@okta/okta-auth-js 7.4.3 → 7.5.1

package/cjs/oidc/mixin/minimal.js

@@ -0,0 +1,29 @@
+"use strict";
+
+exports.mixinMinimalOAuth = mixinMinimalOAuth;
+var _baseApi = require("../factory/baseApi");
+var _util = require("../util");
+function mixinMinimalOAuth(Base, TransactionManagerConstructor) {
+  return class OktaAuthOAuth extends Base {
+    constructor(...args) {
+      super(...args);
+      this.transactionManager = new TransactionManagerConstructor(Object.assign({
+        storageManager: this.storageManager
+      }, this.options.transactionManager));
+      this.token = (0, _baseApi.createBaseTokenAPI)(this);
+    }
+    isLoginRedirect() {
+      return (0, _util.isLoginRedirect)(this);
+    }
+    isPKCE() {
+      return !!this.options.pkce;
+    }
+    hasResponseType(responseType) {
+      return (0, _util.hasResponseType)(responseType, this.options);
+    }
+    isAuthorizationCodeFlow() {
+      return this.hasResponseType('code');
+    }
+  };
+}
+//# sourceMappingURL=minimal.js.map

package/cjs/oidc/mixin/minimal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minimal.js","names":["mixinMinimalOAuth","Base","TransactionManagerConstructor","OktaAuthOAuth","constructor","args","transactionManager","Object","assign","storageManager","options","token","createBaseTokenAPI","isLoginRedirect","isPKCE","pkce","hasResponseType","responseType","isAuthorizationCodeFlow"],"sources":["../../../../lib/oidc/mixin/minimal.ts"],"sourcesContent":["\nimport { OktaAuthConstructor } from '../../base/types';\nimport {\n  OAuthResponseType,\n  OAuthStorageManagerInterface,\n  OAuthTransactionMeta,\n  MinimalOktaOAuthInterface,\n  OktaAuthOAuthOptions,\n  PKCETransactionMeta,\n  BaseTokenAPI,\n  TransactionManagerInterface,\n  TransactionManagerConstructor,\n} from '../types';\nimport { createBaseTokenAPI } from '../factory/baseApi';\nimport { isLoginRedirect, hasResponseType } from '../util';\n\nimport { OktaAuthSessionInterface } from '../../session/types';\nexport function mixinMinimalOAuth\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TM extends TransactionManagerInterface = TransactionManagerInterface,\n  TBase extends OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n    = OktaAuthConstructor<OktaAuthSessionInterface<S, O>>\n>\n(\n  Base: TBase,\n  TransactionManagerConstructor: TransactionManagerConstructor<TM>,\n): TBase & OktaAuthConstructor<MinimalOktaOAuthInterface<M, S, O, TM>>\n{\n  return class OktaAuthOAuth extends Base implements MinimalOktaOAuthInterface<M, S, O, TM>\n  {\n    token: BaseTokenAPI;\n    transactionManager: TM;\n    \n    constructor(...args: any[]) {\n      super(...args);\n\n      this.transactionManager = new TransactionManagerConstructor(Object.assign({\n        storageManager: this.storageManager,\n      }, this.options.transactionManager));\n  \n      this.token = createBaseTokenAPI(this as any);\n    }\n\n    isLoginRedirect(): boolean {\n      return isLoginRedirect(this as any);\n    }\n\n    isPKCE(): boolean {\n      return !!this.options.pkce;\n    }\n\n    hasResponseType(responseType: OAuthResponseType): boolean {\n      return hasResponseType(responseType, this.options);\n    }\n\n    isAuthorizationCodeFlow(): boolean {\n      return this.hasResponseType('code');\n    }\n\n  };\n\n}\n"],"mappings":";;;AAaA;AACA;AAGO,SAASA,iBAAiB,CAU/BC,IAAW,EACXC,6BAAgE,EAElE;EACE,OAAO,MAAMC,aAAa,SAASF,IAAI,CACvC;IAIEG,WAAW,CAAC,GAAGC,IAAW,EAAE;MAC1B,KAAK,CAAC,GAAGA,IAAI,CAAC;MAEd,IAAI,CAACC,kBAAkB,GAAG,IAAIJ,6BAA6B,CAACK,MAAM,CAACC,MAAM,CAAC;QACxEC,cAAc,EAAE,IAAI,CAACA;MACvB,CAAC,EAAE,IAAI,CAACC,OAAO,CAACJ,kBAAkB,CAAC,CAAC;MAEpC,IAAI,CAACK,KAAK,GAAG,IAAAC,2BAAkB,EAAC,IAAI,CAAQ;IAC9C;IAEAC,eAAe,GAAY;MACzB,OAAO,IAAAA,qBAAe,EAAC,IAAI,CAAQ;IACrC;IAEAC,MAAM,GAAY;MAChB,OAAO,CAAC,CAAC,IAAI,CAACJ,OAAO,CAACK,IAAI;IAC5B;IAEAC,eAAe,CAACC,YAA+B,EAAW;MACxD,OAAO,IAAAD,qBAAe,EAACC,YAAY,EAAE,IAAI,CAACP,OAAO,CAAC;IACpD;IAEAQ,uBAAuB,GAAY;MACjC,OAAO,IAAI,CAACF,eAAe,CAAC,MAAM,CAAC;IACrC;EAEF,CAAC;AAEH"}

package/cjs/oidc/renewTokens.js

@@ -21,8 +21,7 @@ var _util = require("./util");
 // If we have a refresh token, renew using that, otherwise getWithoutPrompt
 // eslint-disable-next-line complexity
 async function renewTokens(sdk, options) {
-  var _options;
-  const tokens = ((_options = options) === null || _options === void 0 ? void 0 : _options.tokens) ?? sdk.tokenManager.getTokensSync();
+  const tokens = options?.tokens ?? sdk.tokenManager.getTokensSync();
   if (tokens.refreshToken) {
     return (0, _renewTokensWithRefresh.renewTokensWithRefresh)(sdk, options || {}, tokens.refreshToken);
   }

package/cjs/oidc/renewTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"renewTokens.js","names":["renewTokens","sdk","options","tokens","tokenManager","getTokensSync","refreshToken","renewTokensWithRefresh","accessToken","idToken","AuthSdkError","scopes","authorizeUrl","userinfoUrl","issuer","Object","assign","pkce","responseType","getDefaultTokenParams","getWithoutPrompt","then","res"],"sources":["../../../lib/oidc/renewTokens.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { RenewTokensParams, Tokens } from './types';\nimport { getWithoutPrompt } from './getWithoutPrompt';\nimport { renewTokensWithRefresh } from './renewTokensWithRefresh';\nimport { getDefaultTokenParams } from './util';\n\n// If we have a refresh token, renew using that, otherwise getWithoutPrompt\n// eslint-disable-next-line complexity\nexport async function renewTokens(sdk, options?: RenewTokensParams): Promise<Tokens> {\n  const tokens = options?.tokens ?? sdk.tokenManager.getTokensSync();\n  if (tokens.refreshToken) {\n    return renewTokensWithRefresh(sdk, options || {}, tokens.refreshToken);\n  }\n\n  if (!tokens.accessToken && !tokens.idToken) {\n    throw new AuthSdkError('renewTokens() was called but there is no existing token');\n  }\n\n  const accessToken = tokens.accessToken || {};\n  const idToken = tokens.idToken || {};\n  const scopes = accessToken.scopes || idToken.scopes;\n  if (!scopes) {\n    throw new AuthSdkError('renewTokens: invalid tokens: could not read scopes');\n  }\n  const authorizeUrl = accessToken.authorizeUrl || idToken.authorizeUrl;\n  if (!authorizeUrl) {\n    throw new AuthSdkError('renewTokens: invalid tokens: could not read authorizeUrl');\n  }\n  const userinfoUrl = accessToken.userinfoUrl || sdk.options.userinfoUrl;\n  const issuer = idToken.issuer || sdk.options.issuer;\n\n  // Get tokens using the SSO cookie\n  options = Object.assign({\n    scopes,\n    authorizeUrl,\n    userinfoUrl,\n    issuer\n  }, options);\n\n  if (sdk.options.pkce) {\n    options.responseType = 'code';\n  } else {\n    const { responseType } = getDefaultTokenParams(sdk);\n    options.responseType = responseType;\n  }\n\n  return getWithoutPrompt(sdk, options)\n    .then(res => res.tokens);\n    \n}\n"],"mappings":";;;AAYA;AAEA;AACA;AACA;AAhBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;AACA;AACO,eAAeA,WAAW,CAACC,GAAG,EAAEC,OAA2B,EAAmB;EAAA;EACnF,MAAMC,MAAM,GAAG,aAAAD,OAAO,6CAAP,SAASC,MAAM,KAAIF,GAAG,CAACG,YAAY,CAACC,aAAa,EAAE;EAClE,IAAIF,MAAM,CAACG,YAAY,EAAE;IACvB,OAAO,IAAAC,8CAAsB,EAACN,GAAG,EAAEC,OAAO,IAAI,CAAC,CAAC,EAAEC,MAAM,CAACG,YAAY,CAAC;EACxE;EAEA,IAAI,CAACH,MAAM,CAACK,WAAW,IAAI,CAACL,MAAM,CAACM,OAAO,EAAE;IAC1C,MAAM,IAAIC,oBAAY,CAAC,yDAAyD,CAAC;EACnF;EAEA,MAAMF,WAAW,GAAGL,MAAM,CAACK,WAAW,IAAI,CAAC,CAAC;EAC5C,MAAMC,OAAO,GAAGN,MAAM,CAACM,OAAO,IAAI,CAAC,CAAC;EACpC,MAAME,MAAM,GAAGH,WAAW,CAACG,MAAM,IAAIF,OAAO,CAACE,MAAM;EACnD,IAAI,CAACA,MAAM,EAAE;IACX,MAAM,IAAID,oBAAY,CAAC,oDAAoD,CAAC;EAC9E;EACA,MAAME,YAAY,GAAGJ,WAAW,CAACI,YAAY,IAAIH,OAAO,CAACG,YAAY;EACrE,IAAI,CAACA,YAAY,EAAE;IACjB,MAAM,IAAIF,oBAAY,CAAC,0DAA0D,CAAC;EACpF;EACA,MAAMG,WAAW,GAAGL,WAAW,CAACK,WAAW,IAAIZ,GAAG,CAACC,OAAO,CAACW,WAAW;EACtE,MAAMC,MAAM,GAAGL,OAAO,CAACK,MAAM,IAAIb,GAAG,CAACC,OAAO,CAACY,MAAM;;EAEnD;EACAZ,OAAO,GAAGa,MAAM,CAACC,MAAM,CAAC;IACtBL,MAAM;IACNC,YAAY;IACZC,WAAW;IACXC;EACF,CAAC,EAAEZ,OAAO,CAAC;EAEX,IAAID,GAAG,CAACC,OAAO,CAACe,IAAI,EAAE;IACpBf,OAAO,CAACgB,YAAY,GAAG,MAAM;EAC/B,CAAC,MAAM;IACL,MAAM;MAAEA;IAAa,CAAC,GAAG,IAAAC,2BAAqB,EAAClB,GAAG,CAAC;IACnDC,OAAO,CAACgB,YAAY,GAAGA,YAAY;EACrC;EAEA,OAAO,IAAAE,kCAAgB,EAACnB,GAAG,EAAEC,OAAO,CAAC,CAClCmB,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACnB,MAAM,CAAC;AAE5B"}
+{"version":3,"file":"renewTokens.js","names":["renewTokens","sdk","options","tokens","tokenManager","getTokensSync","refreshToken","renewTokensWithRefresh","accessToken","idToken","AuthSdkError","scopes","authorizeUrl","userinfoUrl","issuer","Object","assign","pkce","responseType","getDefaultTokenParams","getWithoutPrompt","then","res"],"sources":["../../../lib/oidc/renewTokens.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError } from '../errors';\nimport { RenewTokensParams, Tokens } from './types';\nimport { getWithoutPrompt } from './getWithoutPrompt';\nimport { renewTokensWithRefresh } from './renewTokensWithRefresh';\nimport { getDefaultTokenParams } from './util';\n\n// If we have a refresh token, renew using that, otherwise getWithoutPrompt\n// eslint-disable-next-line complexity\nexport async function renewTokens(sdk, options?: RenewTokensParams): Promise<Tokens> {\n  const tokens = options?.tokens ?? sdk.tokenManager.getTokensSync();\n  if (tokens.refreshToken) {\n    return renewTokensWithRefresh(sdk, options || {}, tokens.refreshToken);\n  }\n\n  if (!tokens.accessToken && !tokens.idToken) {\n    throw new AuthSdkError('renewTokens() was called but there is no existing token');\n  }\n\n  const accessToken = tokens.accessToken || {};\n  const idToken = tokens.idToken || {};\n  const scopes = accessToken.scopes || idToken.scopes;\n  if (!scopes) {\n    throw new AuthSdkError('renewTokens: invalid tokens: could not read scopes');\n  }\n  const authorizeUrl = accessToken.authorizeUrl || idToken.authorizeUrl;\n  if (!authorizeUrl) {\n    throw new AuthSdkError('renewTokens: invalid tokens: could not read authorizeUrl');\n  }\n  const userinfoUrl = accessToken.userinfoUrl || sdk.options.userinfoUrl;\n  const issuer = idToken.issuer || sdk.options.issuer;\n\n  // Get tokens using the SSO cookie\n  options = Object.assign({\n    scopes,\n    authorizeUrl,\n    userinfoUrl,\n    issuer\n  }, options);\n\n  if (sdk.options.pkce) {\n    options.responseType = 'code';\n  } else {\n    const { responseType } = getDefaultTokenParams(sdk);\n    options.responseType = responseType;\n  }\n\n  return getWithoutPrompt(sdk, options)\n    .then(res => res.tokens);\n    \n}\n"],"mappings":";;;AAYA;AAEA;AACA;AACA;AAhBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;AACA;AACO,eAAeA,WAAW,CAACC,GAAG,EAAEC,OAA2B,EAAmB;EACnF,MAAMC,MAAM,GAAGD,OAAO,EAAEC,MAAM,IAAIF,GAAG,CAACG,YAAY,CAACC,aAAa,EAAE;EAClE,IAAIF,MAAM,CAACG,YAAY,EAAE;IACvB,OAAO,IAAAC,8CAAsB,EAACN,GAAG,EAAEC,OAAO,IAAI,CAAC,CAAC,EAAEC,MAAM,CAACG,YAAY,CAAC;EACxE;EAEA,IAAI,CAACH,MAAM,CAACK,WAAW,IAAI,CAACL,MAAM,CAACM,OAAO,EAAE;IAC1C,MAAM,IAAIC,oBAAY,CAAC,yDAAyD,CAAC;EACnF;EAEA,MAAMF,WAAW,GAAGL,MAAM,CAACK,WAAW,IAAI,CAAC,CAAC;EAC5C,MAAMC,OAAO,GAAGN,MAAM,CAACM,OAAO,IAAI,CAAC,CAAC;EACpC,MAAME,MAAM,GAAGH,WAAW,CAACG,MAAM,IAAIF,OAAO,CAACE,MAAM;EACnD,IAAI,CAACA,MAAM,EAAE;IACX,MAAM,IAAID,oBAAY,CAAC,oDAAoD,CAAC;EAC9E;EACA,MAAME,YAAY,GAAGJ,WAAW,CAACI,YAAY,IAAIH,OAAO,CAACG,YAAY;EACrE,IAAI,CAACA,YAAY,EAAE;IACjB,MAAM,IAAIF,oBAAY,CAAC,0DAA0D,CAAC;EACpF;EACA,MAAMG,WAAW,GAAGL,WAAW,CAACK,WAAW,IAAIZ,GAAG,CAACC,OAAO,CAACW,WAAW;EACtE,MAAMC,MAAM,GAAGL,OAAO,CAACK,MAAM,IAAIb,GAAG,CAACC,OAAO,CAACY,MAAM;;EAEnD;EACAZ,OAAO,GAAGa,MAAM,CAACC,MAAM,CAAC;IACtBL,MAAM;IACNC,YAAY;IACZC,WAAW;IACXC;EACF,CAAC,EAAEZ,OAAO,CAAC;EAEX,IAAID,GAAG,CAACC,OAAO,CAACe,IAAI,EAAE;IACpBf,OAAO,CAACgB,YAAY,GAAG,MAAM;EAC/B,CAAC,MAAM;IACL,MAAM;MAAEA;IAAa,CAAC,GAAG,IAAAC,2BAAqB,EAAClB,GAAG,CAAC;IACnDC,OAAO,CAACgB,YAAY,GAAGA,YAAY;EACrC;EAEA,OAAO,IAAAE,kCAAgB,EAACnB,GAAG,EAAEC,OAAO,CAAC,CAClCmB,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACnB,MAAM,CAAC;AAE5B"}

