@scalar/api-client 3.12.0 → 3.13.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @scalar/api-client
 
+## 3.13.1
+
+## 3.13.0
+
+### Minor Changes
+
+- [#9613](https://github.com/scalar/scalar/pull/9613): feat(api-client): support an injectable OAuth2 redirect capture for interactive flows
+
+  Adds an optional `captureOAuth2Callback` option so environments that cannot use browser-popup polling (notably the Electron desktop app, where the renderer runs on `file://`) can run the authorization-code and implicit flows through the system browser and a host-owned redirect target. The desktop app uses this to capture the redirect on a `127.0.0.1` loopback server (RFC 8252).
+
+### Patch Changes
+
+- [#9592](https://github.com/scalar/scalar/pull/9592): fix: only offer the security schemes an operation actually declares
+
+  The auth dropdown no longer lists every scheme from `components.securitySchemes`. In the reference docs and the request modal it now respects the operation's `security`: an operation with `security: []` offers no auth, and an operation that lists a subset of schemes only offers those. The standalone client keeps letting you attach any defined scheme.
+
 ## 3.12.0
 
 ### Minor Changes

package/dist/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue.d.ts

@@ -3,10 +3,13 @@ import type { WorkspaceEventBus } from '@scalar/workspace-store/events';
 import { type OAuthFlowsObjectSecret, type SecuritySchemeObjectSecret } from '@scalar/workspace-store/request-example';
 import type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments';
 import type { ServerObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import { type CaptureOAuth2Callback } from '../../../../v2/blocks/scalar-auth-selector-block/helpers/oauth.js';
 /**  Any config options required for the OAuth2 flow */
 export type OAuth2Options = Pick<ApiClientConfiguration, 'oauth2RedirectUri'> & {
     /** Optional fetch override (IPC-backed on desktop) used for token exchange, refresh, and OIDC discovery */
     customFetch?: typeof fetch;
+    /** Optional redirect capture (loopback-backed on desktop) for interactive OAuth2 flows */
+    captureOAuth2Callback?: CaptureOAuth2Callback;
 };
 declare const _default: typeof __VLS_export;
 export default _default;

package/dist/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OAuth2.vue.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue"],"names":[],"mappings":"AA2jBA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAIzE,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAKL,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAChC,MAAM,yCAAyC,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AAGnH,OAAO,KAAK,EAEV,YAAY,EACb,MAAM,8DAA8D,CAAA;AAcrE,uDAAuD;AACvD,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,sBAAsB,EACtB,mBAAmB,CACpB,GAAG;IACF,2GAA2G;IAC3G,WAAW,CAAC,EAAE,OAAO,KAAK,CAAA;CAC3B,CAAA;wBACoB,OAAO,YAAY;AAAxC,wBAAyC;AACzC,QAAA,MAAM,YAAY;IAEhB,wCAAwC;iBAC3B,kBAAkB;IAC/B,kBAAkB;WACX,sBAAsB;IAC7B,6BAA6B;UACvB,MAAM,sBAAsB;IAClC,sBAAsB;oBACN,MAAM,EAAE;IACxB,sBAAsB;YACd,0BAA0B;IAClC,mCAAmC;YAC3B,YAAY,GAAG,IAAI;IAC3B,gBAAgB;cACN,MAAM;IAChB,kCAAkC;UAC5B,MAAM;IACZ,2CAA2C;cACjC,iBAAiB;IAC3B,uDAAuD;cAC7C,aAAa;;;gBAiByB,MAAM,EAAE;;;;;;;;;;;;;;;;IApCxD,wCAAwC;iBAC3B,kBAAkB;IAC/B,kBAAkB;WACX,sBAAsB;IAC7B,6BAA6B;UACvB,MAAM,sBAAsB;IAClC,sBAAsB;oBACN,MAAM,EAAE;IACxB,sBAAsB;YACd,0BAA0B;IAClC,mCAAmC;YAC3B,YAAY,GAAG,IAAI;IAC3B,gBAAgB;cACN,MAAM;IAChB,kCAAkC;UAC5B,MAAM;IACZ,2CAA2C;cACjC,iBAAiB;IAC3B,uDAAuD;cAC7C,aAAa;;;gBAiByB,MAAM,EAAE;;;;;;;;;;;;;;;kFA48BtD,CAAC"}
+{"version":3,"file":"OAuth2.vue.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue"],"names":[],"mappings":"AA0kBA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAIzE,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAKL,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAChC,MAAM,yCAAyC,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AAGnH,OAAO,KAAK,EAEV,YAAY,EACb,MAAM,8DAA8D,CAAA;AAIrE,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sDAAsD,CAAA;AAO7D,uDAAuD;AACvD,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,sBAAsB,EACtB,mBAAmB,CACpB,GAAG;IACF,2GAA2G;IAC3G,WAAW,CAAC,EAAE,OAAO,KAAK,CAAA;IAC1B,0FAA0F;IAC1F,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;CAC9C,CAAA;wBACoB,OAAO,YAAY;AAAxC,wBAAyC;AACzC,QAAA,MAAM,YAAY;IAEhB,wCAAwC;iBAC3B,kBAAkB;IAC/B,kBAAkB;WACX,sBAAsB;IAC7B,6BAA6B;UACvB,MAAM,sBAAsB;IAClC,sBAAsB;oBACN,MAAM,EAAE;IACxB,sBAAsB;YACd,0BAA0B;IAClC,mCAAmC;YAC3B,YAAY,GAAG,IAAI;IAC3B,gBAAgB;cACN,MAAM;IAChB,kCAAkC;UAC5B,MAAM;IACZ,2CAA2C;cACjC,iBAAiB;IAC3B,uDAAuD;cAC7C,aAAa;;;gBAiByB,MAAM,EAAE;;;;;;;;;;;;;;;;IApCxD,wCAAwC;iBAC3B,kBAAkB;IAC/B,kBAAkB;WACX,sBAAsB;IAC7B,6BAA6B;UACvB,MAAM,sBAAsB;IAClC,sBAAsB;oBACN,MAAM,EAAE;IACxB,sBAAsB;YACd,0BAA0B;IAClC,mCAAmC;YAC3B,YAAY,GAAG,IAAI;IAC3B,gBAAgB;cACN,MAAM;IAChB,kCAAkC;UAC5B,MAAM;IACZ,2CAA2C;cACjC,iBAAiB;IAC3B,uDAAuD;cAC7C,aAAa;;;gBAiByB,MAAM,EAAE;;;;;;;;;;;;;;;kFA69BtD,CAAC"}

