@stigmer/server-slim 3.15.0 → 3.15.2

package/console/_next/static/chunks/{0g4_345f39a55.js → 0cu7jpps89qek.js}

@@ -1 +1 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,470858,567989,e=>{"use strict";class t extends Error{}t.prototype.name="InvalidTokenError";var s,i,r,n,a={debug:()=>void 0,info:()=>void 0,warn:()=>void 0,error:()=>void 0},o=((s=o||{})[s.NONE=0]="NONE",s[s.ERROR=1]="ERROR",s[s.WARN=2]="WARN",s[s.INFO=3]="INFO",s[s.DEBUG=4]="DEBUG",s);(i=o||(o={})).reset=function(){r=3,n=a},i.setLevel=function(e){if(!(0<=e&&e<=4))throw Error("Invalid log level");r=e},i.setLogger=function(e){n=e};var c=class e{constructor(e){this._name=e}debug(...t){r>=4&&n.debug(e._format(this._name,this._method),...t)}info(...t){r>=3&&n.info(e._format(this._name,this._method),...t)}warn(...t){r>=2&&n.warn(e._format(this._name,this._method),...t)}error(...t){r>=1&&n.error(e._format(this._name,this._method),...t)}throw(e){throw this.error(e),e}create(e){let t=Object.create(this);return t._method=e,t.debug("begin"),t}static createStatic(t,s){let i=new e(`${t}.${s}`);return i.debug("begin"),i}static _format(e,t){let s=`[${e}]`;return t?`${s} ${t}:`:s}static debug(t,...s){r>=4&&n.debug(e._format(t),...s)}static info(t,...s){r>=3&&n.info(e._format(t),...s)}static warn(t,...s){r>=2&&n.warn(e._format(t),...s)}static error(t,...s){r>=1&&n.error(e._format(t),...s)}};o.reset();var l=class{static decode(e){try{return function(e,s){let i;if("string"!=typeof e)throw new t("Invalid token specified: must be a string");s||(s={});let r=+(!0!==s.header),n=e.split(".")[r];if("string"!=typeof n)throw new t(`Invalid token specified: missing part #${r+1}`);try{i=function(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");switch(t.length%4){case 0:break;case 2:t+="==";break;case 3:t+="=";break;default:throw Error("base64 string is not of the correct length")}try{var s;return s=t,decodeURIComponent(atob(s).replace(/(.)/g,(e,t)=>{let s=t.charCodeAt(0).toString(16).toUpperCase();return s.length<2&&(s="0"+s),"%"+s}))}catch(e){return atob(t)}}(n)}catch(e){throw new t(`Invalid token specified: invalid base64 for part #${r+1} (${e.message})`)}try{return JSON.parse(i)}catch(e){throw new t(`Invalid token specified: invalid json for part #${r+1} (${e.message})`)}}(e)}catch(e){throw c.error("JwtUtils.decode",e),e}}static async generateSignedJwt(e,t,s){let i=g.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))),r=g.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))),n=`${i}.${r}`,a=await window.crypto.subtle.sign({name:"ECDSA",hash:{name:"SHA-256"}},s,new TextEncoder().encode(n)),o=g.encodeBase64Url(new Uint8Array(a));return`${n}.${o}`}static async generateSignedJwtWithHmac(e,t,s){let i=g.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))),r=g.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))),n=`${i}.${r}`,a=await window.crypto.subtle.sign("HMAC",s,new TextEncoder().encode(n)),o=g.encodeBase64Url(new Uint8Array(a));return`${n}.${o}`}},h=e=>btoa([...new Uint8Array(e)].map(e=>String.fromCharCode(e)).join("")),d=class e{static _randomWord(){let e=new Uint32Array(1);return crypto.getRandomValues(e),e[0]}static generateUUIDv4(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,t=>(t^e._randomWord()&15>>t/4).toString(16)).replace(/-/g,"")}static generateCodeVerifier(){return e.generateUUIDv4()+e.generateUUIDv4()+e.generateUUIDv4()}static async generateCodeChallenge(e){if(!crypto.subtle)throw Error("Crypto.subtle is available only in secure contexts (HTTPS).");try{let t=new TextEncoder().encode(e),s=await crypto.subtle.digest("SHA-256",t);return h(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(e){throw c.error("CryptoUtils.generateCodeChallenge",e),e}}static generateBasicAuth(e,t){return h(new TextEncoder().encode([e,t].join(":")))}static async hash(e,t){let s=new TextEncoder().encode(t);return new Uint8Array(await crypto.subtle.digest(e,s))}static async customCalculateJwkThumbprint(t){let s;switch(t.kty){case"RSA":s={e:t.e,kty:t.kty,n:t.n};break;case"EC":s={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":s={crv:t.crv,kty:t.kty,x:t.x};break;case"oct":s={crv:t.k,kty:t.kty};break;default:throw Error("Unknown jwk type")}let i=await e.hash("SHA-256",JSON.stringify(s));return e.encodeBase64Url(i)}static async generateDPoPProof({url:t,accessToken:s,httpMethod:i,keyPair:r,nonce:n}){let a,o={jti:window.crypto.randomUUID(),htm:null!=i?i:"GET",htu:t,iat:Math.floor(Date.now()/1e3)};s&&(a=await e.hash("SHA-256",s),o.ath=e.encodeBase64Url(a)),n&&(o.nonce=n);try{let e=await crypto.subtle.exportKey("jwk",r.publicKey),t={alg:"ES256",typ:"dpop+jwt",jwk:{crv:e.crv,kty:e.kty,x:e.x,y:e.y}};return await l.generateSignedJwt(t,o,r.privateKey)}catch(e){if(e instanceof TypeError)throw Error(`Error exporting dpop public key: ${e.message}`);throw e}}static async generateDPoPJkt(t){try{let s=await crypto.subtle.exportKey("jwk",t.publicKey);return await e.customCalculateJwkThumbprint(s)}catch(e){if(e instanceof TypeError)throw Error(`Could not retrieve dpop keys from storage: ${e.message}`);throw e}}static async generateDPoPKeys(){return await window.crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign","verify"])}static async generateClientAssertionJwt(t,s,i,r="HS256"){let n=Math.floor(Date.now()/1e3),a={iss:t,sub:t,aud:i,jti:e.generateUUIDv4(),exp:n+300,iat:n},o={HS256:"SHA-256",HS384:"SHA-384",HS512:"SHA-512"}[r];if(!o)throw Error(`Unsupported algorithm: ${r}. Supported algorithms are: HS256, HS384, HS512`);let c=new TextEncoder,h=await crypto.subtle.importKey("raw",c.encode(s),{name:"HMAC",hash:o},!1,["sign"]);return await l.generateSignedJwtWithHmac({alg:r,typ:"JWT"},a,h)}};d.encodeBase64Url=e=>h(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_");var g=d,u=class{constructor(e){this._name=e,this._callbacks=[],this._logger=new c(`Event('${this._name}')`)}addHandler(e){return this._callbacks.push(e),()=>this.removeHandler(e)}removeHandler(e){let t=this._callbacks.lastIndexOf(e);t>=0&&this._callbacks.splice(t,1)}async raise(...e){for(let t of(this._logger.debug("raise:",...e),this._callbacks))await t(...e)}},_=class{static center({...e}){var t;return null==e.width&&(e.width=null!=(t=[800,720,600,480].find(e=>e<=window.outerWidth/1.618))?t:360),null!=e.left||(e.left=Math.max(0,Math.round(window.screenX+(window.outerWidth-e.width)/2))),null!=e.height&&(null!=e.top||(e.top=Math.max(0,Math.round(window.screenY+(window.outerHeight-e.height)/2)))),e}static serialize(e){return Object.entries(e).filter(([,e])=>null!=e).map(([e,t])=>`${e}=${"boolean"!=typeof t?t:t?"yes":"no"}`).join(",")}},p=class e extends u{constructor(){super(...arguments),this._logger=new c(`Timer('${this._name}')`),this._timerHandle=null,this._expiration=0,this._callback=()=>{let t=this._expiration-e.getEpochTime();this._logger.debug("timer completes in",t),this._expiration<=e.getEpochTime()&&(this.cancel(),super.raise())}}static getEpochTime(){return Math.floor(Date.now()/1e3)}init(t){let s=this._logger.create("init");t=Math.max(Math.floor(t),1);let i=e.getEpochTime()+t;if(this.expiration===i&&this._timerHandle)return void s.debug("skipping since already initialized for expiration at",this.expiration);this.cancel(),s.debug("using duration",t),this._expiration=i;let r=Math.min(t,5);this._timerHandle=setInterval(this._callback,1e3*r)}get expiration(){return this._expiration}cancel(){this._logger.create("cancel"),this._timerHandle&&(clearInterval(this._timerHandle),this._timerHandle=null)}},w=class{static readParams(e,t="query"){if(!e)throw TypeError("Invalid URL");return new URLSearchParams(new URL(e,"http://127.0.0.1")["fragment"===t?"hash":"search"].slice(1))}},m=class extends Error{constructor(e,t){var s,i,r;if(super(e.error_description||e.error||""),this.form=t,this.name="ErrorResponse",!e.error)throw c.error("ErrorResponse","No error passed"),Error("No error passed");this.error=e.error,this.error_description=null!=(s=e.error_description)?s:null,this.error_uri=null!=(i=e.error_uri)?i:null,this.state=e.userState,this.session_state=null!=(r=e.session_state)?r:null,this.url_state=e.url_state}},f=class extends Error{constructor(e){super(e),this.name="ErrorTimeout"}},S=class{constructor(e){this._logger=new c("AccessTokenEvents"),this._expiringTimer=new p("Access token expiring"),this._expiredTimer=new p("Access token expired"),this._expiringNotificationTimeInSeconds=e.expiringNotificationTimeInSeconds}async load(e){let t=this._logger.create("load");if(e.access_token&&void 0!==e.expires_in){let s=e.expires_in;if(t.debug("access token present, remaining duration:",s),s>0){let e=s-this._expiringNotificationTimeInSeconds;e<=0&&(e=1),t.debug("registering expiring timer, raising in",e,"seconds"),this._expiringTimer.init(e)}else t.debug("canceling existing expiring timer because we're past expiration."),this._expiringTimer.cancel();let i=s+1;t.debug("registering expired timer, raising in",i,"seconds"),this._expiredTimer.init(i)}else this._expiringTimer.cancel(),this._expiredTimer.cancel()}async unload(){this._logger.debug("unload: canceling existing access token timers"),this._expiringTimer.cancel(),this._expiredTimer.cancel()}addAccessTokenExpiring(e){return this._expiringTimer.addHandler(e)}removeAccessTokenExpiring(e){this._expiringTimer.removeHandler(e)}addAccessTokenExpired(e){return this._expiredTimer.addHandler(e)}removeAccessTokenExpired(e){this._expiredTimer.removeHandler(e)}},y=class{constructor(e,t,s,i,r){this._callback=e,this._client_id=t,this._intervalInSeconds=i,this._stopOnError=r,this._logger=new c("CheckSessionIFrame"),this._timer=null,this._session_state=null,this._message=e=>{e.origin===this._frame_origin&&e.source===this._frame.contentWindow&&("error"===e.data?(this._logger.error("error message from check session op iframe"),this._stopOnError&&this.stop()):"changed"===e.data?(this._logger.debug("changed message from check session op iframe"),this.stop(),this._callback()):this._logger.debug(e.data+" message from check session op iframe"))};const n=new URL(s);this._frame_origin=n.origin,this._frame=window.document.createElement("iframe"),this._frame.style.visibility="hidden",this._frame.style.position="fixed",this._frame.style.left="-1000px",this._frame.style.top="0",this._frame.width="0",this._frame.height="0",this._frame.src=n.href}load(){return new Promise(e=>{this._frame.onload=()=>{e()},window.document.body.appendChild(this._frame),window.addEventListener("message",this._message,!1)})}start(e){if(this._session_state===e)return;this._logger.create("start"),this.stop(),this._session_state=e;let t=()=>{this._frame.contentWindow&&this._session_state&&this._frame.contentWindow.postMessage(this._client_id+" "+this._session_state,this._frame_origin)};t(),this._timer=setInterval(t,1e3*this._intervalInSeconds)}stop(){this._logger.create("stop"),this._session_state=null,this._timer&&(clearInterval(this._timer),this._timer=null)}},v=class{constructor(){this._logger=new c("InMemoryWebStorage"),this._data={}}clear(){this._logger.create("clear"),this._data={}}getItem(e){return this._logger.create(`getItem('${e}')`),this._data[e]}setItem(e,t){this._logger.create(`setItem('${e}')`),this._data[e]=t}removeItem(e){this._logger.create(`removeItem('${e}')`),delete this._data[e]}get length(){return Object.getOwnPropertyNames(this._data).length}key(e){return Object.getOwnPropertyNames(this._data)[e]}},b=class extends Error{constructor(e,t){super(t),this.name="ErrorDPoPNonce",this.nonce=e}},k=class{constructor(e=[],t=null,s={}){this._jwtHandler=t,this._extraHeaders=s,this._logger=new c("JsonService"),this._contentTypes=[],this._contentTypes.push(...e,"application/json"),t&&this._contentTypes.push("application/jwt")}async fetchWithTimeout(e,t={}){let{timeoutInSeconds:s,...i}=t;if(!s)return await fetch(e,i);let r=new AbortController,n=setTimeout(()=>r.abort(),1e3*s);try{return await fetch(e,{...t,signal:r.signal})}catch(e){if(e instanceof DOMException&&"AbortError"===e.name)throw new f("Network timed out");throw e}finally{clearTimeout(n)}}async getJson(e,{token:t,credentials:s,timeoutInSeconds:i}={}){let r,n,a=this._logger.create("getJson"),o={Accept:this._contentTypes.join(", ")};t&&(a.debug("token passed, setting Authorization header"),o.Authorization="Bearer "+t),this._appendExtraHeaders(o);try{a.debug("url:",e),r=await this.fetchWithTimeout(e,{method:"GET",headers:o,timeoutInSeconds:i,credentials:s})}catch(e){throw a.error("Network Error"),e}a.debug("HTTP response received, status",r.status);let c=r.headers.get("Content-Type");if(c&&!this._contentTypes.find(e=>c.startsWith(e))&&a.throw(Error(`Invalid response Content-Type: ${null!=c?c:"undefined"}, from URL: ${e}`)),r.ok&&this._jwtHandler&&(null==c?void 0:c.startsWith("application/jwt")))return await this._jwtHandler(await r.text());try{n=await r.json()}catch(e){if(a.error("Error parsing JSON response",e),r.ok)throw e;throw Error(`${r.statusText} (${r.status})`)}if(!r.ok){if(a.error("Error from server:",n),n.error)throw new m(n);throw Error(`${r.statusText} (${r.status}): ${JSON.stringify(n)}`)}return n}async postForm(e,{body:t,basicAuth:s,timeoutInSeconds:i,initCredentials:r,extraHeaders:n}){let a,o=this._logger.create("postForm"),c={Accept:this._contentTypes.join(", "),"Content-Type":"application/x-www-form-urlencoded",...n};void 0!==s&&(c.Authorization="Basic "+s),this._appendExtraHeaders(c);try{o.debug("url:",e),a=await this.fetchWithTimeout(e,{method:"POST",headers:c,body:t,timeoutInSeconds:i,credentials:r})}catch(e){throw o.error("Network error"),e}o.debug("HTTP response received, status",a.status);let l=a.headers.get("Content-Type");if(l&&!this._contentTypes.find(e=>l.startsWith(e)))throw Error(`Invalid response Content-Type: ${null!=l?l:"undefined"}, from URL: ${e}`);let h=await a.text(),d={};if(h)try{d=JSON.parse(h)}catch(e){if(o.error("Error parsing JSON response",e),a.ok)throw e;throw Error(`${a.statusText} (${a.status})`)}if(!a.ok){if(o.error("Error from server:",d),a.headers.has("dpop-nonce"))throw new b(a.headers.get("dpop-nonce"),`${JSON.stringify(d)}`);if(d.error)throw new m(d,t);throw Error(`${a.statusText} (${a.status}): ${JSON.stringify(d)}`)}return d}_appendExtraHeaders(e){let t=this._logger.create("appendExtraHeaders"),s=Object.keys(this._extraHeaders),i=["accept","content-type"],r=["authorization"];0!==s.length&&s.forEach(s=>{if(i.includes(s.toLocaleLowerCase()))return void t.warn("Protected header could not be set",s,i);if(r.includes(s.toLocaleLowerCase())&&Object.keys(e).includes(s))return void t.warn("Header could not be overridden",s,r);let n="function"==typeof this._extraHeaders[s]?this._extraHeaders[s]():this._extraHeaders[s];n&&""!==n&&(e[s]=n)})}},E=class{constructor(e){this._settings=e,this._logger=new c("MetadataService"),this._signingKeys=null,this._metadata=null,this._metadataUrl=this._settings.metadataUrl,this._jsonService=new k(["application/jwk-set+json"],null,this._settings.extraHeaders),this._settings.signingKeys&&(this._logger.debug("using signingKeys from settings"),this._signingKeys=this._settings.signingKeys),this._settings.metadata&&(this._logger.debug("using metadata from settings"),this._metadata=this._settings.metadata),this._settings.fetchRequestCredentials&&(this._logger.debug("using fetchRequestCredentials from settings"),this._fetchRequestCredentials=this._settings.fetchRequestCredentials)}resetSigningKeys(){this._signingKeys=null}async getMetadata(){let e=this._logger.create("getMetadata");if(this._metadata)return e.debug("using cached values"),this._metadata;if(!this._metadataUrl)throw e.throw(Error("No authority or metadataUrl configured on settings")),null;e.debug("getting metadata from",this._metadataUrl);let t=await this._jsonService.getJson(this._metadataUrl,{credentials:this._fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return e.debug("merging remote JSON with seed metadata"),this._metadata=Object.assign({},t,this._settings.metadataSeed),this._metadata}getIssuer(){return this._getMetadataProperty("issuer")}getAuthorizationEndpoint(){return this._getMetadataProperty("authorization_endpoint")}getUserInfoEndpoint(){return this._getMetadataProperty("userinfo_endpoint")}getTokenEndpoint(e=!0){return this._getMetadataProperty("token_endpoint",e)}getCheckSessionIframe(){return this._getMetadataProperty("check_session_iframe",!0)}getEndSessionEndpoint(){return this._getMetadataProperty("end_session_endpoint",!0)}getRevocationEndpoint(e=!0){return this._getMetadataProperty("revocation_endpoint",e)}getKeysEndpoint(e=!0){return this._getMetadataProperty("jwks_uri",e)}async _getMetadataProperty(e,t=!1){let s=this._logger.create(`_getMetadataProperty('${e}')`),i=await this.getMetadata();if(s.debug("resolved"),void 0===i[e]){if(!0===t)return void s.warn("Metadata does not contain optional property");s.throw(Error("Metadata does not contain property "+e))}return i[e]}async getSigningKeys(){let e=this._logger.create("getSigningKeys");if(this._signingKeys)return e.debug("returning signingKeys from cache"),this._signingKeys;let t=await this.getKeysEndpoint(!1);e.debug("got jwks_uri",t);let s=await this._jsonService.getJson(t,{timeoutInSeconds:this._settings.requestTimeoutInSeconds});if(e.debug("got key set",s),!Array.isArray(s.keys))throw e.throw(Error("Missing keys on keyset")),null;return this._signingKeys=s.keys,this._signingKeys}},T=class{constructor({prefix:e="oidc.",store:t=localStorage}={}){this._logger=new c("WebStorageStateStore"),this._store=t,this._prefix=e}async set(e,t){this._logger.create(`set('${e}')`),e=this._prefix+e,await this._store.setItem(e,t)}async get(e){return this._logger.create(`get('${e}')`),e=this._prefix+e,await this._store.getItem(e)}async remove(e){this._logger.create(`remove('${e}')`),e=this._prefix+e;let t=await this._store.getItem(e);return await this._store.removeItem(e),t}async getAllKeys(){this._logger.create("getAllKeys");let e=await this._store.length,t=[];for(let s=0;s<e;s++){let e=await this._store.key(s);e&&0===e.indexOf(this._prefix)&&t.push(e.substr(this._prefix.length))}return t}},x=class{constructor({authority:e,metadataUrl:t,metadata:s,signingKeys:i,metadataSeed:r,client_id:n,client_secret:a,response_type:o="code",scope:c="openid",redirect_uri:l,post_logout_redirect_uri:h,client_authentication:d="client_secret_post",token_endpoint_auth_signing_alg:g="HS256",prompt:u,display:_,max_age:p,ui_locales:w,acr_values:m,resource:f,response_mode:S,filterProtocolClaims:y=!0,loadUserInfo:b=!1,requestTimeoutInSeconds:k,staleStateAgeInSeconds:E=900,mergeClaimsStrategy:x={array:"replace"},disablePKCE:R=!1,stateStore:P,revokeTokenAdditionalContentTypes:C,fetchRequestCredentials:I,refreshTokenAllowedScope:U,extraQueryParams:A={},extraTokenParams:O={},extraHeaders:N={},dpop:j,omitScopeWhenRequesting:q=!1}){var H;if(this.authority=e,t?this.metadataUrl=t:(this.metadataUrl=e,e&&(this.metadataUrl.endsWith("/")||(this.metadataUrl+="/"),this.metadataUrl+=".well-known/openid-configuration")),this.metadata=s,this.metadataSeed=r,this.signingKeys=i,this.client_id=n,this.client_secret=a,this.response_type=o,this.scope=c,this.redirect_uri=l,this.post_logout_redirect_uri=h,this.client_authentication=d,this.token_endpoint_auth_signing_alg=g,this.prompt=u,this.display=_,this.max_age=p,this.ui_locales=w,this.acr_values=m,this.resource=f,this.response_mode=S,this.filterProtocolClaims=null==y||y,this.loadUserInfo=!!b,this.staleStateAgeInSeconds=E,this.mergeClaimsStrategy=x,this.omitScopeWhenRequesting=q,this.disablePKCE=!!R,this.revokeTokenAdditionalContentTypes=C,this.fetchRequestCredentials=I||"same-origin",this.requestTimeoutInSeconds=k,P)this.stateStore=P;else{const e="u">typeof window?window.localStorage:new v;this.stateStore=new T({store:e})}if(this.refreshTokenAllowedScope=U,this.extraQueryParams=A,this.extraTokenParams=O,this.extraHeaders=N,this.dpop=j,this.dpop&&!