@osdk/oauth 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @osdk/oauth
 
+## 0.3.2
+
+### Patch Changes
+
+- 6de6c33: Add overrides for minimatch/picomatch/rollup for CVEs
+
+## 0.3.1
+
+### Patch Changes
+
+- 75711ff: Added the ability to re-create the refresh token if the operation scopes change
+
 ## 0.3.0
 
 ### Minor Changes

package/build/browser/index.js

@@ -22,20 +22,19 @@ var CustomEvent = process.env.target === "browser" ? globalThis.CustomEvent : gl
     return this.#detail;
   }
 };
-var localStorage = globalThis.localStorage;
 function saveLocal(client, x) {
-  localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));
+  globalThis.localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));
 }
 function removeLocal(client) {
-  localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);
+  globalThis.localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);
 }
 function readLocal(client) {
   return JSON.parse(
     // MUST `localStorage?` as nodejs does not have localStorage
-    localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? "{}"
+    globalThis.localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? "{}"
   );
 }
-function common(client, as, _signIn, oauthHttpOptions, refresh) {
+function common(client, as, _signIn, oauthHttpOptions, refresh, scopes) {
   let token;
   const eventTarget = new TypedEventTarget();
   function makeTokenAndSaveRefresh(resp, type) {
@@ -46,7 +45,8 @@ function common(client, as, _signIn, oauthHttpOptions, refresh) {
     } = resp;
     !(expires_in != null) ? process.env.NODE_ENV !== "production" ? invariant(false) : invariant(false) : void 0;
     saveLocal(client, {
-      refresh_token
+      refresh_token,
+      requestedScopes: scopes
     });
     token = {
       refresh_token,
@@ -130,13 +130,14 @@ function createConfidentialOauthClient(client_id, client_secret, url, scopes = [
   const oauthHttpOptions = {
     [customFetch]: fetchFn
   };
+  const joinedScopes = scopes.join(" ");
   const {
     getToken,
     makeTokenAndSaveRefresh
-  } = common(client, authServer, _signIn, oauthHttpOptions, void 0);
+  } = common(client, authServer, _signIn, oauthHttpOptions, void 0, joinedScopes);
   async function _signIn() {
     return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({
-      scope: scopes.join(" ")
+      scope: joinedScopes
     }), oauthHttpOptions))), "signIn");
   }
   return getToken;
@@ -150,10 +151,11 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
   const oauthHttpOptions = {
     [customFetch]: fetchFn
   };
+  let joinedScopes = [...scopes ?? ["api:read-data", "api:write-data"]].sort().join(" ");
   const {
     makeTokenAndSaveRefresh,
     getToken
-  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true));
+  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), joinedScopes);
   async function go(x) {
     if (useHistory) return window.history.replaceState({}, "", x);
     else window.location.assign(x);
@@ -162,12 +164,17 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
   }
   async function maybeRefresh(expectRefreshToken) {
     const {
-      refresh_token
+      refresh_token,
+      requestedScopes: initialRequestedScopes
     } = readLocal(client);
     if (!refresh_token) {
       if (expectRefreshToken) throw new Error("No refresh token found");
       return;
     }
+    if (!refresh_token || !(initialRequestedScopes != null && joinedScopes === initialRequestedScopes)) {
+      if (expectRefreshToken) throw new Error("No refresh token found");
+      return;
+    }
     try {
       return makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), "refresh");
     } catch (e) {
@@ -220,7 +227,7 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
       redirect_uri: redirectUrl,
       code_challenge: await calculatePKCECodeChallenge(codeVerifier),
       code_challenge_method: "S256",
-      scope: ["offline_access", ...scopes].join(" ")
+      scope: `offline_access ${joinedScopes}`
     })}`);
     await delay(1e3);
     throw new Error("Unable to redirect");
@@ -232,5 +239,5 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
 }
 
