@scalar/api-client 2.38.3 → 2.39.0

package/dist/libs-spbv4P0g.js

@@ -1,249 +0,0 @@
-import { n as ADD_AUTH_OPTIONS } from "./consts-CyGRb9dl.js";
-import { isDefined } from "@scalar/oas-utils/helpers";
-import { encode, fromUint8Array } from "js-base64";
-import { shouldUseProxy } from "@scalar/helpers/url/redirect-to-proxy";
-import { replaceVariables } from "@scalar/helpers/regex/replace-variables";
-import { isRelativePath } from "@scalar/helpers/url/is-relative-path";
-import { makeUrlAbsolute as makeUrlAbsolute$1 } from "@scalar/helpers/url/make-url-absolute";
-//#region src/views/Request/libs/auth.ts
-/** Format a scheme object into a display object */
-var formatScheme = (s) => ({
-	id: s.uid,
-	label: s.type === "openIdConnect" ? `${s.nameKey} (coming soon)` : s.nameKey
-});
-/** Formats complex security schemes */
-var formatComplexScheme = (uids, securitySchemes) => formatScheme(uids.reduce((acc, uid, index) => {
-	const scheme = securitySchemes[uid];
-	if (scheme) {
-		acc.nameKey += `${index > 0 ? " & " : ""}${scheme.nameKey}`;
-		acc.uid = `${acc.uid}${index > 0 ? "," : ""}${scheme.uid}`;
-	}
-	return acc;
-}, {
-	type: "complex",
-	nameKey: "",
-	uid: ""
-}));
-/** Compute what the security requirements should be for a request */
-var getSecurityRequirements = (operation, collection) => {
-	if (JSON.stringify(operation?.security) === "[{}]" && collection?.security?.length) return Boolean(collection?.security.find((s) => JSON.stringify(s) === "{}")) ? collection.security : [...collection.security, {}];
-	return operation?.security ?? collection?.security ?? [];
-};
-/**
-* Generates the options for the security scheme combobox
-*
-* contains either a flat list, or different groups of required, available, and add new
-*/
-var getSchemeOptions = (filteredRequirements, collectionSchemeUids, securitySchemes, isReadOnly = false) => {
-	{
-		/** Creates a dictionary of security schemes by nameKey (not UID) */
-		const schemeDict = collectionSchemeUids.reduce((acc, uid) => {
-			const scheme = securitySchemes[uid];
-			if (scheme) acc[scheme.nameKey] = scheme;
-			return acc;
-		}, {});
-		/** Builds the required schemes formatted as options */
-		const requiredFormatted = filteredRequirements.flatMap((r) => {
-			const keys = Object.keys(r);
-			if (keys.length > 1) return formatComplexScheme(keys.map((k) => schemeDict[k]?.uid).filter(isDefined), securitySchemes);
-			if (keys[0]) {
-				const scheme = schemeDict[keys[0]];
-				if (scheme) return formatScheme(scheme);
-			}
-			return [];
-		});
-		/** Collection schemes minus the required ones */
-		const availableFormatted = collectionSchemeUids.filter((uid) => !requiredFormatted.some((r) => r.id === uid)).map((uid) => {
-			const scheme = securitySchemes[uid];
-			if (scheme) return formatScheme(scheme);
-			return null;
-		}).filter(isDefined);
-		const options = [{
-			label: "Required authentication",
-			options: requiredFormatted
-		}, {
-			label: "Available authentication",
-			options: availableFormatted
-		}];
-		if (isReadOnly) return requiredFormatted.length ? options : availableFormatted;
-		options.push({
-			label: "Add new authentication",
-			options: ADD_AUTH_OPTIONS
-		});
-		return options;
-	}
-};
-//#endregion
-//#region src/views/Request/libs/oauth2.ts
-/**
-* Interpolates server URL template variables (e.g. `https://{env}.example.com`)
-* using the user-set `value` when available, falling back to the OpenAPI `default`.
-* This is needed so OAuth flows that use the server URL as a base resolve correctly
-* when the spec defines server variables.
