MAAMC,cAAmC,GAAG;MAAC,GAAGJ;IAAgB,CAAC;IAEjE,IAAIH,IAAI,EAAE;MACR,MAAMQ,OAAO,GAAG,MAAM,IAAAC,iBAAW,EAACX,kBAAkB,EAAEY,UAAU,CAAC,CAAC,CAAI;MACtEH,cAAc,CAACI,WAAW,GAAGH,OAAO;MACpCL,gBAAgB,CAACH,IAAI,GAAGA,IAAI;MAC5BG,gBAAgB,CAACO,UAAU,GAAGZ,kBAAkB,CAACY,UAAU;IAC7D;IAEA,MAAME,aAAa,GAAG,MAAM,IAAAC,uBAAgB,EAACjB,GAAG,EAAEW,cAAc,EAAET,kBAAkB,CAAC;IACrF,MAAMgB,IAAI,GAAG,IAAAC,mBAAY,EAACnB,GAAG,EAAEC,WAAW,CAAC;IAC3C,MAAM;MAAEmB;IAAO,CAAC,GAAG,MAAM,IAAAC,wCAAmB,EAACrB,GAAG,EAAEO,gBAAgB,EAAES,aAAa,EAAEE,IAAI,CAAC;;IAExF;IACA,MAAM;MAAEI;IAAa,CAAC,GAAGF,MAAM;IAC/B,IAAIE,YAAY,IAAI,CAAC,IAAAC,gCAAkB,EAACD,YAAY,EAAEpB,kBAAkB,CAAC,EAAE;MACzEF,GAAG,CAACwB,YAAY,CAACC,kBAAkB,CAACH,YAAY,CAAC;IACnD;IAEA,OAAOF,MAAM;EACf,CAAC,CACD,OAAOM,GAAG,EAAE;IACV,IAAI,IAAAC,mCAA0B,EAACD,GAAG,CAAC,EAAE;MACnC;MACA1B,GAAG,CAACwB,YAAY,CAACI,kBAAkB,CAAC,CAAC;IACvC;IACA,MAAMF,GAAG;EACX;AACF","ignoreList":[]}

package/cjs/oidc/revokeToken.js

@@ -5,7 +5,6 @@ exports.revokeToken = revokeToken;
 var _http = require("../http");
 var _util = require("../util");
 var _oauth = require("./util/oauth");
-var _crypto = require("../crypto");
 var _AuthSdkError = _interopRequireDefault(require("../errors/AuthSdkError"));
 /*!
  * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.
@@ -45,7 +44,7 @@ async function revokeToken(sdk, token) {
     token_type_hint: refreshToken ? 'refresh_token' : 'access_token',
     token: refreshToken || accessToken
   }).slice(1);
-  var creds = clientSecret ? (0, _crypto.btoa)(`${clientId}:${clientSecret}`) : (0, _crypto.btoa)(clientId);
+  var creds = clientSecret ? btoa(`${clientId}:${clientSecret}`) : btoa(clientId);
   return (0, _http.post)(sdk, revokeUrl, args, {
     headers: {
       'Content-Type': 'application/x-www-form-urlencoded',

package/cjs/oidc/revokeToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"revokeToken.js","names":["revokeToken","sdk","token","accessToken","refreshToken","AuthSdkError","clientId","options","clientSecret","revokeUrl","getOAuthUrls","args","toQueryString","token_type_hint","slice","creds","btoa","post","headers"],"sources":["../../../lib/oidc/revokeToken.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\n\n/* eslint complexity:[0,8] */\nimport { post } from '../http';\nimport { toQueryString } from '../util';\nimport {\n  getOAuthUrls,\n} from './util/oauth';\nimport { btoa } from '../crypto';\nimport AuthSdkError from '../errors/AuthSdkError';\nimport {\n  OktaAuthOAuthInterface,\n  RevocableToken,\n  AccessToken,\n  RefreshToken\n} from './types';\n\n// refresh tokens have precedence to be revoked if no token is specified\nexport async function revokeToken(sdk: OktaAuthOAuthInterface, token: RevocableToken): Promise<any> {\n  let accessToken = '';\n  let refreshToken = '';\n  if (token) { \n      accessToken = (token as AccessToken).accessToken;\n      