@openclaw/matrix 2026.8.1-beta.3 → 2026.8.1

package/node_modules/matrix-js-sdk/lib/oidc/validate.js

@@ -1,181 +0,0 @@
-/*
-Copyright 2023 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import { jwtDecode } from "jwt-decode";
-import { logger } from "../logger.js";
-import { OidcError } from "./error.js";
-import { OAuthGrantType } from "./index.js";
-
-/**
- * Metadata from OAuth 2.0 client authentication API as per
- * https://spec.matrix.org/v1.17/client-server-api/#get_matrixclientv1auth_metadata
- * With validated properties required in type
- */
-
-const isRecord = value => !!value && typeof value === "object" && !Array.isArray(value);
-const requiredStringProperty = (wellKnown, key) => {
-  if (!wellKnown[key] || !optionalStringProperty(wellKnown, key)) {
-    logger.error(`Missing or invalid property: ${key}`);
-    return false;
-  }
-  return true;
-};
-const optionalStringProperty = (wellKnown, key) => {
-  if (!!wellKnown[key] && typeof wellKnown[key] !== "string") {
-    logger.error(`Invalid property: ${key}`);
-    return false;
-  }
-  return true;
-};
-const optionalStringArrayProperty = (wellKnown, key) => {
-  if (!!wellKnown[key] && (!Array.isArray(wellKnown[key]) || !wellKnown[key].every(v => typeof v === "string"))) {
-    logger.error(`Invalid property: ${key}`);
-    return false;
-  }
-  return true;
-};
-const requiredArrayValue = (wellKnown, key, value) => {
-  const array = wellKnown[key];
-  if (!array || !Array.isArray(array) || !array.includes(value)) {
-    logger.error(`Invalid property: ${key}. ${value} is required.`);
-    return false;
-  }
-  return true;
-};
-
-/**
- * Validates OAuth 2.0 auth metadata as defined by
- * https://spec.matrix.org/v1.17/client-server-api/#get_matrixclientv1auth_metadata
- * is compatible with Element's OAuth/OIDC flow
- * @param authMetadata - json object
- * @returns valid issuer config
- * @throws Error - when issuer config is not found or is invalid
- */
-export const validateAuthMetadata = authMetadata => {
-  if (!isRecord(authMetadata)) {
-    logger.error("Issuer configuration not found or malformed");
-    throw new Error(OidcError.OpSupport);
-  }
-  const isInvalid = [requiredStringProperty(authMetadata, "issuer"), requiredStringProperty(authMetadata, "authorization_endpoint"), requiredStringProperty(authMetadata, "token_endpoint"), requiredStringProperty(authMetadata, "revocation_endpoint"), optionalStringProperty(authMetadata, "registration_endpoint"), optionalStringProperty(authMetadata, "account_management_uri"), optionalStringProperty(authMetadata, "device_authorization_endpoint"), optionalStringArrayProperty(authMetadata, "account_management_actions_supported"), requiredArrayValue(authMetadata, "response_types_supported", "code"), requiredArrayValue(authMetadata, "grant_types_supported", OAuthGrantType.AuthorizationCode), requiredArrayValue(authMetadata, "code_challenge_methods_supported", "S256"), optionalStringArrayProperty(authMetadata, "prompt_values_supported")].some(isValid => !isValid);
-  if (!isInvalid) {
-    return authMetadata;
-  }
-  logger.error("Issuer configuration not valid");
-  throw new Error(OidcError.OpSupport);
-};
-export const decodeIdToken = token => {
-  try {
-    return jwtDecode(token);
-  } catch (error) {
-    logger.error("Could not decode id_token", error);
-    throw error;
-  }
-};
-
-/**
- * Validate idToken
- * https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
- * @param idToken - id token from token endpoint
- * @param issuer - issuer for the OP as found during discovery