-*/
-var getInterpolatedServerUrl = (activeServer) => {
-	if (!activeServer?.url) return void 0;
-	const serverVariables = Object.entries(activeServer.variables ?? {}).reduce((acc, [name, variable]) => {
-		const value = variable.value || variable.default;
-		if (value) acc[name] = value;
-		return acc;
-	}, {});
-	return replaceVariables(activeServer.url, serverVariables);
-};
-var getActiveServerBase = (activeServer) => {
-	const serverUrl = getInterpolatedServerUrl(activeServer);
-	if (!serverUrl) return {};
-	if (isRelativePath(serverUrl)) return typeof window === "undefined" ? {} : { basePath: serverUrl };
-	return { baseUrl: serverUrl };
-};
-/**
-* Generates a random string for PKCE code verifier
-*
-* @see https://www.rfc-editor.org/rfc/rfc7636#page-8
-*/
-var generateCodeVerifier = () => {
-	const buffer = new Uint8Array(32);
-	crypto.getRandomValues(buffer);
-	return fromUint8Array(buffer, true);
-};
-/**
-* Creates a code challenge from the code verifier
-*/
-var generateCodeChallenge = async (verifier, encoding) => {
-	if (encoding === "plain") return verifier;
-	if (typeof crypto?.subtle?.digest !== "function") {
-		console.warn("SHA-256 is only supported when using https, using a plain text code challenge instead.");
-		return verifier;
-	}
-	const data = new TextEncoder().encode(verifier);
-	const digest = await crypto.subtle.digest("SHA-256", data);
-	return fromUint8Array(new Uint8Array(digest), true);
-};
-/**
-* Authorize oauth2 flow
-*
-* @returns the accessToken
-*/
-var authorizeOauth2 = async (flow, activeServer, proxyUrl) => {
-	try {
-		if (!flow) return [/* @__PURE__ */ new Error("Flow not found"), null];
-		const scopes = flow.selectedScopes.join(" ");
-		if (flow.type === "clientCredentials" || flow.type === "password") return authorizeServers(flow, scopes, { proxyUrl }, activeServer);
-		const state = (Math.random() + 1).toString(36).substring(2, 10);
-		const authorizationUrl = makeUrlAbsolute$1(flow.authorizationUrl, getActiveServerBase(activeServer));
-		const url = new URL(authorizationUrl);
-		/** Special PKCE state */
-		let pkce = null;
-		if (flow.type === "implicit") url.searchParams.set("response_type", "token");
-		else if (flow.type === "authorizationCode") {
-			url.searchParams.set("response_type", "code");
-			if (flow["x-usePkce"] !== "no") {
-				const codeVerifier = generateCodeVerifier();
-				const codeChallenge = await generateCodeChallenge(codeVerifier, flow["x-usePkce"]);
-				pkce = {
-					codeVerifier,
-					codeChallenge,
-					codeChallengeMethod: flow["x-usePkce"] === "SHA-256" ? "S256" : "plain"
-				};
-				url.searchParams.set("code_challenge", codeChallenge);
-				url.searchParams.set("code_challenge_method", pkce.codeChallengeMethod);
-			}
-		}
-		if (flow["x-scalar-redirect-uri"].startsWith("/")) {
-			const baseUrl = getInterpolatedServerUrl(activeServer) || window.location.origin + window.location.pathname;
-			const redirectUri = makeUrlAbsolute$1(flow["x-scalar-redirect-uri"], { baseUrl });
-			url.searchParams.set("redirect_uri", redirectUri);
-		} else url.searchParams.set("redirect_uri", flow["x-scalar-redirect-uri"]);
-		if (flow["x-scalar-security-query"]) Object.keys(flow["x-scalar-security-query"]).forEach((key) => {
-			const value = flow["x-scalar-security-query"]?.[key];
-			if (!value) return;
-			url.searchParams.set(key, value);
-		});
-		url.searchParams.set("client_id", flow["x-scalar-client-id"]);
-		url.searchParams.set("state", state);
-		if (scopes) url.searchParams.set("scope", scopes);
-		const authWindow = window.open(url, "openAuth2Window", "left=100,top=100,width=800,height=600");
-		if (authWindow) return new Promise((resolve) => {
-			const checkWindowClosed = setInterval(() => {
-				let accessToken = null;
-				let code = null;
-				let error = null;
-				let errorDescription = null;
-				try {
-					const urlParams = new URL(authWindow.location.href).searchParams;
-					const tokenName = flow["x-tokenName"] || "access_token";
-					accessToken = urlParams.get(tokenName);
-					code = urlParams.get("code");
-					error = urlParams.get("error");
-					errorDescription = urlParams.get("error_description");
-					const hashParams = new URLSearchParams(authWindow.location.href.split("#")[1]);
-					accessToken ||= hashParams.get(tokenName);
-					code ||= hashParams.get("code");
-					error ||= hashParams.get("error");