refreshToken = (token as RefreshToken).refreshToken;  \n  }\n  if(!accessToken && !refreshToken) { \n    throw new AuthSdkError('A valid access or refresh token object is required');\n  }\n  var clientId = sdk.options.clientId;\n  var clientSecret = sdk.options.clientSecret;\n  if (!clientId) {\n    throw new AuthSdkError('A clientId must be specified in the OktaAuth constructor to revoke a token');\n  }\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  var revokeUrl = getOAuthUrls(sdk).revokeUrl!;\n  var args = toQueryString({\n    // eslint-disable-next-line camelcase\n    token_type_hint: refreshToken ? 'refresh_token' : 'access_token', \n    token: refreshToken || accessToken,\n  }).slice(1);\n  var creds = clientSecret ? btoa(`${clientId}:${clientSecret}`) : btoa(clientId);\n  return post(sdk, revokeUrl, args, {\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      'Authorization': 'Basic ' + creds\n    }\n  });\n}\n"],"mappings":";;;;AAcA;AACA;AACA;AAGA;AACA;AApBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAeA;AACO,eAAeA,WAAW,CAACC,GAA2B,EAAEC,KAAqB,EAAgB;EAClG,IAAIC,WAAW,GAAG,EAAE;EACpB,IAAIC,YAAY,GAAG,EAAE;EACrB,IAAIF,KAAK,EAAE;IACPC,WAAW,GAAID,KAAK,CAAiBC,WAAW;IAChDC,YAAY,GAAIF,KAAK,CAAkBE,YAAY;EACvD;EACA,IAAG,CAACD,WAAW,IAAI,CAACC,YAAY,EAAE;IAChC,MAAM,IAAIC,qBAAY,CAAC,oDAAoD,CAAC;EAC9E;EACA,IAAIC,QAAQ,GAAGL,GAAG,CAACM,OAAO,CAACD,QAAQ;EACnC,IAAIE,YAAY,GAAGP,GAAG,CAACM,OAAO,CAACC,YAAY;EAC3C,IAAI,CAACF,QAAQ,EAAE;IACb,MAAM,IAAID,qBAAY,CAAC,4EAA4E,CAAC;EACtG;EACA;EACA,IAAII,SAAS,GAAG,IAAAC,mBAAY,EAACT,GAAG,CAAC,CAACQ,SAAU;EAC5C,IAAIE,IAAI,GAAG,IAAAC,mBAAa,EAAC;IACvB;IACAC,eAAe,EAAET,YAAY,GAAG,eAAe,GAAG,cAAc;IAChEF,KAAK,EAAEE,YAAY,IAAID;EACzB,CAAC,CAAC,CAACW,KAAK,CAAC,CAAC,CAAC;EACX,IAAIC,KAAK,GAAGP,YAAY,GAAG,IAAAQ,YAAI,EAAE,GAAEV,QAAS,IAAGE,YAAa,EAAC,CAAC,GAAG,IAAAQ,YAAI,EAACV,QAAQ,CAAC;EAC/E,OAAO,IAAAW,UAAI,EAAChB,GAAG,EAAEQ,SAAS,EAAEE,IAAI,EAAE;IAChCO,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnD,eAAe,EAAE,QAAQ,GAAGH;IAC9B;EACF,CAAC,CAAC;AACJ"}
+{"version":3,"file":"revokeToken.js","names":["_http","require","_util","_oauth","_AuthSdkError","_interopRequireDefault","revokeToken","sdk","token","accessToken","refreshToken","AuthSdkError","clientId","options","clientSecret","revokeUrl","getOAuthUrls","args","toQueryString","token_type_hint","slice","creds","btoa","post","headers"],"sources":["../../../lib/oidc/revokeToken.