- * @param clientId - this client's id as registered with the OP
- * @param nonce - nonce used in the authentication request
- * @throws when id token is invalid
- */
-export const validateIdToken = (idToken, issuer, clientId, nonce) => {
-  try {
-    if (!idToken) {
-      throw new Error("No ID token");
-    }
-    const claims = decodeIdToken(idToken);
-
-    // The Issuer Identifier for the OpenID Provider MUST exactly match the value of the iss (issuer) Claim.
-    if (claims.iss !== issuer) {
-      throw new Error("Invalid issuer");
-    }
-    /**
-     * The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience.
-     * The aud (audience) Claim MAY contain an array with more than one element.
-     * The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
-     * EW: Don't accept tokens with other untrusted audiences
-     * */
-    const sanitisedAuds = typeof claims.aud === "string" ? [claims.aud] : claims.aud;
-    if (!sanitisedAuds.includes(clientId)) {
-      throw new Error("Invalid audience");
-    }
-
-    /**
-     * If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked
-     * to verify that it is the same value as the one that was sent in the Authentication Request.
-     */
-    if (nonce !== undefined && claims.nonce !== nonce) {
-      throw new Error("Invalid nonce");
-    }
-
-    /**
-     * The current time MUST be before the time represented by the exp Claim.
-     *  exp is an epoch timestamp in seconds
-     * */
-    if (!claims.exp || Date.now() > claims.exp * 1000) {
-      throw new Error("Invalid expiry");
-    }
-  } catch (error) {
-    logger.error("Invalid ID token", error);
-    throw new Error(OidcError.InvalidIdToken);
-  }
-};
-
-/**
- * State we ask OidcClient to store when starting oidc authorization flow (in `generateOidcAuthorizationUrl`)
- * so that we can access it on return from the OP and complete login
- */
-
-/**
- * Validate stored user state exists and is valid
- * @param userState - userState returned by oidcClient.processSigninResponse
- * @throws when userState is invalid
- */
-export function validateStoredUserState(userState) {
-  if (!isRecord(userState)) {
-    logger.error("Stored user state not found");
-    throw new Error(OidcError.MissingOrInvalidStoredState);
-  }
-  const isInvalid = [requiredStringProperty(userState, "homeserverUrl"), requiredStringProperty(userState, "nonce"), optionalStringProperty(userState, "identityServerUrl")].some(isValid => !isValid);
-  if (isInvalid) {
-    throw new Error(OidcError.MissingOrInvalidStoredState);
-  }
-}
-
-/**
- * The expected response type from the token endpoint during authorization code flow
- * Normalized to always use capitalized 'Bearer' for token_type
- *
- * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,
- * https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.
- */
-
-/**
- * Make required properties required in type
- */
-
-const isValidBearerTokenResponse = response => isRecord(response) && requiredStringProperty(response, "token_type") &&
-// token_type is case insensitive, some OPs return `token_type: "bearer"`
-response["token_type"].toLowerCase() === "bearer" && requiredStringProperty(response, "access_token") && requiredStringProperty(response, "refresh_token") && (!("expires_in" in response) || typeof response["expires_in"] === "number");
-export function validateBearerTokenResponse(response) {
-  if (!isValidBearerTokenResponse(response)) {
-    throw new Error(OidcError.InvalidBearerTokenResponse);
-  }
-}
-//# sourceMappingURL=validate.js.map