package/dist/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue.js.map

@@ -1 +1 @@
-{"version":3,"file":"OAuth2.vue.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue"],"sourcesContent":["<script lang=\"ts\">\n/**  Any config options required for the OAuth2 flow */\nexport type OAuth2Options = Pick<\n  ApiClientConfiguration,\n  'oauth2RedirectUri'\n> & {\n  /** Optional fetch override (IPC-backed on desktop) used for token exchange, refresh, and OIDC discovery */\n  customFetch?: typeof fetch\n}\n</script>\n\n<script setup lang=\"ts\">\nimport { ScalarButton } from '@scalar/components/button'\nimport { useLoadingState } from '@scalar/components/loading'\nimport type { ApiClientConfiguration } from '@scalar/types/api-reference'\nimport { pkceOptions } from '@scalar/types/entities'\nimport { useToasts } from '@scalar/use-toasts'\nimport type { SecretsOAuthFlows } from '@scalar/workspace-store/entities/auth'\nimport type {\n  ApiReferenceEvents,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport {\n  getEnvironmentVariables,\n  type OAuthFlowAuthorizationCodeSecret,\n  type OAuthFlowClientCredentialsSecret,\n  type OAuthFlowPasswordSecret,\n  type OAuthFlowsObjectSecret,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { XScalarCredentialsLocation } from '@scalar/workspace-store/schemas/extensions/security/x-scalar-credentials-location'\nimport { type XusePkce } from '@scalar/workspace-store/schemas/extensions/security/x-use-pkce'\nimport type {\n  OAuthFlow,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport { computed, ref, watch } from 'vue'\n\nimport OAuthScopesInput from '@/v2/blocks/scalar-auth-selector-block/components/OAuthScopesInput.vue'\nimport {\n  authorizeOauth2,\n  refreshOauth2Token,\n} from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { resolveDefaultOAuth2RedirectUri } from '@/v2/blocks/scalar-auth-selector-block/helpers/resolve-default-oauth2-redirect-url'\nimport { DataTableRow } from '@/v2/components/data-table'\n\nimport RequestAuthDataTableInput from './RequestAuthDataTableInput.vue'\n\nconst {\n  environment,\n  flows,\n  type,\n  scheme,\n  selectedScopes: selectedScopesProp,\n  server,\n  proxyUrl,\n  eventBus,\n  name,\n  options = {},\n} = defineProps<{\n  /** Current environment configuration */\n  environment: XScalarEnvironment\n  /** OAuth flows */\n  flows: OAuthFlowsObjectSecret\n  /** Type of the OAuth flow */\n  type: keyof OAuthFlowsObjectSecret\n  /** Selected scopes */\n  selectedScopes: string[]\n  /** Security scheme */\n  scheme: SecuritySchemeObjectSecret\n  /** Current server configuration */\n  server: ServerObject | null\n  /** Proxy URL */\n  proxyUrl: string\n  /** Name of the security scheme */\n  name: string\n  /** Event bus for authentication updates */\n  eventBus: WorkspaceEventBus\n  /**  Any config options required for the OAuth2 flow */\n  options?: OAuth2Options\n}>()\n\nconst emits = defineEmits<{\n  (e: 'update:selectedScopes', payload: { scopes: string[] }): void\n  (\n    e: 'upsert:scope',\n    payload: Omit<ApiReferenceEvents['auth:upsert:scopes'], 'name'>,\n  ): void\n  (\n    e: 'delete:scope',\n    payload: Omit<ApiReferenceEvents['auth:delete:scopes'], 'name'>,\n  ): void\n}>()\n\nconst loader = useLoadingState()\nconst { toast } = useToasts()\n\n/** The current OAuth flow based on the selected type */\nconst flow = computed(() => flows[type]!)\ntype NonImplicitFlow =\n  | OAuthFlowPasswordSecret\n  | OAuthFlowClientCredentialsSecret\n  | OAuthFlowAuthorizationCodeSecret\n\n/** We filter selected scopes to only include scopes that are defined on this flow (own keys only). */\nconst selectedScopes = computed(() => {\n  const definedScopes = flow.value.scopes\n  if (!definedScopes) {\n    return []\n  }\n  return selectedScopesProp.filter((scope) =>\n    Object.hasOwn(definedScopes, scope),\n  )\n})\n\n/**\n * PKCE public clients do not use a client_secret. Hide the field when the\n * document enables PKCE so readers are not prompted for an unused secret.\n */\nconst showClientSecret = computed(() => {\n  if (!('x-scalar-secret-client-secret' in flow.value)) {\n    return false\n  }\n  const pkceMode =\n    'x-usePkce' in flow.value ? flow.value['x-usePkce'] : undefined\n  return pkceMode !== 'SHA-256' && pkceMode !== 'plain'\n})\n\nconst clientSecretValue = computed((): string => {\n  const f = flow.value as { 'x-scalar-secret-client-secret'?: string }\n  return f['x-scalar-secret-client-secret'] ?? ''\n})\n\n/** Updates the security scheme base */\nconst handleOauth2Update = (\n  payload: Partial<OAuthFlow & XScalarCredentialsLocation>,\n): void => {\n  // OpenIdConnect uses the secrets update for all\n  if (scheme.type === 'openIdConnect') {\n    return handleOauth2SecretsUpdate(payload)\n  }\n\n  eventBus.emit('auth:update:security-scheme', {\n    payload: {\n      type: scheme.type,\n      flows: {\n        [type]: payload,\n      },\n    },\n    name,\n  })\n}\n\n/** Updates the flow secrets */\nconst handleOauth2SecretsUpdate = (\n  payload: Omit<Partial<SecretsOAuthFlows[keyof SecretsOAuthFlows]>, 'type'>,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: {\n      type: scheme.type,\n      [type]: payload,\n    },\n    name,\n  })\n\n/** Clears the flow secrets */\nconst clearOauth2Secrets = (): void => {\n  if (loader.isLoading) {\n    return\n  }\n  eventBus.emit('auth:clear:security-scheme-secrets', {\n    name,\n  })\n}\n\n/** Clears stored access and refresh tokens (authorized state) */\nconst handleClearAccessTokens = (): void => {\n  if (loader.isLoading) {\n    return\n  }\n  handleOauth2SecretsUpdate({\n    'x-scalar-secret-token': '',\n    'x-scalar-secret-refresh-token': '',\n  })\n}\n\n/** Track redirect URI prefill per flow instance to support document switching */\nconst prefilledFlowIdentity = ref<string | null>(null)\nconst hasHandledRedirectPrefill = ref(false)\n\nconst resolveFlowIdentity = (\n  currentFlow: OAuthFlowsObjectSecret[keyof OAuthFlowsObjectSecret] | undefined,\n): string =>\n  JSON.stringify({\n    type,\n    authorizationUrl:\n      currentFlow && 'authorizationUrl' in currentFlow\n        ? currentFlow.authorizationUrl\n        : '',\n    tokenUrl:\n      currentFlow && 'tokenUrl' in currentFlow ? currentFlow.tokenUrl : '',\n    refreshUrl: currentFlow?.refreshUrl ?? '',\n    scopes: Object.keys(currentFlow?.scopes ?? {}),\n  })\n\n/** Default the redirect-uri to the current origin if we have access to window */\nwatch(\n  () => flow.value,\n  (currentFlow) => {\n    if (!currentFlow || !('x-scalar-secret-redirect-uri' in currentFlow)) {\n      return\n    }\n\n    const flowIdentity = resolveFlowIdentity(currentFlow)\n    if (prefilledFlowIdentity.value !== flowIdentity) {\n      prefilledFlowIdentity.value = flowIdentity\n      hasHandledRedirectPrefill.value = false\n    }\n\n    if (hasHandledRedirectPrefill.value) {\n      return\n    }\n\n    const newRedirectUri = (currentFlow as OAuthFlowAuthorizationCodeSecret)[\n      'x-scalar-secret-redirect-uri'\n    ]\n    const defaultRedirectUri = resolveDefaultOAuth2RedirectUri(options)\n\n    hasHandledRedirectPrefill.value = true\n\n    if (newRedirectUri || !defaultRedirectUri) {\n      return\n    }\n\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-redirect-uri': defaultRedirectUri,\n    })\n  },\n  { immediate: true },\n)\n\n/**\n * Authorizes the user using the specified OAuth flow.\n * Opens the appropriate OAuth dialog and/or performs the token exchange.\n */\nconst handleAuthorize = async (): Promise<void> => {\n  if (loader.isLoading) {\n    return\n  }\n\n  loader.start()\n\n  const [error, tokens] = await authorizeOauth2(\n    flows,\n    type,\n    selectedScopes.value,\n    server,\n    proxyUrl,\n    getEnvironmentVariables(environment),\n    options.customFetch,\n  )\n\n  await loader.clear()\n\n  if (tokens?.accessToken) {\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-token': tokens.accessToken,\n      ...(tokens.refreshToken\n        ? { 'x-scalar-secret-refresh-token': tokens.refreshToken }\n        : {}),\n    })\n  } else {\n    console.error(error)\n    toast(error?.message ?? 'Failed to authorize', 'error')\n  }\n}\n\n/** Whether the current flow supports refreshing the access token */\nconst supportsRefreshToken = computed(() => type !== 'implicit')\n\n/**\n * Refresh URL placeholder, shows tokenUrl as hint if refreshUrl is not specified.\n * This helps users understand that tokenUrl will be used as fallback.\n */\nconst refreshUrlPlaceholder = computed(() => {\n  if ('tokenUrl' in flow.value && flow.value.tokenUrl) {\n    return flow.value.tokenUrl\n  }\n  return 'https://galaxy.scalar.com/oauth/refresh'\n})\n\n/**\n * Uses the stored refresh token to obtain a new access token\n * via grant_type=refresh_token.\n */\nconst handleRefresh = async (): Promise<void> => {\n  if (loader.isLoading || type === 'implicit') {\n    return\n  }\n\n  loader.start()\n\n  const [error, tokens] = await refreshOauth2Token(\n    flows,\n    type,\n    proxyUrl,\n    server,\n    getEnvironmentVariables(environment),\n    options.customFetch,\n  )\n\n  await loader.clear()\n\n  if (tokens?.accessToken) {\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-token': tokens.accessToken,\n      ...(tokens.refreshToken\n        ? { 'x-scalar-secret-refresh-token': tokens.refreshToken }\n        : {}),\n    })\n  } else {\n    console.error(error)\n    toast(error?.message ?? 'Failed to refresh token', 'error')\n  }\n}\n\n/** Updates the secret location */\nconst handleSecretLocationUpdate = (value: string): void => {\n  const credentialsLocation = value === 'body' ? 'body' : 'header'\n\n  if (scheme.type !== 'openIdConnect') {\n    handleOauth2Update({\n      'x-scalar-credentials-location': credentialsLocation,\n    })\n  }\n\n  handleOauth2SecretsUpdate({\n    'x-scalar-credentials-location': credentialsLocation,\n  })\n}\n</script>\n\n<template>\n  <!-- Access Token Display: Shows when user is already authorized -->\n  <template v-if=\"Boolean(flow['x-scalar-secret-token'])\">\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        class=\"border-r-transparent\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-token']\"\n        placeholder=\"QUxMIFlPVVIgQkFTRSBBUkUgQkVMT05HIFRPIFVT\"\n        type=\"password\"\n        @update:modelValue=\"\n          (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-token': v })\n        \">\n        Access Token\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"supportsRefreshToken\">\n      <RequestAuthDataTableInput\n        class=\"border-r-transparent\"\n        :environment\n        :modelValue=\"flow.refreshUrl ?? ''\"\n        :placeholder=\"refreshUrlPlaceholder\"\n        @update:modelValue=\"(v) => handleOauth2Update({ refreshUrl: v })\">\n        Refresh URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow class=\"min-w-full\">\n      <div class=\"flex h-8 items-center justify-end gap-2 border-t\">\n        <ScalarButton\n          v-if=\"supportsRefreshToken\"\n          class=\"p-0 px-2 py-0.5\"\n          :loader\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleRefresh\">\n          Refresh\n        </ScalarButton>\n        <ScalarButton\n          class=\"mr-1 p-0 px-2 py-0.5\"\n          :disabled=\"loader.isLoading\"\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleClearAccessTokens\">\n          Clear\n        </ScalarButton>\n      </div>\n    </DataTableRow>\n  </template>\n\n  <!-- Authorization Form: Shows when user needs to authorize -->\n  <template v-else>\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        v-if=\"'authorizationUrl' in flow\"\n        containerClass=\"border-r-0\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-auth-url'] ?? ''\"\n        placeholder=\"https://galaxy.scalar.com/authorize\"\n        @update:modelValue=\"\n          (v) => {\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-auth-url': v })\n            handleOauth2Update({ authorizationUrl: v })\n          }\n        \">\n        Auth URL\n      </RequestAuthDataTableInput>\n\n      <RequestAuthDataTableInput\n        v-if=\"'tokenUrl' in flow\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-token-url'] ?? ''\"\n        placeholder=\"https://galaxy.scalar.com/token\"\n        @update:modelValue=\"\n          (v) => {\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-token-url': v })\n            handleOauth2Update({ tokenUrl: v })\n          }\n        \">\n        Token URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"'x-scalar-secret-redirect-uri' in flow\">\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"flow['x-scalar-secret-redirect-uri']\"\n        placeholder=\"Optional redirect URL\"\n        @update:modelValue=\"\n          (v) => {\n            hasHandledRedirectPrefill = true\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-redirect-uri': v })\n          }\n        \">\n        Redirect URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <template\n      v-if=\"\n        'x-scalar-secret-username' in flow && 'x-scalar-secret-password' in flow\n      \">\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          class=\"text-c-2\"\n          :environment\n          :modelValue=\"flow['x-scalar-secret-username']\"\n          placeholder=\"janedoe\"\n          @update:modelValue=\"\n            (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-username': v })\n          \">\n          Username\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          :environment\n          :modelValue=\"flow['x-scalar-secret-password']\"\n          placeholder=\"********\"\n          type=\"password\"\n          @update:modelValue=\"\n            (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-password': v })\n          \">\n          Password\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n    </template>\n\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"flow['x-scalar-secret-client-id']\"\n        placeholder=\"12345\"\n        @update:modelValue=\"\n          (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-client-id': v })\n        \">\n        Client ID\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"showClientSecret\">\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"clientSecretValue\"\n        placeholder=\"XYZ123\"\n        type=\"password\"\n        @update:modelValue=\"\n          (v) =>\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-client-secret': v })\n        \">\n        Client Secret\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"'x-usePkce' in flow\">\n      <RequestAuthDataTableInput\n        :enum=\"pkceOptions\"\n        :environment\n        :modelValue=\"flow['x-usePkce']\"\n        readOnly\n        @update:modelValue=\"\n          (v) =>\n            handleOauth2Update({\n              'x-usePkce': v as XusePkce['x-usePkce'],\n            })\n        \">\n        Use PKCE\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <!-- Credentials Location -->\n    <DataTableRow v-if=\"type !== 'implicit'\">\n      <RequestAuthDataTableInput\n        :enum=\"['header', 'body']\"\n        :environment\n        :modelValue=\"\n          (flow as NonImplicitFlow)['x-scalar-credentials-location'] || 'header'\n        \"\n        placeholder=\"header\"\n        readOnly\n        @update:modelValue=\"(v) => handleSecretLocationUpdate(v)\">\n        Credentials Location\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <!-- Scopes -->\n    <DataTableRow>\n      <OAuthScopesInput\n        :flow\n        :flowType=\"type\"\n        :selectedScopes\n        @update:selectedScopes=\"(v) => emits('update:selectedScopes', v)\"\n        @upsert:scope=\"(v) => emits('upsert:scope', v)\"\n        @delete:scope=\"(v) => emits('delete:scope', v)\" />\n    </DataTableRow>\n\n    <DataTableRow class=\"min-w-full\">\n      <div class=\"flex h-8 w-full items-center justify-end border-t\">\n        <!-- Allow clearing the oauth section and going back to discovery -->\n        <ScalarButton\n          v-if=\"scheme.type === 'openIdConnect'\"\n          class=\"mr-1 p-0 px-2 py-0.5\"\n          :disabled=\"loader.isLoading\"\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"clearOauth2Secrets\">\n          Clear\n        </ScalarButton>\n\n        <ScalarButton\n          class=\"mr-0.75 p-0 px-2 py-0.5\"\n          :loader\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleAuthorize\">\n          Authorize\n        </ScalarButton>\n      </div>\n    </DataTableRow>\n  </template>\n</template>\n"],"mappings":""}
+{"version":3,"file":"OAuth2.vue.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue"],"sourcesContent":["<script lang=\"ts\">\n/**  Any config options required for the OAuth2 flow */\nexport type OAuth2Options = Pick<\n  ApiClientConfiguration,\n  'oauth2RedirectUri'\n> & {\n  /** Optional fetch override (IPC-backed on desktop) used for token exchange, refresh, and OIDC discovery */\n  customFetch?: typeof fetch\n  /** Optional redirect capture (loopback-backed on desktop) for interactive OAuth2 flows */\n  captureOAuth2Callback?: CaptureOAuth2Callback\n}\n</script>\n\n<script setup lang=\"ts\">\nimport { ScalarButton } from '@scalar/components/button'\nimport { useLoadingState } from '@scalar/components/loading'\nimport type { ApiClientConfiguration } from '@scalar/types/api-reference'\nimport { pkceOptions } from '@scalar/types/entities'\nimport { useToasts } from '@scalar/use-toasts'\nimport type { SecretsOAuthFlows } from '@scalar/workspace-store/entities/auth'\nimport type {\n  ApiReferenceEvents,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport {\n  getEnvironmentVariables,\n  type OAuthFlowAuthorizationCodeSecret,\n  type OAuthFlowClientCredentialsSecret,\n  type OAuthFlowPasswordSecret,\n  type OAuthFlowsObjectSecret,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { XScalarCredentialsLocation } from '@scalar/workspace-store/schemas/extensions/security/x-scalar-credentials-location'\nimport { type XusePkce } from '@scalar/workspace-store/schemas/extensions/security/x-use-pkce'\nimport type {\n  OAuthFlow,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport { computed, ref, watch } from 'vue'\n\nimport OAuthScopesInput from '@/v2/blocks/scalar-auth-selector-block/components/OAuthScopesInput.vue'\nimport {\n  authorizeOauth2,\n  refreshOauth2Token,\n  type CaptureOAuth2Callback,\n} from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { resolveDefaultOAuth2RedirectUri } from '@/v2/blocks/scalar-auth-selector-block/helpers/resolve-default-oauth2-redirect-url'\nimport { DataTableRow } from '@/v2/components/data-table'\n\nimport RequestAuthDataTableInput from './RequestAuthDataTableInput.vue'\n\nconst {\n  environment,\n  flows,\n  type,\n  scheme,\n  selectedScopes: selectedScopesProp,\n  server,\n  proxyUrl,\n  eventBus,\n  name,\n  options = {},\n} = defineProps<{\n  /** Current environment configuration */\n  environment: XScalarEnvironment\n  /** OAuth flows */\n  flows: OAuthFlowsObjectSecret\n  /** Type of the OAuth flow */\n  type: keyof OAuthFlowsObjectSecret\n  /** Selected scopes */\n  selectedScopes: string[]\n  /** Security scheme */\n  scheme: SecuritySchemeObjectSecret\n  /** Current server configuration */\n  server: ServerObject | null\n  /** Proxy URL */\n  proxyUrl: string\n  /** Name of the security scheme */\n  name: string\n  /** Event bus for authentication updates */\n  eventBus: WorkspaceEventBus\n  /**  Any config options required for the OAuth2 flow */\n  options?: OAuth2Options\n}>()\n\nconst emits = defineEmits<{\n  (e: 'update:selectedScopes', payload: { scopes: string[] }): void\n  (\n    e: 'upsert:scope',\n    payload: Omit<ApiReferenceEvents['auth:upsert:scopes'], 'name'>,\n  ): void\n  (\n    e: 'delete:scope',\n    payload: Omit<ApiReferenceEvents['auth:delete:scopes'], 'name'>,\n  ): void\n}>()\n\nconst loader = useLoadingState()\nconst { toast } = useToasts()\n\n/** The current OAuth flow based on the selected type */\nconst flow = computed(() => flows[type]!)\ntype NonImplicitFlow =\n  | OAuthFlowPasswordSecret\n  | OAuthFlowClientCredentialsSecret\n  | OAuthFlowAuthorizationCodeSecret\n\n/** We filter selected scopes to only include scopes that are defined on this flow (own keys only). */\nconst selectedScopes = computed(() => {\n  const definedScopes = flow.value.scopes\n  if (!definedScopes) {\n    return []\n  }\n  return selectedScopesProp.filter((scope) =>\n    Object.hasOwn(definedScopes, scope),\n  )\n})\n\n/**\n * PKCE public clients do not use a client_secret. Hide the field when the\n * document enables PKCE so readers are not prompted for an unused secret.\n */\nconst showClientSecret = computed(() => {\n  if (!('x-scalar-secret-client-secret' in flow.value)) {\n    return false\n  }\n  const pkceMode =\n    'x-usePkce' in flow.value ? flow.value['x-usePkce'] : undefined\n  return pkceMode !== 'SHA-256' && pkceMode !== 'plain'\n})\n\nconst clientSecretValue = computed((): string => {\n  const f = flow.value as { 'x-scalar-secret-client-secret'?: string }\n  return f['x-scalar-secret-client-secret'] ?? ''\n})\n\n/** Updates the security scheme base */\nconst handleOauth2Update = (\n  payload: Partial<OAuthFlow & XScalarCredentialsLocation>,\n): void => {\n  // OpenIdConnect uses the secrets update for all\n  if (scheme.type === 'openIdConnect') {\n    return handleOauth2SecretsUpdate(payload)\n  }\n\n  eventBus.emit('auth:update:security-scheme', {\n    payload: {\n      type: scheme.type,\n      flows: {\n        [type]: payload,\n      },\n    },\n    name,\n  })\n}\n\n/** Updates the flow secrets */\nconst handleOauth2SecretsUpdate = (\n  payload: Omit<Partial<SecretsOAuthFlows[keyof SecretsOAuthFlows]>, 'type'>,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: {\n      type: scheme.type,\n      [type]: payload,\n    },\n    name,\n  })\n\n/** Clears the flow secrets */\nconst clearOauth2Secrets = (): void => {\n  if (loader.isLoading) {\n    return\n  }\n  eventBus.emit('auth:clear:security-scheme-secrets', {\n    name,\n  })\n}\n\n/** Clears stored access and refresh tokens (authorized state) */\nconst handleClearAccessTokens = (): void => {\n  if (loader.isLoading) {\n    return\n  }\n  handleOauth2SecretsUpdate({\n    'x-scalar-secret-token': '',\n    'x-scalar-secret-refresh-token': '',\n  })\n}\n\n/** Track redirect URI prefill per flow instance to support document switching */\nconst prefilledFlowIdentity = ref<string | null>(null)\nconst hasHandledRedirectPrefill = ref(false)\n\nconst resolveFlowIdentity = (\n  currentFlow: OAuthFlowsObjectSecret[keyof OAuthFlowsObjectSecret] | undefined,\n): string =>\n  JSON.stringify({\n    type,\n    authorizationUrl:\n      currentFlow && 'authorizationUrl' in currentFlow\n        ? currentFlow.authorizationUrl\n        : '',\n    tokenUrl:\n      currentFlow && 'tokenUrl' in currentFlow ? currentFlow.tokenUrl : '',\n    refreshUrl: currentFlow?.refreshUrl ?? '',\n    scopes: Object.keys(currentFlow?.scopes ?? {}),\n  })\n\n/** Default the redirect-uri to the current origin if we have access to window */\nwatch(\n  () => flow.value,\n  (currentFlow) => {\n    if (!currentFlow || !('x-scalar-secret-redirect-uri' in currentFlow)) {\n      return\n    }\n\n    const flowIdentity = resolveFlowIdentity(currentFlow)\n    if (prefilledFlowIdentity.value !== flowIdentity) {\n      prefilledFlowIdentity.value = flowIdentity\n      hasHandledRedirectPrefill.value = false\n    }\n\n    if (hasHandledRedirectPrefill.value) {\n      return\n    }\n\n    const newRedirectUri = (currentFlow as OAuthFlowAuthorizationCodeSecret)[\n      'x-scalar-secret-redirect-uri'\n    ]\n    const defaultRedirectUri = resolveDefaultOAuth2RedirectUri(options)\n\n    hasHandledRedirectPrefill.value = true\n\n    // The desktop loopback path computes the redirect URI at authorize time (an\n    // ephemeral 127.0.0.1 port), so persisting a default into the document would\n    // only bake in a stale, unused value. Leave it empty and show a hint instead.\n    if (\n      newRedirectUri ||\n      !defaultRedirectUri ||\n      options.captureOAuth2Callback\n    ) {\n      return\n    }\n\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-redirect-uri': defaultRedirectUri,\n    })\n  },\n  { immediate: true },\n)\n\n/**\n * Authorizes the user using the specified OAuth flow.\n * Opens the appropriate OAuth dialog and/or performs the token exchange.\n */\nconst handleAuthorize = async (): Promise<void> => {\n  if (loader.isLoading) {\n    return\n  }\n\n  loader.start()\n\n  const [error, tokens] = await authorizeOauth2(\n    flows,\n    type,\n    selectedScopes.value,\n    server,\n    proxyUrl,\n    getEnvironmentVariables(environment),\n    options.customFetch,\n    options.captureOAuth2Callback,\n  )\n\n  await loader.clear()\n\n  if (tokens?.accessToken) {\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-token': tokens.accessToken,\n      ...(tokens.refreshToken\n        ? { 'x-scalar-secret-refresh-token': tokens.refreshToken }\n        : {}),\n    })\n  } else {\n    console.error(error)\n    toast(error?.message ?? 'Failed to authorize', 'error')\n  }\n}\n\n/** Whether the current flow supports refreshing the access token */\nconst supportsRefreshToken = computed(() => type !== 'implicit')\n\n/**\n * Refresh URL placeholder, shows tokenUrl as hint if refreshUrl is not specified.\n * This helps users understand that tokenUrl will be used as fallback.\n */\nconst refreshUrlPlaceholder = computed(() => {\n  if ('tokenUrl' in flow.value && flow.value.tokenUrl) {\n    return flow.value.tokenUrl\n  }\n  return 'https://galaxy.scalar.com/oauth/refresh'\n})\n\n/**\n * Uses the stored refresh token to obtain a new access token\n * via grant_type=refresh_token.\n */\nconst handleRefresh = async (): Promise<void> => {\n  if (loader.isLoading || type === 'implicit') {\n    return\n  }\n\n  loader.start()\n\n  const [error, tokens] = await refreshOauth2Token(\n    flows,\n    type,\n    proxyUrl,\n    server,\n    getEnvironmentVariables(environment),\n    options.customFetch,\n  )\n\n  await loader.clear()\n\n  if (tokens?.accessToken) {\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-token': tokens.accessToken,\n      ...(tokens.refreshToken\n        ? { 'x-scalar-secret-refresh-token': tokens.refreshToken }\n        : {}),\n    })\n  } else {\n    console.error(error)\n    toast(error?.message ?? 'Failed to refresh token', 'error')\n  }\n}\n\n/** Updates the secret location */\nconst handleSecretLocationUpdate = (value: string): void => {\n  const credentialsLocation = value === 'body' ? 'body' : 'header'\n\n  if (scheme.type !== 'openIdConnect') {\n    handleOauth2Update({\n      'x-scalar-credentials-location': credentialsLocation,\n    })\n  }\n\n  handleOauth2SecretsUpdate({\n    'x-scalar-credentials-location': credentialsLocation,\n  })\n}\n</script>\n\n<template>\n  <!-- Access Token Display: Shows when user is already authorized -->\n  <template v-if=\"Boolean(flow['x-scalar-secret-token'])\">\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        class=\"border-r-transparent\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-token']\"\n        placeholder=\"QUxMIFlPVVIgQkFTRSBBUkUgQkVMT05HIFRPIFVT\"\n        type=\"password\"\n        @update:modelValue=\"\n          (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-token': v })\n        \">\n        Access Token\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"supportsRefreshToken\">\n      <RequestAuthDataTableInput\n        class=\"border-r-transparent\"\n        :environment\n        :modelValue=\"flow.refreshUrl ?? ''\"\n        :placeholder=\"refreshUrlPlaceholder\"\n        @update:modelValue=\"(v) => handleOauth2Update({ refreshUrl: v })\">\n        Refresh URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow class=\"min-w-full\">\n      <div class=\"flex h-8 items-center justify-end gap-2 border-t\">\n        <ScalarButton\n          v-if=\"supportsRefreshToken\"\n          class=\"p-0 px-2 py-0.5\"\n          :loader\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleRefresh\">\n          Refresh\n        </ScalarButton>\n        <ScalarButton\n          class=\"mr-1 p-0 px-2 py-0.5\"\n          :disabled=\"loader.isLoading\"\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleClearAccessTokens\">\n          Clear\n        </ScalarButton>\n      </div>\n    </DataTableRow>\n  </template>\n\n  <!-- Authorization Form: Shows when user needs to authorize -->\n  <template v-else>\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        v-if=\"'authorizationUrl' in flow\"\n        containerClass=\"border-r-0\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-auth-url'] ?? ''\"\n        placeholder=\"https://galaxy.scalar.com/authorize\"\n        @update:modelValue=\"\n          (v) => {\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-auth-url': v })\n            handleOauth2Update({ authorizationUrl: v })\n          }\n        \">\n        Auth URL\n      </RequestAuthDataTableInput>\n\n      <RequestAuthDataTableInput\n        v-if=\"'tokenUrl' in flow\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-token-url'] ?? ''\"\n        placeholder=\"https://galaxy.scalar.com/token\"\n        @update:modelValue=\"\n          (v) => {\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-token-url': v })\n            handleOauth2Update({ tokenUrl: v })\n          }\n        \">\n        Token URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"'x-scalar-secret-redirect-uri' in flow\">\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"flow['x-scalar-secret-redirect-uri']\"\n        :placeholder=\"\n          options.captureOAuth2Callback\n            ? `${resolveDefaultOAuth2RedirectUri(options) || 'http://127.0.0.1'} (handled automatically)`\n            : 'Optional redirect URL'\n        \"\n        @update:modelValue=\"\n          (v) => {\n            hasHandledRedirectPrefill = true\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-redirect-uri': v })\n          }\n        \">\n        Redirect URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <template\n      v-if=\"\n        'x-scalar-secret-username' in flow && 'x-scalar-secret-password' in flow\n      \">\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          class=\"text-c-2\"\n          :environment\n          :modelValue=\"flow['x-scalar-secret-username']\"\n          placeholder=\"janedoe\"\n          @update:modelValue=\"\n            (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-username': v })\n          \">\n          Username\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          :environment\n          :modelValue=\"flow['x-scalar-secret-password']\"\n          placeholder=\"********\"\n          type=\"password\"\n          @update:modelValue=\"\n            (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-password': v })\n          \">\n          Password\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n    </template>\n\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"flow['x-scalar-secret-client-id']\"\n        placeholder=\"12345\"\n        @update:modelValue=\"\n          (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-client-id': v })\n        \">\n        Client ID\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"showClientSecret\">\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"clientSecretValue\"\n        placeholder=\"XYZ123\"\n        type=\"password\"\n        @update:modelValue=\"\n          (v) =>\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-client-secret': v })\n        \">\n        Client Secret\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"'x-usePkce' in flow\">\n      <RequestAuthDataTableInput\n        :enum=\"pkceOptions\"\n        :environment\n        :modelValue=\"flow['x-usePkce']\"\n        readOnly\n        @update:modelValue=\"\n          (v) =>\n            handleOauth2Update({\n              'x-usePkce': v as XusePkce['x-usePkce'],\n            })\n        \">\n        Use PKCE\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <!-- Credentials Location -->\n    <DataTableRow v-if=\"type !== 'implicit'\">\n      <RequestAuthDataTableInput\n        :enum=\"['header', 'body']\"\n        :environment\n        :modelValue=\"\n          (flow as NonImplicitFlow)['x-scalar-credentials-location'] || 'header'\n        \"\n        placeholder=\"header\"\n        readOnly\n        @update:modelValue=\"(v) => handleSecretLocationUpdate(v)\">\n        Credentials Location\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <!-- Scopes -->\n    <DataTableRow>\n      <OAuthScopesInput\n        :flow\n        :flowType=\"type\"\n        :selectedScopes\n        @update:selectedScopes=\"(v) => emits('update:selectedScopes', v)\"\n        @upsert:scope=\"(v) => emits('upsert:scope', v)\"\n        @delete:scope=\"(v) => emits('delete:scope', v)\" />\n    </DataTableRow>\n\n    <DataTableRow class=\"min-w-full\">\n      <div class=\"flex h-8 w-full items-center justify-end border-t\">\n        <!-- Allow clearing the oauth section and going back to discovery -->\n        <ScalarButton\n          v-if=\"scheme.type === 'openIdConnect'\"\n          class=\"mr-1 p-0 px-2 py-0.5\"\n          :disabled=\"loader.isLoading\"\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"clearOauth2Secrets\">\n          Clear\n        </ScalarButton>\n\n        <ScalarButton\n          class=\"mr-0.75 p-0 px-2 py-0.5\"\n          :loader\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleAuthorize\">\n          Authorize\n        </ScalarButton>\n      </div>\n    </DataTableRow>\n  </template>\n</template>\n"],"mappings":""}

package/dist/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue.script.js

@@ -108,7 +108,7 @@ var OAuth2_vue_vue_type_script_setup_true_lang_default = /* @__PURE__ */ defineC
 			const newRedirectUri = currentFlow["x-scalar-secret-redirect-uri"];
 			const defaultRedirectUri = resolveDefaultOAuth2RedirectUri(__props.options);
 			hasHandledRedirectPrefill.value = true;
-			if (newRedirectUri || !defaultRedirectUri) return;
+			if (newRedirectUri || !defaultRedirectUri || __props.options.captureOAuth2Callback) return;
 			handleOauth2SecretsUpdate({ "x-scalar-secret-redirect-uri": defaultRedirectUri });
 		}, { immediate: true });
 		/**
@@ -118,7 +118,7 @@ var OAuth2_vue_vue_type_script_setup_true_lang_default = /* @__PURE__ */ defineC
 		const handleAuthorize = async () => {
 			if (loader.isLoading) return;
 			loader.start();
-			const [error, tokens] = await authorizeOauth2(__props.flows, __props.type, selectedScopes.value, __props.server, __props.proxyUrl, getEnvironmentVariables(__props.environment), __props.options.customFetch);
+			const [error, tokens] = await authorizeOauth2(__props.flows, __props.type, selectedScopes.value, __props.server, __props.proxyUrl, getEnvironmentVariables(__props.environment), __props.options.customFetch, __props.options.captureOAuth2Callback);
 			await loader.clear();
 			if (tokens?.accessToken) handleOauth2SecretsUpdate({
 				"x-scalar-secret-token": tokens.accessToken,
@@ -253,7 +253,7 @@ var OAuth2_vue_vue_type_script_setup_true_lang_default = /* @__PURE__ */ defineC
 					default: withCtx(() => [createVNode(RequestAuthDataTableInput_default, {
 						environment: __props.environment,
 						modelValue: flow.value["x-scalar-secret-redirect-uri"],
-						placeholder: "Optional redirect URL",
+						placeholder: __props.options.captureOAuth2Callback ? `${unref(resolveDefaultOAuth2RedirectUri)(__props.options) || "http://127.0.0.1"} (handled automatically)` : "Optional redirect URL",
 						"onUpdate:modelValue": _cache[4] || (_cache[4] = (v) => {
 							hasHandledRedirectPrefill.value = true;
 							handleOauth2SecretsUpdate({ "x-scalar-secret-redirect-uri": v });
@@ -261,7 +261,11 @@ var OAuth2_vue_vue_type_script_setup_true_lang_default = /* @__PURE__ */ defineC
 					}, {
 						default: withCtx(() => [..._cache[20] || (_cache[20] = [createTextVNode(" Redirect URL ", -1)])]),
 						_: 1
-					}, 8, ["environment", "modelValue"])]),
+					}, 8, [
+						"environment",
+						"modelValue",
+						"placeholder"
+					])]),
 					_: 1
 				})) : createCommentVNode("", true),
 				"x-scalar-secret-username" in flow.value && "x-scalar-secret-password" in flow.value ? (openBlock(), createElementBlock(Fragment, { key: 1 }, [createVNode(unref(DataTableRow_default), null, {

package/dist/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue.script.js.map

