@okta/okta-auth-js 7.6.0 → 7.7.1

package/cjs/oidc/endpoints/token.js

@@ -5,6 +5,7 @@ exports.postToTokenEndpoint = postToTokenEndpoint;
 var _errors = require("../../errors");
 var _util = require("../../util");
 var _http = require("../../http");
+var _dpop = require("../dpop");
 /*!
  * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.
  * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.")
@@ -56,38 +57,91 @@ function getPostData(sdk, options) {
   return (0, _util.toQueryString)(params).slice(1);
 }
 
-// exchange authorization code for an access token
-function postToTokenEndpoint(sdk, options, urls) {
-  validateOptions(options);
-  var data = getPostData(sdk, options);
+/* eslint complexity: [2, 10] */
+async function makeTokenRequest(sdk, {
+  url,
+  data,
+  nonce,
+  dpopKeyPair
+}) {
+  const method = 'POST';
   const headers = {
     'Content-Type': 'application/x-www-form-urlencoded'
   };
-  return (0, _http.httpRequest)(sdk, {
+  if (sdk.options.dpop) {
+    if (!dpopKeyPair) {
+      throw new _errors.AuthSdkError('DPoP is configured but no key pair was provided');
+    }
+    const proof = await (0, _dpop.generateDPoPForTokenRequest)({
+      url,
+      method,
+      nonce,
+      keyPair: dpopKeyPair
+    });
+    headers.DPoP = proof;
+  }
+  try {
+    const resp = await (0, _http.httpRequest)(sdk, {
+      url,
+      method,
+      args: data,
+      headers
+    });
+    return resp;
+  } catch (err) {
+    if ((0, _dpop.isDPoPNonceError)(err) && !nonce) {
+      const dpopNonce = err.resp?.headers['dpop-nonce'];
+      if (!dpopNonce) {
+        // throws error is dpop-nonce header cannot be found, prevents infinite loop
+        throw new _errors.AuthApiError({
+          errorSummary: 'No `dpop-nonce` header found when required'
+        }, err.resp ?? undefined // yay ts
+        );
+      }
+
+      return makeTokenRequest(sdk, {
+        url,
+        data,
+        dpopKeyPair,
+        nonce: dpopNonce
+      });
+    }
+    throw err;
+  }
+}
+
+// exchange authorization code for an access token
+async function postToTokenEndpoint(sdk, options, urls) {
+  validateOptions(options);
+  var data = getPostData(sdk, options);
+  const params = {
     url: urls.tokenUrl,
-    method: 'POST',
-    args: data,
-    headers
-  });
+    data,
+    dpopKeyPair: options?.dpopKeyPair
+  };
+  return makeTokenRequest(sdk, params);
 }
-function postRefreshToken(sdk, options, refreshToken) {
-  return (0, _http.httpRequest)(sdk, {
-    url: refreshToken.tokenUrl,
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded'
-    },
-    args: Object.entries({
-      client_id: options.clientId,
-      // eslint-disable-line camelcase
-      grant_type: 'refresh_token',
-      // eslint-disable-line camelcase
-      scope: refreshToken.scopes.join(' '),
-      refresh_token: refreshToken.refreshToken // eslint-disable-line camelcase
-    }).map(function ([name, value]) {
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-      return name + '=' + encodeURIComponent(value);
-    }).join('&')
-  });
+async function postRefreshToken(sdk, options, refreshToken) {
+  const data = Object.entries({
+    client_id: options.clientId,
+    // eslint-disable-line camelcase
+    grant_type: 'refresh_token',
+    // eslint-disable-line camelcase
+    scope: refreshToken.scopes.join(' '),
+    refresh_token: refreshToken.refreshToken // eslint-disable-line camelcase
+  }).map(function ([name, value]) {
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    return name + '=' + encodeURIComponent(value);
+  }).join('&');
+  let url = refreshToken.tokenUrl;
+  if (options.extraParams && Object.keys(options.extraParams).length >= 1) {
+    url += (0, _util.toQueryString)(options.extraParams);
+  }
+  const params = {
+    url,
+    data,
+    dpopKeyPair: options?.dpopKeyPair
+  };
+  return makeTokenRequest(sdk, params);
 }
 //# sourceMappingURL=token.js.map

