@rivm-loculus-tools/common-frontend 0.8.0 → 0.10.0

package/dist/_chunks/LoculusService.js

@@ -0,0 +1,1049 @@
+import { MetaDataUtil as e } from "../utils/MetaDataUtil/index.js";
+import { FastaUtil as t } from "../utils/FastaUtil/index.js";
+import { t as n } from "./decorate.js";
+import { singleton as r } from "tsyringe";
+import { SubscribableAbstract as i } from "@gen-epix/ui-core/classes/abstracts/SubscribableAbstract";
+import { Subject as a } from "@gen-epix/ui-core/classes/Subject";
+// ../../../node_modules/.pnpm/keycloak-js@26.2.5/node_modules/keycloak-js/lib/deprecations.js
+var o = /* @__PURE__ */ new Set();
+function s(e, t) {
+	o.has(e) || (o.add(e), console.warn(`[KEYCLOAK] ${e}: ${t}`));
+}
+function c(e, t, n) {
+	for (let r of n) {
+		let n = e[r];
+		e[r] = function(...i) {
+			return this !== e && s(`${t}:${r}`, `Calling '${r}()' without a bound 'this' is deprecated and will stop working in a future major version.`), n.apply(e, i);
+		};
+	}
+}
+// ../../../node_modules/.pnpm/keycloak-js@26.2.5/node_modules/keycloak-js/lib/keycloak.js
+var l = "application/json", u = class {
+	#e = [];
+	#t;
+	#n = !0;
+	#r;
+	#i = this.#F(console.info);
+	#a = this.#F(console.warn);
+	#o = {
+		enable: !0,
+		callbackList: [],
+		interval: 5
+	};
+	#s;
+	#c;
+	didInitialize = !1;
+	authenticated = !1;
+	loginRequired = !1;
+	responseMode = "fragment";
+	responseType = "code";
+	flow = "standard";
+	timeSkew = null;
+	redirectUri;
+	silentCheckSsoRedirectUri;
+	silentCheckSsoFallback = !0;
+	pkceMethod = "S256";
+	enableLogging = !1;
+	logoutMethod = "GET";
+	scope;
+	messageReceiveTimeout = 1e4;
+	idToken;
+	idTokenParsed;
+	token;
+	tokenParsed;
+	refreshToken;
+	refreshTokenParsed;
+	clientId;
+	sessionId;
+	subject;
+	authServerUrl;
+	realm;
+	realmAccess;
+	resourceAccess;
+	profile;
+	userInfo;
+	endpoints;
+	tokenTimeoutHandle;
+	onAuthSuccess;
+	onAuthError;
+	onAuthRefreshSuccess;
+	onAuthRefreshError;
+	onTokenExpired;
+	onAuthLogout;
+	onReady;
+	onActionUpdate;
+	constructor(e) {
+		if (typeof e != "string" && !D(e)) throw Error("The 'Keycloak' constructor must be provided with a configuration object, or a URL to a JSON configuration file.");
+		if (D(e)) {
+			let t = "oidcProvider" in e ? ["clientId"] : [
+				"url",
+				"realm",
+				"clientId"
+			];
+			for (let n of t) if (!(n in e)) throw Error(`The configuration object is missing the required '${n}' property.`);
+		}
+		globalThis.isSecureContext || this.#a("[KEYCLOAK] Keycloak JS must be used in a 'secure context' to function properly as it relies on browser APIs that are otherwise not available.\nContinuing to run your application insecurely will lead to unexpected behavior and breakage.\n\nFor more information see: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts"), this.#c = e, c(this, "KC-DEP-003", [
+			"init",
+			"login",
+			"createLoginUrl",
+			"logout",
+			"createLogoutUrl",
+			"register",
+			"createRegisterUrl",
+			"createAccountUrl",
+			"accountManagement",
+			"hasRealmRole",
+			"hasResourceRole",
+			"loadUserProfile",
+			"loadUserInfo",
+			"isTokenExpired",
+			"updateToken",
+			"clearToken"
+		]);
+	}
+	async init(e = {}) {
+		if (this.didInitialize) throw Error("A 'Keycloak' instance can only be initialized once.");
+		if (this.didInitialize = !0, this.#r = v(), this.#t = typeof e.adapter == "string" && [
+			"default",
+			"cordova",
+			"cordova-native"
+		].includes(e.adapter) ? this.#l(e.adapter) : typeof e.adapter == "object" ? e.adapter : "Cordova" in window || "cordova" in window ? this.#l("cordova") : this.#l("default"), e.useNonce !== void 0 && (this.#n = e.useNonce), e.checkLoginIframe !== void 0 && (this.#o.enable = e.checkLoginIframe), e.checkLoginIframeInterval && (this.#o.interval = e.checkLoginIframeInterval), e.onLoad === "login-required" && (this.loginRequired = !0), e.responseMode) {
+			if (e.responseMode === "query" || e.responseMode === "fragment") this.responseMode = e.responseMode;
+			else throw Error("Invalid value for responseMode");
+		}
+		if (e.flow) {
+			switch (e.flow) {
+				case "standard":
+					this.responseType = "code";
+					break;
+				case "implicit":
+					this.responseType = "id_token token";
+					break;
+				case "hybrid":
+					this.responseType = "code id_token token";
+					break;
+				default: throw Error("Invalid value for flow");
+			}
+			this.flow = e.flow;
+		}
+		if (typeof e.timeSkew == "number" && (this.timeSkew = e.timeSkew), e.redirectUri && (this.redirectUri = e.redirectUri), e.silentCheckSsoRedirectUri && (this.silentCheckSsoRedirectUri = e.silentCheckSsoRedirectUri), typeof e.silentCheckSsoFallback == "boolean" && (this.silentCheckSsoFallback = e.silentCheckSsoFallback), e.pkceMethod !== void 0) {
+			if (e.pkceMethod !== "S256" && e.pkceMethod !== !1) throw TypeError(`Invalid value for pkceMethod', expected 'S256' or false but got ${e.pkceMethod}.`);
+			this.pkceMethod = e.pkceMethod;
+		}