 export { createConfidentialOauthClient, createPublicOauthClient };
-//# sourceMappingURL=out.js.map
+//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/build/browser/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/createConfidentialOauthClient.ts","../../src/common.ts","../../src/throwIfError.ts","../../src/createPublicOauthClient.ts"],"names":["CustomEvent","getToken","customFetch"],"mappings":";AAgBA,SAAS,+BAA+B,aAAa,wCAAwC;;;ACA7F,SAAS,2BAA2B,yBAAyB;AAC7D,OAAO,eAAe;AACtB,SAAS,wBAAwB;;;ACFjC,SAAS,qBAAqB;AACvB,SAAS,aAAa,QAAQ;AACnC,MAAI,cAAc,MAAM,GAAG;AACzB,UAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,EACxD;AACA,SAAO;AACT;;;ADAA,IAAM,cAAc,QAAQ,IAAI,WAAW,YAAY,WAAW,cAAc,WAAW,eAAe,MAAMA,qBAAoB,MAAM;AAAA,EACxI;AAAA,EACA,YAAY,MAAM,SAAS;AACzB,UAAM,MAAM,OAAO;AACnB,SAAK,UAAU,SAAS,UAAU;AAAA,EACpC;AAAA,EACA,IAAI,SAAS;AACX,WAAO,KAAK;AAAA,EACd;AACF;AACA,IAAM,eAAe,WAAW;AACzB,SAAS,UAAU,QAAQ,GAAG;AAEnC,gBAAc,QAAQ,2BAA2B,OAAO,SAAS,IAAI,KAAK,UAAU,CAAC,CAAC;AACxF;AACO,SAAS,YAAY,QAAQ;AAElC,gBAAc,WAAW,2BAA2B,OAAO,SAAS,EAAE;AACxE;AACO,SAAS,UAAU,QAAQ;AAChC,SAAO,KAAK;AAAA;AAAA,IAEZ,cAAc,QAAQ,2BAA2B,OAAO,SAAS,EAAE,KAAK;AAAA,EAAI;AAC9E;AACO,SAAS,OAAO,QAAQ,IAAI,SAAS,kBAAkB,SAAS;AACrE,MAAI;AACJ,QAAM,cAAc,IAAI,iBAAiB;AACzC,WAAS,wBAAwB,MAAM,MAAM;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AACJ,MAAE,cAAc,QAAQ,QAAQ,IAAI,aAAa,eAAe,UAAU,KAAK,IAAI,UAAU,KAAK,IAAI;AACtG,cAAU,QAAQ;AAAA,MAChB;AAAA,IACF,CAAC;AACD,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY,KAAK,IAAI,IAAI,aAAa;AAAA,IACxC;AACA,gBAAY,mBAAmB,MAAM,IAAI,YAAY,MAAM;AAAA,MACzD,QAAQ;AAAA,IACV,CAAC,CAAC;AACF,WAAO;AAAA,EACT;AACA,MAAI;AACJ,WAAS,YAAY;AACnB,QAAI,eAAgB,cAAa,cAAc;AAAA,EACjD;AACA,WAAS,oBAAoB,KAAK;AAChC,QAAI,SAAS;AACX,gBAAU;AACV,uBAAiB,WAAW,SAAS,IAAI,OAAO,aAAa,MAAO,KAAK,GAAI;AAAA,IAC/E;AAAA,EACF;AACA,iBAAe,UAAU;AACvB,KAAC,QAAQ,QAAQ,IAAI,aAAa,eAAe,UAAU,OAAO,eAAe,IAAI,UAAU,KAAK,IAAI;AACxG,UAAM,SAAS,MAAM,0BAA0B,MAAM,kBAAkB,IAAI,QAAQ,MAAM,cAAc,gBAAgB,CAAC;AACxH,cAAU;AAGV,gBAAY,MAAM;AAClB,YAAQ;AACR,iBAAa,MAAM;AACnB,gBAAY,mBAAmB,WAAW,IAAI,MAAM,SAAS,CAAC;AAAA,EAChE;AACA,MAAI;AACJ,iBAAe,SAAS;AACtB,QAAI,eAAe;AACjB,aAAO;AAAA,IACT;AACA,QAAI;AACF,sBAAgB,QAAQ;AACxB,aAAO,MAAM;AAAA,IACf,UAAE;AACA,sBAAgB;AAAA,IAClB;AAAA,EACF;AACA,cAAY,iBAAiB,UAAU,mBAAmB;AAC1D,cAAY,iBAAiB,WAAW,mBAAmB;AAC3D,QAAM,WAAW,OAAO,OAAO,eAAeC,YAAW;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,KAAK,MAAM,YAAY;AAC5C,cAAQ,MAAM,OAAO;AAAA,IACvB;AACA,WAAO,MAAM;AAAA,EACf,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,YAAY,iBAAiB,KAAK,WAAW;AAAA,IAC/D,qBAAqB,YAAY,oBAAoB,KAAK,WAAW;AAAA,EACvE,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AACO,SAAS,0BAA0B,SAAS,KAAK;AACtD,QAAM,SAAS,GAAG,IAAI,IAAI,SAAS,GAAG,CAAC;AACvC,SAAO;AAAA,IACL,gBAAgB,GAAG,MAAM;AAAA,IACzB,wBAAwB,GAAG,MAAM;AAAA,IACjC,qBAAqB,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF;AACF;;;ADtGO,SAAS,8BAA8B,WAAW,eAAe,KAAK,SAAS,CAAC,iBAAiB,gBAAgB,GAAG,UAAU,WAAW,OAAO,UAAU,cAAc;AAC7K,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,0BAA0B,SAAS,GAAG;AACzD,QAAM,mBAAmB;AAAA,IACvB,CAAC,WAAW,GAAG;AAAA,EACjB;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF,IAAI,OAAO,QAAQ,YAAY,SAAS,kBAAkB,MAAS;AACnE,iBAAe,UAAU;AACvB,WAAO,wBAAwB,aAAa,MAAM,iCAAiC,YAAY,QAAQ,MAAM,8BAA8B,YAAY,QAAQ,IAAI,gBAAgB;AAAA,MACjL,OAAO,OAAO,KAAK,GAAG;AAAA,IACxB,CAAC,GAAG,gBAAgB,CAAC,CAAC,GAAG,QAAQ;AAAA,EACnC;AACA,SAAO;AACT;;;AGhCA,OAAO,WAAW;AAClB,SAAS,+BAA+B,4BAA4B,eAAAC,cAAa,4BAA4B,qBAAqB,wCAAwC,0BAA0B,4BAA4B;AAezN,SAAS,wBAAwB,WAAW,KAAK,aAAa,YAAY,WAAW,gBAAgB,OAAO,SAAS,SAAS,GAAG,SAAS,CAAC,iBAAiB,gBAAgB,GAAG,UAAU,WAAW,OAAO,UAAU,cAAc;AACxO,QAAM,SAAS;AAAA,IACb;AAAA,IACA,4BAA4B;AAAA,EAC9B;AACA,QAAM,aAAa,0BAA0B,SAAS,GAAG;AACzD,QAAM,mBAAmB;AAAA,IACvB,CAACA,YAAW,GAAG;AAAA,EACjB;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF,IAAI,OAAO,QAAQ,YAAY,SAAS,kBAAkB,aAAa,KAAK,YAAY,IAAI,CAAC;AAC7F,iBAAe,GAAG,GAAG;AACnB,QAAI,WAAY,QAAO,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,CAAC;AAAA,QAAO,QAAO,SAAS,OAAO,CAAC;AAC3F,UAAM,MAAM,GAAI;AAChB,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,iBAAe,aAAa,oBAAoB;AAC9C,UAAM;AAAA,MACJ;AAAA,IACF,IAAI,UAAU,MAAM;AACpB,QAAI,CAAC,eAAe;AAClB,UAAI,mBAAoB,OAAM,IAAI,MAAM,wBAAwB;AAChE;AAAA,IACF;AACA,QAAI;AAGF,aAAO,wBAAwB,aAAa,MAAM,uCAAuC,YAAY,QAAQ,MAAM,yBAAyB,YAAY,QAAQ,eAAe,gBAAgB,CAAC,CAAC,GAAG,SAAS;AAAA,IAC/M,SAAS,GAAG;AACV,UAAI,SAAS,KAAK,aAAa,cAAc;AAE3C,gBAAQ,KAAK,8DAA8D,CAAC;AAAA,MAC9E;AACA,kBAAY,MAAM;AAClB,UAAI,oBAAoB;AACtB,cAAM,IAAI,MAAM,yBAAyB;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACA,iBAAe,wBAAwB;AACrC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI,UAAU,MAAM;AACpB,QAAI,CAAC,aAAc;AACnB,QAAI;AACF,YAAM,MAAM,wBAAwB,aAAa,MAAM,uCAAuC,YAAY,QAAQ,MAAM,8BAA8B,YAAY,QAAQ,aAAa,qBAAqB,YAAY,QAAQ,IAAI,IAAI,OAAO,SAAS,IAAI,GAAG,KAAK,CAAC,GAAG,aAAa,cAAc,gBAAgB,CAAC,CAAC,GAAG,QAAQ;AAChU,SAAG,MAAM;AACT,aAAO;AAAA,IACT,SAAS,GAAG;AACV,UAAI,SAAS,KAAK,aAAa,cAAc;AAE3C,gBAAQ,KAAK,qFAAqF,CAAC;AAAA,MACrG;AACA,kBAAY,MAAM;AAAA,IACpB;AAAA,EACF;AACA,iBAAe,wBAAwB;AACrC,QAAI,aAAa,OAAO,SAAS,SAAS,WAAW;AACnD,gBAAU,QAAQ;AAAA,QAChB,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,MAAM,GAAG,SAAS;AAAA,IAC3B;AACA,UAAM,QAAQ,oBAAoB;AAClC,UAAM,eAAe,2BAA2B;AAChD,UAAM,SAAS,UAAU,MAAM,EAAE,UAAU,OAAO,SAAS,SAAS;AACpE,cAAU,QAAQ;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,WAAO,SAAS,OAAO,GAAG,WAAW,sBAAsB,IAAI,IAAI,gBAAgB;AAAA,MACjF;AAAA,MACA,eAAe;AAAA,MACf;AAAA,MACA,cAAc;AAAA,MACd,gBAAgB,MAAM,2BAA2B,YAAY;AAAA,MAC7D,uBAAuB;AAAA,MACvB,OAAO,CAAC,kBAAkB,GAAG,MAAM,EAAE,KAAK,GAAG;AAAA,IAC/C,CAAC,CAAC,EAAE;AAGJ,UAAM,MAAM,GAAI;AAChB,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAGA,iBAAe,UAAU;AAEvB,WAAQ,MAAM,aAAa,KAErB,MAAM,sBAAsB,KAE9B,MAAM,sBAAsB;AAAA,EAClC;AACA,SAAO;AACT","sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { clientCredentialsGrantRequest, customFetch, processClientCredentialsResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n\n/**\n * @param client_id\n * @param client_secret\n * @param url the base url of your foundry server\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns which can be used as a token provider\n */\nexport function createConfidentialOauthClient(client_id, client_secret, url, scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    client_secret\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const {\n    getToken,\n    makeTokenAndSaveRefresh\n  } = common(client, authServer, _signIn, oauthHttpOptions, undefined);\n  async function _signIn() {\n    return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({\n      scope: scopes.join(\" \")\n    }), oauthHttpOptions))), \"signIn\");\n  }\n  return getToken;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { processRevocationResponse, revocationRequest } from \"oauth4webapi\";\nimport invariant from \"tiny-invariant\";\nimport { TypedEventTarget } from \"typescript-event-target\";\nimport { throwIfError } from \"./throwIfError.js\";\n// Node 18 is supposed to have a `CustomEvent` but it is not exposed on `globalThis`\n// which creates a problem for making a single codebase for node and browser. This polyfill works around it\nconst CustomEvent = process.env.target === \"browser\" ? globalThis.CustomEvent : globalThis.CustomEvent ?? class CustomEvent extends Event {\n  #detail;\n  constructor(type, options) {\n    super(type, options);\n    this.#detail = options?.detail ?? null;\n  }\n  get detail() {\n    return this.#detail;\n  }\n};\nconst localStorage = globalThis.localStorage;\nexport function saveLocal(client, x) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));\n}\nexport function removeLocal(client) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);\n}\nexport function readLocal(client) {\n  return JSON.parse(\n  // MUST `localStorage?` as nodejs does not have localStorage\n  localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? \"{}\");\n}\nexport function common(client, as, _signIn, oauthHttpOptions, refresh) {\n  let token;\n  const eventTarget = new TypedEventTarget();\n  function makeTokenAndSaveRefresh(resp, type) {\n    const {\n      refresh_token,\n      expires_in,\n      access_token\n    } = resp;\n    !(expires_in != null) ? process.env.NODE_ENV !== \"production\" ? invariant(false) : invariant(false) : void 0;\n    saveLocal(client, {\n      refresh_token\n    });\n    token = {\n      refresh_token,\n      expires_in,\n      access_token,\n      expires_at: Date.now() + expires_in * 1000\n    };\n    eventTarget.dispatchTypedEvent(type, new CustomEvent(type, {\n      detail: token\n    }));\n    return token;\n  }\n  let refreshTimeout;\n  function rmTimeout() {\n    if (refreshTimeout) clearTimeout(refreshTimeout);\n  }\n  function restartRefreshTimer(evt) {\n    if (refresh) {\n      rmTimeout();\n      refreshTimeout = setTimeout(refresh, evt.detail.expires_in * 1000 - 60 * 1000);\n    }\n  }\n  async function signOut() {\n    !token ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"not signed in\") : invariant(false) : void 0;\n    const result = await processRevocationResponse(await revocationRequest(as, client, token.access_token, oauthHttpOptions));\n    rmTimeout();\n\n    // Clean up\n    removeLocal(client);\n    token = undefined;\n    throwIfError(result);\n    eventTarget.dispatchTypedEvent(\"signOut\", new Event(\"signOut\"));\n  }\n  let pendingSignIn;\n  async function signIn() {\n    if (pendingSignIn) {\n      return pendingSignIn;\n    }\n    try {\n      pendingSignIn = _signIn();\n      return await pendingSignIn;\n    } finally {\n      pendingSignIn = undefined;\n    }\n  }\n  eventTarget.addEventListener(\"signIn\", restartRefreshTimer);\n  eventTarget.addEventListener(\"refresh\", restartRefreshTimer);\n  const getToken = Object.assign(async function getToken() {\n    if (!token || Date.now() >= token.expires_at) {\n      token = await signIn();\n    }\n    return token.access_token;\n  }, {\n    signIn,\n    refresh,\n    signOut,\n    rmTimeout,\n    addEventListener: eventTarget.addEventListener.bind(eventTarget),\n    removeEventListener: eventTarget.removeEventListener.bind(eventTarget)\n  });\n  return {\n    getToken,\n    makeTokenAndSaveRefresh\n  };\n}\nexport function createAuthorizationServer(ctxPath, url) {\n  const issuer = `${new URL(ctxPath, url)}`;\n  return {\n    token_endpoint: `${issuer}/api/oauth2/token`,\n    authorization_endpoint: `${issuer}/api/oauth2/authorize`,\n    revocation_endpoint: `${issuer}/api/oauth2/revoke_token`,\n    issuer\n  };\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isOAuth2Error } from \"oauth4webapi\";\nexport function throwIfError(result) {\n  if (isOAuth2Error(result)) {\n    throw new Error(`Failed to get token: ${result.error}`);\n  }\n  return result;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport delay from \"delay\";\nimport { authorizationCodeGrantRequest, calculatePKCECodeChallenge, customFetch, generateRandomCodeVerifier, generateRandomState, processAuthorizationCodeOAuth2Response, refreshTokenGrantRequest, validateAuthResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer, readLocal, removeLocal, saveLocal } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n/**\n * @param client_id\n * @param url the base url of your foundry server\n * @param redirectUrl the url configured for redirect in the oauth configuration on the server\n * @param useHistory if true, when possible uses `history.replaceState()`, otherwise uses `window.location.assign()`\n * @param loginPage if you want a custom landing page prior to logging in, set this to that url\n * @param postLoginPage if you want to customize where you return to after a completed authentication cycle. defaults to the url when the page loaded\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns {PublicOauthClient} which can be used as a token provider\n */\nexport function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginPage, postLoginPage = window.location.toString(), scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    token_endpoint_auth_method: \"none\"\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const {\n    makeTokenAndSaveRefresh,\n    getToken\n  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true));\n  async function go(x) {\n    if (useHistory) return window.history.replaceState({}, \"\", x);else window.location.assign(x);\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n  async function maybeRefresh(expectRefreshToken) {\n    const {\n      refresh_token\n    } = readLocal(client);\n    if (!refresh_token) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    try {\n      // note, we don't use processRefreshTokenResponse because the mp oauth implementation\n      // doesn't do refresh tokens quite right and this lets us skip the id check\n      return makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), \"refresh\");\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 refresh token. Removing refresh token\", e);\n      }\n      removeLocal(client);\n      if (expectRefreshToken) {\n        throw new Error(\"Could not refresh token\");\n      }\n    }\n  }\n  async function maybeHandleAuthReturn() {\n    const {\n      codeVerifier,\n      state,\n      oldUrl\n    } = readLocal(client);\n    if (!codeVerifier) return;\n    try {\n      const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirectUrl, codeVerifier, oauthHttpOptions))), \"signIn\");\n      go(oldUrl);\n      return ret;\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow\", e);\n      }\n      removeLocal(client);\n    }\n  }\n  async function initiateLoginRedirect() {\n    if (loginPage && window.location.href !== loginPage) {\n      saveLocal(client, {\n        oldUrl: postLoginPage\n      });\n      return await go(loginPage);\n    }\n    const state = generateRandomState();\n    const codeVerifier = generateRandomCodeVerifier();\n    const oldUrl = readLocal(client).oldUrl ?? window.location.toString();\n    saveLocal(client, {\n      codeVerifier,\n      state,\n      oldUrl\n    });\n    window.location.assign(`${authServer.authorization_endpoint}?${new URLSearchParams({\n      client_id,\n      response_type: \"code\",\n      state,\n      redirect_uri: redirectUrl,\n      code_challenge: await calculatePKCECodeChallenge(codeVerifier),\n      code_challenge_method: \"S256\",\n      scope: [\"offline_access\", ...scopes].join(\" \")\n    })}`);\n\n    // Give time for redirect to happen\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n\n  /** Will throw if there is no token! */\n  async function _signIn() {\n    // 1. Check if we have a refresh token in local storage\n    return (await maybeRefresh()\n    // 2. If there is no refresh token we are likely trying to perform the callback\n    ) ?? (await maybeHandleAuthReturn())\n    // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request\n    ?? (await initiateLoginRedirect());\n  }\n  return getToken;\n}"]}
+{"version":3,"sources":["../../src/throwIfError.ts","../../src/common.ts","../../src/createConfidentialOauthClient.ts","../../src/createPublicOauthClient.ts"],"names":["CustomEvent","getToken","customFetch"],"mappings":";;;;;;AAiBO,SAAS,aAAa,MAAQ,EAAA;AACnC,EAAI,IAAA,aAAA,CAAc,MAAM,CAAG,EAAA;AACzB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAwB,qBAAA,EAAA,MAAA,CAAO,KAAK,CAAE,CAAA,CAAA,CAAA;AAAA,GACxD;AACA,EAAO,OAAA,MAAA,CAAA;AACT,CAAA;;;ACAA,IAAM,WAAA,GAAc,OAAQ,CAAA,GAAA,CAAI,MAAW,KAAA,SAAA,GAAY,UAAW,CAAA,WAAA,GAAc,UAAW,CAAA,WAAA,IAAe,MAAMA,YAAAA,SAAoB,KAAM,CAAA;AAAA,EACxI,OAAA,CAAA;AAAA,EACA,WAAA,CAAY,MAAM,OAAS,EAAA;AACzB,IAAA,KAAA,CAAM,MAAM,OAAO,CAAA,CAAA;AACnB,IAAK,IAAA,CAAA,OAAA,GAAU,SAAS,MAAU,IAAA,IAAA,CAAA;AAAA,GACpC;AAAA,EACA,IAAI,MAAS,GAAA;AACX,IAAA,OAAO,IAAK,CAAA,OAAA,CAAA;AAAA,GACd;AACF,CAAA,CAAA;AACO,SAAS,SAAA,CAAU,QAAQ,CAAG,EAAA;AAEnC,EAAW,UAAA,CAAA,YAAA,EAAc,QAAQ,CAA2B,wBAAA,EAAA,MAAA,CAAO,SAAS,CAAI,CAAA,EAAA,IAAA,CAAK,SAAU,CAAA,CAAC,CAAC,CAAA,CAAA;AACnG,CAAA;AACO,SAAS,YAAY,MAAQ,EAAA;AAElC,EAAA,UAAA,CAAW,YAAc,EAAA,UAAA,CAAW,CAA2B,wBAAA,EAAA,MAAA,CAAO,SAAS,CAAE,CAAA,CAAA,CAAA;AACnF,CAAA;AACO,SAAS,UAAU,MAAQ,EAAA;AAChC,EAAA,OAAO,IAAK,CAAA,KAAA;AAAA;AAAA,IAEZ,WAAW,YAAc,EAAA,OAAA,CAAQ,2BAA2B,MAAO,CAAA,SAAS,EAAE,CAAK,IAAA,IAAA;AAAA,GAAI,CAAA;AACzF,CAAA;AACO,SAAS,OAAO,MAAQ,EAAA,EAAA,EAAI,OAAS,EAAA,gBAAA,EAAkB,SAAS,MAAQ,EAAA;AAC7E,EAAI,IAAA,KAAA,CAAA;AACJ,EAAM,MAAA,WAAA,GAAc,IAAI,gBAAiB,EAAA,CAAA;AACzC,EAAS,SAAA,uBAAA,CAAwB,MAAM,IAAM,EAAA;AAC3C,IAAM,MAAA;AAAA,MACJ,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,KACE,GAAA,IAAA,CAAA;AACJ,IAAE,EAAA,UAAA,IAAc,IAAQ,CAAA,GAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,KAAa,YAAe,GAAA,SAAA,CAAU,KAAK,CAAA,GAAI,SAAU,CAAA,KAAK,CAAI,GAAA,KAAA,CAAA,CAAA;AACtG,IAAA,SAAA,CAAU,MAAQ,EAAA;AAAA,MAChB,aAAA;AAAA,MACA,eAAiB,EAAA,MAAA;AAAA,KAClB,CAAA,CAAA;AACD,IAAQ,KAAA,GAAA;AAAA,MACN,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA,UAAY,EAAA,IAAA,CAAK,GAAI,EAAA,GAAI,UAAa,GAAA,GAAA;AAAA,KACxC,CAAA;AACA,IAAA,WAAA,CAAY,kBAAmB,CAAA,IAAA,EAAM,IAAI,WAAA,CAAY,IAAM,EAAA;AAAA,MACzD,MAAQ,EAAA,KAAA;AAAA,KACT,CAAC,CAAA,CAAA;AACF,IAAO,OAAA,KAAA,CAAA;AAAA,GACT;AACA,EAAI,IAAA,cAAA,CAAA;AACJ,EAAA,SAAS,SAAY,GAAA;AACnB,IAAI,IAAA,cAAA,eAA6B,cAAc,CAAA,CAAA;AAAA,GACjD;AACA,EAAA,SAAS,oBAAoB,GAAK,EAAA;AAChC,IAAA,IAAI,OAAS,EAAA;AACX,MAAU,SAAA,EAAA,CAAA;AACV,MAAA,cAAA,GAAiB,WAAW,OAAS,EAAA,GAAA,CAAI,OAAO,UAAa,GAAA,GAAA,GAAO,KAAK,GAAI,CAAA,CAAA;AAAA,KAC/E;AAAA,GACF;AACA,EAAA,eAAe,OAAU,GAAA;AACvB,IAAC,CAAA,KAAA,GAAQ,OAAQ,CAAA,GAAA,CAAI,QAAa,KAAA,YAAA,GAAe,SAAU,CAAA,KAAA,EAAO,eAAe,CAAA,GAAI,SAAU,CAAA,KAAK,CAAI,GAAA,KAAA,CAAA,CAAA;AACxG,IAAM,MAAA,MAAA,GAAS,MAAM,yBAAA,CAA0B,MAAM,iBAAA,CAAkB,IAAI,MAAQ,EAAA,KAAA,CAAM,YAAc,EAAA,gBAAgB,CAAC,CAAA,CAAA;AACxH,IAAU,SAAA,EAAA,CAAA;AAGV,IAAA,WAAA,CAAY,MAAM,CAAA,CAAA;AAClB,IAAQ,KAAA,GAAA,KAAA,CAAA,CAAA;AACR,IAAA,YAAA,CAAa,MAAM,CAAA,CAAA;AACnB,IAAA,WAAA,CAAY,kBAAmB,CAAA,SAAA,EAAW,IAAI,KAAA,CAAM,SAAS,CAAC,CAAA,CAAA;AAAA,GAChE;AACA,EAAI,IAAA,aAAA,CAAA;AACJ,EAAA,eAAe,MAAS,GAAA;AACtB,IAAA,IAAI,aAAe,EAAA;AACjB,MAAO,OAAA,aAAA,CAAA;AAAA,KACT;AACA,IAAI,IAAA;AACF,MAAA,aAAA,GAAgB,OAAQ,EAAA,CAAA;AACxB,MAAA,OAAO,MAAM,aAAA,CAAA;AAAA,KACb,SAAA;AACA,MAAgB,aAAA,GAAA,KAAA,CAAA,CAAA;AAAA,KAClB;AAAA,GACF;AACA,EAAY,WAAA,CAAA,gBAAA,CAAiB,UAAU,mBAAmB,CAAA,CAAA;AAC1D,EAAY,WAAA,CAAA,gBAAA,CAAiB,WAAW,mBAAmB,CAAA,CAAA;AAC3D,EAAA,MAAM,QAAW,GAAA,MAAA,CAAO,MAAO,CAAA,eAAeC,SAAW,GAAA;AACvD,IAAA,IAAI,CAAC,KAAS,IAAA,IAAA,CAAK,GAAI,EAAA,IAAK,MAAM,UAAY,EAAA;AAC5C,MAAA,KAAA,GAAQ,MAAM,MAAO,EAAA,CAAA;AAAA,KACvB;AACA,IAAA,OAAO,KAAM,CAAA,YAAA,CAAA;AAAA,GACZ,EAAA;AAAA,IACD,MAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAkB,EAAA,WAAA,CAAY,gBAAiB,CAAA,IAAA,CAAK,WAAW,CAAA;AAAA,IAC/D,mBAAqB,EAAA,WAAA,CAAY,mBAAoB,CAAA,IAAA,CAAK,WAAW,CAAA;AAAA,GACtE,CAAA,CAAA;AACD,EAAO,OAAA;AAAA,IACL,QAAA;AAAA,IACA,uBAAA;AAAA,GACF,CAAA;AACF,CAAA;AACO,SAAS,yBAAA,CAA0B,SAAS,GAAK,EAAA;AACtD,EAAA,MAAM,SAAS,CAAG,EAAA,IAAI,GAAI,CAAA,OAAA,EAAS,GAAG,CAAC,CAAA,CAAA,CAAA;AACvC,EAAO,OAAA;AAAA,IACL,cAAA,EAAgB,GAAG,MAAM,CAAA,iBAAA,CAAA;AAAA,IACzB,sBAAA,EAAwB,GAAG,MAAM,CAAA,qBAAA,CAAA;AAAA,IACjC,mBAAA,EAAqB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IAC9B,MAAA;AAAA,GACF,CAAA;AACF,CAAA;;;ACtGO,SAAS,6BAA8B,CAAA,SAAA,EAAW,aAAe,EAAA,GAAA,EAAK,MAAS,GAAA,CAAC,eAAiB,EAAA,gBAAgB,CAAG,EAAA,OAAA,GAAU,UAAW,CAAA,KAAA,EAAO,UAAU,YAAc,EAAA;AAC7K,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,SAAA;AAAA,IACA,aAAA;AAAA,GACF,CAAA;AACA,EAAM,MAAA,UAAA,GAAa,yBAA0B,CAAA,OAAA,EAAS,GAAG,CAAA,CAAA;AACzD,EAAA,MAAM,gBAAmB,GAAA;AAAA,IACvB,CAAC,WAAW,GAAG,OAAA;AAAA,GACjB,CAAA;AACA,EAAM,MAAA,YAAA,GAAe,MAAO,CAAA,IAAA,CAAK,GAAG,CAAA,CAAA;AACpC,EAAM,MAAA;AAAA,IACJ,QAAA;AAAA,IACA,uBAAA;AAAA,MACE,MAAO,CAAA,MAAA,EAAQ,YAAY,OAAS,EAAA,gBAAA,EAAkB,QAAW,YAAY,CAAA,CAAA;AACjF,EAAA,eAAe,OAAU,GAAA;AACvB,IAAO,OAAA,uBAAA,CAAwB,YAAa,CAAA,MAAM,gCAAiC,CAAA,UAAA,EAAY,MAAQ,EAAA,MAAM,6BAA8B,CAAA,UAAA,EAAY,MAAQ,EAAA,IAAI,eAAgB,CAAA;AAAA,MACjL,KAAO,EAAA,YAAA;AAAA,KACR,CAAG,EAAA,gBAAgB,CAAC,CAAC,GAAG,QAAQ,CAAA,CAAA;AAAA,GACnC;AACA,EAAO,OAAA,QAAA,CAAA;AACT,CAAA;ACjBO,SAAS,uBAAA,CAAwB,WAAW,GAAK,EAAA,WAAA,EAAa,YAAY,SAAW,EAAA,aAAA,GAAgB,OAAO,QAAS,CAAA,QAAA,IAAY,MAAS,GAAA,CAAC,iBAAiB,gBAAgB,CAAA,EAAG,UAAU,UAAW,CAAA,KAAA,EAAO,UAAU,YAAc,EAAA;AACxO,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,SAAA;AAAA,IACA,0BAA4B,EAAA,MAAA;AAAA,GAC9B,CAAA;AACA,EAAM,MAAA,UAAA,GAAa,yBAA0B,CAAA,OAAA,EAAS,GAAG,CAAA,CAAA;AACzD,EAAA,MAAM,gBAAmB,GAAA;AAAA,IACvB,CAACC,WAAW,GAAG,OAAA;AAAA,GACjB,CAAA;AACA,EAAA,IAAI,YAAe,GAAA,CAAC,GAAI,MAAA,IAAU,CAAC,eAAA,EAAiB,gBAAgB,CAAE,CAAE,CAAA,IAAA,EAAO,CAAA,IAAA,CAAK,GAAG,CAAA,CAAA;AACvF,EAAM,MAAA;AAAA,IACJ,uBAAA;AAAA,IACA,QAAA;AAAA,GACF,GAAI,MAAO,CAAA,MAAA,EAAQ,UAAY,EAAA,OAAA,EAAS,gBAAkB,EAAA,YAAA,CAAa,IAAK,CAAA,UAAA,EAAY,IAAI,CAAA,EAAG,YAAY,CAAA,CAAA;AAC3G,EAAA,eAAe,GAAG,CAAG,EAAA;AACnB,IAAI,IAAA,UAAA,SAAmB,MAAO,CAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,CAAC,CAAA,CAAA;AAAA,SAAO,MAAA,CAAO,QAAS,CAAA,MAAA,CAAO,CAAC,CAAA,CAAA;AAC3F,IAAA,MAAM,MAAM,GAAI,CAAA,CAAA;AAChB,IAAM,MAAA,IAAI,MAAM,oBAAoB,CAAA,CAAA;AAAA,GACtC;AACA,EAAA,eAAe,aAAa,kBAAoB,EAAA;AAC9C,IAAM,MAAA;AAAA,MACJ,aAAA;AAAA,MACA,eAAiB,EAAA,sBAAA;AAAA,KACnB,GAAI,UAAU,MAAM,CAAA,CAAA;AACpB,IAAA,IAAI,CAAC,aAAe,EAAA;AAClB,MAAA,IAAI,kBAAoB,EAAA,MAAM,IAAI,KAAA,CAAM,wBAAwB,CAAA,CAAA;AAChE,MAAA,OAAA;AAAA,KACF;AACA,IAAA,IAAI,CAAC,aAAiB,IAAA,EAAE,sBAA0B,IAAA,IAAA,IAAQ,iBAAiB,sBAAyB,CAAA,EAAA;AAClG,MAAA,IAAI,kBAAoB,EAAA,MAAM,IAAI,KAAA,CAAM,wBAAwB,CAAA,CAAA;AAChE,MAAA,OAAA;AAAA,KACF;AACA,IAAI,IAAA;AAGF,MAAA,OAAO,uBAAwB,CAAA,YAAA,CAAa,MAAM,sCAAA,CAAuC,YAAY,MAAQ,EAAA,MAAM,wBAAyB,CAAA,UAAA,EAAY,QAAQ,aAAe,EAAA,gBAAgB,CAAC,CAAC,GAAG,SAAS,CAAA,CAAA;AAAA,aACtM,CAAG,EAAA;AACV,MAAI,IAAA,OAAA,EAAS,GAAK,EAAA,QAAA,KAAa,YAAc,EAAA;AAE3C,QAAQ,OAAA,CAAA,IAAA,CAAK,8DAA8D,CAAC,CAAA,CAAA;AAAA,OAC9E;AACA,MAAA,WAAA,CAAY,MAAM,CAAA,CAAA;AAClB,MAAA,IAAI,kBAAoB,EAAA;AACtB,QAAM,MAAA,IAAI,MAAM,yBAAyB,CAAA,CAAA;AAAA,OAC3C;AAAA,KACF;AAAA,GACF;AACA,EAAA,eAAe,qBAAwB,GAAA;AACrC,IAAM,MAAA;AAAA,MACJ,YAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,KACF,GAAI,UAAU,MAAM,CAAA,CAAA;AACpB,IAAA,IAAI,CAAC,YAAc,EAAA,OAAA;AACnB,IAAI,IAAA;AACF,MAAA,MAAM,GAAM,GAAA,uBAAA,CAAwB,YAAa,CAAA,MAAM,sCAAuC,CAAA,UAAA,EAAY,MAAQ,EAAA,MAAM,6BAA8B,CAAA,UAAA,EAAY,MAAQ,EAAA,YAAA,CAAa,qBAAqB,UAAY,EAAA,MAAA,EAAQ,IAAI,GAAA,CAAI,MAAO,CAAA,QAAA,CAAS,IAAI,CAAA,EAAG,KAAK,CAAC,CAAG,EAAA,WAAA,EAAa,YAAc,EAAA,gBAAgB,CAAC,CAAC,GAAG,QAAQ,CAAA,CAAA;AAChU,MAAA,EAAA,CAAG,MAAM,CAAA,CAAA;AACT,MAAO,OAAA,GAAA,CAAA;AAAA,aACA,CAAG,EAAA;AACV,MAAI,IAAA,OAAA,EAAS,GAAK,EAAA,QAAA,KAAa,YAAc,EAAA;AAE3C,QAAQ,OAAA,CAAA,IAAA,CAAK,qFAAqF,CAAC,CAAA,CAAA;AAAA,OACrG;AACA,MAAA,WAAA,CAAY,MAAM,CAAA,CAAA;AAAA,KACpB;AAAA,GACF;AACA,EAAA,eAAe,qBAAwB,GAAA;AACrC,IAAA,IAAI,SAAa,IAAA,MAAA,CAAO,QAAS,CAAA,IAAA,KAAS,SAAW,EAAA;AACnD,MAAA,SAAA,CAAU,MAAQ,EAAA;AAAA,QAChB,MAAQ,EAAA,aAAA;AAAA,OACT,CAAA,CAAA;AACD,MAAO,OAAA,MAAM,GAAG,SAAS,CAAA,CAAA;AAAA,KAC3B;AACA,IAAA,MAAM,QAAQ,mBAAoB,EAAA,CAAA;AAClC,IAAA,MAAM,eAAe,0BAA2B,EAAA,CAAA;AAChD,IAAA,MAAM,SAAS,SAAU,CAAA,MAAM,EAAE,MAAU,IAAA,MAAA,CAAO,SAAS,QAAS,EAAA,CAAA;AACpE,IAAA,SAAA,CAAU,MAAQ,EAAA;AAAA,MAChB,YAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,KACD,CAAA,CAAA;AACD,IAAA,MAAA,CAAO,SAAS,MAAO,CAAA,CAAA,EAAG,WAAW,sBAAsB,CAAA,CAAA,EAAI,IAAI,eAAgB,CAAA;AAAA,MACjF,SAAA;AAAA,MACA,aAAe,EAAA,MAAA;AAAA,MACf,KAAA;AAAA,MACA,YAAc,EAAA,WAAA;AAAA,MACd,cAAA,EAAgB,MAAM,0BAAA,CAA2B,YAAY,CAAA;AAAA,MAC7D,qBAAuB,EAAA,MAAA;AAAA,MACvB,KAAA,EAAO,kBAAkB,YAAY,CAAA,CAAA;AAAA,KACtC,CAAC,CAAE,CAAA,CAAA,CAAA;AAGJ,IAAA,MAAM,MAAM,GAAI,CAAA,CAAA;AAChB,IAAM,MAAA,IAAI,MAAM,oBAAoB,CAAA,CAAA;AAAA,GACtC;AAGA,EAAA,eAAe,OAAU,GAAA;AAEvB,IAAA,OAAQ,MAAM,YAAa,EAAA,IAErB,MAAM,qBAAsB,EAAA,IAE9B,MAAM,qBAAsB,EAAA,CAAA;AAAA,GAClC;AACA,EAAO,OAAA,QAAA,CAAA;AACT","file":"index.js","sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isOAuth2Error } from \"oauth4webapi\";\nexport function throwIfError(result) {\n  if (isOAuth2Error(result)) {\n    throw new Error(`Failed to get token: ${result.error}`);\n  }\n  return result;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { processRevocationResponse, revocationRequest } from \"oauth4webapi\";\nimport invariant from \"tiny-invariant\";\nimport { TypedEventTarget } from \"typescript-event-target\";\nimport { throwIfError } from \"./throwIfError.js\";\n// Node 18 is supposed to have a `CustomEvent` but it is not exposed on `globalThis`\n// which creates a problem for making a single codebase for node and browser. This polyfill works around it\nconst CustomEvent = process.env.target === \"browser\" ? globalThis.CustomEvent : globalThis.CustomEvent ?? class CustomEvent extends Event {\n  #detail;\n  constructor(type, options) {\n    super(type, options);\n    this.#detail = options?.detail ?? null;\n  }\n  get detail() {\n    return this.#detail;\n  }\n};\nexport function saveLocal(client, x) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  globalThis.localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));\n}\nexport function removeLocal(client) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  globalThis.localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);\n}\nexport function readLocal(client) {\n  return JSON.parse(\n  // MUST `localStorage?` as nodejs does not have localStorage\n  globalThis.localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? \"{}\");\n}\nexport function common(client, as, _signIn, oauthHttpOptions, refresh, scopes) {\n  let token;\n  const eventTarget = new TypedEventTarget();\n  function makeTokenAndSaveRefresh(resp, type) {\n    const {\n      refresh_token,\n      expires_in,\n      access_token\n    } = resp;\n    !(expires_in != null) ? process.env.NODE_ENV !== \"production\" ? invariant(false) : invariant(false) : void 0;\n    saveLocal(client, {\n      refresh_token,\n      requestedScopes: scopes\n    });\n    token = {\n      refresh_token,\n      expires_in,\n      access_token,\n      expires_at: Date.now() + expires_in * 1000\n    };\n    eventTarget.dispatchTypedEvent(type, new CustomEvent(type, {\n      detail: token\n    }));\n    return token;\n  }\n  let refreshTimeout;\n  function rmTimeout() {\n    if (refreshTimeout) clearTimeout(refreshTimeout);\n  }\n  function restartRefreshTimer(evt) {\n    if (refresh) {\n      rmTimeout();\n      refreshTimeout = setTimeout(refresh, evt.detail.expires_in * 1000 - 60 * 1000);\n    }\n  }\n  async function signOut() {\n    !token ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"not signed in\") : invariant(false) : void 0;\n    const result = await processRevocationResponse(await revocationRequest(as, client, token.access_token, oauthHttpOptions));\n    rmTimeout();\n\n    // Clean up\n    removeLocal(client);\n    token = undefined;\n    throwIfError(result);\n    eventTarget.dispatchTypedEvent(\"signOut\", new Event(\"signOut\"));\n  }\n  let pendingSignIn;\n  async function signIn() {\n    if (pendingSignIn) {\n      return pendingSignIn;\n    }\n    try {\n      pendingSignIn = _signIn();\n      return await pendingSignIn;\n    } finally {\n      pendingSignIn = undefined;\n    }\n  }\n  eventTarget.addEventListener(\"signIn\", restartRefreshTimer);\n  eventTarget.addEventListener(\"refresh\", restartRefreshTimer);\n  const getToken = Object.assign(async function getToken() {\n    if (!token || Date.now() >= token.expires_at) {\n      token = await signIn();\n    }\n    return token.access_token;\n  }, {\n    signIn,\n    refresh,\n    signOut,\n    rmTimeout,\n    addEventListener: eventTarget.addEventListener.bind(eventTarget),\n    removeEventListener: eventTarget.removeEventListener.bind(eventTarget)\n  });\n  return {\n    getToken,\n    makeTokenAndSaveRefresh\n  };\n}\nexport function createAuthorizationServer(ctxPath, url) {\n  const issuer = `${new URL(ctxPath, url)}`;\n  return {\n    token_endpoint: `${issuer}/api/oauth2/token`,\n    authorization_endpoint: `${issuer}/api/oauth2/authorize`,\n    revocation_endpoint: `${issuer}/api/oauth2/revoke_token`,\n    issuer\n  };\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { clientCredentialsGrantRequest, customFetch, processClientCredentialsResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n\n/**\n * @param client_id\n * @param client_secret\n * @param url the base url of your foundry server\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns which can be used as a token provider\n */\nexport function createConfidentialOauthClient(client_id, client_secret, url, scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    client_secret\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const joinedScopes = scopes.join(\" \");\n  const {\n    getToken,\n    makeTokenAndSaveRefresh\n  } = common(client, authServer, _signIn, oauthHttpOptions, undefined, joinedScopes);\n  async function _signIn() {\n    return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({\n      scope: joinedScopes\n    }), oauthHttpOptions))), \"signIn\");\n  }\n  return getToken;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport delay from \"delay\";\nimport { authorizationCodeGrantRequest, calculatePKCECodeChallenge, customFetch, generateRandomCodeVerifier, generateRandomState, processAuthorizationCodeOAuth2Response, refreshTokenGrantRequest, validateAuthResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer, readLocal, removeLocal, saveLocal } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n/**\n * @param client_id\n * @param url the base url of your foundry server\n * @param redirectUrl the url configured for redirect in the oauth configuration on the server\n * @param useHistory if true, when possible uses `history.replaceState()`, otherwise uses `window.location.assign()`\n * @param loginPage if you want a custom landing page prior to logging in, set this to that url\n * @param postLoginPage if you want to customize where you return to after a completed authentication cycle. defaults to the url when the page loaded\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns {PublicOauthClient} which can be used as a token provider\n */\nexport function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginPage, postLoginPage = window.location.toString(), scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    token_endpoint_auth_method: \"none\"\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  let joinedScopes = [...(scopes ?? [\"api:read-data\", \"api:write-data\"])].sort().join(\" \");\n  const {\n    makeTokenAndSaveRefresh,\n    getToken\n  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), joinedScopes);\n  async function go(x) {\n    if (useHistory) return window.history.replaceState({}, \"\", x);else window.location.assign(x);\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n  async function maybeRefresh(expectRefreshToken) {\n    const {\n      refresh_token,\n      requestedScopes: initialRequestedScopes\n    } = readLocal(client);\n    if (!refresh_token) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    if (!refresh_token || !(initialRequestedScopes != null && joinedScopes === initialRequestedScopes)) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    try {\n      // note, we don't use processRefreshTokenResponse because the mp oauth implementation\n      // doesn't do refresh tokens quite right and this lets us skip the id check\n      return makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), \"refresh\");\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 refresh token. Removing refresh token\", e);\n      }\n      removeLocal(client);\n      if (expectRefreshToken) {\n        throw new Error(\"Could not refresh token\");\n      }\n    }\n  }\n  async function maybeHandleAuthReturn() {\n    const {\n      codeVerifier,\n      state,\n      oldUrl\n    } = readLocal(client);\n    if (!codeVerifier) return;\n    try {\n      const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirectUrl, codeVerifier, oauthHttpOptions))), \"signIn\");\n      go(oldUrl);\n      return ret;\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow\", e);\n      }\n      removeLocal(client);\n    }\n  }\n  async function initiateLoginRedirect() {\n    if (loginPage && window.location.href !== loginPage) {\n      saveLocal(client, {\n        oldUrl: postLoginPage\n      });\n      return await go(loginPage);\n    }\n    const state = generateRandomState();\n    const codeVerifier = generateRandomCodeVerifier();\n    const oldUrl = readLocal(client).oldUrl ?? window.location.toString();\n    saveLocal(client, {\n      codeVerifier,\n      state,\n      oldUrl\n    });\n    window.location.assign(`${authServer.authorization_endpoint}?${new URLSearchParams({\n      client_id,\n      response_type: \"code\",\n      state,\n      redirect_uri: redirectUrl,\n      code_challenge: await calculatePKCECodeChallenge(codeVerifier),\n      code_challenge_method: \"S256\",\n      scope: `offline_access ${joinedScopes}`\n    })}`);\n\n    // Give time for redirect to happen\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n\n  /** Will throw if there is no token! */\n  async function _signIn() {\n    // 1. Check if we have a refresh token in local storage\n    return (await maybeRefresh()\n    // 2. If there is no refresh token we are likely trying to perform the callback\n    ) ?? (await maybeHandleAuthReturn())\n    // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request\n    ?? (await initiateLoginRedirect());\n  }\n  return getToken;\n}"]}