package/cjs/oidc/endpoints/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","names":["validateOptions","options","clientId","AuthSdkError","redirectUri","authorizationCode","interactionCode","codeVerifier","getPostData","sdk","params","removeNils","code","clientSecret","toQueryString","slice","postToTokenEndpoint","urls","data","headers","httpRequest","url","tokenUrl","method","args","postRefreshToken","refreshToken","Object","entries","client_id","grant_type","scope","scopes","join","refresh_token","map","name","value","encodeURIComponent"],"sources":["../../../../lib/oidc/endpoints/token.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\n\nimport { AuthSdkError } from '../../errors';\nimport { CustomUrls, OAuthParams, OAuthResponse, RefreshToken, TokenParams } from '../types';\nimport { removeNils, toQueryString } from '../../util';\nimport { httpRequest, OktaAuthHttpInterface } from '../../http';\n\nfunction validateOptions(options: TokenParams) {\n  // Quick validation\n  if (!options.clientId) {\n    throw new AuthSdkError('A clientId must be specified in the OktaAuth constructor to get a token');\n  }\n\n  if (!options.redirectUri) {\n    throw new AuthSdkError('The redirectUri passed to /authorize must also be passed to /token');\n  }\n\n  if (!options.authorizationCode && !options.interactionCode) {\n    throw new AuthSdkError('An authorization code (returned from /authorize) must be passed to /token');\n  }\n\n  if (!options.codeVerifier) {\n    throw new AuthSdkError('The \"codeVerifier\" (generated and saved by your app) must be passed to /token');\n  }\n}\n\nfunction getPostData(sdk, options: TokenParams): string {\n  // Convert Token params to OAuth params, sent to the /token endpoint\n  var params: OAuthParams = removeNils({\n    'client_id': options.clientId,\n    'redirect_uri': options.redirectUri,\n    'grant_type': options.interactionCode ? 'interaction_code' : 'authorization_code',\n    'code_verifier': options.codeVerifier\n  });\n\n  if (options.interactionCode) {\n    params['interaction_code'] = options.interactionCode;\n  } else if (options.authorizationCode) {\n    params.code = options.authorizationCode;\n  }\n\n  const { clientSecret } = sdk.options;\n  if (clientSecret) {\n    params['client_secret'] = clientSecret;\n  }\n\n  // Encode as URL string\n  return toQueryString(params).slice(1);\n}\n\n// exchange authorization code for an access token\nexport function postToTokenEndpoint(sdk, options: TokenParams, urls: CustomUrls): Promise<OAuthResponse> {\n  validateOptions(options);\n  var data = getPostData(sdk, options);\n\n  const headers = {\n    'Content-Type': 'application/x-www-form-urlencoded'\n  };\n\n  return httpRequest(sdk, {\n    url: urls.tokenUrl,\n    method: 'POST',\n    args: data,\n    headers\n  });\n}\n\nexport function postRefreshToken(\n  sdk: OktaAuthHttpInterface,\n  options: TokenParams,\n  refreshToken: RefreshToken\n): Promise<OAuthResponse> {\n  return httpRequest(sdk, {\n    url: refreshToken.tokenUrl,\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n\n    args: Object.entries({\n      client_id: options.clientId, // eslint-disable-line camelcase\n      grant_type: 'refresh_token', // eslint-disable-line camelcase\n      scope: refreshToken.scopes.join(' '),\n      refresh_token: refreshToken.refreshToken, // eslint-disable-line camelcase\n    }).map(function ([name, value]) {\n      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n      return name + '=' + encodeURIComponent(value!);\n    }).join('&'),\n  });\n}"],"mappings":";;;;AAaA;AAEA;AACA;AAhBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA,SAASA,eAAe,CAACC,OAAoB,EAAE;EAC7C;EACA,IAAI,CAACA,OAAO,CAACC,QAAQ,EAAE;IACrB,MAAM,IAAIC,oBAAY,CAAC,yEAAyE,CAAC;EACnG;EAEA,IAAI,CAACF,OAAO,CAACG,WAAW,EAAE;IACxB,MAAM,IAAID,oBAAY,CAAC,oEAAoE,CAAC;EAC9F;EAEA,IAAI,CAACF,OAAO,CAACI,iBAAiB,IAAI,CAACJ,OAAO,CAACK,eAAe,EAAE;IAC1D,MAAM,IAAIH,oBAAY,CAAC,2EAA2E,CAAC;EACrG;EAEA,IAAI,CAACF,OAAO,CAACM,YAAY,EAAE;IACzB,MAAM,IAAIJ,oBAAY,CAAC,+EAA+E,CAAC;EACzG;AACF;AAEA,SAASK,WAAW,CAACC,GAAG,EAAER,OAAoB,EAAU;EACtD;EACA,IAAIS,MAAmB,GAAG,IAAAC,gBAAU,EAAC;IACnC,WAAW,EAAEV,OAAO,CAACC,QAAQ;IAC7B,cAAc,EAAED,OAAO,CAACG,WAAW;IACnC,YAAY,EAAEH,OAAO,CAACK,eAAe,GAAG,kBAAkB,GAAG,oBAAoB;IACjF,eAAe,EAAEL,OAAO,CAACM;EAC3B,CAAC,CAAC;EAEF,IAAIN,OAAO,CAACK,eAAe,EAAE;IAC3BI,MAAM,CAAC,kBAAkB,CAAC,GAAGT,OAAO,CAACK,eAAe;EACtD,CAAC,MAAM,IAAIL,OAAO,CAACI,iBAAiB,EAAE;IACpCK,MAAM,CAACE,IAAI,GAAGX,OAAO,CAACI,iBAAiB;EACzC;EAEA,MAAM;IAAEQ;EAAa,CAAC,GAAGJ,GAAG,CAACR,OAAO;EACpC,IAAIY,YAAY,EAAE;IAChBH,MAAM,CAAC,eAAe,CAAC,GAAGG,YAAY;EACxC;;EAEA;EACA,OAAO,IAAAC,mBAAa,EAACJ,MAAM,CAAC,CAACK,KAAK,CAAC,CAAC,CAAC;AACvC;;AAEA;AACO,SAASC,mBAAmB,CAACP,GAAG,EAAER,OAAoB,EAAEgB,IAAgB,EAA0B;EACvGjB,eAAe,CAACC,OAAO,CAAC;EACxB,IAAIiB,IAAI,GAAGV,WAAW,CAACC,GAAG,EAAER,OAAO,CAAC;EAEpC,MAAMkB,OAAO,GAAG;IACd,cAAc,EAAE;EAClB,CAAC;EAED,OAAO,IAAAC,iBAAW,EAACX,GAAG,EAAE;IACtBY,GAAG,EAAEJ,IAAI,CAACK,QAAQ;IAClBC,MAAM,EAAE,MAAM;IACdC,IAAI,EAAEN,IAAI;IACVC;EACF,CAAC,CAAC;AACJ;AAEO,SAASM,gBAAgB,CAC9BhB,GAA0B,EAC1BR,OAAoB,EACpByB,YAA0B,EACF;EACxB,OAAO,IAAAN,iBAAW,EAACX,GAAG,EAAE;IACtBY,GAAG,EAAEK,YAAY,CAACJ,QAAQ;IAC1BC,MAAM,EAAE,MAAM;IACdJ,OAAO,EAAE;MACP,cAAc,EAAE;IAClB,CAAC;IAEDK,IAAI,EAAEG,MAAM,CAACC,OAAO,CAAC;MACnBC,SAAS,EAAE5B,OAAO,CAACC,QAAQ;MAAE;MAC7B4B,UAAU,EAAE,eAAe;MAAE;MAC7BC,KAAK,EAAEL,YAAY,CAACM,MAAM,CAACC,IAAI,CAAC,GAAG,CAAC;MACpCC,aAAa,EAAER,YAAY,CAACA,YAAY,CAAE;IAC5C,CAAC,CAAC,CAACS,GAAG,CAAC,UAAU,CAACC,IAAI,EAAEC,KAAK,CAAC,EAAE;MAC9B;MACA,OAAOD,IAAI,GAAG,GAAG,GAAGE,kBAAkB,CAACD,KAAK,CAAE;IAChD,CAAC,CAAC,CAACJ,IAAI,CAAC,GAAG;EACb,CAAC,CAAC;AACJ"}
+{"version":3,"file":"token.js","names":["validateOptions","options","clientId","AuthSdkError","redirectUri","authorizationCode","interactionCode","codeVerifier","getPostData","sdk","params","removeNils","code","clientSecret","toQueryString","slice","makeTokenRequest","url","data","nonce","dpopKeyPair","method","headers","dpop","proof","generateDPoPForTokenRequest","keyPair","DPoP","resp","httpRequest","args","err","isDPoPNonceError","dpopNonce","AuthApiError","errorSummary","undefined","postToTokenEndpoint","urls","tokenUrl","postRefreshToken","refreshToken","Object","entries","client_id","grant_type","scope","scopes","join","refresh_token","map","name","value","encodeURIComponent","extraParams","keys","length"],"sources":["../../../../lib/oidc/endpoints/token.ts"],"sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\n\nimport { AuthSdkError, AuthApiError } from '../../errors';\nimport { CustomUrls, OAuthParams, OAuthResponse, RefreshToken, TokenParams } from '../types';\nimport { removeNils, toQueryString } from '../../util';\nimport { httpRequest, OktaAuthHttpInterface } from '../../http';\nimport { generateDPoPForTokenRequest, isDPoPNonceError } from '../dpop';\n\nexport interface TokenEndpointParams extends TokenParams {\n  dpopKeyPair?: CryptoKeyPair;\n}\n\ninterface TokenRequestParams {\n  url: string;\n  data: any;\n  dpopKeyPair?: CryptoKeyPair;\n  nonce?: string;\n}\n\nfunction validateOptions(options: TokenEndpointParams) {\n  // Quick validation\n  if (!options.clientId) {\n    throw new AuthSdkError('A clientId must be specified in the OktaAuth constructor to get a token');\n  }\n\n  if (!options.redirectUri) {\n    throw new AuthSdkError('The redirectUri passed to /authorize must also be passed to /token');\n  }\n\n  if (!options.authorizationCode && !options.interactionCode) {\n    throw new AuthSdkError('An authorization code (returned from /authorize) must be passed to /token');\n  }\n\n  if (!options.codeVerifier) {\n    throw new AuthSdkError('The \"codeVerifier\" (generated and saved by your app) must be passed to /token');\n  }\n}\n\nfunction getPostData(sdk, options: TokenParams): string {\n  // Convert Token params to OAuth params, sent to the /token endpoint\n  var params: OAuthParams = removeNils({\n    'client_id': options.clientId,\n    'redirect_uri': options.redirectUri,\n    'grant_type': options.interactionCode ? 'interaction_code' : 'authorization_code',\n    'code_verifier': options.codeVerifier\n  });\n\n  if (options.interactionCode) {\n    params['interaction_code'] = options.interactionCode;\n  } else if (options.authorizationCode) {\n    params.code = options.authorizationCode;\n  }\n\n  const { clientSecret } = sdk.options;\n  if (clientSecret) {\n    params['client_secret'] = clientSecret;\n  }\n\n  // Encode as URL string\n  return toQueryString(params).slice(1);\n}\n\n/* eslint complexity: [2, 10] */\nasync function makeTokenRequest (sdk, { url, data, nonce, dpopKeyPair }: TokenRequestParams): Promise<OAuthResponse> {\n  const method = 'POST';\n  const headers: any = {\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (sdk.options.dpop) {\n    if (!dpopKeyPair) {\n      throw new AuthSdkError('DPoP is configured but no key pair was provided');\n    }\n\n    const proof = await generateDPoPForTokenRequest({ url, method, nonce, keyPair: dpopKeyPair });\n    headers.DPoP = proof;\n  }\n\n  try {\n    const resp = await httpRequest(sdk, {\n      url,\n      method,\n      args: data,\n      headers\n    });\n    return resp;\n  }\n  catch (err) {\n    if (isDPoPNonceError(err) && !nonce) {\n      const dpopNonce = err.resp?.headers['dpop-nonce'];\n      if (!dpopNonce) {\n        // throws error is dpop-nonce header cannot be found, prevents infinite loop\n        throw new AuthApiError(\n          {errorSummary: 'No `dpop-nonce` header found when required'},\n          err.resp ?? undefined    // yay ts\n        );\n      }\n      return makeTokenRequest(sdk, { url, data, dpopKeyPair, nonce: dpopNonce });\n    }\n    throw err;\n  }\n}\n\n// exchange authorization code for an access token\nexport async function postToTokenEndpoint(sdk, options: TokenEndpointParams, urls: CustomUrls): Promise<OAuthResponse> {\n  validateOptions(options);\n  var data = getPostData(sdk, options);\n\n  const params: TokenRequestParams = {\n    url: urls.tokenUrl!,\n    data,\n    dpopKeyPair: options?.dpopKeyPair\n  };\n\n  return makeTokenRequest(sdk, params);\n}\n\nexport async function postRefreshToken(\n  sdk: OktaAuthHttpInterface,\n  options: TokenEndpointParams,\n  refreshToken: RefreshToken\n): Promise<OAuthResponse> {\n  const data = Object.entries({\n    client_id: options.clientId, // eslint-disable-line camelcase\n    grant_type: 'refresh_token', // eslint-disable-line camelcase\n    scope: refreshToken.scopes.join(' '),\n    refresh_token: refreshToken.refreshToken, // eslint-disable-line camelcase\n  }).map(function ([name, value]) {\n    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n    return name + '=' + encodeURIComponent(value!);\n  }).join('&');\n\n  let url = refreshToken.tokenUrl;\n  if (options.extraParams && Object.keys(options.extraParams).length >= 1) {\n    url += toQueryString(options.extraParams);\n  }\n\n  const params: TokenRequestParams = {\n    url,\n    data,\n    dpopKeyPair: options?.dpopKeyPair\n  };\n\n  return makeTokenRequest(sdk, params);\n}\n"],"mappings":";;;;AAaA;AAEA;AACA;AACA;AAjBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoBA,SAASA,eAAe,CAACC,OAA4B,EAAE;EACrD;EACA,IAAI,CAACA,OAAO,CAACC,QAAQ,EAAE;IACrB,MAAM,IAAIC,oBAAY,CAAC,yEAAyE,CAAC;EACnG;EAEA,IAAI,CAACF,OAAO,CAACG,WAAW,EAAE;IACxB,MAAM,IAAID,oBAAY,CAAC,oEAAoE,CAAC;EAC9F;EAEA,IAAI,CAACF,OAAO,CAACI,iBAAiB,IAAI,CAACJ,OAAO,CAACK,eAAe,EAAE;IAC1D,MAAM,IAAIH,oBAAY,CAAC,2EAA2E,CAAC;EACrG;EAEA,IAAI,CAACF,OAAO,CAACM,YAAY,EAAE;IACzB,MAAM,IAAIJ,oBAAY,CAAC,+EAA+E,CAAC;EACzG;AACF;AAEA,SAASK,WAAW,CAACC,GAAG,EAAER,OAAoB,EAAU;EACtD;EACA,IAAIS,MAAmB,GAAG,IAAAC,gBAAU,EAAC;IACnC,WAAW,EAAEV,OAAO,CAACC,QAAQ;IAC7B,cAAc,EAAED,OAAO,CAACG,WAAW;IACnC,YAAY,EAAEH,OAAO,CAACK,eAAe,GAAG,kBAAkB,GAAG,oBAAoB;IACjF,eAAe,EAAEL,OAAO,CAACM;EAC3B,CAAC,CAAC;EAEF,IAAIN,OAAO,CAACK,eAAe,EAAE;IAC3BI,MAAM,CAAC,kBAAkB,CAAC,GAAGT,OAAO,CAACK,eAAe;EACtD,CAAC,MAAM,IAAIL,OAAO,CAACI,iBAAiB,EAAE;IACpCK,MAAM,CAACE,IAAI,GAAGX,OAAO,CAACI,iBAAiB;EACzC;EAEA,MAAM;IAAEQ;EAAa,CAAC,GAAGJ,GAAG,CAACR,OAAO;EACpC,IAAIY,YAAY,EAAE;IAChBH,MAAM,CAAC,eAAe,CAAC,GAAGG,YAAY;EACxC;;EAEA;EACA,OAAO,IAAAC,mBAAa,EAACJ,MAAM,CAAC,CAACK,KAAK,CAAC,CAAC,CAAC;AACvC;;AAEA;AACA,eAAeC,gBAAgB,CAAEP,GAAG,EAAE;EAAEQ,GAAG;EAAEC,IAAI;EAAEC,KAAK;EAAEC;AAAgC,CAAC,EAA0B;EACnH,MAAMC,MAAM,GAAG,MAAM;EACrB,MAAMC,OAAY,GAAG;IACnB,cAAc,EAAE;EAClB,CAAC;EAED,IAAIb,GAAG,CAACR,OAAO,CAACsB,IAAI,EAAE;IACpB,IAAI,CAACH,WAAW,EAAE;MAChB,MAAM,IAAIjB,oBAAY,CAAC,iDAAiD,CAAC;IAC3E;IAEA,MAAMqB,KAAK,GAAG,MAAM,IAAAC,iCAA2B,EAAC;MAAER,GAAG;MAAEI,MAAM;MAAEF,KAAK;MAAEO,OAAO,EAAEN;IAAY,CAAC,CAAC;IAC7FE,OAAO,CAACK,IAAI,GAAGH,KAAK;EACtB;EAEA,IAAI;IACF,MAAMI,IAAI,GAAG,MAAM,IAAAC,iBAAW,EAACpB,GAAG,EAAE;MAClCQ,GAAG;MACHI,MAAM;MACNS,IAAI,EAAEZ,IAAI;MACVI;IACF,CAAC,CAAC;IACF,OAAOM,IAAI;EACb,CAAC,CACD,OAAOG,GAAG,EAAE;IACV,IAAI,IAAAC,sBAAgB,EAACD,GAAG,CAAC,IAAI,CAACZ,KAAK,EAAE;MACnC,MAAMc,SAAS,GAAGF,GAAG,CAACH,IAAI,EAAEN,OAAO,CAAC,YAAY,CAAC;MACjD,IAAI,CAACW,SAAS,EAAE;QACd;QACA,MAAM,IAAIC,oBAAY,CACpB;UAACC,YAAY,EAAE;QAA4C,CAAC,EAC5DJ,GAAG,CAACH,IAAI,IAAIQ,SAAS,CAAI;QAAA,CAC1B;MACH;;MACA,OAAOpB,gBAAgB,CAACP,GAAG,EAAE;QAAEQ,GAAG;QAAEC,IAAI;QAAEE,WAAW;QAAED,KAAK,EAAEc;MAAU,CAAC,CAAC;IAC5E;IACA,MAAMF,GAAG;EACX;AACF;;AAEA;AACO,eAAeM,mBAAmB,CAAC5B,GAAG,EAAER,OAA4B,EAAEqC,IAAgB,EAA0B;EACrHtC,eAAe,CAACC,OAAO,CAAC;EACxB,IAAIiB,IAAI,GAAGV,WAAW,CAACC,GAAG,EAAER,OAAO,CAAC;EAEpC,MAAMS,MAA0B,GAAG;IACjCO,GAAG,EAAEqB,IAAI,CAACC,QAAS;IACnBrB,IAAI;IACJE,WAAW,EAAEnB,OAAO,EAAEmB;EACxB,CAAC;EAED,OAAOJ,gBAAgB,CAACP,GAAG,EAAEC,MAAM,CAAC;AACtC;AAEO,eAAe8B,gBAAgB,CACpC/B,GAA0B,EAC1BR,OAA4B,EAC5BwC,YAA0B,EACF;EACxB,MAAMvB,IAAI,GAAGwB,MAAM,CAACC,OAAO,CAAC;IAC1BC,SAAS,EAAE3C,OAAO,CAACC,QAAQ;IAAE;IAC7B2C,UAAU,EAAE,eAAe;IAAE;IAC7BC,KAAK,EAAEL,YAAY,CAACM,MAAM,CAACC,IAAI,CAAC,GAAG,CAAC;IACpCC,aAAa,EAAER,YAAY,CAACA,YAAY,CAAE;EAC5C,CAAC,CAAC,CAACS,GAAG,CAAC,UAAU,CAACC,IAAI,EAAEC,KAAK,CAAC,EAAE;IAC9B;IACA,OAAOD,IAAI,GAAG,GAAG,GAAGE,kBAAkB,CAACD,KAAK,CAAE;EAChD,CAAC,CAAC,CAACJ,IAAI,CAAC,GAAG,CAAC;EAEZ,IAAI/B,GAAG,GAAGwB,YAAY,CAACF,QAAQ;EAC/B,IAAItC,OAAO,CAACqD,WAAW,IAAIZ,MAAM,CAACa,IAAI,CAACtD,OAAO,CAACqD,WAAW,CAAC,CAACE,MAAM,IAAI,CAAC,EAAE;IACvEvC,GAAG,IAAI,IAAAH,mBAAa,EAACb,OAAO,CAACqD,WAAW,CAAC;EAC3C;EAEA,MAAM5C,MAA0B,GAAG;IACjCO,GAAG;IACHC,IAAI;IACJE,WAAW,EAAEnB,OAAO,EAAEmB;EACxB,CAAC;EAED,OAAOJ,gBAAgB,CAACP,GAAG,EAAEC,MAAM,CAAC;AACtC"}