@@ -1 +1 @@
-{"version":3,"file":"OAuth2.vue.script.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue"],"sourcesContent":["<script lang=\"ts\">\n/**  Any config options required for the OAuth2 flow */\nexport type OAuth2Options = Pick<\n  ApiClientConfiguration,\n  'oauth2RedirectUri'\n> & {\n  /** Optional fetch override (IPC-backed on desktop) used for token exchange, refresh, and OIDC discovery */\n  customFetch?: typeof fetch\n}\n</script>\n\n<script setup lang=\"ts\">\nimport { ScalarButton } from '@scalar/components/button'\nimport { useLoadingState } from '@scalar/components/loading'\nimport type { ApiClientConfiguration } from '@scalar/types/api-reference'\nimport { pkceOptions } from '@scalar/types/entities'\nimport { useToasts } from '@scalar/use-toasts'\nimport type { SecretsOAuthFlows } from '@scalar/workspace-store/entities/auth'\nimport type {\n  ApiReferenceEvents,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport {\n  getEnvironmentVariables,\n  type OAuthFlowAuthorizationCodeSecret,\n  type OAuthFlowClientCredentialsSecret,\n  type OAuthFlowPasswordSecret,\n  type OAuthFlowsObjectSecret,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { XScalarCredentialsLocation } from '@scalar/workspace-store/schemas/extensions/security/x-scalar-credentials-location'\nimport { type XusePkce } from '@scalar/workspace-store/schemas/extensions/security/x-use-pkce'\nimport type {\n  OAuthFlow,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport { computed, ref, watch } from 'vue'\n\nimport OAuthScopesInput from '@/v2/blocks/scalar-auth-selector-block/components/OAuthScopesInput.vue'\nimport {\n  authorizeOauth2,\n  refreshOauth2Token,\n} from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { resolveDefaultOAuth2RedirectUri } from '@/v2/blocks/scalar-auth-selector-block/helpers/resolve-default-oauth2-redirect-url'\nimport { DataTableRow } from '@/v2/components/data-table'\n\nimport RequestAuthDataTableInput from './RequestAuthDataTableInput.vue'\n\nconst {\n  environment,\n  flows,\n  type,\n  scheme,\n  selectedScopes: selectedScopesProp,\n  server,\n  proxyUrl,\n  eventBus,\n  name,\n  options = {},\n} = defineProps<{\n  /** Current environment configuration */\n  environment: XScalarEnvironment\n  /** OAuth flows */\n  flows: OAuthFlowsObjectSecret\n  /** Type of the OAuth flow */\n  type: keyof OAuthFlowsObjectSecret\n  /** Selected scopes */\n  selectedScopes: string[]\n  /** Security scheme */\n  scheme: SecuritySchemeObjectSecret\n  /** Current server configuration */\n  server: ServerObject | null\n  /** Proxy URL */\n  proxyUrl: string\n  /** Name of the security scheme */\n  name: string\n  /** Event bus for authentication updates */\n  eventBus: WorkspaceEventBus\n  /**  Any config options required for the OAuth2 flow */\n  options?: OAuth2Options\n}>()\n\nconst emits = defineEmits<{\n  (e: 'update:selectedScopes', payload: { scopes: string[] }): void\n  (\n    e: 'upsert:scope',\n    payload: Omit<ApiReferenceEvents['auth:upsert:scopes'], 'name'>,\n  ): void\n  (\n    e: 'delete:scope',\n    payload: Omit<ApiReferenceEvents['auth:delete:scopes'], 'name'>,\n  ): void\n}>()\n\nconst loader = useLoadingState()\nconst { toast } = useToasts()\n\n/** The current OAuth flow based on the selected type */\nconst flow = computed(() => flows[type]!)\ntype NonImplicitFlow =\n  | OAuthFlowPasswordSecret\n  | OAuthFlowClientCredentialsSecret\n  | OAuthFlowAuthorizationCodeSecret\n\n/** We filter selected scopes to only include scopes that are defined on this flow (own keys only). */\nconst selectedScopes = computed(() => {\n  const definedScopes = flow.value.scopes\n  if (!definedScopes) {\n    return []\n  }\n  return selectedScopesProp.filter((scope) =>\n    Object.hasOwn(definedScopes, scope),\n  )\n})\n\n/**\n * PKCE public clients do not use a client_secret. Hide the field when the\n * document enables PKCE so readers are not prompted for an unused secret.\n */\nconst showClientSecret = computed(() => {\n  if (!('x-scalar-secret-client-secret' in flow.value)) {\n    return false\n  }\n  const pkceMode =\n    'x-usePkce' in flow.value ? flow.value['x-usePkce'] : undefined\n  return pkceMode !== 'SHA-256' && pkceMode !== 'plain'\n})\n\nconst clientSecretValue = computed((): string => {\n  const f = flow.value as { 'x-scalar-secret-client-secret'?: string }\n  return f['x-scalar-secret-client-secret'] ?? ''\n})\n\n/** Updates the security scheme base */\nconst handleOauth2Update = (\n  payload: Partial<OAuthFlow & XScalarCredentialsLocation>,\n): void => {\n  // OpenIdConnect uses the secrets update for all\n  if (scheme.type === 'openIdConnect') {\n    return handleOauth2SecretsUpdate(payload)\n  }\n\n  eventBus.emit('auth:update:security-scheme', {\n    payload: {\n      type: scheme.type,\n      flows: {\n        [type]: payload,\n      },\n    },\n    name,\n  })\n}\n\n/** Updates the flow secrets */\nconst handleOauth2SecretsUpdate = (\n  payload: Omit<Partial<SecretsOAuthFlows[keyof SecretsOAuthFlows]>, 'type'>,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: {\n      type: scheme.type,\n      [type]: payload,\n    },\n    name,\n  })\n\n/** Clears the flow secrets */\nconst clearOauth2Secrets = (): void => {\n  if (loader.isLoading) {\n    return\n  }\n  eventBus.emit('auth:clear:security-scheme-secrets', {\n    name,\n  })\n}\n\n/** Clears stored access and refresh tokens (authorized state) */\nconst handleClearAccessTokens = (): void => {\n  if (loader.isLoading) {\n    return\n  }\n  handleOauth2SecretsUpdate({\n    'x-scalar-secret-token': '',\n    'x-scalar-secret-refresh-token': '',\n  })\n}\n\n/** Track redirect URI prefill per flow instance to support document switching */\nconst prefilledFlowIdentity = ref<string | null>(null)\nconst hasHandledRedirectPrefill = ref(false)\n\nconst resolveFlowIdentity = (\n  currentFlow: OAuthFlowsObjectSecret[keyof OAuthFlowsObjectSecret] | undefined,\n): string =>\n  JSON.stringify({\n    type,\n    authorizationUrl:\n      currentFlow && 'authorizationUrl' in currentFlow\n        ? currentFlow.authorizationUrl\n        : '',\n    tokenUrl:\n      currentFlow && 'tokenUrl' in currentFlow ? currentFlow.tokenUrl : '',\n    refreshUrl: currentFlow?.refreshUrl ?? '',\n    scopes: Object.keys(currentFlow?.scopes ?? {}),\n  })\n\n/** Default the redirect-uri to the current origin if we have access to window */\nwatch(\n  () => flow.value,\n  (currentFlow) => {\n    if (!currentFlow || !('x-scalar-secret-redirect-uri' in currentFlow)) {\n      return\n    }\n\n    const flowIdentity = resolveFlowIdentity(currentFlow)\n    if (prefilledFlowIdentity.value !== flowIdentity) {\n      prefilledFlowIdentity.value = flowIdentity\n      hasHandledRedirectPrefill.value = false\n    }\n\n    if (hasHandledRedirectPrefill.value) {\n      return\n    }\n\n    const newRedirectUri = (currentFlow as OAuthFlowAuthorizationCodeSecret)[\n      'x-scalar-secret-redirect-uri'\n    ]\n    const defaultRedirectUri = resolveDefaultOAuth2RedirectUri(options)\n\n    hasHandledRedirectPrefill.value = true\n\n    if (newRedirectUri || !defaultRedirectUri) {\n      return\n    }\n\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-redirect-uri': defaultRedirectUri,\n    })\n  },\n  { immediate: true },\n)\n\n/**\n * Authorizes the user using the specified OAuth flow.\n * Opens the appropriate OAuth dialog and/or performs the token exchange.\n */\nconst handleAuthorize = async (): Promise<void> => {\n  if (loader.isLoading) {\n    return\n  }\n\n  loader.start()\n\n  const [error, tokens] = await authorizeOauth2(\n    flows,\n    type,\n    selectedScopes.value,\n    server,\n    proxyUrl,\n    getEnvironmentVariables(environment),\n    options.customFetch,\n  )\n\n  await loader.clear()\n\n  if (tokens?.accessToken) {\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-token': tokens.accessToken,\n      ...(tokens.refreshToken\n        ? { 'x-scalar-secret-refresh-token': tokens.refreshToken }\n        : {}),\n    })\n  } else {\n    console.error(error)\n    toast(error?.message ?? 'Failed to authorize', 'error')\n  }\n}\n\n/** Whether the current flow supports refreshing the access token */\nconst supportsRefreshToken = computed(() => type !== 'implicit')\n\n/**\n * Refresh URL placeholder, shows tokenUrl as hint if refreshUrl is not specified.\n * This helps users understand that tokenUrl will be used as fallback.\n */\nconst refreshUrlPlaceholder = computed(() => {\n  if ('tokenUrl' in flow.value && flow.value.tokenUrl) {\n    return flow.value.tokenUrl\n  }\n  return 'https://galaxy.scalar.com/oauth/refresh'\n})\n\n/**\n * Uses the stored refresh token to obtain a new access token\n * via grant_type=refresh_token.\n */\nconst handleRefresh = async (): Promise<void> => {\n  if (loader.isLoading || type === 'implicit') {\n    return\n  }\n\n  loader.start()\n\n  const [error, tokens] = await refreshOauth2Token(\n    flows,\n    type,\n    proxyUrl,\n    server,\n    getEnvironmentVariables(environment),\n    options.customFetch,\n  )\n\n  await loader.clear()\n\n  if (tokens?.accessToken) {\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-token': tokens.accessToken,\n      ...(tokens.refreshToken\n        ? { 'x-scalar-secret-refresh-token': tokens.refreshToken }\n        : {}),\n    })\n  } else {\n    console.error(error)\n    toast(error?.message ?? 'Failed to refresh token', 'error')\n  }\n}\n\n/** Updates the secret location */\nconst handleSecretLocationUpdate = (value: string): void => {\n  const credentialsLocation = value === 'body' ? 'body' : 'header'\n\n  if (scheme.type !== 'openIdConnect') {\n    handleOauth2Update({\n      'x-scalar-credentials-location': credentialsLocation,\n    })\n  }\n\n  handleOauth2SecretsUpdate({\n    'x-scalar-credentials-location': credentialsLocation,\n  })\n}\n</script>\n\n<template>\n  <!-- Access Token Display: Shows when user is already authorized -->\n  <template v-if=\"Boolean(flow['x-scalar-secret-token'])\">\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        class=\"border-r-transparent\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-token']\"\n        placeholder=\"QUxMIFlPVVIgQkFTRSBBUkUgQkVMT05HIFRPIFVT\"\n        type=\"password\"\n        @update:modelValue=\"\n          (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-token': v })\n        \">\n        Access Token\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"supportsRefreshToken\">\n      <RequestAuthDataTableInput\n        class=\"border-r-transparent\"\n        :environment\n        :modelValue=\"flow.refreshUrl ?? ''\"\n        :placeholder=\"refreshUrlPlaceholder\"\n        @update:modelValue=\"(v) => handleOauth2Update({ refreshUrl: v })\">\n        Refresh URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow class=\"min-w-full\">\n      <div class=\"flex h-8 items-center justify-end gap-2 border-t\">\n        <ScalarButton\n          v-if=\"supportsRefreshToken\"\n          class=\"p-0 px-2 py-0.5\"\n          :loader\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleRefresh\">\n          Refresh\n        </ScalarButton>\n        <ScalarButton\n          class=\"mr-1 p-0 px-2 py-0.5\"\n          :disabled=\"loader.isLoading\"\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleClearAccessTokens\">\n          Clear\n        </ScalarButton>\n      </div>\n    </DataTableRow>\n  </template>\n\n  <!-- Authorization Form: Shows when user needs to authorize -->\n  <template v-else>\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        v-if=\"'authorizationUrl' in flow\"\n        containerClass=\"border-r-0\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-auth-url'] ?? ''\"\n        placeholder=\"https://galaxy.scalar.com/authorize\"\n        @update:modelValue=\"\n          (v) => {\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-auth-url': v })\n            handleOauth2Update({ authorizationUrl: v })\n          }\n        \">\n        Auth URL\n      </RequestAuthDataTableInput>\n\n      <RequestAuthDataTableInput\n        v-if=\"'tokenUrl' in flow\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-token-url'] ?? ''\"\n        placeholder=\"https://galaxy.scalar.com/token\"\n        @update:modelValue=\"\n          (v) => {\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-token-url': v })\n            handleOauth2Update({ tokenUrl: v })\n          }\n        \">\n        Token URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"'x-scalar-secret-redirect-uri' in flow\">\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"flow['x-scalar-secret-redirect-uri']\"\n        placeholder=\"Optional redirect URL\"\n        @update:modelValue=\"\n          (v) => {\n            hasHandledRedirectPrefill = true\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-redirect-uri': v })\n          }\n        \">\n        Redirect URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <template\n      v-if=\"\n        'x-scalar-secret-username' in flow && 'x-scalar-secret-password' in flow\n      \">\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          class=\"text-c-2\"\n          :environment\n          :modelValue=\"flow['x-scalar-secret-username']\"\n          placeholder=\"janedoe\"\n          @update:modelValue=\"\n            (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-username': v })\n          \">\n          Username\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          :environment\n          :modelValue=\"flow['x-scalar-secret-password']\"\n          placeholder=\"********\"\n          type=\"password\"\n          @update:modelValue=\"\n            (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-password': v })\n          \">\n          Password\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n    </template>\n\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"flow['x-scalar-secret-client-id']\"\n        placeholder=\"12345\"\n        @update:modelValue=\"\n          (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-client-id': v })\n        \">\n        Client ID\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"showClientSecret\">\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"clientSecretValue\"\n        placeholder=\"XYZ123\"\n        type=\"password\"\n        @update:modelValue=\"\n          (v) =>\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-client-secret': v })\n        \">\n        Client Secret\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"'x-usePkce' in flow\">\n      <RequestAuthDataTableInput\n        :enum=\"pkceOptions\"\n        :environment\n        :modelValue=\"flow['x-usePkce']\"\n        readOnly\n        @update:modelValue=\"\n          (v) =>\n            handleOauth2Update({\n              'x-usePkce': v as XusePkce['x-usePkce'],\n            })\n        \">\n        Use PKCE\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <!-- Credentials Location -->\n    <DataTableRow v-if=\"type !== 'implicit'\">\n      <RequestAuthDataTableInput\n        :enum=\"['header', 'body']\"\n        :environment\n        :modelValue=\"\n          (flow as NonImplicitFlow)['x-scalar-credentials-location'] || 'header'\n        \"\n        placeholder=\"header\"\n        readOnly\n        @update:modelValue=\"(v) => handleSecretLocationUpdate(v)\">\n        Credentials Location\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <!-- Scopes -->\n    <DataTableRow>\n      <OAuthScopesInput\n        :flow\n        :flowType=\"type\"\n        :selectedScopes\n        @update:selectedScopes=\"(v) => emits('update:selectedScopes', v)\"\n        @upsert:scope=\"(v) => emits('upsert:scope', v)\"\n        @delete:scope=\"(v) => emits('delete:scope', v)\" />\n    </DataTableRow>\n\n    <DataTableRow class=\"min-w-full\">\n      <div class=\"flex h-8 w-full items-center justify-end border-t\">\n        <!-- Allow clearing the oauth section and going back to discovery -->\n        <ScalarButton\n          v-if=\"scheme.type === 'openIdConnect'\"\n          class=\"mr-1 p-0 px-2 py-0.5\"\n          :disabled=\"loader.isLoading\"\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"clearOauth2Secrets\">\n          Clear\n        </ScalarButton>\n\n        <ScalarButton\n          class=\"mr-0.75 p-0 px-2 py-0.5\"\n          :loader\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleAuthorize\">\n          Authorize\n        </ScalarButton>\n      </div>\n    </DataTableRow>\n  </template>\n</template>\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmFA,MAAM,QAAQ;EAYd,MAAM,SAAS,iBAAgB;EAC/B,MAAM,EAAE,UAAU,WAAU;;EAG5B,MAAM,OAAO,eAAe,QAAA,MAAM,QAAA,MAAM;EAOxC,MAAM,iBAAiB,eAAe;GACpC,MAAM,gBAAgB,KAAK,MAAM;AACjC,OAAI,CAAC,cACH,QAAO,EAAC;AAEV,UAAO,QAAA,eAAmB,QAAQ,UAChC,OAAO,OAAO,eAAe,MAAM,CACrC;IACD;;;;;EAMD,MAAM,mBAAmB,eAAe;AACtC,OAAI,EAAE,mCAAmC,KAAK,OAC5C,QAAO;GAET,MAAM,WACJ,eAAe,KAAK,QAAQ,KAAK,MAAM,eAAe,KAAA;AACxD,UAAO,aAAa,aAAa,aAAa;IAC/C;EAED,MAAM,oBAAoB,eAAuB;AAE/C,UADU,KAAK,MACN,oCAAoC;IAC9C;;EAGD,MAAM,sBACJ,YACS;AAET,OAAI,QAAA,OAAO,SAAS,gBAClB,QAAO,0BAA0B,QAAO;AAG1C,WAAA,SAAS,KAAK,+BAA+B;IAC3C,SAAS;KACP,MAAM,QAAA,OAAO;KACb,OAAO,GACJ,QAAA,OAAO,SACT;KACF;IACD,MAAG,QAAA;IACJ,CAAA;;;EAIH,MAAM,6BACJ,YAEA,QAAA,SAAS,KAAK,uCAAuC;GACnD,SAAS;IACP,MAAM,QAAA,OAAO;KACZ,QAAA,OAAO;IACT;GACD,MAAG,QAAA;GACJ,CAAA;;EAGH,MAAM,2BAAiC;AACrC,OAAI,OAAO,UACT;AAEF,WAAA,SAAS,KAAK,sCAAsC,EAClD,MAAG,QAAA,MACJ,CAAA;;;EAIH,MAAM,gCAAsC;AAC1C,OAAI,OAAO,UACT;AAEF,6BAA0B;IACxB,yBAAyB;IACzB,iCAAiC;IAClC,CAAA;;;EAIH,MAAM,wBAAwB,IAAmB,KAAI;EACrD,MAAM,4BAA4B,IAAI,MAAK;EAE3C,MAAM,uBACJ,gBAEA,KAAK,UAAU;GACb,MAAG,QAAA;GACH,kBACE,eAAe,sBAAsB,cACjC,YAAY,mBACZ;GACN,UACE,eAAe,cAAc,cAAc,YAAY,WAAW;GACpE,YAAY,aAAa,cAAc;GACvC,QAAQ,OAAO,KAAK,aAAa,UAAU,EAAE,CAAC;GAC/C,CAAA;;AAGH,cACQ,KAAK,QACV,gBAAgB;AACf,OAAI,CAAC,eAAe,EAAE,kCAAkC,aACtD;GAGF,MAAM,eAAe,oBAAoB,YAAW;AACpD,OAAI,sBAAsB,UAAU,cAAc;AAChD,0BAAsB,QAAQ;AAC9B,8BAA0B,QAAQ;;AAGpC,OAAI,0BAA0B,MAC5B;GAGF,MAAM,iBAAkB,YACtB;GAEF,MAAM,qBAAqB,gCAAgC,QAAA,QAAO;AAElE,6BAA0B,QAAQ;AAElC,OAAI,kBAAkB,CAAC,mBACrB;AAGF,6BAA0B,EACxB,gCAAgC,oBACjC,CAAA;KAEH,EAAE,WAAW,MAAM,CACrB;;;;;EAMA,MAAM,kBAAkB,YAA2B;AACjD,OAAI,OAAO,UACT;AAGF,UAAO,OAAM;GAEb,MAAM,CAAC,OAAO,UAAU,MAAM,gBAC5B,QAAA,OACA,QAAA,MACA,eAAe,OACf,QAAA,QACA,QAAA,UACA,wBAAwB,QAAA,YAAY,EACpC,QAAA,QAAQ,YACV;AAEA,SAAM,OAAO,OAAM;AAEnB,OAAI,QAAQ,YACV,2BAA0B;IACxB,yBAAyB,OAAO;IAChC,GAAI,OAAO,eACP,EAAE,iCAAiC,OAAO,cAAa,GACvD,EAAE;IACP,CAAA;QACI;AACL,YAAQ,MAAM,MAAK;AACnB,UAAM,OAAO,WAAW,uBAAuB,QAAO;;;;EAK1D,MAAM,uBAAuB,eAAe,QAAA,SAAS,WAAU;;;;;EAM/D,MAAM,wBAAwB,eAAe;AAC3C,OAAI,cAAc,KAAK,SAAS,KAAK,MAAM,SACzC,QAAO,KAAK,MAAM;AAEpB,UAAO;IACR;;;;;EAMD,MAAM,gBAAgB,YAA2B;AAC/C,OAAI,OAAO,aAAa,QAAA,SAAS,WAC/B;AAGF,UAAO,OAAM;GAEb,MAAM,CAAC,OAAO,UAAU,MAAM,mBAC5B,QAAA,OACA,QAAA,MACA,QAAA,UACA,QAAA,QACA,wBAAwB,QAAA,YAAY,EACpC,QAAA,QAAQ,YACV;AAEA,SAAM,OAAO,OAAM;AAEnB,OAAI,QAAQ,YACV,2BAA0B;IACxB,yBAAyB,OAAO;IAChC,GAAI,OAAO,eACP,EAAE,iCAAiC,OAAO,cAAa,GACvD,EAAE;IACP,CAAA;QACI;AACL,YAAQ,MAAM,MAAK;AACnB,UAAM,OAAO,WAAW,2BAA2B,QAAO;;;;EAK9D,MAAM,8BAA8B,UAAwB;GAC1D,MAAM,sBAAsB,UAAU,SAAS,SAAS;AAExD,OAAI,QAAA,OAAO,SAAS,gBAClB,oBAAmB,EACjB,iCAAiC,qBAClC,CAAA;AAGH,6BAA0B,EACxB,iCAAiC,qBAClC,CAAA;;;UAMe,QAAQ,KAAA,MAAI,yBAAA,IAAA,WAAA,EAA5B,mBA+CW,UAAA,EAAA,KAAA,GAAA,EAAA;IA9CT,YAYe,MAAA,qBAAA,EAAA,MAAA;4BADe,CAV5B,YAU4B,mCAAA;MAT1B,OAAM;MACL,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,aAAY;MACZ,MAAK;MACJ,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAM,0BAAyB,EAAA,yBAA4B,GAAC,CAAA;;6BAI9F,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,kBAEJ,GAAA,CAAA,EAAA,CAAA;;;;;IAGkB,qBAAA,SAAA,WAAA,EAApB,YASe,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAP5B,YAO4B,mCAAA;MAN1B,OAAM;MACL,aAAA,QAAA;MACA,YAAY,KAAA,MAAK,cAAU;MAC3B,aAAa,sBAAA;MACb,uBAAiB,OAAA,OAAA,OAAA,MAAG,MAAM,mBAAkB,EAAA,YAAe,GAAC,CAAA;;6BAE/D,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFoE,iBAEpE,GAAA,CAAA,EAAA,CAAA;;;;;;;;;IAGF,YAoBe,MAAA,qBAAA,EAAA,EApBD,OAAM,cAAY,EAAA;4BAmBxB,CAlBN,mBAkBM,OAlBN,YAkBM,CAhBI,qBAAA,SAAA,WAAA,EADR,YAQe,MAAA,aAAA,EAAA;;MANb,OAAM;MACL,QAAA,MAAA,OAAM;MACP,MAAK;MACL,SAAQ;MACP,SAAO;;6BAEV,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFyB,aAEzB,GAAA,CAAA,EAAA,CAAA;;wDACA,YAOe,MAAA,aAAA,EAAA;MANb,OAAM;MACL,UAAU,MAAA,OAAM,CAAC;MAClB,MAAK;MACL,SAAQ;MACP,SAAO;;6BAEV,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFmC,WAEnC,GAAA,CAAA,EAAA,CAAA;;;;;2BAMN,mBAyKW,UAAA,EAAA,KAAA,GAAA,EAAA;IAxKT,YA6Be,MAAA,qBAAA,EAAA,MAAA;4BAfe,CAAA,sBAZE,KAAA,SAAA,WAAA,EAD9B,YAa4B,mCAAA;;MAX1B,gBAAe;MACd,aAAA,QAAA;MACA,YAAY,KAAA,MAAI,+BAAA;MACjB,aAAY;MACX,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAC;AAAmB,iCAAyB,EAAA,4BAA+B,GAAC,CAAA;AAAgB,0BAAkB,EAAA,kBAAqB,GAAC,CAAA;;;6BAOvK,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,cAEJ,GAAA,CAAA,EAAA,CAAA;;yFAGsB,KAAA,SAAA,WAAA,EADtB,YAY4B,mCAAA;;MAVzB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI,gCAAA;MACjB,aAAY;MACX,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAC;AAAmB,iCAAyB,EAAA,6BAAgC,GAAC,CAAA;AAAgB,0BAAkB,EAAA,UAAa,GAAC,CAAA;;;6BAOhK,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,eAEJ,GAAA,CAAA,EAAA,CAAA;;;;;sCAGoD,KAAA,SAAA,WAAA,EAAtD,YAae,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAX5B,YAW4B,mCAAA;MAVzB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,aAAY;MACX,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAC;AAAmB,iCAAA,QAAyB;AAAoB,iCAAyB,EAAA,gCAAmC,GAAC,CAAA;;;6BAOhK,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,kBAEJ,GAAA,CAAA,EAAA,CAAA;;;;;kCAI6C,KAAA,SAAI,8BAAkC,KAAA,SAAA,WAAA,EADrF,mBA6BW,UAAA,EAAA,KAAA,GAAA,EAAA,CAzBT,YAWe,MAAA,qBAAA,EAAA,MAAA;4BADe,CAT5B,YAS4B,mCAAA;MAR1B,OAAM;MACL,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,aAAY;MACX,uBAAiB,OAAA,OAAA,OAAA,MAAgB,MAAM,0BAAyB,EAAA,4BAA+B,GAAC,CAAA;;6BAInG,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,cAEJ,GAAA,CAAA,EAAA,CAAA;;;;QAGF,YAWe,MAAA,qBAAA,EAAA,MAAA;4BADe,CAT5B,YAS4B,mCAAA;MARzB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,aAAY;MACZ,MAAK;MACJ,uBAAiB,OAAA,OAAA,OAAA,MAAgB,MAAM,0BAAyB,EAAA,4BAA+B,GAAC,CAAA;;6BAInG,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,cAEJ,GAAA,CAAA,EAAA,CAAA;;;;;IAIJ,YAUe,MAAA,qBAAA,EAAA,MAAA;4BADe,CAR5B,YAQ4B,mCAAA;MAPzB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,aAAY;MACX,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAM,0BAAyB,EAAA,6BAAgC,GAAC,CAAA;;6BAIlG,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,eAEJ,GAAA,CAAA,EAAA,CAAA;;;;;IAGkB,iBAAA,SAAA,WAAA,EAApB,YAYe,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAV5B,YAU4B,mCAAA;MATzB,aAAA,QAAA;MACA,YAAY,kBAAA;MACb,aAAY;MACZ,MAAK;MACJ,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAkB,0BAAyB,EAAA,iCAAoC,GAAC,CAAA;;6BAKlH,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,mBAEJ,GAAA,CAAA,EAAA,CAAA;;;;;mBAGiC,KAAA,SAAA,WAAA,EAAnC,YAce,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAZ5B,YAY4B,mCAAA;MAXzB,MAAM,MAAA,YAAW;MACjB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,UAAA;MACC,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAkB,mBAAkB,EAAA,aAA8B,GAAA,CAAA;;6BAOpG,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,cAEJ,GAAA,CAAA,EAAA,CAAA;;;;;;;;;IAIkB,QAAA,SAAI,cAAA,WAAA,EAAxB,YAYe,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAV5B,YAU4B,mCAAA;MATzB,MAAM,CAAA,UAAA,OAAkB;MACxB,aAAA,QAAA;MACA,YAAwB,KAAA,MAAI,oCAAA;MAG7B,aAAY;MACZ,UAAA;MACC,uBAAiB,OAAA,QAAA,OAAA,OAAG,MAAM,2BAA2B,EAAC;;6BAEzD,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAF4D,0BAE5D,GAAA,CAAA,EAAA,CAAA;;;;;IAIF,YAQe,MAAA,qBAAA,EAAA,MAAA;4BADuC,CANpD,YAMoD,0BAAA;MALjD,MAAA,KAAA;MACA,UAAU,QAAA;MACV,gBAAA,eAAA;MACA,2BAAqB,OAAA,QAAA,OAAA,OAAG,MAAM,MAAK,yBAA0B,EAAC;MAC9D,kBAAY,OAAA,QAAA,OAAA,OAAG,MAAM,MAAK,gBAAiB,EAAC;MAC5C,kBAAY,OAAA,QAAA,OAAA,OAAG,MAAM,MAAK,gBAAiB,EAAC;;;;;;;;IAGjD,YAsBe,MAAA,qBAAA,EAAA,EAtBD,OAAM,cAAY,EAAA;4BAqBxB,CApBN,mBAoBM,OApBN,YAoBM,CAjBI,QAAA,OAAO,SAAI,mBAAA,WAAA,EADnB,YAQe,MAAA,aAAA,EAAA;;MANb,OAAM;MACL,UAAU,MAAA,OAAM,CAAC;MAClB,MAAK;MACL,SAAQ;MACP,SAAO;;6BAEV,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAF8B,WAE9B,GAAA,CAAA,EAAA,CAAA;;0DAEA,YAOe,MAAA,aAAA,EAAA;MANb,OAAM;MACL,QAAA,MAAA,OAAM;MACP,MAAK;MACL,SAAQ;MACP,SAAO;;6BAEV,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAF2B,eAE3B,GAAA,CAAA,EAAA,CAAA"}
+{"version":3,"file":"OAuth2.vue.script.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue"],"sourcesContent":["<script lang=\"ts\">\n/**  Any config options required for the OAuth2 flow */\nexport type OAuth2Options = Pick<\n  ApiClientConfiguration,\n  'oauth2RedirectUri'\n> & {\n  /** Optional fetch override (IPC-backed on desktop) used for token exchange, refresh, and OIDC discovery */\n  customFetch?: typeof fetch\n  /** Optional redirect capture (loopback-backed on desktop) for interactive OAuth2 flows */\n  captureOAuth2Callback?: CaptureOAuth2Callback\n}\n</script>\n\n<script setup lang=\"ts\">\nimport { ScalarButton } from '@scalar/components/button'\nimport { useLoadingState } from '@scalar/components/loading'\nimport type { ApiClientConfiguration } from '@scalar/types/api-reference'\nimport { pkceOptions } from '@scalar/types/entities'\nimport { useToasts } from '@scalar/use-toasts'\nimport type { SecretsOAuthFlows } from '@scalar/workspace-store/entities/auth'\nimport type {\n  ApiReferenceEvents,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport {\n  getEnvironmentVariables,\n  type OAuthFlowAuthorizationCodeSecret,\n  type OAuthFlowClientCredentialsSecret,\n  type OAuthFlowPasswordSecret,\n  type OAuthFlowsObjectSecret,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { XScalarCredentialsLocation } from '@scalar/workspace-store/schemas/extensions/security/x-scalar-credentials-location'\nimport { type XusePkce } from '@scalar/workspace-store/schemas/extensions/security/x-use-pkce'\nimport type {\n  OAuthFlow,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport { computed, ref, watch } from 'vue'\n\nimport OAuthScopesInput from '@/v2/blocks/scalar-auth-selector-block/components/OAuthScopesInput.vue'\nimport {\n  authorizeOauth2,\n  refreshOauth2Token,\n  type CaptureOAuth2Callback,\n} from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { resolveDefaultOAuth2RedirectUri } from '@/v2/blocks/scalar-auth-selector-block/helpers/resolve-default-oauth2-redirect-url'\nimport { DataTableRow } from '@/v2/components/data-table'\n\nimport RequestAuthDataTableInput from './RequestAuthDataTableInput.vue'\n\nconst {\n  environment,\n  flows,\n  type,\n  scheme,\n  selectedScopes: selectedScopesProp,\n  server,\n  proxyUrl,\n  eventBus,\n  name,\n  options = {},\n} = defineProps<{\n  /** Current environment configuration */\n  environment: XScalarEnvironment\n  /** OAuth flows */\n  flows: OAuthFlowsObjectSecret\n  /** Type of the OAuth flow */\n  type: keyof OAuthFlowsObjectSecret\n  /** Selected scopes */\n  selectedScopes: string[]\n  /** Security scheme */\n  scheme: SecuritySchemeObjectSecret\n  /** Current server configuration */\n  server: ServerObject | null\n  /** Proxy URL */\n  proxyUrl: string\n  /** Name of the security scheme */\n  name: string\n  /** Event bus for authentication updates */\n  eventBus: WorkspaceEventBus\n  /**  Any config options required for the OAuth2 flow */\n  options?: OAuth2Options\n}>()\n\nconst emits = defineEmits<{\n  (e: 'update:selectedScopes', payload: { scopes: string[] }): void\n  (\n    e: 'upsert:scope',\n    payload: Omit<ApiReferenceEvents['auth:upsert:scopes'], 'name'>,\n  ): void\n  (\n    e: 'delete:scope',\n    payload: Omit<ApiReferenceEvents['auth:delete:scopes'], 'name'>,\n  ): void\n}>()\n\nconst loader = useLoadingState()\nconst { toast } = useToasts()\n\n/** The current OAuth flow based on the selected type */\nconst flow = computed(() => flows[type]!)\ntype NonImplicitFlow =\n  | OAuthFlowPasswordSecret\n  | OAuthFlowClientCredentialsSecret\n  | OAuthFlowAuthorizationCodeSecret\n\n/** We filter selected scopes to only include scopes that are defined on this flow (own keys only). */\nconst selectedScopes = computed(() => {\n  const definedScopes = flow.value.scopes\n  if (!definedScopes) {\n    return []\n  }\n  return selectedScopesProp.filter((scope) =>\n    Object.hasOwn(definedScopes, scope),\n  )\n})\n\n/**\n * PKCE public clients do not use a client_secret. Hide the field when the\n * document enables PKCE so readers are not prompted for an unused secret.\n */\nconst showClientSecret = computed(() => {\n  if (!('x-scalar-secret-client-secret' in flow.value)) {\n    return false\n  }\n  const pkceMode =\n    'x-usePkce' in flow.value ? flow.value['x-usePkce'] : undefined\n  return pkceMode !== 'SHA-256' && pkceMode !== 'plain'\n})\n\nconst clientSecretValue = computed((): string => {\n  const f = flow.value as { 'x-scalar-secret-client-secret'?: string }\n  return f['x-scalar-secret-client-secret'] ?? ''\n})\n\n/** Updates the security scheme base */\nconst handleOauth2Update = (\n  payload: Partial<OAuthFlow & XScalarCredentialsLocation>,\n): void => {\n  // OpenIdConnect uses the secrets update for all\n  if (scheme.type === 'openIdConnect') {\n    return handleOauth2SecretsUpdate(payload)\n  }\n\n  eventBus.emit('auth:update:security-scheme', {\n    payload: {\n      type: scheme.type,\n      flows: {\n        [type]: payload,\n      },\n    },\n    name,\n  })\n}\n\n/** Updates the flow secrets */\nconst handleOauth2SecretsUpdate = (\n  payload: Omit<Partial<SecretsOAuthFlows[keyof SecretsOAuthFlows]>, 'type'>,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: {\n      type: scheme.type,\n      [type]: payload,\n    },\n    name,\n  })\n\n/** Clears the flow secrets */\nconst clearOauth2Secrets = (): void => {\n  if (loader.isLoading) {\n    return\n  }\n  eventBus.emit('auth:clear:security-scheme-secrets', {\n    name,\n  })\n}\n\n/** Clears stored access and refresh tokens (authorized state) */\nconst handleClearAccessTokens = (): void => {\n  if (loader.isLoading) {\n    return\n  }\n  handleOauth2SecretsUpdate({\n    'x-scalar-secret-token': '',\n    'x-scalar-secret-refresh-token': '',\n  })\n}\n\n/** Track redirect URI prefill per flow instance to support document switching */\nconst prefilledFlowIdentity = ref<string | null>(null)\nconst hasHandledRedirectPrefill = ref(false)\n\nconst resolveFlowIdentity = (\n  currentFlow: OAuthFlowsObjectSecret[keyof OAuthFlowsObjectSecret] | undefined,\n): string =>\n  JSON.stringify({\n    type,\n    authorizationUrl:\n      currentFlow && 'authorizationUrl' in currentFlow\n        ? currentFlow.authorizationUrl\n        : '',\n    tokenUrl:\n      currentFlow && 'tokenUrl' in currentFlow ? currentFlow.tokenUrl : '',\n    refreshUrl: currentFlow?.refreshUrl ?? '',\n    scopes: Object.keys(currentFlow?.scopes ?? {}),\n  })\n\n/** Default the redirect-uri to the current origin if we have access to window */\nwatch(\n  () => flow.value,\n  (currentFlow) => {\n    if (!currentFlow || !('x-scalar-secret-redirect-uri' in currentFlow)) {\n      return\n    }\n\n    const flowIdentity = resolveFlowIdentity(currentFlow)\n    if (prefilledFlowIdentity.value !== flowIdentity) {\n      prefilledFlowIdentity.value = flowIdentity\n      hasHandledRedirectPrefill.value = false\n    }\n\n    if (hasHandledRedirectPrefill.value) {\n      return\n    }\n\n    const newRedirectUri = (currentFlow as OAuthFlowAuthorizationCodeSecret)[\n      'x-scalar-secret-redirect-uri'\n    ]\n    const defaultRedirectUri = resolveDefaultOAuth2RedirectUri(options)\n\n    hasHandledRedirectPrefill.value = true\n\n    // The desktop loopback path computes the redirect URI at authorize time (an\n    // ephemeral 127.0.0.1 port), so persisting a default into the document would\n    // only bake in a stale, unused value. Leave it empty and show a hint instead.\n    if (\n      newRedirectUri ||\n      !defaultRedirectUri ||\n      options.captureOAuth2Callback\n    ) {\n      return\n    }\n\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-redirect-uri': defaultRedirectUri,\n    })\n  },\n  { immediate: true },\n)\n\n/**\n * Authorizes the user using the specified OAuth flow.\n * Opens the appropriate OAuth dialog and/or performs the token exchange.\n */\nconst handleAuthorize = async (): Promise<void> => {\n  if (loader.isLoading) {\n    return\n  }\n\n  loader.start()\n\n  const [error, tokens] = await authorizeOauth2(\n    flows,\n    type,\n    selectedScopes.value,\n    server,\n    proxyUrl,\n    getEnvironmentVariables(environment),\n    options.customFetch,\n    options.captureOAuth2Callback,\n  )\n\n  await loader.clear()\n\n  if (tokens?.accessToken) {\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-token': tokens.accessToken,\n      ...(tokens.refreshToken\n        ? { 'x-scalar-secret-refresh-token': tokens.refreshToken }\n        : {}),\n    })\n  } else {\n    console.error(error)\n    toast(error?.message ?? 'Failed to authorize', 'error')\n  }\n}\n\n/** Whether the current flow supports refreshing the access token */\nconst supportsRefreshToken = computed(() => type !== 'implicit')\n\n/**\n * Refresh URL placeholder, shows tokenUrl as hint if refreshUrl is not specified.\n * This helps users understand that tokenUrl will be used as fallback.\n */\nconst refreshUrlPlaceholder = computed(() => {\n  if ('tokenUrl' in flow.value && flow.value.tokenUrl) {\n    return flow.value.tokenUrl\n  }\n  return 'https://galaxy.scalar.com/oauth/refresh'\n})\n\n/**\n * Uses the stored refresh token to obtain a new access token\n * via grant_type=refresh_token.\n */\nconst handleRefresh = async (): Promise<void> => {\n  if (loader.isLoading || type === 'implicit') {\n    return\n  }\n\n  loader.start()\n\n  const [error, tokens] = await refreshOauth2Token(\n    flows,\n    type,\n    proxyUrl,\n    server,\n    getEnvironmentVariables(environment),\n    options.customFetch,\n  )\n\n  await loader.clear()\n\n  if (tokens?.accessToken) {\n    handleOauth2SecretsUpdate({\n      'x-scalar-secret-token': tokens.accessToken,\n      ...(tokens.refreshToken\n        ? { 'x-scalar-secret-refresh-token': tokens.refreshToken }\n        : {}),\n    })\n  } else {\n    console.error(error)\n    toast(error?.message ?? 'Failed to refresh token', 'error')\n  }\n}\n\n/** Updates the secret location */\nconst handleSecretLocationUpdate = (value: string): void => {\n  const credentialsLocation = value === 'body' ? 'body' : 'header'\n\n  if (scheme.type !== 'openIdConnect') {\n    handleOauth2Update({\n      'x-scalar-credentials-location': credentialsLocation,\n    })\n  }\n\n  handleOauth2SecretsUpdate({\n    'x-scalar-credentials-location': credentialsLocation,\n  })\n}\n</script>\n\n<template>\n  <!-- Access Token Display: Shows when user is already authorized -->\n  <template v-if=\"Boolean(flow['x-scalar-secret-token'])\">\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        class=\"border-r-transparent\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-token']\"\n        placeholder=\"QUxMIFlPVVIgQkFTRSBBUkUgQkVMT05HIFRPIFVT\"\n        type=\"password\"\n        @update:modelValue=\"\n          (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-token': v })\n        \">\n        Access Token\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"supportsRefreshToken\">\n      <RequestAuthDataTableInput\n        class=\"border-r-transparent\"\n        :environment\n        :modelValue=\"flow.refreshUrl ?? ''\"\n        :placeholder=\"refreshUrlPlaceholder\"\n        @update:modelValue=\"(v) => handleOauth2Update({ refreshUrl: v })\">\n        Refresh URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow class=\"min-w-full\">\n      <div class=\"flex h-8 items-center justify-end gap-2 border-t\">\n        <ScalarButton\n          v-if=\"supportsRefreshToken\"\n          class=\"p-0 px-2 py-0.5\"\n          :loader\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleRefresh\">\n          Refresh\n        </ScalarButton>\n        <ScalarButton\n          class=\"mr-1 p-0 px-2 py-0.5\"\n          :disabled=\"loader.isLoading\"\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleClearAccessTokens\">\n          Clear\n        </ScalarButton>\n      </div>\n    </DataTableRow>\n  </template>\n\n  <!-- Authorization Form: Shows when user needs to authorize -->\n  <template v-else>\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        v-if=\"'authorizationUrl' in flow\"\n        containerClass=\"border-r-0\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-auth-url'] ?? ''\"\n        placeholder=\"https://galaxy.scalar.com/authorize\"\n        @update:modelValue=\"\n          (v) => {\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-auth-url': v })\n            handleOauth2Update({ authorizationUrl: v })\n          }\n        \">\n        Auth URL\n      </RequestAuthDataTableInput>\n\n      <RequestAuthDataTableInput\n        v-if=\"'tokenUrl' in flow\"\n        :environment\n        :modelValue=\"flow['x-scalar-secret-token-url'] ?? ''\"\n        placeholder=\"https://galaxy.scalar.com/token\"\n        @update:modelValue=\"\n          (v) => {\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-token-url': v })\n            handleOauth2Update({ tokenUrl: v })\n          }\n        \">\n        Token URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"'x-scalar-secret-redirect-uri' in flow\">\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"flow['x-scalar-secret-redirect-uri']\"\n        :placeholder=\"\n          options.captureOAuth2Callback\n            ? `${resolveDefaultOAuth2RedirectUri(options) || 'http://127.0.0.1'} (handled automatically)`\n            : 'Optional redirect URL'\n        \"\n        @update:modelValue=\"\n          (v) => {\n            hasHandledRedirectPrefill = true\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-redirect-uri': v })\n          }\n        \">\n        Redirect URL\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <template\n      v-if=\"\n        'x-scalar-secret-username' in flow && 'x-scalar-secret-password' in flow\n      \">\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          class=\"text-c-2\"\n          :environment\n          :modelValue=\"flow['x-scalar-secret-username']\"\n          placeholder=\"janedoe\"\n          @update:modelValue=\"\n            (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-username': v })\n          \">\n          Username\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          :environment\n          :modelValue=\"flow['x-scalar-secret-password']\"\n          placeholder=\"********\"\n          type=\"password\"\n          @update:modelValue=\"\n            (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-password': v })\n          \">\n          Password\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n    </template>\n\n    <DataTableRow>\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"flow['x-scalar-secret-client-id']\"\n        placeholder=\"12345\"\n        @update:modelValue=\"\n          (v) => handleOauth2SecretsUpdate({ 'x-scalar-secret-client-id': v })\n        \">\n        Client ID\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"showClientSecret\">\n      <RequestAuthDataTableInput\n        :environment\n        :modelValue=\"clientSecretValue\"\n        placeholder=\"XYZ123\"\n        type=\"password\"\n        @update:modelValue=\"\n          (v) =>\n            handleOauth2SecretsUpdate({ 'x-scalar-secret-client-secret': v })\n        \">\n        Client Secret\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <DataTableRow v-if=\"'x-usePkce' in flow\">\n      <RequestAuthDataTableInput\n        :enum=\"pkceOptions\"\n        :environment\n        :modelValue=\"flow['x-usePkce']\"\n        readOnly\n        @update:modelValue=\"\n          (v) =>\n            handleOauth2Update({\n              'x-usePkce': v as XusePkce['x-usePkce'],\n            })\n        \">\n        Use PKCE\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <!-- Credentials Location -->\n    <DataTableRow v-if=\"type !== 'implicit'\">\n      <RequestAuthDataTableInput\n        :enum=\"['header', 'body']\"\n        :environment\n        :modelValue=\"\n          (flow as NonImplicitFlow)['x-scalar-credentials-location'] || 'header'\n        \"\n        placeholder=\"header\"\n        readOnly\n        @update:modelValue=\"(v) => handleSecretLocationUpdate(v)\">\n        Credentials Location\n      </RequestAuthDataTableInput>\n    </DataTableRow>\n\n    <!-- Scopes -->\n    <DataTableRow>\n      <OAuthScopesInput\n        :flow\n        :flowType=\"type\"\n        :selectedScopes\n        @update:selectedScopes=\"(v) => emits('update:selectedScopes', v)\"\n        @upsert:scope=\"(v) => emits('upsert:scope', v)\"\n        @delete:scope=\"(v) => emits('delete:scope', v)\" />\n    </DataTableRow>\n\n    <DataTableRow class=\"min-w-full\">\n      <div class=\"flex h-8 w-full items-center justify-end border-t\">\n        <!-- Allow clearing the oauth section and going back to discovery -->\n        <ScalarButton\n          v-if=\"scheme.type === 'openIdConnect'\"\n          class=\"mr-1 p-0 px-2 py-0.5\"\n          :disabled=\"loader.isLoading\"\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"clearOauth2Secrets\">\n          Clear\n        </ScalarButton>\n\n        <ScalarButton\n          class=\"mr-0.75 p-0 px-2 py-0.5\"\n          :loader\n          size=\"sm\"\n          variant=\"outlined\"\n          @click=\"handleAuthorize\">\n          Authorize\n        </ScalarButton>\n      </div>\n    </DataTableRow>\n  </template>\n</template>\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsFA,MAAM,QAAQ;EAYd,MAAM,SAAS,iBAAgB;EAC/B,MAAM,EAAE,UAAU,WAAU;;EAG5B,MAAM,OAAO,eAAe,QAAA,MAAM,QAAA,MAAM;EAOxC,MAAM,iBAAiB,eAAe;GACpC,MAAM,gBAAgB,KAAK,MAAM;AACjC,OAAI,CAAC,cACH,QAAO,EAAC;AAEV,UAAO,QAAA,eAAmB,QAAQ,UAChC,OAAO,OAAO,eAAe,MAAM,CACrC;IACD;;;;;EAMD,MAAM,mBAAmB,eAAe;AACtC,OAAI,EAAE,mCAAmC,KAAK,OAC5C,QAAO;GAET,MAAM,WACJ,eAAe,KAAK,QAAQ,KAAK,MAAM,eAAe,KAAA;AACxD,UAAO,aAAa,aAAa,aAAa;IAC/C;EAED,MAAM,oBAAoB,eAAuB;AAE/C,UADU,KAAK,MACN,oCAAoC;IAC9C;;EAGD,MAAM,sBACJ,YACS;AAET,OAAI,QAAA,OAAO,SAAS,gBAClB,QAAO,0BAA0B,QAAO;AAG1C,WAAA,SAAS,KAAK,+BAA+B;IAC3C,SAAS;KACP,MAAM,QAAA,OAAO;KACb,OAAO,GACJ,QAAA,OAAO,SACT;KACF;IACD,MAAG,QAAA;IACJ,CAAA;;;EAIH,MAAM,6BACJ,YAEA,QAAA,SAAS,KAAK,uCAAuC;GACnD,SAAS;IACP,MAAM,QAAA,OAAO;KACZ,QAAA,OAAO;IACT;GACD,MAAG,QAAA;GACJ,CAAA;;EAGH,MAAM,2BAAiC;AACrC,OAAI,OAAO,UACT;AAEF,WAAA,SAAS,KAAK,sCAAsC,EAClD,MAAG,QAAA,MACJ,CAAA;;;EAIH,MAAM,gCAAsC;AAC1C,OAAI,OAAO,UACT;AAEF,6BAA0B;IACxB,yBAAyB;IACzB,iCAAiC;IAClC,CAAA;;;EAIH,MAAM,wBAAwB,IAAmB,KAAI;EACrD,MAAM,4BAA4B,IAAI,MAAK;EAE3C,MAAM,uBACJ,gBAEA,KAAK,UAAU;GACb,MAAG,QAAA;GACH,kBACE,eAAe,sBAAsB,cACjC,YAAY,mBACZ;GACN,UACE,eAAe,cAAc,cAAc,YAAY,WAAW;GACpE,YAAY,aAAa,cAAc;GACvC,QAAQ,OAAO,KAAK,aAAa,UAAU,EAAE,CAAC;GAC/C,CAAA;;AAGH,cACQ,KAAK,QACV,gBAAgB;AACf,OAAI,CAAC,eAAe,EAAE,kCAAkC,aACtD;GAGF,MAAM,eAAe,oBAAoB,YAAW;AACpD,OAAI,sBAAsB,UAAU,cAAc;AAChD,0BAAsB,QAAQ;AAC9B,8BAA0B,QAAQ;;AAGpC,OAAI,0BAA0B,MAC5B;GAGF,MAAM,iBAAkB,YACtB;GAEF,MAAM,qBAAqB,gCAAgC,QAAA,QAAO;AAElE,6BAA0B,QAAQ;AAKlC,OACE,kBACA,CAAC,sBACD,QAAA,QAAQ,sBAER;AAGF,6BAA0B,EACxB,gCAAgC,oBACjC,CAAA;KAEH,EAAE,WAAW,MAAM,CACrB;;;;;EAMA,MAAM,kBAAkB,YAA2B;AACjD,OAAI,OAAO,UACT;AAGF,UAAO,OAAM;GAEb,MAAM,CAAC,OAAO,UAAU,MAAM,gBAC5B,QAAA,OACA,QAAA,MACA,eAAe,OACf,QAAA,QACA,QAAA,UACA,wBAAwB,QAAA,YAAY,EACpC,QAAA,QAAQ,aACR,QAAA,QAAQ,sBACV;AAEA,SAAM,OAAO,OAAM;AAEnB,OAAI,QAAQ,YACV,2BAA0B;IACxB,yBAAyB,OAAO;IAChC,GAAI,OAAO,eACP,EAAE,iCAAiC,OAAO,cAAa,GACvD,EAAE;IACP,CAAA;QACI;AACL,YAAQ,MAAM,MAAK;AACnB,UAAM,OAAO,WAAW,uBAAuB,QAAO;;;;EAK1D,MAAM,uBAAuB,eAAe,QAAA,SAAS,WAAU;;;;;EAM/D,MAAM,wBAAwB,eAAe;AAC3C,OAAI,cAAc,KAAK,SAAS,KAAK,MAAM,SACzC,QAAO,KAAK,MAAM;AAEpB,UAAO;IACR;;;;;EAMD,MAAM,gBAAgB,YAA2B;AAC/C,OAAI,OAAO,aAAa,QAAA,SAAS,WAC/B;AAGF,UAAO,OAAM;GAEb,MAAM,CAAC,OAAO,UAAU,MAAM,mBAC5B,QAAA,OACA,QAAA,MACA,QAAA,UACA,QAAA,QACA,wBAAwB,QAAA,YAAY,EACpC,QAAA,QAAQ,YACV;AAEA,SAAM,OAAO,OAAM;AAEnB,OAAI,QAAQ,YACV,2BAA0B;IACxB,yBAAyB,OAAO;IAChC,GAAI,OAAO,eACP,EAAE,iCAAiC,OAAO,cAAa,GACvD,EAAE;IACP,CAAA;QACI;AACL,YAAQ,MAAM,MAAK;AACnB,UAAM,OAAO,WAAW,2BAA2B,QAAO;;;;EAK9D,MAAM,8BAA8B,UAAwB;GAC1D,MAAM,sBAAsB,UAAU,SAAS,SAAS;AAExD,OAAI,QAAA,OAAO,SAAS,gBAClB,oBAAmB,EACjB,iCAAiC,qBAClC,CAAA;AAGH,6BAA0B,EACxB,iCAAiC,qBAClC,CAAA;;;UAMe,QAAQ,KAAA,MAAI,yBAAA,IAAA,WAAA,EAA5B,mBA+CW,UAAA,EAAA,KAAA,GAAA,EAAA;IA9CT,YAYe,MAAA,qBAAA,EAAA,MAAA;4BADe,CAV5B,YAU4B,mCAAA;MAT1B,OAAM;MACL,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,aAAY;MACZ,MAAK;MACJ,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAM,0BAAyB,EAAA,yBAA4B,GAAC,CAAA;;6BAI9F,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,kBAEJ,GAAA,CAAA,EAAA,CAAA;;;;;IAGkB,qBAAA,SAAA,WAAA,EAApB,YASe,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAP5B,YAO4B,mCAAA;MAN1B,OAAM;MACL,aAAA,QAAA;MACA,YAAY,KAAA,MAAK,cAAU;MAC3B,aAAa,sBAAA;MACb,uBAAiB,OAAA,OAAA,OAAA,MAAG,MAAM,mBAAkB,EAAA,YAAe,GAAC,CAAA;;6BAE/D,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFoE,iBAEpE,GAAA,CAAA,EAAA,CAAA;;;;;;;;;IAGF,YAoBe,MAAA,qBAAA,EAAA,EApBD,OAAM,cAAY,EAAA;4BAmBxB,CAlBN,mBAkBM,OAlBN,YAkBM,CAhBI,qBAAA,SAAA,WAAA,EADR,YAQe,MAAA,aAAA,EAAA;;MANb,OAAM;MACL,QAAA,MAAA,OAAM;MACP,MAAK;MACL,SAAQ;MACP,SAAO;;6BAEV,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFyB,aAEzB,GAAA,CAAA,EAAA,CAAA;;wDACA,YAOe,MAAA,aAAA,EAAA;MANb,OAAM;MACL,UAAU,MAAA,OAAM,CAAC;MAClB,MAAK;MACL,SAAQ;MACP,SAAO;;6BAEV,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFmC,WAEnC,GAAA,CAAA,EAAA,CAAA;;;;;2BAMN,mBA6KW,UAAA,EAAA,KAAA,GAAA,EAAA;IA5KT,YA6Be,MAAA,qBAAA,EAAA,MAAA;4BAfe,CAAA,sBAZE,KAAA,SAAA,WAAA,EAD9B,YAa4B,mCAAA;;MAX1B,gBAAe;MACd,aAAA,QAAA;MACA,YAAY,KAAA,MAAI,+BAAA;MACjB,aAAY;MACX,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAC;AAAmB,iCAAyB,EAAA,4BAA+B,GAAC,CAAA;AAAgB,0BAAkB,EAAA,kBAAqB,GAAC,CAAA;;;6BAOvK,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,cAEJ,GAAA,CAAA,EAAA,CAAA;;yFAGsB,KAAA,SAAA,WAAA,EADtB,YAY4B,mCAAA;;MAVzB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI,gCAAA;MACjB,aAAY;MACX,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAC;AAAmB,iCAAyB,EAAA,6BAAgC,GAAC,CAAA;AAAgB,0BAAkB,EAAA,UAAa,GAAC,CAAA;;;6BAOhK,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,eAEJ,GAAA,CAAA,EAAA,CAAA;;;;;sCAGoD,KAAA,SAAA,WAAA,EAAtD,YAiBe,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAf5B,YAe4B,mCAAA;MAdzB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MAChB,aAAwB,QAAA,QAAQ,wBAAA,GAAuC,MAAA,gCAA+B,CAAC,QAAA,QAAO,IAAA,mBAAA,4BAAA;MAK9G,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAC;AAAmB,iCAAA,QAAyB;AAAoB,iCAAyB,EAAA,gCAAmC,GAAC,CAAA;;;6BAOhK,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,kBAEJ,GAAA,CAAA,EAAA,CAAA;;;;;;;;;kCAI6C,KAAA,SAAI,8BAAkC,KAAA,SAAA,WAAA,EADrF,mBA6BW,UAAA,EAAA,KAAA,GAAA,EAAA,CAzBT,YAWe,MAAA,qBAAA,EAAA,MAAA;4BADe,CAT5B,YAS4B,mCAAA;MAR1B,OAAM;MACL,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,aAAY;MACX,uBAAiB,OAAA,OAAA,OAAA,MAAgB,MAAM,0BAAyB,EAAA,4BAA+B,GAAC,CAAA;;6BAInG,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,cAEJ,GAAA,CAAA,EAAA,CAAA;;;;QAGF,YAWe,MAAA,qBAAA,EAAA,MAAA;4BADe,CAT5B,YAS4B,mCAAA;MARzB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,aAAY;MACZ,MAAK;MACJ,uBAAiB,OAAA,OAAA,OAAA,MAAgB,MAAM,0BAAyB,EAAA,4BAA+B,GAAC,CAAA;;6BAInG,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,cAEJ,GAAA,CAAA,EAAA,CAAA;;;;;IAIJ,YAUe,MAAA,qBAAA,EAAA,MAAA;4BADe,CAR5B,YAQ4B,mCAAA;MAPzB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,aAAY;MACX,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAM,0BAAyB,EAAA,6BAAgC,GAAC,CAAA;;6BAIlG,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,eAEJ,GAAA,CAAA,EAAA,CAAA;;;;;IAGkB,iBAAA,SAAA,WAAA,EAApB,YAYe,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAV5B,YAU4B,mCAAA;MATzB,aAAA,QAAA;MACA,YAAY,kBAAA;MACb,aAAY;MACZ,MAAK;MACJ,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAkB,0BAAyB,EAAA,iCAAoC,GAAC,CAAA;;6BAKlH,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,mBAEJ,GAAA,CAAA,EAAA,CAAA;;;;;mBAGiC,KAAA,SAAA,WAAA,EAAnC,YAce,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAZ5B,YAY4B,mCAAA;MAXzB,MAAM,MAAA,YAAW;MACjB,aAAA,QAAA;MACA,YAAY,KAAA,MAAI;MACjB,UAAA;MACC,uBAAiB,OAAA,OAAA,OAAA,MAAc,MAAkB,mBAAkB,EAAA,aAA8B,GAAA,CAAA;;6BAOpG,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAFI,cAEJ,GAAA,CAAA,EAAA,CAAA;;;;;;;;;IAIkB,QAAA,SAAI,cAAA,WAAA,EAAxB,YAYe,MAAA,qBAAA,EAAA,EAAA,KAAA,GAAA,EAAA;4BADe,CAV5B,YAU4B,mCAAA;MATzB,MAAM,CAAA,UAAA,OAAkB;MACxB,aAAA,QAAA;MACA,YAAwB,KAAA,MAAI,oCAAA;MAG7B,aAAY;MACZ,UAAA;MACC,uBAAiB,OAAA,QAAA,OAAA,OAAG,MAAM,2BAA2B,EAAC;;6BAEzD,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAF4D,0BAE5D,GAAA,CAAA,EAAA,CAAA;;;;;IAIF,YAQe,MAAA,qBAAA,EAAA,MAAA;4BADuC,CANpD,YAMoD,0BAAA;MALjD,MAAA,KAAA;MACA,UAAU,QAAA;MACV,gBAAA,eAAA;MACA,2BAAqB,OAAA,QAAA,OAAA,OAAG,MAAM,MAAK,yBAA0B,EAAC;MAC9D,kBAAY,OAAA,QAAA,OAAA,OAAG,MAAM,MAAK,gBAAiB,EAAC;MAC5C,kBAAY,OAAA,QAAA,OAAA,OAAG,MAAM,MAAK,gBAAiB,EAAC;;;;;;;;IAGjD,YAsBe,MAAA,qBAAA,EAAA,EAtBD,OAAM,cAAY,EAAA;4BAqBxB,CApBN,mBAoBM,OApBN,YAoBM,CAjBI,QAAA,OAAO,SAAI,mBAAA,WAAA,EADnB,YAQe,MAAA,aAAA,EAAA;;MANb,OAAM;MACL,UAAU,MAAA,OAAM,CAAC;MAClB,MAAK;MACL,SAAQ;MACP,SAAO;;6BAEV,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAF8B,WAE9B,GAAA,CAAA,EAAA,CAAA;;0DAEA,YAOe,MAAA,aAAA,EAAA;MANb,OAAM;MACL,QAAA,MAAA,OAAM;MACP,MAAK;MACL,SAAQ;MACP,SAAO;;6BAEV,CAAA,GAAA,OAAA,QAAA,OAAA,MAAA,CAAA,gBAF2B,eAE3B,GAAA,CAAA,EAAA,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.d.ts