package/cjs/oidc/types/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","names":[],"sources":["../../../../lib/oidc/types/api.ts"],"sourcesContent":["/*!\n * Copyright (c) 2021-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { JWTObject } from './JWT';\nimport { OAuthTransactionMeta, PKCETransactionMeta } from './meta';\nimport { CustomUrls, OktaAuthOAuthOptions, SigninWithRedirectOptions, TokenParams, RenewTokensParams } from './options';\nimport { OAuthResponseType } from './proto';\nimport { OAuthStorageManagerInterface } from './storage';\nimport { AccessToken, IDToken, RefreshToken, RevocableToken, Token, Tokens, TokenKind } from './Token';\nimport { TokenManagerInterface } from './TokenManager';\nimport { CustomUserClaims, UserClaims } from './UserClaims';\nimport { TransactionManagerInterface } from './TransactionManager';\nimport { OktaAuthSessionInterface } from '../../session/types';\nimport { Endpoints } from './endpoints';\n\nexport interface PopupParams {\n  popupTitle?: string;\n  popupWindow?: Window;\n}\n\nexport interface TokenResponse {\n  tokens: Tokens;\n  state: string;\n  code?: string;\n  responseType?: OAuthResponseType | OAuthResponseType[] | 'none';\n}\n\nexport interface ParseFromUrlOptions {\n  url?: string;\n  responseMode?: string;\n}\n\nexport type ParseFromUrlFunction = (options?: string | ParseFromUrlOptions) => Promise<TokenResponse>;\n\nexport interface ParseFromUrlInterface extends ParseFromUrlFunction {\n  _getDocument: () => Document;\n  _getLocation: () => Location;\n  _getHistory: () => History;\n}\n\nexport type GetWithRedirectFunction = (params?: TokenParams) => Promise<void>;\n\nexport type SetLocationFunction = (loc: string) => void;\n\nexport interface BaseTokenAPI {\n  decode(token: string): JWTObject;\n  prepareTokenParams(params?: TokenParams): Promise<TokenParams>;\n  exchangeCodeForTokens(params: TokenParams, urls?: CustomUrls): Promise<TokenResponse>;\n}\n\nexport interface TokenAPI extends BaseTokenAPI {\n  getUserInfo<S extends CustomUserClaims = CustomUserClaims>(\n    accessToken?: AccessToken,\n    idToken?: IDToken\n  ): Promise<UserClaims<S>>;\n  getWithRedirect: GetWithRedirectFunction;\n  parseFromUrl: ParseFromUrlInterface;\n  getWithoutPrompt(params?: TokenParams): Promise<TokenResponse>;\n  getWithPopup(params?: TokenParams): Promise<TokenResponse>;\n  revoke(token: RevocableToken): Promise<object>;\n  renew(token: Token): Promise<Token | undefined>;\n  renewTokens(options?: RenewTokensParams): Promise<Tokens>;\n  renewTokensWithRefresh(tokenParams: TokenParams, refreshTokenObject: RefreshToken): Promise<Tokens>;\n  verify(token: IDToken, params?: object): Promise<IDToken>;\n  isLoginRedirect(): boolean;\n  introspect(kind: TokenKind, token?: Token): any;  // TODO: make real return type\n}\n\nexport interface TokenVerifyParams {\n  clientId: string;\n  issuer: string;\n  ignoreSignature?: boolean;\n  nonce?: string;\n  accessToken?: string; // raw access token string\n  acrValues?: string;\n}\n\nexport interface IDTokenAPI {\n  authorize: {\n    _getLocationHref: () => string;\n  };\n}\n\nexport interface PkceAPI {\n  DEFAULT_CODE_CHALLENGE_METHOD: string;\n  generateVerifier(prefix: string): string;\n  computeChallenge(str: string): PromiseLike<any>;\n}\n\nexport interface IsAuthenticatedOptions {\n  onExpiredToken?: 'renew' | 'remove' | 'none';\n}\n\nexport interface SignoutRedirectUrlOptions {\n  postLogoutRedirectUri?: string | null;\n  idToken?: IDToken;\n  state?: string;\n}\n\nexport interface SignoutOptions extends SignoutRedirectUrlOptions {\n  revokeAccessToken?: boolean;\n  revokeRefreshToken?: boolean;\n  accessToken?: AccessToken;\n  refreshToken?: RefreshToken;\n  clearTokensBeforeRedirect?: boolean;\n}\n\nexport interface OriginalUriApi {\n  getOriginalUri(state?: string): string | undefined;\n  setOriginalUri(originalUri: string, state?: string): void;\n  removeOriginalUri(state?: string): void;\n}\n\nexport interface OktaAuthOAuthInterface\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TM extends TransactionManagerInterface = TransactionManagerInterface\n> \n  extends OktaAuthSessionInterface<S, O>,\n  OriginalUriApi\n{\n  token: TokenAPI;\n  tokenManager: TokenManagerInterface;\n  pkce: PkceAPI;\n  transactionManager: TM;\n  endpoints: Endpoints;\n  \n  isPKCE(): boolean;\n  getIdToken(): string | undefined;\n  getAccessToken(): string | undefined;\n  getRefreshToken(): string | undefined;\n\n  isAuthenticated(options?: IsAuthenticatedOptions): Promise<boolean>;\n  signOut(opts?: SignoutOptions): Promise<boolean>;\n  isLoginRedirect(): boolean;\n  storeTokensFromRedirect(): Promise<void>;\n  getUser<T extends CustomUserClaims = CustomUserClaims>(): Promise<UserClaims<T>>;\n  signInWithRedirect(opts?: SigninWithRedirectOptions): Promise<void>;\n  \n  revokeAccessToken(accessToken?: AccessToken): Promise<unknown>;\n  revokeRefreshToken(refreshToken?: RefreshToken): Promise<unknown>;\n}\n"],"mappings":""}
+{"version":3,"file":"api.js","names":[],"sources":["../../../../lib/oidc/types/api.ts"],"sourcesContent":["/*!\n * Copyright (c) 2021-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { JWTObject } from './JWT';\nimport { OAuthTransactionMeta, PKCETransactionMeta } from './meta';\nimport { CustomUrls, OktaAuthOAuthOptions, SigninWithRedirectOptions, TokenParams, RenewTokensParams } from './options';\nimport { OAuthResponseType } from './proto';\nimport { OAuthStorageManagerInterface } from './storage';\nimport { AccessToken, IDToken, RefreshToken, RevocableToken, Token, Tokens, TokenKind } from './Token';\nimport { TokenManagerInterface } from './TokenManager';\nimport { CustomUserClaims, UserClaims } from './UserClaims';\nimport { TransactionManagerInterface } from './TransactionManager';\nimport { OktaAuthSessionInterface } from '../../session/types';\nimport { Endpoints } from './endpoints';\n\nexport interface PopupParams {\n  popupTitle?: string;\n  popupWindow?: Window;\n}\n\nexport interface TokenResponse {\n  tokens: Tokens;\n  state: string;\n  code?: string;\n  responseType?: OAuthResponseType | OAuthResponseType[] | 'none';\n}\n\nexport interface ParseFromUrlOptions {\n  url?: string;\n  responseMode?: string;\n}\n\nexport type ParseFromUrlFunction = (options?: string | ParseFromUrlOptions) => Promise<TokenResponse>;\n\nexport interface ParseFromUrlInterface extends ParseFromUrlFunction {\n  _getDocument: () => Document;\n  _getLocation: () => Location;\n  _getHistory: () => History;\n}\n\nexport type GetWithRedirectFunction = (params?: TokenParams) => Promise<void>;\n\nexport type SetLocationFunction = (loc: string) => void;\n\nexport interface BaseTokenAPI {\n  decode(token: string): JWTObject;\n  prepareTokenParams(params?: TokenParams): Promise<TokenParams>;\n  exchangeCodeForTokens(params: TokenParams, urls?: CustomUrls): Promise<TokenResponse>;\n}\n\nexport interface TokenAPI extends BaseTokenAPI {\n  getUserInfo<S extends CustomUserClaims = CustomUserClaims>(\n    accessToken?: AccessToken,\n    idToken?: IDToken\n  ): Promise<UserClaims<S>>;\n  getWithRedirect: GetWithRedirectFunction;\n  parseFromUrl: ParseFromUrlInterface;\n  getWithoutPrompt(params?: TokenParams): Promise<TokenResponse>;\n  getWithPopup(params?: TokenParams): Promise<TokenResponse>;\n  revoke(token: RevocableToken): Promise<object>;\n  renew(token: Token): Promise<Token | undefined>;\n  renewTokens(options?: RenewTokensParams): Promise<Tokens>;\n  renewTokensWithRefresh(tokenParams: TokenParams, refreshTokenObject: RefreshToken): Promise<Tokens>;\n  verify(token: IDToken, params?: object): Promise<IDToken>;\n  isLoginRedirect(): boolean;\n  introspect(kind: TokenKind, token?: Token): any;  // TODO: make real return type\n}\n\nexport interface TokenVerifyParams {\n  clientId: string;\n  issuer: string;\n  ignoreSignature?: boolean;\n  nonce?: string;\n  accessToken?: string; // raw access token string\n  acrValues?: string;\n}\n\nexport interface IDTokenAPI {\n  authorize: {\n    _getLocationHref: () => string;\n  };\n}\n\nexport interface PkceAPI {\n  DEFAULT_CODE_CHALLENGE_METHOD: string;\n  generateVerifier(prefix: string): string;\n  computeChallenge(str: string): PromiseLike<any>;\n}\n\nexport interface IsAuthenticatedOptions {\n  onExpiredToken?: 'renew' | 'remove' | 'none';\n}\n\nexport interface SignoutRedirectUrlOptions {\n  postLogoutRedirectUri?: string | null;\n  idToken?: IDToken;\n  state?: string;\n}\n\nexport interface SignoutOptions extends SignoutRedirectUrlOptions {\n  revokeAccessToken?: boolean;\n  revokeRefreshToken?: boolean;\n  accessToken?: AccessToken;\n  refreshToken?: RefreshToken;\n  clearTokensBeforeRedirect?: boolean;\n}\n\nexport interface OriginalUriApi {\n  getOriginalUri(state?: string): string | undefined;\n  setOriginalUri(originalUri: string, state?: string): void;\n  removeOriginalUri(state?: string): void;\n}\n\nexport interface MinimalOktaOAuthInterface\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TM extends TransactionManagerInterface = TransactionManagerInterface\n> \n  extends OktaAuthSessionInterface<S, O>\n{\n  token: BaseTokenAPI;\n  transactionManager: TM;\n\n  isPKCE(): boolean;\n  isLoginRedirect(): boolean;\n  isAuthorizationCodeFlow(): boolean;\n}\n\nexport interface OktaAuthOAuthInterface\n<\n  M extends OAuthTransactionMeta = PKCETransactionMeta,\n  S extends OAuthStorageManagerInterface<M> = OAuthStorageManagerInterface<M>,\n  O extends OktaAuthOAuthOptions = OktaAuthOAuthOptions,\n  TM extends TransactionManagerInterface = TransactionManagerInterface\n> \n  extends OktaAuthSessionInterface<S, O>,\n  OriginalUriApi\n{\n  token: TokenAPI;\n  tokenManager: TokenManagerInterface;\n  pkce: PkceAPI;\n  transactionManager: TM;\n  endpoints: Endpoints;\n  \n  isPKCE(): boolean;\n  getIdToken(): string | undefined;\n  getAccessToken(): string | undefined;\n  getRefreshToken(): string | undefined;\n\n  isAuthenticated(options?: IsAuthenticatedOptions): Promise<boolean>;\n  signOut(opts?: SignoutOptions): Promise<boolean>;\n  isLoginRedirect(): boolean;\n  isAuthorizationCodeFlow(): boolean;\n  storeTokensFromRedirect(): Promise<void>;\n  getUser<T extends CustomUserClaims = CustomUserClaims>(): Promise<UserClaims<T>>;\n  signInWithRedirect(opts?: SigninWithRedirectOptions): Promise<void>;\n  \n  revokeAccessToken(accessToken?: AccessToken): Promise<unknown>;\n  revokeRefreshToken(refreshToken?: RefreshToken): Promise<unknown>;\n}\n"],"mappings":""}

package/cjs/oidc/util/errors.js

@@ -30,8 +30,8 @@ function isAuthorizationCodeError(sdk, error) {
   const authApiError = error;
   // xhr property doesn't seem to match XMLHttpRequest type
   const errorResponse = authApiError.xhr;
-  const responseJSON = errorResponse === null || errorResponse === void 0 ? void 0 : errorResponse.responseJSON;
-  return sdk.options.pkce && (responseJSON === null || responseJSON === void 0 ? void 0 : responseJSON.error) === 'invalid_grant';
+  const responseJSON = errorResponse?.responseJSON;
+  return sdk.options.pkce && responseJSON?.error === 'invalid_grant';
 }
 function isRefreshTokenInvalidError(error) {
   // error: {"error":"invalid_grant","error_description":"The refresh token is invalid or expired."}