+		if (typeof e.enableLogging == "boolean" && (this.enableLogging = e.enableLogging), e.logoutMethod === "POST" && (this.logoutMethod = "POST"), typeof e.scope == "string" && (this.scope = e.scope), typeof e.messageReceiveTimeout == "number" && e.messageReceiveTimeout > 0 && (this.messageReceiveTimeout = e.messageReceiveTimeout), e.dpopConfig && (this.dpopConfig = e.dpopConfig), await this.#p(), this.dpopConfig?.mode === "strict" && (!this.dpopSigningAlgValuesSupported || this.dpopSigningAlgValuesSupported.length === 0)) throw Error("DPoP is set to strict mode but the server does not advertise DPoP support (dpop_signing_alg_values_supported is missing or empty).");
+		if (this.dpopConfig && this.dpopSigningAlgValuesSupported?.length) {
+			let e = this.#P();
+			if (!e) throw Error("Cannot initialize DPoP: issuer URL is not available. Ensure authServerUrl and realm are configured, or use OIDC provider mode with a valid issuer.");
+			if (!this.clientId) throw Error("Cannot initialize DPoP: clientId is not configured.");
+			let { DPoPSignatureProvider: t, BrowserSignatureAlgs: n } = await import("./keycloak-dpop.js");
+			this.#s = new t({
+				issuerUrl: new URL(e),
+				clientId: this.clientId,
+				serverSupportedAlgorithms: this.dpopSigningAlgValuesSupported,
+				requestedAlgorithm: this.dpopConfig.alg ? n[this.dpopConfig.alg] : n.ES256,
+				strictStorage: this.dpopConfig.strictStorage ?? !1,
+				getTimeSkew: () => this.timeSkew ?? 0
+			}), await this.#s.init(), this.#i("[KEYCLOAK] DPoP initialized");
+		}
+		return await this.#_(), await this.#v(e), this.onReady?.(this.authenticated), this.authenticated;
+	}
+	#l(e) {
+		if (e === "default") return this.#u();
+		if (e === "cordova") return s("KC-DEP-001", "The 'cordova' adapter is deprecated and will be removed in a future version. Use a custom adapter instead."), this.#o.enable = !1, this.#d();
+		if (e === "cordova-native") return s("KC-DEP-002", "The 'cordova-native' adapter is deprecated and will be removed in a future version. Use a custom adapter instead."), this.#o.enable = !1, this.#f();
+		throw Error("invalid adapter type: " + e);
+	}
+	#u() {
+		let e = (e) => e?.redirectUri || this.redirectUri || globalThis.location.href;
+		return {
+			login: async (e) => (window.location.assign(await this.createLoginUrl(e)), await new Promise(() => {})),
+			logout: async (t) => {
+				if ((t?.logoutMethod ?? this.logoutMethod) === "GET") {
+					window.location.replace(this.createLogoutUrl(t));
+					return;
+				}
+				let n = document.createElement("form");
+				n.setAttribute("method", "POST"), n.setAttribute("action", this.createLogoutUrl(t)), n.style.display = "none";
+				let r = {
+					id_token_hint: this.idToken,
+					client_id: this.clientId,
+					post_logout_redirect_uri: e(t)
+				};
+				for (let [e, t] of Object.entries(r)) {
+					let r = document.createElement("input");
+					r.setAttribute("type", "hidden"), r.setAttribute("name", e), r.setAttribute("value", t), n.appendChild(r);
+				}
+				document.body.appendChild(n), n.submit();
+			},
+			register: async (e) => (window.location.assign(await this.createRegisterUrl(e)), await new Promise(() => {})),
+			accountManagement: async () => {
+				let e = this.createAccountUrl();
+				if (e !== void 0) window.location.href = e;
+				else throw Error("Not supported by the OIDC server");
+				return await new Promise(() => {});
+			},
+			redirectUri: e
+		};
+	}
+	#d() {
+		let e = (e, t, n) => window.cordova && window.cordova.InAppBrowser ? window.cordova.InAppBrowser.open(e, t, n) : window.open(e, t, n), t = (e) => e && e.cordovaOptions ? Object.keys(e.cordovaOptions).reduce((t, n) => (t[n] = e.cordovaOptions[n], t), {}) : {}, n = (e) => Object.keys(e).reduce((t, n) => (t.push(n + "=" + e[n]), t), []).join(","), r = (e) => {
+			let r = t(e);
+			return r.location = "no", e && e.prompt === "none" && (r.hidden = "yes"), n(r);
+		}, i = () => this.redirectUri || "http://localhost";
+		return {
+			login: async (t) => {
+				let n = r(t), a = await this.createLoginUrl(t), o = e(a, "_blank", n), s = !1, c = !1;
+				function l() {
+					c = !0, o.close();
+				}
+				return await new Promise((e, t) => {
+					o.addEventListener("loadstart", async (n) => {
+						if (n.url.indexOf(i()) === 0) {
+							let r = this.#S(n.url);
+							if (s = !0, l(), !r || !r.valid) {
+								t(/* @__PURE__ */ Error("Invalid OAuth state in login callback."));
+								return;
+							}
+							try {
+								await this.#T(r), e();
+							} catch (e) {
+								t(e);
+							}
+						}
+					}), o.addEventListener("loaderror", async (n) => {
+						if (!s) {
+							if (n.url.indexOf(i()) === 0) {
+								let r = this.#S(n.url);
+								if (s = !0, l(), !r || !r.valid) {
+									t(/* @__PURE__ */ Error("Invalid OAuth state in login callback."));
+									return;
+								}
+								try {
+									await this.#T(r), e();
+								} catch (e) {
+									t(e);
+								}
+							} else t(/* @__PURE__ */ Error("Unable to process login.")), l();
+						}
+					}), o.addEventListener("exit", function(e) {
+						c || t(/* @__PURE__ */ Error("User closed the login window."));
+					});
+				});
+			},
+			logout: async (t) => {
+				let n = this.createLogoutUrl(t), r = e(n, "_blank", "location=no,hidden=yes,clearcache=yes"), a = !1;
+				r.addEventListener("loadstart", (e) => {
+					e.url.indexOf(i()) === 0 && r.close();
+				}), r.addEventListener("loaderror", (e) => {
+					e.url.indexOf(i()) === 0 || (a = !0), r.close();