-					errorDescription ||= hashParams.get("error_description");
-				} catch (_e) {}
-				if (authWindow.closed || accessToken || code || error) {
-					clearInterval(checkWindowClosed);
-					authWindow.close();
-					if (error) resolve([/* @__PURE__ */ new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ""}`), null]);
-					else if (accessToken) if (authWindow.location.href.match(/state=([^&]*)/)?.[1] === state) resolve([null, accessToken]);
-					else resolve([/* @__PURE__ */ new Error("State mismatch"), null]);
-					else if (code) if (new URL(authWindow.location.href).searchParams.get("state") === state) authorizeServers(flow, scopes, {
-						code,
-						pkce,
-						proxyUrl
-					}, activeServer).then(resolve);
-					else resolve([/* @__PURE__ */ new Error("State mismatch"), null]);
-					else {
-						clearInterval(checkWindowClosed);
-						resolve([/* @__PURE__ */ new Error("Window was closed without granting authorization"), null]);
-					}
-				}
-			}, 200);
-		});
-		return [/* @__PURE__ */ new Error("Failed to open auth window"), null];
-	} catch (_) {
-		return [/* @__PURE__ */ new Error("Failed to authorize oauth2 flow"), null];
-	}
-};
-/**
-* Makes the BE authorization call to grab the token server to server
-* Used for clientCredentials and authorizationCode
-*/
-var authorizeServers = async (flow, scopes, { code, pkce, proxyUrl } = {}, activeServer) => {
-	if (!flow) return [/* @__PURE__ */ new Error("OAuth2 flow was not defined"), null];
-	const formData = new URLSearchParams();
-	formData.set("client_id", flow["x-scalar-client-id"]);
-	if (scopes && (flow.type === "clientCredentials" || flow.type === "password")) formData.set("scope", scopes);
-	if (flow.clientSecret && (!flow["x-scalar-credentials-location"] || flow["x-scalar-credentials-location"] === "body")) formData.set("client_secret", flow.clientSecret);
-	if ("x-scalar-redirect-uri" in flow && flow["x-scalar-redirect-uri"]) formData.set("redirect_uri", flow["x-scalar-redirect-uri"]);
-	if (code) {
-		formData.set("code", code);
-		formData.set("grant_type", "authorization_code");
-		if (pkce) formData.set("code_verifier", pkce.codeVerifier);
-	} else if (flow.type === "password") {
-		formData.set("grant_type", "password");
-		formData.set("username", flow.username);
-		formData.set("password", flow.password);
-	} else formData.set("grant_type", "client_credentials");
-	if (flow["x-scalar-security-body"]) Object.entries(flow["x-scalar-security-body"]).forEach(([key, value]) => {
-		if (value) formData.set(key, value);
-	});
-	try {
-		const headers = { "Content-Type": "application/x-www-form-urlencoded" };
-		if (flow.clientSecret && (!flow["x-scalar-credentials-location"] || flow["x-scalar-credentials-location"] === "header")) headers.Authorization = `Basic ${encode(`${flow["x-scalar-client-id"]}:${flow.clientSecret}`)}`;
-		const tokenUrl = makeUrlAbsolute$1(flow.tokenUrl, getActiveServerBase(activeServer));
-		const url = shouldUseProxy(proxyUrl, tokenUrl) ? `${proxyUrl}?${new URLSearchParams([["scalar_url", tokenUrl]]).toString()}` : tokenUrl;
-		return [null, (await (await fetch(url, {
-			method: "POST",
-			headers,
-			body: formData
-		})).json())[flow["x-tokenName"] || "access_token"]];
-	} catch {
-		return [/* @__PURE__ */ new Error("Failed to get an access token. Please check your credentials."), null];
-	}
-};
-//#endregion
-export { formatScheme as a, formatComplexScheme as i, authorizeServers as n, getSchemeOptions as o, generateCodeChallenge as r, getSecurityRequirements as s, authorizeOauth2 as t };
-
-//# sourceMappingURL=libs-spbv4P0g.js.map

package/dist/libs-spbv4P0g.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"libs-spbv4P0g.js","names":[],"sources":["../src/views/Request/libs/auth.ts","../src/views/Request/libs/oauth2.ts"],"sourcesContent":["import type { Collection, Operation, SecurityScheme } from '@scalar/oas-utils/entities/spec'\nimport { isDefined } from '@scalar/oas-utils/helpers'\n\nimport { ADD_AUTH_OPTIONS, type SecuritySchemeGroup, type SecuritySchemeOption } from '@/views/Request/consts'\n\ntype DisplayScheme = {\n  type: SecurityScheme['type'] | 'complex'\n  nameKey: SecurityScheme['nameKey']\n  uid: SecurityScheme['uid']\n}\n\n/** Format a scheme object into a display object */\nexport const formatScheme = (s: DisplayScheme) => ({\n  id: s.uid,\n  