package/cjs/oidc/util/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","names":["isInteractionRequiredError","error","name","oauthError","errorCode","isAuthorizationCodeError","sdk","authApiError","errorResponse","xhr","responseJSON","options","pkce","isRefreshTokenInvalidError","isOAuthError","errorSummary"],"sources":["../../../../lib/oidc/util/errors.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\n\nimport { OktaAuthOAuthInterface } from '../types';\nimport { OAuthError, AuthApiError, isOAuthError } from '../../errors';\n\nexport function isInteractionRequiredError(error: Error) {\n  if (error.name !== 'OAuthError') {\n    return false;\n  }\n  const oauthError = error as OAuthError;\n  return (oauthError.errorCode === 'interaction_required');\n}\n\nexport function isAuthorizationCodeError(sdk: OktaAuthOAuthInterface, error: Error) {\n  if (error.name !== 'AuthApiError') {\n    return false;\n  }\n  const authApiError = error as AuthApiError;\n  // xhr property doesn't seem to match XMLHttpRequest type\n  const errorResponse = authApiError.xhr as unknown as Record<string, unknown>;\n  const responseJSON = errorResponse?.responseJSON as Record<string, unknown>;\n  return sdk.options.pkce && (responseJSON?.error as string === 'invalid_grant');\n}\n\nexport function isRefreshTokenInvalidError(error: unknown): boolean {\n  // error: {\"error\":\"invalid_grant\",\"error_description\":\"The refresh token is invalid or expired.\"}\n  return isOAuthError(error) &&\n    error.errorCode === 'invalid_grant' &&\n    error.errorSummary === 'The refresh token is invalid or expired.';\n}\n"],"mappings":";;;;;AAcA;AAdA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMO,SAASA,0BAA0B,CAACC,KAAY,EAAE;EACvD,IAAIA,KAAK,CAACC,IAAI,KAAK,YAAY,EAAE;IAC/B,OAAO,KAAK;EACd;EACA,MAAMC,UAAU,GAAGF,KAAmB;EACtC,OAAQE,UAAU,CAACC,SAAS,KAAK,sBAAsB;AACzD;AAEO,SAASC,wBAAwB,CAACC,GAA2B,EAAEL,KAAY,EAAE;EAClF,IAAIA,KAAK,CAACC,IAAI,KAAK,cAAc,EAAE;IACjC,OAAO,KAAK;EACd;EACA,MAAMK,YAAY,GAAGN,KAAqB;EAC1C;EACA,MAAMO,aAAa,GAAGD,YAAY,CAACE,GAAyC;EAC5E,MAAMC,YAAY,GAAGF,aAAa,aAAbA,aAAa,uBAAbA,aAAa,CAAEE,YAAuC;EAC3E,OAAOJ,GAAG,CAACK,OAAO,CAACC,IAAI,IAAK,CAAAF,YAAY,aAAZA,YAAY,uBAAZA,YAAY,CAAET,KAAK,MAAe,eAAgB;AAChF;AAEO,SAASY,0BAA0B,CAACZ,KAAc,EAAW;EAClE;EACA,OAAO,IAAAa,oBAAY,EAACb,KAAK,CAAC,IACxBA,KAAK,CAACG,SAAS,KAAK,eAAe,IACnCH,KAAK,CAACc,YAAY,KAAK,0CAA0C;AACrE"}
+{"version":3,"file":"errors.js","names":["isInteractionRequiredError","error","name","oauthError","errorCode","isAuthorizationCodeError","sdk","authApiError","errorResponse","xhr","responseJSON","options","pkce","isRefreshTokenInvalidError","isOAuthError","errorSummary"],"sources":["../../../../lib/oidc/util/errors.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\n\nimport { OktaAuthOAuthInterface } from '../types';\nimport { OAuthError, AuthApiError, isOAuthError } from '../../errors';\n\nexport function isInteractionRequiredError(error: Error) {\n  if (error.name !== 'OAuthError') {\n    return false;\n  }\n  const oauthError = error as OAuthError;\n  return (oauthError.errorCode === 'interaction_required');\n}\n\nexport function isAuthorizationCodeError(sdk: OktaAuthOAuthInterface, error: Error) {\n  if (error.name !== 'AuthApiError') {\n    return false;\n  }\n  const authApiError = error as AuthApiError;\n  // xhr property doesn't seem to match XMLHttpRequest type\n  const errorResponse = authApiError.xhr as unknown as Record<string, unknown>;\n  const responseJSON = errorResponse?.responseJSON as Record<string, unknown>;\n  return sdk.options.pkce && (responseJSON?.error as string === 'invalid_grant');\n}\n\nexport function isRefreshTokenInvalidError(error: unknown): boolean {\n  // error: {\"error\":\"invalid_grant\",\"error_description\":\"The refresh token is invalid or expired.\"}\n  return isOAuthError(error) &&\n    error.errorCode === 'invalid_grant' &&\n    error.errorSummary === 'The refresh token is invalid or expired.';\n}\n"],"mappings":";;;;;AAcA;AAdA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMO,SAASA,0BAA0B,CAACC,KAAY,EAAE;EACvD,IAAIA,KAAK,CAACC,IAAI,KAAK,YAAY,EAAE;IAC/B,OAAO,KAAK;EACd;EACA,MAAMC,UAAU,GAAGF,KAAmB;EACtC,OAAQE,UAAU,CAACC,SAAS,KAAK,sBAAsB;AACzD;AAEO,SAASC,wBAAwB,CAACC,GAA2B,EAAEL,KAAY,EAAE;EAClF,IAAIA,KAAK,CAACC,IAAI,KAAK,cAAc,EAAE;IACjC,OAAO,KAAK;EACd;EACA,MAAMK,YAAY,GAAGN,KAAqB;EAC1C;EACA,MAAMO,aAAa,GAAGD,YAAY,CAACE,GAAyC;EAC5E,MAAMC,YAAY,GAAGF,aAAa,EAAEE,YAAuC;EAC3E,OAAOJ,GAAG,CAACK,OAAO,CAACC,IAAI,IAAKF,YAAY,EAAET,KAAK,KAAe,eAAgB;AAChF;AAEO,SAASY,0BAA0B,CAACZ,KAAc,EAAW;EAClE;EACA,OAAO,IAAAa,oBAAY,EAACb,KAAK,CAAC,IACxBA,KAAK,CAACG,SAAS,KAAK,eAAe,IACnCH,KAAK,CAACc,YAAY,KAAK,0CAA0C;AACrE"}

package/cjs/oidc/util/loginRedirect.js

@@ -4,6 +4,7 @@ exports.getHashOrSearch = getHashOrSearch;
 exports.hasAuthorizationCode = hasAuthorizationCode;
 exports.hasErrorInUrl = hasErrorInUrl;
 exports.hasInteractionCode = hasInteractionCode;
+exports.hasResponseType = hasResponseType;
 exports.hasTokensInHash = hasTokensInHash;
 exports.isCodeFlow = isCodeFlow;
 exports.isInteractionRequired = isInteractionRequired;
@@ -50,6 +51,15 @@ function isRedirectUri(uri, sdk) {
 function isCodeFlow(options) {
   return options.pkce || options.responseType === 'code' || options.responseMode === 'query';
 }
+function hasResponseType(responseType, options) {
+  let hasResponseType = false;
+  if (Array.isArray(options.responseType) && options.responseType.length) {
+    hasResponseType = options.responseType.indexOf(responseType) >= 0;
+  } else {
+    hasResponseType = options.responseType === responseType;
+  }
+  return hasResponseType;
+}
 function getHashOrSearch(options) {
   var codeFlow = isCodeFlow(options);
   var useQuery = codeFlow && options.responseMode !== 'fragment';

package/cjs/oidc/util/loginRedirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginRedirect.js","names":["hasTokensInHash","hash","test","hasAuthorizationCode","hashOrSearch","hasInteractionCode","hasErrorInUrl","isRedirectUri","uri","sdk","authParams","options","redirectUri","indexOf","isCodeFlow","pkce","responseType","responseMode","getHashOrSearch","codeFlow","useQuery","window","location","search","isLoginRedirect","href","hasCode","isInteractionRequired"],"sources":["../../../../lib/oidc/util/loginRedirect.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\n/* global window */\n/* eslint-disable complexity, max-statements */\nimport { OktaAuthOAuthOptions, OktaAuthOAuthInterface } from '../types';\n\nexport function hasTokensInHash(hash: string): boolean {\n  return /((id|access)_token=)/i.test(hash);\n}\n\n// authorization_code\nexport function hasAuthorizationCode(hashOrSearch: string): boolean {\n  return /(code=)/i.test(hashOrSearch);\n}\n\n// interaction_code\nexport function hasInteractionCode(hashOrSearch: string): boolean {\n  return /(interaction_code=)/i.test(hashOrSearch);\n}\n\nexport function hasErrorInUrl(hashOrSearch: string): boolean {\n  return /(error=)/i.test(hashOrSearch) || /(error_description)/i.test(hashOrSearch);\n}\n\nexport function isRedirectUri(uri: string, sdk: OktaAuthOAuthInterface): boolean {\n  var authParams = sdk.options;\n  if (!uri || !authParams.redirectUri) {\n    return false;\n  }\n  return uri.indexOf(authParams.redirectUri) === 0;\n}\n\nexport function isCodeFlow(options: OktaAuthOAuthOptions) {\n  return options.pkce || options.responseType === 'code' || options.responseMode === 'query';\n}\n\nexport function getHashOrSearch(options: OktaAuthOAuthOptions) {\n  var codeFlow = isCodeFlow(options);\n  var useQuery = codeFlow && options.responseMode !== 'fragment';\n  return useQuery ? window.location.search : window.location.hash;\n}\n\n/**\n * Check if tokens or a code have been passed back into the url, which happens in\n * the OIDC (including social auth IDP) redirect flow.\n */\nexport function isLoginRedirect (sdk: OktaAuthOAuthInterface) {\n  // First check, is this a redirect URI?\n  if (!isRedirectUri(window.location.href, sdk)){\n    return false;\n  }\n\n  // The location contains either a code, token, or an error + error_description\n  var codeFlow = isCodeFlow(sdk.options);\n  var hashOrSearch = getHashOrSearch(sdk.options);\n\n  if (hasErrorInUrl(hashOrSearch)) {\n    return true;\n  }\n\n  if (codeFlow) {\n    var hasCode =  hasAuthorizationCode(hashOrSearch) || hasInteractionCode(hashOrSearch);\n    return hasCode;\n  }\n\n  // implicit flow, will always be hash fragment\n  return hasTokensInHash(window.location.hash);\n}\n\n/**\n * Check if error=interaction_required has been passed back in the url, which happens in\n * the social auth IDP redirect flow.\n */\nexport function isInteractionRequired (sdk: OktaAuthOAuthInterface, hashOrSearch?: string) {\n  if (!hashOrSearch) { // web only\n    // First check, is this a redirect URI?\n    if (!isLoginRedirect(sdk)){\n      return false;\n    }\n  \n    hashOrSearch = getHashOrSearch(sdk.options);\n  }\n  return /(error=interaction_required)/i.test(hashOrSearch);\n}"],"mappings":";;;;;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGO,SAASA,eAAe,CAACC,IAAY,EAAW;EACrD,OAAO,uBAAuB,CAACC,IAAI,CAACD,IAAI,CAAC;AAC3C;;AAEA;AACO,SAASE,oBAAoB,CAACC,YAAoB,EAAW;EAClE,OAAO,UAAU,CAACF,IAAI,CAACE,YAAY,CAAC;AACtC;;AAEA;AACO,SAASC,kBAAkB,CAACD,YAAoB,EAAW;EAChE,OAAO,sBAAsB,CAACF,IAAI,CAACE,YAAY,CAAC;AAClD;AAEO,SAASE,aAAa,CAACF,YAAoB,EAAW;EAC3D,OAAO,WAAW,CAACF,IAAI,CAACE,YAAY,CAAC,IAAI,sBAAsB,CAACF,IAAI,CAACE,YAAY,CAAC;AACpF;AAEO,SAASG,aAAa,CAACC,GAAW,EAAEC,GAA2B,EAAW;EAC/E,IAAIC,UAAU,GAAGD,GAAG,CAACE,OAAO;EAC5B,IAAI,CAACH,GAAG,IAAI,CAACE,UAAU,CAACE,WAAW,EAAE;IACnC,OAAO,KAAK;EACd;EACA,OAAOJ,GAAG,CAACK,OAAO,CAACH,UAAU,CAACE,WAAW,CAAC,KAAK,CAAC;AAClD;AAEO,SAASE,UAAU,CAACH,OAA6B,EAAE;EACxD,OAAOA,OAAO,CAACI,IAAI,IAAIJ,OAAO,CAACK,YAAY,KAAK,MAAM,IAAIL,OAAO,CAACM,YAAY,KAAK,OAAO;AAC5F;AAEO,SAASC,eAAe,CAACP,OAA6B,EAAE;EAC7D,IAAIQ,QAAQ,GAAGL,UAAU,CAACH,OAAO,CAAC;EAClC,IAAIS,QAAQ,GAAGD,QAAQ,IAAIR,OAAO,CAACM,YAAY,KAAK,UAAU;EAC9D,OAAOG,QAAQ,GAAGC,MAAM,CAACC,QAAQ,CAACC,MAAM,GAAGF,MAAM,CAACC,QAAQ,CAACrB,IAAI;AACjE;;AAEA;AACA;AACA;AACA;AACO,SAASuB,eAAe,CAAEf,GAA2B,EAAE;EAC5D;EACA,IAAI,CAACF,aAAa,CAACc,MAAM,CAACC,QAAQ,CAACG,IAAI,EAAEhB,GAAG,CAAC,EAAC;IAC5C,OAAO,KAAK;EACd;;EAEA;EACA,IAAIU,QAAQ,GAAGL,UAAU,CAACL,GAAG,CAACE,OAAO,CAAC;EACtC,IAAIP,YAAY,GAAGc,eAAe,CAACT,GAAG,CAACE,OAAO,CAAC;EAE/C,IAAIL,aAAa,CAACF,YAAY,CAAC,EAAE;IAC/B,OAAO,IAAI;EACb;EAEA,IAAIe,QAAQ,EAAE;IACZ,IAAIO,OAAO,GAAIvB,oBAAoB,CAACC,YAAY,CAAC,IAAIC,kBAAkB,CAACD,YAAY,CAAC;IACrF,OAAOsB,OAAO;EAChB;;EAEA;EACA,OAAO1B,eAAe,CAACqB,MAAM,CAACC,QAAQ,CAACrB,IAAI,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACO,SAAS0B,qBAAqB,CAAElB,GAA2B,EAAEL,YAAqB,EAAE;EACzF,IAAI,CAACA,YAAY,EAAE;IAAE;IACnB;IACA,IAAI,CAACoB,eAAe,CAACf,GAAG,CAAC,EAAC;MACxB,OAAO,KAAK;IACd;IAEAL,YAAY,GAAGc,eAAe,CAACT,GAAG,CAACE,OAAO,CAAC;EAC7C;EACA,OAAO,+BAA+B,CAACT,IAAI,CAACE,YAAY,CAAC;AAC3D"}
+{"version":3,"file":"loginRedirect.js","names":["hasTokensInHash","hash","test","hasAuthorizationCode","hashOrSearch","hasInteractionCode","hasErrorInUrl","isRedirectUri","uri","sdk","authParams","options","redirectUri","indexOf","isCodeFlow","pkce","responseType","responseMode","hasResponseType","Array","isArray","length","getHashOrSearch","codeFlow","useQuery","window","location","search","isLoginRedirect","href","hasCode","isInteractionRequired"],"sources":["../../../../lib/oidc/util/loginRedirect.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\n/* global window */\n/* eslint-disable complexity, max-statements */\nimport { OktaAuthOAuthOptions, OktaAuthOAuthInterface, OAuthResponseType } from '../types';\n\nexport function hasTokensInHash(hash: string): boolean {\n  return /((id|access)_token=)/i.test(hash);\n}\n\n// authorization_code\nexport function hasAuthorizationCode(hashOrSearch: string): boolean {\n  return /(code=)/i.test(hashOrSearch);\n}\n\n// interaction_code\nexport function hasInteractionCode(hashOrSearch: string): boolean {\n  return /(interaction_code=)/i.test(hashOrSearch);\n}\n\nexport function hasErrorInUrl(hashOrSearch: string): boolean {\n  return /(error=)/i.test(hashOrSearch) || /(error_description)/i.test(hashOrSearch);\n}\n\nexport function isRedirectUri(uri: string, sdk: OktaAuthOAuthInterface): boolean {\n  var authParams = sdk.options;\n  if (!uri || !authParams.redirectUri) {\n    return false;\n  }\n  return uri.indexOf(authParams.redirectUri) === 0;\n}\n\nexport function isCodeFlow(options: OktaAuthOAuthOptions) {\n  return options.pkce || options.responseType === 'code' || options.responseMode === 'query';\n}\n\nexport function hasResponseType(responseType: OAuthResponseType, options: OktaAuthOAuthOptions): boolean {\n  let hasResponseType = false;\n  if (Array.isArray(options.responseType) && options.responseType.length) {\n    hasResponseType = options.responseType.indexOf(responseType) >= 0;\n  } else {\n    hasResponseType = options.responseType === responseType;\n  }\n  return hasResponseType;\n}\n\nexport function getHashOrSearch(options: OktaAuthOAuthOptions) {\n  var codeFlow = isCodeFlow(options);\n  var useQuery = codeFlow && options.responseMode !== 'fragment';\n  return useQuery ? window.location.search : window.location.hash;\n}\n\n/**\n * Check if tokens or a code have been passed back into the url, which happens in\n * the OIDC (including social auth IDP) redirect flow.\n */\nexport function isLoginRedirect (sdk: OktaAuthOAuthInterface) {\n  // First check, is this a redirect URI?\n  if (!isRedirectUri(window.location.href, sdk)){\n    return false;\n  }\n\n  // The location contains either a code, token, or an error + error_description\n  var codeFlow = isCodeFlow(sdk.options);\n  var hashOrSearch = getHashOrSearch(sdk.options);\n\n  if (hasErrorInUrl(hashOrSearch)) {\n    return true;\n  }\n\n  if (codeFlow) {\n    var hasCode =  hasAuthorizationCode(hashOrSearch) || hasInteractionCode(hashOrSearch);\n    return hasCode;\n  }\n\n  // implicit flow, will always be hash fragment\n  return hasTokensInHash(window.location.hash);\n}\n\n/**\n * Check if error=interaction_required has been passed back in the url, which happens in\n * the social auth IDP redirect flow.\n */\nexport function isInteractionRequired (sdk: OktaAuthOAuthInterface, hashOrSearch?: string) {\n  if (!hashOrSearch) { // web only\n    // First check, is this a redirect URI?\n    if (!isLoginRedirect(sdk)){\n      return false;\n    }\n  \n    hashOrSearch = getHashOrSearch(sdk.options);\n  }\n  return /(error=interaction_required)/i.test(hashOrSearch);\n}"],"mappings":";;;;;;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGO,SAASA,eAAe,CAACC,IAAY,EAAW;EACrD,OAAO,uBAAuB,CAACC,IAAI,CAACD,IAAI,CAAC;AAC3C;;AAEA;AACO,SAASE,oBAAoB,CAACC,YAAoB,EAAW;EAClE,OAAO,UAAU,CAACF,IAAI,CAACE,YAAY,CAAC;AACtC;;AAEA;AACO,SAASC,kBAAkB,CAACD,YAAoB,EAAW;EAChE,OAAO,sBAAsB,CAACF,IAAI,CAACE,YAAY,CAAC;AAClD;AAEO,SAASE,aAAa,CAACF,YAAoB,EAAW;EAC3D,OAAO,WAAW,CAACF,IAAI,CAACE,YAAY,CAAC,IAAI,sBAAsB,CAACF,IAAI,CAACE,YAAY,CAAC;AACpF;AAEO,SAASG,aAAa,CAACC,GAAW,EAAEC,GAA2B,EAAW;EAC/E,IAAIC,UAAU,GAAGD,GAAG,CAACE,OAAO;EAC5B,IAAI,CAACH,GAAG,IAAI,CAACE,UAAU,CAACE,WAAW,EAAE;IACnC,OAAO,KAAK;EACd;EACA,OAAOJ,GAAG,CAACK,OAAO,CAACH,UAAU,CAACE,WAAW,CAAC,KAAK,CAAC;AAClD;AAEO,SAASE,UAAU,CAACH,OAA6B,EAAE;EACxD,OAAOA,OAAO,CAACI,IAAI,IAAIJ,OAAO,CAACK,YAAY,KAAK,MAAM,IAAIL,OAAO,CAACM,YAAY,KAAK,OAAO;AAC5F;AAEO,SAASC,eAAe,CAACF,YAA+B,EAAEL,OAA6B,EAAW;EACvG,IAAIO,eAAe,GAAG,KAAK;EAC3B,IAAIC,KAAK,CAACC,OAAO,CAACT,OAAO,CAACK,YAAY,CAAC,IAAIL,OAAO,CAACK,YAAY,CAACK,MAAM,EAAE;IACtEH,eAAe,GAAGP,OAAO,CAACK,YAAY,CAACH,OAAO,CAACG,YAAY,CAAC,IAAI,CAAC;EACnE,CAAC,MAAM;IACLE,eAAe,GAAGP,OAAO,CAACK,YAAY,KAAKA,YAAY;EACzD;EACA,OAAOE,eAAe;AACxB;AAEO,SAASI,eAAe,CAACX,OAA6B,EAAE;EAC7D,IAAIY,QAAQ,GAAGT,UAAU,CAACH,OAAO,CAAC;EAClC,IAAIa,QAAQ,GAAGD,QAAQ,IAAIZ,OAAO,CAACM,YAAY,KAAK,UAAU;EAC9D,OAAOO,QAAQ,GAAGC,MAAM,CAACC,QAAQ,CAACC,MAAM,GAAGF,MAAM,CAACC,QAAQ,CAACzB,IAAI;AACjE;;AAEA;AACA;AACA;AACA;AACO,SAAS2B,eAAe,CAAEnB,GAA2B,EAAE;EAC5D;EACA,IAAI,CAACF,aAAa,CAACkB,MAAM,CAACC,QAAQ,CAACG,IAAI,EAAEpB,GAAG,CAAC,EAAC;IAC5C,OAAO,KAAK;EACd;;EAEA;EACA,IAAIc,QAAQ,GAAGT,UAAU,CAACL,GAAG,CAACE,OAAO,CAAC;EACtC,IAAIP,YAAY,GAAGkB,eAAe,CAACb,GAAG,CAACE,OAAO,CAAC;EAE/C,IAAIL,aAAa,CAACF,YAAY,CAAC,EAAE;IAC/B,OAAO,IAAI;EACb;EAEA,IAAImB,QAAQ,EAAE;IACZ,IAAIO,OAAO,GAAI3B,oBAAoB,CAACC,YAAY,CAAC,IAAIC,kBAAkB,CAACD,YAAY,CAAC;IACrF,OAAO0B,OAAO;EAChB;;EAEA;EACA,OAAO9B,eAAe,CAACyB,MAAM,CAACC,QAAQ,CAACzB,IAAI,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACO,SAAS8B,qBAAqB,CAAEtB,GAA2B,EAAEL,YAAqB,EAAE;EACzF,IAAI,CAACA,YAAY,EAAE;IAAE;IACnB;IACA,IAAI,CAACwB,eAAe,CAACnB,GAAG,CAAC,EAAC;MACxB,OAAO,KAAK;IACd;IAEAL,YAAY,GAAGkB,eAAe,CAACb,GAAG,CAACE,OAAO,CAAC;EAC7C;EACA,OAAO,+BAA+B,CAACT,IAAI,CAACE,YAAY,CAAC;AAC3D"}