+				}), await new Promise((e, t) => {
+					r.addEventListener("exit", () => {
+						a ? t(/* @__PURE__ */ Error("User closed the login window.")) : (this.clearToken(), e());
+					});
+				});
+			},
+			register: async (t) => {
+				let n = await this.createRegisterUrl(), a = r(t), o = e(n, "_blank", a);
+				await new Promise((e, t) => {
+					o.addEventListener("loadstart", async (n) => {
+						if (n.url.indexOf(i()) === 0) {
+							o.close();
+							let r = this.#S(n.url);
+							if (!r || !r.valid) {
+								t(/* @__PURE__ */ Error("Invalid OAuth state in register callback."));
+								return;
+							}
+							try {
+								await this.#T(r), e();
+							} catch (e) {
+								t(e);
+							}
+						}
+					});
+				});
+			},
+			accountManagement: async () => {
+				let t = this.createAccountUrl();
+				if (t !== void 0) {
+					let n = e(t, "_blank", "location=no");
+					n.addEventListener("loadstart", function(e) {
+						e.url.indexOf(i()) === 0 && n.close();
+					});
+				} else throw Error("Not supported by the OIDC server");
+			},
+			redirectUri: () => i()
+		};
+	}
+	#f() {
+		return {
+			login: async (e) => {
+				let t = await this.createLoginUrl(e);
+				await new Promise((e, n) => {
+					universalLinks.subscribe("keycloak", async (t) => {
+						universalLinks.unsubscribe("keycloak"), window.cordova.plugins.browsertab.close();
+						let r = this.#S(t.url);
+						if (!r || !r.valid) n(/* @__PURE__ */ Error("Invalid OAuth state in login callback."));
+						else try {
+							await this.#T(r), e();
+						} catch (e) {
+							n(e);
+						}
+					}), window.cordova.plugins.browsertab.openUrl(t);
+				});
+			},
+			logout: async (e) => {
+				let t = this.createLogoutUrl(e);
+				await new Promise((e) => {
+					universalLinks.subscribe("keycloak", () => {
+						universalLinks.unsubscribe("keycloak"), window.cordova.plugins.browsertab.close(), this.clearToken(), e();
+					}), window.cordova.plugins.browsertab.openUrl(t);
+				});
+			},
+			register: async (e) => {
+				let t = await this.createRegisterUrl(e);
+				await new Promise((e, n) => {
+					universalLinks.subscribe("keycloak", async (t) => {
+						universalLinks.unsubscribe("keycloak"), window.cordova.plugins.browsertab.close();
+						let r = this.#S(t.url);
+						if (!r || !r.valid) n(/* @__PURE__ */ Error("Invalid OAuth state in register callback."));
+						else try {
+							await this.#T(r), e();
+						} catch (e) {
+							n(e);
+						}
+					}), window.cordova.plugins.browsertab.openUrl(t);
+				});
+			},
+			accountManagement: async () => {
+				let e = this.createAccountUrl();
+				if (e !== void 0) window.cordova.plugins.browsertab.openUrl(e);
+				else throw Error("Not supported by the OIDC server");
+			},
+			redirectUri: (e) => e && e.redirectUri ? e.redirectUri : this.redirectUri ? this.redirectUri : "http://localhost"
+		};
+	}
+	async #p() {
+		if (typeof this.#c == "string") {
+			let e = await O(this.#c);
+			this.authServerUrl = e["auth-server-url"], this.realm = e.realm, this.clientId = e.resource, await this.#m();
+		} else this.clientId = this.#c.clientId, "oidcProvider" in this.#c ? await this.#h(this.#c.oidcProvider) : (this.authServerUrl = this.#c.url, this.realm = this.#c.realm, await this.#m());
+	}
+	async #m() {
+		if (this.dpopConfig) {
+			let e = this.#P();
+			if (!e) this.#a("[KEYCLOAK] Cannot fetch OIDC metadata: issuer URL is not available");
+			else {
+				let t = `${N(e)}/.well-known/openid-configuration`;
+				try {
+					let e = await k(t);
+					this.dpopSigningAlgValuesSupported = e.dpop_signing_alg_values_supported ? e.dpop_signing_alg_values_supported : void 0;
+				} catch (e) {
+					this.#a("[KEYCLOAK] Failed to fetch OIDC metadata for DPoP configuration: " + (e instanceof Error ? e.message : e));
+				}
+			}
+		}
+		this.endpoints = {
+			authorize: () => this.#N() + "/protocol/openid-connect/auth",
+			token: () => this.#N() + "/protocol/openid-connect/token",
+			logout: () => this.#N() + "/protocol/openid-connect/logout",
+			checkSessionIframe: () => this.#N() + "/protocol/openid-connect/login-status-iframe.html",
+			thirdPartyCookiesIframe: () => this.#N() + "/protocol/openid-connect/3p-cookies/step1.html",
+			register: () => this.#N() + "/protocol/openid-connect/registrations",
+			userinfo: () => this.#N() + "/protocol/openid-connect/userinfo"
+		};
+	}
+	async #h(e) {
+		if (typeof e == "string") {
+			let t = await k(`${N(e)}/.well-known/openid-configuration`);
+			this.#g(t);
+		} else this.#g(e);
+	}
+	#g(e) {
+		this.dpopSigningAlgValuesSupported = e.dpop_signing_alg_values_supported, this.issuer = e.issuer, this.endpoints = {
+			authorize() {
+				return e.authorization_endpoint;
+			},
+			token() {
+				return e.token_endpoint;
+			},
+			logout() {
+				if (!e.end_session_endpoint) throw Error("Not supported by the OIDC server");
+				return e.end_session_endpoint;
+			},
+			checkSessionIframe() {
+				if (!e.check_session_iframe) throw Error("Not supported by the OIDC server");
+				return e.check_session_iframe;
+			},
+			register() {
+				throw Error("Redirection to \"Register user\" page not supported in standard OIDC mode");
+			},
+			userinfo() {