(null==(H=this.dpop)?void 0:H.store))throw Error("A DPoPStore is required when dpop is enabled")}},R=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new c("UserInfoService"),this._getClaimsFromJwt=async e=>{let t=this._logger.create("_getClaimsFromJwt");try{let s=l.decode(e);return t.debug("JWT decoding successful"),s}catch(e){throw t.error("Error parsing JWT response"),e}},this._jsonService=new k(void 0,this._getClaimsFromJwt,this._settings.extraHeaders)}async getClaims(e){let t=this._logger.create("getClaims");e||this._logger.throw(Error("No token passed"));let s=await this._metadataService.getUserInfoEndpoint();t.debug("got userinfo url",s);let i=await this._jsonService.getJson(s,{token:e,credentials:this._settings.fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return t.debug("got claims",i),i}},P=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new c("TokenClient"),this._jsonService=new k(this._settings.revokeTokenAdditionalContentTypes,null,this._settings.extraHeaders)}async exchangeCode({grant_type:e="authorization_code",redirect_uri:t=this._settings.redirect_uri,client_id:s=this._settings.client_id,client_secret:i=this._settings.client_secret,extraHeaders:r,...n}){let a,o=this._logger.create("exchangeCode");s||o.throw(Error("A client_id is required")),t||o.throw(Error("A redirect_uri is required")),n.code||o.throw(Error("A code is required"));let c=new URLSearchParams({grant_type:e,redirect_uri:t});for(let[e,t]of Object.entries(n))null!=t&&c.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==i)throw o.throw(Error("A client_secret is required")),null;let l=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":a=g.generateBasicAuth(s,i);break;case"client_secret_post":c.append("client_id",s),i&&c.append("client_secret",i);break;case"client_secret_jwt":{let e=await g.generateClientAssertionJwt(s,i,l,this._settings.token_endpoint_auth_signing_alg);c.append("client_id",s),c.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),c.append("client_assertion",e)}}o.debug("got token endpoint");let h=await this._jsonService.postForm(l,{body:c,basicAuth:a,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:r});return o.debug("got response"),h}async exchangeCredentials({grant_type:e="password",client_id:t=this._settings.client_id,client_secret:s=this._settings.client_secret,scope:i=this._settings.scope,...r}){let n,a=this._logger.create("exchangeCredentials");t||a.throw(Error("A client_id is required"));let o=new URLSearchParams({grant_type:e});for(let[e,t]of(this._settings.omitScopeWhenRequesting||o.set("scope",i),Object.entries(r)))null!=t&&o.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==s)throw a.throw(Error("A client_secret is required")),null;let c=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":n=g.generateBasicAuth(t,s);break;case"client_secret_post":o.append("client_id",t),s&&o.append("client_secret",s);break;case"client_secret_jwt":{let e=await g.generateClientAssertionJwt(t,s,c,this._settings.token_endpoint_auth_signing_alg);o.append("client_id",t),o.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),o.append("client_assertion",e)}}a.debug("got token endpoint");let l=await this._jsonService.postForm(c,{body:o,basicAuth:n,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials});return a.debug("got response"),l}async exchangeRefreshToken({grant_type:e="refresh_token",client_id:t=this._settings.client_id,client_secret:s=this._settings.client_secret,timeoutInSeconds:i,extraHeaders:r,...n}){let a,o=this._logger.create("exchangeRefreshToken");t||o.throw(Error("A client_id is required")),n.refresh_token||o.throw(Error("A refresh_token is required"));let c=new URLSearchParams({grant_type:e});for(let[e,t]of Object.entries(n))Array.isArray(t)?t.forEach(t=>c.append(e,t)):null!=t&&c.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==s)throw o.throw(Error("A client_secret is required")),null;let l=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":a=g.generateBasicAuth(t,s);break;case"client_secret_post":c.append("client_id",t),s&&c.append("client_secret",s);break;case"client_secret_jwt":{let e=await g.generateClientAssertionJwt(t,s,l,this._settings.token_endpoint_auth_signing_alg);c.append("client_id",t),c.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),c.append("client_assertion",e)}}o.debug("got token endpoint");let h=await this._jsonService.postForm(l,{body:c,basicAuth:a,timeoutInSeconds:i,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:r});return o.debug("got response"),h}async revoke(e){var t;let s=this._logger.create("revoke");e.token||s.throw(Error("A token is required"));let i=await this._metadataService.getRevocationEndpoint(!1);s.debug(`got revocation endpoint, revoking ${null!=(t=e.token_type_hint)?t:"default token type"}`);let r=new URLSearchParams;for(let[t,s]of Object.entries(e))null!=s&&r.set(t,s);r.set("client_id",this._settings.client_id),this._settings.client_secret&&r.set("client_secret",this._settings.client_secret),await this._jsonService.postForm(i,{body:r,timeoutInSeconds:this._settings.requestTimeoutInSeconds}),s.debug("got response")}},C=class{constructor(e,t,s){this._settings=e,this._metadataService=t,this._claimsService=s,this._logger=new c("ResponseValidator"),this._userInfoService=new R(this._settings,this._metadataService),this._tokenClient=new P(this._settings,this._metadataService)}async validateSigninResponse(e,t,s){let i=this._logger.create("validateSigninResponse");this._processSigninState(e,t),i.debug("state processed"),await this._processCode(e,t,s),i.debug("code processed"),e.isOpenId&&this._validateIdTokenAttributes(e,"",t.nonce),i.debug("tokens validated"),await this._processClaims(e,null==t?void 0:t.skipUserInfo,e.isOpenId),i.debug("claims processed")}async validateCredentialsResponse(e,t){let s=this._logger.create("validateCredentialsResponse"),i=e.isOpenId&&!!e.id_token;i&&this._validateIdTokenAttributes(e),s.debug("tokens validated"),await this._processClaims(e,t,i),s.debug("claims processed")}async validateRefreshResponse(e,t){let s=this._logger.create("validateRefreshResponse");e.userState=t.data,null!=e.session_state||(e.session_state=t.session_state),null!=e.scope||(e.scope=t.scope),e.isOpenId&&e.id_token&&(this._validateIdTokenAttributes(e,t.id_token),s.debug("ID Token validated")),e.id_token||(e.id_token=t.id_token,e.profile=t.profile);let i=e.isOpenId&&!!e.id_token;await this._processClaims(e,!1,i),s.debug("claims processed")}validateSignoutResponse(e,t){let s=this._logger.create("validateSignoutResponse");if(t.id!==e.state&&s.throw(Error("State does not match")),s.debug("state validated"),e.userState=t.data,e.error)throw s.warn("Response was error",e.error),new m(e)}_processSigninState(e,t){let s=this._logger.create("_processSigninState");if(t.id!==e.state&&s.throw(Error("State does not match")),t.client_id||s.throw(Error("No client_id on state")),t.authority||s.throw(Error("No authority on state")),this._settings.authority!==t.authority&&s.throw(Error("authority mismatch on settings vs. signin state")),this._settings.client_id&&this._settings.client_id!==t.client_id&&s.throw(Error("client_id mismatch on settings vs. signin state")),s.debug("state validated"),e.userState=t.data,e.url_state=t.url_state,null!=e.scope||(e.scope=t.scope),e.error)throw s.warn("Response was error",e.error),new m(e);t.code_verifier&&!e.code&&s.throw(Error("Expected code in response"))}async _processClaims(e,t=!1,s=!0){let i=this._logger.create("_processClaims");if(e.profile=this._claimsService.filterProtocolClaims(e.profile),t||!this._settings.loadUserInfo||!e.access_token)return void i.debug("not loading user info");i.debug("loading user info");let r=await this._userInfoService.getClaims(e.access_token);i.debug("user info claims received from user info endpoint"),s&&r.sub!==e.profile.sub&&i.throw(Error("subject from UserInfo response does not match subject in ID Token")),e.profile=this._claimsService.mergeClaims(e.profile,this._claimsService.filterProtocolClaims(r)),i.debug("user info claims received, updated profile:",e.profile)}async _processCode(e,t,s){let i=this._logger.create("_processCode");if(e.code){i.debug("Validating code");let r=await this._tokenClient.exchangeCode({client_id:t.client_id,client_secret:t.client_secret,code:e.code,redirect_uri:t.redirect_uri,code_verifier:t.code_verifier,extraHeaders:s,...t.extraTokenParams});Object.assign(e,r)}else i.debug("No code to process")}_validateIdTokenAttributes(e,t,s){var i;let r=this._logger.create("_validateIdTokenAttributes");r.debug("decoding ID Token JWT");let n=l.decode(null!=(i=e.id_token)?i:"");if(n.sub||r.throw(Error("ID Token is missing a subject claim")),s&&n.nonce!==s&&r.throw(Error("nonce in id_token does not match nonce in client storage")),t){let e=l.decode(t);n.sub!==e.sub&&r.throw(Error("sub in id_token does not match current sub")),n.auth_time&&n.auth_time!==e.auth_time&&r.throw(Error("auth_time in id_token does not match original auth_time")),n.azp&&n.azp!==e.azp&&r.throw(Error("azp in id_token does not match original azp")),!n.azp&&e.azp&&r.throw(Error("azp not in id_token, but present in original id_token"))}e.profile=n}},I=class e{constructor(e){this.id=e.id||g.generateUUIDv4(),this.data=e.data,e.created&&e.created>0?this.created=e.created:this.created=p.getEpochTime(),this.request_type=e.request_type,this.url_state=e.url_state}toStorageString(){return new c("State").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state})}static fromStorageString(t){return c.createStatic("State","fromStorageString"),Promise.resolve(new e(JSON.parse(t)))}static async clearStaleState(t,s){let i=c.createStatic("State","clearStaleState"),r=p.getEpochTime()-s,n=await t.getAllKeys();i.debug("got keys",n);for(let s=0;s<n.length;s++){let a=n[s],o=await t.get(a),c=!1;if(o)try{let t=await e.fromStorageString(o);i.debug("got item from key:",a,t.created),t.created<=r&&(c=!0)}catch(e){i.error("Error parsing state for key:",a,e),c=!0}else i.debug("no item in storage for key:",a),c=!0;c&&(i.debug("removed item for key:",a),t.remove(a))}}},U=class e extends I{constructor(e){super(e),this.code_verifier=e.code_verifier,this.code_challenge=e.code_challenge,this.authority=e.authority,this.client_id=e.client_id,this.redirect_uri=e.redirect_uri,this.scope=e.scope,this.client_secret=e.client_secret,this.extraTokenParams=e.extraTokenParams,this.response_mode=e.response_mode,this.skipUserInfo=e.skipUserInfo,this.nonce=e.nonce}static async create(t){let s=!0===t.code_verifier?g.generateCodeVerifier():t.code_verifier||void 0,i=s?await g.generateCodeChallenge(s):void 0;return new e({...t,code_verifier:s,code_challenge:i})}toStorageString(){return new c("SigninState").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state,code_verifier:this.code_verifier,authority:this.authority,client_id:this.client_id,redirect_uri:this.redirect_uri,scope:this.scope,client_secret:this.client_secret,extraTokenParams:this.extraTokenParams,response_mode:this.response_mode,skipUserInfo:this.skipUserInfo,nonce:this.nonce})}static fromStorageString(t){c.createStatic("SigninState","fromStorageString");let s=JSON.parse(t);return e.create(s)}},A=class e{constructor(e){this.url=e.url,this.state=e.state}static async create({url:t,authority:s,client_id:i,redirect_uri:r,response_type:n,scope:a,state_data:o,response_mode:c,request_type:l,client_secret:h,nonce:d,url_state:g,resource:u,skipUserInfo:_,extraQueryParams:p,extraTokenParams:w,disablePKCE:m,dpopJkt:f,omitScopeWhenRequesting:S,...y}){if(!t)throw this._logger.error("create: No url passed"),Error("url");if(!i)throw this._logger.error("create: No client_id passed"),Error("client_id");if(!r)throw this._logger.error("create: No redirect_uri passed"),Error("redirect_uri");if(!n)throw this._logger.error("create: No response_type passed"),Error("response_type");if(!a)throw this._logger.error("create: No scope passed"),Error("scope");if(!s)throw this._logger.error("create: No authority passed"),Error("authority");let v=await U.create({data:o,request_type:l,url_state:g,code_verifier:!m,client_id:i,authority:s,redirect_uri:r,response_mode:c,client_secret:h,scope:a,extraTokenParams:w,skipUserInfo:_,nonce:d}),b=new URL(t);b.searchParams.append("client_id",i),b.searchParams.append("redirect_uri",r),b.searchParams.append("response_type",n),S||b.searchParams.append("scope",a),d&&b.searchParams.append("nonce",d),f&&b.searchParams.append("dpop_jkt",f);let k=v.id;for(let[e,t]of(g&&(k=`${k};${g}`),b.searchParams.append("state",k),v.code_challenge&&(b.searchParams.append("code_challenge",v.code_challenge),b.searchParams.append("code_challenge_method","S256")),u&&(Array.isArray(u)?u:[u]).forEach(e=>b.searchParams.append("resource",e)),Object.entries({response_mode:c,...y,...p})))null!=t&&b.searchParams.append(e,t.toString());return new e({url:b.href,state:v})}};A._logger=new c("SigninRequest");var O=class{constructor(e){if(this.access_token="",this.token_type="",this.profile={},this.state=e.get("state"),this.session_state=e.get("session_state"),this.state){const e=decodeURIComponent(this.state).split(";");this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(";"))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri"),this.code=e.get("code")}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-p.getEpochTime()}set expires_in(e){"string"==typeof e&&(e=Number(e)),void 0!==e&&e>=0&&(this.expires_at=Math.floor(e)+p.getEpochTime())}get isOpenId(){var e;return(null==(e=this.scope)?void 0:e.split(" ").includes("openid"))||!!this.id_token}},N=class{constructor({url:e,state_data:t,id_token_hint:s,post_logout_redirect_uri:i,extraQueryParams:r,request_type:n,client_id:a,url_state:o}){if(this._logger=new c("SignoutRequest"),!e)throw this._logger.error("ctor: No url passed"),Error("url");const l=new URL(e);if(s&&l.searchParams.append("id_token_hint",s),a&&l.searchParams.append("client_id",a),i&&(l.searchParams.append("post_logout_redirect_uri",i),t||o)){this.state=new I({data:t,request_type:n,url_state:o});let e=this.state.id;o&&(e=`${e};${o}`),l.searchParams.append("state",e)}for(const[e,t]of Object.entries({...r}))null!=t&&l.searchParams.append(e,t.toString());this.url=l.href}},j=class{constructor(e){if(this.state=e.get("state"),this.state){const e=decodeURIComponent(this.state).split(";");this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(";"))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri")}},q=["nbf","jti","auth_time","nonce","acr","amr","azp","at_hash"],H=["sub","iss","aud","exp","iat"],M=class{constructor(e){this._settings=e,this._logger=new c("ClaimsService")}filterProtocolClaims(e){let t={...e};if(this._settings.filterProtocolClaims){for(let e of Array.isArray(this._settings.filterProtocolClaims)?this._settings.filterProtocolClaims:q)H.includes(e)||delete t[e]}return t}mergeClaims(e,t){let s={...e};for(let[e,i]of Object.entries(t))if(s[e]!==i)if(Array.isArray(s[e])||Array.isArray(i))if("replace"==this._settings.mergeClaimsStrategy.array)s[e]=i;else{let t=Array.isArray(s[e])?s[e]:[s[e]];for(let e of Array.isArray(i)?i:[i])t.includes(e)||t.push(e);s[e]=t}else"object"==typeof s[e]&&"object"==typeof i?s[e]=this.mergeClaims(s[e],i):s[e]=i;return s}},$=class{constructor(e,t){this.keys=e,this.nonce=t}},J=class{constructor(e,t){this._logger=new c("OidcClient"),this.settings=e instanceof x?e:new x(e),this.metadataService=null!=t?t:new E(this.settings),this._claimsService=new M(this.settings),this._validator=new C(this.settings,this.metadataService,this._claimsService),this._tokenClient=new P(this.settings,this.metadataService)}async createSigninRequest({state:e,request:t,request_uri:s,request_type:i,id_token_hint:r,login_hint:n,skipUserInfo:a,nonce:o,url_state:c,response_type:l=this.settings.response_type,scope:h=this.settings.scope,redirect_uri:d=this.settings.redirect_uri,prompt:g=this.settings.prompt,display:u=this.settings.display,max_age:_=this.settings.max_age,ui_locales:p=this.settings.ui_locales,acr_values:w=this.settings.acr_values,resource:m=this.settings.resource,response_mode:f=this.settings.response_mode,extraQueryParams:S=this.settings.extraQueryParams,extraTokenParams:y=this.settings.extraTokenParams,dpopJkt:v,omitScopeWhenRequesting:b=this.settings.omitScopeWhenRequesting}){let k=this._logger.create("createSigninRequest");if("code"!==l)throw Error("Only the Authorization Code flow (with PKCE) is supported");let E=await this.metadataService.getAuthorizationEndpoint();k.debug("Received authorization endpoint",E);let T=await A.create({url:E,authority:this.settings.authority,client_id:this.settings.client_id,redirect_uri:d,response_type:l,scope:h,state_data:e,url_state:c,prompt:g,display:u,max_age:_,ui_locales:p,id_token_hint:r,login_hint:n,acr_values:w,dpopJkt:v,resource:m,request:t,request_uri:s,extraQueryParams:S,extraTokenParams:y,request_type:i,response_mode:f,client_secret:this.settings.client_secret,skipUserInfo:a,nonce:o,disablePKCE:this.settings.disablePKCE,omitScopeWhenRequesting:b});await this.clearStaleState();let x=T.state;return await this.settings.stateStore.set(x.id,x.toStorageString()),T}async readSigninResponseState(e,t=!1){let s=this._logger.create("readSigninResponseState"),i=new O(w.readParams(e,this.settings.response_mode));if(!i.state)throw s.throw(Error("No state in response")),null;let r=await this.settings.stateStore[t?"remove":"get"](i.state);if(!r)throw s.throw(Error("No matching state found in storage")),null;return{state:await U.fromStorageString(r),response:i}}async processSigninResponse(e,t,s=!0){let i=this._logger.create("processSigninResponse"),{state:r,response:n}=await this.readSigninResponseState(e,s);if(i.debug("received state from storage; validating response"),this.settings.dpop&&this.settings.dpop.store){let e=await this.getDpopProof(this.settings.dpop.store);t={...t,DPoP:e}}try{await this._validator.validateSigninResponse(n,r,t)}catch(e){if(e instanceof b&&this.settings.dpop){let s=await this.getDpopProof(this.settings.dpop.store,e.nonce);t.DPoP=s,await this._validator.validateSigninResponse(n,r,t)}else throw e}return n}async getDpopProof(e,t){let s;return(await e.getAllKeys()).includes(this.settings.client_id)?