package/node_modules/matrix-js-sdk/lib/oidc/validate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"validate.js","names":[],"sources":["../../src/oidc/validate.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { jwtDecode } from \"jwt-decode\";\nimport { type IdTokenClaims, type OidcMetadata, type SigninResponse } from \"oidc-client-ts\";\n\nimport { logger } from \"../logger.ts\";\nimport { OidcError } from \"./error.ts\";\nimport { OAuthGrantType } from \"./index.ts\";\n\n/**\n * Metadata from OAuth 2.0 client authentication API as per\n * https://spec.matrix.org/v1.17/client-server-api/#get_matrixclientv1auth_metadata\n * With validated properties required in type\n */\nexport type ValidatedAuthMetadata = Partial<OidcMetadata> &\n    Pick<\n        // These values are from [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414#section-2)\n        // so we can reuse the OidcMetadata definitions from oidc-client-ts\n        OidcMetadata,\n        | \"issuer\"\n        | \"authorization_endpoint\"\n        | \"token_endpoint\"\n        | \"revocation_endpoint\"\n        | \"response_types_supported\"\n        | \"grant_types_supported\"\n        | \"code_challenge_methods_supported\"\n    > & {\n        // These values aren't part of RFC8414 so we add them here\n        // Account management fields from stable MSC4191:\n        account_management_uri?: string;\n        account_management_actions_supported?: string[];\n        // Value from [Initiating User Registration via OpenID Connect](https://openid.net/specs/openid-connect-prompt-create-1_0.html):\n        prompt_values_supported?: string[];\n        // Experimental MSC4341 value from [RFC8628](https://datatracker.ietf.org/doc/html/rfc8628#section-4):\n        device_authorization_endpoint?: string;\n    };\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n    !!value && typeof value === \"object\" && !Array.isArray(value);\nconst requiredStringProperty = (wellKnown: Record<string, unknown>, key: string): boolean => {\n    if (!wellKnown[key] || !optionalStringProperty(wellKnown, key)) {\n        logger.error(`Missing or invalid property: ${key}`);\n        return false;\n    }\n    return true;\n};\nconst optionalStringProperty = (wellKnown: Record<string, unknown>, key: string): boolean => {\n    if (!!wellKnown[key] && typeof wellKnown[key] !== \"string\") {\n        logger.error(`Invalid property: ${key}`);\n        return false;\n    }\n    return true;\n};\nconst optionalStringArrayProperty = (wellKnown: Record<string, unknown>, key: string): boolean => {\n    if (\n        !!wellKnown[key] &&\n        (!Array.isArray(wellKnown[key]) || !(<unknown[]>wellKnown[key]).every((v) => typeof v === \"string\"))\n    ) {\n        logger.error(`Invalid property: ${key}`);\n        return false;\n    }\n    return true;\n};\nconst requiredArrayValue = (wellKnown: Record<string, unknown>, key: string, value: any): boolean => {\n    const array = wellKnown[key];\n    if (!array || !Array.isArray(array) || !array.includes(value)) {\n        logger.error(`Invalid property: ${key}. ${value} is required.`);\n        return false;\n    }\n    return true;\n};\n\n/**\n * Validates OAuth 2.0 auth metadata as defined by\n * https://spec.matrix.org/v1.17/client-server-api/#get_matrixclientv1auth_metadata\n * is compatible with Element's OAuth/OIDC flow\n * @param authMetadata - json object\n * @returns valid issuer config\n * @throws Error - when issuer config is not found or is invalid\n */\nexport const validateAuthMetadata = (authMetadata: unknown): ValidatedAuthMetadata => {\n    if (!isRecord(authMetadata)) {\n        logger.error(\"Issuer configuration not found or malformed\");\n        throw new Error(OidcError.OpSupport);\n    }\n\n    const isInvalid = [\n        requiredStringProperty(authMetadata, \"issuer\"),\n        requiredStringProperty(authMetadata, \"authorization_endpoint\"),\n        requiredStringProperty(authMetadata, \"token_endpoint\"),\n        requiredStringProperty(authMetadata, \"revocation_endpoint\"),\n        optionalStringProperty(authMetadata, \"registration_endpoint\"),\n        optionalStringProperty(authMetadata, \"account_management_uri\"),\n        optionalStringProperty(authMetadata, \"device_authorization_endpoint\"),\n        optionalStringArrayProperty(authMetadata, \"account_management_actions_supported\"),\n        requiredArrayValue(authMetadata, \"response_types_supported\", \"code\"),\n        requiredArrayValue(authMetadata, \"grant_types_supported\", OAuthGrantType.AuthorizationCode),\n        requiredArrayValue(authMetadata, \"code_challenge_methods_supported\", \"S256\"),\n        optionalStringArrayProperty(authMetadata, \"prompt_values_supported\"),\n    ].some((isValid) => !isValid);\n\n    if (!isInvalid) {\n        return authMetadata as ValidatedAuthMetadata;\n    }\n\n    logger.error(\"Issuer configuration not valid\");\n    throw new Error(OidcError.OpSupport);\n};\n\nexport const decodeIdToken = (token: string): IdTokenClaims => {\n    try {\n        return jwtDecode<IdTokenClaims>(token);\n    } catch (error) {\n        logger.error(\"Could not decode id_token\", error);\n        throw error;\n    }\n};\n\n/**\n * Validate idToken\n * https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation\n * @param idToken - id token from token endpoint\n * @param issuer - issuer for the OP as found during discovery\n * @param clientId - this client's id as registered with the OP\n * @param nonce - nonce used in the authentication request\n * @throws when id token is invalid\n */\nexport const validateIdToken = (\n    idToken: string | undefined,\n    issuer: string,\n    clientId: string,\n    nonce: string | undefined,\n): void => {\n    try {\n        if (!idToken) {\n            throw new Error(\"No ID token\");\n        }\n        const claims = decodeIdToken(idToken);\n\n        // The Issuer Identifier for the OpenID Provider MUST exactly match the value of the iss (issuer) Claim.\n        if (claims.iss !== issuer) {\n            throw new Error(\"Invalid issuer\");\n        }\n        /**\n         * The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience.\n         * The aud (audience) Claim MAY contain an array with more than one element.\n         * The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.\n         * EW: Don't accept tokens with other untrusted audiences\n         * */\n        const sanitisedAuds = typeof claims.aud === \"string\" ? [claims.aud] : claims.aud;\n        if (!sanitisedAuds.includes(clientId)) {\n            throw new Error(\"Invalid audience\");\n        }\n\n        /**\n         * If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked\n         * to verify that it is the same value as the one that was sent in the Authentication Request.\n         */\n        if (nonce !== undefined && claims.nonce !== nonce) {\n            throw new Error(\"Invalid nonce\");\n        }\n\n        /**\n         * The current time MUST be before the time represented by the exp Claim.\n         *  exp is an epoch timestamp in seconds\n         * */\n        if (!claims.exp || Date.now() > claims.exp * 1000) {\n            throw new Error(\"Invalid expiry\");\n        }\n    } catch (error) {\n        logger.error(\"Invalid ID token\", error);\n        throw new Error(OidcError.InvalidIdToken);\n    }\n};\n\n/**\n * State we ask OidcClient to store when starting oidc authorization flow (in `generateOidcAuthorizationUrl`)\n * so that we can access it on return from the OP and complete login\n */\nexport type UserState = {\n    /**\n     * Remember which server we were trying to login to\n     */\n    homeserverUrl: string;\n    identityServerUrl?: string;\n    /**\n     * Used to validate id token\n     */\n    nonce: string;\n};\n/**\n * Validate stored user state exists and is valid\n * @param userState - userState returned by oidcClient.processSigninResponse\n * @throws when userState is invalid\n */\nexport function validateStoredUserState(userState: unknown): asserts userState is UserState {\n    if (!isRecord(userState)) {\n        logger.error(\"Stored user state not found\");\n        throw new Error(OidcError.MissingOrInvalidStoredState);\n    }\n    const isInvalid = [\n        requiredStringProperty(userState, \"homeserverUrl\"),\n        requiredStringProperty(userState, \"nonce\"),\n        optionalStringProperty(userState, \"identityServerUrl\"),\n    ].some((isValid) => !isValid);\n\n    if (isInvalid) {\n        throw new Error(OidcError.MissingOrInvalidStoredState);\n    }\n}\n\n/**\n * The expected response type from the token endpoint during authorization code flow\n * Normalized to always use capitalized 'Bearer' for token_type\n *\n * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,\n * https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.\n */\nexport type BearerTokenResponse = {\n    token_type: \"Bearer\";\n    access_token: string;\n    scope: string;\n    refresh_token?: string;\n    expires_in?: number;\n    // from oidc-client-ts\n    expires_at?: number;\n    id_token: string;\n};\n\n/**\n * Make required properties required in type\n */\ntype ValidSignInResponse = SigninResponse &\n    BearerTokenResponse & {\n        token_type: \"Bearer\" | \"bearer\";\n    };\n\nconst isValidBearerTokenResponse = (response: unknown): response is ValidSignInResponse =>\n    isRecord(response) &&\n    requiredStringProperty(response, \"token_type\") &&\n    // token_type is case insensitive, some OPs return `token_type: \"bearer\"`\n    (response[\"token_type\"] as string).toLowerCase() === \"bearer\" &&\n    requiredStringProperty(response, \"access_token\") &&\n    requiredStringProperty(response, \"refresh_token\") &&\n    (!