+				if (!e.userinfo_endpoint) throw Error("Not supported by the OIDC server");
+				return e.userinfo_endpoint;
+			}
+		};
+	}
+	async #_() {
+		if (!this.#o.enable && !this.silentCheckSsoRedirectUri || typeof this.endpoints.thirdPartyCookiesIframe != "function") return;
+		let e = document.createElement("iframe");
+		return e.setAttribute("src", this.endpoints.thirdPartyCookiesIframe()), e.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin"), e.setAttribute("title", "keycloak-3p-check-iframe"), e.style.display = "none", document.body.appendChild(e), await _(new Promise((t) => {
+			let n = (r) => {
+				e.contentWindow === r.source && (r.data === "supported" || r.data === "unsupported") && (r.data === "unsupported" && (this.#a("[KEYCLOAK] Your browser is blocking access to 3rd-party cookies, this means:\n\n - It is not possible to retrieve tokens without redirecting to the Keycloak server (a.k.a. no support for silent authentication).\n - It is not possible to automatically detect changes to the session status (such as the user logging out in another tab).\n\nFor more information see: https://www.keycloak.org/securing-apps/javascript-adapter#_modern_browsers"), this.#o.enable = !1, this.silentCheckSsoFallback && (this.silentCheckSsoRedirectUri = void 0)), document.body.removeChild(e), window.removeEventListener("message", n), t());
+			};
+			window.addEventListener("message", n, !1);
+		}), this.messageReceiveTimeout, "Timeout when waiting for 3rd party check iframe message.");
+	}
+	async #v(e) {
+		let t = this.#S(window.location.href);
+		if (t?.newUrl && window.history.replaceState(window.history.state, "", t.newUrl), t && t.valid) {
+			await this.#y(), await this.#T(t);
+			return;
+		}
+		let n = async (t) => {
+			let n = {};
+			t || (n.prompt = "none"), e.locale && (n.locale = e.locale), await this.login(n);
+		}, r = async () => {
+			switch (e.onLoad) {
+				case "check-sso":
+					this.#o.enable ? (await this.#y(), await this.#b() || (this.silentCheckSsoRedirectUri ? await this.#x() : await n(!1))) : this.silentCheckSsoRedirectUri ? await this.#x() : await n(!1);
+					break;
+				case "login-required":
+					await n(!0);
+					break;
+				default: throw Error("Invalid value for onLoad");
+			}
+		};
+		if (e.token && e.refreshToken) {
+			if (this.#M(e.token, e.refreshToken, e.idToken), this.#o.enable) await this.#y(), await this.#b() && (this.onAuthSuccess?.(), this.#E());
+			else try {
+				await this.updateToken(-1), this.onAuthSuccess?.();
+			} catch (t) {
+				if (this.onAuthError?.(), e.onLoad) await r();
+				else throw t;
+			}
+		} else e.onLoad && await r();
+	}
+	async #y() {
+		if (!this.#o.enable || this.#o.iframe) return;
+		let e = document.createElement("iframe");
+		this.#o.iframe = e, e.setAttribute("src", this.endpoints.checkSessionIframe()), e.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin"), e.setAttribute("title", "keycloak-session-iframe"), e.style.display = "none", document.body.appendChild(e), window.addEventListener("message", (e) => {
+			if (e.origin !== this.#o.iframeOrigin || this.#o.iframe?.contentWindow !== e.source || e.data !== "unchanged" && e.data !== "changed" && e.data !== "error") return;
+			e.data !== "unchanged" && this.clearToken();
+			let t = this.#o.callbackList;
+			this.#o.callbackList = [];
+			for (let n of t.reverse()) e.data === "error" ? n(/* @__PURE__ */ Error("Error while checking login iframe")) : n(null, e.data === "unchanged");
+		}, !1), await new Promise((t) => {
+			e.addEventListener("load", () => {
+				let e = this.endpoints.authorize();
+				e.startsWith("/") ? this.#o.iframeOrigin = globalThis.location.origin : this.#o.iframeOrigin = new URL(e).origin, t();
+			});
+		});
+	}
+	async #b() {
+		if (!this.#o.iframe || !this.#o.iframeOrigin) return;
+		let e = `${this.clientId} ${this.sessionId ? this.sessionId : ""}`, t = this.#o.iframeOrigin;
+		return await new Promise((n, r) => {
+			this.#o.callbackList.push((e, t) => e ? r(e) : n(t)), this.#o.callbackList.length === 1 && this.#o.iframe?.contentWindow?.postMessage(e, t);
+		});
+	}
+	async #x() {
+		let e = document.createElement("iframe"), t = await this.createLoginUrl({
+			prompt: "none",
+			redirectUri: this.silentCheckSsoRedirectUri
+		});
+		return e.setAttribute("src", t), e.setAttribute("sandbox", "allow-storage-access-by-user-activation allow-scripts allow-same-origin"), e.setAttribute("title", "keycloak-silent-check-sso"), e.style.display = "none", document.body.appendChild(e), await new Promise((t, n) => {
+			let r = async (i) => {
+				if (i.origin !== window.location.origin || e.contentWindow !== i.source) return;
+				let a = this.#S(i.data);
+				try {
+					await this.#T(a), t();
+				} catch (e) {
+					n(e);
+				}
+				document.body.removeChild(e), window.removeEventListener("message", r);
+			};
+			window.addEventListener("message", r);
+		});
+	}
+	#S(e) {
+		let t = this.#C(e);
+		if (!t) return;
+		let n = this.#r.get(t.state);
+		if (n && (t.valid = !0, t.redirectUri = n.redirectUri, t.storedNonce = n.nonce, t.prompt = n.prompt, t.pkceCodeVerifier = n.pkceCodeVerifier, t.loginOptions = n.loginOptions, n.appHash)) {
+			let r = new URL(t.newUrl || e);
+			r.hash = n.appHash, t.newUrl = r.href;