(s=await e.get(this.settings.client_id)).nonce!==t&&t&&(s.nonce=t,await e.set(this.settings.client_id,s)):(s=new $(await g.generateDPoPKeys(),t),await e.set(this.settings.client_id,s)),await g.generateDPoPProof({url:await this.metadataService.getTokenEndpoint(!1),httpMethod:"POST",keyPair:s.keys,nonce:s.nonce})}async processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:s=!1,extraTokenParams:i={}}){let r=await this._tokenClient.exchangeCredentials({username:e,password:t,...i}),n=new O(new URLSearchParams);return Object.assign(n,r),await this._validator.validateCredentialsResponse(n,s),n}async useRefreshToken({state:e,redirect_uri:t,resource:s,timeoutInSeconds:i,extraHeaders:r,extraTokenParams:n}){var a;let o,c,l=this._logger.create("useRefreshToken");if(void 0===this.settings.refreshTokenAllowedScope)o=e.scope;else{let t=this.settings.refreshTokenAllowedScope.split(" ");o=((null==(a=e.scope)?void 0:a.split(" "))||[]).filter(e=>t.includes(e)).join(" ")}if(this.settings.dpop&&this.settings.dpop.store){let e=await this.getDpopProof(this.settings.dpop.store);r={...r,DPoP:e}}try{c=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:o,redirect_uri:t,resource:s,timeoutInSeconds:i,extraHeaders:r,...n})}catch(a){if(a instanceof b&&this.settings.dpop)r.DPoP=await this.getDpopProof(this.settings.dpop.store,a.nonce),c=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:o,redirect_uri:t,resource:s,timeoutInSeconds:i,extraHeaders:r,...n});else throw a}let h=new O(new URLSearchParams);return Object.assign(h,c),l.debug("validating response",h),await this._validator.validateRefreshResponse(h,{...e,scope:o}),h}async createSignoutRequest({state:e,id_token_hint:t,client_id:s,request_type:i,url_state:r,post_logout_redirect_uri:n=this.settings.post_logout_redirect_uri,extraQueryParams:a=this.settings.extraQueryParams}={}){let o=this._logger.create("createSignoutRequest"),c=await this.metadataService.getEndSessionEndpoint();if(!c)throw o.throw(Error("No end session endpoint")),null;o.debug("Received end session endpoint",c),s||!n||t||(s=this.settings.client_id);let l=new N({url:c,id_token_hint:t,client_id:s,post_logout_redirect_uri:n,state_data:e,extraQueryParams:a,request_type:i,url_state:r});await this.clearStaleState();let h=l.state;return h&&(o.debug("Signout request has state to persist"),await this.settings.stateStore.set(h.id,h.toStorageString())),l}async readSignoutResponseState(e,t=!1){let s=this._logger.create("readSignoutResponseState"),i=new j(w.readParams(e,this.settings.response_mode));if(!i.state){if(s.debug("No state in response"),i.error)throw s.warn("Response was error:",i.error),new m(i);return{state:void 0,response:i}}let r=await this.settings.stateStore[t?"remove":"get"](i.state);if(!r)throw s.throw(Error("No matching state found in storage")),null;return{state:await I.fromStorageString(r),response:i}}async processSignoutResponse(e){let t=this._logger.create("processSignoutResponse"),{state:s,response:i}=await this.readSignoutResponseState(e,!0);return s?(t.debug("Received state from storage; validating response"),this._validator.validateSignoutResponse(i,s)):t.debug("No state from storage; skipping response validation"),i}clearStaleState(){return this._logger.create("clearStaleState"),I.clearStaleState(this.settings.stateStore,this.settings.staleStateAgeInSeconds)}async revokeToken(e,t){return this._logger.create("revokeToken"),await this._tokenClient.revoke({token:e,token_type_hint:t})}},D=class{constructor(e){this._userManager=e,this._logger=new c("SessionMonitor"),this._start=async e=>{let t=e.session_state;if(!t)return;let s=this._logger.create("_start");if(e.profile?(this._sub=e.profile.sub,s.debug("session_state",t,", sub",this._sub)):(this._sub=void 0,s.debug("session_state",t,", anonymous user")),this._checkSessionIFrame)return void this._checkSessionIFrame.start(t);try{let e=await this._userManager.metadataService.getCheckSessionIframe();if(e){s.debug("initializing check session iframe");let i=this._userManager.settings.client_id,r=this._userManager.settings.checkSessionIntervalInSeconds,n=this._userManager.settings.stopCheckSessionOnError,a=new y(this._callback,i,e,r,n);await a.load(),this._checkSessionIFrame=a,a.start(t)}else s.warn("no check session iframe found in the metadata")}catch(e){s.error("Error from getCheckSessionIframe:",e instanceof Error?e.message:e)}},this._stop=()=>{let e=this._logger.create("_stop");if(this._sub=void 0,this._checkSessionIFrame&&this._checkSessionIFrame.stop(),this._userManager.settings.monitorAnonymousSession){let t=setInterval(async()=>{clearInterval(t);try{let e=await this._userManager.querySessionStatus();if(e){let t={session_state:e.session_state,profile:e.sub?{sub:e.sub}:null};this._start(t)}}catch(t){e.error("error from querySessionStatus",t instanceof Error?t.message:t)}},1e3)}},this._callback=async()=>{let e=this._logger.create("_callback");try{let t=await this._userManager.querySessionStatus(),s=!0;t&&this._checkSessionIFrame?t.sub===this._sub?(s=!1,this._checkSessionIFrame.start(t.session_state),e.debug("same sub still logged in at OP, session state has changed, restarting check session iframe; session_state",t.session_state),await this._userManager.events._raiseUserSessionChanged()):e.debug("different subject signed into OP",t.sub):e.debug("subject no longer signed into OP"),s?this._sub?await this._userManager.events._raiseUserSignedOut():await this._userManager.events._raiseUserSignedIn():e.debug("no change in session detected, no event to raise")}catch(t){this._sub&&(e.debug("Error calling queryCurrentSigninSession; raising signed out event",t),await this._userManager.events._raiseUserSignedOut())}},e||this._logger.throw(Error("No user manager passed")),this._userManager.events.addUserLoaded(this._start),this._userManager.events.addUserUnloaded(this._stop),this._init().catch(e=>{this._logger.error(e)})}async _init(){this._logger.create("_init");let e=await this._userManager.getUser();if(e)this._start(e);else if(this._userManager.settings.monitorAnonymousSession){let e=await this._userManager.querySessionStatus();if(e){let t={session_state:e.session_state,profile:e.sub?{sub:e.sub}:null};this._start(t)}}}},K=class e{constructor(e){var t;this.id_token=e.id_token,this.session_state=null!=(t=e.session_state)?t:null,this.access_token=e.access_token,this.refresh_token=e.refresh_token,this.token_type=e.token_type,this.scope=e.scope,this.profile=e.profile,this.expires_at=e.expires_at,this.state=e.userState,this.url_state=e.url_state}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-p.getEpochTime()}set expires_in(e){void 0!==e&&(this.expires_at=Math.floor(e)+p.getEpochTime())}get expired(){let e=this.expires_in;if(void 0!==e)return e<=0}get scopes(){var e,t;return null!=(t=null==(e=this.scope)?void 0:e.split(" "))?t:[]}toStorageString(){return new c("User").create("toStorageString"),JSON.stringify({id_token:this.id_token,session_state:this.session_state,access_token:this.access_token,refresh_token:this.refresh_token,token_type:this.token_type,scope:this.scope,profile:this.profile,expires_at:this.expires_at})}static fromStorageString(t){return c.createStatic("User","fromStorageString"),new e(JSON.parse(t))}},L="oidc-client",W=class{constructor(){this._abort=new u("Window navigation aborted"),this._disposeHandlers=new Set,this._window=null}async navigate(e){let t=this._logger.create("navigate");if(!this._window)throw Error("Attempted to navigate on a disposed window");t.debug("setting URL in window"),this._window.location.replace(e.url);let{url:s,keepOpen:i}=await new Promise((s,i)=>{let r=r=>{var n;let a=r.data,o=null!=(n=e.scriptOrigin)?n:window.location.origin;if(r.origin===o&&(null==a?void 0:a.source)===L){try{let s=w.readParams(a.url,e.response_mode).get("state");if(s||t.warn("no state found in response url"),r.source!==this._window&&s!==e.state)return}catch{this._dispose(),i(Error("Invalid response from window"))}s(a)}};window.addEventListener("message",r,!1),this._disposeHandlers.add(()=>window.removeEventListener("message",r,!1));let n=new BroadcastChannel(`oidc-client-popup-${e.state}`);n.addEventListener("message",r,!1),this._disposeHandlers.add(()=>n.close()),this._disposeHandlers.add(this._abort.addHandler(e=>{this._dispose(),i(e)}))});return t.debug("got response from window"),this._dispose(),i||this.close(),{url:s}}_dispose(){for(let e of(this._logger.create("_dispose"),this._disposeHandlers))e();this._disposeHandlers.clear()}static _notifyParent(e,t,s=!1,i=window.location.origin){let r={source:L,url:t,keepOpen:s},n=new c("_notifyParent");if(e)n.debug("With parent. Using parent.postMessage."),e.postMessage(r,i);else{n.debug("No parent. Using BroadcastChannel.");let e=new URL(t).searchParams.get("state");if(!e)throw Error("No parent and no state in URL. Can't complete notification.");let s=new BroadcastChannel(`oidc-client-popup-${e}`);s.postMessage(r),s.close()}}},z={location:!1,toolbar:!1,height:640,closePopupWindowAfterInSeconds:-1},F="_blank",B=class extends x{constructor(e){const{popup_redirect_uri:t=e.redirect_uri,popup_post_logout_redirect_uri:s=e.post_logout_redirect_uri,popupWindowFeatures:i=z,popupWindowTarget:r=F,redirectMethod:n="assign",redirectTarget:a="self",iframeNotifyParentOrigin:o=e.iframeNotifyParentOrigin,iframeScriptOrigin:c=e.iframeScriptOrigin,requestTimeoutInSeconds:l,silent_redirect_uri:h=e.redirect_uri,silentRequestTimeoutInSeconds:d,automaticSilentRenew:g=!0,validateSubOnSilentRenew:u=!0,includeIdTokenInSilentRenew:_=!1,monitorSession:p=!1,monitorAnonymousSession:w=!1,checkSessionIntervalInSeconds:m=2,query_status_response_type:f="code",stopCheckSessionOnError:S=!0,revokeTokenTypes:y=["access_token","refresh_token"],revokeTokensOnSignout:b=!1,includeIdTokenInSilentSignout:k=!1,accessTokenExpiringNotificationTimeInSeconds:E=60,maxSilentRenewTimeoutRetries:x,userStore:R}=e;if(super(e),this.popup_redirect_uri=t,this.popup_post_logout_redirect_uri=s,this.popupWindowFeatures=i,this.popupWindowTarget=r,this.redirectMethod=n,this.redirectTarget=a,this.iframeNotifyParentOrigin=o,this.iframeScriptOrigin=c,this.silent_redirect_uri=h,this.silentRequestTimeoutInSeconds=d||l||10,this.automaticSilentRenew=g,this.validateSubOnSilentRenew=u,this.includeIdTokenInSilentRenew=_,this.monitorSession=p,this.monitorAnonymousSession=w,this.checkSessionIntervalInSeconds=m,this.stopCheckSessionOnError=S,this.query_status_response_type=f,this.revokeTokenTypes=y,this.revokeTokensOnSignout=b,this.includeIdTokenInSilentSignout=k,this.accessTokenExpiringNotificationTimeInSeconds=E,this.maxSilentRenewTimeoutRetries=x,R)this.userStore=R;else{const e="u">typeof window?window.sessionStorage:new v;this.userStore=new T({store:e})}}},V=class e extends W{constructor({silentRequestTimeoutInSeconds:t=10}){super(),this._logger=new c("IFrameWindow"),this._timeoutInSeconds=t,this._frame=e.createHiddenIframe(),this._window=this._frame.contentWindow}static createHiddenIframe(){let e=window.document.createElement("iframe");return e.style.visibility="hidden",e.style.position="fixed",e.style.left="-1000px",e.style.top="0",e.width="0",e.height="0",window.document.body.appendChild(e),e}async navigate(e){this._logger.debug("navigate: Using timeout of:",this._timeoutInSeconds);let t=setTimeout(()=>void this._abort.raise(new f("IFrame timed out without a response")),1e3*this._timeoutInSeconds);return this._disposeHandlers.add(()=>clearTimeout(t)),await super.navigate(e)}close(){var e;this._frame&&(this._frame.parentNode&&(this._frame.addEventListener("load",e=>{var t;let s=e.target;null==(t=s.parentNode)||t.removeChild(s),this._abort.raise(Error("IFrame removed from DOM"))},!0),null==(e=this._frame.contentWindow)||e.location.replace("about:blank")),this._frame=null),this._window=null}static notifyParent(e,t){return super._notifyParent(window.parent,e,!1,t)}},G=class{constructor(e){this._settings=e,this._logger=new c("IFrameNavigator")}async prepare({silentRequestTimeoutInSeconds:e=this._settings.silentRequestTimeoutInSeconds}){return new V({silentRequestTimeoutInSeconds:e})}async callback(e){this._logger.create("callback"),V.notifyParent(e,this._settings.iframeNotifyParentOrigin)}},Q=class extends W{constructor({popupWindowTarget:e=F,popupWindowFeatures:t={},popupSignal:s,popupAbortOnClose:i}){super(),this._logger=new c("PopupWindow");const r=_.center({...z,...t});this._window=window.open(void 0,e,_.serialize(r)),this.abortOnClose=!!i,s&&s.addEventListener("abort",()=>{var e;this._abort.raise(Error(null!=(e=s.reason)?e:"Popup aborted"))}),t.closePopupWindowAfterInSeconds&&t.closePopupWindowAfterInSeconds>0&&setTimeout(()=>{!this._window||"boolean"!=typeof this._window.closed||this._window.closed?this._abort.raise(Error("Popup blocked by user")):this.close()},1e3*t.closePopupWindowAfterInSeconds)}async navigate(e){var t;null==(t=this._window)||t.focus();let s=setInterval(()=>{(!this._window||this._window.closed)&&(this._logger.debug("Popup closed by user or isolated by redirect"),i(),this._disposeHandlers.delete(i),this.abortOnClose&&this._abort.raise(Error("Popup closed by user")))},500),i=()=>clearInterval(s);return this._disposeHandlers.add(i),await super.navigate(e)}close(){this._window&&!this._window.closed&&(this._window.close(),this._abort.raise(Error("Popup closed"))),this._window=null}static notifyOpener(e,t){super._notifyParent(window.opener,e,t),t||window.opener||window.close()}},X=class{constructor(e){this._settings=e,this._logger=new c("PopupNavigator")}async prepare({popupWindowFeatures:e=this._settings.popupWindowFeatures,popupWindowTarget:t=this._settings.popupWindowTarget,popupSignal:s,popupAbortOnClose:i}){return new Q({popupWindowFeatures:e,popupWindowTarget:t,popupSignal:s,popupAbortOnClose:i})}async callback(e,{keepOpen:t=!1}){this._logger.create("callback"),Q.notifyOpener(e,t)}},Y=class{constructor(e){this._settings=e,this._logger=new c("RedirectNavigator")}async prepare({redirectMethod:e=this._settings.redirectMethod,redirectTarget:t=this._settings.redirectTarget}){var s;let i;this._logger.create("prepare");let r=window.self;"top"===t&&(r=null!=(s=window.top)?s:window.self);let n=r.location[e].bind(r.location);return{navigate:async e=>{this._logger.create("navigate");let t=new Promise((t,s)=>{i=s,window.addEventListener("pageshow",()=>t(window.location.href)),n(e.url)});return await t},close:()=>{this._logger.create("close"),null==i||i(Error("Redirect aborted")),r.stop()}}}async callback(){}},Z=class extends S{constructor(e){super({expiringNotificationTimeInSeconds:e.accessTokenExpiringNotificationTimeInSeconds}),this._logger=new c("UserManagerEvents"),this._userLoaded=new u("User loaded"),this._userUnloaded=new u("User unloaded"),this._silentRenewError=new u("Silent renew error"),this._userSignedIn=new u("User signed in"),this._userSignedOut=new u("User signed out"),this._userSessionChanged=new u("User session changed")}async load(e,t=!0){await super.load(e),t&&await this._userLoaded.raise(e)}async unload(){await super.unload(),await this._userUnloaded.raise()}addUserLoaded(e){return this._userLoaded.addHandler(e)}removeUserLoaded(e){return this._userLoaded.removeHandler(e)}addUserUnloaded(e){return this._userUnloaded.addHandler(e)}removeUserUnloaded(e){return this._userUnloaded.removeHandler(e)}addSilentRenewError(e){return this._silentRenewError.addHandler(e)}removeSilentRenewError(e){return this._silentRenewError.removeHandler(e)}async _raiseSilentRenewError(e){await this._silentRenewError.raise(e)}addUserSignedIn(e){return this._userSignedIn.addHandler(e)}removeUserSignedIn(e){this._userSignedIn.removeHandler(e)}async _raiseUserSignedIn(){await this._userSignedIn.raise()}addUserSignedOut(e){return this._userSignedOut.addHandler(e)}removeUserSignedOut(e){this._userSignedOut.removeHandler(e)}async _raiseUserSignedOut(){await this._userSignedOut.raise()}addUserSessionChanged(e){return this._userSessionChanged.addHandler(e)}removeUserSessionChanged(e){this._userSessionChanged.removeHandler(e)}async _raiseUserSessionChanged(){await this._userSessionChanged.raise()}},ee=class{constructor(e){this._userManager=e,this._logger=new c("SilentRenewService"),this._isStarted=!1,this._retryTimer=new p("Retry Silent Renew"),this._timeoutRetryCount=0,this._tokenExpiring=async()=>{let e=this._logger.create("_tokenExpiring");try{await this._userManager.signinSilent(),this._timeoutRetryCount=0,e.debug("silent token renewal successful")}catch(t){if(t instanceof f){this._timeoutRetryCount++;let s=this._userManager.settings.maxSilentRenewTimeoutRetries;if(void 0!==s&&this._timeoutRetryCount>s){e.error(`Timeout retry limit reached (${this._timeoutRetryCount} > ${s}), raising silentRenewError:`,t),this._timeoutRetryCount=0,await this._userManager.events._raiseSilentRenewError(t);return}e.warn(`ErrorTimeout from signinSilent (attempt ${this._timeoutRetryCount}), retry in 5s:`,t),this._retryTimer.init(5);return}e.error("Error from signinSilent:",t),this._timeoutRetryCount=0,await this._userManager.events._raiseSilentRenewError(t)}}}async start(){let e=this._logger.create("start");if(!this._isStarted){this._isStarted=!0,this._userManager.events.addAccessTokenExpiring(this._tokenExpiring),this._retryTimer.addHandler(this._tokenExpiring);try{await this._userManager.getUser()}catch(t){e.error("getUser error",t)}}}stop(){this._isStarted&&(this._retryTimer.cancel(),this._retryTimer.removeHandler(this._tokenExpiring),this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring),this._isStarted=!1)}},et=class{constructor(e){this.refresh_token=e.refresh_token,this.id_token=e.id_token,this.session_state=e.session_state,this.scope=e.scope,this.profile=e.profile,this.data=e.state}},es=class{constructor(e,t,s,i){this._logger=new c("UserManager"),this.settings=new B(e),this._client=new J(e),this._redirectNavigator=null!=t?t:new Y(this.settings),this._popupNavigator=null!=s?s:new X(this.settings),this._iframeNavigator=null!=i?i:new G(this.settings),this._events=new Z(this.settings),this._silentRenewService=new ee(this),this.settings.automaticSilentRenew&&this.startSilentRenew(),this._sessionMonitor=null,this.settings.monitorSession&&(this._sessionMonitor=new D(this))}get events(){return this._events}get metadataService(){return this._client.metadataService}async getUser(e=!1){let t=this._logger.create("getUser"),s=await this._loadUser();return s?