@pega/auth 0.2.23 → 0.2.25

package/lib/oauth-client/auth.js

@@ -1,22 +1,35 @@
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _PegaAuth_instances, _PegaAuth_config, _PegaAuth_dynState, _PegaAuth_reloadSS, _PegaAuth_reloadConfig, _PegaAuth_updateConfig, _PegaAuth_importSingleLib, _PegaAuth_importNodeLibs, _PegaAuth_buildAuthorizeUrl, _PegaAuth_authCodeStart, _PegaAuth_updateSessionIndex, _PegaAuth_sha256Hash, _PegaAuth_encode64, _PegaAuth_base64UrlSafeEncode, _PegaAuth_getRandomString, _PegaAuth_getCodeChallenge, _PegaAuth_getAgent;
 export class PegaAuth {
-    // The properties within config structure are expected to be more static config values that are then
-    //  used to properly make various OAuth endpoint calls.
-    #config = null;
-    // Any dynamic state is stored separately in its own structure.  If a sessionStorage key is passed in
-    //  without a Dynamic State key.
-    #dynState = {};
     // Current properties within dynState structure:
     //  codeVerifier, state, sessionIndex, sessionIndexAttempts, acRedirectUri, silentAuthFailed
     constructor(ssKeyConfig, ssKeyDynState = '') {
+        _PegaAuth_instances.add(this);
+        // The properties within config structure are expected to be more static config values that are then
+        //  used to properly make various OAuth endpoint calls.
+        _PegaAuth_config.set(this, null);
+        // Any dynamic state is stored separately in its own structure.  If a sessionStorage key is passed in
+        //  without a Dynamic State key.
+        _PegaAuth_dynState.set(this, {});
         if (typeof ssKeyConfig === 'string') {
             this.ssKeyConfig = ssKeyConfig;
             this.ssKeyDynState = ssKeyDynState || `${ssKeyConfig}_DS`;
-            this.#reloadConfig();
+            __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_reloadConfig).call(this);
         }
         else {
             // object with config structure is passed in
-            this.#config = ssKeyConfig;
-            this.#dynState = ssKeyDynState || {};
+            __classPrivateFieldSet(this, _PegaAuth_config, ssKeyConfig, "f");
+            __classPrivateFieldSet(this, _PegaAuth_dynState, ssKeyDynState || {}, "f");
         }
         this.urlencoded = 'application/x-www-form-urlencoded';
         this.tokenError = 'Token endpoint error';
@@ -26,153 +39,21 @@ export class PegaAuth {
             this.crypto = window.crypto;
             this.subtle = window.crypto.subtle;
         }
-        if (Object.keys(this.#config).length > 0) {
-            if (!this.#config.serverType) {
-                this.#config.serverType = 'infinity';
+        if (Object.keys(__classPrivateFieldGet(this, _PegaAuth_config, "f")).length > 0) {
+            if (!__classPrivateFieldGet(this, _PegaAuth_config, "f").serverType) {
+                __classPrivateFieldGet(this, _PegaAuth_config, "f").serverType = 'infinity';
             }
         }
         else {
             throw new Error('invalid config settings');
         }
     }
-    #reloadSS(ssKey) {
-        const sItem = window.sessionStorage.getItem(ssKey);
-        let obj = {};
-        if (sItem) {
-            try {
-                obj = JSON.parse(sItem);
-            }
-            catch (e) {
-                try {
-                    obj = JSON.parse(atob(sItem));
-                }
-                catch (err) {
-                    obj = {};
-                }
-            }
-        }
-        if (ssKey === this.ssKeyConfig) {
-            this.#config = sItem ? obj : {};
-        }
-        else {
-            this.#dynState = sItem ? obj : {};
-        }
-    }
-    #reloadConfig() {
-        if (this.ssKeyConfig) {
-            this.#reloadSS(this.ssKeyConfig);
-        }
-        if (this.ssKeyDynState) {
-            this.#reloadSS(this.ssKeyDynState);
-        }
-    }
-    #updateConfig() {
-        // transform must occur unless it is explicitly disabled
-        const transform = this.#config.transform !== false;
-        // May not need to write out Config info all the time, but there is a scenario where a
-        //  non obfuscated value is passed in and then it needs to be obfuscated
-        if (this.ssKeyConfig) {
-            const sConfig = JSON.stringify(this.#config);
-            window.sessionStorage.setItem(this.ssKeyConfig, transform ? btoa(sConfig) : sConfig);
-        }
-        if (this.ssKeyDynState) {
-            const sDynState = JSON.stringify(this.#dynState);
-            window.sessionStorage.setItem(this.ssKeyDynState, transform ? btoa(sDynState) : sDynState);
-        }
-        if (this.#config.fnDynStateChangedCB) {
-            this.#config.fnDynStateChangedCB();
-        }
-    }
-    async #importSingleLib(libName, libProp, bLoadAlways = false) {
-        if (!bLoadAlways && typeof (this.isNode ? global : window)[libProp] !== 'undefined') {
-            this[libProp] = (this.isNode ? global : window)[libProp];
-            return this[libProp];
-        }
-        // Needed to explicitly make import argument a string by using template literals to fix a compile
-        // error: Critical dependency: the request of a dependency is an expression
-        return import(/* webpackIgnore: true */ `${libName}`)
-            .then(mod => {
-            this[libProp] = mod.default;
-        })
-            .catch(e => {
-            // eslint-disable-next-line no-console
-            console.error(`Library ${libName} failed to load. ${e}`);
-            throw e;
-        });
-    }
-    async #importNodeLibs() {
-        // Also current assumption is using Node 18 or better
-        // With 18.3 there is now a native fetch (but may want to force use of node-fetch)
-        const useNodeFetch = !!this.#config.useNodeFetch;
-        return Promise.all([
-            this.#importSingleLib('node-fetch', 'fetch', useNodeFetch),
-            this.#importSingleLib('open', 'open'),
-            this.#importSingleLib('node:crypto', 'crypto', true),
-            this.#importSingleLib('node:https', 'https'),
-            this.#importSingleLib('node:http', 'http'),
-            this.#importSingleLib('node:fs', 'fs')
-        ]).then(() => {
-            this.subtle = this.crypto?.subtle || this.crypto.webcrypto.subtle;
-            if ((typeof fetch === 'undefined' || useNodeFetch) && this.fetch) {
-                /* eslint-disable-next-line no-global-assign */
-                fetch = this.fetch;
-            }
-        });
-    }
-    // For PKCE the authorize includes a code_challenge & code_challenge_method as well
-    async #buildAuthorizeUrl(state) {
-        const { serverType, clientId, redirectUri, authorizeUri, userinfoUri, authService, appAlias, userIdentifier, password, noPKCE } = this.#config;
-        const { sessionIndex } = this.#dynState;
-        const bInfinity = serverType === 'infinity';
-        if (!noPKCE) {
-            // Generate random string of 64 chars for verifier.  RFC 7636 says from 43-128 chars
-            const buf = new Uint8Array(64);
-            this.crypto.getRandomValues(buf);
-            this.#dynState.codeVerifier = this.#base64UrlSafeEncode(buf);
-        }
-        // If sessionIndex exists then increment attempts count (we will stop sending session_index after two failures)
-        // With Infinity '24 we can now properly detect a invalid_session_index error, but can't for earlier versions
-        if (sessionIndex) {
-            this.#dynState.sessionIndexAttempts += 1;
-        }
-        // We use state to verify that the received code is for the right authorize transaction
-        this.#dynState.state = `${state || ''}.${this.#getRandomString(32)}`;
-        // The same redirectUri needs to be provided to token endpoint, so save this away incase redirectUri is
-        //  adjusted for next authorize
-        this.#dynState.acRedirectUri = redirectUri;
-        // Persist codeVerifier in session storage so it survives the redirects that are to follow
-        this.#updateConfig();
-        // Trim alias to include just the real alias piece
-        const additionalScope = (userinfoUri ? '+profile' : '') +
-            (appAlias ? `+app.alias.${appAlias.replace(/^app\//, '')}` : '');
-        const scope = bInfinity ? `openid+email${additionalScope}` : 'user_info';
-        const authServiceArg = authService
-            ? `&${bInfinity ? 'authentication_service' : 'alias'}=${encodeURIComponent(authService)}`
-            : '';
-        const sessionIndexArg = sessionIndex && this.#dynState.sessionIndexAttempts < 3
-            ? `&session_index=${sessionIndex}`
-            : '';
-        // Add specified creds to try to avoid login popup (for Infinity only, and only with 'pega' authService)
-        const userIdentifierArg = userIdentifier
-            ? `&UserIdentifier=${encodeURIComponent(userIdentifier)}`
-            : '';
-        const passwordArg = password && userIdentifier ? `&Password=${encodeURIComponent(atob(password))}` : '';
-        const moreAuthArgs = bInfinity
-            ? `&enable_psyncId=true&cookies=none${sessionIndexArg}${userIdentifierArg}${passwordArg}`
-            : '';
-        let pkceArgs = '';
-        if (!noPKCE) {
-            const cc = await this.#getCodeChallenge(this.#dynState.codeVerifier);
-            pkceArgs = `&code_challenge=${cc}&code_challenge_method=S256`;
-        }
-        return `${authorizeUri}?client_id=${clientId}&response_type=code&redirect_uri=${redirectUri}&scope=${scope}&state=${encodeURIComponent(this.#dynState.state)}${pkceArgs}${authServiceArg}${moreAuthArgs}`;
-    }
     async login() {
         if (this.isNode && !this.crypto) {
             // Deferring dynamic loading of node libraries til this first method to avoid doing this in constructor
-            await this.#importNodeLibs();