+		}
+		return t;
+	}
+	#C(e) {
+		let t = [];
+		switch (this.flow) {
+			case "standard":
+				t = [
+					"code",
+					"state",
+					"session_state",
+					"kc_action_status",
+					"kc_action",
+					"iss"
+				];
+				break;
+			case "implicit":
+				t = [
+					"access_token",
+					"token_type",
+					"id_token",
+					"state",
+					"session_state",
+					"expires_in",
+					"kc_action_status",
+					"kc_action",
+					"iss"
+				];
+				break;
+			case "hybrid": t = [
+				"access_token",
+				"token_type",
+				"id_token",
+				"code",
+				"state",
+				"session_state",
+				"expires_in",
+				"kc_action_status",
+				"kc_action",
+				"iss"
+			];
+		}
+		t.push("error"), t.push("error_description"), t.push("error_uri");
+		let n = new URL(e), r = "", i;
+		if (this.responseMode === "query" && n.searchParams.size > 0 ? (i = this.#w(n.search, t), n.search = i.paramsString, r = n.toString()) : this.responseMode === "fragment" && n.hash.length > 0 && (i = this.#w(n.hash.substring(1), t), n.hash = i.paramsString, r = n.toString()), i?.oauthParams) {
+			if (this.flow === "standard" || this.flow === "hybrid") {
+				if ((i.oauthParams.code || i.oauthParams.error) && i.oauthParams.state) return i.oauthParams.newUrl = r, i.oauthParams;
+			} else if (this.flow === "implicit" && (i.oauthParams.access_token || i.oauthParams.error) && i.oauthParams.state) return i.oauthParams.newUrl = r, i.oauthParams;
+		}
+	}
+	#w(e, t) {
+		let n = e.split("&"), r = {}, i = "";
+		for (let e of n.reverse()) {
+			let n = new URLSearchParams(e).entries().next().value;
+			if (!n) {
+				i = "&" + i;
+				continue;
+			}
+			let [a, o] = n;
+			t.includes(a) && !(a in r) ? r[a] = o : i = i.length === 0 ? e : e + "&" + i;
+		}
+		return {
+			paramsString: i,
+			oauthParams: r
+		};
+	}
+	async #T(e) {
+		let { code: t, error: n, prompt: r } = e, i = (/* @__PURE__ */ new Date()).getTime(), a = (t, n, r) => {
+			if (i = (i + (/* @__PURE__ */ new Date()).getTime()) / 2, this.#M(t, n, r, i), this.#n && this.idTokenParsed && this.idTokenParsed.nonce !== e.storedNonce) throw this.#i("[KEYCLOAK] Invalid nonce, clearing token"), this.clearToken(), Error("Invalid nonce.");
+		};
+		if (e.kc_action_status && this.onActionUpdate && this.onActionUpdate(e.kc_action_status, e.kc_action), n) {
+			if (r !== "none") {
+				if (e.error_description && e.error_description === "authentication_expired") await this.login(e.loginOptions);
+				else {
+					let t = {
+						error: n,
+						error_description: e.error_description
+					};
+					throw this.onAuthError?.(t), t;
+				}
+			}
+		} else if (this.flow !== "standard" && (e.access_token || e.id_token) && (a(e.access_token, void 0, e.id_token), this.onAuthSuccess?.()), this.flow !== "implicit" && t) try {
+			let n = await this.#D(this.endpoints.token(), t, this.clientId, e.redirectUri, e.pkceCodeVerifier);
+			a(n.access_token, n.refresh_token, n.id_token), this.flow === "standard" && this.onAuthSuccess?.(), this.#E();
+		} catch (e) {
+			throw this.onAuthError?.(), e;
+		}
+	}
+	async #E() {
+		this.#o.enable && this.token && (await F(this.#o.interval * 1e3), await this.#b() && await this.#E());
+	}
+	login(e) {
+		return this.#t.login(e);
+	}
+	async createLoginUrl(e) {
+		let t = d(), n = d(), r = new URL(this.#t.redirectUri(e), globalThis.location?.href), i = r.hash;
+		r.hash = "";
+		let a = r.href, o = {
+			state: t,
+			nonce: n,
+			redirectUri: a,
+			appHash: i,
+			loginOptions: e
+		};
+		e?.prompt && (o.prompt = e.prompt);
+		let s = e?.action === "register" ? this.endpoints.register() : this.endpoints.authorize(), c = e?.scope || this.scope, l = c ? c.split(" ") : [];
+		l.includes("openid") || l.unshift("openid"), c = l.join(" ");
+		let u = new URLSearchParams([
+			["client_id", this.clientId],
+			["redirect_uri", a],
+			["state", t],
+			["response_mode", this.responseMode],
+			["response_type", this.responseType],
+			["scope", c]
+		]);
+		if (this.#n && u.append("nonce", n), e?.prompt && u.append("prompt", e.prompt), typeof e?.maxAge == "number" && u.append("max_age", e.maxAge.toString()), e?.loginHint && u.append("login_hint", e.loginHint), e?.idpHint && u.append("kc_idp_hint", e.idpHint), e?.action && e.action !== "register" && u.append("kc_action", e.action), e?.locale && u.append("ui_locales", e.locale), e?.acr && u.append("claims", f(e.acr)), e?.acrValues && u.append("acr_values", e.acrValues), this.pkceMethod) try {
+			let e = p(96), t = await m(this.pkceMethod, e);
+			o.pkceCodeVerifier = e, u.append("code_challenge", t), u.append("code_challenge_method", this.pkceMethod);
+		} catch (e) {
+			throw Error("Failed to generate PKCE challenge.", { cause: e });
+		}
+		return this.#r.add(o), `${s}?${u.toString()}`;
+	}
+	async logout(e) {
+		return await this.#s?.flush(), this.#t.logout(e);
+	}
+	createLogoutUrl(e) {
+		let t = e?.logoutMethod ?? this.logoutMethod, n = this.endpoints.logout();
+		if (t === "POST") return n;
+		let r = new URLSearchParams([["client_id", this.clientId], ["post_logout_redirect_uri", this.#t.redirectUri(e)]]);
+		return this.idToken && r.append("id_token_hint", this.idToken), `${n}?${r.toString()}`;
+	}
+	register(e) {
+		return this.#t.register(e);