@@ -11,6 +11,26 @@ export type OAuth2Tokens = {
     accessToken: string;
     refreshToken?: string;
 };
+/**
+ * Captures the OAuth2 redirect for environments where the browser-popup polling
+ * approach cannot work (notably the Electron desktop app, where the renderer
+ * runs on `file://` and providers reject `file://` redirect URIs).
+ *
+ * The implementation opens the authorization URL in the system browser and
+ * resolves once the provider redirects back. Because the redirect target (for
+ * example an ephemeral loopback port) is only known to the host environment, the
+ * implementation appends the `redirect_uri` itself and reports back the exact
+ * value it used so the token exchange can send the matching `redirect_uri`.
+ */
+export type CaptureOAuth2Callback = (params: {
+    /** The fully built authorization URL, without a `redirect_uri` parameter. */
+    authorizationUrl: string;
+}) => Promise<ErrorResponse<{
+    /** The full callback URL the provider redirected to, including query and/or hash params. */
+    callbackUrl: string;
+    /** The `redirect_uri` the host environment used, so the token exchange can match it. */
+    redirectUri: string;
+}>>;
 /** Flow types that support token refresh (all except implicit) */
 type RefreshableFlows = Exclude<keyof OAuthFlowsObjectSecret, 'implicit'>;
 /**
@@ -38,7 +58,13 @@ proxyUrl: string,
 /** Flattened environment variables used to resolve server URL templates like `{protocol}` */
 environmentVariables?: Record<string, string>, 
 /** Fetch used for the token request; the desktop app passes an IPC-backed fetch (see {@link authorizeServers}). */
-customFetch?: CustomFetch) => Promise<ErrorResponse<OAuth2Tokens>>;
+customFetch?: CustomFetch, 
+/**
+ * Optional redirect capture for interactive flows (authorization code and implicit).
+ * When provided, the system browser plus a host-owned redirect target replaces the
+ * default popup-polling approach. Required for the Electron desktop app.
+ */
+captureCallback?: CaptureOAuth2Callback) => Promise<ErrorResponse<OAuth2Tokens>>;
 /**
  * Exchange a refresh token for a new access token using the `grant_type=refresh_token` flow.
  *