label: s.type === 'openIdConnect' ? `${s.nameKey} (coming soon)` : s.nameKey,\n})\n\n/** Formats complex security schemes */\nexport const formatComplexScheme = (uids: string[], securitySchemes: Record<string, DisplayScheme>) =>\n  formatScheme(\n    uids.reduce(\n      (acc, uid, index) => {\n        const scheme = securitySchemes[uid]\n        if (scheme) {\n          acc.nameKey += `${index > 0 ? ' & ' : ''}${scheme.nameKey}`\n          acc.uid = `${acc.uid}${index > 0 ? ',' : ''}${scheme.uid}` as SecurityScheme['uid']\n        }\n        return acc\n      },\n      { type: 'complex', nameKey: '', uid: '' as SecurityScheme['uid'] },\n    ),\n  )\n\n/** Compute what the security requirements should be for a request */\nexport const getSecurityRequirements = (operation?: Operation, collection?: Collection) => {\n  // If the request security is optional, use the collection security and ensure it includes an optional object\n  if (JSON.stringify(operation?.security) === '[{}]' && collection?.security?.length) {\n    const collectionHasOptional = Boolean(collection?.security.find((s) => JSON.stringify(s) === '{}'))\n\n    return collectionHasOptional ? collection.security : [...collection.security, {}]\n  }\n\n  return operation?.security ?? collection?.security ?? []\n}\n\n/**\n * Generates the options for the security scheme combobox\n *\n * contains either a flat list, or different groups of required, available, and add new\n */\nexport const getSchemeOptions = (\n  filteredRequirements: Collection['security'],\n  collectionSchemeUids: Collection['securitySchemes'],\n  securitySchemes: Record<string, DisplayScheme>,\n  isReadOnly: boolean = false,\n): SecuritySchemeOption[] | SecuritySchemeGroup[] => {\n  {\n    /** Creates a dictionary of security schemes by nameKey (not UID) */\n    const schemeDict = collectionSchemeUids.reduce(\n      (acc, uid) => {\n        const scheme = securitySchemes[uid]\n        if (scheme) {\n          acc[scheme.nameKey] = scheme\n        }\n        return acc\n      },\n      {} as Record<string, DisplayScheme>,\n    )\n\n    /** Builds the required schemes formatted as options */\n    const requiredFormatted = filteredRequirements.flatMap((r): SecuritySchemeOption | [] => {\n      const keys = Object.keys(r)\n\n      // Complex auth\n      if (keys.length > 1) {\n        const uids = keys.map((k) => schemeDict[k]?.uid).filter(isDefined)\n        return formatComplexScheme(uids, securitySchemes)\n      }\n      // Simple auth\n      if (keys[0]) {\n        const scheme = schemeDict[keys[0]]\n        if (scheme) {\n          return formatScheme(scheme)\n        }\n      }\n\n      return []\n    })\n\n    /** Collection schemes minus the required ones */\n    const availableFormatted = collectionSchemeUids\n      .filter((uid) => !requiredFormatted.some((r) => r.id === uid))\n      .map((uid) => {\n        const scheme = securitySchemes[uid]\n        if (scheme) {\n          return formatScheme(scheme)\n        }\n        return null\n      })\n      .filter(isDefined)\n\n    const options = [\n      { label: 'Required authentication', options: requiredFormatted },\n      { label: 'Available authentication', options: availableFormatted },\n    ]\n\n    if (isReadOnly) {\n      return requiredFormatted.length ? options : availableFormatted\n    }\n\n    options.push({\n      label: 'Add new authentication',\n      options: ADD_AUTH_OPTIONS,\n    })\n\n    return options\n  }\n}\n","import { replaceVariables } from '@scalar/helpers/regex/replace-variables'\nimport { isRelativePath } from '@scalar/helpers/url/is-relative-path'\nimport { makeUrlAbsolute } from '@scalar/helpers/url/make-url-absolute'\nimport { shouldUseProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport type { Oauth2Flow, Server } from '@scalar/oas-utils/entities/spec'\nimport { encode, fromUint8Array } from 'js-base64'\n\nimport type { ErrorResponse } from '@/libs/errors'\n\n/** Oauth2 security schemes which are not implicit */\ntype NonImplicitFlow = Exclude<Oauth2Flow, { type: 'implicit' }>\n\ntype PKCEState = {\n  codeVerifier: string\n  codeChallenge: string\n  codeChallengeMethod: string\n}\n\n/**\n * Interpolates server URL template variables (e.g. `https://{env}.example.com`)\n * using the user-set `value` when available, falling back to the OpenAPI `default`.