+	}
+	createRegisterUrl(e) {
+		return this.createLoginUrl({
+			...e,
+			action: "register"
+		});
+	}
+	createAccountUrl(e) {
+		let t = this.#N();
+		if (!t) throw Error("Unable to create account URL, make sure the adapter is not configured using a generic OIDC provider.");
+		return `${t}/account?${new URLSearchParams([["referrer", this.clientId], ["referrer_uri", this.#t.redirectUri(e)]]).toString()}`;
+	}
+	accountManagement() {
+		return this.#t.accountManagement();
+	}
+	hasRealmRole(e) {
+		let t = this.realmAccess;
+		return !!t && t.roles.indexOf(e) >= 0;
+	}
+	hasResourceRole(e, t) {
+		if (!this.resourceAccess) return !1;
+		let n = this.resourceAccess[t || this.clientId];
+		return !!n && n.roles.indexOf(e) >= 0;
+	}
+	async loadUserProfile() {
+		let e = this.#N();
+		if (!e) throw Error("Unable to load user profile, make sure the adapter is not configured using a generic OIDC provider.");
+		let t = await A(`${e}/account`, { headers: [M(this.token)] });
+		return this.profile = t;
+	}
+	async loadUserInfo() {
+		let e = await A(this.endpoints.userinfo(), { headers: [M(this.token)] });
+		return this.userInfo = e;
+	}
+	isTokenExpired(e) {
+		if (!this.tokenParsed || !this.refreshToken && this.flow !== "implicit") throw Error("Not authenticated");
+		if (this.timeSkew == null) return this.#i("[KEYCLOAK] Unable to determine if token is expired as timeskew is not set"), !0;
+		if (typeof this.tokenParsed.exp != "number") return !1;
+		let t = this.tokenParsed.exp - Math.ceil((/* @__PURE__ */ new Date()).getTime() / 1e3) + this.timeSkew;
+		if (e) {
+			if (isNaN(e)) throw Error("Invalid minValidity");
+			t -= e;
+		}
+		return t < 0;
+	}
+	async updateToken(e) {
+		if (!this.refreshToken) throw Error("Unable to update token, no refresh token available.");
+		e ||= 5, this.#o.enable && await this.#b();
+		let t = !1;
+		if (e === -1 ? (t = !0, this.#i("[KEYCLOAK] Refreshing token: forced refresh")) : (!this.tokenParsed || this.isTokenExpired(e)) && (t = !0, this.#i("[KEYCLOAK] Refreshing token: token expired")), !t) return !1;
+		let { promise: n, resolve: r, reject: i } = Promise.withResolvers();
+		if (this.#e.push({
+			resolve: r,
+			reject: i
+		}), this.#e.length === 1) {
+			let e = this.endpoints.token(), t = (/* @__PURE__ */ new Date()).getTime();
+			try {
+				let n = await this.#j(e, this.refreshToken, this.clientId);
+				this.#i("[KEYCLOAK] Token refreshed"), t = (t + (/* @__PURE__ */ new Date()).getTime()) / 2, this.#M(n.access_token, n.refresh_token, n.id_token, t), this.onAuthRefreshSuccess?.();
+				for (let e = this.#e.pop(); e != null; e = this.#e.pop()) e.resolve(!0);
+			} catch (e) {
+				this.#a("[KEYCLOAK] Failed to refresh token"), e instanceof P && e.response.status === 400 && this.clearToken(), this.onAuthRefreshError?.();
+				for (let t = this.#e.pop(); t != null; t = this.#e.pop()) t.reject(e);
+			}
+		}
+		return await n;
+	}
+	async clearToken() {
+		this.token && (await this.#s?.flush(), await this.#s?.init(), this.#M(), this.onAuthLogout?.(), this.loginRequired && await this.login());
+	}
+	fetch = async (e, t = {}) => {
+		let n = this.#s;
+		if (n && this.authenticated && this.token) {
+			if (new Headers(t.headers).get("Authorization") !== `Bearer ${this.token}`) return fetch(e, t);
+			let r = new URL(String(e), document.baseURI), i = r.href, a = r.origin, o = t.method ?? "GET", s = n.getResourceServerNonce(a), c = await this.#k(e, t, i, o, s), l = c.headers.get("DPoP-Nonce");
+			if (l && n.updateResourceServerNonce(a, l), c.status === 401 && l) {
+				let r = c.headers.get("WWW-Authenticate") ?? "";
+				if (r.includes("DPoP") && r.includes("error=\"use_dpop_nonce\"")) {
+					let r = await this.#k(e, t, i, o, l), s = r.headers.get("DPoP-Nonce");
+					return s && n.updateResourceServerNonce(a, s), r;
+				}
+			}
+			return c;
+		}
+		return fetch(e, t);
+	};
+	async #D(e, t, n, r, i) {
+		let a = new URLSearchParams([
+			["code", t],
+			["grant_type", "authorization_code"],
+			["client_id", n],
+			["redirect_uri", r]
+		]);
+		return i && a.append("code_verifier", i), this.#s ? await this.#A(e, a) : await A(e, {
+			method: "POST",
+			credentials: "include",
+			body: a
+		});
+	}
+	#O(e) {
+		let t = e.token_type?.toLowerCase();
+		if (this.#s && t !== "dpop") {
+			if (this.dpopConfig?.mode === "strict") throw Error("DPoP strict mode enabled but server returned non-DPoP token (token_type: " + e.token_type + ")");
+			this.#a("[KEYCLOAK] Server returned token_type \"" + e.token_type + "\" instead of \"DPoP\". Disabling DPoP for this session."), this.#s = void 0;
+		}
+		return e;
+	}
+	async #k(e, t, n, r, i) {
+		let a = this.#s;
+		if (!a) throw Error("DPoP provider not initialized");
+		let o = await a.generateDPoPProof(n, r, this.token, i), s = new Headers(t.headers);
+		return s.set("Authorization", `DPoP ${this.token}`), s.set("DPoP", o), fetch(e, {
+			...t,
+			headers: s
+		});
+	}
+	async #A(e, t) {
+		let n = this.#s;
+		if (!n) throw Error("DPoP provider not initialized");
+		let r = async (r) => {
+			let i = await n.generateDPoPProof(e, "POST", void 0, r), a = new Headers();
+			a.set("DPoP", i), a.set("Accept", l);
+			let o = await j(e, {
+				method: "POST",