package/cjs/oidc/util/validateClaims.js

@@ -33,7 +33,7 @@ function validateClaims(sdk, claims, validationParams) {
   if (claims.iss !== iss) {
     throw new _AuthSdkError.default('The issuer [' + claims.iss + '] ' + 'does not match [' + iss + ']');
   }
-  if (claims.aud !== aud) {
+  if (Array.isArray(claims.aud) && claims.aud.indexOf(aud) < 0 || !Array.isArray(claims.aud) && claims.aud !== aud) {
     throw new _AuthSdkError.default('The audience [' + claims.aud + '] ' + 'does not match [' + aud + ']');
   }
   if (acr && claims.acr !== acr) {

package/cjs/oidc/util/validateClaims.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateClaims.js","names":["validateClaims","sdk","claims","validationParams","aud","clientId","iss","issuer","nonce","acr","acrValues","AuthSdkError","now","Math","floor","Date","iat","exp","options","ignoreLifetime","maxClockSkew"],"sources":["../../../../lib/oidc/util/validateClaims.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\n/* eslint-disable complexity, max-statements */\n\nimport AuthSdkError from '../../errors/AuthSdkError';\nimport { OktaAuthOAuthInterface, TokenVerifyParams, UserClaims } from '../../oidc/types';\n\nexport function validateClaims(sdk: OktaAuthOAuthInterface, claims: UserClaims, validationParams: TokenVerifyParams) {\n  const aud = validationParams.clientId;\n  const iss = validationParams.issuer;\n  const nonce = validationParams.nonce;\n  const acr = validationParams.acrValues;\n\n  if (!claims || !iss || !aud) {\n    throw new AuthSdkError('The jwt, iss, and aud arguments are all required');\n  }\n\n  if (nonce && claims.nonce !== nonce) {\n    throw new AuthSdkError('OAuth flow response nonce doesn\\'t match request nonce');\n  }\n\n  const now = Math.floor(Date.now()/1000);\n\n  if (claims.iss !== iss) {\n    throw new AuthSdkError('The issuer [' + claims.iss + '] ' +\n      'does not match [' + iss + ']');\n  }\n\n  if (claims.aud !== aud) {\n    throw new AuthSdkError('The audience [' + claims.aud + '] ' +\n      'does not match [' + aud + ']');\n  }\n\n  if (acr && claims.acr !== acr) {\n    throw new AuthSdkError('The acr [' + claims.acr + '] ' +\n      'does not match acr_values [' + acr + ']');\n  }\n\n  if (claims.iat! > claims.exp!) {\n    throw new AuthSdkError('The JWT expired before it was issued');\n  }\n\n  if (!sdk.options.ignoreLifetime) {\n    if ((now - sdk.options.maxClockSkew!) > claims.exp!) {\n      throw new AuthSdkError('The JWT expired and is no longer valid');\n    }\n\n    if (claims.iat! > (now + sdk.options.maxClockSkew!)) {\n      throw new AuthSdkError('The JWT was issued in the future');\n    }\n  }\n}\n"],"mappings":";;;;AAeA;AAfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKO,SAASA,cAAc,CAACC,GAA2B,EAAEC,MAAkB,EAAEC,gBAAmC,EAAE;EACnH,MAAMC,GAAG,GAAGD,gBAAgB,CAACE,QAAQ;EACrC,MAAMC,GAAG,GAAGH,gBAAgB,CAACI,MAAM;EACnC,MAAMC,KAAK,GAAGL,gBAAgB,CAACK,KAAK;EACpC,MAAMC,GAAG,GAAGN,gBAAgB,CAACO,SAAS;EAEtC,IAAI,CAACR,MAAM,IAAI,CAACI,GAAG,IAAI,CAACF,GAAG,EAAE;IAC3B,MAAM,IAAIO,qBAAY,CAAC,kDAAkD,CAAC;EAC5E;EAEA,IAAIH,KAAK,IAAIN,MAAM,CAACM,KAAK,KAAKA,KAAK,EAAE;IACnC,MAAM,IAAIG,qBAAY,CAAC,wDAAwD,CAAC;EAClF;EAEA,MAAMC,GAAG,GAAGC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACH,GAAG,EAAE,GAAC,IAAI,CAAC;EAEvC,IAAIV,MAAM,CAACI,GAAG,KAAKA,GAAG,EAAE;IACtB,MAAM,IAAIK,qBAAY,CAAC,cAAc,GAAGT,MAAM,CAACI,GAAG,GAAG,IAAI,GACvD,kBAAkB,GAAGA,GAAG,GAAG,GAAG,CAAC;EACnC;EAEA,IAAIJ,MAAM,CAACE,GAAG,KAAKA,GAAG,EAAE;IACtB,MAAM,IAAIO,qBAAY,CAAC,gBAAgB,GAAGT,MAAM,CAACE,GAAG,GAAG,IAAI,GACzD,kBAAkB,GAAGA,GAAG,GAAG,GAAG,CAAC;EACnC;EAEA,IAAIK,GAAG,IAAIP,MAAM,CAACO,GAAG,KAAKA,GAAG,EAAE;IAC7B,MAAM,IAAIE,qBAAY,CAAC,WAAW,GAAGT,MAAM,CAACO,GAAG,GAAG,IAAI,GACpD,6BAA6B,GAAGA,GAAG,GAAG,GAAG,CAAC;EAC9C;EAEA,IAAIP,MAAM,CAACc,GAAG,GAAId,MAAM,CAACe,GAAI,EAAE;IAC7B,MAAM,IAAIN,qBAAY,CAAC,sCAAsC,CAAC;EAChE;EAEA,IAAI,CAACV,GAAG,CAACiB,OAAO,CAACC,cAAc,EAAE;IAC/B,IAAKP,GAAG,GAAGX,GAAG,CAACiB,OAAO,CAACE,YAAa,GAAIlB,MAAM,CAACe,GAAI,EAAE;MACnD,MAAM,IAAIN,qBAAY,CAAC,wCAAwC,CAAC;IAClE;IAEA,IAAIT,MAAM,CAACc,GAAG,GAAKJ,GAAG,GAAGX,GAAG,CAACiB,OAAO,CAACE,YAAc,EAAE;MACnD,MAAM,IAAIT,qBAAY,CAAC,kCAAkC,CAAC;IAC5D;EACF;AACF"}
+{"version":3,"file":"validateClaims.js","names":["validateClaims","sdk","claims","validationParams","aud","clientId","iss","issuer","nonce","acr","acrValues","AuthSdkError","now","Math","floor","Date","Array","isArray","indexOf","iat","exp","options","ignoreLifetime","maxClockSkew"],"sources":["../../../../lib/oidc/util/validateClaims.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\n/* eslint-disable complexity, max-statements */\n\nimport AuthSdkError from '../../errors/AuthSdkError';\nimport { OktaAuthOAuthInterface, TokenVerifyParams, UserClaims } from '../../oidc/types';\n\nexport function validateClaims(sdk: OktaAuthOAuthInterface, claims: UserClaims, validationParams: TokenVerifyParams) {\n  const aud = validationParams.clientId;\n  const iss = validationParams.issuer;\n  const nonce = validationParams.nonce;\n  const acr = validationParams.acrValues;\n\n  if (!claims || !iss || !aud) {\n    throw new AuthSdkError('The jwt, iss, and aud arguments are all required');\n  }\n\n  if (nonce && claims.nonce !== nonce) {\n    throw new AuthSdkError('OAuth flow response nonce doesn\\'t match request nonce');\n  }\n\n  const now = Math.floor(Date.now()/1000);\n\n  if (claims.iss !== iss) {\n    throw new AuthSdkError('The issuer [' + claims.iss + '] ' +\n      'does not match [' + iss + ']');\n  }\n\n  if ((Array.isArray(claims.aud) && claims.aud.indexOf(aud) < 0) ||\n    (!Array.isArray(claims.aud) && claims.aud !== aud))\n  {\n    throw new AuthSdkError('The audience [' + claims.aud + '] ' +\n      'does not match [' + aud + ']');\n  }\n\n  if (acr && claims.acr !== acr) {\n    throw new AuthSdkError('The acr [' + claims.acr + '] ' +\n      'does not match acr_values [' + acr + ']');\n  }\n\n  if (claims.iat! > claims.exp!) {\n    throw new AuthSdkError('The JWT expired before it was issued');\n  }\n\n  if (!sdk.options.ignoreLifetime) {\n    if ((now - sdk.options.maxClockSkew!) > claims.exp!) {\n      throw new AuthSdkError('The JWT expired and is no longer valid');\n    }\n\n    if (claims.iat! > (now + sdk.options.maxClockSkew!)) {\n      throw new AuthSdkError('The JWT was issued in the future');\n    }\n  }\n}\n"],"mappings":";;;;AAeA;AAfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKO,SAASA,cAAc,CAACC,GAA2B,EAAEC,MAAkB,EAAEC,gBAAmC,EAAE;EACnH,MAAMC,GAAG,GAAGD,gBAAgB,CAACE,QAAQ;EACrC,MAAMC,GAAG,GAAGH,gBAAgB,CAACI,MAAM;EACnC,MAAMC,KAAK,GAAGL,gBAAgB,CAACK,KAAK;EACpC,MAAMC,GAAG,GAAGN,gBAAgB,CAACO,SAAS;EAEtC,IAAI,CAACR,MAAM,IAAI,CAACI,GAAG,IAAI,CAACF,GAAG,EAAE;IAC3B,MAAM,IAAIO,qBAAY,CAAC,kDAAkD,CAAC;EAC5E;EAEA,IAAIH,KAAK,IAAIN,MAAM,CAACM,KAAK,KAAKA,KAAK,EAAE;IACnC,MAAM,IAAIG,qBAAY,CAAC,wDAAwD,CAAC;EAClF;EAEA,MAAMC,GAAG,GAAGC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACH,GAAG,EAAE,GAAC,IAAI,CAAC;EAEvC,IAAIV,MAAM,CAACI,GAAG,KAAKA,GAAG,EAAE;IACtB,MAAM,IAAIK,qBAAY,CAAC,cAAc,GAAGT,MAAM,CAACI,GAAG,GAAG,IAAI,GACvD,kBAAkB,GAAGA,GAAG,GAAG,GAAG,CAAC;EACnC;EAEA,IAAKU,KAAK,CAACC,OAAO,CAACf,MAAM,CAACE,GAAG,CAAC,IAAIF,MAAM,CAACE,GAAG,CAACc,OAAO,CAACd,GAAG,CAAC,GAAG,CAAC,IAC1D,CAACY,KAAK,CAACC,OAAO,CAACf,MAAM,CAACE,GAAG,CAAC,IAAIF,MAAM,CAACE,GAAG,KAAKA,GAAI,EACpD;IACE,MAAM,IAAIO,qBAAY,CAAC,gBAAgB,GAAGT,MAAM,CAACE,GAAG,GAAG,IAAI,GACzD,kBAAkB,GAAGA,GAAG,GAAG,GAAG,CAAC;EACnC;EAEA,IAAIK,GAAG,IAAIP,MAAM,CAACO,GAAG,KAAKA,GAAG,EAAE;IAC7B,MAAM,IAAIE,qBAAY,CAAC,WAAW,GAAGT,MAAM,CAACO,GAAG,GAAG,IAAI,GACpD,6BAA6B,GAAGA,GAAG,GAAG,GAAG,CAAC;EAC9C;EAEA,IAAIP,MAAM,CAACiB,GAAG,GAAIjB,MAAM,CAACkB,GAAI,EAAE;IAC7B,MAAM,IAAIT,qBAAY,CAAC,sCAAsC,CAAC;EAChE;EAEA,IAAI,CAACV,GAAG,CAACoB,OAAO,CAACC,cAAc,EAAE;IAC/B,IAAKV,GAAG,GAAGX,GAAG,CAACoB,OAAO,CAACE,YAAa,GAAIrB,MAAM,CAACkB,GAAI,EAAE;MACnD,MAAM,IAAIT,qBAAY,CAAC,wCAAwC,CAAC;IAClE;IAEA,IAAIT,MAAM,CAACiB,GAAG,GAAKP,GAAG,GAAGX,GAAG,CAACoB,OAAO,CAACE,YAAc,EAAE;MACnD,MAAM,IAAIZ,qBAAY,CAAC,kCAAkC,CAAC;IAC5D;EACF;AACF"}