+            await __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_importNodeLibs).call(this);
         }
-        const { grantType, noPKCE } = this.#config;
+        const { grantType, noPKCE } = __classPrivateFieldGet(this, _PegaAuth_config, "f");
         if (grantType && grantType !== 'authCode') {
             return this.getToken();
         }
@@ -180,373 +61,39 @@ export class PegaAuth {
         if (!this.isNode && !noPKCE && !window.isSecureContext) {
             throw new Error(`Authorization code grant flow failed due to insecure browser context at ${window.location.origin}.  Use localhost or https.`);
         }
-        return this.#authCodeStart();
-    }
-    // authCode login issues the authorize endpoint transaction and deals with redirects
-    async #authCodeStart() {
-        const fnGetRedirectUriOrigin = () => {
-            const redirectUri = this.#config.redirectUri;
-            const nRootOffset = redirectUri.indexOf('//');
-            const nFirstPathOffset = nRootOffset !== -1 ? redirectUri.indexOf('/', nRootOffset + 2) : -1;
-            return nFirstPathOffset !== -1 ? redirectUri.substring(0, nFirstPathOffset) : redirectUri;
-        };
-        const redirectOrigin = fnGetRedirectUriOrigin();
-        const startState = this.isNode ? '' : btoa(window.location.origin);
-        return new Promise((resolve, reject) => {
-            let theUrl = null; // holds the crafted authorize url
-            let myWindow = null; // popup or iframe
-            let elIframe = null;
-            let elCloseBtn = null;
-            const iframeTimeout = this.#config.silentTimeout !== undefined ? this.#config.silentTimeout : 5000;
-            let bWinIframe = true;
-            let tmrAuthComplete = null;
-            let checkWindowClosed = null;
-            let bDisablePromptNone = false;
-            // Onload handlers fire for iframe content (but not for popup windows)
-            const myWinOnLoad = () => {
-                try {
-                    elIframe.contentWindow.postMessage({ type: 'PegaAuth' }, redirectOrigin);
-                }
-                catch (e) {
-                    // Exception trying to postMessage on load (perhaps should console.warn)
-                }
-            };
-            const fnSetSilentAuthFailed = bSet => {
-                this.#dynState.silentAuthFailed = bSet;
-                this.#updateConfig();
-            };
-            /* eslint-disable prefer-promise-reject-errors */
-            const fnOpenPopup = () => {
-                if (this.#config.noPopups) {
-                    return reject('no-popups');
-                }
-                // Since displaying a visible window, clear the silent auth failed flag
-                fnSetSilentAuthFailed(false);
-                myWindow = (this.isNode ? this.open : window.open)(theUrl, '_blank', 'width=700,height=500,left=200,top=100');
-                if (!myWindow) {
-                    // Blocked by popup-blocker
-                    return reject('blocked');
-                }
-                checkWindowClosed = setInterval(() => {
-                    if (myWindow.closed) {
-                        clearInterval(checkWindowClosed);
-                        reject('closed');
-                    }
-                    // Post to the popup window to cover scenario where window.opener is disabled on
-                    //  popup window by some security library (like helmet.js)
-                    if (!this.isNode) {
-                        myWindow.postMessage({ type: 'PegaAuth' }, redirectOrigin);
-                    }
-                }, 500);
-            };
-            /* eslint-enable prefer-promise-reject-errors */
-            const fnCloseIframe = () => {
-                elIframe.parentNode.removeChild(elIframe);
-                elCloseBtn.parentNode.removeChild(elCloseBtn);
-                elIframe = null;
-                elCloseBtn = null;
-                bWinIframe = false;
-            };
-            const fnCloseAndReject = () => {
-                fnCloseIframe();
-                /* eslint-disable-next-line prefer-promise-reject-errors */
-                reject('closed');
-            };
-            const fnAuthMessageReceiver = event => {
-                // Check origin to make sure it is the redirect origin
-                if (event.origin !== redirectOrigin) {
-                    if (event.data?.type === 'PegaAuth') {
-                        // eslint-disable-next-line no-console
-                        console.error(`Authorization code grant flow error: Unexpected origin: ${event.origin} ... expecting: ${redirectOrigin}`);
-                    }
-                    return;
-                }
-                if (!event.data || !event.data.type || event.data.type !== 'PegaAuth')
-                    return;
-                const aArgs = ['code', 'state', 'error', 'errorDesc'];
-                const aValues = [];
-                for (let i = 0; i < aArgs.length; i += 1) {
-                    const arg = aArgs[i];
-                    aValues[arg] = event.data[arg] ? event.data[arg].toString() : null;
-                }
-                const { code, state, error, errorDesc } = aValues;
-                if (error) {
-                    // eslint-disable-next-line no-console
-                    console.error(`Authorization code grant flow error (${error}): ${errorDesc}`);
-                }
-                if (code && state !== this.#dynState.state) {
-                    // eslint-disable-next-line no-console
-                    console.error(`Authorization code transfer error: state mismatch: ${state} ... expecting: ${this.#dynState.state}`);
-                }
-                if (error || (code && state === this.#dynState.state)) {
-                    // eslint-disable-next-line no-use-before-define
-                    fnGetTokenAndFinish(code, error, errorDesc);
-                }
-            };
-            const fnEnableMessageReceiver = bEnable => {
-                if (bEnable) {
-                    window.addEventListener('message', fnAuthMessageReceiver, false);
-                    window.authCodeCallback = (code, state, error, errorDesc) => {
-                        if (error) {
-                            // eslint-disable-next-line no-console
-                            console.error(`Authorization code grant flow error (${error}): ${errorDesc}`);
-                        }
-                        if (code && state !== this.#dynState.state) {
-                            // eslint-disable-next-line no-console
-                            console.error(`Authorization code transfer error: state mismatch: ${state} ... expecting: ${this.#dynState.state}`);
-                        }
-                        if (error || (code && state === this.#dynState.state)) {
-                            // eslint-disable-next-line no-use-before-define
-                            fnGetTokenAndFinish(code, error, errorDesc);
-                        }
-                    };
-                }
-                else {
-                    window.removeEventListener('message', fnAuthMessageReceiver, false);
-                    delete window.authCodeCallback;
-                }
-            };
-            const doAuthorize = () => {
-                // If there is a userIdentifier and password specified or an external SSO auth service,
-                //  we can try to use this silently in an iFrame first
-                bWinIframe =
-                    !this.isNode &&
-                        !this.#dynState.silentAuthFailed &&
-                        iframeTimeout > 0 &&
-                        ((!!this.#config.userIdentifier && !!this.#config.password) ||
-                            this.#config.iframeLoginUI ||
-                            this.#config.authService !== 'pega');
-                // Enable message receiver
-                if (!this.isNode) {
-                    fnEnableMessageReceiver(true);
-                }
-                if (bWinIframe) {
-                    const nFrameZLevel = 99999;
-                    elIframe = document.createElement('iframe');
-                    elIframe.id = `pe${this.#config.clientId}`;
-                    const loginBoxWidth = 500;
-                    const loginBoxHeight = 700;
-                    const oStyle = elIframe.style;
-                    oStyle.position = 'absolute';
-                    oStyle.display = 'none';
-                    oStyle.zIndex = nFrameZLevel;
-                    oStyle.top = `${Math.round(Math.max(window.innerHeight - loginBoxHeight, 0) / 2)}px`;
-                    oStyle.left = `${Math.round(Math.max(window.innerWidth - loginBoxWidth, 0) / 2)}px`;
-                    oStyle.width = '500px';
-                    oStyle.height = '700px';
-                    // Add Iframe to top of document DOM to have it load
-                    document.body.insertBefore(elIframe, document.body.firstChild);
-                    // document.getElementsByTagName('body')[0].appendChild(elIframe);
-                    elIframe.addEventListener('load', myWinOnLoad, true);
-                    // Disallow iframe content attempts to navigate main window
-                    elIframe.setAttribute('sandbox', 'allow-scripts allow-forms allow-same-origin');
-                    // Adding prompt=none as this is standard OIDC way to communicate no UI is expected (With Infinity '23 or better, this is passed on to
-                    //  configured OIDC authentication services).  cookies=none disables the temporary Pega-Rules cookie otherwise created on auth code
-                    //  grant flow.  For now these two args are either both set or not set, but might have a cookies="partitioned" one day.