(t.info("user loaded"),await this._events.load(s,e),s):(t.info("user not found in storage"),null)}async removeUser(){let e=this._logger.create("removeUser");await this.storeUser(null),e.info("user removed from storage"),await this._events.unload()}async signinRedirect(e={}){var t;let s;this._logger.create("signinRedirect");let{redirectMethod:i,...r}=e;(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(s=await this.generateDPoPJkt(this.settings.dpop));let n=await this._redirectNavigator.prepare({redirectMethod:i});await this._signinStart({request_type:"si:r",dpopJkt:s,...r},n)}async signinRedirectCallback(e=window.location.href){let t=this._logger.create("signinRedirectCallback"),s=await this._signinEnd(e);return s.profile&&s.profile.sub?t.info("success, signed in subject",s.profile.sub):t.info("no subject"),s}async signinResourceOwnerCredentials({username:e,password:t,skipUserInfo:s=!1}){let i=this._logger.create("signinResourceOwnerCredential"),r=await this._client.processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:s,extraTokenParams:this.settings.extraTokenParams});i.debug("got signin response");let n=await this._buildUser(r);return n.profile&&n.profile.sub?i.info("success, signed in subject",n.profile.sub):i.info("no subject"),n}async signinPopup(e={}){var t;let s,i=this._logger.create("signinPopup");(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(s=await this.generateDPoPJkt(this.settings.dpop));let{popupWindowFeatures:r,popupWindowTarget:n,popupSignal:a,popupAbortOnClose:o,...c}=e,l=this.settings.popup_redirect_uri;l||i.throw(Error("No popup_redirect_uri configured"));let h=await this._popupNavigator.prepare({popupWindowFeatures:r,popupWindowTarget:n,popupSignal:a,popupAbortOnClose:o}),d=await this._signin({request_type:"si:p",redirect_uri:l,display:"popup",dpopJkt:s,...c},h);return d&&(d.profile&&d.profile.sub?i.info("success, signed in subject",d.profile.sub):i.info("no subject")),d}async signinPopupCallback(e=window.location.href,t=!1){let s=this._logger.create("signinPopupCallback");await this._popupNavigator.callback(e,{keepOpen:t}),s.info("success")}async signinSilent(e={}){var t,s;let i,r,n=this._logger.create("signinSilent"),{silentRequestTimeoutInSeconds:a,...o}=e,c=await this._loadUser();if(!e.forceIframeAuth&&(null==c?void 0:c.refresh_token)){n.debug("using refresh token");let e=new et(c);return await this._useRefreshToken({state:e,redirect_uri:o.redirect_uri,resource:o.resource,extraTokenParams:o.extraTokenParams,timeoutInSeconds:a})}(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(i=await this.generateDPoPJkt(this.settings.dpop));let l=this.settings.silent_redirect_uri;l||n.throw(Error("No silent_redirect_uri configured")),c&&this.settings.validateSubOnSilentRenew&&(n.debug("subject prior to silent renew:",c.profile.sub),r=c.profile.sub);let h=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:a});return(c=await this._signin({request_type:"si:s",redirect_uri:l,prompt:"none",id_token_hint:this.settings.includeIdTokenInSilentRenew?null==c?void 0:c.id_token:void 0,dpopJkt:i,...o},h,r))&&((null==(s=c.profile)?void 0:s.sub)?n.info("success, signed in subject",c.profile.sub):n.info("no subject")),c}async _useRefreshToken(e){let t=await this._client.useRefreshToken({timeoutInSeconds:this.settings.silentRequestTimeoutInSeconds,...e}),s=new K({...e.state,...t});return await this.storeUser(s),await this._events.load(s),s}async signinSilentCallback(e=window.location.href){let t=this._logger.create("signinSilentCallback");await this._iframeNavigator.callback(e),t.info("success")}async signinCallback(e=window.location.href){let{state:t}=await this._client.readSigninResponseState(e);switch(t.request_type){case"si:r":return await this.signinRedirectCallback(e);case"si:p":await this.signinPopupCallback(e);break;case"si:s":await this.signinSilentCallback(e);break;default:throw Error("invalid request_type in state")}}async signoutCallback(e=window.location.href,t=!1){let{state:s}=await this._client.readSignoutResponseState(e);if(s)switch(s.request_type){case"so:r":return await this.signoutRedirectCallback(e);case"so:p":await this.signoutPopupCallback(e,t);break;case"so:s":await this.signoutSilentCallback(e);break;default:throw Error("invalid request_type in state")}}async querySessionStatus(e={}){let t=this._logger.create("querySessionStatus"),{silentRequestTimeoutInSeconds:s,...i}=e,r=this.settings.silent_redirect_uri;r||t.throw(Error("No silent_redirect_uri configured"));let n=await this._loadUser(),a=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:s}),o=await this._signinStart({request_type:"si:s",redirect_uri:r,prompt:"none",id_token_hint:this.settings.includeIdTokenInSilentRenew?null==n?void 0:n.id_token:void 0,response_type:this.settings.query_status_response_type,scope:"openid",skipUserInfo:!0,...i},a);try{let e=await this._client.processSigninResponse(o.url,{});if(t.debug("got signin response"),e.session_state&&e.profile.sub)return t.info("success for subject",e.profile.sub),{session_state:e.session_state,sub:e.profile.sub};return t.info("success, user not authenticated"),null}catch(e){if(this.settings.monitorAnonymousSession&&e instanceof m)switch(e.error){case"login_required":case"consent_required":case"interaction_required":case"account_selection_required":return t.info("success for anonymous user"),{session_state:e.session_state}}throw e}}async _signin(e,t,s){let i=await this._signinStart(e,t);return await this._signinEnd(i.url,s)}async _signinStart(e,t){let s=this._logger.create("_signinStart");try{let i=await this._client.createSigninRequest(e);return s.debug("got signin request"),await t.navigate({url:i.url,state:i.state.id,response_mode:i.state.response_mode,scriptOrigin:this.settings.iframeScriptOrigin})}catch(e){throw s.debug("error after preparing navigator, closing navigator window"),t.close(),e}}async _signinEnd(e,t){let s=this._logger.create("_signinEnd"),i=await this._client.processSigninResponse(e,{});return s.debug("got signin response"),await this._buildUser(i,t)}async _buildUser(e,t){let s=this._logger.create("_buildUser"),i=new K(e);if(t){if(t!==i.profile.sub)throw s.debug("current user does not match user returned from signin. sub from signin:",i.profile.sub),new m({...e,error:"login_required"});s.debug("current user matches user returned from signin")}return await this.storeUser(i),s.debug("user stored"),await this._events.load(i),i}async signoutRedirect(e={}){let t=this._logger.create("signoutRedirect"),{redirectMethod:s,...i}=e,r=await this._redirectNavigator.prepare({redirectMethod:s});await this._signoutStart({request_type:"so:r",post_logout_redirect_uri:this.settings.post_logout_redirect_uri,...i},r),t.info("success")}async signoutRedirectCallback(e=window.location.href){let t=this._logger.create("signoutRedirectCallback"),s=await this._signoutEnd(e);return t.info("success"),s}async signoutPopup(e={}){let t=this._logger.create("signoutPopup"),{popupWindowFeatures:s,popupWindowTarget:i,popupSignal:r,...n}=e,a=this.settings.popup_post_logout_redirect_uri,o=await this._popupNavigator.prepare({popupWindowFeatures:s,popupWindowTarget:i,popupSignal:r});await this._signout({request_type:"so:p",post_logout_redirect_uri:a,state:null==a?void 0:{},...n},o),t.info("success")}async signoutPopupCallback(e=window.location.href,t=!1){let s=this._logger.create("signoutPopupCallback");await this._popupNavigator.callback(e,{keepOpen:t}),s.info("success")}async _signout(e,t){let s=await this._signoutStart(e,t);return await this._signoutEnd(s.url)}async _signoutStart(e={},t){var s;let i=this._logger.create("_signoutStart");try{let r=await this._loadUser();i.debug("loaded current user from storage"),this.settings.revokeTokensOnSignout&&await this._revokeInternal(r);let n=e.id_token_hint||r&&r.id_token;n&&(i.debug("setting id_token_hint in signout request"),e.id_token_hint=n),await this.removeUser(),i.debug("user removed, creating signout request");let a=await this._client.createSignoutRequest(e);return i.debug("got signout request"),await t.navigate({url:a.url,state:null==(s=a.state)?void 0:s.id,scriptOrigin:this.settings.iframeScriptOrigin})}catch(e){throw i.debug("error after preparing navigator, closing navigator window"),t.close(),e}}async _signoutEnd(e){let t=this._logger.create("_signoutEnd"),s=await this._client.processSignoutResponse(e);return t.debug("got signout response"),s}async signoutSilent(e={}){var t;let s=this._logger.create("signoutSilent"),{silentRequestTimeoutInSeconds:i,...r}=e,n=this.settings.includeIdTokenInSilentSignout?null==(t=await this._loadUser())?void 0:t.id_token:void 0,a=this.settings.popup_post_logout_redirect_uri,o=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:i});await this._signout({request_type:"so:s",post_logout_redirect_uri:a,id_token_hint:n,...r},o),s.info("success")}async signoutSilentCallback(e=window.location.href){let t=this._logger.create("signoutSilentCallback");await this._iframeNavigator.callback(e),t.info("success")}async revokeTokens(e){let t=await this._loadUser();await this._revokeInternal(t,e)}async _revokeInternal(e,t=this.settings.revokeTokenTypes){let s=this._logger.create("_revokeInternal");if(!e)return;let i=t.filter(t=>"string"==typeof e[t]);if(!i.length)return void s.debug("no need to revoke due to no token(s)");for(let t of i)await this._client.revokeToken(e[t],t),s.info(`${t} revoked successfully`),"access_token"!==t&&(e[t]=null);await this.storeUser(e),s.debug("user stored"),await this._events.load(e)}startSilentRenew(){this._logger.create("startSilentRenew"),this._silentRenewService.start()}stopSilentRenew(){this._silentRenewService.stop()}get _userStoreKey(){return`user:${this.settings.authority}:${this.settings.client_id}`}async _loadUser(){let e=this._logger.create("_loadUser"),t=await this.settings.userStore.get(this._userStoreKey);return t?(e.debug("user storageString loaded"),K.fromStorageString(t)):(e.debug("no user storageString"),null)}async storeUser(e){let t=this._logger.create("storeUser");if(e){t.debug("storing user");let s=e.toStorageString();await this.settings.userStore.set(this._userStoreKey,s)}else this._logger.debug("removing user"),await this.settings.userStore.remove(this._userStoreKey),this.settings.dpop&&await this.settings.dpop.store.remove(this.settings.client_id)}async clearStaleState(){await this._client.clearStaleState()}async dpopProof(e,t,s,i){var r,n;let a=await (null==(n=null==(r=this.settings.dpop)?void 0:r.store)?void 0:n.get(this.settings.client_id));if(a)return await g.generateDPoPProof({url:e,accessToken:null==t?void 0:t.access_token,httpMethod:s,keyPair:a.keys,nonce:i})}async generateDPoPJkt(e){let t=await e.store.get(this.settings.client_id);return t||(t=new $(await g.generateDPoPKeys()),await e.store.set(this.settings.client_id,t)),await g.generateDPoPJkt(t.keys)}};e.s(["createUserManager",0,function(e){let t=window.location.origin;return new es({authority:e.issuer,client_id:e.clientId,redirect_uri:`${t}/auth/callback`,post_logout_redirect_uri:e.postLogoutRedirectUri??t,scope:e.scopes?.join(" ")??"openid email profile offline_access",response_type:"code",automaticSilentRenew:!0,userStore:new T({store:sessionStorage}),extraQueryParams:{audience:e.audience}})}],470858);let ei="stigmer:sso:login",er="stigmer:sso:session";function en(e){return null!==e&&"object"==typeof e&&"string"==typeof e.issuer&&e.issuer.length>0&&"string"==typeof e.clientId&&e.clientId.length>0&&"string"==typeof e.audience&&"string"==typeof e.org&&e.org.length>0}function ea(e){try{let t=sessionStorage.getItem(e);if(!t)return null;let s=JSON.parse(t);return en(s)?s:null}catch{return null}}e.s(["clearSsoLoginState",0,function(){sessionStorage.removeItem(ei)},"clearSsoSession",0,function(){sessionStorage.removeItem(er)},"getSsoLoginState",0,function(){return ea(ei)},"getSsoSession",0,function(){return ea(er)},"isValidSsoState",0,en,"saveSsoLoginState",0,function(e){sessionStorage.setItem(ei,JSON.stringify(e))},"saveSsoSession",0,function(e){sessionStorage.setItem(er,JSON.stringify(e))}],567989)}]);
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,470858,567989,e=>{"use strict";class t extends Error{}t.prototype.name="InvalidTokenError";var s,i,r,n,a={debug:()=>void 0,info:()=>void 0,warn:()=>void 0,error:()=>void 0},o=((s=o||{})[s.NONE=0]="NONE",s[s.ERROR=1]="ERROR",s[s.WARN=2]="WARN",s[s.INFO=3]="INFO",s[s.DEBUG=4]="DEBUG",s);(i=o||(o={})).reset=function(){r=3,n=a},i.setLevel=function(e){if(!(0<=e&&e<=4))throw Error("Invalid log level");r=e},i.setLogger=function(e){n=e};var c=class e{constructor(e){this._name=e}debug(...t){r>=4&&n.debug(e._format(this._name,this._method),...t)}info(...t){r>=3&&n.info(e._format(this._name,this._method),...t)}warn(...t){r>=2&&n.warn(e._format(this._name,this._method),...t)}error(...t){r>=1&&n.error(e._format(this._name,this._method),...t)}throw(e){throw this.error(e),e}create(e){let t=Object.create(this);return t._method=e,t.debug("begin"),t}static createStatic(t,s){let i=new e(`${t}.${s}`);return i.debug("begin"),i}static _format(e,t){let s=`[${e}]`;return t?`${s} ${t}:`:s}static debug(t,...s){r>=4&&n.debug(e._format(t),...s)}static info(t,...s){r>=3&&n.info(e._format(t),...s)}static warn(t,...s){r>=2&&n.warn(e._format(t),...s)}static error(t,...s){r>=1&&n.error(e._format(t),...s)}};o.reset();var l=class{static decode(e){try{return function(e,s){let i;if("string"!=typeof e)throw new t("Invalid token specified: must be a string");s||(s={});let r=+(!0!==s.header),n=e.split(".")[r];if("string"!=typeof n)throw new t(`Invalid token specified: missing part #${r+1}`);try{i=function(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");switch(t.length%4){case 0:break;case 2:t+="==";break;case 3:t+="=";break;default:throw Error("base64 string is not of the correct length")}try{var s;return s=t,decodeURIComponent(atob(s).replace(/(.)/g,(e,t)=>{let s=t.charCodeAt(0).toString(16).toUpperCase();return s.length<2&&(s="0"+s),"%"+s}))}catch(e){return atob(t)}}(n)}catch(e){throw new t(`Invalid token specified: invalid base64 for part #${r+1} (${e.message})`)}try{return JSON.parse(i)}catch(e){throw new t(`Invalid token specified: invalid json for part #${r+1} (${e.message})`)}}(e)}catch(e){throw c.error("JwtUtils.decode",e),e}}static async generateSignedJwt(e,t,s){let i=g.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))),r=g.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))),n=`${i}.${r}`,a=await window.crypto.subtle.sign({name:"ECDSA",hash:{name:"SHA-256"}},s,new TextEncoder().encode(n)),o=g.encodeBase64Url(new Uint8Array(a));return`${n}.${o}`}static async generateSignedJwtWithHmac(e,t,s){let i=g.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))),r=g.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))),n=`${i}.${r}`,a=await window.crypto.subtle.sign("HMAC",s,new TextEncoder().encode(n)),o=g.encodeBase64Url(new Uint8Array(a));return`${n}.${o}`}},h=e=>btoa([...new Uint8Array(e)].map(e=>String.fromCharCode(e)).join("")),d=class e{static _randomWord(){let e=new Uint32Array(1);return crypto.getRandomValues(e),e[0]}static generateUUIDv4(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,t=>(t^e._randomWord()&15>>t/4).toString(16)).replace(/-/g,"")}static generateCodeVerifier(){return e.generateUUIDv4()+e.generateUUIDv4()+e.generateUUIDv4()}static async generateCodeChallenge(e){if(!crypto.subtle)throw Error("Crypto.subtle is available only in secure contexts (HTTPS).");try{let t=new TextEncoder().encode(e),s=await crypto.subtle.digest("SHA-256",t);return h(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(e){throw c.error("CryptoUtils.generateCodeChallenge",e),e}}static generateBasicAuth(e,t){return h(new TextEncoder().encode([e,t].join(":")))}static async hash(e,t){let s=new TextEncoder().encode(t);return new Uint8Array(await crypto.subtle.digest(e,s))}static async customCalculateJwkThumbprint(t){let s;switch(t.kty){case"RSA":s={e:t.e,kty:t.kty,n:t.n};break;case"EC":s={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":s={crv:t.crv,kty:t.kty,x:t.x};break;case"oct":s={crv:t.k,kty:t.kty};break;default:throw Error("Unknown jwk type")}let i=await e.hash("SHA-256",JSON.stringify(s));return e.encodeBase64Url(i)}static async generateDPoPProof({url:t,accessToken:s,httpMethod:i,keyPair:r,nonce:n}){let a,o={jti:window.crypto.randomUUID(),htm:null!=i?i:"GET",htu:t,iat:Math.floor(Date.now()/1e3)};s&&(a=await e.hash("SHA-256",s),o.ath=e.encodeBase64Url(a)),n&&(o.nonce=n);try{let e=await crypto.subtle.exportKey("jwk",r.publicKey),t={alg:"ES256",typ:"dpop+jwt",jwk:{crv:e.crv,kty:e.kty,x:e.x,y:e.y}};return await l.generateSignedJwt(t,o,r.privateKey)}catch(e){if(e instanceof TypeError)throw Error(`Error exporting dpop public key: ${e.message}`);throw e}}static async generateDPoPJkt(t){try{let s=await crypto.subtle.exportKey("jwk",t.publicKey);return await e.customCalculateJwkThumbprint(s)}catch(e){if(e instanceof TypeError)throw Error(`Could not retrieve dpop keys from storage: ${e.message}`);throw e}}static async generateDPoPKeys(){return await window.crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign","verify"])}static async generateClientAssertionJwt(t,s,i,r="HS256"){let n=Math.floor(Date.now()/1e3),a={iss:t,sub:t,aud:i,jti:e.generateUUIDv4(),exp:n+300,iat:n},o={HS256:"SHA-256",HS384:"SHA-384",HS512:"SHA-512"}[r];if(!o)throw Error(`Unsupported algorithm: ${r}. Supported algorithms are: HS256, HS384, HS512`);let c=new TextEncoder,h=await crypto.subtle.importKey("raw",c.encode(s),{name:"HMAC",hash:o},!1,["sign"]);return await l.generateSignedJwtWithHmac({alg:r,typ:"JWT"},a,h)}};d.encodeBase64Url=e=>h(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_");var g=d,u=class{constructor(e){this._name=e,this._callbacks=[],this._logger=new c(`Event('${this._name}')`)}addHandler(e){return this._callbacks.push(e),()=>this.removeHandler(e)}removeHandler(e){let t=this._callbacks.lastIndexOf(e);t>=0&&this._callbacks.splice(t,1)}async raise(...e){for(let t of(this._logger.debug("raise:",...e),this._callbacks))await t(...e)}},_=class{static center({...e}){var t;return null==e.width&&(e.width=null!=(t=[800,720,600,480].find(e=>e<=window.outerWidth/1.618))?t:360),null!=e.left||(e.left=Math.max(0,Math.round(window.screenX+(window.outerWidth-e.width)/2))),null!=e.height&&(null!=e.top||(e.top=Math.max(0,Math.round(window.screenY+(window.outerHeight-e.height)/2)))),e}static serialize(e){return Object.entries(e).filter(([,e])=>null!=e).map(([e,t])=>`${e}=${"boolean"!