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\n\n/* eslint complexity:[0,8] */\nimport { post } from '../http';\nimport { toQueryString } from '../util';\nimport {\n  getOAuthUrls,\n} from './util/oauth';\nimport AuthSdkError from '../errors/AuthSdkError';\nimport {\n  OktaAuthOAuthInterface,\n  RevocableToken,\n  AccessToken,\n  RefreshToken\n} from './types';\n\n// refresh tokens have precedence to be revoked if no token is specified\nexport async function revokeToken(sdk: OktaAuthOAuthInterface, token: RevocableToken): Promise<any> {\n  let accessToken = '';\n  let refreshToken = '';\n  if (token) { \n      accessToken = (token as AccessToken).accessToken;\n      refreshToken = (token as RefreshToken).refreshToken;  \n  }\n  if(!accessToken && !refreshToken) { \n    throw new AuthSdkError('A valid access or refresh token object is required');\n  }\n  var clientId = sdk.options.clientId;\n  var clientSecret = sdk.options.clientSecret;\n  if (!clientId) {\n    throw new AuthSdkError('A clientId must be specified in the OktaAuth constructor to revoke a token');\n  }\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  var revokeUrl = getOAuthUrls(sdk).revokeUrl!;\n  var args = toQueryString({\n    // eslint-disable-next-line camelcase\n    token_type_hint: refreshToken ? 'refresh_token' : 'access_token', \n    token: refreshToken || accessToken,\n  }).slice(1);\n  var creds = clientSecret ? btoa(`${clientId}:${clientSecret}`) : btoa(clientId);\n  return post(sdk, revokeUrl, args, {\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      'Authorization': 'Basic ' + creds\n    }\n  });\n}\n"],"mappings":";;;;AAcA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AAGA,IAAAG,aAAA,GAAAC,sBAAA,CAAAJ,OAAA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAcA;AACO,eAAeK,WAAWA,CAACC,GAA2B,EAAEC,KAAqB,EAAgB;EAClG,IAAIC,WAAW,GAAG,EAAE;EACpB,IAAIC,YAAY,GAAG,EAAE;EACrB,IAAIF,KAAK,EAAE;IACPC,WAAW,GAAID,KAAK,CAAiBC,WAAW;IAChDC,YAAY,GAAIF,KAAK,CAAkBE,YAAY;EACvD;EACA,IAAG,CAACD,WAAW,IAAI,CAACC,YAAY,EAAE;IAChC,MAAM,IAAIC,qBAAY,CAAC,oDAAoD,CAAC;EAC9E;EACA,IAAIC,QAAQ,GAAGL,GAAG,CAACM,OAAO,CAACD,QAAQ;EACnC,IAAIE,YAAY,GAAGP,GAAG,CAACM,OAAO,CAACC,YAAY;EAC3C,IAAI,CAACF,QAAQ,EAAE;IACb,MAAM,IAAID,qBAAY,CAAC,4EAA4E,CAAC;EACtG;EACA;EACA,IAAII,SAAS,GAAG,IAAAC,mBAAY,EAACT,GAAG,CAAC,CAACQ,SAAU;EAC5C,IAAIE,IAAI,GAAG,IAAAC,mBAAa,EAAC;IACvB;IACAC,eAAe,EAAET,YAAY,GAAG,eAAe,GAAG,cAAc;IAChEF,KAAK,EAAEE,YAAY,IAAID;EACzB,CAAC,CAAC,CAACW,KAAK,CAAC,CAAC,CAAC;EACX,IAAIC,KAAK,GAAGP,YAAY,GAAGQ,IAAI,CAAC,GAAGV,QAAQ,IAAIE,YAAY,EAAE,CAAC,GAAGQ,IAAI,CAACV,QAAQ,CAAC;EAC/E,OAAO,IAAAW,UAAI,EAAChB,GAAG,EAAEQ,SAAS,EAAEE,IAAI,EAAE;IAChCO,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnD,eAAe,EAAE,QAAQ,GAAGH;IAC9B;EACF,CAAC,CAAC;AACJ","ignoreList":[]}

package/cjs/oidc/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","names":["createOAuthStorageManager","OAuthStorageManager","BaseStorageManager","constructor","storageManagerOptions","cookieOptions","storageUtil","getTransactionStorage","options","getOptionsForSection","logServerSideMemoryStorageWarning","storage","getStorage","storageKey","TRANSACTION_STORAGE_NAME","SavedObject","getSharedTansactionStorage","SHARED_TRANSACTION_STORAGE_NAME","getOriginalUriStorage","ORIGINAL_URI_STORAGE_NAME"],"sources":["../../../lib/oidc/storage.ts"],"sourcesContent":["import {\n  CookieOptions,\n  StorageManagerOptions,\n  StorageOptions,\n  StorageUtil\n} from '../storage/types';\nimport { BaseStorageManager, logServerSideMemoryStorageWarning } from '../storage/BaseStorageManager';\nimport { TransactionStorage, OAuthTransactionMeta, OAuthStorageManagerInterface, PKCETransactionMeta } from './types';\nimport { SavedObject } from '../storage';\nimport { ORIGINAL_URI_STORAGE_NAME, SHARED_TRANSACTION_STORAGE_NAME, TRANSACTION_STORAGE_NAME } from '../constants';\n\n\nexport function createOAuthStorageManager<M extends OAuthTransactionMeta = PKCETransactionMeta>()\n{\n  return class OAuthStorageManager\n    extends BaseStorageManager\n    implements OAuthStorageManagerInterface<M>\n  {\n    constructor(storageManagerOptions: StorageManagerOptions, cookieOptions: CookieOptions, storageUtil: StorageUtil) {\n      super(storageManagerOptions, cookieOptions, storageUtil);\n    }\n\n    getTransactionStorage(options?: StorageOptions): TransactionStorage<M> {\n      options = this.getOptionsForSection('transaction', options);\n      logServerSideMemoryStorageWarning(options);\n      const storage = this.getStorage(options);\n      const storageKey = options.storageKey || TRANSACTION_STORAGE_NAME;\n      return new SavedObject(storage, storageKey);\n    }\n\n    getSharedTansactionStorage(options?: StorageOptions): TransactionStorage<M> {\n      options = this.getOptionsForSection('shared-transaction', options);\n      logServerSideMemoryStorageWarning(options);\n      const storage = this.getStorage(options);\n      const storageKey = options.storageKey || SHARED_TRANSACTION_STORAGE_NAME;\n      return new SavedObject(storage, storageKey);\n    }\n\n    getOriginalUriStorage(options?: StorageOptions): TransactionStorage<M> {\n      options = this.getOptionsForSection('original-uri', options);\n      logServerSideMemoryStorageWarning(options);\n      const storage = this.getStorage(options);\n      const storageKey = options.storageKey || ORIGINAL_URI_STORAGE_NAME;\n      return new SavedObject(storage, storageKey);\n    }\n  };\n\n}\n"],"mappings":";;;AAMA;AAEA;AACA;AAGO,SAASA,yBAAyB,GACzC;EACE,OAAO,MAAMC,mBAAmB,SACtBC,sCAAkB,CAE5B;IACEC,WAAW,CAACC,qBAA4C,EAAEC,aAA4B,EAAEC,WAAwB,EAAE;MAChH,KAAK,CAACF,qBAAqB,EAAEC,aAAa,EAAEC,WAAW,CAAC;IAC1D;IAEAC,qBAAqB,CAACC,OAAwB,EAAyB;MACrEA,OAAO,GAAG,IAAI,CAACC,oBAAoB,CAAC,aAAa,EAAED,OAAO,CAAC;MAC3D,IAAAE,qDAAiC,EAACF,OAAO,CAAC;MAC1C,MAAMG,OAAO,GAAG,IAAI,CAACC,UAAU,CAACJ,OAAO,CAAC;MACxC,MAAMK,UAAU,GAAGL,OAAO,CAACK,UAAU,IAAIC,mCAAwB;MACjE,OAAO,IAAIC,oBAAW,CAACJ,OAAO,EAAEE,UAAU,CAAC;IAC7C;IAEAG,0BAA0B,CAACR,OAAwB,EAAyB;MAC1EA,OAAO,GAAG,IAAI,CAACC,oBAAoB,CAAC,oBAAoB,EAAED,OAAO,CAAC;MAClE,IAAAE,qDAAiC,EAACF,OAAO,CAAC;MAC1C,MAAMG,OAAO,GAAG,IAAI,CAACC,UAAU,CAACJ,OAAO,CAAC;MACxC,MAAMK,UAAU,GAAGL,OAAO,CAACK,UAAU,IAAII,0CAA+B;MACxE,OAAO,IAAIF,oBAAW,CAACJ,OAAO,EAAEE,UAAU,CAAC;IAC7C;IAEAK,qBAAqB,CAACV,OAAwB,EAAyB;MACrEA,OAAO,GAAG,IAAI,CAACC,oBAAoB,CAAC,cAAc,EAAED,OAAO,CAAC;MAC5D,IAAAE,qDAAiC,EAACF,OAAO,CAAC;MAC1C,MAAMG,OAAO,GAAG,IAAI,CAACC,UAAU,CAACJ,OAAO,CAAC;MACxC,MAAMK,UAAU,GAAGL,OAAO,CAACK,UAAU,IAAIM,oCAAyB;MAClE,OAAO,IAAIJ,oBAAW,CAACJ,OAAO,EAAEE,UAAU,CAAC;IAC7C;EACF,CAAC;AAEH"}
+{"version":3,"file":"storage.js","names":["_BaseStorageManager","require","_storage","_constants","createOAuthStorageManager","OAuthStorageManager","BaseStorageManager","constructor","storageManagerOptions","cookieOptions","storageUtil","getTransactionStorage","options","getOptionsForSection","logServerSideMemoryStorageWarning","storage","getStorage","storageKey","TRANSACTION_STORAGE_NAME","SavedObject","getSharedTansactionStorage","SHARED_TRANSACTION_STORAGE_NAME","getOriginalUriStorage","ORIGINAL_URI_STORAGE_NAME"],"sources":["../../../lib/oidc/storage.ts"],"sourcesContent":["import {\n  CookieOptions,\n  StorageManagerOptions,\n  StorageOptions,\n  StorageUtil\n} from '../storage/types';\nimport { BaseStorageManager, logServerSideMemoryStorageWarning } from '../storage/BaseStorageManager';\nimport { TransactionStorage, OAuthTransactionMeta, OAuthStorageManagerInterface, PKCETransactionMeta } from './types';\nimport { SavedObject } from '../storage';\nimport { ORIGINAL_URI_STORAGE_NAME, SHARED_TRANSACTION_STORAGE_NAME, TRANSACTION_STORAGE_NAME } from '../constants';\n\n\nexport function createOAuthStorageManager<M extends OAuthTransactionMeta = PKCETransactionMeta>()\n{\n  return class OAuthStorageManager\n    extends BaseStorageManager\n    implements OAuthStorageManagerInterface<M>\n  {\n    constructor(storageManagerOptions: StorageManagerOptions, cookieOptions: CookieOptions, storageUtil: StorageUtil) {\n      super(storageManagerOptions, cookieOptions, storageUtil);\n    }\n\n    getTransactionStorage(options?: StorageOptions): TransactionStorage<M> {\n      options = this.getOptionsForSection('transaction', options);\n      logServerSideMemoryStorageWarning(options);\n      const storage = this.getStorage(options);\n      const storageKey = options.storageKey || TRANSACTION_STORAGE_NAME;\n      return new SavedObject(storage, storageKey);\n    }\n\n    getSharedTansactionStorage(options?: StorageOptions): TransactionStorage<M> {\n      options = this.getOptionsForSection('shared-transaction', options);\n      logServerSideMemoryStorageWarning(options);\n      const storage = this.getStorage(options);\n      const storageKey = options.storageKey || SHARED_TRANSACTION_STORAGE_NAME;\n      return new SavedObject(storage, storageKey);\n    }\n\n    getOriginalUriStorage(options?: StorageOptions): TransactionStorage<M> {\n      