-                    elIframe.setAttribute('src', bDisablePromptNone ? theUrl : `${theUrl}&prompt=none`);
-                    const svgCloseBtn = `<?xml version="1.0" encoding="UTF-8"?>
-                        <svg width="34px" height="34px" viewBox="0 0 34 34" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-                          <title>Dismiss - Black</title>
-                          <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
-                            <g transform="translate(1.000000, 1.000000)">
-                              <circle fill="#252C32" cx="16" cy="16" r="16"></circle>
-                              <g transform="translate(9.109375, 9.214844)" fill="#FFFFFF" fill-rule="nonzero">
-                                <path d="M12.7265625,0 L0,12.6210938 L1.0546875,13.5703125 L13.78125,1.0546875 L12.7265625,0 Z M13.7460938,12.5507812 L1.01953125,0 L0,1.01953125 L12.7617188,13.6054688 L13.7460938,12.5507812 Z"></path>
-                              </g>
-                            </g>
-                          </g>
-                        </svg>`;
-                    const bCloseWithinFrame = false;
-                    elCloseBtn = document.createElement('img');
-                    elCloseBtn.onclick = fnCloseAndReject;
-                    elCloseBtn.src = `data:image/svg+xml;base64,${btoa(svgCloseBtn)}`;
-                    const oBtnStyle = elCloseBtn.style;
-                    oBtnStyle.cursor = 'pointer';
-                    // If svg doesn't set width and height might want to set oBtStyle width and height to something like '2em'
-                    oBtnStyle.position = 'absolute';
-                    oBtnStyle.display = 'none';
-                    oBtnStyle.zIndex = nFrameZLevel + 1;
-                    const nTopOffset = bCloseWithinFrame ? 5 : -10;
-                    const nRightOffset = bCloseWithinFrame ? -34 : -20;
-                    const nTop = Math.round(Math.max(window.innerHeight - loginBoxHeight, 0) / 2) + nTopOffset;
-                    oBtnStyle.top = `${nTop}px`;
-                    const nLeft = Math.round(Math.max(window.innerWidth - loginBoxWidth, 0) / 2) +
-                        loginBoxWidth +
-                        nRightOffset;
-                    oBtnStyle.left = `${nLeft}px`;
-                    document.body.insertBefore(elCloseBtn, document.body.firstChild);
-                    // If the password was wrong, then the login screen will be in the iframe
-                    // ..and with Pega without realization of US-372314 it may replace the top (main portal) window
-                    // For now set a timer and if the timer expires, remove the iFrame and use same url within
-                    // visible window
-                    tmrAuthComplete = setTimeout(() => {
-                        clearTimeout(tmrAuthComplete);
-                        /*
-                        // remove password from config
-                        if (this.#config.password) {
-                          delete this.#config.password;
-                          this.#updateConfig();
-                        }
-                        */
-                        // Display the iframe where the redirects did not succeed (or invoke a popup window)
-                        if (this.#config.iframeLoginUI) {
-                            elIframe.style.display = 'block';
-                            elCloseBtn.style.display = 'block';
-                        }
-                        else {
-                            fnCloseIframe();
-                            fnOpenPopup();
-                        }
-                    }, iframeTimeout);
-                }
-                else {
-                    if (this.isNode) {
-                        // Determine port to listen to by extracting it from redirect uri
-                        const { redirectUri, cert, key } = this.#config;
-                        const isHttp = redirectUri.startsWith('http:');
-                        const nLocalhost = redirectUri.indexOf('localhost:');
-                        const nSlash = redirectUri.indexOf('/', nLocalhost + 10);
-                        const nPort = parseInt(redirectUri.substring(nLocalhost + 10, nSlash), 10);
-                        if (nLocalhost !== -1) {
-                            const options = key && cert && !isHttp
-                                ? {
-                                    key: this.fs.readFileSync(key),
-                                    cert: this.fs.readFileSync(cert)
-                                }
-                                : {};
-                            const server = (isHttp ? this.http : this.https).createServer(options, (req, res) => {
-                                const { winTitle, winBodyHtml } = this.#config;
-                                res.writeHead(200, { 'Content-Type': 'text/html' });
-                                // Auto closing window for now.  Can always leave it up and allow authConfig props to set title and bodyHtml
-                                res.end(`<html><head><title>${winTitle}</title><script>window.close();</script></head><body>${winBodyHtml}</body></html>`);
-                                const queryString = req.url.split('?')[1];
-                                const urlParams = new URLSearchParams(queryString);
-                                const code = urlParams.get('code');
-                                const state = urlParams.get('state');
-                                const error = urlParams.get('error');
-                                const errorDesc = urlParams.get('error_description');
-                                if (error || (code && state === this.#dynState.state)) {
-                                    // Stop receiving connections and close when all are handled.