=typeof t?t:t?"yes":"no"}`).join(",")}},p=class e extends u{constructor(){super(...arguments),this._logger=new c(`Timer('${this._name}')`),this._timerHandle=null,this._expiration=0,this._callback=()=>{let t=this._expiration-e.getEpochTime();this._logger.debug("timer completes in",t),this._expiration<=e.getEpochTime()&&(this.cancel(),super.raise())}}static getEpochTime(){return Math.floor(Date.now()/1e3)}init(t){let s=this._logger.create("init");t=Math.max(Math.floor(t),1);let i=e.getEpochTime()+t;if(this.expiration===i&&this._timerHandle)return void s.debug("skipping since already initialized for expiration at",this.expiration);this.cancel(),s.debug("using duration",t),this._expiration=i;let r=Math.min(t,5);this._timerHandle=setInterval(this._callback,1e3*r)}get expiration(){return this._expiration}cancel(){this._logger.create("cancel"),this._timerHandle&&(clearInterval(this._timerHandle),this._timerHandle=null)}},w=class{static readParams(e,t="query"){if(!e)throw TypeError("Invalid URL");return new URLSearchParams(new URL(e,"http://127.0.0.1")["fragment"===t?"hash":"search"].slice(1))}},m=class extends Error{constructor(e,t){var s,i,r;if(super(e.error_description||e.error||""),this.form=t,this.name="ErrorResponse",!e.error)throw c.error("ErrorResponse","No error passed"),Error("No error passed");this.error=e.error,this.error_description=null!=(s=e.error_description)?s:null,this.error_uri=null!=(i=e.error_uri)?i:null,this.state=e.userState,this.session_state=null!=(r=e.session_state)?r:null,this.url_state=e.url_state}},f=class extends Error{constructor(e){super(e),this.name="ErrorTimeout"}},S=class{constructor(e){this._logger=new c("AccessTokenEvents"),this._expiringTimer=new p("Access token expiring"),this._expiredTimer=new p("Access token expired"),this._expiringNotificationTimeInSeconds=e.expiringNotificationTimeInSeconds}async load(e){let t=this._logger.create("load");if(e.access_token&&void 0!==e.expires_in){let s=e.expires_in;if(t.debug("access token present, remaining duration:",s),s>0){let e=s-this._expiringNotificationTimeInSeconds;e<=0&&(e=1),t.debug("registering expiring timer, raising in",e,"seconds"),this._expiringTimer.init(e)}else t.debug("canceling existing expiring timer because we're past expiration."),this._expiringTimer.cancel();let i=s+1;t.debug("registering expired timer, raising in",i,"seconds"),this._expiredTimer.init(i)}else this._expiringTimer.cancel(),this._expiredTimer.cancel()}async unload(){this._logger.debug("unload: canceling existing access token timers"),this._expiringTimer.cancel(),this._expiredTimer.cancel()}addAccessTokenExpiring(e){return this._expiringTimer.addHandler(e)}removeAccessTokenExpiring(e){this._expiringTimer.removeHandler(e)}addAccessTokenExpired(e){return this._expiredTimer.addHandler(e)}removeAccessTokenExpired(e){this._expiredTimer.removeHandler(e)}},y=class{constructor(e,t,s,i,r){this._callback=e,this._client_id=t,this._intervalInSeconds=i,this._stopOnError=r,this._logger=new c("CheckSessionIFrame"),this._timer=null,this._session_state=null,this._message=e=>{e.origin===this._frame_origin&&e.source===this._frame.contentWindow&&("error"===e.data?(this._logger.error("error message from check session op iframe"),this._stopOnError&&this.stop()):"changed"===e.data?(this._logger.debug("changed message from check session op iframe"),this.stop(),this._callback()):this._logger.debug(e.data+" message from check session op iframe"))};const n=new URL(s);this._frame_origin=n.origin,this._frame=window.document.createElement("iframe"),this._frame.style.visibility="hidden",this._frame.style.position="fixed",this._frame.style.left="-1000px",this._frame.style.top="0",this._frame.width="0",this._frame.height="0",this._frame.src=n.href}load(){return new Promise(e=>{this._frame.onload=()=>{e()},window.document.body.appendChild(this._frame),window.addEventListener("message",this._message,!1)})}start(e){if(this._session_state===e)return;this._logger.create("start"),this.stop(),this._session_state=e;let t=()=>{this._frame.contentWindow&&this._session_state&&this._frame.contentWindow.postMessage(this._client_id+" "+this._session_state,this._frame_origin)};t(),this._timer=setInterval(t,1e3*this._intervalInSeconds)}stop(){this._logger.create("stop"),this._session_state=null,this._timer&&(clearInterval(this._timer),this._timer=null)}},v=class{constructor(){this._logger=new c("InMemoryWebStorage"),this._data={}}clear(){this._logger.create("clear"),this._data={}}getItem(e){return this._logger.create(`getItem('${e}')`),this._data[e]}setItem(e,t){this._logger.create(`setItem('${e}')`),this._data[e]=t}removeItem(e){this._logger.create(`removeItem('${e}')`),delete this._data[e]}get length(){return Object.getOwnPropertyNames(this._data).length}key(e){return Object.getOwnPropertyNames(this._data)[e]}},b=class extends Error{constructor(e,t){super(t),this.name="ErrorDPoPNonce",this.nonce=e}},k=class{constructor(e=[],t=null,s={}){this._jwtHandler=t,this._extraHeaders=s,this._logger=new c("JsonService"),this._contentTypes=[],this._contentTypes.push(...e,"application/json"),t&&this._contentTypes.push("application/jwt")}async fetchWithTimeout(e,t={}){let{timeoutInSeconds:s,...i}=t;if(!s)return await fetch(e,i);let r=new AbortController,n=setTimeout(()=>r.abort(),1e3*s);try{return await fetch(e,{...t,signal:r.signal})}catch(e){if(e instanceof DOMException&&"AbortError"===e.name)throw new f("Network timed out");throw e}finally{clearTimeout(n)}}async getJson(e,{token:t,credentials:s,timeoutInSeconds:i}={}){let r,n,a=this._logger.create("getJson"),o={Accept:this._contentTypes.join(", ")};t&&(a.debug("token passed, setting Authorization header"),o.Authorization="Bearer "+t),this._appendExtraHeaders(o);try{a.debug("url:",e),r=await this.fetchWithTimeout(e,{method:"GET",headers:o,timeoutInSeconds:i,credentials:s})}catch(e){throw a.error("Network Error"),e}a.debug("HTTP response received, status",r.status);let c=r.headers.get("Content-Type");if(c&&!this._contentTypes.find(e=>c.startsWith(e))&&a.throw(Error(`Invalid response Content-Type: ${null!=c?c:"undefined"}, from URL: ${e}`)),r.ok&&this._jwtHandler&&(null==c?void 0:c.startsWith("application/jwt")))return await this._jwtHandler(await r.text());try{n=await r.json()}catch(e){if(a.error("Error parsing JSON response",e),r.ok)throw e;throw Error(`${r.statusText} (${r.status})`)}if(!r.ok){if(a.error("Error from server:",n),n.error)throw new m(n);throw Error(`${r.statusText} (${r.status}): ${JSON.stringify(n)}`)}return n}async postForm(e,{body:t,basicAuth:s,timeoutInSeconds:i,initCredentials:r,extraHeaders:n}){let a,o=this._logger.create("postForm"),c={Accept:this._contentTypes.join(", "),"Content-Type":"application/x-www-form-urlencoded",...n};void 0!==s&&(c.Authorization="Basic "+s),this._appendExtraHeaders(c);try{o.debug("url:",e),a=await this.fetchWithTimeout(e,{method:"POST",headers:c,body:t,timeoutInSeconds:i,credentials:r})}catch(e){throw o.error("Network error"),e}o.debug("HTTP response received, status",a.status);let l=a.headers.get("Content-Type");if(l&&!this._contentTypes.find(e=>l.startsWith(e)))throw Error(`Invalid response Content-Type: ${null!=l?l:"undefined"}, from URL: ${e}`);let h=await a.text(),d={};if(h)try{d=JSON.parse(h)}catch(e){if(o.error("Error parsing JSON response",e),a.ok)throw e;throw Error(`${a.statusText} (${a.status})`)}if(!a.ok){if(o.error("Error from server:",d),a.headers.has("dpop-nonce"))throw new b(a.headers.get("dpop-nonce"),`${JSON.stringify(d)}`);if(d.error)throw new m(d,t);throw Error(`${a.statusText} (${a.status}): ${JSON.stringify(d)}`)}return d}_appendExtraHeaders(e){let t=this._logger.create("appendExtraHeaders"),s=Object.keys(this._extraHeaders),i=["accept","content-type"],r=["authorization"];0!==s.length&&s.forEach(s=>{if(i.includes(s.toLocaleLowerCase()))return void t.warn("Protected header could not be set",s,i);if(r.includes(s.toLocaleLowerCase())&&Object.keys(e).includes(s))return void t.warn("Header could not be overridden",s,r);let n="function"==typeof this._extraHeaders[s]?this._extraHeaders[s]():this._extraHeaders[s];n&&""!==n&&(e[s]=n)})}},E=class{constructor(e){this._settings=e,this._logger=new c("MetadataService"),this._signingKeys=null,this._metadata=null,this._metadataUrl=this._settings.metadataUrl,this._jsonService=new k(["application/jwk-set+json"],null,this._settings.extraHeaders),this._settings.signingKeys&&(this._logger.debug("using signingKeys from settings"),this._signingKeys=this._settings.signingKeys),this._settings.metadata&&(this._logger.debug("using metadata from settings"),this._metadata=this._settings.metadata),this._settings.fetchRequestCredentials&&(this._logger.debug("using fetchRequestCredentials from settings"),this._fetchRequestCredentials=this._settings.fetchRequestCredentials)}resetSigningKeys(){this._signingKeys=null}async getMetadata(){let e=this._logger.create("getMetadata");if(this._metadata)return e.debug("using cached values"),this._metadata;if(!this._metadataUrl)throw e.throw(Error("No authority or metadataUrl configured on settings")),null;e.debug("getting metadata from",this._metadataUrl);let t=await this._jsonService.getJson(this._metadataUrl,{credentials:this._fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return e.debug("merging remote JSON with seed metadata"),this._metadata=Object.assign({},t,this._settings.metadataSeed),this._metadata}getIssuer(){return this._getMetadataProperty("issuer")}getAuthorizationEndpoint(){return this._getMetadataProperty("authorization_endpoint")}getUserInfoEndpoint(){return this._getMetadataProperty("userinfo_endpoint")}getTokenEndpoint(e=!0){return this._getMetadataProperty("token_endpoint",e)}getCheckSessionIframe(){return this._getMetadataProperty("check_session_iframe",!0)}getEndSessionEndpoint(){return this._getMetadataProperty("end_session_endpoint",!0)}getRevocationEndpoint(e=!0){return this._getMetadataProperty("revocation_endpoint",e)}getKeysEndpoint(e=!0){return this._getMetadataProperty("jwks_uri",e)}async _getMetadataProperty(e,t=!1){let s=this._logger.create(`_getMetadataProperty('${e}')`),i=await this.getMetadata();if(s.debug("resolved"),void 0===i[e]){if(!0===t)return void s.warn("Metadata does not contain optional property");s.throw(Error("Metadata does not contain property "+e))}return i[e]}async getSigningKeys(){let e=this._logger.create("getSigningKeys");if(this._signingKeys)return e.debug("returning signingKeys from cache"),this._signingKeys;let t=await this.getKeysEndpoint(!1);e.debug("got jwks_uri",t);let s=await this._jsonService.getJson(t,{timeoutInSeconds:this._settings.requestTimeoutInSeconds});if(e.debug("got key set",s),!Array.isArray(s.keys))throw e.throw(Error("Missing keys on keyset")),null;return this._signingKeys=s.keys,this._signingKeys}},T=class{constructor({prefix:e="oidc.",store:t=localStorage}={}){this._logger=new c("WebStorageStateStore"),this._store=t,this._prefix=e}async set(e,t){this._logger.create(`set('${e}')`),e=this._prefix+e,await this._store.setItem(e,t)}async get(e){return this._logger.create(`get('${e}')`),e=this._prefix+e,await this._store.getItem(e)}async remove(e){this._logger.create(`remove('${e}')`),e=this._prefix+e;let t=await this._store.getItem(e);return await this._store.removeItem(e),t}async getAllKeys(){this._logger.create("getAllKeys");let e=await this._store.length,t=[];for(let s=0;s<e;s++){let e=await this._store.key(s);e&&0===e.indexOf(this._prefix)&&t.push(e.substr(this._prefix.length))}return t}},x=class{constructor({authority:e,metadataUrl:t,metadata:s,signingKeys:i,metadataSeed:r,client_id:n,client_secret:a,response_type:o="code",scope:c="openid",redirect_uri:l,post_logout_redirect_uri:h,client_authentication:d="client_secret_post",token_endpoint_auth_signing_alg:g="HS256",prompt:u,display:_,max_age:p,ui_locales:w,acr_values:m,resource:f,response_mode:S,filterProtocolClaims:y=!0,loadUserInfo:b=!1,requestTimeoutInSeconds:k,staleStateAgeInSeconds:E=900,mergeClaimsStrategy:x={array:"replace"},disablePKCE:R=!1,stateStore:P,revokeTokenAdditionalContentTypes:C,fetchRequestCredentials:I,refreshTokenAllowedScope:U,extraQueryParams:A={},extraTokenParams:O={},extraHeaders:N={},dpop:j,omitScopeWhenRequesting:q=!1}){var H;if(this.authority=e,t?this.metadataUrl=t:(this.metadataUrl=e,e&&(this.metadataUrl.endsWith("/")||(this.metadataUrl+="/"),this.metadataUrl+=".well-known/openid-configuration")),this.metadata=s,this.metadataSeed=r,this.signingKeys=i,this.client_id=n,this.client_secret=a,this.response_type=o,this.scope=c,this.redirect_uri=l,this.post_logout_redirect_uri=h,this.client_authentication=d,this.token_endpoint_auth_signing_alg=g,this.prompt=u,this.display=_,this.max_age=p,this.ui_locales=w,this.acr_values=m,this.resource=f,this.response_mode=S,this.filterProtocolClaims=null==y||y,this.loadUserInfo=!!b,this.staleStateAgeInSeconds=E,this.mergeClaimsStrategy=x,this.omitScopeWhenRequesting=q,this.disablePKCE=!!R,this.revokeTokenAdditionalContentTypes=C,this.fetchRequestCredentials=I||"same-origin",this.requestTimeoutInSeconds=k,P)this.stateStore=P;else{const e="u">typeof window?window.localStorage:new v;this.stateStore=new T({store:e})}if(this.refreshTokenAllowedScope=U,this.extraQueryParams=A,this.extraTokenParams=O,this.extraHeaders=N,this.dpop=j,this.dpop&&!(null==(H=this.dpop)?void 0:H.store))throw Error("A DPoPStore is required when dpop is enabled")}},R=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new c("UserInfoService"),this._getClaimsFromJwt=async e=>{let t=this._logger.create("_getClaimsFromJwt");try{let s=l.decode(e);return t.debug("JWT decoding successful"),s}catch(e){throw t.error("Error parsing JWT response"),e}},this._jsonService=new k(void 0,this._getClaimsFromJwt,this._settings.extraHeaders)}async getClaims(e){let t=this._logger.create("getClaims");e||this._logger.throw(Error("No token passed"));let s=await this._metadataService.getUserInfoEndpoint();t.debug("got userinfo url",s);let i=await this._jsonService.getJson(s,{token:e,credentials:this._settings.fetchRequestCredentials,timeoutInSeconds:this._settings.requestTimeoutInSeconds});return t.debug("got claims",i),i}},P=class{constructor(e,t){this._settings=e,this._metadataService=t,this._logger=new c("TokenClient"),this._jsonService=new k(this._settings.revokeTokenAdditionalContentTypes,null,this._settings.extraHeaders)}async exchangeCode({grant_type:e="authorization_code",redirect_uri:t=this._settings.redirect_uri,client_id:s=this._settings.client_id,client_secret:i=this._settings.client_secret,extraHeaders:r,...n}){let a,o=this._logger.create("exchangeCode");s||o.throw(Error("A client_id is required")),t||o.throw(Error("A redirect_uri is required")),n.code||o.throw(Error("A code is required"));let c=new URLSearchParams({grant_type:e,redirect_uri:t});for(let[e,t]of Object.entries(n))null!=t&&c.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==i)throw o.throw(Error("A client_secret is required")),null;let l=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":a=g.generateBasicAuth(s,i);break;case"client_secret_post":c.append("client_id",s),i&&c.append("client_secret",i);break;case"client_secret_jwt":{let e=await g.generateClientAssertionJwt(s,i,l,this._settings.token_endpoint_auth_signing_alg);c.append("client_id",s),c.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),c.append("client_assertion",e)}}o.debug("got token endpoint");let h=await this._jsonService.postForm(l,{body:c,basicAuth:a,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:r});return o.debug("got response"),h}async exchangeCredentials({grant_type:e="password",client_id:t=this._settings.client_id,client_secret:s=this._settings.client_secret,scope:i=this._settings.scope,...r}){let n,a=this._logger.create("exchangeCredentials");t||a.throw(Error("A client_id is required"));let o=new URLSearchParams({grant_type:e});for(let[e,t]of(this._settings.omitScopeWhenRequesting||o.set("scope",i),Object.entries(r)))null!=t&&o.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==s)throw a.throw(Error("A client_secret is required")),null;let c=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":n=g.generateBasicAuth(t,s);break;case"client_secret_post":o.append("client_id",t),s&&o.append("client_secret",s);break;case"client_secret_jwt":{let e=await g.generateClientAssertionJwt(t,s,c,this._settings.token_endpoint_auth_signing_alg);o.append("client_id",t),o.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),o.append("client_assertion",e)}}a.debug("got token endpoint");let l=await this._jsonService.postForm(c,{body:o,basicAuth:n,timeoutInSeconds:this._settings.requestTimeoutInSeconds,initCredentials:this._settings.fetchRequestCredentials});return a.debug("got response"),l}async exchangeRefreshToken({grant_type:e="refresh_token",client_id:t=this._settings.client_id,client_secret:s=this._settings.client_secret,timeoutInSeconds:i,extraHeaders:r,...n}){let a,o=this._logger.create("exchangeRefreshToken");t||o.throw(Error("A client_id is required")),n.refresh_token||o.throw(Error("A refresh_token is required"));let c=new URLSearchParams({grant_type:e});for(let[e,t]of Object.entries(n))Array.isArray(t)?t.forEach(t=>c.append(e,t)):null!=t&&c.set(e,t);if(("client_secret_basic"===this._settings.client_authentication||"client_secret_jwt"===this._settings.client_authentication)&&null==s)throw o.throw(Error("A client_secret is required")),null;let l=await this._metadataService.getTokenEndpoint(!1);switch(this._settings.client_authentication){case"client_secret_basic":a=g.generateBasicAuth(t,s);break;case"client_secret_post":c.append("client_id",t),s&&c.append("client_secret",s);break;case"client_secret_jwt":{let e=await g.generateClientAssertionJwt(t,s,l,this._settings.token_endpoint_auth_signing_alg);c.append("client_id",t),c.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),c.append("client_assertion",e)}}o.debug("got token endpoint");let h=await this._jsonService.postForm(l,{body:c,basicAuth:a,timeoutInSeconds:i,initCredentials:this._settings.fetchRequestCredentials,extraHeaders:r});return o.debug("got response"),h}async revoke(e){var t;let s=this._logger.create("revoke");e.token||s.throw(Error("A token is required"));let i=await this._metadataService.getRevocationEndpoint(!1);s.debug(`got revocation endpoint, revoking ${null!=(t=e.token_type_hint)?t:"default token type"}`);let r=new URLSearchParams;for(let[t,s]of Object.entries(e))null!=s&&r.set(t,s);r.set("client_id",this._settings.client_id),this._settings.client_secret&&r.set("client_secret",this._settings.client_secret),await this._jsonService.postForm(i,{body:r,timeoutInSeconds:this._settings.requestTimeoutInSeconds}),s.debug("got response")}},C=class{constructor(e,t,s){this._settings=e,this._metadataService=t,this._claimsService=s,this._logger=new c("ResponseValidator"),this._userInfoService=new R(this._settings,this._metadataService),this._tokenClient=new P(this._settings,this._metadataService)}async validateSigninResponse(e,t,s){let i=this._logger.create("validateSigninResponse");this._processSigninState(e,t),i.debug("state processed"),await this._processCode(e,t,s),i.debug("code processed"),e.isOpenId&&this._validateIdTokenAttributes(e,"",t.nonce),i.debug("tokens validated"),await this._processClaims(e,null==t?void 0:t.skipUserInfo,e.isOpenId),i.debug("claims processed")}async validateCredentialsResponse(e,t){let s=this._logger.create("validateCredentialsResponse"),i=e.isOpenId&&!!e.id_token;i&&this._validateIdTokenAttributes(e),s.debug("tokens validated"),await this._processClaims(e,t,i),s.debug("claims processed")}async validateRefreshResponse(e,t){let s=this._logger.create("validateRefreshResponse");e.userState=t.data,null!