(\"expires_in\" in response) || typeof response[\"expires_in\"] === \"number\");\n\nexport function validateBearerTokenResponse(response: unknown): asserts response is ValidSignInResponse {\n    if (!isValidBearerTokenResponse(response)) {\n        throw new Error(OidcError.InvalidBearerTokenResponse);\n    }\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAAS,SAAS,QAAQ,YAAY;AAGtC,SAAS,MAAM,QAAQ,cAAc;AACrC,SAAS,SAAS,QAAQ,YAAY;AACtC,SAAS,cAAc,QAAQ,YAAY;;AAE3C;AACA;AACA;AACA;AACA;;AAwBA,MAAM,QAAQ,GAAI,KAAc,IAC5B,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;AACjE,MAAM,sBAAsB,GAAG,CAAC,SAAkC,EAAE,GAAW,KAAc;EACzF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;IAC5D,MAAM,CAAC,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC;IACnD,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf,CAAC;AACD,MAAM,sBAAsB,GAAG,CAAC,SAAkC,EAAE,GAAW,KAAc;EACzF,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE;IACxD,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC;IACxC,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf,CAAC;AACD,MAAM,2BAA2B,GAAG,CAAC,SAAkC,EAAE,GAAW,KAAc;EAC9F,IACI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KACf,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAa,SAAS,CAAC,GAAG,CAAC,CAAE,KAAK,CAAE,CAAC,IAAK,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EACtG;IACE,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC;IACxC,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf,CAAC;AACD,MAAM,kBAAkB,GAAG,CAAC,SAAkC,EAAE,GAAW,EAAE,KAAU,KAAc;EACjG,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC;EAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;IAC3D,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,KAAK,KAAK,eAAe,CAAC;IAC/D,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM,oBAAoB,GAAI,YAAqB,IAA4B;EAClF,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE;IACzB,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC;IAC3D,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;EACxC;EAEA,MAAM,SAAS,GAAG,CACd,sBAAsB,CAAC,YAAY,EAAE,QAAQ,CAAC,EAC9C,sBAAsB,CAAC,YAAY,EAAE,wBAAwB,CAAC,EAC9D,sBAAsB,CAAC,YAAY,EAAE,gBAAgB,CAAC,EACtD,sBAAsB,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAC3D,sBAAsB,CAAC,YAAY,EAAE,uBAAuB,CAAC,EAC7D,sBAAsB,CAAC,YAAY,EAAE,wBAAwB,CAAC,EAC9D,sBAAsB,CAAC,YAAY,EAAE,+BAA+B,CAAC,EACrE,2BAA2B,CAAC,YAAY,EAAE,sCAAsC,CAAC,EACjF,kBAAkB,CAAC,YAAY,EAAE,0BAA0B,EAAE,MAAM,CAAC,EACpE,kBAAkB,CAAC,YAAY,EAAE,uBAAuB,EAAE,cAAc,CAAC,iBAAiB,CAAC,EAC3F,kBAAkB,CAAC,YAAY,EAAE,kCAAkC,EAAE,MAAM,CAAC,EAC5E,2BAA2B,CAAC,YAAY,EAAE,yBAAyB,CAAC,CACvE,CAAC,IAAI,CAAE,OAAO,IAAK,CAAC,OAAO,CAAC;EAE7B,IAAI,CAAC,SAAS,EAAE;IACZ,OAAO,YAAY;EACvB;EAEA,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC;EAC9C,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,OAAO,MAAM,aAAa,GAAI,KAAa,IAAoB;EAC3D,IAAI;IACA,OAAO,SAAS,CAAgB,KAAK,CAAC;EAC1C,CAAC,CAAC,OAAO,KAAK,EAAE;IACZ,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC;IAChD,MAAM,KAAK;EACf;AACJ,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM,eAAe,GAAG,CAC3B,OAA2B,EAC3B,MAAc,EACd,QAAgB,EAChB,KAAyB,KAClB;EACP,IAAI;IACA,IAAI,CAAC,OAAO,EAAE;MACV,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC;IAClC;IACA,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC;;IAErC;IACA,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE;MACvB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC;IACrC;IACA;AACR;AACA;AACA;AACA;AACA;IACQ,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG;IAChF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;MACnC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC;IACvC;;IAEA;AACR;AACA;AACA;IACQ,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE;MAC/C,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC;IACpC;;IAEA;AACR;AACA;AACA;IACQ,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE;MAC/C,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC;IACrC;EACJ,CAAC,CAAC,OAAO,KAAK,EAAE;IACZ,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC;IACvC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC;EAC7C;AACJ,CAAC;;AAED;AACA;AACA;AACA;;AAYA;AACA;AACA;AACA;AACA;AACA,OAAO,SAAS,uBAAuB,CAAC,SAAkB,EAAkC;EACxF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;IACtB,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC;IAC3C,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,2BAA2B,CAAC;EAC1D;EACA,MAAM,SAAS,GAAG,CACd,sBAAsB,CAAC,SAAS,EAAE,eAAe,CAAC,EAClD,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,EAC1C,sBAAsB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CACzD,CAAC,IAAI,CAAE,OAAO,IAAK,CAAC,OAAO,CAAC;EAE7B,IAAI,SAAS,EAAE;IACX,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,2BAA2B,CAAC;EAC1D;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA;AACA;AACA;;AAMA,MAAM,0BAA0B,GAAI,QAAiB,IACjD,QAAQ,CAAC,QAAQ,CAAC,IAClB,sBAAsB,CAAC,QAAQ,EAAE,YAAY,CAAC;AAC9C;AACC,QAAQ,CAAC,YAAY,CAAC,CAAY,WAAW,CAAC,CAAC,KAAK,QAAQ,IAC7D,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,IAChD,sBAAsB,CAAC,QAAQ,EAAE,eAAe,CAAC,KAChD,EAAE,YAAY,IAAI,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC;AAE/E,OAAO,SAAS,2BAA2B,CAAC,QAAiB,EAA2C;EACpG,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE;IACvC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,0BAA0B,CAAC;EACzD;AACJ","ignoreList":[]}