-                                    server.close();
-                                    // eslint-disable-next-line no-use-before-define
-                                    fnGetTokenAndFinish(code, error, errorDesc);
-                                }
-                            });
-                            server.listen(nPort);
-                        }
-                    }
-                    fnOpenPopup();
-                }
-            };
-            /* Retrieve token(s) and close login window */
-            const fnGetTokenAndFinish = (code, error, errorDesc) => {
-                // Can clear state in session info at this point
-                delete this.#dynState.state;
-                this.#updateConfig();
-                if (!this.isNode) {
-                    fnEnableMessageReceiver(false);
-                    if (bWinIframe) {
-                        clearTimeout(tmrAuthComplete);
-                        fnCloseIframe();
-                    }
-                    else {
-                        clearInterval(checkWindowClosed);
-                        try {
-                            if (myWindow) {
-                                myWindow.close();
-                                myWindow = null;
-                            }
-                        }
-                        catch (e) {
-                            // keep going and process code or error even though issue closing popup
-                            // eslint-disable-next-line no-console
-                            console.warn(`Error closing window: ${e}`);
-                        }
-                    }
-                }
-                if (code) {
-                    this.getToken(code)
-                        .then(token => {
-                        resolve(token);
-                    })
-                        .catch(e => {
-                        reject(e);
-                    });
-                }
-                else if (error) {
-                    // Handle some errors in a special manner and pass others back to client
-                    if (error === 'login_required') {
-                        // eslint-disable-next-line no-console
-                        console.warn('silent authentication failed...starting full authentication');
-                        const bSpecialDebugPath = false;
-                        if (bSpecialDebugPath) {
-                            fnSetSilentAuthFailed(false);
-                            bDisablePromptNone = true;
-                        }
-                        else {
-                            fnSetSilentAuthFailed(true);
-                            bDisablePromptNone = false;
-                        }
-                        this.#buildAuthorizeUrl(startState).then(url => {
-                            theUrl = url;
-                            doAuthorize();
-                        });
-                    }
-                    else if (error === 'invalid_session_index') {
-                        // eslint-disable-next-line no-console
-                        console.warn('auth session no longer valid...starting new session');
-                        // In these scenarios, not much user can do without just starting a new session, so do that
-                        this.#updateSessionIndex(null);
-                        fnSetSilentAuthFailed(false);
-                        this.#buildAuthorizeUrl(startState).then(url => {
-                            theUrl = url;
-                            doAuthorize();
-                        });
-                    }
-                    else {
-                        // eslint-disable-next-line no-console
-                        console.warn(`Authorize failed: ${error}. ${errorDesc}\nFailing authorize url: ${theUrl}`);
-                        throw new Error(error, { cause: errorDesc });
-                    }
-                }
-            };
-            this.#buildAuthorizeUrl(startState).then(url => {
-                theUrl = url;
-                doAuthorize();
-            });
-        });
+        return __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_authCodeStart).call(this);
     }
     // Login redirect
     loginRedirect() {
         // eslint-disable-next-line no-restricted-globals
         const startState = btoa(location.origin);
-        this.#buildAuthorizeUrl(startState).then(url => {
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_buildAuthorizeUrl).call(this, startState).then(url => {
+            // Determine if this is in an iframe, and if so, add &cookies=none
+            let cookiesArg = '&cookies=none';
+            try {
+                // No need for &cookies=none if this is a top level window
+                if (window.top === window.self) {
+                    cookiesArg = '';
+                }
+            }
+            catch (e) {
+                // do nothing;
+            }
             // eslint-disable-next-line no-restricted-globals
-            location.href = url;
+            location.href = `${url}${cookiesArg}`;
         });
     }
     // check state
     checkStateMatch(state) {
-        return state === this.#dynState.state;
-    }
-    // Clear session index within config
-    #updateSessionIndex(sessionIndex) {
-        if (sessionIndex) {
-            this.#dynState.sessionIndex = sessionIndex;
-            this.#dynState.sessionIndexAttempts = 0;
-        }
-        else if (this.#dynState.sessionIndex) {
-            delete this.#dynState.sessionIndex;
-        }
-        this.#updateConfig();
+        return state === __classPrivateFieldGet(this, _PegaAuth_dynState, "f").state;
     }
     // For PKCE token endpoint includes code_verifier
     getToken(authCode) {
         // Reload config to pick up the previously stored codeVerifier
-        this.#reloadConfig();
-        const { serverType, clientId, clientSecret, tokenUri, grantType, customTokenParams, userIdentifier, password, noPKCE, secureCookie } = this.#config;
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_reloadConfig).call(this);
+        const { serverType, clientId, clientSecret, tokenUri, grantType, customTokenParams, userIdentifier, password, noPKCE, secureCookie } = __classPrivateFieldGet(this, _PegaAuth_config, "f");
         const bInfinity = serverType === 'infinity';
-        const { sessionIndex, acRedirectUri, codeVerifier } = this.#dynState;
+        const { sessionIndex, acRedirectUri, codeVerifier } = __classPrivateFieldGet(this, _PegaAuth_dynState, "f");
         const bAuthCode = !grantType || grantType === 'authCode';
         if (bAuthCode && !authCode && !this.isNode) {
             const queryString = window.location.search;
@@ -591,7 +138,7 @@ export class PegaAuth {
             formData.append('password', atob(password));
         }
         return fetch(tokenUri, {
-            agent: this.#getAgent(),
+            agent: __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_getAgent).call(this),
             method: 'POST',
             headers: new Headers({
                 'content-type': this.urlencoded
@@ -615,22 +162,22 @@ export class PegaAuth {
                 // add property to keep track of current time when the token expires
                 token.eA = Date.now() + token.expires_in * 1000;
                 // Clear authCode related config state: state, codeVerifier, acRedirectUri
-                if (this.#dynState.state) {
-                    delete this.#dynState.state;
+                if (__classPrivateFieldGet(this, _PegaAuth_dynState, "f").state) {
+                    delete __classPrivateFieldGet(this, _PegaAuth_dynState, "f").state;
                 }
-                if (this.#dynState.codeVerifier) {
-                    delete this.#dynState.codeVerifier;
+                if (__classPrivateFieldGet(this, _PegaAuth_dynState, "f").codeVerifier) {
+                    delete __classPrivateFieldGet(this, _PegaAuth_dynState, "f").codeVerifier;
                 }
-                if (this.#dynState.acRedirectUri) {
-                    delete this.#dynState.acRedirectUri;
+                if (__classPrivateFieldGet(this, _PegaAuth_dynState, "f").acRedirectUri) {
+                    delete __classPrivateFieldGet(this, _PegaAuth_dynState, "f").acRedirectUri;
                 }
                 // If there is a session_index then move this to the peConfig structure (as used on authorize)
                 if (token.session_index) {
-                    this.#updateSessionIndex(token.session_index);
+                    __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_updateSessionIndex).call(this, token.session_index);
                     // does an #updateConfig within #updateSessionIndex
                 }
                 else {
-                    this.#updateConfig();
+                    __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_updateConfig).call(this);
                 }
             }
             return token;
@@ -643,10 +190,10 @@ export class PegaAuth {
         });
     }
     async refreshToken(refreshToken) {
-        const { clientId, clientSecret, tokenUri, secureCookie } = this.#config;
+        const { clientId, clientSecret, tokenUri, secureCookie } = __classPrivateFieldGet(this, _PegaAuth_config, "f");
         if (this.isNode && !this.crypto) {
             // Deferring dynamic loading of node libraries til this first method to avoid doing this in constructor
-            await this.#importNodeLibs();
+            await __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_importNodeLibs).call(this);