=e.session_state||(e.session_state=t.session_state),null!=e.scope||(e.scope=t.scope),e.isOpenId&&e.id_token&&(this._validateIdTokenAttributes(e,t.id_token),s.debug("ID Token validated")),e.id_token||(e.id_token=t.id_token,e.profile=t.profile);let i=e.isOpenId&&!!e.id_token;await this._processClaims(e,!1,i),s.debug("claims processed")}validateSignoutResponse(e,t){let s=this._logger.create("validateSignoutResponse");if(t.id!==e.state&&s.throw(Error("State does not match")),s.debug("state validated"),e.userState=t.data,e.error)throw s.warn("Response was error",e.error),new m(e)}_processSigninState(e,t){let s=this._logger.create("_processSigninState");if(t.id!==e.state&&s.throw(Error("State does not match")),t.client_id||s.throw(Error("No client_id on state")),t.authority||s.throw(Error("No authority on state")),this._settings.authority!==t.authority&&s.throw(Error("authority mismatch on settings vs. signin state")),this._settings.client_id&&this._settings.client_id!==t.client_id&&s.throw(Error("client_id mismatch on settings vs. signin state")),s.debug("state validated"),e.userState=t.data,e.url_state=t.url_state,null!=e.scope||(e.scope=t.scope),e.error)throw s.warn("Response was error",e.error),new m(e);t.code_verifier&&!e.code&&s.throw(Error("Expected code in response"))}async _processClaims(e,t=!1,s=!0){let i=this._logger.create("_processClaims");if(e.profile=this._claimsService.filterProtocolClaims(e.profile),t||!this._settings.loadUserInfo||!e.access_token)return void i.debug("not loading user info");i.debug("loading user info");let r=await this._userInfoService.getClaims(e.access_token);i.debug("user info claims received from user info endpoint"),s&&r.sub!==e.profile.sub&&i.throw(Error("subject from UserInfo response does not match subject in ID Token")),e.profile=this._claimsService.mergeClaims(e.profile,this._claimsService.filterProtocolClaims(r)),i.debug("user info claims received, updated profile:",e.profile)}async _processCode(e,t,s){let i=this._logger.create("_processCode");if(e.code){i.debug("Validating code");let r=await this._tokenClient.exchangeCode({client_id:t.client_id,client_secret:t.client_secret,code:e.code,redirect_uri:t.redirect_uri,code_verifier:t.code_verifier,extraHeaders:s,...t.extraTokenParams});Object.assign(e,r)}else i.debug("No code to process")}_validateIdTokenAttributes(e,t,s){var i;let r=this._logger.create("_validateIdTokenAttributes");r.debug("decoding ID Token JWT");let n=l.decode(null!=(i=e.id_token)?i:"");if(n.sub||r.throw(Error("ID Token is missing a subject claim")),s&&n.nonce!==s&&r.throw(Error("nonce in id_token does not match nonce in client storage")),t){let e=l.decode(t);n.sub!==e.sub&&r.throw(Error("sub in id_token does not match current sub")),n.auth_time&&n.auth_time!==e.auth_time&&r.throw(Error("auth_time in id_token does not match original auth_time")),n.azp&&n.azp!==e.azp&&r.throw(Error("azp in id_token does not match original azp")),!n.azp&&e.azp&&r.throw(Error("azp not in id_token, but present in original id_token"))}e.profile=n}},I=class e{constructor(e){this.id=e.id||g.generateUUIDv4(),this.data=e.data,e.created&&e.created>0?this.created=e.created:this.created=p.getEpochTime(),this.request_type=e.request_type,this.url_state=e.url_state}toStorageString(){return new c("State").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state})}static fromStorageString(t){return c.createStatic("State","fromStorageString"),Promise.resolve(new e(JSON.parse(t)))}static async clearStaleState(t,s){let i=c.createStatic("State","clearStaleState"),r=p.getEpochTime()-s,n=await t.getAllKeys();i.debug("got keys",n);for(let s=0;s<n.length;s++){let a=n[s],o=await t.get(a),c=!1;if(o)try{let t=await e.fromStorageString(o);i.debug("got item from key:",a,t.created),t.created<=r&&(c=!0)}catch(e){i.error("Error parsing state for key:",a,e),c=!0}else i.debug("no item in storage for key:",a),c=!0;c&&(i.debug("removed item for key:",a),t.remove(a))}}},U=class e extends I{constructor(e){super(e),this.code_verifier=e.code_verifier,this.code_challenge=e.code_challenge,this.authority=e.authority,this.client_id=e.client_id,this.redirect_uri=e.redirect_uri,this.scope=e.scope,this.client_secret=e.client_secret,this.extraTokenParams=e.extraTokenParams,this.response_mode=e.response_mode,this.skipUserInfo=e.skipUserInfo,this.nonce=e.nonce}static async create(t){let s=!0===t.code_verifier?g.generateCodeVerifier():t.code_verifier||void 0,i=s?await g.generateCodeChallenge(s):void 0;return new e({...t,code_verifier:s,code_challenge:i})}toStorageString(){return new c("SigninState").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state,code_verifier:this.code_verifier,authority:this.authority,client_id:this.client_id,redirect_uri:this.redirect_uri,scope:this.scope,client_secret:this.client_secret,extraTokenParams:this.extraTokenParams,response_mode:this.response_mode,skipUserInfo:this.skipUserInfo,nonce:this.nonce})}static fromStorageString(t){c.createStatic("SigninState","fromStorageString");let s=JSON.parse(t);return e.create(s)}},A=class e{constructor(e){this.url=e.url,this.state=e.state}static async create({url:t,authority:s,client_id:i,redirect_uri:r,response_type:n,scope:a,state_data:o,response_mode:c,request_type:l,client_secret:h,nonce:d,url_state:g,resource:u,skipUserInfo:_,extraQueryParams:p,extraTokenParams:w,disablePKCE:m,dpopJkt:f,omitScopeWhenRequesting:S,...y}){if(!t)throw this._logger.error("create: No url passed"),Error("url");if(!i)throw this._logger.error("create: No client_id passed"),Error("client_id");if(!r)throw this._logger.error("create: No redirect_uri passed"),Error("redirect_uri");if(!n)throw this._logger.error("create: No response_type passed"),Error("response_type");if(!a)throw this._logger.error("create: No scope passed"),Error("scope");if(!s)throw this._logger.error("create: No authority passed"),Error("authority");let v=await U.create({data:o,request_type:l,url_state:g,code_verifier:!m,client_id:i,authority:s,redirect_uri:r,response_mode:c,client_secret:h,scope:a,extraTokenParams:w,skipUserInfo:_,nonce:d}),b=new URL(t);b.searchParams.append("client_id",i),b.searchParams.append("redirect_uri",r),b.searchParams.append("response_type",n),S||b.searchParams.append("scope",a),d&&b.searchParams.append("nonce",d),f&&b.searchParams.append("dpop_jkt",f);let k=v.id;for(let[e,t]of(g&&(k=`${k};${g}`),b.searchParams.append("state",k),v.code_challenge&&(b.searchParams.append("code_challenge",v.code_challenge),b.searchParams.append("code_challenge_method","S256")),u&&(Array.isArray(u)?u:[u]).forEach(e=>b.searchParams.append("resource",e)),Object.entries({response_mode:c,...y,...p})))null!=t&&b.searchParams.append(e,t.toString());return new e({url:b.href,state:v})}};A._logger=new c("SigninRequest");var O=class{constructor(e){if(this.access_token="",this.token_type="",this.profile={},this.state=e.get("state"),this.session_state=e.get("session_state"),this.state){const e=decodeURIComponent(this.state).split(";");this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(";"))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri"),this.code=e.get("code")}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-p.getEpochTime()}set expires_in(e){"string"==typeof e&&(e=Number(e)),void 0!==e&&e>=0&&(this.expires_at=Math.floor(e)+p.getEpochTime())}get isOpenId(){var e;return(null==(e=this.scope)?void 0:e.split(" ").includes("openid"))||!!this.id_token}},N=class{constructor({url:e,state_data:t,id_token_hint:s,post_logout_redirect_uri:i,extraQueryParams:r,request_type:n,client_id:a,url_state:o}){if(this._logger=new c("SignoutRequest"),!e)throw this._logger.error("ctor: No url passed"),Error("url");const l=new URL(e);if(s&&l.searchParams.append("id_token_hint",s),a&&l.searchParams.append("client_id",a),i&&(l.searchParams.append("post_logout_redirect_uri",i),t||o)){this.state=new I({data:t,request_type:n,url_state:o});let e=this.state.id;o&&(e=`${e};${o}`),l.searchParams.append("state",e)}for(const[e,t]of Object.entries({...r}))null!=t&&l.searchParams.append(e,t.toString());this.url=l.href}},j=class{constructor(e){if(this.state=e.get("state"),this.state){const e=decodeURIComponent(this.state).split(";");this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(";"))}this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri")}},q=["nbf","jti","auth_time","nonce","acr","amr","azp","at_hash"],H=["sub","iss","aud","exp","iat"],M=class{constructor(e){this._settings=e,this._logger=new c("ClaimsService")}filterProtocolClaims(e){let t={...e};if(this._settings.filterProtocolClaims){for(let e of Array.isArray(this._settings.filterProtocolClaims)?this._settings.filterProtocolClaims:q)H.includes(e)||delete t[e]}return t}mergeClaims(e,t){let s={...e};for(let[e,i]of Object.entries(t))if(s[e]!==i)if(Array.isArray(s[e])||Array.isArray(i))if("replace"==this._settings.mergeClaimsStrategy.array)s[e]=i;else{let t=Array.isArray(s[e])?s[e]:[s[e]];for(let e of Array.isArray(i)?i:[i])t.includes(e)||t.push(e);s[e]=t}else"object"==typeof s[e]&&"object"==typeof i?s[e]=this.mergeClaims(s[e],i):s[e]=i;return s}},$=class{constructor(e,t){this.keys=e,this.nonce=t}},J=class{constructor(e,t){this._logger=new c("OidcClient"),this.settings=e instanceof x?e:new x(e),this.metadataService=null!=t?t:new E(this.settings),this._claimsService=new M(this.settings),this._validator=new C(this.settings,this.metadataService,this._claimsService),this._tokenClient=new P(this.settings,this.metadataService)}async createSigninRequest({state:e,request:t,request_uri:s,request_type:i,id_token_hint:r,login_hint:n,skipUserInfo:a,nonce:o,url_state:c,response_type:l=this.settings.response_type,scope:h=this.settings.scope,redirect_uri:d=this.settings.redirect_uri,prompt:g=this.settings.prompt,display:u=this.settings.display,max_age:_=this.settings.max_age,ui_locales:p=this.settings.ui_locales,acr_values:w=this.settings.acr_values,resource:m=this.settings.resource,response_mode:f=this.settings.response_mode,extraQueryParams:S=this.settings.extraQueryParams,extraTokenParams:y=this.settings.extraTokenParams,dpopJkt:v,omitScopeWhenRequesting:b=this.settings.omitScopeWhenRequesting}){let k=this._logger.create("createSigninRequest");if("code"!==l)throw Error("Only the Authorization Code flow (with PKCE) is supported");let E=await this.metadataService.getAuthorizationEndpoint();k.debug("Received authorization endpoint",E);let T=await A.create({url:E,authority:this.settings.authority,client_id:this.settings.client_id,redirect_uri:d,response_type:l,scope:h,state_data:e,url_state:c,prompt:g,display:u,max_age:_,ui_locales:p,id_token_hint:r,login_hint:n,acr_values:w,dpopJkt:v,resource:m,request:t,request_uri:s,extraQueryParams:S,extraTokenParams:y,request_type:i,response_mode:f,client_secret:this.settings.client_secret,skipUserInfo:a,nonce:o,disablePKCE:this.settings.disablePKCE,omitScopeWhenRequesting:b});await this.clearStaleState();let x=T.state;return await this.settings.stateStore.set(x.id,x.toStorageString()),T}async readSigninResponseState(e,t=!1){let s=this._logger.create("readSigninResponseState"),i=new O(w.readParams(e,this.settings.response_mode));if(!i.state)throw s.throw(Error("No state in response")),null;let r=await this.settings.stateStore[t?"remove":"get"](i.state);if(!r)throw s.throw(Error("No matching state found in storage")),null;return{state:await U.fromStorageString(r),response:i}}async processSigninResponse(e,t,s=!0){let i=this._logger.create("processSigninResponse"),{state:r,response:n}=await this.readSigninResponseState(e,s);if(i.debug("received state from storage; validating response"),this.settings.dpop&&this.settings.dpop.store){let e=await this.getDpopProof(this.settings.dpop.store);t={...t,DPoP:e}}try{await this._validator.validateSigninResponse(n,r,t)}catch(e){if(e instanceof b&&this.settings.dpop){let s=await this.getDpopProof(this.settings.dpop.store,e.nonce);t.DPoP=s,await this._validator.validateSigninResponse(n,r,t)}else throw e}return n}async getDpopProof(e,t){let s;return(await e.getAllKeys()).includes(this.settings.client_id)?(s=await e.get(this.settings.client_id)).nonce!==t&&t&&(s.nonce=t,await e.set(this.settings.client_id,s)):(s=new $(await g.generateDPoPKeys(),t),await e.set(this.settings.client_id,s)),await g.generateDPoPProof({url:await this.metadataService.getTokenEndpoint(!1),httpMethod:"POST",keyPair:s.keys,nonce:s.nonce})}async processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:s=!1,extraTokenParams:i={}}){let r=await this._tokenClient.exchangeCredentials({username:e,password:t,...i}),n=new O(new URLSearchParams);return Object.assign(n,r),await this._validator.validateCredentialsResponse(n,s),n}async useRefreshToken({state:e,redirect_uri:t,resource:s,timeoutInSeconds:i,extraHeaders:r,extraTokenParams:n}){var a;let o,c,l=this._logger.create("useRefreshToken");if(void 0===this.settings.refreshTokenAllowedScope)o=e.scope;else{let t=this.settings.refreshTokenAllowedScope.split(" ");o=((null==(a=e.scope)?void 0:a.split(" "))||[]).filter(e=>t.includes(e)).join(" ")}if(this.settings.dpop&&this.settings.dpop.store){let e=await this.getDpopProof(this.settings.dpop.store);r={...r,DPoP:e}}try{c=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:o,redirect_uri:t,resource:s,timeoutInSeconds:i,extraHeaders:r,...n})}catch(a){if(a instanceof b&&this.settings.dpop)r.DPoP=await this.getDpopProof(this.settings.dpop.store,a.nonce),c=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:o,redirect_uri:t,resource:s,timeoutInSeconds:i,extraHeaders:r,...n});else throw a}let h=new O(new URLSearchParams);return Object.assign(h,c),l.debug("validating response",h),await this._validator.validateRefreshResponse(h,{...e,scope:o}),h}async createSignoutRequest({state:e,id_token_hint:t,client_id:s,request_type:i,url_state:r,post_logout_redirect_uri:n=this.settings.post_logout_redirect_uri,extraQueryParams:a=this.settings.extraQueryParams}={}){let o=this._logger.create("createSignoutRequest"),c=await this.metadataService.getEndSessionEndpoint();if(!c)throw o.throw(Error("No end session endpoint")),null;o.debug("Received end session endpoint",c),s||!n||t||(s=this.settings.client_id);let l=new N({url:c,id_token_hint:t,client_id:s,post_logout_redirect_uri:n,state_data:e,extraQueryParams:a,request_type:i,url_state:r});await this.clearStaleState();let h=l.state;return h&&(o.debug("Signout request has state to persist"),await this.settings.stateStore.set(h.id,h.toStorageString())),l}async readSignoutResponseState(e,t=!1){let s=this._logger.create("readSignoutResponseState"),i=new j(w.readParams(e,this.settings.response_mode));if(!i.state){if(s.debug("No state in response"),i.error)throw s.warn("Response was error:",i.error),new m(i);return{state:void 0,response:i}}let r=await this.settings.stateStore[t?"remove":"get"](i.state);if(!r)throw s.throw(Error("No matching state found in storage")),null;return{state:await I.fromStorageString(r),response:i}}async processSignoutResponse(e){let t=this._logger.create("processSignoutResponse"),{state:s,response:i}=await this.readSignoutResponseState(e,!0);return s?(t.debug("Received state from storage; validating response"),this._validator.validateSignoutResponse(i,s)):t.debug("No state from storage; skipping response validation"),i}clearStaleState(){return this._logger.create("clearStaleState"),I.clearStaleState(this.settings.stateStore,this.settings.staleStateAgeInSeconds)}async revokeToken(e,t){return this._logger.create("revokeToken"),await this._tokenClient.revoke({token:e,token_type_hint:t})}},D=class{constructor(e){this._userManager=e,this._logger=new c("SessionMonitor"),this._start=async e=>{let t=e.session_state;if(!t)return;let s=this._logger.create("_start");if(e.profile?(this._sub=e.profile.sub,s.debug("session_state",t,", sub",this._sub)):(this._sub=void 0,s.debug("session_state",t,", anonymous user")),this._checkSessionIFrame)return void this._checkSessionIFrame.start(t);try{let e=await this._userManager.metadataService.getCheckSessionIframe();if(e){s.debug("initializing check session iframe");let i=this._userManager.settings.client_id,r=this._userManager.settings.checkSessionIntervalInSeconds,n=this._userManager.settings.stopCheckSessionOnError,a=new y(this._callback,i,e,r,n);await a.load(),this._checkSessionIFrame=a,a.start(t)}else s.warn("no check session iframe found in the metadata")}catch(e){s.error("Error from getCheckSessionIframe:",e instanceof Error?e.message:e)}},this._stop=()=>{let e=this._logger.create("_stop");if(this._sub=void 0,this._checkSessionIFrame&&this._checkSessionIFrame.stop(),this._userManager.settings.monitorAnonymousSession){let t=setInterval(async()=>{clearInterval(t);try{let e=await this._userManager.querySessionStatus();if(e){let t={session_state:e.session_state,profile:e.sub?{sub:e.sub}:null};this._start(t)}}catch(t){e.error("error from querySessionStatus",t instanceof Error?t.message:t)}},1e3)}},this._callback=async()=>{let e=this._logger.create("_callback");try{let t=await this._userManager.querySessionStatus(),s=!0;t&&this._checkSessionIFrame?t.sub===this._sub?(s=!1,this._checkSessionIFrame.start(t.session_state),e.debug("same sub still logged in at OP, session state has changed, restarting check session iframe; session_state",t.session_state),await this._userManager.events._raiseUserSessionChanged()):e.debug("different subject signed into OP",t.sub):e.debug("subject no longer signed into OP"),s?this._sub?await this._userManager.events._raiseUserSignedOut():await this._userManager.events._raiseUserSignedIn():e.debug("no change in session detected, no event to raise")}catch(t){this._sub&&(e.debug("Error calling queryCurrentSigninSession; raising signed out event",t),await this._userManager.events._raiseUserSignedOut())}},e||this._logger.throw(Error("No user manager passed")),this._userManager.events.addUserLoaded(this._start),this._userManager.events.addUserUnloaded(this._stop),this._init().catch(e=>{this._logger.error(e)})}async _init(){this._logger.create("_init");let e=await this._userManager.getUser();if(e)this._start(e);else if(this._userManager.settings.monitorAnonymousSession){let e=await this._userManager.querySessionStatus();if(e){let t={session_state:e.session_state,profile:e.sub?{sub:e.sub}:null};this._start(t)}}}},K=class e{constructor(e){var t;this.id_token=e.id_token,this.session_state=null!=(t=e.session_state)?t:null,this.access_token=e.access_token,this.refresh_token=e.refresh_token,this.token_type=e.token_type,this.scope=e.scope,this.profile=e.profile,this.expires_at=e.expires_at,this.state=e.userState,this.url_state=e.url_state}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-p.getEpochTime()}set expires_in(e){void 0!