package/build/cjs/index.cjs

@@ -29,20 +29,19 @@ var CustomEvent = process.env.target === "browser" ? globalThis.CustomEvent : gl
     return this.#detail;
   }
 };
-var localStorage = globalThis.localStorage;
 function saveLocal(client, x) {
-  localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));
+  globalThis.localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));
 }
 function removeLocal(client) {
-  localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);
+  globalThis.localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);
 }
 function readLocal(client) {
   return JSON.parse(
     // MUST `localStorage?` as nodejs does not have localStorage
-    localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? "{}"
+    globalThis.localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? "{}"
   );
 }
-function common(client, as, _signIn, oauthHttpOptions, refresh) {
+function common(client, as, _signIn, oauthHttpOptions, refresh, scopes) {
   let token;
   const eventTarget = new typescriptEventTarget.TypedEventTarget();
   function makeTokenAndSaveRefresh(resp, type) {
@@ -53,7 +52,8 @@ function common(client, as, _signIn, oauthHttpOptions, refresh) {
     } = resp;
     !(expires_in != null) ? process.env.NODE_ENV !== "production" ? invariant__default.default(false) : invariant__default.default(false) : void 0;
     saveLocal(client, {
-      refresh_token
+      refresh_token,
+      requestedScopes: scopes
     });
     token = {
       refresh_token,
@@ -137,13 +137,14 @@ function createConfidentialOauthClient(client_id, client_secret, url, scopes = [
   const oauthHttpOptions = {
     [oauth4webapi.customFetch]: fetchFn
   };
+  const joinedScopes = scopes.join(" ");
   const {
     getToken,
     makeTokenAndSaveRefresh
-  } = common(client, authServer, _signIn, oauthHttpOptions, void 0);
+  } = common(client, authServer, _signIn, oauthHttpOptions, void 0, joinedScopes);
   async function _signIn() {
     return makeTokenAndSaveRefresh(throwIfError(await oauth4webapi.processClientCredentialsResponse(authServer, client, await oauth4webapi.clientCredentialsGrantRequest(authServer, client, new URLSearchParams({
-      scope: scopes.join(" ")
+      scope: joinedScopes
     }), oauthHttpOptions))), "signIn");
   }
   return getToken;
@@ -157,10 +158,11 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
   const oauthHttpOptions = {
     [oauth4webapi.customFetch]: fetchFn
   };
+  let joinedScopes = [...scopes ?? ["api:read-data", "api:write-data"]].sort().join(" ");
   const {
     makeTokenAndSaveRefresh,
     getToken
-  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true));
+  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), joinedScopes);
   async function go(x) {
     if (useHistory) return window.history.replaceState({}, "", x);
     else window.location.assign(x);
@@ -169,12 +171,17 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
   }
   async function maybeRefresh(expectRefreshToken) {
     const {
-      refresh_token
+      refresh_token,
+      requestedScopes: initialRequestedScopes
     } = readLocal(client);
     if (!refresh_token) {
       if (expectRefreshToken) throw new Error("No refresh token found");
       return;
     }
+    if (!refresh_token || !(initialRequestedScopes != null && joinedScopes === initialRequestedScopes)) {
+      if (expectRefreshToken) throw new Error("No refresh token found");
+      return;
+    }
     try {
       return makeTokenAndSaveRefresh(throwIfError(await oauth4webapi.processAuthorizationCodeOAuth2Response(authServer, client, await oauth4webapi.refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), "refresh");
     } catch (e) {
@@ -227,7 +234,7 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
       redirect_uri: redirectUrl,
       code_challenge: await oauth4webapi.calculatePKCECodeChallenge(codeVerifier),
       code_challenge_method: "S256",
-      scope: ["offline_access", ...scopes].join(" ")
+      scope: `offline_access ${joinedScopes}`
     })}`);
     await delay__default.default(1e3);
     throw new Error("Unable to redirect");
@@ -240,5 +247,5 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
 