         }
         if (!secureCookie && !refreshToken) {
             return null;
@@ -664,7 +211,7 @@ export class PegaAuth {
             formData.append('refresh_token', refreshToken);
         }
         return fetch(tokenUri, {
-            agent: this.#getAgent(),
+            agent: __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_getAgent).call(this),
             method: 'POST',
             headers: new Headers({
                 'content-type': this.urlencoded
@@ -703,15 +250,15 @@ export class PegaAuth {
      * @returns
      */
     async revokeTokens(accessToken, refreshToken = null) {
-        if (Object.keys(this.#config).length === 0) {
+        if (Object.keys(__classPrivateFieldGet(this, _PegaAuth_config, "f")).length === 0) {
             // Must have a config structure to proceed
             return;
         }
-        const { serverType, clientId, clientSecret, revokeUri, secureCookie } = this.#config;
+        const { serverType, clientId, clientSecret, revokeUri, secureCookie } = __classPrivateFieldGet(this, _PegaAuth_config, "f");
         const bLaunchpad = serverType === 'launchpad';
         if (this.isNode && !this.crypto) {
             // Deferring dynamic loading of node libraries til this first method to avoid doing this in constructor
-            await this.#importNodeLibs();
+            await __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_importNodeLibs).call(this);
         }
         const headers = { 'content-type': this.urlencoded };
         if (clientSecret && !bLaunchpad) {
@@ -739,7 +286,7 @@ export class PegaAuth {
         formData.append('token_type_hint', prop);
         if (revokeUri) {
             return fetch(revokeUri, {
-                agent: this.#getAgent(),
+                agent: __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_getAgent).call(this),
                 method: 'POST',
                 headers: new Headers(headers),
                 credentials: secureCookie ? 'include' : 'omit',
@@ -756,19 +303,19 @@ export class PegaAuth {
                 console.error(`Error revoking ${prop}; ${e}`);
             })
                 .finally(() => {
-                this.#dynState.silentAuthFailed = false;
+                __classPrivateFieldGet(this, _PegaAuth_dynState, "f").silentAuthFailed = false;
                 // Also clobber any sessionIndex
-                this.#updateSessionIndex(null);
+                __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_updateSessionIndex).call(this, null);
             });
         }
-        this.#dynState.silentAuthFailed = false;
+        __classPrivateFieldGet(this, _PegaAuth_dynState, "f").silentAuthFailed = false;
         // Also clobber any sessionIndex
-        this.#updateSessionIndex(null);
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_updateSessionIndex).call(this, null);
     }
     // For userinfo endpoint to return meaningful data, endpoint must include appAlias (if specified) and authorize must
     //  specify profile and optionally email scope to get such info returned
     async getUserinfo(accessToken) {
-        if (!this.#config || !this.#config.userinfoUri) {
+        if (!__classPrivateFieldGet(this, _PegaAuth_config, "f") || !__classPrivateFieldGet(this, _PegaAuth_config, "f").userinfoUri) {
             // Must have a config structure and userInfo to proceed
             return {};
         }
@@ -776,8 +323,8 @@ export class PegaAuth {
             authorization: `bearer ${accessToken}`,
             'content-type': 'application/json;charset=UTF-8'
         };
-        return fetch(this.#config.userinfoUri, {
-            agent: this.#getAgent(),
+        return fetch(__classPrivateFieldGet(this, _PegaAuth_config, "f").userinfoUri, {
+            agent: __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_getAgent).call(this),
             method: 'GET',
             headers: new Headers(headers)
         })
@@ -796,64 +343,520 @@ export class PegaAuth {
             console.log(e);
         });
     }
-    #sha256Hash(str) {
-        // Found that the Node implementation of subtle.digest is yielding incorrect results
-        //  so using a different set of apis to get expected results.
-        if (this.isNode) {
-            return new Promise(resolve => {
-                resolve(this.crypto.createHash('sha256').update(str).digest());
-            });
+}
+_PegaAuth_config = new WeakMap(), _PegaAuth_dynState = new WeakMap(), _PegaAuth_instances = new WeakSet(), _PegaAuth_reloadSS = function _PegaAuth_reloadSS(ssKey) {
+    const sItem = window.sessionStorage.getItem(ssKey);
+    let obj = {};
+    if (sItem) {
+        try {
+            obj = JSON.parse(sItem);
+        }
+        catch (e) {
+            try {
+                obj = JSON.parse(atob(sItem));
+            }
+            catch (err) {
+                obj = {};
+            }
         }
-        return this.subtle.digest('SHA-256', new TextEncoder().encode(str));
     }
-    // Base64 encode
-    /* eslint-disable-next-line class-methods-use-this */
-    #encode64(buff) {
-        return btoa(new Uint8Array(buff).reduce((s, b) => s + String.fromCharCode(b), ''));
+    if (ssKey === this.ssKeyConfig) {
+        __classPrivateFieldSet(this, _PegaAuth_config, sItem ? obj : {}, "f");
     }
-    /*
-     * Base64 url safe encoding of an array
-     */
-    #base64UrlSafeEncode(buf) {
-        return this.#encode64(buf).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+    else {
+        __classPrivateFieldSet(this, _PegaAuth_dynState, sItem ? obj : {}, "f");
     }
-    /*
-     * Get Random string starting with buffer of specified size
-     */
-    #getRandomString(nSize) {
-        const buf = new Uint8Array(nSize);
+}, _PegaAuth_reloadConfig = function _PegaAuth_reloadConfig() {
+    if (this.ssKeyConfig) {
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_reloadSS).call(this, this.ssKeyConfig);
+    }
+    if (this.ssKeyDynState) {
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_reloadSS).call(this, this.ssKeyDynState);
+    }
+}, _PegaAuth_updateConfig = function _PegaAuth_updateConfig() {
+    // transform must occur unless it is explicitly disabled
+    const transform = __classPrivateFieldGet(this, _PegaAuth_config, "f").transform !== false;
+    // May not need to write out Config info all the time, but there is a scenario where a
+    //  non obfuscated value is passed in and then it needs to be obfuscated
+    if (this.ssKeyConfig) {
+        const sConfig = JSON.stringify(__classPrivateFieldGet(this, _PegaAuth_config, "f"));
+        window.sessionStorage.setItem(this.ssKeyConfig, transform ? btoa(sConfig) : sConfig);
+    }
+    if (this.ssKeyDynState) {
+        const sDynState = JSON.stringify(__classPrivateFieldGet(this, _PegaAuth_dynState, "f"));
+        window.sessionStorage.setItem(this.ssKeyDynState, transform ? btoa(sDynState) : sDynState);
+    }
+    if (__classPrivateFieldGet(this, _PegaAuth_config, "f").fnDynStateChangedCB) {
+        __classPrivateFieldGet(this, _PegaAuth_config, "f").fnDynStateChangedCB();
+    }
+}, _PegaAuth_importSingleLib = async function _PegaAuth_importSingleLib(libName, libProp, bLoadAlways = false) {
+    if (!bLoadAlways && typeof (this.isNode ? global : window)[libProp] !== 'undefined') {
+        this[libProp] = (this.isNode ? global : window)[libProp];
+        return this[libProp];
+    }
+    // Needed to explicitly make import argument a string by using template literals to fix a compile
+    // error: Critical dependency: the request of a dependency is an expression
+    return import(/* webpackIgnore: true */ `${libName}`)
+        .then(mod => {
+        this[libProp] = mod.default;
+    })
+        .catch(e => {
+        // eslint-disable-next-line no-console
+        console.error(`Library ${libName} failed to load. ${e}`);
+        throw e;
+    });
+}, _PegaAuth_importNodeLibs = async function _PegaAuth_importNodeLibs() {
+    // Also current assumption is using Node 18 or better
+    // With 18.3 there is now a native fetch (but may want to force use of node-fetch)
+    const useNodeFetch = !!__classPrivateFieldGet(this, _PegaAuth_config, "f").useNodeFetch;
+    return Promise.all([
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_importSingleLib).call(this, 'node-fetch', 'fetch', useNodeFetch),
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_importSingleLib).call(this, 'open', 'open'),
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_importSingleLib).call(this, 'node:crypto', 'crypto', true),
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_importSingleLib).call(this, 'node:https', 'https'),
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_importSingleLib).call(this, 'node:http', 'http'),
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_importSingleLib).call(this, 'node:fs', 'fs')
+    ]).then(() => {
+        this.subtle = this.crypto?.subtle || this.crypto.webcrypto.subtle;
+        if ((typeof fetch === 'undefined' || useNodeFetch) && this.fetch) {
+            /* eslint-disable-next-line no-global-assign */
+            fetch = this.fetch;
+        }
+    });
+}, _PegaAuth_buildAuthorizeUrl = 
+// For PKCE the authorize includes a code_challenge & code_challenge_method as well
+async function _PegaAuth_buildAuthorizeUrl(state) {
+    const { serverType, clientId, redirectUri, authorizeUri, userinfoUri, authService, appAlias, userIdentifier, password, noPKCE } = __classPrivateFieldGet(this, _PegaAuth_config, "f");
+    const { sessionIndex } = __classPrivateFieldGet(this, _PegaAuth_dynState, "f");