package/cjs/oidc/exchangeCodeForTokens.js

@@ -5,6 +5,7 @@ var _util = require("./util");
 var _util2 = require("../util");
 var _token = require("./endpoints/token");
 var _handleOAuthResponse = require("./handleOAuthResponse");
+var _dpop = require("./dpop");
 /* eslint-disable @typescript-eslint/no-non-null-assertion */
 /* eslint-disable max-len */
 /*!
@@ -21,7 +22,7 @@ var _handleOAuthResponse = require("./handleOAuthResponse");
  */
 
 // codeVerifier is required. May pass either an authorizationCode or interactionCode
-function exchangeCodeForTokens(sdk, tokenParams, urls) {
+async function exchangeCodeForTokens(sdk, tokenParams, urls) {
   urls = urls || (0, _util.getOAuthUrls)(sdk, tokenParams);
   // build params using defaults + options
   tokenParams = Object.assign({}, (0, _util.getDefaultTokenParams)(sdk), (0, _util2.clone)(tokenParams));
@@ -34,40 +35,64 @@ function exchangeCodeForTokens(sdk, tokenParams, urls) {
     scopes,
     ignoreSignature,
     state,
-    acrValues
+    acrValues,
+    dpop,
+    dpopPairId,
+    extraParams
   } = tokenParams;
-  var getTokenOptions = {
+
+  // postToTokenEndpoint() params
+  const getTokenOptions = {
     clientId,
     redirectUri,
     authorizationCode,
     interactionCode,
-    codeVerifier
+    codeVerifier,
+    dpop
   };
-  return (0, _token.postToTokenEndpoint)(sdk, getTokenOptions, urls).then(response => {
-    // `handleOAuthResponse` hanadles responses from both `/authorize` and `/token` endpoints
-    // Here we modify the response from `/token` so that it more closely matches a response from `/authorize`
-    // `responseType` is used to validate that the expected tokens were returned
-    const responseType = ['token']; // an accessToken will always be returned
-    if (scopes.indexOf('openid') !== -1) {
-      responseType.push('id_token'); // an idToken will be returned if "openid" is in the scopes
-    }
 
-    const handleResponseOptions = {
-      clientId,
-      redirectUri,
-      scopes,
-      responseType,
-      ignoreSignature,
-      acrValues
-    };
-    return (0, _handleOAuthResponse.handleOAuthResponse)(sdk, handleResponseOptions, response, urls).then(response => {
-      // For compatibility, "code" is returned in the TokenResponse. OKTA-326091
-      response.code = authorizationCode;
-      response.state = state;
-      return response;
-    });
-  }).finally(() => {
+  // `handleOAuthResponse` hanadles responses from both `/authorize` and `/token` endpoints
+  // Here we modify the response from `/token` so that it more closely matches a response from `/authorize`
+  // `responseType` is used to validate that the expected tokens were returned
+  const responseType = ['token']; // an accessToken will always be returned
+  if (scopes.indexOf('openid') !== -1) {
+    responseType.push('id_token'); // an idToken will be returned if "openid" is in the scopes
+  }
+  // handleOAuthResponse() params
+  const handleResponseOptions = {
+    clientId,
+    redirectUri,
+    scopes,
+    responseType,
+    ignoreSignature,
+    acrValues,
+    extraParams
+  };
+  try {
+    if (dpop) {
+      // token refresh, KP should already exist
+      if (dpopPairId) {
+        const keyPair = await (0, _dpop.findKeyPair)(dpopPairId);
+        getTokenOptions.dpopKeyPair = keyPair;
+        handleResponseOptions.dpop = dpop;
+        handleResponseOptions.dpopPairId = dpopPairId;
+      } else {
+        const {
+          keyPair,
+          keyPairId
+        } = await (0, _dpop.createDPoPKeyPair)();
+        getTokenOptions.dpopKeyPair = keyPair;
+        handleResponseOptions.dpop = dpop;
+        handleResponseOptions.dpopPairId = keyPairId;
+      }
+    }
+    const oauthResponse = await (0, _token.postToTokenEndpoint)(sdk, getTokenOptions, urls);
+    const tokenResponse = await (0, _handleOAuthResponse.handleOAuthResponse)(sdk, handleResponseOptions, oauthResponse, urls);
+    tokenResponse.code = authorizationCode;
+    tokenResponse.state = state;
+    return tokenResponse;
+  } finally {
     sdk.transactionManager.clear();
-  });
+  }
 }
 //# sourceMappingURL=exchangeCodeForTokens.js.map