options = this.getOptionsForSection('original-uri', options);\n      logServerSideMemoryStorageWarning(options);\n      const storage = this.getStorage(options);\n      const storageKey = options.storageKey || ORIGINAL_URI_STORAGE_NAME;\n      return new SavedObject(storage, storageKey);\n    }\n  };\n\n}\n"],"mappings":";;;AAMA,IAAAA,mBAAA,GAAAC,OAAA;AAEA,IAAAC,QAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AAGO,SAASG,yBAAyBA,CAAA,EACzC;EACE,OAAO,MAAMC,mBAAmB,SACtBC,sCAAkB,CAE5B;IACEC,WAAWA,CAACC,qBAA4C,EAAEC,aAA4B,EAAEC,WAAwB,EAAE;MAChH,KAAK,CAACF,qBAAqB,EAAEC,aAAa,EAAEC,WAAW,CAAC;IAC1D;IAEAC,qBAAqBA,CAACC,OAAwB,EAAyB;MACrEA,OAAO,GAAG,IAAI,CAACC,oBAAoB,CAAC,aAAa,EAAED,OAAO,CAAC;MAC3D,IAAAE,qDAAiC,EAACF,OAAO,CAAC;MAC1C,MAAMG,OAAO,GAAG,IAAI,CAACC,UAAU,CAACJ,OAAO,CAAC;MACxC,MAAMK,UAAU,GAAGL,OAAO,CAACK,UAAU,IAAIC,mCAAwB;MACjE,OAAO,IAAIC,oBAAW,CAACJ,OAAO,EAAEE,UAAU,CAAC;IAC7C;IAEAG,0BAA0BA,CAACR,OAAwB,EAAyB;MAC1EA,OAAO,GAAG,IAAI,CAACC,oBAAoB,CAAC,oBAAoB,EAAED,OAAO,CAAC;MAClE,IAAAE,qDAAiC,EAACF,OAAO,CAAC;MAC1C,MAAMG,OAAO,GAAG,IAAI,CAACC,UAAU,CAACJ,OAAO,CAAC;MACxC,MAAMK,UAAU,GAAGL,OAAO,CAACK,UAAU,IAAII,0CAA+B;MACxE,OAAO,IAAIF,oBAAW,CAACJ,OAAO,EAAEE,UAAU,CAAC;IAC7C;IAEAK,qBAAqBA,CAACV,OAAwB,EAAyB;MACrEA,OAAO,GAAG,IAAI,CAACC,oBAAoB,CAAC,cAAc,EAAED,OAAO,CAAC;MAC5D,IAAAE,qDAAiC,EAACF,OAAO,CAAC;MAC1C,MAAMG,OAAO,GAAG,IAAI,CAACC,UAAU,CAACJ,OAAO,CAAC;MACxC,MAAMK,UAAU,GAAGL,OAAO,CAACK,UAAU,IAAIM,oCAAyB;MAClE,OAAO,IAAIJ,oBAAW,CAACJ,OAAO,EAAEE,UAAU,CAAC;IAC7C;EACF,CAAC;AAEH","ignoreList":[]}

package/cjs/oidc/types/JWT.js.map

@@ -1 +1 @@
-{"version":3,"file":"JWT.js","names":[],"sources":["../../../../lib/oidc/types/JWT.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { UserClaims } from './UserClaims';\n\nexport interface JWTHeader {\n  alg: string;\n  typ?: string;\n  kid?: string;\n  jku?: string;\n  x5u?: string;\n  x5t?: string;\n}\n\nexport type JWTPayload = UserClaims & {\n  scp?: string[];\n}\n\nexport interface JWTObject {\n  header: JWTHeader;\n  payload: JWTPayload;\n  signature: string;\n}\n"],"mappings":""}
+{"version":3,"file":"JWT.js","names":[],"sources":["../../../../lib/oidc/types/JWT.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { UserClaims } from './UserClaims';\n\nexport interface JWTHeader {\n  alg: string;\n  typ?: string;\n  kid?: string;\n  jku?: string;\n  x5u?: string;\n  x5t?: string;\n}\n\nexport type JWTPayload = UserClaims & {\n  scp?: string[];\n}\n\nexport interface JWTObject {\n  header: JWTHeader;\n  payload: JWTPayload;\n  signature: string;\n}\n"],"mappings":"","ignoreList":[]}

package/cjs/oidc/types/Token.js

@@ -15,13 +15,13 @@ exports.isToken = isToken;
  * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  *
  * See the License for the specific language governing permissions and limitations under the License.