+    const bInfinity = serverType === 'infinity';
+    if (!noPKCE) {
+        // Generate random string of 64 chars for verifier.  RFC 7636 says from 43-128 chars
+        const buf = new Uint8Array(64);
         this.crypto.getRandomValues(buf);
-        return this.#base64UrlSafeEncode(buf);
+        __classPrivateFieldGet(this, _PegaAuth_dynState, "f").codeVerifier = __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_base64UrlSafeEncode).call(this, buf);
     }
-    /*
-     * Calc code verifier if necessary
-     */
-    async #getCodeChallenge(codeVerifier) {
-        return this.#sha256Hash(codeVerifier)
-            .then(hashed => {
-            return this.#base64UrlSafeEncode(hashed);
-        })
-            .catch(error => {
-            // eslint-disable-next-line no-console
-            console.error(`Error calculation code challenge for PKCE: ${error}`);
-        })
-            .finally(() => {
-            return null;
-        });
+    // If sessionIndex exists then increment attempts count (we will stop sending session_index after two failures)
+    // With Infinity '24 we can now properly detect a invalid_session_index error, but can't for earlier versions
+    if (sessionIndex) {
+        __classPrivateFieldGet(this, _PegaAuth_dynState, "f").sessionIndexAttempts += 1;
     }
-    /*
-     * Return agent value for POST commands
-     */
-    #getAgent() {
-        if (this.isNode && this.#config.ignoreInvalidCerts) {
-            const options = { rejectUnauthorized: false };
-            if (this.#config.legacyTLS) {
-                options.secureOptions = this.crypto.constants.SSL_OP_LEGACY_SERVER_CONNECT;
+    // We use state to verify that the received code is for the right authorize transaction
+    __classPrivateFieldGet(this, _PegaAuth_dynState, "f").state = `${state || ''}.${__classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_getRandomString).call(this, 32)}`;
+    // The same redirectUri needs to be provided to token endpoint, so save this away in case redirectUri is
+    //  adjusted for next authorize
+    __classPrivateFieldGet(this, _PegaAuth_dynState, "f").acRedirectUri = redirectUri;
+    // Persist codeVerifier in session storage so it survives the redirects that are to follow
+    __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_updateConfig).call(this);
+    // Trim alias to include just the real alias piece
+    const additionalScope = (userinfoUri ? '+profile' : '') +
+        (appAlias ? `+app.alias.${appAlias.replace(/^app\//, '')}` : '');
+    const scope = bInfinity ? `openid+email${additionalScope}` : 'user_info';
+    const authServiceArg = authService
+        ? `&${bInfinity ? 'authentication_service' : 'alias'}=${encodeURIComponent(authService)}`
+        : '';
+    const sessionIndexArg = sessionIndex && __classPrivateFieldGet(this, _PegaAuth_dynState, "f").sessionIndexAttempts < 3
+        ? `&session_index=${sessionIndex}`
+        : '';
+    // Add specified creds to try to avoid login popup (for Infinity only, and only with 'pega' authService)
+    const userIdentifierArg = userIdentifier
+        ? `&UserIdentifier=${encodeURIComponent(userIdentifier)}`
+        : '';
+    const passwordArg = password && userIdentifier ? `&Password=${encodeURIComponent(atob(password))}` : '';
+    const moreAuthArgs = bInfinity
+        ? `&enable_psyncId=true${sessionIndexArg}${userIdentifierArg}${passwordArg}`
+        : '';
+    let pkceArgs = '';
+    if (!noPKCE) {
+        const cc = await __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_getCodeChallenge).call(this, __classPrivateFieldGet(this, _PegaAuth_dynState, "f").codeVerifier);
+        pkceArgs = `&code_challenge=${cc}&code_challenge_method=S256`;
+    }
+    return `${authorizeUri}?client_id=${clientId}&response_type=code&redirect_uri=${redirectUri}&scope=${scope}&state=${encodeURIComponent(__classPrivateFieldGet(this, _PegaAuth_dynState, "f").state)}${pkceArgs}${authServiceArg}${moreAuthArgs}`;
+}, _PegaAuth_authCodeStart = 
+// authCode login issues the authorize endpoint transaction and deals with redirects
+async function _PegaAuth_authCodeStart() {
+    const fnGetRedirectUriOrigin = () => {
+        const redirectUri = __classPrivateFieldGet(this, _PegaAuth_config, "f").redirectUri;
+        const nRootOffset = redirectUri.indexOf('//');
+        const nFirstPathOffset = nRootOffset !== -1 ? redirectUri.indexOf('/', nRootOffset + 2) : -1;
+        return nFirstPathOffset !== -1 ? redirectUri.substring(0, nFirstPathOffset) : redirectUri;
+    };
+    const redirectOrigin = fnGetRedirectUriOrigin();
+    // Found that if loaded within a iframe srcdoc tag, then window.location.origin is string 'null
+    const startState = this.isNode || window.location.origin === 'null' ? '' : btoa(window.location.origin);
+    return new Promise((resolve, reject) => {
+        let theUrl = null; // holds the crafted authorize url
+        let myWindow = null; // popup or iframe
+        let elIframe = null;
+        let elCloseBtn = null;
+        const iframeTimeout = __classPrivateFieldGet(this, _PegaAuth_config, "f").silentTimeout !== undefined ? __classPrivateFieldGet(this, _PegaAuth_config, "f").silentTimeout : 5000;
+        let bWinIframe = true;
+        let tmrAuthComplete = null;
+        let checkWindowClosed = null;
+        let bDisablePromptNone = false;
+        // Onload handlers fire for iframe content (but not for popup windows)
+        const myWinOnLoad = () => {
+            try {
+                elIframe.contentWindow.postMessage({ type: 'PegaAuth' }, redirectOrigin);
             }
-            return new this.https.Agent(options);
-        }
-        return undefined;
+            catch (e) {
+                // Exception trying to postMessage on load (perhaps should console.warn)
+            }
+        };
+        const fnSetSilentAuthFailed = bSet => {
+            __classPrivateFieldGet(this, _PegaAuth_dynState, "f").silentAuthFailed = bSet;
+            __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_updateConfig).call(this);
+        };
+        /* eslint-disable prefer-promise-reject-errors */
+        const fnOpenPopup = () => {
+            if (__classPrivateFieldGet(this, _PegaAuth_config, "f").noPopups) {
+                return reject('no-popups');
+            }
+            // Since displaying a visible window, clear the silent auth failed flag
+            fnSetSilentAuthFailed(false);
+            myWindow = (this.isNode ? this.open : window.open)(theUrl, '_blank', 'width=700,height=500,left=200,top=100');
+            if (!myWindow) {
+                // Blocked by popup-blocker
+                return reject('blocked');
+            }
+            checkWindowClosed = setInterval(() => {
+                if (myWindow.closed) {
+                    clearInterval(checkWindowClosed);
+                    reject('closed');
+                }
+                // Post to the popup window to cover scenario where window.opener is disabled on
+                //  popup window by some security library (like helmet.js)
+                if (!this.isNode) {
+                    myWindow.postMessage({ type: 'PegaAuth' }, redirectOrigin);
+                }
+            }, 500);
+        };
+        /* eslint-enable prefer-promise-reject-errors */
+        const fnCloseIframe = () => {
+            elIframe.parentNode.removeChild(elIframe);
+            elCloseBtn.parentNode.removeChild(elCloseBtn);
+            elIframe = null;
+            elCloseBtn = null;
+            bWinIframe = false;
+        };
+        const fnCloseAndReject = () => {
+            fnCloseIframe();
+            /* eslint-disable-next-line prefer-promise-reject-errors */
+            reject('closed');
+        };
+        const fnAuthMessageReceiver = event => {
+            // Check origin to make sure it is the redirect origin
+            if (event.origin !== redirectOrigin) {
+                if (event.data?.type === 'PegaAuth') {
+                    // eslint-disable-next-line no-console
+                    console.error(`Authorization code grant flow error: Unexpected origin: ${event.origin} ... expecting: ${redirectOrigin}`);
+                }
+                return;
+            }
+            if (!event.data || !event.data.type || event.data.type !== 'PegaAuth')
+                return;
+            const aArgs = ['code', 'state', 'error', 'errorDesc'];
+            const aValues = [];
+            for (let i = 0; i < aArgs.length; i += 1) {
+                const arg = aArgs[i];
+                aValues[arg] = event.data[arg] ? event.data[arg].toString() : null;
+            }
+            const { code, state, error, errorDesc } = aValues;
+            if (error) {
+                // eslint-disable-next-line no-console
+                console.error(`Authorization code grant flow error (${error}): ${errorDesc}`);
+            }
+            if (code && state !== __classPrivateFieldGet(this, _PegaAuth_dynState, "f").state) {
+                // eslint-disable-next-line no-console
+                console.error(`Authorization code transfer error: state mismatch: ${state} ... expecting: ${__classPrivateFieldGet(this, _PegaAuth_dynState, "f").state}`);
+            }
+            if (error || (code && state === __classPrivateFieldGet(this, _PegaAuth_dynState, "f").state)) {
+                // eslint-disable-next-line no-use-before-define
+                fnGetTokenAndFinish(code, error, errorDesc);
+            }
+        };
+        const fnEnableMessageReceiver = bEnable => {
+            if (bEnable) {