package/cjs/oidc/exchangeCodeForTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"exchangeCodeForTokens.js","names":["exchangeCodeForTokens","sdk","tokenParams","urls","getOAuthUrls","Object","assign","getDefaultTokenParams","clone","authorizationCode","interactionCode","codeVerifier","clientId","redirectUri","scopes","ignoreSignature","state","acrValues","getTokenOptions","postToTokenEndpoint","then","response","responseType","indexOf","push","handleResponseOptions","handleOAuthResponse","code","finally","transactionManager","clear"],"sources":["../../../lib/oidc/exchangeCodeForTokens.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\n/* eslint-disable max-len */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { CustomUrls, OAuthResponse, OAuthResponseType, OktaAuthOAuthInterface, TokenParams, TokenResponse } from './types';\nimport { getOAuthUrls, getDefaultTokenParams } from './util';\nimport { clone } from '../util';\nimport { postToTokenEndpoint } from './endpoints/token';\nimport { handleOAuthResponse } from './handleOAuthResponse';\n\n// codeVerifier is required. May pass either an authorizationCode or interactionCode\nexport function exchangeCodeForTokens(sdk: OktaAuthOAuthInterface, tokenParams: TokenParams, urls?: CustomUrls): Promise<TokenResponse> {\n  urls = urls || getOAuthUrls(sdk, tokenParams);\n  // build params using defaults + options\n  tokenParams = Object.assign({}, getDefaultTokenParams(sdk), clone(tokenParams));\n\n  const {\n    authorizationCode,\n    interactionCode,\n    codeVerifier,\n    clientId,\n    redirectUri,\n    scopes,\n    ignoreSignature,\n    state,\n    acrValues\n  } = tokenParams;\n\n  var getTokenOptions = {\n    clientId,\n    redirectUri,\n    authorizationCode,\n    interactionCode,\n    codeVerifier,\n  };\n\n  return postToTokenEndpoint(sdk, getTokenOptions, urls)\n    .then((response: OAuthResponse) => {\n\n      // `handleOAuthResponse` hanadles responses from both `/authorize` and `/token` endpoints\n      // Here we modify the response from `/token` so that it more closely matches a response from `/authorize`\n      // `responseType` is used to validate that the expected tokens were returned\n      const responseType: OAuthResponseType[] = ['token']; // an accessToken will always be returned\n      if (scopes!.indexOf('openid') !== -1) {\n        responseType.push('id_token'); // an idToken will be returned if \"openid\" is in the scopes\n      }\n      const handleResponseOptions: TokenParams = {\n        clientId,\n        redirectUri,\n        scopes,\n        responseType,\n        ignoreSignature,\n        acrValues\n      };\n      return handleOAuthResponse(sdk, handleResponseOptions, response, urls!)\n        .then((response: TokenResponse) => {\n          // For compatibility, \"code\" is returned in the TokenResponse. OKTA-326091\n          response.code = authorizationCode;\n          response.state = state!;\n          return response;\n        });\n    })\n    .finally(() => {\n      sdk.transactionManager.clear();\n    });\n}"],"mappings":";;;AAeA;AACA;AACA;AACA;AAlBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;AACO,SAASA,qBAAqB,CAACC,GAA2B,EAAEC,WAAwB,EAAEC,IAAiB,EAA0B;EACtIA,IAAI,GAAGA,IAAI,IAAI,IAAAC,kBAAY,EAACH,GAAG,EAAEC,WAAW,CAAC;EAC7C;EACAA,WAAW,GAAGG,MAAM,CAACC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAAC,2BAAqB,EAACN,GAAG,CAAC,EAAE,IAAAO,YAAK,EAACN,WAAW,CAAC,CAAC;EAE/E,MAAM;IACJO,iBAAiB;IACjBC,eAAe;IACfC,YAAY;IACZC,QAAQ;IACRC,WAAW;IACXC,MAAM;IACNC,eAAe;IACfC,KAAK;IACLC;EACF,CAAC,GAAGf,WAAW;EAEf,IAAIgB,eAAe,GAAG;IACpBN,QAAQ;IACRC,WAAW;IACXJ,iBAAiB;IACjBC,eAAe;IACfC;EACF,CAAC;EAED,OAAO,IAAAQ,0BAAmB,EAAClB,GAAG,EAAEiB,eAAe,EAAEf,IAAI,CAAC,CACnDiB,IAAI,CAAEC,QAAuB,IAAK;IAEjC;IACA;IACA;IACA,MAAMC,YAAiC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,IAAIR,MAAM,CAAES,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;MACpCD,YAAY,CAACE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACjC;;IACA,MAAMC,qBAAkC,GAAG;MACzCb,QAAQ;MACRC,WAAW;MACXC,MAAM;MACNQ,YAAY;MACZP,eAAe;MACfE;IACF,CAAC;IACD,OAAO,IAAAS,wCAAmB,EAACzB,GAAG,EAAEwB,qBAAqB,EAAEJ,QAAQ,EAAElB,IAAI,CAAE,CACpEiB,IAAI,CAAEC,QAAuB,IAAK;MACjC;MACAA,QAAQ,CAACM,IAAI,GAAGlB,iBAAiB;MACjCY,QAAQ,CAACL,KAAK,GAAGA,KAAM;MACvB,OAAOK,QAAQ;IACjB,CAAC,CAAC;EACN,CAAC,CAAC,CACDO,OAAO,CAAC,MAAM;IACb3B,GAAG,CAAC4B,kBAAkB,CAACC,KAAK,EAAE;EAChC,CAAC,CAAC;AACN"}
+{"version":3,"file":"exchangeCodeForTokens.js","names":["exchangeCodeForTokens","sdk","tokenParams","urls","getOAuthUrls","Object","assign","getDefaultTokenParams","clone","authorizationCode","interactionCode","codeVerifier","clientId","redirectUri","scopes","ignoreSignature","state","acrValues","dpop","dpopPairId","extraParams","getTokenOptions","responseType","indexOf","push","handleResponseOptions","keyPair","findKeyPair","dpopKeyPair","keyPairId","createDPoPKeyPair","oauthResponse","postToTokenEndpoint","tokenResponse","handleOAuthResponse","code","transactionManager","clear"],"sources":["../../../lib/oidc/exchangeCodeForTokens.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\n/* eslint-disable max-len */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { CustomUrls, OAuthResponse, OAuthResponseType, OktaAuthOAuthInterface, TokenParams, TokenResponse } from './types';\nimport { getOAuthUrls, getDefaultTokenParams } from './util';\nimport { clone } from '../util';\nimport { postToTokenEndpoint, TokenEndpointParams } from './endpoints/token';\nimport { handleOAuthResponse } from './handleOAuthResponse';\nimport { createDPoPKeyPair, findKeyPair } from './dpop';\n\n// codeVerifier is required. May pass either an authorizationCode or interactionCode\nexport async function exchangeCodeForTokens(sdk: OktaAuthOAuthInterface, tokenParams: TokenParams, urls?: CustomUrls): Promise<TokenResponse> {\n  urls = urls || getOAuthUrls(sdk, tokenParams);\n  // build params using defaults + options\n  tokenParams = Object.assign({}, getDefaultTokenParams(sdk), clone(tokenParams));\n\n  const {\n    authorizationCode,\n    interactionCode,\n    codeVerifier,\n    clientId,\n    redirectUri,\n    scopes,\n    ignoreSignature,\n    state,\n    acrValues,\n    dpop,\n    dpopPairId,\n    extraParams\n  } = tokenParams;\n\n  // postToTokenEndpoint() params\n  const getTokenOptions: TokenEndpointParams = {\n    clientId,\n    redirectUri,\n    authorizationCode,\n    interactionCode,\n    codeVerifier,\n    dpop,\n  };\n\n  // `handleOAuthResponse` hanadles responses from both `/authorize` and `/token` endpoints\n  // Here we modify the response from `/token` so that it more closely matches a response from `/authorize`\n  // `responseType` is used to validate that the expected tokens were returned\n  const responseType: OAuthResponseType[] = ['token']; // an accessToken will always be returned\n  if (scopes!.indexOf('openid') !== -1) {\n    responseType.push('id_token'); // an idToken will be returned if \"openid\" is in the scopes\n  }\n  // handleOAuthResponse() params\n  const handleResponseOptions: TokenParams = {\n    clientId,\n    redirectUri,\n    scopes,\n    responseType,\n    ignoreSignature,\n    acrValues,\n    extraParams\n  };\n\n  try {\n    if (dpop) {\n      // token refresh, KP should already exist\n      if (dpopPairId) {\n        const keyPair = await findKeyPair(dpopPairId);\n        getTokenOptions.dpopKeyPair = keyPair;\n        handleResponseOptions.dpop = dpop;\n        handleResponseOptions.dpopPairId = dpopPairId;\n      }\n      else {\n        const { keyPair, keyPairId } = await createDPoPKeyPair();\n        getTokenOptions.dpopKeyPair = keyPair;\n        handleResponseOptions.dpop = dpop;\n        handleResponseOptions.dpopPairId = keyPairId;\n      }\n    }\n\n    const oauthResponse: OAuthResponse = await postToTokenEndpoint(sdk, getTokenOptions, urls);\n\n    const tokenResponse: TokenResponse = await handleOAuthResponse(sdk, handleResponseOptions, oauthResponse, urls!);\n    tokenResponse.code = authorizationCode;\n    tokenResponse.state = state!;\n    return tokenResponse;\n  }\n  finally {\n    sdk.transactionManager.clear();\n  }\n}\n"],"mappings":";;;AAeA;AACA;AACA;AACA;AACA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA;AACO,eAAeA,qBAAqB,CAACC,GAA2B,EAAEC,WAAwB,EAAEC,IAAiB,EAA0B;EAC5IA,IAAI,GAAGA,IAAI,IAAI,IAAAC,kBAAY,EAACH,GAAG,EAAEC,WAAW,CAAC;EAC7C;EACAA,WAAW,GAAGG,MAAM,CAACC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAAC,2BAAqB,EAACN,GAAG,CAAC,EAAE,IAAAO,YAAK,EAACN,WAAW,CAAC,CAAC;EAE/E,MAAM;IACJO,iBAAiB;IACjBC,eAAe;IACfC,YAAY;IACZC,QAAQ;IACRC,WAAW;IACXC,MAAM;IACNC,eAAe;IACfC,KAAK;IACLC,SAAS;IACTC,IAAI;IACJC,UAAU;IACVC;EACF,CAAC,GAAGlB,WAAW;;EAEf;EACA,MAAMmB,eAAoC,GAAG;IAC3CT,QAAQ;IACRC,WAAW;IACXJ,iBAAiB;IACjBC,eAAe;IACfC,YAAY;IACZO;EACF,CAAC;;EAED;EACA;EACA;EACA,MAAMI,YAAiC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;EACrD,IAAIR,MAAM,CAAES,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;IACpCD,YAAY,CAACE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;EACjC;EACA;EACA,MAAMC,qBAAkC,GAAG;IACzCb,QAAQ;IACRC,WAAW;IACXC,MAAM;IACNQ,YAAY;IACZP,eAAe;IACfE,SAAS;IACTG;EACF,CAAC;EAED,IAAI;IACF,IAAIF,IAAI,EAAE;MACR;MACA,IAAIC,UAAU,EAAE;QACd,MAAMO,OAAO,GAAG,MAAM,IAAAC,iBAAW,EAACR,UAAU,CAAC;QAC7CE,eAAe,CAACO,WAAW,GAAGF,OAAO;QACrCD,qBAAqB,CAACP,IAAI,GAAGA,IAAI;QACjCO,qBAAqB,CAACN,UAAU,GAAGA,UAAU;MAC/C,CAAC,MACI;QACH,MAAM;UAAEO,OAAO;UAAEG;QAAU,CAAC,GAAG,MAAM,IAAAC,uBAAiB,GAAE;QACxDT,eAAe,CAACO,WAAW,GAAGF,OAAO;QACrCD,qBAAqB,CAACP,IAAI,GAAGA,IAAI;QACjCO,qBAAqB,CAACN,UAAU,GAAGU,SAAS;MAC9C;IACF;IAEA,MAAME,aAA4B,GAAG,MAAM,IAAAC,0BAAmB,EAAC/B,GAAG,EAAEoB,eAAe,EAAElB,IAAI,CAAC;IAE1F,MAAM8B,aAA4B,GAAG,MAAM,IAAAC,wCAAmB,EAACjC,GAAG,EAAEwB,qBAAqB,EAAEM,aAAa,EAAE5B,IAAI,CAAE;IAChH8B,aAAa,CAACE,IAAI,GAAG1B,iBAAiB;IACtCwB,aAAa,CAACjB,KAAK,GAAGA,KAAM;IAC5B,OAAOiB,aAAa;EACtB,CAAC,SACO;IACNhC,GAAG,CAACmC,kBAAkB,CAACC,KAAK,EAAE;EAChC;AACF"}

package/cjs/oidc/getUserInfo.js

@@ -1,7 +1,6 @@
 "use strict";
 
 exports.getUserInfo = getUserInfo;
-var _util = require("../util");
 var _errors = require("../errors");
 var _http = require("../http");
 var _types = require("./types");
@@ -33,32 +32,48 @@ async function getUserInfo(sdk, accessTokenObject, idTokenObject) {
   if (!idTokenObject || !(0, _types.isIDToken)(idTokenObject)) {
     return Promise.reject(new _errors.AuthSdkError('getUserInfo requires an ID token object'));
   }
-  return (0, _http.httpRequest)(sdk, {
+  const options = {
     url: accessTokenObject.userinfoUrl,
     method: 'GET',
     accessToken: accessTokenObject.accessToken
-  }).then(userInfo => {
+  };
+  if (sdk.options.dpop) {
+    const headers = await sdk.getDPoPAuthorizationHeaders({
+      ...options,
+      accessToken: accessTokenObject
+    });
+    options.headers = headers;
+    delete options.accessToken; // unset to prevent overriding Auth header with Bearer Token
+  }
+
+  return (0, _http.httpRequest)(sdk, options).then(userInfo => {
     // Only return the userinfo response if subjects match to mitigate token substitution attacks
     if (userInfo.sub === idTokenObject.claims.sub) {
       return userInfo;
     }
     return Promise.reject(new _errors.AuthSdkError('getUserInfo request was rejected due to token mismatch'));
   }).catch(function (err) {
-    if (err.xhr && (err.xhr.status === 401 || err.xhr.status === 403)) {
-      var authenticateHeader;
-      if (err.xhr.headers && (0, _util.isFunction)(err.xhr.headers.get) && err.xhr.headers.get('WWW-Authenticate')) {
-        authenticateHeader = err.xhr.headers.get('WWW-Authenticate');
-      } else if ((0, _util.isFunction)(err.xhr.getResponseHeader)) {
-        authenticateHeader = err.xhr.getResponseHeader('WWW-Authenticate');
+    // throw OAuthError to avoid breaking change (when dpop is not being used)
+    if (err instanceof _errors.WWWAuthError && !sdk.options.dpop) {
+      const {
+        error,
+        errorDescription
+      } = err;
+      throw new _errors.OAuthError(error, errorDescription);
+    }
+
+    // throw OAuthError to avoid breaking change (when dpop is not being used)
+    if (!sdk.options.dpop) {
+      let e = err;
+      if (err instanceof _errors.AuthApiError && err?.meta?.wwwAuthHeader) {
+        e = _errors.WWWAuthError.parseHeader(err.meta.wwwAuthHeader);
       }
-      if (authenticateHeader) {
-        var errorMatches = authenticateHeader.match(/error="(.*?)"/) || [];
-        var errorDescriptionMatches = authenticateHeader.match(/error_description="(.*?)"/) || [];
-        var error = errorMatches[1];
-        var errorDescription = errorDescriptionMatches[1];
-        if (error && errorDescription) {
-          err = new _errors.OAuthError(error, errorDescription);
-        }
+      if (e instanceof _errors.WWWAuthError) {
+        const {
+          error,
+          errorDescription
+        } = e;
+        throw new _errors.OAuthError(error, errorDescription);
       }
     }
     throw err;