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAA;AAErF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAGhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AA4BnF,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAE1F,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,kEAAkE;AAClE,KAAK,gBAAgB,GAAG,OAAO,CAAC,MAAM,sBAAsB,EAAE,UAAU,CAAC,CAAA;AAEzE;;;GAGG;AACH,eAAO,MAAM,YAAY,GACvB,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,MAIA,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,gBAWF,CAAA;AAuCD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,sBAAsB,EAC7B,MAAM,MAAM,sBAAsB,EAClC,gBAAgB,MAAM,EAAE;AACxB,wEAAwE;AACxE,cAAc,YAAY,GAAG,IAAI;AACjC,kCAAkC;AAClC,UAAU,MAAM;AAChB,6FAA6F;AAC7F,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,mHAAmH;AACnH,cAAc,WAAW,KACxB,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAwKrC,CAAA;AAuID;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,sBAAsB,EAC7B,MAAM,gBAAgB;AACtB,kCAAkC;AAClC,UAAU,MAAM;AAChB,+DAA+D;AAC/D,cAAc,YAAY,GAAG,IAAI;AACjC,2EAA2E;AAC3E,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,gIAAgI;AAChI,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAqFrC,CAAA"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAA;AAErF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAGhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AA4BnF,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAE1F,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE;IAC3C,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAA;CACzB,KAAK,OAAO,CACX,aAAa,CAAC;IACZ,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CACH,CAAA;AAED,kEAAkE;AAClE,KAAK,gBAAgB,GAAG,OAAO,CAAC,MAAM,sBAAsB,EAAE,UAAU,CAAC,CAAA;AAEzE;;;GAGG;AACH,eAAO,MAAM,YAAY,GACvB,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,MAIA,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,gBAWF,CAAA;AAuCD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,sBAAsB,EAC7B,MAAM,MAAM,sBAAsB,EAClC,gBAAgB,MAAM,EAAE;AACxB,wEAAwE;AACxE,cAAc,YAAY,GAAG,IAAI;AACjC,kCAAkC;AAClC,UAAU,MAAM;AAChB,6FAA6F;AAC7F,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,mHAAmH;AACnH,cAAc,WAAW;AACzB;;;;GAIG;AACH,kBAAkB,qBAAqB,KACtC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CA6NrC,CAAA;AA4ID;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,sBAAsB,EAC7B,MAAM,gBAAgB;AACtB,kCAAkC;AAClC,UAAU,MAAM;AAChB,+DAA+D;AAC/D,cAAc,YAAY,GAAG,IAAI;AACjC,2EAA2E;AAC3E,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,gIAAgI;AAChI,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAqFrC,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.js