\n * This is needed so OAuth flows that use the server URL as a base resolve correctly\n * when the spec defines server variables.\n */\nexport const getInterpolatedServerUrl = (activeServer?: Server): string | undefined => {\n  if (!activeServer?.url) return undefined\n\n  const serverVariables = Object.entries(activeServer.variables ?? {}).reduce(\n    (acc, [name, variable]) => {\n      // User-set value takes priority over the OpenAPI default\n      const value = variable.value || variable.default\n      if (value) acc[name] = value\n      return acc\n    },\n    {} as Record<string, string>,\n  )\n\n  return replaceVariables(activeServer.url, serverVariables)\n}\n\nconst getActiveServerBase = (activeServer?: Server) => {\n  const serverUrl = getInterpolatedServerUrl(activeServer)\n\n  if (!serverUrl) {\n    return {}\n  }\n\n  if (isRelativePath(serverUrl)) {\n    return typeof window === 'undefined' ? {} : { basePath: serverUrl }\n  }\n\n  return { baseUrl: serverUrl }\n}\n\n/**\n * Generates a random string for PKCE code verifier\n *\n * @see https://www.rfc-editor.org/rfc/rfc7636#page-8\n */\nconst generateCodeVerifier = (): string => {\n  // Generate 32 random bytes\n  const buffer = new Uint8Array(32)\n  crypto.getRandomValues(buffer)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(buffer, true)\n}\n\n/**\n * Creates a code challenge from the code verifier\n */\nexport const generateCodeChallenge = async (verifier: string, encoding: 'SHA-256' | 'plain'): Promise<string> => {\n  if (encoding === 'plain') {\n    return verifier\n  }\n\n  // If crypto.subtle.digest is not a function, we cannot use SHA-256\n  if (typeof crypto?.subtle?.digest !== 'function') {\n    console.warn('SHA-256 is only supported when using https, using a plain text code challenge instead.')\n    return verifier\n  }\n\n  // ASCII encoding is just taking the lower 8 bits of each character\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(new Uint8Array(digest), true)\n}\n\n/**\n * Authorize oauth2 flow\n *\n * @returns the accessToken\n */\nexport const authorizeOauth2 = async (\n  flow: Oauth2Flow,\n  /** We use the active server to set a base for relative redirect uris */\n  activeServer: Server,\n  /** If we want to use the proxy */\n  proxyUrl?: string,\n): Promise<ErrorResponse<string>> => {\n  try {\n    if (!flow) {\n      return [new Error('Flow not found'), null]\n    }\n\n    const scopes = flow.selectedScopes.join(' ')\n\n    // Client Credentials or Password Flow\n    if (flow.type === 'clientCredentials' || flow.type === 'password') {\n      return authorizeServers(\n        flow,\n        scopes,\n        {\n          proxyUrl,\n        },\n        activeServer,\n      )\n    }\n\n    // OAuth2 flows with a login popup\n\n    // Generate a random state string with the length of 8 characters\n    const state = (Math.random() + 1).toString(36).substring(2, 10)\n    const authorizationUrl = makeUrlAbsolute(flow.authorizationUrl, getActiveServerBase(activeServer))\n    const url = new URL(authorizationUrl)\n\n    /** Special PKCE state */\n    let pkce: PKCEState | null = null\n\n    // Params unique to the flows\n    if (flow.type === 'implicit') {\n      url.searchParams.set('response_type', 'token')\n    }\n\n    // Authorization Code Flow\n    else if (flow.type === 'authorizationCode') {\n      url.searchParams.set('response_type', 'code')\n\n      // PKCE\n      if (flow['x-usePkce'] !== 'no') {\n        const codeVerifier = generateCodeVerifier()\n        const codeChallenge = await generateCodeChallenge(codeVerifier, flow['x-usePkce'])\n\n        // Set state for later verification\n        pkce = {\n          codeVerifier,\n          codeChallenge,\n          codeChallengeMethod: flow['x-usePkce'] === 'SHA-256' ? 'S256' : 'plain',\n        }\n\n        // Set the code challenge and method on the url\n        url.searchParams.set('code_challenge', codeChallenge)\n        url.searchParams.set('code_challenge_method', pkce.codeChallengeMethod)\n      }\n    }\n\n    // Handle relative redirect uris\n    if (flow['x-scalar-redirect-uri'].startsWith('/')) {\n      const baseUrl = getInterpolatedServerUrl(activeServer) || window.location.origin + window.location.pathname\n      const redirectUri = makeUrlAbsolute(flow['x-scalar-redirect-uri'], { baseUrl: baseUrl })\n\n      url.searchParams.set('redirect_uri', redirectUri)\n    } else {\n      url.searchParams.set('redirect_uri', flow['x-scalar-redirect-uri'])\n    }\n\n    if (flow['x-scalar-security-query']) {\n      Object.keys(flow['x-scalar-security-query']).forEach((key: string): void => {\n        const value = flow['x-scalar-security-query']?.