package/cjs/oidc/getUserInfo.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserInfo.js","names":["getUserInfo","sdk","accessTokenObject","idTokenObject","tokenManager","getTokens","accessToken","idToken","isAccessToken","Promise","reject","AuthSdkError","isIDToken","httpRequest","url","userinfoUrl","method","then","userInfo","sub","claims","catch","err","xhr","status","authenticateHeader","headers","isFunction","get","getResponseHeader","errorMatches","match","errorDescriptionMatches","error","errorDescription","OAuthError"],"sources":["../../../lib/oidc/getUserInfo.ts"],"sourcesContent":["/* eslint-disable complexity */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { isFunction } from '../util';\nimport { AuthSdkError, OAuthError } from '../errors';\nimport { httpRequest } from '../http';\nimport { AccessToken, IDToken, UserClaims, isAccessToken, isIDToken, CustomUserClaims } from './types';\n\nexport async function getUserInfo<T extends CustomUserClaims = CustomUserClaims>(\n  sdk, accessTokenObject: AccessToken,\n  idTokenObject: IDToken\n): Promise<UserClaims<T>> {\n  // If token objects were not passed, attempt to read from the TokenManager\n  if (!accessTokenObject) {\n    accessTokenObject = (await sdk.tokenManager.getTokens()).accessToken as AccessToken;\n  }\n  if (!idTokenObject) {\n    idTokenObject = (await sdk.tokenManager.getTokens()).idToken as IDToken;\n  }\n\n  if (!accessTokenObject || !isAccessToken(accessTokenObject)) {\n    return Promise.reject(new AuthSdkError('getUserInfo requires an access token object'));\n  }\n\n  if (!idTokenObject || !isIDToken(idTokenObject)) {\n    return Promise.reject(new AuthSdkError('getUserInfo requires an ID token object'));\n  }\n\n  return httpRequest(sdk, {\n    url: accessTokenObject.userinfoUrl,\n    method: 'GET',\n    accessToken: accessTokenObject.accessToken\n  })\n    .then(userInfo => {\n      // Only return the userinfo response if subjects match to mitigate token substitution attacks\n      if (userInfo.sub === idTokenObject.claims.sub) {\n        return userInfo;\n      }\n      return Promise.reject(new AuthSdkError('getUserInfo request was rejected due to token mismatch'));\n    })\n    .catch(function (err) {\n      if (err.xhr && (err.xhr.status === 401 || err.xhr.status === 403)) {\n        var authenticateHeader;\n        if (err.xhr.headers && isFunction(err.xhr.headers.get) && err.xhr.headers.get('WWW-Authenticate')) {\n          authenticateHeader = err.xhr.headers.get('WWW-Authenticate');\n        } else if (isFunction(err.xhr.getResponseHeader)) {\n          authenticateHeader = err.xhr.getResponseHeader('WWW-Authenticate');\n        }\n        if (authenticateHeader) {\n          var errorMatches = authenticateHeader.match(/error=\"(.*?)\"/) || [];\n          var errorDescriptionMatches = authenticateHeader.match(/error_description=\"(.*?)\"/) || [];\n          var error = errorMatches[1];\n          var errorDescription = errorDescriptionMatches[1];\n          if (error && errorDescription) {\n            err = new OAuthError(error, errorDescription);\n          }\n        }\n      }\n      throw err;\n    });\n}\n"],"mappings":";;;AAaA;AACA;AACA;AACA;AAhBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMO,eAAeA,WAAW,CAC/BC,GAAG,EAAEC,iBAA8B,EACnCC,aAAsB,EACE;EACxB;EACA,IAAI,CAACD,iBAAiB,EAAE;IACtBA,iBAAiB,GAAG,CAAC,MAAMD,GAAG,CAACG,YAAY,CAACC,SAAS,EAAE,EAAEC,WAA0B;EACrF;EACA,IAAI,CAACH,aAAa,EAAE;IAClBA,aAAa,GAAG,CAAC,MAAMF,GAAG,CAACG,YAAY,CAACC,SAAS,EAAE,EAAEE,OAAkB;EACzE;EAEA,IAAI,CAACL,iBAAiB,IAAI,CAAC,IAAAM,oBAAa,EAACN,iBAAiB,CAAC,EAAE;IAC3D,OAAOO,OAAO,CAACC,MAAM,CAAC,IAAIC,oBAAY,CAAC,6CAA6C,CAAC,CAAC;EACxF;EAEA,IAAI,CAACR,aAAa,IAAI,CAAC,IAAAS,gBAAS,EAACT,aAAa,CAAC,EAAE;IAC/C,OAAOM,OAAO,CAACC,MAAM,CAAC,IAAIC,oBAAY,CAAC,yCAAyC,CAAC,CAAC;EACpF;EAEA,OAAO,IAAAE,iBAAW,EAACZ,GAAG,EAAE;IACtBa,GAAG,EAAEZ,iBAAiB,CAACa,WAAW;IAClCC,MAAM,EAAE,KAAK;IACbV,WAAW,EAAEJ,iBAAiB,CAACI;EACjC,CAAC,CAAC,CACCW,IAAI,CAACC,QAAQ,IAAI;IAChB;IACA,IAAIA,QAAQ,CAACC,GAAG,KAAKhB,aAAa,CAACiB,MAAM,CAACD,GAAG,EAAE;MAC7C,OAAOD,QAAQ;IACjB;IACA,OAAOT,OAAO,CAACC,MAAM,CAAC,IAAIC,oBAAY,CAAC,wDAAwD,CAAC,CAAC;EACnG,CAAC,CAAC,CACDU,KAAK,CAAC,UAAUC,GAAG,EAAE;IACpB,IAAIA,GAAG,CAACC,GAAG,KAAKD,GAAG,CAACC,GAAG,CAACC,MAAM,KAAK,GAAG,IAAIF,GAAG,CAACC,GAAG,CAACC,MAAM,KAAK,GAAG,CAAC,EAAE;MACjE,IAAIC,kBAAkB;MACtB,IAAIH,GAAG,CAACC,GAAG,CAACG,OAAO,IAAI,IAAAC,gBAAU,EAACL,GAAG,CAACC,GAAG,CAACG,OAAO,CAACE,GAAG,CAAC,IAAIN,GAAG,CAACC,GAAG,CAACG,OAAO,CAACE,GAAG,CAAC,kBAAkB,CAAC,EAAE;QACjGH,kBAAkB,GAAGH,GAAG,CAACC,GAAG,CAACG,OAAO,CAACE,GAAG,CAAC,kBAAkB,CAAC;MAC9D,CAAC,MAAM,IAAI,IAAAD,gBAAU,EAACL,GAAG,CAACC,GAAG,CAACM,iBAAiB,CAAC,EAAE;QAChDJ,kBAAkB,GAAGH,GAAG,CAACC,GAAG,CAACM,iBAAiB,CAAC,kBAAkB,CAAC;MACpE;MACA,IAAIJ,kBAAkB,EAAE;QACtB,IAAIK,YAAY,GAAGL,kBAAkB,CAACM,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE;QAClE,IAAIC,uBAAuB,GAAGP,kBAAkB,CAACM,KAAK,CAAC,2BAA2B,CAAC,IAAI,EAAE;QACzF,IAAIE,KAAK,GAAGH,YAAY,CAAC,CAAC,CAAC;QAC3B,IAAII,gBAAgB,GAAGF,uBAAuB,CAAC,CAAC,CAAC;QACjD,IAAIC,KAAK,IAAIC,gBAAgB,EAAE;UAC7BZ,GAAG,GAAG,IAAIa,kBAAU,CAACF,KAAK,EAAEC,gBAAgB,CAAC;QAC/C;MACF;IACF;IACA,MAAMZ,GAAG;EACX,CAAC,CAAC;AACN"}
+{"version":3,"file":"getUserInfo.js","names":["getUserInfo","sdk","accessTokenObject","idTokenObject","tokenManager","getTokens","accessToken","idToken","isAccessToken","Promise","reject","AuthSdkError","isIDToken","options","url","userinfoUrl","method","dpop","headers","getDPoPAuthorizationHeaders","httpRequest","then","userInfo","sub","claims","catch","err","WWWAuthError","error","errorDescription","OAuthError","e","AuthApiError","meta","wwwAuthHeader","parseHeader"],"sources":["../../../lib/oidc/getUserInfo.ts"],"sourcesContent":["/* eslint-disable complexity */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { AuthSdkError, OAuthError, WWWAuthError, AuthApiError } from '../errors';\nimport { httpRequest } from '../http';\nimport { AccessToken, IDToken, UserClaims, isAccessToken, isIDToken, CustomUserClaims } from './types';\n\nexport async function getUserInfo<T extends CustomUserClaims = CustomUserClaims>(\n  sdk, accessTokenObject: AccessToken,\n  idTokenObject: IDToken\n): Promise<UserClaims<T>> {\n  // If token objects were not passed, attempt to read from the TokenManager\n  if (!accessTokenObject) {\n    accessTokenObject = (await sdk.tokenManager.getTokens()).accessToken as AccessToken;\n  }\n  if (!idTokenObject) {\n    idTokenObject = (await sdk.tokenManager.getTokens()).idToken as IDToken;\n  }\n\n  if (!accessTokenObject || !isAccessToken(accessTokenObject)) {\n    return Promise.reject(new AuthSdkError('getUserInfo requires an access token object'));\n  }\n\n  if (!idTokenObject || !isIDToken(idTokenObject)) {\n    return Promise.reject(new AuthSdkError('getUserInfo requires an ID token object'));\n  }\n\n  const options: any = {\n    url: accessTokenObject.userinfoUrl,\n    method: 'GET',\n    accessToken: accessTokenObject.accessToken\n  };\n\n  if (sdk.options.dpop) {\n    const headers = await sdk.getDPoPAuthorizationHeaders({...options, accessToken: accessTokenObject });\n    options.headers = headers;\n    delete options.accessToken;      // unset to prevent overriding Auth header with Bearer Token\n  }\n\n  return httpRequest(sdk, options)\n    .then(userInfo => {\n      // Only return the userinfo response if subjects match to mitigate token substitution attacks\n      if (userInfo.sub === idTokenObject.claims.sub) {\n        return userInfo;\n      }\n      return Promise.reject(new AuthSdkError('getUserInfo request was rejected due to token mismatch'));\n    })\n    .catch(function (err) {\n      // throw OAuthError to avoid breaking change (when dpop is not being used)\n      if (err instanceof WWWAuthError && !sdk.options.dpop) {\n        const { error, errorDescription } = err;\n        throw new OAuthError(error, errorDescription);\n      }\n\n      // throw OAuthError to avoid breaking change (when dpop is not being used)\n      if (!sdk.options.dpop) {\n        let e = err;\n        if (err instanceof AuthApiError && err?.meta?.wwwAuthHeader) {\n          e = WWWAuthError.parseHeader(err.meta.wwwAuthHeader as string);\n        }\n\n        if (e instanceof WWWAuthError) {\n          const { error, errorDescription } = e;\n          throw new OAuthError(error, errorDescription);\n        }\n      }\n\n      throw err;\n    });\n}\n"],"mappings":";;;AAaA;AACA;AACA;AAfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKO,eAAeA,WAAW,CAC/BC,GAAG,EAAEC,iBAA8B,EACnCC,aAAsB,EACE;EACxB;EACA,IAAI,CAACD,iBAAiB,EAAE;IACtBA,iBAAiB,GAAG,CAAC,MAAMD,GAAG,CAACG,YAAY,CAACC,SAAS,EAAE,EAAEC,WAA0B;EACrF;EACA,IAAI,CAACH,aAAa,EAAE;IAClBA,aAAa,GAAG,CAAC,MAAMF,GAAG,CAACG,YAAY,CAACC,SAAS,EAAE,EAAEE,OAAkB;EACzE;EAEA,IAAI,CAACL,iBAAiB,IAAI,CAAC,IAAAM,oBAAa,EAACN,iBAAiB,CAAC,EAAE;IAC3D,OAAOO,OAAO,CAACC,MAAM,CAAC,IAAIC,oBAAY,CAAC,6CAA6C,CAAC,CAAC;EACxF;EAEA,IAAI,CAACR,aAAa,IAAI,CAAC,IAAAS,gBAAS,EAACT,aAAa,CAAC,EAAE;IAC/C,OAAOM,OAAO,CAACC,MAAM,CAAC,IAAIC,oBAAY,CAAC,yCAAyC,CAAC,CAAC;EACpF;EAEA,MAAME,OAAY,GAAG;IACnBC,GAAG,EAAEZ,iBAAiB,CAACa,WAAW;IAClCC,MAAM,EAAE,KAAK;IACbV,WAAW,EAAEJ,iBAAiB,CAACI;EACjC,CAAC;EAED,IAAIL,GAAG,CAACY,OAAO,CAACI,IAAI,EAAE;IACpB,MAAMC,OAAO,GAAG,MAAMjB,GAAG,CAACkB,2BAA2B,CAAC;MAAC,GAAGN,OAAO;MAAEP,WAAW,EAAEJ;IAAkB,CAAC,CAAC;IACpGW,OAAO,CAACK,OAAO,GAAGA,OAAO;IACzB,OAAOL,OAAO,CAACP,WAAW,CAAC,CAAM;EACnC;;EAEA,OAAO,IAAAc,iBAAW,EAACnB,GAAG,EAAEY,OAAO,CAAC,CAC7BQ,IAAI,CAACC,QAAQ,IAAI;IAChB;IACA,IAAIA,QAAQ,CAACC,GAAG,KAAKpB,aAAa,CAACqB,MAAM,CAACD,GAAG,EAAE;MAC7C,OAAOD,QAAQ;IACjB;IACA,OAAOb,OAAO,CAACC,MAAM,CAAC,IAAIC,oBAAY,CAAC,wDAAwD,CAAC,CAAC;EACnG,CAAC,CAAC,CACDc,KAAK,CAAC,UAAUC,GAAG,EAAE;IACpB;IACA,IAAIA,GAAG,YAAYC,oBAAY,IAAI,CAAC1B,GAAG,CAACY,OAAO,CAACI,IAAI,EAAE;MACpD,MAAM;QAAEW,KAAK;QAAEC;MAAiB,CAAC,GAAGH,GAAG;MACvC,MAAM,IAAII,kBAAU,CAACF,KAAK,EAAEC,gBAAgB,CAAC;IAC/C;;IAEA;IACA,IAAI,CAAC5B,GAAG,CAACY,OAAO,CAACI,IAAI,EAAE;MACrB,IAAIc,CAAC,GAAGL,GAAG;MACX,IAAIA,GAAG,YAAYM,oBAAY,IAAIN,GAAG,EAAEO,IAAI,EAAEC,aAAa,EAAE;QAC3DH,CAAC,GAAGJ,oBAAY,CAACQ,WAAW,CAACT,GAAG,CAACO,IAAI,CAACC,aAAa,CAAW;MAChE;MAEA,IAAIH,CAAC,YAAYJ,oBAAY,EAAE;QAC7B,MAAM;UAAEC,KAAK;UAAEC;QAAiB,CAAC,GAAGE,CAAC;QACrC,MAAM,IAAID,kBAAU,CAACF,KAAK,EAAEC,gBAAgB,CAAC;MAC/C;IACF;IAEA,MAAMH,GAAG;EACX,CAAC,CAAC;AACN"}