 exports.createConfidentialOauthClient = createConfidentialOauthClient;
 exports.createPublicOauthClient = createPublicOauthClient;
-//# sourceMappingURL=out.js.map
+//# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/build/cjs/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/createConfidentialOauthClient.ts","../../src/common.ts","../../src/throwIfError.ts","../../src/createPublicOauthClient.ts"],"names":["CustomEvent","getToken","customFetch"],"mappings":";AAgBA,SAAS,+BAA+B,aAAa,wCAAwC;;;ACA7F,SAAS,2BAA2B,yBAAyB;AAC7D,OAAO,eAAe;AACtB,SAAS,wBAAwB;;;ACFjC,SAAS,qBAAqB;AACvB,SAAS,aAAa,QAAQ;AACnC,MAAI,cAAc,MAAM,GAAG;AACzB,UAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,EACxD;AACA,SAAO;AACT;;;ADAA,IAAM,cAAc,QAAQ,IAAI,WAAW,YAAY,WAAW,cAAc,WAAW,eAAe,MAAMA,qBAAoB,MAAM;AAAA,EACxI;AAAA,EACA,YAAY,MAAM,SAAS;AACzB,UAAM,MAAM,OAAO;AACnB,SAAK,UAAU,SAAS,UAAU;AAAA,EACpC;AAAA,EACA,IAAI,SAAS;AACX,WAAO,KAAK;AAAA,EACd;AACF;AACA,IAAM,eAAe,WAAW;AACzB,SAAS,UAAU,QAAQ,GAAG;AAEnC,gBAAc,QAAQ,2BAA2B,OAAO,SAAS,IAAI,KAAK,UAAU,CAAC,CAAC;AACxF;AACO,SAAS,YAAY,QAAQ;AAElC,gBAAc,WAAW,2BAA2B,OAAO,SAAS,EAAE;AACxE;AACO,SAAS,UAAU,QAAQ;AAChC,SAAO,KAAK;AAAA;AAAA,IAEZ,cAAc,QAAQ,2BAA2B,OAAO,SAAS,EAAE,KAAK;AAAA,EAAI;AAC9E;AACO,SAAS,OAAO,QAAQ,IAAI,SAAS,kBAAkB,SAAS;AACrE,MAAI;AACJ,QAAM,cAAc,IAAI,iBAAiB;AACzC,WAAS,wBAAwB,MAAM,MAAM;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AACJ,MAAE,cAAc,QAAQ,QAAQ,IAAI,aAAa,eAAe,UAAU,KAAK,IAAI,UAAU,KAAK,IAAI;AACtG,cAAU,QAAQ;AAAA,MAChB;AAAA,IACF,CAAC;AACD,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY,KAAK,IAAI,IAAI,aAAa;AAAA,IACxC;AACA,gBAAY,mBAAmB,MAAM,IAAI,YAAY,MAAM;AAAA,MACzD,QAAQ;AAAA,IACV,CAAC,CAAC;AACF,WAAO;AAAA,EACT;AACA,MAAI;AACJ,WAAS,YAAY;AACnB,QAAI,eAAgB,cAAa,cAAc;AAAA,EACjD;AACA,WAAS,oBAAoB,KAAK;AAChC,QAAI,SAAS;AACX,gBAAU;AACV,uBAAiB,WAAW,SAAS,IAAI,OAAO,aAAa,MAAO,KAAK,GAAI;AAAA,IAC/E;AAAA,EACF;AACA,iBAAe,UAAU;AACvB,KAAC,QAAQ,QAAQ,IAAI,aAAa,eAAe,UAAU,OAAO,eAAe,IAAI,UAAU,KAAK,IAAI;AACxG,UAAM,SAAS,MAAM,0BAA0B,MAAM,kBAAkB,IAAI,QAAQ,MAAM,cAAc,gBAAgB,CAAC;AACxH,cAAU;AAGV,gBAAY,MAAM;AAClB,YAAQ;AACR,iBAAa,MAAM;AACnB,gBAAY,mBAAmB,WAAW,IAAI,MAAM,SAAS,CAAC;AAAA,EAChE;AACA,MAAI;AACJ,iBAAe,SAAS;AACtB,QAAI,eAAe;AACjB,aAAO;AAAA,IACT;AACA,QAAI;AACF,sBAAgB,QAAQ;AACxB,aAAO,MAAM;AAAA,IACf,UAAE;AACA,sBAAgB;AAAA,IAClB;AAAA,EACF;AACA,cAAY,iBAAiB,UAAU,mBAAmB;AAC1D,cAAY,iBAAiB,WAAW,mBAAmB;AAC3D,QAAM,WAAW,OAAO,OAAO,eAAeC,YAAW;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,KAAK,MAAM,YAAY;AAC5C,cAAQ,MAAM,OAAO;AAAA,IACvB;AACA,WAAO,MAAM;AAAA,EACf,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,YAAY,iBAAiB,KAAK,WAAW;AAAA,IAC/D,qBAAqB,YAAY,oBAAoB,KAAK,WAAW;AAAA,EACvE,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AACO,SAAS,0BAA0B,SAAS,KAAK;AACtD,QAAM,SAAS,GAAG,IAAI,IAAI,SAAS,GAAG,CAAC;AACvC,SAAO;AAAA,IACL,gBAAgB,GAAG,MAAM;AAAA,IACzB,wBAAwB,GAAG,MAAM;AAAA,IACjC,qBAAqB,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF;AACF;;;ADtGO,SAAS,8BAA8B,WAAW,eAAe,KAAK,SAAS,CAAC,iBAAiB,gBAAgB,GAAG,UAAU,WAAW,OAAO,UAAU,cAAc;AAC7K,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,0BAA0B,SAAS,GAAG;AACzD,QAAM,mBAAmB;AAAA,IACvB,CAAC,WAAW,GAAG;AAAA,EACjB;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF,IAAI,OAAO,QAAQ,YAAY,SAAS,kBAAkB,MAAS;AACnE,iBAAe,UAAU;AACvB,WAAO,wBAAwB,aAAa,MAAM,iCAAiC,YAAY,QAAQ,MAAM,8BAA8B,YAAY,QAAQ,IAAI,gBAAgB;AAAA,MACjL,OAAO,OAAO,KAAK,GAAG;AAAA,IACxB,CAAC,GAAG,gBAAgB,CAAC,CAAC,GAAG,QAAQ;AAAA,EACnC;AACA,SAAO;AACT;;;AGhCA,OAAO,WAAW;AAClB,SAAS,+BAA+B,4BAA4B,eAAAC,cAAa,4BAA4B,qBAAqB,wCAAwC,0BAA0B,4BAA4B;AAezN,SAAS,wBAAwB,WAAW,KAAK,aAAa,YAAY,WAAW,gBAAgB,OAAO,SAAS,SAAS,GAAG,SAAS,CAAC,iBAAiB,gBAAgB,GAAG,UAAU,WAAW,OAAO,UAAU,cAAc;AACxO,QAAM,SAAS;AAAA,IACb;AAAA,IACA,4BAA4B;AAAA,EAC9B;AACA,QAAM,aAAa,0BAA0B,SAAS,GAAG;AACzD,QAAM,mBAAmB;AAAA,IACvB,CAACA,YAAW,GAAG;AAAA,EACjB;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF,IAAI,OAAO,QAAQ,YAAY,SAAS,kBAAkB,aAAa,KAAK,YAAY,IAAI,CAAC;AAC7F,iBAAe,GAAG,GAAG;AACnB,QAAI,WAAY,QAAO,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,CAAC;AAAA,QAAO,QAAO,SAAS,OAAO,CAAC;AAC3F,UAAM,MAAM,GAAI;AAChB,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,iBAAe,aAAa,oBAAoB;AAC9C,UAAM;AAAA,MACJ;AAAA,IACF,IAAI,UAAU,MAAM;AACpB,QAAI,CAAC,eAAe;AAClB,UAAI,mBAAoB,OAAM,IAAI,MAAM,wBAAwB;AAChE;AAAA,IACF;AACA,QAAI;AAGF,aAAO,wBAAwB,aAAa,MAAM,uCAAuC,YAAY,QAAQ,MAAM,yBAAyB,YAAY,QAAQ,eAAe,gBAAgB,CAAC,CAAC,GAAG,SAAS;AAAA,IAC/M,SAAS,GAAG;AACV,UAAI,SAAS,KAAK,aAAa,cAAc;AAE3C,gBAAQ,KAAK,8DAA8D,CAAC;AAAA,MAC9E;AACA,kBAAY,MAAM;AAClB,UAAI,oBAAoB;AACtB,cAAM,IAAI,MAAM,yBAAyB;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACA,iBAAe,wBAAwB;AACrC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI,UAAU,MAAM;AACpB,QAAI,CAAC,aAAc;AACnB,QAAI;AACF,YAAM,MAAM,wBAAwB,aAAa,MAAM,uCAAuC,YAAY,QAAQ,MAAM,8BAA8B,YAAY,QAAQ,aAAa,qBAAqB,YAAY,QAAQ,IAAI,IAAI,OAAO,SAAS,IAAI,GAAG,KAAK,CAAC,GAAG,aAAa,cAAc,gBAAgB,CAAC,CAAC,GAAG,QAAQ;AAChU,SAAG,MAAM;AACT,aAAO;AAAA,IACT,SAAS,GAAG;AACV,UAAI,SAAS,KAAK,aAAa,cAAc;AAE3C,gBAAQ,KAAK,qFAAqF,CAAC;AAAA,MACrG;AACA,kBAAY,MAAM;AAAA,IACpB;AAAA,EACF;AACA,iBAAe,wBAAwB;AACrC,QAAI,aAAa,OAAO,SAAS,SAAS,WAAW;AACnD,gBAAU,QAAQ;AAAA,QAChB,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,MAAM,GAAG,SAAS;AAAA,IAC3B;AACA,UAAM,QAAQ,oBAAoB;AAClC,UAAM,eAAe,2BAA2B;AAChD,UAAM,SAAS,UAAU,MAAM,EAAE,UAAU,OAAO,SAAS,SAAS;AACpE,cAAU,QAAQ;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,WAAO,SAAS,OAAO,GAAG,WAAW,sBAAsB,IAAI,IAAI,gBAAgB;AAAA,MACjF;AAAA,MACA,eAAe;AAAA,MACf;AAAA,MACA,cAAc;AAAA,MACd,gBAAgB,MAAM,2BAA2B,YAAY;AAAA,MAC7D,uBAAuB;AAAA,MACvB,OAAO,CAAC,kBAAkB,GAAG,MAAM,EAAE,KAAK,GAAG;AAAA,IAC/C,CAAC,CAAC,EAAE;AAGJ,UAAM,MAAM,GAAI;AAChB,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAGA,iBAAe,UAAU;AAEvB,WAAQ,MAAM,aAAa,KAErB,MAAM,sBAAsB,KAE9B,MAAM,sBAAsB;AAAA,EAClC;AACA,SAAO;AACT","sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { clientCredentialsGrantRequest, customFetch, processClientCredentialsResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n\n/**\n * @param client_id\n * @param client_secret\n * @param url the base url of your foundry server\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns which can be used as a token provider\n */\nexport function createConfidentialOauthClient(client_id, client_secret, url, scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    client_secret\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const {\n    getToken,\n    makeTokenAndSaveRefresh\n  } = common(client, authServer, _signIn, oauthHttpOptions, undefined);\n  async function _signIn() {\n    return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({\n      scope: scopes.join(\" \")\n    }), oauthHttpOptions))), \"signIn\");\n  }\n  return getToken;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { processRevocationResponse, revocationRequest } from \"oauth4webapi\";\nimport invariant from \"tiny-invariant\";\nimport { TypedEventTarget } from \"typescript-event-target\";\nimport { throwIfError } from \"./throwIfError.js\";\n// Node 18 is supposed to have a `CustomEvent` but it is not exposed on `globalThis`\n// which creates a problem for making a single codebase for node and browser. This polyfill works around it\nconst CustomEvent = process.env.target === \"browser\" ? globalThis.CustomEvent : globalThis.CustomEvent ?? class CustomEvent extends Event {\n  #detail;\n  constructor(type, options) {\n    super(type, options);\n    this.#detail = options?.detail ?? null;\n  }\n  get detail() {\n    return this.#detail;\n  }\n};\nconst localStorage = globalThis.localStorage;\nexport function saveLocal(client, x) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));\n}\nexport function removeLocal(client) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);\n}\nexport function readLocal(client) {\n  return JSON.parse(\n  // MUST `localStorage?` as nodejs does not have localStorage\n  localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? \"{}\");\n}\nexport function common(client, as, _signIn, oauthHttpOptions, refresh) {\n  let token;\n  const eventTarget = new TypedEventTarget();\n  function makeTokenAndSaveRefresh(resp, type) {\n    const {\n      refresh_token,\n      expires_in,\n      access_token\n    } = resp;\n    !(expires_in != null) ? process.env.NODE_ENV !== \"production\" ? invariant(false) : invariant(false) : void 0;\n    saveLocal(client, {\n      refresh_token\n    });\n    token = {\n      refresh_token,\n      expires_in,\n      access_token,\n      expires_at: Date.now() + expires_in * 1000\n    };\n    eventTarget.dispatchTypedEvent(type, new CustomEvent(type, {\n      detail: token\n    }));\n    return token;\n  }\n  let refreshTimeout;\n  function rmTimeout() {\n    if (refreshTimeout) clearTimeout(refreshTimeout);\n  }\n  function restartRefreshTimer(evt) {\n    if (refresh) {\n      rmTimeout();\n      refreshTimeout = setTimeout(refresh, evt.detail.expires_in * 1000 - 60 * 1000);\n    }\n  }\n  async function signOut() {\n    !token ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"not signed in\") : invariant(false) : void 0;\n    const result = await processRevocationResponse(await revocationRequest(as, client, token.access_token, oauthHttpOptions));\n    rmTimeout();\n\n    // Clean up\n    removeLocal(client);\n    token = undefined;\n    throwIfError(result);\n    eventTarget.dispatchTypedEvent(\"signOut\", new Event(\"signOut\"));\n  }\n  let pendingSignIn;\n  async function signIn() {\n    if (pendingSignIn) {\n      return pendingSignIn;\n    }\n    try {\n      pendingSignIn = _signIn();\n      return await pendingSignIn;\n    } finally {\n      pendingSignIn = undefined;\n    }\n  }\n  eventTarget.addEventListener(\"signIn\", restartRefreshTimer);\n  eventTarget.addEventListener(\"refresh\", restartRefreshTimer);\n  const getToken = Object.assign(async function getToken() {\n    if (!token || Date.now() >= token.expires_at) {\n      token = await signIn();\n    }\n    return token.access_token;\n  }, {\n    signIn,\n    refresh,\n    signOut,\n    rmTimeout,\n    addEventListener: eventTarget.addEventListener.bind(eventTarget),\n    removeEventListener: eventTarget.removeEventListener.bind(eventTarget)\n  });\n  return {\n    getToken,\n    makeTokenAndSaveRefresh\n  };\n}\nexport function createAuthorizationServer(ctxPath, url) {\n  const issuer = `${new URL(ctxPath, url)}`;\n  return {\n    token_endpoint: `${issuer}/api/oauth2/token`,\n    authorization_endpoint: `${issuer}/api/oauth2/authorize`,\n    revocation_endpoint: `${issuer}/api/oauth2/revoke_token`,\n    issuer\n  };\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isOAuth2Error } from \"oauth4webapi\";\nexport function throwIfError(result) {\n  if (isOAuth2Error(result)) {\n    throw new Error(`Failed to get token: ${result.error}`);\n  }\n  return result;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport delay from \"delay\";\nimport { authorizationCodeGrantRequest, calculatePKCECodeChallenge, customFetch, generateRandomCodeVerifier, generateRandomState, processAuthorizationCodeOAuth2Response, refreshTokenGrantRequest, validateAuthResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer, readLocal, removeLocal, saveLocal } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n/**\n * @param client_id\n * @param url the base url of your foundry server\n * @param redirectUrl the url configured for redirect in the oauth configuration on the server\n * @param useHistory if true, when possible uses `history.replaceState()`, otherwise uses `window.location.assign()`\n * @param loginPage if you want a custom landing page prior to logging in, set this to that url\n * @param postLoginPage if you want to customize where you return to after a completed authentication cycle. defaults to the url when the page loaded\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns {PublicOauthClient} which can be used as a token provider\n */\nexport function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginPage, postLoginPage = window.location.toString(), scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    token_endpoint_auth_method: \"none\"\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const {\n    makeTokenAndSaveRefresh,\n    getToken\n  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true));\n  async function go(x) {\n    if (useHistory) return window.history.replaceState({}, \"\", x);else window.location.assign(x);\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n  async function maybeRefresh(expectRefreshToken) {\n    const {\n      refresh_token\n    } = readLocal(client);\n    if (!refresh_token) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    try {\n      // note, we don't use processRefreshTokenResponse because the mp oauth implementation\n      // doesn't do refresh tokens quite right and this lets us skip the id check\n      return makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), \"refresh\");\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 refresh token. Removing refresh token\", e);\n      }\n      removeLocal(client);\n      if (expectRefreshToken) {\n        throw new Error(\"Could not refresh token\");\n      }\n    }\n  }\n  async function maybeHandleAuthReturn() {\n    const {\n      codeVerifier,\n      state,\n      oldUrl\n    } = readLocal(client);\n    if (!codeVerifier) return;\n    try {\n      const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirectUrl, codeVerifier, oauthHttpOptions))), \"signIn\");\n      go(oldUrl);\n      return ret;\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow\", e);\n      }\n      removeLocal(client);\n    }\n  }\n  async function initiateLoginRedirect() {\n    if (loginPage && window.location.href !== loginPage) {\n      saveLocal(client, {\n        oldUrl: postLoginPage\n      });\n      return await go(loginPage);\n    }\n    const state = generateRandomState();\n    const codeVerifier = generateRandomCodeVerifier();\n    const oldUrl = readLocal(client).oldUrl ?? window.location.toString();\n    saveLocal(client, {\n      codeVerifier,\n      state,\n      oldUrl\n    });\n    window.location.assign(`${authServer.authorization_endpoint}?${new URLSearchParams({\n      client_id,\n      response_type: \"code\",\n      state,\n      redirect_uri: redirectUrl,\n      code_challenge: await calculatePKCECodeChallenge(codeVerifier),\n      code_challenge_method: \"S256\",\n      scope: [\"offline_access\", ...scopes].join(\" \")\n    })}`);\n\n    // Give time for redirect to happen\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n\n  /** Will throw if there is no token! */\n  async function _signIn() {\n    // 1. Check if we have a refresh token in local storage\n    return (await maybeRefresh()\n    // 2. If there is no refresh token we are likely trying to perform the callback\n    ) ?? (await maybeHandleAuthReturn())\n    // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request\n    ?? (await initiateLoginRedirect());\n  }\n  return getToken;\n}"]}