[key]\n        if (!value) {\n          return\n        }\n        url.searchParams.set(key, value)\n      })\n    }\n\n    // Common to all flows\n    url.searchParams.set('client_id', flow['x-scalar-client-id'])\n    url.searchParams.set('state', state)\n    if (scopes) {\n      url.searchParams.set('scope', scopes)\n    }\n\n    const windowFeatures = 'left=100,top=100,width=800,height=600'\n    const authWindow = window.open(url, 'openAuth2Window', windowFeatures)\n\n    // Open up a window and poll until closed or we have the data we want\n    if (authWindow) {\n      // We need to return a promise here due to the setInterval\n      return new Promise<ErrorResponse<string>>((resolve) => {\n        const checkWindowClosed = setInterval(() => {\n          let accessToken: string | null = null\n          let code: string | null = null\n          let error: string | null = null\n          let errorDescription: string | null = null\n\n          try {\n            const urlParams = new URL(authWindow.location.href).searchParams\n            const tokenName = flow['x-tokenName'] || 'access_token'\n            accessToken = urlParams.get(tokenName)\n            code = urlParams.get('code')\n\n            error = urlParams.get('error')\n            errorDescription = urlParams.get('error_description')\n\n            // We may get the properties in a hash\n            const hashParams = new URLSearchParams(authWindow.location.href.split('#')[1])\n            accessToken ||= hashParams.get(tokenName)\n            code ||= hashParams.get('code')\n            error ||= hashParams.get('error')\n            errorDescription ||= hashParams.get('error_description')\n          } catch (_e) {\n            // Ignore CORS error from popup\n          }\n\n          // The window has closed OR we have what we are looking for so we stop polling\n          if (authWindow.closed || accessToken || code || error) {\n            clearInterval(checkWindowClosed)\n            authWindow.close()\n\n            if (error) {\n              resolve([new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null])\n            }\n\n            // Implicit Flow\n            else if (accessToken) {\n              // State is a hash fragment and cannot be found through search params\n              const _state = authWindow.location.href.match(/state=([^&]*)/)?.[1]\n\n              if (_state === state) {\n                resolve([null, accessToken])\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n            }\n\n            // Authorization Code Server Flow\n            else if (code) {\n              const _state = new URL(authWindow.location.href).searchParams.get('state')\n\n              if (_state === state) {\n                // biome-ignore lint/nursery/noFloatingPromises: output of authorizeServers must be returned\n                authorizeServers(\n                  flow as NonImplicitFlow,\n                  scopes,\n                  {\n                    code,\n                    pkce,\n                    proxyUrl,\n                  },\n                  activeServer,\n                ).then(resolve)\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n            }\n            // User closed window without authorizing\n            else {\n              clearInterval(checkWindowClosed)\n              resolve([new Error('Window was closed without granting authorization'), null])\n            }\n          }\n        }, 200)\n      })\n    }\n    return [new Error('Failed to open auth window'), null]\n  } catch (_) {\n    return [new Error('Failed to authorize oauth2 flow'), null]\n  }\n}\n\n/**\n * Makes the BE authorization call to grab the token server to server\n * Used for clientCredentials and authorizationCode\n */\nexport const authorizeServers = async (\n  flow: NonImplicitFlow,\n  scopes: string,\n  {\n    code,\n    pkce,\n    proxyUrl,\n  }: {\n    code?: string\n    pkce?: PKCEState | null\n    proxyUrl?: string | undefined\n  } = {},\n  activeServer: Server | undefined,\n): Promise<ErrorResponse<string>> => {\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const formData = new URLSearchParams()\n  formData.set('client_id', flow['x-scalar-client-id'])\n\n  // Only client credentials and password flows support scopes in the token request\n  if (scopes && (flow.type === 'clientCredentials' || flow.type === 'password')) {\n    formData.set('scope', scopes)\n  }\n\n  // Only add the secret if a credentials location is not specified (backwards compatibility) or is set to body\n  const shouldAddSecretToBody =\n    flow.clientSecret && (!flow['x-scalar-credentials-location'] || flow['x-scalar-credentials-location'] === 'body')\n\n  if (shouldAddSecretToBody) {\n    formData.set('client_secret', flow.clientSecret)\n  }\n  if ('x-scalar-redirect-uri' in flow && flow['x-scalar-redirect-uri']) {\n    formData.set('redirect_uri', flow['x-scalar-redirect-uri'])\n  }\n\n  // Authorization Code\n  if (code) {\n    formData.set('code', code)\n    formData.set('grant_type', 'authorization_code')\n\n    // PKCE\n    if (pkce) {\n      formData.set('code_verifier', pkce.codeVerifier)\n    }\n  }\n  // Password\n  else if (flow.type === 'password') {\n    formData.set('grant_type', 'password')\n    formData.set('username', flow.username)\n    formData.set('password', flow.password)\n  }\n  // Client Credentials\n  else {\n    formData.set('grant_type', 'client_credentials')\n  }\n\n  // Additional request body parameters\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value) {\n        formData.set(key, value)\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    // Only add the secret if a credentials location is not specified (backwards compatibility) or is set to header\n    const shouldAddSecretToHeader =\n      flow.clientSecret &&\n      (!flow['x-scalar-credentials-location'] || flow['x-scalar-credentials-location'] === 'header')\n\n    // Add client id + secret to headers\n    if (shouldAddSecretToHeader) {\n      headers.Authorization = `Basic ${encode(`${flow['x-scalar-client-id']}:${flow.clientSecret}`)}`\n    }\n\n    // Check if we should use the proxy\n    const tokenUrl = makeUrlAbsolute(flow.tokenUrl, getActiveServerBase(activeServer))\n    const url = shouldUseProxy(proxyUrl, tokenUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', tokenUrl]]).toString()}`\n      : tokenUrl\n\n    // Make the call\n    const resp = await fetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    // Use custom token name if specified, otherwise default to access_token\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n\n    return [null, accessToken]\n  } catch {\n    return [new Error('Failed to get an access token. Please check your credentials.'), null]\n  }\n}\n"],"mappings":";;;;;;;;;AAYA,IAAa,gBAAgB,OAAsB;CACjD,IAAI,EAAE;CACN,OAAO,EAAE,SAAS,kBAAkB,GAAG,EAAE,QAAQ,kBAAkB,EAAE;CACtE;;AAGD,IAAa,uBAAuB,MAAgB,oBAClD,aACE,KAAK,QACF,KAAK,KAAK,UAAU;CACnB,MAAM,SAAS,gBAAgB;AAC/B,KAAI,QAAQ;AACV,MAAI,WAAW,GAAG,QAAQ,IAAI,QAAQ,KAAK,OAAO;AAClD,MAAI,MAAM,GAAG,IAAI,MAAM,QAAQ,IAAI,MAAM,KAAK,OAAO;;AAEvD,QAAO;GAET;CAAE,MAAM;CAAW,SAAS;CAAI,KAAK;CAA6B,CACnE,CACF;;AAGH,IAAa,2BAA2B,WAAuB,eAA4B;AAEzF,KAAI,KAAK,UAAU,WAAW,SAAS,KAAK,UAAU,YAAY,UAAU,OAG1E,QAF8B,QAAQ,YAAY,SAAS,MAAM,MAAM,KAAK,UAAU,EAAE,KAAK,KAAK,CAAC,GAEpE,WAAW,WAAW,CAAC,GAAG,WAAW,UAAU,EAAE,CAAC;AAGnF,QAAO,WAAW,YAAY,YAAY,YAAY,EAAE;;;;;;;AAQ1D,IAAa,oBACX,sBACA,sBACA,iBACA,aAAsB,UAC6B;CACnD;;EAEE,MAAM,aAAa,qBAAqB,QACrC,KAAK,QAAQ;GACZ,MAAM,SAAS,gBAAgB;AAC/B,OAAI,OACF,KAAI,OAAO,WAAW;AAExB,UAAO;KAET,EAAE,CACH;;EAGD,MAAM,oBAAoB,qBAAqB,SAAS,MAAiC;GACvF,MAAM,OAAO,OAAO,KAAK,EAAE;AAG3B,OAAI,KAAK,SAAS,EAEhB,QAAO,oBADM,KAAK,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,OAAO,UAAU,EACjC,gBAAgB;AAGnD,OAAI,KAAK,IAAI;IACX,MAAM,SAAS,WAAW,KAAK;AAC/B,QAAI,OACF,QAAO,aAAa,OAAO;;AAI/B,UAAO,EAAE;IACT;;EAGF,MAAM,qBAAqB,qBACxB,QAAQ,QAAQ,CAAC,kBAAkB,MAAM,MAAM,EAAE,OAAO,IAAI,CAAC,CAC7D,KAAK,QAAQ;GACZ,MAAM,SAAS,gBAAgB;AAC/B,OAAI,OACF,QAAO,aAAa,OAAO;AAE7B,UAAO;IACP,CACD,OAAO,UAAU;EAEpB,MAAM,UAAU,CACd;GAAE,OAAO;GAA2B,SAAS;GAAmB,EAChE;GAAE,OAAO;GAA4B,SAAS;GAAoB,CACnE;AAED,MAAI,WACF,QAAO,kBAAkB,SAAS,UAAU;AAG9C,UAAQ,KAAK;GACX,OAAO;GACP,SAAS;GACV,CAAC;AAEF,SAAO;;;;;;;;;;;AC3FX,IAAa,4BAA4B,iBAA8C;AACrF,KAAI,CAAC,cAAc,IAAK,QAAO,KAAA;CAE/B,MAAM,kBAAkB,OAAO,QAAQ,aAAa,aAAa,EAAE,CAAC,CAAC,QAClE,KAAK,CAAC,MAAM,cAAc;EAEzB,MAAM,QAAQ,SAAS,SAAS,SAAS;AACzC,MAAI,MAAO,KAAI,QAAQ;AACvB,SAAO;IAET,EAAE,