package/cjs/oidc/handleOAuthResponse.js

@@ -29,6 +29,12 @@ function validateResponse(res, oauthParams) {
   if (res.state !== oauthParams.state) {
     throw new _errors.AuthSdkError('OAuth flow response state doesn\'t match request state');
   }
+
+  // https://datatracker.ietf.org/doc/html/rfc9449#token-response
+  // "A token_type of DPoP MUST be included in the access token response to signal to the client"
+  if (oauthParams.dpop && res.token_type !== 'DPoP') {
+    throw new _errors.AuthSdkError('Unable to parse OAuth flow response: DPoP was configured but "token_type" was not DPoP');
+  }
 }
 async function handleOAuthResponse(sdk, tokenParams, res, urls) {
   const pkce = sdk.options.pkce !== false;
@@ -75,6 +81,12 @@ async function handleOAuthResponse(sdk, tokenParams, res, urls) {
       authorizeUrl: urls.authorizeUrl,
       userinfoUrl: urls.userinfoUrl
     };
+    if (tokenParams.dpopPairId) {
+      tokenDict.accessToken.dpopPairId = tokenParams.dpopPairId;
+    }
+    if (tokenParams.extraParams) {
+      tokenDict.accessToken.extraParams = tokenParams.extraParams;
+    }
   }
   if (refreshToken) {
     tokenDict.refreshToken = {
@@ -87,6 +99,12 @@ async function handleOAuthResponse(sdk, tokenParams, res, urls) {
       authorizeUrl: urls.authorizeUrl,
       issuer: urls.issuer
     };
+    if (tokenParams.dpopPairId) {
+      tokenDict.refreshToken.dpopPairId = tokenParams.dpopPairId;
+    }
+    if (tokenParams.extraParams) {
+      tokenDict.refreshToken.extraParams = tokenParams.extraParams;
+    }
   }
   if (idToken) {
     const idJwt = sdk.token.decode(idToken);
@@ -100,6 +118,9 @@ async function handleOAuthResponse(sdk, tokenParams, res, urls) {
       issuer: urls.issuer,
       clientId: clientId
     };
+    if (tokenParams.extraParams) {
+      idTokenObj.extraParams = tokenParams.extraParams;
+    }
     const validationParams = {
       clientId: clientId,
       issuer: urls.issuer,