package/cjs/oidc/verifyToken.js

@@ -34,7 +34,7 @@ async function verifyToken(sdk, token, validationParams) {
 
   // The configured issuer may point to a frontend proxy.
   // Get the "real" issuer from .well-known/openid-configuration
-  const configuredIssuer = (validationParams === null || validationParams === void 0 ? void 0 : validationParams.issuer) || sdk.options.issuer;
+  const configuredIssuer = validationParams?.issuer || sdk.options.issuer;
   const {
     issuer
   } = await (0, _wellKnown.getWellKnown)(sdk, configuredIssuer);

package/cjs/oidc/verifyToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyToken.js","names":["verifyToken","sdk","token","validationParams","idToken","AuthSdkError","jwt","decodeToken","configuredIssuer","issuer","options","getWellKnown","validationOptions","Object","assign","clientId","ignoreSignature","validateClaims","payload","features","isTokenVerifySupported","key","getKey","header","kid","valid","sdkCrypto","accessToken","claims","at_hash","hash","getOidcHash"],"sources":["../../../lib/oidc/verifyToken.ts"],"sourcesContent":["/* eslint-disable max-len */\n/* eslint-disable complexity */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { getWellKnown, getKey } from './endpoints/well-known';\nimport { validateClaims } from './util';\nimport { AuthSdkError } from '../errors';\nimport { IDToken, OktaAuthOAuthInterface, TokenVerifyParams } from '../oidc/types';\nimport { decodeToken } from './decodeToken';\nimport * as sdkCrypto from '../crypto';\n\n// Verify the id token\nexport async function verifyToken(sdk: OktaAuthOAuthInterface, token: IDToken, validationParams: TokenVerifyParams): Promise<IDToken> {\n  if (!token || !token.idToken) {\n    throw new AuthSdkError('Only idTokens may be verified');\n  }\n\n  // Decode the Jwt object (may throw)\n  const jwt = decodeToken(token.idToken);\n\n  // The configured issuer may point to a frontend proxy.\n  // Get the \"real\" issuer from .well-known/openid-configuration\n  const configuredIssuer = validationParams?.issuer || sdk.options.issuer;\n  const { issuer } = await getWellKnown(sdk, configuredIssuer);\n\n  const validationOptions: TokenVerifyParams = Object.assign({\n    // base options, can be overridden by params\n    clientId: sdk.options.clientId,\n    ignoreSignature: sdk.options.ignoreSignature\n  }, validationParams, {\n    // final options, cannot be overridden\n    issuer\n  });\n\n  // Standard claim validation (may throw)\n  validateClaims(sdk, jwt.payload, validationOptions);\n\n  // If the browser doesn't support native crypto or we choose not\n  // to verify the signature, bail early\n  if (validationOptions.ignoreSignature == true || !sdk.features.isTokenVerifySupported()) {\n    return token;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  const key = await getKey(sdk, token.issuer, jwt.header.kid!);\n  const valid = await sdkCrypto.verifyToken(token.idToken, key);\n  if (!valid) {\n    throw new AuthSdkError('The token signature is not valid');\n  }\n  if (validationParams && validationParams.accessToken && token.claims.at_hash) {\n    const hash = await sdkCrypto.getOidcHash(validationParams.accessToken);\n    if (hash !== token.claims.at_hash) {\n      throw new AuthSdkError('Token hash verification failed');\n    }\n  }\n  return token;\n}\n"],"mappings":";;;AAcA;AACA;AACA;AAEA;AACA;AAAuC;AAAA;AAnBvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA;AACO,eAAeA,WAAW,CAACC,GAA2B,EAAEC,KAAc,EAAEC,gBAAmC,EAAoB;EACpI,IAAI,CAACD,KAAK,IAAI,CAACA,KAAK,CAACE,OAAO,EAAE;IAC5B,MAAM,IAAIC,oBAAY,CAAC,+BAA+B,CAAC;EACzD;;EAEA;EACA,MAAMC,GAAG,GAAG,IAAAC,wBAAW,EAACL,KAAK,CAACE,OAAO,CAAC;;EAEtC;EACA;EACA,MAAMI,gBAAgB,GAAG,CAAAL,gBAAgB,aAAhBA,gBAAgB,uBAAhBA,gBAAgB,CAAEM,MAAM,KAAIR,GAAG,CAACS,OAAO,CAACD,MAAM;EACvE,MAAM;IAAEA;EAAO,CAAC,GAAG,MAAM,IAAAE,uBAAY,EAACV,GAAG,EAAEO,gBAAgB,CAAC;EAE5D,MAAMI,iBAAoC,GAAGC,MAAM,CAACC,MAAM,CAAC;IACzD;IACAC,QAAQ,EAAEd,GAAG,CAACS,OAAO,CAACK,QAAQ;IAC9BC,eAAe,EAAEf,GAAG,CAACS,OAAO,CAACM;EAC/B,CAAC,EAAEb,gBAAgB,EAAE;IACnB;IACAM;EACF,CAAC,CAAC;;EAEF;EACA,IAAAQ,oBAAc,EAAChB,GAAG,EAAEK,GAAG,CAACY,OAAO,EAAEN,iBAAiB,CAAC;;EAEnD;EACA;EACA,IAAIA,iBAAiB,CAACI,eAAe,IAAI,IAAI,IAAI,CAACf,GAAG,CAACkB,QAAQ,CAACC,sBAAsB,EAAE,EAAE;IACvF,OAAOlB,KAAK;EACd;;EAEA;EACA,MAAMmB,GAAG,GAAG,MAAM,IAAAC,iBAAM,EAACrB,GAAG,EAAEC,KAAK,CAACO,MAAM,EAAEH,GAAG,CAACiB,MAAM,CAACC,GAAG,CAAE;EAC5D,MAAMC,KAAK,GAAG,MAAMC,SAAS,CAAC1B,WAAW,CAACE,KAAK,CAACE,OAAO,EAAEiB,GAAG,CAAC;EAC7D,IAAI,CAACI,KAAK,EAAE;IACV,MAAM,IAAIpB,oBAAY,CAAC,kCAAkC,CAAC;EAC5D;EACA,IAAIF,gBAAgB,IAAIA,gBAAgB,CAACwB,WAAW,IAAIzB,KAAK,CAAC0B,MAAM,CAACC,OAAO,EAAE;IAC5E,MAAMC,IAAI,GAAG,MAAMJ,SAAS,CAACK,WAAW,CAAC5B,gBAAgB,CAACwB,WAAW,CAAC;IACtE,IAAIG,IAAI,KAAK5B,KAAK,CAAC0B,MAAM,CAACC,OAAO,EAAE;MACjC,MAAM,IAAIxB,oBAAY,CAAC,gCAAgC,CAAC;IAC1D;EACF;EACA,OAAOH,KAAK;AACd"}
+{"version":3,"file":"verifyToken.js","names":["verifyToken","sdk","token","validationParams","idToken","AuthSdkError","jwt","decodeToken","configuredIssuer","issuer","options","getWellKnown","validationOptions","Object","assign","clientId","ignoreSignature","validateClaims","payload","features","isTokenVerifySupported","key","getKey","header","kid","valid","sdkCrypto","accessToken","claims","at_hash","hash","getOidcHash"],"sources":["../../../lib/oidc/verifyToken.ts"],"sourcesContent":["/* eslint-disable max-len */\n/* eslint-disable complexity */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { getWellKnown, getKey } from './endpoints/well-known';\nimport { validateClaims } from './util';\nimport { AuthSdkError } from '../errors';\nimport { IDToken, OktaAuthOAuthInterface, TokenVerifyParams } from '../oidc/types';\nimport { decodeToken } from './decodeToken';\nimport * as sdkCrypto from '../crypto';\n\n// Verify the id token\nexport async function verifyToken(sdk: OktaAuthOAuthInterface, token: IDToken, validationParams: TokenVerifyParams): Promise<IDToken> {\n  if (!token || !token.idToken) {\n    throw new AuthSdkError('Only idTokens may be verified');\n  }\n\n  // Decode the Jwt object (may throw)\n  const jwt = decodeToken(token.idToken);\n\n  // The configured issuer may point to a frontend proxy.\n  // Get the \"real\" issuer from .well-known/openid-configuration\n  const configuredIssuer = validationParams?.issuer || sdk.options.issuer;\n  const { issuer } = await getWellKnown(sdk, configuredIssuer);\n\n  const validationOptions: TokenVerifyParams = Object.assign({\n    // base options, can be overridden by params\n    clientId: sdk.options.clientId,\n    ignoreSignature: sdk.options.ignoreSignature\n  }, validationParams, {\n    // final options, cannot be overridden\n    issuer\n  });\n\n  // Standard claim validation (may throw)\n  validateClaims(sdk, jwt.payload, validationOptions);\n\n  // If the browser doesn't support native crypto or we choose not\n  // to verify the signature, bail early\n  if (validationOptions.ignoreSignature == true || !sdk.features.isTokenVerifySupported()) {\n    return token;\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  const key = await getKey(sdk, token.issuer, jwt.header.kid!);\n  const valid = await sdkCrypto.verifyToken(token.idToken, key);\n  if (!valid) {\n    throw new AuthSdkError('The token signature is not valid');\n  }\n  if (validationParams && validationParams.accessToken && token.claims.at_hash) {\n    const hash = await sdkCrypto.getOidcHash(validationParams.accessToken);\n    if (hash !== token.claims.at_hash) {\n      throw new AuthSdkError('Token hash verification failed');\n    }\n  }\n  return token;\n}\n"],"mappings":";;;AAcA;AACA;AACA;AAEA;AACA;AAAuC;AAAA;AAnBvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA;AACO,eAAeA,WAAW,CAACC,GAA2B,EAAEC,KAAc,EAAEC,gBAAmC,EAAoB;EACpI,IAAI,CAACD,KAAK,IAAI,CAACA,KAAK,CAACE,OAAO,EAAE;IAC5B,MAAM,IAAIC,oBAAY,CAAC,+BAA+B,CAAC;EACzD;;EAEA;EACA,MAAMC,GAAG,GAAG,IAAAC,wBAAW,EAACL,KAAK,CAACE,OAAO,CAAC;;EAEtC;EACA;EACA,MAAMI,gBAAgB,GAAGL,gBAAgB,EAAEM,MAAM,IAAIR,GAAG,CAACS,OAAO,CAACD,MAAM;EACvE,MAAM;IAAEA;EAAO,CAAC,GAAG,MAAM,IAAAE,uBAAY,EAACV,GAAG,EAAEO,gBAAgB,CAAC;EAE5D,MAAMI,iBAAoC,GAAGC,MAAM,CAACC,MAAM,CAAC;IACzD;IACAC,QAAQ,EAAEd,GAAG,CAACS,OAAO,CAACK,QAAQ;IAC9BC,eAAe,EAAEf,GAAG,CAACS,OAAO,CAACM;EAC/B,CAAC,EAAEb,gBAAgB,EAAE;IACnB;IACAM;EACF,CAAC,CAAC;;EAEF;EACA,IAAAQ,oBAAc,EAAChB,GAAG,EAAEK,GAAG,CAACY,OAAO,EAAEN,iBAAiB,CAAC;;EAEnD;EACA;EACA,IAAIA,iBAAiB,CAACI,eAAe,IAAI,IAAI,IAAI,CAACf,GAAG,CAACkB,QAAQ,CAACC,sBAAsB,EAAE,EAAE;IACvF,OAAOlB,KAAK;EACd;;EAEA;EACA,MAAMmB,GAAG,GAAG,MAAM,IAAAC,iBAAM,EAACrB,GAAG,EAAEC,KAAK,CAACO,MAAM,EAAEH,GAAG,CAACiB,MAAM,CAACC,GAAG,CAAE;EAC5D,MAAMC,KAAK,GAAG,MAAMC,SAAS,CAAC1B,WAAW,CAACE,KAAK,CAACE,OAAO,EAAEiB,GAAG,CAAC;EAC7D,IAAI,CAACI,KAAK,EAAE;IACV,MAAM,IAAIpB,oBAAY,CAAC,kCAAkC,CAAC;EAC5D;EACA,IAAIF,gBAAgB,IAAIA,gBAAgB,CAACwB,WAAW,IAAIzB,KAAK,CAAC0B,MAAM,CAACC,OAAO,EAAE;IAC5E,MAAMC,IAAI,GAAG,MAAMJ,SAAS,CAACK,WAAW,CAAC5B,gBAAgB,CAACwB,WAAW,CAAC;IACtE,IAAIG,IAAI,KAAK5B,KAAK,CAAC0B,MAAM,CAACC,OAAO,EAAE;MACjC,MAAM,IAAIxB,oBAAY,CAAC,gCAAgC,CAAC;IAC1D;EACF;EACA,OAAOH,KAAK;AACd"}