==e&&(this.expires_at=Math.floor(e)+p.getEpochTime())}get expired(){let e=this.expires_in;if(void 0!==e)return e<=0}get scopes(){var e,t;return null!=(t=null==(e=this.scope)?void 0:e.split(" "))?t:[]}toStorageString(){return new c("User").create("toStorageString"),JSON.stringify({id_token:this.id_token,session_state:this.session_state,access_token:this.access_token,refresh_token:this.refresh_token,token_type:this.token_type,scope:this.scope,profile:this.profile,expires_at:this.expires_at})}static fromStorageString(t){return c.createStatic("User","fromStorageString"),new e(JSON.parse(t))}},L="oidc-client",W=class{constructor(){this._abort=new u("Window navigation aborted"),this._disposeHandlers=new Set,this._window=null}async navigate(e){let t=this._logger.create("navigate");if(!this._window)throw Error("Attempted to navigate on a disposed window");t.debug("setting URL in window"),this._window.location.replace(e.url);let{url:s,keepOpen:i}=await new Promise((s,i)=>{let r=r=>{var n;let a=r.data,o=null!=(n=e.scriptOrigin)?n:window.location.origin;if(r.origin===o&&(null==a?void 0:a.source)===L){try{let s=w.readParams(a.url,e.response_mode).get("state");if(s||t.warn("no state found in response url"),r.source!==this._window&&s!==e.state)return}catch{this._dispose(),i(Error("Invalid response from window"))}s(a)}};window.addEventListener("message",r,!1),this._disposeHandlers.add(()=>window.removeEventListener("message",r,!1));let n=new BroadcastChannel(`oidc-client-popup-${e.state}`);n.addEventListener("message",r,!1),this._disposeHandlers.add(()=>n.close()),this._disposeHandlers.add(this._abort.addHandler(e=>{this._dispose(),i(e)}))});return t.debug("got response from window"),this._dispose(),i||this.close(),{url:s}}_dispose(){for(let e of(this._logger.create("_dispose"),this._disposeHandlers))e();this._disposeHandlers.clear()}static _notifyParent(e,t,s=!1,i=window.location.origin){let r={source:L,url:t,keepOpen:s},n=new c("_notifyParent");if(e)n.debug("With parent. Using parent.postMessage."),e.postMessage(r,i);else{n.debug("No parent. Using BroadcastChannel.");let e=new URL(t).searchParams.get("state");if(!e)throw Error("No parent and no state in URL. Can't complete notification.");let s=new BroadcastChannel(`oidc-client-popup-${e}`);s.postMessage(r),s.close()}}},z={location:!1,toolbar:!1,height:640,closePopupWindowAfterInSeconds:-1},F="_blank",B=class extends x{constructor(e){const{popup_redirect_uri:t=e.redirect_uri,popup_post_logout_redirect_uri:s=e.post_logout_redirect_uri,popupWindowFeatures:i=z,popupWindowTarget:r=F,redirectMethod:n="assign",redirectTarget:a="self",iframeNotifyParentOrigin:o=e.iframeNotifyParentOrigin,iframeScriptOrigin:c=e.iframeScriptOrigin,requestTimeoutInSeconds:l,silent_redirect_uri:h=e.redirect_uri,silentRequestTimeoutInSeconds:d,automaticSilentRenew:g=!0,validateSubOnSilentRenew:u=!0,includeIdTokenInSilentRenew:_=!1,monitorSession:p=!1,monitorAnonymousSession:w=!1,checkSessionIntervalInSeconds:m=2,query_status_response_type:f="code",stopCheckSessionOnError:S=!0,revokeTokenTypes:y=["access_token","refresh_token"],revokeTokensOnSignout:b=!1,includeIdTokenInSilentSignout:k=!1,accessTokenExpiringNotificationTimeInSeconds:E=60,maxSilentRenewTimeoutRetries:x,userStore:R}=e;if(super(e),this.popup_redirect_uri=t,this.popup_post_logout_redirect_uri=s,this.popupWindowFeatures=i,this.popupWindowTarget=r,this.redirectMethod=n,this.redirectTarget=a,this.iframeNotifyParentOrigin=o,this.iframeScriptOrigin=c,this.silent_redirect_uri=h,this.silentRequestTimeoutInSeconds=d||l||10,this.automaticSilentRenew=g,this.validateSubOnSilentRenew=u,this.includeIdTokenInSilentRenew=_,this.monitorSession=p,this.monitorAnonymousSession=w,this.checkSessionIntervalInSeconds=m,this.stopCheckSessionOnError=S,this.query_status_response_type=f,this.revokeTokenTypes=y,this.revokeTokensOnSignout=b,this.includeIdTokenInSilentSignout=k,this.accessTokenExpiringNotificationTimeInSeconds=E,this.maxSilentRenewTimeoutRetries=x,R)this.userStore=R;else{const e="u">typeof window?window.sessionStorage:new v;this.userStore=new T({store:e})}}},V=class e extends W{constructor({silentRequestTimeoutInSeconds:t=10}){super(),this._logger=new c("IFrameWindow"),this._timeoutInSeconds=t,this._frame=e.createHiddenIframe(),this._window=this._frame.contentWindow}static createHiddenIframe(){let e=window.document.createElement("iframe");return e.style.visibility="hidden",e.style.position="fixed",e.style.left="-1000px",e.style.top="0",e.width="0",e.height="0",window.document.body.appendChild(e),e}async navigate(e){this._logger.debug("navigate: Using timeout of:",this._timeoutInSeconds);let t=setTimeout(()=>void this._abort.raise(new f("IFrame timed out without a response")),1e3*this._timeoutInSeconds);return this._disposeHandlers.add(()=>clearTimeout(t)),await super.navigate(e)}close(){var e;this._frame&&(this._frame.parentNode&&(this._frame.addEventListener("load",e=>{var t;let s=e.target;null==(t=s.parentNode)||t.removeChild(s),this._abort.raise(Error("IFrame removed from DOM"))},!0),null==(e=this._frame.contentWindow)||e.location.replace("about:blank")),this._frame=null),this._window=null}static notifyParent(e,t){return super._notifyParent(window.parent,e,!1,t)}},G=class{constructor(e){this._settings=e,this._logger=new c("IFrameNavigator")}async prepare({silentRequestTimeoutInSeconds:e=this._settings.silentRequestTimeoutInSeconds}){return new V({silentRequestTimeoutInSeconds:e})}async callback(e){this._logger.create("callback"),V.notifyParent(e,this._settings.iframeNotifyParentOrigin)}},Q=class extends W{constructor({popupWindowTarget:e=F,popupWindowFeatures:t={},popupSignal:s,popupAbortOnClose:i}){super(),this._logger=new c("PopupWindow");const r=_.center({...z,...t});this._window=window.open(void 0,e,_.serialize(r)),this.abortOnClose=!!i,s&&s.addEventListener("abort",()=>{var e;this._abort.raise(Error(null!=(e=s.reason)?e:"Popup aborted"))}),t.closePopupWindowAfterInSeconds&&t.closePopupWindowAfterInSeconds>0&&setTimeout(()=>{!this._window||"boolean"!=typeof this._window.closed||this._window.closed?this._abort.raise(Error("Popup blocked by user")):this.close()},1e3*t.closePopupWindowAfterInSeconds)}async navigate(e){var t;null==(t=this._window)||t.focus();let s=setInterval(()=>{(!this._window||this._window.closed)&&(this._logger.debug("Popup closed by user or isolated by redirect"),i(),this._disposeHandlers.delete(i),this.abortOnClose&&this._abort.raise(Error("Popup closed by user")))},500),i=()=>clearInterval(s);return this._disposeHandlers.add(i),await super.navigate(e)}close(){this._window&&!this._window.closed&&(this._window.close(),this._abort.raise(Error("Popup closed"))),this._window=null}static notifyOpener(e,t){super._notifyParent(window.opener,e,t),t||window.opener||window.close()}},X=class{constructor(e){this._settings=e,this._logger=new c("PopupNavigator")}async prepare({popupWindowFeatures:e=this._settings.popupWindowFeatures,popupWindowTarget:t=this._settings.popupWindowTarget,popupSignal:s,popupAbortOnClose:i}){return new Q({popupWindowFeatures:e,popupWindowTarget:t,popupSignal:s,popupAbortOnClose:i})}async callback(e,{keepOpen:t=!1}){this._logger.create("callback"),Q.notifyOpener(e,t)}},Y=class{constructor(e){this._settings=e,this._logger=new c("RedirectNavigator")}async prepare({redirectMethod:e=this._settings.redirectMethod,redirectTarget:t=this._settings.redirectTarget}){var s;let i;this._logger.create("prepare");let r=window.self;"top"===t&&(r=null!=(s=window.top)?s:window.self);let n=r.location[e].bind(r.location);return{navigate:async e=>{this._logger.create("navigate");let t=new Promise((t,s)=>{i=s,window.addEventListener("pageshow",()=>t(window.location.href)),n(e.url)});return await t},close:()=>{this._logger.create("close"),null==i||i(Error("Redirect aborted")),r.stop()}}}async callback(){}},Z=class extends S{constructor(e){super({expiringNotificationTimeInSeconds:e.accessTokenExpiringNotificationTimeInSeconds}),this._logger=new c("UserManagerEvents"),this._userLoaded=new u("User loaded"),this._userUnloaded=new u("User unloaded"),this._silentRenewError=new u("Silent renew error"),this._userSignedIn=new u("User signed in"),this._userSignedOut=new u("User signed out"),this._userSessionChanged=new u("User session changed")}async load(e,t=!0){await super.load(e),t&&await this._userLoaded.raise(e)}async unload(){await super.unload(),await this._userUnloaded.raise()}addUserLoaded(e){return this._userLoaded.addHandler(e)}removeUserLoaded(e){return this._userLoaded.removeHandler(e)}addUserUnloaded(e){return this._userUnloaded.addHandler(e)}removeUserUnloaded(e){return this._userUnloaded.removeHandler(e)}addSilentRenewError(e){return this._silentRenewError.addHandler(e)}removeSilentRenewError(e){return this._silentRenewError.removeHandler(e)}async _raiseSilentRenewError(e){await this._silentRenewError.raise(e)}addUserSignedIn(e){return this._userSignedIn.addHandler(e)}removeUserSignedIn(e){this._userSignedIn.removeHandler(e)}async _raiseUserSignedIn(){await this._userSignedIn.raise()}addUserSignedOut(e){return this._userSignedOut.addHandler(e)}removeUserSignedOut(e){this._userSignedOut.removeHandler(e)}async _raiseUserSignedOut(){await this._userSignedOut.raise()}addUserSessionChanged(e){return this._userSessionChanged.addHandler(e)}removeUserSessionChanged(e){this._userSessionChanged.removeHandler(e)}async _raiseUserSessionChanged(){await this._userSessionChanged.raise()}},ee=class{constructor(e){this._userManager=e,this._logger=new c("SilentRenewService"),this._isStarted=!1,this._retryTimer=new p("Retry Silent Renew"),this._timeoutRetryCount=0,this._tokenExpiring=async()=>{let e=this._logger.create("_tokenExpiring");try{await this._userManager.signinSilent(),this._timeoutRetryCount=0,e.debug("silent token renewal successful")}catch(t){if(t instanceof f){this._timeoutRetryCount++;let s=this._userManager.settings.maxSilentRenewTimeoutRetries;if(void 0!==s&&this._timeoutRetryCount>s){e.error(`Timeout retry limit reached (${this._timeoutRetryCount} > ${s}), raising silentRenewError:`,t),this._timeoutRetryCount=0,await this._userManager.events._raiseSilentRenewError(t);return}e.warn(`ErrorTimeout from signinSilent (attempt ${this._timeoutRetryCount}), retry in 5s:`,t),this._retryTimer.init(5);return}e.error("Error from signinSilent:",t),this._timeoutRetryCount=0,await this._userManager.events._raiseSilentRenewError(t)}}}async start(){let e=this._logger.create("start");if(!this._isStarted){this._isStarted=!0,this._userManager.events.addAccessTokenExpiring(this._tokenExpiring),this._retryTimer.addHandler(this._tokenExpiring);try{await this._userManager.getUser()}catch(t){e.error("getUser error",t)}}}stop(){this._isStarted&&(this._retryTimer.cancel(),this._retryTimer.removeHandler(this._tokenExpiring),this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring),this._isStarted=!1)}},et=class{constructor(e){this.refresh_token=e.refresh_token,this.id_token=e.id_token,this.session_state=e.session_state,this.scope=e.scope,this.profile=e.profile,this.data=e.state}},es=class{constructor(e,t,s,i){this._logger=new c("UserManager"),this.settings=new B(e),this._client=new J(e),this._redirectNavigator=null!=t?t:new Y(this.settings),this._popupNavigator=null!=s?s:new X(this.settings),this._iframeNavigator=null!=i?i:new G(this.settings),this._events=new Z(this.settings),this._silentRenewService=new ee(this),this.settings.automaticSilentRenew&&this.startSilentRenew(),this._sessionMonitor=null,this.settings.monitorSession&&(this._sessionMonitor=new D(this))}get events(){return this._events}get metadataService(){return this._client.metadataService}async getUser(e=!1){let t=this._logger.create("getUser"),s=await this._loadUser();return s?(t.info("user loaded"),await this._events.load(s,e),s):(t.info("user not found in storage"),null)}async removeUser(){let e=this._logger.create("removeUser");await this.storeUser(null),e.info("user removed from storage"),await this._events.unload()}async signinRedirect(e={}){var t;let s;this._logger.create("signinRedirect");let{redirectMethod:i,...r}=e;(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(s=await this.generateDPoPJkt(this.settings.dpop));let n=await this._redirectNavigator.prepare({redirectMethod:i});await this._signinStart({request_type:"si:r",dpopJkt:s,...r},n)}async signinRedirectCallback(e=window.location.href){let t=this._logger.create("signinRedirectCallback"),s=await this._signinEnd(e);return s.profile&&s.profile.sub?t.info("success, signed in subject",s.profile.sub):t.info("no subject"),s}async signinResourceOwnerCredentials({username:e,password:t,skipUserInfo:s=!1}){let i=this._logger.create("signinResourceOwnerCredential"),r=await this._client.processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:s,extraTokenParams:this.settings.extraTokenParams});i.debug("got signin response");let n=await this._buildUser(r);return n.profile&&n.profile.sub?i.info("success, signed in subject",n.profile.sub):i.info("no subject"),n}async signinPopup(e={}){var t;let s,i=this._logger.create("signinPopup");(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(s=await this.generateDPoPJkt(this.settings.dpop));let{popupWindowFeatures:r,popupWindowTarget:n,popupSignal:a,popupAbortOnClose:o,...c}=e,l=this.settings.popup_redirect_uri;l||i.throw(Error("No popup_redirect_uri configured"));let h=await this._popupNavigator.prepare({popupWindowFeatures:r,popupWindowTarget:n,popupSignal:a,popupAbortOnClose:o}),d=await this._signin({request_type:"si:p",redirect_uri:l,display:"popup",dpopJkt:s,...c},h);return d&&(d.profile&&d.profile.sub?i.info("success, signed in subject",d.profile.sub):i.info("no subject")),d}async signinPopupCallback(e=window.location.href,t=!1){let s=this._logger.create("signinPopupCallback");await this._popupNavigator.callback(e,{keepOpen:t}),s.info("success")}async signinSilent(e={}){var t,s;let i,r,n=this._logger.create("signinSilent"),{silentRequestTimeoutInSeconds:a,...o}=e,c=await this._loadUser();if(!e.forceIframeAuth&&(null==c?void 0:c.refresh_token)){n.debug("using refresh token");let e=new et(c);return await this._useRefreshToken({state:e,redirect_uri:o.redirect_uri,resource:o.resource,extraTokenParams:o.extraTokenParams,timeoutInSeconds:a})}(null==(t=this.settings.dpop)?void 0:t.bind_authorization_code)&&(i=await this.generateDPoPJkt(this.settings.dpop));let l=this.settings.silent_redirect_uri;l||n.throw(Error("No silent_redirect_uri configured")),c&&this.settings.validateSubOnSilentRenew&&(n.debug("subject prior to silent renew:",c.profile.sub),r=c.profile.sub);let h=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:a});return(c=await this._signin({request_type:"si:s",redirect_uri:l,prompt:"none",id_token_hint:this.settings.includeIdTokenInSilentRenew?null==c?void 0:c.id_token:void 0,dpopJkt:i,...o},h,r))&&((null==(s=c.profile)?void 0:s.sub)?n.info("success, signed in subject",c.profile.sub):n.info("no subject")),c}async _useRefreshToken(e){let t=await this._client.useRefreshToken({timeoutInSeconds:this.settings.silentRequestTimeoutInSeconds,...e}),s=new K({...e.state,...t});return await this.storeUser(s),await this._events.load(s),s}async signinSilentCallback(e=window.location.href){let t=this._logger.create("signinSilentCallback");await this._iframeNavigator.callback(e),t.info("success")}async signinCallback(e=window.location.href){let{state:t}=await this._client.readSigninResponseState(e);switch(t.request_type){case"si:r":return await this.signinRedirectCallback(e);case"si:p":await this.signinPopupCallback(e);break;case"si:s":await this.signinSilentCallback(e);break;default:throw Error("invalid request_type in state")}}async signoutCallback(e=window.location.href,t=!1){let{state:s}=await this._client.readSignoutResponseState(e);if(s)switch(s.request_type){case"so:r":return await this.signoutRedirectCallback(e);case"so:p":await this.signoutPopupCallback(e,t);break;case"so:s":await this.signoutSilentCallback(e);break;default:throw Error("invalid request_type in state")}}async querySessionStatus(e={}){let t=this._logger.create("querySessionStatus"),{silentRequestTimeoutInSeconds:s,...i}=e,r=this.settings.silent_redirect_uri;r||t.throw(Error("No silent_redirect_uri configured"));let n=await this._loadUser(),a=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:s}),o=await this._signinStart({request_type:"si:s",redirect_uri:r,prompt:"none",id_token_hint:this.settings.includeIdTokenInSilentRenew?null==n?void 0:n.id_token:void 0,response_type:this.settings.query_status_response_type,scope:"openid",skipUserInfo:!0,...i},a);try{let e=await this._client.processSigninResponse(o.url,{});if(t.debug("got signin response"),e.session_state&&e.profile.sub)return t.info("success for subject",e.profile.sub),{session_state:e.session_state,sub:e.profile.sub};return t.info("success, user not authenticated"),null}catch(e){if(this.settings.monitorAnonymousSession&&e instanceof m)switch(e.error){case"login_required":case"consent_required":case"interaction_required":case"account_selection_required":return t.info("success for anonymous user"),{session_state:e.session_state}}throw e}}async _signin(e,t,s){let i=await this._signinStart(e,t);return await this._signinEnd(i.url,s)}async _signinStart(e,t){let s=this._logger.create("_signinStart");try{let i=await this._client.createSigninRequest(e);return s.debug("got signin request"),await t.navigate({url:i.url,state:i.state.id,response_mode:i.state.response_mode,scriptOrigin:this.settings.iframeScriptOrigin})}catch(e){throw s.debug("error after preparing navigator, closing navigator window"),t.close(),e}}async _signinEnd(e,t){let s=this._logger.create("_signinEnd"),i=await this._client.processSigninResponse(e,{});return s.debug("got signin response"),await this._buildUser(i,t)}async _buildUser(e,t){let s=this._logger.create("_buildUser"),i=new K(e);if(t){if(t!