+                window.addEventListener('message', fnAuthMessageReceiver, false);
+                window.authCodeCallback = (code, state, error, errorDesc) => {
+                    if (error) {
+                        // eslint-disable-next-line no-console
+                        console.error(`Authorization code grant flow error (${error}): ${errorDesc}`);
+                    }
+                    if (code && state !== __classPrivateFieldGet(this, _PegaAuth_dynState, "f").state) {
+                        // eslint-disable-next-line no-console
+                        console.error(`Authorization code transfer error: state mismatch: ${state} ... expecting: ${__classPrivateFieldGet(this, _PegaAuth_dynState, "f").state}`);
+                    }
+                    if (error || (code && state === __classPrivateFieldGet(this, _PegaAuth_dynState, "f").state)) {
+                        // eslint-disable-next-line no-use-before-define
+                        fnGetTokenAndFinish(code, error, errorDesc);
+                    }
+                };
+            }
+            else {
+                window.removeEventListener('message', fnAuthMessageReceiver, false);
+                delete window.authCodeCallback;
+            }
+        };
+        const doAuthorize = () => {
+            // If there is a userIdentifier and password specified or an external SSO auth service,
+            //  we can try to use this silently in an iFrame first
+            bWinIframe =
+                !this.isNode &&
+                    !__classPrivateFieldGet(this, _PegaAuth_dynState, "f").silentAuthFailed &&
+                    iframeTimeout > 0 &&
+                    ((!!__classPrivateFieldGet(this, _PegaAuth_config, "f").userIdentifier && !!__classPrivateFieldGet(this, _PegaAuth_config, "f").password) ||
+                        __classPrivateFieldGet(this, _PegaAuth_config, "f").iframeLoginUI ||
+                        __classPrivateFieldGet(this, _PegaAuth_config, "f").authService !== 'pega');
+            // Enable message receiver
+            if (!this.isNode) {
+                fnEnableMessageReceiver(true);
+            }
+            if (bWinIframe) {
+                const nFrameZLevel = 99999;
+                elIframe = document.createElement('iframe');
+                elIframe.id = `pe${__classPrivateFieldGet(this, _PegaAuth_config, "f").clientId}`;
+                const loginBoxWidth = 500;
+                const loginBoxHeight = 700;
+                const oStyle = elIframe.style;
+                oStyle.position = 'absolute';
+                oStyle.display = 'none';
+                oStyle.zIndex = nFrameZLevel;
+                oStyle.top = `${Math.round(Math.max(window.innerHeight - loginBoxHeight, 0) / 2)}px`;
+                oStyle.left = `${Math.round(Math.max(window.innerWidth - loginBoxWidth, 0) / 2)}px`;
+                oStyle.width = '500px';
+                oStyle.height = '700px';
+                // Add Iframe to top of document DOM to have it load
+                document.body.insertBefore(elIframe, document.body.firstChild);
+                // document.getElementsByTagName('body')[0].appendChild(elIframe);
+                elIframe.addEventListener('load', myWinOnLoad, true);
+                // Disallow iframe content attempts to navigate main window
+                elIframe.setAttribute('sandbox', 'allow-scripts allow-forms allow-same-origin');
+                // Adding prompt=none as this is standard OIDC way to communicate no UI is expected (With Infinity '23 or better, this is passed on to
+                //  configured OIDC authentication services).  cookies=none disables the temporary Pega-Rules cookie otherwise created on auth code
+                //  grant flow.  For now these two args are either both set or not set, but might have a cookies="partitioned" one day.
+                elIframe.setAttribute('src', bDisablePromptNone ? `${theUrl}&cookies=none` : `${theUrl}&cookies=none&prompt=none`);
+                const svgCloseBtn = `<?xml version="1.0" encoding="UTF-8"?>
+                        <svg width="34px" height="34px" viewBox="0 0 34 34" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+                          <title>Dismiss - Black</title>
+                          <g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
+                            <g transform="translate(1.000000, 1.000000)">
+                              <circle fill="#252C32" cx="16" cy="16" r="16"></circle>
+                              <g transform="translate(9.109375, 9.214844)" fill="#FFFFFF" fill-rule="nonzero">
+                                <path d="M12.7265625,0 L0,12.6210938 L1.0546875,13.5703125 L13.78125,1.0546875 L12.7265625,0 Z M13.7460938,12.5507812 L1.01953125,0 L0,1.01953125 L12.7617188,13.6054688 L13.7460938,12.5507812 Z"></path>
+                              </g>
+                            </g>
+                          </g>
+                        </svg>`;
+                const bCloseWithinFrame = false;
+                elCloseBtn = document.createElement('img');
+                elCloseBtn.onclick = fnCloseAndReject;
+                elCloseBtn.src = `data:image/svg+xml;base64,${btoa(svgCloseBtn)}`;
+                const oBtnStyle = elCloseBtn.style;
+                oBtnStyle.cursor = 'pointer';
+                // If svg doesn't set width and height might want to set oBtStyle width and height to something like '2em'
+                oBtnStyle.position = 'absolute';
+                oBtnStyle.display = 'none';
+                oBtnStyle.zIndex = nFrameZLevel + 1;
+                const nTopOffset = bCloseWithinFrame ? 5 : -10;
+                const nRightOffset = bCloseWithinFrame ? -34 : -20;
+                const nTop = Math.round(Math.max(window.innerHeight - loginBoxHeight, 0) / 2) + nTopOffset;
+                oBtnStyle.top = `${nTop}px`;
+                const nLeft = Math.round(Math.max(window.innerWidth - loginBoxWidth, 0) / 2) +
+                    loginBoxWidth +
+                    nRightOffset;
+                oBtnStyle.left = `${nLeft}px`;
+                document.body.insertBefore(elCloseBtn, document.body.firstChild);
+                // If the password was wrong, then the login screen will be in the iframe
+                // ..and with Pega without realization of US-372314 it may replace the top (main portal) window
+                // For now set a timer and if the timer expires, remove the iFrame and use same url within
+                // visible window
+                tmrAuthComplete = setTimeout(() => {
+                    clearTimeout(tmrAuthComplete);
+                    /*
+                    // remove password from config
+                    if (this.#config.password) {
+                      delete this.#config.password;
+                      this.#updateConfig();
+                    }
+                    */
+                    // Display the iframe where the redirects did not succeed (or invoke a popup window)
+                    if (__classPrivateFieldGet(this, _PegaAuth_config, "f").iframeLoginUI) {
+                        elIframe.style.display = 'block';
+                        elCloseBtn.style.display = 'block';
+                    }
+                    else {
+                        fnCloseIframe();
+                        fnOpenPopup();
+                    }
+                }, iframeTimeout);
+            }
+            else {
+                if (this.isNode) {
+                    // Determine port to listen to by extracting it from redirect uri
+                    const { redirectUri, cert, key } = __classPrivateFieldGet(this, _PegaAuth_config, "f");
+                    const isHttp = redirectUri.startsWith('http:');
+                    const nLocalhost = redirectUri.indexOf('localhost:');
+                    const nSlash = redirectUri.indexOf('/', nLocalhost + 10);
+                    const nPort = parseInt(redirectUri.substring(nLocalhost + 10, nSlash), 10);
+                    if (nLocalhost !== -1) {
+                        const options = key && cert && !isHttp
+                            ? {
+                                key: this.fs.readFileSync(key),
+                                cert: this.fs.readFileSync(cert)
+                            }
+                            : {};
+                        const server = (isHttp ? this.http : this.https).createServer(options, (req, res) => {
+                            const { winTitle, winBodyHtml } = __classPrivateFieldGet(this, _PegaAuth_config, "f");
+                            res.writeHead(200, { 'Content-Type': 'text/html' });
+                            // Auto closing window for now.  Can always leave it up and allow authConfig props to set title and bodyHtml
+                            res.end(`<html><head><title>${winTitle}</title><script>window.close();</script></head><body>${winBodyHtml}</body></html>`);
+                            const queryString = req.url.split('?')[1];
+                            const urlParams = new URLSearchParams(queryString);
+                            const code = urlParams.get('code');
+                            const state = urlParams.get('state');
+                            const error = urlParams.get('error');
+                            const errorDesc = urlParams.get('error_description');
+                            if (error || (code && state === __classPrivateFieldGet(this, _PegaAuth_dynState, "f").state)) {
+                                // Stop receiving connections and close when all are handled.