+				credentials: "include",
+				body: t,
+				headers: a
+			}), s = o.headers.get("DPoP-Nonce");
+			s && await n.updateAuthServerNonce(s);
+			let c = await o.json();
+			return this.#O(c);
+		};
+		try {
+			return await r(await n.getAuthServerNonce());
+		} catch (e) {
+			if (e instanceof P && e.response.status === 400) {
+				let t = e.response.headers.get("DPoP-Nonce");
+				if (t && (await e.response.json().catch(() => ({}))).error === "use_dpop_nonce") return await n.updateAuthServerNonce(t), await r(t);
+			}
+			throw e;
+		}
+	}
+	async #j(e, t, n) {
+		let r = new URLSearchParams([
+			["grant_type", "refresh_token"],
+			["refresh_token", t],
+			["client_id", n]
+		]);
+		return this.#s ? await this.#A(e, r) : await A(e, {
+			method: "POST",
+			credentials: "include",
+			body: r
+		});
+	}
+	#M(e, t, n, r) {
+		if (this.tokenTimeoutHandle &&= (clearTimeout(this.tokenTimeoutHandle), void 0), t ? (this.refreshToken = t, this.refreshTokenParsed = w(t)) : (delete this.refreshToken, delete this.refreshTokenParsed), n ? (this.idToken = n, this.idTokenParsed = w(n)) : (delete this.idToken, delete this.idTokenParsed), e) {
+			if (this.token = e, this.tokenParsed = w(e), this.sessionId = this.tokenParsed.sid, this.authenticated = !0, this.subject = this.tokenParsed.sub, this.realmAccess = this.tokenParsed.realm_access, this.resourceAccess = this.tokenParsed.resource_access, r && (this.timeSkew = Math.floor(r / 1e3) - this.tokenParsed.iat), this.timeSkew !== null && (this.#i("[KEYCLOAK] Estimated time difference between browser and server is " + this.timeSkew + " seconds"), this.onTokenExpired)) {
+				let e = (this.tokenParsed.exp - (/* @__PURE__ */ new Date()).getTime() / 1e3 + this.timeSkew) * 1e3;
+				this.#i("[KEYCLOAK] Token expires in " + Math.round(e / 1e3) + " s"), e <= 0 ? this.onTokenExpired() : this.tokenTimeoutHandle = window.setTimeout(this.onTokenExpired, e);
+			}
+		} else delete this.token, delete this.tokenParsed, delete this.subject, delete this.realmAccess, delete this.resourceAccess, this.authenticated = !1;
+	}
+	#N() {
+		if (this.authServerUrl !== void 0) return `${N(this.authServerUrl)}/realms/${encodeURIComponent(this.realm)}`;
+	}
+	#P() {
+		return this.issuer ? this.issuer : this.#N();
+	}
+	#F(e) {
+		return (t) => {
+			this.enableLogging && e.call(console, t);
+		};
+	}
+};
+function d() {
+	if (typeof crypto > "u" || crypto.randomUUID === void 0) throw Error("Web Crypto API is not available.");
+	return crypto.randomUUID();
+}
+function f(e) {
+	return JSON.stringify({ id_token: { acr: e } });
+}
+function p(e) {
+	return h(e, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
+}
+async function m(e, t) {
+	if (e !== "S256") throw TypeError(`Invalid value for 'pkceMethod', expected 'S256' but got '${e}'.`);
+	return S(new Uint8Array(await C(t))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function h(e, t) {
+	let n = g(e), r = Array(e);
+	for (let i = 0; i < e; i++) r[i] = t.charCodeAt(n[i] % t.length);
+	return String.fromCharCode.apply(null, r);
+}
+function g(e) {
+	if (typeof crypto > "u" || crypto.getRandomValues === void 0) throw Error("Web Crypto API is not available.");
+	return crypto.getRandomValues(new Uint8Array(e));
+}
+function _(e, t, n) {
+	let r, i = new Promise(function(e, i) {
+		r = window.setTimeout(function() {
+			i(Error(n || "Promise is not settled within timeout of " + t + "ms"));
+		}, t);
+	});
+	return Promise.race([e, i]).finally(function() {
+		clearTimeout(r);
+	});
+}
+function v() {
+	try {
+		return new b();
+	} catch {
+		return new x();
+	}
+}
+var y = "kc-callback-", b = class {
+	constructor() {
+		globalThis.localStorage.setItem("kc-test", "test"), globalThis.localStorage.removeItem("kc-test");
+	}
+	get(e) {
+		if (!e) return null;
+		this.#e();
+		let t = y + e, n = globalThis.localStorage.getItem(t);
+		return n ? (globalThis.localStorage.removeItem(t), JSON.parse(n)) : null;
+	}
+	add(e) {
+		this.#e();
+		let t = y + e.state, n = JSON.stringify({
+			...e,
+			expires: Date.now() + 36e5
+		});
+		try {
+			globalThis.localStorage.setItem(t, n);
+		} catch {
+			this.#t(), globalThis.localStorage.setItem(t, n);
+		}
+	}
+	#e() {
+		let e = Date.now();
+		for (let [t, n] of this.#n()) {
+			let r = this.#r(n);
+			(r === null || r < e) && globalThis.localStorage.removeItem(t);
+		}
+	}
+	#t() {
+		for (let [e] of this.#n()) globalThis.localStorage.removeItem(e);
+	}
+	#n() {
+		return Object.entries(globalThis.localStorage).filter(([e]) => e.startsWith(y));
+	}
+	#r(e) {
+		let t;
+		try {
+			t = JSON.parse(e);
+		} catch {
+			return null;
+		}
+		return D(t) && "expires" in t && typeof t.expires == "number" ? t.expires : null;
+	}
+}, x = class {
+	get(e) {
+		if (!e) return null;
+		let t = this.#e(y + e);
+		return this.#t(y + e, "", this.#n(-100)), t ? JSON.parse(t) : null;
+	}
+	add(e) {
+		this.#t(y + e.state, JSON.stringify(e), this.#n(60));
+	}
+	#e(e) {
+		let t = e + "=", n = document.cookie.split(";");
+		for (let e = 0; e < n.length; e++) {
+			let r = n[e];
+			for (; r.charAt(0) === " ";) r = r.substring(1);
+			if (r.indexOf(t) === 0) return r.substring(t.length, r.length);
+		}
+		return "";
+	}
+	#t(e, t, n) {