CACH;AAED,QAAO,iBAAiB,aAAa,KAAK,gBAAgB;;AAG5D,IAAM,uBAAuB,iBAA0B;CACrD,MAAM,YAAY,yBAAyB,aAAa;AAExD,KAAI,CAAC,UACH,QAAO,EAAE;AAGX,KAAI,eAAe,UAAU,CAC3B,QAAO,OAAO,WAAW,cAAc,EAAE,GAAG,EAAE,UAAU,WAAW;AAGrE,QAAO,EAAE,SAAS,WAAW;;;;;;;AAQ/B,IAAM,6BAAqC;CAEzC,MAAM,SAAS,IAAI,WAAW,GAAG;AACjC,QAAO,gBAAgB,OAAO;AAG9B,QAAO,eAAe,QAAQ,KAAK;;;;;AAMrC,IAAa,wBAAwB,OAAO,UAAkB,aAAmD;AAC/G,KAAI,aAAa,QACf,QAAO;AAIT,KAAI,OAAO,QAAQ,QAAQ,WAAW,YAAY;AAChD,UAAQ,KAAK,yFAAyF;AACtG,SAAO;;CAKT,MAAM,OADU,IAAI,aAAa,CACZ,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAG1D,QAAO,eAAe,IAAI,WAAW,OAAO,EAAE,KAAK;;;;;;;AAQrD,IAAa,kBAAkB,OAC7B,MAEA,cAEA,aACmC;AACnC,KAAI;AACF,MAAI,CAAC,KACH,QAAO,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK;EAG5C,MAAM,SAAS,KAAK,eAAe,KAAK,IAAI;AAG5C,MAAI,KAAK,SAAS,uBAAuB,KAAK,SAAS,WACrD,QAAO,iBACL,MACA,QACA,EACE,UACD,EACD,aACD;EAMH,MAAM,SAAS,KAAK,QAAQ,GAAG,GAAG,SAAS,GAAG,CAAC,UAAU,GAAG,GAAG;EAC/D,MAAM,mBAAmB,kBAAgB,KAAK,kBAAkB,oBAAoB,aAAa,CAAC;EAClG,MAAM,MAAM,IAAI,IAAI,iBAAiB;;EAGrC,IAAI,OAAyB;AAG7B,MAAI,KAAK,SAAS,WAChB,KAAI,aAAa,IAAI,iBAAiB,QAAQ;WAIvC,KAAK,SAAS,qBAAqB;AAC1C,OAAI,aAAa,IAAI,iBAAiB,OAAO;AAG7C,OAAI,KAAK,iBAAiB,MAAM;IAC9B,MAAM,eAAe,sBAAsB;IAC3C,MAAM,gBAAgB,MAAM,sBAAsB,cAAc,KAAK,aAAa;AAGlF,WAAO;KACL;KACA;KACA,qBAAqB,KAAK,iBAAiB,YAAY,SAAS;KACjE;AAGD,QAAI,aAAa,IAAI,kBAAkB,cAAc;AACrD,QAAI,aAAa,IAAI,yBAAyB,KAAK,oBAAoB;;;AAK3E,MAAI,KAAK,yBAAyB,WAAW,IAAI,EAAE;GACjD,MAAM,UAAU,yBAAyB,aAAa,IAAI,OAAO,SAAS,SAAS,OAAO,SAAS;GACnG,MAAM,cAAc,kBAAgB,KAAK,0BAA0B,EAAW,SAAS,CAAC;AAExF,OAAI,aAAa,IAAI,gBAAgB,YAAY;QAEjD,KAAI,aAAa,IAAI,gBAAgB,KAAK,yBAAyB;AAGrE,MAAI,KAAK,2BACP,QAAO,KAAK,KAAK,2BAA2B,CAAC,SAAS,QAAsB;GAC1E,MAAM,QAAQ,KAAK,6BAA6B;AAChD,OAAI,CAAC,MACH;AAEF,OAAI,aAAa,IAAI,KAAK,MAAM;IAChC;AAIJ,MAAI,aAAa,IAAI,aAAa,KAAK,sBAAsB;AAC7D,MAAI,aAAa,IAAI,SAAS,MAAM;AACpC,MAAI,OACF,KAAI,aAAa,IAAI,SAAS,OAAO;EAIvC,MAAM,aAAa,OAAO,KAAK,KAAK,mBADb,wCAC+C;AAGtE,MAAI,WAEF,QAAO,IAAI,SAAgC,YAAY;GACrD,MAAM,oBAAoB,kBAAkB;IAC1C,IAAI,cAA6B;IACjC,IAAI,OAAsB;IAC1B,IAAI,QAAuB;IAC3B,IAAI,mBAAkC;AAEtC,QAAI;KACF,MAAM,YAAY,IAAI,IAAI,WAAW,SAAS,KAAK,CAAC;KACpD,MAAM,YAAY,KAAK,kBAAkB;AACzC,mBAAc,UAAU,IAAI,UAAU;AACtC,YAAO,UAAU,IAAI,OAAO;AAE5B,aAAQ,UAAU,IAAI,QAAQ;AAC9B,wBAAmB,UAAU,IAAI,oBAAoB;KAGrD,MAAM,aAAa,IAAI,gBAAgB,WAAW,SAAS,KAAK,MAAM,IAAI,CAAC,GAAG;AAC9E,qBAAgB,WAAW,IAAI,UAAU;AACzC,cAAS,WAAW,IAAI,OAAO;AAC/B,eAAU,WAAW,IAAI,QAAQ;AACjC,0BAAqB,WAAW,IAAI,oBAAoB;aACjD,IAAI;AAKb,QAAI,WAAW,UAAU,eAAe,QAAQ,OAAO;AACrD,mBAAc,kBAAkB;AAChC,gBAAW,OAAO;AAElB,SAAI,MACF,SAAQ,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,KAAK,EAAE,KAAK,CAAC;cAI/F,YAIP,KAFe,WAAW,SAAS,KAAK,MAAM,gBAAgB,GAAG,OAElD,MACb,SAAQ,CAAC,MAAM,YAAY,CAAC;SAE5B,SAAQ,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK,CAAC;cAKvC,KAGP,KAFe,IAAI,IAAI,WAAW,SAAS,KAAK,CAAC,aAAa,IAAI,QAAQ,KAE3D,MAEb,kBACE,MACA,QACA;MACE;MACA;MACA;MACD,EACD,aACD,CAAC,KAAK,QAAQ;SAEf,SAAQ,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK,CAAC;UAI3C;AACH,oBAAc,kBAAkB;AAChC,cAAQ,iBAAC,IAAI,MAAM,mDAAmD,EAAE,KAAK,CAAC;;;MAGjF,IAAI;IACP;AAEJ,SAAO,iBAAC,IAAI,MAAM,6BAA6B,EAAE,KAAK;UAC/C,GAAG;AACV,SAAO,iBAAC,IAAI,MAAM,kCAAkC,EAAE,KAAK;;;;;;;AAQ/D,IAAa,mBAAmB,OAC9B,MACA,QACA,EACE,MACA,MACA,aAKE,EAAE,EACN,iBACmC;AACnC,KAAI,CAAC,KACH,QAAO,iBAAC,IAAI,MAAM,8BAA8B,EAAE,KAAK;CAGzD,MAAM,WAAW,IAAI,iBAAiB;AACtC,UAAS,IAAI,aAAa,KAAK,sBAAsB;AAGrD,KAAI,WAAW,KAAK,SAAS,uBAAuB,KAAK,SAAS,YAChE,UAAS,IAAI,SAAS,OAAO;AAO/B,KAFE,KAAK,iBAAiB,CAAC,KAAK,oCAAoC,KAAK,qCAAqC,QAG1G,UAAS,IAAI,iBAAiB,KAAK,aAAa;AAElD,KAAI,2BAA2B,QAAQ,KAAK,yBAC1C,UAAS,IAAI,gBAAgB,KAAK,yBAAyB;AAI7D,KAAI,MAAM;AACR,WAAS,IAAI,QAAQ,KAAK;AAC1B,WAAS,IAAI,cAAc,qBAAqB;AAGhD,MAAI,KACF,UAAS,IAAI,iBAAiB,KAAK,aAAa;YAI3C,KAAK,SAAS,YAAY;AACjC,WAAS,IAAI,cAAc,WAAW;AACtC,WAAS,IAAI,YAAY,KAAK,SAAS;AACvC,WAAS,IAAI,YAAY,KAAK,SAAS;OAIvC,UAAS,IAAI,cAAc,qBAAqB;AAIlD,KAAI,KAAK,0BACP,QAAO,QAAQ,KAAK,0BAA0B,CAAC,SAAS,CAAC,KAAK,WAAW;AACvE,MAAI,MACF,UAAS,IAAI,KAAK,MAAM;GAE1B;AAGJ,KAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,qCACjB;AAQD,MAJE,KAAK,iBACJ,CAAC,KAAK,oCAAoC,KAAK,qCAAqC,UAIrF,SAAQ,gBAAgB,SAAS,OAAO,GAAG,KAAK,sBAAsB,GAAG,KAAK,eAAe;EAI/F,MAAM,WAAW,kBAAgB,KAAK,UAAU,oBAAoB,aAAa,CAAC;EAClF,MAAM,MAAM,eAAe,UAAU,SAAS,GAC1C,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,SAAS,CAAC,CAAC,CAAC,UAAU,KACzE;AAcJ,SAAO,CAAC,OANa,OALR,MAAM,MAAM,KAAK;GAC5B,QAAQ;GACR;GACA,MAAM;GACP,CAAC,EAC8B,MAAM,EAGpB,KAAK,kBAAkB,gBAGf;SACpB;AACN,SAAO,iBAAC,IAAI,MAAM,gEAAgE,EAAE,KAAK"}