@@ -58,7 +58,7 @@ var generateCodeChallenge = async (verifier, encoding) => {
 *
 * @returns the resolved oauth2 tokens
 */
-var authorizeOauth2 = async (flows, type, selectedScopes, activeServer, proxyUrl, environmentVariables = {}, customFetch) => {
+var authorizeOauth2 = async (flows, type, selectedScopes, activeServer, proxyUrl, environmentVariables = {}, customFetch, captureCallback) => {
 	const flow = flows[type];
 	try {
 		if (!flow) return [/* @__PURE__ */ new Error("Flow not found"), null];
@@ -89,7 +89,7 @@ var authorizeOauth2 = async (flows, type, selectedScopes, activeServer, proxyUrl
 			}
 		}
 		const typedFlow = flows[type];
-		if (typedFlow["x-scalar-secret-redirect-uri"].startsWith("/")) {
+		if (!captureCallback) if (typedFlow["x-scalar-secret-redirect-uri"].startsWith("/")) {
 			const baseUrl = getServerUrl(activeServer, environmentVariables) || window.location.origin + window.location.pathname;
 			const redirectUri = new URL(typedFlow["x-scalar-secret-redirect-uri"], baseUrl).toString();
 			url.searchParams.set("redirect_uri", redirectUri);
@@ -102,6 +102,30 @@ var authorizeOauth2 = async (flows, type, selectedScopes, activeServer, proxyUrl
 		url.searchParams.set("client_id", flow["x-scalar-secret-client-id"]);
 		url.searchParams.set("state", state);
 		if (scopes) url.searchParams.set("scope", scopes);
+		if (captureCallback) {
+			const [captureError, capture] = await captureCallback({ authorizationUrl: url.toString() });
+			if (captureError || !capture) return [captureError ?? /* @__PURE__ */ new Error("Failed to capture the OAuth2 redirect"), null];
+			const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } = getOAuthCallbackData(() => capture.callbackUrl, flow["x-tokenName"] || "access_token");
+			if (error) return [/* @__PURE__ */ new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ""}`), null];
+			if (accessToken) {
+				if ((accessTokenParams?.get("state") ?? null) !== state) return [/* @__PURE__ */ new Error("State mismatch"), null];
+				return [null, {
+					accessToken,
+					...refreshToken ? { refreshToken } : {}
+				}];
+			}
+			if (code && type === "authorizationCode") {
+				if ((codeParams?.get("state") ?? null) !== state) return [/* @__PURE__ */ new Error("State mismatch"), null];
+				return authorizeServers(flows, type, scopes, {
+					code,
+					pkce,
+					proxyUrl,
+					customFetch,
+					redirectUri: capture.redirectUri
+				}, activeServer, environmentVariables);
+			}
+			return [/* @__PURE__ */ new Error("No authorization code or access token was returned"), null];
+		}
 		const authWindow = window.open(url, "openAuth2Window", "left=100,top=100,width=800,height=600");
 		if (authWindow) return new Promise((resolve) => {
 			const checkWindowClosed = setInterval(() => {
@@ -146,7 +170,7 @@ var authorizeOauth2 = async (flows, type, selectedScopes, activeServer, proxyUrl
 * Makes the BE authorization call to grab the token server to server
 * Used for clientCredentials and authorizationCode
 */
-var authorizeServers = async (flows, type, scopes, { code, pkce, proxyUrl, customFetch = fetch } = {}, activeServer, environmentVariables = {}) => {
+var authorizeServers = async (flows, type, scopes, { code, pkce, proxyUrl, customFetch = fetch, redirectUri } = {}, activeServer, environmentVariables = {}) => {
 	const flow = flows[type];
 	if (!flow) return [/* @__PURE__ */ new Error("OAuth2 flow was not defined"), null];
 	const formData = new URLSearchParams();
@@ -157,7 +181,8 @@ var authorizeServers = async (flows, type, scopes, { code, pkce, proxyUrl, custo
 	const hasClientSecret = Boolean(flow["x-scalar-secret-client-secret"]) && !pkcePublicClient;
 	if (addCredentialsToBody || type === "authorizationCode" && !hasClientSecret) formData.set("client_id", flow["x-scalar-secret-client-id"]);
 	if (addCredentialsToBody && hasClientSecret) formData.set("client_secret", flow["x-scalar-secret-client-secret"]);
-	if ("x-scalar-secret-redirect-uri" in flow && flow["x-scalar-secret-redirect-uri"]) formData.set("redirect_uri", flow["x-scalar-secret-redirect-uri"]);
+	if (redirectUri) formData.set("redirect_uri", redirectUri);
+	else if ("x-scalar-secret-redirect-uri" in flow && flow["x-scalar-secret-redirect-uri"]) formData.set("redirect_uri", flow["x-scalar-secret-redirect-uri"]);
 	if (code) {
 		formData.set("code", code);
 		formData.set("grant_type", "authorization_code");