package/node_modules/matrix-js-sdk/node_modules/jwt-decode/LICENSE

@@ -1,21 +0,0 @@
-The MIT License (MIT)
- 
-Copyright (c) 2015 Auth0, Inc. <support@auth0.com> (http://auth0.com)
- 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
- 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
- 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/node_modules/matrix-js-sdk/node_modules/jwt-decode/README.md

@@ -1,134 +0,0 @@
-![Browser library that helps decoding JWT tokens which are Base64Url encoded](https://cdn.auth0.com/website/sdks/banners/jwt-decode-banner.png)
-
-**IMPORTANT:** This library doesn't validate the token, any well-formed JWT can be decoded. You should validate the token in your server-side logic by using something like [express-jwt](https://github.com/auth0/express-jwt), [koa-jwt](https://github.com/stiang/koa-jwt), [Microsoft.AspNetCore.Authentication.JwtBearer](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer), etc.
-
-![Release](https://img.shields.io/npm/v/jwt-decode)
-![Downloads](https://img.shields.io/npm/dw/jwt-decode)
-[![License](https://img.shields.io/:license-MIT-blue.svg?style=flat)](https://opensource.org/licenses/MIT)
-[![CircleCI](https://img.shields.io/circleci/build/github/auth0/jwt-decode)](https://circleci.com/gh/auth0/jwt-decode)
-
-:books: [Documentation](#documentation) - :rocket: [Getting Started](#getting-started) - :speech_balloon: [Feedback](#feedback)
-
-## Documentation
-
-- [Docs site](https://www.auth0.com/docs) - explore our docs site and learn more about Auth0.
-
-## Getting started
-
-### Installation
-
-Install with NPM or Yarn.
-
-Run `npm install jwt-decode` or `yarn add jwt-decode` to install the library.
-
-### Usage
-
-```js
-import { jwtDecode } from "jwt-decode";
-
-const token = "eyJ0eXAiO.../// jwt token";
-const decoded = jwtDecode(token);
-
-console.log(decoded);
-
-/* prints:
- * { 
- *   foo: "bar",
- *   exp: 1393286893,
- *   iat: 1393268893  
- * }
- */
-
-// decode header by passing in options (useful for when you need `kid` to verify a JWT):
-const decodedHeader = jwtDecode(token, { header: true });
-console.log(decodedHeader);
-
-/* prints:
- * { 
- *   typ: "JWT",
- *   alg: "HS256" 
- * }
- */
-```
-
-**Note:** A falsy or malformed token will throw an `InvalidTokenError` error; see below for more information on specific errors.
-
-## Errors
-
-This library works with valid JSON web tokens. The basic format of these token is
-```
-[part1].[part2].[part3]
-```
-All parts are supposed to be valid base64 (url) encoded json.
-Depending on the `{ header: <option> }` option it will decode part 1 (only if header: true is specified) or part 2 (default)
-
-Not adhering to the format will result in a `InvalidTokenError` with one of the following messages:
-
-- `Invalid token specified: must be a string` => the token passed was not a string, this library only works on strings. 
-- `Invalid token specified: missing part #` => this probably means you are missing a dot (`.`) in the token 
-- `Invalid token specified: invalid base64 for part #` => the part could not be base64 decoded (the message should contain the error the base64 decoder gave)
-- `Invalid token specified: invalid json for part #` => the part was correctly base64 decoded, however, the decoded value was not valid JSON (the message should contain the error the JSON parser gave)
-
-#### Use with TypeScript
-
-The return type of the `jwtDecode` function is determined by the `header` property of the object passed as the second argument. If omitted (or set to false), it'll use `JwtPayload`, when true it will use `JwtHeader`. 
-If needed, you can specify what the expected return type should be by passing a type argument to the `jwtDecode` function.
-
-You can extend both `JwtHeader` and `JwtPayload` to include non-standard claims or properties.
-
-```typescript
-import { jwtDecode } from "jwt-decode";
-
-const token = "eyJhsw5c";
-const decoded = jwtDecode<JwtPayload>(token); // Returns with the JwtPayload type
-```
-
-#### Use as a CommonJS package
-
-```javascript
-const { jwtDecode } = require('jwt-decode');
-...
-```
-
-#### Include with a script tag
-
-Copy the file `jwt-decode.js` from the root of the `build/esm` folder to your project somewhere, then import `jwtDecode` from it inside a script tag that's marked with `type="module"`:
-
-```html
-<script type="module">
-  import { jwtDecode } from "/path/to/jwt-decode.js";
-
-  const token = "eyJhsw5c";
-  const decoded = jwtDecode(token);
-</script>
-```
-
-## Feedback
-
-### Contributing
-
-We appreciate feedback and contribution to this repo! Before you get started, please see the following:
-
-- [Auth0's general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
-- [Auth0's code of conduct guidelines](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
-
-### Raise an issue
-
-To provide feedback or report a bug, please [raise an issue on our issue tracker](https://github.com/auth0/jwt-decode/issues).
-
-### Vulnerability Reporting
-
-Please do not report security vulnerabilities on the public GitHub issue tracker. The [Responsible Disclosure Program](https://auth0.com/responsible-disclosure-policy) details the procedure for disclosing security issues.
-
----
-
-<p align="center">
-  <picture>
-    <source media="(prefers-color-scheme: light)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png"   width="150">
-    <source media="(prefers-color-scheme: dark)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_dark_mode.png" width="150">
-    <img alt="Auth0 Logo" src="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png" width="150">
-  </picture>
-</p>
-<p align="center">Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout <a href="https://auth0.com/why-auth0">Why Auth0?</a></p>
-<p align="center">
-This project is licensed under the MIT license. See the <a href="./LICENSE"> LICENSE</a> file for more info.</p>