+{"version":3,"sources":["../../src/throwIfError.ts","../../src/common.ts","../../src/createConfidentialOauthClient.ts","../../src/createPublicOauthClient.ts"],"names":["isOAuth2Error","CustomEvent","TypedEventTarget","invariant","processRevocationResponse","revocationRequest","getToken","customFetch","processClientCredentialsResponse","clientCredentialsGrantRequest","delay","processAuthorizationCodeOAuth2Response","refreshTokenGrantRequest","authorizationCodeGrantRequest","validateAuthResponse","generateRandomState","generateRandomCodeVerifier","calculatePKCECodeChallenge"],"mappings":";;;;;;;;;;;;;AAiBO,SAAS,aAAa,MAAQ,EAAA;AACnC,EAAI,IAAAA,0BAAA,CAAc,MAAM,CAAG,EAAA;AACzB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAwB,qBAAA,EAAA,MAAA,CAAO,KAAK,CAAE,CAAA,CAAA,CAAA;AAAA,GACxD;AACA,EAAO,OAAA,MAAA,CAAA;AACT,CAAA;;;ACAA,IAAM,WAAA,GAAc,OAAQ,CAAA,GAAA,CAAI,MAAW,KAAA,SAAA,GAAY,UAAW,CAAA,WAAA,GAAc,UAAW,CAAA,WAAA,IAAe,MAAMC,YAAAA,SAAoB,KAAM,CAAA;AAAA,EACxI,OAAA,CAAA;AAAA,EACA,WAAA,CAAY,MAAM,OAAS,EAAA;AACzB,IAAA,KAAA,CAAM,MAAM,OAAO,CAAA,CAAA;AACnB,IAAK,IAAA,CAAA,OAAA,GAAU,SAAS,MAAU,IAAA,IAAA,CAAA;AAAA,GACpC;AAAA,EACA,IAAI,MAAS,GAAA;AACX,IAAA,OAAO,IAAK,CAAA,OAAA,CAAA;AAAA,GACd;AACF,CAAA,CAAA;AACO,SAAS,SAAA,CAAU,QAAQ,CAAG,EAAA;AAEnC,EAAW,UAAA,CAAA,YAAA,EAAc,QAAQ,CAA2B,wBAAA,EAAA,MAAA,CAAO,SAAS,CAAI,CAAA,EAAA,IAAA,CAAK,SAAU,CAAA,CAAC,CAAC,CAAA,CAAA;AACnG,CAAA;AACO,SAAS,YAAY,MAAQ,EAAA;AAElC,EAAA,UAAA,CAAW,YAAc,EAAA,UAAA,CAAW,CAA2B,wBAAA,EAAA,MAAA,CAAO,SAAS,CAAE,CAAA,CAAA,CAAA;AACnF,CAAA;AACO,SAAS,UAAU,MAAQ,EAAA;AAChC,EAAA,OAAO,IAAK,CAAA,KAAA;AAAA;AAAA,IAEZ,WAAW,YAAc,EAAA,OAAA,CAAQ,2BAA2B,MAAO,CAAA,SAAS,EAAE,CAAK,IAAA,IAAA;AAAA,GAAI,CAAA;AACzF,CAAA;AACO,SAAS,OAAO,MAAQ,EAAA,EAAA,EAAI,OAAS,EAAA,gBAAA,EAAkB,SAAS,MAAQ,EAAA;AAC7E,EAAI,IAAA,KAAA,CAAA;AACJ,EAAM,MAAA,WAAA,GAAc,IAAIC,sCAAiB,EAAA,CAAA;AACzC,EAAS,SAAA,uBAAA,CAAwB,MAAM,IAAM,EAAA;AAC3C,IAAM,MAAA;AAAA,MACJ,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,KACE,GAAA,IAAA,CAAA;AACJ,IAAE,EAAA,UAAA,IAAc,IAAQ,CAAA,GAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,KAAa,YAAe,GAAAC,0BAAA,CAAU,KAAK,CAAA,GAAIA,0BAAU,CAAA,KAAK,CAAI,GAAA,KAAA,CAAA,CAAA;AACtG,IAAA,SAAA,CAAU,MAAQ,EAAA;AAAA,MAChB,aAAA;AAAA,MACA,eAAiB,EAAA,MAAA;AAAA,KAClB,CAAA,CAAA;AACD,IAAQ,KAAA,GAAA;AAAA,MACN,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA,UAAY,EAAA,IAAA,CAAK,GAAI,EAAA,GAAI,UAAa,GAAA,GAAA;AAAA,KACxC,CAAA;AACA,IAAA,WAAA,CAAY,kBAAmB,CAAA,IAAA,EAAM,IAAI,WAAA,CAAY,IAAM,EAAA;AAAA,MACzD,MAAQ,EAAA,KAAA;AAAA,KACT,CAAC,CAAA,CAAA;AACF,IAAO,OAAA,KAAA,CAAA;AAAA,GACT;AACA,EAAI,IAAA,cAAA,CAAA;AACJ,EAAA,SAAS,SAAY,GAAA;AACnB,IAAI,IAAA,cAAA,eAA6B,cAAc,CAAA,CAAA;AAAA,GACjD;AACA,EAAA,SAAS,oBAAoB,GAAK,EAAA;AAChC,IAAA,IAAI,OAAS,EAAA;AACX,MAAU,SAAA,EAAA,CAAA;AACV,MAAA,cAAA,GAAiB,WAAW,OAAS,EAAA,GAAA,CAAI,OAAO,UAAa,GAAA,GAAA,GAAO,KAAK,GAAI,CAAA,CAAA;AAAA,KAC/E;AAAA,GACF;AACA,EAAA,eAAe,OAAU,GAAA;AACvB,IAAC,CAAA,KAAA,GAAQ,OAAQ,CAAA,GAAA,CAAI,QAAa,KAAA,YAAA,GAAeA,0BAAU,CAAA,KAAA,EAAO,eAAe,CAAA,GAAIA,0BAAU,CAAA,KAAK,CAAI,GAAA,KAAA,CAAA,CAAA;AACxG,IAAM,MAAA,MAAA,GAAS,MAAMC,sCAAA,CAA0B,MAAMC,8BAAA,CAAkB,IAAI,MAAQ,EAAA,KAAA,CAAM,YAAc,EAAA,gBAAgB,CAAC,CAAA,CAAA;AACxH,IAAU,SAAA,EAAA,CAAA;AAGV,IAAA,WAAA,CAAY,MAAM,CAAA,CAAA;AAClB,IAAQ,KAAA,GAAA,KAAA,CAAA,CAAA;AACR,IAAA,YAAA,CAAa,MAAM,CAAA,CAAA;AACnB,IAAA,WAAA,CAAY,kBAAmB,CAAA,SAAA,EAAW,IAAI,KAAA,CAAM,SAAS,CAAC,CAAA,CAAA;AAAA,GAChE;AACA,EAAI,IAAA,aAAA,CAAA;AACJ,EAAA,eAAe,MAAS,GAAA;AACtB,IAAA,IAAI,aAAe,EAAA;AACjB,MAAO,OAAA,aAAA,CAAA;AAAA,KACT;AACA,IAAI,IAAA;AACF,MAAA,aAAA,GAAgB,OAAQ,EAAA,CAAA;AACxB,MAAA,OAAO,MAAM,aAAA,CAAA;AAAA,KACb,SAAA;AACA,MAAgB,aAAA,GAAA,KAAA,CAAA,CAAA;AAAA,KAClB;AAAA,GACF;AACA,EAAY,WAAA,CAAA,gBAAA,CAAiB,UAAU,mBAAmB,CAAA,CAAA;AAC1D,EAAY,WAAA,CAAA,gBAAA,CAAiB,WAAW,mBAAmB,CAAA,CAAA;AAC3D,EAAA,MAAM,QAAW,GAAA,MAAA,CAAO,MAAO,CAAA,eAAeC,SAAW,GAAA;AACvD,IAAA,IAAI,CAAC,KAAS,IAAA,IAAA,CAAK,GAAI,EAAA,IAAK,MAAM,UAAY,EAAA;AAC5C,MAAA,KAAA,GAAQ,MAAM,MAAO,EAAA,CAAA;AAAA,KACvB;AACA,IAAA,OAAO,KAAM,CAAA,YAAA,CAAA;AAAA,GACZ,EAAA;AAAA,IACD,MAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAkB,EAAA,WAAA,CAAY,gBAAiB,CAAA,IAAA,CAAK,WAAW,CAAA;AAAA,IAC/D,mBAAqB,EAAA,WAAA,CAAY,mBAAoB,CAAA,IAAA,CAAK,WAAW,CAAA;AAAA,GACtE,CAAA,CAAA;AACD,EAAO,OAAA;AAAA,IACL,QAAA;AAAA,IACA,uBAAA;AAAA,GACF,CAAA;AACF,CAAA;AACO,SAAS,yBAAA,CAA0B,SAAS,GAAK,EAAA;AACtD,EAAA,MAAM,SAAS,CAAG,EAAA,IAAI,GAAI,CAAA,OAAA,EAAS,GAAG,CAAC,CAAA,CAAA,CAAA;AACvC,EAAO,OAAA;AAAA,IACL,cAAA,EAAgB,GAAG,MAAM,CAAA,iBAAA,CAAA;AAAA,IACzB,sBAAA,EAAwB,GAAG,MAAM,CAAA,qBAAA,CAAA;AAAA,IACjC,mBAAA,EAAqB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IAC9B,MAAA;AAAA,GACF,CAAA;AACF,CAAA;;;ACtGO,SAAS,6BAA8B,CAAA,SAAA,EAAW,aAAe,EAAA,GAAA,EAAK,MAAS,GAAA,CAAC,eAAiB,EAAA,gBAAgB,CAAG,EAAA,OAAA,GAAU,UAAW,CAAA,KAAA,EAAO,UAAU,YAAc,EAAA;AAC7K,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,SAAA;AAAA,IACA,aAAA;AAAA,GACF,CAAA;AACA,EAAM,MAAA,UAAA,GAAa,yBAA0B,CAAA,OAAA,EAAS,GAAG,CAAA,CAAA;AACzD,EAAA,MAAM,gBAAmB,GAAA;AAAA,IACvB,CAACC,wBAAW,GAAG,OAAA;AAAA,GACjB,CAAA;AACA,EAAM,MAAA,YAAA,GAAe,MAAO,CAAA,IAAA,CAAK,GAAG,CAAA,CAAA;AACpC,EAAM,MAAA;AAAA,IACJ,QAAA;AAAA,IACA,uBAAA;AAAA,MACE,MAAO,CAAA,MAAA,EAAQ,YAAY,OAAS,EAAA,gBAAA,EAAkB,QAAW,YAAY,CAAA,CAAA;AACjF,EAAA,eAAe,OAAU,GAAA;AACvB,IAAO,OAAA,uBAAA,CAAwB,YAAa,CAAA,MAAMC,6CAAiC,CAAA,UAAA,EAAY,MAAQ,EAAA,MAAMC,0CAA8B,CAAA,UAAA,EAAY,MAAQ,EAAA,IAAI,eAAgB,CAAA;AAAA,MACjL,KAAO,EAAA,YAAA;AAAA,KACR,CAAG,EAAA,gBAAgB,CAAC,CAAC,GAAG,QAAQ,CAAA,CAAA;AAAA,GACnC;AACA,EAAO,OAAA,QAAA,CAAA;AACT,CAAA;ACjBO,SAAS,uBAAA,CAAwB,WAAW,GAAK,EAAA,WAAA,EAAa,YAAY,SAAW,EAAA,aAAA,GAAgB,OAAO,QAAS,CAAA,QAAA,IAAY,MAAS,GAAA,CAAC,iBAAiB,gBAAgB,CAAA,EAAG,UAAU,UAAW,CAAA,KAAA,EAAO,UAAU,YAAc,EAAA;AACxO,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,SAAA;AAAA,IACA,0BAA4B,EAAA,MAAA;AAAA,GAC9B,CAAA;AACA,EAAM,MAAA,UAAA,GAAa,yBAA0B,CAAA,OAAA,EAAS,GAAG,CAAA,CAAA;AACzD,EAAA,MAAM,gBAAmB,GAAA;AAAA,IACvB,CAACF,wBAAW,GAAG,OAAA;AAAA,GACjB,CAAA;AACA,EAAA,IAAI,YAAe,GAAA,CAAC,GAAI,MAAA,IAAU,CAAC,eAAA,EAAiB,gBAAgB,CAAE,CAAE,CAAA,IAAA,EAAO,CAAA,IAAA,CAAK,GAAG,CAAA,CAAA;AACvF,EAAM,MAAA;AAAA,IACJ,uBAAA;AAAA,IACA,QAAA;AAAA,GACF,GAAI,MAAO,CAAA,MAAA,EAAQ,UAAY,EAAA,OAAA,EAAS,gBAAkB,EAAA,YAAA,CAAa,IAAK,CAAA,UAAA,EAAY,IAAI,CAAA,EAAG,YAAY,CAAA,CAAA;AAC3G,EAAA,eAAe,GAAG,CAAG,EAAA;AACnB,IAAI,IAAA,UAAA,SAAmB,MAAO,CAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,CAAC,CAAA,CAAA;AAAA,SAAO,MAAA,CAAO,QAAS,CAAA,MAAA,CAAO,CAAC,CAAA,CAAA;AAC3F,IAAA,MAAMG,uBAAM,GAAI,CAAA,CAAA;AAChB,IAAM,MAAA,IAAI,MAAM,oBAAoB,CAAA,CAAA;AAAA,GACtC;AACA,EAAA,eAAe,aAAa,kBAAoB,EAAA;AAC9C,IAAM,MAAA;AAAA,MACJ,aAAA;AAAA,MACA,eAAiB,EAAA,sBAAA;AAAA,KACnB,GAAI,UAAU,MAAM,CAAA,CAAA;AACpB,IAAA,IAAI,CAAC,aAAe,EAAA;AAClB,MAAA,IAAI,kBAAoB,EAAA,MAAM,IAAI,KAAA,CAAM,wBAAwB,CAAA,CAAA;AAChE,MAAA,OAAA;AAAA,KACF;AACA,IAAA,IAAI,CAAC,aAAiB,IAAA,EAAE,sBAA0B,IAAA,IAAA,IAAQ,iBAAiB,sBAAyB,CAAA,EAAA;AAClG,MAAA,IAAI,kBAAoB,EAAA,MAAM,IAAI,KAAA,CAAM,wBAAwB,CAAA,CAAA;AAChE,MAAA,OAAA;AAAA,KACF;AACA,IAAI,IAAA;AAGF,MAAA,OAAO,uBAAwB,CAAA,YAAA,CAAa,MAAMC,mDAAA,CAAuC,YAAY,MAAQ,EAAA,MAAMC,qCAAyB,CAAA,UAAA,EAAY,QAAQ,aAAe,EAAA,gBAAgB,CAAC,CAAC,GAAG,SAAS,CAAA,CAAA;AAAA,aACtM,CAAG,EAAA;AACV,MAAI,IAAA,OAAA,EAAS,GAAK,EAAA,QAAA,KAAa,YAAc,EAAA;AAE3C,QAAQ,OAAA,CAAA,IAAA,CAAK,8DAA8D,CAAC,CAAA,CAAA;AAAA,OAC9E;AACA,MAAA,WAAA,CAAY,MAAM,CAAA,CAAA;AAClB,MAAA,IAAI,kBAAoB,EAAA;AACtB,QAAM,MAAA,IAAI,MAAM,yBAAyB,CAAA,CAAA;AAAA,OAC3C;AAAA,KACF;AAAA,GACF;AACA,EAAA,eAAe,qBAAwB,GAAA;AACrC,IAAM,MAAA;AAAA,MACJ,YAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,KACF,GAAI,UAAU,MAAM,CAAA,CAAA;AACpB,IAAA,IAAI,CAAC,YAAc,EAAA,OAAA;AACnB,IAAI,IAAA;AACF,MAAA,MAAM,GAAM,GAAA,uBAAA,CAAwB,YAAa,CAAA,MAAMD,mDAAuC,CAAA,UAAA,EAAY,MAAQ,EAAA,MAAME,0CAA8B,CAAA,UAAA,EAAY,MAAQ,EAAA,YAAA,CAAaC,kCAAqB,UAAY,EAAA,MAAA,EAAQ,IAAI,GAAA,CAAI,MAAO,CAAA,QAAA,CAAS,IAAI,CAAA,EAAG,KAAK,CAAC,CAAG,EAAA,WAAA,EAAa,YAAc,EAAA,gBAAgB,CAAC,CAAC,GAAG,QAAQ,CAAA,CAAA;AAChU,MAAA,EAAA,CAAG,MAAM,CAAA,CAAA;AACT,MAAO,OAAA,GAAA,CAAA;AAAA,aACA,CAAG,EAAA;AACV,MAAI,IAAA,OAAA,EAAS,GAAK,EAAA,QAAA,KAAa,YAAc,EAAA;AAE3C,QAAQ,OAAA,CAAA,IAAA,CAAK,qFAAqF,CAAC,CAAA,CAAA;AAAA,OACrG;AACA,MAAA,WAAA,CAAY,MAAM,CAAA,CAAA;AAAA,KACpB;AAAA,GACF;AACA,EAAA,eAAe,qBAAwB,GAAA;AACrC,IAAA,IAAI,SAAa,IAAA,MAAA,CAAO,QAAS,CAAA,IAAA,KAAS,SAAW,EAAA;AACnD,MAAA,SAAA,CAAU,MAAQ,EAAA;AAAA,QAChB,MAAQ,EAAA,aAAA;AAAA,OACT,CAAA,CAAA;AACD,MAAO,OAAA,MAAM,GAAG,SAAS,CAAA,CAAA;AAAA,KAC3B;AACA,IAAA,MAAM,QAAQC,gCAAoB,EAAA,CAAA;AAClC,IAAA,MAAM,eAAeC,uCAA2B,EAAA,CAAA;AAChD,IAAA,MAAM,SAAS,SAAU,CAAA,MAAM,EAAE,MAAU,IAAA,MAAA,CAAO,SAAS,QAAS,EAAA,CAAA;AACpE,IAAA,SAAA,CAAU,MAAQ,EAAA;AAAA,MAChB,YAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,KACD,CAAA,CAAA;AACD,IAAA,MAAA,CAAO,SAAS,MAAO,CAAA,CAAA,EAAG,WAAW,sBAAsB,CAAA,CAAA,EAAI,IAAI,eAAgB,CAAA;AAAA,MACjF,SAAA;AAAA,MACA,aAAe,EAAA,MAAA;AAAA,MACf,KAAA;AAAA,MACA,YAAc,EAAA,WAAA;AAAA,MACd,cAAA,EAAgB,MAAMC,uCAAA,CAA2B,YAAY,CAAA;AAAA,MAC7D,qBAAuB,EAAA,MAAA;AAAA,MACvB,KAAA,EAAO,kBAAkB,YAAY,CAAA,CAAA;AAAA,KACtC,CAAC,CAAE,CAAA,CAAA,CAAA;AAGJ,IAAA,MAAMP,uBAAM,GAAI,CAAA,CAAA;AAChB,IAAM,MAAA,IAAI,MAAM,oBAAoB,CAAA,CAAA;AAAA,GACtC;AAGA,EAAA,eAAe,OAAU,GAAA;AAEvB,IAAA,OAAQ,MAAM,YAAa,EAAA,IAErB,MAAM,qBAAsB,EAAA,IAE9B,MAAM,qBAAsB,EAAA,CAAA;AAAA,GAClC;AACA,EAAO,OAAA,QAAA,CAAA;AACT","file":"index.cjs","sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isOAuth2Error } from \"oauth4webapi\";\nexport function throwIfError(result) {\n  if (isOAuth2Error(result)) {\n    throw new Error(`Failed to get token: ${result.error}`);\n  }\n  return result;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { processRevocationResponse, revocationRequest } from \"oauth4webapi\";\nimport invariant from \"tiny-invariant\";\nimport { TypedEventTarget } from \"typescript-event-target\";\nimport { throwIfError } from \"./throwIfError.js\";\n// Node 18 is supposed to have a `CustomEvent` but it is not exposed on `globalThis`\n// which creates a problem for making a single codebase for node and browser. This polyfill works around it\nconst CustomEvent = process.env.target === \"browser\" ? globalThis.CustomEvent : globalThis.CustomEvent ?? class CustomEvent extends Event {\n  #detail;\n  constructor(type, options) {\n    super(type, options);\n    this.#detail = options?.detail ?? null;\n  }\n  get detail() {\n    return this.#detail;\n  }\n};\nexport function saveLocal(client, x) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  globalThis.localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));\n}\nexport function removeLocal(client) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  globalThis.localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);\n}\nexport function readLocal(client) {\n  return JSON.parse(\n  // MUST `localStorage?` as nodejs does not have localStorage\n  globalThis.localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? \"{}\");\n}\nexport function common(client, as, _signIn, oauthHttpOptions, refresh, scopes) {\n  let token;\n  const eventTarget = new TypedEventTarget();\n  function makeTokenAndSaveRefresh(resp, type) {\n    const {\n      refresh_token,\n      expires_in,\n      access_token\n    } = resp;\n    !(expires_in != null) ? process.env.NODE_ENV !== \"production\" ? invariant(false) : invariant(false) : void 0;\n    saveLocal(client, {\n      refresh_token,\n      requestedScopes: scopes\n    });\n    token = {\n      refresh_token,\n      expires_in,\n      access_token,\n      expires_at: Date.now() + expires_in * 1000\n    };\n    eventTarget.dispatchTypedEvent(type, new CustomEvent(type, {\n      detail: token\n    }));\n    return token;\n  }\n  let refreshTimeout;\n  function rmTimeout() {\n    if (refreshTimeout) clearTimeout(refreshTimeout);\n  }\n  function restartRefreshTimer(evt) {\n    if (refresh) {\n      rmTimeout();\n      refreshTimeout = setTimeout(refresh, evt.detail.expires_in * 1000 - 60 * 1000);\n    }\n  }\n  async function signOut() {\n    !token ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"not signed in\") : invariant(false) : void 0;\n    const result = await processRevocationResponse(await revocationRequest(as, client, token.access_token, oauthHttpOptions));\n    rmTimeout();\n\n    // Clean up\n    removeLocal(client);\n    token = undefined;\n    throwIfError(result);\n    eventTarget.dispatchTypedEvent(\"signOut\", new Event(\"signOut\"));\n  }\n  let pendingSignIn;\n  async function signIn() {\n    if (pendingSignIn) {\n      return pendingSignIn;\n    }\n    try {\n      pendingSignIn = _signIn();\n      return await pendingSignIn;\n    } finally {\n      pendingSignIn = undefined;\n    }\n  }\n  eventTarget.addEventListener(\"signIn\", restartRefreshTimer);\n  eventTarget.addEventListener(\"refresh\", restartRefreshTimer);\n  const getToken = Object.assign(async function getToken() {\n    if (!token || Date.now() >= token.expires_at) {\n      token = await signIn();\n    }\n    return token.access_token;\n  }, {\n    signIn,\n    refresh,\n    signOut,\n    rmTimeout,\n    addEventListener: eventTarget.addEventListener.bind(eventTarget),\n    removeEventListener: eventTarget.removeEventListener.bind(eventTarget)\n  });\n  return {\n    getToken,\n    makeTokenAndSaveRefresh\n  };\n}\nexport function createAuthorizationServer(ctxPath, url) {\n  const issuer = `${new URL(ctxPath, url)}`;\n  return {\n    token_endpoint: `${issuer}/api/oauth2/token`,\n    authorization_endpoint: `${issuer}/api/oauth2/authorize`,\n    revocation_endpoint: `${issuer}/api/oauth2/revoke_token`,\n    issuer\n  };\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { clientCredentialsGrantRequest, customFetch, processClientCredentialsResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n\n/**\n * @param client_id\n * @param client_secret\n * @param url the base url of your foundry server\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns which can be used as a token provider\n */\nexport function createConfidentialOauthClient(client_id, client_secret, url, scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    client_secret\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const joinedScopes = scopes.join(\" \");\n  const {\n    getToken,\n    makeTokenAndSaveRefresh\n  } = common(client, authServer, _signIn, oauthHttpOptions, undefined, joinedScopes);\n  async function _signIn() {\n    return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({\n      scope: joinedScopes\n    }), oauthHttpOptions))), \"signIn\");\n  }\n  return getToken;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport delay from \"delay\";\nimport { authorizationCodeGrantRequest, calculatePKCECodeChallenge, customFetch, generateRandomCodeVerifier, generateRandomState, processAuthorizationCodeOAuth2Response, refreshTokenGrantRequest, validateAuthResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer, readLocal, removeLocal, saveLocal } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n/**\n * @param client_id\n * @param url the base url of your foundry server\n * @param redirectUrl the url configured for redirect in the oauth configuration on the server\n * @param useHistory if true, when possible uses `history.replaceState()`, otherwise uses `window.location.assign()`\n * @param loginPage if you want a custom landing page prior to logging in, set this to that url\n * @param postLoginPage if you want to customize where you return to after a completed authentication cycle. defaults to the url when the page loaded\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns {PublicOauthClient} which can be used as a token provider\n */\nexport function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginPage, postLoginPage = window.location.toString(), scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    token_endpoint_auth_method: \"none\"\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  let joinedScopes = [...(scopes ?? [\"api:read-data\", \"api:write-data\"])].sort().join(\" \");\n  const {\n    makeTokenAndSaveRefresh,\n    getToken\n  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), joinedScopes);\n  async function go(x) {\n    if (useHistory) return window.history.replaceState({}, \"\", x);else window.location.assign(x);\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n  async function maybeRefresh(expectRefreshToken) {\n    const {\n      refresh_token,\n      requestedScopes: initialRequestedScopes\n    } = readLocal(client);\n    if (!refresh_token) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    if (!refresh_token || !(initialRequestedScopes != null && joinedScopes === initialRequestedScopes)) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    try {\n      // note, we don't use processRefreshTokenResponse because the mp oauth implementation\n      // doesn't do refresh tokens quite right and this lets us skip the id check\n      return makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), \"refresh\");\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 refresh token. Removing refresh token\", e);\n      }\n      removeLocal(client);\n      if (expectRefreshToken) {\n        throw new Error(\"Could not refresh token\");\n      }\n    }\n  }\n  async function maybeHandleAuthReturn() {\n    const {\n      codeVerifier,\n      state,\n      oldUrl\n    } = readLocal(client);\n    if (!codeVerifier) return;\n    try {\n      const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirectUrl, codeVerifier, oauthHttpOptions))), \"signIn\");\n      go(oldUrl);\n      return ret;\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow\", e);\n      }\n      removeLocal(client);\n    }\n  }\n  async function initiateLoginRedirect() {\n    if (loginPage && window.location.href !== loginPage) {\n      saveLocal(client, {\n        oldUrl: postLoginPage\n      });\n      return await go(loginPage);\n    }\n    const state = generateRandomState();\n    const codeVerifier = generateRandomCodeVerifier();\n    const oldUrl = readLocal(client).oldUrl ?? window.location.toString();\n    saveLocal(client, {\n      codeVerifier,\n      state,\n      oldUrl\n    });\n    window.location.assign(`${authServer.authorization_endpoint}?${new URLSearchParams({\n      client_id,\n      response_type: \"code\",\n      state,\n      redirect_uri: redirectUrl,\n      code_challenge: await calculatePKCECodeChallenge(codeVerifier),\n      code_challenge_method: \"S256\",\n      scope: `offline_access ${joinedScopes}`\n    })}`);\n\n    // Give time for redirect to happen\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n\n  /** Will throw if there is no token! */\n  async function _signIn() {\n    // 1. Check if we have a refresh token in local storage\n    return (await maybeRefresh()\n    // 2. If there is no refresh token we are likely trying to perform the callback\n    ) ?? (await maybeHandleAuthReturn())\n    // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request\n    ?? (await initiateLoginRedirect());\n  }\n  return getToken;\n}"]}