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { replaceEnvVariables, replacePathVariables } from '@scalar/helpers/regex/replace-variables'\nimport { isRelativePath } from '@scalar/helpers/url/is-relative-path'\nimport { makeUrlAbsolute } from '@scalar/helpers/url/make-url-absolute'\nimport { shouldUseProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport type { OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example'\nimport { getServerVariables } from '@scalar/workspace-store/request-example'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport { encode, fromUint8Array } from 'js-base64'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\nimport { getOAuthCallbackData } from './oauth-callback'\n\n/** Oauth2 security schemes which are not implicit */\ntype NonImplicitFlows = Omit<OAuthFlowsObjectSecret, 'implicit'>\n\nconst authorizationCodeUsesPkcePublicClient = (\n  flowType: keyof NonImplicitFlows,\n  flow: NonImplicitFlows[keyof NonImplicitFlows],\n): boolean => {\n  if (flowType !== 'authorizationCode') {\n    return false\n  }\n  const authCode = flow as OAuthFlowsObjectSecret['authorizationCode']\n  if (!authCode) {\n    return false\n  }\n  const pkceMode = authCode['x-usePkce']\n  return pkceMode === 'SHA-256' || pkceMode === 'plain'\n}\n\ntype PKCEState = {\n  codeVerifier: string\n  codeChallenge: string\n  codeChallengeMethod: string\n}\n\ntype ActiveServerBase = { basePath: string } | { baseUrl: string } | Record<string, never>\n\nexport type OAuth2Tokens = {\n  accessToken: string\n  refreshToken?: string\n}\n\n/** Flow types that support token refresh (all except implicit) */\ntype RefreshableFlows = Exclude<keyof OAuthFlowsObjectSecret, 'implicit'>\n\n/**\n * Resolves the active server URL using OpenAPI server variables first, then\n * Scalar environment variables.\n */\nexport const getServerUrl = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): string =>\n  replaceEnvVariables(\n    replacePathVariables(activeServer?.url ?? '', getServerVariables(activeServer)),\n    environmentVariables,\n  )\n\n/**\n * Builds the base option used when OAuth URLs are relative to the active server.\n *\n * Relative server URLs become browser-only base paths because they need the\n * current window location to resolve correctly.\n */\nexport const getActiveServerBase = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): ActiveServerBase => {\n  const serverUrl = getServerUrl(activeServer, environmentVariables)\n  if (!serverUrl) {\n    return {}\n  }\n\n  if (isRelativePath(serverUrl)) {\n    return typeof window === 'undefined' ? {} : { basePath: serverUrl }\n  }\n\n  return { baseUrl: serverUrl }\n}\n\n/**\n * Generates a random string for PKCE code verifier\n *\n * @see https://www.rfc-editor.org/rfc/rfc7636#page-8\n */\nconst generateCodeVerifier = (): string => {\n  // Generate 32 random bytes\n  const buffer = new Uint8Array(32)\n  crypto.getRandomValues(buffer)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(buffer, true)\n}\n\n/**\n * Creates a code challenge from the code verifier\n */\nconst generateCodeChallenge = async (verifier: string, encoding: 'SHA-256' | 'plain'): Promise<string> => {\n  if (encoding === 'plain') {\n    return verifier\n  }\n\n  // If crypto.subtle.digest is not a function, we cannot use SHA-256\n  if (typeof crypto?.subtle?.digest !== 'function') {\n    console.warn('SHA-256 is only supported when using https, using a plain text code challenge instead.')\n    return verifier\n  }\n\n  // ASCII encoding is just taking the lower 8 bits of each character\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(new Uint8Array(digest), true)\n}\n\n/**\n * Authorize oauth2 flow\n *\n * @returns the resolved oauth2 tokens\n */\nexport const authorizeOauth2 = async (\n  flows: OAuthFlowsObjectSecret,\n  type: keyof OAuthFlowsObjectSecret,\n  selectedScopes: string[],\n  /** We use the active server to set a base for relative redirect uris */\n  activeServer: ServerObject | null,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** Flattened environment variables used to resolve server URL templates like `{protocol}` */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the token request; the desktop app passes an IPC-backed fetch (see {@link authorizeServers}). */\n  customFetch?: CustomFetch,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  try {\n    if (!flow) {\n      return [new Error('Flow not found'), null]\n    }\n\n    const scopes = selectedScopes.join(' ')\n\n    // Client Credentials or Password Flow\n    if (type === 'clientCredentials' || type === 'password') {\n      return authorizeServers(\n        flows,\n        type,\n        scopes,\n        {\n          proxyUrl,\n          customFetch,\n        },\n        activeServer,\n        environmentVariables,\n      )\n    }\n\n    // Generate a random state string with the length of 8 characters\n    const state = (Math.random() + 1).toString(36).substring(2, 10)\n\n    const authorizationUrl = makeUrlAbsolute(\n      flows[type]!['x-scalar-secret-auth-url'] ?? flows[type]!.authorizationUrl,\n      getActiveServerBase(activeServer, environmentVariables),\n    )\n\n    const url = new URL(authorizationUrl)\n\n    /** Special PKCE state */\n    let pkce: PKCEState | null = null\n\n    // Params unique to the flows\n    if (type === 'implicit') {\n      url.searchParams.set('response_type', 'token')\n    } else if (type === 'authorizationCode') {\n      const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n      url.searchParams.set('response_type', 'code')\n\n      // PKCE\n      if (typedFlow['x-usePkce'] !== 'no') {\n        const codeVerifier = generateCodeVerifier()\n        const codeChallenge = await generateCodeChallenge(codeVerifier, typedFlow['x-usePkce'])\n\n        // Set state for later verification\n        pkce = {\n          codeVerifier,\n          codeChallenge,\n          codeChallengeMethod: typedFlow['x-usePkce'] === 'SHA-256' ? 'S256' : 'plain',\n        }\n\n        // Set the code challenge and method on the url\n        url.searchParams.set('code_challenge', codeChallenge)\n        url.searchParams.set('code_challenge_method', pkce.codeChallengeMethod)\n      }\n    }\n\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n    // Handle relative redirect uris\n    if (typedFlow['x-scalar-secret-redirect-uri'].startsWith('/')) {\n      const baseUrl =\n        getServerUrl(activeServer, environmentVariables) || window.location.origin + window.location.pathname\n      const redirectUri = new URL(typedFlow['x-scalar-secret-redirect-uri'], baseUrl).toString()\n\n      url.searchParams.set('redirect_uri', redirectUri)\n    } else {\n      url.searchParams.set('redirect_uri', typedFlow['x-scalar-secret-redirect-uri'])\n    }\n\n    if (flow['x-scalar-security-query']) {\n      Object.keys(flow['x-scalar-security-query']).forEach((key: string): void => {\n        const value = flow['x-scalar-security-query']?.[key]\n        if (!value) {\n          return\n        }\n        url.searchParams.set(key, value)\n      })\n    }\n\n    // Common to all flows\n    url.searchParams.set('client_id', flow['x-scalar-secret-client-id'])\n    url.searchParams.set('state', state)\n    if (scopes) {\n      url.searchParams.set('scope', scopes)\n    }\n\n    const windowFeatures = 'left=100,top=100,width=800,height=600'\n    const authWindow = window.open(url, 'openAuth2Window', windowFeatures)\n\n    // Open up a window and poll until closed or we have the data we want\n    if (authWindow) {\n      // We need to return a promise here due to the setInterval\n      return new Promise<ErrorResponse<OAuth2Tokens>>((resolve) => {\n        const checkWindowClosed = setInterval(() => {\n          const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n            getOAuthCallbackData(() => authWindow.location.href, flow['x-tokenName'] || 'access_token')\n\n          // The window has closed OR we have what we are looking for so we stop polling\n          if (authWindow.closed || accessToken || code || error) {\n            clearInterval(checkWindowClosed)\n            authWindow.close()\n\n            if (error) {\n              resolve([new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null])\n              return\n            }\n\n            // Implicit Flow\n            if (accessToken) {\n              const _state = accessTokenParams?.get('state') ?? null\n\n              if (_state === state) {\n                resolve([null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }])\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // Authorization Code Server Flow\n            if (code && type === 'authorizationCode') {\n              const _state = codeParams?.get('state') ?? null\n\n              if (_state === state) {\n                void authorizeServers(\n                  flows,\n                  type,\n                  scopes,\n                  {\n                    code,\n                    pkce,\n                    proxyUrl,\n                    customFetch,\n                  },\n                  activeServer,\n                  environmentVariables,\n                )\n                  .then(resolve)\n                  .catch((error: unknown) => {\n                    resolve([\n                      error instanceof Error ? error : new Error('Failed to get an access token', { cause: error }),\n                      null,\n                    ])\n                  })\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // User closed window without authorizing\n            resolve([new Error('Window was closed without granting authorization'), null])\n          }\n        }, 200)\n      })\n    }\n    return [new Error('Failed to open auth window'), null]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to authorize oauth2 flow', { cause: error }), null]\n  }\n}\n\n/**\n * Makes the BE authorization call to grab the token server to server\n * Used for clientCredentials and authorizationCode\n */\nconst authorizeServers = async (\n  flows: NonImplicitFlows,\n  type: keyof NonImplicitFlows,\n  scopes: string,\n  {\n    code,\n    pkce,\n    proxyUrl,\n    customFetch = fetch,\n  }: {\n    code?: string\n    pkce?: PKCEState | null\n    proxyUrl?: string\n    customFetch?: CustomFetch\n  } = {},\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const formData = new URLSearchParams()\n\n  // Only client credentials and password flows support scopes in the token request\n  if (scopes && (type === 'clientCredentials' || type === 'password')) {\n    formData.set('scope', scopes)\n  }\n\n  /** Where to add the credentials */\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  const pkcePublicClient = authorizationCodeUsesPkcePublicClient(type, flow)\n  const hasClientSecret = Boolean(flow['x-scalar-secret-client-secret']) && !pkcePublicClient\n  /**\n   * Public authorization-code clients still need client_id in the token body.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody = addCredentialsToBody || (type === 'authorizationCode' && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', flow['x-scalar-secret-client-id'])\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', flow['x-scalar-secret-client-secret'])\n  }\n  if ('x-scalar-secret-redirect-uri' in flow && flow['x-scalar-secret-redirect-uri']) {\n    formData.set('redirect_uri', flow['x-scalar-secret-redirect-uri'])\n  }\n\n  // Authorization Code\n  if (code) {\n    formData.set('code', code)\n    formData.set('grant_type', 'authorization_code')\n\n    // PKCE\n    if (pkce) {\n      formData.set('code_verifier', pkce.codeVerifier)\n    }\n  }\n  // Password\n  else if (type === 'password') {\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n    formData.set('grant_type', 'password')\n    formData.set('username', typedFlow['x-scalar-secret-username'])\n    formData.set('password', typedFlow['x-scalar-secret-password'])\n  }\n  // Client Credentials\n  else {\n    formData.set('grant_type', 'client_credentials')\n  }\n\n  // Additional request body parameters\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    // Add client id + secret to headers for confidential clients.\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = `Basic ${encode(`${flow['x-scalar-secret-client-id']}:${flow['x-scalar-secret-client-secret']}`)}`\n    }\n\n    // Check if we should use the proxy\n    const tokenUrl = makeUrlAbsolute(\n      flow['x-scalar-secret-token-url'] ?? flow.tokenUrl,\n      getActiveServerBase(activeServer, environmentVariables),\n    )\n    const url = shouldUseProxy(proxyUrl, tokenUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', tokenUrl]]).toString()}`\n      : tokenUrl\n\n    // Make the call\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    // Use custom token name if specified, otherwise default to access_token\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const refreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Failed to get an access token'), null]\n    }\n\n    return [null, { accessToken, ...(typeof refreshToken === 'string' ? { refreshToken } : {}) }]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to get an access token. Please check your credentials.', { cause: error }),\n      null,\n    ]\n  }\n}\n\n/**\n * Exchange a refresh token for a new access token using the `grant_type=refresh_token` flow.\n *\n * Uses the stored refresh token, client credentials, and the token URL (or refreshUrl when available)\n * to request fresh tokens from the authorization server per RFC 6749 Section 6.\n */\nexport const refreshOauth2Token = async (\n  flows: OAuthFlowsObjectSecret,\n  type: RefreshableFlows,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** We use the active server to set a base for relative URLs */\n  activeServer: ServerObject | null,\n  /** Flattened environment variables used to resolve server URL templates */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the refresh request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack. */\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const refreshToken = flow['x-scalar-secret-refresh-token']\n  if (!refreshToken) {\n    return [new Error('No refresh token available'), null]\n  }\n\n  const formData = new URLSearchParams()\n  formData.set('grant_type', 'refresh_token')\n  formData.set('refresh_token', refreshToken)\n\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  const pkcePublicClient = authorizationCodeUsesPkcePublicClient(type, flow)\n  const hasClientSecret = Boolean(flow['x-scalar-secret-client-secret']) && !pkcePublicClient\n  /**\n   * Public authorization-code clients still need client_id in the refresh body per RFC 6749 Section 6.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody = addCredentialsToBody || (type === 'authorizationCode' && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', flow['x-scalar-secret-client-id'])\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', flow['x-scalar-secret-client-secret'])\n  }\n\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = `Basic ${encode(`${flow['x-scalar-secret-client-id']}:${flow['x-scalar-secret-client-secret']}`)}`\n    }\n\n    const refreshUrl = flow.refreshUrl || flow['x-scalar-secret-token-url'] || flow.tokenUrl\n    const absoluteRefreshUrl = makeUrlAbsolute(refreshUrl, getActiveServerBase(activeServer, environmentVariables))\n    const url = shouldUseProxy(proxyUrl, absoluteRefreshUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', absoluteRefreshUrl]]).toString()}`\n      : absoluteRefreshUrl\n\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const newRefreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Token refresh failed'), null]\n    }\n\n    return [\n      null,\n      {\n        accessToken,\n        ...(typeof newRefreshToken === 'string' ? { refreshToken: newRefreshToken } : { refreshToken }),\n      },\n    ]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to refresh the access token. Please re-authorize.', { cause: error }),\n      null,\n    ]\n  }\n}\n"],"mappings":";;;;;;;;AAiBA,IAAM,yCACJ,UACA,SACY;AACZ,KAAI,aAAa,oBACf,QAAO;CAET,MAAM,WAAW;AACjB,KAAI,CAAC,SACH,QAAO;CAET,MAAM,WAAW,SAAS;AAC1B,QAAO,aAAa,aAAa,aAAa;;;;;;AAuBhD,IAAa,gBACX,cACA,uBAA+C,EAAE,KAEjD,oBACE,qBAAqB,cAAc,OAAO,IAAI,mBAAmB,aAAa,CAAC,EAC/E,qBACD;;;;;;;AAQH,IAAa,uBACX,cACA,uBAA+C,EAAE,KAC5B;CACrB,MAAM,YAAY,aAAa,cAAc,qBAAqB;AAClE,KAAI,CAAC,UACH,QAAO,EAAE;AAGX,KAAI,eAAe,UAAU,CAC3B,QAAO,OAAO,WAAW,cAAc,EAAE,GAAG,EAAE,UAAU,WAAW;AAGrE,QAAO,EAAE,SAAS,WAAW;;;;;;;AAQ/B,IAAM,6BAAqC;CAEzC,MAAM,SAAS,IAAI,WAAW,GAAG;AACjC,QAAO,gBAAgB,OAAO;AAG9B,QAAO,eAAe,QAAQ,KAAK;;;;;AAMrC,IAAM,wBAAwB,OAAO,UAAkB,aAAmD;AACxG,KAAI,aAAa,QACf,QAAO;AAIT,KAAI,OAAO,QAAQ,QAAQ,WAAW,YAAY;AAChD,UAAQ,KAAK,yFAAyF;AACtG,SAAO;;CAKT,MAAM,OADU,IAAI,aAAa,CACZ,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAG1D,QAAO,eAAe,IAAI,WAAW,OAAO,EAAE,KAAK;;;;;;;AAQrD,IAAa,kBAAkB,OAC7B,OACA,MACA,gBAEA,cAEA,UAEA,uBAA+C,EAAE,EAEjD,gBACyC;CACzC,MAAM,OAAO,MAAM;AAEnB,KAAI;AACF,MAAI,CAAC,KACH,QAAO,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK;EAG5C,MAAM,SAAS,eAAe,KAAK,IAAI;AAGvC,MAAI,SAAS,uBAAuB,SAAS,WAC3C,QAAO,iBACL,OACA,MACA,QACA;GACE;GACA;GACD,EACD,cACA,qBACD;EAIH,MAAM,SAAS,KAAK,QAAQ,GAAG,GAAG,SAAS,GAAG,CAAC,UAAU,GAAG,GAAG;EAE/D,MAAM,mBAAmB,gBACvB,MAAM,MAAO,+BAA+B,MAAM,MAAO,kBACzD,oBAAoB,cAAc,qBAAqB,CACxD;EAED,MAAM,MAAM,IAAI,IAAI,iBAAiB;;EAGrC,IAAI,OAAyB;AAG7B,MAAI,SAAS,WACX,KAAI,aAAa,IAAI,iBAAiB,QAAQ;WACrC,SAAS,qBAAqB;GACvC,MAAM,YAAY,MAAM;AAExB,OAAI,aAAa,IAAI,iBAAiB,OAAO;AAG7C,OAAI,UAAU,iBAAiB,MAAM;IACnC,MAAM,eAAe,sBAAsB;IAC3C,MAAM,gBAAgB,MAAM,sBAAsB,cAAc,UAAU,aAAa;AAGvF,WAAO;KACL;KACA;KACA,qBAAqB,UAAU,iBAAiB,YAAY,SAAS;KACtE;AAGD,QAAI,aAAa,IAAI,kBAAkB,cAAc;AACrD,QAAI,aAAa,IAAI,yBAAyB,KAAK,oBAAoB;;;EAI3E,MAAM,YAAY,MAAM;AAGxB,MAAI,UAAU,gCAAgC,WAAW,IAAI,EAAE;GAC7D,MAAM,UACJ,aAAa,cAAc,qBAAqB,IAAI,OAAO,SAAS,SAAS,OAAO,SAAS;GAC/F,MAAM,cAAc,IAAI,IAAI,UAAU,iCAAiC,QAAQ,CAAC,UAAU;AAE1F,OAAI,aAAa,IAAI,gBAAgB,YAAY;QAEjD,KAAI,aAAa,IAAI,gBAAgB,UAAU,gCAAgC;AAGjF,MAAI,KAAK,2BACP,QAAO,KAAK,KAAK,2BAA2B,CAAC,SAAS,QAAsB;GAC1E,MAAM,QAAQ,KAAK,6BAA6B;AAChD,OAAI,CAAC,MACH;AAEF,OAAI,aAAa,IAAI,KAAK,MAAM;IAChC;AAIJ,MAAI,aAAa,IAAI,aAAa,KAAK,6BAA6B;AACpE,MAAI,aAAa,IAAI,SAAS,MAAM;AACpC,MAAI,OACF,KAAI,aAAa,IAAI,SAAS,OAAO;EAIvC,MAAM,aAAa,OAAO,KAAK,KAAK,mBADb,wCAC+C;AAGtE,MAAI,WAEF,QAAO,IAAI,SAAsC,YAAY;GAC3D,MAAM,oBAAoB,kBAAkB;IAC1C,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,WAAW,SAAS,MAAM,KAAK,kBAAkB,eAAe;AAG7F,QAAI,WAAW,UAAU,eAAe,QAAQ,OAAO;AACrD,mBAAc,kBAAkB;AAChC,gBAAW,OAAO;AAElB,SAAI,OAAO;AACT,cAAQ,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,KAAK,EAAE,KAAK,CAAC;AACtG;;AAIF,SAAI,aAAa;AAGf,WAFe,mBAAmB,IAAI,QAAQ,IAAI,UAEnC,MACb,SAAQ,CAAC,MAAM;OAAE;OAAa,GAAI,eAAe,EAAE,cAAc,GAAG,EAAE;OAAG,CAAC,CAAC;UAE3E,SAAQ,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK,CAAC;AAE9C;;AAIF,SAAI,QAAQ,SAAS,qBAAqB;AAGxC,WAFe,YAAY,IAAI,QAAQ,IAAI,UAE5B,MACR,kBACH,OACA,MACA,QACA;OACE;OACA;OACA;OACA;OACD,EACD,cACA,qBACD,CACE,KAAK,QAAQ,CACb,OAAO,UAAmB;AACzB,eAAQ,CACN,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,iCAAiC,EAAE,OAAO,OAAO,CAAC,EAC7F,KACD,CAAC;QACF;UAEJ,SAAQ,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK,CAAC;AAE9C;;AAIF,aAAQ,iBAAC,IAAI,MAAM,mDAAmD,EAAE,KAAK,CAAC;;MAE/E,IAAI;IACP;AAEJ,SAAO,iBAAC,IAAI,MAAM,6BAA6B,EAAE,KAAK;UAC/C,OAAO;AACd,SAAO,CAAC,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,mCAAmC,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK;;;;;;;AAQlH,IAAM,mBAAmB,OACvB,OACA,MACA,QACA,EACE,MACA,MACA,UACA,cAAc,UAMZ,EAAE,EACN,cACA,uBAA+C,EAAE,KACR;CACzC,MAAM,OAAO,MAAM;AAEnB,KAAI,CAAC,KACH,QAAO,iBAAC,IAAI,MAAM,8BAA8B,EAAE,KAAK;CAGzD,MAAM,WAAW,IAAI,iBAAiB;AAGtC,KAAI,WAAW,SAAS,uBAAuB,SAAS,YACtD,UAAS,IAAI,SAAS,OAAO;;CAI/B,MAAM,uBAAuB,KAAK,qCAAqC;CACvE,MAAM,mBAAmB,sCAAsC,MAAM,KAAK;CAC1E,MAAM,kBAAkB,QAAQ,KAAK,iCAAiC,IAAI,CAAC;AAO3E,KAFiC,wBAAyB,SAAS,uBAAuB,CAAC,gBAGzF,UAAS,IAAI,aAAa,KAAK,6BAA6B;AAE9D,KAAI,wBAAwB,gBAC1B,UAAS,IAAI,iBAAiB,KAAK,iCAAiC;AAEtE,KAAI,kCAAkC,QAAQ,KAAK,gCACjD,UAAS,IAAI,gBAAgB,KAAK,gCAAgC;AAIpE,KAAI,MAAM;AACR,WAAS,IAAI,QAAQ,KAAK;AAC1B,WAAS,IAAI,cAAc,qBAAqB;AAGhD,MAAI,KACF,UAAS,IAAI,iBAAiB,KAAK,aAAa;YAI3C,SAAS,YAAY;EAC5B,MAAM,YAAY,MAAM;AACxB,WAAS,IAAI,cAAc,WAAW;AACtC,WAAS,IAAI,YAAY,UAAU,4BAA4B;AAC/D,WAAS,IAAI,YAAY,UAAU,4BAA4B;OAI/D,UAAS,IAAI,cAAc,qBAAqB;AAIlD,KAAI,KAAK,0BACP,QAAO,QAAQ,KAAK,0BAA0B,CAAC,SAAS,CAAC,KAAK,WAAW;AACvE,MAAI,UAAU,KAAA,KAAa,UAAU,KACnC,UAAS,IAAI,KAAK,OAAO,MAAM,CAAC;GAElC;AAGJ,KAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,qCACjB;AAGD,MAAI,CAAC,wBAAwB,gBAC3B,SAAQ,gBAAgB,SAAS,OAAO,GAAG,KAAK,6BAA6B,GAAG,KAAK,mCAAmC;EAI1H,MAAM,WAAW,gBACf,KAAK,gCAAgC,KAAK,UAC1C,oBAAoB,cAAc,qBAAqB,CACxD;EAWD,MAAM,eAAe,OALR,MAAM,YALP,eAAe,UAAU,SAAS,GAC1C,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,SAAS,CAAC,CAAC,CAAC,UAAU,KACzE,UAGgC;GAClC,QAAQ;GACR;GACA,MAAM;GACP,CAAC,EAC8B,MAAM;EAItC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,eAAe,aAAa;AAElC,MAAI,CAAC,YACH,QAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,gCAAgC,EAAE,KAAK;AAGnH,SAAO,CAAC,MAAM;GAAE;GAAa,GAAI,OAAO,iBAAiB,WAAW,EAAE,cAAc,GAAG,EAAE;GAAG,CAAC;UACtF,OAAO;AACd,SAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,iEAAiE,EAAE,OAAO,OAAO,CAAC,EAChG,KACD;;;;;;;;;AAUL,IAAa,qBAAqB,OAChC,OACA,MAEA,UAEA,cAEA,uBAA+C,EAAE,EAEjD,cAA2B,UACc;CACzC,MAAM,OAAO,MAAM;AAEnB,KAAI,CAAC,KACH,QAAO,iBAAC,IAAI,MAAM,8BAA8B,EAAE,KAAK;CAGzD,MAAM,eAAe,KAAK;AAC1B,KAAI,CAAC,aACH,QAAO,iBAAC,IAAI,MAAM,6BAA6B,EAAE,KAAK;CAGxD,MAAM,WAAW,IAAI,iBAAiB;AACtC,UAAS,IAAI,cAAc,gBAAgB;AAC3C,UAAS,IAAI,iBAAiB,aAAa;CAE3C,MAAM,uBAAuB,KAAK,qCAAqC;CACvE,MAAM,mBAAmB,sCAAsC,MAAM,KAAK;CAC1E,MAAM,kBAAkB,QAAQ,KAAK,iCAAiC,IAAI,CAAC;AAO3E,KAFiC,wBAAyB,SAAS,uBAAuB,CAAC,gBAGzF,UAAS,IAAI,aAAa,KAAK,6BAA6B;AAE9D,KAAI,wBAAwB,gBAC1B,UAAS,IAAI,iBAAiB,KAAK,iCAAiC;AAGtE,KAAI,KAAK,0BACP,QAAO,QAAQ,KAAK,0BAA0B,CAAC,SAAS,CAAC,KAAK,WAAW;AACvE,MAAI,UAAU,KAAA,KAAa,UAAU,KACnC,UAAS,IAAI,KAAK,OAAO,MAAM,CAAC;GAElC;AAGJ,KAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,qCACjB;AAED,MAAI,CAAC,wBAAwB,gBAC3B,SAAQ,gBAAgB,SAAS,OAAO,GAAG,KAAK,6BAA6B,GAAG,KAAK,mCAAmC;EAI1H,MAAM,qBAAqB,gBADR,KAAK,cAAc,KAAK,gCAAgC,KAAK,UACzB,oBAAoB,cAAc,qBAAqB,CAAC;EAU/G,MAAM,eAAe,OALR,MAAM,YAJP,eAAe,UAAU,mBAAmB,GACpD,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,mBAAmB,CAAC,CAAC,CAAC,UAAU,KACnF,oBAEgC;GAClC,QAAQ;GACR;GACA,MAAM;GACP,CAAC,EAC8B,MAAM;EAGtC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,kBAAkB,aAAa;AAErC,MAAI,CAAC,YACH,QAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,uBAAuB,EAAE,KAAK;AAG1G,SAAO,CACL,MACA;GACE;GACA,GAAI,OAAO,oBAAoB,WAAW,EAAE,cAAc,iBAAiB,GAAG,EAAE,cAAc;GAC/F,CACF;UACM,OAAO;AACd,SAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,4DAA4D,EAAE,OAAO,OAAO,CAAC,EAC3F,KACD"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { replaceEnvVariables, replacePathVariables } from '@scalar/helpers/regex/replace-variables'\nimport { isRelativePath } from '@scalar/helpers/url/is-relative-path'\nimport { makeUrlAbsolute } from '@scalar/helpers/url/make-url-absolute'\nimport { shouldUseProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport type { OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example'\nimport { getServerVariables } from '@scalar/workspace-store/request-example'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport { encode, fromUint8Array } from 'js-base64'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\nimport { getOAuthCallbackData } from './oauth-callback'\n\n/** Oauth2 security schemes which are not implicit */\ntype NonImplicitFlows = Omit<OAuthFlowsObjectSecret, 'implicit'>\n\nconst authorizationCodeUsesPkcePublicClient = (\n  flowType: keyof NonImplicitFlows,\n  flow: NonImplicitFlows[keyof NonImplicitFlows],\n): boolean => {\n  if (flowType !== 'authorizationCode') {\n    return false\n  }\n  const authCode = flow as OAuthFlowsObjectSecret['authorizationCode']\n  if (!authCode) {\n    return false\n  }\n  const pkceMode = authCode['x-usePkce']\n  return pkceMode === 'SHA-256' || pkceMode === 'plain'\n}\n\ntype PKCEState = {\n  codeVerifier: string\n  codeChallenge: string\n  codeChallengeMethod: string\n}\n\ntype ActiveServerBase = { basePath: string } | { baseUrl: string } | Record<string, never>\n\nexport type OAuth2Tokens = {\n  accessToken: string\n  refreshToken?: string\n}\n\n/**\n * Captures the OAuth2 redirect for environments where the browser-popup polling\n * approach cannot work (notably the Electron desktop app, where the renderer\n * runs on `file://` and providers reject `file://` redirect URIs).\n *\n * The implementation opens the authorization URL in the system browser and\n * resolves once the provider redirects back. Because the redirect target (for\n * example an ephemeral loopback port) is only known to the host environment, the\n * implementation appends the `redirect_uri` itself and reports back the exact\n * value it used so the token exchange can send the matching `redirect_uri`.\n */\nexport type CaptureOAuth2Callback = (params: {\n  /** The fully built authorization URL, without a `redirect_uri` parameter. */\n  authorizationUrl: string\n}) => Promise<\n  ErrorResponse<{\n    /** The full callback URL the provider redirected to, including query and/or hash params. */\n    callbackUrl: string\n    /** The `redirect_uri` the host environment used, so the token exchange can match it. */\n    redirectUri: string\n  }>\n>\n\n/** Flow types that support token refresh (all except implicit) */\ntype RefreshableFlows = Exclude<keyof OAuthFlowsObjectSecret, 'implicit'>\n\n/**\n * Resolves the active server URL using OpenAPI server variables first, then\n * Scalar environment variables.\n */\nexport const getServerUrl = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): string =>\n  replaceEnvVariables(\n    replacePathVariables(activeServer?.url ?? '', getServerVariables(activeServer)),\n    environmentVariables,\n  )\n\n/**\n * Builds the base option used when OAuth URLs are relative to the active server.\n *\n * Relative server URLs become browser-only base paths because they need the\n * current window location to resolve correctly.\n */\nexport const getActiveServerBase = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): ActiveServerBase => {\n  const serverUrl = getServerUrl(activeServer, environmentVariables)\n  if (!serverUrl) {\n    return {}\n  }\n\n  if (isRelativePath(serverUrl)) {\n    return typeof window === 'undefined' ? {} : { basePath: serverUrl }\n  }\n\n  return { baseUrl: serverUrl }\n}\n\n/**\n * Generates a random string for PKCE code verifier\n *\n * @see https://www.rfc-editor.org/rfc/rfc7636#page-8\n */\nconst generateCodeVerifier = (): string => {\n  // Generate 32 random bytes\n  const buffer = new Uint8Array(32)\n  crypto.getRandomValues(buffer)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(buffer, true)\n}\n\n/**\n * Creates a code challenge from the code verifier\n */\nconst generateCodeChallenge = async (verifier: string, encoding: 'SHA-256' | 'plain'): Promise<string> => {\n  if (encoding === 'plain') {\n    return verifier\n  }\n\n  // If crypto.subtle.digest is not a function, we cannot use SHA-256\n  if (typeof crypto?.subtle?.digest !== 'function') {\n    console.warn('SHA-256 is only supported when using https, using a plain text code challenge instead.')\n    return verifier\n  }\n\n  // ASCII encoding is just taking the lower 8 bits of each character\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(new Uint8Array(digest), true)\n}\n\n/**\n * Authorize oauth2 flow\n *\n * @returns the resolved oauth2 tokens\n */\nexport const authorizeOauth2 = async (\n  flows: OAuthFlowsObjectSecret,\n  type: keyof OAuthFlowsObjectSecret,\n  selectedScopes: string[],\n  /** We use the active server to set a base for relative redirect uris */\n  activeServer: ServerObject | null,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** Flattened environment variables used to resolve server URL templates like `{protocol}` */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the token request; the desktop app passes an IPC-backed fetch (see {@link authorizeServers}). */\n  customFetch?: CustomFetch,\n  /**\n   * Optional redirect capture for interactive flows (authorization code and implicit).\n   * When provided, the system browser plus a host-owned redirect target replaces the\n   * default popup-polling approach. Required for the Electron desktop app.\n   */\n  captureCallback?: CaptureOAuth2Callback,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  try {\n    if (!flow) {\n      return [new Error('Flow not found'), null]\n    }\n\n    const scopes = selectedScopes.join(' ')\n\n    // Client Credentials or Password Flow\n    if (type === 'clientCredentials' || type === 'password') {\n      return authorizeServers(\n        flows,\n        type,\n        scopes,\n        {\n          proxyUrl,\n          customFetch,\n        },\n        activeServer,\n        environmentVariables,\n      )\n    }\n\n    // Generate a random state string with the length of 8 characters\n    const state = (Math.random() + 1).toString(36).substring(2, 10)\n\n    const authorizationUrl = makeUrlAbsolute(\n      flows[type]!['x-scalar-secret-auth-url'] ?? flows[type]!.authorizationUrl,\n      getActiveServerBase(activeServer, environmentVariables),\n    )\n\n    const url = new URL(authorizationUrl)\n\n    /** Special PKCE state */\n    let pkce: PKCEState | null = null\n\n    // Params unique to the flows\n    if (type === 'implicit') {\n      url.searchParams.set('response_type', 'token')\n    } else if (type === 'authorizationCode') {\n      const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n      url.searchParams.set('response_type', 'code')\n\n      // PKCE\n      if (typedFlow['x-usePkce'] !== 'no') {\n        const codeVerifier = generateCodeVerifier()\n        const codeChallenge = await generateCodeChallenge(codeVerifier, typedFlow['x-usePkce'])\n\n        // Set state for later verification\n        pkce = {\n          codeVerifier,\n          codeChallenge,\n          codeChallengeMethod: typedFlow['x-usePkce'] === 'SHA-256' ? 'S256' : 'plain',\n        }\n\n        // Set the code challenge and method on the url\n        url.searchParams.set('code_challenge', codeChallenge)\n        url.searchParams.set('code_challenge_method', pkce.codeChallengeMethod)\n      }\n    }\n\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n    // The capture path appends its own `redirect_uri` (it owns the target, for\n    // example an ephemeral loopback port), so we only set it here for the popup path.\n    if (!captureCallback) {\n      // Handle relative redirect uris\n      if (typedFlow['x-scalar-secret-redirect-uri'].startsWith('/')) {\n        const baseUrl =\n          getServerUrl(activeServer, environmentVariables) || window.location.origin + window.location.pathname\n        const redirectUri = new URL(typedFlow['x-scalar-secret-redirect-uri'], baseUrl).toString()\n\n        url.searchParams.set('redirect_uri', redirectUri)\n      } else {\n        url.searchParams.set('redirect_uri', typedFlow['x-scalar-secret-redirect-uri'])\n      }\n    }\n\n    if (flow['x-scalar-security-query']) {\n      Object.keys(flow['x-scalar-security-query']).forEach((key: string): void => {\n        const value = flow['x-scalar-security-query']?.[key]\n        if (!value) {\n          return\n        }\n        url.searchParams.set(key, value)\n      })\n    }\n\n    // Common to all flows\n    url.searchParams.set('client_id', flow['x-scalar-secret-client-id'])\n    url.searchParams.set('state', state)\n    if (scopes) {\n      url.searchParams.set('scope', scopes)\n    }\n\n    // Capture path: open the system browser and let the host environment catch\n    // the redirect (used by the desktop app, where popup polling cannot work).\n    if (captureCallback) {\n      const [captureError, capture] = await captureCallback({ authorizationUrl: url.toString() })\n\n      if (captureError || !capture) {\n        return [captureError ?? new Error('Failed to capture the OAuth2 redirect'), null]\n      }\n\n      const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n        getOAuthCallbackData(() => capture.callbackUrl, flow['x-tokenName'] || 'access_token')\n\n      if (error) {\n        return [new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null]\n      }\n\n      // Implicit Flow\n      if (accessToken) {\n        if ((accessTokenParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return [null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }]\n      }\n\n      // Authorization Code Server Flow\n      if (code && type === 'authorizationCode') {\n        if ((codeParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return authorizeServers(\n          flows,\n          type,\n          scopes,\n          {\n            code,\n            pkce,\n            proxyUrl,\n            customFetch,\n            // The token request must echo the exact redirect_uri used in the authorization request.\n            redirectUri: capture.redirectUri,\n          },\n          activeServer,\n          environmentVariables,\n        )\n      }\n\n      return [new Error('No authorization code or access token was returned'), null]\n    }\n\n    const windowFeatures = 'left=100,top=100,width=800,height=600'\n    const authWindow = window.open(url, 'openAuth2Window', windowFeatures)\n\n    // Open up a window and poll until closed or we have the data we want\n    if (authWindow) {\n      // We need to return a promise here due to the setInterval\n      return new Promise<ErrorResponse<OAuth2Tokens>>((resolve) => {\n        const checkWindowClosed = setInterval(() => {\n          const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n            getOAuthCallbackData(() => authWindow.location.href, flow['x-tokenName'] || 'access_token')\n\n          // The window has closed OR we have what we are looking for so we stop polling\n          if (authWindow.closed || accessToken || code || error) {\n            clearInterval(checkWindowClosed)\n            authWindow.close()\n\n            if (error) {\n              resolve([new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null])\n              return\n            }\n\n            // Implicit Flow\n            if (accessToken) {\n              const _state = accessTokenParams?.get('state') ?? null\n\n              if (_state === state) {\n                resolve([null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }])\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // Authorization Code Server Flow\n            if (code && type === 'authorizationCode') {\n              const _state = codeParams?.get('state') ?? null\n\n              if (_state === state) {\n                void authorizeServers(\n                  flows,\n                  type,\n                  scopes,\n                  {\n                    code,\n                    pkce,\n                    proxyUrl,\n                    customFetch,\n                  },\n                  activeServer,\n                  environmentVariables,\n                )\n                  .then(resolve)\n                  .catch((error: unknown) => {\n                    resolve([\n                      error instanceof Error ? error : new Error('Failed to get an access token', { cause: error }),\n                      null,\n                    ])\n                  })\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // User closed window without authorizing\n            resolve([new Error('Window was closed without granting authorization'), null])\n          }\n        }, 200)\n      })\n    }\n    return [new Error('Failed to open auth window'), null]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to authorize oauth2 flow', { cause: error }), null]\n  }\n}\n\n/**\n * Makes the BE authorization call to grab the token server to server\n * Used for clientCredentials and authorizationCode\n */\nconst authorizeServers = async (\n  flows: NonImplicitFlows,\n  type: keyof NonImplicitFlows,\n  scopes: string,\n  {\n    code,\n    pkce,\n    proxyUrl,\n    customFetch = fetch,\n    redirectUri,\n  }: {\n    code?: string\n    pkce?: PKCEState | null\n    proxyUrl?: string\n    customFetch?: CustomFetch\n    /** Overrides the stored redirect_uri (the capture path owns the real target). */\n    redirectUri?: string\n  } = {},\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const formData = new URLSearchParams()\n\n  // Only client credentials and password flows support scopes in the token request\n  if (scopes && (type === 'clientCredentials' || type === 'password')) {\n    formData.set('scope', scopes)\n  }\n\n  /** Where to add the credentials */\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  const pkcePublicClient = authorizationCodeUsesPkcePublicClient(type, flow)\n  const hasClientSecret = Boolean(flow['x-scalar-secret-client-secret']) && !pkcePublicClient\n  /**\n   * Public authorization-code clients still need client_id in the token body.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody = addCredentialsToBody || (type === 'authorizationCode' && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', flow['x-scalar-secret-client-id'])\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', flow['x-scalar-secret-client-secret'])\n  }\n  if (redirectUri) {\n    formData.set('redirect_uri', redirectUri)\n  } else if ('x-scalar-secret-redirect-uri' in flow && flow['x-scalar-secret-redirect-uri']) {\n    formData.set('redirect_uri', flow['x-scalar-secret-redirect-uri'])\n  }\n\n  // Authorization Code\n  if (code) {\n    formData.set('code', code)\n    formData.set('grant_type', 'authorization_code')\n\n    // PKCE\n    if (pkce) {\n      formData.set('code_verifier', pkce.codeVerifier)\n    }\n  }\n  // Password\n  else if (type === 'password') {\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n    formData.set('grant_type', 'password')\n    formData.set('username', typedFlow['x-scalar-secret-username'])\n    formData.set('password', typedFlow['x-scalar-secret-password'])\n  }\n  // Client Credentials\n  else {\n    formData.set('grant_type', 'client_credentials')\n  }\n\n  // Additional request body parameters\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    // Add client id + secret to headers for confidential clients.\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = `Basic ${encode(`${flow['x-scalar-secret-client-id']}:${flow['x-scalar-secret-client-secret']}`)}`\n    }\n\n    // Check if we should use the proxy\n    const tokenUrl = makeUrlAbsolute(\n      flow['x-scalar-secret-token-url'] ?? flow.tokenUrl,\n      getActiveServerBase(activeServer, environmentVariables),\n    )\n    const url = shouldUseProxy(proxyUrl, tokenUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', tokenUrl]]).toString()}`\n      : tokenUrl\n\n    // Make the call\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    // Use custom token name if specified, otherwise default to access_token\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const refreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Failed to get an access token'), null]\n    }\n\n    return [null, { accessToken, ...(typeof refreshToken === 'string' ? { refreshToken } : {}) }]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to get an access token. Please check your credentials.', { cause: error }),\n      null,\n    ]\n  }\n}\n\n/**\n * Exchange a refresh token for a new access token using the `grant_type=refresh_token` flow.\n *\n * Uses the stored refresh token, client credentials, and the token URL (or refreshUrl when available)\n * to request fresh tokens from the authorization server per RFC 6749 Section 6.\n */\nexport const refreshOauth2Token = async (\n  flows: OAuthFlowsObjectSecret,\n  type: RefreshableFlows,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** We use the active server to set a base for relative URLs */\n  activeServer: ServerObject | null,\n  /** Flattened environment variables used to resolve server URL templates */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the refresh request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack. */\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const refreshToken = flow['x-scalar-secret-refresh-token']\n  if (!refreshToken) {\n    return [new Error('No refresh token available'), null]\n  }\n\n  const formData = new URLSearchParams()\n  formData.set('grant_type', 'refresh_token')\n  formData.set('refresh_token', refreshToken)\n\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  const pkcePublicClient = authorizationCodeUsesPkcePublicClient(type, flow)\n  const hasClientSecret = Boolean(flow['x-scalar-secret-client-secret']) && !pkcePublicClient\n  /**\n   * Public authorization-code clients still need client_id in the refresh body per RFC 6749 Section 6.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody = addCredentialsToBody || (type === 'authorizationCode' && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', flow['x-scalar-secret-client-id'])\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', flow['x-scalar-secret-client-secret'])\n  }\n\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = `Basic ${encode(`${flow['x-scalar-secret-client-id']}:${flow['x-scalar-secret-client-secret']}`)}`\n    }\n\n    const refreshUrl = flow.refreshUrl || flow['x-scalar-secret-token-url'] || flow.tokenUrl\n    const absoluteRefreshUrl = makeUrlAbsolute(refreshUrl, getActiveServerBase(activeServer, environmentVariables))\n    const url = shouldUseProxy(proxyUrl, absoluteRefreshUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', absoluteRefreshUrl]]).toString()}`\n      : absoluteRefreshUrl\n\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const newRefreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Token refresh failed'), null]\n    }\n\n    return [\n      null,\n      {\n        accessToken,\n        ...(typeof newRefreshToken === 'string' ? { refreshToken: newRefreshToken } : { refreshToken }),\n      },\n    ]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to refresh the access token. Please re-authorize.', { cause: error }),\n      null,\n    ]\n  }\n}\n"],"mappings":";;;;;;;;AAiBA,IAAM,yCACJ,UACA,SACY;AACZ,KAAI,aAAa,oBACf,QAAO;CAET,MAAM,WAAW;AACjB,KAAI,CAAC,SACH,QAAO;CAET,MAAM,WAAW,SAAS;AAC1B,QAAO,aAAa,aAAa,aAAa;;;;;;AA8ChD,IAAa,gBACX,cACA,uBAA+C,EAAE,KAEjD,oBACE,qBAAqB,cAAc,OAAO,IAAI,mBAAmB,aAAa,CAAC,EAC/E,qBACD;;;;;;;AAQH,IAAa,uBACX,cACA,uBAA+C,EAAE,KAC5B;CACrB,MAAM,YAAY,aAAa,cAAc,qBAAqB;AAClE,KAAI,CAAC,UACH,QAAO,EAAE;AAGX,KAAI,eAAe,UAAU,CAC3B,QAAO,OAAO,WAAW,cAAc,EAAE,GAAG,EAAE,UAAU,WAAW;AAGrE,QAAO,EAAE,SAAS,WAAW;;;;;;;AAQ/B,IAAM,6BAAqC;CAEzC,MAAM,SAAS,IAAI,WAAW,GAAG;AACjC,QAAO,gBAAgB,OAAO;AAG9B,QAAO,eAAe,QAAQ,KAAK;;;;;AAMrC,IAAM,wBAAwB,OAAO,UAAkB,aAAmD;AACxG,KAAI,aAAa,QACf,QAAO;AAIT,KAAI,OAAO,QAAQ,QAAQ,WAAW,YAAY;AAChD,UAAQ,KAAK,yFAAyF;AACtG,SAAO;;CAKT,MAAM,OADU,IAAI,aAAa,CACZ,OAAO,SAAS;CACrC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAG1D,QAAO,eAAe,IAAI,WAAW,OAAO,EAAE,KAAK;;;;;;;AAQrD,IAAa,kBAAkB,OAC7B,OACA,MACA,gBAEA,cAEA,UAEA,uBAA+C,EAAE,EAEjD,aAMA,oBACyC;CACzC,MAAM,OAAO,MAAM;AAEnB,KAAI;AACF,MAAI,CAAC,KACH,QAAO,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK;EAG5C,MAAM,SAAS,eAAe,KAAK,IAAI;AAGvC,MAAI,SAAS,uBAAuB,SAAS,WAC3C,QAAO,iBACL,OACA,MACA,QACA;GACE;GACA;GACD,EACD,cACA,qBACD;EAIH,MAAM,SAAS,KAAK,QAAQ,GAAG,GAAG,SAAS,GAAG,CAAC,UAAU,GAAG,GAAG;EAE/D,MAAM,mBAAmB,gBACvB,MAAM,MAAO,+BAA+B,MAAM,MAAO,kBACzD,oBAAoB,cAAc,qBAAqB,CACxD;EAED,MAAM,MAAM,IAAI,IAAI,iBAAiB;;EAGrC,IAAI,OAAyB;AAG7B,MAAI,SAAS,WACX,KAAI,aAAa,IAAI,iBAAiB,QAAQ;WACrC,SAAS,qBAAqB;GACvC,MAAM,YAAY,MAAM;AAExB,OAAI,aAAa,IAAI,iBAAiB,OAAO;AAG7C,OAAI,UAAU,iBAAiB,MAAM;IACnC,MAAM,eAAe,sBAAsB;IAC3C,MAAM,gBAAgB,MAAM,sBAAsB,cAAc,UAAU,aAAa;AAGvF,WAAO;KACL;KACA;KACA,qBAAqB,UAAU,iBAAiB,YAAY,SAAS;KACtE;AAGD,QAAI,aAAa,IAAI,kBAAkB,cAAc;AACrD,QAAI,aAAa,IAAI,yBAAyB,KAAK,oBAAoB;;;EAI3E,MAAM,YAAY,MAAM;AAIxB,MAAI,CAAC,gBAEH,KAAI,UAAU,gCAAgC,WAAW,IAAI,EAAE;GAC7D,MAAM,UACJ,aAAa,cAAc,qBAAqB,IAAI,OAAO,SAAS,SAAS,OAAO,SAAS;GAC/F,MAAM,cAAc,IAAI,IAAI,UAAU,iCAAiC,QAAQ,CAAC,UAAU;AAE1F,OAAI,aAAa,IAAI,gBAAgB,YAAY;QAEjD,KAAI,aAAa,IAAI,gBAAgB,UAAU,gCAAgC;AAInF,MAAI,KAAK,2BACP,QAAO,KAAK,KAAK,2BAA2B,CAAC,SAAS,QAAsB;GAC1E,MAAM,QAAQ,KAAK,6BAA6B;AAChD,OAAI,CAAC,MACH;AAEF,OAAI,aAAa,IAAI,KAAK,MAAM;IAChC;AAIJ,MAAI,aAAa,IAAI,aAAa,KAAK,6BAA6B;AACpE,MAAI,aAAa,IAAI,SAAS,MAAM;AACpC,MAAI,OACF,KAAI,aAAa,IAAI,SAAS,OAAO;AAKvC,MAAI,iBAAiB;GACnB,MAAM,CAAC,cAAc,WAAW,MAAM,gBAAgB,EAAE,kBAAkB,IAAI,UAAU,EAAE,CAAC;AAE3F,OAAI,gBAAgB,CAAC,QACnB,QAAO,CAAC,gCAAgB,IAAI,MAAM,wCAAwC,EAAE,KAAK;GAGnF,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,QAAQ,aAAa,KAAK,kBAAkB,eAAe;AAExF,OAAI,MACF,QAAO,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,KAAK,EAAE,KAAK;AAItG,OAAI,aAAa;AACf,SAAK,mBAAmB,IAAI,QAAQ,IAAI,UAAU,MAChD,QAAO,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK;AAE5C,WAAO,CAAC,MAAM;KAAE;KAAa,GAAI,eAAe,EAAE,cAAc,GAAG,EAAE;KAAG,CAAC;;AAI3E,OAAI,QAAQ,SAAS,qBAAqB;AACxC,SAAK,YAAY,IAAI,QAAQ,IAAI,UAAU,MACzC,QAAO,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK;AAE5C,WAAO,iBACL,OACA,MACA,QACA;KACE;KACA;KACA;KACA;KAEA,aAAa,QAAQ;KACtB,EACD,cACA,qBACD;;AAGH,UAAO,iBAAC,IAAI,MAAM,qDAAqD,EAAE,KAAK;;EAIhF,MAAM,aAAa,OAAO,KAAK,KAAK,mBADb,wCAC+C;AAGtE,MAAI,WAEF,QAAO,IAAI,SAAsC,YAAY;GAC3D,MAAM,oBAAoB,kBAAkB;IAC1C,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,WAAW,SAAS,MAAM,KAAK,kBAAkB,eAAe;AAG7F,QAAI,WAAW,UAAU,eAAe,QAAQ,OAAO;AACrD,mBAAc,kBAAkB;AAChC,gBAAW,OAAO;AAElB,SAAI,OAAO;AACT,cAAQ,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,KAAK,EAAE,KAAK,CAAC;AACtG;;AAIF,SAAI,aAAa;AAGf,WAFe,mBAAmB,IAAI,QAAQ,IAAI,UAEnC,MACb,SAAQ,CAAC,MAAM;OAAE;OAAa,GAAI,eAAe,EAAE,cAAc,GAAG,EAAE;OAAG,CAAC,CAAC;UAE3E,SAAQ,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK,CAAC;AAE9C;;AAIF,SAAI,QAAQ,SAAS,qBAAqB;AAGxC,WAFe,YAAY,IAAI,QAAQ,IAAI,UAE5B,MACR,kBACH,OACA,MACA,QACA;OACE;OACA;OACA;OACA;OACD,EACD,cACA,qBACD,CACE,KAAK,QAAQ,CACb,OAAO,UAAmB;AACzB,eAAQ,CACN,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,iCAAiC,EAAE,OAAO,OAAO,CAAC,EAC7F,KACD,CAAC;QACF;UAEJ,SAAQ,iBAAC,IAAI,MAAM,iBAAiB,EAAE,KAAK,CAAC;AAE9C;;AAIF,aAAQ,iBAAC,IAAI,MAAM,mDAAmD,EAAE,KAAK,CAAC;;MAE/E,IAAI;IACP;AAEJ,SAAO,iBAAC,IAAI,MAAM,6BAA6B,EAAE,KAAK;UAC/C,OAAO;AACd,SAAO,CAAC,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,mCAAmC,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK;;;;;;;AAQlH,IAAM,mBAAmB,OACvB,OACA,MACA,QACA,EACE,MACA,MACA,UACA,cAAc,OACd,gBAQE,EAAE,EACN,cACA,uBAA+C,EAAE,KACR;CACzC,MAAM,OAAO,MAAM;AAEnB,KAAI,CAAC,KACH,QAAO,iBAAC,IAAI,MAAM,8BAA8B,EAAE,KAAK;CAGzD,MAAM,WAAW,IAAI,iBAAiB;AAGtC,KAAI,WAAW,SAAS,uBAAuB,SAAS,YACtD,UAAS,IAAI,SAAS,OAAO;;CAI/B,MAAM,uBAAuB,KAAK,qCAAqC;CACvE,MAAM,mBAAmB,sCAAsC,MAAM,KAAK;CAC1E,MAAM,kBAAkB,QAAQ,KAAK,iCAAiC,IAAI,CAAC;AAO3E,KAFiC,wBAAyB,SAAS,uBAAuB,CAAC,gBAGzF,UAAS,IAAI,aAAa,KAAK,6BAA6B;AAE9D,KAAI,wBAAwB,gBAC1B,UAAS,IAAI,iBAAiB,KAAK,iCAAiC;AAEtE,KAAI,YACF,UAAS,IAAI,gBAAgB,YAAY;UAChC,kCAAkC,QAAQ,KAAK,gCACxD,UAAS,IAAI,gBAAgB,KAAK,gCAAgC;AAIpE,KAAI,MAAM;AACR,WAAS,IAAI,QAAQ,KAAK;AAC1B,WAAS,IAAI,cAAc,qBAAqB;AAGhD,MAAI,KACF,UAAS,IAAI,iBAAiB,KAAK,aAAa;YAI3C,SAAS,YAAY;EAC5B,MAAM,YAAY,MAAM;AACxB,WAAS,IAAI,cAAc,WAAW;AACtC,WAAS,IAAI,YAAY,UAAU,4BAA4B;AAC/D,WAAS,IAAI,YAAY,UAAU,4BAA4B;OAI/D,UAAS,IAAI,cAAc,qBAAqB;AAIlD,KAAI,KAAK,0BACP,QAAO,QAAQ,KAAK,0BAA0B,CAAC,SAAS,CAAC,KAAK,WAAW;AACvE,MAAI,UAAU,KAAA,KAAa,UAAU,KACnC,UAAS,IAAI,KAAK,OAAO,MAAM,CAAC;GAElC;AAGJ,KAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,qCACjB;AAGD,MAAI,CAAC,wBAAwB,gBAC3B,SAAQ,gBAAgB,SAAS,OAAO,GAAG,KAAK,6BAA6B,GAAG,KAAK,mCAAmC;EAI1H,MAAM,WAAW,gBACf,KAAK,gCAAgC,KAAK,UAC1C,oBAAoB,cAAc,qBAAqB,CACxD;EAWD,MAAM,eAAe,OALR,MAAM,YALP,eAAe,UAAU,SAAS,GAC1C,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,SAAS,CAAC,CAAC,CAAC,UAAU,KACzE,UAGgC;GAClC,QAAQ;GACR;GACA,MAAM;GACP,CAAC,EAC8B,MAAM;EAItC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,eAAe,aAAa;AAElC,MAAI,CAAC,YACH,QAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,gCAAgC,EAAE,KAAK;AAGnH,SAAO,CAAC,MAAM;GAAE;GAAa,GAAI,OAAO,iBAAiB,WAAW,EAAE,cAAc,GAAG,EAAE;GAAG,CAAC;UACtF,OAAO;AACd,SAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,iEAAiE,EAAE,OAAO,OAAO,CAAC,EAChG,KACD;;;;;;;;;AAUL,IAAa,qBAAqB,OAChC,OACA,MAEA,UAEA,cAEA,uBAA+C,EAAE,EAEjD,cAA2B,UACc;CACzC,MAAM,OAAO,MAAM;AAEnB,KAAI,CAAC,KACH,QAAO,iBAAC,IAAI,MAAM,8BAA8B,EAAE,KAAK;CAGzD,MAAM,eAAe,KAAK;AAC1B,KAAI,CAAC,aACH,QAAO,iBAAC,IAAI,MAAM,6BAA6B,EAAE,KAAK;CAGxD,MAAM,WAAW,IAAI,iBAAiB;AACtC,UAAS,IAAI,cAAc,gBAAgB;AAC3C,UAAS,IAAI,iBAAiB,aAAa;CAE3C,MAAM,uBAAuB,KAAK,qCAAqC;CACvE,MAAM,mBAAmB,sCAAsC,MAAM,KAAK;CAC1E,MAAM,kBAAkB,QAAQ,KAAK,iCAAiC,IAAI,CAAC;AAO3E,KAFiC,wBAAyB,SAAS,uBAAuB,CAAC,gBAGzF,UAAS,IAAI,aAAa,KAAK,6BAA6B;AAE9D,KAAI,wBAAwB,gBAC1B,UAAS,IAAI,iBAAiB,KAAK,iCAAiC;AAGtE,KAAI,KAAK,0BACP,QAAO,QAAQ,KAAK,0BAA0B,CAAC,SAAS,CAAC,KAAK,WAAW;AACvE,MAAI,UAAU,KAAA,KAAa,UAAU,KACnC,UAAS,IAAI,KAAK,OAAO,MAAM,CAAC;GAElC;AAGJ,KAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,qCACjB;AAED,MAAI,CAAC,wBAAwB,gBAC3B,SAAQ,gBAAgB,SAAS,OAAO,GAAG,KAAK,6BAA6B,GAAG,KAAK,mCAAmC;EAI1H,MAAM,qBAAqB,gBADR,KAAK,cAAc,KAAK,gCAAgC,KAAK,UACzB,oBAAoB,cAAc,qBAAqB,CAAC;EAU/G,MAAM,eAAe,OALR,MAAM,YAJP,eAAe,UAAU,mBAAmB,GACpD,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,mBAAmB,CAAC,CAAC,CAAC,UAAU,KACnF,oBAEgC;GAClC,QAAQ;GACR;GACA,MAAM;GACP,CAAC,EAC8B,MAAM;EAGtC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,kBAAkB,aAAa;AAErC,MAAI,CAAC,YACH,QAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,uBAAuB,EAAE,KAAK;AAG1G,SAAO,CACL,MACA;GACE;GACA,GAAI,OAAO,oBAAoB,WAAW,EAAE,cAAc,iBAAiB,GAAG,EAAE,cAAc;GAC/F,CACF;UACM,OAAO;AACd,SAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,4DAA4D,EAAE,OAAO,OAAO,CAAC,EAC3F,KACD"}