package/cjs/services/LeaderElectionService.js

@@ -26,16 +26,13 @@ class LeaderElectionService {
   }
   onLeaderDuplicate() {}
   async onLeader() {
-    var _this$options$onLeade, _this$options;
-    await ((_this$options$onLeade = (_this$options = this.options).onLeader) === null || _this$options$onLeade === void 0 ? void 0 : _this$options$onLeade.call(_this$options));
+    await this.options.onLeader?.();
   }
   isLeader() {
-    var _this$elector;
-    return !!((_this$elector = this.elector) !== null && _this$elector !== void 0 && _this$elector.isLeader);
+    return !!this.elector?.isLeader;
   }
   hasLeader() {
-    var _this$elector2;
-    return !!((_this$elector2 = this.elector) !== null && _this$elector2 !== void 0 && _this$elector2.hasLeader);
+    return !!this.elector?.hasLeader;
   }
   async start() {
     if (this.canStart()) {

package/cjs/services/LeaderElectionService.js.map

@@ -1 +1 @@
-{"version":3,"file":"LeaderElectionService.js","names":["LeaderElectionService","constructor","options","onLeaderDuplicate","bind","onLeader","isLeader","elector","hasLeader","start","canStart","electionChannelName","channel","BroadcastChannel","createLeaderElection","onduplicate","awaitLeadership","then","started","stop","die","undefined","postInternal","Promise","resolve","close","requiresLeadership","isStarted","isBrowser"],"sources":["../../../lib/services/LeaderElectionService.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\n\nimport { ServiceInterface, ServiceManagerOptions } from '../core/types';\nimport {\n  BroadcastChannel,\n  createLeaderElection,\n  LeaderElector\n} from 'broadcast-channel';\nimport { isBrowser } from '../features';\n\ndeclare type OnLeaderHandler = (() => Promise<void>);\ndeclare type ServiceOptions = ServiceManagerOptions & {\n  onLeader?: OnLeaderHandler;\n};\n\nexport class LeaderElectionService implements ServiceInterface {\n  private options: ServiceOptions;\n  private channel?: BroadcastChannel;\n  private elector?: LeaderElector;\n  private started = false;\n\n  constructor(options: ServiceOptions = {}) {\n    this.options = options;\n    this.onLeaderDuplicate = this.onLeaderDuplicate.bind(this);\n    this.onLeader = this.onLeader.bind(this);\n  }\n\n  private onLeaderDuplicate() {\n  }\n\n  private async onLeader() {\n    await this.options.onLeader?.();\n  }\n\n  isLeader() {\n    return !!this.elector?.isLeader;\n  }\n\n  hasLeader() {\n    return !!this.elector?.hasLeader;\n  }\n\n  async start() {\n    if (this.canStart()) {\n      const { electionChannelName } = this.options;\n      this.channel = new BroadcastChannel(electionChannelName as string);\n      this.elector = createLeaderElection(this.channel);\n      this.elector.onduplicate = this.onLeaderDuplicate;\n      this.elector.awaitLeadership().then(this.onLeader);\n      this.started = true;\n    }\n  }\n\n  async stop() {\n    if (this.started) {\n      if (this.elector) {\n        await this.elector.die();\n        this.elector = undefined;\n      }\n      if (this.channel) {\n        // Workaround to fix error `Failed to execute 'postMessage' on 'BroadcastChannel': Channel is closed`\n        (this.channel as any).postInternal = () => Promise.resolve();\n        await this.channel.close();\n        this.channel = undefined;\n      }\n      this.started = false;\n    }\n  }\n\n  requiresLeadership() {\n    return false;\n  }\n\n  isStarted() {\n    return this.started;\n  }\n\n  canStart() {\n    return isBrowser() && !this.started;\n  }\n\n}\n"],"mappings":";;;;;AAcA;AAKA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAgBO,MAAMA,qBAAqB,CAA6B;EAM7DC,WAAW,CAACC,OAAuB,GAAG,CAAC,CAAC,EAAE;IAAA,+CAFxB,KAAK;IAGrB,IAAI,CAACA,OAAO,GAAGA,OAAO;IACtB,IAAI,CAACC,iBAAiB,GAAG,IAAI,CAACA,iBAAiB,CAACC,IAAI,CAAC,IAAI,CAAC;IAC1D,IAAI,CAACC,QAAQ,GAAG,IAAI,CAACA,QAAQ,CAACD,IAAI,CAAC,IAAI,CAAC;EAC1C;EAEQD,iBAAiB,GAAG,CAC5B;EAEA,MAAcE,QAAQ,GAAG;IAAA;IACvB,gCAAM,qBAAI,CAACH,OAAO,EAACG,QAAQ,0DAArB,yCAAyB;EACjC;EAEAC,QAAQ,GAAG;IAAA;IACT,OAAO,CAAC,mBAAC,IAAI,CAACC,OAAO,0CAAZ,cAAcD,QAAQ;EACjC;EAEAE,SAAS,GAAG;IAAA;IACV,OAAO,CAAC,oBAAC,IAAI,CAACD,OAAO,2CAAZ,eAAcC,SAAS;EAClC;EAEA,MAAMC,KAAK,GAAG;IACZ,IAAI,IAAI,CAACC,QAAQ,EAAE,EAAE;MACnB,MAAM;QAAEC;MAAoB,CAAC,GAAG,IAAI,CAACT,OAAO;MAC5C,IAAI,CAACU,OAAO,GAAG,IAAIC,kCAAgB,CAACF,mBAAmB,CAAW;MAClE,IAAI,CAACJ,OAAO,GAAG,IAAAO,sCAAoB,EAAC,IAAI,CAACF,OAAO,CAAC;MACjD,IAAI,CAACL,OAAO,CAACQ,WAAW,GAAG,IAAI,CAACZ,iBAAiB;MACjD,IAAI,CAACI,OAAO,CAACS,eAAe,EAAE,CAACC,IAAI,CAAC,IAAI,CAACZ,QAAQ,CAAC;MAClD,IAAI,CAACa,OAAO,GAAG,IAAI;IACrB;EACF;EAEA,MAAMC,IAAI,GAAG;IACX,IAAI,IAAI,CAACD,OAAO,EAAE;MAChB,IAAI,IAAI,CAACX,OAAO,EAAE;QAChB,MAAM,IAAI,CAACA,OAAO,CAACa,GAAG,EAAE;QACxB,IAAI,CAACb,OAAO,GAAGc,SAAS;MAC1B;MACA,IAAI,IAAI,CAACT,OAAO,EAAE;QAChB;QACC,IAAI,CAACA,OAAO,CAASU,YAAY,GAAG,MAAMC,OAAO,CAACC,OAAO,EAAE;QAC5D,MAAM,IAAI,CAACZ,OAAO,CAACa,KAAK,EAAE;QAC1B,IAAI,CAACb,OAAO,GAAGS,SAAS;MAC1B;MACA,IAAI,CAACH,OAAO,GAAG,KAAK;IACtB;EACF;EAEAQ,kBAAkB,GAAG;IACnB,OAAO,KAAK;EACd;EAEAC,SAAS,GAAG;IACV,OAAO,IAAI,CAACT,OAAO;EACrB;EAEAR,QAAQ,GAAG;IACT,OAAO,IAAAkB,mBAAS,GAAE,IAAI,CAAC,IAAI,CAACV,OAAO;EACrC;AAEF;AAAC"}
+{"version":3,"file":"LeaderElectionService.js","names":["LeaderElectionService","constructor","options","onLeaderDuplicate","bind","onLeader","isLeader","elector","hasLeader","start","canStart","electionChannelName","channel","BroadcastChannel","createLeaderElection","onduplicate","awaitLeadership","then","started","stop","die","undefined","postInternal","Promise","resolve","close","requiresLeadership","isStarted","isBrowser"],"sources":["../../../lib/services/LeaderElectionService.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\n\nimport { ServiceInterface, ServiceManagerOptions } from '../core/types';\nimport {\n  BroadcastChannel,\n  createLeaderElection,\n  LeaderElector\n} from 'broadcast-channel';\nimport { isBrowser } from '../features';\n\ndeclare type OnLeaderHandler = (() => Promise<void>);\ndeclare type ServiceOptions = ServiceManagerOptions & {\n  onLeader?: OnLeaderHandler;\n};\n\nexport class LeaderElectionService implements ServiceInterface {\n  private options: ServiceOptions;\n  private channel?: BroadcastChannel;\n  private elector?: LeaderElector;\n  private started = false;\n\n  constructor(options: ServiceOptions = {}) {\n    this.options = options;\n    this.onLeaderDuplicate = this.onLeaderDuplicate.bind(this);\n    this.onLeader = this.onLeader.bind(this);\n  }\n\n  private onLeaderDuplicate() {\n  }\n\n  private async onLeader() {\n    await this.options.onLeader?.();\n  }\n\n  isLeader() {\n    return !!this.elector?.isLeader;\n  }\n\n  hasLeader() {\n    return !!this.elector?.hasLeader;\n  }\n\n  async start() {\n    if (this.canStart()) {\n      const { electionChannelName } = this.options;\n      this.channel = new BroadcastChannel(electionChannelName as string);\n      this.elector = createLeaderElection(this.channel);\n      this.elector.onduplicate = this.onLeaderDuplicate;\n      this.elector.awaitLeadership().then(this.onLeader);\n      this.started = true;\n    }\n  }\n\n  async stop() {\n    if (this.started) {\n      if (this.elector) {\n        await this.elector.die();\n        this.elector = undefined;\n      }\n      if (this.channel) {\n        // Workaround to fix error `Failed to execute 'postMessage' on 'BroadcastChannel': Channel is closed`\n        (this.channel as any).postInternal = () => Promise.resolve();\n        await this.channel.close();\n        this.channel = undefined;\n      }\n      this.started = false;\n    }\n  }\n\n  requiresLeadership() {\n    return false;\n  }\n\n  isStarted() {\n    return this.started;\n  }\n\n  canStart() {\n    return isBrowser() && !this.started;\n  }\n\n}\n"],"mappings":";;;;;AAcA;AAKA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAgBO,MAAMA,qBAAqB,CAA6B;EAM7DC,WAAW,CAACC,OAAuB,GAAG,CAAC,CAAC,EAAE;IAAA,+CAFxB,KAAK;IAGrB,IAAI,CAACA,OAAO,GAAGA,OAAO;IACtB,IAAI,CAACC,iBAAiB,GAAG,IAAI,CAACA,iBAAiB,CAACC,IAAI,CAAC,IAAI,CAAC;IAC1D,IAAI,CAACC,QAAQ,GAAG,IAAI,CAACA,QAAQ,CAACD,IAAI,CAAC,IAAI,CAAC;EAC1C;EAEQD,iBAAiB,GAAG,CAC5B;EAEA,MAAcE,QAAQ,GAAG;IACvB,MAAM,IAAI,CAACH,OAAO,CAACG,QAAQ,IAAI;EACjC;EAEAC,QAAQ,GAAG;IACT,OAAO,CAAC,CAAC,IAAI,CAACC,OAAO,EAAED,QAAQ;EACjC;EAEAE,SAAS,GAAG;IACV,OAAO,CAAC,CAAC,IAAI,CAACD,OAAO,EAAEC,SAAS;EAClC;EAEA,MAAMC,KAAK,GAAG;IACZ,IAAI,IAAI,CAACC,QAAQ,EAAE,EAAE;MACnB,MAAM;QAAEC;MAAoB,CAAC,GAAG,IAAI,CAACT,OAAO;MAC5C,IAAI,CAACU,OAAO,GAAG,IAAIC,kCAAgB,CAACF,mBAAmB,CAAW;MAClE,IAAI,CAACJ,OAAO,GAAG,IAAAO,sCAAoB,EAAC,IAAI,CAACF,OAAO,CAAC;MACjD,IAAI,CAACL,OAAO,CAACQ,WAAW,GAAG,IAAI,CAACZ,iBAAiB;MACjD,IAAI,CAACI,OAAO,CAACS,eAAe,EAAE,CAACC,IAAI,CAAC,IAAI,CAACZ,QAAQ,CAAC;MAClD,IAAI,CAACa,OAAO,GAAG,IAAI;IACrB;EACF;EAEA,MAAMC,IAAI,GAAG;IACX,IAAI,IAAI,CAACD,OAAO,EAAE;MAChB,IAAI,IAAI,CAACX,OAAO,EAAE;QAChB,MAAM,IAAI,CAACA,OAAO,CAACa,GAAG,EAAE;QACxB,IAAI,CAACb,OAAO,GAAGc,SAAS;MAC1B;MACA,IAAI,IAAI,CAACT,OAAO,EAAE;QAChB;QACC,IAAI,CAACA,OAAO,CAASU,YAAY,GAAG,MAAMC,OAAO,CAACC,OAAO,EAAE;QAC5D,MAAM,IAAI,CAACZ,OAAO,CAACa,KAAK,EAAE;QAC1B,IAAI,CAACb,OAAO,GAAGS,SAAS;MAC1B;MACA,IAAI,CAACH,OAAO,GAAG,KAAK;IACtB;EACF;EAEAQ,kBAAkB,GAAG;IACnB,OAAO,KAAK;EACd;EAEAC,SAAS,GAAG;IACV,OAAO,IAAI,CAACT,OAAO;EACrB;EAEAR,QAAQ,GAAG;IACT,OAAO,IAAAkB,mBAAS,GAAE,IAAI,CAAC,IAAI,CAACV,OAAO;EACrC;AAEF;AAAC"}