package/cjs/oidc/handleOAuthResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"handleOAuthResponse.js","names":["validateResponse","res","oauthParams","OAuthError","state","AuthSdkError","handleOAuthResponse","sdk","tokenParams","urls","pkce","options","code","interaction_code","token","exchangeCodeForTokens","Object","assign","authorizationCode","interactionCode","getDefaultTokenParams","getOAuthUrls","responseType","Array","isArray","scopes","scope","split","clone","clientId","tokenDict","expiresIn","expires_in","tokenType","token_type","accessToken","access_token","idToken","id_token","refreshToken","refresh_token","now","Math","floor","Date","accessJwt","decode","claims","payload","expiresAt","Number","authorizeUrl","userinfoUrl","tokenUrl","issuer","idJwt","idTokenObj","exp","iat","validationParams","nonce","acrValues","ignoreSignature","undefined","verifyToken","indexOf","tokens"],"sources":["../../../lib/oidc/handleOAuthResponse.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\n\n/* eslint-disable complexity, max-statements */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { clone } from '../util';\nimport {\n  getOAuthUrls,\n} from './util/oauth';\nimport { AuthSdkError, OAuthError } from '../errors';\nimport {\n  OktaAuthOAuthInterface,\n  TokenVerifyParams,\n  IDToken,\n  OAuthResponse,\n  TokenParams,\n  TokenResponse,\n  CustomUrls,\n  Tokens,\n} from './types';\nimport { verifyToken } from './verifyToken';\nimport { getDefaultTokenParams } from './util';\n\nfunction validateResponse(res: OAuthResponse, oauthParams: TokenParams) {\n  if (res['error'] && res['error_description']) {\n    throw new OAuthError(res['error'], res['error_description']);\n  }\n\n  if (res.state !== oauthParams.state) {\n    throw new AuthSdkError('OAuth flow response state doesn\\'t match request state');\n  }\n}\n\nexport async function handleOAuthResponse(\n  sdk: OktaAuthOAuthInterface,\n  tokenParams: TokenParams,\n  res: OAuthResponse,\n  urls?: CustomUrls\n): Promise<TokenResponse> {\n  const pkce = sdk.options.pkce !== false;\n\n  // The result contains an authorization_code and PKCE is enabled \n  // `exchangeCodeForTokens` will call /token then call `handleOauthResponse` recursively with the result\n  if (pkce && (res.code || res.interaction_code)) {\n    return sdk.token.exchangeCodeForTokens(Object.assign({}, tokenParams, {\n      authorizationCode: res.code,\n      interactionCode: res.interaction_code\n    }), urls);\n  }\n\n  tokenParams = tokenParams || getDefaultTokenParams(sdk);\n  urls = urls || getOAuthUrls(sdk, tokenParams);\n\n  let responseType = tokenParams.responseType || [];\n  if (!Array.isArray(responseType) && responseType !== 'none') {\n    responseType = [responseType];\n  }\n\n  let scopes;\n  if (res.scope) {\n    scopes = res.scope.split(' ');\n  } else {\n    scopes = clone(tokenParams.scopes);\n  }\n  const clientId = tokenParams.clientId || sdk.options.clientId;\n\n  // Handling the result from implicit flow or PKCE token exchange\n  validateResponse(res, tokenParams);\n\n  const tokenDict = {} as Tokens;\n  const expiresIn = res.expires_in;\n  const tokenType = res.token_type;\n  const accessToken = res.access_token;\n  const idToken = res.id_token;\n  const refreshToken = res.refresh_token;\n  const now = Math.floor(Date.now()/1000);\n\n  if (accessToken) {\n    const accessJwt = sdk.token.decode(accessToken);\n    tokenDict.accessToken = {\n      accessToken: accessToken,\n      claims: accessJwt.payload,\n      expiresAt: Number(expiresIn) + now,\n      tokenType: tokenType!,\n      scopes: scopes,\n      authorizeUrl: urls.authorizeUrl!,\n      userinfoUrl: urls.userinfoUrl!\n    };\n  }\n\n  if (refreshToken) {\n    tokenDict.refreshToken = {\n      refreshToken: refreshToken,\n      // should not be used, this is the accessToken expire time\n      // TODO: remove \"expiresAt\" in the next major version OKTA-407224\n      expiresAt: Number(expiresIn) + now, \n      scopes: scopes,\n      tokenUrl: urls.tokenUrl!,\n      authorizeUrl: urls.authorizeUrl!,\n      issuer: urls.issuer!,\n    };\n  }\n\n  if (idToken) {\n    const idJwt = sdk.token.decode(idToken);\n    const idTokenObj: IDToken = {\n      idToken: idToken,\n      claims: idJwt.payload,\n      expiresAt: idJwt.payload.exp! - idJwt.payload.iat! + now, // adjusting expiresAt to be in local time\n      scopes: scopes,\n      authorizeUrl: urls.authorizeUrl!,\n      issuer: urls.issuer!,\n      clientId: clientId!\n    };\n\n    const validationParams: TokenVerifyParams = {\n      clientId: clientId!,\n      issuer: urls.issuer!,\n      nonce: tokenParams.nonce,\n      accessToken: accessToken,\n      acrValues: tokenParams.acrValues\n    };\n\n    if (tokenParams.ignoreSignature !== undefined) {\n      validationParams.ignoreSignature = tokenParams.ignoreSignature;\n    }\n\n    await verifyToken(sdk, idTokenObj, validationParams);\n    tokenDict.idToken = idTokenObj;\n  }\n\n  // Validate received tokens against requested response types \n  if (responseType.indexOf('token') !== -1 && !tokenDict.accessToken) {\n    // eslint-disable-next-line max-len\n    throw new AuthSdkError('Unable to parse OAuth flow response: response type \"token\" was requested but \"access_token\" was not returned.');\n  }\n  if (responseType.indexOf('id_token') !== -1 && !tokenDict.idToken) {\n    // eslint-disable-next-line max-len\n    throw new AuthSdkError('Unable to parse OAuth flow response: response type \"id_token\" was requested but \"id_token\" was not returned.');\n  }\n\n  return {\n    tokens: tokenDict,\n    state: res.state!,\n    code: res.code,\n    responseType\n  };\n  \n}"],"mappings":";;;AAeA;AACA;AAGA;AAWA;AACA;AA/BA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAmBA,SAASA,gBAAgB,CAACC,GAAkB,EAAEC,WAAwB,EAAE;EACtE,IAAID,GAAG,CAAC,OAAO,CAAC,IAAIA,GAAG,CAAC,mBAAmB,CAAC,EAAE;IAC5C,MAAM,IAAIE,kBAAU,CAACF,GAAG,CAAC,OAAO,CAAC,EAAEA,GAAG,CAAC,mBAAmB,CAAC,CAAC;EAC9D;EAEA,IAAIA,GAAG,CAACG,KAAK,KAAKF,WAAW,CAACE,KAAK,EAAE;IACnC,MAAM,IAAIC,oBAAY,CAAC,wDAAwD,CAAC;EAClF;AACF;AAEO,eAAeC,mBAAmB,CACvCC,GAA2B,EAC3BC,WAAwB,EACxBP,GAAkB,EAClBQ,IAAiB,EACO;EACxB,MAAMC,IAAI,GAAGH,GAAG,CAACI,OAAO,CAACD,IAAI,KAAK,KAAK;;EAEvC;EACA;EACA,IAAIA,IAAI,KAAKT,GAAG,CAACW,IAAI,IAAIX,GAAG,CAACY,gBAAgB,CAAC,EAAE;IAC9C,OAAON,GAAG,CAACO,KAAK,CAACC,qBAAqB,CAACC,MAAM,CAACC,MAAM,CAAC,CAAC,CAAC,EAAET,WAAW,EAAE;MACpEU,iBAAiB,EAAEjB,GAAG,CAACW,IAAI;MAC3BO,eAAe,EAAElB,GAAG,CAACY;IACvB,CAAC,CAAC,EAAEJ,IAAI,CAAC;EACX;EAEAD,WAAW,GAAGA,WAAW,IAAI,IAAAY,4BAAqB,EAACb,GAAG,CAAC;EACvDE,IAAI,GAAGA,IAAI,IAAI,IAAAY,mBAAY,EAACd,GAAG,EAAEC,WAAW,CAAC;EAE7C,IAAIc,YAAY,GAAGd,WAAW,CAACc,YAAY,IAAI,EAAE;EACjD,IAAI,CAACC,KAAK,CAACC,OAAO,CAACF,YAAY,CAAC,IAAIA,YAAY,KAAK,MAAM,EAAE;IAC3DA,YAAY,GAAG,CAACA,YAAY,CAAC;EAC/B;EAEA,IAAIG,MAAM;EACV,IAAIxB,GAAG,CAACyB,KAAK,EAAE;IACbD,MAAM,GAAGxB,GAAG,CAACyB,KAAK,CAACC,KAAK,CAAC,GAAG,CAAC;EAC/B,CAAC,MAAM;IACLF,MAAM,GAAG,IAAAG,WAAK,EAACpB,WAAW,CAACiB,MAAM,CAAC;EACpC;EACA,MAAMI,QAAQ,GAAGrB,WAAW,CAACqB,QAAQ,IAAItB,GAAG,CAACI,OAAO,CAACkB,QAAQ;;EAE7D;EACA7B,gBAAgB,CAACC,GAAG,EAAEO,WAAW,CAAC;EAElC,MAAMsB,SAAS,GAAG,CAAC,CAAW;EAC9B,MAAMC,SAAS,GAAG9B,GAAG,CAAC+B,UAAU;EAChC,MAAMC,SAAS,GAAGhC,GAAG,CAACiC,UAAU;EAChC,MAAMC,WAAW,GAAGlC,GAAG,CAACmC,YAAY;EACpC,MAAMC,OAAO,GAAGpC,GAAG,CAACqC,QAAQ;EAC5B,MAAMC,YAAY,GAAGtC,GAAG,CAACuC,aAAa;EACtC,MAAMC,GAAG,GAAGC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACH,GAAG,EAAE,GAAC,IAAI,CAAC;EAEvC,IAAIN,WAAW,EAAE;IACf,MAAMU,SAAS,GAAGtC,GAAG,CAACO,KAAK,CAACgC,MAAM,CAACX,WAAW,CAAC;IAC/CL,SAAS,CAACK,WAAW,GAAG;MACtBA,WAAW,EAAEA,WAAW;MACxBY,MAAM,EAAEF,SAAS,CAACG,OAAO;MACzBC,SAAS,EAAEC,MAAM,CAACnB,SAAS,CAAC,GAAGU,GAAG;MAClCR,SAAS,EAAEA,SAAU;MACrBR,MAAM,EAAEA,MAAM;MACd0B,YAAY,EAAE1C,IAAI,CAAC0C,YAAa;MAChCC,WAAW,EAAE3C,IAAI,CAAC2C;IACpB,CAAC;EACH;EAEA,IAAIb,YAAY,EAAE;IAChBT,SAAS,CAACS,YAAY,GAAG;MACvBA,YAAY,EAAEA,YAAY;MAC1B;MACA;MACAU,SAAS,EAAEC,MAAM,CAACnB,SAAS,CAAC,GAAGU,GAAG;MAClChB,MAAM,EAAEA,MAAM;MACd4B,QAAQ,EAAE5C,IAAI,CAAC4C,QAAS;MACxBF,YAAY,EAAE1C,IAAI,CAAC0C,YAAa;MAChCG,MAAM,EAAE7C,IAAI,CAAC6C;IACf,CAAC;EACH;EAEA,IAAIjB,OAAO,EAAE;IACX,MAAMkB,KAAK,GAAGhD,GAAG,CAACO,KAAK,CAACgC,MAAM,CAACT,OAAO,CAAC;IACvC,MAAMmB,UAAmB,GAAG;MAC1BnB,OAAO,EAAEA,OAAO;MAChBU,MAAM,EAAEQ,KAAK,CAACP,OAAO;MACrBC,SAAS,EAAEM,KAAK,CAACP,OAAO,CAACS,GAAG,GAAIF,KAAK,CAACP,OAAO,CAACU,GAAI,GAAGjB,GAAG;MAAE;MAC1DhB,MAAM,EAAEA,MAAM;MACd0B,YAAY,EAAE1C,IAAI,CAAC0C,YAAa;MAChCG,MAAM,EAAE7C,IAAI,CAAC6C,MAAO;MACpBzB,QAAQ,EAAEA;IACZ,CAAC;IAED,MAAM8B,gBAAmC,GAAG;MAC1C9B,QAAQ,EAAEA,QAAS;MACnByB,MAAM,EAAE7C,IAAI,CAAC6C,MAAO;MACpBM,KAAK,EAAEpD,WAAW,CAACoD,KAAK;MACxBzB,WAAW,EAAEA,WAAW;MACxB0B,SAAS,EAAErD,WAAW,CAACqD;IACzB,CAAC;IAED,IAAIrD,WAAW,CAACsD,eAAe,KAAKC,SAAS,EAAE;MAC7CJ,gBAAgB,CAACG,eAAe,GAAGtD,WAAW,CAACsD,eAAe;IAChE;IAEA,MAAM,IAAAE,wBAAW,EAACzD,GAAG,EAAEiD,UAAU,EAAEG,gBAAgB,CAAC;IACpD7B,SAAS,CAACO,OAAO,GAAGmB,UAAU;EAChC;;EAEA;EACA,IAAIlC,YAAY,CAAC2C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAACnC,SAAS,CAACK,WAAW,EAAE;IAClE;IACA,MAAM,IAAI9B,oBAAY,CAAC,+GAA+G,CAAC;EACzI;EACA,IAAIiB,YAAY,CAAC2C,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAACnC,SAAS,CAACO,OAAO,EAAE;IACjE;IACA,MAAM,IAAIhC,oBAAY,CAAC,8GAA8G,CAAC;EACxI;EAEA,OAAO;IACL6D,MAAM,EAAEpC,SAAS;IACjB1B,KAAK,EAAEH,GAAG,CAACG,KAAM;IACjBQ,IAAI,EAAEX,GAAG,CAACW,IAAI;IACdU;EACF,CAAC;AAEH"}