+                                server.close();
+                                // eslint-disable-next-line no-use-before-define
+                                fnGetTokenAndFinish(code, error, errorDesc);
+                            }
+                        });
+                        server.listen(nPort);
+                    }
+                }
+                fnOpenPopup();
+            }
+        };
+        /* Retrieve token(s) and close login window */
+        const fnGetTokenAndFinish = (code, error, errorDesc) => {
+            // Can clear state in session info at this point
+            delete __classPrivateFieldGet(this, _PegaAuth_dynState, "f").state;
+            __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_updateConfig).call(this);
+            if (!this.isNode) {
+                fnEnableMessageReceiver(false);
+                if (bWinIframe) {
+                    clearTimeout(tmrAuthComplete);
+                    fnCloseIframe();
+                }
+                else {
+                    clearInterval(checkWindowClosed);
+                    try {
+                        if (myWindow) {
+                            myWindow.close();
+                            myWindow = null;
+                        }
+                    }
+                    catch (e) {
+                        // keep going and process code or error even though issue closing popup
+                        // eslint-disable-next-line no-console
+                        console.warn(`Error closing window: ${e}`);
+                    }
+                }
+            }
+            if (code) {
+                this.getToken(code)
+                    .then(token => {
+                    resolve(token);
+                })
+                    .catch(e => {
+                    reject(e);
+                });
+            }
+            else if (error) {
+                // Handle some errors in a special manner and pass others back to client
+                if (error === 'login_required') {
+                    // eslint-disable-next-line no-console
+                    console.warn('silent authentication failed...starting full authentication');
+                    const bSpecialDebugPath = false;
+                    if (bSpecialDebugPath) {
+                        fnSetSilentAuthFailed(false);
+                        bDisablePromptNone = true;
+                    }
+                    else {
+                        fnSetSilentAuthFailed(true);
+                        bDisablePromptNone = false;
+                    }
+                    __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_buildAuthorizeUrl).call(this, startState).then(url => {
+                        theUrl = url;
+                        doAuthorize();
+                    });
+                }
+                else if (error === 'invalid_session_index') {
+                    // eslint-disable-next-line no-console
+                    console.warn('auth session no longer valid...starting new session');
+                    // In these scenarios, not much user can do without just starting a new session, so do that
+                    __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_updateSessionIndex).call(this, null);
+                    fnSetSilentAuthFailed(false);
+                    __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_buildAuthorizeUrl).call(this, startState).then(url => {
+                        theUrl = url;
+                        doAuthorize();
+                    });
+                }
+                else {
+                    // eslint-disable-next-line no-console
+                    console.warn(`Authorize failed: ${error}. ${errorDesc}\nFailing authorize url: ${theUrl}`);
+                    throw new Error(error, { cause: errorDesc });
+                }
+            }
+        };
+        __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_buildAuthorizeUrl).call(this, startState).then(url => {
+            theUrl = url;
+            doAuthorize();
+        });
+    });
+}, _PegaAuth_updateSessionIndex = function _PegaAuth_updateSessionIndex(sessionIndex) {
+    if (sessionIndex) {
+        __classPrivateFieldGet(this, _PegaAuth_dynState, "f").sessionIndex = sessionIndex;
+        __classPrivateFieldGet(this, _PegaAuth_dynState, "f").sessionIndexAttempts = 0;
     }
-}
+    else if (__classPrivateFieldGet(this, _PegaAuth_dynState, "f").sessionIndex) {
+        delete __classPrivateFieldGet(this, _PegaAuth_dynState, "f").sessionIndex;
+    }
+    __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_updateConfig).call(this);
+}, _PegaAuth_sha256Hash = function _PegaAuth_sha256Hash(str) {
+    // Found that the Node implementation of subtle.digest is yielding incorrect results
+    //  so using a different set of apis to get expected results.
+    if (this.isNode) {
+        return new Promise(resolve => {
+            resolve(this.crypto.createHash('sha256').update(str).digest());
+        });
+    }
+    return this.subtle.digest('SHA-256', new TextEncoder().encode(str));
+}, _PegaAuth_encode64 = function _PegaAuth_encode64(buff) {
+    return btoa(new Uint8Array(buff).reduce((s, b) => s + String.fromCharCode(b), ''));
+}, _PegaAuth_base64UrlSafeEncode = function _PegaAuth_base64UrlSafeEncode(buf) {
+    return __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_encode64).call(this, buf).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}, _PegaAuth_getRandomString = function _PegaAuth_getRandomString(nSize) {
+    const buf = new Uint8Array(nSize);
+    this.crypto.getRandomValues(buf);
+    return __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_base64UrlSafeEncode).call(this, buf);
+}, _PegaAuth_getCodeChallenge = 
+/*
+ * Calc code verifier if necessary
+ */
+async function _PegaAuth_getCodeChallenge(codeVerifier) {
+    return __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_sha256Hash).call(this, codeVerifier)
+        .then(hashed => {
+        return __classPrivateFieldGet(this, _PegaAuth_instances, "m", _PegaAuth_base64UrlSafeEncode).call(this, hashed);
+    })
+        .catch(error => {
+        // eslint-disable-next-line no-console
+        console.error(`Error calculation code challenge for PKCE: ${error}`);
+    })
+        .finally(() => {
+        return null;
+    });
+}, _PegaAuth_getAgent = function _PegaAuth_getAgent() {
+    if (this.isNode && __classPrivateFieldGet(this, _PegaAuth_config, "f").ignoreInvalidCerts) {
+        const options = { rejectUnauthorized: false };
+        if (__classPrivateFieldGet(this, _PegaAuth_config, "f").legacyTLS) {
+            options.secureOptions = this.crypto.constants.SSL_OP_LEGACY_SERVER_CONNECT;
+        }
+        return new this.https.Agent(options);
+    }
+    return undefined;
+};
 export default PegaAuth;
 //# sourceMappingURL=auth.js.map