+		let r = e + "=" + t + "; expires=" + n.toUTCString() + "; ";
+		document.cookie = r;
+	}
+	#n(e) {
+		let t = /* @__PURE__ */ new Date();
+		return t.setTime(t.getTime() + e * 60 * 1e3), t;
+	}
+};
+function S(e) {
+	let t = String.fromCodePoint(...e);
+	return btoa(t);
+}
+async function C(e) {
+	let t = new TextEncoder().encode(e);
+	if (typeof crypto > "u" || crypto.subtle === void 0) throw Error("Web Crypto API is not available.");
+	return await crypto.subtle.digest("SHA-256", t);
+}
+function w(e) {
+	let [, t] = e.split(".");
+	if (typeof t != "string") throw Error("Unable to decode token, payload not found.");
+	let n;
+	try {
+		n = T(t);
+	} catch (e) {
+		throw Error("Unable to decode token, payload is not a valid Base64URL value.", { cause: e });
+	}
+	try {
+		return JSON.parse(n);
+	} catch (e) {
+		throw Error("Unable to decode token, payload is not a valid JSON value.", { cause: e });
+	}
+}
+function T(e) {
+	let t = e.replaceAll("-", "+").replaceAll("_", "/");
+	switch (t.length % 4) {
+		case 0: break;
+		case 2:
+			t += "==";
+			break;
+		case 3:
+			t += "=";
+			break;
+		default: throw Error("Input is not of the correct length.");
+	}
+	try {
+		return E(t);
+	} catch {
+		return atob(t);
+	}
+}
+function E(e) {
+	return decodeURIComponent(atob(e).replace(/(.)/g, (e, t) => {
+		let n = t.charCodeAt(0).toString(16).toUpperCase();
+		return n.length < 2 && (n = "0" + n), "%" + n;
+	}));
+}
+function D(e) {
+	return typeof e == "object" && !!e;
+}
+async function O(e) {
+	return await A(e);
+}
+async function k(e) {
+	return await A(e);
+}
+async function A(e, t = {}) {
+	let n = new Headers(t.headers);
+	return n.set("Accept", l), await (await j(e, {
+		...t,
+		headers: n
+	})).json();
+}
+async function j(e, t) {
+	let n = await fetch(e, t);
+	if (!n.ok) throw new P("Server responded with an invalid status.", { response: n });
+	return n;
+}
+function M(e) {
+	if (!e) throw Error("Unable to build authorization header, token is not set, make sure the user is authenticated.");
+	return ["Authorization", `bearer ${e}`];
+}
+function N(e) {
+	return e.endsWith("/") ? e.slice(0, -1) : e;
+}
+var P = class extends Error {
+	response;
+	constructor(e, t) {
+		super(e, t), this.response = t.response;
+	}
+}, F = (e) => new Promise((t) => setTimeout(t, e)), I, L = I = class extends i {
+	get code() {
+		return this.keycloak?.idToken ?? null;
+	}
+	keycloak = null;
+	constructor() {
+		super(new a({ authenticated: !1 }));
+	}
+	static createRevisedSequences(n, r, i = n) {
+		let a = t.parseFasta(n);
+		if (a.error) throw Error(a.error);
+		let o = t.parseFasta(i);
+		if (o.error) throw Error(o.error);
+		let s = (e) => Object.values(r.recordsByColumn).some((t) => t[e]), c = new Set(a.sequences.map((e) => e.id)), l = new Set(o.sequences.map((e) => e.id)), u = a.sequences.filter((e) => s(e.id)), d = new Set(u.map((e) => e.id)), f = r.records.filter((e) => Object.values(e).some((e) => d.has(e)));
+		return {
+			addedSequencesWithoutMetadata: a.sequences.filter((e) => !l.has(e.id) && !s(e.id)).map((e) => e.id),
+			fasta: u.map((e) => `>${e.header}\n${e.sequence}`).join("\n"),
+			groupId: e.getGroupId(r),
+			metadata: [r.columns.join("	"), ...f.map((e) => r.columns.map((t) => e[t] ?? "").join("	"))].join("\n"),
+			removedSequences: o.sequences.filter((e) => !c.has(e.id)).map((e) => e.id),
+			sequenceCount: u.length
+		};
+	}
+	clear() {
+		this.keycloak = null, this.next({ authenticated: !1 });
+	}
+	async init(e) {
+		let { authClientId: t, authEndpoint: n, authRealm: r } = e, i = !1, a = null;
+		try {
+			let e = new u({
+				clientId: t,
+				realm: r,
+				url: n
+			});
+			a = e, this.keycloak = e, e.onAuthLogout = () => {
+				this.next({ authenticated: !1 });
+			}, e.onTokenExpired = () => {
+				this.keycloak === e && e.updateToken(-1).catch((t) => {
+					console.error("Failed to refresh Keycloak token:", t), e.clearToken();
+				});
+			}, i = await e.init({
+				enableLogging: !0,
+				onLoad: "check-sso",
+				pkceMethod: "S256",
+				silentCheckSsoFallback: !1,
+				silentCheckSsoRedirectUri: `${window.location.origin}/silent-check-sso.html`,
+				useNonce: !0
+			});
+		} catch (e) {
+			console.error("Failed to initialize Keycloak:", e);
+		}
+		a && this.keycloak !== a || this.next({ authenticated: i });
+	}
+	async reviseSequences(e, t, n, r, i) {
+		let a = I.createRevisedSequences(e, t), o = new FormData();
+		o.append("sequenceFile", new File([a.fasta], "sequences.fasta", { type: "text/plain" })), o.append("metadataFile", new File([a.metadata], "metadata.tsv", { type: "text/tab-separated-values" }));
+		let s = `${n.replace(/\/$/, "")}/${encodeURIComponent(r)}/revise?${new URLSearchParams({
+			dataUseTermsType: "OPEN",
+			groupId: a.groupId
+		})}`, c = await this.keycloak?.fetch(s, {
+			body: o,
+			method: "POST",
+			signal: i.signal
+		});
+		if (!c?.ok) {
+			if (c?.status === 401 || c?.status === 403) throw Error("Your Loculus session is no longer valid. Please log in to Loculus again in a separate tab, then try uploading again.");
+			let e = await c?.text();
+			throw Error(`Failed to revise sequences: ${e}`);
+		}
+	}
+};
+L = I = n([r()], L);
+export { L as t };
+
+//# sourceMappingURL=LoculusService.js.map