package/dist/v2/constants.js

@@ -1,6 +1,6 @@
 //#region src/v2/constants.ts
 /** The version number taken from the package.json. Consumers can override at build time via define (e.g. OVERRIDE_PACKAGE_VERSION: JSON.stringify('1.2.3')). */
-var APP_VERSION = typeof OVERRIDE_PACKAGE_VERSION !== "undefined" ? OVERRIDE_PACKAGE_VERSION : "3.12.0";
+var APP_VERSION = typeof OVERRIDE_PACKAGE_VERSION !== "undefined" ? OVERRIDE_PACKAGE_VERSION : "3.13.1";
 //#endregion
 export { APP_VERSION };
 

package/dist/v2/types/options.d.ts

@@ -1,6 +1,7 @@
 import type { ApiReferenceConfigurationRaw } from '@scalar/types/api-reference';
 import type { Ref } from 'vue';
 import type { CustomFetch } from '../../v2/blocks/operation-block/helpers/send-request.js';
+import type { CaptureOAuth2Callback } from '../../v2/blocks/scalar-auth-selector-block/helpers/oauth.js';
 /**
  * Configuration options for the API Client (app and modal).
  */
@@ -10,6 +11,12 @@ export type ApiClientOptions = Partial<Pick<ApiReferenceConfigurationRaw, 'authe
      * When provided, replaces the global fetch in the request execution engine (sendRequest).
      */
     customFetch?: CustomFetch;
+    /**
+     * Captures the OAuth2 redirect for interactive flows where browser-popup polling
+     * cannot work. The desktop app provides this to run authorization through the
+     * system browser plus a loopback redirect target.
+     */
+    captureOAuth2Callback?: CaptureOAuth2Callback;
 };
 export type ApiClientOptionsRef = Ref<ApiClientOptions>;
 //# sourceMappingURL=options.d.ts.map

package/dist/v2/types/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/v2/types/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC/E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAA;AAE9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAEnF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CACpC,IAAI,CACF,4BAA4B,EAC1B,gBAAgB,GAChB,eAAe,GACf,kBAAkB,GAClB,eAAe,GACf,mBAAmB,GACnB,UAAU,GACV,SAAS,CACZ,CACF,GAAG;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAA"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/v2/types/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC/E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAA;AAE9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAA;AAEjG;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CACpC,IAAI,CACF,4BAA4B,EAC1B,gBAAgB,GAChB,eAAe,GACf,kBAAkB,GAClB,eAAe,GACf,mBAAmB,GACnB,UAAU,GACV,SAAS,CACZ,CACF,GAAG;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;CAC9C,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAA"}

package/package.json

@@ -18,7 +18,7 @@
     "rest",
     "testing"
   ],
-  "version": "3.12.0",
+  "version": "3.13.1",
   "engines": {
     "node": ">=22"
   },
@@ -309,20 +309,20 @@
     "vue": "^3.5.30",
     "yaml": "^2.8.3",
     "zod": "^4.3.5",
+    "@scalar/blocks": "0.1.2",
     "@scalar/components": "0.27.4",
     "@scalar/helpers": "0.9.0",
-    "@scalar/oas-utils": "0.19.1",
+    "@scalar/oas-utils": "0.19.3",
     "@scalar/icons": "0.7.3",
+    "@scalar/sidebar": "0.9.27",
+    "@scalar/snippetz": "0.9.20",
     "@scalar/openapi-types": "0.9.1",
-    "@scalar/blocks": "0.1.0",
-    "@scalar/snippetz": "0.9.19",
-    "@scalar/sidebar": "0.9.25",
-    "@scalar/themes": "0.16.2",
-    "@scalar/types": "0.16.0",
+    "@scalar/types": "0.16.1",
     "@scalar/use-codemirror": "0.14.12",
+    "@scalar/themes": "0.16.2",
     "@scalar/use-hooks": "0.4.7",
-    "@scalar/workspace-store": "0.55.0",
-    "@scalar/use-toasts": "0.10.2"
+    "@scalar/use-toasts": "0.10.2",
+    "@scalar/workspace-store": "0.55.2"
   },
   "devDependencies": {
     "@tailwindcss/cli": "^4.2.4",