package/build/esm/common.d.ts

@@ -6,26 +6,30 @@ type LocalStorageState = {
     codeVerifier?: never;
     state?: never;
     oldUrl: string;
+    requestedScopes?: string;
 } | {
     refresh_token?: never;
     codeVerifier: string;
     state: string;
     oldUrl: string;
+    requestedScopes?: string;
 } | {
     refresh_token?: string;
     codeVerifier?: never;
     state?: never;
     oldUrl?: never;
+    requestedScopes?: string;
 } | {
     refresh_token?: never;
     codeVerifier?: never;
     state?: never;
     oldUrl?: never;
+    requestedScopes?: string;
 };
 export declare function saveLocal(client: Client, x: LocalStorageState): void;
 export declare function removeLocal(client: Client): void;
 export declare function readLocal(client: Client): LocalStorageState;
-export declare function common<R extends undefined | (() => Promise<Token | undefined>)>(client: Client, as: AuthorizationServer, _signIn: () => Promise<Token>, oauthHttpOptions: HttpRequestOptions, refresh: R): {
+export declare function common<R extends undefined | (() => Promise<Token | undefined>)>(client: Client, as: AuthorizationServer, _signIn: () => Promise<Token>, oauthHttpOptions: HttpRequestOptions, refresh: R, scopes: string): {
     getToken: BaseOauthClient<keyof Events & string> & {
         refresh: R;
     };

package/build/esm/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/common.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,mBAAmB,EACnB,MAAM,EACN,kBAAkB,EAClB,2BAA2B,EAC5B,MAAM,cAAc,CAAC;AAItB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AA0BxC,KAAK,iBAAiB,GAElB;IACA,aAAa,CAAC,EAAE,KAAK,CAAC;IACtB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAEC;IACA,aAAa,CAAC,EAAE,KAAK,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAEC;IACA,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB,GACC;IACA,aAAa,CAAC,EAAE,KAAK,CAAC;IACtB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB,CAAC;AAEJ,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,QAM7D;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,QAGzC;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAM3D;AAED,wBAAgB,MAAM,CACpB,CAAC,SAAS,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,EAExD,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,mBAAmB,EACvB,OAAO,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,EAC7B,gBAAgB,EAAE,kBAAkB,EACpC,OAAO,EAAE,CAAC,GACT;IACD,QAAQ,EAAE,eAAe,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IAClE,uBAAuB,EAAE,CACvB,IAAI,EAAE,2BAA2B,EACjC,IAAI,EAAE,QAAQ,GAAG,SAAS,KACvB,KAAK,CAAC;CACZ,CAkGA;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,QAAQ,CACT,IAAI,CACF,mBAAmB,EACjB,QAAQ,GACR,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,CACxB,CACF,CAQA"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/common.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,mBAAmB,EACnB,MAAM,EACN,kBAAkB,EAClB,2BAA2B,EAC5B,MAAM,cAAc,CAAC;AAItB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAwBxC,KAAK,iBAAiB,GAElB;IACA,aAAa,CAAC,EAAE,KAAK,CAAC;IACtB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IAGf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAEC;IACA,aAAa,CAAC,EAAE,KAAK,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAEC;IACA,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACC;IACA,aAAa,CAAC,EAAE,KAAK,CAAC;IACtB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEJ,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,QAM7D;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,QAKzC;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAQ3D;AAED,wBAAgB,MAAM,CACpB,CAAC,SAAS,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,EAExD,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,mBAAmB,EACvB,OAAO,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,EAC7B,gBAAgB,EAAE,kBAAkB,EACpC,OAAO,EAAE,CAAC,EACV,MAAM,EAAE,MAAM,GACb;IACD,QAAQ,EAAE,eAAe,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IAClE,uBAAuB,EAAE,CACvB,IAAI,EAAE,2BAA2B,EACjC,IAAI,EAAE,QAAQ,GAAG,SAAS,KACvB,KAAK,CAAC;CACZ,CAkGA;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,QAAQ,CACT,IAAI,CACF,mBAAmB,EACjB,QAAQ,GACR,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,CACxB,CACF,CAQA"}

package/build/esm/common.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=common.test.d.ts.map

package/build/esm/common.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.test.d.ts","sourceRoot":"","sources":["../../src/common.test.ts"],"names":[],"mappings":""}

package/build/esm/createConfidentialOauthClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createConfidentialOauthClient.d.ts","sourceRoot":"","sources":["../../src/createConfidentialOauthClient.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAG5E;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,EAAwC,EACtD,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,EACnD,OAAO,GAAE,MAAqB,GAC7B,uBAAuB,CAgCzB"}
+{"version":3,"file":"createConfidentialOauthClient.d.ts","sourceRoot":"","sources":["../../src/createConfidentialOauthClient.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAG5E;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,EAAwC,EACtD,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,EACnD,OAAO,GAAE,MAAqB,GAC7B,uBAAuB,CAkCzB"}

package/build/esm/createPublicOauthClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createPublicOauthClient.d.ts","sourceRoot":"","sources":["../../src/createPublicOauthClient.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAUhE;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,OAAO,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,GAAE,MAAmC,EAClD,MAAM,GAAE,MAAM,EAAwC,EACtD,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,EACnD,OAAO,GAAE,MAAqB,GAC7B,iBAAiB,CAiJnB"}
+{"version":3,"file":"createPublicOauthClient.d.ts","sourceRoot":"","sources":["../../src/createPublicOauthClient.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAUhE;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,OAAO,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,GAAE,MAAmC,EAClD,MAAM,GAAE,MAAM,EAAwC,EACtD,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,EACnD,OAAO,GAAE,MAAqB,GAC7B,iBAAiB,CA6JnB"}

package/build/esm/index.js

@@ -22,20 +22,19 @@ var CustomEvent = process.env.target === "browser" ? globalThis.CustomEvent : gl
     return this.#detail;
   }
 };
-var localStorage = globalThis.localStorage;
 function saveLocal(client, x) {
-  localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));
+  globalThis.localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));
 }
 function removeLocal(client) {
-  localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);
+  globalThis.localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);
 }
 function readLocal(client) {
   return JSON.parse(
     // MUST `localStorage?` as nodejs does not have localStorage
-    localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? "{}"
+    globalThis.localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? "{}"
   );
 }
-function common(client, as, _signIn, oauthHttpOptions, refresh) {
+function common(client, as, _signIn, oauthHttpOptions, refresh, scopes) {
   let token;
   const eventTarget = new TypedEventTarget();
   function makeTokenAndSaveRefresh(resp, type) {
@@ -46,7 +45,8 @@ function common(client, as, _signIn, oauthHttpOptions, refresh) {
     } = resp;
     !(expires_in != null) ? process.env.NODE_ENV !== "production" ? invariant(false) : invariant(false) : void 0;
     saveLocal(client, {
-      refresh_token
+      refresh_token,
+      requestedScopes: scopes
     });
     token = {
       refresh_token,
@@ -130,13 +130,14 @@ function createConfidentialOauthClient(client_id, client_secret, url, scopes = [
   const oauthHttpOptions = {
     [customFetch]: fetchFn
   };
+  const joinedScopes = scopes.join(" ");
   const {
     getToken,
     makeTokenAndSaveRefresh
-  } = common(client, authServer, _signIn, oauthHttpOptions, void 0);
+  } = common(client, authServer, _signIn, oauthHttpOptions, void 0, joinedScopes);
   async function _signIn() {
     return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({
-      scope: scopes.join(" ")
+      scope: joinedScopes
     }), oauthHttpOptions))), "signIn");
   }
   return getToken;
@@ -150,10 +151,11 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
   const oauthHttpOptions = {
     [customFetch]: fetchFn
   };
+  let joinedScopes = [...scopes ?? ["api:read-data", "api:write-data"]].sort().join(" ");
   const {
     makeTokenAndSaveRefresh,
     getToken
-  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true));
+  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), joinedScopes);
   async function go(x) {
     if (useHistory) return window.history.replaceState({}, "", x);
     else window.location.assign(x);
@@ -162,12 +164,17 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
   }
   async function maybeRefresh(expectRefreshToken) {
     const {
-      refresh_token
+      refresh_token,
+      requestedScopes: initialRequestedScopes
     } = readLocal(client);
     if (!refresh_token) {
       if (expectRefreshToken) throw new Error("No refresh token found");
       return;
     }
+    if (!refresh_token || !(initialRequestedScopes != null && joinedScopes === initialRequestedScopes)) {
+      if (expectRefreshToken) throw new Error("No refresh token found");
+      return;
+    }
     try {
       return makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), "refresh");
     } catch (e) {
@@ -220,7 +227,7 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
       redirect_uri: redirectUrl,
       code_challenge: await calculatePKCECodeChallenge(codeVerifier),
       code_challenge_method: "S256",
-      scope: ["offline_access", ...scopes].join(" ")
+      scope: `offline_access ${joinedScopes}`
     })}`);
     await delay(1e3);
     throw new Error("Unable to redirect");
@@ -232,5 +239,5 @@ function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginP
 }
 