- */let TokenKind;
-exports.TokenKind = TokenKind;
-(function (TokenKind) {
+ */
+let TokenKind = exports.TokenKind = /*#__PURE__*/function (TokenKind) {
   TokenKind["ACCESS"] = "accessToken";
   TokenKind["ID"] = "idToken";
   TokenKind["REFRESH"] = "refreshToken";
-})(TokenKind || (exports.TokenKind = TokenKind = {}));
+  return TokenKind;
+}({});
 function isToken(obj) {
   if (obj && (obj.accessToken || obj.idToken || obj.refreshToken) && Array.isArray(obj.scopes)) {
     return true;

package/cjs/oidc/types/Token.js.map

@@ -1 +1 @@
-{"version":3,"file":"Token.js","names":["TokenKind","isToken","obj","accessToken","idToken","refreshToken","Array","isArray","scopes","isAccessToken","isIDToken","isRefreshToken"],"sources":["../../../../lib/oidc/types/Token.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { UserClaims } from './UserClaims';\n\nexport interface AbstractToken {\n  expiresAt: number;\n  authorizeUrl: string;\n  scopes: string[];\n  pendingRemove?: boolean;\n  extraParams?: Record<string, string>;\n}\n\nexport interface AccessToken extends AbstractToken {\n  accessToken: string;\n  claims: UserClaims;\n  tokenType: string;\n  userinfoUrl: string;\n  dpopPairId?: string;\n}\n\nexport interface RefreshToken extends AbstractToken {\n  refreshToken: string;\n  tokenUrl: string;\n  issuer: string;\n  dpopPairId?: string;\n}\n\nexport interface IDToken extends AbstractToken {\n  idToken: string;\n  claims: UserClaims;\n  issuer: string;\n  clientId: string;\n}\n\nexport type Token = AccessToken | IDToken | RefreshToken;\nexport type RevocableToken = AccessToken | RefreshToken;\n\nexport type TokenType = 'accessToken' | 'idToken' | 'refreshToken';\nexport enum TokenKind {\n  ACCESS = 'accessToken',\n  ID = 'idToken',\n  REFRESH = 'refreshToken',\n}\n\nexport function isToken(obj: any): obj is Token {\n  if (obj &&\n      (obj.accessToken || obj.idToken || obj.refreshToken) &&\n      Array.isArray(obj.scopes)) {\n    return true;\n  }\n  return false;\n}\n\nexport function isAccessToken(obj: any): obj is AccessToken {\n  return obj && obj.accessToken;\n}\n\nexport function isIDToken(obj: any): obj is IDToken {\n  return obj && obj.idToken;\n}\n\nexport function isRefreshToken(obj: any): obj is RefreshToken {\n  return obj && obj.refreshToken;\n}\n\nexport interface Tokens {\n  accessToken?: AccessToken;\n  idToken?: IDToken;\n  refreshToken?: RefreshToken;\n}\n"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,GAVA,IAgDYA,SAAS;AAAA;AAAA,WAATA,SAAS;EAATA,SAAS;EAATA,SAAS;EAATA,SAAS;AAAA,GAATA,SAAS,yBAATA,SAAS;AAMd,SAASC,OAAO,CAACC,GAAQ,EAAgB;EAC9C,IAAIA,GAAG,KACFA,GAAG,CAACC,WAAW,IAAID,GAAG,CAACE,OAAO,IAAIF,GAAG,CAACG,YAAY,CAAC,IACpDC,KAAK,CAACC,OAAO,CAACL,GAAG,CAACM,MAAM,CAAC,EAAE;IAC7B,OAAO,IAAI;EACb;EACA,OAAO,KAAK;AACd;AAEO,SAASC,aAAa,CAACP,GAAQ,EAAsB;EAC1D,OAAOA,GAAG,IAAIA,GAAG,CAACC,WAAW;AAC/B;AAEO,SAASO,SAAS,CAACR,GAAQ,EAAkB;EAClD,OAAOA,GAAG,IAAIA,GAAG,CAACE,OAAO;AAC3B;AAEO,SAASO,cAAc,CAACT,GAAQ,EAAuB;EAC5D,OAAOA,GAAG,IAAIA,GAAG,CAACG,YAAY;AAChC"}