package/cjs/services/SyncStorageService.js

@@ -62,45 +62,41 @@ class SyncStorageService {
   }
   async stop() {
     if (this.started) {
-      var _this$channel, _this$channel2;
       this.tokenManager.off(_types.EVENT_ADDED, this.onTokenAddedHandler);
       this.tokenManager.off(_types.EVENT_REMOVED, this.onTokenRemovedHandler);
       this.tokenManager.off(_types.EVENT_RENEWED, this.onTokenRenewedHandler);
       this.tokenManager.off(_types.EVENT_SET_STORAGE, this.onSetStorageHandler);
-      (_this$channel = this.channel) === null || _this$channel === void 0 ? void 0 : _this$channel.removeEventListener('message', this.onSyncMessageHandler);
-      await ((_this$channel2 = this.channel) === null || _this$channel2 === void 0 ? void 0 : _this$channel2.close());
+      this.channel?.removeEventListener('message', this.onSyncMessageHandler);
+      await this.channel?.close();
       this.channel = undefined;
       this.started = false;
     }
   }
   onTokenAddedHandler(key, token) {
-    var _this$channel3;
     if (!this.enablePostMessage) {
       return;
     }
-    (_this$channel3 = this.channel) === null || _this$channel3 === void 0 ? void 0 : _this$channel3.postMessage({
+    this.channel?.postMessage({
       type: _types.EVENT_ADDED,
       key,
       token
     });
   }
   onTokenRemovedHandler(key, token) {
-    var _this$channel4;
     if (!this.enablePostMessage) {
       return;
     }
-    (_this$channel4 = this.channel) === null || _this$channel4 === void 0 ? void 0 : _this$channel4.postMessage({
+    this.channel?.postMessage({
       type: _types.EVENT_REMOVED,
       key,
       token
     });
   }
   onTokenRenewedHandler(key, token, oldToken) {
-    var _this$channel5;
     if (!this.enablePostMessage) {
       return;
     }
-    (_this$channel5 = this.channel) === null || _this$channel5 === void 0 ? void 0 : _this$channel5.postMessage({
+    this.channel?.postMessage({
       type: _types.EVENT_RENEWED,
       key,
       token,
@@ -108,8 +104,7 @@ class SyncStorageService {
     });
   }
   onSetStorageHandler(storage) {
-    var _this$channel6;
-    (_this$channel6 = this.channel) === null || _this$channel6 === void 0 ? void 0 : _this$channel6.postMessage({
+    this.channel?.postMessage({
       type: _types.EVENT_SET_STORAGE,
       storage
     });