 export { createConfidentialOauthClient, createPublicOauthClient };
-//# sourceMappingURL=out.js.map
+//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/build/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/createConfidentialOauthClient.ts","../../src/common.ts","../../src/throwIfError.ts","../../src/createPublicOauthClient.ts"],"names":["CustomEvent","getToken","customFetch"],"mappings":";AAgBA,SAAS,+BAA+B,aAAa,wCAAwC;;;ACA7F,SAAS,2BAA2B,yBAAyB;AAC7D,OAAO,eAAe;AACtB,SAAS,wBAAwB;;;ACFjC,SAAS,qBAAqB;AACvB,SAAS,aAAa,QAAQ;AACnC,MAAI,cAAc,MAAM,GAAG;AACzB,UAAM,IAAI,MAAM,wBAAwB,OAAO,KAAK,EAAE;AAAA,EACxD;AACA,SAAO;AACT;;;ADAA,IAAM,cAAc,QAAQ,IAAI,WAAW,YAAY,WAAW,cAAc,WAAW,eAAe,MAAMA,qBAAoB,MAAM;AAAA,EACxI;AAAA,EACA,YAAY,MAAM,SAAS;AACzB,UAAM,MAAM,OAAO;AACnB,SAAK,UAAU,SAAS,UAAU;AAAA,EACpC;AAAA,EACA,IAAI,SAAS;AACX,WAAO,KAAK;AAAA,EACd;AACF;AACA,IAAM,eAAe,WAAW;AACzB,SAAS,UAAU,QAAQ,GAAG;AAEnC,gBAAc,QAAQ,2BAA2B,OAAO,SAAS,IAAI,KAAK,UAAU,CAAC,CAAC;AACxF;AACO,SAAS,YAAY,QAAQ;AAElC,gBAAc,WAAW,2BAA2B,OAAO,SAAS,EAAE;AACxE;AACO,SAAS,UAAU,QAAQ;AAChC,SAAO,KAAK;AAAA;AAAA,IAEZ,cAAc,QAAQ,2BAA2B,OAAO,SAAS,EAAE,KAAK;AAAA,EAAI;AAC9E;AACO,SAAS,OAAO,QAAQ,IAAI,SAAS,kBAAkB,SAAS;AACrE,MAAI;AACJ,QAAM,cAAc,IAAI,iBAAiB;AACzC,WAAS,wBAAwB,MAAM,MAAM;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AACJ,MAAE,cAAc,QAAQ,QAAQ,IAAI,aAAa,eAAe,UAAU,KAAK,IAAI,UAAU,KAAK,IAAI;AACtG,cAAU,QAAQ;AAAA,MAChB;AAAA,IACF,CAAC;AACD,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY,KAAK,IAAI,IAAI,aAAa;AAAA,IACxC;AACA,gBAAY,mBAAmB,MAAM,IAAI,YAAY,MAAM;AAAA,MACzD,QAAQ;AAAA,IACV,CAAC,CAAC;AACF,WAAO;AAAA,EACT;AACA,MAAI;AACJ,WAAS,YAAY;AACnB,QAAI,eAAgB,cAAa,cAAc;AAAA,EACjD;AACA,WAAS,oBAAoB,KAAK;AAChC,QAAI,SAAS;AACX,gBAAU;AACV,uBAAiB,WAAW,SAAS,IAAI,OAAO,aAAa,MAAO,KAAK,GAAI;AAAA,IAC/E;AAAA,EACF;AACA,iBAAe,UAAU;AACvB,KAAC,QAAQ,QAAQ,IAAI,aAAa,eAAe,UAAU,OAAO,eAAe,IAAI,UAAU,KAAK,IAAI;AACxG,UAAM,SAAS,MAAM,0BAA0B,MAAM,kBAAkB,IAAI,QAAQ,MAAM,cAAc,gBAAgB,CAAC;AACxH,cAAU;AAGV,gBAAY,MAAM;AAClB,YAAQ;AACR,iBAAa,MAAM;AACnB,gBAAY,mBAAmB,WAAW,IAAI,MAAM,SAAS,CAAC;AAAA,EAChE;AACA,MAAI;AACJ,iBAAe,SAAS;AACtB,QAAI,eAAe;AACjB,aAAO;AAAA,IACT;AACA,QAAI;AACF,sBAAgB,QAAQ;AACxB,aAAO,MAAM;AAAA,IACf,UAAE;AACA,sBAAgB;AAAA,IAClB;AAAA,EACF;AACA,cAAY,iBAAiB,UAAU,mBAAmB;AAC1D,cAAY,iBAAiB,WAAW,mBAAmB;AAC3D,QAAM,WAAW,OAAO,OAAO,eAAeC,YAAW;AACvD,QAAI,CAAC,SAAS,KAAK,IAAI,KAAK,MAAM,YAAY;AAC5C,cAAQ,MAAM,OAAO;AAAA,IACvB;AACA,WAAO,MAAM;AAAA,EACf,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,YAAY,iBAAiB,KAAK,WAAW;AAAA,IAC/D,qBAAqB,YAAY,oBAAoB,KAAK,WAAW;AAAA,EACvE,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AACO,SAAS,0BAA0B,SAAS,KAAK;AACtD,QAAM,SAAS,GAAG,IAAI,IAAI,SAAS,GAAG,CAAC;AACvC,SAAO;AAAA,IACL,gBAAgB,GAAG,MAAM;AAAA,IACzB,wBAAwB,GAAG,MAAM;AAAA,IACjC,qBAAqB,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF;AACF;;;ADtGO,SAAS,8BAA8B,WAAW,eAAe,KAAK,SAAS,CAAC,iBAAiB,gBAAgB,GAAG,UAAU,WAAW,OAAO,UAAU,cAAc;AAC7K,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,0BAA0B,SAAS,GAAG;AACzD,QAAM,mBAAmB;AAAA,IACvB,CAAC,WAAW,GAAG;AAAA,EACjB;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF,IAAI,OAAO,QAAQ,YAAY,SAAS,kBAAkB,MAAS;AACnE,iBAAe,UAAU;AACvB,WAAO,wBAAwB,aAAa,MAAM,iCAAiC,YAAY,QAAQ,MAAM,8BAA8B,YAAY,QAAQ,IAAI,gBAAgB;AAAA,MACjL,OAAO,OAAO,KAAK,GAAG;AAAA,IACxB,CAAC,GAAG,gBAAgB,CAAC,CAAC,GAAG,QAAQ;AAAA,EACnC;AACA,SAAO;AACT;;;AGhCA,OAAO,WAAW;AAClB,SAAS,+BAA+B,4BAA4B,eAAAC,cAAa,4BAA4B,qBAAqB,wCAAwC,0BAA0B,4BAA4B;AAezN,SAAS,wBAAwB,WAAW,KAAK,aAAa,YAAY,WAAW,gBAAgB,OAAO,SAAS,SAAS,GAAG,SAAS,CAAC,iBAAiB,gBAAgB,GAAG,UAAU,WAAW,OAAO,UAAU,cAAc;AACxO,QAAM,SAAS;AAAA,IACb;AAAA,IACA,4BAA4B;AAAA,EAC9B;AACA,QAAM,aAAa,0BAA0B,SAAS,GAAG;AACzD,QAAM,mBAAmB;AAAA,IACvB,CAACA,YAAW,GAAG;AAAA,EACjB;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF,IAAI,OAAO,QAAQ,YAAY,SAAS,kBAAkB,aAAa,KAAK,YAAY,IAAI,CAAC;AAC7F,iBAAe,GAAG,GAAG;AACnB,QAAI,WAAY,QAAO,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,CAAC;AAAA,QAAO,QAAO,SAAS,OAAO,CAAC;AAC3F,UAAM,MAAM,GAAI;AAChB,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,iBAAe,aAAa,oBAAoB;AAC9C,UAAM;AAAA,MACJ;AAAA,IACF,IAAI,UAAU,MAAM;AACpB,QAAI,CAAC,eAAe;AAClB,UAAI,mBAAoB,OAAM,IAAI,MAAM,wBAAwB;AAChE;AAAA,IACF;AACA,QAAI;AAGF,aAAO,wBAAwB,aAAa,MAAM,uCAAuC,YAAY,QAAQ,MAAM,yBAAyB,YAAY,QAAQ,eAAe,gBAAgB,CAAC,CAAC,GAAG,SAAS;AAAA,IAC/M,SAAS,GAAG;AACV,UAAI,SAAS,KAAK,aAAa,cAAc;AAE3C,gBAAQ,KAAK,8DAA8D,CAAC;AAAA,MAC9E;AACA,kBAAY,MAAM;AAClB,UAAI,oBAAoB;AACtB,cAAM,IAAI,MAAM,yBAAyB;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACA,iBAAe,wBAAwB;AACrC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI,UAAU,MAAM;AACpB,QAAI,CAAC,aAAc;AACnB,QAAI;AACF,YAAM,MAAM,wBAAwB,aAAa,MAAM,uCAAuC,YAAY,QAAQ,MAAM,8BAA8B,YAAY,QAAQ,aAAa,qBAAqB,YAAY,QAAQ,IAAI,IAAI,OAAO,SAAS,IAAI,GAAG,KAAK,CAAC,GAAG,aAAa,cAAc,gBAAgB,CAAC,CAAC,GAAG,QAAQ;AAChU,SAAG,MAAM;AACT,aAAO;AAAA,IACT,SAAS,GAAG;AACV,UAAI,SAAS,KAAK,aAAa,cAAc;AAE3C,gBAAQ,KAAK,qFAAqF,CAAC;AAAA,MACrG;AACA,kBAAY,MAAM;AAAA,IACpB;AAAA,EACF;AACA,iBAAe,wBAAwB;AACrC,QAAI,aAAa,OAAO,SAAS,SAAS,WAAW;AACnD,gBAAU,QAAQ;AAAA,QAChB,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,MAAM,GAAG,SAAS;AAAA,IAC3B;AACA,UAAM,QAAQ,oBAAoB;AAClC,UAAM,eAAe,2BAA2B;AAChD,UAAM,SAAS,UAAU,MAAM,EAAE,UAAU,OAAO,SAAS,SAAS;AACpE,cAAU,QAAQ;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,WAAO,SAAS,OAAO,GAAG,WAAW,sBAAsB,IAAI,IAAI,gBAAgB;AAAA,MACjF;AAAA,MACA,eAAe;AAAA,MACf;AAAA,MACA,cAAc;AAAA,MACd,gBAAgB,MAAM,2BAA2B,YAAY;AAAA,MAC7D,uBAAuB;AAAA,MACvB,OAAO,CAAC,kBAAkB,GAAG,MAAM,EAAE,KAAK,GAAG;AAAA,IAC/C,CAAC,CAAC,EAAE;AAGJ,UAAM,MAAM,GAAI;AAChB,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAGA,iBAAe,UAAU;AAEvB,WAAQ,MAAM,aAAa,KAErB,MAAM,sBAAsB,KAE9B,MAAM,sBAAsB;AAAA,EAClC;AACA,SAAO;AACT","sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { clientCredentialsGrantRequest, customFetch, processClientCredentialsResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n\n/**\n * @param client_id\n * @param client_secret\n * @param url the base url of your foundry server\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns which can be used as a token provider\n */\nexport function createConfidentialOauthClient(client_id, client_secret, url, scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    client_secret\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const {\n    getToken,\n    makeTokenAndSaveRefresh\n  } = common(client, authServer, _signIn, oauthHttpOptions, undefined);\n  async function _signIn() {\n    return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({\n      scope: scopes.join(\" \")\n    }), oauthHttpOptions))), \"signIn\");\n  }\n  return getToken;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { processRevocationResponse, revocationRequest } from \"oauth4webapi\";\nimport invariant from \"tiny-invariant\";\nimport { TypedEventTarget } from \"typescript-event-target\";\nimport { throwIfError } from \"./throwIfError.js\";\n// Node 18 is supposed to have a `CustomEvent` but it is not exposed on `globalThis`\n// which creates a problem for making a single codebase for node and browser. This polyfill works around it\nconst CustomEvent = process.env.target === \"browser\" ? globalThis.CustomEvent : globalThis.CustomEvent ?? class CustomEvent extends Event {\n  #detail;\n  constructor(type, options) {\n    super(type, options);\n    this.#detail = options?.detail ?? null;\n  }\n  get detail() {\n    return this.#detail;\n  }\n};\nconst localStorage = globalThis.localStorage;\nexport function saveLocal(client, x) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));\n}\nexport function removeLocal(client) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);\n}\nexport function readLocal(client) {\n  return JSON.parse(\n  // MUST `localStorage?` as nodejs does not have localStorage\n  localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? \"{}\");\n}\nexport function common(client, as, _signIn, oauthHttpOptions, refresh) {\n  let token;\n  const eventTarget = new TypedEventTarget();\n  function makeTokenAndSaveRefresh(resp, type) {\n    const {\n      refresh_token,\n      expires_in,\n      access_token\n    } = resp;\n    !(expires_in != null) ? process.env.NODE_ENV !== \"production\" ? invariant(false) : invariant(false) : void 0;\n    saveLocal(client, {\n      refresh_token\n    });\n    token = {\n      refresh_token,\n      expires_in,\n      access_token,\n      expires_at: Date.now() + expires_in * 1000\n    };\n    eventTarget.dispatchTypedEvent(type, new CustomEvent(type, {\n      detail: token\n    }));\n    return token;\n  }\n  let refreshTimeout;\n  function rmTimeout() {\n    if (refreshTimeout) clearTimeout(refreshTimeout);\n  }\n  function restartRefreshTimer(evt) {\n    if (refresh) {\n      rmTimeout();\n      refreshTimeout = setTimeout(refresh, evt.detail.expires_in * 1000 - 60 * 1000);\n    }\n  }\n  async function signOut() {\n    !token ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"not signed in\") : invariant(false) : void 0;\n    const result = await processRevocationResponse(await revocationRequest(as, client, token.access_token, oauthHttpOptions));\n    rmTimeout();\n\n    // Clean up\n    removeLocal(client);\n    token = undefined;\n    throwIfError(result);\n    eventTarget.dispatchTypedEvent(\"signOut\", new Event(\"signOut\"));\n  }\n  let pendingSignIn;\n  async function signIn() {\n    if (pendingSignIn) {\n      return pendingSignIn;\n    }\n    try {\n      pendingSignIn = _signIn();\n      return await pendingSignIn;\n    } finally {\n      pendingSignIn = undefined;\n    }\n  }\n  eventTarget.addEventListener(\"signIn\", restartRefreshTimer);\n  eventTarget.addEventListener(\"refresh\", restartRefreshTimer);\n  const getToken = Object.assign(async function getToken() {\n    if (!token || Date.now() >= token.expires_at) {\n      token = await signIn();\n    }\n    return token.access_token;\n  }, {\n    signIn,\n    refresh,\n    signOut,\n    rmTimeout,\n    addEventListener: eventTarget.addEventListener.bind(eventTarget),\n    removeEventListener: eventTarget.removeEventListener.bind(eventTarget)\n  });\n  return {\n    getToken,\n    makeTokenAndSaveRefresh\n  };\n}\nexport function createAuthorizationServer(ctxPath, url) {\n  const issuer = `${new URL(ctxPath, url)}`;\n  return {\n    token_endpoint: `${issuer}/api/oauth2/token`,\n    authorization_endpoint: `${issuer}/api/oauth2/authorize`,\n    revocation_endpoint: `${issuer}/api/oauth2/revoke_token`,\n    issuer\n  };\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isOAuth2Error } from \"oauth4webapi\";\nexport function throwIfError(result) {\n  if (isOAuth2Error(result)) {\n    throw new Error(`Failed to get token: ${result.error}`);\n  }\n  return result;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport delay from \"delay\";\nimport { authorizationCodeGrantRequest, calculatePKCECodeChallenge, customFetch, generateRandomCodeVerifier, generateRandomState, processAuthorizationCodeOAuth2Response, refreshTokenGrantRequest, validateAuthResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer, readLocal, removeLocal, saveLocal } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n/**\n * @param client_id\n * @param url the base url of your foundry server\n * @param redirectUrl the url configured for redirect in the oauth configuration on the server\n * @param useHistory if true, when possible uses `history.replaceState()`, otherwise uses `window.location.assign()`\n * @param loginPage if you want a custom landing page prior to logging in, set this to that url\n * @param postLoginPage if you want to customize where you return to after a completed authentication cycle. defaults to the url when the page loaded\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns {PublicOauthClient} which can be used as a token provider\n */\nexport function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginPage, postLoginPage = window.location.toString(), scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    token_endpoint_auth_method: \"none\"\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const {\n    makeTokenAndSaveRefresh,\n    getToken\n  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true));\n  async function go(x) {\n    if (useHistory) return window.history.replaceState({}, \"\", x);else window.location.assign(x);\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n  async function maybeRefresh(expectRefreshToken) {\n    const {\n      refresh_token\n    } = readLocal(client);\n    if (!refresh_token) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    try {\n      // note, we don't use processRefreshTokenResponse because the mp oauth implementation\n      // doesn't do refresh tokens quite right and this lets us skip the id check\n      return makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), \"refresh\");\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 refresh token. Removing refresh token\", e);\n      }\n      removeLocal(client);\n      if (expectRefreshToken) {\n        throw new Error(\"Could not refresh token\");\n      }\n    }\n  }\n  async function maybeHandleAuthReturn() {\n    const {\n      codeVerifier,\n      state,\n      oldUrl\n    } = readLocal(client);\n    if (!codeVerifier) return;\n    try {\n      const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirectUrl, codeVerifier, oauthHttpOptions))), \"signIn\");\n      go(oldUrl);\n      return ret;\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow\", e);\n      }\n      removeLocal(client);\n    }\n  }\n  async function initiateLoginRedirect() {\n    if (loginPage && window.location.href !== loginPage) {\n      saveLocal(client, {\n        oldUrl: postLoginPage\n      });\n      return await go(loginPage);\n    }\n    const state = generateRandomState();\n    const codeVerifier = generateRandomCodeVerifier();\n    const oldUrl = readLocal(client).oldUrl ?? window.location.toString();\n    saveLocal(client, {\n      codeVerifier,\n      state,\n      oldUrl\n    });\n    window.location.assign(`${authServer.authorization_endpoint}?${new URLSearchParams({\n      client_id,\n      response_type: \"code\",\n      state,\n      redirect_uri: redirectUrl,\n      code_challenge: await calculatePKCECodeChallenge(codeVerifier),\n      code_challenge_method: \"S256\",\n      scope: [\"offline_access\", ...scopes].join(\" \")\n    })}`);\n\n    // Give time for redirect to happen\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n\n  /** Will throw if there is no token! */\n  async function _signIn() {\n    // 1. Check if we have a refresh token in local storage\n    return (await maybeRefresh()\n    // 2. If there is no refresh token we are likely trying to perform the callback\n    ) ?? (await maybeHandleAuthReturn())\n    // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request\n    ?? (await initiateLoginRedirect());\n  }\n  return getToken;\n}"]}