+{"version":3,"file":"handleOAuthResponse.js","names":["validateResponse","res","oauthParams","OAuthError","state","AuthSdkError","dpop","token_type","handleOAuthResponse","sdk","tokenParams","urls","pkce","options","code","interaction_code","token","exchangeCodeForTokens","Object","assign","authorizationCode","interactionCode","getDefaultTokenParams","getOAuthUrls","responseType","Array","isArray","scopes","scope","split","clone","clientId","tokenDict","expiresIn","expires_in","tokenType","accessToken","access_token","idToken","id_token","refreshToken","refresh_token","now","Math","floor","Date","accessJwt","decode","claims","payload","expiresAt","Number","authorizeUrl","userinfoUrl","dpopPairId","extraParams","tokenUrl","issuer","idJwt","idTokenObj","exp","iat","validationParams","nonce","acrValues","ignoreSignature","undefined","verifyToken","indexOf","tokens"],"sources":["../../../lib/oidc/handleOAuthResponse.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\n\n/* eslint-disable complexity, max-statements */\n/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n *\n * See the License for the specific language governing permissions and limitations under the License.\n *\n */\nimport { clone } from '../util';\nimport {\n  getOAuthUrls,\n} from './util/oauth';\nimport { AuthSdkError, OAuthError } from '../errors';\nimport {\n  OktaAuthOAuthInterface,\n  TokenVerifyParams,\n  IDToken,\n  OAuthResponse,\n  TokenParams,\n  TokenResponse,\n  CustomUrls,\n  Tokens,\n} from './types';\nimport { verifyToken } from './verifyToken';\nimport { getDefaultTokenParams } from './util';\n\nfunction validateResponse(res: OAuthResponse, oauthParams: TokenParams) {\n  if (res['error'] && res['error_description']) {\n    throw new OAuthError(res['error'], res['error_description']);\n  }\n\n  if (res.state !== oauthParams.state) {\n    throw new AuthSdkError('OAuth flow response state doesn\\'t match request state');\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc9449#token-response\n  // \"A token_type of DPoP MUST be included in the access token response to signal to the client\"\n  if (oauthParams.dpop && res.token_type !== 'DPoP') {\n    throw new AuthSdkError('Unable to parse OAuth flow response: DPoP was configured but \"token_type\" was not DPoP');\n  }\n}\n\nexport async function handleOAuthResponse(\n  sdk: OktaAuthOAuthInterface,\n  tokenParams: TokenParams,\n  res: OAuthResponse,\n  urls?: CustomUrls\n): Promise<TokenResponse> {\n  const pkce = sdk.options.pkce !== false;\n\n\n  // The result contains an authorization_code and PKCE is enabled \n  // `exchangeCodeForTokens` will call /token then call `handleOauthResponse` recursively with the result\n  if (pkce && (res.code || res.interaction_code)) {\n    return sdk.token.exchangeCodeForTokens(Object.assign({}, tokenParams, {\n      authorizationCode: res.code,\n      interactionCode: res.interaction_code\n    }), urls);\n  }\n\n  tokenParams = tokenParams || getDefaultTokenParams(sdk);\n  urls = urls || getOAuthUrls(sdk, tokenParams);\n\n  let responseType = tokenParams.responseType || [];\n  if (!Array.isArray(responseType) && responseType !== 'none') {\n    responseType = [responseType];\n  }\n\n  let scopes;\n  if (res.scope) {\n    scopes = res.scope.split(' ');\n  } else {\n    scopes = clone(tokenParams.scopes);\n  }\n  const clientId = tokenParams.clientId || sdk.options.clientId;\n\n  // Handling the result from implicit flow or PKCE token exchange\n  validateResponse(res, tokenParams);\n\n  const tokenDict = {} as Tokens;\n  const expiresIn = res.expires_in;\n  const tokenType = res.token_type;\n  const accessToken = res.access_token;\n  const idToken = res.id_token;\n  const refreshToken = res.refresh_token;\n  const now = Math.floor(Date.now()/1000);\n\n  if (accessToken) {\n    const accessJwt = sdk.token.decode(accessToken);\n    tokenDict.accessToken = {\n      accessToken: accessToken,\n      claims: accessJwt.payload,\n      expiresAt: Number(expiresIn) + now,\n      tokenType: tokenType!,\n      scopes: scopes,\n      authorizeUrl: urls.authorizeUrl!,\n      userinfoUrl: urls.userinfoUrl!\n    };\n\n    if (tokenParams.dpopPairId) {\n      tokenDict.accessToken.dpopPairId = tokenParams.dpopPairId;\n    }\n\n    if (tokenParams.extraParams) {\n      tokenDict.accessToken.extraParams = tokenParams.extraParams;\n    }\n  }\n\n  if (refreshToken) {\n    tokenDict.refreshToken = {\n      refreshToken: refreshToken,\n      // should not be used, this is the accessToken expire time\n      // TODO: remove \"expiresAt\" in the next major version OKTA-407224\n      expiresAt: Number(expiresIn) + now, \n      scopes: scopes,\n      tokenUrl: urls.tokenUrl!,\n      authorizeUrl: urls.authorizeUrl!,\n      issuer: urls.issuer!,\n    };\n\n    if (tokenParams.dpopPairId) {\n      tokenDict.refreshToken.dpopPairId = tokenParams.dpopPairId;\n    }\n\n    if (tokenParams.extraParams) {\n      tokenDict.refreshToken.extraParams = tokenParams.extraParams;\n    }\n  }\n\n  if (idToken) {\n    const idJwt = sdk.token.decode(idToken);\n    const idTokenObj: IDToken = {\n      idToken: idToken,\n      claims: idJwt.payload,\n      expiresAt: idJwt.payload.exp! - idJwt.payload.iat! + now, // adjusting expiresAt to be in local time\n      scopes: scopes,\n      authorizeUrl: urls.authorizeUrl!,\n      issuer: urls.issuer!,\n      clientId: clientId!\n    };\n\n    if (tokenParams.extraParams) {\n      idTokenObj.extraParams = tokenParams.extraParams;\n    }\n\n    const validationParams: TokenVerifyParams = {\n      clientId: clientId!,\n      issuer: urls.issuer!,\n      nonce: tokenParams.nonce,\n      accessToken: accessToken,\n      acrValues: tokenParams.acrValues\n    };\n\n    if (tokenParams.ignoreSignature !== undefined) {\n      validationParams.ignoreSignature = tokenParams.ignoreSignature;\n    }\n\n    await verifyToken(sdk, idTokenObj, validationParams);\n    tokenDict.idToken = idTokenObj;\n  }\n\n  // Validate received tokens against requested response types \n  if (responseType.indexOf('token') !== -1 && !tokenDict.accessToken) {\n    // eslint-disable-next-line max-len\n    throw new AuthSdkError('Unable to parse OAuth flow response: response type \"token\" was requested but \"access_token\" was not returned.');\n  }\n  if (responseType.indexOf('id_token') !== -1 && !tokenDict.idToken) {\n    // eslint-disable-next-line max-len\n    throw new AuthSdkError('Unable to parse OAuth flow response: response type \"id_token\" was requested but \"id_token\" was not returned.');\n  }\n\n  return {\n    tokens: tokenDict,\n    state: res.state!,\n    code: res.code,\n    responseType\n  };\n  \n}"],"mappings":";;;AAeA;AACA;AAGA;AAWA;AACA;AA/BA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAmBA,SAASA,gBAAgB,CAACC,GAAkB,EAAEC,WAAwB,EAAE;EACtE,IAAID,GAAG,CAAC,OAAO,CAAC,IAAIA,GAAG,CAAC,mBAAmB,CAAC,EAAE;IAC5C,MAAM,IAAIE,kBAAU,CAACF,GAAG,CAAC,OAAO,CAAC,EAAEA,GAAG,CAAC,mBAAmB,CAAC,CAAC;EAC9D;EAEA,IAAIA,GAAG,CAACG,KAAK,KAAKF,WAAW,CAACE,KAAK,EAAE;IACnC,MAAM,IAAIC,oBAAY,CAAC,wDAAwD,CAAC;EAClF;;EAEA;EACA;EACA,IAAIH,WAAW,CAACI,IAAI,IAAIL,GAAG,CAACM,UAAU,KAAK,MAAM,EAAE;IACjD,MAAM,IAAIF,oBAAY,CAAC,wFAAwF,CAAC;EAClH;AACF;AAEO,eAAeG,mBAAmB,CACvCC,GAA2B,EAC3BC,WAAwB,EACxBT,GAAkB,EAClBU,IAAiB,EACO;EACxB,MAAMC,IAAI,GAAGH,GAAG,CAACI,OAAO,CAACD,IAAI,KAAK,KAAK;;EAGvC;EACA;EACA,IAAIA,IAAI,KAAKX,GAAG,CAACa,IAAI,IAAIb,GAAG,CAACc,gBAAgB,CAAC,EAAE;IAC9C,OAAON,GAAG,CAACO,KAAK,CAACC,qBAAqB,CAACC,MAAM,CAACC,MAAM,CAAC,CAAC,CAAC,EAAET,WAAW,EAAE;MACpEU,iBAAiB,EAAEnB,GAAG,CAACa,IAAI;MAC3BO,eAAe,EAAEpB,GAAG,CAACc;IACvB,CAAC,CAAC,EAAEJ,IAAI,CAAC;EACX;EAEAD,WAAW,GAAGA,WAAW,IAAI,IAAAY,4BAAqB,EAACb,GAAG,CAAC;EACvDE,IAAI,GAAGA,IAAI,IAAI,IAAAY,mBAAY,EAACd,GAAG,EAAEC,WAAW,CAAC;EAE7C,IAAIc,YAAY,GAAGd,WAAW,CAACc,YAAY,IAAI,EAAE;EACjD,IAAI,CAACC,KAAK,CAACC,OAAO,CAACF,YAAY,CAAC,IAAIA,YAAY,KAAK,MAAM,EAAE;IAC3DA,YAAY,GAAG,CAACA,YAAY,CAAC;EAC/B;EAEA,IAAIG,MAAM;EACV,IAAI1B,GAAG,CAAC2B,KAAK,EAAE;IACbD,MAAM,GAAG1B,GAAG,CAAC2B,KAAK,CAACC,KAAK,CAAC,GAAG,CAAC;EAC/B,CAAC,MAAM;IACLF,MAAM,GAAG,IAAAG,WAAK,EAACpB,WAAW,CAACiB,MAAM,CAAC;EACpC;EACA,MAAMI,QAAQ,GAAGrB,WAAW,CAACqB,QAAQ,IAAItB,GAAG,CAACI,OAAO,CAACkB,QAAQ;;EAE7D;EACA/B,gBAAgB,CAACC,GAAG,EAAES,WAAW,CAAC;EAElC,MAAMsB,SAAS,GAAG,CAAC,CAAW;EAC9B,MAAMC,SAAS,GAAGhC,GAAG,CAACiC,UAAU;EAChC,MAAMC,SAAS,GAAGlC,GAAG,CAACM,UAAU;EAChC,MAAM6B,WAAW,GAAGnC,GAAG,CAACoC,YAAY;EACpC,MAAMC,OAAO,GAAGrC,GAAG,CAACsC,QAAQ;EAC5B,MAAMC,YAAY,GAAGvC,GAAG,CAACwC,aAAa;EACtC,MAAMC,GAAG,GAAGC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACH,GAAG,EAAE,GAAC,IAAI,CAAC;EAEvC,IAAIN,WAAW,EAAE;IACf,MAAMU,SAAS,GAAGrC,GAAG,CAACO,KAAK,CAAC+B,MAAM,CAACX,WAAW,CAAC;IAC/CJ,SAAS,CAACI,WAAW,GAAG;MACtBA,WAAW,EAAEA,WAAW;MACxBY,MAAM,EAAEF,SAAS,CAACG,OAAO;MACzBC,SAAS,EAAEC,MAAM,CAAClB,SAAS,CAAC,GAAGS,GAAG;MAClCP,SAAS,EAAEA,SAAU;MACrBR,MAAM,EAAEA,MAAM;MACdyB,YAAY,EAAEzC,IAAI,CAACyC,YAAa;MAChCC,WAAW,EAAE1C,IAAI,CAAC0C;IACpB,CAAC;IAED,IAAI3C,WAAW,CAAC4C,UAAU,EAAE;MAC1BtB,SAAS,CAACI,WAAW,CAACkB,UAAU,GAAG5C,WAAW,CAAC4C,UAAU;IAC3D;IAEA,IAAI5C,WAAW,CAAC6C,WAAW,EAAE;MAC3BvB,SAAS,CAACI,WAAW,CAACmB,WAAW,GAAG7C,WAAW,CAAC6C,WAAW;IAC7D;EACF;EAEA,IAAIf,YAAY,EAAE;IAChBR,SAAS,CAACQ,YAAY,GAAG;MACvBA,YAAY,EAAEA,YAAY;MAC1B;MACA;MACAU,SAAS,EAAEC,MAAM,CAAClB,SAAS,CAAC,GAAGS,GAAG;MAClCf,MAAM,EAAEA,MAAM;MACd6B,QAAQ,EAAE7C,IAAI,CAAC6C,QAAS;MACxBJ,YAAY,EAAEzC,IAAI,CAACyC,YAAa;MAChCK,MAAM,EAAE9C,IAAI,CAAC8C;IACf,CAAC;IAED,IAAI/C,WAAW,CAAC4C,UAAU,EAAE;MAC1BtB,SAAS,CAACQ,YAAY,CAACc,UAAU,GAAG5C,WAAW,CAAC4C,UAAU;IAC5D;IAEA,IAAI5C,WAAW,CAAC6C,WAAW,EAAE;MAC3BvB,SAAS,CAACQ,YAAY,CAACe,WAAW,GAAG7C,WAAW,CAAC6C,WAAW;IAC9D;EACF;EAEA,IAAIjB,OAAO,EAAE;IACX,MAAMoB,KAAK,GAAGjD,GAAG,CAACO,KAAK,CAAC+B,MAAM,CAACT,OAAO,CAAC;IACvC,MAAMqB,UAAmB,GAAG;MAC1BrB,OAAO,EAAEA,OAAO;MAChBU,MAAM,EAAEU,KAAK,CAACT,OAAO;MACrBC,SAAS,EAAEQ,KAAK,CAACT,OAAO,CAACW,GAAG,GAAIF,KAAK,CAACT,OAAO,CAACY,GAAI,GAAGnB,GAAG;MAAE;MAC1Df,MAAM,EAAEA,MAAM;MACdyB,YAAY,EAAEzC,IAAI,CAACyC,YAAa;MAChCK,MAAM,EAAE9C,IAAI,CAAC8C,MAAO;MACpB1B,QAAQ,EAAEA;IACZ,CAAC;IAED,IAAIrB,WAAW,CAAC6C,WAAW,EAAE;MAC3BI,UAAU,CAACJ,WAAW,GAAG7C,WAAW,CAAC6C,WAAW;IAClD;IAEA,MAAMO,gBAAmC,GAAG;MAC1C/B,QAAQ,EAAEA,QAAS;MACnB0B,MAAM,EAAE9C,IAAI,CAAC8C,MAAO;MACpBM,KAAK,EAAErD,WAAW,CAACqD,KAAK;MACxB3B,WAAW,EAAEA,WAAW;MACxB4B,SAAS,EAAEtD,WAAW,CAACsD;IACzB,CAAC;IAED,IAAItD,WAAW,CAACuD,eAAe,KAAKC,SAAS,EAAE;MAC7CJ,gBAAgB,CAACG,eAAe,GAAGvD,WAAW,CAACuD,eAAe;IAChE;IAEA,MAAM,IAAAE,wBAAW,EAAC1D,GAAG,EAAEkD,UAAU,EAAEG,gBAAgB,CAAC;IACpD9B,SAAS,CAACM,OAAO,GAAGqB,UAAU;EAChC;;EAEA;EACA,IAAInC,YAAY,CAAC4C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAACpC,SAAS,CAACI,WAAW,EAAE;IAClE;IACA,MAAM,IAAI/B,oBAAY,CAAC,+GAA+G,CAAC;EACzI;EACA,IAAImB,YAAY,CAAC4C,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAACpC,SAAS,CAACM,OAAO,EAAE;IACjE;IACA,MAAM,IAAIjC,oBAAY,CAAC,8GAA8G,CAAC;EACxI;EAEA,OAAO;IACLgE,MAAM,EAAErC,SAAS;IACjB5B,KAAK,EAAEH,GAAG,CAACG,KAAM;IACjBU,IAAI,EAAEb,GAAG,CAACa,IAAI;IACdU;EACF,CAAC;AAEH"}