==i.profile.sub)throw s.debug("current user does not match user returned from signin. sub from signin:",i.profile.sub),new m({...e,error:"login_required"});s.debug("current user matches user returned from signin")}return await this.storeUser(i),s.debug("user stored"),await this._events.load(i),i}async signoutRedirect(e={}){let t=this._logger.create("signoutRedirect"),{redirectMethod:s,...i}=e,r=await this._redirectNavigator.prepare({redirectMethod:s});await this._signoutStart({request_type:"so:r",post_logout_redirect_uri:this.settings.post_logout_redirect_uri,...i},r),t.info("success")}async signoutRedirectCallback(e=window.location.href){let t=this._logger.create("signoutRedirectCallback"),s=await this._signoutEnd(e);return t.info("success"),s}async signoutPopup(e={}){let t=this._logger.create("signoutPopup"),{popupWindowFeatures:s,popupWindowTarget:i,popupSignal:r,...n}=e,a=this.settings.popup_post_logout_redirect_uri,o=await this._popupNavigator.prepare({popupWindowFeatures:s,popupWindowTarget:i,popupSignal:r});await this._signout({request_type:"so:p",post_logout_redirect_uri:a,state:null==a?void 0:{},...n},o),t.info("success")}async signoutPopupCallback(e=window.location.href,t=!1){let s=this._logger.create("signoutPopupCallback");await this._popupNavigator.callback(e,{keepOpen:t}),s.info("success")}async _signout(e,t){let s=await this._signoutStart(e,t);return await this._signoutEnd(s.url)}async _signoutStart(e={},t){var s;let i=this._logger.create("_signoutStart");try{let r=await this._loadUser();i.debug("loaded current user from storage"),this.settings.revokeTokensOnSignout&&await this._revokeInternal(r);let n=e.id_token_hint||r&&r.id_token;n&&(i.debug("setting id_token_hint in signout request"),e.id_token_hint=n),await this.removeUser(),i.debug("user removed, creating signout request");let a=await this._client.createSignoutRequest(e);return i.debug("got signout request"),await t.navigate({url:a.url,state:null==(s=a.state)?void 0:s.id,scriptOrigin:this.settings.iframeScriptOrigin})}catch(e){throw i.debug("error after preparing navigator, closing navigator window"),t.close(),e}}async _signoutEnd(e){let t=this._logger.create("_signoutEnd"),s=await this._client.processSignoutResponse(e);return t.debug("got signout response"),s}async signoutSilent(e={}){var t;let s=this._logger.create("signoutSilent"),{silentRequestTimeoutInSeconds:i,...r}=e,n=this.settings.includeIdTokenInSilentSignout?null==(t=await this._loadUser())?void 0:t.id_token:void 0,a=this.settings.popup_post_logout_redirect_uri,o=await this._iframeNavigator.prepare({silentRequestTimeoutInSeconds:i});await this._signout({request_type:"so:s",post_logout_redirect_uri:a,id_token_hint:n,...r},o),s.info("success")}async signoutSilentCallback(e=window.location.href){let t=this._logger.create("signoutSilentCallback");await this._iframeNavigator.callback(e),t.info("success")}async revokeTokens(e){let t=await this._loadUser();await this._revokeInternal(t,e)}async _revokeInternal(e,t=this.settings.revokeTokenTypes){let s=this._logger.create("_revokeInternal");if(!e)return;let i=t.filter(t=>"string"==typeof e[t]);if(!i.length)return void s.debug("no need to revoke due to no token(s)");for(let t of i)await this._client.revokeToken(e[t],t),s.info(`${t} revoked successfully`),"access_token"!==t&&(e[t]=null);await this.storeUser(e),s.debug("user stored"),await this._events.load(e)}startSilentRenew(){this._logger.create("startSilentRenew"),this._silentRenewService.start()}stopSilentRenew(){this._silentRenewService.stop()}get _userStoreKey(){return`user:${this.settings.authority}:${this.settings.client_id}`}async _loadUser(){let e=this._logger.create("_loadUser"),t=await this.settings.userStore.get(this._userStoreKey);return t?(e.debug("user storageString loaded"),K.fromStorageString(t)):(e.debug("no user storageString"),null)}async storeUser(e){let t=this._logger.create("storeUser");if(e){t.debug("storing user");let s=e.toStorageString();await this.settings.userStore.set(this._userStoreKey,s)}else this._logger.debug("removing user"),await this.settings.userStore.remove(this._userStoreKey),this.settings.dpop&&await this.settings.dpop.store.remove(this.settings.client_id)}async clearStaleState(){await this._client.clearStaleState()}async dpopProof(e,t,s,i){var r,n;let a=await (null==(n=null==(r=this.settings.dpop)?void 0:r.store)?void 0:n.get(this.settings.client_id));if(a)return await g.generateDPoPProof({url:e,accessToken:null==t?void 0:t.access_token,httpMethod:s,keyPair:a.keys,nonce:i})}async generateDPoPJkt(e){let t=await e.store.get(this.settings.client_id);return t||(t=new $(await g.generateDPoPKeys()),await e.store.set(this.settings.client_id,t)),await g.generateDPoPJkt(t.keys)}};e.s(["createUserManager",0,function(e){let t=window.location.origin;return new es({authority:e.issuer,client_id:e.clientId,redirect_uri:`${t}/auth/callback`,post_logout_redirect_uri:e.postLogoutRedirectUri??`${t}/login`,scope:e.scopes?.join(" ")??"openid email profile offline_access",response_type:"code",automaticSilentRenew:!0,userStore:new T({store:sessionStorage}),extraQueryParams:{audience:e.audience}})}],470858);let ei="stigmer:sso:login",er="stigmer:sso:session";function en(e){return null!==e&&"object"==typeof e&&"string"==typeof e.issuer&&e.issuer.length>0&&"string"==typeof e.clientId&&e.clientId.length>0&&"string"==typeof e.audience&&"string"==typeof e.org&&e.org.length>0}function ea(e){try{let t=sessionStorage.getItem(e);if(!t)return null;let s=JSON.parse(t);return en(s)?s:null}catch{return null}}e.s(["clearSsoLoginState",0,function(){sessionStorage.removeItem(ei)},"clearSsoSession",0,function(){sessionStorage.removeItem(er)},"getSsoLoginState",0,function(){return ea(ei)},"getSsoSession",0,function(){return ea(er)},"isValidSsoState",0,en,"saveSsoLoginState",0,function(e){sessionStorage.setItem(ei,JSON.stringify(e))},"saveSsoSession",0,function(e){sessionStorage.setItem(er,JSON.stringify(e))}],567989)}]);

package/console/_next/static/chunks/0dvs3_g88-y3w.js

@@ -0,0 +1 @@
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,531466,e=>{"use strict";var t=e.i(843476);e.s(["StigmerLogo",0,function(){return(0,t.jsx)("div",{className:"mx-auto flex size-14 items-center justify-center rounded-xl bg-primary",children:(0,t.jsxs)("svg",{width:"28",height:"28",viewBox:"0 0 34 34",fill:"currentColor",className:"text-primary-foreground","aria-hidden":"true",children:[(0,t.jsx)("path",{d:"M7.22379 10.1458C9.05407 9.86272 10.2601 10.7932 10.1332 12.7168C10.0607 13.816 9.37085 13.9538 8.991 14.6751C8.15807 16.257 8.23651 19.0558 9.83964 20.1704C11.0252 20.9947 12.3089 20.9226 13.6764 20.8136C15.351 20.6822 15.7312 18.9283 17.4949 19.1781C18.5045 19.3212 19.3539 19.986 19.5308 21.0368C19.8731 23.115 17.5328 24.6973 15.796 23.4003C15.4981 23.1941 15.2124 22.7836 14.9017 22.6188C13.8888 22.0813 12.4364 22.1988 11.3325 22.2567C10.3331 22.2995 9.9481 22.827 9.24872 23.3777C7.78404 24.5308 5.5977 23.5036 5.5362 21.6393C5.49261 20.3166 5.97204 20.2337 6.65004 19.3786C7.14854 18.7498 7.22436 17.5822 7.1666 16.8242C7.15174 16.5125 7.16799 16.2157 7.1345 15.8989C6.95287 14.18 5.54082 14.0969 5.53861 12.3885C5.54697 12.0035 5.56265 11.8801 5.64874 11.5096C5.77807 11.1548 5.9613 10.9652 6.1995 10.6742C6.55201 10.3742 6.78576 10.2673 7.22379 10.1458Z"}),(0,t.jsx)("path",{d:"M15.9375 5.05709C16.4863 4.88101 17.0211 4.86877 17.5308 5.14264C17.9448 5.36503 18.4229 5.80132 18.5317 6.24791C18.8693 7.63344 18.0298 8.97957 16.4783 8.77693C16.0886 8.726 15.378 8.51377 15.0055 8.66575C14.8321 8.79577 14.5069 9.39896 14.3364 9.61119C14.003 10.0262 13.6777 10.3331 13.4151 10.7953C12.911 11.7801 12.9882 13.5299 13.2403 14.5874C13.5117 15.7261 14.8648 16.067 14.7677 17.4599C14.753 18.4001 14.0312 19.4698 13.1005 19.7406C11.8014 20.1187 10.437 19.382 10.0585 18.0656C9.74119 16.962 10.2395 16.3481 10.9358 15.6014C11.6326 14.8542 11.6829 13.8901 11.625 12.9246C11.6019 12.4623 11.6428 11.698 11.527 11.2677C11.1984 10.0464 9.8135 9.61166 9.96919 8.10529C10.1705 6.92461 11.0909 5.99196 12.3211 5.99226C12.4559 5.9923 12.5904 5.99301 12.7253 5.99481C13.4296 6.07526 13.5342 6.37133 14.0066 6.55894C14.231 6.41566 14.313 6.54908 14.3628 6.51437C14.5546 6.38061 14.5933 6.22329 14.8535 6.15937C15.0853 5.76885 15.2225 5.6133 15.5494 5.29676L15.9375 5.05709Z"}),(0,t.jsx)("path",{d:"M26.0385 10.077C27.2284 10.0687 28.2828 10.7748 28.4955 12.0193C28.7075 13.2596 28.0148 13.7278 27.3582 14.5966C26.6054 15.5925 26.6842 17.9707 27.197 19.0797C27.5852 19.846 28.3581 20.3182 28.4914 21.2145C28.6816 22.4934 27.7395 23.7173 26.4719 23.9195C25.1999 24.1224 24.0097 23.1019 23.8163 21.8685C23.6467 20.7868 24.2415 20.2214 24.8926 19.481C25.6418 18.5769 25.5329 16.5867 25.3735 15.4935C25.1206 14.5153 24.2806 13.5335 23.2874 13.2836C22.3671 13.0521 20.1592 12.9783 19.2892 13.4472C18.5563 13.8421 17.9765 14.7779 16.9495 14.8475C16.4639 14.9012 15.748 14.583 15.3706 14.2874C14.9233 13.9438 14.6306 13.4366 14.5568 12.8773C14.4823 12.2675 14.5398 11.5165 14.9442 11.0497C16.1084 9.70584 17.5753 9.90845 18.7589 11.0712C19.7302 12.0255 22.5325 12.0177 23.6494 11.4266C24.6503 10.8969 24.5342 10.2494 26.0385 10.077Z"}),(0,t.jsx)("path",{d:"M21.4613 14.1264C21.7085 14.1091 22.1094 14.2505 22.3436 14.3287C23.3527 14.6651 23.9782 15.4779 23.9631 16.5522C23.9447 17.8506 22.83 18.2703 22.4409 19.388C22.1931 20.0995 22.2474 20.7953 22.2654 21.5345C22.2815 22.2131 22.3898 22.9193 22.7868 23.4961C23.0911 23.9404 23.5497 24.2076 23.7702 24.7176C24.6099 26.658 22.6283 28.7293 20.6657 27.781C20.4308 27.6674 19.6747 27.2047 19.5265 27.3624C18.9443 27.982 18.9227 28.5279 18.0373 28.9311C17.5994 29.1049 17.1136 29.116 16.6682 28.9623C16.1287 28.7737 15.7497 28.3615 15.513 27.8535C15.3039 27.4051 15.2846 26.8912 15.4594 26.4284C15.642 25.9407 16.0436 25.5058 16.5179 25.2929C17.2492 24.9648 17.9962 25.2105 18.6926 25.4769C19.2726 25.1432 19.3258 24.7958 19.6894 24.2827C19.9037 23.9801 20.3712 23.6667 20.5162 23.3254C21.1284 21.884 21.1859 20.1407 20.4614 18.729C20.1032 18.2156 19.5862 17.8974 19.411 17.2616C19.2477 16.669 19.2064 16.0187 19.515 15.4598C19.9589 14.6558 20.6234 14.3736 21.4613 14.1264Z"}),(0,t.jsx)("path",{d:"M21.3264 7.13262C22.3915 6.99169 23.3682 7.74343 23.5045 8.80913C23.6409 9.87482 22.885 10.8483 21.8187 10.9801C20.7588 11.1111 19.7926 10.3607 19.657 9.30148C19.5215 8.24225 20.2677 7.27274 21.3264 7.13262Z"}),(0,t.jsx)("path",{d:"M12.1482 22.9577C13.2006 22.807 14.1781 23.5319 14.3396 24.5828C14.501 25.6336 13.7861 26.6184 12.737 26.7905C12.0487 26.9035 11.3528 26.6381 10.9146 26.0955C10.4764 25.5529 10.3633 24.8168 10.6185 24.1677C10.8737 23.5186 11.4578 23.0565 12.1482 22.9577Z"}),(0,t.jsx)("path",{d:"M4.88784 15.6498C5.61993 15.5335 6.3073 16.0339 6.42154 16.7663C6.53575 17.4987 6.0334 18.1847 5.30067 18.2968C4.65759 18.3952 4.03672 18.0173 3.82881 17.4008C3.7368 17.1281 3.7351 16.8329 3.82401 16.5591C3.97953 16.0801 4.39049 15.7288 4.88784 15.6498Z"}),(0,t.jsx)("path",{d:"M28.6677 15.6546C29.3955 15.5226 30.0918 16.0073 30.2208 16.7356C30.3498 17.4639 29.8622 18.1582 29.1334 18.2842C28.4088 18.4095 27.7193 17.9253 27.5911 17.2013C27.4629 16.4772 27.9442 15.7858 28.6677 15.6546Z"})]})})}])},968563,e=>{"use strict";var t=e.i(843476),s=e.i(271645),r=e.i(618566),n=e.i(363178),i=e.i(272012),o=e.i(940530),a=e.i(163308),l=e.i(893976),c=e.i(610595),d=e.i(575407),g=e.i(379410);function u({initialOrg:e,onSsoLogin:r,className:n}){var i,o,a,c;let[g,h]=(0,s.useState)(e??""),[j,b]=(0,s.useState)(e??null),{ssoProvider:v,isLoading:y,error:N}=(0,d.useSsoProvider)(j),k=(0,s.useRef)(null),S=(i=j,o=y,a=v,c=N,i?o?"loading":c?"error":a?"found":"not-found":"input");(0,s.useEffect)(()=>{"input"===S&&k.current?.focus()},[S]);let w=(0,s.useCallback)(e=>{e.preventDefault();let t=g.trim().toLowerCase();t&&b(t)},[g]),M=(0,s.useCallback)(()=>{b(null),h("")},[]),L=(0,s.useCallback)(()=>{j&&(b(null),queueMicrotask(()=>b(j)))},[j]),A=(0,s.useCallback)(()=>{v&&j&&r(v,j)},[v,j,r]),R=(0,s.useCallback)(e=>{("Enter"===e.key||" "===e.key)&&(e.preventDefault(),A())},[A]);return(0,t.jsxs)("div",{className:(0,l.cn)("stg:w-full",n),role:"region","aria-label":"SSO sign-in",children:["input"===S&&(0,t.jsx)(m,{ref:k,value:g,onChange:h,onSubmit:w}),"loading"===S&&(0,t.jsx)(x,{org:j}),"found"===S&&v&&(0,t.jsx)(C,{provider:v,org:j,onClick:A,onKeyDown:R,onChangeOrg:M}),"not-found"===S&&(0,t.jsx)(p,{org:j,onBack:M}),"error"===S&&N&&(0,t.jsx)(f,{error:N,onRetry:L,onBack:M})]})}let m=(0,s.forwardRef)(function({value:e,onChange:r,onSubmit:n},i){let o=(0,s.useId)();return(0,t.jsxs)("form",{onSubmit:n,className:"stg:space-y-3",children:[(0,t.jsx)("label",{htmlFor:o,className:"stg:block stg:text-sm stg:font-medium stg:text-foreground",children:"Organization"}),(0,t.jsx)("input",{ref:i,id:o,type:"text",value:e,onChange:e=>r(e.target.value),placeholder:"Enter your organization slug",autoComplete:"organization",spellCheck:!1,className:(0,l.cn)("stg:block stg:w-full stg:rounded-md stg:border stg:border-input stg:bg-background stg:px-3 stg:py-2","stg:text-sm stg:text-foreground stg:placeholder:text-muted-foreground","stg:focus:outline-none stg:focus:ring-2 stg:focus:ring-ring","stg:transition-colors")}),(0,t.jsx)("button",{type:"submit",disabled:!e.trim(),className:(0,l.cn)("stg:w-full stg:rounded-md stg:px-4 stg:py-2 stg:text-sm stg:font-medium","stg:bg-primary stg:text-primary-foreground","stg:hover:bg-primary-hover","stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring","stg:disabled:pointer-events-none stg:disabled:opacity-50","stg:transition-colors"),children:"Continue"})]})});function x({org:e}){return(0,t.jsxs)("div",{className:"stg:flex stg:flex-col stg:items-center stg:gap-3 stg:py-4","aria-busy":"true","aria-label":`Looking up SSO provider for ${e}`,children:[(0,t.jsx)(g.SpinnerIcon,{size:20,className:"stg:text-muted-foreground"}),(0,t.jsxs)("p",{className:"stg:text-sm stg:text-muted-foreground",children:["Looking up ",(0,t.jsx)("span",{className:"stg:font-medium stg:text-foreground",children:e}),"…"]})]})}function C({provider:e,org:s,onClick:r,onKeyDown:n,onChangeOrg:i}){return(0,t.jsxs)("div",{className:"stg:space-y-4",children:[(0,t.jsx)("div",{className:"stg:text-center",children:(0,t.jsxs)("p",{className:"stg:text-xs stg:text-muted-foreground",children:["Signing in to"," ",(0,t.jsx)("span",{className:"stg:font-medium stg:text-foreground",children:s})]})}),(0,t.jsxs)("button",{type:"button",onClick:r,onKeyDown:n,className:(0,l.cn)("stg:flex stg:w-full stg:items-center stg:justify-center stg:gap-2 stg:rounded-md stg:px-4 stg:py-2.5","stg:text-sm stg:font-medium","stg:bg-primary stg:text-primary-foreground","stg:hover:bg-primary-hover","stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring","stg:transition-colors"),children:[(0,t.jsx)(h,{}),"Sign in with ",e.displayName]}),(0,t.jsx)("button",{type:"button",onClick:i,className:"stg:block stg:w-full stg:text-center stg:text-xs stg:text-muted-foreground stg:hover:text-foreground stg:transition-colors",children:"Not your organization? Change"})]})}function p({org:e,onBack:s}){return(0,t.jsxs)("div",{className:"stg:space-y-3 stg:text-center",children:[(0,t.jsxs)("p",{className:"stg:text-sm stg:text-muted-foreground",children:["No SSO provider configured for"," ",(0,t.jsx)("span",{className:"stg:font-medium stg:text-foreground",children:e}),"."]}),(0,t.jsx)("button",{type:"button",onClick:s,className:"stg:text-xs stg:text-primary stg:hover:text-primary-hover stg:transition-colors",children:"Try a different organization"})]})}function f({error:e,onRetry:s,onBack:r}){return(0,t.jsxs)("div",{className:"stg:space-y-3 stg:text-center",role:"alert",children:[(0,t.jsx)("p",{className:"stg:text-sm stg:text-destructive",children:(0,c.getUserMessage)(e)}),(0,t.jsxs)("div",{className:"stg:flex stg:items-center stg:justify-center stg:gap-3",children:[(0,t.jsx)("button",{type:"button",onClick:s,className:(0,l.cn)("stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium","stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover","stg:transition-colors"),children:"Retry"}),(0,t.jsx)("button",{type:"button",onClick:r,className:"stg:text-xs stg:text-muted-foreground stg:hover:text-foreground stg:transition-colors",children:"Back"})]})]})}function h(){return(0,t.jsxs)("svg",{width:"16",height:"16",viewBox:"0 0 16 16",fill:"none",stroke:"currentColor",strokeWidth:"1.5",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:[(0,t.jsx)("path",{d:"M8 1.5L2 4v4c0 3.5 2.5 5.5 6 7 3.5-1.5 6-3.5 6-7V4L8 1.5z"}),(0,t.jsx)("path",{d:"M6 8l1.5 1.5L10 6.5"})]})}var j=e.i(170255),b=e.i(472402),v=e.i(35127),y=e.i(470858),N=e.i(567989),k=e.i(531466),S=e.i(230374);let w="stigmer:auth:redirect_path";function M(){let e=(0,r.useSearchParams)().get("org")??void 0,{resolvedTheme:l}=(0,n.useTheme)(),c="dark"===l?"dark":"light",d=(0,s.useMemo)(()=>new i.Stigmer({baseUrl:(0,b.getApiBaseUrl)(),getAccessToken:()=>null}),[]),g=(0,S.useDeploymentMode)(d),m=g.resolved&&(0,o.isResourceAvailable)(j.ApiResourceKind.identity_provider,g.mode),x=(0,s.useCallback)((e,t)=>{(0,N.saveSsoLoginState)({issuer:e.issuer,clientId:e.oidcClientId,audience:e.expectedAudience,org:t}),sessionStorage.setItem(w,"/");let s={};e.expectedAudience&&(s.audience=e.expectedAudience),(0,y.createUserManager)({issuer:e.issuer,clientId:e.oidcClientId,audience:e.expectedAudience}).signinRedirect({extraQueryParams:s})},[]),C=(0,s.useCallback)(()=>{let e=(0,v.resolveAuthConfig)();"oidc"!==e.mode||(sessionStorage.setItem(w,"/"),(0,y.createUserManager)(e.oidc).signinRedirect())},[]);return g.resolved?(0,t.jsx)(a.StigmerProvider,{client:d,colorMode:c,preset:"monochrome",children:(0,t.jsx)("div",{className:"flex min-h-screen flex-col items-center justify-center p-4",children:(0,t.jsxs)("div",{className:"w-full max-w-sm space-y-8",children:[(0,t.jsxs)("div",{className:"text-center",children:[(0,t.jsx)(k.StigmerLogo,{}),(0,t.jsx)("h1",{className:"text-foreground mt-4 text-lg font-semibold",children:"Sign in to Stigmer"}),(0,t.jsx)("p",{className:"text-muted-foreground mt-1 text-sm",children:m?"Enter your organization to continue with SSO":"Continue with your identity provider"})]}),m&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(u,{initialOrg:e,onSsoLogin:x}),(0,t.jsxs)("div",{className:"relative",children:[(0,t.jsx)("div",{className:"absolute inset-0 flex items-center",children:(0,t.jsx)("div",{className:"border-border w-full border-t"})}),(0,t.jsx)("div",{className:"relative flex justify-center text-xs",children:(0,t.jsx)("span",{className:"bg-background text-muted-foreground px-2",children:"or"})})]})]}),(0,t.jsx)("button",{type:"button",onClick:C,className:"border-input bg-background text-foreground hover:bg-accent focus-visible:ring-ring block w-full rounded-md border px-4 py-2.5 text-center text-sm font-medium transition-colors focus-visible:ring-2 focus-visible:outline-none",children:m?"Sign in with email":"Sign in"})]})})}):(0,t.jsx)(a.StigmerProvider,{client:d,colorMode:c,preset:"monochrome",children:(0,t.jsx)(L,{})})}function L(){return(0,t.jsx)("div",{className:"flex min-h-screen flex-col items-center justify-center p-4",children:(0,t.jsxs)("div",{className:"w-full max-w-sm space-y-8",children:[(0,t.jsxs)("div",{className:"flex flex-col items-center gap-4",children:[(0,t.jsx)("div",{className:"bg-muted h-10 w-10 animate-pulse rounded-lg"}),(0,t.jsx)("div",{className:"bg-muted h-5 w-40 animate-pulse rounded"}),(0,t.jsx)("div",{className:"bg-muted h-4 w-56 animate-pulse rounded"})]}),(0,t.jsxs)("div",{className:"space-y-3",children:[(0,t.jsx)("div",{className:"bg-muted h-4 w-24 animate-pulse rounded"}),(0,t.jsx)("div",{className:"bg-muted h-10 animate-pulse rounded-md"}),(0,t.jsx)("div",{className:"bg-muted h-10 animate-pulse rounded-md"})]})]})})}e.s(["default",0,function(){return(0,t.jsx)(s.Suspense,{fallback:(0,t.jsx)(L,{}),children:(0,t.jsx)(M,{})})}],968563)}]);