package/node_modules/matrix-js-sdk/node_modules/jwt-decode/build/cjs/index.d.ts

@@ -1,23 +0,0 @@
-export interface JwtDecodeOptions {
-    header?: boolean;
-}
-export interface JwtHeader {
-    typ?: string;
-    alg?: string;
-    kid?: string;
-}
-export interface JwtPayload {
-    iss?: string;
-    sub?: string;
-    aud?: string[] | string;
-    exp?: number;
-    nbf?: number;
-    iat?: number;
-    jti?: string;
-}
-export declare class InvalidTokenError extends Error {
-}
-export declare function jwtDecode<T = JwtHeader>(token: string, options: JwtDecodeOptions & {
-    header: true;
-}): T;
-export declare function jwtDecode<T = JwtPayload>(token: string, options?: JwtDecodeOptions): T;

package/node_modules/matrix-js-sdk/node_modules/jwt-decode/build/cjs/index.js

@@ -1,62 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.jwtDecode = exports.InvalidTokenError = void 0;
-class InvalidTokenError extends Error {
-}
-exports.InvalidTokenError = InvalidTokenError;
-InvalidTokenError.prototype.name = "InvalidTokenError";
-function b64DecodeUnicode(str) {
-    return decodeURIComponent(atob(str).replace(/(.)/g, (m, p) => {
-        let code = p.charCodeAt(0).toString(16).toUpperCase();
-        if (code.length < 2) {
-            code = "0" + code;
-        }
-        return "%" + code;
-    }));
-}
-function base64UrlDecode(str) {
-    let output = str.replace(/-/g, "+").replace(/_/g, "/");
-    switch (output.length % 4) {
-        case 0:
-            break;
-        case 2:
-            output += "==";
-            break;
-        case 3:
-            output += "=";
-            break;
-        default:
-            throw new Error("base64 string is not of the correct length");
-    }
-    try {
-        return b64DecodeUnicode(output);
-    }
-    catch (err) {
-        return atob(output);
-    }
-}
-function jwtDecode(token, options) {
-    if (typeof token !== "string") {
-        throw new InvalidTokenError("Invalid token specified: must be a string");
-    }
-    options || (options = {});
-    const pos = options.header === true ? 0 : 1;
-    const part = token.split(".")[pos];
-    if (typeof part !== "string") {
-        throw new InvalidTokenError(`Invalid token specified: missing part #${pos + 1}`);
-    }
-    let decoded;
-    try {
-        decoded = base64UrlDecode(part);
-    }
-    catch (e) {
-        throw new InvalidTokenError(`Invalid token specified: invalid base64 for part #${pos + 1} (${e.message})`);
-    }
-    try {
-        return JSON.parse(decoded);
-    }
-    catch (e) {
-        throw new InvalidTokenError(`Invalid token specified: invalid json for part #${pos + 1} (${e.message})`);
-    }
-}
-exports.jwtDecode = jwtDecode;

package/node_modules/matrix-js-sdk/node_modules/jwt-decode/build/cjs/package.json

@@ -1 +0,0 @@
-{"type": "commonjs"}

package/node_modules/matrix-js-sdk/node_modules/jwt-decode/build/esm/index.d.ts

@@ -1,23 +0,0 @@
-export interface JwtDecodeOptions {
-    header?: boolean;
-}
-export interface JwtHeader {
-    typ?: string;
-    alg?: string;
-    kid?: string;
-}
-export interface JwtPayload {
-    iss?: string;
-    sub?: string;
-    aud?: string[] | string;
-    exp?: number;
-    nbf?: number;
-    iat?: number;
-    jti?: string;
-}
-export declare class InvalidTokenError extends Error {
-}
-export declare function jwtDecode<T = JwtHeader>(token: string, options: JwtDecodeOptions & {
-    header: true;
-}): T;
-export declare function jwtDecode<T = JwtPayload>(token: string, options?: JwtDecodeOptions): T;