package/cjs/services/SyncStorageService.js.map

@@ -1 +1 @@
-{"version":3,"file":"SyncStorageService.js","names":["SyncStorageService","constructor","tokenManager","options","onTokenAddedHandler","bind","onTokenRemovedHandler","onTokenRenewedHandler","onSetStorageHandler","onSyncMessageHandler","requiresLeadership","isStarted","started","canStart","syncStorage","isBrowser","start","syncChannelName","channel","BroadcastChannel","err","AuthSdkError","on","EVENT_ADDED","EVENT_REMOVED","EVENT_RENEWED","EVENT_SET_STORAGE","addEventListener","stop","off","removeEventListener","close","undefined","key","token","enablePostMessage","postMessage","type","oldToken","storage","msg","getStorage","setStorage","emitAdded","setExpireEventTimeout","clearExpireEventTimeout","emitRemoved","emitRenewed"],"sources":["../../../lib/services/SyncStorageService.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { BroadcastChannel } from 'broadcast-channel';\nimport { isBrowser } from '../features';\nimport {\n  ServiceManagerOptions, ServiceInterface\n} from '../core/types';\nimport {\n  Token, Tokens, \n  EVENT_ADDED, EVENT_REMOVED, EVENT_RENEWED, EVENT_SET_STORAGE, TokenManagerInterface\n} from '../oidc/types';\nimport { AuthSdkError } from '../errors';\n\nexport type SyncMessage = {\n  type: string;\n  key?: string;\n  token?: Token;\n  oldToken?: Token;\n  storage?: Tokens;\n};\nexport class SyncStorageService implements ServiceInterface {\n  private tokenManager: TokenManagerInterface;\n  private options: ServiceManagerOptions;\n  private channel?: BroadcastChannel<SyncMessage>;\n  private started = false;\n  private enablePostMessage = true;\n\n  constructor(tokenManager: TokenManagerInterface, options: ServiceManagerOptions = {}) {\n    this.tokenManager = tokenManager;\n    this.options = options;\n    this.onTokenAddedHandler = this.onTokenAddedHandler.bind(this);\n    this.onTokenRemovedHandler = this.onTokenRemovedHandler.bind(this);\n    this.onTokenRenewedHandler = this.onTokenRenewedHandler.bind(this);\n    this.onSetStorageHandler = this.onSetStorageHandler.bind(this);\n    this.onSyncMessageHandler = this.onSyncMessageHandler.bind(this);\n  }\n\n  requiresLeadership() {\n    return false;\n  }\n\n  isStarted() {\n    return this.started;\n  }\n\n  canStart() {\n    return !!this.options.syncStorage && isBrowser() && !this.started;\n  }\n\n  async start() {\n    if (!this.canStart()) {\n      return;\n    }\n    \n    const { syncChannelName } = this.options;\n    try {\n      // BroadcastChannel throws if no supported method can be found\n      this.channel = new BroadcastChannel(syncChannelName as string);\n    } catch (err) {\n      throw new AuthSdkError('SyncStorageService is not supported in current browser.');\n    }\n\n    this.tokenManager.on(EVENT_ADDED, this.onTokenAddedHandler);\n    this.tokenManager.on(EVENT_REMOVED, this.onTokenRemovedHandler);\n    this.tokenManager.on(EVENT_RENEWED, this.onTokenRenewedHandler);\n    this.tokenManager.on(EVENT_SET_STORAGE, this.onSetStorageHandler);\n    this.channel.addEventListener('message', this.onSyncMessageHandler);\n    this.started = true;\n  }\n\n  async stop() {\n    if (this.started) {\n      this.tokenManager.off(EVENT_ADDED, this.onTokenAddedHandler);\n      this.tokenManager.off(EVENT_REMOVED, this.onTokenRemovedHandler);\n      this.tokenManager.off(EVENT_RENEWED, this.onTokenRenewedHandler);\n      this.tokenManager.off(EVENT_SET_STORAGE, this.onSetStorageHandler);\n      this.channel?.removeEventListener('message', this.onSyncMessageHandler);\n      await this.channel?.close();\n      this.channel = undefined;\n      this.started = false;\n    }\n  }\n\n  private onTokenAddedHandler(key: string, token: Token) {\n    if (!this.enablePostMessage) {\n      return;\n    }\n    this.channel?.postMessage({\n      type: EVENT_ADDED,\n      key,\n      token\n    });\n  }\n\n  private onTokenRemovedHandler(key: string, token: Token) {\n    if (!this.enablePostMessage) {\n      return;\n    }\n    this.channel?.postMessage({\n      type: EVENT_REMOVED,\n      key,\n      token\n    });\n  }\n\n  private onTokenRenewedHandler(key: string, token: Token, oldToken?: Token) {\n    if (!this.enablePostMessage) {\n      return;\n    }\n    this.channel?.postMessage({\n      type: EVENT_RENEWED,\n      key,\n      token,\n      oldToken\n    });\n  }\n\n  private onSetStorageHandler(storage: Tokens) {\n    this.channel?.postMessage({\n      type: EVENT_SET_STORAGE,\n      storage\n    });\n  }\n\n  /* eslint-disable complexity */\n  private onSyncMessageHandler(msg: SyncMessage) {\n    // Notes:\n    // 1. Using `enablePostMessage` flag here to prevent sync message loop.\n    //    If this flag is on, tokenManager event handlers do not post sync message.\n    // 2. IE11 has known issue with synchronization of LocalStorage cross tabs.\n    //    One workaround is to set empty event handler for `window.onstorage`.\n    //    But it's not 100% working, sometimes you still get old value from LocalStorage.\n    //    Better approch is to explicitly udpate LocalStorage with `setStorage`.\n\n    this.enablePostMessage = false;\n    switch (msg.type) {\n      case EVENT_SET_STORAGE:\n        this.tokenManager.getStorage().setStorage(msg.storage);\n        break;\n      case EVENT_ADDED:\n        this.tokenManager.emitAdded(msg.key!, msg.token!);\n        this.tokenManager.setExpireEventTimeout(msg.key!, msg.token!);\n        break;\n      case EVENT_REMOVED:\n        this.tokenManager.clearExpireEventTimeout(msg.key!);\n        this.tokenManager.emitRemoved(msg.key!, msg.token!);\n        break;\n      case EVENT_RENEWED:\n        this.tokenManager.emitRenewed(msg.key!, msg.token!, msg.oldToken);\n        break;\n      default:\n        break;\n    }\n    this.enablePostMessage = true;\n  }\n} "],"mappings":";;;;;AAYA;AACA;AAIA;AAIA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoBO,MAAMA,kBAAkB,CAA6B;EAO1DC,WAAW,CAACC,YAAmC,EAAEC,OAA8B,GAAG,CAAC,CAAC,EAAE;IAAA,+CAHpE,KAAK;IAAA,yDACK,IAAI;IAG9B,IAAI,CAACD,YAAY,GAAGA,YAAY;IAChC,IAAI,CAACC,OAAO,GAAGA,OAAO;IACtB,IAAI,CAACC,mBAAmB,GAAG,IAAI,CAACA,mBAAmB,CAACC,IAAI,CAAC,IAAI,CAAC;IAC9D,IAAI,CAACC,qBAAqB,GAAG,IAAI,CAACA,qBAAqB,CAACD,IAAI,CAAC,IAAI,CAAC;IAClE,IAAI,CAACE,qBAAqB,GAAG,IAAI,CAACA,qBAAqB,CAACF,IAAI,CAAC,IAAI,CAAC;IAClE,IAAI,CAACG,mBAAmB,GAAG,IAAI,CAACA,mBAAmB,CAACH,IAAI,CAAC,IAAI,CAAC;IAC9D,IAAI,CAACI,oBAAoB,GAAG,IAAI,CAACA,oBAAoB,CAACJ,IAAI,CAAC,IAAI,CAAC;EAClE;EAEAK,kBAAkB,GAAG;IACnB,OAAO,KAAK;EACd;EAEAC,SAAS,GAAG;IACV,OAAO,IAAI,CAACC,OAAO;EACrB;EAEAC,QAAQ,GAAG;IACT,OAAO,CAAC,CAAC,IAAI,CAACV,OAAO,CAACW,WAAW,IAAI,IAAAC,mBAAS,GAAE,IAAI,CAAC,IAAI,CAACH,OAAO;EACnE;EAEA,MAAMI,KAAK,GAAG;IACZ,IAAI,CAAC,IAAI,CAACH,QAAQ,EAAE,EAAE;MACpB;IACF;IAEA,MAAM;MAAEI;IAAgB,CAAC,GAAG,IAAI,CAACd,OAAO;IACxC,IAAI;MACF;MACA,IAAI,CAACe,OAAO,GAAG,IAAIC,kCAAgB,CAACF,eAAe,CAAW;IAChE,CAAC,CAAC,OAAOG,GAAG,EAAE;MACZ,MAAM,IAAIC,oBAAY,CAAC,yDAAyD,CAAC;IACnF;IAEA,IAAI,CAACnB,YAAY,CAACoB,EAAE,CAACC,kBAAW,EAAE,IAAI,CAACnB,mBAAmB,CAAC;IAC3D,IAAI,CAACF,YAAY,CAACoB,EAAE,CAACE,oBAAa,EAAE,IAAI,CAAClB,qBAAqB,CAAC;IAC/D,IAAI,CAACJ,YAAY,CAACoB,EAAE,CAACG,oBAAa,EAAE,IAAI,CAAClB,qBAAqB,CAAC;IAC/D,IAAI,CAACL,YAAY,CAACoB,EAAE,CAACI,wBAAiB,EAAE,IAAI,CAAClB,mBAAmB,CAAC;IACjE,IAAI,CAACU,OAAO,CAACS,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAClB,oBAAoB,CAAC;IACnE,IAAI,CAACG,OAAO,GAAG,IAAI;EACrB;EAEA,MAAMgB,IAAI,GAAG;IACX,IAAI,IAAI,CAAChB,OAAO,EAAE;MAAA;MAChB,IAAI,CAACV,YAAY,CAAC2B,GAAG,CAACN,kBAAW,EAAE,IAAI,CAACnB,mBAAmB,CAAC;MAC5D,IAAI,CAACF,YAAY,CAAC2B,GAAG,CAACL,oBAAa,EAAE,IAAI,CAAClB,qBAAqB,CAAC;MAChE,IAAI,CAACJ,YAAY,CAAC2B,GAAG,CAACJ,oBAAa,EAAE,IAAI,CAAClB,qBAAqB,CAAC;MAChE,IAAI,CAACL,YAAY,CAAC2B,GAAG,CAACH,wBAAiB,EAAE,IAAI,CAAClB,mBAAmB,CAAC;MAClE,qBAAI,CAACU,OAAO,kDAAZ,cAAcY,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAACrB,oBAAoB,CAAC;MACvE,yBAAM,IAAI,CAACS,OAAO,mDAAZ,eAAca,KAAK,EAAE;MAC3B,IAAI,CAACb,OAAO,GAAGc,SAAS;MACxB,IAAI,CAACpB,OAAO,GAAG,KAAK;IACtB;EACF;EAEQR,mBAAmB,CAAC6B,GAAW,EAAEC,KAAY,EAAE;IAAA;IACrD,IAAI,CAAC,IAAI,CAACC,iBAAiB,EAAE;MAC3B;IACF;IACA,sBAAI,CAACjB,OAAO,mDAAZ,eAAckB,WAAW,CAAC;MACxBC,IAAI,EAAEd,kBAAW;MACjBU,GAAG;MACHC;IACF,CAAC,CAAC;EACJ;EAEQ5B,qBAAqB,CAAC2B,GAAW,EAAEC,KAAY,EAAE;IAAA;IACvD,IAAI,CAAC,IAAI,CAACC,iBAAiB,EAAE;MAC3B;IACF;IACA,sBAAI,CAACjB,OAAO,mDAAZ,eAAckB,WAAW,CAAC;MACxBC,IAAI,EAAEb,oBAAa;MACnBS,GAAG;MACHC;IACF,CAAC,CAAC;EACJ;EAEQ3B,qBAAqB,CAAC0B,GAAW,EAAEC,KAAY,EAAEI,QAAgB,EAAE;IAAA;IACzE,IAAI,CAAC,IAAI,CAACH,iBAAiB,EAAE;MAC3B;IACF;IACA,sBAAI,CAACjB,OAAO,mDAAZ,eAAckB,WAAW,CAAC;MACxBC,IAAI,EAAEZ,oBAAa;MACnBQ,GAAG;MACHC,KAAK;MACLI;IACF,CAAC,CAAC;EACJ;EAEQ9B,mBAAmB,CAAC+B,OAAe,EAAE;IAAA;IAC3C,sBAAI,CAACrB,OAAO,mDAAZ,eAAckB,WAAW,CAAC;MACxBC,IAAI,EAAEX,wBAAiB;MACvBa;IACF,CAAC,CAAC;EACJ;;EAEA;EACQ9B,oBAAoB,CAAC+B,GAAgB,EAAE;IAC7C;IACA;IACA;IACA;IACA;IACA;IACA;;IAEA,IAAI,CAACL,iBAAiB,GAAG,KAAK;IAC9B,QAAQK,GAAG,CAACH,IAAI;MACd,KAAKX,wBAAiB;QACpB,IAAI,CAACxB,YAAY,CAACuC,UAAU,EAAE,CAACC,UAAU,CAACF,GAAG,CAACD,OAAO,CAAC;QACtD;MACF,KAAKhB,kBAAW;QACd,IAAI,CAACrB,YAAY,CAACyC,SAAS,CAACH,GAAG,CAACP,GAAG,EAAGO,GAAG,CAACN,KAAK,CAAE;QACjD,IAAI,CAAChC,YAAY,CAAC0C,qBAAqB,CAACJ,GAAG,CAACP,GAAG,EAAGO,GAAG,CAACN,KAAK,CAAE;QAC7D;MACF,KAAKV,oBAAa;QAChB,IAAI,CAACtB,YAAY,CAAC2C,uBAAuB,CAACL,GAAG,CAACP,GAAG,CAAE;QACnD,IAAI,CAAC/B,YAAY,CAAC4C,WAAW,CAACN,GAAG,CAACP,GAAG,EAAGO,GAAG,CAACN,KAAK,CAAE;QACnD;MACF,KAAKT,oBAAa;QAChB,IAAI,CAACvB,YAAY,CAAC6C,WAAW,CAACP,GAAG,CAACP,GAAG,EAAGO,GAAG,CAACN,KAAK,EAAGM,GAAG,CAACF,QAAQ,CAAC;QACjE;MACF;QACE;IAAM;IAEV,IAAI,CAACH,iBAAiB,GAAG,IAAI;EAC/B;AACF;AAAC"}
+{"version":3,"file":"SyncStorageService.js","names":["SyncStorageService","constructor","tokenManager","options","onTokenAddedHandler","bind","onTokenRemovedHandler","onTokenRenewedHandler","onSetStorageHandler","onSyncMessageHandler","requiresLeadership","isStarted","started","canStart","syncStorage","isBrowser","start","syncChannelName","channel","BroadcastChannel","err","AuthSdkError","on","EVENT_ADDED","EVENT_REMOVED","EVENT_RENEWED","EVENT_SET_STORAGE","addEventListener","stop","off","removeEventListener","close","undefined","key","token","enablePostMessage","postMessage","type","oldToken","storage","msg","getStorage","setStorage","emitAdded","setExpireEventTimeout","clearExpireEventTimeout","emitRemoved","emitRenewed"],"sources":["../../../lib/services/SyncStorageService.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\nimport { BroadcastChannel } from 'broadcast-channel';\nimport { isBrowser } from '../features';\nimport {\n  ServiceManagerOptions, ServiceInterface\n} from '../core/types';\nimport {\n  Token, Tokens, \n  EVENT_ADDED, EVENT_REMOVED, EVENT_RENEWED, EVENT_SET_STORAGE, TokenManagerInterface\n} from '../oidc/types';\nimport { AuthSdkError } from '../errors';\n\nexport type SyncMessage = {\n  type: string;\n  key?: string;\n  token?: Token;\n  oldToken?: Token;\n  storage?: Tokens;\n};\nexport class SyncStorageService implements ServiceInterface {\n  private tokenManager: TokenManagerInterface;\n  private options: ServiceManagerOptions;\n  private channel?: BroadcastChannel<SyncMessage>;\n  private started = false;\n  private enablePostMessage = true;\n\n  constructor(tokenManager: TokenManagerInterface, options: ServiceManagerOptions = {}) {\n    this.tokenManager = tokenManager;\n    this.options = options;\n    this.onTokenAddedHandler = this.onTokenAddedHandler.bind(this);\n    this.onTokenRemovedHandler = this.onTokenRemovedHandler.bind(this);\n    this.onTokenRenewedHandler = this.onTokenRenewedHandler.bind(this);\n    this.onSetStorageHandler = this.onSetStorageHandler.bind(this);\n    this.onSyncMessageHandler = this.onSyncMessageHandler.bind(this);\n  }\n\n  requiresLeadership() {\n    return false;\n  }\n\n  isStarted() {\n    return this.started;\n  }\n\n  canStart() {\n    return !!this.options.syncStorage && isBrowser() && !this.started;\n  }\n\n  async start() {\n    if (!this.canStart()) {\n      return;\n    }\n    \n    const { syncChannelName } = this.options;\n    try {\n      // BroadcastChannel throws if no supported method can be found\n      this.channel = new BroadcastChannel(syncChannelName as string);\n    } catch (err) {\n      throw new AuthSdkError('SyncStorageService is not supported in current browser.');\n    }\n\n    this.tokenManager.on(EVENT_ADDED, this.onTokenAddedHandler);\n    this.tokenManager.on(EVENT_REMOVED, this.onTokenRemovedHandler);\n    this.tokenManager.on(EVENT_RENEWED, this.onTokenRenewedHandler);\n    this.tokenManager.on(EVENT_SET_STORAGE, this.onSetStorageHandler);\n    this.channel.addEventListener('message', this.onSyncMessageHandler);\n    this.started = true;\n  }\n\n  async stop() {\n    if (this.started) {\n      this.tokenManager.off(EVENT_ADDED, this.onTokenAddedHandler);\n      this.tokenManager.off(EVENT_REMOVED, this.onTokenRemovedHandler);\n      this.tokenManager.off(EVENT_RENEWED, this.onTokenRenewedHandler);\n      this.tokenManager.off(EVENT_SET_STORAGE, this.onSetStorageHandler);\n      this.channel?.removeEventListener('message', this.onSyncMessageHandler);\n      await this.channel?.close();\n      this.channel = undefined;\n      this.started = false;\n    }\n  }\n\n  private onTokenAddedHandler(key: string, token: Token) {\n    if (!this.enablePostMessage) {\n      return;\n    }\n    this.channel?.postMessage({\n      type: EVENT_ADDED,\n      key,\n      token\n    });\n  }\n\n  private onTokenRemovedHandler(key: string, token: Token) {\n    if (!this.enablePostMessage) {\n      return;\n    }\n    this.channel?.postMessage({\n      type: EVENT_REMOVED,\n      key,\n      token\n    });\n  }\n\n  private onTokenRenewedHandler(key: string, token: Token, oldToken?: Token) {\n    if (!this.enablePostMessage) {\n      return;\n    }\n    this.channel?.postMessage({\n      type: EVENT_RENEWED,\n      key,\n      token,\n      oldToken\n    });\n  }\n\n  private onSetStorageHandler(storage: Tokens) {\n    this.channel?.postMessage({\n      type: EVENT_SET_STORAGE,\n      storage\n    });\n  }\n\n  /* eslint-disable complexity */\n  private onSyncMessageHandler(msg: SyncMessage) {\n    // Notes:\n    // 1. Using `enablePostMessage` flag here to prevent sync message loop.\n    //    If this flag is on, tokenManager event handlers do not post sync message.\n    // 2. IE11 has known issue with synchronization of LocalStorage cross tabs.\n    //    One workaround is to set empty event handler for `window.onstorage`.\n    //    But it's not 100% working, sometimes you still get old value from LocalStorage.\n    //    Better approch is to explicitly udpate LocalStorage with `setStorage`.\n\n    this.enablePostMessage = false;\n    switch (msg.type) {\n      case EVENT_SET_STORAGE:\n        this.tokenManager.getStorage().setStorage(msg.storage);\n        break;\n      case EVENT_ADDED:\n        this.tokenManager.emitAdded(msg.key!, msg.token!);\n        this.tokenManager.setExpireEventTimeout(msg.key!, msg.token!);\n        break;\n      case EVENT_REMOVED:\n        this.tokenManager.clearExpireEventTimeout(msg.key!);\n        this.tokenManager.emitRemoved(msg.key!, msg.token!);\n        break;\n      case EVENT_RENEWED:\n        this.tokenManager.emitRenewed(msg.key!, msg.token!, msg.oldToken);\n        break;\n      default:\n        break;\n    }\n    this.enablePostMessage = true;\n  }\n} "],"mappings":";;;;;AAYA;AACA;AAIA;AAIA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoBO,MAAMA,kBAAkB,CAA6B;EAO1DC,WAAW,CAACC,YAAmC,EAAEC,OAA8B,GAAG,CAAC,CAAC,EAAE;IAAA,+CAHpE,KAAK;IAAA,yDACK,IAAI;IAG9B,IAAI,CAACD,YAAY,GAAGA,YAAY;IAChC,IAAI,CAACC,OAAO,GAAGA,OAAO;IACtB,IAAI,CAACC,mBAAmB,GAAG,IAAI,CAACA,mBAAmB,CAACC,IAAI,CAAC,IAAI,CAAC;IAC9D,IAAI,CAACC,qBAAqB,GAAG,IAAI,CAACA,qBAAqB,CAACD,IAAI,CAAC,IAAI,CAAC;IAClE,IAAI,CAACE,qBAAqB,GAAG,IAAI,CAACA,qBAAqB,CAACF,IAAI,CAAC,IAAI,CAAC;IAClE,IAAI,CAACG,mBAAmB,GAAG,IAAI,CAACA,mBAAmB,CAACH,IAAI,CAAC,IAAI,CAAC;IAC9D,IAAI,CAACI,oBAAoB,GAAG,IAAI,CAACA,oBAAoB,CAACJ,IAAI,CAAC,IAAI,CAAC;EAClE;EAEAK,kBAAkB,GAAG;IACnB,OAAO,KAAK;EACd;EAEAC,SAAS,GAAG;IACV,OAAO,IAAI,CAACC,OAAO;EACrB;EAEAC,QAAQ,GAAG;IACT,OAAO,CAAC,CAAC,IAAI,CAACV,OAAO,CAACW,WAAW,IAAI,IAAAC,mBAAS,GAAE,IAAI,CAAC,IAAI,CAACH,OAAO;EACnE;EAEA,MAAMI,KAAK,GAAG;IACZ,IAAI,CAAC,IAAI,CAACH,QAAQ,EAAE,EAAE;MACpB;IACF;IAEA,MAAM;MAAEI;IAAgB,CAAC,GAAG,IAAI,CAACd,OAAO;IACxC,IAAI;MACF;MACA,IAAI,CAACe,OAAO,GAAG,IAAIC,kCAAgB,CAACF,eAAe,CAAW;IAChE,CAAC,CAAC,OAAOG,GAAG,EAAE;MACZ,MAAM,IAAIC,oBAAY,CAAC,yDAAyD,CAAC;IACnF;IAEA,IAAI,CAACnB,YAAY,CAACoB,EAAE,CAACC,kBAAW,EAAE,IAAI,CAACnB,mBAAmB,CAAC;IAC3D,IAAI,CAACF,YAAY,CAACoB,EAAE,CAACE,oBAAa,EAAE,IAAI,CAAClB,qBAAqB,CAAC;IAC/D,IAAI,CAACJ,YAAY,CAACoB,EAAE,CAACG,oBAAa,EAAE,IAAI,CAAClB,qBAAqB,CAAC;IAC/D,IAAI,CAACL,YAAY,CAACoB,EAAE,CAACI,wBAAiB,EAAE,IAAI,CAAClB,mBAAmB,CAAC;IACjE,IAAI,CAACU,OAAO,CAACS,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAClB,oBAAoB,CAAC;IACnE,IAAI,CAACG,OAAO,GAAG,IAAI;EACrB;EAEA,MAAMgB,IAAI,GAAG;IACX,IAAI,IAAI,CAAChB,OAAO,EAAE;MAChB,IAAI,CAACV,YAAY,CAAC2B,GAAG,CAACN,kBAAW,EAAE,IAAI,CAACnB,mBAAmB,CAAC;MAC5D,IAAI,CAACF,YAAY,CAAC2B,GAAG,CAACL,oBAAa,EAAE,IAAI,CAAClB,qBAAqB,CAAC;MAChE,IAAI,CAACJ,YAAY,CAAC2B,GAAG,CAACJ,oBAAa,EAAE,IAAI,CAAClB,qBAAqB,CAAC;MAChE,IAAI,CAACL,YAAY,CAAC2B,GAAG,CAACH,wBAAiB,EAAE,IAAI,CAAClB,mBAAmB,CAAC;MAClE,IAAI,CAACU,OAAO,EAAEY,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAACrB,oBAAoB,CAAC;MACvE,MAAM,IAAI,CAACS,OAAO,EAAEa,KAAK,EAAE;MAC3B,IAAI,CAACb,OAAO,GAAGc,SAAS;MACxB,IAAI,CAACpB,OAAO,GAAG,KAAK;IACtB;EACF;EAEQR,mBAAmB,CAAC6B,GAAW,EAAEC,KAAY,EAAE;IACrD,IAAI,CAAC,IAAI,CAACC,iBAAiB,EAAE;MAC3B;IACF;IACA,IAAI,CAACjB,OAAO,EAAEkB,WAAW,CAAC;MACxBC,IAAI,EAAEd,kBAAW;MACjBU,GAAG;MACHC;IACF,CAAC,CAAC;EACJ;EAEQ5B,qBAAqB,CAAC2B,GAAW,EAAEC,KAAY,EAAE;IACvD,IAAI,CAAC,IAAI,CAACC,iBAAiB,EAAE;MAC3B;IACF;IACA,IAAI,CAACjB,OAAO,EAAEkB,WAAW,CAAC;MACxBC,IAAI,EAAEb,oBAAa;MACnBS,GAAG;MACHC;IACF,CAAC,CAAC;EACJ;EAEQ3B,qBAAqB,CAAC0B,GAAW,EAAEC,KAAY,EAAEI,QAAgB,EAAE;IACzE,IAAI,CAAC,IAAI,CAACH,iBAAiB,EAAE;MAC3B;IACF;IACA,IAAI,CAACjB,OAAO,EAAEkB,WAAW,CAAC;MACxBC,IAAI,EAAEZ,oBAAa;MACnBQ,GAAG;MACHC,KAAK;MACLI;IACF,CAAC,CAAC;EACJ;EAEQ9B,mBAAmB,CAAC+B,OAAe,EAAE;IAC3C,IAAI,CAACrB,OAAO,EAAEkB,WAAW,CAAC;MACxBC,IAAI,EAAEX,wBAAiB;MACvBa;IACF,CAAC,CAAC;EACJ;;EAEA;EACQ9B,oBAAoB,CAAC+B,GAAgB,EAAE;IAC7C;IACA;IACA;IACA;IACA;IACA;IACA;;IAEA,IAAI,CAACL,iBAAiB,GAAG,KAAK;IAC9B,QAAQK,GAAG,CAACH,IAAI;MACd,KAAKX,wBAAiB;QACpB,IAAI,CAACxB,YAAY,CAACuC,UAAU,EAAE,CAACC,UAAU,CAACF,GAAG,CAACD,OAAO,CAAC;QACtD;MACF,KAAKhB,kBAAW;QACd,IAAI,CAACrB,YAAY,CAACyC,SAAS,CAACH,GAAG,CAACP,GAAG,EAAGO,GAAG,CAACN,KAAK,CAAE;QACjD,IAAI,CAAChC,YAAY,CAAC0C,qBAAqB,CAACJ,GAAG,CAACP,GAAG,EAAGO,GAAG,CAACN,KAAK,CAAE;QAC7D;MACF,KAAKV,oBAAa;QAChB,IAAI,CAACtB,YAAY,CAAC2C,uBAAuB,CAACL,GAAG,CAACP,GAAG,CAAE;QACnD,IAAI,CAAC/B,YAAY,CAAC4C,WAAW,CAACN,GAAG,CAACP,GAAG,EAAGO,GAAG,CAACN,KAAK,CAAE;QACnD;MACF,KAAKT,oBAAa;QAChB,IAAI,CAACvB,YAAY,CAAC6C,WAAW,CAACP,GAAG,CAACP,GAAG,EAAGO,GAAG,CAACN,KAAK,EAAGM,GAAG,CAACF,QAAQ,CAAC;QACjE;MACF;QACE;IAAM;IAEV,IAAI,CAACH,iBAAiB,GAAG,IAAI;EAC/B;AACF;AAAC"}