+{"version":3,"file":"Token.js","names":["TokenKind","exports","isToken","obj","accessToken","idToken","refreshToken","Array","isArray","scopes","isAccessToken","isIDToken","isRefreshToken"],"sources":["../../../../lib/oidc/types/Token.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { UserClaims } from './UserClaims';\n\nexport interface AbstractToken {\n  expiresAt: number;\n  authorizeUrl: string;\n  scopes: string[];\n  pendingRemove?: boolean;\n  extraParams?: Record<string, string>;\n}\n\nexport interface AccessToken extends AbstractToken {\n  accessToken: string;\n  claims?: UserClaims;\n  tokenType: string;\n  userinfoUrl: string;\n  dpopPairId?: string;\n}\n\nexport interface RefreshToken extends AbstractToken {\n  refreshToken: string;\n  tokenUrl: string;\n  issuer: string;\n  dpopPairId?: string;\n}\n\nexport interface IDToken extends AbstractToken {\n  idToken: string;\n  claims: UserClaims;\n  issuer: string;\n  clientId: string;\n}\n\nexport type Token = AccessToken | IDToken | RefreshToken;\nexport type RevocableToken = AccessToken | RefreshToken;\n\nexport type TokenType = 'accessToken' | 'idToken' | 'refreshToken';\nexport enum TokenKind {\n  ACCESS = 'accessToken',\n  ID = 'idToken',\n  REFRESH = 'refreshToken',\n}\n\nexport function isToken(obj: any): obj is Token {\n  if (obj &&\n      (obj.accessToken || obj.idToken || obj.refreshToken) &&\n      Array.isArray(obj.scopes)) {\n    return true;\n  }\n  return false;\n}\n\nexport function isAccessToken(obj: any): obj is AccessToken {\n  return obj && obj.accessToken;\n}\n\nexport function isIDToken(obj: any): obj is IDToken {\n  return obj && obj.idToken;\n}\n\nexport function isRefreshToken(obj: any): obj is RefreshToken {\n  return obj && obj.refreshToken;\n}\n\nexport interface Tokens {\n  accessToken?: AccessToken;\n  idToken?: IDToken;\n  refreshToken?: RefreshToken;\n}\n"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAVA,IAgDYA,SAAS,GAAAC,OAAA,CAAAD,SAAA,0BAATA,SAAS;EAATA,SAAS;EAATA,SAAS;EAATA,SAAS;EAAA,OAATA,SAAS;AAAA;AAMd,SAASE,OAAOA,CAACC,GAAQ,EAAgB;EAC9C,IAAIA,GAAG,KACFA,GAAG,CAACC,WAAW,IAAID,GAAG,CAACE,OAAO,IAAIF,GAAG,CAACG,YAAY,CAAC,IACpDC,KAAK,CAACC,OAAO,CAACL,GAAG,CAACM,MAAM,CAAC,EAAE;IAC7B,OAAO,IAAI;EACb;EACA,OAAO,KAAK;AACd;AAEO,SAASC,aAAaA,CAACP,GAAQ,EAAsB;EAC1D,OAAOA,GAAG,IAAIA,GAAG,CAACC,WAAW;AAC/B;AAEO,SAASO,SAASA,CAACR,GAAQ,EAAkB;EAClD,OAAOA,GAAG,IAAIA,GAAG,CAACE,OAAO;AAC3B;AAEO,SAASO,cAAcA,CAACT,GAAQ,EAAuB;EAC5D,OAAOA,GAAG,IAAIA,GAAG,CAACG,YAAY;AAChC","ignoreList":[]}

package/cjs/oidc/types/TokenManager.js

@@ -3,16 +3,12 @@
 exports.EVENT_SET_STORAGE = exports.EVENT_RENEWED = exports.EVENT_REMOVED = exports.EVENT_EXPIRED = exports.EVENT_ERROR = exports.EVENT_ADDED = void 0;
 /* eslint-disable max-len */
 
-const EVENT_EXPIRED = 'expired';
-exports.EVENT_EXPIRED = EVENT_EXPIRED;
-const EVENT_RENEWED = 'renewed';
-exports.EVENT_RENEWED = EVENT_RENEWED;
-const EVENT_ADDED = 'added';
-exports.EVENT_ADDED = EVENT_ADDED;
-const EVENT_REMOVED = 'removed';
-exports.EVENT_REMOVED = EVENT_REMOVED;
-const EVENT_ERROR = 'error';
-exports.EVENT_ERROR = EVENT_ERROR;
-const EVENT_SET_STORAGE = 'set_storage';
-exports.EVENT_SET_STORAGE = EVENT_SET_STORAGE;
+const EVENT_EXPIRED = exports.EVENT_EXPIRED = 'expired';
+const EVENT_RENEWED = exports.EVENT_RENEWED = 'renewed';
+const EVENT_ADDED = exports.EVENT_ADDED = 'added';
+const EVENT_REMOVED = exports.EVENT_REMOVED = 'removed';
+const EVENT_ERROR = exports.EVENT_ERROR = 'error';
+const EVENT_SET_STORAGE = exports.EVENT_SET_STORAGE = 'set_storage';
+
+// only add methods needed internally
 //# sourceMappingURL=TokenManager.js.map