package/node_modules/matrix-js-sdk/node_modules/jwt-decode/build/esm/index.js

@@ -1,57 +0,0 @@
-export class InvalidTokenError extends Error {
-}
-InvalidTokenError.prototype.name = "InvalidTokenError";
-function b64DecodeUnicode(str) {
-    return decodeURIComponent(atob(str).replace(/(.)/g, (m, p) => {
-        let code = p.charCodeAt(0).toString(16).toUpperCase();
-        if (code.length < 2) {
-            code = "0" + code;
-        }
-        return "%" + code;
-    }));
-}
-function base64UrlDecode(str) {
-    let output = str.replace(/-/g, "+").replace(/_/g, "/");
-    switch (output.length % 4) {
-        case 0:
-            break;
-        case 2:
-            output += "==";
-            break;
-        case 3:
-            output += "=";
-            break;
-        default:
-            throw new Error("base64 string is not of the correct length");
-    }
-    try {
-        return b64DecodeUnicode(output);
-    }
-    catch (err) {
-        return atob(output);
-    }
-}
-export function jwtDecode(token, options) {
-    if (typeof token !== "string") {
-        throw new InvalidTokenError("Invalid token specified: must be a string");
-    }
-    options || (options = {});
-    const pos = options.header === true ? 0 : 1;
-    const part = token.split(".")[pos];
-    if (typeof part !== "string") {
-        throw new InvalidTokenError(`Invalid token specified: missing part #${pos + 1}`);
-    }
-    let decoded;
-    try {
-        decoded = base64UrlDecode(part);
-    }
-    catch (e) {
-        throw new InvalidTokenError(`Invalid token specified: invalid base64 for part #${pos + 1} (${e.message})`);
-    }
-    try {
-        return JSON.parse(decoded);
-    }
-    catch (e) {
-        throw new InvalidTokenError(`Invalid token specified: invalid json for part #${pos + 1} (${e.message})`);
-    }
-}

package/node_modules/matrix-js-sdk/node_modules/jwt-decode/package.json

@@ -1,81 +0,0 @@
-{
-  "name": "jwt-decode",
-  "version": "4.0.0",
-  "description": "Decode JWT tokens, mostly useful for browser applications.",
-  "type": "module",
-  "main": "build/cjs/index.js",
-  "module": "build/esm/index.js",
-  "types": "build/cjs/index.d.ts",
-  "exports": {
-    ".": {
-      "import": {
-        "types": "./build/esm/index.d.ts",
-        "default": "./build/esm/index.js"
-      },
-      "require": {
-        "types": "./build/cjs/index.d.ts",
-        "default": "./build/cjs/index.js"
-      }
-    }
-  },
-  "keywords": [
-    "jwt",
-    "browser"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git://github.com/auth0/jwt-decode"
-  },
-  "url": "https://github.com/auth0/jwt-decode/issues",
-  "homepage": "https://github.com/auth0/jwt-decode#readme",
-  "scripts": {
-    "dev": "concurrently --kill-others \"npm run build:watch\" \"npm run dev:server\"",
-    "dev:server": "browser-sync start --config bs-config.json",
-    "prebuild": "shx rm -rf ./build && shx mkdir -p ./build/cjs && shx echo '{\"type\": \"commonjs\"}'> build/cjs/package.json",
-    "build": "tsc -b ./tsconfig.cjs.json ./tsconfig.esm.json",
-    "build:watch": "npm run build -- --watch",
-    "lint": "eslint .",
-    "lint:package": "publint",
-    "test": "npm run test:node && npm run test:browser",
-    "test:node": "NODE_OPTIONS='--experimental-vm-modules --no-warnings' jest --coverage",
-    "test:browser": "NODE_OPTIONS='--experimental-vm-modules --no-warnings' jest --coverage --testEnvironment=jsdom",
-    "prepack": "npm run build",
-    "prepare": "husky install"
-  },
-  "author": "Jose F. Romaniello <jfromaniello@gmail.com>",
-  "contributors": [
-    "Sam Bellen <sam.bellen@auth0.com>"
-  ],
-  "license": "MIT",
-  "devDependencies": {
-    "@babel/core": "7.23.2",
-    "@typescript-eslint/eslint-plugin": "^6.4.1",
-    "@typescript-eslint/parser": "^6.4.1",
-    "browser-sync": "^2.29.3",
-    "concurrently": "^8.2.0",
-    "eslint": "^8.48.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-import-resolver-typescript": "^3.6.0",
-    "eslint-plugin-import": "^2.28.1",
-    "eslint-plugin-prettier": "^5.0.0",
-    "husky": "^8.0.3",
-    "jest": "^29.7.0",
-    "jest-environment-jsdom": "^29.6.2",
-    "lint-staged": "^15.0.2",
-    "prettier": "^3.0.2",
-    "publint": "^0.2.2",
-    "shx": "^0.3.4",
-    "ts-jest": "^29.1.1",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.1.6"
-  },
-  "files": [
-    "build"
-  ],
-  "engines": {
-    "node": ">=18"
-  },
-  "lint-staged": {
-    "*.{js,ts}": "eslint --fix"
-  }
-}