+{"version":3,"sources":["../../src/throwIfError.ts","../../src/common.ts","../../src/createConfidentialOauthClient.ts","../../src/createPublicOauthClient.ts"],"names":["CustomEvent","getToken","customFetch"],"mappings":";;;;;;AAiBO,SAAS,aAAa,MAAQ,EAAA;AACnC,EAAI,IAAA,aAAA,CAAc,MAAM,CAAG,EAAA;AACzB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAwB,qBAAA,EAAA,MAAA,CAAO,KAAK,CAAE,CAAA,CAAA,CAAA;AAAA,GACxD;AACA,EAAO,OAAA,MAAA,CAAA;AACT,CAAA;;;ACAA,IAAM,WAAA,GAAc,OAAQ,CAAA,GAAA,CAAI,MAAW,KAAA,SAAA,GAAY,UAAW,CAAA,WAAA,GAAc,UAAW,CAAA,WAAA,IAAe,MAAMA,YAAAA,SAAoB,KAAM,CAAA;AAAA,EACxI,OAAA,CAAA;AAAA,EACA,WAAA,CAAY,MAAM,OAAS,EAAA;AACzB,IAAA,KAAA,CAAM,MAAM,OAAO,CAAA,CAAA;AACnB,IAAK,IAAA,CAAA,OAAA,GAAU,SAAS,MAAU,IAAA,IAAA,CAAA;AAAA,GACpC;AAAA,EACA,IAAI,MAAS,GAAA;AACX,IAAA,OAAO,IAAK,CAAA,OAAA,CAAA;AAAA,GACd;AACF,CAAA,CAAA;AACO,SAAS,SAAA,CAAU,QAAQ,CAAG,EAAA;AAEnC,EAAW,UAAA,CAAA,YAAA,EAAc,QAAQ,CAA2B,wBAAA,EAAA,MAAA,CAAO,SAAS,CAAI,CAAA,EAAA,IAAA,CAAK,SAAU,CAAA,CAAC,CAAC,CAAA,CAAA;AACnG,CAAA;AACO,SAAS,YAAY,MAAQ,EAAA;AAElC,EAAA,UAAA,CAAW,YAAc,EAAA,UAAA,CAAW,CAA2B,wBAAA,EAAA,MAAA,CAAO,SAAS,CAAE,CAAA,CAAA,CAAA;AACnF,CAAA;AACO,SAAS,UAAU,MAAQ,EAAA;AAChC,EAAA,OAAO,IAAK,CAAA,KAAA;AAAA;AAAA,IAEZ,WAAW,YAAc,EAAA,OAAA,CAAQ,2BAA2B,MAAO,CAAA,SAAS,EAAE,CAAK,IAAA,IAAA;AAAA,GAAI,CAAA;AACzF,CAAA;AACO,SAAS,OAAO,MAAQ,EAAA,EAAA,EAAI,OAAS,EAAA,gBAAA,EAAkB,SAAS,MAAQ,EAAA;AAC7E,EAAI,IAAA,KAAA,CAAA;AACJ,EAAM,MAAA,WAAA,GAAc,IAAI,gBAAiB,EAAA,CAAA;AACzC,EAAS,SAAA,uBAAA,CAAwB,MAAM,IAAM,EAAA;AAC3C,IAAM,MAAA;AAAA,MACJ,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,KACE,GAAA,IAAA,CAAA;AACJ,IAAE,EAAA,UAAA,IAAc,IAAQ,CAAA,GAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,KAAa,YAAe,GAAA,SAAA,CAAU,KAAK,CAAA,GAAI,SAAU,CAAA,KAAK,CAAI,GAAA,KAAA,CAAA,CAAA;AACtG,IAAA,SAAA,CAAU,MAAQ,EAAA;AAAA,MAChB,aAAA;AAAA,MACA,eAAiB,EAAA,MAAA;AAAA,KAClB,CAAA,CAAA;AACD,IAAQ,KAAA,GAAA;AAAA,MACN,aAAA;AAAA,MACA,UAAA;AAAA,MACA,YAAA;AAAA,MACA,UAAY,EAAA,IAAA,CAAK,GAAI,EAAA,GAAI,UAAa,GAAA,GAAA;AAAA,KACxC,CAAA;AACA,IAAA,WAAA,CAAY,kBAAmB,CAAA,IAAA,EAAM,IAAI,WAAA,CAAY,IAAM,EAAA;AAAA,MACzD,MAAQ,EAAA,KAAA;AAAA,KACT,CAAC,CAAA,CAAA;AACF,IAAO,OAAA,KAAA,CAAA;AAAA,GACT;AACA,EAAI,IAAA,cAAA,CAAA;AACJ,EAAA,SAAS,SAAY,GAAA;AACnB,IAAI,IAAA,cAAA,eAA6B,cAAc,CAAA,CAAA;AAAA,GACjD;AACA,EAAA,SAAS,oBAAoB,GAAK,EAAA;AAChC,IAAA,IAAI,OAAS,EAAA;AACX,MAAU,SAAA,EAAA,CAAA;AACV,MAAA,cAAA,GAAiB,WAAW,OAAS,EAAA,GAAA,CAAI,OAAO,UAAa,GAAA,GAAA,GAAO,KAAK,GAAI,CAAA,CAAA;AAAA,KAC/E;AAAA,GACF;AACA,EAAA,eAAe,OAAU,GAAA;AACvB,IAAC,CAAA,KAAA,GAAQ,OAAQ,CAAA,GAAA,CAAI,QAAa,KAAA,YAAA,GAAe,SAAU,CAAA,KAAA,EAAO,eAAe,CAAA,GAAI,SAAU,CAAA,KAAK,CAAI,GAAA,KAAA,CAAA,CAAA;AACxG,IAAM,MAAA,MAAA,GAAS,MAAM,yBAAA,CAA0B,MAAM,iBAAA,CAAkB,IAAI,MAAQ,EAAA,KAAA,CAAM,YAAc,EAAA,gBAAgB,CAAC,CAAA,CAAA;AACxH,IAAU,SAAA,EAAA,CAAA;AAGV,IAAA,WAAA,CAAY,MAAM,CAAA,CAAA;AAClB,IAAQ,KAAA,GAAA,KAAA,CAAA,CAAA;AACR,IAAA,YAAA,CAAa,MAAM,CAAA,CAAA;AACnB,IAAA,WAAA,CAAY,kBAAmB,CAAA,SAAA,EAAW,IAAI,KAAA,CAAM,SAAS,CAAC,CAAA,CAAA;AAAA,GAChE;AACA,EAAI,IAAA,aAAA,CAAA;AACJ,EAAA,eAAe,MAAS,GAAA;AACtB,IAAA,IAAI,aAAe,EAAA;AACjB,MAAO,OAAA,aAAA,CAAA;AAAA,KACT;AACA,IAAI,IAAA;AACF,MAAA,aAAA,GAAgB,OAAQ,EAAA,CAAA;AACxB,MAAA,OAAO,MAAM,aAAA,CAAA;AAAA,KACb,SAAA;AACA,MAAgB,aAAA,GAAA,KAAA,CAAA,CAAA;AAAA,KAClB;AAAA,GACF;AACA,EAAY,WAAA,CAAA,gBAAA,CAAiB,UAAU,mBAAmB,CAAA,CAAA;AAC1D,EAAY,WAAA,CAAA,gBAAA,CAAiB,WAAW,mBAAmB,CAAA,CAAA;AAC3D,EAAA,MAAM,QAAW,GAAA,MAAA,CAAO,MAAO,CAAA,eAAeC,SAAW,GAAA;AACvD,IAAA,IAAI,CAAC,KAAS,IAAA,IAAA,CAAK,GAAI,EAAA,IAAK,MAAM,UAAY,EAAA;AAC5C,MAAA,KAAA,GAAQ,MAAM,MAAO,EAAA,CAAA;AAAA,KACvB;AACA,IAAA,OAAO,KAAM,CAAA,YAAA,CAAA;AAAA,GACZ,EAAA;AAAA,IACD,MAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAkB,EAAA,WAAA,CAAY,gBAAiB,CAAA,IAAA,CAAK,WAAW,CAAA;AAAA,IAC/D,mBAAqB,EAAA,WAAA,CAAY,mBAAoB,CAAA,IAAA,CAAK,WAAW,CAAA;AAAA,GACtE,CAAA,CAAA;AACD,EAAO,OAAA;AAAA,IACL,QAAA;AAAA,IACA,uBAAA;AAAA,GACF,CAAA;AACF,CAAA;AACO,SAAS,yBAAA,CAA0B,SAAS,GAAK,EAAA;AACtD,EAAA,MAAM,SAAS,CAAG,EAAA,IAAI,GAAI,CAAA,OAAA,EAAS,GAAG,CAAC,CAAA,CAAA,CAAA;AACvC,EAAO,OAAA;AAAA,IACL,cAAA,EAAgB,GAAG,MAAM,CAAA,iBAAA,CAAA;AAAA,IACzB,sBAAA,EAAwB,GAAG,MAAM,CAAA,qBAAA,CAAA;AAAA,IACjC,mBAAA,EAAqB,GAAG,MAAM,CAAA,wBAAA,CAAA;AAAA,IAC9B,MAAA;AAAA,GACF,CAAA;AACF,CAAA;;;ACtGO,SAAS,6BAA8B,CAAA,SAAA,EAAW,aAAe,EAAA,GAAA,EAAK,MAAS,GAAA,CAAC,eAAiB,EAAA,gBAAgB,CAAG,EAAA,OAAA,GAAU,UAAW,CAAA,KAAA,EAAO,UAAU,YAAc,EAAA;AAC7K,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,SAAA;AAAA,IACA,aAAA;AAAA,GACF,CAAA;AACA,EAAM,MAAA,UAAA,GAAa,yBAA0B,CAAA,OAAA,EAAS,GAAG,CAAA,CAAA;AACzD,EAAA,MAAM,gBAAmB,GAAA;AAAA,IACvB,CAAC,WAAW,GAAG,OAAA;AAAA,GACjB,CAAA;AACA,EAAM,MAAA,YAAA,GAAe,MAAO,CAAA,IAAA,CAAK,GAAG,CAAA,CAAA;AACpC,EAAM,MAAA;AAAA,IACJ,QAAA;AAAA,IACA,uBAAA;AAAA,MACE,MAAO,CAAA,MAAA,EAAQ,YAAY,OAAS,EAAA,gBAAA,EAAkB,QAAW,YAAY,CAAA,CAAA;AACjF,EAAA,eAAe,OAAU,GAAA;AACvB,IAAO,OAAA,uBAAA,CAAwB,YAAa,CAAA,MAAM,gCAAiC,CAAA,UAAA,EAAY,MAAQ,EAAA,MAAM,6BAA8B,CAAA,UAAA,EAAY,MAAQ,EAAA,IAAI,eAAgB,CAAA;AAAA,MACjL,KAAO,EAAA,YAAA;AAAA,KACR,CAAG,EAAA,gBAAgB,CAAC,CAAC,GAAG,QAAQ,CAAA,CAAA;AAAA,GACnC;AACA,EAAO,OAAA,QAAA,CAAA;AACT,CAAA;ACjBO,SAAS,uBAAA,CAAwB,WAAW,GAAK,EAAA,WAAA,EAAa,YAAY,SAAW,EAAA,aAAA,GAAgB,OAAO,QAAS,CAAA,QAAA,IAAY,MAAS,GAAA,CAAC,iBAAiB,gBAAgB,CAAA,EAAG,UAAU,UAAW,CAAA,KAAA,EAAO,UAAU,YAAc,EAAA;AACxO,EAAA,MAAM,MAAS,GAAA;AAAA,IACb,SAAA;AAAA,IACA,0BAA4B,EAAA,MAAA;AAAA,GAC9B,CAAA;AACA,EAAM,MAAA,UAAA,GAAa,yBAA0B,CAAA,OAAA,EAAS,GAAG,CAAA,CAAA;AACzD,EAAA,MAAM,gBAAmB,GAAA;AAAA,IACvB,CAACC,WAAW,GAAG,OAAA;AAAA,GACjB,CAAA;AACA,EAAA,IAAI,YAAe,GAAA,CAAC,GAAI,MAAA,IAAU,CAAC,eAAA,EAAiB,gBAAgB,CAAE,CAAE,CAAA,IAAA,EAAO,CAAA,IAAA,CAAK,GAAG,CAAA,CAAA;AACvF,EAAM,MAAA;AAAA,IACJ,uBAAA;AAAA,IACA,QAAA;AAAA,GACF,GAAI,MAAO,CAAA,MAAA,EAAQ,UAAY,EAAA,OAAA,EAAS,gBAAkB,EAAA,YAAA,CAAa,IAAK,CAAA,UAAA,EAAY,IAAI,CAAA,EAAG,YAAY,CAAA,CAAA;AAC3G,EAAA,eAAe,GAAG,CAAG,EAAA;AACnB,IAAI,IAAA,UAAA,SAAmB,MAAO,CAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,CAAC,CAAA,CAAA;AAAA,SAAO,MAAA,CAAO,QAAS,CAAA,MAAA,CAAO,CAAC,CAAA,CAAA;AAC3F,IAAA,MAAM,MAAM,GAAI,CAAA,CAAA;AAChB,IAAM,MAAA,IAAI,MAAM,oBAAoB,CAAA,CAAA;AAAA,GACtC;AACA,EAAA,eAAe,aAAa,kBAAoB,EAAA;AAC9C,IAAM,MAAA;AAAA,MACJ,aAAA;AAAA,MACA,eAAiB,EAAA,sBAAA;AAAA,KACnB,GAAI,UAAU,MAAM,CAAA,CAAA;AACpB,IAAA,IAAI,CAAC,aAAe,EAAA;AAClB,MAAA,IAAI,kBAAoB,EAAA,MAAM,IAAI,KAAA,CAAM,wBAAwB,CAAA,CAAA;AAChE,MAAA,OAAA;AAAA,KACF;AACA,IAAA,IAAI,CAAC,aAAiB,IAAA,EAAE,sBAA0B,IAAA,IAAA,IAAQ,iBAAiB,sBAAyB,CAAA,EAAA;AAClG,MAAA,IAAI,kBAAoB,EAAA,MAAM,IAAI,KAAA,CAAM,wBAAwB,CAAA,CAAA;AAChE,MAAA,OAAA;AAAA,KACF;AACA,IAAI,IAAA;AAGF,MAAA,OAAO,uBAAwB,CAAA,YAAA,CAAa,MAAM,sCAAA,CAAuC,YAAY,MAAQ,EAAA,MAAM,wBAAyB,CAAA,UAAA,EAAY,QAAQ,aAAe,EAAA,gBAAgB,CAAC,CAAC,GAAG,SAAS,CAAA,CAAA;AAAA,aACtM,CAAG,EAAA;AACV,MAAI,IAAA,OAAA,EAAS,GAAK,EAAA,QAAA,KAAa,YAAc,EAAA;AAE3C,QAAQ,OAAA,CAAA,IAAA,CAAK,8DAA8D,CAAC,CAAA,CAAA;AAAA,OAC9E;AACA,MAAA,WAAA,CAAY,MAAM,CAAA,CAAA;AAClB,MAAA,IAAI,kBAAoB,EAAA;AACtB,QAAM,MAAA,IAAI,MAAM,yBAAyB,CAAA,CAAA;AAAA,OAC3C;AAAA,KACF;AAAA,GACF;AACA,EAAA,eAAe,qBAAwB,GAAA;AACrC,IAAM,MAAA;AAAA,MACJ,YAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,KACF,GAAI,UAAU,MAAM,CAAA,CAAA;AACpB,IAAA,IAAI,CAAC,YAAc,EAAA,OAAA;AACnB,IAAI,IAAA;AACF,MAAA,MAAM,GAAM,GAAA,uBAAA,CAAwB,YAAa,CAAA,MAAM,sCAAuC,CAAA,UAAA,EAAY,MAAQ,EAAA,MAAM,6BAA8B,CAAA,UAAA,EAAY,MAAQ,EAAA,YAAA,CAAa,qBAAqB,UAAY,EAAA,MAAA,EAAQ,IAAI,GAAA,CAAI,MAAO,CAAA,QAAA,CAAS,IAAI,CAAA,EAAG,KAAK,CAAC,CAAG,EAAA,WAAA,EAAa,YAAc,EAAA,gBAAgB,CAAC,CAAC,GAAG,QAAQ,CAAA,CAAA;AAChU,MAAA,EAAA,CAAG,MAAM,CAAA,CAAA;AACT,MAAO,OAAA,GAAA,CAAA;AAAA,aACA,CAAG,EAAA;AACV,MAAI,IAAA,OAAA,EAAS,GAAK,EAAA,QAAA,KAAa,YAAc,EAAA;AAE3C,QAAQ,OAAA,CAAA,IAAA,CAAK,qFAAqF,CAAC,CAAA,CAAA;AAAA,OACrG;AACA,MAAA,WAAA,CAAY,MAAM,CAAA,CAAA;AAAA,KACpB;AAAA,GACF;AACA,EAAA,eAAe,qBAAwB,GAAA;AACrC,IAAA,IAAI,SAAa,IAAA,MAAA,CAAO,QAAS,CAAA,IAAA,KAAS,SAAW,EAAA;AACnD,MAAA,SAAA,CAAU,MAAQ,EAAA;AAAA,QAChB,MAAQ,EAAA,aAAA;AAAA,OACT,CAAA,CAAA;AACD,MAAO,OAAA,MAAM,GAAG,SAAS,CAAA,CAAA;AAAA,KAC3B;AACA,IAAA,MAAM,QAAQ,mBAAoB,EAAA,CAAA;AAClC,IAAA,MAAM,eAAe,0BAA2B,EAAA,CAAA;AAChD,IAAA,MAAM,SAAS,SAAU,CAAA,MAAM,EAAE,MAAU,IAAA,MAAA,CAAO,SAAS,QAAS,EAAA,CAAA;AACpE,IAAA,SAAA,CAAU,MAAQ,EAAA;AAAA,MAChB,YAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,KACD,CAAA,CAAA;AACD,IAAA,MAAA,CAAO,SAAS,MAAO,CAAA,CAAA,EAAG,WAAW,sBAAsB,CAAA,CAAA,EAAI,IAAI,eAAgB,CAAA;AAAA,MACjF,SAAA;AAAA,MACA,aAAe,EAAA,MAAA;AAAA,MACf,KAAA;AAAA,MACA,YAAc,EAAA,WAAA;AAAA,MACd,cAAA,EAAgB,MAAM,0BAAA,CAA2B,YAAY,CAAA;AAAA,MAC7D,qBAAuB,EAAA,MAAA;AAAA,MACvB,KAAA,EAAO,kBAAkB,YAAY,CAAA,CAAA;AAAA,KACtC,CAAC,CAAE,CAAA,CAAA,CAAA;AAGJ,IAAA,MAAM,MAAM,GAAI,CAAA,CAAA;AAChB,IAAM,MAAA,IAAI,MAAM,oBAAoB,CAAA,CAAA;AAAA,GACtC;AAGA,EAAA,eAAe,OAAU,GAAA;AAEvB,IAAA,OAAQ,MAAM,YAAa,EAAA,IAErB,MAAM,qBAAsB,EAAA,IAE9B,MAAM,qBAAsB,EAAA,CAAA;AAAA,GAClC;AACA,EAAO,OAAA,QAAA,CAAA;AACT","file":"index.js","sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isOAuth2Error } from \"oauth4webapi\";\nexport function throwIfError(result) {\n  if (isOAuth2Error(result)) {\n    throw new Error(`Failed to get token: ${result.error}`);\n  }\n  return result;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { processRevocationResponse, revocationRequest } from \"oauth4webapi\";\nimport invariant from \"tiny-invariant\";\nimport { TypedEventTarget } from \"typescript-event-target\";\nimport { throwIfError } from \"./throwIfError.js\";\n// Node 18 is supposed to have a `CustomEvent` but it is not exposed on `globalThis`\n// which creates a problem for making a single codebase for node and browser. This polyfill works around it\nconst CustomEvent = process.env.target === \"browser\" ? globalThis.CustomEvent : globalThis.CustomEvent ?? class CustomEvent extends Event {\n  #detail;\n  constructor(type, options) {\n    super(type, options);\n    this.#detail = options?.detail ?? null;\n  }\n  get detail() {\n    return this.#detail;\n  }\n};\nexport function saveLocal(client, x) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  globalThis.localStorage?.setItem(`@osdk/oauth : refresh : ${client.client_id}`, JSON.stringify(x));\n}\nexport function removeLocal(client) {\n  // MUST `localStorage?` as nodejs does not have localStorage\n  globalThis.localStorage?.removeItem(`@osdk/oauth : refresh : ${client.client_id}`);\n}\nexport function readLocal(client) {\n  return JSON.parse(\n  // MUST `localStorage?` as nodejs does not have localStorage\n  globalThis.localStorage?.getItem(`@osdk/oauth : refresh : ${client.client_id}`) ?? \"{}\");\n}\nexport function common(client, as, _signIn, oauthHttpOptions, refresh, scopes) {\n  let token;\n  const eventTarget = new TypedEventTarget();\n  function makeTokenAndSaveRefresh(resp, type) {\n    const {\n      refresh_token,\n      expires_in,\n      access_token\n    } = resp;\n    !(expires_in != null) ? process.env.NODE_ENV !== \"production\" ? invariant(false) : invariant(false) : void 0;\n    saveLocal(client, {\n      refresh_token,\n      requestedScopes: scopes\n    });\n    token = {\n      refresh_token,\n      expires_in,\n      access_token,\n      expires_at: Date.now() + expires_in * 1000\n    };\n    eventTarget.dispatchTypedEvent(type, new CustomEvent(type, {\n      detail: token\n    }));\n    return token;\n  }\n  let refreshTimeout;\n  function rmTimeout() {\n    if (refreshTimeout) clearTimeout(refreshTimeout);\n  }\n  function restartRefreshTimer(evt) {\n    if (refresh) {\n      rmTimeout();\n      refreshTimeout = setTimeout(refresh, evt.detail.expires_in * 1000 - 60 * 1000);\n    }\n  }\n  async function signOut() {\n    !token ? process.env.NODE_ENV !== \"production\" ? invariant(false, \"not signed in\") : invariant(false) : void 0;\n    const result = await processRevocationResponse(await revocationRequest(as, client, token.access_token, oauthHttpOptions));\n    rmTimeout();\n\n    // Clean up\n    removeLocal(client);\n    token = undefined;\n    throwIfError(result);\n    eventTarget.dispatchTypedEvent(\"signOut\", new Event(\"signOut\"));\n  }\n  let pendingSignIn;\n  async function signIn() {\n    if (pendingSignIn) {\n      return pendingSignIn;\n    }\n    try {\n      pendingSignIn = _signIn();\n      return await pendingSignIn;\n    } finally {\n      pendingSignIn = undefined;\n    }\n  }\n  eventTarget.addEventListener(\"signIn\", restartRefreshTimer);\n  eventTarget.addEventListener(\"refresh\", restartRefreshTimer);\n  const getToken = Object.assign(async function getToken() {\n    if (!token || Date.now() >= token.expires_at) {\n      token = await signIn();\n    }\n    return token.access_token;\n  }, {\n    signIn,\n    refresh,\n    signOut,\n    rmTimeout,\n    addEventListener: eventTarget.addEventListener.bind(eventTarget),\n    removeEventListener: eventTarget.removeEventListener.bind(eventTarget)\n  });\n  return {\n    getToken,\n    makeTokenAndSaveRefresh\n  };\n}\nexport function createAuthorizationServer(ctxPath, url) {\n  const issuer = `${new URL(ctxPath, url)}`;\n  return {\n    token_endpoint: `${issuer}/api/oauth2/token`,\n    authorization_endpoint: `${issuer}/api/oauth2/authorize`,\n    revocation_endpoint: `${issuer}/api/oauth2/revoke_token`,\n    issuer\n  };\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { clientCredentialsGrantRequest, customFetch, processClientCredentialsResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n\n/**\n * @param client_id\n * @param client_secret\n * @param url the base url of your foundry server\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns which can be used as a token provider\n */\nexport function createConfidentialOauthClient(client_id, client_secret, url, scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    client_secret\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  const joinedScopes = scopes.join(\" \");\n  const {\n    getToken,\n    makeTokenAndSaveRefresh\n  } = common(client, authServer, _signIn, oauthHttpOptions, undefined, joinedScopes);\n  async function _signIn() {\n    return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({\n      scope: joinedScopes\n    }), oauthHttpOptions))), \"signIn\");\n  }\n  return getToken;\n}","/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport delay from \"delay\";\nimport { authorizationCodeGrantRequest, calculatePKCECodeChallenge, customFetch, generateRandomCodeVerifier, generateRandomState, processAuthorizationCodeOAuth2Response, refreshTokenGrantRequest, validateAuthResponse } from \"oauth4webapi\";\nimport { common, createAuthorizationServer, readLocal, removeLocal, saveLocal } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n/**\n * @param client_id\n * @param url the base url of your foundry server\n * @param redirectUrl the url configured for redirect in the oauth configuration on the server\n * @param useHistory if true, when possible uses `history.replaceState()`, otherwise uses `window.location.assign()`\n * @param loginPage if you want a custom landing page prior to logging in, set this to that url\n * @param postLoginPage if you want to customize where you return to after a completed authentication cycle. defaults to the url when the page loaded\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns {PublicOauthClient} which can be used as a token provider\n */\nexport function createPublicOauthClient(client_id, url, redirectUrl, useHistory, loginPage, postLoginPage = window.location.toString(), scopes = [\"api:read-data\", \"api:write-data\"], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n  const client = {\n    client_id,\n    token_endpoint_auth_method: \"none\"\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions = {\n    [customFetch]: fetchFn\n  };\n  let joinedScopes = [...(scopes ?? [\"api:read-data\", \"api:write-data\"])].sort().join(\" \");\n  const {\n    makeTokenAndSaveRefresh,\n    getToken\n  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), joinedScopes);\n  async function go(x) {\n    if (useHistory) return window.history.replaceState({}, \"\", x);else window.location.assign(x);\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n  async function maybeRefresh(expectRefreshToken) {\n    const {\n      refresh_token,\n      requestedScopes: initialRequestedScopes\n    } = readLocal(client);\n    if (!refresh_token) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    if (!refresh_token || !(initialRequestedScopes != null && joinedScopes === initialRequestedScopes)) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n    try {\n      // note, we don't use processRefreshTokenResponse because the mp oauth implementation\n      // doesn't do refresh tokens quite right and this lets us skip the id check\n      return makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), \"refresh\");\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 refresh token. Removing refresh token\", e);\n      }\n      removeLocal(client);\n      if (expectRefreshToken) {\n        throw new Error(\"Could not refresh token\");\n      }\n    }\n  }\n  async function maybeHandleAuthReturn() {\n    const {\n      codeVerifier,\n      state,\n      oldUrl\n    } = readLocal(client);\n    if (!codeVerifier) return;\n    try {\n      const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirectUrl, codeVerifier, oauthHttpOptions))), \"signIn\");\n      go(oldUrl);\n      return ret;\n    } catch (e) {\n      if (process?.env?.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\"Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow\", e);\n      }\n      removeLocal(client);\n    }\n  }\n  async function initiateLoginRedirect() {\n    if (loginPage && window.location.href !== loginPage) {\n      saveLocal(client, {\n        oldUrl: postLoginPage\n      });\n      return await go(loginPage);\n    }\n    const state = generateRandomState();\n    const codeVerifier = generateRandomCodeVerifier();\n    const oldUrl = readLocal(client).oldUrl ?? window.location.toString();\n    saveLocal(client, {\n      codeVerifier,\n      state,\n      oldUrl\n    });\n    window.location.assign(`${authServer.authorization_endpoint}?${new URLSearchParams({\n      client_id,\n      response_type: \"code\",\n      state,\n      redirect_uri: redirectUrl,\n      code_challenge: await calculatePKCECodeChallenge(codeVerifier),\n      code_challenge_method: \"S256\",\n      scope: `offline_access ${joinedScopes}`\n    })}`);\n\n    // Give time for redirect to happen\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  }\n\n  /** Will throw if there is no token! */\n  async function _signIn() {\n    // 1. Check if we have a refresh token in local storage\n    return (await maybeRefresh()\n    // 2. If there is no refresh token we are likely trying to perform the callback\n    ) ?? (await maybeHandleAuthReturn())\n    // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request\n    ?? (await initiateLoginRedirect());\n  }\n  return getToken;\n}"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@osdk/oauth",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -24,9 +24,9 @@
   },
   "devDependencies": {
     "jest-extended": "^4.0.2",
-    "typescript": "^5.5.2",
-    "@osdk/monorepo.tsconfig": "~0.0.0",
+    "typescript": "^5.5.4",
     "@osdk/monorepo.api-extractor": "~0.0.0",
+    "@osdk/monorepo.tsconfig": "~0.0.0",
     "@osdk/monorepo.tsup": "~0.0.0"
   },
   "publishConfig": {